diff --git a/.github/workflows/native-beta-android.yml b/.github/workflows/native-beta-android.yml
new file mode 100644
index 00000000..5c753ade
--- /dev/null
+++ b/.github/workflows/native-beta-android.yml
@@ -0,0 +1,89 @@
+name: Native 3.0 Android Beta
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: native-3-android-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-android:
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.fork == false
+    runs-on: ubuntu-latest-8-cores
+    env:
+      MAPLE_API_ENV: dev
+      MAPLE_CI_BUILD_ROOT: ${{ github.workspace }}/native/target/maple-ci
+      CARGO_TERM_COLOR: always
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+
+      - name: Setup Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-linux-android,armv7-linux-androideabi,x86_64-linux-android
+
+      - name: Cache Rust artifacts
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: |
+            native -> target
+            native/rmp-cli -> target
+
+      - name: Setup Android NDK
+        uses: nttld/setup-ndk@v1.5.0
+        id: setup-ndk
+        with:
+          ndk-version: r28c
+          add-to-path: true
+          local-cache: true
+
+      - name: Install native Android build tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libssl-dev pkg-config
+          cargo install cargo-ndk --locked
+
+      - name: Configure Android signing
+        env:
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+        run: |
+          echo "$ANDROID_KEYSTORE_BASE64" | base64 --decode > "$RUNNER_TEMP/maple-upload.jks"
+          cat > native/android/keystore.properties <<EOF
+          keyAlias=$ANDROID_KEY_ALIAS
+          password=$ANDROID_KEY_PASSWORD
+          storeFile=$RUNNER_TEMP/maple-upload.jks
+          EOF
+
+      - name: Build signed native Android beta
+        env:
+          ANDROID_HOME: ${{ env.ANDROID_SDK_ROOT }}
+          ANDROID_SDK_ROOT: ${{ env.ANDROID_SDK_ROOT }}
+          ANDROID_NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
+          NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
+        run: bash native/scripts/ci/build-android-release.sh
+
+      - name: Upload Android artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: native-android-beta
+          path: |
+            native/target/maple-ci/android/*.apk
+            native/target/maple-ci/android/*.aab
+          retention-days: 7
diff --git a/.github/workflows/native-beta-ios.yml b/.github/workflows/native-beta-ios.yml
new file mode 100644
index 00000000..7efd1eb8
--- /dev/null
+++ b/.github/workflows/native-beta-ios.yml
@@ -0,0 +1,70 @@
+name: Native 3.0 iOS Beta
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: native-3-ios-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-testflight:
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.fork == false
+    runs-on: macos-26-xlarge
+    env:
+      MAPLE_API_ENV: dev
+      MAPLE_CI_BUILD_ROOT: ${{ github.workspace }}/native/target/maple-ci
+      CARGO_TERM_COLOR: always
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Xcode
+        uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: "26.2"
+
+      - name: Install xcodegen
+        run: brew install xcodegen
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-apple-ios,aarch64-apple-ios-sim
+
+      - name: Cache Rust artifacts
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: |
+            native -> target
+            native/rmp-cli -> target
+
+      - name: Set up App Store Connect API key
+        env:
+          APPLE_API_PRIVATE_KEY: ${{ secrets.APPLE_API_PRIVATE_KEY }}
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+        run: |
+          mkdir -p "$RUNNER_TEMP/app-store-connect"
+          echo "$APPLE_API_PRIVATE_KEY" | base64 --decode > "$RUNNER_TEMP/app-store-connect/AuthKey_${APPLE_API_KEY}.p8"
+          chmod 600 "$RUNNER_TEMP/app-store-connect/AuthKey_${APPLE_API_KEY}.p8"
+          echo "APPLE_API_KEY_PATH=$RUNNER_TEMP/app-store-connect/AuthKey_${APPLE_API_KEY}.p8" >> "$GITHUB_ENV"
+
+      - name: Build and upload native iOS beta
+        env:
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+          APPLE_API_KEY_PATH: ${{ env.APPLE_API_KEY_PATH }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: bash native/scripts/ci/build-ios-testflight.sh
+
+      - name: Upload iOS artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: native-ios-beta
+          path: |
+            native/target/maple-ci/ios/export/*.ipa
+          retention-days: 7
diff --git a/.github/workflows/native-beta-linux.yml b/.github/workflows/native-beta-linux.yml
new file mode 100644
index 00000000..51a573f5
--- /dev/null
+++ b/.github/workflows/native-beta-linux.yml
@@ -0,0 +1,57 @@
+name: Native 3.0 Linux Beta
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: native-3-linux-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-linux:
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.fork == false
+    runs-on: ubuntu-latest-8-cores
+    env:
+      MAPLE_API_ENV: dev
+      MAPLE_CI_BUILD_ROOT: ${{ github.workspace }}/native/target/maple-ci
+      CARGO_TERM_COLOR: always
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Rust artifacts
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: |
+            native -> target
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31
+
+      - name: Install Linux desktop build tools
+        env:
+          CARGO_CFG_TARGET_OS: linux
+        run: cargo install tauri-cli --version 2.9.2 --locked
+
+      - name: Build Linux beta artifacts
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: bash native/scripts/ci/package-linux.sh
+
+      - name: Upload Linux artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: native-desktop-linux-beta
+          path: |
+            native/target/maple-ci/desktop-linux/*.AppImage
+            native/target/maple-ci/desktop-linux/*.deb
+            native/target/maple-ci/desktop-linux/*.sig
+          retention-days: 7
diff --git a/.github/workflows/native-beta-macos.yml b/.github/workflows/native-beta-macos.yml
new file mode 100644
index 00000000..654c85dd
--- /dev/null
+++ b/.github/workflows/native-beta-macos.yml
@@ -0,0 +1,95 @@
+name: Native 3.0 macOS Beta
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: native-3-macos-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-macos:
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.fork == false
+    runs-on: macos-26-xlarge
+    env:
+      MAPLE_API_ENV: dev
+      MAPLE_CI_BUILD_ROOT: ${{ github.workspace }}/native/target/maple-ci
+      CARGO_TERM_COLOR: always
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Xcode
+        uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: "26.2"
+
+      - name: Install xcodegen
+        run: brew install xcodegen
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-apple-darwin,x86_64-apple-darwin,aarch64-apple-ios,aarch64-apple-ios-sim
+
+      - name: Cache Rust artifacts
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: |
+            native -> target
+            native/rmp-cli -> target
+
+      - name: Install desktop packaging tools
+        env:
+          CARGO_CFG_TARGET_OS: macos
+        run: cargo install tauri-cli --version 2.9.2 --locked
+
+      - name: Import Apple Developer certificate
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        run: |
+          echo "$APPLE_CERTIFICATE" | base64 --decode > "$RUNNER_TEMP/maple-desktop-cert.p12"
+          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
+          security default-keychain -s build.keychain
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
+          security set-keychain-settings -t 3600 -u build.keychain
+          security import "$RUNNER_TEMP/maple-desktop-cert.p12" -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
+          CERT_ID=$(security find-identity -v -p codesigning build.keychain | awk -F '"' '/Developer ID Application/ { print $2; exit }')
+          echo "APPLE_SIGNING_IDENTITY=$CERT_ID" >> "$GITHUB_ENV"
+
+      - name: Set up App Store Connect API key
+        env:
+          APPLE_API_PRIVATE_KEY: ${{ secrets.APPLE_API_PRIVATE_KEY }}
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+        run: |
+          mkdir -p "$RUNNER_TEMP/app-store-connect"
+          echo "$APPLE_API_PRIVATE_KEY" | base64 --decode > "$RUNNER_TEMP/app-store-connect/AuthKey_${APPLE_API_KEY}.p8"
+          chmod 600 "$RUNNER_TEMP/app-store-connect/AuthKey_${APPLE_API_KEY}.p8"
+          echo "APPLE_API_KEY_PATH=$RUNNER_TEMP/app-store-connect/AuthKey_${APPLE_API_KEY}.p8" >> "$GITHUB_ENV"
+
+      - name: Build notarized macOS beta artifacts
+        env:
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+          APPLE_API_KEY_PATH: ${{ env.APPLE_API_KEY_PATH }}
+          APPLE_SIGNING_IDENTITY: ${{ env.APPLE_SIGNING_IDENTITY }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: bash native/scripts/ci/package-macos.sh
+
+      - name: Upload macOS artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: native-desktop-macos-beta
+          path: |
+            native/target/maple-ci/desktop-macos/*.dmg
+            native/target/maple-ci/desktop-macos/*.zip
+            native/target/maple-ci/desktop-macos/*.sig
+          retention-days: 7
diff --git a/.gitignore b/.gitignore
index 04321fd8..fd7f6c4d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -84,3 +84,14 @@ frontend/*.local
 
 # iOS build backups
 frontend/src-tauri/gen/apple/maple.xcodeproj/project.pbxproj.backup
+
+# Native (3.0) build artifacts
+native/target/
+native/rmp-cli/target/
+native/android/app/build/
+native/android/.gradle/
+native/ios/App.xcodeproj/
+native/ios/Frameworks/
+native/ios/Bindings/
+
+.factory/
diff --git a/justfile b/justfile
index de9e4810..fe3cd709 100644
--- a/justfile
+++ b/justfile
@@ -207,3 +207,90 @@ release version:
     git commit -m "chore: bump version to {{version}}"
     git tag -a "v{{version}}" -m "Release v{{version}}"
     echo "Release v{{version}} created! Don't forget to push tags: git push && git push --tags"
+
+# ┌─────────────────────────────────────────────────────────────────────┐
+# │  Maple 3.0 (native/) - Native Rust/SwiftUI/Compose/GTK4            │
+# └─────────────────────────────────────────────────────────────────────┘
+
+native_nix := "cd native && nix develop --command bash -c"
+
+# Run native rmp doctor
+native-doctor:
+    {{native_nix}} "rmp doctor"
+
+# Regenerate native FFI bindings (Swift + Kotlin) (api_env: local|dev|prod)
+native-bindings api_env="local":
+    {{native_nix}} "unset CC CXX AR RANLIB && rmp bindings all"
+
+# Regenerate native Swift FFI bindings (api_env: local|dev|prod)
+native-bindings-swift api_env="local":
+    {{native_nix}} "unset CC CXX AR RANLIB && rmp bindings swift"
+
+# Regenerate native Kotlin FFI bindings (api_env: local|dev|prod)
+native-bindings-kotlin api_env="local":
+    {{native_nix}} "unset CC CXX AR RANLIB && rmp bindings kotlin"
+
+# Build native desktop for the current host platform (api_env: local|dev|prod)
+native-build-desktop api_env="local":
+    just -f {{justfile_directory()}}/native/justfile build-desktop "{{api_env}}"
+
+# Run native desktop for the current host platform (api_env: local|dev|prod)
+native-run-desktop api_env="local":
+    just -f {{justfile_directory()}}/native/justfile run-desktop "{{api_env}}"
+
+# Run native iOS on simulator (api_env: local|dev|prod)
+native-run-ios api_env="local":
+    cd native && api_env="{{api_env}}"; while [[ "$api_env" == api_env=* ]]; do api_env="${api_env#api_env=}"; done; api_url="http://0.0.0.0:3000"; if [ "$api_env" = "dev" ]; then api_url="https://enclave.secretgpt.ai"; elif [ "$api_env" = "prod" ]; then api_url="https://enclave.trymaple.ai"; fi; OPEN_SECRET_API_URL="$api_url" nix develop --command bash -c "unset CC CXX AR RANLIB && rmp run ios"
+
+# Run native Android on emulator (api_env: local|dev|prod)
+native-run-android serial="emulator-5554" api_env="local":
+    cd native && api_env="{{api_env}}"; while [[ "$api_env" == api_env=* ]]; do api_env="${api_env#api_env=}"; done; api_url="http://0.0.0.0:3000"; if [ "$api_env" = "dev" ]; then api_url="https://enclave.secretgpt.ai"; elif [ "$api_env" = "prod" ]; then api_url="https://enclave.trymaple.ai"; fi; OPEN_SECRET_API_URL="$api_url" nix develop --command bash -c "unset CC CXX AR RANLIB && export PATH=\$HOME/.cargo/bin:\$PATH && rmp run android --serial {{serial}}"
+
+# Build native Android APK
+native-build-android api_env="local":
+    cd native/android && api_env="{{api_env}}"; while [[ "$api_env" == api_env=* ]]; do api_env="${api_env#api_env=}"; done; api_url="http://0.0.0.0:3000"; if [ "$api_env" = "dev" ]; then api_url="https://enclave.secretgpt.ai"; elif [ "$api_env" = "prod" ]; then api_url="https://enclave.trymaple.ai"; fi; OPEN_SECRET_API_URL="$api_url" ./gradlew assembleDebug
+
+# Build all native platforms
+native-build-all api_env="local":
+    just native-build-desktop "{{api_env}}"
+    just native-build-android "{{api_env}}"
+    @echo "Native desktop and Android built. iOS is build+run only via rmp."
+
+# Run all native platforms
+native-run-all serial="emulator-5554" api_env="local":
+    just native-bindings "{{api_env}}"
+    just native-run-ios "{{api_env}}"
+    just native-run-android serial={{serial}} "{{api_env}}"
+    just native-run-desktop "{{api_env}}"
+
+# ┌─────────────────────────────────────────────────────────────────────┐
+# │  OrbStack → macOS wrappers (run from Linux container)               │
+# │  Usage: just mac-native-run-ios                                     │
+# └─────────────────────────────────────────────────────────────────────┘
+
+mac-native-run-ios api_env="local":
+    mac just -f {{justfile_directory()}}/native/justfile run-ios "{{api_env}}"
+
+mac-native-run-android serial="emulator-5554" api_env="local":
+    mac just -f {{justfile_directory()}}/native/justfile run-android serial={{serial}} "{{api_env}}"
+
+mac-native-run-desktop api_env="local":
+    mac just -f {{justfile_directory()}}/native/justfile run-desktop "{{api_env}}"
+
+mac-native-build-desktop api_env="local":
+    mac just -f {{justfile_directory()}}/native/justfile build-desktop "{{api_env}}"
+
+mac-native-build-android api_env="local":
+    mac just -f {{justfile_directory()}}/native/justfile build-android "{{api_env}}"
+
+mac-native-bindings api_env="local":
+    mac just -f {{justfile_directory()}}/native/justfile bindings "{{api_env}}"
+
+mac-native-bindings-swift api_env="local":
+    mac just -f {{justfile_directory()}}/native/justfile bindings-swift "{{api_env}}"
+
+mac-native-bindings-kotlin api_env="local":
+    mac just -f {{justfile_directory()}}/native/justfile bindings-kotlin "{{api_env}}"
+
+mac-native-doctor:
+    mac just -f {{justfile_directory()}}/native/justfile doctor
diff --git a/native/.env.example b/native/.env.example
new file mode 100644
index 00000000..d949397c
--- /dev/null
+++ b/native/.env.example
@@ -0,0 +1,3 @@
+MAPLE_BILLING_API_URL=http://0.0.0.0:3001
+OPEN_SECRET_API_URL=http://0.0.0.0:3000
+CLIENT_ID=ba5a14b5-d915-47b1-b7b1-afda52bc5fc6
diff --git a/native/.gitignore b/native/.gitignore
new file mode 100644
index 00000000..a5d5903c
--- /dev/null
+++ b/native/.gitignore
@@ -0,0 +1,18 @@
+/target
+.env
+.direnv/
+.DS_Store
+*.swp
+*.swo
+flake.lock
+staging/
+ios/Bindings/
+ios/Frameworks/
+ios/.build/
+ios/*.xcodeproj
+android/app/src/main/jniLibs/
+android/.gradle/
+android/build/
+android/app/build/
+android/local.properties
+emulator.log
diff --git a/native/Cargo.lock b/native/Cargo.lock
new file mode 100644
index 00000000..7aa9f0f8
--- /dev/null
+++ b/native/Cargo.lock
@@ -0,0 +1,3583 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common",
+ "generic-array",
+]
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
+
+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
+[[package]]
+name = "askama"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f75363874b771be265f4ffe307ca705ef6f3baa19011c149da8674a87f1b75c4"
+dependencies = [
+ "askama_derive",
+ "itoa",
+ "percent-encoding",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "askama_derive"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "129397200fe83088e8a68407a8e2b1f826cf0086b21ccdb866a722c8bcd3a94f"
+dependencies = [
+ "askama_parser",
+ "basic-toml",
+ "memchr",
+ "proc-macro2",
+ "quote",
+ "rustc-hash",
+ "serde",
+ "serde_derive",
+ "syn",
+]
+
+[[package]]
+name = "askama_parser"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6ab5630b3d5eaf232620167977f95eb51f3432fc76852328774afbd242d4358"
+dependencies = [
+ "memchr",
+ "serde",
+ "serde_derive",
+ "winnow",
+]
+
+[[package]]
+name = "asn1-rs"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5493c3bedbacf7fd7382c6346bbd66687d12bbaad3a89a2d2c303ee6cf20b048"
+dependencies = [
+ "asn1-rs-derive",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+ "time",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "965c2d33e53cb6b267e148a4cb0760bc01f4904c1cd4bb4002a085bb016d1490"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "async-trait"
+version = "0.1.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "basic-toml"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba62675e8242a4c4e806d12f11d136e626e6c8361d6b829310732241652a178a"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "bitflags"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+
+[[package]]
+name = "cairo-rs"
+version = "0.20.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e3bd0f4e25afa9cabc157908d14eeef9067d6448c49414d17b3fb55f0eadd0"
+dependencies = [
+ "bitflags",
+ "cairo-sys-rs",
+ "glib",
+ "libc",
+]
+
+[[package]]
+name = "cairo-sys-rs"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "059cc746549898cbfd9a47754288e5a958756650ef4652bbb6c5f71a6bda4f8b"
+dependencies = [
+ "glib-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "camino"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e629a66d692cb9ff1a1c664e41771b3dcaf961985a9774c0eb0bd1b51cf60a48"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "cargo-platform"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e35af189006b9c0f00a064685c727031e3ed2d8020f7ba284d78cc2671bd36ea"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "cargo_metadata"
+version = "0.19.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd5eb614ed4c27c5d706420e4320fbe3216ab31fa1c33cd8246ac36dae4479ba"
+dependencies = [
+ "camino",
+ "cargo-platform",
+ "semver",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "cc"
+version = "1.2.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aebf35691d1bfb0ac386a69bac2fde4dd276fb618cf8bf4f5318fe285e821bb2"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-expr"
+version = "0.20.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c6b04e07d8080154ed4ac03546d9a2b303cc2fe1901ba0b35b301516e289368"
+dependencies = [
+ "smallvec",
+ "target-lexicon",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
+[[package]]
+name = "chacha20"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+]
+
+[[package]]
+name = "chacha20poly1305"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
+dependencies = [
+ "aead",
+ "chacha20",
+ "cipher",
+ "poly1305",
+ "zeroize",
+]
+
+[[package]]
+name = "chrono"
+version = "0.4.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "serde",
+ "wasm-bindgen",
+ "windows-link",
+]
+
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+ "zeroize",
+]
+
+[[package]]
+name = "clap"
+version = "4.5.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2797f34da339ce31042b27d23607e051786132987f595b02ba4f6a6dffb7030a"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.5.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24a241312cea5059b13574bb9b3861cabf758b879c15190b37b6d6fd63ab6876"
+dependencies = [
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.5.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a92793da1a46a5f2a02a6f4c46c6496b28c43638adea8306fcb0caa1634f24e5"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a822ea5bc7590f9d40f1ba12c0dc3c2760f3482c6984db1573ad11031420831"
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "typenum",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "fiat-crypto",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7a1e2f27636f116493b8b860f5546edb47c8d8f8ea73e1d2a20be88e28d1fea"
+
+[[package]]
+name = "der-parser"
+version = "9.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cd0a5c643689626bec213c4d8bd4d96acc8ffdb4ad4bb6bc16abf27d5f4b553"
+dependencies = [
+ "asn1-rs",
+ "displaydoc",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "powerfmt",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "dirs-next"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b98cf8ebf19c3d1b223e151f99a4f9f0690dca41414773390fc824184ac833e1"
+dependencies = [
+ "cfg-if",
+ "dirs-sys-next",
+]
+
+[[package]]
+name = "dirs-sys-next"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ebda144c4fe02d1f7ea1a7d9641b6fc6b580adcfa024ae48797ecdeb6825b4d"
+dependencies = [
+ "libc",
+ "redox_users",
+ "winapi",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dotenvy"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "eventsource-stream"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74fef4569247a5f429d9156b9d0a2599914385dd189c539334c625d8099d90ab"
+dependencies = [
+ "futures-core",
+ "nom",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
+[[package]]
+name = "field-offset"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38e2275cc4e4fc009b0669731a1e5ab7ebf11f469eaede2bab9309a5b4d6057f"
+dependencies = [
+ "memoffset",
+ "rustc_version",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "flume"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da0e4dd2a88388a1f4ccc7c9ce104604dab68d9f408dc34cd45823d5a9069095"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "nanorand",
+ "spin",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fs-err"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88a41f105fe1d5b6b34b2055e3dc59bb79b46b48b2040b9e6c7b4b5de097aa41"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "futures"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "gdk-pixbuf"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fd242894c084f4beed508a56952750bce3e96e85eb68fdc153637daa163e10c"
+dependencies = [
+ "gdk-pixbuf-sys",
+ "gio",
+ "glib",
+ "libc",
+]
+
+[[package]]
+name = "gdk-pixbuf-sys"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b34f3b580c988bd217e9543a2de59823fafae369d1a055555e5f95a8b130b96"
+dependencies = [
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "gdk4"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4850c9d9c1aecd1a3eb14fadc1cdb0ac0a2298037e116264c7473e1740a32d60"
+dependencies = [
+ "cairo-rs",
+ "gdk-pixbuf",
+ "gdk4-sys",
+ "gio",
+ "glib",
+ "libc",
+ "pango",
+]
+
+[[package]]
+name = "gdk4-sys"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f6eb95798e2b46f279cf59005daf297d5b69555428f185650d71974a910473a"
+dependencies = [
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "pango-sys",
+ "pkg-config",
+ "system-deps",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi",
+ "wasip2",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139ef39800118c7683f2fd3c98c1b23c09ae076556b435f8e9064ae108aaeeec"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "wasip2",
+ "wasip3",
+]
+
+[[package]]
+name = "gio"
+version = "0.20.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e27e276e7b6b8d50f6376ee7769a71133e80d093bdc363bd0af71664228b831"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "gio-sys",
+ "glib",
+ "libc",
+ "pin-project-lite",
+ "smallvec",
+]
+
+[[package]]
+name = "gio-sys"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521e93a7e56fc89e84aea9a52cfc9436816a4b363b030260b699950ff1336c83"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "glib"
+version = "0.20.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffc4b6e352d4716d84d7dde562dd9aee2a7d48beb872dd9ece7f2d1515b2d683"
+dependencies = [
+ "bitflags",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-task",
+ "futures-util",
+ "gio-sys",
+ "glib-macros",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "memchr",
+ "smallvec",
+]
+
+[[package]]
+name = "glib-macros"
+version = "0.20.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8084af62f09475a3f529b1629c10c429d7600ee1398ae12dd3bf175d74e7145"
+dependencies = [
+ "heck",
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "glib-sys"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ab79e1ed126803a8fb827e3de0e2ff95191912b8db65cee467edb56fc4cc215"
+dependencies = [
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "glob"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
+
+[[package]]
+name = "gobject-sys"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec9aca94bb73989e3cfdbf8f2e0f1f6da04db4d291c431f444838925c4c63eda"
+dependencies = [
+ "glib-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "goblin"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b363a30c165f666402fe6a3024d3bec7ebc898f96a4a23bd1c99f8dbf3f4f47"
+dependencies = [
+ "log",
+ "plain",
+ "scroll",
+]
+
+[[package]]
+name = "graphene-rs"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b86dfad7d14251c9acaf1de63bc8754b7e3b4e5b16777b6f5a748208fe9519b"
+dependencies = [
+ "glib",
+ "graphene-sys",
+ "libc",
+]
+
+[[package]]
+name = "graphene-sys"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df583a85ba2d5e15e1797e40d666057b28bc2f60a67c9c24145e6db2cc3861ea"
+dependencies = [
+ "glib-sys",
+ "libc",
+ "pkg-config",
+ "system-deps",
+]
+
+[[package]]
+name = "gsk4"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61f5e72f931c8c9f65fbfc89fe0ddc7746f147f822f127a53a9854666ac1f855"
+dependencies = [
+ "cairo-rs",
+ "gdk4",
+ "glib",
+ "graphene-rs",
+ "gsk4-sys",
+ "libc",
+ "pango",
+]
+
+[[package]]
+name = "gsk4-sys"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "755059de55fa6f85a46bde8caf03e2184c96bfda1f6206163c72fb0ea12436dc"
+dependencies = [
+ "cairo-sys-rs",
+ "gdk4-sys",
+ "glib-sys",
+ "gobject-sys",
+ "graphene-sys",
+ "libc",
+ "pango-sys",
+ "system-deps",
+]
+
+[[package]]
+name = "gtk4"
+version = "0.9.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f274dd0102c21c47bbfa8ebcb92d0464fab794a22fad6c3f3d5f165139a326d6"
+dependencies = [
+ "cairo-rs",
+ "field-offset",
+ "futures-channel",
+ "gdk-pixbuf",
+ "gdk4",
+ "gio",
+ "glib",
+ "graphene-rs",
+ "gsk4",
+ "gtk4-macros",
+ "gtk4-sys",
+ "libc",
+ "pango",
+]
+
+[[package]]
+name = "gtk4-macros"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ed1786c4703dd196baf7e103525ce0cf579b3a63a0570fe653b7ee6bac33999"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "gtk4-sys"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41e03b01e54d77c310e1d98647d73f996d04b2f29b9121fe493ea525a7ec03d6"
+dependencies = [
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gdk4-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "graphene-sys",
+ "gsk4-sys",
+ "libc",
+ "pango-sys",
+ "system-deps",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "half"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b43ede17f21864e81be2fa654110bf1e793774238d86ef8555c37e6519c0403"
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "http"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "hyper"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "itoa",
+ "pin-project-lite",
+ "pin-utils",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "system-configuration",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "windows-registry",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
+
+[[package]]
+name = "icu_properties"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
+
+[[package]]
+name = "icu_provider"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.16.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
+
+[[package]]
+name = "iri-string"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c91338f0783edbd6195decb37bae672fd3b165faffb89bf7b9e6942f8b1a731a"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+
+[[package]]
+name = "js-sys"
+version = "0.3.90"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14dc6f6450b3f6d4ed5b16327f38fed626d375a886159ca555bd7822c0c3a5a6"
+dependencies = [
+ "once_cell",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "keyring"
+version = "3.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eebcc3aff044e5944a8fbaf69eb277d11986064cba30c468730e8b9909fb551c"
+dependencies = [
+ "byteorder",
+ "linux-keyutils",
+ "log",
+ "security-framework 2.11.1",
+ "security-framework 3.7.0",
+ "windows-sys 0.60.2",
+ "zeroize",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "libc"
+version = "0.2.182"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6800badb6cb2082ffd7b6a67e6125bb39f18782f793520caee8cb8846be06112"
+
+[[package]]
+name = "libredox"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d0b95e02c851351f877147b7deea7b1afb1df71b63aa5f8270716e0c5720616"
+dependencies = [
+ "bitflags",
+ "libc",
+]
+
+[[package]]
+name = "linux-keyutils"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "761e49ec5fd8a5a463f9b84e877c373d888935b71c6be78f3767fe2ae6bed18e"
+dependencies = [
+ "bitflags",
+ "libc",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6373607a59f0be73a39b6fe456b8192fcc3585f602af20751600e974dd455e77"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "maple_core"
+version = "3.0.0"
+dependencies = [
+ "base64",
+ "chrono",
+ "flume",
+ "futures",
+ "opensecret",
+ "reqwest",
+ "serde_cbor",
+ "serde_json",
+ "tokio",
+ "uniffi",
+ "uuid",
+]
+
+[[package]]
+name = "maple_desktop_gtk"
+version = "3.0.0"
+dependencies = [
+ "dirs-next",
+ "dotenvy",
+ "flume",
+ "gtk4",
+ "keyring",
+ "maple_core",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "mio"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "nanorand"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a51313c5820b0b02bd422f4b44776fbf47961755c74ce64afc73bfad10226c3"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050"
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "oid-registry"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8d8034d9489cdaf79228eb9f6a3b8d7bb32ba00d6645ebd48eef4077ceb5bd9"
+dependencies = [
+ "asn1-rs",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
+[[package]]
+name = "opensecret"
+version = "3.0.0-alpha.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbacacf2d939e25ce433c6a926630c2cc650af4e1431cc1e407f14a53f65e5ca"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "base64",
+ "bytes",
+ "chacha20poly1305",
+ "chrono",
+ "eventsource-stream",
+ "futures",
+ "getrandom 0.2.17",
+ "hex",
+ "percent-encoding",
+ "pin-project",
+ "rand 0.8.5",
+ "reqwest",
+ "ring",
+ "serde",
+ "serde_cbor",
+ "serde_json",
+ "sha2",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "uuid",
+ "x25519-dalek",
+ "x509-parser",
+ "yasna",
+]
+
+[[package]]
+name = "pango"
+version = "0.20.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6576b311f6df659397043a5fa8a021da8f72e34af180b44f7d57348de691ab5c"
+dependencies = [
+ "gio",
+ "glib",
+ "libc",
+ "pango-sys",
+]
+
+[[package]]
+name = "pango-sys"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "186909673fc09be354555c302c0b3dcf753cd9fa08dcb8077fa663c80fb243fa"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677f1add503faace112b9f1373e43e9e054bfdd22ff1a63c1bc485eaec6a6a8a"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e918e4ff8c4549eb882f14b3a4bc8c8bc93de829416eacf579f1207a8fbf861"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "poly1305"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+dependencies = [
+ "cpufeatures",
+ "opaque-debug",
+ "universal-hash",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b73949432f5e2a09657003c25bca5e19a0e9c84f8058ca374f49e0ebe605af77"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983"
+dependencies = [
+ "toml_edit",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1906b49b0c3bc04b5fe5d86a77925ae6524a19b816ae38ce1e426255f1d8a31"
+dependencies = [
+ "bytes",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand 0.9.2",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.18",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.60.2",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
+dependencies = [
+ "getrandom 0.2.17",
+ "libredox",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64",
+ "bytes",
+ "encoding_rs",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams",
+ "web-sys",
+ "webpki-roots",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4"
+dependencies = [
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "scroll"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ab8598aa408498679922eff7fa985c25d58a90771bd6be794434c5277eab1a6"
+dependencies = [
+ "scroll_derive",
+]
+
+[[package]]
+name = "scroll_derive"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1783eabc414609e28a5ba76aee5ddd52199f7107a0b24c2e9746a1ecc34a683d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "security-framework"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
+dependencies = [
+ "bitflags",
+ "core-foundation 0.9.4",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags",
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_cbor"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bef2ebfde456fb76bbcf9f59315333decc4fda0b2b44b420243c11e0f5ec1f5"
+dependencies = [
+ "half",
+ "serde",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.149"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8bbf91e5a4d6315eee45e704372590b30e260ee83af6639d64557f51b067776"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "siphasher"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2aa850e253778c88a04c3d7323b043aeda9d3e30d5971937c1855769763678e"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+
+[[package]]
+name = "smawk"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c388c1b5e93756d0c740965c41e8822f866621d41acbdf6336a6a168f8840c"
+
+[[package]]
+name = "socket2"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86f4aa3ad99f2088c990dfa82d367e19cb29268ed67c574d10d0a4bfe71f07e0"
+dependencies = [
+ "libc",
+ "windows-sys 0.60.2",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
+dependencies = [
+ "bitflags",
+ "core-foundation 0.9.4",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "system-deps"
+version = "7.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c8f33736f986f16d69b6cb8b03f55ddcad5c41acc4ccc39dd88e84aa805e7f"
+dependencies = [
+ "cfg-expr",
+ "heck",
+ "pkg-config",
+ "toml",
+ "version-compare",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df7f62577c25e07834649fc3b39fafdc597c0a3527dc1c60129201ccfcbaa50c"
+
+[[package]]
+name = "tempfile"
+version = "3.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82a72c767771b47409d2345987fda8628641887d5466101319899796367354a0"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.1",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.16.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c13547615a44dc9c452a8a534638acdf07120d4b6847c8178705da06306a3057"
+dependencies = [
+ "smawk",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl 2.0.18",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "time"
+version = "0.3.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+
+[[package]]
+name = "time-macros"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa5fdc3bce6191a1dbc8c02d5c8bffcf557bafa17c124c5264a458f1b0613fa"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.49.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "parking_lot",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "toml"
+version = "0.9.12+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
+dependencies = [
+ "indexmap",
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_parser",
+ "toml_writer",
+ "winnow",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.7.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.23.10+spec-1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "84c8b9f757e028cee9fa244aea147aab2a9ec09d5325a9b01e0a49730c2b5269"
+dependencies = [
+ "indexmap",
+ "toml_datetime",
+ "toml_parser",
+ "winnow",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.0.9+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "702d4415e08923e7e1ef96cd5727c0dfed80b4d2fa25db9647fe5eb6f7c5a4c4"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "toml_writer"
+version = "1.0.6+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab16f14aed21ee8bfd8ec22513f7287cd4a91aa92e44edfe2c17ddd004e92607"
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "iri-string",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typenum"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "uniffi"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8c6dec3fc6645f71a16a3fa9ff57991028153bd194ca97f4b55e610c73ce66a"
+dependencies = [
+ "anyhow",
+ "camino",
+ "cargo_metadata",
+ "clap",
+ "uniffi_bindgen",
+ "uniffi_core",
+ "uniffi_macros",
+ "uniffi_pipeline",
+]
+
+[[package]]
+name = "uniffi-bindgen"
+version = "0.1.0"
+dependencies = [
+ "uniffi",
+]
+
+[[package]]
+name = "uniffi_bindgen"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ed0150801958d4825da56a41c71f000a457ac3a4613fa9647df78ac4b6b6881"
+dependencies = [
+ "anyhow",
+ "askama",
+ "camino",
+ "cargo_metadata",
+ "fs-err",
+ "glob",
+ "goblin",
+ "heck",
+ "indexmap",
+ "once_cell",
+ "serde",
+ "tempfile",
+ "textwrap",
+ "toml",
+ "uniffi_internal_macros",
+ "uniffi_meta",
+ "uniffi_pipeline",
+ "uniffi_udl",
+]
+
+[[package]]
+name = "uniffi_core"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0ef62e69762fbb9386dcb6c87cd3dd05d525fa8a3a579a290892e60ddbda47e"
+dependencies = [
+ "anyhow",
+ "bytes",
+ "once_cell",
+ "static_assertions",
+]
+
+[[package]]
+name = "uniffi_internal_macros"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98f51ebca0d9a4b2aa6c644d5ede45c56f73906b96403c08a1985e75ccb64a01"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "uniffi_macros"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db9d12529f1223d014fd501e5f29ca0884d15d6ed5ddddd9f506e55350327dc3"
+dependencies = [
+ "camino",
+ "fs-err",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "syn",
+ "toml",
+ "uniffi_meta",
+]
+
+[[package]]
+name = "uniffi_meta"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9df6d413db2827c68588f8149d30d49b71d540d46539e435b23a7f7dbd4d4f86"
+dependencies = [
+ "anyhow",
+ "siphasher",
+ "uniffi_internal_macros",
+ "uniffi_pipeline",
+]
+
+[[package]]
+name = "uniffi_pipeline"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a806dddc8208f22efd7e95a5cdf88ed43d0f3271e8f63b47e757a8bbdb43b63a"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "tempfile",
+ "uniffi_internal_macros",
+]
+
+[[package]]
+name = "uniffi_udl"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d1a7339539bf6f6fa3e9b534dece13f778bda2d54b1a6d4e40b4d6090ac26e7"
+dependencies = [
+ "anyhow",
+ "textwrap",
+ "uniffi_meta",
+ "weedle2",
+]
+
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "uuid"
+version = "1.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b672338555252d43fd2240c714dc444b8c6fb0a5c5335e65a07bba7742735ddb"
+dependencies = [
+ "getrandom 0.4.1",
+ "js-sys",
+ "serde_core",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "version-compare"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03c2856837ef78f57382f06b2b8563a2f512f7185d732608fd9176cb3b8edf0e"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.2+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.113"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60722a937f594b7fde9adb894d7c092fc1bb6612897c46368d18e7a20208eff2"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a89f4650b770e4521aa6573724e2aed4704372151bd0de9d16a3bbabb87441a"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "js-sys",
+ "once_cell",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.113"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fac8c6395094b6b91c4af293f4c79371c163f9a6f56184d2c9a85f5a95f3950"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.113"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab3fabce6159dc20728033842636887e4877688ae94382766e00b180abac9d60"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.113"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de0e091bdb824da87dc01d967388880d017a0a9bc4f3bdc0d86ee9f9336e3bb5"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-streams"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.15.5",
+ "indexmap",
+ "semver",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.90"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "705eceb4ce901230f8625bd1d665128056ccbe4b7408faa625eec1ba80f59a97"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cfaf3c063993ff62e73cb4311efde4db1efb31ab78a3e5c457939ad5cc0bed"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "weedle2"
+version = "5.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "998d2c24ec099a87daf9467808859f9d82b61f1d9c9701251aea037f514eae0e"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm 0.52.6",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.53.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
+dependencies = [
+ "windows-link",
+ "windows_aarch64_gnullvm 0.53.1",
+ "windows_aarch64_msvc 0.53.1",
+ "windows_i686_gnu 0.53.1",
+ "windows_i686_gnullvm 0.53.1",
+ "windows_i686_msvc 0.53.1",
+ "windows_x86_64_gnu 0.53.1",
+ "windows_x86_64_gnullvm 0.53.1",
+ "windows_x86_64_msvc 0.53.1",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
+
+[[package]]
+name = "winnow"
+version = "0.7.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
+
+[[package]]
+name = "x25519-dalek"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
+dependencies = [
+ "curve25519-dalek",
+ "rand_core 0.6.4",
+ "serde",
+ "zeroize",
+]
+
+[[package]]
+name = "x509-parser"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcbc162f30700d6f3f82a24bf7cc62ffe7caea42c0b2cba8bf7f3ae50cf51f69"
+dependencies = [
+ "asn1-rs",
+ "data-encoding",
+ "der-parser",
+ "lazy_static",
+ "nom",
+ "oid-registry",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+ "time",
+]
+
+[[package]]
+name = "yasna"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd"
+
+[[package]]
+name = "yoke"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a789c6e490b576db9f7e6b6d661bcc9799f7c0ac8352f56ea20193b2681532e5"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f65c489a7071a749c849713807783f70672b28094011623e200cb86dcb835953"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerotrie"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c28719294829477f525be0186d13efa9a3c602f7ec202ca9e353d310fb9a002"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/native/Cargo.toml b/native/Cargo.toml
new file mode 100644
index 00000000..8996fa78
--- /dev/null
+++ b/native/Cargo.toml
@@ -0,0 +1,10 @@
+[workspace]
+resolver = "2"
+members = [
+  "rust",
+  "uniffi-bindgen",
+  "desktop/gtk",
+]
+exclude = [
+  "rmp-cli",
+]
diff --git a/native/README.md b/native/README.md
new file mode 100644
index 00000000..74a912ea
--- /dev/null
+++ b/native/README.md
@@ -0,0 +1,101 @@
+# Maple 3.0 (Native)
+
+Native cross-platform AI agent chat app built with Rust core + platform-native UIs.
+
+## Architecture
+
+```
+native/
+├── rust/              # Shared Rust core (maple_core) - all business logic
+│   ├── src/lib.rs     # AppState, actions, reducers, SSE streaming, pagination
+│   └── uniffi.toml    # FFI bindings config (cloud.opensecret.maple.rust)
+├── ios/               # SwiftUI frontend (iOS 26+, liquid glass)
+│   ├── Sources/       # ContentView, AppManager, MapleTheme, MapleWordmark
+│   └── project.yml    # XcodeGen project (cloud.opensecret.maple)
+├── android/           # Jetpack Compose frontend (Material 3)
+│   └── app/src/main/java/cloud/opensecret/maple/
+├── desktop/iced/      # iced 0.14 desktop frontend
+│   └── src/main.rs    # Single-file app with theme.rs
+├── rmp.toml           # RMP project config
+├── justfile           # Build commands (also accessible from repo root)
+└── Cargo.toml         # Workspace: rust, uniffi-bindgen, desktop/iced
+```
+
+**Design principle**: All logic lives in `rust/src/lib.rs`. Platforms are thin
+renderers that dispatch `AppAction`s and render `AppState`. No business logic
+in Swift/Kotlin/Rust-iced code.
+
+See `rmp-architecture-bible.md` for the full RMP framework reference.
+
+## Bundle IDs & Versions
+
+| Platform | Bundle ID | Version |
+|----------|-----------|---------|
+| iOS | `cloud.opensecret.maple` (debug: `.dev` suffix) | 3.0.0 |
+| Android | `cloud.opensecret.maple` (debug: `.dev` suffix) | 3.0.0 (versionCode: 3000000000) |
+| Desktop | `cloud.opensecret.maple.desktop` (keyring) | 3.0.0 |
+
+These match Maple 2.0's App Store / Play Store listings for upgrade continuity.
+Team ID: `X773Y823TN`.
+
+## Dependencies
+
+- **OpenSecret SDK**: `opensecret = "3.0.0-alpha.0"` from crates.io
+- **FFI**: UniFFI 0.31 (generates Swift + Kotlin bindings)
+- **Desktop**: iced 0.14 with tokio + canvas features
+- **Build tooling**: RMP CLI, Nix flake, XcodeGen
+
+## Quick Start
+
+From the repo root (`maple/`):
+
+```bash
+# Run on each platform
+just native-run-ios
+just native-run-android
+just native-run-desktop
+
+# Regenerate FFI bindings after changing rust/src/lib.rs
+just native-bindings
+
+# Or from inside native/ directly
+just run-ios
+just run-android
+just run-desktop
+```
+
+From OrbStack (Linux container with macOS host):
+
+```bash
+mac just -f /path/to/maple/native/justfile run-ios
+mac just -f /path/to/maple/native/justfile run-android
+# Desktop builds natively on mac:
+mac just -f /path/to/maple/native/justfile run-desktop
+```
+
+## Key Features
+
+- **Single-agent chat** with SSE streaming via OpenSecret API
+- **Session persistence** (keychain on iOS, EncryptedSharedPreferences on Android, keyring on desktop)
+- **Cursor-based pagination** (20 messages per page, prefetch within 3 of top)
+- **iMessage-style timestamps** with smart grouping (5+ min gap threshold)
+- **Settings** with delete agent + sign out
+- **OAuth** (GitHub, Google, Apple) + email/password auth
+- **Splash screen** with radial gradient and SVG wordmark
+
+## Design System
+
+- **iOS**: Native iOS 26 Liquid Glass (`.glassEffect()`, `GlassEffectContainer`)
+- **Android**: Simulated frosted glass (translucent containers, scale animations)
+- **Desktop**: Simulated frosted glass (translucent containers, subtle borders/shadows)
+- **Brand**: Manrope body font, Array-Bold display font, MPL app icon
+- **Colors**: Maple (primary), Pebble (secondary), Bark (tertiary), Grove, Neutral
+- **Bubbles**: User = Maple 400→600 gradient, Agent = Pebble-50
+
+## Relationship to Maple 2.0
+
+Maple 2.0 lives in `frontend/` (Tauri + React/TypeScript web app).
+Maple 3.0 lives in `native/` (pure native apps).
+
+Both share the same bundle IDs and App Store listings. When 3.0 is ready,
+it will replace 2.0 as the shipped product. Until then, both coexist.
diff --git a/native/android/app/build.gradle.kts b/native/android/app/build.gradle.kts
new file mode 100644
index 00000000..4739db27
--- /dev/null
+++ b/native/android/app/build.gradle.kts
@@ -0,0 +1,135 @@
+import java.util.Properties
+
+plugins {
+    id("com.android.application")
+    id("org.jetbrains.kotlin.android")
+}
+
+fun String.toKotlinStringLiteral(): String =
+    "\"${replace("\\", "\\\\").replace("\"", "\\\"")}\""
+
+val keystoreProperties = Properties()
+val keystorePropertiesFile = rootProject.file("keystore.properties")
+
+if (keystorePropertiesFile.exists()) {
+    keystorePropertiesFile.inputStream().use(keystoreProperties::load)
+}
+
+val openSecretApiUrl = providers.gradleProperty("openSecretApiUrl")
+    .orElse(providers.environmentVariable("OPEN_SECRET_API_URL"))
+    .getOrElse("")
+
+val mapleVersionName = providers.gradleProperty("mapleVersionName")
+    .orElse(providers.environmentVariable("MAPLE_ANDROID_VERSION_NAME"))
+    .orNull
+    ?: "3.0.0"
+
+val mapleVersionCode = providers.gradleProperty("mapleVersionCode")
+    .orElse(providers.environmentVariable("MAPLE_ANDROID_VERSION_CODE"))
+    .orNull
+    ?.toInt()
+    ?: 300000000
+
+android {
+    namespace = "cloud.opensecret.maple"
+    compileSdk = 35
+    ndkVersion = "28.2.13676358"
+
+    defaultConfig {
+        applicationId = "cloud.opensecret.maple"
+        minSdk = 26
+        targetSdk = 35
+        versionCode = mapleVersionCode
+        versionName = mapleVersionName
+        buildConfigField("String", "OPEN_SECRET_API_URL", openSecretApiUrl.toKotlinStringLiteral())
+    }
+
+    signingConfigs {
+        if (keystorePropertiesFile.exists()) {
+            create("release") {
+                storeFile = file(keystoreProperties.getProperty("storeFile"))
+                storePassword = keystoreProperties.getProperty("password")
+                keyAlias = keystoreProperties.getProperty("keyAlias")
+                keyPassword = keystoreProperties.getProperty("password")
+            }
+        }
+    }
+
+    buildTypes {
+        debug {
+            applicationIdSuffix = ".dev"
+            versionNameSuffix = "-dev"
+        }
+        release {
+            isMinifyEnabled = false
+            signingConfig = signingConfigs.findByName("release")
+            proguardFiles(
+                getDefaultProguardFile("proguard-android-optimize.txt"),
+            )
+        }
+    }
+
+    buildFeatures {
+        compose = true
+        buildConfig = true
+    }
+
+    composeOptions {
+        kotlinCompilerExtensionVersion = "1.5.14"
+    }
+
+    compileOptions {
+        sourceCompatibility = JavaVersion.VERSION_17
+        targetCompatibility = JavaVersion.VERSION_17
+    }
+
+    kotlinOptions {
+        jvmTarget = "17"
+    }
+
+    packaging {
+        resources.excludes.addAll(
+            listOf("/META-INF/{AL2.0,LGPL2.1}", "META-INF/DEPENDENCIES"),
+        )
+    }
+
+    sourceSets {
+        getByName("main") {
+            jniLibs.srcDirs("src/main/jniLibs")
+        }
+    }
+}
+
+tasks.register("ensureUniffiGenerated") {
+    doLast {
+        val out = file("src/main/java/cloud/opensecret/maple/rust/maple_core.kt")
+        if (!out.exists()) {
+            throw GradleException("Missing UniFFI Kotlin bindings. Run `rmp bindings kotlin` first.")
+        }
+    }
+}
+
+tasks.named("preBuild") {
+    dependsOn("ensureUniffiGenerated")
+}
+
+dependencies {
+    val composeBom = platform("androidx.compose:compose-bom:2024.06.00")
+    implementation(composeBom)
+
+    implementation("androidx.core:core-ktx:1.13.1")
+    implementation("androidx.activity:activity-compose:1.9.0")
+    implementation("androidx.lifecycle:lifecycle-runtime-ktx:2.8.3")
+
+    implementation("androidx.compose.ui:ui")
+    implementation("androidx.compose.ui:ui-tooling-preview")
+    implementation("androidx.compose.material3:material3")
+
+    debugImplementation("androidx.compose.ui:ui-tooling")
+
+    // UniFFI JNA
+    implementation("net.java.dev.jna:jna:5.14.0@aar")
+
+    // Secure credential storage
+    implementation("androidx.security:security-crypto:1.1.0-alpha06")
+}
diff --git a/native/android/app/src/main/AndroidManifest.xml b/native/android/app/src/main/AndroidManifest.xml
new file mode 100644
index 00000000..360936d0
--- /dev/null
+++ b/native/android/app/src/main/AndroidManifest.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <uses-permission android:name="android.permission.INTERNET" />
+
+    <application
+        android:allowBackup="true"
+        android:label="Maple"
+        android:icon="@mipmap/ic_launcher"
+        android:roundIcon="@mipmap/ic_launcher_round"
+        android:supportsRtl="true"
+        android:theme="@style/Theme.App">
+
+        <activity
+            android:name=".MainActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+
+    </application>
+
+</manifest>
diff --git a/native/android/app/src/main/java/cloud/opensecret/maple/AppManager.kt b/native/android/app/src/main/java/cloud/opensecret/maple/AppManager.kt
new file mode 100644
index 00000000..3943b9eb
--- /dev/null
+++ b/native/android/app/src/main/java/cloud/opensecret/maple/AppManager.kt
@@ -0,0 +1,128 @@
+package cloud.opensecret.maple
+
+import android.content.Context
+import android.os.Handler
+import android.os.Looper
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.setValue
+import androidx.security.crypto.EncryptedSharedPreferences
+import androidx.security.crypto.MasterKey
+import cloud.opensecret.maple.rust.AppAction
+import cloud.opensecret.maple.rust.AppReconciler
+import cloud.opensecret.maple.rust.AppState
+import cloud.opensecret.maple.rust.AppUpdate
+import cloud.opensecret.maple.rust.AuthState
+import cloud.opensecret.maple.rust.FfiApp
+import cloud.opensecret.maple.rust.Router
+import cloud.opensecret.maple.rust.Screen
+
+class AppManager private constructor(context: Context) : AppReconciler {
+    private val mainHandler = Handler(Looper.getMainLooper())
+    private val rust: FfiApp
+    private var lastRevApplied: ULong = 0UL
+
+    private val securePrefs = EncryptedSharedPreferences.create(
+        context.applicationContext,
+        "maple_secure_prefs",
+        MasterKey.Builder(context.applicationContext)
+            .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
+            .build(),
+        EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
+        EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM,
+    )
+
+    var state: AppState by mutableStateOf(
+        AppState(
+            rev = 0UL,
+            auth = AuthState.Initializing,
+            pendingAuthUrl = null,
+            router = Router(
+                defaultScreen = Screen.LOADING,
+                screenStack = emptyList(),
+            ),
+            messages = emptyList(),
+            isAgentTyping = false,
+            isLoadingHistory = false,
+            hasOlderMessages = false,
+            composeText = "",
+            toast = null,
+            showSettings = false,
+            confirmDeleteAgent = false,
+            isDeletingAgent = false,
+        ),
+    )
+        private set
+
+    private fun configuredApiUrl(): String {
+        val configured = BuildConfig.OPEN_SECRET_API_URL.trim()
+        val apiUrl = if (configured.isNotEmpty()) configured else "http://0.0.0.0:3000"
+
+        return if (apiUrl == "http://0.0.0.0:3000") "http://10.0.2.2:3000" else apiUrl
+    }
+
+    init {
+        val dataDir = context.filesDir.absolutePath
+
+        val apiUrl = configuredApiUrl()
+        val clientId = "ba5a14b5-d915-47b1-b7b1-afda52bc5fc6"
+
+        rust = FfiApp(apiUrl = apiUrl, clientId = clientId, dataDir = dataDir)
+        val initial = rust.state()
+        state = initial
+        lastRevApplied = initial.rev
+        rust.listenForUpdates(this)
+
+        // Attempt session restore from EncryptedSharedPreferences
+        val access = securePrefs.getString("access_token", null)
+        val refresh = securePrefs.getString("refresh_token", null)
+        if (access != null && refresh != null) {
+            rust.dispatch(AppAction.RestoreSession(accessToken = access, refreshToken = refresh))
+        } else {
+            if (access != null || refresh != null) {
+                securePrefs.edit().remove("access_token").remove("refresh_token").apply()
+            }
+            rust.dispatch(AppAction.CompleteStartup)
+        }
+    }
+
+    fun dispatch(action: AppAction) {
+        rust.dispatch(action)
+    }
+
+    override fun reconcile(update: AppUpdate) {
+        mainHandler.post {
+            when (update) {
+                is AppUpdate.SessionTokens -> {
+                    // Persist side-effect BEFORE rev guard (per bible 6.6)
+                    if (update.accessToken.isEmpty()) {
+                        securePrefs.edit().remove("access_token").remove("refresh_token").apply()
+                    } else {
+                        securePrefs.edit()
+                            .putString("access_token", update.accessToken)
+                            .putString("refresh_token", update.refreshToken)
+                            .apply()
+                    }
+                    if (update.rev > lastRevApplied) {
+                        lastRevApplied = update.rev
+                    }
+                }
+                is AppUpdate.FullState -> {
+                    if (update.v1.rev <= lastRevApplied) return@post
+                    lastRevApplied = update.v1.rev
+                    state = update.v1
+                }
+            }
+        }
+    }
+
+    companion object {
+        @Volatile
+        private var instance: AppManager? = null
+
+        fun getInstance(context: Context): AppManager =
+            instance ?: synchronized(this) {
+                instance ?: AppManager(context.applicationContext).also { instance = it }
+            }
+    }
+}
diff --git a/native/android/app/src/main/java/cloud/opensecret/maple/MainActivity.kt b/native/android/app/src/main/java/cloud/opensecret/maple/MainActivity.kt
new file mode 100644
index 00000000..2d0c3db9
--- /dev/null
+++ b/native/android/app/src/main/java/cloud/opensecret/maple/MainActivity.kt
@@ -0,0 +1,35 @@
+package cloud.opensecret.maple
+
+import android.os.Bundle
+import androidx.activity.ComponentActivity
+import androidx.activity.compose.setContent
+import androidx.compose.foundation.isSystemInDarkTheme
+import androidx.compose.runtime.SideEffect
+import androidx.compose.ui.platform.LocalView
+import androidx.core.view.WindowCompat
+import cloud.opensecret.maple.ui.MainApp
+import cloud.opensecret.maple.ui.theme.AppTheme
+
+class MainActivity : ComponentActivity() {
+    private lateinit var manager: AppManager
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        manager = AppManager.getInstance(applicationContext)
+        setContent {
+            val darkTheme = isSystemInDarkTheme()
+            val view = LocalView.current
+
+            SideEffect {
+                WindowCompat.getInsetsController(window, view).apply {
+                    isAppearanceLightStatusBars = !darkTheme
+                    isAppearanceLightNavigationBars = !darkTheme
+                }
+            }
+
+            AppTheme(darkTheme = darkTheme) {
+                MainApp(manager = manager)
+            }
+        }
+    }
+}
diff --git a/native/android/app/src/main/java/cloud/opensecret/maple/rust/maple_core.kt b/native/android/app/src/main/java/cloud/opensecret/maple/rust/maple_core.kt
new file mode 100644
index 00000000..2373a138
--- /dev/null
+++ b/native/android/app/src/main/java/cloud/opensecret/maple/rust/maple_core.kt
@@ -0,0 +1,2436 @@
+// This file was autogenerated by some hot garbage in the `uniffi` crate.
+// Trust me, you don't want to mess with it!
+
+@file:Suppress("NAME_SHADOWING")
+
+package cloud.opensecret.maple.rust
+
+// Common helper code.
+//
+// Ideally this would live in a separate .kt file where it can be unittested etc
+// in isolation, and perhaps even published as a re-useable package.
+//
+// However, it's important that the details of how this helper code works (e.g. the
+// way that different builtin types are passed across the FFI) exactly match what's
+// expected by the Rust code on the other side of the interface. In practice right
+// now that means coming from the exact some version of `uniffi` that was used to
+// compile the Rust component. The easiest way to ensure this is to bundle the Kotlin
+// helpers directly inline like we're doing here.
+
+import com.sun.jna.Library
+import com.sun.jna.IntegerType
+import com.sun.jna.Native
+import com.sun.jna.Pointer
+import com.sun.jna.Structure
+import com.sun.jna.Callback
+import com.sun.jna.ptr.*
+import java.nio.ByteBuffer
+import java.nio.ByteOrder
+import java.nio.CharBuffer
+import java.nio.charset.CodingErrorAction
+import java.util.concurrent.atomic.AtomicLong
+import java.util.concurrent.ConcurrentHashMap
+import java.util.concurrent.atomic.AtomicBoolean
+
+// This is a helper for safely working with byte buffers returned from the Rust code.
+// A rust-owned buffer is represented by its capacity, its current length, and a
+// pointer to the underlying data.
+
+/**
+ * @suppress
+ */
+@Structure.FieldOrder("capacity", "len", "data")
+open class RustBuffer : Structure() {
+    // Note: `capacity` and `len` are actually `ULong` values, but JVM only supports signed values.
+    // When dealing with these fields, make sure to call `toULong()`.
+    @JvmField var capacity: Long = 0
+    @JvmField var len: Long = 0
+    @JvmField var data: Pointer? = null
+
+    class ByValue: RustBuffer(), Structure.ByValue
+    class ByReference: RustBuffer(), Structure.ByReference
+
+   internal fun setValue(other: RustBuffer) {
+        capacity = other.capacity
+        len = other.len
+        data = other.data
+    }
+
+    companion object {
+        internal fun alloc(size: ULong = 0UL) = uniffiRustCall() { status ->
+            // Note: need to convert the size to a `Long` value to make this work with JVM.
+            UniffiLib.ffi_maple_core_rustbuffer_alloc(size.toLong(), status)
+        }.also {
+            if(it.data == null) {
+               throw RuntimeException("RustBuffer.alloc() returned null data pointer (size=${size})")
+           }
+        }
+
+        internal fun create(capacity: ULong, len: ULong, data: Pointer?): RustBuffer.ByValue {
+            var buf = RustBuffer.ByValue()
+            buf.capacity = capacity.toLong()
+            buf.len = len.toLong()
+            buf.data = data
+            return buf
+        }
+
+        internal fun free(buf: RustBuffer.ByValue) = uniffiRustCall() { status ->
+            UniffiLib.ffi_maple_core_rustbuffer_free(buf, status)
+        }
+    }
+
+    @Suppress("TooGenericExceptionThrown")
+    fun asByteBuffer() =
+        this.data?.getByteBuffer(0, this.len)?.also {
+            it.order(ByteOrder.BIG_ENDIAN)
+        }
+}
+
+// This is a helper for safely passing byte references into the rust code.
+// It's not actually used at the moment, because there aren't many things that you
+// can take a direct pointer to in the JVM, and if we're going to copy something
+// then we might as well copy it into a `RustBuffer`. But it's here for API
+// completeness.
+
+@Structure.FieldOrder("len", "data")
+internal open class ForeignBytes : Structure() {
+    @JvmField var len: Int = 0
+    @JvmField var data: Pointer? = null
+
+    class ByValue : ForeignBytes(), Structure.ByValue
+}
+/**
+ * The FfiConverter interface handles converter types to and from the FFI
+ *
+ * All implementing objects should be public to support external types.  When a
+ * type is external we need to import it's FfiConverter.
+ *
+ * @suppress
+ */
+public interface FfiConverter<KotlinType, FfiType> {
+    // Convert an FFI type to a Kotlin type
+    fun lift(value: FfiType): KotlinType
+
+    // Convert an Kotlin type to an FFI type
+    fun lower(value: KotlinType): FfiType
+
+    // Read a Kotlin type from a `ByteBuffer`
+    fun read(buf: ByteBuffer): KotlinType
+
+    // Calculate bytes to allocate when creating a `RustBuffer`
+    //
+    // This must return at least as many bytes as the write() function will
+    // write. It can return more bytes than needed, for example when writing
+    // Strings we can't know the exact bytes needed until we the UTF-8
+    // encoding, so we pessimistically allocate the largest size possible (3
+    // bytes per codepoint).  Allocating extra bytes is not really a big deal
+    // because the `RustBuffer` is short-lived.
+    fun allocationSize(value: KotlinType): ULong
+
+    // Write a Kotlin type to a `ByteBuffer`
+    fun write(value: KotlinType, buf: ByteBuffer)
+
+    // Lower a value into a `RustBuffer`
+    //
+    // This method lowers a value into a `RustBuffer` rather than the normal
+    // FfiType.  It's used by the callback interface code.  Callback interface
+    // returns are always serialized into a `RustBuffer` regardless of their
+    // normal FFI type.
+    fun lowerIntoRustBuffer(value: KotlinType): RustBuffer.ByValue {
+        val rbuf = RustBuffer.alloc(allocationSize(value))
+        try {
+            val bbuf = rbuf.data!!.getByteBuffer(0, rbuf.capacity).also {
+                it.order(ByteOrder.BIG_ENDIAN)
+            }
+            write(value, bbuf)
+            rbuf.writeField("len", bbuf.position().toLong())
+            return rbuf
+        } catch (e: Throwable) {
+            RustBuffer.free(rbuf)
+            throw e
+        }
+    }
+
+    // Lift a value from a `RustBuffer`.
+    //
+    // This here mostly because of the symmetry with `lowerIntoRustBuffer()`.
+    // It's currently only used by the `FfiConverterRustBuffer` class below.
+    fun liftFromRustBuffer(rbuf: RustBuffer.ByValue): KotlinType {
+        val byteBuf = rbuf.asByteBuffer()!!
+        try {
+           val item = read(byteBuf)
+           if (byteBuf.hasRemaining()) {
+               throw RuntimeException("junk remaining in buffer after lifting, something is very wrong!!")
+           }
+           return item
+        } finally {
+            RustBuffer.free(rbuf)
+        }
+    }
+}
+
+/**
+ * FfiConverter that uses `RustBuffer` as the FfiType
+ *
+ * @suppress
+ */
+public interface FfiConverterRustBuffer<KotlinType>: FfiConverter<KotlinType, RustBuffer.ByValue> {
+    override fun lift(value: RustBuffer.ByValue) = liftFromRustBuffer(value)
+    override fun lower(value: KotlinType) = lowerIntoRustBuffer(value)
+}
+// A handful of classes and functions to support the generated data structures.
+// This would be a good candidate for isolating in its own ffi-support lib.
+
+internal const val UNIFFI_CALL_SUCCESS = 0.toByte()
+internal const val UNIFFI_CALL_ERROR = 1.toByte()
+internal const val UNIFFI_CALL_UNEXPECTED_ERROR = 2.toByte()
+
+@Structure.FieldOrder("code", "error_buf")
+internal open class UniffiRustCallStatus : Structure() {
+    @JvmField var code: Byte = 0
+    @JvmField var error_buf: RustBuffer.ByValue = RustBuffer.ByValue()
+
+    class ByValue: UniffiRustCallStatus(), Structure.ByValue
+
+    fun isSuccess(): Boolean {
+        return code == UNIFFI_CALL_SUCCESS
+    }
+
+    fun isError(): Boolean {
+        return code == UNIFFI_CALL_ERROR
+    }
+
+    fun isPanic(): Boolean {
+        return code == UNIFFI_CALL_UNEXPECTED_ERROR
+    }
+
+    companion object {
+        fun create(code: Byte, errorBuf: RustBuffer.ByValue): UniffiRustCallStatus.ByValue {
+            val callStatus = UniffiRustCallStatus.ByValue()
+            callStatus.code = code
+            callStatus.error_buf = errorBuf
+            return callStatus
+        }
+    }
+}
+
+class InternalException(message: String) : kotlin.Exception(message)
+
+/**
+ * Each top-level error class has a companion object that can lift the error from the call status's rust buffer
+ *
+ * @suppress
+ */
+interface UniffiRustCallStatusErrorHandler<E> {
+    fun lift(error_buf: RustBuffer.ByValue): E;
+}
+
+// Helpers for calling Rust
+// In practice we usually need to be synchronized to call this safely, so it doesn't
+// synchronize itself
+
+// Call a rust function that returns a Result<>.  Pass in the Error class companion that corresponds to the Err
+private inline fun <U, E: kotlin.Exception> uniffiRustCallWithError(errorHandler: UniffiRustCallStatusErrorHandler<E>, callback: (UniffiRustCallStatus) -> U): U {
+    var status = UniffiRustCallStatus()
+    val return_value = callback(status)
+    uniffiCheckCallStatus(errorHandler, status)
+    return return_value
+}
+
+// Check UniffiRustCallStatus and throw an error if the call wasn't successful
+private fun<E: kotlin.Exception> uniffiCheckCallStatus(errorHandler: UniffiRustCallStatusErrorHandler<E>, status: UniffiRustCallStatus) {
+    if (status.isSuccess()) {
+        return
+    } else if (status.isError()) {
+        throw errorHandler.lift(status.error_buf)
+    } else if (status.isPanic()) {
+        // when the rust code sees a panic, it tries to construct a rustbuffer
+        // with the message.  but if that code panics, then it just sends back
+        // an empty buffer.
+        if (status.error_buf.len > 0) {
+            throw InternalException(FfiConverterString.lift(status.error_buf))
+        } else {
+            throw InternalException("Rust panic")
+        }
+    } else {
+        throw InternalException("Unknown rust call status: $status.code")
+    }
+}
+
+/**
+ * UniffiRustCallStatusErrorHandler implementation for times when we don't expect a CALL_ERROR
+ *
+ * @suppress
+ */
+object UniffiNullRustCallStatusErrorHandler: UniffiRustCallStatusErrorHandler<InternalException> {
+    override fun lift(error_buf: RustBuffer.ByValue): InternalException {
+        RustBuffer.free(error_buf)
+        return InternalException("Unexpected CALL_ERROR")
+    }
+}
+
+// Call a rust function that returns a plain value
+private inline fun <U> uniffiRustCall(callback: (UniffiRustCallStatus) -> U): U {
+    return uniffiRustCallWithError(UniffiNullRustCallStatusErrorHandler, callback)
+}
+
+internal inline fun<T> uniffiTraitInterfaceCall(
+    callStatus: UniffiRustCallStatus,
+    makeCall: () -> T,
+    writeReturn: (T) -> Unit,
+) {
+    try {
+        writeReturn(makeCall())
+    } catch(e: kotlin.Exception) {
+        val err = try { e.stackTraceToString() } catch(_: Throwable) { "" }
+        callStatus.code = UNIFFI_CALL_UNEXPECTED_ERROR
+        callStatus.error_buf = FfiConverterString.lower(err)
+    }
+}
+
+internal inline fun<T, reified E: Throwable> uniffiTraitInterfaceCallWithError(
+    callStatus: UniffiRustCallStatus,
+    makeCall: () -> T,
+    writeReturn: (T) -> Unit,
+    lowerError: (E) -> RustBuffer.ByValue
+) {
+    try {
+        writeReturn(makeCall())
+    } catch(e: kotlin.Exception) {
+        if (e is E) {
+            callStatus.code = UNIFFI_CALL_ERROR
+            callStatus.error_buf = lowerError(e)
+        } else {
+            val err = try { e.stackTraceToString() } catch(_: Throwable) { "" }
+            callStatus.code = UNIFFI_CALL_UNEXPECTED_ERROR
+            callStatus.error_buf = FfiConverterString.lower(err)
+        }
+    }
+}
+// Initial value and increment amount for handles. 
+// These ensure that Kotlin-generated handles always have the lowest bit set
+private const val UNIFFI_HANDLEMAP_INITIAL = 1.toLong()
+private const val UNIFFI_HANDLEMAP_DELTA = 2.toLong()
+
+// Map handles to objects
+//
+// This is used pass an opaque 64-bit handle representing a foreign object to the Rust code.
+internal class UniffiHandleMap<T: Any> {
+    private val map = ConcurrentHashMap<Long, T>()
+    // Start 
+    private val counter = java.util.concurrent.atomic.AtomicLong(UNIFFI_HANDLEMAP_INITIAL)
+
+    val size: Int
+        get() = map.size
+
+    // Insert a new object into the handle map and get a handle for it
+    fun insert(obj: T): Long {
+        val handle = counter.getAndAdd(UNIFFI_HANDLEMAP_DELTA)
+        map.put(handle, obj)
+        return handle
+    }
+
+    // Clone a handle, creating a new one
+    fun clone(handle: Long): Long {
+        val obj = map.get(handle) ?: throw InternalException("UniffiHandleMap.clone: Invalid handle")
+        return insert(obj)
+    }
+
+    // Get an object from the handle map
+    fun get(handle: Long): T {
+        return map.get(handle) ?: throw InternalException("UniffiHandleMap.get: Invalid handle")
+    }
+
+    // Remove an entry from the handlemap and get the Kotlin object back
+    fun remove(handle: Long): T {
+        return map.remove(handle) ?: throw InternalException("UniffiHandleMap: Invalid handle")
+    }
+}
+
+// Contains loading, initialization code,
+// and the FFI Function declarations in a com.sun.jna.Library.
+@Synchronized
+private fun findLibraryName(componentName: String): String {
+    val libOverride = System.getProperty("uniffi.component.$componentName.libraryOverride")
+    if (libOverride != null) {
+        return libOverride
+    }
+    return "maple_core"
+}
+
+// Define FFI callback types
+internal interface UniffiRustFutureContinuationCallback : com.sun.jna.Callback {
+    fun callback(`data`: Long,`pollResult`: Byte,)
+}
+internal interface UniffiForeignFutureDroppedCallback : com.sun.jna.Callback {
+    fun callback(`handle`: Long,)
+}
+internal interface UniffiCallbackInterfaceFree : com.sun.jna.Callback {
+    fun callback(`handle`: Long,)
+}
+internal interface UniffiCallbackInterfaceClone : com.sun.jna.Callback {
+    fun callback(`handle`: Long,)
+    : Long
+}
+@Structure.FieldOrder("handle", "free")
+internal open class UniffiForeignFutureDroppedCallbackStruct(
+    @JvmField internal var `handle`: Long = 0.toLong(),
+    @JvmField internal var `free`: UniffiForeignFutureDroppedCallback? = null,
+) : Structure() {
+    class UniffiByValue(
+        `handle`: Long = 0.toLong(),
+        `free`: UniffiForeignFutureDroppedCallback? = null,
+    ): UniffiForeignFutureDroppedCallbackStruct(`handle`,`free`,), Structure.ByValue
+
+   internal fun uniffiSetValue(other: UniffiForeignFutureDroppedCallbackStruct) {
+        `handle` = other.`handle`
+        `free` = other.`free`
+    }
+
+}
+@Structure.FieldOrder("returnValue", "callStatus")
+internal open class UniffiForeignFutureResultU8(
+    @JvmField internal var `returnValue`: Byte = 0.toByte(),
+    @JvmField internal var `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+) : Structure() {
+    class UniffiByValue(
+        `returnValue`: Byte = 0.toByte(),
+        `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+    ): UniffiForeignFutureResultU8(`returnValue`,`callStatus`,), Structure.ByValue
+
+   internal fun uniffiSetValue(other: UniffiForeignFutureResultU8) {
+        `returnValue` = other.`returnValue`
+        `callStatus` = other.`callStatus`
+    }
+
+}
+internal interface UniffiForeignFutureCompleteU8 : com.sun.jna.Callback {
+    fun callback(`callbackData`: Long,`result`: UniffiForeignFutureResultU8.UniffiByValue,)
+}
+@Structure.FieldOrder("returnValue", "callStatus")
+internal open class UniffiForeignFutureResultI8(
+    @JvmField internal var `returnValue`: Byte = 0.toByte(),
+    @JvmField internal var `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+) : Structure() {
+    class UniffiByValue(
+        `returnValue`: Byte = 0.toByte(),
+        `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+    ): UniffiForeignFutureResultI8(`returnValue`,`callStatus`,), Structure.ByValue
+
+   internal fun uniffiSetValue(other: UniffiForeignFutureResultI8) {
+        `returnValue` = other.`returnValue`
+        `callStatus` = other.`callStatus`
+    }
+
+}
+internal interface UniffiForeignFutureCompleteI8 : com.sun.jna.Callback {
+    fun callback(`callbackData`: Long,`result`: UniffiForeignFutureResultI8.UniffiByValue,)
+}
+@Structure.FieldOrder("returnValue", "callStatus")
+internal open class UniffiForeignFutureResultU16(
+    @JvmField internal var `returnValue`: Short = 0.toShort(),
+    @JvmField internal var `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+) : Structure() {
+    class UniffiByValue(
+        `returnValue`: Short = 0.toShort(),
+        `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+    ): UniffiForeignFutureResultU16(`returnValue`,`callStatus`,), Structure.ByValue
+
+   internal fun uniffiSetValue(other: UniffiForeignFutureResultU16) {
+        `returnValue` = other.`returnValue`
+        `callStatus` = other.`callStatus`
+    }
+
+}
+internal interface UniffiForeignFutureCompleteU16 : com.sun.jna.Callback {
+    fun callback(`callbackData`: Long,`result`: UniffiForeignFutureResultU16.UniffiByValue,)
+}
+@Structure.FieldOrder("returnValue", "callStatus")
+internal open class UniffiForeignFutureResultI16(
+    @JvmField internal var `returnValue`: Short = 0.toShort(),
+    @JvmField internal var `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+) : Structure() {
+    class UniffiByValue(
+        `returnValue`: Short = 0.toShort(),
+        `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+    ): UniffiForeignFutureResultI16(`returnValue`,`callStatus`,), Structure.ByValue
+
+   internal fun uniffiSetValue(other: UniffiForeignFutureResultI16) {
+        `returnValue` = other.`returnValue`
+        `callStatus` = other.`callStatus`
+    }
+
+}
+internal interface UniffiForeignFutureCompleteI16 : com.sun.jna.Callback {
+    fun callback(`callbackData`: Long,`result`: UniffiForeignFutureResultI16.UniffiByValue,)
+}
+@Structure.FieldOrder("returnValue", "callStatus")
+internal open class UniffiForeignFutureResultU32(
+    @JvmField internal var `returnValue`: Int = 0,
+    @JvmField internal var `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+) : Structure() {
+    class UniffiByValue(
+        `returnValue`: Int = 0,
+        `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+    ): UniffiForeignFutureResultU32(`returnValue`,`callStatus`,), Structure.ByValue
+
+   internal fun uniffiSetValue(other: UniffiForeignFutureResultU32) {
+        `returnValue` = other.`returnValue`
+        `callStatus` = other.`callStatus`
+    }
+
+}
+internal interface UniffiForeignFutureCompleteU32 : com.sun.jna.Callback {
+    fun callback(`callbackData`: Long,`result`: UniffiForeignFutureResultU32.UniffiByValue,)
+}
+@Structure.FieldOrder("returnValue", "callStatus")
+internal open class UniffiForeignFutureResultI32(
+    @JvmField internal var `returnValue`: Int = 0,
+    @JvmField internal var `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+) : Structure() {
+    class UniffiByValue(
+        `returnValue`: Int = 0,
+        `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+    ): UniffiForeignFutureResultI32(`returnValue`,`callStatus`,), Structure.ByValue
+
+   internal fun uniffiSetValue(other: UniffiForeignFutureResultI32) {
+        `returnValue` = other.`returnValue`
+        `callStatus` = other.`callStatus`
+    }
+
+}
+internal interface UniffiForeignFutureCompleteI32 : com.sun.jna.Callback {
+    fun callback(`callbackData`: Long,`result`: UniffiForeignFutureResultI32.UniffiByValue,)
+}
+@Structure.FieldOrder("returnValue", "callStatus")
+internal open class UniffiForeignFutureResultU64(
+    @JvmField internal var `returnValue`: Long = 0.toLong(),
+    @JvmField internal var `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+) : Structure() {
+    class UniffiByValue(
+        `returnValue`: Long = 0.toLong(),
+        `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+    ): UniffiForeignFutureResultU64(`returnValue`,`callStatus`,), Structure.ByValue
+
+   internal fun uniffiSetValue(other: UniffiForeignFutureResultU64) {
+        `returnValue` = other.`returnValue`
+        `callStatus` = other.`callStatus`
+    }
+
+}
+internal interface UniffiForeignFutureCompleteU64 : com.sun.jna.Callback {
+    fun callback(`callbackData`: Long,`result`: UniffiForeignFutureResultU64.UniffiByValue,)
+}
+@Structure.FieldOrder("returnValue", "callStatus")
+internal open class UniffiForeignFutureResultI64(
+    @JvmField internal var `returnValue`: Long = 0.toLong(),
+    @JvmField internal var `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+) : Structure() {
+    class UniffiByValue(
+        `returnValue`: Long = 0.toLong(),
+        `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+    ): UniffiForeignFutureResultI64(`returnValue`,`callStatus`,), Structure.ByValue
+
+   internal fun uniffiSetValue(other: UniffiForeignFutureResultI64) {
+        `returnValue` = other.`returnValue`
+        `callStatus` = other.`callStatus`
+    }
+
+}
+internal interface UniffiForeignFutureCompleteI64 : com.sun.jna.Callback {
+    fun callback(`callbackData`: Long,`result`: UniffiForeignFutureResultI64.UniffiByValue,)
+}
+@Structure.FieldOrder("returnValue", "callStatus")
+internal open class UniffiForeignFutureResultF32(
+    @JvmField internal var `returnValue`: Float = 0.0f,
+    @JvmField internal var `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+) : Structure() {
+    class UniffiByValue(
+        `returnValue`: Float = 0.0f,
+        `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+    ): UniffiForeignFutureResultF32(`returnValue`,`callStatus`,), Structure.ByValue
+
+   internal fun uniffiSetValue(other: UniffiForeignFutureResultF32) {
+        `returnValue` = other.`returnValue`
+        `callStatus` = other.`callStatus`
+    }
+
+}
+internal interface UniffiForeignFutureCompleteF32 : com.sun.jna.Callback {
+    fun callback(`callbackData`: Long,`result`: UniffiForeignFutureResultF32.UniffiByValue,)
+}
+@Structure.FieldOrder("returnValue", "callStatus")
+internal open class UniffiForeignFutureResultF64(
+    @JvmField internal var `returnValue`: Double = 0.0,
+    @JvmField internal var `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+) : Structure() {
+    class UniffiByValue(
+        `returnValue`: Double = 0.0,
+        `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+    ): UniffiForeignFutureResultF64(`returnValue`,`callStatus`,), Structure.ByValue
+
+   internal fun uniffiSetValue(other: UniffiForeignFutureResultF64) {
+        `returnValue` = other.`returnValue`
+        `callStatus` = other.`callStatus`
+    }
+
+}
+internal interface UniffiForeignFutureCompleteF64 : com.sun.jna.Callback {
+    fun callback(`callbackData`: Long,`result`: UniffiForeignFutureResultF64.UniffiByValue,)
+}
+@Structure.FieldOrder("returnValue", "callStatus")
+internal open class UniffiForeignFutureResultRustBuffer(
+    @JvmField internal var `returnValue`: RustBuffer.ByValue = RustBuffer.ByValue(),
+    @JvmField internal var `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+) : Structure() {
+    class UniffiByValue(
+        `returnValue`: RustBuffer.ByValue = RustBuffer.ByValue(),
+        `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+    ): UniffiForeignFutureResultRustBuffer(`returnValue`,`callStatus`,), Structure.ByValue
+
+   internal fun uniffiSetValue(other: UniffiForeignFutureResultRustBuffer) {
+        `returnValue` = other.`returnValue`
+        `callStatus` = other.`callStatus`
+    }
+
+}
+internal interface UniffiForeignFutureCompleteRustBuffer : com.sun.jna.Callback {
+    fun callback(`callbackData`: Long,`result`: UniffiForeignFutureResultRustBuffer.UniffiByValue,)
+}
+@Structure.FieldOrder("callStatus")
+internal open class UniffiForeignFutureResultVoid(
+    @JvmField internal var `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+) : Structure() {
+    class UniffiByValue(
+        `callStatus`: UniffiRustCallStatus.ByValue = UniffiRustCallStatus.ByValue(),
+    ): UniffiForeignFutureResultVoid(`callStatus`,), Structure.ByValue
+
+   internal fun uniffiSetValue(other: UniffiForeignFutureResultVoid) {
+        `callStatus` = other.`callStatus`
+    }
+
+}
+internal interface UniffiForeignFutureCompleteVoid : com.sun.jna.Callback {
+    fun callback(`callbackData`: Long,`result`: UniffiForeignFutureResultVoid.UniffiByValue,)
+}
+internal interface UniffiCallbackInterfaceAppReconcilerMethod0 : com.sun.jna.Callback {
+    fun callback(`uniffiHandle`: Long,`update`: RustBuffer.ByValue,`uniffiOutReturn`: Pointer,uniffiCallStatus: UniffiRustCallStatus,)
+}
+@Structure.FieldOrder("uniffiFree", "uniffiClone", "reconcile")
+internal open class UniffiVTableCallbackInterfaceAppReconciler(
+    @JvmField internal var `uniffiFree`: UniffiCallbackInterfaceFree? = null,
+    @JvmField internal var `uniffiClone`: UniffiCallbackInterfaceClone? = null,
+    @JvmField internal var `reconcile`: UniffiCallbackInterfaceAppReconcilerMethod0? = null,
+) : Structure() {
+    class UniffiByValue(
+        `uniffiFree`: UniffiCallbackInterfaceFree? = null,
+        `uniffiClone`: UniffiCallbackInterfaceClone? = null,
+        `reconcile`: UniffiCallbackInterfaceAppReconcilerMethod0? = null,
+    ): UniffiVTableCallbackInterfaceAppReconciler(`uniffiFree`,`uniffiClone`,`reconcile`,), Structure.ByValue
+
+   internal fun uniffiSetValue(other: UniffiVTableCallbackInterfaceAppReconciler) {
+        `uniffiFree` = other.`uniffiFree`
+        `uniffiClone` = other.`uniffiClone`
+        `reconcile` = other.`reconcile`
+    }
+
+}
+
+// A JNA Library to expose the extern-C FFI definitions.
+// This is an implementation detail which will be called internally by the public API.
+
+// For large crates we prevent `MethodTooLargeException` (see #2340)
+// N.B. the name of the extension is very misleading, since it is
+// rather `InterfaceTooLargeException`, caused by too many methods
+// in the interface for large crates.
+//
+// By splitting the otherwise huge interface into two parts
+// * UniffiLib (this)
+// * IntegrityCheckingUniffiLib
+// And all checksum methods are put into `IntegrityCheckingUniffiLib`
+// we allow for ~2x as many methods in the UniffiLib interface.
+//
+// Note: above all written when we used JNA's `loadIndirect` etc.
+// We now use JNA's "direct mapping" - unclear if same considerations apply exactly.
+internal object IntegrityCheckingUniffiLib {
+    init {
+        Native.register(IntegrityCheckingUniffiLib::class.java, findLibraryName(componentName = "maple_core"))
+        uniffiCheckContractApiVersion(this)
+        uniffiCheckApiChecksums(this)
+    }
+    external fun uniffi_maple_core_checksum_func_default_api_url(
+    ): Short
+    external fun uniffi_maple_core_checksum_method_ffiapp_dispatch(
+    ): Short
+    external fun uniffi_maple_core_checksum_method_ffiapp_listen_for_updates(
+    ): Short
+    external fun uniffi_maple_core_checksum_method_ffiapp_state(
+    ): Short
+    external fun uniffi_maple_core_checksum_constructor_ffiapp_new(
+    ): Short
+    external fun uniffi_maple_core_checksum_method_appreconciler_reconcile(
+    ): Short
+    external fun ffi_maple_core_uniffi_contract_version(
+    ): Int
+
+        
+}
+
+internal object UniffiLib {
+    
+    // The Cleaner for the whole library
+    internal val CLEANER: UniffiCleaner by lazy {
+        UniffiCleaner.create()
+    }
+    
+
+    init {
+        Native.register(UniffiLib::class.java, findLibraryName(componentName = "maple_core"))
+        uniffiCallbackInterfaceAppReconciler.register(this)
+        
+    }
+    external fun uniffi_maple_core_fn_clone_ffiapp(`handle`: Long,uniffi_out_err: UniffiRustCallStatus, 
+    ): Long
+    external fun uniffi_maple_core_fn_free_ffiapp(`handle`: Long,uniffi_out_err: UniffiRustCallStatus, 
+    ): Unit
+    external fun uniffi_maple_core_fn_constructor_ffiapp_new(`apiUrl`: RustBuffer.ByValue,`clientId`: RustBuffer.ByValue,`dataDir`: RustBuffer.ByValue,uniffi_out_err: UniffiRustCallStatus, 
+    ): Long
+    external fun uniffi_maple_core_fn_method_ffiapp_dispatch(`ptr`: Long,`action`: RustBuffer.ByValue,uniffi_out_err: UniffiRustCallStatus, 
+    ): Unit
+    external fun uniffi_maple_core_fn_method_ffiapp_listen_for_updates(`ptr`: Long,`reconciler`: Long,uniffi_out_err: UniffiRustCallStatus, 
+    ): Unit
+    external fun uniffi_maple_core_fn_method_ffiapp_state(`ptr`: Long,uniffi_out_err: UniffiRustCallStatus, 
+    ): RustBuffer.ByValue
+    external fun uniffi_maple_core_fn_init_callback_vtable_appreconciler(`vtable`: UniffiVTableCallbackInterfaceAppReconciler,
+    ): Unit
+    external fun uniffi_maple_core_fn_func_default_api_url(uniffi_out_err: UniffiRustCallStatus, 
+    ): RustBuffer.ByValue
+    external fun ffi_maple_core_rustbuffer_alloc(`size`: Long,uniffi_out_err: UniffiRustCallStatus, 
+    ): RustBuffer.ByValue
+    external fun ffi_maple_core_rustbuffer_from_bytes(`bytes`: ForeignBytes.ByValue,uniffi_out_err: UniffiRustCallStatus, 
+    ): RustBuffer.ByValue
+    external fun ffi_maple_core_rustbuffer_free(`buf`: RustBuffer.ByValue,uniffi_out_err: UniffiRustCallStatus, 
+    ): Unit
+    external fun ffi_maple_core_rustbuffer_reserve(`buf`: RustBuffer.ByValue,`additional`: Long,uniffi_out_err: UniffiRustCallStatus, 
+    ): RustBuffer.ByValue
+    external fun ffi_maple_core_rust_future_poll_u8(`handle`: Long,`callback`: UniffiRustFutureContinuationCallback,`callbackData`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_cancel_u8(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_free_u8(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_complete_u8(`handle`: Long,uniffi_out_err: UniffiRustCallStatus, 
+    ): Byte
+    external fun ffi_maple_core_rust_future_poll_i8(`handle`: Long,`callback`: UniffiRustFutureContinuationCallback,`callbackData`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_cancel_i8(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_free_i8(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_complete_i8(`handle`: Long,uniffi_out_err: UniffiRustCallStatus, 
+    ): Byte
+    external fun ffi_maple_core_rust_future_poll_u16(`handle`: Long,`callback`: UniffiRustFutureContinuationCallback,`callbackData`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_cancel_u16(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_free_u16(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_complete_u16(`handle`: Long,uniffi_out_err: UniffiRustCallStatus, 
+    ): Short
+    external fun ffi_maple_core_rust_future_poll_i16(`handle`: Long,`callback`: UniffiRustFutureContinuationCallback,`callbackData`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_cancel_i16(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_free_i16(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_complete_i16(`handle`: Long,uniffi_out_err: UniffiRustCallStatus, 
+    ): Short
+    external fun ffi_maple_core_rust_future_poll_u32(`handle`: Long,`callback`: UniffiRustFutureContinuationCallback,`callbackData`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_cancel_u32(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_free_u32(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_complete_u32(`handle`: Long,uniffi_out_err: UniffiRustCallStatus, 
+    ): Int
+    external fun ffi_maple_core_rust_future_poll_i32(`handle`: Long,`callback`: UniffiRustFutureContinuationCallback,`callbackData`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_cancel_i32(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_free_i32(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_complete_i32(`handle`: Long,uniffi_out_err: UniffiRustCallStatus, 
+    ): Int
+    external fun ffi_maple_core_rust_future_poll_u64(`handle`: Long,`callback`: UniffiRustFutureContinuationCallback,`callbackData`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_cancel_u64(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_free_u64(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_complete_u64(`handle`: Long,uniffi_out_err: UniffiRustCallStatus, 
+    ): Long
+    external fun ffi_maple_core_rust_future_poll_i64(`handle`: Long,`callback`: UniffiRustFutureContinuationCallback,`callbackData`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_cancel_i64(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_free_i64(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_complete_i64(`handle`: Long,uniffi_out_err: UniffiRustCallStatus, 
+    ): Long
+    external fun ffi_maple_core_rust_future_poll_f32(`handle`: Long,`callback`: UniffiRustFutureContinuationCallback,`callbackData`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_cancel_f32(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_free_f32(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_complete_f32(`handle`: Long,uniffi_out_err: UniffiRustCallStatus, 
+    ): Float
+    external fun ffi_maple_core_rust_future_poll_f64(`handle`: Long,`callback`: UniffiRustFutureContinuationCallback,`callbackData`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_cancel_f64(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_free_f64(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_complete_f64(`handle`: Long,uniffi_out_err: UniffiRustCallStatus, 
+    ): Double
+    external fun ffi_maple_core_rust_future_poll_rust_buffer(`handle`: Long,`callback`: UniffiRustFutureContinuationCallback,`callbackData`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_cancel_rust_buffer(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_free_rust_buffer(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_complete_rust_buffer(`handle`: Long,uniffi_out_err: UniffiRustCallStatus, 
+    ): RustBuffer.ByValue
+    external fun ffi_maple_core_rust_future_poll_void(`handle`: Long,`callback`: UniffiRustFutureContinuationCallback,`callbackData`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_cancel_void(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_free_void(`handle`: Long,
+    ): Unit
+    external fun ffi_maple_core_rust_future_complete_void(`handle`: Long,uniffi_out_err: UniffiRustCallStatus, 
+    ): Unit
+
+        
+}
+
+private fun uniffiCheckContractApiVersion(lib: IntegrityCheckingUniffiLib) {
+    // Get the bindings contract version from our ComponentInterface
+    val bindings_contract_version = 30
+    // Get the scaffolding contract version by calling the into the dylib
+    val scaffolding_contract_version = lib.ffi_maple_core_uniffi_contract_version()
+    if (bindings_contract_version != scaffolding_contract_version) {
+        throw RuntimeException("UniFFI contract version mismatch: try cleaning and rebuilding your project")
+    }
+}
+@Suppress("UNUSED_PARAMETER")
+private fun uniffiCheckApiChecksums(lib: IntegrityCheckingUniffiLib) {
+    if (lib.uniffi_maple_core_checksum_func_default_api_url() != 29239.toShort()) {
+        throw RuntimeException("UniFFI API checksum mismatch: try cleaning and rebuilding your project")
+    }
+    if (lib.uniffi_maple_core_checksum_method_ffiapp_dispatch() != 27078.toShort()) {
+        throw RuntimeException("UniFFI API checksum mismatch: try cleaning and rebuilding your project")
+    }
+    if (lib.uniffi_maple_core_checksum_method_ffiapp_listen_for_updates() != 63526.toShort()) {
+        throw RuntimeException("UniFFI API checksum mismatch: try cleaning and rebuilding your project")
+    }
+    if (lib.uniffi_maple_core_checksum_method_ffiapp_state() != 13593.toShort()) {
+        throw RuntimeException("UniFFI API checksum mismatch: try cleaning and rebuilding your project")
+    }
+    if (lib.uniffi_maple_core_checksum_constructor_ffiapp_new() != 52040.toShort()) {
+        throw RuntimeException("UniFFI API checksum mismatch: try cleaning and rebuilding your project")
+    }
+    if (lib.uniffi_maple_core_checksum_method_appreconciler_reconcile() != 25035.toShort()) {
+        throw RuntimeException("UniFFI API checksum mismatch: try cleaning and rebuilding your project")
+    }
+}
+
+/**
+ * @suppress
+ */
+public fun uniffiEnsureInitialized() {
+    IntegrityCheckingUniffiLib
+    // UniffiLib() initialized as objects are used, but we still need to explicitly
+    // reference it so initialization across crates works as expected.
+    UniffiLib
+}
+
+// Async support
+
+// Public interface members begin here.
+
+
+// Interface implemented by anything that can contain an object reference.
+//
+// Such types expose a `destroy()` method that must be called to cleanly
+// dispose of the contained objects. Failure to call this method may result
+// in memory leaks.
+//
+// The easiest way to ensure this method is called is to use the `.use`
+// helper method to execute a block and destroy the object at the end.
+interface Disposable {
+    fun destroy()
+    companion object {
+        fun destroy(vararg args: Any?) {
+            for (arg in args) {
+                when (arg) {
+                    is Disposable -> arg.destroy()
+                    is ArrayList<*> -> {
+                        for (idx in arg.indices) {
+                            val element = arg[idx]
+                            if (element is Disposable) {
+                                element.destroy()
+                            }
+                        }
+                    }
+                    is Map<*, *> -> {
+                        for (element in arg.values) {
+                            if (element is Disposable) {
+                                element.destroy()
+                            }
+                        }
+                    }
+                    is Iterable<*> -> {
+                        for (element in arg) {
+                            if (element is Disposable) {
+                                element.destroy()
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+/**
+ * @suppress
+ */
+inline fun <T : Disposable?, R> T.use(block: (T) -> R) =
+    try {
+        block(this)
+    } finally {
+        try {
+            // N.B. our implementation is on the nullable type `Disposable?`.
+            this?.destroy()
+        } catch (e: Throwable) {
+            // swallow
+        }
+    }
+
+/** 
+ * Placeholder object used to signal that we're constructing an interface with a FFI handle.
+ *
+ * This is the first argument for interface constructors that input a raw handle. It exists is that
+ * so we can avoid signature conflicts when an interface has a regular constructor than inputs a
+ * Long.
+ *
+ * @suppress
+ * */
+object UniffiWithHandle
+
+/** 
+ * Used to instantiate an interface without an actual pointer, for fakes in tests, mostly.
+ *
+ * @suppress
+ * */
+object NoHandle// Magic number for the Rust proxy to call using the same mechanism as every other method,
+// to free the callback once it's dropped by Rust.
+internal const val IDX_CALLBACK_FREE = 0
+// Callback return codes
+internal const val UNIFFI_CALLBACK_SUCCESS = 0
+internal const val UNIFFI_CALLBACK_ERROR = 1
+internal const val UNIFFI_CALLBACK_UNEXPECTED_ERROR = 2
+
+/**
+ * @suppress
+ */
+public abstract class FfiConverterCallbackInterface<CallbackInterface: Any>: FfiConverter<CallbackInterface, Long> {
+    internal val handleMap = UniffiHandleMap<CallbackInterface>()
+
+    internal fun drop(handle: Long) {
+        handleMap.remove(handle)
+    }
+
+    override fun lift(value: Long): CallbackInterface {
+        return handleMap.get(value)
+    }
+
+    override fun read(buf: ByteBuffer) = lift(buf.getLong())
+
+    override fun lower(value: CallbackInterface) = handleMap.insert(value)
+
+    override fun allocationSize(value: CallbackInterface) = 8UL
+
+    override fun write(value: CallbackInterface, buf: ByteBuffer) {
+        buf.putLong(lower(value))
+    }
+}
+/**
+ * The cleaner interface for Object finalization code to run.
+ * This is the entry point to any implementation that we're using.
+ *
+ * The cleaner registers objects and returns cleanables, so now we are
+ * defining a `UniffiCleaner` with a `UniffiClenaer.Cleanable` to abstract the
+ * different implmentations available at compile time.
+ *
+ * @suppress
+ */
+interface UniffiCleaner {
+    interface Cleanable {
+        fun clean()
+    }
+
+    fun register(value: Any, cleanUpTask: Runnable): UniffiCleaner.Cleanable
+
+    companion object
+}
+
+// The fallback Jna cleaner, which is available for both Android, and the JVM.
+private class UniffiJnaCleaner : UniffiCleaner {
+    private val cleaner = com.sun.jna.internal.Cleaner.getCleaner()
+
+    override fun register(value: Any, cleanUpTask: Runnable): UniffiCleaner.Cleanable =
+        UniffiJnaCleanable(cleaner.register(value, cleanUpTask))
+}
+
+private class UniffiJnaCleanable(
+    private val cleanable: com.sun.jna.internal.Cleaner.Cleanable,
+) : UniffiCleaner.Cleanable {
+    override fun clean() = cleanable.clean()
+}
+
+
+// We decide at uniffi binding generation time whether we were
+// using Android or not.
+// There are further runtime checks to chose the correct implementation
+// of the cleaner.
+private fun UniffiCleaner.Companion.create(): UniffiCleaner =
+    try {
+        // For safety's sake: if the library hasn't been run in android_cleaner = true
+        // mode, but is being run on Android, then we still need to think about
+        // Android API versions.
+        // So we check if java.lang.ref.Cleaner is there, and use that…
+        java.lang.Class.forName("java.lang.ref.Cleaner")
+        JavaLangRefCleaner()
+    } catch (e: ClassNotFoundException) {
+        // … otherwise, fallback to the JNA cleaner.
+        UniffiJnaCleaner()
+    }
+
+private class JavaLangRefCleaner : UniffiCleaner {
+    val cleaner = java.lang.ref.Cleaner.create()
+
+    override fun register(value: Any, cleanUpTask: Runnable): UniffiCleaner.Cleanable =
+        JavaLangRefCleanable(cleaner.register(value, cleanUpTask))
+}
+
+private class JavaLangRefCleanable(
+    val cleanable: java.lang.ref.Cleaner.Cleanable
+) : UniffiCleaner.Cleanable {
+    override fun clean() = cleanable.clean()
+}
+
+/**
+ * @suppress
+ */
+public object FfiConverterULong: FfiConverter<ULong, Long> {
+    override fun lift(value: Long): ULong {
+        return value.toULong()
+    }
+
+    override fun read(buf: ByteBuffer): ULong {
+        return lift(buf.getLong())
+    }
+
+    override fun lower(value: ULong): Long {
+        return value.toLong()
+    }
+
+    override fun allocationSize(value: ULong) = 8UL
+
+    override fun write(value: ULong, buf: ByteBuffer) {
+        buf.putLong(value.toLong())
+    }
+}
+
+/**
+ * @suppress
+ */
+public object FfiConverterLong: FfiConverter<Long, Long> {
+    override fun lift(value: Long): Long {
+        return value
+    }
+
+    override fun read(buf: ByteBuffer): Long {
+        return buf.getLong()
+    }
+
+    override fun lower(value: Long): Long {
+        return value
+    }
+
+    override fun allocationSize(value: Long) = 8UL
+
+    override fun write(value: Long, buf: ByteBuffer) {
+        buf.putLong(value)
+    }
+}
+
+/**
+ * @suppress
+ */
+public object FfiConverterBoolean: FfiConverter<Boolean, Byte> {
+    override fun lift(value: Byte): Boolean {
+        return value.toInt() != 0
+    }
+
+    override fun read(buf: ByteBuffer): Boolean {
+        return lift(buf.get())
+    }
+
+    override fun lower(value: Boolean): Byte {
+        return if (value) 1.toByte() else 0.toByte()
+    }
+
+    override fun allocationSize(value: Boolean) = 1UL
+
+    override fun write(value: Boolean, buf: ByteBuffer) {
+        buf.put(lower(value))
+    }
+}
+
+/**
+ * @suppress
+ */
+public object FfiConverterString: FfiConverter<String, RustBuffer.ByValue> {
+    // Note: we don't inherit from FfiConverterRustBuffer, because we use a
+    // special encoding when lowering/lifting.  We can use `RustBuffer.len` to
+    // store our length and avoid writing it out to the buffer.
+    override fun lift(value: RustBuffer.ByValue): String {
+        try {
+            val byteArr = ByteArray(value.len.toInt())
+            value.asByteBuffer()!!.get(byteArr)
+            return byteArr.toString(Charsets.UTF_8)
+        } finally {
+            RustBuffer.free(value)
+        }
+    }
+
+    override fun read(buf: ByteBuffer): String {
+        val len = buf.getInt()
+        val byteArr = ByteArray(len)
+        buf.get(byteArr)
+        return byteArr.toString(Charsets.UTF_8)
+    }
+
+    fun toUtf8(value: String): ByteBuffer {
+        // Make sure we don't have invalid UTF-16, check for lone surrogates.
+        return Charsets.UTF_8.newEncoder().run {
+            onMalformedInput(CodingErrorAction.REPORT)
+            encode(CharBuffer.wrap(value))
+        }
+    }
+
+    override fun lower(value: String): RustBuffer.ByValue {
+        val byteBuf = toUtf8(value)
+        // Ideally we'd pass these bytes to `ffi_bytebuffer_from_bytes`, but doing so would require us
+        // to copy them into a JNA `Memory`. So we might as well directly copy them into a `RustBuffer`.
+        val rbuf = RustBuffer.alloc(byteBuf.limit().toULong())
+        rbuf.asByteBuffer()!!.put(byteBuf)
+        return rbuf
+    }
+
+    // We aren't sure exactly how many bytes our string will be once it's UTF-8
+    // encoded.  Allocate 3 bytes per UTF-16 code unit which will always be
+    // enough.
+    override fun allocationSize(value: String): ULong {
+        val sizeForLength = 4UL
+        val sizeForString = value.length.toULong() * 3UL
+        return sizeForLength + sizeForString
+    }
+
+    override fun write(value: String, buf: ByteBuffer) {
+        val byteBuf = toUtf8(value)
+        buf.putInt(byteBuf.limit())
+        buf.put(byteBuf)
+    }
+}
+
+
+// This template implements a class for working with a Rust struct via a handle
+// to the live Rust struct on the other side of the FFI.
+//
+// There's some subtlety here, because we have to be careful not to operate on a Rust
+// struct after it has been dropped, and because we must expose a public API for freeing
+// theq Kotlin wrapper object in lieu of reliable finalizers. The core requirements are:
+//
+//   * Each instance holds an opaque handle to the underlying Rust struct.
+//     Method calls need to read this handle from the object's state and pass it in to
+//     the Rust FFI.
+//
+//   * When an instance is no longer needed, its handle should be passed to a
+//     special destructor function provided by the Rust FFI, which will drop the
+//     underlying Rust struct.
+//
+//   * Given an instance, calling code is expected to call the special
+//     `destroy` method in order to free it after use, either by calling it explicitly
+//     or by using a higher-level helper like the `use` method. Failing to do so risks
+//     leaking the underlying Rust struct.
+//
+//   * We can't assume that calling code will do the right thing, and must be prepared
+//     to handle Kotlin method calls executing concurrently with or even after a call to
+//     `destroy`, and to handle multiple (possibly concurrent!) calls to `destroy`.
+//
+//   * We must never allow Rust code to operate on the underlying Rust struct after
+//     the destructor has been called, and must never call the destructor more than once.
+//     Doing so may trigger memory unsafety.
+//
+//   * To mitigate many of the risks of leaking memory and use-after-free unsafety, a `Cleaner`
+//     is implemented to call the destructor when the Kotlin object becomes unreachable.
+//     This is done in a background thread. This is not a panacea, and client code should be aware that
+//      1. the thread may starve if some there are objects that have poorly performing
+//     `drop` methods or do significant work in their `drop` methods.
+//      2. the thread is shared across the whole library. This can be tuned by using `android_cleaner = true`,
+//         or `android = true` in the [`kotlin` section of the `uniffi.toml` file](https://mozilla.github.io/uniffi-rs/kotlin/configuration.html).
+//
+// If we try to implement this with mutual exclusion on access to the handle, there is the
+// possibility of a race between a method call and a concurrent call to `destroy`:
+//
+//    * Thread A starts a method call, reads the value of the handle, but is interrupted
+//      before it can pass the handle over the FFI to Rust.
+//    * Thread B calls `destroy` and frees the underlying Rust struct.
+//    * Thread A resumes, passing the already-read handle value to Rust and triggering
+//      a use-after-free.
+//
+// One possible solution would be to use a `ReadWriteLock`, with each method call taking
+// a read lock (and thus allowed to run concurrently) and the special `destroy` method
+// taking a write lock (and thus blocking on live method calls). However, we aim not to
+// generate methods with any hidden blocking semantics, and a `destroy` method that might
+// block if called incorrectly seems to meet that bar.
+//
+// So, we achieve our goals by giving each instance an associated `AtomicLong` counter to track
+// the number of in-flight method calls, and an `AtomicBoolean` flag to indicate whether `destroy`
+// has been called. These are updated according to the following rules:
+//
+//    * The initial value of the counter is 1, indicating a live object with no in-flight calls.
+//      The initial value for the flag is false.
+//
+//    * At the start of each method call, we atomically check the counter.
+//      If it is 0 then the underlying Rust struct has already been destroyed and the call is aborted.
+//      If it is nonzero them we atomically increment it by 1 and proceed with the method call.
+//
+//    * At the end of each method call, we atomically decrement and check the counter.
+//      If it has reached zero then we destroy the underlying Rust struct.
+//
+//    * When `destroy` is called, we atomically flip the flag from false to true.
+//      If the flag was already true we silently fail.
+//      Otherwise we atomically decrement and check the counter.
+//      If it has reached zero then we destroy the underlying Rust struct.
+//
+// Astute readers may observe that this all sounds very similar to the way that Rust's `Arc<T>` works,
+// and indeed it is, with the addition of a flag to guard against multiple calls to `destroy`.
+//
+// The overall effect is that the underlying Rust struct is destroyed only when `destroy` has been
+// called *and* all in-flight method calls have completed, avoiding violating any of the expectations
+// of the underlying Rust code.
+//
+// This makes a cleaner a better alternative to _not_ calling `destroy()` as
+// and when the object is finished with, but the abstraction is not perfect: if the Rust object's `drop`
+// method is slow, and/or there are many objects to cleanup, and it's on a low end Android device, then the cleaner
+// thread may be starved, and the app will leak memory.
+//
+// In this case, `destroy`ing manually may be a better solution.
+//
+// The cleaner can live side by side with the manual calling of `destroy`. In the order of responsiveness, uniffi objects
+// with Rust peers are reclaimed:
+//
+// 1. By calling the `destroy` method of the object, which calls `rustObject.free()`. If that doesn't happen:
+// 2. When the object becomes unreachable, AND the Cleaner thread gets to call `rustObject.free()`. If the thread is starved then:
+// 3. The memory is reclaimed when the process terminates.
+//
+// [1] https://stackoverflow.com/questions/24376768/can-java-finalize-an-object-when-it-is-still-in-scope/24380219
+//
+
+
+public interface FfiAppInterface {
+    
+    fun `dispatch`(`action`: AppAction)
+    
+    fun `listenForUpdates`(`reconciler`: AppReconciler)
+    
+    fun `state`(): AppState
+    
+    companion object
+}
+
+open class FfiApp: Disposable, AutoCloseable, FfiAppInterface
+{
+
+    @Suppress("UNUSED_PARAMETER")
+    /**
+     * @suppress
+     */
+    constructor(withHandle: UniffiWithHandle, handle: Long) {
+        this.handle = handle
+        this.cleanable = UniffiLib.CLEANER.register(this, UniffiCleanAction(handle))
+    }
+
+    /**
+     * @suppress
+     *
+     * This constructor can be used to instantiate a fake object. Only used for tests. Any
+     * attempt to actually use an object constructed this way will fail as there is no
+     * connected Rust object.
+     */
+    @Suppress("UNUSED_PARAMETER")
+    constructor(noHandle: NoHandle) {
+        this.handle = 0
+        this.cleanable = null
+    }
+    constructor(`apiUrl`: kotlin.String, `clientId`: kotlin.String, `dataDir`: kotlin.String) :
+        this(UniffiWithHandle, 
+    uniffiRustCall() { _status ->
+    UniffiLib.uniffi_maple_core_fn_constructor_ffiapp_new(
+    
+        FfiConverterString.lower(`apiUrl`),FfiConverterString.lower(`clientId`),FfiConverterString.lower(`dataDir`),_status)
+}
+    )
+
+    protected val handle: Long
+    protected val cleanable: UniffiCleaner.Cleanable?
+
+    private val wasDestroyed = AtomicBoolean(false)
+    private val callCounter = AtomicLong(1)
+
+    override fun destroy() {
+        // Only allow a single call to this method.
+        // TODO: maybe we should log a warning if called more than once?
+        if (this.wasDestroyed.compareAndSet(false, true)) {
+            // This decrement always matches the initial count of 1 given at creation time.
+            if (this.callCounter.decrementAndGet() == 0L) {
+                cleanable?.clean()
+            }
+        }
+    }
+
+    @Synchronized
+    override fun close() {
+        this.destroy()
+    }
+
+    internal inline fun <R> callWithHandle(block: (handle: Long) -> R): R {
+        // Check and increment the call counter, to keep the object alive.
+        // This needs a compare-and-set retry loop in case of concurrent updates.
+        do {
+            val c = this.callCounter.get()
+            if (c == 0L) {
+                throw IllegalStateException("${this.javaClass.simpleName} object has already been destroyed")
+            }
+            if (c == Long.MAX_VALUE) {
+                throw IllegalStateException("${this.javaClass.simpleName} call counter would overflow")
+            }
+        } while (! this.callCounter.compareAndSet(c, c + 1L))
+        // Now we can safely do the method call without the handle being freed concurrently.
+        try {
+            return block(this.uniffiCloneHandle())
+        } finally {
+            // This decrement always matches the increment we performed above.
+            if (this.callCounter.decrementAndGet() == 0L) {
+                cleanable?.clean()
+            }
+        }
+    }
+
+    // Use a static inner class instead of a closure so as not to accidentally
+    // capture `this` as part of the cleanable's action.
+    private class UniffiCleanAction(private val handle: Long) : Runnable {
+        override fun run() {
+            if (handle == 0.toLong()) {
+                // Fake object created with `NoHandle`, don't try to free.
+                return;
+            }
+            uniffiRustCall { status ->
+                UniffiLib.uniffi_maple_core_fn_free_ffiapp(handle, status)
+            }
+        }
+    }
+
+    /**
+     * @suppress
+     */
+    fun uniffiCloneHandle(): Long {
+        if (handle == 0.toLong()) {
+            throw InternalException("uniffiCloneHandle() called on NoHandle object");
+        }
+        return uniffiRustCall() { status ->
+            UniffiLib.uniffi_maple_core_fn_clone_ffiapp(handle, status)
+        }
+    }
+
+    override fun `dispatch`(`action`: AppAction)
+        = 
+    callWithHandle {
+    uniffiRustCall() { _status ->
+    UniffiLib.uniffi_maple_core_fn_method_ffiapp_dispatch(
+        it,
+        FfiConverterTypeAppAction.lower(`action`),_status)
+}
+    }
+    
+    
+
+    override fun `listenForUpdates`(`reconciler`: AppReconciler)
+        = 
+    callWithHandle {
+    uniffiRustCall() { _status ->
+    UniffiLib.uniffi_maple_core_fn_method_ffiapp_listen_for_updates(
+        it,
+        FfiConverterTypeAppReconciler.lower(`reconciler`),_status)
+}
+    }
+    
+    
+
+    override fun `state`(): AppState {
+            return FfiConverterTypeAppState.lift(
+    callWithHandle {
+    uniffiRustCall() { _status ->
+    UniffiLib.uniffi_maple_core_fn_method_ffiapp_state(
+        it,
+        _status)
+}
+    }
+    )
+    }
+    
+
+    
+
+    
+
+
+    
+    
+    /**
+     * @suppress
+     */
+    companion object
+    
+}
+
+
+/**
+ * @suppress
+ */
+public object FfiConverterTypeFfiApp: FfiConverter<FfiApp, Long> {
+    override fun lower(value: FfiApp): Long {
+        return value.uniffiCloneHandle()
+    }
+
+    override fun lift(value: Long): FfiApp {
+        return FfiApp(UniffiWithHandle, value)
+    }
+
+    override fun read(buf: ByteBuffer): FfiApp {
+        return lift(buf.getLong())
+    }
+
+    override fun allocationSize(value: FfiApp) = 8UL
+
+    override fun write(value: FfiApp, buf: ByteBuffer) {
+        buf.putLong(lower(value))
+    }
+}
+
+
+
+data class AppState (
+    var `rev`: kotlin.ULong
+    , 
+    var `auth`: AuthState
+    , 
+    var `pendingAuthUrl`: kotlin.String?
+    , 
+    var `router`: Router
+    , 
+    var `messages`: List<ChatMessage>
+    , 
+    var `isAgentTyping`: kotlin.Boolean
+    , 
+    var `isLoadingHistory`: kotlin.Boolean
+    , 
+    var `hasOlderMessages`: kotlin.Boolean
+    , 
+    var `composeText`: kotlin.String
+    , 
+    var `toast`: kotlin.String?
+    , 
+    var `showSettings`: kotlin.Boolean
+    , 
+    var `confirmDeleteAgent`: kotlin.Boolean
+    , 
+    var `isDeletingAgent`: kotlin.Boolean
+    
+){
+    
+
+    
+
+    
+    companion object
+}
+
+/**
+ * @suppress
+ */
+public object FfiConverterTypeAppState: FfiConverterRustBuffer<AppState> {
+    override fun read(buf: ByteBuffer): AppState {
+        return AppState(
+            FfiConverterULong.read(buf),
+            FfiConverterTypeAuthState.read(buf),
+            FfiConverterOptionalString.read(buf),
+            FfiConverterTypeRouter.read(buf),
+            FfiConverterSequenceTypeChatMessage.read(buf),
+            FfiConverterBoolean.read(buf),
+            FfiConverterBoolean.read(buf),
+            FfiConverterBoolean.read(buf),
+            FfiConverterString.read(buf),
+            FfiConverterOptionalString.read(buf),
+            FfiConverterBoolean.read(buf),
+            FfiConverterBoolean.read(buf),
+            FfiConverterBoolean.read(buf),
+        )
+    }
+
+    override fun allocationSize(value: AppState) = (
+            FfiConverterULong.allocationSize(value.`rev`) +
+            FfiConverterTypeAuthState.allocationSize(value.`auth`) +
+            FfiConverterOptionalString.allocationSize(value.`pendingAuthUrl`) +
+            FfiConverterTypeRouter.allocationSize(value.`router`) +
+            FfiConverterSequenceTypeChatMessage.allocationSize(value.`messages`) +
+            FfiConverterBoolean.allocationSize(value.`isAgentTyping`) +
+            FfiConverterBoolean.allocationSize(value.`isLoadingHistory`) +
+            FfiConverterBoolean.allocationSize(value.`hasOlderMessages`) +
+            FfiConverterString.allocationSize(value.`composeText`) +
+            FfiConverterOptionalString.allocationSize(value.`toast`) +
+            FfiConverterBoolean.allocationSize(value.`showSettings`) +
+            FfiConverterBoolean.allocationSize(value.`confirmDeleteAgent`) +
+            FfiConverterBoolean.allocationSize(value.`isDeletingAgent`)
+    )
+
+    override fun write(value: AppState, buf: ByteBuffer) {
+            FfiConverterULong.write(value.`rev`, buf)
+            FfiConverterTypeAuthState.write(value.`auth`, buf)
+            FfiConverterOptionalString.write(value.`pendingAuthUrl`, buf)
+            FfiConverterTypeRouter.write(value.`router`, buf)
+            FfiConverterSequenceTypeChatMessage.write(value.`messages`, buf)
+            FfiConverterBoolean.write(value.`isAgentTyping`, buf)
+            FfiConverterBoolean.write(value.`isLoadingHistory`, buf)
+            FfiConverterBoolean.write(value.`hasOlderMessages`, buf)
+            FfiConverterString.write(value.`composeText`, buf)
+            FfiConverterOptionalString.write(value.`toast`, buf)
+            FfiConverterBoolean.write(value.`showSettings`, buf)
+            FfiConverterBoolean.write(value.`confirmDeleteAgent`, buf)
+            FfiConverterBoolean.write(value.`isDeletingAgent`, buf)
+    }
+}
+
+
+
+data class ChatMessage (
+    var `id`: kotlin.String
+    , 
+    var `content`: kotlin.String
+    , 
+    var `isUser`: kotlin.Boolean
+    , 
+    var `isStreaming`: kotlin.Boolean
+    , 
+    var `timestamp`: kotlin.Long
+    , 
+    var `timestampDisplay`: kotlin.String
+    , 
+    var `showSender`: kotlin.Boolean
+    , 
+    var `showTimestamp`: kotlin.Boolean
+    
+){
+    
+
+    
+
+    
+    companion object
+}
+
+/**
+ * @suppress
+ */
+public object FfiConverterTypeChatMessage: FfiConverterRustBuffer<ChatMessage> {
+    override fun read(buf: ByteBuffer): ChatMessage {
+        return ChatMessage(
+            FfiConverterString.read(buf),
+            FfiConverterString.read(buf),
+            FfiConverterBoolean.read(buf),
+            FfiConverterBoolean.read(buf),
+            FfiConverterLong.read(buf),
+            FfiConverterString.read(buf),
+            FfiConverterBoolean.read(buf),
+            FfiConverterBoolean.read(buf),
+        )
+    }
+
+    override fun allocationSize(value: ChatMessage) = (
+            FfiConverterString.allocationSize(value.`id`) +
+            FfiConverterString.allocationSize(value.`content`) +
+            FfiConverterBoolean.allocationSize(value.`isUser`) +
+            FfiConverterBoolean.allocationSize(value.`isStreaming`) +
+            FfiConverterLong.allocationSize(value.`timestamp`) +
+            FfiConverterString.allocationSize(value.`timestampDisplay`) +
+            FfiConverterBoolean.allocationSize(value.`showSender`) +
+            FfiConverterBoolean.allocationSize(value.`showTimestamp`)
+    )
+
+    override fun write(value: ChatMessage, buf: ByteBuffer) {
+            FfiConverterString.write(value.`id`, buf)
+            FfiConverterString.write(value.`content`, buf)
+            FfiConverterBoolean.write(value.`isUser`, buf)
+            FfiConverterBoolean.write(value.`isStreaming`, buf)
+            FfiConverterLong.write(value.`timestamp`, buf)
+            FfiConverterString.write(value.`timestampDisplay`, buf)
+            FfiConverterBoolean.write(value.`showSender`, buf)
+            FfiConverterBoolean.write(value.`showTimestamp`, buf)
+    }
+}
+
+
+
+data class Router (
+    var `defaultScreen`: Screen
+    , 
+    var `screenStack`: List<Screen>
+    
+){
+    
+
+    
+
+    
+    companion object
+}
+
+/**
+ * @suppress
+ */
+public object FfiConverterTypeRouter: FfiConverterRustBuffer<Router> {
+    override fun read(buf: ByteBuffer): Router {
+        return Router(
+            FfiConverterTypeScreen.read(buf),
+            FfiConverterSequenceTypeScreen.read(buf),
+        )
+    }
+
+    override fun allocationSize(value: Router) = (
+            FfiConverterTypeScreen.allocationSize(value.`defaultScreen`) +
+            FfiConverterSequenceTypeScreen.allocationSize(value.`screenStack`)
+    )
+
+    override fun write(value: Router, buf: ByteBuffer) {
+            FfiConverterTypeScreen.write(value.`defaultScreen`, buf)
+            FfiConverterSequenceTypeScreen.write(value.`screenStack`, buf)
+    }
+}
+
+
+
+sealed class AppAction {
+    
+    data class LoginWithEmail(
+        val `email`: kotlin.String, 
+        val `password`: kotlin.String) : AppAction()
+        
+    {
+        
+
+        companion object
+    }
+    
+    data class SignUpWithEmail(
+        val `email`: kotlin.String, 
+        val `password`: kotlin.String, 
+        val `name`: kotlin.String) : AppAction()
+        
+    {
+        
+
+        companion object
+    }
+    
+    data class InitiateOAuth(
+        val `provider`: cloud.opensecret.maple.rust.OAuthProvider, 
+        val `inviteCode`: kotlin.String?) : AppAction()
+        
+    {
+        
+
+        companion object
+    }
+    
+    data class HandleOAuthCallback(
+        val `provider`: cloud.opensecret.maple.rust.OAuthProvider, 
+        val `code`: kotlin.String, 
+        val `state`: kotlin.String, 
+        val `inviteCode`: kotlin.String) : AppAction()
+        
+    {
+        
+
+        companion object
+    }
+    
+    data class RestoreSession(
+        val `accessToken`: kotlin.String,
+        val `refreshToken`: kotlin.String) : AppAction()
+
+    {
+        
+
+        companion object
+    }
+    
+    object CompleteStartup : AppAction()
+
+
+    object ClearPendingAuthUrl : AppAction()
+    
+    
+    object Logout : AppAction()
+    
+    
+    data class SendMessage(
+        val `content`: kotlin.String) : AppAction()
+        
+    {
+        
+
+        companion object
+    }
+    
+    object LoadOlderMessages : AppAction()
+    
+    
+    object RefreshTimestamps : AppAction()
+    
+    
+    object ClearToast : AppAction()
+    
+    
+    object ToggleSettings : AppAction()
+    
+    
+    object RequestDeleteAgent : AppAction()
+    
+    
+    object ConfirmDeleteAgent : AppAction()
+    
+    
+    object CancelDeleteAgent : AppAction()
+    
+    
+
+    
+
+    
+    
+
+
+    companion object
+}
+
+/**
+ * @suppress
+ */
+public object FfiConverterTypeAppAction : FfiConverterRustBuffer<AppAction>{
+    override fun read(buf: ByteBuffer): AppAction {
+        return when(buf.getInt()) {
+            1 -> AppAction.LoginWithEmail(
+                FfiConverterString.read(buf),
+                FfiConverterString.read(buf),
+                )
+            2 -> AppAction.SignUpWithEmail(
+                FfiConverterString.read(buf),
+                FfiConverterString.read(buf),
+                FfiConverterString.read(buf),
+                )
+            3 -> AppAction.InitiateOAuth(
+                FfiConverterTypeOAuthProvider.read(buf),
+                FfiConverterOptionalString.read(buf),
+                )
+            4 -> AppAction.HandleOAuthCallback(
+                FfiConverterTypeOAuthProvider.read(buf),
+                FfiConverterString.read(buf),
+                FfiConverterString.read(buf),
+                FfiConverterString.read(buf),
+                )
+            5 -> AppAction.RestoreSession(
+                FfiConverterString.read(buf),
+                FfiConverterString.read(buf),
+                )
+            6 -> AppAction.CompleteStartup
+            7 -> AppAction.ClearPendingAuthUrl
+            8 -> AppAction.Logout
+            9 -> AppAction.SendMessage(
+                FfiConverterString.read(buf),
+                )
+            10 -> AppAction.LoadOlderMessages
+            11 -> AppAction.RefreshTimestamps
+            12 -> AppAction.ClearToast
+            13 -> AppAction.ToggleSettings
+            14 -> AppAction.RequestDeleteAgent
+            15 -> AppAction.ConfirmDeleteAgent
+            16 -> AppAction.CancelDeleteAgent
+            else -> throw RuntimeException("invalid enum value, something is very wrong!!")
+        }
+    }
+
+    override fun allocationSize(value: AppAction) = when(value) {
+        is AppAction.LoginWithEmail -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+                + FfiConverterString.allocationSize(value.`email`)
+                + FfiConverterString.allocationSize(value.`password`)
+            )
+        }
+        is AppAction.SignUpWithEmail -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+                + FfiConverterString.allocationSize(value.`email`)
+                + FfiConverterString.allocationSize(value.`password`)
+                + FfiConverterString.allocationSize(value.`name`)
+            )
+        }
+        is AppAction.InitiateOAuth -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+                + FfiConverterTypeOAuthProvider.allocationSize(value.`provider`)
+                + FfiConverterOptionalString.allocationSize(value.`inviteCode`)
+            )
+        }
+        is AppAction.HandleOAuthCallback -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+                + FfiConverterTypeOAuthProvider.allocationSize(value.`provider`)
+                + FfiConverterString.allocationSize(value.`code`)
+                + FfiConverterString.allocationSize(value.`state`)
+                + FfiConverterString.allocationSize(value.`inviteCode`)
+            )
+        }
+        is AppAction.RestoreSession -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+                + FfiConverterString.allocationSize(value.`accessToken`)
+                + FfiConverterString.allocationSize(value.`refreshToken`)
+            )
+        }
+        is AppAction.CompleteStartup -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+            )
+        }
+        is AppAction.ClearPendingAuthUrl -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+            )
+        }
+        is AppAction.Logout -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+            )
+        }
+        is AppAction.SendMessage -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+                + FfiConverterString.allocationSize(value.`content`)
+            )
+        }
+        is AppAction.LoadOlderMessages -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+            )
+        }
+        is AppAction.RefreshTimestamps -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+            )
+        }
+        is AppAction.ClearToast -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+            )
+        }
+        is AppAction.ToggleSettings -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+            )
+        }
+        is AppAction.RequestDeleteAgent -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+            )
+        }
+        is AppAction.ConfirmDeleteAgent -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+            )
+        }
+        is AppAction.CancelDeleteAgent -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+            )
+        }
+    }
+
+    override fun write(value: AppAction, buf: ByteBuffer) {
+        when(value) {
+            is AppAction.LoginWithEmail -> {
+                buf.putInt(1)
+                FfiConverterString.write(value.`email`, buf)
+                FfiConverterString.write(value.`password`, buf)
+                Unit
+            }
+            is AppAction.SignUpWithEmail -> {
+                buf.putInt(2)
+                FfiConverterString.write(value.`email`, buf)
+                FfiConverterString.write(value.`password`, buf)
+                FfiConverterString.write(value.`name`, buf)
+                Unit
+            }
+            is AppAction.InitiateOAuth -> {
+                buf.putInt(3)
+                FfiConverterTypeOAuthProvider.write(value.`provider`, buf)
+                FfiConverterOptionalString.write(value.`inviteCode`, buf)
+                Unit
+            }
+            is AppAction.HandleOAuthCallback -> {
+                buf.putInt(4)
+                FfiConverterTypeOAuthProvider.write(value.`provider`, buf)
+                FfiConverterString.write(value.`code`, buf)
+                FfiConverterString.write(value.`state`, buf)
+                FfiConverterString.write(value.`inviteCode`, buf)
+                Unit
+            }
+            is AppAction.RestoreSession -> {
+                buf.putInt(5)
+                FfiConverterString.write(value.`accessToken`, buf)
+                FfiConverterString.write(value.`refreshToken`, buf)
+                Unit
+            }
+            is AppAction.CompleteStartup -> {
+                buf.putInt(6)
+                Unit
+            }
+            is AppAction.ClearPendingAuthUrl -> {
+                buf.putInt(7)
+                Unit
+            }
+            is AppAction.Logout -> {
+                buf.putInt(8)
+                Unit
+            }
+            is AppAction.SendMessage -> {
+                buf.putInt(9)
+                FfiConverterString.write(value.`content`, buf)
+                Unit
+            }
+            is AppAction.LoadOlderMessages -> {
+                buf.putInt(10)
+                Unit
+            }
+            is AppAction.RefreshTimestamps -> {
+                buf.putInt(11)
+                Unit
+            }
+            is AppAction.ClearToast -> {
+                buf.putInt(12)
+                Unit
+            }
+            is AppAction.ToggleSettings -> {
+                buf.putInt(13)
+                Unit
+            }
+            is AppAction.RequestDeleteAgent -> {
+                buf.putInt(14)
+                Unit
+            }
+            is AppAction.ConfirmDeleteAgent -> {
+                buf.putInt(15)
+                Unit
+            }
+            is AppAction.CancelDeleteAgent -> {
+                buf.putInt(16)
+                Unit
+            }
+        }.let { /* this makes the `when` an expression, which ensures it is exhaustive */ }
+    }
+}
+
+
+
+
+
+sealed class AppUpdate {
+    
+    data class FullState(
+        val v1: cloud.opensecret.maple.rust.AppState) : AppUpdate()
+        
+    {
+        
+
+        companion object
+    }
+    
+    data class SessionTokens(
+        val `rev`: kotlin.ULong, 
+        val `accessToken`: kotlin.String, 
+        val `refreshToken`: kotlin.String) : AppUpdate()
+        
+    {
+        
+
+        companion object
+    }
+    
+
+    
+
+    
+    
+
+
+    companion object
+}
+
+/**
+ * @suppress
+ */
+public object FfiConverterTypeAppUpdate : FfiConverterRustBuffer<AppUpdate>{
+    override fun read(buf: ByteBuffer): AppUpdate {
+        return when(buf.getInt()) {
+            1 -> AppUpdate.FullState(
+                FfiConverterTypeAppState.read(buf),
+                )
+            2 -> AppUpdate.SessionTokens(
+                FfiConverterULong.read(buf),
+                FfiConverterString.read(buf),
+                FfiConverterString.read(buf),
+                )
+            else -> throw RuntimeException("invalid enum value, something is very wrong!!")
+        }
+    }
+
+    override fun allocationSize(value: AppUpdate) = when(value) {
+        is AppUpdate.FullState -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+                + FfiConverterTypeAppState.allocationSize(value.v1)
+            )
+        }
+        is AppUpdate.SessionTokens -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+                + FfiConverterULong.allocationSize(value.`rev`)
+                + FfiConverterString.allocationSize(value.`accessToken`)
+                + FfiConverterString.allocationSize(value.`refreshToken`)
+            )
+        }
+    }
+
+    override fun write(value: AppUpdate, buf: ByteBuffer) {
+        when(value) {
+            is AppUpdate.FullState -> {
+                buf.putInt(1)
+                FfiConverterTypeAppState.write(value.v1, buf)
+                Unit
+            }
+            is AppUpdate.SessionTokens -> {
+                buf.putInt(2)
+                FfiConverterULong.write(value.`rev`, buf)
+                FfiConverterString.write(value.`accessToken`, buf)
+                FfiConverterString.write(value.`refreshToken`, buf)
+                Unit
+            }
+        }.let { /* this makes the `when` an expression, which ensures it is exhaustive */ }
+    }
+}
+
+
+
+
+
+sealed class AuthState {
+    
+    object Initializing : AuthState()
+    
+    
+    object Ready : AuthState()
+    
+    
+    object LoggingIn : AuthState()
+    
+    
+    object SigningUp : AuthState()
+    
+    
+    data class LoggedIn(
+        val `userId`: kotlin.String, 
+        val `email`: kotlin.String?, 
+        val `name`: kotlin.String?) : AuthState()
+        
+    {
+        
+
+        companion object
+    }
+    
+
+    
+
+    
+    
+
+
+    companion object
+}
+
+/**
+ * @suppress
+ */
+public object FfiConverterTypeAuthState : FfiConverterRustBuffer<AuthState>{
+    override fun read(buf: ByteBuffer): AuthState {
+        return when(buf.getInt()) {
+            1 -> AuthState.Initializing
+            2 -> AuthState.Ready
+            3 -> AuthState.LoggingIn
+            4 -> AuthState.SigningUp
+            5 -> AuthState.LoggedIn(
+                FfiConverterString.read(buf),
+                FfiConverterOptionalString.read(buf),
+                FfiConverterOptionalString.read(buf),
+                )
+            else -> throw RuntimeException("invalid enum value, something is very wrong!!")
+        }
+    }
+
+    override fun allocationSize(value: AuthState) = when(value) {
+        is AuthState.Initializing -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+            )
+        }
+        is AuthState.Ready -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+            )
+        }
+        is AuthState.LoggingIn -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+            )
+        }
+        is AuthState.SigningUp -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+            )
+        }
+        is AuthState.LoggedIn -> {
+            // Add the size for the Int that specifies the variant plus the size needed for all fields
+            (
+                4UL
+                + FfiConverterString.allocationSize(value.`userId`)
+                + FfiConverterOptionalString.allocationSize(value.`email`)
+                + FfiConverterOptionalString.allocationSize(value.`name`)
+            )
+        }
+    }
+
+    override fun write(value: AuthState, buf: ByteBuffer) {
+        when(value) {
+            is AuthState.Initializing -> {
+                buf.putInt(1)
+                Unit
+            }
+            is AuthState.Ready -> {
+                buf.putInt(2)
+                Unit
+            }
+            is AuthState.LoggingIn -> {
+                buf.putInt(3)
+                Unit
+            }
+            is AuthState.SigningUp -> {
+                buf.putInt(4)
+                Unit
+            }
+            is AuthState.LoggedIn -> {
+                buf.putInt(5)
+                FfiConverterString.write(value.`userId`, buf)
+                FfiConverterOptionalString.write(value.`email`, buf)
+                FfiConverterOptionalString.write(value.`name`, buf)
+                Unit
+            }
+        }.let { /* this makes the `when` an expression, which ensures it is exhaustive */ }
+    }
+}
+
+
+
+
+
+
+enum class OAuthProvider {
+    
+    GITHUB,
+    GOOGLE,
+    APPLE;
+
+    
+
+
+    companion object
+}
+
+
+/**
+ * @suppress
+ */
+public object FfiConverterTypeOAuthProvider: FfiConverterRustBuffer<OAuthProvider> {
+    override fun read(buf: ByteBuffer) = try {
+        OAuthProvider.values()[buf.getInt() - 1]
+    } catch (e: IndexOutOfBoundsException) {
+        throw RuntimeException("invalid enum value, something is very wrong!!", e)
+    }
+
+    override fun allocationSize(value: OAuthProvider) = 4UL
+
+    override fun write(value: OAuthProvider, buf: ByteBuffer) {
+        buf.putInt(value.ordinal + 1)
+    }
+}
+
+
+
+
+
+
+enum class Screen {
+    
+    LOADING,
+    LOGIN,
+    CHAT;
+
+    
+
+
+    companion object
+}
+
+
+/**
+ * @suppress
+ */
+public object FfiConverterTypeScreen: FfiConverterRustBuffer<Screen> {
+    override fun read(buf: ByteBuffer) = try {
+        Screen.values()[buf.getInt() - 1]
+    } catch (e: IndexOutOfBoundsException) {
+        throw RuntimeException("invalid enum value, something is very wrong!!", e)
+    }
+
+    override fun allocationSize(value: Screen) = 4UL
+
+    override fun write(value: Screen, buf: ByteBuffer) {
+        buf.putInt(value.ordinal + 1)
+    }
+}
+
+
+
+
+
+
+
+public interface AppReconciler {
+    
+    fun `reconcile`(`update`: AppUpdate)
+    
+    companion object
+}
+
+
+
+// Put the implementation in an object so we don't pollute the top-level namespace
+internal object uniffiCallbackInterfaceAppReconciler {
+    internal object `reconcile`: UniffiCallbackInterfaceAppReconcilerMethod0 {
+        override fun callback(`uniffiHandle`: Long,`update`: RustBuffer.ByValue,`uniffiOutReturn`: Pointer,uniffiCallStatus: UniffiRustCallStatus,) {
+            val uniffiObj = FfiConverterTypeAppReconciler.handleMap.get(uniffiHandle)
+            val makeCall = { ->
+                uniffiObj.`reconcile`(
+                    FfiConverterTypeAppUpdate.lift(`update`),
+                )
+            }
+            val writeReturn = { _: Unit -> Unit }
+            uniffiTraitInterfaceCall(uniffiCallStatus, makeCall, writeReturn)
+        }
+    }
+
+    internal object uniffiFree: UniffiCallbackInterfaceFree {
+        override fun callback(handle: Long) {
+            FfiConverterTypeAppReconciler.handleMap.remove(handle)
+        }
+    }
+
+    internal object uniffiClone: UniffiCallbackInterfaceClone {
+        override fun callback(handle: Long): Long {
+            return FfiConverterTypeAppReconciler.handleMap.clone(handle)
+        }
+    }
+
+    internal var vtable = UniffiVTableCallbackInterfaceAppReconciler.UniffiByValue(
+        uniffiFree,
+        uniffiClone,
+        `reconcile`,
+    )
+
+    // Registers the foreign callback with the Rust side.
+    // This method is generated for each callback interface.
+    internal fun register(lib: UniffiLib) {
+        lib.uniffi_maple_core_fn_init_callback_vtable_appreconciler(vtable)
+    }
+}
+
+/**
+ * The ffiConverter which transforms the Callbacks in to handles to pass to Rust.
+ *
+ * @suppress
+ */
+public object FfiConverterTypeAppReconciler: FfiConverterCallbackInterface<AppReconciler>()
+
+
+
+
+/**
+ * @suppress
+ */
+public object FfiConverterOptionalString: FfiConverterRustBuffer<kotlin.String?> {
+    override fun read(buf: ByteBuffer): kotlin.String? {
+        if (buf.get().toInt() == 0) {
+            return null
+        }
+        return FfiConverterString.read(buf)
+    }
+
+    override fun allocationSize(value: kotlin.String?): ULong {
+        if (value == null) {
+            return 1UL
+        } else {
+            return 1UL + FfiConverterString.allocationSize(value)
+        }
+    }
+
+    override fun write(value: kotlin.String?, buf: ByteBuffer) {
+        if (value == null) {
+            buf.put(0)
+        } else {
+            buf.put(1)
+            FfiConverterString.write(value, buf)
+        }
+    }
+}
+
+
+
+
+/**
+ * @suppress
+ */
+public object FfiConverterSequenceTypeChatMessage: FfiConverterRustBuffer<List<ChatMessage>> {
+    override fun read(buf: ByteBuffer): List<ChatMessage> {
+        val len = buf.getInt()
+        return List<ChatMessage>(len) {
+            FfiConverterTypeChatMessage.read(buf)
+        }
+    }
+
+    override fun allocationSize(value: List<ChatMessage>): ULong {
+        val sizeForLength = 4UL
+        val sizeForItems = value.map { FfiConverterTypeChatMessage.allocationSize(it) }.sum()
+        return sizeForLength + sizeForItems
+    }
+
+    override fun write(value: List<ChatMessage>, buf: ByteBuffer) {
+        buf.putInt(value.size)
+        value.iterator().forEach {
+            FfiConverterTypeChatMessage.write(it, buf)
+        }
+    }
+}
+
+
+
+
+/**
+ * @suppress
+ */
+public object FfiConverterSequenceTypeScreen: FfiConverterRustBuffer<List<Screen>> {
+    override fun read(buf: ByteBuffer): List<Screen> {
+        val len = buf.getInt()
+        return List<Screen>(len) {
+            FfiConverterTypeScreen.read(buf)
+        }
+    }
+
+    override fun allocationSize(value: List<Screen>): ULong {
+        val sizeForLength = 4UL
+        val sizeForItems = value.map { FfiConverterTypeScreen.allocationSize(it) }.sum()
+        return sizeForLength + sizeForItems
+    }
+
+    override fun write(value: List<Screen>, buf: ByteBuffer) {
+        buf.putInt(value.size)
+        value.iterator().forEach {
+            FfiConverterTypeScreen.write(it, buf)
+        }
+    }
+} fun `defaultApiUrl`(): kotlin.String {
+            return FfiConverterString.lift(
+    uniffiRustCall() { _status ->
+    UniffiLib.uniffi_maple_core_fn_func_default_api_url(
+    
+        _status)
+}
+    )
+    }
+    
+
+
diff --git a/native/android/app/src/main/java/cloud/opensecret/maple/ui/MainApp.kt b/native/android/app/src/main/java/cloud/opensecret/maple/ui/MainApp.kt
new file mode 100644
index 00000000..3f5de919
--- /dev/null
+++ b/native/android/app/src/main/java/cloud/opensecret/maple/ui/MainApp.kt
@@ -0,0 +1,1375 @@
+package cloud.opensecret.maple.ui
+
+import androidx.compose.animation.AnimatedContent
+import androidx.compose.animation.AnimatedVisibility
+import androidx.compose.animation.fadeIn
+import androidx.compose.animation.fadeOut
+import androidx.compose.animation.slideInVertically
+import androidx.compose.animation.slideOutVertically
+import androidx.compose.animation.core.animateFloatAsState
+import androidx.compose.animation.core.tween
+import androidx.compose.foundation.background
+import androidx.compose.foundation.border
+import androidx.compose.foundation.BorderStroke
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.text.BasicTextField
+import androidx.compose.foundation.interaction.MutableInteractionSource
+import androidx.compose.foundation.interaction.collectIsPressedAsState
+import androidx.compose.foundation.isSystemInDarkTheme
+import androidx.compose.foundation.layout.*
+import androidx.compose.foundation.layout.BoxWithConstraints
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.foundation.lazy.LazyListState
+import androidx.compose.foundation.lazy.items
+import androidx.compose.foundation.lazy.rememberLazyListState
+import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.automirrored.filled.Send
+import androidx.compose.material.icons.automirrored.filled.ExitToApp
+import androidx.compose.material.icons.filled.Delete
+import androidx.compose.material.icons.filled.Menu
+import androidx.compose.material.icons.filled.Search
+import androidx.compose.material.icons.filled.Settings
+import androidx.compose.material3.*
+import androidx.compose.runtime.*
+import androidx.compose.runtime.saveable.rememberSaveable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.draw.alpha
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.draw.scale
+import androidx.compose.ui.draw.shadow
+import androidx.compose.ui.focus.FocusRequester
+import androidx.compose.ui.focus.focusRequester
+import androidx.compose.ui.graphics.Brush
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.layout.onGloballyPositioned
+import androidx.compose.ui.layout.positionInRoot
+import androidx.compose.ui.platform.LocalDensity
+import androidx.compose.ui.graphics.SolidColor
+import androidx.compose.ui.text.TextStyle
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.input.ImeAction
+import androidx.compose.ui.text.input.PasswordVisualTransformation
+import androidx.compose.ui.text.input.VisualTransformation
+import androidx.compose.foundation.text.KeyboardActions
+import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
+import cloud.opensecret.maple.AppManager
+import cloud.opensecret.maple.rust.AppAction
+import cloud.opensecret.maple.rust.AuthState
+import cloud.opensecret.maple.rust.ChatMessage
+import cloud.opensecret.maple.rust.OAuthProvider
+import cloud.opensecret.maple.rust.Screen
+import cloud.opensecret.maple.ui.theme.*
+import kotlin.math.roundToInt
+
+private const val HISTORY_PREFETCH_THRESHOLD = 3
+private const val BOTTOM_FOLLOW_THRESHOLD_PX = 96
+private const val TYPING_INDICATOR_KEY = "typing-indicator"
+
+private sealed interface HistoryLoadScrollStrategy {
+    data object PreserveBottom : HistoryLoadScrollStrategy
+    data class PreserveAnchor(
+        val messageId: String,
+        val scrollOffset: Int,
+    ) : HistoryLoadScrollStrategy
+}
+
+private fun didPrependMessages(
+    previousIds: List<String>,
+    currentIds: List<String>,
+): Boolean {
+    return previousIds.isNotEmpty() &&
+        currentIds.size > previousIds.size &&
+        currentIds.takeLast(previousIds.size) == previousIds
+}
+
+private fun didAppendMessages(
+    previousIds: List<String>,
+    currentIds: List<String>,
+): Boolean {
+    return previousIds.isNotEmpty() &&
+        currentIds.size > previousIds.size &&
+        currentIds.take(previousIds.size) == previousIds
+}
+
+private fun LazyListState.isNearBottom(): Boolean {
+    val info = layoutInfo
+    if (info.totalItemsCount == 0) return true
+
+    val lastVisible = info.visibleItemsInfo.lastOrNull() ?: return true
+    val viewportEnd = info.viewportEndOffset - info.afterContentPadding
+    val distanceFromBottom = (lastVisible.offset + lastVisible.size) - viewportEnd
+
+    return lastVisible.index >= info.totalItemsCount - 2 &&
+        distanceFromBottom <= BOTTOM_FOLLOW_THRESHOLD_PX
+}
+
+private fun LazyListState.historyAnchor(
+    messageIds: List<String>,
+): HistoryLoadScrollStrategy.PreserveAnchor? {
+    val firstVisibleMessage = layoutInfo.visibleItemsInfo.firstOrNull { visibleItem ->
+        val key = visibleItem.key as? String
+        key != null && key != TYPING_INDICATOR_KEY
+    } ?: return null
+
+    val messageId = firstVisibleMessage.key as? String ?: return null
+    if (messageId !in messageIds) return null
+
+    return HistoryLoadScrollStrategy.PreserveAnchor(
+        messageId = messageId,
+        scrollOffset = firstVisibleItemScrollOffset,
+    )
+}
+
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+fun MainApp(manager: AppManager) {
+    val state = manager.state
+    var showSplash by remember { mutableStateOf(true) }
+    var minTimePassed by remember { mutableStateOf(false) }
+    val currentScreen = state.router.defaultScreen
+    val toastMessage = state.toast
+
+    LaunchedEffect(Unit) {
+        kotlinx.coroutines.delay(1000)
+        minTimePassed = true
+    }
+
+    LaunchedEffect(minTimePassed, currentScreen) {
+        if (minTimePassed && currentScreen != Screen.LOADING) {
+            showSplash = false
+        }
+    }
+
+    LaunchedEffect(toastMessage) {
+        if (toastMessage == null) return@LaunchedEffect
+        kotlinx.coroutines.delay(4000)
+        if (manager.state.toast == toastMessage) {
+            manager.dispatch(AppAction.ClearToast)
+        }
+    }
+
+    Box(modifier = Modifier.fillMaxSize()) {
+        when (state.router.defaultScreen) {
+            Screen.LOADING -> SplashScreen()
+            Screen.LOGIN -> LoginScreen(manager)
+            Screen.CHAT -> AgentChatScreen(manager)
+        }
+
+        androidx.compose.animation.AnimatedVisibility(
+            visible = showSplash,
+            exit = androidx.compose.animation.fadeOut(
+                animationSpec = androidx.compose.animation.core.tween(400),
+            ),
+        ) {
+            SplashScreen()
+        }
+
+        MapleToastHost(
+            message = toastMessage,
+            isChatScreen = currentScreen == Screen.CHAT,
+            onDismiss = { manager.dispatch(AppAction.ClearToast) },
+        )
+    }
+}
+
+@Composable
+private fun MapleToastHost(
+    message: String?,
+    isChatScreen: Boolean,
+    onDismiss: () -> Unit,
+) {
+    val isDarkTheme = isSystemInDarkTheme()
+
+    AnimatedVisibility(
+        visible = message != null,
+        modifier = Modifier.fillMaxSize(),
+        enter = fadeIn(animationSpec = tween(durationMillis = 180)) +
+            slideInVertically(animationSpec = tween(durationMillis = 220)) { it / 2 },
+        exit = fadeOut(animationSpec = tween(durationMillis = 160)) +
+            slideOutVertically(animationSpec = tween(durationMillis = 200)) { it / 2 },
+    ) {
+        Box(
+            modifier = Modifier.fillMaxSize(),
+            contentAlignment = Alignment.BottomCenter,
+        ) {
+            Surface(
+                modifier = Modifier
+                    .padding(horizontal = 16.dp)
+                    .padding(bottom = if (isChatScreen) 112.dp else 24.dp)
+                    .clickable(onClick = onDismiss),
+                shape = RoundedCornerShape(999.dp),
+                color = if (isDarkTheme) {
+                    Color(0xFF271D1A).copy(alpha = 0.92f)
+                } else {
+                    Color.White.copy(alpha = 0.94f)
+                },
+                tonalElevation = 0.dp,
+                shadowElevation = if (isDarkTheme) 8.dp else 4.dp,
+                border = BorderStroke(
+                    1.dp,
+                    MapleError.copy(alpha = if (isDarkTheme) 0.35f else 0.18f),
+                ),
+            ) {
+                Text(
+                    text = message.orEmpty(),
+                    color = if (isDarkTheme) Pebble50 else Neutral800,
+                    style = MaterialTheme.typography.bodySmall,
+                    modifier = Modifier.padding(horizontal = 16.dp, vertical = 12.dp),
+                )
+            }
+        }
+    }
+}
+
+// -- Splash --
+
+@Composable
+fun SplashScreen() {
+    BoxWithConstraints(
+        modifier = Modifier.fillMaxSize(),
+        contentAlignment = Alignment.Center,
+    ) {
+        val w = constraints.maxWidth.toFloat()
+        val h = constraints.maxHeight.toFloat()
+        Box(
+            modifier = Modifier
+                .fillMaxSize()
+                .background(
+                    brush = Brush.radialGradient(
+                        colors = listOf(
+                            androidx.compose.ui.graphics.Color(0xFFFF9771),
+                            androidx.compose.ui.graphics.Color(0xFFCE9A8E),
+                            androidx.compose.ui.graphics.Color(0xFF9C9DAB),
+                        ),
+                        center = androidx.compose.ui.geometry.Offset(w / 2f, h),
+                        radius = h,
+                    ),
+                ),
+        )
+        Column(horizontalAlignment = Alignment.CenterHorizontally) {
+            Icon(
+                painter = androidx.compose.ui.res.painterResource(id = cloud.opensecret.maple.R.drawable.maple_wordmark),
+                contentDescription = "Maple",
+                modifier = Modifier.height(40.dp),
+                tint = Pebble50,
+            )
+            Spacer(modifier = Modifier.height(20.dp))
+            Text(
+                "Privacy-first intelligence",
+                style = MaterialTheme.typography.bodyMedium.copy(
+                    fontFamily = cloud.opensecret.maple.ui.theme.ArrayFamily,
+                ),
+                color = Pebble100.copy(alpha = 0.8f),
+            )
+        }
+    }
+}
+
+// -- Login --
+
+private data class LoginPalette(
+    val backgroundBase: Color,
+    val backgroundGlow: List<Color>,
+    val cardBackground: Color,
+    val cardHighlight: Color,
+    val cardBorder: Color,
+    val cardShadow: Color,
+    val wordmark: Color,
+    val supportingText: Color,
+    val tertiaryText: Color,
+    val divider: Color,
+    val fieldBackground: Color,
+    val fieldBorder: Color,
+    val fieldText: Color,
+    val fieldPlaceholder: Color,
+    val secondaryButtonBackground: Color,
+    val secondaryButtonBorder: Color,
+    val secondaryButtonForeground: Color,
+    val secondaryButtonShadow: Color,
+)
+
+private fun loginPalette(isDarkTheme: Boolean): LoginPalette =
+    if (isDarkTheme) {
+        LoginPalette(
+            backgroundBase = Color(0xFF1A110E),
+            backgroundGlow = listOf(
+                Maple500.copy(alpha = 0.07f),
+                Color(0xFF5D4036).copy(alpha = 0.11f),
+                Pebble800.copy(alpha = 0.12f),
+                Color.Transparent,
+            ),
+            cardBackground = Color(0xFF271D1A).copy(alpha = 0.9f),
+            cardHighlight = Color.White.copy(alpha = 0.04f),
+            cardBorder = Color(0xFF53433E),
+            cardShadow = Color.Black.copy(alpha = 0.4f),
+            wordmark = Pebble50,
+            supportingText = Color(0xFFD8C2BB),
+            tertiaryText = Color(0xFFD8C2BB).copy(alpha = 0.8f),
+            divider = Color(0xFF53433E),
+            fieldBackground = Color(0xFF231A16).copy(alpha = 0.96f),
+            fieldBorder = Color(0xFFA08D86).copy(alpha = 0.45f),
+            fieldText = Color(0xFFF1DFD9),
+            fieldPlaceholder = Color(0xFFD8C2BB).copy(alpha = 0.75f),
+            secondaryButtonBackground = Color(0xFF322824).copy(alpha = 0.96f),
+            secondaryButtonBorder = Color(0xFF53433E),
+            secondaryButtonForeground = Color(0xFFF1DFD9),
+            secondaryButtonShadow = Color.Black.copy(alpha = 0.14f),
+        )
+    } else {
+        LoginPalette(
+            backgroundBase = Color(0xFFFBF8F6),
+            backgroundGlow = listOf(
+                Maple500.copy(alpha = 0.18f),
+                Bark300.copy(alpha = 0.1f),
+                Pebble300.copy(alpha = 0.1f),
+                Color.Transparent,
+            ),
+            cardBackground = Color.White.copy(alpha = 0.74f),
+            cardHighlight = Color.White.copy(alpha = 0.42f),
+            cardBorder = Color.White.copy(alpha = 0.72f),
+            cardShadow = Pebble900.copy(alpha = 0.08f),
+            wordmark = Pebble800,
+            supportingText = Pebble600,
+            tertiaryText = Pebble400,
+            divider = Neutral200,
+            fieldBackground = Color.White.copy(alpha = 0.84f),
+            fieldBorder = Neutral200.copy(alpha = 0.95f),
+            fieldText = Pebble800,
+            fieldPlaceholder = Pebble400,
+            secondaryButtonBackground = Color.White.copy(alpha = 0.56f),
+            secondaryButtonBorder = Color.White.copy(alpha = 0.68f),
+            secondaryButtonForeground = Pebble700,
+            secondaryButtonShadow = Pebble900.copy(alpha = 0.05f),
+        )
+    }
+
+private data class ChatPalette(
+    val backgroundBase: Color,
+    val backgroundGlow: List<Color>,
+    val chromeHighlight: Color,
+    val chromeBackground: Color,
+    val chromeBorder: Color,
+    val chromeShadow: Color,
+    val headerWordmark: Color,
+    val secondaryIcon: Color,
+    val composeBackground: Color,
+    val composeBorder: Color,
+    val composeShadow: Color,
+    val composeText: Color,
+    val composePlaceholder: Color,
+    val metadataText: Color,
+    val assistantText: Color,
+    val userBubbleColor: Color,
+    val userText: Color,
+    val surfaceText: Color,
+    val sheetBackground: Color,
+    val sheetDivider: Color,
+    val sheetSecondaryText: Color,
+    val disabledIcon: Color,
+)
+
+private fun chatPalette(isDarkTheme: Boolean): ChatPalette =
+    if (isDarkTheme) {
+        ChatPalette(
+            backgroundBase = Color(0xFF1A110E),
+            backgroundGlow = listOf(
+                Maple500.copy(alpha = 0.07f),
+                Color(0xFF5D4036).copy(alpha = 0.1f),
+                Pebble800.copy(alpha = 0.12f),
+                Color.Transparent,
+            ),
+            chromeHighlight = Color(0xFF271D1A).copy(alpha = 0.78f),
+            chromeBackground = Color(0xFF271D1A).copy(alpha = 0.78f),
+            chromeBorder = Color(0xFF53433E),
+            chromeShadow = Color.Black.copy(alpha = 0.14f),
+            headerWordmark = Pebble50,
+            secondaryIcon = Color(0xFFD8C2BB),
+            composeBackground = Color(0xFF271D1A).copy(alpha = 0.78f),
+            composeBorder = Color(0xFF53433E),
+            composeShadow = Color.Black.copy(alpha = 0.14f),
+            composeText = Color(0xFFF1DFD9),
+            composePlaceholder = Color(0xFFD8C2BB).copy(alpha = 0.78f),
+            metadataText = Color(0xFFD8C2BB).copy(alpha = 0.82f),
+            assistantText = Color(0xFFF1DFD9),
+            userBubbleColor = Color(0xFF322824).copy(alpha = 0.96f),
+            userText = Color(0xFFF1DFD9),
+            surfaceText = Color(0xFFF1DFD9),
+            sheetBackground = Color(0xFF271D1A),
+            sheetDivider = Color(0xFF53433E),
+            sheetSecondaryText = Color(0xFFD8C2BB),
+            disabledIcon = Color(0xFFA08D86).copy(alpha = 0.45f),
+        )
+    } else {
+        ChatPalette(
+            backgroundBase = Color.White,
+            backgroundGlow = listOf(
+                Color(0xFFFF9771).copy(alpha = 0.35f),
+                Color(0xFFECB8A5).copy(alpha = 0.2f),
+                Color(0xFFDADADA).copy(alpha = 0.1f),
+                Color.Transparent,
+            ),
+            chromeHighlight = Color.White.copy(alpha = 0.98f),
+            chromeBackground = Color(0xFFFFF1EC).copy(alpha = 0.84f),
+            chromeBorder = Color.White.copy(alpha = 0.92f),
+            chromeShadow = Pebble900.copy(alpha = 0.08f),
+            headerWordmark = Pebble800,
+            secondaryIcon = Pebble800,
+            composeBackground = Color.White.copy(alpha = 0.9f),
+            composeBorder = Color.White.copy(alpha = 0.94f),
+            composeShadow = Pebble900.copy(alpha = 0.12f),
+            composeText = Neutral800,
+            composePlaceholder = Color(0xFF878787),
+            metadataText = Pebble400,
+            assistantText = Pebble800,
+            userBubbleColor = Pebble100,
+            userText = Neutral800,
+            surfaceText = Neutral800,
+            sheetBackground = Color.White.copy(alpha = 0.96f),
+            sheetDivider = Neutral200,
+            sheetSecondaryText = Pebble500,
+            disabledIcon = Neutral300,
+        )
+    }
+
+@Composable
+private fun composeFieldColors(palette: ChatPalette) = OutlinedTextFieldDefaults.colors(
+    focusedContainerColor = Color.Transparent,
+    unfocusedContainerColor = Color.Transparent,
+    disabledContainerColor = Color.Transparent,
+    focusedTextColor = palette.composeText,
+    unfocusedTextColor = palette.composeText,
+    disabledTextColor = palette.composeText.copy(alpha = 0.5f),
+    cursorColor = Maple500,
+    focusedBorderColor = Color.Transparent,
+    unfocusedBorderColor = Color.Transparent,
+    disabledBorderColor = Color.Transparent,
+    focusedPlaceholderColor = palette.composePlaceholder,
+    unfocusedPlaceholderColor = palette.composePlaceholder,
+    disabledPlaceholderColor = palette.composePlaceholder.copy(alpha = 0.5f),
+)
+
+@Composable
+fun LoginScreen(manager: AppManager) {
+    val state = manager.state
+    val isDarkTheme = isSystemInDarkTheme()
+    val palette = loginPalette(isDarkTheme)
+    var email by remember { mutableStateOf("") }
+    var password by remember { mutableStateOf("") }
+    var name by remember { mutableStateOf("") }
+    var isSignUp by remember { mutableStateOf(false) }
+
+    val isLoading = state.auth is AuthState.LoggingIn || state.auth is AuthState.SigningUp
+
+    val nameFocus = remember { FocusRequester() }
+    val emailFocus = remember { FocusRequester() }
+    val passwordFocus = remember { FocusRequester() }
+
+    fun submitForm() {
+        if (isSignUp) {
+            manager.dispatch(AppAction.SignUpWithEmail(email = email, password = password, name = name))
+        } else {
+            manager.dispatch(AppAction.LoginWithEmail(email = email, password = password))
+        }
+    }
+
+    val canSubmit = email.isNotEmpty() && password.isNotEmpty() && !isLoading
+
+    BoxWithConstraints(
+        modifier = Modifier.fillMaxSize(),
+        contentAlignment = Alignment.Center,
+    ) {
+        val w = constraints.maxWidth.toFloat()
+        val h = constraints.maxHeight.toFloat()
+        Box(
+            modifier = Modifier
+                .fillMaxSize()
+                .background(palette.backgroundBase),
+        )
+        Box(
+            modifier = Modifier
+                .fillMaxSize()
+                .background(
+                    brush = Brush.radialGradient(
+                        colors = palette.backgroundGlow,
+                        center = androidx.compose.ui.geometry.Offset(w / 2f, h),
+                        radius = h,
+                    ),
+                ),
+        )
+        Column(
+            modifier = Modifier
+                .fillMaxSize()
+                .padding(horizontal = 20.dp),
+            horizontalAlignment = Alignment.CenterHorizontally,
+        ) {
+            Spacer(modifier = Modifier.weight(1f))
+
+            Column(
+                modifier = Modifier
+                    .fillMaxWidth()
+                    .widthIn(max = 360.dp)
+                    .shadow(
+                        elevation = if (isDarkTheme) 28.dp else 20.dp,
+                        shape = RoundedCornerShape(24.dp),
+                        ambientColor = palette.cardShadow,
+                        spotColor = palette.cardShadow,
+                    )
+                    .clip(RoundedCornerShape(24.dp))
+                    .background(
+                        brush = Brush.linearGradient(
+                            colors = listOf(palette.cardHighlight, palette.cardBackground),
+                        ),
+                    )
+                    .border(1.dp, palette.cardBorder, RoundedCornerShape(24.dp))
+                    .padding(24.dp),
+                horizontalAlignment = Alignment.CenterHorizontally,
+                verticalArrangement = Arrangement.spacedBy(24.dp),
+            ) {
+                Icon(
+                    painter = androidx.compose.ui.res.painterResource(id = cloud.opensecret.maple.R.drawable.maple_wordmark),
+                    contentDescription = "Maple",
+                    modifier = Modifier.height(28.dp),
+                    tint = palette.wordmark,
+                )
+
+                Column(
+                    modifier = Modifier.fillMaxWidth(),
+                    verticalArrangement = Arrangement.spacedBy(12.dp),
+                ) {
+                    if (isSignUp) {
+                        MapleLoginTextField(
+                            value = name,
+                            onValueChange = { name = it },
+                            placeholder = "Name",
+                            palette = palette,
+                            modifier = Modifier.focusRequester(nameFocus),
+                            keyboardOptions = KeyboardOptions(imeAction = ImeAction.Next),
+                            keyboardActions = KeyboardActions(onNext = { emailFocus.requestFocus() }),
+                        )
+                    }
+
+                    MapleLoginTextField(
+                        value = email,
+                        onValueChange = { email = it },
+                        placeholder = "Email",
+                        palette = palette,
+                        modifier = Modifier.focusRequester(emailFocus),
+                        keyboardOptions = KeyboardOptions(imeAction = ImeAction.Next),
+                        keyboardActions = KeyboardActions(onNext = { passwordFocus.requestFocus() }),
+                    )
+
+                    MapleLoginTextField(
+                        value = password,
+                        onValueChange = { password = it },
+                        placeholder = "Password",
+                        palette = palette,
+                        modifier = Modifier.focusRequester(passwordFocus),
+                        visualTransformation = PasswordVisualTransformation(),
+                        keyboardOptions = KeyboardOptions(imeAction = ImeAction.Go),
+                        keyboardActions = KeyboardActions(onGo = { submitForm() }),
+                    )
+                }
+
+                val primaryInteractionSource = remember { MutableInteractionSource() }
+                val primaryPressed by primaryInteractionSource.collectIsPressedAsState()
+                val primaryScale by animateFloatAsState(
+                    targetValue = if (primaryPressed) 0.95f else 1f,
+                    animationSpec = tween(durationMillis = 200),
+                )
+
+                Button(
+                    onClick = { submitForm() },
+                    modifier = Modifier
+                        .fillMaxWidth()
+                        .height(48.dp)
+                        .scale(primaryScale),
+                    enabled = canSubmit,
+                    interactionSource = primaryInteractionSource,
+                    shape = RoundedCornerShape(999.dp),
+                    contentPadding = PaddingValues(0.dp),
+                    colors = ButtonDefaults.buttonColors(
+                        containerColor = Color.Transparent,
+                        contentColor = Color.White,
+                        disabledContainerColor = Color.Transparent,
+                        disabledContentColor = Color.White,
+                    ),
+                    elevation = ButtonDefaults.buttonElevation(
+                        defaultElevation = 0.dp,
+                        pressedElevation = 0.dp,
+                        disabledElevation = 0.dp,
+                    ),
+                ) {
+                    Box(
+                        modifier = Modifier
+                            .fillMaxSize()
+                            .clip(RoundedCornerShape(999.dp))
+                            .background(
+                                brush = Brush.verticalGradient(
+                                    colors = listOf(Maple400, Maple600),
+                                ),
+                            )
+                            .alpha(if (canSubmit || isLoading) 1f else 0.5f),
+                        contentAlignment = Alignment.Center,
+                    ) {
+                        if (isLoading) {
+                            CircularProgressIndicator(
+                                modifier = Modifier.size(20.dp),
+                                strokeWidth = 2.dp,
+                                color = Color.White,
+                            )
+                        } else {
+                            Text(
+                                if (isSignUp) "Sign Up" else "Sign In",
+                                color = Color.White,
+                                fontWeight = FontWeight.SemiBold,
+                            )
+                        }
+                    }
+                }
+
+                Row(
+                    modifier = Modifier.fillMaxWidth(),
+                    verticalAlignment = Alignment.CenterVertically,
+                    horizontalArrangement = Arrangement.spacedBy(8.dp),
+                ) {
+                    HorizontalDivider(modifier = Modifier.weight(1f), color = palette.divider)
+                    Text("or", style = MaterialTheme.typography.labelSmall, color = palette.tertiaryText)
+                    HorizontalDivider(modifier = Modifier.weight(1f), color = palette.divider)
+                }
+
+                Column(
+                    modifier = Modifier.fillMaxWidth(),
+                    verticalArrangement = Arrangement.spacedBy(8.dp),
+                ) {
+                    GlassyOutlinedButton(
+                        text = "Continue with GitHub",
+                        onClick = { manager.dispatch(AppAction.InitiateOAuth(provider = OAuthProvider.GITHUB, inviteCode = null)) },
+                        palette = palette,
+                        enabled = !isLoading,
+                    )
+                    GlassyOutlinedButton(
+                        text = "Continue with Google",
+                        onClick = { manager.dispatch(AppAction.InitiateOAuth(provider = OAuthProvider.GOOGLE, inviteCode = null)) },
+                        palette = palette,
+                        enabled = !isLoading,
+                    )
+                    GlassyOutlinedButton(
+                        text = "Continue with Apple",
+                        onClick = { manager.dispatch(AppAction.InitiateOAuth(provider = OAuthProvider.APPLE, inviteCode = null)) },
+                        palette = palette,
+                        enabled = !isLoading,
+                    )
+                }
+
+                TextButton(onClick = { isSignUp = !isSignUp }) {
+                    Text(
+                        if (isSignUp) "Already have an account? Sign In" else "Don't have an account? Sign Up",
+                        color = palette.supportingText,
+                    )
+                }
+            }
+
+            Spacer(modifier = Modifier.weight(1f))
+        }
+    }
+}
+
+@Composable
+private fun MapleLoginTextField(
+    value: String,
+    onValueChange: (String) -> Unit,
+    placeholder: String,
+    palette: LoginPalette,
+    modifier: Modifier = Modifier,
+    keyboardOptions: KeyboardOptions = KeyboardOptions.Default,
+    keyboardActions: KeyboardActions = KeyboardActions.Default,
+    visualTransformation: VisualTransformation = VisualTransformation.None,
+) {
+    val shape = RoundedCornerShape(12.dp)
+
+    BasicTextField(
+        value = value,
+        onValueChange = onValueChange,
+        modifier = modifier
+            .fillMaxWidth()
+            .clip(shape)
+            .background(palette.fieldBackground, shape)
+            .border(1.dp, palette.fieldBorder, shape)
+            .padding(horizontal = 16.dp, vertical = 14.dp),
+        textStyle = MaterialTheme.typography.bodyLarge.copy(color = palette.fieldText),
+        singleLine = true,
+        keyboardOptions = keyboardOptions,
+        keyboardActions = keyboardActions,
+        visualTransformation = visualTransformation,
+        cursorBrush = SolidColor(Maple500),
+        decorationBox = { innerTextField ->
+            Box(modifier = Modifier.fillMaxWidth()) {
+                if (value.isEmpty()) {
+                    Text(
+                        placeholder,
+                        style = MaterialTheme.typography.bodyLarge,
+                        color = palette.fieldPlaceholder,
+                    )
+                }
+                innerTextField()
+            }
+        },
+    )
+}
+
+@Composable
+private fun GlassyOutlinedButton(
+    text: String,
+    onClick: () -> Unit,
+    palette: LoginPalette,
+    enabled: Boolean = true,
+) {
+    val interactionSource = remember { MutableInteractionSource() }
+    val isPressed by interactionSource.collectIsPressedAsState()
+    val scale by animateFloatAsState(
+        targetValue = if (isPressed) 0.95f else 1f,
+        animationSpec = tween(durationMillis = 200),
+    )
+
+    Button(
+        onClick = onClick,
+        modifier = Modifier
+            .fillMaxWidth()
+            .height(44.dp)
+            .scale(scale)
+            .shadow(
+                elevation = 10.dp,
+                shape = RoundedCornerShape(999.dp),
+                ambientColor = palette.secondaryButtonShadow,
+                spotColor = palette.secondaryButtonShadow,
+            ),
+        enabled = enabled,
+        interactionSource = interactionSource,
+        shape = RoundedCornerShape(999.dp),
+        border = BorderStroke(
+            1.dp,
+            if (enabled) palette.secondaryButtonBorder else palette.secondaryButtonBorder.copy(alpha = 0.5f),
+        ),
+        colors = ButtonDefaults.buttonColors(
+            containerColor = palette.secondaryButtonBackground,
+            contentColor = palette.secondaryButtonForeground,
+            disabledContainerColor = palette.secondaryButtonBackground.copy(alpha = 0.5f),
+            disabledContentColor = palette.secondaryButtonForeground.copy(alpha = 0.5f),
+        ),
+        elevation = ButtonDefaults.buttonElevation(
+            defaultElevation = 0.dp,
+            pressedElevation = 0.dp,
+        ),
+    ) {
+        Text(text, fontWeight = FontWeight.Medium)
+    }
+}
+
+// -- Agent Chat --
+
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+fun AgentChatScreen(manager: AppManager) {
+    val state = manager.state
+    val isDarkTheme = isSystemInDarkTheme()
+    val palette = chatPalette(isDarkTheme)
+    val headerChromeShape = RoundedCornerShape(99.dp)
+    val composeChromeShape = RoundedCornerShape(24.dp)
+    val density = LocalDensity.current
+    var composeText by remember { mutableStateOf("") }
+    val messageIds = remember(state.messages) { state.messages.map(ChatMessage::id) }
+    val listState = rememberLazyListState()
+    var headerBottomPx by remember { mutableIntStateOf(0) }
+    var composeBarTopPx by remember { mutableIntStateOf(0) }
+    var hasSettledInitialScroll by remember { mutableStateOf(false) }
+    var pendingHistoryScrollStrategy by remember {
+        mutableStateOf<HistoryLoadScrollStrategy?>(null)
+    }
+    var previousMessageIds by remember { mutableStateOf(messageIds) }
+    var previousLastMessageContent by remember {
+        mutableStateOf(state.messages.lastOrNull()?.content)
+    }
+    var previousIsAgentTyping by remember { mutableStateOf(state.isAgentTyping) }
+    var wasNearBottom by remember { mutableStateOf(true) }
+
+    // Refresh relative timestamps every 30s
+    LaunchedEffect(Unit) {
+        while (true) {
+            kotlinx.coroutines.delay(30_000)
+            manager.dispatch(AppAction.RefreshTimestamps)
+        }
+    }
+
+    suspend fun scrollToBottom(animated: Boolean) {
+        val bottomIndex = when {
+            state.isAgentTyping -> state.messages.size
+            state.messages.isNotEmpty() -> state.messages.lastIndex
+            else -> -1
+        }
+
+        if (bottomIndex < 0) return
+
+        if (animated) {
+            listState.animateScrollToItem(bottomIndex)
+        } else {
+            listState.scrollToItem(bottomIndex)
+        }
+    }
+
+    val canScrollBackward by remember { derivedStateOf { listState.canScrollBackward } }
+    val firstVisibleIndex by remember { derivedStateOf { listState.firstVisibleItemIndex } }
+    val isNearBottom by remember { derivedStateOf { listState.isNearBottom() } }
+
+    fun requestOlderMessages() {
+        if (
+            !hasSettledInitialScroll ||
+            pendingHistoryScrollStrategy != null ||
+            state.isLoadingHistory ||
+            !state.hasOlderMessages
+        ) {
+            return
+        }
+
+        pendingHistoryScrollStrategy = if (!canScrollBackward && isNearBottom) {
+            HistoryLoadScrollStrategy.PreserveBottom
+        } else {
+            listState.historyAnchor(messageIds) ?: HistoryLoadScrollStrategy.PreserveBottom
+        }
+
+        manager.dispatch(AppAction.LoadOlderMessages)
+    }
+
+    LaunchedEffect(isNearBottom) {
+        wasNearBottom = isNearBottom
+    }
+
+    // Prefetch older messages when scrolled near top
+    LaunchedEffect(
+        firstVisibleIndex,
+        canScrollBackward,
+        state.hasOlderMessages,
+        state.isLoadingHistory,
+        hasSettledInitialScroll,
+        pendingHistoryScrollStrategy,
+    ) {
+        val shouldPrefetchOlder =
+            hasSettledInitialScroll &&
+                state.hasOlderMessages &&
+                !state.isLoadingHistory &&
+                pendingHistoryScrollStrategy == null &&
+                (firstVisibleIndex <= HISTORY_PREFETCH_THRESHOLD || !canScrollBackward)
+
+        if (shouldPrefetchOlder) {
+            requestOlderMessages()
+        }
+    }
+
+    LaunchedEffect(messageIds) {
+        when {
+            messageIds.isEmpty() -> {
+                hasSettledInitialScroll = false
+                pendingHistoryScrollStrategy = null
+            }
+
+            !hasSettledInitialScroll -> {
+                scrollToBottom(animated = false)
+                hasSettledInitialScroll = true
+            }
+
+            didPrependMessages(previousMessageIds, messageIds) -> {
+                when (val strategy = pendingHistoryScrollStrategy) {
+                    HistoryLoadScrollStrategy.PreserveBottom -> scrollToBottom(animated = false)
+                    is HistoryLoadScrollStrategy.PreserveAnchor -> {
+                        val restoredIndex = messageIds.indexOf(strategy.messageId)
+                        if (restoredIndex >= 0) {
+                            listState.scrollToItem(restoredIndex, strategy.scrollOffset)
+                        }
+                    }
+
+                    null -> Unit
+                }
+                pendingHistoryScrollStrategy = null
+            }
+
+            didAppendMessages(previousMessageIds, messageIds) && wasNearBottom -> {
+                scrollToBottom(animated = false)
+            }
+
+            else -> {
+                pendingHistoryScrollStrategy = null
+            }
+        }
+
+        previousMessageIds = messageIds
+    }
+
+    LaunchedEffect(state.isLoadingHistory) {
+        if (
+            !state.isLoadingHistory &&
+            pendingHistoryScrollStrategy != null &&
+            messageIds == previousMessageIds
+        ) {
+            pendingHistoryScrollStrategy = null
+        }
+    }
+
+    LaunchedEffect(state.messages.lastOrNull()?.content, state.isAgentTyping) {
+        val contentChanged = state.messages.lastOrNull()?.content != previousLastMessageContent
+        val typingChanged = state.isAgentTyping != previousIsAgentTyping
+
+        if (
+            hasSettledInitialScroll &&
+            pendingHistoryScrollStrategy == null &&
+            wasNearBottom &&
+            (contentChanged || typingChanged)
+        ) {
+            scrollToBottom(animated = false)
+        }
+
+        previousLastMessageContent = state.messages.lastOrNull()?.content
+        previousIsAgentTyping = state.isAgentTyping
+    }
+
+    BoxWithConstraints(modifier = Modifier.fillMaxSize()) {
+        val w = constraints.maxWidth.toFloat()
+        val backgroundGlowRadius = with(density) { 500.dp.toPx() }
+        val topContentPadding = with(density) {
+            if (headerBottomPx == 0) 108.dp else headerBottomPx.toDp() + 16.dp
+        }
+        val bottomContentPadding = with(density) {
+            if (composeBarTopPx == 0) {
+                116.dp
+            } else {
+                (constraints.maxHeight - composeBarTopPx).coerceAtLeast(0).toDp() + 16.dp
+            }
+        }
+
+        // Background radial gradient from top center (matches Figma)
+        Box(
+            modifier = Modifier
+                .fillMaxSize()
+                .background(palette.backgroundBase),
+        )
+        Box(
+            modifier = Modifier
+                .fillMaxSize()
+                .background(
+                    brush = Brush.radialGradient(
+                        colors = palette.backgroundGlow,
+                        center = androidx.compose.ui.geometry.Offset(w / 2f, 0f),
+                        radius = backgroundGlowRadius,
+                    ),
+                ),
+        )
+
+        // Messages list (full size, scrolls behind header and compose bar)
+        LazyColumn(
+            modifier = Modifier
+                .fillMaxSize()
+                .alpha(if (hasSettledInitialScroll || messageIds.isEmpty()) 1f else 0f),
+            state = listState,
+            contentPadding = PaddingValues(
+                start = 16.dp, end = 16.dp,
+                top = topContentPadding,
+                bottom = bottomContentPadding,
+            ),
+            verticalArrangement = Arrangement.spacedBy(20.dp),
+        ) {
+            items(state.messages, key = { it.id }) { message ->
+                MessageBubble(message, palette)
+            }
+
+            if (state.isAgentTyping) {
+                item(key = TYPING_INDICATOR_KEY) {
+                    Text(
+                        "Maple is typing...",
+                        style = MaterialTheme.typography.bodySmall,
+                        color = palette.metadataText,
+                        modifier = Modifier.padding(start = 8.dp),
+                    )
+                }
+            }
+        }
+
+        if (state.isLoadingHistory && state.messages.isNotEmpty()) {
+            Box(
+                modifier = Modifier
+                    .fillMaxWidth()
+                    .padding(top = topContentPadding + 8.dp)
+                    .align(Alignment.TopCenter),
+                contentAlignment = Alignment.Center,
+            ) {
+                CircularProgressIndicator(modifier = Modifier.size(20.dp), strokeWidth = 2.dp)
+            }
+        }
+
+        if ((state.isLoadingHistory && state.messages.isEmpty()) || (!hasSettledInitialScroll && messageIds.isNotEmpty())) {
+            Box(
+                modifier = Modifier.fillMaxSize(),
+                contentAlignment = Alignment.Center,
+            ) {
+                CircularProgressIndicator()
+            }
+        }
+
+        // Floating header islands
+        Box(
+            modifier = Modifier
+                .fillMaxWidth()
+                .statusBarsPadding()
+                .padding(horizontal = 16.dp, vertical = 8.dp)
+                .onGloballyPositioned { coordinates ->
+                    headerBottomPx =
+                        (coordinates.positionInRoot().y + coordinates.size.height).roundToInt()
+                }
+                .align(Alignment.TopCenter),
+        ) {
+            // MPL wordmark pill with chevron (centered)
+            Box(
+                modifier = Modifier
+                    .align(Alignment.Center)
+                    .shadow(
+                        elevation = if (isDarkTheme) 6.dp else 8.dp,
+                        shape = headerChromeShape,
+                        ambientColor = palette.chromeShadow,
+                        spotColor = palette.chromeShadow,
+                    )
+                    .background(
+                        brush = Brush.linearGradient(
+                            colors = listOf(palette.chromeHighlight, palette.chromeBackground),
+                        ),
+                        shape = headerChromeShape,
+                    )
+                    .border(
+                        width = if (isDarkTheme) 0.5.dp else 1.dp,
+                        color = palette.chromeBorder,
+                        shape = headerChromeShape,
+                    )
+                    .padding(start = 16.dp, end = 12.dp, top = 12.dp, bottom = 12.dp),
+            ) {
+                Row(verticalAlignment = Alignment.CenterVertically, horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+                    Icon(
+                        painter = androidx.compose.ui.res.painterResource(id = cloud.opensecret.maple.R.drawable.maple_wordmark_abbr),
+                        contentDescription = "Maple",
+                        modifier = Modifier.height(16.dp),
+                        tint = palette.headerWordmark,
+                    )
+                    Text("⌄", fontSize = 12.sp, fontWeight = FontWeight.Black, color = Pebble400)
+                }
+            }
+
+            // Hamburger menu pill (start aligned)
+            Box(
+                modifier = Modifier
+                    .align(Alignment.CenterStart)
+                    .size(43.dp)
+                    .shadow(
+                        elevation = if (isDarkTheme) 6.dp else 8.dp,
+                        shape = headerChromeShape,
+                        ambientColor = palette.chromeShadow,
+                        spotColor = palette.chromeShadow,
+                    )
+                    .background(
+                        brush = Brush.linearGradient(
+                            colors = listOf(palette.chromeHighlight, palette.chromeBackground),
+                        ),
+                        shape = headerChromeShape,
+                    )
+                    .border(
+                        width = if (isDarkTheme) 0.5.dp else 1.dp,
+                        color = palette.chromeBorder,
+                        shape = headerChromeShape,
+                    ),
+                contentAlignment = Alignment.Center,
+            ) {
+                IconButton(
+                    onClick = { manager.dispatch(AppAction.ToggleSettings) },
+                    modifier = Modifier.size(43.dp),
+                ) {
+                    Icon(
+                        imageVector = Icons.Filled.Menu,
+                        contentDescription = "Menu",
+                        tint = palette.secondaryIcon,
+                        modifier = Modifier.size(18.dp),
+                    )
+                }
+            }
+
+            // Search pill (end aligned)
+            Box(
+                modifier = Modifier
+                    .align(Alignment.CenterEnd)
+                    .size(43.dp)
+                    .shadow(
+                        elevation = if (isDarkTheme) 6.dp else 8.dp,
+                        shape = headerChromeShape,
+                        ambientColor = palette.chromeShadow,
+                        spotColor = palette.chromeShadow,
+                    )
+                    .background(
+                        brush = Brush.linearGradient(
+                            colors = listOf(palette.chromeHighlight, palette.chromeBackground),
+                        ),
+                        shape = headerChromeShape,
+                    )
+                    .border(
+                        width = if (isDarkTheme) 0.5.dp else 1.dp,
+                        color = palette.chromeBorder,
+                        shape = headerChromeShape,
+                    ),
+                contentAlignment = Alignment.Center,
+            ) {
+                IconButton(
+                    onClick = { },
+                    modifier = Modifier.size(43.dp),
+                ) {
+                    Icon(
+                        imageVector = Icons.Filled.Search,
+                        contentDescription = "Search",
+                        tint = palette.secondaryIcon,
+                        modifier = Modifier.size(18.dp),
+                    )
+                }
+            }
+        }
+
+        // Floating compose bar
+        Row(
+            modifier = Modifier
+                .align(Alignment.BottomCenter)
+                .fillMaxWidth()
+                .navigationBarsPadding()
+                .padding(horizontal = 16.dp, vertical = 8.dp)
+                .onGloballyPositioned { coordinates ->
+                    composeBarTopPx = coordinates.positionInRoot().y.roundToInt()
+                }
+                .shadow(
+                    elevation = if (isDarkTheme) 0.dp else 12.dp,
+                    shape = composeChromeShape,
+                    ambientColor = palette.composeShadow,
+                    spotColor = palette.composeShadow,
+                )
+                .background(
+                    color = palette.composeBackground,
+                    shape = composeChromeShape,
+                )
+                .border(
+                    width = if (isDarkTheme) 0.5.dp else 1.dp,
+                    color = palette.composeBorder,
+                    shape = composeChromeShape,
+                )
+                .padding(start = 16.dp, end = 16.dp, top = 12.dp, bottom = 14.dp),
+            verticalAlignment = Alignment.CenterVertically,
+            horizontalArrangement = Arrangement.spacedBy(8.dp),
+        ) {
+            val composeFocus = remember { FocusRequester() }
+
+            Column(
+                modifier = Modifier.weight(1f),
+                verticalArrangement = Arrangement.spacedBy(4.dp),
+            ) {
+                BasicTextField(
+                    value = composeText,
+                    onValueChange = { composeText = it },
+                    modifier = Modifier.fillMaxWidth().focusRequester(composeFocus),
+                    textStyle = MaterialTheme.typography.bodyMedium.copy(
+                        color = palette.composeText,
+                        fontWeight = FontWeight.Medium,
+                        fontSize = 15.sp,
+                    ),
+                    singleLine = false,
+                    minLines = 1,
+                    maxLines = 4,
+                    cursorBrush = SolidColor(Maple500),
+                    decorationBox = { innerTextField ->
+                        Box(modifier = Modifier.fillMaxWidth()) {
+                            if (composeText.isEmpty()) {
+                                Text("Write...", color = palette.composePlaceholder, fontSize = 15.sp, fontWeight = FontWeight.Medium)
+                            }
+                            innerTextField()
+                        }
+                    },
+                )
+
+                Box(
+                    modifier = Modifier
+                        .size(24.dp)
+                        .background(Maple500.copy(alpha = 0.15f), CircleShape),
+                    contentAlignment = Alignment.Center,
+                ) {
+                    Text("+", fontSize = 14.sp, fontWeight = FontWeight.Bold, color = Maple500)
+                }
+            }
+
+            val canSend = composeText.trim().isNotEmpty() && !state.isAgentTyping
+
+            Box(
+                modifier = Modifier
+                    .width(71.dp)
+                    .clip(RoundedCornerShape(99.dp))
+                    .background(
+                        brush = Brush.verticalGradient(
+                            colors = listOf(
+                                Maple500.copy(alpha = if (canSend) 1f else 0.5f),
+                                Maple700.copy(alpha = if (canSend) 1f else 0.5f),
+                            ),
+                        ),
+                    )
+                    .clickable(enabled = canSend) {
+                        val text = composeText.trim()
+                        if (text.isNotEmpty()) {
+                            manager.dispatch(AppAction.SendMessage(content = text))
+                            composeText = ""
+                        }
+                    }
+                    .padding(horizontal = 24.dp, vertical = 8.dp),
+                contentAlignment = Alignment.Center,
+            ) {
+                Text(
+                    "↑",
+                    fontSize = 20.sp,
+                    fontWeight = FontWeight.Black,
+                    color = Color.White.copy(alpha = if (canSend) 1f else 0.1f),
+                )
+            }
+        }
+    }
+
+    if (state.showSettings) {
+        SettingsSheet(manager = manager, palette = palette)
+    }
+
+    if (state.confirmDeleteAgent) {
+        AlertDialog(
+            onDismissRequest = { manager.dispatch(AppAction.CancelDeleteAgent) },
+            containerColor = palette.sheetBackground,
+            titleContentColor = palette.surfaceText,
+            textContentColor = palette.metadataText,
+            title = { Text("Delete Agent?") },
+            text = { Text("This will permanently delete your agent conversation history. This cannot be undone.") },
+            confirmButton = {
+                TextButton(onClick = { manager.dispatch(AppAction.ConfirmDeleteAgent) }) {
+                    Text("Delete", color = MapleError)
+                }
+            },
+            dismissButton = {
+                TextButton(onClick = { manager.dispatch(AppAction.CancelDeleteAgent) }) {
+                    Text("Cancel", color = palette.surfaceText)
+                }
+            },
+        )
+    }
+}
+
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+private fun SettingsSheet(manager: AppManager, palette: ChatPalette) {
+    val sheetState = rememberModalBottomSheetState()
+
+    ModalBottomSheet(
+        onDismissRequest = { manager.dispatch(AppAction.ToggleSettings) },
+        sheetState = sheetState,
+        containerColor = palette.sheetBackground,
+        contentColor = palette.surfaceText,
+    ) {
+        Column(modifier = Modifier.padding(horizontal = 16.dp, vertical = 8.dp)) {
+            Text(
+                "Settings",
+                style = MaterialTheme.typography.titleMedium,
+                color = palette.surfaceText,
+                modifier = Modifier.padding(bottom = 16.dp),
+            )
+            TextButton(
+                onClick = { manager.dispatch(AppAction.RequestDeleteAgent) },
+                enabled = !manager.state.isDeletingAgent,
+                shape = RoundedCornerShape(999.dp),
+            ) {
+                Icon(
+                    imageVector = Icons.Filled.Delete,
+                    contentDescription = null,
+                    tint = MapleError,
+                    modifier = Modifier.padding(end = 8.dp),
+                )
+                Text("Delete Agent", color = MapleError)
+            }
+            HorizontalDivider(modifier = Modifier.padding(vertical = 8.dp), color = palette.sheetDivider)
+            TextButton(
+                onClick = {
+                    manager.dispatch(AppAction.ToggleSettings)
+                    manager.dispatch(AppAction.Logout)
+                },
+                shape = RoundedCornerShape(999.dp),
+            ) {
+                Icon(
+                    imageVector = Icons.AutoMirrored.Filled.ExitToApp,
+                    contentDescription = null,
+                    tint = palette.sheetSecondaryText,
+                    modifier = Modifier.padding(end = 8.dp),
+                )
+                Text("Sign Out", color = palette.surfaceText)
+            }
+            Spacer(modifier = Modifier.height(32.dp))
+        }
+    }
+}
+
+@Composable
+private fun MessageBubble(message: ChatMessage, palette: ChatPalette) {
+    val isUser = message.isUser
+    val alignment = if (isUser) Alignment.End else Alignment.Start
+    val bubbleShape = RoundedCornerShape(
+        topStart = 24.dp, topEnd = 24.dp,
+        bottomStart = if (isUser) 24.dp else 4.dp,
+        bottomEnd = if (isUser) 4.dp else 24.dp,
+    )
+
+    Column(
+        modifier = Modifier.fillMaxWidth(),
+        horizontalAlignment = alignment,
+    ) {
+        if (isUser) {
+            Box(
+                modifier = Modifier
+                    .widthIn(max = 300.dp)
+                    .background(palette.userBubbleColor, bubbleShape)
+                    .padding(horizontal = 12.dp, vertical = 8.dp),
+            ) {
+                Text(
+                    text = message.content,
+                    color = palette.userText,
+                    style = TextStyle(
+                        fontFamily = ManropeFamily,
+                        fontWeight = FontWeight.Medium,
+                        fontSize = 16.sp,
+                        lineHeight = 26.sp,
+                    ),
+                )
+            }
+        } else {
+            Text(
+                text = message.content,
+                color = palette.assistantText,
+                style = TextStyle(
+                    fontFamily = ManropeFamily,
+                    fontWeight = FontWeight.Medium,
+                    fontSize = 16.sp,
+                    lineHeight = 26.sp,
+                ),
+                modifier = Modifier.widthIn(max = 300.dp),
+            )
+        }
+        if (message.showTimestamp) {
+            Text(
+                text = message.timestampDisplay,
+                style = MaterialTheme.typography.labelSmall.copy(fontSize = 10.sp),
+                color = palette.metadataText,
+                modifier = Modifier.padding(start = 8.dp, end = 8.dp).padding(top = 2.dp),
+            )
+        }
+    }
+}
diff --git a/native/android/app/src/main/java/cloud/opensecret/maple/ui/theme/Color.kt b/native/android/app/src/main/java/cloud/opensecret/maple/ui/theme/Color.kt
new file mode 100644
index 00000000..51462f1f
--- /dev/null
+++ b/native/android/app/src/main/java/cloud/opensecret/maple/ui/theme/Color.kt
@@ -0,0 +1,70 @@
+package cloud.opensecret.maple.ui.theme
+
+import androidx.compose.ui.graphics.Color
+
+// Maple (Primary) - "Primary brand energy"
+val Maple50 = Color(0xFFFFF4F0)
+val Maple100 = Color(0xFFFFE8E0)
+val Maple200 = Color(0xFFFFD1C1)
+val Maple300 = Color(0xFFFFBAA2)
+val Maple400 = Color(0xFFFFA88A)
+val Maple500 = Color(0xFFFF9771)
+val Maple600 = Color(0xFFF67D57)
+val Maple700 = Color(0xFFE8633D)
+val Maple800 = Color(0xFFD04926)
+val Maple900 = Color(0xFFA83515)
+
+// Pebble (Secondary) - "Ethereal balance"
+val Pebble50 = Color(0xFFF7F7F9)
+val Pebble100 = Color(0xFFE8E8ED)
+val Pebble200 = Color(0xFFD1D2DC)
+val Pebble300 = Color(0xFFBABCCB)
+val Pebble400 = Color(0xFF9C9DAB)
+val Pebble500 = Color(0xFF8A8B9A)
+val Pebble600 = Color(0xFF757689)
+val Pebble700 = Color(0xFF5E5F6E)
+val Pebble800 = Color(0xFF474854)
+val Pebble900 = Color(0xFF30313A)
+
+// Bark (Tertiary) - "Grounded structure"
+val Bark50 = Color(0xFFF8F5F4)
+val Bark100 = Color(0xFFEADED9)
+val Bark200 = Color(0xFFD4BCAF)
+val Bark300 = Color(0xFFC29A8D)
+val Bark400 = Color(0xFFB0877C)
+val Bark500 = Color(0xFF9E7469)
+val Bark600 = Color(0xFF8A6055)
+val Bark700 = Color(0xFF704D43)
+val Bark800 = Color(0xFF583A32)
+val Bark900 = Color(0xFF3D2821)
+
+// Grove (Tertiary) - "Organic calming"
+val Grove50 = Color(0xFFF7F6F0)
+val Grove100 = Color(0xFFE8E4D4)
+val Grove200 = Color(0xFFD3CCB0)
+val Grove300 = Color(0xFFBEB48C)
+val Grove400 = Color(0xFFAEA375)
+val Grove500 = Color(0xFF9E925E)
+val Grove600 = Color(0xFF8A7F4C)
+val Grove700 = Color(0xFF726B3C)
+val Grove800 = Color(0xFF5A542D)
+val Grove900 = Color(0xFF3F3B1F)
+
+// Neutral - "Focus and clarity"
+val Neutral0 = Color(0xFFFAFAFA)
+val Neutral50 = Color(0xFFF5F5F5)
+val Neutral100 = Color(0xFFE5E5E5)
+val Neutral200 = Color(0xFFD4D4D4)
+val Neutral300 = Color(0xFFA3A3A3)
+val Neutral400 = Color(0xFF737373)
+val Neutral500 = Color(0xFF525252)
+val Neutral600 = Color(0xFF404040)
+val Neutral700 = Color(0xFF262626)
+val Neutral800 = Color(0xFF171717)
+val Neutral900 = Color(0xFF0A0A0A)
+
+// Semantic States
+val MapleSuccess = Color(0xFF7B8F4A)
+val MapleWarning = Color(0xFFD4A35A)
+val MapleError = Color(0xFFD05E41)
+val MapleInfo = Color(0xFF7E8DA1)
diff --git a/native/android/app/src/main/java/cloud/opensecret/maple/ui/theme/Theme.kt b/native/android/app/src/main/java/cloud/opensecret/maple/ui/theme/Theme.kt
new file mode 100644
index 00000000..715ddaad
--- /dev/null
+++ b/native/android/app/src/main/java/cloud/opensecret/maple/ui/theme/Theme.kt
@@ -0,0 +1,154 @@
+package cloud.opensecret.maple.ui.theme
+
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Shapes
+import androidx.compose.material3.Typography
+import androidx.compose.material3.darkColorScheme
+import androidx.compose.material3.lightColorScheme
+import androidx.compose.foundation.isSystemInDarkTheme
+import androidx.compose.runtime.Composable
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.text.TextStyle
+import androidx.compose.ui.text.font.Font
+import androidx.compose.ui.text.font.FontFamily
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
+import cloud.opensecret.maple.R
+
+private val MapleLightColorScheme = lightColorScheme(
+    primary = Maple500,
+    onPrimary = Color.White,
+    primaryContainer = Maple100,
+    onPrimaryContainer = Maple900,
+    secondary = Pebble500,
+    onSecondary = Color.White,
+    secondaryContainer = Pebble100,
+    onSecondaryContainer = Pebble900,
+    tertiary = Bark500,
+    onTertiary = Color.White,
+    tertiaryContainer = Bark100,
+    onTertiaryContainer = Bark900,
+    background = Neutral50,
+    onBackground = Neutral900,
+    surface = Neutral0,
+    onSurface = Neutral900,
+    surfaceVariant = Neutral100,
+    onSurfaceVariant = Neutral600,
+    outline = Neutral300,
+    outlineVariant = Neutral200,
+    error = MapleError,
+    onError = Color.White,
+    errorContainer = Maple50,
+    onErrorContainer = Maple900,
+)
+
+private val MapleDarkColorScheme = darkColorScheme(
+    primary = Color(0xFFFFB59B),
+    onPrimary = Color(0xFF55200A),
+    primaryContainer = Color(0xFF72351E),
+    onPrimaryContainer = Color(0xFFFFDBCF),
+    secondary = Color(0xFFE7BDB0),
+    onSecondary = Color(0xFF442A21),
+    secondaryContainer = Color(0xFF5D4036),
+    onSecondaryContainer = Color(0xFFFFDBCF),
+    tertiary = Color(0xFFD5C68E),
+    onTertiary = Color(0xFF393005),
+    tertiaryContainer = Color(0xFF50461A),
+    onTertiaryContainer = Color(0xFFF2E2A7),
+    background = Color(0xFF1A110E),
+    onBackground = Color(0xFFF1DFD9),
+    surface = Color(0xFF1A110E),
+    onSurface = Color(0xFFF1DFD9),
+    surfaceVariant = Color(0xFF53433E),
+    onSurfaceVariant = Color(0xFFD8C2BB),
+    outline = Color(0xFFA08D86),
+    outlineVariant = Color(0xFF53433E),
+    error = Color(0xFFFFB4AB),
+    onError = Color(0xFF690005),
+    errorContainer = Color(0xFF93000A),
+    onErrorContainer = Color(0xFFFFDAD6),
+)
+
+private val MapleShapes = Shapes(
+    small = RoundedCornerShape(8.dp),
+    medium = RoundedCornerShape(12.dp),
+    large = RoundedCornerShape(16.dp),
+    extraLarge = RoundedCornerShape(24.dp),
+)
+
+val ManropeFamily = FontFamily(
+    Font(R.font.manrope_regular, FontWeight.Normal),
+    Font(R.font.manrope_medium, FontWeight.Medium),
+    Font(R.font.manrope_semibold, FontWeight.SemiBold),
+    Font(R.font.manrope_bold, FontWeight.Bold),
+)
+
+val ArrayFamily = FontFamily(
+    Font(R.font.array_bold, FontWeight.Bold),
+)
+
+private val MapleTypography = Typography(
+    headlineLarge = TextStyle(
+        fontFamily = ManropeFamily,
+        fontWeight = FontWeight.SemiBold,
+        fontSize = 24.sp,
+        lineHeight = 32.sp,
+    ),
+    headlineMedium = TextStyle(
+        fontFamily = ManropeFamily,
+        fontWeight = FontWeight.Medium,
+        fontSize = 20.sp,
+        lineHeight = 28.sp,
+    ),
+    titleLarge = TextStyle(
+        fontFamily = ManropeFamily,
+        fontWeight = FontWeight.SemiBold,
+        fontSize = 20.sp,
+        lineHeight = 28.sp,
+    ),
+    titleMedium = TextStyle(
+        fontFamily = ManropeFamily,
+        fontWeight = FontWeight.Medium,
+        fontSize = 16.sp,
+        lineHeight = 24.sp,
+    ),
+    bodyLarge = TextStyle(
+        fontFamily = ManropeFamily,
+        fontWeight = FontWeight.Normal,
+        fontSize = 16.sp,
+        lineHeight = 24.sp,
+    ),
+    bodyMedium = TextStyle(
+        fontFamily = ManropeFamily,
+        fontWeight = FontWeight.Normal,
+        fontSize = 14.sp,
+        lineHeight = 20.sp,
+    ),
+    labelLarge = TextStyle(
+        fontFamily = ManropeFamily,
+        fontWeight = FontWeight.Medium,
+        fontSize = 14.sp,
+        lineHeight = 20.sp,
+    ),
+    labelMedium = TextStyle(
+        fontFamily = ManropeFamily,
+        fontWeight = FontWeight.Medium,
+        fontSize = 12.sp,
+        lineHeight = 16.sp,
+    ),
+)
+
+@Composable
+fun AppTheme(
+    darkTheme: Boolean = isSystemInDarkTheme(),
+    content: @Composable () -> Unit,
+) {
+    MaterialTheme(
+        colorScheme = if (darkTheme) MapleDarkColorScheme else MapleLightColorScheme,
+        shapes = MapleShapes,
+        typography = MapleTypography,
+        content = content,
+    )
+}
diff --git a/native/android/app/src/main/res/drawable/maple_wordmark.xml b/native/android/app/src/main/res/drawable/maple_wordmark.xml
new file mode 100644
index 00000000..5a1658be
--- /dev/null
+++ b/native/android/app/src/main/res/drawable/maple_wordmark.xml
@@ -0,0 +1,21 @@
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="248dp"
+    android:height="48dp"
+    android:viewportWidth="248"
+    android:viewportHeight="48">
+    <path
+        android:pathData="M0,41.24V6.07C0,0.65 5.78,-1.72 10.19,1.44L26.92,15.56L43.64,1.44C48.06,-1.72 53.83,0.65 53.83,6.07V41.24C53.83,44.97 50.8,48 47.05,48H6.18C2.16,48 0,45.63 0,41.24Z"
+        android:fillColor="#F7F7F9"/>
+    <path
+        android:pathData="M58.79,39.84L79.69,3.37C82.26,-1.11 86.56,-1.13 89.14,3.37L110.03,39.84C112.77,44.61 111.08,48 105.56,48H63.26C57.74,48 56.05,44.62 58.79,39.84Z"
+        android:fillColor="#F7F7F9"/>
+    <path
+        android:pathData="M137.26,39.41V41.24C137.26,44.97 134.22,48 130.48,48H121.49C117.75,48 114.71,44.97 114.71,41.24V7.56C114.71,3.83 117.75,0.8 121.49,0.8H136.83C154.65,0.8 160.97,8.66 160.97,20.13C160.97,31.61 154.75,39.28 137.26,39.41Z"
+        android:fillColor="#F7F7F9"/>
+    <path
+        android:pathData="M164.19,41.24V7.56C164.19,3.83 167.23,0.8 170.97,0.8H179.96C183.71,0.8 186.74,3.83 186.74,7.56V16.53H195.74C199.49,16.53 202.52,19.56 202.52,23.29V41.24C202.52,44.97 199.49,48 195.74,48H170.97C167.23,48 164.19,44.97 164.19,41.24Z"
+        android:fillColor="#F7F7F9"/>
+    <path
+        android:pathData="M240.3,16.53H230.6C233.94,17.49 236.39,20.55 236.39,24.19C236.39,28.03 233.67,31.23 230.05,31.98H240.32C244.71,31.98 247.08,34.34 247.08,38.72V41.25C247.08,45.63 244.71,48 240.32,48H212.98C208.58,48 206.22,45.63 206.22,41.25V7.54C206.22,3.16 208.58,0.8 212.98,0.8H240.32C244.71,0.8 247.08,3.16 247.08,7.54V9.78C247.08,13.51 244.05,16.53 240.31,16.53Z"
+        android:fillColor="#F7F7F9"/>
+</vector>
diff --git a/native/android/app/src/main/res/drawable/maple_wordmark_abbr.xml b/native/android/app/src/main/res/drawable/maple_wordmark_abbr.xml
new file mode 100644
index 00000000..03042601
--- /dev/null
+++ b/native/android/app/src/main/res/drawable/maple_wordmark_abbr.xml
@@ -0,0 +1,15 @@
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="100dp"
+    android:height="32dp"
+    android:viewportWidth="100"
+    android:viewportHeight="32">
+    <path
+        android:pathData="M0,27.48V4.03C0,0.42 3.85,-1.16 6.8,0.95L17.94,10.36L29.09,0.95C32.04,-1.16 35.89,0.42 35.89,4.03V27.48C35.89,29.97 33.86,31.98 31.37,31.98H4.12C1.44,31.98 0,30.41 0,27.48Z"
+        android:fillColor="#F7F7F9"/>
+    <path
+        android:pathData="M55.38,26V27.23C55.38,29.71 53.36,31.73 50.86,31.73H44.87C42.37,31.73 40.35,29.71 40.35,27.23V4.77C40.35,2.28 42.37,0.27 44.87,0.27H55.1C66.98,0.27 71.18,5.5 71.18,13.15C71.18,20.8 67.04,25.92 55.38,26Z"
+        android:fillColor="#F7F7F9"/>
+    <path
+        android:pathData="M74.34,27.23V4.77C74.34,2.28 76.36,0.27 78.86,0.27H84.85C87.35,0.27 89.37,2.28 89.37,4.77V10.75H95.37C97.87,10.75 99.89,12.77 99.89,15.26V27.22C99.89,29.71 97.87,31.73 95.37,31.73H78.86C76.36,31.73 74.34,29.71 74.34,27.22Z"
+        android:fillColor="#F7F7F9"/>
+</vector>
diff --git a/native/android/app/src/main/res/font/array_bold.ttf b/native/android/app/src/main/res/font/array_bold.ttf
new file mode 100644
index 00000000..85af9a9d
Binary files /dev/null and b/native/android/app/src/main/res/font/array_bold.ttf differ
diff --git a/native/android/app/src/main/res/font/manrope_bold.ttf b/native/android/app/src/main/res/font/manrope_bold.ttf
new file mode 100644
index 00000000..62a61839
Binary files /dev/null and b/native/android/app/src/main/res/font/manrope_bold.ttf differ
diff --git a/native/android/app/src/main/res/font/manrope_medium.ttf b/native/android/app/src/main/res/font/manrope_medium.ttf
new file mode 100644
index 00000000..c6d28def
Binary files /dev/null and b/native/android/app/src/main/res/font/manrope_medium.ttf differ
diff --git a/native/android/app/src/main/res/font/manrope_regular.ttf b/native/android/app/src/main/res/font/manrope_regular.ttf
new file mode 100644
index 00000000..9a108f1c
Binary files /dev/null and b/native/android/app/src/main/res/font/manrope_regular.ttf differ
diff --git a/native/android/app/src/main/res/font/manrope_semibold.ttf b/native/android/app/src/main/res/font/manrope_semibold.ttf
new file mode 100644
index 00000000..46a13d61
Binary files /dev/null and b/native/android/app/src/main/res/font/manrope_semibold.ttf differ
diff --git a/native/android/app/src/main/res/mipmap-hdpi/ic_launcher.png b/native/android/app/src/main/res/mipmap-hdpi/ic_launcher.png
new file mode 100644
index 00000000..f85d6125
Binary files /dev/null and b/native/android/app/src/main/res/mipmap-hdpi/ic_launcher.png differ
diff --git a/native/android/app/src/main/res/mipmap-hdpi/ic_launcher_round.png b/native/android/app/src/main/res/mipmap-hdpi/ic_launcher_round.png
new file mode 100644
index 00000000..f85d6125
Binary files /dev/null and b/native/android/app/src/main/res/mipmap-hdpi/ic_launcher_round.png differ
diff --git a/native/android/app/src/main/res/mipmap-mdpi/ic_launcher.png b/native/android/app/src/main/res/mipmap-mdpi/ic_launcher.png
new file mode 100644
index 00000000..4a3759f3
Binary files /dev/null and b/native/android/app/src/main/res/mipmap-mdpi/ic_launcher.png differ
diff --git a/native/android/app/src/main/res/mipmap-mdpi/ic_launcher_round.png b/native/android/app/src/main/res/mipmap-mdpi/ic_launcher_round.png
new file mode 100644
index 00000000..4a3759f3
Binary files /dev/null and b/native/android/app/src/main/res/mipmap-mdpi/ic_launcher_round.png differ
diff --git a/native/android/app/src/main/res/mipmap-xhdpi/ic_launcher.png b/native/android/app/src/main/res/mipmap-xhdpi/ic_launcher.png
new file mode 100644
index 00000000..8bfe2d86
Binary files /dev/null and b/native/android/app/src/main/res/mipmap-xhdpi/ic_launcher.png differ
diff --git a/native/android/app/src/main/res/mipmap-xhdpi/ic_launcher_round.png b/native/android/app/src/main/res/mipmap-xhdpi/ic_launcher_round.png
new file mode 100644
index 00000000..8bfe2d86
Binary files /dev/null and b/native/android/app/src/main/res/mipmap-xhdpi/ic_launcher_round.png differ
diff --git a/native/android/app/src/main/res/mipmap-xxhdpi/ic_launcher.png b/native/android/app/src/main/res/mipmap-xxhdpi/ic_launcher.png
new file mode 100644
index 00000000..223e00da
Binary files /dev/null and b/native/android/app/src/main/res/mipmap-xxhdpi/ic_launcher.png differ
diff --git a/native/android/app/src/main/res/mipmap-xxhdpi/ic_launcher_round.png b/native/android/app/src/main/res/mipmap-xxhdpi/ic_launcher_round.png
new file mode 100644
index 00000000..223e00da
Binary files /dev/null and b/native/android/app/src/main/res/mipmap-xxhdpi/ic_launcher_round.png differ
diff --git a/native/android/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png b/native/android/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png
new file mode 100644
index 00000000..5184cb11
Binary files /dev/null and b/native/android/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png differ
diff --git a/native/android/app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.png b/native/android/app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.png
new file mode 100644
index 00000000..5184cb11
Binary files /dev/null and b/native/android/app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.png differ
diff --git a/native/android/app/src/main/res/values/strings.xml b/native/android/app/src/main/res/values/strings.xml
new file mode 100644
index 00000000..aee402c0
--- /dev/null
+++ b/native/android/app/src/main/res/values/strings.xml
@@ -0,0 +1,3 @@
+<resources>
+    <string name="app_name">Hello Chat</string>
+</resources>
diff --git a/native/android/app/src/main/res/values/themes.xml b/native/android/app/src/main/res/values/themes.xml
new file mode 100644
index 00000000..b72bfb9a
--- /dev/null
+++ b/native/android/app/src/main/res/values/themes.xml
@@ -0,0 +1,3 @@
+<resources>
+    <style name="Theme.App" parent="android:Theme.Material.Light.NoActionBar" />
+</resources>
diff --git a/native/android/build.gradle.kts b/native/android/build.gradle.kts
new file mode 100644
index 00000000..910fe24c
--- /dev/null
+++ b/native/android/build.gradle.kts
@@ -0,0 +1,4 @@
+plugins {
+    id("com.android.application") version "8.5.1" apply false
+    id("org.jetbrains.kotlin.android") version "1.9.24" apply false
+}
diff --git a/native/android/gradle.properties b/native/android/gradle.properties
new file mode 100644
index 00000000..32a0c141
--- /dev/null
+++ b/native/android/gradle.properties
@@ -0,0 +1,3 @@
+android.useAndroidX=true
+kotlin.code.style=official
+org.gradle.jvmargs=-Xmx2048m
diff --git a/native/android/gradle/wrapper/gradle-wrapper.jar b/native/android/gradle/wrapper/gradle-wrapper.jar
new file mode 100644
index 00000000..980502d1
Binary files /dev/null and b/native/android/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/native/android/gradle/wrapper/gradle-wrapper.properties b/native/android/gradle/wrapper/gradle-wrapper.properties
new file mode 100644
index 00000000..128196a7
--- /dev/null
+++ b/native/android/gradle/wrapper/gradle-wrapper.properties
@@ -0,0 +1,7 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.0-milestone-1-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists
diff --git a/native/android/gradlew b/native/android/gradlew
new file mode 100755
index 00000000..faf93008
--- /dev/null
+++ b/native/android/gradlew
@@ -0,0 +1,251 @@
+#!/bin/sh
+
+#
+# Copyright © 2015-2021 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+##############################################################################
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
+##############################################################################
+
+# Attempt to set APP_HOME
+
+# Resolve links: $0 may be a link
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
+done
+
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD=maximum
+
+warn () {
+    echo "$*"
+} >&2
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+} >&2
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
+esac
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD=$JAVA_HOME/jre/sh/java
+    else
+        JAVACMD=$JAVA_HOME/bin/java
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+fi
+
+# Increase the maximum file descriptors if we can.
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
+fi
+
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        org.gradle.wrapper.GradleWrapperMain \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
+exec "$JAVACMD" "$@"
diff --git a/native/android/gradlew.bat b/native/android/gradlew.bat
new file mode 100644
index 00000000..9b42019c
--- /dev/null
+++ b/native/android/gradlew.bat
@@ -0,0 +1,94 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
+
+@if "%DEBUG%"=="" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if %ERRORLEVEL% equ 0 goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if %ERRORLEVEL% equ 0 goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega
diff --git a/native/android/settings.gradle.kts b/native/android/settings.gradle.kts
new file mode 100644
index 00000000..008f267c
--- /dev/null
+++ b/native/android/settings.gradle.kts
@@ -0,0 +1,16 @@
+pluginManagement {
+    repositories {
+        google()
+        mavenCentral()
+        gradlePluginPortal()
+    }
+}
+dependencyResolutionManagement {
+    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
+    repositories {
+        google()
+        mavenCentral()
+    }
+}
+rootProject.name = "Hello Chat"
+include(":app")
diff --git a/native/desktop/gtk/Cargo.toml b/native/desktop/gtk/Cargo.toml
new file mode 100644
index 00000000..50171479
--- /dev/null
+++ b/native/desktop/gtk/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "maple_desktop_gtk"
+version = "3.0.0"
+edition = "2021"
+publish = false
+
+[dependencies]
+maple_core = { path = "../../rust" }
+gtk4 = "0.9"
+flume = "0.11"
+dirs-next = "2"
+dotenvy = "0.15"
+keyring = { version = "3", features = ["apple-native", "windows-native", "linux-native"] }
diff --git a/native/desktop/gtk/src/app.rs b/native/desktop/gtk/src/app.rs
new file mode 100644
index 00000000..2663739a
--- /dev/null
+++ b/native/desktop/gtk/src/app.rs
@@ -0,0 +1,1582 @@
+use std::cell::RefCell;
+use std::rc::Rc;
+use std::time::Duration;
+
+use gtk::glib::{self, ControlFlow};
+use gtk::pango;
+use gtk::prelude::*;
+use gtk4 as gtk;
+use maple_core::{AppAction, AppState, AppUpdate, AuthState, ChatMessage, OAuthProvider, Screen};
+
+use crate::manager::AppManager;
+use crate::theme::{
+    self, background_area, BackgroundKind, ThemeConfig, PEBBLE_400, SPACE_LG, SPACE_MD, SPACE_SM,
+    SPACE_XS,
+};
+use crate::wordmark::{abbr_wordmark, full_wordmark};
+
+const DEFAULT_WINDOW_WIDTH: i32 = 430;
+const DEFAULT_WINDOW_HEIGHT: i32 = 860;
+const MIN_WINDOW_WIDTH: i32 = 360;
+const MIN_WINDOW_HEIGHT: i32 = 640;
+const LOGIN_CARD_WIDTH: i32 = 360;
+const HISTORY_PREFETCH_THRESHOLD: f64 = 72.0;
+const BOTTOM_FOLLOW_THRESHOLD: f64 = 96.0;
+const MESSAGE_MAX_WIDTH_CHARS: i32 = 34;
+
+pub fn launch(app: &gtk::Application) {
+    match DesktopApp::new(app) {
+        Ok(desktop) => desktop.start(),
+        Err(error) => show_boot_error(app, &error),
+    }
+}
+
+#[derive(Clone, Default)]
+struct LoginFormState {
+    email: String,
+    password: String,
+    name: String,
+    is_sign_up: bool,
+}
+
+#[derive(Clone)]
+struct Model {
+    state: AppState,
+    login: LoginFormState,
+    compose_text: String,
+    splash_min_elapsed: bool,
+    toast_serial: u64,
+    previous_message_ids: Vec<String>,
+    previous_last_message_content: Option<String>,
+    previous_is_agent_typing: bool,
+    has_settled_initial_scroll: bool,
+    pending_history_restore: Option<HistoryLoadScrollStrategy>,
+}
+
+impl Model {
+    fn new(state: AppState) -> Self {
+        Self {
+            previous_message_ids: message_ids(&state),
+            previous_last_message_content: state
+                .messages
+                .last()
+                .map(|message| message.content.clone()),
+            previous_is_agent_typing: state.is_agent_typing,
+            state,
+            login: LoginFormState::default(),
+            compose_text: String::new(),
+            splash_min_elapsed: false,
+            toast_serial: 0,
+            has_settled_initial_scroll: false,
+            pending_history_restore: None,
+        }
+    }
+
+    fn can_send(&self) -> bool {
+        !self.compose_text.trim().is_empty() && !self.state.is_agent_typing
+    }
+
+    fn login_is_loading(&self) -> bool {
+        matches!(self.state.auth, AuthState::LoggingIn | AuthState::SigningUp)
+    }
+
+    fn splash_visible(&self) -> bool {
+        !self.splash_min_elapsed || self.state.router.default_screen == Screen::Loading
+    }
+}
+
+#[derive(Clone, Copy)]
+enum HistoryLoadScrollStrategy {
+    PreserveBottom,
+    PreserveOffset {
+        upper_before: f64,
+        value_before: f64,
+    },
+}
+
+#[derive(Clone, Copy)]
+enum ChatPostRenderAction {
+    None,
+    ScrollToBottom {
+        settle_initial: bool,
+    },
+    RestoreOffset {
+        upper_before: f64,
+        value_before: f64,
+    },
+}
+
+#[derive(Clone, Copy)]
+struct ChatViewportSnapshot {
+    was_near_bottom: bool,
+}
+
+struct Widgets {
+    window: gtk::ApplicationWindow,
+    screen_stack: gtk::Stack,
+    splash_revealer: gtk::Revealer,
+    toast_revealer: gtk::Revealer,
+    toast_button: gtk::Button,
+    toast_label: gtk::Label,
+    login_name_revealer: gtk::Revealer,
+    login_name_entry: gtk::Entry,
+    login_email_entry: gtk::Entry,
+    login_password_entry: gtk::Entry,
+    login_primary_button: gtk::Button,
+    login_primary_label: gtk::Label,
+    login_toggle_button: gtk::Button,
+    oauth_buttons: Vec<gtk::Button>,
+    chat_menu_button: gtk::Button,
+    chat_messages_scroller: gtk::ScrolledWindow,
+    chat_messages_box: gtk::Box,
+    chat_top_spinner: gtk::Spinner,
+    chat_center_spinner: gtk::Spinner,
+    chat_compose_view: gtk::TextView,
+    chat_compose_placeholder: gtk::Label,
+    chat_send_button: gtk::Button,
+    settings_dialog: gtk::Dialog,
+    settings_delete_button: gtk::Button,
+    settings_sign_out_button: gtk::Button,
+    delete_dialog: gtk::MessageDialog,
+}
+
+struct DesktopApp {
+    manager: AppManager,
+    widgets: Widgets,
+    model: RefCell<Model>,
+}
+
+impl DesktopApp {
+    fn new(application: &gtk::Application) -> Result<Rc<Self>, String> {
+        let theme = ThemeConfig::new(theme::detect_dark_mode());
+        theme::install_css(theme);
+
+        let manager = AppManager::new()?;
+        let model = Model::new(manager.state());
+        let widgets = build_widgets(application, theme);
+
+        let app = Rc::new(Self {
+            manager,
+            widgets,
+            model: RefCell::new(model),
+        });
+
+        app.connect_events();
+        app.sync_screen();
+        app.sync_login_form();
+        app.sync_chat_inputs();
+        app.rebuild_chat_messages(ChatPostRenderAction::None);
+        app.sync_chat_loading_state();
+        app.sync_toast();
+        app.sync_splash();
+        app.sync_dialogs();
+
+        Ok(app)
+    }
+
+    fn start(self: &Rc<Self>) {
+        self.start_update_bridge();
+        self.start_timers();
+        self.widgets.window.present();
+    }
+
+    fn connect_events(self: &Rc<Self>) {
+        {
+            let app = Rc::clone(self);
+            self.widgets.login_name_entry.connect_changed(move |entry| {
+                app.model.borrow_mut().login.name = entry.text().to_string();
+            });
+        }
+        {
+            let app = Rc::clone(self);
+            self.widgets
+                .login_email_entry
+                .connect_changed(move |entry| {
+                    app.model.borrow_mut().login.email = entry.text().to_string();
+                    app.sync_login_form();
+                });
+        }
+        {
+            let app = Rc::clone(self);
+            self.widgets
+                .login_password_entry
+                .connect_changed(move |entry| {
+                    app.model.borrow_mut().login.password = entry.text().to_string();
+                    app.sync_login_form();
+                });
+        }
+        {
+            let app = Rc::clone(self);
+            self.widgets
+                .login_name_entry
+                .connect_activate(move |_| app.submit_auth());
+        }
+        {
+            let app = Rc::clone(self);
+            self.widgets.login_email_entry.connect_activate(move |_| {
+                app.widgets.login_password_entry.grab_focus();
+            });
+        }
+        {
+            let app = Rc::clone(self);
+            self.widgets
+                .login_password_entry
+                .connect_activate(move |_| app.submit_auth());
+        }
+        {
+            let app = Rc::clone(self);
+            self.widgets.login_primary_button.connect_clicked(move |_| {
+                app.submit_auth();
+            });
+        }
+        {
+            let app = Rc::clone(self);
+            self.widgets.login_toggle_button.connect_clicked(move |_| {
+                {
+                    let mut model = app.model.borrow_mut();
+                    model.login.is_sign_up = !model.login.is_sign_up;
+                }
+                app.sync_login_form();
+            });
+        }
+
+        let oauth_providers = [
+            OAuthProvider::Github,
+            OAuthProvider::Google,
+            OAuthProvider::Apple,
+        ];
+        for (button, provider) in self
+            .widgets
+            .oauth_buttons
+            .iter()
+            .zip(oauth_providers.iter().cloned())
+        {
+            let app = Rc::clone(self);
+            button.connect_clicked(move |_| {
+                app.manager.dispatch(AppAction::InitiateOAuth {
+                    provider: provider.clone(),
+                    invite_code: None,
+                });
+            });
+        }
+
+        {
+            let app = Rc::clone(self);
+            self.widgets.chat_menu_button.connect_clicked(move |_| {
+                app.manager.dispatch(AppAction::ToggleSettings);
+            });
+        }
+
+        {
+            let app = Rc::clone(self);
+            self.widgets.chat_send_button.connect_clicked(move |_| {
+                app.send_message();
+            });
+        }
+
+        {
+            let app = Rc::clone(self);
+            let buffer = self.widgets.chat_compose_view.buffer();
+            buffer.connect_changed(move |buffer| {
+                let text = buffer.text(&buffer.start_iter(), &buffer.end_iter(), true);
+                app.model.borrow_mut().compose_text = text.to_string();
+                app.sync_chat_inputs();
+            });
+        }
+
+        {
+            let app = Rc::clone(self);
+            self.widgets
+                .chat_messages_scroller
+                .vadjustment()
+                .connect_value_changed(move |adjustment| {
+                    if adjustment.value() <= HISTORY_PREFETCH_THRESHOLD {
+                        app.request_older_messages();
+                    }
+                });
+        }
+
+        {
+            let app = Rc::clone(self);
+            self.widgets.toast_button.connect_clicked(move |_| {
+                app.manager.dispatch(AppAction::ClearToast);
+            });
+        }
+
+        {
+            let app = Rc::clone(self);
+            self.widgets
+                .settings_delete_button
+                .connect_clicked(move |_| {
+                    app.manager.dispatch(AppAction::RequestDeleteAgent);
+                });
+        }
+
+        {
+            let app = Rc::clone(self);
+            self.widgets
+                .settings_sign_out_button
+                .connect_clicked(move |_| {
+                    app.manager.dispatch(AppAction::ToggleSettings);
+                    app.manager.dispatch(AppAction::Logout);
+                });
+        }
+
+        {
+            let app = Rc::clone(self);
+            self.widgets
+                .settings_dialog
+                .connect_close_request(move |_| {
+                    if app.model.borrow().state.show_settings {
+                        app.manager.dispatch(AppAction::ToggleSettings);
+                    }
+                    glib::Propagation::Proceed
+                });
+        }
+
+        {
+            let app = Rc::clone(self);
+            self.widgets
+                .delete_dialog
+                .connect_response(move |dialog, response| {
+                    dialog.hide();
+                    match response {
+                        gtk::ResponseType::Accept => {
+                            app.manager.dispatch(AppAction::ConfirmDeleteAgent)
+                        }
+                        _ => app.manager.dispatch(AppAction::CancelDeleteAgent),
+                    }
+                });
+        }
+
+        {
+            let app = Rc::clone(self);
+            self.widgets.delete_dialog.connect_close_request(move |_| {
+                if app.model.borrow().state.confirm_delete_agent {
+                    app.manager.dispatch(AppAction::CancelDeleteAgent);
+                }
+                glib::Propagation::Proceed
+            });
+        }
+    }
+
+    fn start_update_bridge(self: &Rc<Self>) {
+        let updates = self.manager.subscribe_updates();
+        let app = Rc::clone(self);
+        glib::timeout_add_local(Duration::from_millis(16), move || {
+            while let Ok(update) = updates.try_recv() {
+                app.apply_update(update);
+            }
+            ControlFlow::Continue
+        });
+    }
+
+    fn start_timers(self: &Rc<Self>) {
+        let app = Rc::clone(self);
+        glib::timeout_add_local_once(Duration::from_secs(1), move || {
+            app.model.borrow_mut().splash_min_elapsed = true;
+            app.sync_splash();
+        });
+
+        let app = Rc::clone(self);
+        glib::timeout_add_local(Duration::from_secs(30), move || {
+            app.manager.dispatch(AppAction::RefreshTimestamps);
+            ControlFlow::Continue
+        });
+    }
+
+    fn apply_update(self: &Rc<Self>, update: AppUpdate) {
+        AppManager::persist_side_effect(&update);
+
+        let AppUpdate::FullState(new_state) = update else {
+            return;
+        };
+
+        let old_state = self.model.borrow().state.clone();
+        if new_state.rev <= old_state.rev {
+            return;
+        }
+
+        let viewport = if old_state.router.default_screen == Screen::Chat {
+            Some(self.capture_chat_viewport())
+        } else {
+            None
+        };
+
+        let old_toast = old_state.toast.clone();
+        let pending_auth_url = new_state.pending_auth_url.clone();
+        let new_ids = message_ids(&new_state);
+
+        let post_render = {
+            let mut model = self.model.borrow_mut();
+            let old_screen = model.state.router.default_screen.clone();
+            let new_screen = new_state.router.default_screen.clone();
+
+            if old_screen != new_screen {
+                if new_screen == Screen::Login {
+                    model.login = LoginFormState::default();
+                }
+                if new_screen != Screen::Chat {
+                    model.compose_text.clear();
+                    model.has_settled_initial_scroll = false;
+                    model.pending_history_restore = None;
+                    model.previous_message_ids.clear();
+                    model.previous_last_message_content = None;
+                    model.previous_is_agent_typing = false;
+                }
+                if new_screen == Screen::Chat && old_screen != Screen::Chat {
+                    model.compose_text.clear();
+                    model.has_settled_initial_scroll = false;
+                    model.pending_history_restore = None;
+                }
+            }
+
+            let prepended = did_prepend_messages(&model.previous_message_ids, &new_ids);
+            let appended = did_append_messages(&model.previous_message_ids, &new_ids);
+            let content_changed = new_state
+                .messages
+                .last()
+                .map(|message| message.content.clone())
+                != model.previous_last_message_content;
+            let typing_changed = new_state.is_agent_typing != model.previous_is_agent_typing;
+
+            let post_render = if new_screen == Screen::Chat {
+                if new_ids.is_empty() {
+                    model.has_settled_initial_scroll = false;
+                    model.pending_history_restore = None;
+                    ChatPostRenderAction::None
+                } else if !model.has_settled_initial_scroll {
+                    ChatPostRenderAction::ScrollToBottom {
+                        settle_initial: true,
+                    }
+                } else if prepended {
+                    match model.pending_history_restore.take() {
+                        Some(HistoryLoadScrollStrategy::PreserveBottom) => {
+                            ChatPostRenderAction::ScrollToBottom {
+                                settle_initial: false,
+                            }
+                        }
+                        Some(HistoryLoadScrollStrategy::PreserveOffset {
+                            upper_before,
+                            value_before,
+                        }) => ChatPostRenderAction::RestoreOffset {
+                            upper_before,
+                            value_before,
+                        },
+                        None => ChatPostRenderAction::None,
+                    }
+                } else if appended
+                    && viewport
+                        .map(|snapshot| snapshot.was_near_bottom)
+                        .unwrap_or(true)
+                {
+                    ChatPostRenderAction::ScrollToBottom {
+                        settle_initial: false,
+                    }
+                } else if model.pending_history_restore.is_none()
+                    && viewport
+                        .map(|snapshot| snapshot.was_near_bottom)
+                        .unwrap_or(true)
+                    && (content_changed || typing_changed)
+                {
+                    ChatPostRenderAction::ScrollToBottom {
+                        settle_initial: false,
+                    }
+                } else {
+                    if !new_state.is_loading_history
+                        && model.pending_history_restore.is_some()
+                        && new_ids == model.previous_message_ids
+                    {
+                        model.pending_history_restore = None;
+                    }
+                    ChatPostRenderAction::None
+                }
+            } else {
+                ChatPostRenderAction::None
+            };
+
+            if old_toast != new_state.toast {
+                model.toast_serial = model.toast_serial.saturating_add(1);
+            }
+
+            model.state = new_state.clone();
+            model.previous_message_ids = new_ids;
+            model.previous_last_message_content = new_state
+                .messages
+                .last()
+                .map(|message| message.content.clone());
+            model.previous_is_agent_typing = new_state.is_agent_typing;
+            post_render
+        };
+
+        self.sync_screen();
+        self.sync_login_form();
+        self.sync_chat_inputs();
+        self.rebuild_chat_messages(post_render);
+        self.sync_chat_loading_state();
+        self.sync_toast();
+        self.sync_splash();
+        self.sync_dialogs();
+
+        if old_toast != self.model.borrow().state.toast {
+            self.schedule_toast_dismissal();
+        }
+
+        if let Some(url) = pending_auth_url {
+            open_external_url(&url);
+            self.manager.dispatch(AppAction::ClearPendingAuthUrl);
+        }
+    }
+
+    fn submit_auth(&self) {
+        let model = self.model.borrow();
+        if model.login_is_loading()
+            || model.login.email.is_empty()
+            || model.login.password.is_empty()
+        {
+            return;
+        }
+
+        if model.login.is_sign_up {
+            self.manager.dispatch(AppAction::SignUpWithEmail {
+                email: model.login.email.clone(),
+                password: model.login.password.clone(),
+                name: model.login.name.clone(),
+            });
+        } else {
+            self.manager.dispatch(AppAction::LoginWithEmail {
+                email: model.login.email.clone(),
+                password: model.login.password.clone(),
+            });
+        }
+    }
+
+    fn send_message(&self) {
+        let trimmed = self.model.borrow().compose_text.trim().to_string();
+        if trimmed.is_empty() || self.model.borrow().state.is_agent_typing {
+            return;
+        }
+
+        self.manager
+            .dispatch(AppAction::SendMessage { content: trimmed });
+        self.model.borrow_mut().compose_text.clear();
+        set_text_view_text(&self.widgets.chat_compose_view, "");
+        self.sync_chat_inputs();
+    }
+
+    fn schedule_toast_dismissal(self: &Rc<Self>) {
+        let (serial, toast) = {
+            let model = self.model.borrow();
+            let Some(toast) = model.state.toast.clone() else {
+                return;
+            };
+            (model.toast_serial, toast)
+        };
+
+        let app = Rc::clone(self);
+        glib::timeout_add_local_once(Duration::from_secs(4), move || {
+            let model = app.model.borrow();
+            if model.toast_serial == serial && model.state.toast.as_deref() == Some(toast.as_str())
+            {
+                drop(model);
+                app.manager.dispatch(AppAction::ClearToast);
+            }
+        });
+    }
+
+    fn capture_chat_viewport(&self) -> ChatViewportSnapshot {
+        let adjustment = self.widgets.chat_messages_scroller.vadjustment();
+        ChatViewportSnapshot {
+            was_near_bottom: is_near_bottom(&adjustment),
+        }
+    }
+
+    fn request_older_messages(&self) {
+        let adjustment = self.widgets.chat_messages_scroller.vadjustment();
+        let mut model = self.model.borrow_mut();
+
+        if !model.has_settled_initial_scroll
+            || model.pending_history_restore.is_some()
+            || model.state.is_loading_history
+            || !model.state.has_older_messages
+        {
+            return;
+        }
+
+        model.pending_history_restore = Some(
+            if viewport_is_underfilled(&adjustment) && is_near_bottom(&adjustment) {
+                HistoryLoadScrollStrategy::PreserveBottom
+            } else {
+                HistoryLoadScrollStrategy::PreserveOffset {
+                    upper_before: adjustment.upper(),
+                    value_before: adjustment.value(),
+                }
+            },
+        );
+
+        drop(model);
+        self.manager.dispatch(AppAction::LoadOlderMessages);
+    }
+
+    fn sync_screen(&self) {
+        let model = self.model.borrow();
+        let screen_name = match model.state.router.default_screen {
+            Screen::Loading => "loading",
+            Screen::Login => "login",
+            Screen::Chat => "chat",
+        };
+        self.widgets
+            .screen_stack
+            .set_visible_child_name(screen_name);
+
+        match model.state.router.default_screen {
+            Screen::Login => {
+                if model.login.is_sign_up {
+                    self.widgets.login_name_entry.grab_focus();
+                } else {
+                    self.widgets.login_email_entry.grab_focus();
+                }
+            }
+            Screen::Chat => {
+                self.widgets.chat_compose_view.grab_focus();
+            }
+            Screen::Loading => {}
+        }
+    }
+
+    fn sync_login_form(&self) {
+        let model = self.model.borrow();
+        let is_loading = model.login_is_loading();
+        let can_submit =
+            !model.login.email.is_empty() && !model.login.password.is_empty() && !is_loading;
+
+        set_entry_text_if_needed(&self.widgets.login_name_entry, &model.login.name);
+        set_entry_text_if_needed(&self.widgets.login_email_entry, &model.login.email);
+        set_entry_text_if_needed(&self.widgets.login_password_entry, &model.login.password);
+
+        self.widgets
+            .login_name_revealer
+            .set_reveal_child(model.login.is_sign_up);
+        self.widgets
+            .login_primary_label
+            .set_text(if model.login.is_sign_up {
+                "Sign Up"
+            } else {
+                "Sign In"
+            });
+        self.widgets.login_primary_button.set_sensitive(can_submit);
+        self.widgets
+            .login_toggle_button
+            .set_label(if model.login.is_sign_up {
+                "Already have an account? Sign In"
+            } else {
+                "Don't have an account? Sign Up"
+            });
+
+        for button in &self.widgets.oauth_buttons {
+            button.set_sensitive(!is_loading);
+        }
+    }
+
+    fn sync_chat_inputs(&self) {
+        let model = self.model.borrow();
+        self.widgets
+            .chat_compose_placeholder
+            .set_visible(model.compose_text.is_empty());
+        self.widgets
+            .chat_send_button
+            .set_sensitive(model.can_send());
+    }
+
+    fn sync_chat_loading_state(&self) {
+        let model = self.model.borrow();
+        let show_history_spinner =
+            model.state.is_loading_history && !model.state.messages.is_empty();
+        let show_initial_spinner = (model.state.is_loading_history
+            && model.state.messages.is_empty())
+            || (!model.has_settled_initial_scroll && !model.state.messages.is_empty());
+
+        self.widgets
+            .chat_top_spinner
+            .set_visible(show_history_spinner);
+        if show_history_spinner {
+            self.widgets.chat_top_spinner.start();
+        } else {
+            self.widgets.chat_top_spinner.stop();
+        }
+
+        self.widgets
+            .chat_center_spinner
+            .set_visible(show_initial_spinner);
+        if show_initial_spinner {
+            self.widgets.chat_center_spinner.start();
+        } else {
+            self.widgets.chat_center_spinner.stop();
+        }
+
+        self.widgets.chat_messages_box.set_opacity(
+            if model.has_settled_initial_scroll || model.state.messages.is_empty() {
+                1.0
+            } else {
+                0.0
+            },
+        );
+    }
+
+    fn sync_toast(&self) {
+        let model = self.model.borrow();
+        let is_chat = model.state.router.default_screen == Screen::Chat;
+        let visible = model.state.toast.is_some();
+        self.widgets
+            .toast_button
+            .set_margin_bottom(if is_chat { 112 } else { 24 });
+        self.widgets.toast_button.set_visible(visible);
+        self.widgets.toast_revealer.set_reveal_child(visible);
+        self.widgets.toast_revealer.set_can_target(visible);
+        self.widgets
+            .toast_label
+            .set_text(model.state.toast.as_deref().unwrap_or_default());
+    }
+
+    fn sync_splash(&self) {
+        let visible = self.model.borrow().splash_visible();
+        self.widgets.splash_revealer.set_reveal_child(visible);
+        self.widgets.splash_revealer.set_can_target(visible);
+    }
+
+    fn sync_dialogs(&self) {
+        let model = self.model.borrow();
+
+        self.widgets
+            .settings_delete_button
+            .set_sensitive(!model.state.is_deleting_agent);
+
+        if model.state.show_settings {
+            self.widgets.settings_dialog.present();
+        } else {
+            self.widgets.settings_dialog.hide();
+        }
+
+        if model.state.confirm_delete_agent {
+            self.widgets.delete_dialog.present();
+        } else {
+            self.widgets.delete_dialog.hide();
+        }
+    }
+
+    fn rebuild_chat_messages(self: &Rc<Self>, post_render: ChatPostRenderAction) {
+        clear_box(&self.widgets.chat_messages_box);
+
+        let model = self.model.borrow();
+        for message in &model.state.messages {
+            self.widgets
+                .chat_messages_box
+                .append(&build_message_row(message));
+        }
+
+        if model.state.is_agent_typing {
+            let typing = gtk::Label::new(Some("Maple is typing..."));
+            typing.add_css_class("maple-meta");
+            typing.set_halign(gtk::Align::Start);
+            typing.set_margin_start(SPACE_XS);
+            self.widgets.chat_messages_box.append(&typing);
+        }
+
+        drop(model);
+
+        let app = Rc::clone(self);
+        glib::idle_add_local(move || {
+            match post_render {
+                ChatPostRenderAction::None => {}
+                ChatPostRenderAction::ScrollToBottom { settle_initial } => {
+                    app.scroll_to_bottom();
+                    if settle_initial {
+                        app.model.borrow_mut().has_settled_initial_scroll = true;
+                    }
+                }
+                ChatPostRenderAction::RestoreOffset {
+                    upper_before,
+                    value_before,
+                } => {
+                    let adjustment = app.widgets.chat_messages_scroller.vadjustment();
+                    let delta = adjustment.upper() - upper_before;
+                    let target = value_before + delta;
+                    adjustment.set_value(target.max(0.0));
+                }
+            }
+
+            if matches!(post_render, ChatPostRenderAction::None)
+                && !app.model.borrow().state.messages.is_empty()
+                && !app.model.borrow().has_settled_initial_scroll
+            {
+                app.scroll_to_bottom();
+                app.model.borrow_mut().has_settled_initial_scroll = true;
+            }
+
+            app.sync_chat_loading_state();
+            app.maybe_request_older_messages_for_underfilled_viewport();
+            ControlFlow::Break
+        });
+    }
+
+    fn scroll_to_bottom(&self) {
+        let adjustment = self.widgets.chat_messages_scroller.vadjustment();
+        let bottom = (adjustment.upper() - adjustment.page_size()).max(0.0);
+        adjustment.set_value(bottom);
+    }
+
+    fn maybe_request_older_messages_for_underfilled_viewport(&self) {
+        let adjustment = self.widgets.chat_messages_scroller.vadjustment();
+        let model = self.model.borrow();
+        let should_request = model.has_settled_initial_scroll
+            && model.state.has_older_messages
+            && !model.state.is_loading_history
+            && model.pending_history_restore.is_none()
+            && viewport_is_underfilled(&adjustment)
+            && is_near_bottom(&adjustment);
+        drop(model);
+
+        if should_request {
+            self.request_older_messages();
+        }
+    }
+}
+
+fn build_widgets(application: &gtk::Application, theme: ThemeConfig) -> Widgets {
+    let window = gtk::ApplicationWindow::builder()
+        .application(application)
+        .title("Maple")
+        .default_width(DEFAULT_WINDOW_WIDTH)
+        .default_height(DEFAULT_WINDOW_HEIGHT)
+        .build();
+    window.add_css_class("maple-window");
+    window.set_size_request(MIN_WINDOW_WIDTH, MIN_WINDOW_HEIGHT);
+
+    let root_overlay = gtk::Overlay::new();
+    root_overlay.set_hexpand(true);
+    root_overlay.set_vexpand(true);
+
+    let screen_stack = gtk::Stack::new();
+    screen_stack.set_hexpand(true);
+    screen_stack.set_vexpand(true);
+
+    let loading_screen = build_splash_screen(theme);
+    let (
+        login_screen,
+        login_name_revealer,
+        login_name_entry,
+        login_email_entry,
+        login_password_entry,
+        login_primary_button,
+        login_primary_label,
+        login_toggle_button,
+        oauth_buttons,
+    ) = build_login_screen(theme);
+    let (
+        chat_screen,
+        chat_menu_button,
+        chat_messages_scroller,
+        chat_messages_box,
+        chat_top_spinner,
+        chat_center_spinner,
+        chat_compose_view,
+        chat_compose_placeholder,
+        chat_send_button,
+    ) = build_chat_screen(theme);
+
+    screen_stack.add_named(&loading_screen, Some("loading"));
+    screen_stack.add_named(&login_screen, Some("login"));
+    screen_stack.add_named(&chat_screen, Some("chat"));
+    root_overlay.set_child(Some(&screen_stack));
+
+    let toast_revealer = gtk::Revealer::new();
+    toast_revealer.set_transition_type(gtk::RevealerTransitionType::SlideUp);
+    toast_revealer.set_halign(gtk::Align::Center);
+    toast_revealer.set_valign(gtk::Align::End);
+    toast_revealer.set_margin_start(SPACE_MD);
+    toast_revealer.set_margin_end(SPACE_MD);
+
+    let toast_button = gtk::Button::new();
+    toast_button.add_css_class("flat");
+    toast_button.add_css_class("maple-toast");
+    let toast_label = gtk::Label::new(None);
+    toast_label.set_wrap(true);
+    toast_label.set_justify(gtk::Justification::Center);
+    toast_label.set_margin_start(16);
+    toast_label.set_margin_end(16);
+    toast_label.set_margin_top(12);
+    toast_label.set_margin_bottom(12);
+    toast_button.set_child(Some(&toast_label));
+    toast_revealer.set_child(Some(&toast_button));
+    root_overlay.add_overlay(&toast_revealer);
+    toast_revealer.set_can_target(false);
+
+    let splash_revealer = gtk::Revealer::new();
+    splash_revealer.set_transition_type(gtk::RevealerTransitionType::Crossfade);
+    splash_revealer.set_hexpand(true);
+    splash_revealer.set_vexpand(true);
+    splash_revealer.set_child(Some(&build_splash_screen(theme)));
+    root_overlay.add_overlay(&splash_revealer);
+    splash_revealer.set_can_target(true);
+
+    window.set_child(Some(&root_overlay));
+
+    let settings_dialog = build_settings_dialog(&window);
+    let settings_content = settings_dialog.content_area();
+    let settings_root = gtk::Box::new(gtk::Orientation::Vertical, SPACE_SM);
+    settings_root.add_css_class("maple-settings-card");
+    settings_root.set_margin_start(SPACE_MD);
+    settings_root.set_margin_end(SPACE_MD);
+    settings_root.set_margin_top(SPACE_MD);
+    settings_root.set_margin_bottom(SPACE_MD);
+
+    let delete_row = action_button("user-trash-symbolic", "Delete Agent", "maple-danger-action");
+    let delete_help = gtk::Label::new(Some(
+        "Permanently deletes your agent and conversation history.",
+    ));
+    delete_help.add_css_class("maple-meta");
+    delete_help.set_wrap(true);
+    delete_help.set_xalign(0.0);
+
+    let divider = gtk::Separator::new(gtk::Orientation::Horizontal);
+    divider.add_css_class("maple-settings-divider");
+
+    let sign_out_row = action_button(
+        "system-log-out-symbolic",
+        "Sign Out",
+        "maple-settings-action",
+    );
+
+    settings_root.append(&delete_row.0);
+    settings_root.append(&delete_help);
+    settings_root.append(&divider);
+    settings_root.append(&sign_out_row.0);
+    settings_content.append(&settings_root);
+    settings_dialog.set_default_size(360, 220);
+    settings_dialog.set_hide_on_close(true);
+
+    let delete_dialog = gtk::MessageDialog::new(
+        Some(&window),
+        gtk::DialogFlags::MODAL,
+        gtk::MessageType::Question,
+        gtk::ButtonsType::None,
+        "Delete Agent?",
+    );
+    delete_dialog.add_button("Cancel", gtk::ResponseType::Cancel);
+    delete_dialog.add_button("Delete", gtk::ResponseType::Accept);
+    delete_dialog.set_secondary_text(Some(
+        "This will permanently delete your agent conversation history. This cannot be undone.",
+    ));
+    delete_dialog.set_hide_on_close(true);
+
+    Widgets {
+        window,
+        screen_stack,
+        splash_revealer,
+        toast_revealer,
+        toast_button,
+        toast_label,
+        login_name_revealer,
+        login_name_entry,
+        login_email_entry,
+        login_password_entry,
+        login_primary_button,
+        login_primary_label,
+        login_toggle_button,
+        oauth_buttons,
+        chat_menu_button,
+        chat_messages_scroller,
+        chat_messages_box,
+        chat_top_spinner,
+        chat_center_spinner,
+        chat_compose_view,
+        chat_compose_placeholder,
+        chat_send_button,
+        settings_dialog,
+        settings_delete_button: delete_row.0,
+        settings_sign_out_button: sign_out_row.0,
+        delete_dialog,
+    }
+}
+
+fn build_splash_screen(theme: ThemeConfig) -> gtk::Overlay {
+    let overlay = gtk::Overlay::new();
+    overlay.set_child(Some(&background_area(
+        BackgroundKind::Splash,
+        theme.dark_mode,
+    )));
+
+    let content = gtk::Box::new(gtk::Orientation::Vertical, SPACE_MD);
+    content.set_halign(gtk::Align::Center);
+    content.set_valign(gtk::Align::Center);
+
+    let wordmark = full_wordmark(theme.splash_wordmark(), 40);
+    let tagline = gtk::Label::new(Some("Privacy-first intelligence"));
+    tagline.add_css_class("maple-splash-tagline");
+
+    content.append(&wordmark);
+    content.append(&tagline);
+    overlay.add_overlay(&content);
+    overlay
+}
+
+#[allow(clippy::type_complexity)]
+fn build_login_screen(
+    theme: ThemeConfig,
+) -> (
+    gtk::Overlay,
+    gtk::Revealer,
+    gtk::Entry,
+    gtk::Entry,
+    gtk::Entry,
+    gtk::Button,
+    gtk::Label,
+    gtk::Button,
+    Vec<gtk::Button>,
+) {
+    let overlay = gtk::Overlay::new();
+    overlay.set_child(Some(&background_area(
+        BackgroundKind::Login,
+        theme.dark_mode,
+    )));
+
+    let center = gtk::Box::new(gtk::Orientation::Vertical, 0);
+    center.set_hexpand(true);
+    center.set_vexpand(true);
+    center.set_halign(gtk::Align::Center);
+    center.set_valign(gtk::Align::Center);
+    center.set_margin_start(SPACE_MD);
+    center.set_margin_end(SPACE_MD);
+
+    let card_shell = gtk::Box::new(gtk::Orientation::Vertical, 0);
+    card_shell.add_css_class("maple-login-card-shell");
+    card_shell.set_width_request(LOGIN_CARD_WIDTH);
+
+    let card = gtk::Box::new(gtk::Orientation::Vertical, 24);
+    card.set_margin_start(24);
+    card.set_margin_end(24);
+    card.set_margin_top(24);
+    card.set_margin_bottom(24);
+
+    let wordmark = full_wordmark(theme.login_palette().wordmark, 28);
+    wordmark.set_halign(gtk::Align::Center);
+
+    let fields = gtk::Box::new(gtk::Orientation::Vertical, SPACE_SM);
+
+    let (name_shell, name_entry) = entry_shell("Name", true);
+    let name_revealer = gtk::Revealer::new();
+    name_revealer.set_transition_type(gtk::RevealerTransitionType::SlideDown);
+    name_revealer.set_child(Some(&name_shell));
+
+    let (email_shell, email_entry) = entry_shell("Email", true);
+    let (password_shell, password_entry) = entry_shell("Password", false);
+
+    fields.append(&name_revealer);
+    fields.append(&email_shell);
+    fields.append(&password_shell);
+
+    let (primary_button, primary_label) = primary_button("Sign In");
+
+    let divider_row = gtk::Box::new(gtk::Orientation::Horizontal, SPACE_XS);
+    divider_row.set_valign(gtk::Align::Center);
+    let divider_left = gtk::Separator::new(gtk::Orientation::Horizontal);
+    divider_left.add_css_class("maple-divider");
+    divider_left.set_hexpand(true);
+    let divider_label = gtk::Label::new(Some("or"));
+    divider_label.add_css_class("maple-divider");
+    let divider_right = gtk::Separator::new(gtk::Orientation::Horizontal);
+    divider_right.add_css_class("maple-divider");
+    divider_right.set_hexpand(true);
+    divider_row.append(&divider_left);
+    divider_row.append(&divider_label);
+    divider_row.append(&divider_right);
+
+    let oauth_box = gtk::Box::new(gtk::Orientation::Vertical, SPACE_XS);
+    let github = secondary_button("Continue with GitHub");
+    let google = secondary_button("Continue with Google");
+    let apple = secondary_button("Continue with Apple");
+    oauth_box.append(&github.0);
+    oauth_box.append(&google.0);
+    oauth_box.append(&apple.0);
+
+    let toggle_button = gtk::Button::with_label("Don't have an account? Sign Up");
+    toggle_button.add_css_class("flat");
+    toggle_button.add_css_class("maple-link-button");
+
+    card.append(&wordmark);
+    card.append(&fields);
+    card.append(&primary_button);
+    card.append(&divider_row);
+    card.append(&oauth_box);
+    card.append(&toggle_button);
+
+    card_shell.append(&card);
+    center.append(&card_shell);
+    overlay.add_overlay(&center);
+
+    (
+        overlay,
+        name_revealer,
+        name_entry,
+        email_entry,
+        password_entry,
+        primary_button,
+        primary_label,
+        toggle_button,
+        vec![github.0, google.0, apple.0],
+    )
+}
+
+#[allow(clippy::type_complexity)]
+fn build_chat_screen(
+    theme: ThemeConfig,
+) -> (
+    gtk::Overlay,
+    gtk::Button,
+    gtk::ScrolledWindow,
+    gtk::Box,
+    gtk::Spinner,
+    gtk::Spinner,
+    gtk::TextView,
+    gtk::Label,
+    gtk::Button,
+) {
+    let overlay = gtk::Overlay::new();
+    overlay.set_hexpand(true);
+    overlay.set_vexpand(true);
+    overlay.set_child(Some(&background_area(
+        BackgroundKind::Chat,
+        theme.dark_mode,
+    )));
+
+    let scroller = gtk::ScrolledWindow::new();
+    scroller.set_hexpand(true);
+    scroller.set_vexpand(true);
+    scroller.set_policy(gtk::PolicyType::Never, gtk::PolicyType::Automatic);
+
+    let messages_box = gtk::Box::new(gtk::Orientation::Vertical, SPACE_MD);
+    messages_box.set_margin_start(SPACE_MD);
+    messages_box.set_margin_end(SPACE_MD);
+    messages_box.set_margin_top(108);
+    messages_box.set_margin_bottom(128);
+    scroller.set_child(Some(&messages_box));
+    overlay.add_overlay(&scroller);
+
+    let top_spinner = gtk::Spinner::new();
+    top_spinner.set_halign(gtk::Align::Center);
+    top_spinner.set_valign(gtk::Align::Start);
+    top_spinner.set_margin_top(108);
+    overlay.add_overlay(&top_spinner);
+
+    let center_spinner = gtk::Spinner::new();
+    center_spinner.set_halign(gtk::Align::Center);
+    center_spinner.set_valign(gtk::Align::Center);
+    overlay.add_overlay(&center_spinner);
+
+    let header_overlay = gtk::Overlay::new();
+    header_overlay.set_hexpand(true);
+    header_overlay.set_halign(gtk::Align::Fill);
+    header_overlay.set_valign(gtk::Align::Start);
+    header_overlay.set_margin_start(SPACE_MD);
+    header_overlay.set_margin_end(SPACE_MD);
+    header_overlay.set_margin_top(SPACE_SM);
+
+    let header_spacer = gtk::Box::new(gtk::Orientation::Horizontal, 0);
+    header_spacer.set_height_request(43);
+    header_spacer.set_hexpand(true);
+    header_overlay.set_child(Some(&header_spacer));
+
+    let menu_button = icon_pill_button("open-menu-symbolic", "Menu");
+    menu_button.set_halign(gtk::Align::Start);
+    menu_button.set_valign(gtk::Align::Start);
+    header_overlay.add_overlay(&menu_button);
+
+    let search_button = icon_pill_button("edit-find-symbolic", "Search");
+    search_button.set_sensitive(false);
+    search_button.set_halign(gtk::Align::End);
+    search_button.set_valign(gtk::Align::Start);
+    header_overlay.add_overlay(&search_button);
+
+    let wordmark_pill = gtk::Box::new(gtk::Orientation::Horizontal, 0);
+    wordmark_pill.add_css_class("maple-header-pill");
+    wordmark_pill.set_halign(gtk::Align::Center);
+    wordmark_pill.set_valign(gtk::Align::Start);
+    let wordmark_inner = gtk::Box::new(gtk::Orientation::Horizontal, SPACE_XS);
+    wordmark_inner.set_margin_start(16);
+    wordmark_inner.set_margin_end(12);
+    wordmark_inner.set_margin_top(12);
+    wordmark_inner.set_margin_bottom(12);
+    wordmark_inner.append(&abbr_wordmark(theme.chat_palette().header_wordmark, 16));
+    let chevron = gtk::Label::new(Some("⌄"));
+    chevron.set_markup(&format!(
+        "<span foreground=\"{}\" weight=\"heavy\">⌄</span>",
+        PEBBLE_400.pango_rgb()
+    ));
+    wordmark_inner.append(&chevron);
+    wordmark_pill.append(&wordmark_inner);
+    header_overlay.add_overlay(&wordmark_pill);
+
+    overlay.add_overlay(&header_overlay);
+
+    let compose_shell = gtk::Box::new(gtk::Orientation::Horizontal, 0);
+    compose_shell.add_css_class("maple-compose-shell");
+    compose_shell.set_halign(gtk::Align::Fill);
+    compose_shell.set_valign(gtk::Align::End);
+    compose_shell.set_margin_start(SPACE_MD);
+    compose_shell.set_margin_end(SPACE_MD);
+    compose_shell.set_margin_bottom(SPACE_XS);
+
+    let compose_row = gtk::Box::new(gtk::Orientation::Horizontal, SPACE_XS);
+    compose_row.set_valign(gtk::Align::Center);
+    compose_row.set_margin_start(16);
+    compose_row.set_margin_end(16);
+    compose_row.set_margin_top(12);
+    compose_row.set_margin_bottom(14);
+
+    let compose_column = gtk::Box::new(gtk::Orientation::Vertical, 4);
+    compose_column.set_hexpand(true);
+
+    let compose_overlay = gtk::Overlay::new();
+    compose_overlay.set_hexpand(true);
+    let compose_view = gtk::TextView::new();
+    compose_view.add_css_class("maple-compose-view");
+    compose_view.set_wrap_mode(gtk::WrapMode::WordChar);
+    compose_view.set_accepts_tab(false);
+    compose_view.set_left_margin(0);
+    compose_view.set_right_margin(0);
+    compose_view.set_top_margin(0);
+    compose_view.set_bottom_margin(0);
+    compose_view.set_size_request(-1, 54);
+    compose_overlay.set_child(Some(&compose_view));
+
+    let compose_placeholder = gtk::Label::new(Some("Write..."));
+    compose_placeholder.add_css_class("maple-compose-placeholder");
+    compose_placeholder.set_halign(gtk::Align::Start);
+    compose_placeholder.set_valign(gtk::Align::Start);
+    compose_overlay.add_overlay(&compose_placeholder);
+
+    let plus_button = gtk::Button::new();
+    plus_button.add_css_class("flat");
+    plus_button.add_css_class("maple-plus-button");
+    plus_button.set_halign(gtk::Align::Start);
+    plus_button.set_valign(gtk::Align::Center);
+    plus_button.set_size_request(28, 28);
+    plus_button.set_child(Some(&gtk::Label::new(Some("+"))));
+
+    compose_column.append(&compose_overlay);
+    compose_column.append(&plus_button);
+
+    let (send_button, _) = send_button();
+    compose_row.append(&compose_column);
+    compose_row.append(&send_button);
+    compose_shell.append(&compose_row);
+    overlay.add_overlay(&compose_shell);
+
+    (
+        overlay,
+        menu_button,
+        scroller,
+        messages_box,
+        top_spinner,
+        center_spinner,
+        compose_view,
+        compose_placeholder,
+        send_button,
+    )
+}
+
+fn build_settings_dialog(window: &gtk::ApplicationWindow) -> gtk::Dialog {
+    let dialog = gtk::Dialog::new();
+    dialog.set_title(Some("Settings"));
+    dialog.set_transient_for(Some(window));
+    dialog.set_modal(true);
+    dialog
+}
+
+fn show_boot_error(application: &gtk::Application, error: &str) {
+    let window = gtk::ApplicationWindow::builder()
+        .application(application)
+        .title("Maple")
+        .default_width(420)
+        .default_height(220)
+        .build();
+    window.add_css_class("maple-window");
+
+    let content = gtk::Box::new(gtk::Orientation::Vertical, SPACE_MD);
+    content.set_margin_start(SPACE_MD);
+    content.set_margin_end(SPACE_MD);
+    content.set_margin_top(SPACE_LG);
+    content.set_margin_bottom(SPACE_LG);
+
+    let title = gtk::Label::new(Some("Maple failed to start"));
+    title.add_css_class("title-3");
+    title.set_xalign(0.0);
+
+    let body = gtk::Label::new(Some(error));
+    body.set_wrap(true);
+    body.set_xalign(0.0);
+
+    let quit = gtk::Button::with_label("Close");
+    let app = application.clone();
+    quit.connect_clicked(move |_| app.quit());
+
+    content.append(&title);
+    content.append(&body);
+    content.append(&quit);
+    window.set_child(Some(&content));
+    window.present();
+}
+
+fn primary_button(label_text: &str) -> (gtk::Button, gtk::Label) {
+    let button = gtk::Button::new();
+    button.add_css_class("flat");
+    button.add_css_class("maple-primary-button");
+
+    let label = gtk::Label::new(Some(label_text));
+    label.set_margin_start(24);
+    label.set_margin_end(24);
+    label.set_margin_top(12);
+    label.set_margin_bottom(12);
+    button.set_child(Some(&label));
+
+    (button, label)
+}
+
+fn secondary_button(label_text: &str) -> (gtk::Button, gtk::Label) {
+    let button = gtk::Button::new();
+    button.add_css_class("flat");
+    button.add_css_class("maple-secondary-button");
+    button.set_halign(gtk::Align::Fill);
+
+    let label = gtk::Label::new(Some(label_text));
+    label.set_margin_start(24);
+    label.set_margin_end(24);
+    label.set_margin_top(12);
+    label.set_margin_bottom(12);
+    button.set_child(Some(&label));
+
+    (button, label)
+}
+
+fn send_button() -> (gtk::Button, gtk::Label) {
+    let button = gtk::Button::new();
+    button.add_css_class("flat");
+    button.add_css_class("maple-send-button");
+    button.set_valign(gtk::Align::Center);
+    button.set_size_request(71, 36);
+
+    let label = gtk::Label::new(Some("↑"));
+    label.set_margin_start(24);
+    label.set_margin_end(24);
+    label.set_margin_top(8);
+    label.set_margin_bottom(8);
+    button.set_child(Some(&label));
+
+    (button, label)
+}
+
+fn icon_pill_button(icon_name: &str, tooltip: &str) -> gtk::Button {
+    let button = gtk::Button::new();
+    button.add_css_class("flat");
+    button.add_css_class("maple-header-pill-button");
+    button.set_tooltip_text(Some(tooltip));
+    button.set_size_request(43, 43);
+
+    let image = gtk::Image::from_icon_name(icon_name);
+    image.set_pixel_size(18);
+    button.set_child(Some(&image));
+    button
+}
+
+fn action_button(icon_name: &str, label_text: &str, css_class: &str) -> (gtk::Button, gtk::Label) {
+    let button = gtk::Button::new();
+    button.add_css_class("flat");
+    button.add_css_class(css_class);
+    button.set_halign(gtk::Align::Fill);
+
+    let row = gtk::Box::new(gtk::Orientation::Horizontal, SPACE_SM);
+    row.set_margin_start(12);
+    row.set_margin_end(12);
+    row.set_margin_top(10);
+    row.set_margin_bottom(10);
+
+    let icon = gtk::Image::from_icon_name(icon_name);
+    icon.set_pixel_size(18);
+    let label = gtk::Label::new(Some(label_text));
+    label.set_xalign(0.0);
+
+    row.append(&icon);
+    row.append(&label);
+    button.set_child(Some(&row));
+
+    (button, label)
+}
+
+fn entry_shell(placeholder: &str, visible: bool) -> (gtk::Box, gtk::Entry) {
+    let shell = gtk::Box::new(gtk::Orientation::Horizontal, 0);
+    shell.add_css_class("maple-entry-shell");
+
+    let entry = gtk::Entry::new();
+    entry.add_css_class("maple-entry");
+    entry.set_has_frame(false);
+    entry.set_visibility(visible);
+    entry.set_hexpand(true);
+    entry.set_placeholder_text(Some(placeholder));
+    entry.set_margin_start(16);
+    entry.set_margin_end(16);
+    entry.set_margin_top(14);
+    entry.set_margin_bottom(14);
+
+    shell.append(&entry);
+    (shell, entry)
+}
+
+fn build_message_row(message: &ChatMessage) -> gtk::Box {
+    let wrapper = gtk::Box::new(gtk::Orientation::Vertical, 4);
+    wrapper.set_hexpand(true);
+    wrapper.set_halign(gtk::Align::Fill);
+
+    let row = gtk::Box::new(gtk::Orientation::Horizontal, 0);
+    row.set_hexpand(true);
+    row.set_halign(if message.is_user {
+        gtk::Align::End
+    } else {
+        gtk::Align::Start
+    });
+
+    let content = gtk::Box::new(gtk::Orientation::Vertical, 4);
+    content.set_halign(if message.is_user {
+        gtk::Align::End
+    } else {
+        gtk::Align::Start
+    });
+
+    if message.is_user {
+        let bubble = gtk::Box::new(gtk::Orientation::Vertical, 0);
+        bubble.add_css_class("maple-user-bubble");
+
+        let label = gtk::Label::new(Some(&message.content));
+        label.add_css_class("maple-user-message");
+        label.set_wrap(true);
+        label.set_wrap_mode(pango::WrapMode::WordChar);
+        label.set_max_width_chars(MESSAGE_MAX_WIDTH_CHARS);
+        label.set_xalign(0.0);
+        label.set_margin_start(12);
+        label.set_margin_end(12);
+        label.set_margin_top(8);
+        label.set_margin_bottom(8);
+
+        bubble.append(&label);
+        content.append(&bubble);
+    } else {
+        let label = gtk::Label::new(Some(&message.content));
+        label.add_css_class("maple-assistant-message");
+        label.set_wrap(true);
+        label.set_wrap_mode(pango::WrapMode::WordChar);
+        label.set_max_width_chars(MESSAGE_MAX_WIDTH_CHARS);
+        label.set_xalign(0.0);
+        content.append(&label);
+    }
+
+    if message.show_timestamp {
+        let timestamp = gtk::Label::new(Some(&message.timestamp_display));
+        timestamp.add_css_class("maple-meta");
+        timestamp.set_xalign(0.0);
+        timestamp.set_margin_start(8);
+        timestamp.set_margin_end(8);
+        content.append(&timestamp);
+    }
+
+    row.append(&content);
+    wrapper.append(&row);
+    wrapper
+}
+
+fn set_text_view_text(view: &gtk::TextView, text: &str) {
+    let buffer = view.buffer();
+    let current = buffer.text(&buffer.start_iter(), &buffer.end_iter(), true);
+    if current.as_str() != text {
+        buffer.set_text(text);
+    }
+}
+
+fn set_entry_text_if_needed(entry: &gtk::Entry, value: &str) {
+    if entry.text().as_str() != value {
+        entry.set_text(value);
+    }
+}
+
+fn clear_box(container: &gtk::Box) {
+    while let Some(child) = container.first_child() {
+        container.remove(&child);
+    }
+}
+
+fn message_ids(state: &AppState) -> Vec<String> {
+    state
+        .messages
+        .iter()
+        .map(|message| message.id.clone())
+        .collect()
+}
+
+fn did_prepend_messages(previous_ids: &[String], current_ids: &[String]) -> bool {
+    !previous_ids.is_empty()
+        && current_ids.len() > previous_ids.len()
+        && current_ids[current_ids.len() - previous_ids.len()..] == *previous_ids
+}
+
+fn did_append_messages(previous_ids: &[String], current_ids: &[String]) -> bool {
+    !previous_ids.is_empty()
+        && current_ids.len() > previous_ids.len()
+        && current_ids[..previous_ids.len()] == *previous_ids
+}
+
+fn distance_from_bottom(upper: f64, value: f64, page_size: f64) -> f64 {
+    (upper - (value + page_size)).max(0.0)
+}
+
+fn is_near_bottom(adjustment: &gtk::Adjustment) -> bool {
+    distance_from_bottom(
+        adjustment.upper(),
+        adjustment.value(),
+        adjustment.page_size(),
+    ) <= BOTTOM_FOLLOW_THRESHOLD
+}
+
+fn viewport_is_underfilled(adjustment: &gtk::Adjustment) -> bool {
+    adjustment.upper() <= adjustment.page_size() + 1.0
+}
+
+fn open_external_url(url: &str) {
+    if gtk::gio::AppInfo::launch_default_for_uri(url, None::<&gtk::gio::AppLaunchContext>).is_ok() {
+        return;
+    }
+
+    let _ = std::process::Command::new("xdg-open").arg(url).spawn();
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{did_append_messages, did_prepend_messages, distance_from_bottom};
+
+    #[test]
+    fn prepended_messages_detect_suffix_match() {
+        let previous = vec!["b".to_string(), "c".to_string()];
+        let current = vec!["a".to_string(), "b".to_string(), "c".to_string()];
+        assert!(did_prepend_messages(&previous, &current));
+    }
+
+    #[test]
+    fn appended_messages_detect_prefix_match() {
+        let previous = vec!["a".to_string(), "b".to_string()];
+        let current = vec!["a".to_string(), "b".to_string(), "c".to_string()];
+        assert!(did_append_messages(&previous, &current));
+    }
+
+    #[test]
+    fn bottom_distance_clamps_at_zero() {
+        assert_eq!(distance_from_bottom(100.0, 80.0, 40.0), 0.0);
+        assert_eq!(distance_from_bottom(300.0, 120.0, 100.0), 80.0);
+    }
+}
diff --git a/native/desktop/gtk/src/main.rs b/native/desktop/gtk/src/main.rs
new file mode 100644
index 00000000..47841a4d
--- /dev/null
+++ b/native/desktop/gtk/src/main.rs
@@ -0,0 +1,19 @@
+mod app;
+mod manager;
+mod theme;
+mod wordmark;
+
+use gtk::prelude::*;
+use gtk4 as gtk;
+
+fn main() -> gtk::glib::ExitCode {
+    let application = gtk::Application::builder()
+        .application_id("cloud.opensecret.maple.desktop")
+        .build();
+
+    application.connect_activate(|application| {
+        app::launch(application);
+    });
+
+    application.run()
+}
diff --git a/native/desktop/gtk/src/manager.rs b/native/desktop/gtk/src/manager.rs
new file mode 100644
index 00000000..857454f7
--- /dev/null
+++ b/native/desktop/gtk/src/manager.rs
@@ -0,0 +1,136 @@
+use std::hash::{Hash, Hasher};
+use std::sync::Arc;
+
+use flume::Receiver;
+use maple_core::{AppAction, AppReconciler, AppState, AppUpdate, FfiApp};
+
+const KEYRING_SERVICE: &str = "cloud.opensecret.maple.desktop";
+const KEYRING_ACCESS: &str = "access_token";
+const KEYRING_REFRESH: &str = "refresh_token";
+
+#[derive(Clone)]
+pub struct AppManager {
+    ffi: Arc<FfiApp>,
+    update_rx: Receiver<AppUpdate>,
+}
+
+impl Hash for AppManager {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        Arc::as_ptr(&self.ffi).hash(state);
+    }
+}
+
+struct DesktopReconciler {
+    tx: flume::Sender<AppUpdate>,
+}
+
+impl AppReconciler for DesktopReconciler {
+    fn reconcile(&self, update: AppUpdate) {
+        let _ = self.tx.send(update);
+    }
+}
+
+impl AppManager {
+    pub fn new() -> Result<Self, String> {
+        let data_dir = dirs_next::data_dir()
+            .unwrap_or_else(|| std::path::PathBuf::from("."))
+            .join("Maple")
+            .to_string_lossy()
+            .to_string();
+        let _ = std::fs::create_dir_all(&data_dir);
+
+        let _ = dotenvy::dotenv();
+        let api_url = configured_api_url();
+        let client_id = std::env::var("CLIENT_ID")
+            .unwrap_or_else(|_| "ba5a14b5-d915-47b1-b7b1-afda52bc5fc6".to_string());
+
+        let ffi = FfiApp::new(api_url, client_id, data_dir);
+        let (notify_tx, update_rx) = flume::unbounded();
+        ffi.listen_for_updates(Box::new(DesktopReconciler { tx: notify_tx }));
+
+        let manager = Self { ffi, update_rx };
+        manager.restore_or_complete_startup();
+        Ok(manager)
+    }
+
+    pub fn state(&self) -> AppState {
+        self.ffi.state()
+    }
+
+    pub fn dispatch(&self, action: AppAction) {
+        self.ffi.dispatch(action);
+    }
+
+    pub fn subscribe_updates(&self) -> Receiver<AppUpdate> {
+        self.update_rx.clone()
+    }
+
+    pub fn persist_side_effect(update: &AppUpdate) {
+        if let AppUpdate::SessionTokens {
+            access_token,
+            refresh_token,
+            ..
+        } = update
+        {
+            save_tokens_to_keyring(access_token, refresh_token);
+        }
+    }
+
+    fn restore_or_complete_startup(&self) {
+        if let Some((access_token, refresh_token)) = load_tokens_from_keyring() {
+            self.dispatch(AppAction::RestoreSession {
+                access_token,
+                refresh_token,
+            });
+        } else {
+            clear_tokens_from_keyring();
+            self.dispatch(AppAction::CompleteStartup);
+        }
+    }
+}
+
+fn configured_api_url() -> String {
+    std::env::var("OPEN_SECRET_API_URL")
+        .ok()
+        .or_else(|| option_env!("OPEN_SECRET_API_URL").map(str::to_owned))
+        .unwrap_or_else(maple_core::default_api_url)
+}
+
+fn save_tokens_to_keyring(access_token: &str, refresh_token: &str) {
+    if access_token.is_empty() || refresh_token.is_empty() {
+        clear_tokens_from_keyring();
+        return;
+    }
+
+    if let Ok(entry) = keyring::Entry::new(KEYRING_SERVICE, KEYRING_ACCESS) {
+        let _ = entry.set_password(access_token);
+    }
+    if let Ok(entry) = keyring::Entry::new(KEYRING_SERVICE, KEYRING_REFRESH) {
+        let _ = entry.set_password(refresh_token);
+    }
+}
+
+fn load_tokens_from_keyring() -> Option<(String, String)> {
+    let access_token = keyring::Entry::new(KEYRING_SERVICE, KEYRING_ACCESS)
+        .ok()?
+        .get_password()
+        .ok()?;
+    let refresh_token = keyring::Entry::new(KEYRING_SERVICE, KEYRING_REFRESH)
+        .ok()?
+        .get_password()
+        .ok()?;
+    if access_token.is_empty() || refresh_token.is_empty() {
+        clear_tokens_from_keyring();
+        return None;
+    }
+    Some((access_token, refresh_token))
+}
+
+fn clear_tokens_from_keyring() {
+    if let Ok(entry) = keyring::Entry::new(KEYRING_SERVICE, KEYRING_ACCESS) {
+        let _ = entry.delete_credential();
+    }
+    if let Ok(entry) = keyring::Entry::new(KEYRING_SERVICE, KEYRING_REFRESH) {
+        let _ = entry.delete_credential();
+    }
+}
diff --git a/native/desktop/gtk/src/theme.rs b/native/desktop/gtk/src/theme.rs
new file mode 100644
index 00000000..cc26c01c
--- /dev/null
+++ b/native/desktop/gtk/src/theme.rs
@@ -0,0 +1,631 @@
+use gtk::cairo;
+use gtk::prelude::*;
+use gtk4 as gtk;
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Color {
+    pub r: f64,
+    pub g: f64,
+    pub b: f64,
+    pub a: f64,
+}
+
+impl Color {
+    pub const fn rgb(hex: u32) -> Self {
+        Self {
+            r: ((hex >> 16) & 0xff) as f64 / 255.0,
+            g: ((hex >> 8) & 0xff) as f64 / 255.0,
+            b: (hex & 0xff) as f64 / 255.0,
+            a: 1.0,
+        }
+    }
+
+    pub const fn rgba(hex: u32, a: f64) -> Self {
+        Self {
+            a,
+            ..Self::rgb(hex)
+        }
+    }
+
+    pub const fn with_alpha(self, a: f64) -> Self {
+        Self { a, ..self }
+    }
+
+    pub fn css_rgba(self) -> String {
+        format!(
+            "rgba({:.0}, {:.0}, {:.0}, {:.3})",
+            self.r * 255.0,
+            self.g * 255.0,
+            self.b * 255.0,
+            self.a
+        )
+    }
+
+    pub fn pango_rgb(self) -> String {
+        format!(
+            "#{:02X}{:02X}{:02X}",
+            (self.r * 255.0).round() as u8,
+            (self.g * 255.0).round() as u8,
+            (self.b * 255.0).round() as u8,
+        )
+    }
+
+    pub fn set_source(self, cr: &cairo::Context) {
+        cr.set_source_rgba(self.r, self.g, self.b, self.a);
+    }
+}
+
+pub const MAPLE_400: Color = Color::rgb(0xFFA88A);
+pub const MAPLE_500: Color = Color::rgb(0xFF9771);
+pub const MAPLE_600: Color = Color::rgb(0xF67D57);
+pub const MAPLE_700: Color = Color::rgb(0xE8633D);
+pub const PEBBLE_50: Color = Color::rgb(0xF7F7F9);
+pub const PEBBLE_100: Color = Color::rgb(0xE8E8ED);
+pub const PEBBLE_300: Color = Color::rgb(0xBABCCB);
+pub const PEBBLE_400: Color = Color::rgb(0x9C9DAB);
+pub const PEBBLE_600: Color = Color::rgb(0x757689);
+pub const PEBBLE_700: Color = Color::rgb(0x5E5F6E);
+pub const PEBBLE_800: Color = Color::rgb(0x474854);
+pub const BARK_300: Color = Color::rgb(0xC29A8D);
+pub const NEUTRAL_200: Color = Color::rgb(0xD4D4D4);
+pub const NEUTRAL_800: Color = Color::rgb(0x171717);
+pub const WHITE: Color = Color::rgb(0xFFFFFF);
+pub const MAPLE_ERROR: Color = Color::rgb(0xD05E41);
+
+pub const SPACE_XS: i32 = 8;
+pub const SPACE_SM: i32 = 12;
+pub const SPACE_MD: i32 = 20;
+pub const SPACE_LG: i32 = 36;
+pub const RADIUS_MD: i32 = 12;
+pub const RADIUS_XL: i32 = 24;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum BackgroundKind {
+    Splash,
+    Login,
+    Chat,
+}
+
+#[derive(Clone, Copy, Debug)]
+pub struct ThemeConfig {
+    pub dark_mode: bool,
+}
+
+#[derive(Clone, Copy, Debug)]
+pub struct LoginPalette {
+    pub background_base: Color,
+    pub glow_stops: &'static [(f64, Color)],
+    pub card_background: Color,
+    pub card_highlight: Color,
+    pub card_border: Color,
+    pub wordmark: Color,
+    pub supporting_text: Color,
+    pub tertiary_text: Color,
+    pub divider: Color,
+    pub field_background: Color,
+    pub field_border: Color,
+    pub field_text: Color,
+    pub secondary_button_background: Color,
+    pub secondary_button_border: Color,
+    pub secondary_button_foreground: Color,
+}
+
+#[derive(Clone, Copy, Debug)]
+pub struct ChatPalette {
+    pub background_base: Color,
+    pub glow_stops: &'static [(f64, Color)],
+    pub chrome_highlight: Color,
+    pub chrome_background: Color,
+    pub chrome_border: Color,
+    pub header_wordmark: Color,
+    pub secondary_icon: Color,
+    pub compose_background: Color,
+    pub compose_border: Color,
+    pub compose_text: Color,
+    pub compose_placeholder: Color,
+    pub metadata_text: Color,
+    pub assistant_text: Color,
+    pub user_bubble_color: Color,
+    pub user_text: Color,
+    pub surface_text: Color,
+    pub sheet_background: Color,
+    pub sheet_divider: Color,
+}
+
+#[derive(Clone, Copy, Debug)]
+pub struct ToastPalette {
+    pub background: Color,
+    pub text: Color,
+    pub border: Color,
+}
+
+const SPLASH_STOPS: &[(f64, Color)] = &[
+    (0.0, MAPLE_500),
+    (0.48, Color::rgb(0xCE9A8E)),
+    (1.0, PEBBLE_400),
+];
+
+const LOGIN_LIGHT_STOPS: &[(f64, Color)] = &[
+    (0.0, MAPLE_500.with_alpha(0.18)),
+    (0.52, BARK_300.with_alpha(0.10)),
+    (0.78, PEBBLE_300.with_alpha(0.10)),
+    (1.0, WHITE.with_alpha(0.0)),
+];
+
+const LOGIN_DARK_STOPS: &[(f64, Color)] = &[
+    (0.0, MAPLE_500.with_alpha(0.07)),
+    (0.42, Color::rgba(0x5D4036, 0.11)),
+    (0.76, PEBBLE_800.with_alpha(0.12)),
+    (1.0, WHITE.with_alpha(0.0)),
+];
+
+const CHAT_LIGHT_STOPS: &[(f64, Color)] = &[
+    (0.0, Color::rgba(0xFF9771, 0.35)),
+    (0.12, Color::rgba(0xECB8A5, 0.20)),
+    (0.24, Color::rgba(0xDADADA, 0.10)),
+    (1.0, WHITE.with_alpha(0.0)),
+];
+
+const CHAT_DARK_STOPS: &[(f64, Color)] = &[
+    (0.0, MAPLE_500.with_alpha(0.07)),
+    (0.42, Color::rgba(0x5D4036, 0.10)),
+    (0.76, PEBBLE_800.with_alpha(0.12)),
+    (1.0, WHITE.with_alpha(0.0)),
+];
+
+impl ThemeConfig {
+    pub const fn new(dark_mode: bool) -> Self {
+        Self { dark_mode }
+    }
+
+    pub fn login_palette(self) -> LoginPalette {
+        if self.dark_mode {
+            LoginPalette {
+                background_base: Color::rgb(0x1A110E),
+                glow_stops: LOGIN_DARK_STOPS,
+                card_background: Color::rgba(0x271D1A, 0.90),
+                card_highlight: WHITE.with_alpha(0.04),
+                card_border: Color::rgb(0x53433E),
+                wordmark: PEBBLE_50,
+                supporting_text: Color::rgb(0xD8C2BB),
+                tertiary_text: Color::rgba(0xD8C2BB, 0.80),
+                divider: Color::rgb(0x53433E),
+                field_background: Color::rgba(0x231A16, 0.96),
+                field_border: Color::rgba(0xA08D86, 0.45),
+                field_text: Color::rgb(0xF1DFD9),
+                secondary_button_background: Color::rgba(0x322824, 0.96),
+                secondary_button_border: Color::rgb(0x53433E),
+                secondary_button_foreground: Color::rgb(0xF1DFD9),
+            }
+        } else {
+            LoginPalette {
+                background_base: Color::rgb(0xFBF8F6),
+                glow_stops: LOGIN_LIGHT_STOPS,
+                card_background: WHITE.with_alpha(0.74),
+                card_highlight: WHITE.with_alpha(0.42),
+                card_border: WHITE.with_alpha(0.72),
+                wordmark: PEBBLE_800,
+                supporting_text: PEBBLE_600,
+                tertiary_text: PEBBLE_400,
+                divider: NEUTRAL_200,
+                field_background: WHITE.with_alpha(0.84),
+                field_border: NEUTRAL_200.with_alpha(0.95),
+                field_text: PEBBLE_800,
+                secondary_button_background: WHITE.with_alpha(0.56),
+                secondary_button_border: WHITE.with_alpha(0.68),
+                secondary_button_foreground: PEBBLE_700,
+            }
+        }
+    }
+
+    pub fn chat_palette(self) -> ChatPalette {
+        if self.dark_mode {
+            ChatPalette {
+                background_base: Color::rgb(0x1A110E),
+                glow_stops: CHAT_DARK_STOPS,
+                chrome_highlight: Color::rgba(0x271D1A, 0.78),
+                chrome_background: Color::rgba(0x271D1A, 0.78),
+                chrome_border: Color::rgb(0x53433E),
+                header_wordmark: PEBBLE_50,
+                secondary_icon: Color::rgb(0xD8C2BB),
+                compose_background: Color::rgba(0x271D1A, 0.78),
+                compose_border: Color::rgb(0x53433E),
+                compose_text: Color::rgb(0xF1DFD9),
+                compose_placeholder: Color::rgba(0xD8C2BB, 0.78),
+                metadata_text: Color::rgba(0xD8C2BB, 0.82),
+                assistant_text: Color::rgb(0xF1DFD9),
+                user_bubble_color: Color::rgba(0x322824, 0.96),
+                user_text: Color::rgb(0xF1DFD9),
+                surface_text: Color::rgb(0xF1DFD9),
+                sheet_background: Color::rgb(0x271D1A),
+                sheet_divider: Color::rgb(0x53433E),
+            }
+        } else {
+            ChatPalette {
+                background_base: WHITE,
+                glow_stops: CHAT_LIGHT_STOPS,
+                chrome_highlight: WHITE.with_alpha(0.98),
+                chrome_background: Color::rgba(0xFFF1EC, 0.84),
+                chrome_border: WHITE.with_alpha(0.92),
+                header_wordmark: PEBBLE_800,
+                secondary_icon: PEBBLE_800,
+                compose_background: WHITE.with_alpha(0.90),
+                compose_border: WHITE.with_alpha(0.94),
+                compose_text: NEUTRAL_800,
+                compose_placeholder: Color::rgb(0x878787),
+                metadata_text: PEBBLE_400,
+                assistant_text: PEBBLE_800,
+                user_bubble_color: PEBBLE_100,
+                user_text: NEUTRAL_800,
+                surface_text: NEUTRAL_800,
+                sheet_background: WHITE.with_alpha(0.96),
+                sheet_divider: NEUTRAL_200,
+            }
+        }
+    }
+
+    pub fn toast_palette(self) -> ToastPalette {
+        if self.dark_mode {
+            ToastPalette {
+                background: Color::rgba(0x271D1A, 0.92),
+                text: PEBBLE_50,
+                border: MAPLE_ERROR.with_alpha(0.35),
+            }
+        } else {
+            ToastPalette {
+                background: WHITE.with_alpha(0.94),
+                text: NEUTRAL_800,
+                border: MAPLE_ERROR.with_alpha(0.18),
+            }
+        }
+    }
+
+    pub fn splash_wordmark(self) -> Color {
+        let _ = self;
+        PEBBLE_50
+    }
+
+    pub fn splash_tagline(self) -> Color {
+        let _ = self;
+        PEBBLE_100.with_alpha(0.80)
+    }
+
+    pub fn css(self) -> String {
+        let login = self.login_palette();
+        let chat = self.chat_palette();
+        let toast = self.toast_palette();
+
+        format!(
+            r#"
+window.maple-window,
+window.maple-window > * {{
+  background: transparent;
+  color: {};
+  font-family: "Manrope", "Cantarell", sans-serif;
+}}
+
+button.flat {{
+  box-shadow: none;
+}}
+
+label.maple-splash-tagline {{
+  color: {};
+  font-family: "Array-Bold", "Manrope", sans-serif;
+  font-weight: 700;
+  font-size: 16px;
+}}
+
+box.maple-login-card-shell {{
+  background-image: linear-gradient(to bottom right, {}, {});
+  border: 1px solid {};
+  border-radius: {}px;
+}}
+
+box.maple-entry-shell {{
+  background: {};
+  border: 1px solid {};
+  border-radius: {}px;
+}}
+
+entry.maple-entry {{
+  background: transparent;
+  border: none;
+  color: {};
+  caret-color: {};
+  font-size: 16px;
+  font-weight: 500;
+}}
+
+button.maple-primary-button {{
+  background-image: linear-gradient(to bottom, {}, {});
+  color: {};
+  border: none;
+  border-radius: 999px;
+  font-size: 16px;
+  font-weight: 600;
+}}
+
+button.maple-primary-button:disabled {{
+  opacity: 0.5;
+}}
+
+button.maple-secondary-button {{
+  background: {};
+  color: {};
+  border: 1px solid {};
+  border-radius: 999px;
+  font-size: 16px;
+  font-weight: 500;
+}}
+
+button.maple-secondary-button:disabled {{
+  opacity: 0.6;
+}}
+
+button.maple-link-button {{
+  background: transparent;
+  border: none;
+  color: {};
+  font-size: 14px;
+  font-weight: 500;
+}}
+
+label.maple-divider {{
+  color: {};
+}}
+
+separator.maple-divider {{
+  background: {};
+}}
+
+box.maple-header-pill,
+button.maple-header-pill-button {{
+  background-image: linear-gradient(to bottom right, {}, {});
+  border: 1px solid {};
+  border-radius: 999px;
+  color: {};
+}}
+
+button.maple-header-pill-button:disabled {{
+  opacity: 0.45;
+}}
+
+box.maple-compose-shell {{
+  background: {};
+  border: 1px solid {};
+  border-radius: {}px;
+}}
+
+textview.maple-compose-view,
+textview.maple-compose-view text {{
+  background: transparent;
+  color: {};
+  caret-color: {};
+  font-size: 15px;
+  font-weight: 500;
+}}
+
+label.maple-compose-placeholder {{
+  color: {};
+  font-size: 15px;
+  font-weight: 500;
+}}
+
+button.maple-plus-button {{
+  background: {};
+  border: none;
+  border-radius: 999px;
+  color: {};
+  min-width: 28px;
+  min-height: 28px;
+  padding: 0;
+  font-size: 14px;
+  font-weight: 700;
+}}
+
+button.maple-send-button {{
+  background-image: linear-gradient(to bottom, {}, {});
+  border: none;
+  border-radius: 999px;
+  color: {};
+  min-width: 71px;
+  min-height: 36px;
+  padding: 0;
+  font-size: 20px;
+  font-weight: 800;
+}}
+
+button.maple-send-button:disabled {{
+  opacity: 0.5;
+}}
+
+label.maple-assistant-message {{
+  color: {};
+  font-size: 16px;
+  font-weight: 500;
+}}
+
+box.maple-user-bubble {{
+  background: {};
+  border-radius: 24px 24px 4px 24px;
+}}
+
+label.maple-user-message {{
+  color: {};
+  font-size: 16px;
+  font-weight: 500;
+}}
+
+label.maple-meta {{
+  color: {};
+  font-size: 10px;
+  font-weight: 500;
+}}
+
+button.maple-toast {{
+  background: {};
+  color: {};
+  border-radius: 999px;
+  border: 1px solid {};
+}}
+
+box.maple-settings-card {{
+  background: {};
+  border-radius: {}px;
+}}
+
+separator.maple-settings-divider {{
+  background: {};
+}}
+
+button.maple-settings-action {{
+  background: transparent;
+  border: none;
+  color: {};
+  border-radius: 999px;
+}}
+
+button.maple-danger-action {{
+  background: transparent;
+  border: none;
+  color: {};
+  border-radius: 999px;
+}}
+"#,
+            if self.dark_mode {
+                chat.surface_text.css_rgba()
+            } else {
+                NEUTRAL_800.css_rgba()
+            },
+            self.splash_tagline().css_rgba(),
+            login.card_highlight.css_rgba(),
+            login.card_background.css_rgba(),
+            login.card_border.css_rgba(),
+            RADIUS_XL,
+            login.field_background.css_rgba(),
+            login.field_border.css_rgba(),
+            RADIUS_MD,
+            login.field_text.css_rgba(),
+            MAPLE_500.css_rgba(),
+            MAPLE_400.css_rgba(),
+            MAPLE_600.css_rgba(),
+            WHITE.css_rgba(),
+            login.secondary_button_background.css_rgba(),
+            login.secondary_button_foreground.css_rgba(),
+            login.secondary_button_border.css_rgba(),
+            login.supporting_text.css_rgba(),
+            login.tertiary_text.css_rgba(),
+            login.divider.css_rgba(),
+            chat.chrome_highlight.css_rgba(),
+            chat.chrome_background.css_rgba(),
+            chat.chrome_border.css_rgba(),
+            chat.secondary_icon.css_rgba(),
+            chat.compose_background.css_rgba(),
+            chat.compose_border.css_rgba(),
+            RADIUS_XL,
+            chat.compose_text.css_rgba(),
+            MAPLE_500.css_rgba(),
+            chat.compose_placeholder.css_rgba(),
+            MAPLE_500.with_alpha(0.15).css_rgba(),
+            MAPLE_500.css_rgba(),
+            MAPLE_500.css_rgba(),
+            MAPLE_700.css_rgba(),
+            WHITE.css_rgba(),
+            chat.assistant_text.css_rgba(),
+            chat.user_bubble_color.css_rgba(),
+            chat.user_text.css_rgba(),
+            chat.metadata_text.css_rgba(),
+            toast.background.css_rgba(),
+            toast.text.css_rgba(),
+            toast.border.css_rgba(),
+            chat.sheet_background.css_rgba(),
+            RADIUS_XL,
+            chat.sheet_divider.css_rgba(),
+            chat.surface_text.css_rgba(),
+            MAPLE_ERROR.css_rgba(),
+        )
+    }
+}
+
+pub fn detect_dark_mode() -> bool {
+    gtk::Settings::default()
+        .map(|settings| {
+            let theme_name = settings
+                .property::<String>("gtk-theme-name")
+                .to_ascii_lowercase();
+            settings.is_gtk_application_prefer_dark_theme() || theme_name.contains("dark")
+        })
+        .unwrap_or(false)
+}
+
+pub fn install_css(theme: ThemeConfig) {
+    if let Some(display) = gtk::gdk::Display::default() {
+        let provider = gtk::CssProvider::new();
+        provider.load_from_data(theme.css().as_str());
+        gtk::style_context_add_provider_for_display(
+            &display,
+            &provider,
+            gtk::STYLE_PROVIDER_PRIORITY_APPLICATION,
+        );
+    }
+}
+
+pub fn background_area(kind: BackgroundKind, dark_mode: bool) -> gtk::DrawingArea {
+    let area = gtk::DrawingArea::new();
+    area.set_hexpand(true);
+    area.set_vexpand(true);
+    area.set_draw_func(move |_, cr, width, height| {
+        paint_background(cr, width, height, kind, dark_mode);
+    });
+    area
+}
+
+pub fn paint_background(
+    cr: &cairo::Context,
+    width: i32,
+    height: i32,
+    kind: BackgroundKind,
+    dark_mode: bool,
+) {
+    let theme = ThemeConfig::new(dark_mode);
+    let (base, stops, center_x, center_y, radius) = match kind {
+        BackgroundKind::Splash => (
+            PEBBLE_400,
+            SPLASH_STOPS,
+            width as f64 / 2.0,
+            height as f64,
+            height.max(width) as f64,
+        ),
+        BackgroundKind::Login => {
+            let palette = theme.login_palette();
+            (
+                palette.background_base,
+                palette.glow_stops,
+                width as f64 / 2.0,
+                height as f64,
+                500.0_f64.max(height as f64),
+            )
+        }
+        BackgroundKind::Chat => {
+            let palette = theme.chat_palette();
+            (
+                palette.background_base,
+                palette.glow_stops,
+                width as f64 / 2.0,
+                0.0,
+                500.0,
+            )
+        }
+    };
+
+    base.set_source(cr);
+    let _ = cr.paint();
+
+    let gradient = cairo::RadialGradient::new(center_x, center_y, 0.0, center_x, center_y, radius);
+    for (stop, color) in stops.iter().copied() {
+        gradient.add_color_stop_rgba(stop, color.r, color.g, color.b, color.a);
+    }
+
+    let _ = cr.set_source(&gradient);
+    let _ = cr.paint();
+}
diff --git a/native/desktop/gtk/src/wordmark.rs b/native/desktop/gtk/src/wordmark.rs
new file mode 100644
index 00000000..13b93093
--- /dev/null
+++ b/native/desktop/gtk/src/wordmark.rs
@@ -0,0 +1,140 @@
+use gtk::cairo;
+use gtk::prelude::*;
+use gtk4 as gtk;
+
+use crate::theme::Color;
+
+pub fn full_wordmark(color: Color, height: i32) -> gtk::DrawingArea {
+    let area = gtk::DrawingArea::new();
+    area.set_content_width(((height as f64) * (248.0 / 48.0)).round() as i32);
+    area.set_content_height(height);
+    area.set_draw_func(move |_, cr: &cairo::Context, _, height| {
+        cr.scale(height as f64 / 48.0, height as f64 / 48.0);
+        color.set_source(cr);
+        draw_full_wordmark(cr);
+        let _ = cr.fill();
+    });
+    area
+}
+
+pub fn abbr_wordmark(color: Color, height: i32) -> gtk::DrawingArea {
+    let area = gtk::DrawingArea::new();
+    area.set_content_width(((height as f64) * (100.0 / 32.0)).round() as i32);
+    area.set_content_height(height);
+    area.set_draw_func(move |_, cr: &cairo::Context, _, height| {
+        cr.scale(height as f64 / 32.0, height as f64 / 32.0);
+        color.set_source(cr);
+        draw_abbr_wordmark(cr);
+        let _ = cr.fill();
+    });
+    area
+}
+
+fn draw_abbr_wordmark(cr: &cairo::Context) {
+    cr.new_path();
+    cr.move_to(0.0, 27.4798);
+    cr.line_to(0.0, 4.02964);
+    cr.curve_to(0.0, 0.420626, 3.85183, -1.16383, 6.79613, 0.948761);
+    cr.line_to(17.9439, 10.3599);
+    cr.line_to(29.0916, 0.948761);
+    cr.curve_to(32.0378, -1.16383, 35.8878, 0.420626, 35.8878, 4.02964);
+    cr.line_to(35.8878, 27.4798);
+    cr.curve_to(35.8878, 29.967, 33.8642, 31.984, 31.3689, 31.984);
+    cr.line_to(4.11864, 31.984);
+    cr.curve_to(1.44115, 31.984, 0.0, 30.4071, 0.0, 27.4798);
+    cr.close_path();
+
+    cr.move_to(55.3789, 26.0034);
+    cr.line_to(55.3789, 27.2264);
+    cr.curve_to(55.3789, 29.7135, 53.3553, 31.7306, 50.8601, 31.7306);
+    cr.line_to(44.8681, 31.7306);
+    cr.curve_to(42.371, 31.7306, 40.3493, 29.7135, 40.3493, 27.2264);
+    cr.line_to(40.3493, 4.77258);
+    cr.curve_to(40.3493, 2.28354, 42.3729, 0.266478, 44.87, 0.266478);
+    cr.line_to(55.0952, 0.266478);
+    cr.curve_to(66.9758, 0.266478, 71.1846, 5.503, 71.1846, 13.1537);
+    cr.curve_to(71.1846, 20.8043, 67.0434, 25.921, 55.3808, 26.0034);
+    cr.close_path();
+
+    cr.move_to(74.3353, 27.2264);
+    cr.line_to(74.3353, 4.77258);
+    cr.curve_to(74.3353, 2.28354, 76.3589, 0.266478, 78.8561, 0.266478);
+    cr.line_to(84.848, 0.266478);
+    cr.curve_to(87.3451, 0.266478, 89.3669, 2.28354, 89.3669, 4.77071);
+    cr.line_to(89.3669, 10.7545);
+    cr.line_to(95.3701, 10.7545);
+    cr.curve_to(97.8672, 10.7545, 99.8889, 12.7716, 99.8889, 15.2588);
+    cr.line_to(99.8889, 27.2245);
+    cr.curve_to(99.8889, 29.7117, 97.8653, 31.7288, 95.3701, 31.7288);
+    cr.line_to(78.8561, 31.7288);
+    cr.curve_to(76.3589, 31.7288, 74.3372, 29.7117, 74.3372, 27.2245);
+    cr.close_path();
+}
+
+fn draw_full_wordmark(cr: &cairo::Context) {
+    cr.new_path();
+    cr.move_to(0.0, 41.2408);
+    cr.line_to(0.0, 6.06562);
+    cr.curve_to(0.0, 0.652098, 5.77774, -1.72459, 10.1942, 1.4443);
+    cr.line_to(26.9158, 15.561);
+    cr.line_to(43.6375, 1.4443);
+    cr.curve_to(48.0567, -1.72459, 53.8317, 0.652098, 53.8317, 6.06562);
+    cr.line_to(53.8317, 41.2408);
+    cr.curve_to(53.8317, 44.9716, 50.7962, 47.9972, 47.0534, 47.9972);
+    cr.line_to(6.17796, 47.9972);
+    cr.curve_to(2.16172, 47.9972, 0.0, 45.6318, 0.0, 41.2408);
+    cr.close_path();
+
+    cr.move_to(58.7892, 39.8362);
+    cr.line_to(79.685, 3.36589);
+    cr.curve_to(82.2553, -1.11494, 86.5647, -1.12899, 89.1435, 3.36589);
+    cr.line_to(110.031, 39.8362);
+    cr.curve_to(112.77, 44.6148, 111.082, 48.0, 105.555, 48.0);
+    cr.line_to(63.2649, 48.0);
+    cr.curve_to(57.7408, 48.0, 56.0526, 44.6204, 58.7892, 39.8362);
+    cr.close_path();
+
+    cr.move_to(137.257, 39.4064);
+    cr.line_to(137.257, 41.2408);
+    cr.curve_to(137.257, 44.9716, 134.221, 47.9972, 130.478, 47.9972);
+    cr.line_to(121.49, 47.9972);
+    cr.curve_to(117.745, 47.9972, 114.712, 44.9716, 114.712, 41.2408);
+    cr.line_to(114.712, 7.56014);
+    cr.curve_to(114.712, 3.82658, 117.748, 0.800986, 121.493, 0.800986);
+    cr.line_to(136.831, 0.800986);
+    cr.curve_to(154.652, 0.800986, 160.965, 8.65577, 160.965, 20.1318);
+    cr.curve_to(160.965, 31.6077, 154.753, 39.2827, 137.259, 39.4064);
+    cr.close_path();
+
+    cr.move_to(164.191, 41.2408);
+    cr.line_to(164.191, 7.56014);
+    cr.curve_to(164.191, 3.82658, 167.227, 0.800986, 170.972, 0.800986);
+    cr.line_to(179.96, 0.800986);
+    cr.curve_to(183.706, 0.800986, 186.739, 3.82658, 186.739, 7.55733);
+    cr.line_to(186.739, 16.5331);
+    cr.line_to(195.743, 16.5331);
+    cr.curve_to(199.489, 16.5331, 202.522, 19.5587, 202.522, 23.2894);
+    cr.line_to(202.522, 41.238);
+    cr.curve_to(202.522, 44.9688, 199.486, 47.9944, 195.743, 47.9944);
+    cr.line_to(170.972, 47.9944);
+    cr.curve_to(167.227, 47.9944, 164.194, 44.9688, 164.194, 41.238);
+    cr.close_path();
+
+    cr.move_to(240.304, 16.5331);
+    cr.line_to(230.6, 16.5331);
+    cr.curve_to(233.943, 17.4854, 236.386, 20.5532, 236.386, 24.1884);
+    cr.curve_to(236.386, 28.0259, 233.669, 31.2257, 230.05, 31.9842);
+    cr.line_to(240.321, 31.9842);
+    cr.curve_to(244.712, 31.9842, 247.082, 34.3412, 247.082, 38.7237);
+    cr.line_to(247.082, 41.2549);
+    cr.curve_to(247.082, 45.6346, 244.712, 47.9972, 240.315, 47.9972);
+    cr.line_to(212.982, 47.9972);
+    cr.curve_to(208.582, 47.9972, 206.215, 45.6346, 206.215, 41.2549);
+    cr.line_to(206.215, 7.5433);
+    cr.curve_to(206.215, 3.1608, 208.582, 0.800986, 212.982, 0.800986);
+    cr.line_to(240.315, 0.800986);
+    cr.curve_to(244.712, 0.800986, 247.082, 3.1608, 247.082, 7.5433);
+    cr.line_to(247.082, 9.77668);
+    cr.curve_to(247.082, 13.5074, 244.047, 16.5302, 240.306, 16.5302);
+    cr.close_path();
+}
diff --git a/native/flake.nix b/native/flake.nix
new file mode 100644
index 00000000..38c00d20
--- /dev/null
+++ b/native/flake.nix
@@ -0,0 +1,178 @@
+{
+  description = "RMP app dev environment";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    android-nixpkgs = {
+      url = "github:tadfisher/android-nixpkgs";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs = { nixpkgs, flake-utils, rust-overlay, android-nixpkgs, ... }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = import nixpkgs {
+          inherit system;
+          overlays = [ (import rust-overlay) ];
+          config.allowUnfree = true;
+          config.android_sdk.accept_license = true;
+        };
+
+        rustToolchain = pkgs.rust-bin.stable.latest.default.override {
+          extensions = [ "rust-src" "rust-analyzer" ];
+          targets = [
+            "aarch64-linux-android"
+            "armv7-linux-androideabi"
+            "x86_64-linux-android"
+            "aarch64-apple-ios"
+            "aarch64-apple-ios-sim"
+            "x86_64-apple-ios"
+          ] ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [
+            "aarch64-apple-darwin"
+            "x86_64-apple-darwin"
+          ];
+        };
+
+        androidSdk =
+          if builtins.hasAttr system android-nixpkgs.sdk then
+            android-nixpkgs.sdk.${system} (sdkPkgs: with sdkPkgs; [
+              cmdline-tools-latest
+              platform-tools
+              build-tools-34-0-0
+              build-tools-35-0-0
+              platforms-android-34
+              platforms-android-35
+              ndk-28-2-13676358
+              emulator
+              (if pkgs.stdenv.isDarwin
+               then system-images-android-35-google-apis-arm64-v8a
+               else system-images-android-35-google-apis-x86-64)
+            ])
+          else
+            null;
+
+        rmp = pkgs.writeShellScriptBin "rmp" ''
+          set -euo pipefail
+          if [ -z "''${RMP_REPO:-}" ]; then
+            echo "error: set RMP_REPO to a checkout containing the rmp-cli crate" >&2
+            exit 2
+          fi
+          # Support both workspace layout ($RMP_REPO/Cargo.toml with -p rmp-cli)
+          # and standalone layout ($RMP_REPO/rmp-cli/Cargo.toml).
+          if [ -f "$RMP_REPO/Cargo.toml" ]; then
+            exec cargo run --manifest-path "$RMP_REPO/Cargo.toml" -p rmp-cli -- "$@"
+          elif [ -f "$RMP_REPO/rmp-cli/Cargo.toml" ]; then
+            exec cargo run --manifest-path "$RMP_REPO/rmp-cli/Cargo.toml" -- "$@"
+          else
+            echo "error: RMP_REPO=$RMP_REPO does not contain rmp-cli" >&2
+            exit 2
+          fi
+        '';
+
+        shell = pkgs.mkShell {
+          buildInputs = pkgs.lib.optionals pkgs.stdenv.isDarwin [
+            pkgs.libiconv
+          ];
+
+          packages = [
+            rustToolchain
+            pkgs.just
+            pkgs.nodejs_22
+            pkgs.python3
+            pkgs.curl
+            pkgs.file
+            pkgs.git
+            pkgs.gradle
+            pkgs.imagemagick
+            pkgs.patchelf
+            pkgs.pkg-config
+            pkgs.desktop-file-utils
+            pkgs.dpkg
+            pkgs.adwaita-icon-theme
+            pkgs.fontconfig
+            pkgs.dconf
+            pkgs.cairo
+            pkgs.gdk-pixbuf
+            pkgs.gdk-pixbuf.dev
+            pkgs.glib
+            pkgs.glib.dev
+            pkgs.glib-networking
+            pkgs.gsettings-desktop-schemas
+            pkgs.graphene
+            pkgs.gtk4
+            pkgs.hicolor-icon-theme
+            pkgs.isocodes
+            pkgs.libxkbcommon
+            pkgs.pango
+            pkgs.shared-mime-info
+            pkgs.squashfsTools
+            pkgs.wayland
+            pkgs.xkeyboard-config
+            pkgs.libx11
+            rmp
+          ] ++ pkgs.lib.optionals (androidSdk != null) [
+            androidSdk
+          ] ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [
+            pkgs.xcodegen
+          ];
+
+          shellHook = ''
+            export IN_NIX_SHELL=1
+            export MAPLE_NATIVE_NIX_SHELL=1
+
+            if [ -n "${if androidSdk != null then "1" else ""}" ]; then
+              export ANDROID_HOME=${if androidSdk != null then "${androidSdk}/share/android-sdk" else ""}
+              export ANDROID_SDK_ROOT="$ANDROID_HOME"
+              export ANDROID_NDK_HOME="$ANDROID_HOME/ndk/28.2.13676358"
+              export PATH=$ANDROID_HOME/emulator:$ANDROID_HOME/platform-tools:$ANDROID_HOME/cmdline-tools/latest/bin:$PATH
+            fi
+
+            # Auto-detect rmp-cli in parent directory
+            if [ -z "''${RMP_REPO:-}" ]; then
+              _parent="$(cd .. 2>/dev/null && pwd)"
+              if [ -f "$_parent/rmp-cli/Cargo.toml" ]; then
+                export RMP_REPO="$_parent"
+              fi
+            fi
+
+            if [ "$(uname -s)" = "Darwin" ]; then
+              if [ -n "''${DEVELOPER_DIR:-}" ] && [ -x "''${DEVELOPER_DIR}/usr/bin/simctl" ]; then
+                DEV_DIR="$DEVELOPER_DIR"
+              else
+                DEV_DIR="$(xcode-select -p 2>/dev/null || true)"
+              fi
+              if [ -n "$DEV_DIR" ] && [ -d "$DEV_DIR/Toolchains/XcodeDefault.xctoolchain/usr/bin" ]; then
+                export DEVELOPER_DIR="$DEV_DIR"
+                TOOLCHAIN_BIN="$DEV_DIR/Toolchains/XcodeDefault.xctoolchain/usr/bin"
+                export CC="$TOOLCHAIN_BIN/clang"
+                export CXX="$TOOLCHAIN_BIN/clang++"
+                export AR="$TOOLCHAIN_BIN/ar"
+                export RANLIB="$TOOLCHAIN_BIN/ranlib"
+              fi
+            fi
+
+            if [ -n "''${ANDROID_HOME:-}" ]; then
+              mkdir -p android
+              cat > android/local.properties <<EOF
+              sdk.dir=$ANDROID_HOME
+EOF
+            fi
+
+            echo ""
+            echo "RMP app dev environment ready"
+            echo "  Rust: $(rustc --version)"
+            echo "  RMP repo: ''${RMP_REPO:-(not set)}"
+            echo ""
+          '';
+        };
+      in {
+        devShells.default = shell;
+      }
+    );
+}
diff --git a/native/ios/App.entitlements b/native/ios/App.entitlements
new file mode 100644
index 00000000..30cc6215
--- /dev/null
+++ b/native/ios/App.entitlements
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>keychain-access-groups</key>
+	<array>
+		<string>$(AppIdentifierPrefix)$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+	</array>
+</dict>
+</plist>
diff --git a/native/ios/Info-macOS.plist b/native/ios/Info-macOS.plist
new file mode 100644
index 00000000..0efa5abc
--- /dev/null
+++ b/native/ios/Info-macOS.plist
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>en</string>
+	<key>CFBundleDisplayName</key>
+	<string>Maple</string>
+	<key>CFBundleExecutable</key>
+	<string>$(EXECUTABLE_NAME)</string>
+	<key>CFBundleIdentifier</key>
+	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+	<key>CFBundleName</key>
+	<string>$(PRODUCT_NAME)</string>
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>$(MARKETING_VERSION)</string>
+	<key>CFBundleVersion</key>
+	<string>$(CURRENT_PROJECT_VERSION)</string>
+	<key>OPEN_SECRET_API_URL</key>
+	<string>$(OPEN_SECRET_API_URL)</string>
+	<key>ITSAppUsesNonExemptEncryption</key>
+	<false/>
+	<key>ATSApplicationFontsPath</key>
+	<string>Fonts</string>
+	<key>NSHighResolutionCapable</key>
+	<true/>
+</dict>
+</plist>
diff --git a/native/ios/Info.plist b/native/ios/Info.plist
new file mode 100644
index 00000000..4ec9543d
--- /dev/null
+++ b/native/ios/Info.plist
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>en</string>
+	<key>CFBundleDisplayName</key>
+	<string>Maple</string>
+	<key>CFBundleExecutable</key>
+	<string>$(EXECUTABLE_NAME)</string>
+	<key>CFBundleIdentifier</key>
+	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+	<key>CFBundleName</key>
+	<string>$(PRODUCT_NAME)</string>
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>$(MARKETING_VERSION)</string>
+	<key>CFBundleVersion</key>
+	<string>$(CURRENT_PROJECT_VERSION)</string>
+	<key>OPEN_SECRET_API_URL</key>
+	<string>$(OPEN_SECRET_API_URL)</string>
+	<key>ITSAppUsesNonExemptEncryption</key>
+	<false/>
+	<key>UILaunchScreen</key>
+	<dict/>
+	<key>UIAppFonts</key>
+	<array>
+		<string>Fonts/Manrope-Regular.ttf</string>
+		<string>Fonts/Manrope-Medium.ttf</string>
+		<string>Fonts/Manrope-SemiBold.ttf</string>
+		<string>Fonts/Manrope-Bold.ttf</string>
+		<string>Fonts/Array-Bold.ttf</string>
+	</array>
+	<key>UISupportedInterfaceOrientations</key>
+	<array>
+		<string>UIInterfaceOrientationPortrait</string>
+		<string>UIInterfaceOrientationLandscapeLeft</string>
+		<string>UIInterfaceOrientationLandscapeRight</string>
+	</array>
+	<key>UISupportedInterfaceOrientations~ipad</key>
+	<array>
+		<string>UIInterfaceOrientationPortrait</string>
+		<string>UIInterfaceOrientationPortraitUpsideDown</string>
+		<string>UIInterfaceOrientationLandscapeLeft</string>
+		<string>UIInterfaceOrientationLandscapeRight</string>
+	</array>
+</dict>
+</plist>
diff --git a/native/ios/Sources/App.swift b/native/ios/Sources/App.swift
new file mode 100644
index 00000000..bcc6cea5
--- /dev/null
+++ b/native/ios/Sources/App.swift
@@ -0,0 +1,22 @@
+import SwiftUI
+
+@main
+struct MapleApp: App {
+    @State private var manager = AppManager()
+
+    var body: some Scene {
+        WindowGroup {
+            ContentView(manager: manager)
+#if os(macOS)
+                .frame(minWidth: 430, minHeight: 760)
+#endif
+        }
+#if os(macOS)
+        .defaultSize(width: 430, height: 900)
+        .windowStyle(.titleBar)
+        .windowToolbarStyle(.unifiedCompact(showsTitle: false))
+        .windowBackgroundDragBehavior(.enabled)
+        .windowResizability(.contentMinSize)
+#endif
+    }
+}
diff --git a/native/ios/Sources/AppManager.swift b/native/ios/Sources/AppManager.swift
new file mode 100644
index 00000000..cf09b609
--- /dev/null
+++ b/native/ios/Sources/AppManager.swift
@@ -0,0 +1,215 @@
+import Foundation
+import Security
+import Observation
+
+// MARK: - Keychain Helper
+
+private enum KeychainHelper {
+    private static var service: String {
+        Bundle.main.bundleIdentifier ?? "cloud.opensecret.maple.apple"
+    }
+
+    static func saveData(key: String, data: Data) {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: key,
+        ]
+
+        var attributes: [String: Any] = [
+            kSecValueData as String: data,
+        ]
+#if !os(macOS)
+        attributes[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+#endif
+
+        var item = query
+        for (key, value) in attributes {
+            item[key] = value
+        }
+
+        let addStatus = SecItemAdd(item as CFDictionary, nil)
+        if addStatus == errSecDuplicateItem {
+            SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
+        }
+    }
+
+    static func loadData(key: String) -> Data? {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: key,
+            kSecReturnData as String: true,
+            kSecMatchLimit as String: kSecMatchLimitOne,
+        ]
+        var result: AnyObject?
+        guard SecItemCopyMatching(query as CFDictionary, &result) == errSecSuccess,
+              let data = result as? Data else { return nil }
+        return data
+    }
+
+    static func loadString(key: String) -> String? {
+        guard let data = loadData(key: key) else { return nil }
+        return String(data: data, encoding: .utf8)
+    }
+
+    static func delete(key: String) {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: key,
+        ]
+        SecItemDelete(query as CFDictionary)
+    }
+}
+
+private struct StoredSessionTokens: Codable {
+    let accessToken: String
+    let refreshToken: String
+}
+
+private enum SessionTokenStore {
+    private static let combinedKey = "session_tokens"
+    private static let legacyAccessKey = "access_token"
+    private static let legacyRefreshKey = "refresh_token"
+
+    static func load() -> StoredSessionTokens? {
+        if let data = KeychainHelper.loadData(key: combinedKey) {
+            if let tokens = try? JSONDecoder().decode(StoredSessionTokens.self, from: data),
+               !tokens.accessToken.isEmpty,
+               !tokens.refreshToken.isEmpty {
+                return tokens
+            }
+
+            KeychainHelper.delete(key: combinedKey)
+        }
+
+        guard let accessToken = KeychainHelper.loadString(key: legacyAccessKey),
+              let refreshToken = KeychainHelper.loadString(key: legacyRefreshKey),
+              !accessToken.isEmpty,
+              !refreshToken.isEmpty else {
+            return nil
+        }
+
+        let tokens = StoredSessionTokens(accessToken: accessToken, refreshToken: refreshToken)
+        save(accessToken: accessToken, refreshToken: refreshToken)
+        KeychainHelper.delete(key: legacyAccessKey)
+        KeychainHelper.delete(key: legacyRefreshKey)
+        return tokens
+    }
+
+    static func save(accessToken: String, refreshToken: String) {
+        guard !accessToken.isEmpty, !refreshToken.isEmpty else {
+            clear()
+            return
+        }
+
+        let tokens = StoredSessionTokens(accessToken: accessToken, refreshToken: refreshToken)
+        guard let data = try? JSONEncoder().encode(tokens) else { return }
+
+        KeychainHelper.saveData(key: combinedKey, data: data)
+        KeychainHelper.delete(key: legacyAccessKey)
+        KeychainHelper.delete(key: legacyRefreshKey)
+    }
+
+    static func clear() {
+        KeychainHelper.delete(key: combinedKey)
+        KeychainHelper.delete(key: legacyAccessKey)
+        KeychainHelper.delete(key: legacyRefreshKey)
+    }
+}
+
+// MARK: - AppManager
+
+@MainActor
+@Observable
+final class AppManager: AppReconciler {
+    let rust: FfiApp
+    var state: AppState
+    private var lastRevApplied: UInt64
+
+    private static func dataDirectory(using fileManager: FileManager) -> URL {
+        let baseDirectory = fileManager.urls(for: .applicationSupportDirectory, in: .userDomainMask).first!
+#if os(macOS)
+        let directoryName = Bundle.main.bundleIdentifier ?? "cloud.opensecret.maple.desktop"
+        return baseDirectory.appendingPathComponent(directoryName, isDirectory: true)
+#else
+        return baseDirectory
+#endif
+    }
+
+    private static func configuredApiUrl() -> String {
+        if let apiUrl = ProcessInfo.processInfo.environment["OPEN_SECRET_API_URL"]?
+            .trimmingCharacters(in: .whitespacesAndNewlines),
+           !apiUrl.isEmpty {
+            return apiUrl
+        }
+
+        if let apiUrl = (Bundle.main.object(forInfoDictionaryKey: "OPEN_SECRET_API_URL") as? String)?
+            .trimmingCharacters(in: .whitespacesAndNewlines),
+           !apiUrl.isEmpty,
+           !apiUrl.contains("$(") {
+            return apiUrl
+        }
+
+        return defaultApiUrl()
+    }
+
+    init() {
+        let fm = FileManager.default
+        let dataDirUrl = Self.dataDirectory(using: fm)
+        let dataDir = dataDirUrl.path
+        try? fm.createDirectory(at: dataDirUrl, withIntermediateDirectories: true)
+
+        let apiUrl = Self.configuredApiUrl()
+        let clientId = "ba5a14b5-d915-47b1-b7b1-afda52bc5fc6"
+
+        let rust = FfiApp(apiUrl: apiUrl, clientId: clientId, dataDir: dataDir)
+        self.rust = rust
+
+        let initial = rust.state()
+        self.state = initial
+        self.lastRevApplied = initial.rev
+
+        rust.listenForUpdates(reconciler: self)
+
+        if let tokens = SessionTokenStore.load() {
+            rust.dispatch(
+                action: .restoreSession(
+                    accessToken: tokens.accessToken,
+                    refreshToken: tokens.refreshToken
+                )
+            )
+        } else {
+            SessionTokenStore.clear()
+            rust.dispatch(action: .completeStartup)
+        }
+    }
+
+    nonisolated func reconcile(update: AppUpdate) {
+        if case .sessionTokens(_, let accessToken, let refreshToken) = update {
+            SessionTokenStore.save(accessToken: accessToken, refreshToken: refreshToken)
+        }
+
+        Task { @MainActor [weak self] in
+            self?.apply(update: update)
+        }
+    }
+
+    private func apply(update: AppUpdate) {
+        switch update {
+        case .sessionTokens(let rev, _, _):
+            if rev > lastRevApplied {
+                lastRevApplied = rev
+            }
+        case .fullState(let s):
+            if s.rev <= lastRevApplied { return }
+            lastRevApplied = s.rev
+            state = s
+        }
+    }
+
+    func dispatch(_ action: AppAction) {
+        rust.dispatch(action: action)
+    }
+}
diff --git a/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/Contents.json b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/Contents.json
new file mode 100644
index 00000000..f27760d9
--- /dev/null
+++ b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/Contents.json
@@ -0,0 +1,14 @@
+{
+  "images" : [
+    {
+      "filename" : "icon_1024.png",
+      "idiom" : "universal",
+      "platform" : "ios",
+      "size" : "1024x1024"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}
diff --git a/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_1024.png b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_1024.png
new file mode 100644
index 00000000..e07d5a5e
Binary files /dev/null and b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_1024.png differ
diff --git a/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_120.png b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_120.png
new file mode 100644
index 00000000..d3cc1331
Binary files /dev/null and b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_120.png differ
diff --git a/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_152.png b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_152.png
new file mode 100644
index 00000000..bb3ca4f9
Binary files /dev/null and b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_152.png differ
diff --git a/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_167.png b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_167.png
new file mode 100644
index 00000000..22ae6708
Binary files /dev/null and b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_167.png differ
diff --git a/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_180.png b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_180.png
new file mode 100644
index 00000000..da879a02
Binary files /dev/null and b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_180.png differ
diff --git a/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_20.png b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_20.png
new file mode 100644
index 00000000..9a08f91a
Binary files /dev/null and b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_20.png differ
diff --git a/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_29.png b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_29.png
new file mode 100644
index 00000000..2bab0b02
Binary files /dev/null and b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_29.png differ
diff --git a/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_40.png b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_40.png
new file mode 100644
index 00000000..dc676908
Binary files /dev/null and b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_40.png differ
diff --git a/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_58.png b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_58.png
new file mode 100644
index 00000000..f3eef3d3
Binary files /dev/null and b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_58.png differ
diff --git a/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_60.png b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_60.png
new file mode 100644
index 00000000..e3bb20a2
Binary files /dev/null and b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_60.png differ
diff --git a/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_76.png b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_76.png
new file mode 100644
index 00000000..02975155
Binary files /dev/null and b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_76.png differ
diff --git a/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_80.png b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_80.png
new file mode 100644
index 00000000..65420a70
Binary files /dev/null and b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_80.png differ
diff --git a/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_87.png b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_87.png
new file mode 100644
index 00000000..812c2eb0
Binary files /dev/null and b/native/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_87.png differ
diff --git a/native/ios/Sources/Assets.xcassets/Contents.json b/native/ios/Sources/Assets.xcassets/Contents.json
new file mode 100644
index 00000000..2673658f
--- /dev/null
+++ b/native/ios/Sources/Assets.xcassets/Contents.json
@@ -0,0 +1 @@
+{"info":{"version":1,"author":"xcode"}}
diff --git a/native/ios/Sources/ContentView.swift b/native/ios/Sources/ContentView.swift
new file mode 100644
index 00000000..b4fec70e
--- /dev/null
+++ b/native/ios/Sources/ContentView.swift
@@ -0,0 +1,1110 @@
+import SwiftUI
+
+struct ContentView: View {
+    @Bindable var manager: AppManager
+    @Environment(\.openURL) private var openURL
+    @State private var showSplash = true
+    @State private var splashMinTimePassed = false
+    @State private var toastDismissTask: Task<Void, Never>?
+
+    var body: some View {
+        ZStack {
+            switch manager.state.router.defaultScreen {
+            case .loading:
+                SplashView()
+            case .login:
+                LoginView(manager: manager)
+            case .chat:
+                AgentChatView(manager: manager)
+            }
+
+            if showSplash {
+                SplashView()
+                    .transition(.opacity)
+                    .zIndex(1)
+            }
+        }
+        .overlay(alignment: .bottom) {
+            MapleToastOverlay(
+                message: manager.state.toast,
+                screen: manager.state.router.defaultScreen,
+                onDismiss: { manager.dispatch(.clearToast) }
+            )
+        }
+        .onAppear {
+            DispatchQueue.main.asyncAfter(deadline: .now() + 1.0) {
+                splashMinTimePassed = true
+                dismissSplashIfReady()
+            }
+            openPendingAuthUrl(manager.state.pendingAuthUrl)
+        }
+        .onChange(of: manager.state.router.defaultScreen) { _, _ in
+            dismissSplashIfReady()
+        }
+        .onChange(of: manager.state.pendingAuthUrl) { _, newUrl in
+            openPendingAuthUrl(newUrl)
+        }
+        .onChange(of: manager.state.toast) { _, newToast in
+            toastDismissTask?.cancel()
+            guard let newToast else { return }
+
+            toastDismissTask = Task {
+                try? await Task.sleep(for: .seconds(4))
+                guard !Task.isCancelled, manager.state.toast == newToast else { return }
+                manager.dispatch(.clearToast)
+            }
+        }
+        .onDisappear {
+            toastDismissTask?.cancel()
+        }
+    }
+
+    private func dismissSplashIfReady() {
+        guard splashMinTimePassed else { return }
+        guard manager.state.router.defaultScreen != .loading else { return }
+        withAnimation(.easeOut(duration: 0.4)) {
+            showSplash = false
+        }
+    }
+
+    private func openPendingAuthUrl(_ urlString: String?) {
+        guard let urlString,
+              let url = URL(string: urlString) else { return }
+
+        openURL(url)
+        manager.dispatch(.clearPendingAuthUrl)
+    }
+}
+
+private struct MapleToastOverlay: View {
+    @Environment(\.colorScheme) private var colorScheme
+
+    let message: String?
+    let screen: Screen
+    let onDismiss: () -> Void
+
+    private var bottomPadding: CGFloat {
+        screen == .chat ? 96 : 28
+    }
+
+    private var textColor: Color {
+        colorScheme == .dark ? .pebble50 : .neutral800
+    }
+
+    private var borderColor: Color {
+        Color.mapleError.opacity(colorScheme == .dark ? 0.35 : 0.18)
+    }
+
+    var body: some View {
+        if let message {
+            Text(message)
+                .font(MapleFont.caption)
+                .foregroundStyle(textColor)
+                .multilineTextAlignment(.center)
+                .padding(.horizontal, MapleSpacing.md)
+                .padding(.vertical, MapleSpacing.sm)
+                .background(.ultraThinMaterial, in: Capsule())
+                .overlay {
+                    Capsule().stroke(borderColor, lineWidth: 1)
+                }
+                .padding(.horizontal, MapleSpacing.md)
+                .padding(.bottom, bottomPadding)
+                .onTapGesture(perform: onDismiss)
+                .transition(.move(edge: .bottom).combined(with: .opacity))
+        }
+    }
+}
+
+// MARK: - Splash
+
+struct SplashView: View {
+    var body: some View {
+        ZStack {
+            RadialGradient(
+                colors: [
+                    Color(hex: 0xFF9771),
+                    Color(hex: 0xCE9A8E),
+                    Color(hex: 0x9C9DAB),
+                ],
+                center: .bottom,
+                startRadius: 0,
+                endRadius: 600
+            )
+            .ignoresSafeArea()
+
+            VStack(spacing: MapleSpacing.lg) {
+                MapleWordmark(color: .pebble50, height: 40)
+
+                Text("Privacy-first intelligence")
+                    .font(MapleFont.display(16))
+                    .foregroundStyle(Color.pebble100.opacity(0.8))
+            }
+        }
+    }
+}
+
+// MARK: - Login
+
+struct LoginView: View {
+    @Bindable var manager: AppManager
+    @Environment(\.colorScheme) private var colorScheme
+    @State private var email = ""
+    @State private var password = ""
+    @State private var name = ""
+    @State private var isSignUp = false
+    @FocusState private var focusedField: LoginField?
+
+    private enum LoginField {
+        case name, email, password
+    }
+
+    private struct LoginPalette {
+        let backgroundBase: Color
+        let backgroundGlow: [Color]
+        let cardBackground: Color
+        let cardHighlight: Color
+        let cardBorder: Color
+        let cardShadow: Color
+        let wordmark: Color
+        let supportingText: Color
+        let tertiaryText: Color
+        let divider: Color
+        let fieldBackground: Color
+        let fieldBorder: Color
+        let fieldText: Color
+        let fieldPlaceholder: Color
+        let secondaryButtonBackground: Color
+        let secondaryButtonBorder: Color
+        let secondaryButtonForeground: Color
+        let secondaryButtonShadow: Color
+    }
+
+    private var isLoading: Bool {
+        switch manager.state.auth {
+        case .loggingIn, .signingUp:
+            return true
+        default:
+            return false
+        }
+    }
+
+    private var loginPalette: LoginPalette {
+        if colorScheme == .dark {
+            LoginPalette(
+                backgroundBase: Color(hex: 0x1A110E),
+                backgroundGlow: [
+                    Color.maple500.opacity(0.07),
+                    Color(hex: 0x5D4036, opacity: 0.11),
+                    Color.pebble800.opacity(0.12),
+                    .clear,
+                ],
+                cardBackground: Color(hex: 0x271D1A, opacity: 0.9),
+                cardHighlight: Color.white.opacity(0.04),
+                cardBorder: Color(hex: 0x53433E),
+                cardShadow: Color.black.opacity(0.4),
+                wordmark: .pebble50,
+                supportingText: Color(hex: 0xD8C2BB),
+                tertiaryText: Color(hex: 0xD8C2BB, opacity: 0.8),
+                divider: Color(hex: 0x53433E),
+                fieldBackground: Color(hex: 0x231A16, opacity: 0.96),
+                fieldBorder: Color(hex: 0xA08D86, opacity: 0.45),
+                fieldText: Color(hex: 0xF1DFD9),
+                fieldPlaceholder: Color(hex: 0xD8C2BB, opacity: 0.75),
+                secondaryButtonBackground: Color(hex: 0x322824, opacity: 0.96),
+                secondaryButtonBorder: Color(hex: 0x53433E),
+                secondaryButtonForeground: Color(hex: 0xF1DFD9),
+                secondaryButtonShadow: Color.black.opacity(0.14)
+            )
+        } else {
+            LoginPalette(
+                backgroundBase: Color(hex: 0xFBF8F6),
+                backgroundGlow: [
+                    Color.maple500.opacity(0.18),
+                    Color.bark300.opacity(0.1),
+                    Color.pebble300.opacity(0.1),
+                    .clear,
+                ],
+                cardBackground: Color.white.opacity(0.74),
+                cardHighlight: Color.white.opacity(0.42),
+                cardBorder: Color.white.opacity(0.72),
+                cardShadow: Color.pebble900.opacity(0.08),
+                wordmark: .pebble800,
+                supportingText: .pebble600,
+                tertiaryText: .pebble400,
+                divider: .neutral200,
+                fieldBackground: Color.white.opacity(0.84),
+                fieldBorder: Color.neutral200.opacity(0.95),
+                fieldText: .pebble800,
+                fieldPlaceholder: .pebble400,
+                secondaryButtonBackground: Color.white.opacity(0.56),
+                secondaryButtonBorder: Color.white.opacity(0.68),
+                secondaryButtonForeground: .pebble700,
+                secondaryButtonShadow: Color.pebble900.opacity(0.05)
+            )
+        }
+    }
+
+    private var loginCardShape: RoundedRectangle {
+        RoundedRectangle(cornerRadius: MapleRadius.xl, style: .continuous)
+    }
+
+    private var loginFieldShape: RoundedRectangle {
+        RoundedRectangle(cornerRadius: MapleRadius.md, style: .continuous)
+    }
+
+    private var loginCardMaxWidth: CGFloat? {
+#if os(macOS)
+        393
+#else
+        nil
+#endif
+    }
+
+    var body: some View {
+        VStack(spacing: 0) {
+            Spacer()
+
+            VStack(spacing: 24) {
+                MapleWordmark(color: loginPalette.wordmark, height: 28)
+
+                VStack(spacing: MapleSpacing.sm) {
+                    if isSignUp {
+                        mapleTextField("Name", text: $name)
+                            .textContentType(.name)
+                            .autocorrectionDisabled()
+                            .focused($focusedField, equals: .name)
+                            .submitLabel(.next)
+                            .onSubmit { focusedField = .email }
+                    }
+
+                    mapleTextField("Email", text: $email)
+                        .textContentType(.emailAddress)
+                        .autocorrectionDisabled()
+#if !os(macOS)
+                        .textInputAutocapitalization(.never)
+                        .keyboardType(.emailAddress)
+#endif
+                        .focused($focusedField, equals: .email)
+                        .submitLabel(.next)
+                        .onSubmit { focusedField = .password }
+
+                    mapleSecureField("Password", text: $password)
+                        .textContentType(isSignUp ? .newPassword : .password)
+                        .focused($focusedField, equals: .password)
+                        .submitLabel(.go)
+                        .onSubmit(submit)
+                }
+
+                Button(action: submit) {
+                    if isLoading {
+                        ProgressView()
+                            .tint(.white)
+                            .frame(maxWidth: .infinity)
+                    } else {
+                        Text(isSignUp ? "Sign Up" : "Sign In")
+                            .frame(maxWidth: .infinity)
+                    }
+                }
+                .buttonStyle(MaplePrimaryButtonStyle())
+                .disabled(email.isEmpty || password.isEmpty || isLoading)
+
+                dividerWithText("or")
+
+                VStack(spacing: MapleSpacing.xs) {
+                    oauthButton(label: "Continue with GitHub", icon: "globe") {
+                        manager.dispatch(.initiateOAuth(provider: .github, inviteCode: nil))
+                    }
+                    oauthButton(label: "Continue with Google", icon: "globe") {
+                        manager.dispatch(.initiateOAuth(provider: .google, inviteCode: nil))
+                    }
+                    oauthButton(label: "Continue with Apple", icon: "applelogo") {
+                        manager.dispatch(.initiateOAuth(provider: .apple, inviteCode: nil))
+                    }
+                }
+                .disabled(isLoading)
+                .opacity(isLoading ? 0.6 : 1.0)
+
+                Button(isSignUp ? "Already have an account? Sign In" : "Don't have an account? Sign Up") {
+                    isSignUp.toggle()
+                }
+                .font(MapleFont.body)
+                .foregroundStyle(loginPalette.supportingText)
+            }
+            .padding(24)
+            .background {
+                ZStack {
+                    loginCardShape.fill(loginPalette.cardBackground)
+
+                    loginCardShape.fill(
+                        LinearGradient(
+                            colors: [loginPalette.cardHighlight, Color.white.opacity(0.02)],
+                            startPoint: .topLeading,
+                            endPoint: .bottomTrailing
+                        )
+                    )
+                }
+            }
+            .overlay {
+                loginCardShape.stroke(loginPalette.cardBorder, lineWidth: 1)
+            }
+            .shadow(color: loginPalette.cardShadow, radius: 28, y: 20)
+            .frame(maxWidth: loginCardMaxWidth)
+            .padding(.horizontal, MapleSpacing.md)
+
+            Spacer()
+        }
+        .background(
+            ZStack {
+                loginPalette.backgroundBase
+
+                RadialGradient(
+                    colors: loginPalette.backgroundGlow,
+                    center: .bottom,
+                    startRadius: 0,
+                    endRadius: 500
+                )
+            }
+            .ignoresSafeArea()
+        )
+        .tint(Color.maple500)
+    }
+
+    private func submit() {
+        if isSignUp {
+            manager.dispatch(.signUpWithEmail(email: email, password: password, name: name))
+        } else {
+            manager.dispatch(.loginWithEmail(email: email, password: password))
+        }
+    }
+
+    private func mapleTextField(_ placeholder: String, text: Binding<String>) -> some View {
+        TextField(
+            "",
+            text: text,
+            prompt: Text(placeholder).foregroundStyle(loginPalette.fieldPlaceholder)
+        )
+        .font(MapleFont.bodyLarge)
+        .foregroundStyle(loginPalette.fieldText)
+        .padding(.horizontal, 16)
+        .padding(.vertical, 14)
+        .background(loginPalette.fieldBackground, in: loginFieldShape)
+        .overlay {
+            loginFieldShape.stroke(loginPalette.fieldBorder, lineWidth: 1)
+        }
+    }
+
+    private func mapleSecureField(_ placeholder: String, text: Binding<String>) -> some View {
+        SecureField(
+            "",
+            text: text,
+            prompt: Text(placeholder).foregroundStyle(loginPalette.fieldPlaceholder)
+        )
+        .font(MapleFont.bodyLarge)
+        .foregroundStyle(loginPalette.fieldText)
+        .padding(.horizontal, 16)
+        .padding(.vertical, 14)
+        .background(loginPalette.fieldBackground, in: loginFieldShape)
+        .overlay {
+            loginFieldShape.stroke(loginPalette.fieldBorder, lineWidth: 1)
+        }
+    }
+
+    private func dividerWithText(_ text: String) -> some View {
+        HStack {
+            Rectangle().frame(height: 1).foregroundStyle(loginPalette.divider)
+            Text(text).font(MapleFont.caption).foregroundStyle(loginPalette.tertiaryText)
+            Rectangle().frame(height: 1).foregroundStyle(loginPalette.divider)
+        }
+    }
+
+    private func oauthButton(label: String, icon: String, action: @escaping () -> Void) -> some View {
+        Button(action: action) {
+            HStack(spacing: MapleSpacing.sm) {
+                Image(systemName: icon)
+                    .font(.system(size: 16, weight: .medium))
+                Text(label)
+            }
+            .font(MapleFont.medium(16))
+            .foregroundStyle(loginPalette.secondaryButtonForeground)
+            .padding(.horizontal, 24)
+            .padding(.vertical, 12)
+            .background(loginPalette.secondaryButtonBackground, in: Capsule())
+            .overlay {
+                Capsule().stroke(loginPalette.secondaryButtonBorder, lineWidth: 1)
+            }
+            .shadow(color: loginPalette.secondaryButtonShadow, radius: 10, y: 6)
+        }
+        .buttonStyle(.plain)
+    }
+}
+
+// MARK: - Agent Chat
+
+struct ChatPalette {
+    let backgroundBase: Color
+    let backgroundGlow: [Color]
+    let headerWordmark: Color
+    let secondaryIcon: Color
+    let composeText: Color
+    let composePlaceholder: Color
+    let metadataText: Color
+    let assistantText: Color
+    let userBubbleColor: Color
+    let userText: Color
+    let settingsSecondaryText: Color
+
+    static func forColorScheme(_ colorScheme: ColorScheme) -> ChatPalette {
+        if colorScheme == .dark {
+            return ChatPalette(
+                backgroundBase: Color(hex: 0x1A110E),
+                backgroundGlow: [
+                    Color.maple500.opacity(0.07),
+                    Color(hex: 0x5D4036, opacity: 0.1),
+                    Color.pebble800.opacity(0.12),
+                    .clear,
+                ],
+                headerWordmark: .pebble50,
+                secondaryIcon: Color(hex: 0xD8C2BB),
+                composeText: Color(hex: 0xF1DFD9),
+                composePlaceholder: Color(hex: 0xD8C2BB, opacity: 0.78),
+                metadataText: Color(hex: 0xD8C2BB, opacity: 0.82),
+                assistantText: Color(hex: 0xF1DFD9),
+                userBubbleColor: Color(hex: 0x322824, opacity: 0.96),
+                userText: Color(hex: 0xF1DFD9),
+                settingsSecondaryText: Color(hex: 0xD8C2BB)
+            )
+        }
+
+        return ChatPalette(
+            backgroundBase: .white,
+            backgroundGlow: [
+                Color(hex: 0xFF9771, opacity: 0.35),
+                Color(hex: 0xECB8A5, opacity: 0.2),
+                Color(hex: 0xDADADA, opacity: 0.1),
+                Color.white.opacity(0),
+            ],
+            headerWordmark: .pebble800,
+            secondaryIcon: .pebble800,
+            composeText: .neutral800,
+            composePlaceholder: Color(hex: 0x878787),
+            metadataText: .pebble400,
+            assistantText: .neutral800,
+            userBubbleColor: .pebble100,
+            userText: .neutral800,
+            settingsSecondaryText: .pebble500
+        )
+    }
+}
+
+private let typingIndicatorID = "typing-indicator"
+
+private enum HistoryLoadScrollStrategy: Equatable {
+    case preserveBottom
+    case preserveAnchor(String)
+}
+
+private struct MessageFramePreferenceKey: PreferenceKey {
+    static var defaultValue: [String: CGRect] = [:]
+
+    static func reduce(value: inout [String: CGRect], nextValue: () -> [String: CGRect]) {
+        value.merge(nextValue(), uniquingKeysWith: { _, new in new })
+    }
+}
+
+private struct ContentHeightPreferenceKey: PreferenceKey {
+    static var defaultValue: CGFloat = 0
+
+    static func reduce(value: inout CGFloat, nextValue: () -> CGFloat) {
+        value = max(value, nextValue())
+    }
+}
+
+private func didPrependMessages(oldIDs: [String], newIDs: [String]) -> Bool {
+    oldIDs.count > 0 &&
+        newIDs.count > oldIDs.count &&
+        Array(newIDs.suffix(oldIDs.count)) == oldIDs
+}
+
+private func didAppendMessages(oldIDs: [String], newIDs: [String]) -> Bool {
+    oldIDs.count > 0 &&
+        newIDs.count > oldIDs.count &&
+        Array(newIDs.prefix(oldIDs.count)) == oldIDs
+}
+
+struct AgentChatView: View {
+    @Bindable var manager: AppManager
+    @Environment(\.colorScheme) private var colorScheme
+    @State private var composeText = ""
+    @State private var hasSettledInitialScroll = false
+    @State private var messageFrames: [String: CGRect] = [:]
+    @State private var scrollViewHeight: CGFloat = 0
+    @State private var contentHeight: CGFloat = 0
+    @State private var topVisibleMessageID: String?
+    @State private var isNearBottom = true
+    @State private var pendingHistoryScrollStrategy: HistoryLoadScrollStrategy?
+    @State private var lastMessageIDs: [String] = []
+    let timestampTimer = Timer.publish(every: 30, on: .main, in: .common).autoconnect()
+
+    private var palette: ChatPalette {
+        ChatPalette.forColorScheme(colorScheme)
+    }
+
+    private var messageIDs: [String] {
+        manager.state.messages.map(\.id)
+    }
+
+    private var bottomTargetID: String? {
+        manager.state.isAgentTyping ? typingIndicatorID : manager.state.messages.last?.id
+    }
+
+    private var chatContentMaxWidth: CGFloat? {
+#if os(macOS)
+        393
+#else
+        nil
+#endif
+    }
+
+    private var topBarTopPadding: CGFloat {
+        0
+    }
+
+    private var topBarControlSize: CGFloat {
+        44
+    }
+
+    private var topBarContent: some View {
+        ZStack {
+            HStack(spacing: 8) {
+                MapleWordmarkAbbr(color: palette.headerWordmark, height: 16)
+                Image(systemName: "chevron.down")
+                    .font(.system(size: 10, weight: .semibold))
+                    .foregroundStyle(Color.pebble400)
+            }
+            .padding(.leading, 22)
+            .padding(.trailing, 16)
+            .frame(minHeight: topBarControlSize)
+            .glassEffect(.regular.interactive(), in: .capsule)
+
+            HStack {
+                topBarButton(systemName: "line.3.horizontal") {
+                    manager.dispatch(.toggleSettings)
+                }
+                Spacer()
+                topBarButton(systemName: "magnifyingglass") {
+                }
+            }
+        }
+        .padding(.top, topBarTopPadding)
+        .padding(.horizontal, 16)
+        .padding(.bottom, MapleSpacing.xs)
+        .frame(maxWidth: chatContentMaxWidth)
+        .frame(maxWidth: .infinity)
+    }
+
+    private func topBarButton(systemName: String, action: @escaping () -> Void) -> some View {
+        Button(action: action) {
+            Image(systemName: systemName)
+                .font(.system(size: 14, weight: .bold))
+                .foregroundStyle(palette.secondaryIcon)
+                .frame(width: topBarControlSize, height: topBarControlSize)
+        }
+        .buttonStyle(.plain)
+        .contentShape(Circle())
+        .glassEffect(.regular.interactive(), in: .circle)
+    }
+
+    private func scrollToBottom(with proxy: ScrollViewProxy, animated: Bool) {
+        guard let bottomTargetID else { return }
+
+        if animated {
+            withAnimation {
+                proxy.scrollTo(bottomTargetID, anchor: .bottom)
+            }
+            return
+        }
+
+        var transaction = Transaction()
+        transaction.disablesAnimations = true
+        withTransaction(transaction) {
+            proxy.scrollTo(bottomTargetID, anchor: .bottom)
+        }
+    }
+
+    private func restoreAfterHistoryLoad(with proxy: ScrollViewProxy) {
+        guard let pendingHistoryScrollStrategy else { return }
+
+        switch pendingHistoryScrollStrategy {
+        case .preserveBottom:
+            scrollToBottom(with: proxy, animated: false)
+        case .preserveAnchor(let anchorID):
+            var transaction = Transaction()
+            transaction.disablesAnimations = true
+            withTransaction(transaction) {
+                proxy.scrollTo(anchorID, anchor: .top)
+            }
+        }
+
+        self.pendingHistoryScrollStrategy = nil
+    }
+
+    private func requestOlderMessages(triggerMessageID: String? = nil) {
+        guard hasSettledInitialScroll,
+              manager.state.hasOlderMessages,
+              !manager.state.isLoadingHistory,
+              pendingHistoryScrollStrategy == nil else { return }
+
+        if contentHeight <= scrollViewHeight + 1, isNearBottom {
+            pendingHistoryScrollStrategy = .preserveBottom
+        } else if let anchorID = topVisibleMessageID ?? triggerMessageID {
+            pendingHistoryScrollStrategy = .preserveAnchor(anchorID)
+        } else {
+            pendingHistoryScrollStrategy = .preserveBottom
+        }
+
+        manager.dispatch(.loadOlderMessages)
+    }
+
+    private func maybeRequestOlderMessagesForUnderfilledViewport() {
+        guard hasSettledInitialScroll,
+              manager.state.hasOlderMessages,
+              !manager.state.isLoadingHistory,
+              pendingHistoryScrollStrategy == nil,
+              scrollViewHeight > 0,
+              contentHeight > 0,
+              contentHeight <= scrollViewHeight + 1,
+              isNearBottom else { return }
+
+        requestOlderMessages()
+    }
+
+    private func settleInitialScrollIfNeeded(with proxy: ScrollViewProxy) {
+        guard !hasSettledInitialScroll,
+              !messageIDs.isEmpty,
+              scrollViewHeight > 0,
+              let bottomTargetID,
+              messageFrames[bottomTargetID] != nil else { return }
+
+        scrollToBottom(with: proxy, animated: false)
+        hasSettledInitialScroll = true
+    }
+
+    private func updateScrollTracking(with frames: [String: CGRect]) {
+        let visibleMessageFrames = frames
+            .filter { key, frame in
+                key != typingIndicatorID &&
+                    frame.maxY > 0 &&
+                    frame.minY < scrollViewHeight
+            }
+
+        topVisibleMessageID = visibleMessageFrames.min { lhs, rhs in
+            lhs.value.minY < rhs.value.minY
+        }?.key
+
+        guard let bottomTargetID,
+              let bottomFrame = frames[bottomTargetID] else {
+            isNearBottom = true
+            return
+        }
+
+        isNearBottom = bottomFrame.maxY <= scrollViewHeight + 80
+    }
+
+    @ViewBuilder
+    private func messageRow(index: Int, message: ChatMessage) -> some View {
+        MessageBubble(message: message, palette: palette)
+            .id(message.id)
+            .background {
+                GeometryReader { bubbleGeometry in
+                    Color.clear.preference(
+                        key: MessageFramePreferenceKey.self,
+                        value: [message.id: bubbleGeometry.frame(in: .named("chat-scroll"))]
+                    )
+                }
+            }
+            .onAppear {
+                if index < 3 {
+                    requestOlderMessages(triggerMessageID: message.id)
+                }
+            }
+    }
+
+    @ViewBuilder
+    private var typingIndicatorView: some View {
+        HStack {
+            Text("Maple is typing...")
+                .font(MapleFont.caption)
+                .foregroundStyle(palette.metadataText)
+            Spacer()
+        }
+        .padding(.horizontal)
+        .id(typingIndicatorID)
+        .background {
+            GeometryReader { bubbleGeometry in
+                Color.clear.preference(
+                    key: MessageFramePreferenceKey.self,
+                    value: [typingIndicatorID: bubbleGeometry.frame(in: .named("chat-scroll"))]
+                )
+            }
+        }
+    }
+
+    private func makeMessageList(
+        proxy: ScrollViewProxy,
+        geometry: GeometryProxy
+    ) -> some View {
+        let showHistorySpinner = manager.state.isLoadingHistory && !manager.state.messages.isEmpty
+        let showInitialSpinner =
+            (manager.state.isLoadingHistory && manager.state.messages.isEmpty) ||
+            (!hasSettledInitialScroll && !manager.state.messages.isEmpty)
+
+        return ScrollView {
+            LazyVStack(spacing: MapleSpacing.md) {
+                ForEach(Array(manager.state.messages.enumerated()), id: \.element.id) { index, message in
+                    messageRow(index: index, message: message)
+                }
+
+                if manager.state.isAgentTyping {
+                    typingIndicatorView
+                }
+            }
+            .frame(maxWidth: chatContentMaxWidth)
+            .frame(maxWidth: .infinity)
+            .padding()
+            .background {
+                GeometryReader { contentGeometry in
+                    Color.clear.preference(
+                        key: ContentHeightPreferenceKey.self,
+                        value: contentGeometry.size.height
+                    )
+                }
+            }
+        }
+        .defaultScrollAnchor(.bottom)
+#if !os(macOS)
+        .scrollDismissesKeyboard(.interactively)
+#endif
+        .coordinateSpace(name: "chat-scroll")
+        .opacity(hasSettledInitialScroll || manager.state.messages.isEmpty ? 1 : 0)
+        .overlay(alignment: .top) {
+            if showHistorySpinner {
+                ProgressView()
+                    .padding(.top, MapleSpacing.xs)
+            }
+        }
+        .overlay {
+            if showInitialSpinner {
+                ProgressView()
+            }
+        }
+        .onAppear {
+            scrollViewHeight = geometry.size.height
+            updateScrollTracking(with: messageFrames)
+        }
+        .onChange(of: geometry.size.height) { _, newHeight in
+            scrollViewHeight = newHeight
+            updateScrollTracking(with: messageFrames)
+            settleInitialScrollIfNeeded(with: proxy)
+        }
+        .onPreferenceChange(MessageFramePreferenceKey.self) { frames in
+            messageFrames = frames
+            updateScrollTracking(with: frames)
+            settleInitialScrollIfNeeded(with: proxy)
+        }
+        .onPreferenceChange(ContentHeightPreferenceKey.self) { newHeight in
+            contentHeight = newHeight
+            settleInitialScrollIfNeeded(with: proxy)
+            maybeRequestOlderMessagesForUnderfilledViewport()
+        }
+        .onChange(of: hasSettledInitialScroll) { _, _ in
+            maybeRequestOlderMessagesForUnderfilledViewport()
+        }
+        .onChange(of: messageIDs) { oldIDs, newIDs in
+            if newIDs.isEmpty {
+                hasSettledInitialScroll = false
+                pendingHistoryScrollStrategy = nil
+                messageFrames = [:]
+                topVisibleMessageID = nil
+                lastMessageIDs = []
+            } else if !hasSettledInitialScroll {
+                settleInitialScrollIfNeeded(with: proxy)
+            } else if didPrependMessages(oldIDs: oldIDs, newIDs: newIDs) {
+                restoreAfterHistoryLoad(with: proxy)
+            } else if didAppendMessages(oldIDs: oldIDs, newIDs: newIDs) && isNearBottom {
+                scrollToBottom(with: proxy, animated: false)
+            } else {
+                pendingHistoryScrollStrategy = nil
+            }
+
+            lastMessageIDs = newIDs
+        }
+        .onChange(of: manager.state.messages.last?.content) { _, _ in
+            guard hasSettledInitialScroll,
+                  pendingHistoryScrollStrategy == nil,
+                  isNearBottom else { return }
+
+            scrollToBottom(with: proxy, animated: false)
+        }
+        .onChange(of: manager.state.isAgentTyping) { _, _ in
+            guard hasSettledInitialScroll,
+                  pendingHistoryScrollStrategy == nil,
+                  isNearBottom else { return }
+
+            scrollToBottom(with: proxy, animated: false)
+        }
+        .onChange(of: manager.state.isLoadingHistory) { _, isLoading in
+            if !isLoading,
+               pendingHistoryScrollStrategy != nil,
+               messageIDs == lastMessageIDs {
+                pendingHistoryScrollStrategy = nil
+            }
+        }
+    }
+
+    var body: some View {
+        messageList
+#if os(macOS)
+            .safeAreaBar(edge: .top, spacing: 0) {
+                GlassEffectContainer(spacing: 20) {
+                    topBarContent
+                }
+            }
+#else
+            .safeAreaInset(edge: .top) {
+                GlassEffectContainer(spacing: 20) {
+                    topBarContent
+                }
+            }
+#endif
+            .safeAreaBar(edge: .bottom, spacing: 0) {
+                composeBar
+                    .frame(maxWidth: chatContentMaxWidth)
+                    .frame(maxWidth: .infinity)
+            }
+            .background(
+                ZStack {
+                    palette.backgroundBase
+                    RadialGradient(
+                        colors: palette.backgroundGlow,
+                        center: .top,
+                        startRadius: 0,
+                        endRadius: 500
+                    )
+                }
+                .ignoresSafeArea()
+            )
+        .tint(Color.maple500)
+        .onReceive(timestampTimer) { _ in
+            manager.dispatch(.refreshTimestamps)
+        }
+        .sheet(isPresented: Binding(
+            get: { manager.state.showSettings },
+            set: { if !$0 { manager.dispatch(.toggleSettings) } }
+        )) {
+            settingsSheetContent
+        }
+        .alert("Delete Agent?", isPresented: Binding(
+            get: { manager.state.confirmDeleteAgent },
+            set: { if !$0 { manager.dispatch(.cancelDeleteAgent) } }
+        )) {
+            Button("Cancel", role: .cancel) {
+                manager.dispatch(.cancelDeleteAgent)
+            }
+            Button("Delete", role: .destructive) {
+                manager.dispatch(.confirmDeleteAgent)
+            }
+        } message: {
+            Text("This will permanently delete your agent conversation history. This cannot be undone.")
+        }
+    }
+
+    private var messageList: some View {
+        GeometryReader { geometry in
+            ScrollViewReader { proxy in
+                makeMessageList(proxy: proxy, geometry: geometry)
+            }
+        }
+    }
+
+    private var canSend: Bool {
+        !composeText.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty && !manager.state.isAgentTyping
+    }
+
+    @ViewBuilder
+    private var settingsSheetContent: some View {
+        SettingsSheet(manager: manager)
+#if os(macOS)
+            .frame(minWidth: 420, minHeight: 320)
+#else
+            .presentationDetents([.medium])
+#endif
+    }
+
+    private var composeBar: some View {
+        GlassEffectContainer {
+            HStack(alignment: .center, spacing: 8) {
+                VStack(alignment: .leading, spacing: 4) {
+                    TextField(
+                        "",
+                        text: $composeText,
+                        prompt: Text("Write...").foregroundStyle(palette.composePlaceholder),
+                        axis: .vertical
+                    )
+                        .textFieldStyle(.plain)
+                        .font(MapleFont.medium(15))
+                        .foregroundStyle(palette.composeText)
+                        .lineLimit(1...4)
+
+                    Button(action: {}) {
+                        Image(systemName: "plus")
+                            .font(.system(size: 14, weight: .bold))
+                            .foregroundStyle(Color.maple500)
+                            .frame(width: 28, height: 28)
+                    }
+                    .buttonStyle(.plain)
+                }
+
+                Button(action: sendMessage) {
+                    Image(systemName: "arrow.up")
+                        .font(.system(size: 20, weight: .heavy))
+                        .foregroundStyle(.white.opacity(canSend ? 1.0 : 0.1))
+                        .frame(width: 71)
+                        .padding(.vertical, 8)
+                        .background(
+                            LinearGradient(
+                                colors: [
+                                    Color.maple500.opacity(canSend ? 1.0 : 0.5),
+                                    Color.maple700.opacity(canSend ? 1.0 : 0.5),
+                                ],
+                                startPoint: .top,
+                                endPoint: .bottom
+                            ),
+                            in: Capsule()
+                        )
+                }
+                .buttonStyle(.plain)
+                .disabled(!canSend)
+            }
+            .padding(.horizontal, 16)
+            .padding(.top, 12)
+            .padding(.bottom, 14)
+            .glassEffect(in: RoundedRectangle(cornerRadius: MapleRadius.xl, style: .continuous))
+        }
+        .padding(.horizontal, 16)
+        .padding(.bottom, MapleSpacing.xs)
+    }
+
+    private func sendMessage() {
+        let text = composeText.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !text.isEmpty, !manager.state.isAgentTyping else { return }
+        manager.dispatch(.sendMessage(content: text))
+        composeText = ""
+    }
+}
+
+// MARK: - Message Bubble
+
+struct MessageBubble: View {
+    let message: ChatMessage
+    let palette: ChatPalette
+
+    var body: some View {
+        HStack {
+            if message.isUser { Spacer(minLength: 60) }
+
+            VStack(alignment: message.isUser ? .trailing : .leading, spacing: 4) {
+                if message.isUser {
+                    Text(message.content)
+                        .font(MapleFont.medium(16))
+                        .lineSpacing(10)
+                        .foregroundStyle(palette.userText)
+                        .padding(.horizontal, MapleSpacing.sm)
+                        .padding(.vertical, MapleSpacing.xs)
+                        .background(palette.userBubbleColor, in: RoundedRectangle(cornerRadius: MapleRadius.lg, style: .continuous))
+                } else {
+                    Text(message.content)
+                        .font(MapleFont.medium(16))
+                        .lineSpacing(10)
+                        .foregroundStyle(palette.assistantText)
+                }
+
+                if message.showTimestamp {
+                    Text(message.timestampDisplay)
+                        .font(MapleFont.captionSmall)
+                        .foregroundStyle(palette.metadataText)
+                }
+            }
+
+            if !message.isUser { Spacer(minLength: 60) }
+        }
+    }
+}
+
+// MARK: - Settings Sheet
+
+struct SettingsSheet: View {
+    @Environment(\.colorScheme) private var colorScheme
+    let manager: AppManager
+
+    private var palette: ChatPalette {
+        ChatPalette.forColorScheme(colorScheme)
+    }
+
+    var body: some View {
+        NavigationStack {
+            List {
+                Section {
+                    Button {
+                        manager.dispatch(.requestDeleteAgent)
+                    } label: {
+                        HStack {
+                            Image(systemName: "trash")
+                                .foregroundStyle(Color.mapleError)
+                            Text("Delete Agent")
+                                .foregroundStyle(Color.mapleError)
+                        }
+                    }
+                    .disabled(manager.state.isDeletingAgent)
+                } footer: {
+                    Text("Permanently deletes your agent and conversation history.")
+                        .font(MapleFont.captionSmall)
+                }
+
+                Section {
+                    Button {
+                        manager.dispatch(.toggleSettings)
+                        manager.dispatch(.logout)
+                    } label: {
+                        HStack {
+                            Image(systemName: "rectangle.portrait.and.arrow.right")
+                                .foregroundStyle(palette.settingsSecondaryText)
+                            Text("Sign Out")
+                                .foregroundStyle(.primary)
+                        }
+                    }
+                }
+            }
+            .navigationTitle("Settings")
+#if !os(macOS)
+            .navigationBarTitleDisplayMode(.inline)
+#endif
+            .toolbar {
+#if os(macOS)
+                ToolbarItem(placement: .automatic) {
+                    Button("Done") {
+                        manager.dispatch(.toggleSettings)
+                    }
+                    .font(MapleFont.medium(16))
+                }
+#else
+                ToolbarItem(placement: .topBarTrailing) {
+                    Button("Done") {
+                        manager.dispatch(.toggleSettings)
+                    }
+                    .font(MapleFont.medium(16))
+                }
+#endif
+            }
+        }
+    }
+}
diff --git a/native/ios/Sources/Fonts/Array-Bold.ttf b/native/ios/Sources/Fonts/Array-Bold.ttf
new file mode 100644
index 00000000..85af9a9d
Binary files /dev/null and b/native/ios/Sources/Fonts/Array-Bold.ttf differ
diff --git a/native/ios/Sources/Fonts/Manrope-Bold.ttf b/native/ios/Sources/Fonts/Manrope-Bold.ttf
new file mode 100644
index 00000000..62a61839
Binary files /dev/null and b/native/ios/Sources/Fonts/Manrope-Bold.ttf differ
diff --git a/native/ios/Sources/Fonts/Manrope-Medium.ttf b/native/ios/Sources/Fonts/Manrope-Medium.ttf
new file mode 100644
index 00000000..c6d28def
Binary files /dev/null and b/native/ios/Sources/Fonts/Manrope-Medium.ttf differ
diff --git a/native/ios/Sources/Fonts/Manrope-Regular.ttf b/native/ios/Sources/Fonts/Manrope-Regular.ttf
new file mode 100644
index 00000000..9a108f1c
Binary files /dev/null and b/native/ios/Sources/Fonts/Manrope-Regular.ttf differ
diff --git a/native/ios/Sources/Fonts/Manrope-SemiBold.ttf b/native/ios/Sources/Fonts/Manrope-SemiBold.ttf
new file mode 100644
index 00000000..46a13d61
Binary files /dev/null and b/native/ios/Sources/Fonts/Manrope-SemiBold.ttf differ
diff --git a/native/ios/Sources/MapleTheme.swift b/native/ios/Sources/MapleTheme.swift
new file mode 100644
index 00000000..1d8f8355
--- /dev/null
+++ b/native/ios/Sources/MapleTheme.swift
@@ -0,0 +1,215 @@
+import SwiftUI
+
+// MARK: - Color Scales
+
+extension Color {
+    // Maple (Primary) - "Primary brand energy"
+    static let maple50  = Color(hex: 0xFFF4F0)
+    static let maple100 = Color(hex: 0xFFE8E0)
+    static let maple200 = Color(hex: 0xFFD1C1)
+    static let maple300 = Color(hex: 0xFFBAA2)
+    static let maple400 = Color(hex: 0xFFA88A)
+    static let maple500 = Color(hex: 0xFF9771)
+    static let maple600 = Color(hex: 0xF67D57)
+    static let maple700 = Color(hex: 0xE8633D)
+    static let maple800 = Color(hex: 0xD04926)
+    static let maple900 = Color(hex: 0xA83515)
+
+    // Pebble (Secondary) - "Ethereal balance"
+    static let pebble50  = Color(hex: 0xF7F7F9)
+    static let pebble100 = Color(hex: 0xE8E8ED)
+    static let pebble200 = Color(hex: 0xD1D2DC)
+    static let pebble300 = Color(hex: 0xBABCCB)
+    static let pebble400 = Color(hex: 0x9C9DAB)
+    static let pebble500 = Color(hex: 0x8A8B9A)
+    static let pebble600 = Color(hex: 0x757689)
+    static let pebble700 = Color(hex: 0x5E5F6E)
+    static let pebble800 = Color(hex: 0x474854)
+    static let pebble900 = Color(hex: 0x30313A)
+
+    // Bark (Tertiary) - "Grounded structure"
+    static let bark50  = Color(hex: 0xF8F5F4)
+    static let bark100 = Color(hex: 0xEADED9)
+    static let bark200 = Color(hex: 0xD4BCAF)
+    static let bark300 = Color(hex: 0xC29A8D)
+    static let bark400 = Color(hex: 0xB0877C)
+    static let bark500 = Color(hex: 0x9E7469)
+    static let bark600 = Color(hex: 0x8A6055)
+    static let bark700 = Color(hex: 0x704D43)
+    static let bark800 = Color(hex: 0x583A32)
+    static let bark900 = Color(hex: 0x3D2821)
+
+    // Grove (Tertiary) - "Organic calming"
+    static let grove50  = Color(hex: 0xF7F6F0)
+    static let grove100 = Color(hex: 0xE8E4D4)
+    static let grove200 = Color(hex: 0xD3CCB0)
+    static let grove300 = Color(hex: 0xBEB48C)
+    static let grove400 = Color(hex: 0xAEA375)
+    static let grove500 = Color(hex: 0x9E925E)
+    static let grove600 = Color(hex: 0x8A7F4C)
+    static let grove700 = Color(hex: 0x726B3C)
+    static let grove800 = Color(hex: 0x5A542D)
+    static let grove900 = Color(hex: 0x3F3B1F)
+
+    // Neutral - "Focus and clarity"
+    static let neutral0   = Color(hex: 0xFAFAFA)
+    static let neutral50  = Color(hex: 0xF5F5F5)
+    static let neutral100 = Color(hex: 0xE5E5E5)
+    static let neutral200 = Color(hex: 0xD4D4D4)
+    static let neutral300 = Color(hex: 0xA3A3A3)
+    static let neutral400 = Color(hex: 0x737373)
+    static let neutral500 = Color(hex: 0x525252)
+    static let neutral600 = Color(hex: 0x404040)
+    static let neutral700 = Color(hex: 0x262626)
+    static let neutral800 = Color(hex: 0x171717)
+    static let neutral900 = Color(hex: 0x0A0A0A)
+
+    // Semantic States
+    static let mapleSuccess = Color(hex: 0x7B8F4A)
+    static let mapleWarning = Color(hex: 0xD4A35A)
+    static let mapleError   = Color(hex: 0xD05E41)
+    static let mapleInfo    = Color(hex: 0x7E8DA1)
+
+    // Semantic aliases
+    static let maplePrimary          = Color.maple500
+    static let mapleOnPrimary        = Color.white
+    static let maplePrimaryContainer = Color.maple100
+    static let mapleSecondary          = Color.pebble500
+    static let mapleOnSecondary        = Color.white
+    static let mapleSecondaryContainer = Color.pebble100
+    static let mapleTertiary          = Color.bark500
+    static let mapleOnTertiary        = Color.white
+    static let mapleTertiaryContainer = Color.bark100
+
+    init(hex: UInt, opacity: Double = 1.0) {
+        self.init(
+            .sRGB,
+            red: Double((hex >> 16) & 0xFF) / 255,
+            green: Double((hex >> 8) & 0xFF) / 255,
+            blue: Double(hex & 0xFF) / 255,
+            opacity: opacity
+        )
+    }
+}
+
+// MARK: - Typography
+
+enum MapleFont {
+    static func regular(_ size: CGFloat) -> Font { .custom("Manrope-Regular", size: size) }
+    static func medium(_ size: CGFloat) -> Font { .custom("Manrope-Medium", size: size) }
+    static func semiBold(_ size: CGFloat) -> Font { .custom("Manrope-SemiBold", size: size) }
+    static func bold(_ size: CGFloat) -> Font { .custom("Manrope-Bold", size: size) }
+    static func display(_ size: CGFloat) -> Font { .custom("Array-Bold", size: size) }
+
+    static let title = semiBold(22)
+    static let titleMedium = medium(16)
+    static let bodyLarge = regular(16)
+    static let body = regular(14)
+    static let label = medium(14)
+    static let caption = regular(12)
+    static let captionSmall = regular(10)
+}
+
+// MARK: - Spacing
+
+enum MapleSpacing {
+    static let xs:  CGFloat = 8
+    static let sm:  CGFloat = 12
+    static let md:  CGFloat = 20
+    static let lg:  CGFloat = 36
+    static let xl:  CGFloat = 56
+    static let xxl: CGFloat = 88
+}
+
+// MARK: - Border Radius
+
+enum MapleRadius {
+    static let full: CGFloat = 999
+    static let card: CGFloat = 44
+    static let xl:   CGFloat = 24
+    static let lg:   CGFloat = 16
+    static let md:   CGFloat = 12
+    static let sm:   CGFloat = 8
+}
+
+// MARK: - Glassy Button Style
+
+struct MapleButtonStyle: ButtonStyle {
+    enum Size { case small, medium, large }
+    let size: Size
+
+    private var fontSize: CGFloat {
+        switch size {
+        case .small: return 14
+        case .medium: return 16
+        case .large: return 18
+        }
+    }
+
+    private var verticalPadding: CGFloat { 8 }
+    private var horizontalPadding: CGFloat {
+        switch size {
+        case .small, .medium: return 20
+        case .large: return 28
+        }
+    }
+
+    func makeBody(configuration: Configuration) -> some View {
+        configuration.label
+            .font(.custom("Manrope-Medium", size: fontSize))
+            .foregroundStyle(Color.pebble800)
+            .padding(.horizontal, horizontalPadding)
+            .padding(.vertical, verticalPadding)
+            .glassEffect(.regular.interactive())
+            .clipShape(Capsule())
+            .scaleEffect(configuration.isPressed ? 0.95 : 1.0)
+            .animation(.easeOut(duration: 0.2), value: configuration.isPressed)
+    }
+}
+
+// MARK: - Primary Button Style
+
+struct MaplePrimaryButtonStyle: ButtonStyle {
+    @Environment(\.isEnabled) private var isEnabled
+
+    func makeBody(configuration: Configuration) -> some View {
+        configuration.label
+            .font(.custom("Manrope-SemiBold", size: 16))
+            .foregroundStyle(.white)
+            .padding(.horizontal, 24)
+            .padding(.vertical, 12)
+            .frame(maxWidth: .infinity)
+            .background(
+                LinearGradient(
+                    colors: [Color.maple400, Color.maple600],
+                    startPoint: .top,
+                    endPoint: .bottom
+                )
+            )
+            .clipShape(Capsule())
+            .glassEffect()
+            .opacity(isEnabled ? 1.0 : 0.5)
+            .scaleEffect(configuration.isPressed ? 0.95 : 1.0)
+            .animation(.easeOut(duration: 0.2), value: configuration.isPressed)
+    }
+}
+
+// MARK: - Secondary Button Style
+
+struct MapleSecondaryButtonStyle: ButtonStyle {
+    @Environment(\.isEnabled) private var isEnabled
+
+    func makeBody(configuration: Configuration) -> some View {
+        configuration.label
+            .font(.custom("Manrope-Medium", size: 16))
+            .foregroundStyle(Color.pebble700)
+            .padding(.horizontal, 24)
+            .padding(.vertical, 12)
+            .frame(maxWidth: .infinity)
+            .glassEffect(.regular.interactive())
+            .clipShape(Capsule())
+            .opacity(isEnabled ? 1.0 : 0.5)
+            .scaleEffect(configuration.isPressed ? 0.95 : 1.0)
+            .animation(.easeOut(duration: 0.2), value: configuration.isPressed)
+    }
+}
diff --git a/native/ios/Sources/MapleWordmark.swift b/native/ios/Sources/MapleWordmark.swift
new file mode 100644
index 00000000..db25d588
--- /dev/null
+++ b/native/ios/Sources/MapleWordmark.swift
@@ -0,0 +1,110 @@
+import SwiftUI
+
+struct MapleWordmark: View {
+    var color: Color = .pebble50
+    var height: CGFloat = 28
+
+    private let aspectRatio: CGFloat = 248.0 / 48.0
+
+    var body: some View {
+        GeometryReader { _ in
+            Canvas { context, size in
+                let scale = size.height / 48.0
+                let transform = CGAffineTransform(scaleX: scale, y: scale)
+
+                let paths: [CGPath] = [
+                    {
+                        let p = CGMutablePath()
+                        p.move(to: CGPoint(x: 0, y: 41.2408))
+                        p.addLine(to: CGPoint(x: 0, y: 6.06562))
+                        p.addCurve(to: CGPoint(x: 10.1942, y: 1.4443), control1: CGPoint(x: 0, y: 0.652098), control2: CGPoint(x: 5.77774, y: -1.72459))
+                        p.addLine(to: CGPoint(x: 26.9158, y: 15.561))
+                        p.addLine(to: CGPoint(x: 43.6375, y: 1.4443))
+                        p.addCurve(to: CGPoint(x: 53.8317, y: 6.06562), control1: CGPoint(x: 48.0567, y: -1.72459), control2: CGPoint(x: 53.8317, y: 0.652098))
+                        p.addLine(to: CGPoint(x: 53.8317, y: 41.2408))
+                        p.addCurve(to: CGPoint(x: 47.0534, y: 47.9972), control1: CGPoint(x: 53.8317, y: 44.9716), control2: CGPoint(x: 50.7962, y: 47.9972))
+                        p.addLine(to: CGPoint(x: 6.17796, y: 47.9972))
+                        p.addCurve(to: CGPoint(x: 0, y: 41.2408), control1: CGPoint(x: 2.16172, y: 47.9972), control2: CGPoint(x: 0, y: 45.6318))
+                        p.closeSubpath()
+                        return p
+                    }(),
+                    {
+                        let p = CGMutablePath()
+                        p.move(to: CGPoint(x: 58.7892, y: 39.8362))
+                        p.addLine(to: CGPoint(x: 79.685, y: 3.36589))
+                        p.addCurve(to: CGPoint(x: 89.1435, y: 3.36589), control1: CGPoint(x: 82.2553, y: -1.11494), control2: CGPoint(x: 86.5647, y: -1.12899))
+                        p.addLine(to: CGPoint(x: 110.031, y: 39.8362))
+                        p.addCurve(to: CGPoint(x: 105.555, y: 48), control1: CGPoint(x: 112.77, y: 44.6148), control2: CGPoint(x: 111.082, y: 48))
+                        p.addLine(to: CGPoint(x: 63.2649, y: 48))
+                        p.addCurve(to: CGPoint(x: 58.7892, y: 39.8362), control1: CGPoint(x: 57.7408, y: 48), control2: CGPoint(x: 56.0526, y: 44.6204))
+                        p.closeSubpath()
+                        return p
+                    }(),
+                    {
+                        let p = CGMutablePath()
+                        p.move(to: CGPoint(x: 137.257, y: 39.4064))
+                        p.addLine(to: CGPoint(x: 137.257, y: 41.2408))
+                        p.addCurve(to: CGPoint(x: 130.478, y: 47.9972), control1: CGPoint(x: 137.257, y: 44.9716), control2: CGPoint(x: 134.221, y: 47.9972))
+                        p.addLine(to: CGPoint(x: 121.49, y: 47.9972))
+                        p.addCurve(to: CGPoint(x: 114.712, y: 41.2408), control1: CGPoint(x: 117.745, y: 47.9972), control2: CGPoint(x: 114.712, y: 44.9716))
+                        p.addLine(to: CGPoint(x: 114.712, y: 7.56014))
+                        p.addCurve(to: CGPoint(x: 121.493, y: 0.800986), control1: CGPoint(x: 114.712, y: 3.82658), control2: CGPoint(x: 117.748, y: 0.800986))
+                        p.addLine(to: CGPoint(x: 136.831, y: 0.800986))
+                        p.addCurve(to: CGPoint(x: 160.965, y: 20.1318), control1: CGPoint(x: 154.652, y: 0.800986), control2: CGPoint(x: 160.965, y: 8.65577))
+                        p.addCurve(to: CGPoint(x: 137.259, y: 39.4064), control1: CGPoint(x: 160.965, y: 31.6077), control2: CGPoint(x: 154.753, y: 39.2827))
+                        p.addLine(to: CGPoint(x: 137.257, y: 39.4064))
+                        p.closeSubpath()
+                        return p
+                    }(),
+                    {
+                        let p = CGMutablePath()
+                        p.move(to: CGPoint(x: 164.191, y: 41.2408))
+                        p.addLine(to: CGPoint(x: 164.191, y: 7.56014))
+                        p.addCurve(to: CGPoint(x: 170.972, y: 0.800986), control1: CGPoint(x: 164.191, y: 3.82658), control2: CGPoint(x: 167.227, y: 0.800986))
+                        p.addLine(to: CGPoint(x: 179.96, y: 0.800986))
+                        p.addCurve(to: CGPoint(x: 186.739, y: 7.55733), control1: CGPoint(x: 183.706, y: 0.800986), control2: CGPoint(x: 186.739, y: 3.82658))
+                        p.addLine(to: CGPoint(x: 186.739, y: 16.5331))
+                        p.addLine(to: CGPoint(x: 195.743, y: 16.5331))
+                        p.addCurve(to: CGPoint(x: 202.522, y: 23.2894), control1: CGPoint(x: 199.489, y: 16.5331), control2: CGPoint(x: 202.522, y: 19.5587))
+                        p.addLine(to: CGPoint(x: 202.522, y: 41.238))
+                        p.addCurve(to: CGPoint(x: 195.743, y: 47.9944), control1: CGPoint(x: 202.522, y: 44.9688), control2: CGPoint(x: 199.486, y: 47.9944))
+                        p.addLine(to: CGPoint(x: 170.972, y: 47.9944))
+                        p.addCurve(to: CGPoint(x: 164.194, y: 41.238), control1: CGPoint(x: 167.227, y: 47.9944), control2: CGPoint(x: 164.194, y: 44.9688))
+                        p.addLine(to: CGPoint(x: 164.191, y: 41.2408))
+                        p.closeSubpath()
+                        return p
+                    }(),
+                    {
+                        let p = CGMutablePath()
+                        p.move(to: CGPoint(x: 240.304, y: 16.5331))
+                        p.addLine(to: CGPoint(x: 230.6, y: 16.5331))
+                        p.addCurve(to: CGPoint(x: 236.386, y: 24.1884), control1: CGPoint(x: 233.943, y: 17.4854), control2: CGPoint(x: 236.386, y: 20.5532))
+                        p.addCurve(to: CGPoint(x: 230.05, y: 31.9842), control1: CGPoint(x: 236.386, y: 28.0259), control2: CGPoint(x: 233.669, y: 31.2257))
+                        p.addLine(to: CGPoint(x: 240.321, y: 31.9842))
+                        p.addCurve(to: CGPoint(x: 247.082, y: 38.7237), control1: CGPoint(x: 244.712, y: 31.9842), control2: CGPoint(x: 247.082, y: 34.3412))
+                        p.addLine(to: CGPoint(x: 247.082, y: 41.2549))
+                        p.addCurve(to: CGPoint(x: 240.315, y: 47.9972), control1: CGPoint(x: 247.082, y: 45.6346), control2: CGPoint(x: 244.712, y: 47.9972))
+                        p.addLine(to: CGPoint(x: 212.982, y: 47.9972))
+                        p.addCurve(to: CGPoint(x: 206.215, y: 41.2549), control1: CGPoint(x: 208.582, y: 47.9972), control2: CGPoint(x: 206.215, y: 45.6346))
+                        p.addLine(to: CGPoint(x: 206.215, y: 7.5433))
+                        p.addCurve(to: CGPoint(x: 212.982, y: 0.800986), control1: CGPoint(x: 206.215, y: 3.1608), control2: CGPoint(x: 208.582, y: 0.800986))
+                        p.addLine(to: CGPoint(x: 240.315, y: 0.800986))
+                        p.addCurve(to: CGPoint(x: 247.082, y: 7.5433), control1: CGPoint(x: 244.712, y: 0.800986), control2: CGPoint(x: 247.082, y: 3.1608))
+                        p.addLine(to: CGPoint(x: 247.082, y: 9.77668))
+                        p.addCurve(to: CGPoint(x: 240.306, y: 16.5302), control1: CGPoint(x: 247.082, y: 13.5074), control2: CGPoint(x: 244.047, y: 16.5302))
+                        p.addLine(to: CGPoint(x: 240.304, y: 16.5331))
+                        p.closeSubpath()
+                        return p
+                    }(),
+                ]
+
+                for cgPath in paths {
+                    let transformed = cgPath.copy(using: [transform])!
+                    let path = Path(transformed)
+                    context.fill(path, with: .color(color))
+                }
+            }
+        }
+        .frame(width: height * aspectRatio, height: height)
+    }
+}
diff --git a/native/ios/Sources/MapleWordmarkAbbr.swift b/native/ios/Sources/MapleWordmarkAbbr.swift
new file mode 100644
index 00000000..1020674a
--- /dev/null
+++ b/native/ios/Sources/MapleWordmarkAbbr.swift
@@ -0,0 +1,79 @@
+import SwiftUI
+
+struct MapleWordmarkAbbr: View {
+    var color: Color = .pebble50
+    var height: CGFloat = 20
+
+    private let aspectRatio: CGFloat = 100.0 / 32.0
+
+    var body: some View {
+        GeometryReader { _ in
+            Canvas { context, size in
+                let scale = size.height / 32.0
+                let transform = CGAffineTransform(scaleX: scale, y: scale)
+
+                let paths: [CGPath] = [
+                    // M
+                    {
+                        let p = CGMutablePath()
+                        p.move(to: CGPoint(x: 0, y: 27.4798))
+                        p.addLine(to: CGPoint(x: 0, y: 4.02964))
+                        p.addCurve(to: CGPoint(x: 6.79613, y: 0.948761), control1: CGPoint(x: 0, y: 0.420626), control2: CGPoint(x: 3.85183, y: -1.16383))
+                        p.addLine(to: CGPoint(x: 17.9439, y: 10.3599))
+                        p.addLine(to: CGPoint(x: 29.0916, y: 0.948761))
+                        p.addCurve(to: CGPoint(x: 35.8878, y: 4.02964), control1: CGPoint(x: 32.0378, y: -1.16383), control2: CGPoint(x: 35.8878, y: 0.420626))
+                        p.addLine(to: CGPoint(x: 35.8878, y: 27.4798))
+                        p.addCurve(to: CGPoint(x: 31.3689, y: 31.984), control1: CGPoint(x: 35.8878, y: 29.967), control2: CGPoint(x: 33.8642, y: 31.984))
+                        p.addLine(to: CGPoint(x: 4.11864, y: 31.984))
+                        p.addCurve(to: CGPoint(x: 0, y: 27.4798), control1: CGPoint(x: 1.44115, y: 31.984), control2: CGPoint(x: 0, y: 30.4071))
+                        p.closeSubpath()
+                        return p
+                    }(),
+                    // P
+                    {
+                        let p = CGMutablePath()
+                        p.move(to: CGPoint(x: 55.3789, y: 26.0034))
+                        p.addLine(to: CGPoint(x: 55.3789, y: 27.2264))
+                        p.addCurve(to: CGPoint(x: 50.8601, y: 31.7306), control1: CGPoint(x: 55.3789, y: 29.7135), control2: CGPoint(x: 53.3553, y: 31.7306))
+                        p.addLine(to: CGPoint(x: 44.8681, y: 31.7306))
+                        p.addCurve(to: CGPoint(x: 40.3493, y: 27.2264), control1: CGPoint(x: 42.371, y: 31.7306), control2: CGPoint(x: 40.3493, y: 29.7135))
+                        p.addLine(to: CGPoint(x: 40.3493, y: 4.77258))
+                        p.addCurve(to: CGPoint(x: 44.87, y: 0.266478), control1: CGPoint(x: 40.3493, y: 2.28354), control2: CGPoint(x: 42.3729, y: 0.266478))
+                        p.addLine(to: CGPoint(x: 55.0952, y: 0.266478))
+                        p.addCurve(to: CGPoint(x: 71.1846, y: 13.1537), control1: CGPoint(x: 66.9758, y: 0.266478), control2: CGPoint(x: 71.1846, y: 5.503))
+                        p.addCurve(to: CGPoint(x: 55.3808, y: 26.0034), control1: CGPoint(x: 71.1846, y: 20.8043), control2: CGPoint(x: 67.0434, y: 25.921))
+                        p.addLine(to: CGPoint(x: 55.3789, y: 26.0034))
+                        p.closeSubpath()
+                        return p
+                    }(),
+                    // L
+                    {
+                        let p = CGMutablePath()
+                        p.move(to: CGPoint(x: 74.3353, y: 27.2264))
+                        p.addLine(to: CGPoint(x: 74.3353, y: 4.77258))
+                        p.addCurve(to: CGPoint(x: 78.8561, y: 0.266478), control1: CGPoint(x: 74.3353, y: 2.28354), control2: CGPoint(x: 76.3589, y: 0.266478))
+                        p.addLine(to: CGPoint(x: 84.848, y: 0.266478))
+                        p.addCurve(to: CGPoint(x: 89.3669, y: 4.77071), control1: CGPoint(x: 87.3451, y: 0.266478), control2: CGPoint(x: 89.3669, y: 2.28354))
+                        p.addLine(to: CGPoint(x: 89.3669, y: 10.7545))
+                        p.addLine(to: CGPoint(x: 95.3701, y: 10.7545))
+                        p.addCurve(to: CGPoint(x: 99.8889, y: 15.2588), control1: CGPoint(x: 97.8672, y: 10.7545), control2: CGPoint(x: 99.8889, y: 12.7716))
+                        p.addLine(to: CGPoint(x: 99.8889, y: 27.2245))
+                        p.addCurve(to: CGPoint(x: 95.3701, y: 31.7288), control1: CGPoint(x: 99.8889, y: 29.7117), control2: CGPoint(x: 97.8653, y: 31.7288))
+                        p.addLine(to: CGPoint(x: 78.8561, y: 31.7288))
+                        p.addCurve(to: CGPoint(x: 74.3372, y: 27.2245), control1: CGPoint(x: 76.3589, y: 31.7288), control2: CGPoint(x: 74.3372, y: 29.7117))
+                        p.addLine(to: CGPoint(x: 74.3353, y: 27.2264))
+                        p.closeSubpath()
+                        return p
+                    }(),
+                ]
+
+                for cgPath in paths {
+                    let transformed = cgPath.copy(using: [transform])!
+                    let path = Path(transformed)
+                    context.fill(path, with: .color(color))
+                }
+            }
+        }
+        .frame(width: height * aspectRatio, height: height)
+    }
+}
diff --git a/native/ios/Sources/maple-wordmark.svg b/native/ios/Sources/maple-wordmark.svg
new file mode 100644
index 00000000..1e896501
--- /dev/null
+++ b/native/ios/Sources/maple-wordmark.svg
@@ -0,0 +1,7 @@
+<svg width="248" height="48" viewBox="0 0 248 48" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M0 41.2408V6.06562C0 0.652098 5.77774 -1.72459 10.1942 1.4443L26.9158 15.561L43.6375 1.4443C48.0567 -1.72459 53.8317 0.652098 53.8317 6.06562V41.2408C53.8317 44.9716 50.7962 47.9972 47.0534 47.9972H6.17796C2.16172 47.9972 0 45.6318 0 41.2408Z" fill="#F7F7F9"/>
+<path d="M58.7892 39.8362L79.685 3.36589C82.2553 -1.11494 86.5647 -1.12899 89.1435 3.36589L110.031 39.8362C112.77 44.6148 111.082 48 105.555 48H63.2649C57.7408 48 56.0526 44.6204 58.7892 39.8362Z" fill="#F7F7F9"/>
+<path d="M137.257 39.4064V41.2408C137.257 44.9716 134.221 47.9972 130.478 47.9972H121.49C117.745 47.9972 114.712 44.9716 114.712 41.2408V7.56014C114.712 3.82658 117.748 0.800986 121.493 0.800986H136.831C154.652 0.800986 160.965 8.65577 160.965 20.1318C160.965 31.6077 154.753 39.2827 137.259 39.4064H137.257Z" fill="#F7F7F9"/>
+<path d="M164.191 41.2408V7.56014C164.191 3.82658 167.227 0.800986 170.972 0.800986H179.96C183.706 0.800986 186.739 3.82658 186.739 7.55733V16.5331H195.743C199.489 16.5331 202.522 19.5587 202.522 23.2894V41.238C202.522 44.9688 199.486 47.9944 195.743 47.9944H170.972C167.227 47.9944 164.194 44.9688 164.194 41.238L164.191 41.2408Z" fill="#F7F7F9"/>
+<path d="M240.304 16.5331H230.6C233.943 17.4854 236.386 20.5532 236.386 24.1884C236.386 28.0259 233.669 31.2257 230.05 31.9842H240.321C244.712 31.9842 247.082 34.3412 247.082 38.7237V41.2549C247.082 45.6346 244.712 47.9972 240.315 47.9972H212.982C208.582 47.9972 206.215 45.6346 206.215 41.2549V7.5433C206.215 3.1608 208.582 0.800986 212.982 0.800986H240.315C244.712 0.800986 247.082 3.1608 247.082 7.5433V9.77668C247.082 13.5074 244.047 16.5302 240.306 16.5302L240.304 16.5331Z" fill="#F7F7F9"/>
+</svg>
diff --git a/native/ios/project.yml b/native/ios/project.yml
new file mode 100644
index 00000000..df4c2c7c
--- /dev/null
+++ b/native/ios/project.yml
@@ -0,0 +1,80 @@
+name: App
+options:
+  bundleIdPrefix: cloud.opensecret.maple
+  deploymentTarget:
+    iOS: "26.0"
+    macOS: "26.0"
+  createIntermediateGroups: true
+
+settings:
+  base:
+    PRODUCT_BUNDLE_IDENTIFIER: cloud.opensecret.maple
+    MARKETING_VERSION: 3.0.0
+    CURRENT_PROJECT_VERSION: 1
+    SWIFT_VERSION: 5.0
+    DEVELOPMENT_TEAM: X773Y823TN
+  configs:
+    Debug:
+      PRODUCT_BUNDLE_IDENTIFIER: cloud.opensecret.maple.dev
+
+targets:
+  App:
+    type: application
+    platform: iOS
+    sources:
+      - path: Sources
+      - path: Bindings
+        excludes:
+          - "*.h"
+          - "*.modulemap"
+    settings:
+      base:
+        PRODUCT_NAME: Maple
+        INFOPLIST_FILE: Info.plist
+        ASSETCATALOG_COMPILER_APPICON_NAME: AppIcon
+        CODE_SIGN_ENTITLEMENTS: App.entitlements
+        CODE_SIGN_STYLE: Automatic
+        CODE_SIGN_IDENTITY: Apple Development
+        PROVISIONING_PROFILE_SPECIFIER: ""
+    dependencies:
+      - framework: Frameworks/MapleCore.xcframework
+        embed: false
+      - sdk: SystemConfiguration.framework
+      - sdk: Security.framework
+
+  AppMac:
+    type: application
+    platform: macOS
+    sources:
+      - path: Sources
+      - path: Bindings
+        excludes:
+          - "*.h"
+          - "*.modulemap"
+    settings:
+      base:
+        PRODUCT_NAME: Maple
+        PRODUCT_BUNDLE_IDENTIFIER: cloud.opensecret.maple.desktop
+        INFOPLIST_FILE: Info-macOS.plist
+        ASSETCATALOG_COMPILER_APPICON_NAME: AppIcon
+        CODE_SIGN_STYLE: Automatic
+        CODE_SIGN_IDENTITY: Apple Development
+        PROVISIONING_PROFILE_SPECIFIER: ""
+      configs:
+        Debug:
+          PRODUCT_BUNDLE_IDENTIFIER: cloud.opensecret.maple.desktop.dev
+    dependencies:
+      - framework: Frameworks/MapleCore.xcframework
+        embed: false
+      - sdk: SystemConfiguration.framework
+      - sdk: Security.framework
+
+schemes:
+  App:
+    build:
+      targets:
+        App: all
+  AppMac:
+    build:
+      targets:
+        AppMac: all
diff --git a/native/justfile b/native/justfile
new file mode 100644
index 00000000..22fca629
--- /dev/null
+++ b/native/justfile
@@ -0,0 +1,173 @@
+set shell := ["bash", "-c"]
+
+# ┌─────────────────────────────────────────────────────────────────────┐
+# │  Maple justfile                                                     │
+# │                                                                     │
+# │  From macOS:     just <recipe>                                      │
+# │  From OrbStack:  mac just -f /Users/tony/Dev/OpenSecret/maple/native/justfile <recipe> │
+# └─────────────────────────────────────────────────────────────────────┘
+
+default:
+  @just --list
+
+# ── Helpers ──────────────────────────────────────────────────────────────────
+
+nix_run := 'nix develop "{{justfile_directory()}}" --command bash -c'
+
+# ── Diagnostics ──────────────────────────────────────────────────────────────
+
+# run rmp doctor
+doctor:
+  if command -v nix >/dev/null 2>&1; then \
+    nix develop "{{justfile_directory()}}" --command bash -c "if command -v rmp >/dev/null 2>&1; then rmp doctor; else cargo run --manifest-path rmp-cli/Cargo.toml -- doctor; fi"; \
+  else \
+    if command -v rmp >/dev/null 2>&1; then rmp doctor; else cargo run --manifest-path rmp-cli/Cargo.toml -- doctor; fi; \
+  fi
+
+# ── FFI Bindings ─────────────────────────────────────────────────────────────
+
+# regenerate Swift FFI bindings (api_env: local|dev|prod)
+bindings-swift api_env="local":
+  if command -v nix >/dev/null 2>&1; then \
+    nix develop "{{justfile_directory()}}" --command bash -c "unset CC CXX AR RANLIB && if command -v rmp >/dev/null 2>&1; then rmp bindings swift; else cargo run --manifest-path rmp-cli/Cargo.toml -- bindings swift; fi"; \
+  else \
+    unset CC CXX AR RANLIB && if command -v rmp >/dev/null 2>&1; then rmp bindings swift; else cargo run --manifest-path rmp-cli/Cargo.toml -- bindings swift; fi; \
+  fi
+
+# regenerate Kotlin FFI bindings (api_env: local|dev|prod)
+bindings-kotlin api_env="local":
+  if command -v nix >/dev/null 2>&1; then \
+    nix develop "{{justfile_directory()}}" --command bash -c "unset CC CXX AR RANLIB && if command -v rmp >/dev/null 2>&1; then rmp bindings kotlin; else cargo run --manifest-path rmp-cli/Cargo.toml -- bindings kotlin; fi"; \
+  else \
+    unset CC CXX AR RANLIB && if command -v rmp >/dev/null 2>&1; then rmp bindings kotlin; else cargo run --manifest-path rmp-cli/Cargo.toml -- bindings kotlin; fi; \
+  fi
+
+# regenerate all FFI bindings (api_env: local|dev|prod)
+bindings api_env="local":
+  if command -v nix >/dev/null 2>&1; then \
+    nix develop "{{justfile_directory()}}" --command bash -c "unset CC CXX AR RANLIB && if command -v rmp >/dev/null 2>&1; then rmp bindings all; else cargo run --manifest-path rmp-cli/Cargo.toml -- bindings all; fi"; \
+  else \
+    unset CC CXX AR RANLIB && if command -v rmp >/dev/null 2>&1; then rmp bindings all; else cargo run --manifest-path rmp-cli/Cargo.toml -- bindings all; fi; \
+  fi
+
+# ── Desktop (SwiftUI on macOS, GTK4 on Linux) ───────────────────────────────
+
+# build macOS desktop app only (configuration: Debug|Release, api_env: local|dev|prod)
+build-macos api_env="local" configuration="Debug":
+  if [ "$(uname -s)" != "Darwin" ]; then \
+    echo "build-macos is only supported on macOS" >&2; \
+    exit 1; \
+  fi; \
+  api_env="{{api_env}}"; while [[ "$api_env" == api_env=* ]]; do api_env="${api_env#api_env=}"; done; \
+  configuration="{{configuration}}"; while [[ "$configuration" == configuration=* ]]; do configuration="${configuration#configuration=}"; done; \
+  api_url="http://0.0.0.0:3000"; \
+  if [ "$api_env" = "dev" ]; then api_url="https://enclave.secretgpt.ai"; elif [ "$api_env" = "prod" ]; then api_url="https://enclave.trymaple.ai"; fi; \
+  build_root="{{justfile_directory()}}/ios/.build/AppMac"; \
+  rm -rf "$build_root"; \
+  cargo run --manifest-path "{{justfile_directory()}}/rmp-cli/Cargo.toml" -- bindings swift; \
+  (cd "{{justfile_directory()}}/ios" && xcodegen generate); \
+  env -u NIX_LDFLAGS -u LD -u CC -u CXX -u AR -u RANLIB \
+    xcrun xcodebuild \
+      -project "{{justfile_directory()}}/ios/App.xcodeproj" \
+      -scheme AppMac \
+      -configuration "$configuration" \
+      -derivedDataPath "$build_root" \
+      -destination generic/platform=macOS \
+      OPEN_SECRET_API_URL="$api_url" \
+      COMPILER_INDEX_STORE_ENABLE=NO \
+      clean build
+
+# run macOS desktop app (api_env: local|dev|prod)
+run-macos api_env="local":
+  just build-macos api_env="{{api_env}}" configuration=Debug; \
+  open "{{justfile_directory()}}/ios/.build/AppMac/Build/Products/Debug/Maple.app"
+
+# build desktop app for the current host platform (api_env: local|dev|prod)
+build-desktop api_env="local":
+  api_env="{{api_env}}"; while [[ "$api_env" == api_env=* ]]; do api_env="${api_env#api_env=}"; done; \
+  api_url="http://0.0.0.0:3000"; \
+  if [ "$api_env" = "dev" ]; then api_url="https://enclave.secretgpt.ai"; elif [ "$api_env" = "prod" ]; then api_url="https://enclave.trymaple.ai"; fi; \
+  if [ "$(uname -s)" = "Darwin" ]; then \
+    just build-macos api_env="$api_env" configuration=Debug; \
+  elif command -v nix >/dev/null 2>&1 && [ "$(uname -s)" = "Linux" ]; then \
+    OPEN_SECRET_API_URL="$api_url" nix develop --no-write-lock-file "{{justfile_directory()}}" --command bash -c "cargo build -p maple_desktop_gtk"; \
+  else \
+    OPEN_SECRET_API_URL="$api_url" cargo build -p maple_desktop_gtk; \
+  fi
+
+# build relocatable Linux desktop bundle (profile: debug|release, api_env: local|dev|prod)
+bundle-desktop profile="debug" api_env="local":
+  if [ "$(uname -s)" != "Linux" ]; then \
+    echo "bundle-desktop is only supported on Linux" >&2; \
+    exit 1; \
+  fi; \
+  profile="{{profile}}"; while [[ "$profile" == profile=* ]]; do profile="${profile#profile=}"; done; \
+  api_env="{{api_env}}"; while [[ "$api_env" == api_env=* ]]; do api_env="${api_env#api_env=}"; done; \
+  api_url="http://0.0.0.0:3000"; \
+  cargo_args=""; \
+  binary_path="target/debug/maple_desktop_gtk"; \
+  bundle_path="target/maple-bundle-$(uname -m)"; \
+  if [ "$profile" = "release" ]; then cargo_args="--release"; binary_path="target/release/maple_desktop_gtk"; fi; \
+  if [ "$api_env" = "dev" ]; then api_url="https://enclave.secretgpt.ai"; elif [ "$api_env" = "prod" ]; then api_url="https://enclave.trymaple.ai"; fi; \
+  OPEN_SECRET_API_URL="$api_url" nix develop --no-write-lock-file "{{justfile_directory()}}" --command bash -c "set -euo pipefail; cd '{{justfile_directory()}}'; cargo build -p maple_desktop_gtk $cargo_args; ./scripts/bundle-gtk-linux.sh '$binary_path' '$bundle_path'"
+
+# build and run desktop app for the current host platform (api_env: local|dev|prod)
+run-desktop api_env="local":
+  api_env="{{api_env}}"; while [[ "$api_env" == api_env=* ]]; do api_env="${api_env#api_env=}"; done; \
+  api_url="http://0.0.0.0:3000"; \
+  if [ "$api_env" = "dev" ]; then api_url="https://enclave.secretgpt.ai"; elif [ "$api_env" = "prod" ]; then api_url="https://enclave.trymaple.ai"; fi; \
+  if [ "$(uname -s)" = "Darwin" ]; then \
+    just run-macos api_env="$api_env"; \
+  elif command -v nix >/dev/null 2>&1 && [ "$(uname -s)" = "Linux" ]; then \
+    OPEN_SECRET_API_URL="$api_url" nix develop --no-write-lock-file "{{justfile_directory()}}" --command bash -c "cargo run -p maple_desktop_gtk"; \
+  else \
+    OPEN_SECRET_API_URL="$api_url" cargo run -p maple_desktop_gtk; \
+  fi
+
+# ── iOS ──────────────────────────────────────────────────────────────────────
+
+# build and launch iOS on simulator (api_env: local|dev|prod)
+run-ios api_env="local":
+  api_env="{{api_env}}"; while [[ "$api_env" == api_env=* ]]; do api_env="${api_env#api_env=}"; done; \
+  api_url="http://0.0.0.0:3000"; \
+  if [ "$api_env" = "dev" ]; then api_url="https://enclave.secretgpt.ai"; elif [ "$api_env" = "prod" ]; then api_url="https://enclave.trymaple.ai"; fi; \
+  if command -v nix >/dev/null 2>&1; then \
+    OPEN_SECRET_API_URL="$api_url" nix develop "{{justfile_directory()}}" --command bash -c "unset CC CXX AR RANLIB && if command -v rmp >/dev/null 2>&1; then rmp run ios; else cargo run --manifest-path rmp-cli/Cargo.toml -- run ios; fi"; \
+  else \
+    unset CC CXX AR RANLIB && export OPEN_SECRET_API_URL="$api_url" && if command -v rmp >/dev/null 2>&1; then rmp run ios; else cargo run --manifest-path rmp-cli/Cargo.toml -- run ios; fi; \
+  fi
+
+# ── Android ──────────────────────────────────────────────────────────────────
+
+# build and launch Android on emulator (api_env: local|dev|prod, pass serial=<id> to override)
+run-android serial="emulator-5554" api_env="local":
+  api_env="{{api_env}}"; while [[ "$api_env" == api_env=* ]]; do api_env="${api_env#api_env=}"; done; \
+  api_url="http://0.0.0.0:3000"; \
+  if [ "$api_env" = "dev" ]; then api_url="https://enclave.secretgpt.ai"; elif [ "$api_env" = "prod" ]; then api_url="https://enclave.trymaple.ai"; fi; \
+  if command -v nix >/dev/null 2>&1; then \
+    OPEN_SECRET_API_URL="$api_url" nix develop "{{justfile_directory()}}" --command bash -c "unset CC CXX AR RANLIB && export PATH=\$HOME/.cargo/bin:\$PATH && if command -v rmp >/dev/null 2>&1; then rmp run android --serial {{serial}}; else cargo run --manifest-path rmp-cli/Cargo.toml -- run android --serial {{serial}}; fi"; \
+  else \
+    unset CC CXX AR RANLIB && export PATH=\$HOME/.cargo/bin:\$PATH && export OPEN_SECRET_API_URL="$api_url" && if command -v rmp >/dev/null 2>&1; then rmp run android --serial {{serial}}; else cargo run --manifest-path rmp-cli/Cargo.toml -- run android --serial {{serial}}; fi; \
+  fi
+
+# build Android APK only (api_env: local|dev|prod)
+build-android api_env="local":
+  api_env="{{api_env}}"; while [[ "$api_env" == api_env=* ]]; do api_env="${api_env#api_env=}"; done; \
+  api_url="http://0.0.0.0:3000"; \
+  if [ "$api_env" = "dev" ]; then api_url="https://enclave.secretgpt.ai"; elif [ "$api_env" = "prod" ]; then api_url="https://enclave.trymaple.ai"; fi; \
+  cd android && OPEN_SECRET_API_URL="$api_url" ./gradlew assembleDebug
+
+# ── Convenience ──────────────────────────────────────────────────────────────
+
+# build all platforms (no launch)
+build-all api_env="local":
+  just build-desktop "{{api_env}}"
+  just build-android "{{api_env}}"
+  @echo "Desktop and Android built. iOS is build+run only via rmp."
+
+# rebuild FFI bindings, then launch all platforms
+run-all serial="emulator-5554" api_env="local":
+  just bindings "{{api_env}}"
+  just run-ios "{{api_env}}"
+  just run-android serial={{serial}} "{{api_env}}"
+  just run-desktop "{{api_env}}"
diff --git a/native/rmp-architecture-bible.md b/native/rmp-architecture-bible.md
new file mode 100644
index 00000000..aa092c21
--- /dev/null
+++ b/native/rmp-architecture-bible.md
@@ -0,0 +1,2536 @@
+---
+summary: Comprehensive guide for building Rust Multi-Platform apps — philosophy, architecture, FFI, platform layers, build system, patterns, and scaffolding
+read_when:
+  - starting a new RMP project from scratch
+  - deciding whether code belongs in Rust or native (iOS/Android/Desktop)
+  - understanding the unidirectional data flow and actor model patterns
+  - adding a new feature, screen, or platform capability bridge
+  - onboarding to the Pika codebase or any RMP codebase
+---
+
+# RMP Architecture Bible
+
+> A comprehensive guide for building Rust Multi-Platform applications targeting iOS, Android, and Desktop (Linux/macOS/Windows) with maximally shared Rust components and thin native UI layers.
+
+## Intent
+
+This document exists so that **any developer with an idea for any application** can build it using the RMP paradigm and have it target iOS/Android/Desktop with as much shared Rust as possible. The only platform-specific work should be the light native UI layer (SwiftUI, Jetpack Compose, iced, etc.) and bounded platform capability bridges.
+
+The RMP model is a sustainable and correct way to build multi-platform apps, especially given that many SDKs and core libraries already exist in Rust. Rather than writing business logic three times (or using a lowest-common-denominator cross-platform framework), RMP puts Rust at the center and lets each platform do what it does best: render native UI.
+
+**Reference implementation:** The Pika messaging app (`sledtools/pika`) is used throughout this document as the primary example. Pika is a real, battle-tested app -- but it is also alpha software that does not perfectly follow its own philosophy everywhere. Where Pika drifts from the ideal, this bible calls it out. **This document is the stricter standard.**
+
+---
+
+## Table of Contents
+
+- [Part I: Philosophy and Core Principles](#part-i-philosophy-and-core-principles)
+- [Part II: The Rust Core](#part-ii-the-rust-core)
+- [Part III: The FFI Boundary (UniFFI)](#part-iii-the-ffi-boundary-uniffi)
+- [Part IV: Platform Layers](#part-iv-platform-layers)
+- [Part V: Build System and Cross-Compilation](#part-v-build-system-and-cross-compilation)
+- [Part VI: Patterns and Recipes](#part-vi-patterns-and-recipes)
+- [Part VII: Testing Strategy](#part-vii-testing-strategy)
+- [Part VIII: From Zero to Running App](#part-viii-from-zero-to-running-app)
+- [Part IX: Migration and Refactoring](#part-ix-migration-and-refactoring)
+- [Appendix: Research Scratchpad](#appendix-research-scratchpad)
+
+---
+
+## Part I: Philosophy and Core Principles
+
+### 1.1 The UX Invariant
+
+RMP must never produce a second-class experience compared to a true native app. "Cross-platform purity" does not override user experience quality. If a Rust-first implementation would result in a worse user experience than a native one, the native approach wins -- but only for the rendering and OS-integration surface, never for business logic.
+
+What this means in practice:
+
+- **Navigation must feel native.** iOS users expect swipe-back gestures and `NavigationStack` transitions. Android users expect predictive back and Material motion. A todo app should use `NavigationStack` on iOS and `AnimatedContent` on Android -- not a shared cross-platform navigation abstraction that feels wrong on both.
+- **System integration must be seamless.** A fitness tracker's background GPS tracking must use `CLLocationManager` on iOS and `FusedLocationProviderClient` on Android. A photo editor must use the platform's native file picker. These are not things you approximate.
+- **Accessibility must be platform-native.** VoiceOver semantics on iOS and TalkBack semantics on Android differ. The native UI layer handles this; Rust provides the data.
+- **Performance must meet platform expectations.** 60fps scrolling, instant touch response, smooth transitions. The Rust core must not block the UI thread, ever.
+
+The invariant is simple: if a user cannot tell that Rust is involved, the architecture is working correctly.
+
+### 1.2 What Rust Owns vs. What Native Owns
+
+**Rust owns:**
+- State machines and policy decisions (what screen to show, what happens when a button is tapped)
+- Protocol, transport, and cryptographic behavior
+- Long-lived application state (`AppState` and all actor-internal derivation)
+- Cross-platform invariants and error semantics
+- Business logic, validation, formatting, and domain rules
+- Persistence (databases, file storage, caching)
+- Networking (API calls, WebSocket connections, relay management)
+
+**Native owns:**
+- Rendering and UX affordances (SwiftUI views, Compose screens, iced widgets)
+- Platform capability execution (audio routing, push notification surfaces, URL scheme handling, camera capture)
+- Short-lived handles to OS resources (audio sessions, location managers, Bluetooth connections)
+- Secure credential storage (iOS Keychain, Android EncryptedSharedPreferences)
+
+**The preference order is strict:**
+1. Rust implementation that preserves native-quality UX (always try this first)
+2. Native capability bridge if and only if required for native-quality UX (see Section 1.4)
+
+**The golden rule: native must NOT own app business logic.** If you find yourself writing an `if` statement in Swift or Kotlin that decides what the app should *do* (not how it should *look*), that logic belongs in Rust.
+
+Examples of the boundary:
+- **Correct:** Rust computes `display_timestamp: String` for a chat message; Swift/Kotlin just render it.
+- **Wrong:** Swift formats the timestamp with `DateFormatter`; Kotlin formats it with `SimpleDateFormat`. Now you have two implementations to maintain, and they will diverge.
+- **Correct:** Rust decides `can_send_message: bool` based on auth state, connectivity, and group membership; the native button reads this flag.
+- **Wrong:** Kotlin checks `if (state.auth is AuthState.LoggedIn && state.currentChat != null)` in the Compose layer.
+
+### 1.3 Unidirectional Data Flow (Elm Architecture)
+
+RMP applications follow The Elm Architecture (TEA), also known as Model-View-Update. This is the same pattern used by Elm, Redux, iced, and Ratatui (see [Ratatui's TEA documentation](https://ratatui.rs/concepts/application-patterns/the-elm-architecture/) for an excellent introduction to the concept).
+
+The pattern has three components:
+
+1. **Model** (`AppState`) -- a single struct containing all data the UI needs to render.
+2. **Message** (`AppAction`) -- an enum of every user intent or lifecycle event.
+3. **Update** (`AppCore::handle_message`) -- a function that takes the current state and a message, and produces a new state.
+
+The data flow is strictly one-directional:
+
+```
+User taps button
+    → Native UI dispatches AppAction (fire-and-forget, never blocks)
+    → Rust actor thread receives action via channel
+    → handle_message() mutates AppState, increments rev
+    → AppUpdate::FullState(state) sent to platform via AppReconciler callback
+    → Native AppManager receives update on background thread
+    → Hops to main/UI thread
+    → Replaces state (mutableStateOf on Android, @Observable property on iOS)
+    → UI framework detects change and re-renders
+```
+
+**Why this pattern?**
+- **No data races.** A single actor thread owns all mutable state. No locks, no concurrent mutation, no race conditions.
+- **Predictable debugging.** Every state change is caused by an `AppAction` or `InternalEvent`. You can log every action and reproduce any state.
+- **Platform agnostic.** The update function doesn't know or care whether the UI is SwiftUI, Compose, iced, or a CLI. It produces state; the platform renders it.
+- **Testable.** The core can be tested without any platform dependencies. Feed actions in, assert state out.
+
+**Tradeoffs:**
+- Full state snapshots are sent on every change (the MVP approach). This is simple but means every field of `AppState` is cloned and sent across the FFI boundary, even if only one field changed. This works for apps with moderate state complexity. For apps with very large state trees (thousands of list items, heavy media metadata), consider granular update variants as the app matures.
+- `dispatch()` is fire-and-forget. There is no return value. The platform cannot know synchronously whether an action succeeded. Results come back as state changes or side-effect updates.
+
+### 1.4 The Capability Bridge Pattern
+
+A capability bridge is a bounded lifecycle where Rust leases a single responsibility to native runtime code while keeping policy and state ownership in Rust.
+
+**The contract shape:**
+
+1. **Rust opens the window** -- Rust decides that a platform capability is needed (e.g., "start recording audio," "request GPS coordinates," "show file picker").
+2. **Native executes** -- The platform performs the side effect using OS APIs. It holds transient handles (audio sessions, location managers, camera captures) but makes no policy decisions.
+3. **Native reports back** -- Raw data flows back to Rust via typed callback interfaces. Coordinates, audio samples, file paths -- not decisions.
+4. **Rust decides** -- State updates, retries, fallbacks, error handling, and user-visible outcomes are all determined by Rust.
+5. **Rust closes the window** -- Deterministic teardown. Native releases OS resources.
+
+**Guardrails:**
+- **No policy forks.** Native code never decides "should we retry?" or "is this error recoverable?" It reports the error; Rust decides.
+- **Bounded native state.** Native holds only transient buffers and OS handles. No caches, no derived state, no business logic.
+- **Idempotent lifecycle.** Start/stop/restart must be safe. The bridge must handle interruptions gracefully (app backgrounding, permission revocation, hardware disconnection).
+- **Typed contracts.** Callback interfaces are defined in Rust with UniFFI annotations. Native code implements them. The contract is versioned and type-checked at compile time.
+
+**Example -- a location bridge for a fitness tracker:**
+```rust
+#[uniffi::export(callback_interface)]
+pub trait LocationProvider: Send + Sync + 'static {
+    fn start_tracking(&self);
+    fn stop_tracking(&self);
+}
+
+// Rust calls start_tracking() when user starts a workout.
+// Native starts CLLocationManager / FusedLocationProvider.
+// Native calls back with coordinates via a separate channel.
+// Rust decides: store this point, discard noise, end workout, etc.
+```
+
+**Pika examples:**
+- `ExternalSignerBridge` -- Rust asks native to open a URL or sign a Nostr event. Native executes the OS intent/URL scheme. Rust processes the result.
+- `VideoFrameReceiver` -- Rust pushes decoded video frames to native at ~30fps. Native renders them. Rust decides frame rate, codec, and quality.
+- `CallAudioSessionCoordinator` (iOS) -- Rust owns the call state machine. Native configures `AVAudioSession` modes based on call type (voice vs. video). Native never decides whether a call should start or end.
+
+### 1.5 Decision Framework: Should This Be in Rust or Native?
+
+Before adding logic to the native layer, answer these five questions:
+
+1. **Can a Rust-first implementation match true native UX quality?** If yes, put it in Rust. Timestamp formatting, string validation, list sorting, business rules -- all of these can be done in Rust without UX degradation.
+2. **Does it require an OS API that only exists on the platform?** Camera capture, push notification registration, Keychain/Keystore access, audio session routing -- these must be native. But the *logic around them* (when to start recording, what to do with the token, what credentials to store) stays in Rust.
+3. **Is the native state purely transient?** The native side should hold only OS handles and buffers that have no meaning outside the current operation. If you're tempted to cache, sort, filter, or derive state on the native side, that logic belongs in Rust.
+4. **Does Rust still decide policy and user-visible outcomes?** The native layer reports data; Rust makes decisions. If your Kotlin code contains `if/else` branches that determine app behavior (not just visual layout), move that logic to Rust.
+5. **Can you test it without a device?** Rust core logic can be tested with `cargo test`. Native capability bridges are thin enough to mock. If your logic can only be tested on a simulator, it's probably too complex for the native layer.
+
+**Examples across app types:**
+
+| Feature | Rust | Native |
+|---------|------|--------|
+| **Todo app:** Toggle completion | Rust mutates item, recalculates counts, emits state | Native re-renders the checkbox |
+| **Todo app:** Swipe-to-delete gesture | Rust handles `DeleteTodo { id }`, removes item | Native provides the swipe gesture UX |
+| **Fitness tracker:** Compute pace/distance | Rust processes GPS coordinates, calculates metrics | Native provides `CLLocationManager` bridge |
+| **Fitness tracker:** Background tracking | Rust decides tracking state | Native manages `BGAppRefreshTask` / `WorkManager` |
+| **Photo editor:** Apply blur filter | Rust applies filter using `image` crate | Native displays the result as `UIImage` / `Bitmap` |
+| **Photo editor:** Show file picker | Rust receives file path after selection | Native presents `UIDocumentPickerViewController` / `Intent.ACTION_OPEN_DOCUMENT` |
+| **Messaging app:** Parse message content | Rust parses markdown, extracts mentions, formats timestamps | Native renders styled text |
+| **Messaging app:** Camera for QR scan | Rust processes the decoded QR string | Native manages `AVCaptureSession` / CameraX |
+
+### 1.6 Pika as Reference Implementation
+
+Pika is used throughout this document as the primary example. It is a real app shipping to users -- an MLS-encrypted messenger over Nostr with iOS (SwiftUI), Android (Jetpack Compose), Desktop (iced), and CLI targets, all sharing a single Rust core. This makes it a credible, battle-tested reference.
+
+But Pika is also alpha software. It does not perfectly follow its own stated philosophy everywhere. **This bible is the stricter standard.** Where Pika deviates, this document calls it out as a known drift, not as the correct approach.
+
+**Known deviations (as of February 2026):**
+
+- **Duplicated formatting logic.** Timestamp formatting, chat summary display strings, and peer key validation were implemented independently in both Swift and Kotlin instead of living in Rust. As of this draft, timestamp/chat-preview formatting is still native on both mobile platforms; lowering it to Rust fields (e.g., `display_timestamp`, `last_message_preview`) remains an active migration target.
+- **Business logic in ViewState derivation.** Some iOS `ViewState` mapping functions contain conditional logic that should be computed in Rust and exposed as state fields.
+- **Navigation leaks.** Platform code occasionally manages navigation state alongside Rust's `Router` instead of treating the Router as the sole source of truth.
+- **God module.** `core/mod.rs` is 4,600+ lines -- the main actor file that handles all actions. This should be split by domain (chat, calls, profiles, auth) with each domain module handling its own action subset.
+- **No Android ViewModels.** Compose screens read directly from `AppManager.state` without a ViewModel indirection layer. Phase 2 of the Android parity plan addresses this.
+
+The lesson: even the team that designed the architecture drifts under shipping pressure. The bible exists to make the standard explicit so drift can be identified and corrected systematically.
+
+---
+
+## Part II: The Rust Core
+
+### 2.1 Project Structure and Workspace Layout
+
+An RMP app uses a Cargo workspace with the core logic in a single crate that compiles to three library types:
+
+```
+my-app/
+├── Cargo.toml              # Workspace root
+├── rmp.toml                # RMP project configuration
+├── rust/                   # Core crate
+│   ├── Cargo.toml          # crate-type = ["cdylib", "staticlib", "rlib"]
+│   ├── src/
+│   │   ├── lib.rs          # FfiApp, UniFFI scaffolding, callback interfaces
+│   │   ├── state.rs        # AppState and all FFI-visible types
+│   │   ├── actions.rs      # AppAction enum
+│   │   ├── updates.rs      # AppUpdate enum + internal message types
+│   │   └── core/           # Actor implementation and business logic
+│   └── uniffi.toml         # Kotlin package configuration
+├── uniffi-bindgen/         # Standalone binding generator binary
+│   ├── Cargo.toml
+│   └── src/main.rs         # calls uniffi::uniffi_bindgen_main()
+├── ios/                    # iOS app (SwiftUI)
+├── android/                # Android app (Jetpack Compose)
+├── desktop/iced/           # Desktop app (iced, default rmp init scaffold)
+└── crates/my-app-desktop/  # Desktop app in monorepo layout (Pika-style)
+```
+
+Both desktop layouts are valid. `rmp init --iced` scaffolds `desktop/iced/`; larger monorepos often relocate the app into `crates/<name>-desktop/` and wire it through the workspace.
+
+The three library types serve different consumers:
+- **`cdylib`** -- C-compatible dynamic library. Used by `uniffi-bindgen` to generate Swift and Kotlin bindings on the host, and as the `.so` loaded by JNA on Android.
+- **`staticlib`** -- Static archive (`.a`). Linked into the iOS `.xcframework` for static linking.
+- **`rlib`** -- Standard Rust library. Used by the desktop app and CLI as a direct Rust dependency (no FFI overhead), and by integration tests.
+
+Pin protocol-critical dependencies at the workspace level to prevent version skew:
+```toml
+[workspace.dependencies]
+mdk-core = { git = "...", rev = "d9f3727..." }  # MLS library -- must match everywhere
+```
+
+**Pika example:** The workspace has 18 member crates including the core (`rust/`), desktop (`crates/pika-desktop/`), CLI (`cli/`), notification extension (`crates/pika-nse/`), and the scaffolding tool (`crates/rmp-cli/`). Workspace-level pinning of `mdk-core` ensures the MLS wire format is identical across all consumers.
+
+### 2.2 The Actor Model (AppCore)
+
+The RMP core runs on a **dedicated OS thread** (the "actor thread") that owns all mutable state. This thread runs a synchronous event loop reading from a `flume` channel. A separate **tokio runtime** handles async I/O (networking, timers), feeding results back through the same channel.
+
+```
+┌──────────────┐    dispatch()     ┌─────────────────────────────┐
+│  Native UI   │ ───────────────→  │  flume channel (CoreMsg)    │
+│  (any thread)│                   └──────────┬──────────────────┘
+└──────────────┘                              │
+                                              ▼
+                                   ┌─────────────────────────────┐
+                                   │  Actor Thread (std::thread)  │
+                                   │  while let Ok(msg) = rx.recv│
+                                   │    core.handle_message(msg) │
+                                   │                             │
+                                   │  ┌────────────────────────┐ │
+                                   │  │ tokio runtime (2 thds) │ │
+                                   │  │ - network I/O          │ │
+                                   │  │ - timers               │ │
+                                   │  │ → sends InternalEvent   │ │
+                                   │  │   back via channel     │ │
+                                   │  └────────────────────────┘ │
+                                   └──────────┬──────────────────┘
+                                              │ emit AppUpdate
+                                              ▼
+                                   ┌─────────────────────────────┐
+                                   │  Listener Thread            │
+                                   │  reconciler.reconcile(upd)  │
+                                   └─────────────────────────────┘
+```
+
+The actor thread is a plain `std::thread::spawn`, not a tokio task. This keeps the message loop deterministic and avoids executor coupling. The tokio runtime (typically 2 worker threads) is owned by the actor and used exclusively for I/O-bound work.
+
+**Why this pattern?**
+- **No data races.** The actor is the sole writer of `AppState`. No locks needed for state mutation.
+- **Predictable ordering.** Messages are processed sequentially. Action A always completes before Action B starts.
+- **Async without complexity.** Network requests run on tokio's thread pool, but their results are funneled back through the channel and processed synchronously by the actor. The actor never awaits anything.
+
+**Pika implementation:** `FfiApp::new()` creates two `flume::unbounded` channels (`core_tx`/`core_rx` for inbound, `update_tx`/`update_rx` for outbound), spawns the actor thread, and stores the channels in the `FfiApp` struct. The actor creates a `tokio::runtime::Builder::new_multi_thread().worker_threads(2)` runtime for async I/O.
+
+### 2.3 AppState Design
+
+`AppState` is the single, serializable state tree that fully describes the UI at any point in time. It is annotated with `#[derive(uniffi::Record)]` so it crosses the FFI boundary as a value type (copied, not referenced).
+
+**Structural principles:**
+
+- **Flat and complete.** `AppState` contains everything the UI needs to render every screen. If a native view needs a computed value, compute it in Rust and add it as a field. Never derive business logic on the native side.
+- **Monotonic revision.** `rev: u64` increments on every state change. Platforms use this to detect stale updates and skip redundant re-renders.
+- **Navigation as state.** A `Router` field contains the current screen stack, making navigation declarative and Rust-driven.
+- **Busy flags.** A `BusyState` record contains boolean flags for in-flight async operations (creating account, sending message, etc.). This lets the UI show spinners without native-side timing heuristics.
+- **Ephemeral messages.** A `toast: Option<String>` field carries transient user-visible messages (errors, confirmations). The platform displays and then dispatches `ClearToast`.
+- **Raw + display field pairs for user text.** Keep protocol-raw text and Rust-computed display text as separate fields when needed (e.g., `content` + `display_content`). Native renders display fields, while raw fields remain available for copy/share/debug flows.
+
+**Shared state access.** `AppState` is held in an `Arc<RwLock<AppState>>`. The actor thread writes to it after every mutation. The platform can read a synchronous snapshot at any time via `FfiApp::state()`, which is useful for initial hydration before the update stream starts.
+
+**Example for a todo app:**
+```rust
+#[derive(uniffi::Record, Clone, Debug)]
+pub struct AppState {
+    pub rev: u64,
+    pub router: Router,
+    pub items: Vec<TodoItem>,
+    pub active_count: u32,      // computed in Rust, not by native
+    pub busy: BusyState,
+    pub toast: Option<String>,
+}
+```
+
+**Pika example:** `AppState` contains `router`, `auth`, `my_profile`, `busy`, `chat_list` (Vec of summaries), `current_chat` (detailed view of the open chat), `follow_list`, `peer_profile`, `active_call`, `call_timeline`, and `toast`. Every nested type (`ChatSummary`, `ChatMessage`, `CallState`, etc.) is also a `uniffi::Record`.
+
+### 2.4 AppAction: The Action Catalog
+
+`AppAction` is a flat enum of every user-initiated intent and lifecycle event. It is annotated with `#[derive(uniffi::Enum)]` so platforms can construct and dispatch it.
+
+**Design rules:**
+- **Flat, not nested.** UniFFI works best with flat enums. Keep it as a single enum with descriptive variant names, organized by domain in comments.
+- **Fire-and-forget.** `dispatch(action)` enqueues the action via the `flume` channel and returns immediately. It never blocks. There is no return value -- results come back as state changes.
+- **Imperative, not declarative.** Actions describe what the user *wants to do* (`AddTodo { text }`, `ToggleTodo { id }`), not what the state *should become* (`SetTodos { items }`).
+- **Secret-safe.** Implement a `tag()` method that returns a log-safe string representation. Never log secrets (keys, tokens, passwords) in action tags.
+
+**Example for a todo app:**
+```rust
+#[derive(uniffi::Enum, Clone, Debug)]
+pub enum AppAction {
+    // Navigation
+    PushScreen { screen: Screen },
+    PopScreen,
+    // Todos
+    AddTodo { text: String },
+    ToggleTodo { id: u64 },
+    DeleteTodo { id: u64 },
+    ClearCompleted,
+    // UI
+    ClearToast,
+    // Lifecycle
+    Foregrounded,
+}
+```
+
+**Pika example:** `AppAction` has ~50 variants covering Auth (CreateAccount, Login, Logout), Navigation (PushScreen, UpdateScreenStack), Chat (SendMessage, OpenChat, LoadOlderMessages), Calling (StartCall, AcceptCall, ToggleMute), Group Chat (CreateGroupChat, AddGroupMembers), Hypernote (HypernoteAction), UI (ClearToast), Lifecycle (Foregrounded, ReloadConfig), Push (SetPushToken), and Follow List (FollowUser, UnfollowUser).
+
+### 2.5 AppUpdate: The Update Stream
+
+`AppUpdate` is the outbound enum sent from the Rust core to the platform. The primary variant is `FullState(AppState)` -- a complete snapshot sent on every state change.
+
+**Side-effect variants** carry ephemeral data that should not live in `AppState`. In Pika today, these include:
+
+- `AccountCreated { rev, nsec, pubkey, npub }` -- generated local account secret (`nsec`) must be persisted natively, never in Rust state.
+- `BunkerSessionDescriptor { rev, bunker_uri, client_nsec }` -- bunker-session credentials must be persisted natively, never in Rust state.
+
+```rust
+#[derive(uniffi::Enum, Clone, Debug)]
+pub enum AppUpdate {
+    FullState(AppState),
+    AccountCreated { rev: u64, nsec: String, pubkey: String, npub: String },
+    BunkerSessionDescriptor { rev: u64, bunker_uri: String, client_nsec: String },
+}
+```
+
+Side-effect variants carry a `rev` field so platforms can maintain ordering. The native `apply()` method handles side effects (e.g., saving credentials) *before* checking the rev guard, ensuring credentials are never lost even if the rev check would skip the update.
+
+Design rule: if an auth/capability flow produces a secret that native must persist, introduce a dedicated side-effect `AppUpdate` variant rather than embedding that value in `FullState`.
+
+**Internal message types** (not FFI-visible):
+- `CoreMsg` -- the envelope wrapping both `AppAction` (from platform) and `InternalEvent` (from async tasks). Uses `Box<InternalEvent>` to avoid bloating the enum.
+- `InternalEvent` -- a large enum of async completion events (network results, profile fetches, media uploads, subscription recomputations). These stay internal because they reference protocol-specific types that should never cross the FFI boundary.
+
+### 2.6 Module Organization
+
+The core crate follows a two-level organization: the FFI boundary layer at the top and the actor implementation in a subdirectory.
+
+**Top-level modules (`rust/src/`):**
+
+| File | Responsibility |
+|------|----------------|
+| `lib.rs` | FFI entry point. `FfiApp` struct, `dispatch()`, `listen_for_updates()`, `state()`, callback interfaces, `uniffi::setup_scaffolding!()` |
+| `state.rs` | All FFI-visible state types (`AppState`, `Router`, `Screen`, domain-specific records) |
+| `actions.rs` | `AppAction` enum |
+| `updates.rs` | `AppUpdate` enum (FFI-visible) + `CoreMsg` and `InternalEvent` (internal) |
+| `route_projection.rs` | Pure functions mapping `Router` to platform-specific navigation models |
+
+**Actor subdirectory (`rust/src/core/`):**
+
+| File | Responsibility |
+|------|----------------|
+| `mod.rs` | `AppCore` struct, `handle_message()`, `handle_action()`, `handle_internal()`, state emission |
+| `storage.rs` | Persistence refresh and paging (`refresh_all_from_storage`, message/chat reconstruction) |
+| `session.rs` | Session lifecycle (login/restore, relay connections, subscriptions) |
+| `config.rs` | App configuration loading/defaults (`pika_config.json`) |
+| `profile.rs` | Profile fetch/save/update orchestration |
+| `profile_db.rs` | Profile database access layer |
+| `profile_pics.rs` | Profile-picture cache helpers |
+| `chat_media.rs` | Media upload/download/encryption orchestration |
+| `chat_media_db.rs` | Media attachment database access layer |
+| `push.rs` | Push subscription sync management |
+| `call_control.rs` | Call state machine + call signaling orchestration |
+| `call_runtime.rs` | MoQ runtime/media transport integration |
+| `interop.rs` | Interop and protocol normalization helpers |
+
+**Guidance:**
+- Keep the actor file (`core/mod.rs`) as an orchestrator. When it grows beyond ~1,000 lines, split domain logic into sub-modules that the actor calls. Each sub-module handles its own subset of actions and returns state mutations.
+- Domain modules should use `pub(super)` visibility -- they are helpers for the actor, not independent subsystems.
+- **Pika drift note:** Pika's `core/mod.rs` is 4,600+ lines. This is recognized as a deviation that should be refactored into domain-specific sub-modules.
+
+### 2.7 Internal Events vs. FFI-Visible Types
+
+The FFI boundary is defined by UniFFI annotations. Everything without these annotations stays internal to the Rust core.
+
+**FFI-visible (crosses to Swift/Kotlin):**
+- `#[derive(uniffi::Record)]` -- value types (`AppState`, domain records)
+- `#[derive(uniffi::Enum)]` -- enums (`AppAction`, `AppUpdate`, `Screen`)
+- `#[derive(uniffi::Object)]` -- reference types (`FfiApp`)
+- `#[uniffi::export(callback_interface)]` -- protocols (`AppReconciler`, capability bridges)
+
+**Internal-only (never crosses FFI):**
+- `CoreMsg`, `InternalEvent` -- internal message routing
+- `AppCore` -- the actor struct and all its fields
+- Domain-specific types (pending sends, outbox entries, protocol objects, database records)
+- Configuration structs, session handles, connection objects
+
+**Why this separation matters:**
+- **API stability.** Internal types can change freely without regenerating bindings or updating platform code.
+- **Binary size.** Every FFI-visible type generates scaffolding code in both Swift and Kotlin. Keeping the boundary thin reduces generated code size.
+- **Security.** Protocol objects, encryption keys, and raw network data stay in Rust. The platform only sees sanitized, display-ready values.
+
+### 2.8 Async Runtime Integration
+
+The actor thread owns a `tokio::runtime::Runtime` for async I/O. The integration pattern:
+
+```rust
+// Inside AppCore
+let runtime = tokio::runtime::Builder::new_multi_thread()
+    .worker_threads(2)
+    .enable_time()
+    .enable_io()
+    .build()
+    .expect("tokio runtime");
+```
+
+Async tasks are spawned from the actor and communicate results back via the same `flume` channel:
+
+```rust
+// In an action handler:
+let tx = self.core_sender.clone();
+self.runtime.spawn(async move {
+    let result = fetch_something().await;
+    let _ = tx.send(CoreMsg::Internal(Box::new(
+        InternalEvent::FetchCompleted { result }
+    )));
+});
+```
+
+The actor continues processing other messages while the async task runs. When the result arrives, it is handled synchronously in `handle_internal()`, maintaining the single-writer invariant.
+
+**Key principles:**
+- The actor loop uses blocking `flume::Receiver::recv()`, not async. It does not depend on tokio for its own execution.
+- Async tasks never directly mutate `AppCore` state. They send `InternalEvent` messages.
+- 2 worker threads is sufficient for most mobile apps. Adjust based on concurrent network request patterns.
+- Use `tokio::time::timeout` for network operations and `tokio::sync::Semaphore` for rate-limiting (e.g., concurrent image downloads).
+
+### 2.9 Persistence Layer
+
+RMP apps typically use SQLite for local persistence, with optional encryption via SQLCipher.
+
+**The recommended pattern:**
+- **Primary database** (per-user, encrypted) -- domain data. For Pika, this is the MDK (MLS) database holding messages, groups, and MLS state. Encryption keys live in the platform keychain (iOS) or Android Keystore.
+- **Cache databases** (shared, unencrypted) -- public or non-sensitive cached data. For Pika, profile metadata and media attachment records live in separate unencrypted SQLite databases.
+- **JSON files** -- configuration, non-structured state. For Pika, relay config and call timeline events are stored as JSON.
+
+Database connections are held as `Option<Connection>` on the `AppCore` struct for graceful degradation -- if a cache database fails to open, the app continues without it.
+
+The actor provides a `refresh_all_from_storage()` method that rebuilds the full `AppState` from disk. This is called after login, after receiving new messages, and whenever the UI state needs to be consistent with the database.
+
+**Pika example:** Three databases -- `mdk.sqlite3` (encrypted, per-identity), `profiles.sqlite3` (unencrypted, shared), `chat_media.sqlite3` (unencrypted, shared). The MDK database uses `bundled-sqlcipher` (or `bundled-sqlcipher-vendored-openssl` on Android where the NDK lacks OpenSSL).
+
+### 2.10 Error Handling Across the FFI Boundary
+
+RMP apps do not propagate `Result` types across the FFI boundary. Instead, errors are communicated as state changes.
+
+**The pattern:**
+- `FfiApp::dispatch()` is infallible -- it enqueues a message and returns. It cannot fail.
+- `FfiApp::new()` returns `Arc<Self>` -- it panics only on catastrophic failure (tokio runtime creation). This is acceptable because the app cannot function without the core.
+- Operational errors become **toast messages**: `self.state.toast = Some("Login failed: invalid key".into())`
+- Long-running operation errors clear **BusyState flags**: the spinner stops, indicating failure.
+- Per-item errors use **domain-specific state**: `MessageDeliveryState::Failed { reason }` for individual message failures.
+
+Inside the actor, `anyhow::Result` is used pervasively. Errors are caught at the boundary and converted to user-visible messages using `{e:#}` (anyhow's full error chain formatter).
+
+```rust
+// Typical error handling pattern:
+self.set_busy(|b| b.logging_in = true);
+match self.start_session(keys) {
+    Ok(()) => { /* state updated, busy cleared in success path */ },
+    Err(e) => {
+        self.clear_busy();
+        self.toast(format!("Login failed: {e:#}"));
+    }
+}
+```
+
+**Why no FFI-crossing errors?** It simplifies platform code dramatically. Native `dispatch()` calls never need try/catch. All error presentation flows through the same `toast` and `busy` state that the UI already observes.
+
+### 2.11 Route Projection: Platform-Specific Navigation
+
+The core stores navigation as a platform-agnostic `Router`:
+
+```rust
+#[derive(uniffi::Record, Clone, Debug)]
+pub struct Router {
+    pub default_screen: Screen,
+    pub screen_stack: Vec<Screen>,
+}
+```
+
+**Route projection** functions transform this into platform-specific navigation models without duplicating state:
+
+- **`project_mobile(state) -> MobileRouteState`** -- simple stack: root screen + stack produces active screen + `can_pop` flag.
+- **`project_desktop(state) -> DesktopRouteState`** -- shell mode (Login/Main) + selected chat + detail pane (peer profile, group info) + modal (active call).
+
+These projections are pure functions with no side effects. They exist as Rust helpers -- mobile platforms currently read `Router` directly from `AppState` and apply their own navigation, while the desktop app uses `project_desktop()`.
+
+The key principle: **Rust owns navigation state.** When the user taps "Open Chat," the native layer dispatches `AppAction::PushScreen { screen: Screen::Chat { chat_id } }`. Rust updates the `Router`, emits state, and the native `NavigationStack` (iOS) or `AnimatedContent` (Android) reacts to the new screen stack. Platform-initiated navigation (swipe-back) dispatches `UpdateScreenStack` back to Rust.
+
+---
+
+## Part III: The FFI Boundary (UniFFI)
+
+### 3.1 UniFFI Overview and Why It Was Chosen
+
+[UniFFI](https://mozilla.github.io/uniffi-rs/) (version 0.31.x) is Mozilla's tool for generating foreign-language bindings from Rust. It produces idiomatic Swift and Kotlin code from annotated Rust types, handling all marshaling, memory management, and thread safety.
+
+**Proc-macro approach.** RMP uses UniFFI's proc-macro mode exclusively -- no `.udl` files. Types are annotated directly in Rust source with `#[derive(uniffi::Record)]`, `#[derive(uniffi::Enum)]`, etc. This keeps the type definitions in one place and catches errors at compile time.
+
+**Why UniFFI over alternatives:**
+- **vs. raw FFI / `cbindgen`:** Raw C FFI requires manual memory management, manual type marshaling, and manual error handling on both sides. UniFFI generates all of this.
+- **vs. `swift-bridge`:** Only targets Swift. UniFFI generates both Swift and Kotlin from the same annotations.
+- **vs. Diplomat:** Similar goals but less mature ecosystem. UniFFI has Mozilla backing and is used in production (Firefox, Application Services).
+- **vs. `pyo3`/`napi`:** Language-specific. UniFFI is designed for the mobile multi-target use case.
+
+The binding generator is a standalone binary crate (`uniffi-bindgen/`) that calls `uniffi::uniffi_bindgen_main()`. It reads the compiled `cdylib` to extract type metadata and generates platform code.
+
+### 3.2 Type Mapping: Rust to Swift/Kotlin
+
+UniFFI maps Rust types to idiomatic platform types:
+
+| Rust Annotation | Swift | Kotlin |
+|----------------|-------|--------|
+| `#[derive(uniffi::Record)]` | `struct Foo: Equatable, Hashable` | `data class Foo` |
+| `#[derive(uniffi::Enum)]` | `enum Foo` (with associated values) | `sealed class Foo` (with subclasses) |
+| `#[derive(uniffi::Object)]` | `class Foo` (handle-based, reference type) | `class Foo: Disposable, AutoCloseable` |
+| `#[uniffi::export(callback_interface)]` | `protocol Foo: AnyObject, Sendable` | `interface Foo` |
+
+**Primitive mapping:**
+
+| Rust | Swift | Kotlin |
+|------|-------|--------|
+| `String` | `String` | `String` |
+| `u64` | `UInt64` | `ULong` |
+| `bool` | `Bool` | `Boolean` |
+| `Vec<u8>` | `Data` | `ByteArray` |
+| `Vec<T>` | `[T]` | `List<T>` |
+| `Option<T>` | `T?` | `T?` |
+| `HashMap<K,V>` | `[K:V]` | `Map<K,V>` |
+
+**Serialization:** Records are serialized into `RustBuffer` (big-endian byte buffer) for crossing the FFI. Objects use opaque `UInt64` handles. This means every `dispatch()` call serializes the `AppAction`, and every `reconcile()` call serializes the `AppUpdate`. For `FullState`, the entire `AppState` tree is serialized.
+
+**Auto-generated conformances (critical for platform code):**
+- **Swift:** UniFFI Records and Enums automatically conform to `Equatable` and `Hashable`. Do **not** add manual conformances (e.g., `extension MyEnum: @retroactive Hashable`) -- the compiler will error on the duplicate. This means UniFFI enums can be used directly as `NavigationStack` path elements, dictionary keys, and `ForEach` identifiers without any additional Swift code.
+- **Kotlin:** Records become `data class` (automatic `equals`/`hashCode`). Enums become `sealed class` with subclass-based matching.
+
+**Gotchas:**
+- UniFFI enums cannot use `Box<T>` indirection for large variants. If one variant is much larger than others, the entire enum is sized to the largest variant.
+- Recursive types are not supported. `AppState` and its nested types form a tree, not a graph.
+- Custom error types require `#[derive(uniffi::Error)]` and special handling. RMP avoids this by not returning errors across FFI (see Section 2.10).
+
+**Pika scale:** The generated Swift bindings are ~4,500 lines; Kotlin bindings are ~6,000 lines. This covers 23 Records, 8 Enums, 1 Object, and 3 callback interfaces.
+
+### 3.3 The FfiApp Object Pattern
+
+`FfiApp` is the single entry point for all platform interaction with the Rust core. It is a `uniffi::Object` (reference type) created once at app startup.
+
+```rust
+#[derive(uniffi::Object)]
+pub struct FfiApp {
+    core_tx: Sender<CoreMsg>,
+    update_rx: Receiver<AppUpdate>,
+    listening: AtomicBool,
+    shared_state: Arc<RwLock<AppState>>,
+    // ... capability bridge handles
+}
+```
+
+**Constructor:** `FfiApp::new(data_dir: String) -> Arc<Self>`. The constructor creates channels, spawns the actor thread, and returns an `Arc` (UniFFI requirement for Object types). This is the complete wiring -- channels, actor spawn, shared state:
+
+```rust
+#[uniffi::export]
+impl FfiApp {
+    #[uniffi::constructor]
+    pub fn new(data_dir: String) -> Arc<Self> {
+        let (update_tx, update_rx) = flume::unbounded();
+        let (core_tx, core_rx) = flume::unbounded::<CoreMsg>();
+        let shared_state = Arc::new(RwLock::new(AppState::empty()));
+
+        // Spawn the actor thread -- the single owner of all mutable state.
+        let shared_for_core = shared_state.clone();
+        thread::spawn(move || {
+            let mut state = AppState::empty();
+            let mut rev: u64 = 0;
+
+            // Emit initial state so platforms have something to display immediately.
+            let snapshot = state.clone();
+            if let Ok(mut g) = shared_for_core.write() { *g = snapshot.clone(); }
+            let _ = update_tx.send(AppUpdate::FullState(snapshot));
+
+            // Actor loop: process messages sequentially, forever.
+            while let Ok(msg) = core_rx.recv() {
+                match msg {
+                    CoreMsg::Action(action) => {
+                        // Handle action, mutate state...
+                        rev += 1;
+                        state.rev = rev;
+                        // ... domain-specific logic here ...
+
+                        // Write to shared state and emit update.
+                        let snapshot = state.clone();
+                        if let Ok(mut g) = shared_for_core.write() {
+                            *g = snapshot.clone();
+                        }
+                        let _ = update_tx.send(AppUpdate::FullState(snapshot));
+                    }
+                }
+            }
+        });
+
+        Arc::new(Self {
+            core_tx,
+            update_rx,
+            listening: AtomicBool::new(false),
+            shared_state,
+        })
+    }
+}
+```
+
+The pattern has three moving parts: (1) `core_tx`/`core_rx` for inbound actions, (2) `update_tx`/`update_rx` for outbound state updates, (3) `shared_state` for synchronous reads via `state()`. The actor thread writes to both `shared_state` and `update_tx` on every mutation. Production apps add a `keychain_group` parameter, logging initialization, and `tokio::runtime` for async I/O (see Section 2.8), but the core wiring is identical.
+
+**Exported methods:**
+
+| Method | Purpose | Thread Safety |
+|--------|---------|---------------|
+| `new(data_dir, keychain_group)` | Constructor; spawns actor thread | Called once at startup |
+| `state() -> AppState` | Synchronous snapshot from `RwLock` | Read lock; safe from any thread |
+| `dispatch(action: AppAction)` | Non-blocking action send | `flume::send` is lock-free; never blocks |
+| `listen_for_updates(reconciler)` | Start listener thread for state updates | `AtomicBool` CAS ensures single listener |
+| `set_video_frame_receiver(receiver)` | Set platform video callback | Write lock on `Arc<RwLock<Option<...>>>` |
+| `send_video_frame(payload)` | Send camera frame to core | Via channel to actor |
+| `set_external_signer_bridge(bridge)` | Set external signer callback | Write lock |
+
+**Why a single object?** Keeps the API surface minimal. The platform creates one `FfiApp`, stores it in the `AppManager`, and uses it for everything. Multiple service objects would require coordination, lifecycle management, and shared state -- all of which are handled internally by the actor.
+
+**Poison lock handling:** All `RwLock` accesses use `poison.into_inner()` fallback rather than panicking. If the actor thread panics, the platform can still read the last known state.
+
+### 3.4 Callback Interfaces: Native -> Rust Communication
+
+Callback interfaces let Rust call into platform code. They are defined as Rust traits with `#[uniffi::export(callback_interface)]`, which generates a Swift protocol or Kotlin interface.
+
+**The essential callback -- `AppReconciler`:**
+```rust
+#[uniffi::export(callback_interface)]
+pub trait AppReconciler: Send + Sync + 'static {
+    fn reconcile(&self, update: AppUpdate);
+}
+```
+
+The platform's `AppManager` implements this trait. The Rust side spawns a dedicated listener thread that drains the update channel and forwards each update to the reconciler:
+
+```rust
+pub fn listen_for_updates(&self, reconciler: Box<dyn AppReconciler>) {
+    // CAS guard: only one listener thread allowed (a second would split messages).
+    if self
+        .listening
+        .compare_exchange(false, true, Ordering::SeqCst, Ordering::SeqCst)
+        .is_err()
+    {
+        return;
+    }
+
+    let rx = self.update_rx.clone();
+    thread::spawn(move || {
+        while let Ok(update) = rx.recv() {
+            reconciler.reconcile(update);
+        }
+    });
+}
+```
+
+This is the bridge between the actor's `update_tx.send()` and the platform's `reconcile()` callback. The `AtomicBool` CAS ensures only one thread drains the channel -- calling `listen_for_updates` a second time is a no-op, preventing messages from being split across multiple consumers.
+
+**Thread safety is critical.** Callback interfaces must be `Send + Sync + 'static`. Rust calls them from background threads. The platform must handle the thread hop:
+- **iOS:** `nonisolated func reconcile(update:)` dispatches to `@MainActor` via `Task { @MainActor in self?.apply(update:) }`.
+- **Android:** `reconcile(update)` posts to `Handler(Looper.getMainLooper())`.
+
+**Capability bridge callbacks** follow the same pattern. Pika defines:
+- `VideoFrameReceiver` -- Rust pushes decoded video frames at ~30fps.
+- `ExternalSignerBridge` -- Rust asks native to perform cryptographic operations via an external signer app (7 methods for NIP-46/Amber signing, encryption, decryption).
+
+Under the hood, UniFFI wraps callback interfaces as boxed trait objects with reference counting. On Swift, they become protocol objects. On Kotlin, they become JNA callback instances. The marshaling overhead is minimal for infrequent calls but should be considered for high-frequency callbacks (like video frames).
+
+### 3.5 Binding Generation Pipeline
+
+The full pipeline from Rust source to generated bindings:
+
+```
+Rust source (proc-macro annotations)
+    → cargo build --target <host> (produces libmy_core.{dylib|so})
+    → uniffi-bindgen generate --library <lib> --language {swift|kotlin}
+    → generated bindings (Swift .swift + .h + .modulemap, or Kotlin .kt)
+```
+
+**Configuration (`uniffi.toml`):**
+```toml
+[bindings.kotlin]
+package_name = "com.example.myapp.rust"
+cdylib_name = "my_app_core"
+```
+
+**Swift generation:** Produces three files -- `my_core.swift` (all types and wrappers), `my_coreFFI.h` (C header), `my_coreFFI.modulemap` (module map for Swift imports).
+
+**Kotlin generation:** Produces a single file -- `my_core.kt` (all types, JNA bindings, and wrappers).
+
+**Generated bindings should be checked into git.** This avoids requiring a host build step on every developer's machine and makes CI simpler. Regenerate when Rust FFI types change.
+
+**Pika example:** The justfile provides `ios-gen-swift` (generates Swift + NSE bindings, strips trailing whitespace via Python) and `gen-kotlin` (generates Kotlin with `--no-format`). Both depend on `rust-build-host` to produce the host `cdylib` first.
+
+### 3.6 Binary Size Considerations
+
+Every FFI-visible type generates serialization and deserialization code in both the Rust scaffolding and the platform bindings. Minimizing the FFI surface directly reduces binary size.
+
+**Current state (Pika, no optimizations applied):**
+- No `[profile.release]` overrides (Rust defaults: `opt-level=3`, no LTO, 16 codegen units, no stripping)
+- Heavy dependencies: `nostr-sdk`, `tokio`, `rusqlite` (bundled SQLCipher), `rustls`, `reqwest`
+
+**Recommended optimizations for release builds:**
+```toml
+[profile.release]
+lto = true          # Full cross-crate LTO (10-30% size reduction)
+codegen-units = 1   # Better optimization at cost of compile time
+strip = true        # Remove debug symbols
+panic = "abort"     # Smaller binary, no unwind tables
+```
+
+**General guidance:**
+- Only expose what the UI needs over FFI. Internal types add zero to binary size.
+- `lto = true` is the single biggest win for release binary size.
+- Android ships separate `.so` files per ABI (arm64-v8a, armeabi-v7a, x86_64). Consider shipping only arm64 for production if your user base supports it.
+- iOS static libraries are linked into the app binary. Size shows up in the IPA.
+
+---
+
+## Part IV: Platform Layers
+
+### 4.1 iOS (SwiftUI)
+
+#### 4.1.1 Project Structure
+
+The canonical iOS project layout for an RMP app:
+
+```
+ios/
+├── project.yml                # XcodeGen project definition (generates .xcodeproj)
+├── Info.plist                 # App configuration
+├── Sources/                   # Swift source files
+│   ├── AppManager.swift       # Bridge: owns FfiApp, implements AppReconciler
+│   ├── App.swift              # @main SwiftUI entry point
+│   ├── ContentView.swift      # Root view with NavigationStack
+│   ├── ViewState.swift        # Thin derived view-state structs
+│   └── Views/                 # Screen-level SwiftUI views
+├── Bindings/                  # UniFFI-generated Swift (checked into git)
+│   ├── my_core.swift
+│   ├── my_coreFFI.h
+│   └── my_coreFFI.modulemap
+├── Frameworks/                # Pre-built xcframeworks
+│   └── MyCore.xcframework
+└── Tests/ + UITests/
+```
+
+XcodeGen generates the `.xcodeproj` from `project.yml`, keeping the project file out of version control and avoiding merge conflicts. The xcframework is linked as a non-embedded framework dependency (static linking).
+
+**Pika additions beyond the basics:** Notification Service Extension (`NotificationService/`), a second xcframework for the NSE crate (`PikaNSE.xcframework`), NSE-specific bindings (`NSEBindings/`), entitlements for App Groups and Keychain sharing, and call-related views (video pipeline, camera capture, decoder/renderer).
+
+#### 4.1.2 AppManager: The Bridge Class
+
+`AppManager` is the single class that bridges Rust and SwiftUI. It owns the `FfiApp` instance, holds the current `AppState`, implements the `AppReconciler` callback, and provides `dispatch()` to forward actions.
+
+```swift
+@MainActor
+@Observable
+final class AppManager: AppReconciler {
+    let core: AppCore          // Protocol wrapping FfiApp
+    var state: AppState        // Updated via reconciler
+    private var lastRevApplied: UInt64
+
+    init() {
+        let dataDir = /* resolve app data directory */
+        let core = FfiApp(dataDir: dataDir)
+        self.core = core
+        let initial = core.state()
+        self.state = initial
+        self.lastRevApplied = initial.rev
+        core.listenForUpdates(reconciler: self)
+    }
+
+    func dispatch(_ action: AppAction) {
+        core.dispatch(action: action)
+    }
+}
+```
+
+**Protocol abstraction for testability:** Define an `AppCore` protocol that `FfiApp` conforms to via an extension. This enables test doubles and SwiftUI previews without a running Rust core.
+
+```swift
+protocol AppCore: AnyObject, Sendable {
+    func dispatch(action: AppAction)
+    func listenForUpdates(reconciler: AppReconciler)
+    func state() -> AppState
+}
+extension FfiApp: AppCore {}
+```
+
+#### 4.1.2.1 Production boot flow (critical)
+
+The minimal constructor above is intentionally simplified. A production iOS app should add a deterministic boot sequence:
+
+1. Resolve the data directory (prefer App Group container when available).
+2. Run one-time migration from app-private storage to App Group storage (for NSE sharing).
+3. Ensure a default config file exists (`pika_config.json`) and fill missing keys without clobbering user overrides.
+4. Create `FfiApp`.
+5. Load stored auth mode from secure storage and dispatch the correct restore action:
+   - `.restoreSession(nsec:)`
+   - `.restoreSessionBunker(bunkerUri:clientNsec:)`
+6. Expose an `isRestoringSession` UI flag and show a loading surface until Rust settles on logged-in or logged-out state.
+
+This startup contract is architecture-level guidance, not product-specific behavior.
+
+#### 4.1.3 State Observation with @Observable
+
+RMP uses Swift 5.9's `@Observable` macro (Observation framework), not the older `ObservableObject`/`@Published` pattern.
+
+- `@Observable` on `AppManager` makes every stored property automatically observable by SwiftUI.
+- When `state` is replaced in `apply(update:)`, any view that accessed `state` (or its sub-properties) automatically re-renders.
+- No `@Published` wrappers needed. No `objectWillChange` publisher.
+
+The reconciler callback is `nonisolated` (called from Rust's background thread) and hops to `@MainActor`:
+
+```swift
+nonisolated func reconcile(update: AppUpdate) {
+    Task { @MainActor [weak self] in
+        self?.apply(update: update)
+    }
+}
+
+private func apply(update: AppUpdate) {
+    switch update {
+    case .fullState(let s):
+        if s.rev <= lastRevApplied { return }  // stale guard
+        lastRevApplied = s.rev
+        state = s
+    case .accountCreated(let rev, let nsec, _, _):
+        authStore.saveNsec(nsec)  // side effect: persist credential
+        if rev <= lastRevApplied { return }
+        lastRevApplied = rev
+    }
+}
+```
+
+In the app entry point, `AppManager` is stored with `@State` to ensure it lives for the lifetime of the scene:
+
+```swift
+@main struct MyApp: App {
+    @State private var manager = AppManager()
+    var body: some Scene {
+        WindowGroup { ContentView(manager: manager) }
+    }
+}
+```
+
+When passing the manager into child views, use `@Bindable var manager: AppManager` in the receiving view so Observation bindings work correctly with `@Observable`.
+
+#### 4.1.4 Navigation: Rust-Driven NavigationStack
+
+SwiftUI's `NavigationStack` is driven by Rust's `Router.screenStack`:
+
+```swift
+@State private var navPath: [Screen] = []
+
+NavigationStack(path: $navPath) {
+    rootView()
+        .navigationDestination(for: Screen.self) { screen in
+            screenView(for: screen)
+        }
+}
+.onAppear { navPath = manager.state.router.screenStack }
+.onChange(of: manager.state.router.screenStack) { _, new in
+    navPath = new  // Rust pushed/popped a screen
+}
+.onChange(of: navPath) { old, new in
+    guard new != manager.state.router.screenStack else { return }
+    if new.count < old.count {
+        // User swiped back -- report to Rust
+        manager.dispatch(.updateScreenStack(stack: new))
+    }
+}
+```
+
+The sync is bidirectional: Rust drives the stack via state updates, and platform-initiated pops (swipe-back) are reported back to Rust. The `guard` prevents feedback loops.
+
+#### 4.1.5 ViewState Derivation
+
+Thin Swift structs slice `AppState` into screen-specific shapes via pure derivation functions:
+
+```swift
+struct ChatListViewState: Equatable {
+    let chats: [ChatSummary]
+    let myNpub: String?
+    let myProfile: MyProfileState
+}
+
+func chatListState(from state: AppState) -> ChatListViewState {
+    ChatListViewState(
+        chats: state.chatList,
+        myNpub: /* extract from auth */,
+        myProfile: state.myProfile
+    )
+}
+```
+
+Views receive their ViewState, not raw `AppState`. This keeps views focused and makes them `Equatable`-diffable. **ViewState derivation must be trivially mechanical** -- if it contains business logic (filtering, sorting, conditional computation), that logic belongs in Rust.
+
+#### 4.1.6 Platform Capabilities (Push, Audio, Camera, Keychain)
+
+Each iOS capability is a thin native shim that reports to Rust or executes Rust commands:
+
+- **Push notifications:** `PushNotificationManager` calls `UIApplication.shared.registerForRemoteNotifications()`. The resulting device token is dispatched to Rust via `AppAction.setPushToken`. All subscription management happens in Rust.
+- **Audio session:** `CallAudioSessionCoordinator` configures `AVAudioSession` based on `CallState` (voice chat mode for voice calls, video chat mode with speaker for video calls). It reads Rust state and configures the OS; it never decides whether to start or stop a call.
+- **Camera capture:** `VideoCaptureManager` captures frames via `AVCaptureSession` and sends them to Rust via `core.sendVideoFrame(payload:)`. Frame rate and resolution decisions are made in Rust.
+- **Keychain:** `KeychainNsecStore` stores credentials in the iOS Keychain with `kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly` protection. Shared access group enables the NSE to read credentials for push decryption.
+- **External signer:** `IOSExternalSignerBridge` opens URLs for NostrConnect flows. On iOS, only `openUrl` is functional; the full NIP-55 signing interface (used on Android for Amber) returns `.signerUnavailable`.
+
+#### 4.1.7 Notification Service Extension (NSE)
+
+For apps that need to process push notifications before display (decrypting content, fetching additional data), a separate Rust crate provides the heavy lifting within the NSE's constrained environment.
+
+**Why a separate crate:** NSE extensions have strict memory limits (~24MB) and short execution windows (~30 seconds). A stripped-down Rust crate with only the necessary dependencies (crypto, storage) keeps the footprint manageable.
+
+**Pika implementation:** `crates/pika-nse/` provides `decrypt_push_notification()` which opens the MLS database, processes the Nostr event, and returns structured content (message text, sender info, call invite). The NSE reads credentials from the shared Keychain and data from the shared App Group container. This produces a separate `PikaNSE.xcframework` with its own UniFFI bindings.
+
+#### 4.1.8 XcodeGen and Project Configuration
+
+`project.yml` defines the Xcode project declaratively:
+
+```yaml
+name: App
+options:
+  bundleIdPrefix: com.example.myapp
+  deploymentTarget:
+    iOS: "17.0"
+targets:
+  App:
+    type: application
+    platform: iOS
+    sources:
+      - path: Sources
+      - path: Bindings
+        excludes: ["*.h", "*.modulemap"]
+    dependencies:
+      - framework: Frameworks/MyCore.xcframework
+        embed: false
+```
+
+Benefits of XcodeGen over manual `.xcodeproj`: no merge conflicts, declarative and reviewable, easy to regenerate, consistent across team members. The `.xcodeproj` stays out of git.
+
+### 4.2 Android (Jetpack Compose)
+
+#### 4.2.1 Project Structure
+
+The canonical Android project layout for an RMP app:
+
+```
+android/
+├── build.gradle.kts               # Root Gradle build
+├── settings.gradle.kts            # Plugin management
+├── gradle.properties              # JVM/Android flags
+└── app/
+    ├── build.gradle.kts           # App module: dependencies, compose, NDK
+    └── src/main/
+        ├── AndroidManifest.xml
+        ├── java/<package>/
+        │   ├── MainActivity.kt       # ComponentActivity entry point
+        │   ├── AppManager.kt         # Bridge: owns FfiApp, implements AppReconciler
+        │   ├── rust/
+        │   │   └── my_core.kt        # UniFFI-generated Kotlin (checked into git)
+        │   └── ui/
+        │       ├── MainApp.kt        # Root @Composable
+        │       ├── theme/Theme.kt    # Material3 theme
+        │       └── screens/          # Screen composables
+        └── jniLibs/
+            ├── arm64-v8a/libmy_core.so
+            ├── armeabi-v7a/libmy_core.so
+            └── x86_64/libmy_core.so
+```
+
+#### 4.2.2 AppManager: The Bridge Class
+
+Android's `AppManager` mirrors iOS's pattern but uses Compose's `mutableStateOf` for reactivity:
+
+```kotlin
+class AppManager private constructor(context: Context) : AppReconciler {
+    private val rust: FfiApp
+    private val mainHandler = Handler(Looper.getMainLooper())
+    private var lastRevApplied: ULong = 0UL
+
+    var state: AppState by mutableStateOf(/* initial empty state */)
+        private set
+
+    init {
+        rust = FfiApp(dataDir = context.filesDir.absolutePath)
+        val initial = rust.state()
+        state = initial
+        lastRevApplied = initial.rev
+        rust.listenForUpdates(this)
+    }
+
+    fun dispatch(action: AppAction) = rust.dispatch(action)
+
+    override fun reconcile(update: AppUpdate) {
+        mainHandler.post {
+            when (update) {
+                is AppUpdate.FullState -> {
+                    if (update.v1.rev <= lastRevApplied) return@post
+                    lastRevApplied = update.v1.rev
+                    state = update.v1
+                }
+                // handle side-effect variants
+            }
+        }
+    }
+
+    companion object {
+        @Volatile private var instance: AppManager? = null
+        fun getInstance(context: Context): AppManager =
+            instance ?: synchronized(this) {
+                instance ?: AppManager(context.applicationContext).also { instance = it }
+            }
+    }
+}
+```
+
+The singleton pattern ensures `AppManager` survives Activity configuration changes. `mutableStateOf` makes `state` observable to the Compose runtime -- any composable reading `manager.state` recomposes automatically when state is replaced.
+
+#### 4.2.2.1 Production boot flow (critical)
+
+As on iOS, production Android startup should do more than instantiate `FfiApp`:
+
+1. Ensure default config exists (`pika_config.json`) before Rust bootstraps.
+2. Create `FfiApp` and start update listener.
+3. Restore session from secure storage with mode-specific actions:
+   - `RestoreSession(nsec)`
+   - `RestoreSessionExternalSigner(pubkey, signerPackage, currentUser)`
+   - `RestoreSessionBunker(bunkerUri, clientNsec)`
+4. Keep side-effect update handling (`AccountCreated`, `BunkerSessionDescriptor`) before stale-rev checks.
+
+This ensures startup behavior is deterministic and auth mode handling does not drift by platform.
+
+#### 4.2.3 State Observation with Compose mutableStateOf
+
+The Compose integration works identically to iOS's `@Observable`:
+
+1. Rust calls `reconcile()` on a background thread.
+2. `reconcile()` posts to the main thread via `Handler(Looper.getMainLooper())`.
+3. On the main thread, `state = update.v1` triggers Compose's snapshot system.
+4. Any `@Composable` that read `manager.state` (or any sub-property) recomposes.
+
+The `rev`-based stale guard (`if (update.v1.rev <= lastRevApplied) return@post`) prevents out-of-order updates from overwriting newer state.
+
+#### 4.2.4 Navigation: Rust-Driven Compose Navigation
+
+RMP apps on Android use `AnimatedContent` driven by Rust's `Router`, not Jetpack Navigation:
+
+```kotlin
+@Composable
+fun MainApp(manager: AppManager) {
+    val router = manager.state.router
+    val current = router.screenStack.lastOrNull() ?: router.defaultScreen
+
+    BackHandler(enabled = router.screenStack.isNotEmpty()) {
+        manager.dispatch(AppAction.UpdateScreenStack(
+            stack = router.screenStack.dropLast(1)
+        ))
+    }
+
+    AnimatedContent(targetState = current) { screen ->
+        when (screen) {
+            is Screen.ChatList -> ChatListScreen(manager)
+            is Screen.Chat -> ChatScreen(manager, screen.chatId)
+            // ...
+        }
+    }
+}
+```
+
+Back presses dispatch `UpdateScreenStack` to Rust (popping the last screen). Navigation is fully Rust-driven -- the native layer never decides which screen to show.
+
+#### 4.2.5 JNA and Library Loading
+
+UniFFI Kotlin bindings use JNA (Java Native Access) to call into Rust, not raw JNI. The `.so` files in `jniLibs/` are automatically loaded by JNA at runtime.
+
+For Android-specific Rust features that need the NDK context (e.g., Android Keystore-backed keyring), a raw JNI function is needed:
+
+```kotlin
+object Keyring {
+    init { System.loadLibrary("my_core") }
+    @JvmStatic external fun init(context: Context)
+}
+```
+
+This must be called in `MainActivity.onCreate()` before creating `AppManager`, because the Rust core needs NDK context for encrypted database initialization.
+
+#### 4.2.6 Platform Capabilities (Keyring, Audio, Signer, Secure Storage)
+
+- **Secure storage:** `SecureAuthStore` wraps `EncryptedSharedPreferences` (AndroidX Security Crypto) with `AES256_GCM` encryption. Stores credentials by auth mode (local nsec, external signer, bunker).
+- **Audio focus:** `AndroidAudioFocusManager` acquires `AUDIOFOCUS_GAIN_TRANSIENT_EXCLUSIVE` during calls and releases on hang-up. Simpler than iOS (no voice/video mode distinction).
+- **External signer (Amber):** `AmberIntentBridge` uses `ActivityResultLauncher` for intent-based IPC with the Amber signer app. `AmberSignerClient` implements the full NIP-55 protocol. This is Android-specific -- iOS uses NostrConnect URLs instead.
+
+#### 4.2.7 Gradle Configuration and Dependencies
+
+Key Gradle setup for an RMP Android app:
+
+```kotlin
+// app/build.gradle.kts
+android {
+    compileSdk = 35
+    defaultConfig {
+        minSdk = 26
+        targetSdk = 35
+        ndkVersion = "28.2.13676358"
+    }
+    buildFeatures { compose = true }
+    composeOptions { kotlinCompilerExtensionVersion = "1.5.14" }
+    sourceSets {
+        getByName("main") { jniLibs.srcDirs("src/main/jniLibs") }
+    }
+}
+
+dependencies {
+    implementation("net.java.dev.jna:jna:5.18.1@aar")  // Required for UniFFI
+    implementation(platform("androidx.compose:compose-bom:2024.06.00"))
+    implementation("androidx.compose.material3:material3")
+    // ... other Compose and AndroidX deps
+}
+
+// Pre-build check: fail early if bindings don't exist
+tasks.register("ensureUniffiGenerated") {
+    doLast {
+        if (!file("src/main/java/<package>/rust/my_core.kt").exists()) {
+            throw GradleException("Missing UniFFI bindings. Run `rmp bindings kotlin`.")
+        }
+    }
+}
+tasks.named("preBuild") { dependsOn("ensureUniffiGenerated") }
+```
+
+### 4.3 Desktop (iced)
+
+#### 4.3.1 Direct Rust Dependency (No FFI)
+
+The desktop app imports the core crate as a regular Rust path dependency:
+
+```toml
+[dependencies]
+pika_core = { path = "../../rust" }
+```
+
+No UniFFI, no code generation, no serialization overhead. The desktop app calls `FfiApp::new()`, `FfiApp::state()`, and `FfiApp::dispatch()` directly via Rust method calls on `Arc`-wrapped types. This is the fastest integration path.
+
+**Implication for API design:** Because the core crate must serve both UniFFI consumers (iOS, Android) and direct Rust consumers (desktop, CLI), all FFI-visible types must also be usable as regular Rust types. The `uniffi::Record` and `uniffi::Enum` derives are additive -- they don't prevent normal Rust usage.
+
+#### 4.3.2 iced Elm Architecture and the Two Nested Loops
+
+The desktop app uses [iced](https://iced.rs/) (v0.14), a Rust-native GUI framework that itself follows TEA. This creates an architecture of **two nested Elm loops**.
+
+The **outer loop** is iced's: `DesktopApp` implements `new()`, `update()`, `view()`, `subscription()`. The **inner loop** is the Rust core's: `AppCore` processes `CoreMsg` messages on its actor thread and emits `AppUpdate` notifications.
+
+```
+┌─────────────────────────────────────────────────────────┐
+│  iced runtime (outer loop)                              │
+│                                                         │
+│   DesktopApp::view()                                    │
+│        │                                                │
+│        ▼                                                │
+│   Element<Message>  ──user interaction──▶  Message       │
+│        ▲                                    │           │
+│        │                                    ▼           │
+│   DesktopApp::update()                                  │
+│        │                                                │
+│        ├── UI-only state mutations (screen transitions) │
+│        └── manager.dispatch(AppAction::...)             │
+│                       │                                 │
+│  ┌────────────────────▼────────────────────────────┐    │
+│  │  AppCore actor (inner loop)                     │    │
+│  │  CoreMsg → handle_message → mutate AppState     │    │
+│  │  → AppUpdate notification via flume channel     │    │
+│  └────────────────────┬────────────────────────────┘    │
+│                       │                                 │
+│   Subscription::run_with() polls flume::Receiver        │
+│        │                                                │
+│        ▼                                                │
+│   Message::CoreUpdated → sync_from_manager()            │
+│   reads latest AppState, triggers re-render             │
+└─────────────────────────────────────────────────────────┘
+```
+
+The `AppManager` wraps `FfiApp` and exposes `subscribe_updates() -> flume::Receiver<()>`. iced polls this via `Subscription::run_with()`. When `Message::CoreUpdated` arrives, `sync_from_manager()` reads the latest `AppState` snapshot and stores it, triggering a re-render.
+
+**iced 0.14 API notes (critical for implementation):**
+
+- **`Subscription::run_with()` requires `Hash`.** The data parameter (`AppManager`) must implement `Hash`. Derive it manually by hashing the `Arc` pointer:
+  ```rust
+  impl Hash for AppManager {
+      fn hash<H: Hasher>(&self, state: &mut H) {
+          Arc::as_ptr(&self.ffi).hash(state);
+      }
+  }
+  ```
+- **`Space` API.** There is no `horizontal_space()` free function or `Space::with_width()`. Use `iced::widget::Space::new().width(Fill)` for horizontal expansion and `Space::new().height(Fill)` for vertical.
+- **`Rule` API.** There is no `Rule::vertical()` constructor. For vertical dividers, use a styled container: `container(column![]).width(1).height(Fill).style(...)`.
+- **Theme closures.** The `.theme()` method on `iced::application` requires a method reference (e.g., `App::theme`) rather than a closure like `|_| Theme::Dark`, due to lifetime requirements on the `Fn` bound.
+
+#### 4.3.2.1 Desktop AppManager internals (production pattern)
+
+In production desktop apps, `AppManager` is typically more than a thin proxy. Pika uses an explicit inner model + subscriber fan-out pattern:
+
+```rust
+struct Inner {
+    core: Arc<FfiApp>,
+    model: RwLock<ManagerModel>,
+    subscribers: Mutex<Vec<Sender<()>>>,
+    // data_dir, credential store, ...
+}
+
+struct ManagerModel {
+    state: AppState,
+    last_rev_applied: u64,
+    is_restoring_session: bool,
+    pending_login_nsec: Option<String>,
+}
+```
+
+Key behavior:
+- A reconciler callback receives `AppUpdate` values and forwards them into a channel.
+- A background thread applies updates into `ManagerModel` with `rev` stale guards.
+- Secret-bearing side effects (`AccountCreated`) are persisted **before** stale checks.
+- On change, `notify_subscribers()` emits `()` to all active update subscribers.
+- Desktop credential persistence uses file storage with strict permissions (`0600` on Unix).
+
+**Boot state as a top-level enum.** Instead of wrapping the manager in `Option<AppManager>` and scattering `if let Some(manager)` checks everywhere, model boot failure as a variant of the top-level app:
+
+```rust
+enum DesktopApp {
+    BootError { error: String },
+    Loaded {
+        manager: AppManager,
+        screen: Screen,
+        state: AppState,
+        // ...
+    },
+}
+```
+
+Every method (`update`, `view`, `subscription`) matches on the variant first. `BootError` renders an error message and ignores all input. This eliminates an entire category of `Option` unwrapping and makes the impossible state (running without a manager) unrepresentable.
+
+#### 4.3.3 The State / Message / Event Module Pattern
+
+This is the canonical pattern for structuring **stateful** iced view and screen modules. It was designed by an iced contributor and is documented in `crates/pika-desktop/iced-view-pattern.md`. In practice, this is the primary pattern, with lightweight variants for simpler modules.
+
+```rust
+// Stateful modules define these three types.
+// No prefixing needed -- use scoping rules at call sites (e.g. chat_rail::Message).
+
+pub struct State {
+    // All state owned by this module
+}
+
+#[derive(Debug, Clone)]
+pub enum Message {
+    // Triggered by view() interactions (button presses, text input, etc.)
+}
+
+pub enum Event {
+    // Raised to the parent -- "something happened that I can't handle myself"
+}
+
+impl State {
+    pub fn new(/* minimal init data */) -> Self { /* ... */ }
+
+    pub fn update(&mut self, message: Message) -> Option<Event> {
+        match message {
+            // Handle UI state internally, return None
+            // When something needs parent action, return Some(Event::...)
+        }
+    }
+
+    pub fn view(&self, /* read-only context */) -> Element<Message> {
+        // Pure rendering, immutable &self
+    }
+}
+```
+
+When a module needs to kick off an async UI operation (for example, an iced file picker), return an optional `Task` alongside the `Event`:
+
+```rust
+pub fn update(&mut self, message: Message) -> (Option<Event>, Option<Task<Message>>)
+```
+
+Valid module variants in a real iced app:
+- **Full triad (`State` + `Message` + `Event`)**: `conversation`, `my_profile`, `new_chat`, `new_group_chat`, `group_info`
+- **`Message` + `Event` (no local state)**: `peer_profile`
+- **Message-only stateless view modules**: `chat_rail`, `toast`, `call_banner`, `call_screen`
+- **Pure render helpers**: `avatar`, `message_bubble`, `empty_state`
+
+**Key principles:**
+
+1. **Messages go down, Events (and optional Tasks) bubble up.** The parent calls `child.update(msg)` and inspects the returned `Event`/`Task` to decide what to do. The child never reaches up to mutate parent state or call `manager.dispatch()` directly.
+
+2. **Scoped naming.** Every module uses the names `State`, `Message`, `Event` without prefixes. At call sites, Rust's module system provides the namespace: `conversation::Message`, `chat_rail::Message`, `login::Event`. This eliminates naming stutters like `ConversationMessage` or `ChatRailState`.
+
+3. **`view()` takes `&self`, not `&mut self`.** Views are pure functions of state. Side effects only happen through Messages.
+
+#### 4.3.4 Event Bubbling: The Logout Flow
+
+The event bubbling pattern is most clearly illustrated by the logout flow, which spans three levels of the module hierarchy:
+
+```
+my_profile::view()
+  └── button("Logout").on_press(Message::Logout)
+        │
+        ▼
+my_profile::update(Message::Logout)
+  └── returns Some(Event::Logout)
+        │
+        ▼
+home::update(Message::MyProfile(msg))
+  └── matches Event::Logout → returns Some(home::Event::Logout)
+        │
+        ▼
+DesktopApp::update(Message::Home(msg))
+  └── matches home::Event::Logout
+        ├── manager.logout()
+        ├── avatar_cache.borrow_mut().clear()
+        └── *screen = Screen::Login(screen::login::State::new())
+```
+
+At no point does `my_profile` know about `AppManager` or screen transitions. It only knows that logout was requested and communicates this upward. The top level -- which owns the manager and the screen enum -- is the only place that performs the destructive session teardown and screen swap.
+
+This pattern replaces the alternative of passing `&mut AppManager` down through every module, which creates tight coupling and makes modules impossible to test in isolation.
+
+#### 4.3.5 Screen Modules vs. View Modules
+
+The module hierarchy has two tiers:
+
+```
+src/
+├── main.rs              # DesktopApp: top-level iced application
+├── screen/
+│   ├── home.rs          # Authenticated experience (composes view modules)
+│   └── login.rs         # Unauthenticated login form
+└── views/
+    ├── chat_rail.rs     # Left sidebar with chat list
+    ├── conversation.rs  # Message thread + input
+    ├── call_screen.rs   # Voice/video call UI
+    ├── my_profile.rs    # Profile editor overlay
+    ├── peer_profile.rs  # Other user's profile
+    ├── new_chat.rs      # Start DM form
+    ├── new_group_chat.rs# Group creation form
+    ├── group_info.rs    # Group settings
+    ├── toast.rs         # Notification bar
+    └── ...
+```
+
+**Screen modules** (`screen/home.rs`, `screen/login.rs`) are top-level composition units. They own the full-screen layout, compose multiple view modules together, and are the primary routing targets. The top-level `Screen` enum switches between them:
+
+```rust
+enum Screen {
+    Home(Box<screen::home::State>),   // Boxed because it's large
+    Login(screen::login::State),
+}
+```
+
+Screen transitions happen at the `DesktopApp` level in response to auth state changes in `sync_from_manager()` or events like `Event::Logout`.
+
+**View modules** (`views/conversation.rs`, `views/chat_rail.rs`, etc.) are reusable components owned by a screen. The home screen composes them:
+
+```rust
+// home.rs owns child view states
+pub struct State {
+    pane: Pane,                              // Active overlay/panel
+    conversation: views::conversation::State,
+    group_info: Option<views::group_info::State>,
+    // ...
+}
+
+// home.rs delegates messages to the right child
+pub fn update(&mut self, message: Message, ...) -> Option<Event> {
+    match message {
+        Message::Conversation(msg) => {
+            let (event, task) = self.conversation.update(msg);
+            // Handle conversation events (SendMessage, ReactToMessage, etc.)
+        }
+        Message::ChatRail(msg) => {
+            // Handle chat selection, overlay toggles
+        }
+        // ...
+    }
+}
+```
+
+The home screen's `view()` method maps each child's output into its own message namespace:
+
+```rust
+// Each child view's Message type is wrapped via .map()
+let rail = views::chat_rail::view(&state.chat_list, ...)
+    .map(Message::ChatRail);
+
+let center = self.conversation.view(chat, ...)
+    .map(Message::Conversation);
+```
+
+This `.map()` wrapping is how iced maintains type-safe message routing through the component tree.
+
+**When to use a screen vs. a view:**
+
+- If it replaces the entire window content and corresponds to an auth state or major navigation boundary, it is a **screen**.
+- If it fills a panel, overlay, or section within a screen and can be composed alongside other views, it is a **view**.
+- Views can nest (a conversation view contains message bubble views), but screens do not nest.
+
+#### 4.3.6 The Home Screen as Composition Root
+
+The home screen (`screen/home.rs`) deserves special attention because it demonstrates the full pattern at scale. It owns:
+
+- A **Pane enum** for mutually exclusive overlays (new chat form, new group form, profile editor, or empty)
+- A **conversation state** that is always present (for the active chat)
+- An **optional group_info state** (shown only when viewing group settings)
+- **Optimistic selection** tracking (for instant chat switching before the core confirms)
+
+Its `update()` method is a large match that delegates to child modules and translates their Events:
+
+```rust
+Message::Conversation(msg) => {
+    let (event, conv_task) = self.conversation.update(msg);
+    if let Some(event) = event {
+        match event {
+            conversation::Event::SendMessage { content, reply_to_message_id } => {
+                manager.dispatch(AppAction::SendMessage { ... });
+            }
+            conversation::Event::ShowGroupInfo => {
+                self.group_info = Some(views::group_info::State::new(...));
+                manager.dispatch(AppAction::PushScreen { ... });
+            }
+            // ... 10+ other event variants
+        }
+    }
+
+    if let Some(task) = conv_task {
+        return Some(Event::Task(task.map(Message::Conversation)));
+    }
+}
+```
+
+The home screen also receives a `sync_from_update()` call whenever the core state changes, which it uses to:
+- Close overlays when async operations complete (e.g., `creating_chat` goes from `true` to `false`)
+- Reconcile optimistic chat selection with the authoritative route
+- Auto-dismiss the call screen when a call ends
+- Refilter follow lists for open overlays
+
+In practice, this sync method should diff previous and latest core snapshots explicitly:
+
+```rust
+pub fn sync_from_update(
+    &mut self,
+    old_state: &AppState,
+    new_state: &AppState,
+    manager: &AppManager,
+    cached_profiles: &[FollowListEntry],
+)
+```
+
+This is the desktop equivalent of the mobile `AppManager` reconciliation, but structured as explicit Rust state machine transitions rather than reactive UI framework bindings.
+
+#### 4.3.6.1 Task Propagation and Window Event Routing
+
+Top-level iced `update()` returns `Task<Message>`. Child tasks must be mapped upward through each message namespace:
+
+- `conversation::State::update()` may return `Task<conversation::Message>`
+- `home::State::update()` maps it to `Task<home::Message>` via `.map(Message::Conversation)`
+- `DesktopApp::update()` maps it again to `Task<crate::Message>` via `.map(Message::Home)` and returns it to iced
+
+Desktop apps should also route window-level events into the message tree. Pika subscribes via `iced::event::listen()`, maps to `Message::WindowEvent`, and translates file-hover/file-drop events into conversation messages (`FileHovered`, `FilesDropped`, `FilesHoveredLeft`).
+
+#### 4.3.7 Contrast with Mobile Platform Layers
+
+The desktop pattern differs from iOS and Android in a fundamental way:
+
+| Aspect | Mobile (iOS/Android) | Desktop (iced) |
+|--------|---------------------|----------------|
+| Core integration | UniFFI bridge (cross-language FFI serialization) | Direct Rust dependency (zero-cost) |
+| State observation | Callback interface (`AppReconciler`) pushes state | Subscription polls `flume::Receiver` |
+| UI state | Derived in the native layer (`ViewState`) | Modules own local state alongside `AppState` |
+| Component model | SwiftUI/Compose declarative views | iced State/Message/Event modules |
+| Message routing | Framework handles (SwiftUI bindings, Compose state) | Explicit `.map()` wrapping through module tree |
+| Event bubbling | Not needed (flat reconciler callback) | Required (hierarchical State/Message/Event) |
+
+The key insight: mobile platforms have flat state observation (one `AppReconciler` callback updates the entire UI), while desktop has hierarchical state ownership (each module owns its local state and communicates via events). This hierarchy is necessary because iced has no equivalent to SwiftUI's `@Observable` or Compose's `mutableStateOf` -- state flow must be explicit.
+
+#### 4.3.8 Platform-Specific Desktop Features
+
+Desktop has capabilities that don't apply to mobile:
+
+- **Video pipeline (all Rust):** `nokhwa` for camera capture, `openh264` for H.264 encode/decode, custom wgpu shaders for GPU-accelerated video rendering with aspect-ratio-correct letterboxing. No platform APIs needed -- everything is Rust.
+- **Audio:** Handled within the core/MoQ layer using `cpal` for capture/playback.
+- **Fonts:** 6 TTF fonts bundled at compile time via `include_bytes!()` (Geist family, Noto Color Emoji, Lucide icons). No system font dependency ensures consistent rendering across Linux/macOS/Windows.
+- **Design system:** A `PikaTheme` struct defines design tokens (surfaces, semantic colors, spacing scale, typography) with a Signal-inspired dark theme.
+- **macOS release:** Universal binary (arm64 + x86_64 via `lipo`), `.app` bundle with `Info.plist`, `.dmg` packaging. A safety check verifies no `/nix/store` paths leaked into the release binary.
+
+### 4.4 CLI (pikachat)
+
+#### 4.4.1 CLI as a Platform Target
+
+A CLI can consume the Rust core as a direct dependency (like desktop), providing a headless interface for testing, automation, and bot processes.
+
+**Two architectural approaches exist:**
+
+1. **Core-based CLI** -- Uses `FfiApp` directly. Dispatches actions, reads state, runs commands. This is the simplest path and shares 100% of the business logic with mobile/desktop.
+
+2. **Protocol-based CLI** -- Builds on the raw protocol libraries directly (e.g., `mdk-core` + `nostr-sdk`), bypassing the `FfiApp`/`AppState` layer entirely. This is appropriate when the CLI needs capabilities beyond the app's state model (agent provisioning, interop testing, daemon mode).
+
+**Pika example:** `pikachat` takes the second approach -- it uses `mdk-core` and `nostr-sdk` directly with 15+ subcommands including agent management and bot processes. This is a deliberate choice because the CLI's capabilities (daemon mode, provider management, scenario testing) extend far beyond the mobile app's state model. For most RMP apps, the first approach (core-based) is recommended.
+
+---
+
+## Part V: Build System and Cross-Compilation
+
+### 5.1 Workspace and Toolchain Setup
+
+An RMP project needs:
+- **Rust toolchain** with cross-compilation targets for all platforms: `aarch64-apple-ios`, `aarch64-apple-ios-sim`, `x86_64-apple-ios`, `aarch64-linux-android`, `armv7-linux-androideabi`, `x86_64-linux-android`.
+- **Xcode** (macOS only) with iOS simulator runtimes installed. The Xcode toolchain's clang is used as the C compiler for iOS cross-compilation.
+- **Android SDK + NDK** (version 28.2.x recommended) with build tools, platform APIs, and emulator.
+- **cargo-ndk** for Android cross-compilation.
+- **xcodegen** for iOS project generation from `project.yml`.
+- **JDK 17** for Gradle.
+
+**Nix is recommended but optional.** A Nix flake can provision the entire toolchain reproducibly, ensuring every developer and CI runner has the same environment. Without Nix, each tool must be installed manually.
+
+**Pika approach:** No `rust-toolchain.toml` -- the toolchain is 100% Nix-managed via `rust-overlay`. The flake provides a single `rustToolchain` with all six cross-compilation targets pre-installed plus `rust-src` and `rust-analyzer`.
+
+### 5.2 iOS Build Pipeline
+
+The iOS build has five stages:
+
+**1. Build for host** (`rust-build-host`)
+```bash
+cargo build -p my_core --release  # produces libmy_core.dylib on macOS
+```
+The host build is needed because `uniffi-bindgen` reads type metadata from the compiled library.
+
+**2. Generate Swift bindings** (`ios-gen-swift`)
+```bash
+cargo run -p uniffi-bindgen -- generate \
+  --library target/release/libmy_core.dylib \
+  --language swift \
+  --out-dir ios/Bindings \
+  --config rust/uniffi.toml
+```
+Outputs: `my_core.swift`, `my_coreFFI.h`, `my_coreFFI.modulemap`.
+
+**3. Cross-compile for iOS** (`ios-rust`)
+
+This is the most complex step. The Rust compiler must use Xcode's clang as the linker, with the correct SDK root and minimum version flags:
+
+```bash
+# For device (aarch64-apple-ios):
+env -u SDKROOT -u MACOSX_DEPLOYMENT_TARGET \
+  CC="$XCODE_TOOLCHAIN/clang" \
+  SDKROOT="$(xcrun --sdk iphoneos --show-sdk-path)" \
+  RUSTFLAGS="-C linker=$CC -C link-arg=-miphoneos-version-min=17.0" \
+  cargo build -p my_core --lib --target aarch64-apple-ios --release
+
+# For simulator (aarch64-apple-ios-sim):
+env -u SDKROOT -u MACOSX_DEPLOYMENT_TARGET \
+  CC="$XCODE_TOOLCHAIN/clang" \
+  SDKROOT="$(xcrun --sdk iphonesimulator --show-sdk-path)" \
+  RUSTFLAGS="-C linker=$CC -C link-arg=-mios-simulator-version-min=17.0" \
+  cargo build -p my_core --lib --target aarch64-apple-ios-sim --release
+```
+
+**Critical -- Nix environment variable isolation:** When building inside a Nix shell, the shell hook sets `CC`, `CXX`, `AR`, `RANLIB`, `SDKROOT`, `MACOSX_DEPLOYMENT_TARGET`, `LIBRARY_PATH`, and `NIX_LDFLAGS` to Nix's apple-sdk paths. These **completely break** iOS cross-compilation because they point to the macOS SDK, not the iOS SDK. You must unset **all** of them and explicitly point to the system Xcode:
+
+```bash
+# The complete env var isolation for iOS cross-compilation inside Nix:
+XCODE_DEV="/Applications/Xcode.app/Contents/Developer"
+TOOLCHAIN_BIN="$XCODE_DEV/Toolchains/XcodeDefault.xctoolchain/usr/bin"
+IOS_SDK="$XCODE_DEV/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS.sdk"
+SIM_SDK="$XCODE_DEV/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator.sdk"
+
+# Device build:
+env -u SDKROOT -u MACOSX_DEPLOYMENT_TARGET -u CC -u CXX -u AR -u RANLIB -u LIBRARY_PATH \
+  DEVELOPER_DIR="$XCODE_DEV" \
+  SDKROOT="$IOS_SDK" \
+  CC="$TOOLCHAIN_BIN/clang" \
+  RUSTFLAGS="-C linker=$TOOLCHAIN_BIN/clang -C link-arg=-miphoneos-version-min=17.0 -C link-arg=-isysroot -C link-arg=$IOS_SDK" \
+  cargo build -p my_core --lib --target aarch64-apple-ios --release
+```
+
+Note the explicit `-C link-arg=-isysroot -C link-arg=$IOS_SDK` -- without this, the linker may pick up the wrong sysroot from Nix's environment.
+
+**`xcodebuild` must run outside the Nix shell** (or with `NIX_LDFLAGS` unset). Nix injects linker flags like `-objc_abi_version '-Xlinker'` via `NIX_LDFLAGS` that are not valid for the iOS linker and cause the link step to fail with cryptic errors. The simplest approach:
+
+```bash
+# Option 1: Run xcodebuild outside Nix entirely (recommended):
+xcodebuild build -project ios/App.xcodeproj -scheme App ...
+
+# Option 2: Unset all Nix linker pollution:
+env -u NIX_LDFLAGS -u NIX_CFLAGS_COMPILE -u SDKROOT -u MACOSX_DEPLOYMENT_TARGET \
+  -u CC -u CXX -u AR -u RANLIB -u LIBRARY_PATH \
+  DEVELOPER_DIR="/Applications/Xcode.app/Contents/Developer" \
+  xcodebuild build -project ios/App.xcodeproj -scheme App ...
+```
+
+**4. Create xcframework** (`ios-xcframework`)
+```bash
+# Stage the headers from UniFFI-generated bindings:
+mkdir -p staging/headers
+cp ios/Bindings/my_coreFFI.h staging/headers/
+cp ios/Bindings/my_coreFFI.modulemap staging/headers/module.modulemap
+
+xcodebuild -create-xcframework \
+  -library target/aarch64-apple-ios/release/libmy_core.a -headers staging/headers \
+  -library target/aarch64-apple-ios-sim/release/libmy_core.a -headers staging/headers \
+  -output ios/Frameworks/MyCore.xcframework
+
+rm -rf staging
+```
+
+**5. Generate Xcode project** (`ios-xcodeproj`)
+```bash
+cd ios && xcodegen generate
+```
+
+### 5.3 Android Build Pipeline
+
+**1. Build for host** (same as iOS step 1)
+
+**2. Generate Kotlin bindings** (`gen-kotlin`)
+```bash
+cargo run -p uniffi-bindgen -- generate \
+  --library target/release/libmy_core.so \
+  --language kotlin \
+  --out-dir android/app/src/main/java \
+  --no-format \
+  --config rust/uniffi.toml
+```
+
+**3. Cross-compile for Android** (`android-rust`)
+```bash
+cargo ndk -o android/app/src/main/jniLibs -P 26 \
+  -t arm64-v8a -t armeabi-v7a -t x86_64 \
+  build -p my_core --release
+```
+`cargo-ndk` handles NDK toolchain selection, sysroot configuration, and output placement. `-P 26` sets minimum API level 26 (Android 8.0).
+
+**4. Build APK** (`android-assemble`)
+```bash
+cd android && ./gradlew :app:assembleDebug
+```
+
+**Android-specific Rust dependencies:** SQLCipher on Android requires `bundled-sqlcipher-vendored-openssl` because the NDK does not include OpenSSL. This is handled via Cargo feature flags or conditional dependencies.
+
+### 5.4 Desktop Build Pipeline
+
+**Development:** Simply `cargo run -p my-desktop`. On macOS, you may need `cargo-with-xcode` wrapper to unset Nix environment variables and force the Xcode toolchain.
+
+**macOS release:** Build universal binary (arm64 + x86_64), create `.app` bundle with `Info.plist`, package as `.dmg`. Verify no `/nix/store` paths leaked into the binary via `otool -L`.
+
+**Linux:** Requires X11/Wayland and Vulkan/Mesa runtime libraries. A Nix flake can provision these; otherwise they must be installed system-wide.
+
+**Windows:** Not yet implemented in Pika. The iced framework supports Windows, and Rust cross-compilation to `x86_64-pc-windows-msvc` is mature. This is an open area for the RMP ecosystem.
+
+### 5.5 The justfile: Central Build Orchestrator
+
+The `justfile` (using [just](https://github.com/casey/just)) is the central entry point for all build, test, and release operations. Organize recipes by category:
+
+| Category | Naming Convention | Examples |
+|----------|-------------------|----------|
+| Platform builds | `ios-*`, `android-*`, `desktop-*` | `ios-rust`, `android-assemble`, `run-desktop` |
+| Binding generation | `gen-*`, `*-gen-*` | `gen-kotlin`, `ios-gen-swift` |
+| Running | `run-*` | `run-ios`, `run-android`, `run-desktop` |
+| Testing | `test`, `*-ui-test`, `*-e2e-*` | `test`, `ios-ui-test`, `android-ui-e2e-local` |
+| CI lanes | `pre-commit`, `pre-merge-*`, `nightly-*` | `pre-merge-pika`, `nightly` |
+| Release | `release`, `*-release` | `android-release`, `release VERSION` |
+| Utilities | `doctor-*`, `fmt`, `clippy` | `doctor-ios`, `fmt`, `clippy` |
+
+Composite recipes chain dependencies: `android-assemble: gen-kotlin android-rust android-local-properties`.
+
+**Recommended composite recipes for common workflows:**
+
+```just
+# Full iOS pipeline: host build → Swift bindings → cross-compile → xcframework → xcodegen
+ios-full: rust-build-host ios-gen-swift ios-rust ios-xcframework ios-xcodeproj
+
+# Full Android pipeline: host build → Kotlin bindings → cross-compile → Gradle assemble
+android-full: rust-build-host gen-kotlin android-rust android-assemble
+
+# Quick iteration: rebuild Rust + regenerate bindings (no platform build)
+rebind: rust-build-host ios-gen-swift gen-kotlin
+```
+
+The `ios-full` recipe is particularly valuable because the iOS pipeline has 5 sequential steps with environment variable isolation requirements (see Section 5.2). Running them individually is error-prone; a composite recipe ensures the correct order and can embed the `env -u` invocations.
+
+**Pika scale:** dozens of recipes in a ~1,300-line justfile.
+
+### 5.6 Nix Flake: Reproducible Dev Environment
+
+A Nix flake provides fully reproducible developer environments:
+
+```nix
+devShells.default = {
+  # Rust toolchain with all cross-compilation targets
+  # Android SDK + NDK
+  # JDK 17
+  # cargo-ndk, xcodegen, gradle
+  # just, git, curl, python3
+  # Platform-specific: Xcode wrapper (macOS), X11/Vulkan libs (Linux)
+};
+```
+
+The flake ensures every developer and CI runner has identical tool versions. Shell hooks can auto-configure `ANDROID_HOME`, `ANDROID_NDK_HOME`, `JAVA_HOME`, write `android/local.properties`, and set up AVDs.
+
+**The `rmp` wrapper script.** The flake includes a `writeShellScriptBin "rmp"` wrapper that delegates to `cargo run -p rmp-cli` from a source checkout pointed to by `$RMP_REPO`. The wrapper must handle two layouts:
+
+1. **Workspace layout:** `$RMP_REPO/Cargo.toml` is a workspace that contains `rmp-cli` as a member. Use `cargo run --manifest-path "$RMP_REPO/Cargo.toml" -p rmp-cli`.
+2. **Standalone layout:** `$RMP_REPO/rmp-cli/Cargo.toml` exists but there is no parent workspace. Use `cargo run --manifest-path "$RMP_REPO/rmp-cli/Cargo.toml"`.
+
+The wrapper should check both paths and fail with a clear error if neither exists.
+
+**`RMP_REPO` auto-detection.** The shell hook should attempt to locate `rmp-cli` in the parent directory of the project (the common monorepo layout where the scaffolded project sits next to the CLI source). Use `cd .. && pwd` rather than `BASH_SOURCE` (which is unreliable in Nix shell contexts):
+
+```bash
+if [ -z "''${RMP_REPO:-}" ]; then
+  _parent="$(cd .. 2>/dev/null && pwd)"
+  if [ -f "$_parent/rmp-cli/Cargo.toml" ]; then
+    export RMP_REPO="$_parent"
+  fi
+fi
+```
+
+**Multiple shells for different workflows:**
+- `default` -- Full development (all platforms)
+- `rmp` -- Minimal for RMP scaffolding and development
+- `worker-wasm` -- WebAssembly target (if applicable)
+- `infra` -- Infrastructure management
+
+### 5.7 The rmp.toml Configuration File
+
+`rmp.toml` is the single source of truth for project-level configuration:
+
+```toml
+[project]
+name = "my-app"
+org = "com.example"
+
+[core]
+crate = "my_app_core"
+bindings = "uniffi"
+
+[ios]
+bundle_id = "com.example.myapp"
+scheme = "MyApp"
+
+[android]
+app_id = "com.example.myapp"
+avd_name = "my_app_api35"
+
+# Optional:
+# [desktop]
+# targets = ["iced"]
+# [desktop.iced]
+# package = "my_app_desktop_iced"
+```
+
+Pika currently keeps desktop outside `rmp.toml` (`crates/pika-desktop`, wired by workspace + justfile). Fresh `rmp init --iced` scaffolds should include the `[desktop]` section above.
+
+The `rmp` CLI discovers this file by walking up from the current directory. Every subcommand except `init` requires it. It maps the project name to crate names, platform identifiers, and build targets.
+
+---
+
+## Part VI: Patterns and Recipes
+
+### 6.1 Adding a New Feature (End-to-End Walkthrough)
+
+Every new feature follows the same six steps, regardless of app domain:
+
+**Step 1: Add state fields to `AppState`.**
+What does the user need to see? Add fields for it.
+```rust
+// Example: adding a "dark mode" toggle to any app
+pub struct AppState {
+    pub rev: u64,
+    pub dark_mode: bool,  // new
+    // ...
+}
+```
+
+**Step 2: Add action variants to `AppAction`.**
+What can the user do? Each interaction is a variant.
+```rust
+pub enum AppAction {
+    ToggleDarkMode,  // new
+    // ...
+}
+```
+
+**Step 3: Handle the action in `AppCore`.**
+What happens when they do it? Mutate state and emit.
+```rust
+AppAction::ToggleDarkMode => {
+    self.state.dark_mode = !self.state.dark_mode;
+    self.emit_state();
+}
+```
+
+**Step 4: Regenerate bindings.**
+```bash
+rmp bindings all  # or: just ios-gen-swift && just gen-kotlin
+```
+
+**Step 5: Consume in platform UI.**
+- **iOS:** `Toggle(isOn: .constant(manager.state.darkMode))` with `manager.dispatch(.toggleDarkMode)` on change.
+- **Android:** `Switch(checked = manager.state.darkMode, onCheckedChange = { manager.dispatch(AppAction.ToggleDarkMode) })`
+- **Desktop:** Read `state.dark_mode` in iced's `view()` to select the theme.
+
+**Step 6: Add a capability bridge if needed.**
+Dark mode doesn't need one. If the feature required a platform API (e.g., biometrics for a "lock app" feature), define a callback interface (see Section 6.3).
+
+**More complex example (Pika: adding typing indicators):**
+1. Add `typing_members: Vec<TypingMember>` to `ChatViewState`.
+2. Add `AppAction::TypingStarted` (dispatched when the user types).
+3. In the actor: send a Nostr typing event, track incoming typing events, add/remove from `typing_members` with a timeout.
+4. Regenerate bindings.
+5. iOS/Android: render "Alice is typing..." below the message list.
+
+### 6.2 Adding a New Screen
+
+1. **Add a `Screen` variant in Rust:**
+   ```rust
+   pub enum Screen {
+       Settings,  // new
+       // ...
+   }
+   ```
+
+2. **Add navigation actions:**
+   ```rust
+   pub enum AppAction {
+       PushScreen { screen: Screen },
+       // PopScreen is handled via UpdateScreenStack
+   }
+   ```
+
+3. **Handle navigation in the actor:**
+   ```rust
+   AppAction::PushScreen { screen } => {
+       self.state.router.screen_stack.push(screen);
+       self.emit_state();
+   }
+   ```
+
+4. **Create the SwiftUI view:** `SettingsView.swift` reading from `manager.state`. Add the case to `screenView(for:)` in `ContentView.swift`.
+
+5. **Create the Compose screen:** `SettingsScreen.kt` reading from `manager.state`. Add the case to the `when(screen)` block in `MainApp.kt`.
+
+6. **Create the iced view:** Add a `settings` view module. Handle in the screen routing.
+
+7. **Wire up:** The existing `NavigationStack`/`AnimatedContent` routing picks up new `Screen` variants automatically through the `when`/`switch` dispatch.
+
+### 6.3 Adding a Platform Capability Bridge
+
+When your app needs a platform API, define the contract in Rust and implement it natively.
+
+**Example: a location bridge for a fitness tracker.**
+
+**1. Define the Rust-side contract:**
+```rust
+#[uniffi::export(callback_interface)]
+pub trait LocationProvider: Send + Sync + 'static {
+    fn start_tracking(&self);
+    fn stop_tracking(&self);
+}
+```
+
+**2. Add a reporting channel.** The bridge *reports* data; it doesn't return it from method calls. Define an action for incoming data:
+```rust
+pub enum AppAction {
+    LocationUpdate { lat: f64, lon: f64, accuracy: f64 },
+    // ...
+}
+```
+
+**3. Implement in Swift:**
+```swift
+class IOSLocationProvider: LocationProvider, CLLocationManagerDelegate {
+    let manager: AppManager
+    private let clManager = CLLocationManager()
+
+    func startTracking() { clManager.startUpdatingLocation() }
+    func stopTracking() { clManager.stopUpdatingLocation() }
+
+    func locationManager(_ manager: CLLocationManager, didUpdateLocations locations: [CLLocation]) {
+        let loc = locations.last!
+        self.manager.dispatch(.locationUpdate(lat: loc.coordinate.latitude, ...))
+    }
+}
+```
+
+**4. Implement in Kotlin:** Same pattern with `FusedLocationProviderClient`.
+
+**5. Desktop:** Stub or mock if the capability doesn't apply. Or implement using a Rust GPS library if available.
+
+**The guardrail:** If you find yourself adding `if/else` logic to a bridge implementation, stop. Bridges report raw data. Rust makes all decisions.
+
+### 6.4 Managing State Granularity
+
+**Start with full snapshots.** `AppUpdate::FullState(AppState)` on every change is the correct starting point. It is simple, correct, and avoids partial-state consistency bugs. The `rev` counter handles ordering.
+
+**When to consider granular updates:**
+- Profiling shows that serialization/deserialization of `AppState` is a measurable bottleneck.
+- Your state tree contains large collections (thousands of items) that change infrequently.
+- A specific feature sends high-frequency updates (e.g., timer ticks, audio levels).
+
+**How to evolve:**
+```rust
+pub enum AppUpdate {
+    FullState(AppState),
+    TimerTick { elapsed_secs: u64 },        // lightweight, high-frequency
+    ItemUpdated { id: u64, item: TodoItem }, // targeted update
+}
+```
+
+Platform `reconcile()` handlers must grow to handle each variant. The complexity cost is real -- only add granular variants when profiling justifies it.
+
+### 6.5 Handling Platform-Specific Behavior
+
+**Route projection** (Section 2.11) maps the same `Router` state to different navigation models per platform. Mobile gets a stack; desktop gets a shell with sidebar and detail pane.
+
+**Conditional compilation** in Rust handles platform-specific logging, keyring initialization, and dependency selection:
+```rust
+#[cfg(target_os = "ios")]
+use apple_native_keyring_store::protected::Store;
+
+#[cfg(target_os = "android")]
+use android_native_keyring_store::Store;
+```
+
+**Platform identification** at runtime: pass a platform string to `FfiApp::new()` or add a `platform: String` field to the constructor. The actor can use this for platform-specific behavior (e.g., different retry strategies, platform-specific feature flags).
+
+**Feature flags in AppState:** Add `developer_mode: bool` or similar flags to `AppState` that the actor controls and the UI reads. This keeps feature gating in Rust.
+
+### 6.6 Secure Credential Storage
+
+**The rule: Rust never persists secrets.** Private keys, passwords, and tokens are stored natively using each platform's secure storage.
+
+**The pattern:**
+1. Rust generates or receives auth/session secrets.
+2. Rust emits secret-bearing side-effect updates (e.g., `AccountCreated`, `BunkerSessionDescriptor`), never embedding those secrets in `FullState`.
+3. Native persists those secrets in platform secure storage.
+4. On cold launch, native restores auth by loading stored mode and dispatching the matching action (`RestoreSession`, `RestoreSessionExternalSigner`, or `RestoreSessionBunker`).
+5. Rust reconstructs session state and emits normal `FullState` updates.
+6. Rust may keep secrets in memory for active session use, but does not write them to disk.
+
+**Startup restoration UX contract:** expose an explicit "restoring session" loading state during step 4→5 so the UI does not briefly flash the logged-out screen.
+
+**Platform implementations:**
+- **iOS:** `KeychainAuthStore` + `KeychainNsecStore` using `kSecClassGenericPassword` with `kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly`. Use a shared access group for App Group sharing (e.g., with NSE).
+- **Android:** `SecureAuthStore` using `EncryptedSharedPreferences` with `AES256_GCM` encryption backed by Android Keystore; supports local nsec, external signer, and bunker modes.
+- **Desktop:** File-based storage with restricted permissions (`0600` on Unix). Less secure than mobile but acceptable for desktop environments.
+
+### 6.7 Push Notifications
+
+Push notifications in an RMP app have a split architecture:
+
+**Registration:** Native-only. iOS registers with APNs, Android registers with FCM. The resulting device token is dispatched to Rust via `AppAction::SetPushToken`. Rust handles server-side subscription management.
+
+**Display:** Handled by the OS for basic notifications. For rich notifications requiring decryption (like encrypted messaging apps), a background processing component is needed.
+
+**Background processing (iOS NSE):** A separate Rust crate provides decryption within the `UNNotificationServiceExtension`'s constrained environment. The NSE shares data with the main app via App Group containers and Keychain access groups. This crate has minimal dependencies to stay within the NSE's ~24MB memory limit.
+
+**Background processing (Android):** FCM data messages can trigger processing in `FirebaseMessagingService`. Depending on the app's needs, this can call into the Rust core directly or use a separate lightweight Rust crate.
+
+### 6.8 Real-Time Media (Audio/Video Calls)
+
+Real-time media is the quintessential capability bridge in action:
+
+- **Call state machine:** Entirely in Rust. `CallState` (with `CallStatus` enum: Offering, Ringing, Connecting, Active, Ended) is part of `AppState`. Actions like `StartCall`, `AcceptCall`, `EndCall`, `ToggleMute` are dispatched from native. Rust decides all transitions.
+- **Audio routing:** Native capability bridge. iOS configures `AVAudioSession` (voice chat mode vs. video chat mode, speaker vs. earpiece). Android acquires `AudioFocus`. Desktop uses `cpal` directly.
+- **Video capture:** Native provides camera frames via `sendVideoFrame(payload)`. Rust encodes and transmits.
+- **Video receive:** Rust decodes received frames and pushes them to native via `VideoFrameReceiver.onVideoFrame()` at ~30fps. Native renders them.
+- **Video rendering:** iOS uses `VideoToolbox` for hardware decoding. Android uses `MediaCodec`. Desktop uses `openh264` + custom wgpu shaders (all Rust, no platform API needed).
+
+The native layer handles OS-level media APIs. Rust owns the call state machine, codec selection, network transport, and all policy decisions (mute, camera on/off, hang up).
+
+### 6.9 Anti-Patterns and Common Drifts
+
+These are the ways RMP discipline breaks down in practice. Each is named, explained, and corrected.
+
+**Anti-pattern 1: Duplicated Formatting Logic**
+- **Symptom:** Both Swift and Kotlin have their own timestamp formatting, display name derivation, or message preview generation.
+- **Why it happens:** Writing a 5-line Swift extension is faster than adding a Rust field, regenerating bindings, and updating both platforms.
+- **The fix:** Add a pre-formatted field to `AppState` (e.g., `display_timestamp: String`). Rust does the work once. Native renders.
+- **Pika example:** Timestamp formatting and chat summary strings are still duplicated across iOS and Kotlin in the current codebase. Lowering these into Rust fields (`display_timestamp`, `last_message_preview`) is the intended migration path.
+
+**Anti-pattern 2: Business Logic in ViewState Derivation**
+- **Symptom:** Native ViewState mapping functions contain conditional logic, filtering, sorting, or validation.
+- **Why it happens:** It feels like "presentation logic," but it's actually business logic in disguise.
+- **The fix:** If derivation does anything beyond field renaming or type conversion, it belongs in Rust. ViewState derivation must be trivially mechanical.
+
+**Anti-pattern 3: Navigation Logic Leaking to Native**
+- **Symptom:** Native code decides which screen to show based on state conditions, or manages its own navigation stack alongside Rust's Router.
+- **Why it happens:** Platform navigation APIs (`NavigationStack`, `NavHost`) have opinions, and it is tempting to use them idiomatically.
+- **The fix:** Rust Router is the single source of truth. Native navigation is driven by Router state, never by native-side conditionals. Platform-initiated pops dispatch back to Rust.
+
+**Anti-pattern 4: God Module**
+- **Symptom:** The core actor file grows to thousands of lines as every feature adds match arms.
+- **Why it happens:** Path of least resistance -- add a few lines to the existing match block.
+- **The fix:** Split `handle_message()` by domain. Each domain module handles its own action subset and returns state mutations. The actor orchestrates; it does not implement.
+
+**Anti-pattern 5: Native-Side State Caching**
+- **Symptom:** Native code caches derived values from `AppState` and manages invalidation.
+- **Why it happens:** Performance concerns with full-state snapshots.
+- **The fix:** If caching is needed, do it in Rust. Native should treat every `AppUpdate` as the complete, current truth. If performance is an issue, move to granular updates (Section 6.4) -- not native caching.
+
+**Anti-pattern 6: Capability Bridge Scope Creep**
+- **Symptom:** A callback interface that started as "report audio level" now carries policy decisions like "should we mute."
+- **Why it happens:** Easier to add a boolean to the existing callback than to round-trip through Rust.
+- **The fix:** Bridges report data. Rust makes decisions. If you are adding decision logic to a bridge, extract it back to Rust and have the bridge report raw inputs.
+
+---
+
+## Part VII: Testing Strategy
+
+### 7.1 Rust Core Unit Tests
+
+The Rust core is the most testable part of the stack. Because the actor processes actions and produces state, tests are straightforward:
+
+```rust
+#[test]
+fn test_add_todo() {
+    let (update_tx, update_rx) = flume::unbounded();
+    let (core_tx, core_rx) = flume::unbounded();
+    // Create AppCore, send AddTodo action, assert state.items contains the new item
+}
+```
+
+**Patterns:**
+- Test actions by feeding `CoreMsg::Action` into the actor and asserting the resulting `AppState`.
+- Test async flows by spawning the actor in a test, sending actions, and collecting `AppUpdate` messages from the update channel.
+- Mock platform capabilities by implementing callback interfaces with test doubles.
+- The `rlib` crate type enables `use my_core::*` in integration tests without going through FFI.
+
+**Pika example:** Route projection has 7 unit tests covering login overrides, stack navigation, detail pane priority, and fallback behavior. Storage refresh functions are tested against in-memory SQLite databases.
+
+### 7.2 Platform UI Tests
+
+**iOS:** XCUITest with simulators. The `AppCore` protocol abstraction (Section 4.1.2) enables preview factories and test doubles that return pre-built `AppState` values without running the Rust core.
+
+**Android:** Compose testing with `@Composable` test rules. Since all screens read from `AppManager.state`, tests can create an `AppManager` with mock state and assert composable output.
+
+**Desktop:** `cargo test -p my-desktop` tests the manager and UI wiring. iced widgets can be tested for correct output given specific state.
+
+**Across all platforms:** Because the UI is a pure function of `AppState`, most UI tests reduce to: set up a specific `AppState`, render the view, assert the output. Business logic testing belongs in the Rust layer (Section 7.1).
+
+### 7.3 End-to-End Tests
+
+**Local E2E (deterministic):** Spin up local infrastructure (e.g., a local relay, a local bot), run the app on a simulator/emulator, and execute a scripted flow. This tests the full stack without network variability.
+
+**Public E2E (nondeterministic):** Run against production infrastructure. Useful for integration validation but inherently flaky due to network conditions.
+
+**Interop tests:** For apps that communicate with other clients, cross-app compatibility tests verify protocol compliance.
+
+**Pika example:** Local E2E spins up a Nostr relay + a Rust bot, runs the app on iOS simulator or Android emulator, and executes chat flows. Nightly lanes run extended E2E suites including call tests over MoQ relays.
+
+### 7.4 CI/CD Pipeline
+
+**Layered pre-merge lanes** test components independently:
+- `pre-merge-core` -- fmt + clippy + Rust tests
+- `pre-merge-android` -- Gradle build + instrumented tests
+- `pre-merge-ios` -- Xcode build + UI tests (macOS runners)
+- `pre-merge-desktop` -- cargo check/test
+- `pre-merge-rmp` -- scaffold QA (multiple `rmp init` variants)
+
+**Nightly lanes** run extended tests requiring hardware or network:
+- iOS simulator E2E
+- Android emulator E2E
+- Desktop launch smoke test (with `xvfb-run` on Linux)
+- Public relay integration tests
+
+**RMP scaffold QA:** Test multiple scaffold configurations (iOS-only, Android-only, with-iced, with-flake, etc.) to ensure the scaffolding tool works across all combinations.
+
+**Release pipeline:** Version validation, signed builds (encrypted keystores via `age`), platform-specific packaging, distribution (app stores, Zapstore, DMG).
+
+---
+
+## Part VIII: From Zero to Running App
+
+### 8.1 The rmp CLI Tool
+
+The `rmp` CLI scaffolds new RMP projects and manages their lifecycle:
+
+| Command | Purpose | Needs `rmp.toml`? |
+|---------|---------|-------------------|
+| `rmp init <name>` | Scaffold a new project | No (creates it) |
+| `rmp doctor` | Check toolchain prerequisites | Yes |
+| `rmp devices list` | List simulators/emulators | Yes |
+| `rmp devices start <platform>` | Start a target device | Yes |
+| `rmp bindings <target>` | Generate UniFFI bindings + build artifacts | Yes |
+| `rmp run <platform>` | Build, install, and launch | Yes |
+
+**Key flags for `rmp init`:**
+- `--org <org>` -- reverse-DNS organization prefix (default: `com.example`)
+- `--ios / --no-ios` -- include/exclude iOS (default: included)
+- `--android / --no-android` -- include/exclude Android (default: included)
+- `--iced / --no-iced` -- include/exclude iced desktop (default: excluded)
+- `--flake` -- generate a Nix `flake.nix` dev shell
+- `--git` -- initialize a git repo and stage files
+
+### 8.2 Anatomy of a Scaffolded Project
+
+`rmp init my-app --org com.acme` generates a complete, working project:
+
+```
+my-app/
+├── rmp.toml                # Project config
+├── Cargo.toml              # Workspace (rust/ + uniffi-bindgen/ + optional desktop/)
+├── justfile                # Convenience recipes (doctor, bindings, run-ios, run-android)
+├── rust/
+│   ├── Cargo.toml          # crate-type = ["cdylib", "staticlib", "rlib"]
+│   ├── uniffi.toml         # Kotlin package config
+│   └── src/lib.rs          # Starter FfiApp + AppState + AppAction + AppUpdate
+├── uniffi-bindgen/         # Binding generator binary
+├── ios/                    # SwiftUI app
+│   ├── project.yml         # XcodeGen definition
+│   ├── Info.plist
+│   └── Sources/
+│       ├── App.swift           # @main entry point
+│       ├── AppManager.swift    # @Observable bridge class
+│       └── ContentView.swift   # Starter UI
+├── android/                # Jetpack Compose app
+│   ├── build.gradle.kts
+│   ├── settings.gradle.kts
+│   └── app/src/main/java/com/acme/myapp/
+│       ├── MainActivity.kt
+│       ├── AppManager.kt       # Singleton bridge class
+│       └── ui/MainApp.kt       # Starter Compose UI
+└── desktop/iced/           # (only with --iced)
+    └── src/main.rs         # iced app using core directly
+```
+
+As projects mature, many teams move the desktop app to `crates/<name>-desktop/` to match monorepo conventions; the architecture and data flow stay the same.
+
+**The starter `rust/src/lib.rs`** includes a fully working implementation with:
+- `AppState { rev, greeting }` -- a single string field
+- `AppAction::SetName { name }` -- updates the greeting
+- `AppUpdate::FullState(AppState)` -- full snapshot on every change
+- `FfiApp` with constructor, `state()`, `dispatch()`, `listen_for_updates()`
+- `AppReconciler` callback interface
+- Actor thread with `flume` channels and `rev` counter
+
+The scaffold compiles and runs immediately on all platforms. The "hello world" demo shows bidirectional communication: the user enters a name on the native UI, it dispatches `SetName` to Rust, Rust updates the greeting, and the UI re-renders.
+
+### 8.3 From Scaffold to Real App
+
+After the scaffold runs:
+
+1. **Define your domain state.** Replace `greeting: String` with your actual data model in `AppState`. Add nested `uniffi::Record` types for complex domain objects.
+
+2. **Define your actions.** Replace `SetName` with your actual user intents in `AppAction`. Cover all screens and interactions.
+
+3. **Build the core loop.** Expand the `match` block in the actor thread (or extract `AppCore` for larger apps). Handle each action, mutate state, emit updates.
+
+4. **Regenerate bindings.** `rmp bindings all` after every Rust change.
+
+5. **Build your screens.** Each platform gets its own screen implementations that read from `AppState` and dispatch `AppAction`. Start with one platform and replicate to the others.
+
+6. **Add capabilities as needed.** Define callback interfaces for platform APIs, implement on each platform, inject into `FfiApp`.
+
+7. **Set up CI.** Add pre-merge lanes (Section 7.4) to catch regressions on each platform.
+
+### 8.4 Prerequisites and Environment Setup
+
+**Universal:**
+- Rust toolchain (stable) with cross-compilation targets
+- `just` (task runner)
+- `cargo-ndk` (Android cross-compilation)
+
+**iOS (macOS only):**
+- Xcode with iOS simulator runtimes
+- `xcodegen`
+
+**Android:**
+- Android SDK + NDK (28.2.x)
+- JDK 17
+- Gradle
+- An AVD (Android Virtual Device) for testing
+
+**Desktop:**
+- Linux: X11/Wayland + Vulkan/Mesa libraries
+- macOS: Xcode command line tools
+- Windows: MSVC toolchain (for future support)
+
+**Recommended:** Install everything via a Nix flake (`rmp init --flake`). This gives you a reproducible environment with one command: `nix develop`.
+
+`rmp doctor` checks for the minimum prerequisites and reports what is missing.
+
+### 8.5 Designing Your Domain
+
+This is the most important step before writing code. Map your app idea onto the RMP primitives.
+
+**Step 1: Define your state.** Walk through every screen of your app and list every piece of data it displays. That is your `AppState`.
+
+```rust
+// Todo app
+pub struct AppState {
+    pub rev: u64,
+    pub router: Router,
+    pub items: Vec<TodoItem>,
+    pub active_count: u32,
+    pub completed_count: u32,
+    pub current_filter: Filter,
+    pub editing: Option<u64>,
+    pub busy: BusyState,
+    pub toast: Option<String>,
+}
+
+// Fitness tracker
+pub struct AppState {
+    pub rev: u64,
+    pub router: Router,
+    pub current_session: Option<WorkoutSession>,
+    pub history: Vec<WorkoutSummary>,
+    pub weekly_stats: WeeklyStats,
+    pub active_timer_secs: u64,
+    pub busy: BusyState,
+    pub toast: Option<String>,
+}
+
+// Photo editor
+pub struct AppState {
+    pub rev: u64,
+    pub router: Router,
+    pub layers: Vec<Layer>,
+    pub selected_layer_id: Option<u64>,
+    pub active_tool: Tool,
+    pub can_undo: bool,
+    pub can_redo: bool,
+    pub processing: bool,
+    pub export_progress: Option<f32>,
+    pub toast: Option<String>,
+}
+```
+
+**Step 2: Define your actions.** What can the user *do*? Be specific and imperative.
+
+```rust
+// Todo app
+pub enum AppAction {
+    AddTodo { text: String },
+    ToggleTodo { id: u64 },
+    DeleteTodo { id: u64 },
+    SetFilter { filter: Filter },
+    ClearCompleted,
+    // lifecycle
+    Foregrounded,
+    ClearToast,
+}
+```
+
+**Step 3: Identify capability bridges.** What platform APIs does your app need?
+
+| App | Capability | Bridge Pattern |
+|-----|-----------|----------------|
+| Todo app | None needed | -- |
+| Fitness tracker | GPS | `LocationProvider` callback → `LocationUpdate` action |
+| Fitness tracker | Background tracking | `BackgroundTaskBridge` → iOS BGTask / Android WorkManager |
+| Photo editor | File picker | `FilePickerBridge` → native picker → `FileSelected` action |
+| Photo editor | Photo library | `PhotoLibraryBridge` → native gallery → `PhotoSelected` action |
+| Any app | Push notifications | `PushNotificationManager` → native APNs/FCM → `SetPushToken` action |
+
+**Step 4: Draw the state flow.** For each screen, trace the loop:
+```
+User taps "Add Todo"
+  → dispatch(AddTodo { text: "Buy milk" })
+  → Rust: items.push(TodoItem { id: next_id, text, done: false })
+  → Rust: active_count += 1
+  → emit FullState
+  → iOS/Android: list re-renders with new item
+```
+
+If you cannot draw this loop cleanly for every interaction, your state design needs work.
+
+**Step 5: Decide what stays native.** Apply the Section 1.5 checklist. The default is always "put it in Rust." Only go native when the checklist forces you to.
+
+**This exercise produces three artifacts before you write any code:**
+1. An `AppState` struct (even as pseudocode)
+2. An `AppAction` enum (even as a list on paper)
+3. A capability bridge inventory (even as bullet points)
+
+With these three artifacts, you can `rmp init`, replace the starter code, and start building.
+
+---
+
+## Part IX: Migration and Refactoring
+
+### 9.1 Lowering Logic from Native to Rust
+
+When you discover duplicated logic across platforms (and you will), the migration pattern is:
+
+1. **Add the Rust field.** Add a pre-computed field to `AppState` or the relevant nested type. Compute it in the actor when the underlying data changes.
+2. **Update native to use it.** Replace the native computation with a read from `state.newField`. Both platforms benefit simultaneously.
+3. **Remove native logic.** Delete the Swift extension, Kotlin utility function, or ViewState computation that is now redundant.
+4. **Regenerate bindings.** `rmp bindings all`.
+
+**Priority order for lowering (highest first):**
+1. **String formatting** (timestamps, display names, message previews) -- duplicated across all platforms, easy to move, immediate consistency win.
+2. **Validation** (key validation, input normalization) -- business logic that should never live in the UI layer.
+3. **Computed aggregates** (unread counts, active item counts, statistics) -- if native code computes these, they will diverge.
+4. **State machines** (recording state, upload progress, timer state) -- policy logic that belongs in the actor.
+5. **Feature flags and developer mode** -- if native code gates features, the gates will diverge.
+
+### 9.2 The Platform Parity Blueprint
+
+When one platform is ahead of another (common when iOS ships first and Android catches up), use this three-phase approach:
+
+**Phase 1: Lower logic to Rust.**
+Audit both platforms for duplicated parsing, validation, and formatting. Move everything that is not a platform capability into Rust. This phase improves *both* platforms, not just the lagging one. The iOS app gets cleaner too.
+
+**Phase 2: Native UI polish.**
+Now that business logic is shared, focus the lagging platform's native layer on UX quality. Apply platform design guidelines (Material Design 3 for Android, Human Interface Guidelines for iOS). Add ViewModel layers if needed. Address accessibility, transitions, edge-to-edge layout, adaptive layout for tablets/foldables.
+
+**Phase 3: Add missing features.**
+With shared Rust logic in place, adding features to the lagging platform is mostly native UI work. Each feature is: add a Compose/SwiftUI screen, wire it to existing Rust state and actions. This is dramatically faster than Phase 1 because the Rust foundation is already there.
+
+**Pika example:** Android was behind iOS. Phase 1 identified 12 pieces of logic to lower to Rust (message segments, timestamps, display strings, key validation, toast auto-dismiss, etc.). Phase 2 planned Material Design 3 adoption, ViewModel introduction, and accessibility improvements. Phase 3 listed 15+ missing features (typing indicators, reactions, media attachments, voice messages) that become straightforward once Phases 1-2 are done.
+
+### 9.3 Evolving the State Model
+
+As your app grows, `AppState` will evolve. Handle this carefully:
+
+**Adding fields:** New fields with default values are backward-compatible. The actor initializes them in `AppState::empty()` or equivalent. Native code that doesn't know about the field ignores it (after binding regeneration, it will be available).
+
+**Removing or renaming fields:** This is a breaking change. Regenerate bindings, update all platform code, and ship simultaneously.
+
+**State versioning:** For apps with persistent state, consider a `state_version: u64` field in your configuration or database schema. When the app starts with an older schema, the actor can migrate before emitting the first `AppUpdate`.
+
+**Granularity evolution:** When profiling shows full snapshots are a bottleneck:
+1. Add specific `AppUpdate` variants for high-frequency changes (e.g., `TimerTick`, `ScrollPositionChanged`).
+2. Keep `FullState` as the fallback for infrequent changes.
+3. Platform `reconcile()` methods handle each variant type independently.
+4. Never remove `FullState` -- it remains the catch-all and the simplest correctness guarantee.
+
+**FFI contract versioning:** UniFFI does not have built-in versioning. If you need to support multiple native app versions against different Rust core versions, maintain backward compatibility in `AppState` (add fields, don't remove them) or version the `FfiApp` constructor.
+
+---
+
+## Appendix: Research Scratchpad
+
+### Raw Findings and Open Questions
+
+**Pika Reference Implementation Structure:**
+```
+pika/
+├── rust/                  # Core crate: AppState, AppAction, AppUpdate, AppCore actor
+│   ├── src/
+│   │   ├── lib.rs         # FfiApp (UniFFI Object), callback interfaces, scaffolding
+│   │   ├── state.rs       # All FFI-visible state types
+│   │   ├── actions.rs     # AppAction enum (~50 variants)
+│   │   ├── updates.rs     # AppUpdate + internal CoreMsg/InternalEvent
+│   │   ├── route_projection.rs  # Mobile vs desktop navigation projection
+│   │   ├── external_signer.rs   # Callback interface for external signers
+│   │   ├── mdk_support.rs       # MLS library integration
+│   │   ├── logging.rs           # Platform-specific logging (oslog, paranoid-android)
+│   │   └── core/                # AppCore actor + domain modules
+│   ├── Cargo.toml         # crate-type = ["cdylib", "staticlib", "rlib"]
+│   └── uniffi.toml        # Kotlin package config
+├── uniffi-bindgen/        # Standalone binary for binding generation
+├── ios/
+│   ├── Sources/           # SwiftUI app (AppManager, ContentView, screens)
+│   ├── Bindings/          # UniFFI-generated Swift (checked into git)
+│   ├── Frameworks/        # PikaCore.xcframework, PikaNSE.xcframework
+│   └── project.yml        # XcodeGen
+├── android/
+│   └── app/src/main/java/
+│       ├── <package>/     # Kotlin app (AppManager, screens, bridges)
+│       └── <package>/rust/ # UniFFI-generated Kotlin (checked into git)
+├── crates/
+│   ├── pika-desktop/      # iced desktop app (direct Rust dep, no FFI)
+│   ├── rmp-cli/           # Scaffolding tool
+│   ├── pika-nse/          # Notification Service Extension crate
+│   └── ...
+├── rmp.toml               # RMP project config
+├── justfile               # Build orchestrator
+└── flake.nix              # Nix dev environment
+```
+
+**Key Architectural Decisions:**
+- UniFFI proc-macros only (no UDL files) — simpler, type-checked at compile time
+- Full state snapshots over granular diffs — MVP tradeoff for simplicity
+- Single FfiApp object as entry point — clean API surface
+- Generated bindings checked into git — builds don't require host compilation step every time
+- Separate Rust crate for NSE — memory/lifecycle constraints of notification extensions
+- No ViewModels on Android (current design) — Rust owns all state, Compose reads directly
+- Desktop skips FFI entirely — pure Rust-to-Rust, fastest path
+
+**Data Flow Diagram:**
+```
+┌─────────────────────────────────────────────────────────────┐
+│                     NATIVE UI LAYER                         │
+│  ┌──────────┐  ┌──────────────┐  ┌────────────────────┐    │
+│  │ SwiftUI  │  │ Compose      │  │ iced (direct Rust) │    │
+│  │ Views    │  │ Screens      │  │ Views              │    │
+│  └────┬─────┘  └──────┬───────┘  └────────┬───────────┘    │
+│       │               │                    │                │
+│  ┌────▼─────┐  ┌──────▼───────┐  ┌────────▼───────────┐    │
+│  │ AppMgr   │  │ AppMgr       │  │ AppMgr             │    │
+│  │ @Observable│ │ mutableState │  │ (direct)           │    │
+│  └────┬─────┘  └──────┬───────┘  └────────┬───────────┘    │
+│       │dispatch()      │dispatch()          │dispatch()     │
+├───────┼────────────────┼────────────────────┼───────────────┤
+│       │   UniFFI       │   UniFFI           │  Direct       │
+│       │   (Swift)      │   (Kotlin/JNA)     │  Rust call    │
+├───────┼────────────────┼────────────────────┼───────────────┤
+│       ▼                ▼                    ▼               │
+│  ┌──────────────────────────────────────────────────────┐   │
+│  │                    FfiApp                             │   │
+│  │  ┌────────────────────────────────────────────────┐  │   │
+│  │  │  flume channel (CoreMsg)                       │  │   │
+│  │  └──────────────────┬─────────────────────────────┘  │   │
+│  │                     ▼                                │   │
+│  │  ┌────────────────────────────────────────────────┐  │   │
+│  │  │  AppCore (single-threaded actor)               │  │   │
+│  │  │  - handle_message()                            │  │   │
+│  │  │  - mutate AppState                             │  │   │
+│  │  │  - emit AppUpdate                              │  │   │
+│  │  └──────────────────┬─────────────────────────────┘  │   │
+│  │                     │                                │   │
+│  │  ┌──────────────────▼─────────────────────────────┐  │   │
+│  │  │  Arc<RwLock<AppState>>                         │  │   │
+│  │  │  (shared_state for sync reads)                 │  │   │
+│  │  └────────────────────────────────────────────────┘  │   │
+│  │                     │                                │   │
+│  │  ┌──────────────────▼─────────────────────────────┐  │   │
+│  │  │  update_tx -> AppReconciler.reconcile(update)  │  │   │
+│  │  │  (callback to native, invoked on bg thread)    │  │   │
+│  │  └────────────────────────────────────────────────┘  │   │
+│  └──────────────────────────────────────────────────────┘   │
+│                     RUST CORE                               │
+└─────────────────────────────────────────────────────────────┘
+```
+
+**Build Pipeline Per Platform:**
+| Platform | Bindings | Rust Artifact | Platform Build | Final Output |
+|---|---|---|---|---|
+| iOS | UniFFI -> Swift + C header | Static lib (.a) per target | xcodebuild -create-xcframework -> xcodegen -> xcodebuild | .app / .ipa |
+| Android | UniFFI -> Kotlin | Shared lib (.so) via cargo-ndk | Gradle assembleDebug/Release | .apk |
+| Desktop | None (direct Rust dep) | Native binary | cargo run/build | Binary / .app+.dmg (macOS) |
+| CLI | None (direct Rust dep) | Native binary | cargo run/build | Binary |
+
+**Things That Belong in Rust (Examples from Pika):**
+- Message content parsing/formatting (ContentSegment enum)
+- Peer key validation/normalization
+- Timestamp formatting (`display_timestamp`) *(planned migration target; currently still formatted natively on mobile)*
+- Chat list display strings (`display_name`, `subtitle`, `last_message_preview`) *(planned migration target; currently still partially native-derived)*
+- First-unread-message tracking
+- Toast auto-dismiss timers
+- Voice recording state machine (but audio capture stays native)
+- Call duration display formatting
+- Developer mode flag
+- All MLS/crypto operations
+- All Nostr protocol operations
+- All networking and relay management
+- All persistence (SQLite/SQLCipher)
+- Navigation state (Router with screen_stack)
+
+**Things That Must Stay Native (Examples from Pika):**
+- Audio session routing (AVAudioSession / AudioManager)
+- Video capture/decode (VideoToolbox / MediaCodec)
+- Push notification lifecycle (NSE / FirebaseMessagingService)
+- QR code scanning (camera APIs)
+- Keychain / EncryptedSharedPreferences
+- External signer intent handling (Amber on Android)
+- Haptic feedback
+- System share sheet
+- Clipboard access
+
+**Key Dependencies for an RMP Project:**
+- `uniffi` (0.31.x) — FFI binding generation
+- `flume` — MPSC channels for actor message passing
+- `tokio` — Async runtime for I/O
+- `rusqlite` + `libsqlite3-sys` (bundled-sqlcipher) — Encrypted storage
+- `tracing` — Structured logging
+- `tracing-oslog` (iOS) / `paranoid-android` (Android) — Platform logging
+- `serde` + `serde_json` — Serialization
+- `cargo-ndk` — Android cross-compilation tool
+- `xcodegen` — iOS project generation
+- JNA 5.18.x (Android) — Java Native Access for UniFFI
+
+**Open Research Questions:**
+- [ ] How should Windows desktop builds work? (Currently no Windows target in the project)
+- [ ] What's the best approach for Linux desktop distribution? (AppImage, Flatpak, etc.)
+- [ ] How to handle platform-specific UI testing for the Rust layer?
+- [ ] What's the performance ceiling of full-state snapshots? When does granular become necessary?
+- [ ] How to handle background processing differently per platform? (iOS BGAppRefreshTask, Android WorkManager, Desktop always-on)
+- [ ] What's the recommended approach for platform-specific deep linking through the Rust router?
+- [ ] How should accessibility semantics be handled across the FFI boundary?
+- [ ] What's the story for WebAssembly as a target? (pikachat-wasm crate exists but is scaffold status)
+- [ ] How to handle platform-specific permissions (camera, microphone, contacts) through the capability bridge?
+- [ ] What's the recommended testing strategy for the FFI boundary itself?
+- [ ] How should feature flags work across the Rust/native boundary?
+- [ ] What's the upgrade/migration story for AppState schema changes across app versions?
+- [ ] How to handle platform-specific analytics/telemetry through the capability bridge?
+- [ ] What about hot reload / fast iteration during development? (Rust compile times)
+- [ ] How should platform-specific assets (icons, images, colors) be coordinated with Rust state?
diff --git a/native/rmp-cli/Cargo.lock b/native/rmp-cli/Cargo.lock
new file mode 100644
index 00000000..2d11acde
--- /dev/null
+++ b/native/rmp-cli/Cargo.lock
@@ -0,0 +1,677 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "anstream"
+version = "0.6.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43d5b281e737544384e969a5ccad3f1cdd24b48086a0fc1b2a5262a26b8f4f4a"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
+[[package]]
+name = "bitflags"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "clap"
+version = "4.5.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2797f34da339ce31042b27d23607e051786132987f595b02ba4f6a6dffb7030a"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.5.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24a241312cea5059b13574bb9b3861cabf758b879c15190b37b6d6fd63ab6876"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.5.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a92793da1a46a5f2a02a6f4c46c6496b28c43638adea8306fcb0caa1634f24e5"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a822ea5bc7590f9d40f1ba12c0dc3c2760f3482c6984db1573ad11031420831"
+
+[[package]]
+name = "colorchoice"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "getrandom"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139ef39800118c7683f2fd3c98c1b23c09ae076556b435f8e9064ae108aaeeec"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "wasip2",
+ "wasip3",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "indexmap"
+version = "2.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.16.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itoa"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "libc"
+version = "0.2.182"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6800badb6cb2082ffd7b6a67e6125bb39f18782f793520caee8cb8846be06112"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "log"
+version = "0.4.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+
+[[package]]
+name = "memchr"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+
+[[package]]
+name = "once_cell"
+version = "1.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "rmp-cli"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "clap",
+ "serde",
+ "serde_json",
+ "tempfile",
+ "thiserror",
+ "toml",
+ "walkdir",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys",
+]
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.149"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82a72c767771b47409d2345987fda8628641887d5466101319899796367354a0"
+dependencies = [
+ "fastrand",
+ "getrandom",
+ "once_cell",
+ "rustix",
+ "windows-sys",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "toml"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_edit",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.22.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_write",
+ "winnow",
+]
+
+[[package]]
+name = "toml_write"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "wasip2"
+version = "1.0.2+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.15.5",
+ "indexmap",
+ "semver",
+]
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "winnow"
+version = "0.7.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/native/rmp-cli/Cargo.toml b/native/rmp-cli/Cargo.toml
new file mode 100644
index 00000000..097b868a
--- /dev/null
+++ b/native/rmp-cli/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "rmp-cli"
+version = "0.1.0"
+edition = "2021"
+publish = false
+
+[[bin]]
+name = "rmp"
+path = "src/main.rs"
+
+[dependencies]
+anyhow = "1"
+clap = { version = "4.5", features = ["derive"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+thiserror = "2"
+toml = "0.8"
+tempfile = "3"
+walkdir = "2"
diff --git a/native/rmp-cli/README.md b/native/rmp-cli/README.md
new file mode 100644
index 00000000..1ab8cbaf
--- /dev/null
+++ b/native/rmp-cli/README.md
@@ -0,0 +1,20 @@
+# rmp-cli
+
+`rmp-cli` is the Rust Multiplatform orchestration CLI used for scaffolding and running RMP app templates.
+
+## Docs
+
+- RMP architecture and ownership model: [`../../docs/rmp.md`](../../docs/rmp.md)
+- RMP CI lanes and nightly checks: [`../../docs/rmp-ci.md`](../../docs/rmp-ci.md)
+- Repo architecture overview: [`../../docs/architecture.md`](../../docs/architecture.md)
+
+## Purpose
+
+The CLI is intentionally operational:
+
+- scaffold project layouts (`rmp init`)
+- run health checks (`rmp doctor`)
+- generate/bind platform glue (`rmp bindings ...`)
+- run target apps (`rmp run ios|android|iced`)
+
+Business logic and state for generated apps should stay in Rust core crates; platform code should follow the adapter-window model in `docs/rmp.md`.
diff --git a/native/rmp-cli/src/bindings.rs b/native/rmp-cli/src/bindings.rs
new file mode 100644
index 00000000..83e5163b
--- /dev/null
+++ b/native/rmp-cli/src/bindings.rs
@@ -0,0 +1,1235 @@
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+
+use walkdir::WalkDir;
+
+use crate::cli::{human_log, json_print, CliError, JsonOk};
+use crate::config::{load_rmp_toml, RmpToml};
+use crate::util::{apply_cargo_features, discover_xcode_dev_dir, run_capture, which};
+
+const BINDGEN_HASH_FILE_PREFIX: &str = "target/.rmp-bindgen-hash";
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum BuildProfile {
+    Debug,
+    Release,
+}
+
+impl BuildProfile {
+    fn cargo_dir(self) -> &'static str {
+        match self {
+            Self::Debug => "debug",
+            Self::Release => "release",
+        }
+    }
+
+    fn cargo_release_arg(self) -> Option<&'static str> {
+        match self {
+            Self::Debug => None,
+            Self::Release => Some("--release"),
+        }
+    }
+
+    fn display(self) -> &'static str {
+        match self {
+            Self::Debug => "debug",
+            Self::Release => "release",
+        }
+    }
+}
+
+pub fn build_swift_for_run(
+    root: &Path,
+    rust_target: &str,
+    profile: BuildProfile,
+    verbose: bool,
+) -> Result<(), CliError> {
+    let cfg = load_rmp_toml(root)?;
+    let _ = cfg
+        .ios
+        .as_ref()
+        .ok_or_else(|| CliError::user("rmp.toml missing [ios] section"))?;
+    let core_pkg = cfg.core.crate_.clone();
+    let core_lib = core_pkg.replace('-', "_");
+    generate_ios_sources(root, &cfg, profile, true, verbose)?;
+    let macos_target = host_macos_target()?;
+    build_ios_xcframework(
+        root,
+        &core_lib,
+        &core_pkg,
+        &[rust_target, macos_target],
+        profile,
+        verbose,
+    )
+}
+
+pub fn build_kotlin_for_run(
+    root: &Path,
+    abi: &str,
+    profile: BuildProfile,
+    verbose: bool,
+) -> Result<(), CliError> {
+    let cfg = load_rmp_toml(root)?;
+    let _ = cfg
+        .android
+        .as_ref()
+        .ok_or_else(|| CliError::user("rmp.toml missing [android] section"))?;
+    let core_pkg = cfg.core.crate_.clone();
+    generate_android_sources(root, &cfg, profile, true, verbose)?;
+    build_android_so(root, &core_pkg, &[abi], profile, verbose)
+}
+
+fn default_ios_targets() -> [&'static str; 2] {
+    ["aarch64-apple-ios", "aarch64-apple-ios-sim"]
+}
+
+fn host_macos_target() -> Result<&'static str, CliError> {
+    match std::env::consts::ARCH {
+        "aarch64" => Ok("aarch64-apple-darwin"),
+        "x86_64" => Ok("x86_64-apple-darwin"),
+        arch => Err(CliError::operational(format!(
+            "unsupported host arch for macOS builds: {arch}"
+        ))),
+    }
+}
+
+fn default_macos_targets() -> Result<Vec<&'static str>, CliError> {
+    if std::env::var_os("RMP_SWIFT_UNIVERSAL_MACOS").is_some() {
+        return Ok(vec!["aarch64-apple-darwin", "x86_64-apple-darwin"]);
+    }
+
+    Ok(vec![host_macos_target()?])
+}
+
+fn default_apple_targets() -> Result<Vec<&'static str>, CliError> {
+    let mut targets = default_ios_targets().to_vec();
+    targets.extend(default_macos_targets()?);
+    Ok(targets)
+}
+
+fn default_android_abis() -> [&'static str; 3] {
+    ["arm64-v8a", "armeabi-v7a", "x86_64"]
+}
+
+pub fn bindings(
+    root: &Path,
+    json: bool,
+    verbose: bool,
+    args: crate::cli::BindingsArgs,
+) -> Result<(), CliError> {
+    let cfg = load_rmp_toml(root)?;
+    let core_pkg = cfg.core.crate_.clone();
+    let core_lib = core_pkg.replace('-', "_");
+
+    let ios = cfg.ios.clone();
+    let android = cfg.android.clone();
+    let profile = BuildProfile::Release;
+
+    match args.target {
+        crate::cli::BindingsTarget::Swift => {
+            let _ = ios.ok_or_else(|| CliError::user("rmp.toml missing [ios] section"))?;
+            let apple_targets = default_apple_targets()?;
+            if args.clean {
+                clean_ios(root, verbose)?;
+            }
+            if args.check {
+                check_ios_sources(root, &cfg, verbose)?;
+            } else {
+                generate_ios_sources(root, &cfg, profile, false, verbose)?;
+            }
+            build_ios_xcframework(root, &core_lib, &core_pkg, &apple_targets, profile, verbose)?;
+        }
+        crate::cli::BindingsTarget::Kotlin => {
+            let _ = android.ok_or_else(|| CliError::user("rmp.toml missing [android] section"))?;
+            if args.clean {
+                clean_android(root, verbose)?;
+            }
+            if args.check {
+                check_android_sources(root, &cfg, verbose)?;
+            } else {
+                generate_android_sources(root, &cfg, profile, false, verbose)?;
+            }
+            build_android_so(root, &core_pkg, &default_android_abis(), profile, verbose)?;
+        }
+        crate::cli::BindingsTarget::All => {
+            let _ = ios.ok_or_else(|| CliError::user("rmp.toml missing [ios] section"))?;
+            let _ = android.ok_or_else(|| CliError::user("rmp.toml missing [android] section"))?;
+            let apple_targets = default_apple_targets()?;
+            if args.clean {
+                clean_ios(root, verbose)?;
+                clean_android(root, verbose)?;
+            }
+            if args.check {
+                check_ios_sources(root, &cfg, verbose)?;
+                check_android_sources(root, &cfg, verbose)?;
+            } else {
+                generate_ios_sources(root, &cfg, profile, false, verbose)?;
+                generate_android_sources(root, &cfg, profile, false, verbose)?;
+            }
+            build_ios_xcframework(root, &core_lib, &core_pkg, &apple_targets, profile, verbose)?;
+            build_android_so(root, &core_pkg, &default_android_abis(), profile, verbose)?;
+        }
+    }
+
+    if json {
+        json_print(&JsonOk {
+            ok: true,
+            data: serde_json::json!({}),
+        });
+    }
+
+    Ok(())
+}
+
+fn host_cdylib_path(
+    root: &Path,
+    core_lib: &str,
+    profile: BuildProfile,
+) -> Result<PathBuf, CliError> {
+    let target = root.join(format!("target/{}", profile.cargo_dir()));
+    let candidates = [
+        target.join(format!("lib{core_lib}.dylib")),
+        target.join(format!("lib{core_lib}.so")),
+        target.join(format!("{core_lib}.dll")),
+    ];
+    for p in candidates {
+        if p.is_file() {
+            return Ok(p);
+        }
+    }
+    Err(CliError::operational(format!(
+        "missing built host cdylib (expected target/{}/lib{core_lib}.*)",
+        profile.cargo_dir()
+    )))
+}
+
+fn cargo_build_host(
+    root: &Path,
+    core_pkg: &str,
+    profile: BuildProfile,
+    verbose: bool,
+) -> Result<(), CliError> {
+    if which("cargo").is_none() {
+        return Err(CliError::operational("missing `cargo` on PATH"));
+    }
+    human_log(
+        verbose,
+        format!("cargo build -p {core_pkg} (host, {})", profile.display()),
+    );
+    let mut cmd = Command::new("cargo");
+    cmd.current_dir(root).arg("build").arg("-p").arg(core_pkg);
+    if let Some(flag) = profile.cargo_release_arg() {
+        cmd.arg(flag);
+    }
+    apply_cargo_features(&mut cmd);
+    let status = cmd
+        .stdout(Stdio::inherit())
+        .stderr(Stdio::inherit())
+        .status()
+        .map_err(|e| CliError::operational(format!("failed to run cargo: {e}")))?;
+    if !status.success() {
+        return Err(CliError::operational("cargo build failed"));
+    }
+    Ok(())
+}
+
+fn generate_ios_sources(
+    root: &Path,
+    cfg: &RmpToml,
+    profile: BuildProfile,
+    use_cache: bool,
+    verbose: bool,
+) -> Result<(), CliError> {
+    let core_pkg = cfg.core.crate_.as_str();
+    let core_lib = cfg.core.crate_.replace('-', "_");
+    let out_dir = root.join("ios/Bindings");
+    std::fs::create_dir_all(&out_dir)
+        .map_err(|e| CliError::operational(format!("failed to create ios/Bindings: {e}")))?;
+    if use_cache && bindgen_cache_hit(root, swift_bindings_present(root)?, "swift", verbose)? {
+        return Ok(());
+    }
+    cargo_build_host(root, core_pkg, profile, verbose)?;
+    let lib = host_cdylib_path(root, &core_lib, profile)?;
+
+    human_log(verbose, "uniffi-bindgen generate (swift)");
+    let status = Command::new("cargo")
+        .current_dir(root)
+        .arg("run")
+        .arg("-q")
+        .arg("-p")
+        .arg("uniffi-bindgen")
+        .arg("--")
+        .arg("generate")
+        .arg("--library")
+        .arg(lib)
+        .arg("--language")
+        .arg("swift")
+        .arg("--out-dir")
+        .arg(&out_dir)
+        .arg("--config")
+        .arg(uniffi_toml_path(root)?)
+        .stdout(Stdio::inherit())
+        .stderr(Stdio::inherit())
+        .status()
+        .map_err(|e| CliError::operational(format!("failed to run uniffi-bindgen: {e}")))?;
+    if !status.success() {
+        return Err(CliError::operational("uniffi swift generation failed"));
+    }
+    if use_cache {
+        write_bindgen_hash(root, "swift")?;
+    }
+    Ok(())
+}
+
+fn generate_android_sources(
+    root: &Path,
+    cfg: &RmpToml,
+    profile: BuildProfile,
+    use_cache: bool,
+    verbose: bool,
+) -> Result<(), CliError> {
+    let core_pkg = cfg.core.crate_.as_str();
+    let core_lib = cfg.core.crate_.replace('-', "_");
+    let out_dir = root.join("android/app/src/main/java");
+    std::fs::create_dir_all(&out_dir)
+        .map_err(|e| CliError::operational(format!("failed to create android java dir: {e}")))?;
+    if use_cache && bindgen_cache_hit(root, kotlin_bindings_present(root)?, "kotlin", verbose)? {
+        return Ok(());
+    }
+    cargo_build_host(root, core_pkg, profile, verbose)?;
+    let lib = host_cdylib_path(root, &core_lib, profile)?;
+
+    human_log(verbose, "uniffi-bindgen generate (kotlin)");
+    let status = Command::new("cargo")
+        .current_dir(root)
+        .arg("run")
+        .arg("-q")
+        .arg("-p")
+        .arg("uniffi-bindgen")
+        .arg("--")
+        .arg("generate")
+        .arg("--library")
+        .arg(lib)
+        .arg("--language")
+        .arg("kotlin")
+        .arg("--out-dir")
+        .arg(&out_dir)
+        .arg("--no-format")
+        .arg("--config")
+        .arg(uniffi_toml_path(root)?)
+        .stdout(Stdio::inherit())
+        .stderr(Stdio::inherit())
+        .status()
+        .map_err(|e| CliError::operational(format!("failed to run uniffi-bindgen: {e}")))?;
+    if !status.success() {
+        return Err(CliError::operational("uniffi kotlin generation failed"));
+    }
+    if use_cache {
+        write_bindgen_hash(root, "kotlin")?;
+    }
+    Ok(())
+}
+
+fn clean_ios(root: &Path, verbose: bool) -> Result<(), CliError> {
+    human_log(verbose, "clean ios bindings + build outputs");
+    let bindings = root.join("ios/Bindings");
+    if bindings.is_dir() {
+        for ent in std::fs::read_dir(&bindings).map_err(|e| {
+            CliError::operational(format!("failed to read {}: {e}", bindings.display()))
+        })? {
+            let ent =
+                ent.map_err(|e| CliError::operational(format!("failed to read dir entry: {e}")))?;
+            let p = ent.path();
+            if !p.is_file() {
+                continue;
+            }
+            let name = p.file_name().and_then(|v| v.to_str()).unwrap_or("");
+            if name == ".gitkeep" {
+                continue;
+            }
+            if name.ends_with(".swift")
+                || name.ends_with("FFI.h")
+                || name.ends_with("FFI.modulemap")
+            {
+                let _ = std::fs::remove_file(p);
+            }
+        }
+    }
+    let _ = std::fs::remove_dir_all(root.join("ios/.build"));
+    let _ = std::fs::remove_dir_all(root.join("ios/Frameworks"));
+    let _ = std::fs::remove_file(bindgen_hash_path(root, "swift"));
+    Ok(())
+}
+
+fn clean_android(root: &Path, verbose: bool) -> Result<(), CliError> {
+    human_log(verbose, "clean android bindings + jniLibs");
+    let _ = std::fs::remove_dir_all(kotlin_bindings_dir(root)?);
+    let _ = std::fs::remove_dir_all(root.join("android/app/src/main/jniLibs"));
+    let _ = std::fs::remove_file(bindgen_hash_path(root, "kotlin"));
+    Ok(())
+}
+
+fn check_ios_sources(root: &Path, cfg: &RmpToml, verbose: bool) -> Result<(), CliError> {
+    use tempfile::TempDir;
+
+    let core_pkg = cfg.core.crate_.as_str();
+    let core_lib = cfg.core.crate_.replace('-', "_");
+    cargo_build_host(root, core_pkg, BuildProfile::Release, verbose)?;
+    let lib = host_cdylib_path(root, &core_lib, BuildProfile::Release)?;
+    let tmp = TempDir::new().map_err(|e| CliError::operational(format!("tempdir: {e}")))?;
+    let out_dir = tmp.path().join("Bindings");
+    std::fs::create_dir_all(&out_dir)
+        .map_err(|e| CliError::operational(format!("failed to create temp out dir: {e}")))?;
+
+    let status = Command::new("cargo")
+        .current_dir(root)
+        .arg("run")
+        .arg("-q")
+        .arg("-p")
+        .arg("uniffi-bindgen")
+        .arg("--")
+        .arg("generate")
+        .arg("--library")
+        .arg(lib)
+        .arg("--language")
+        .arg("swift")
+        .arg("--out-dir")
+        .arg(&out_dir)
+        .arg("--config")
+        .arg(uniffi_toml_path(root)?)
+        .stdout(Stdio::inherit())
+        .stderr(Stdio::inherit())
+        .status()
+        .map_err(|e| CliError::operational(format!("failed to run uniffi-bindgen: {e}")))?;
+    if !status.success() {
+        return Err(CliError::operational("uniffi swift generation failed"));
+    }
+
+    let want = out_dir;
+    let have = root.join("ios/Bindings");
+    diff_dir(&have, &want, &[".gitkeep"])?;
+    Ok(())
+}
+
+fn check_android_sources(root: &Path, cfg: &RmpToml, verbose: bool) -> Result<(), CliError> {
+    use tempfile::TempDir;
+
+    let core_pkg = cfg.core.crate_.as_str();
+    let core_lib = cfg.core.crate_.replace('-', "_");
+    cargo_build_host(root, core_pkg, BuildProfile::Release, verbose)?;
+    let lib = host_cdylib_path(root, &core_lib, BuildProfile::Release)?;
+    let tmp = TempDir::new().map_err(|e| CliError::operational(format!("tempdir: {e}")))?;
+    let out_dir = tmp.path().join("java");
+    std::fs::create_dir_all(&out_dir)
+        .map_err(|e| CliError::operational(format!("failed to create temp out dir: {e}")))?;
+
+    let status = Command::new("cargo")
+        .current_dir(root)
+        .arg("run")
+        .arg("-q")
+        .arg("-p")
+        .arg("uniffi-bindgen")
+        .arg("--")
+        .arg("generate")
+        .arg("--library")
+        .arg(lib)
+        .arg("--language")
+        .arg("kotlin")
+        .arg("--out-dir")
+        .arg(&out_dir)
+        .arg("--no-format")
+        .arg("--config")
+        .arg(uniffi_toml_path(root)?)
+        .stdout(Stdio::inherit())
+        .stderr(Stdio::inherit())
+        .status()
+        .map_err(|e| CliError::operational(format!("failed to run uniffi-bindgen: {e}")))?;
+    if !status.success() {
+        return Err(CliError::operational("uniffi kotlin generation failed"));
+    }
+
+    let rel = kotlin_bindings_relpath(root)?;
+    let want = out_dir.join(&rel);
+    let have = root.join("android/app/src/main/java").join(&rel);
+    diff_dir(&have, &want, &[])?;
+    Ok(())
+}
+
+fn diff_dir(have: &Path, want: &Path, ignore: &[&str]) -> Result<(), CliError> {
+    let mut mismatches: Vec<String> = vec![];
+
+    let mut want_files: Vec<PathBuf> = vec![];
+    for ent in WalkDir::new(want).into_iter().flatten() {
+        if !ent.file_type().is_file() {
+            continue;
+        }
+        let rel = ent.path().strip_prefix(want).unwrap().to_path_buf();
+        if ignore.iter().any(|i| Path::new(i) == rel) {
+            continue;
+        }
+        want_files.push(rel);
+    }
+
+    let mut have_files: Vec<PathBuf> = vec![];
+    for ent in WalkDir::new(have).into_iter().flatten() {
+        if !ent.file_type().is_file() {
+            continue;
+        }
+        let rel = ent.path().strip_prefix(have).unwrap().to_path_buf();
+        if ignore.iter().any(|i| Path::new(i) == rel) {
+            continue;
+        }
+        have_files.push(rel);
+    }
+
+    want_files.sort();
+    have_files.sort();
+
+    for rel in want_files.iter() {
+        let w = std::fs::read(want.join(rel)).unwrap_or_default();
+        let h = std::fs::read(have.join(rel)).unwrap_or_default();
+        if w != h {
+            mismatches.push(rel.to_string_lossy().to_string());
+        }
+    }
+    for rel in have_files.iter() {
+        if !want_files.contains(rel) {
+            mismatches.push(format!("extra: {}", rel.to_string_lossy()));
+        }
+    }
+
+    if !mismatches.is_empty() {
+        return Err(
+            CliError::operational("bindings --check failed (generated outputs differ)")
+                .with_detail("files", serde_json::json!(mismatches)),
+        );
+    }
+    Ok(())
+}
+
+fn build_ios_xcframework(
+    root: &Path,
+    core_lib: &str,
+    core_pkg: &str,
+    targets: &[&str],
+    profile: BuildProfile,
+    verbose: bool,
+) -> Result<(), CliError> {
+    if targets.is_empty() {
+        return Err(CliError::user("no iOS Rust target selected"));
+    }
+    let dev_dir = discover_xcode_dev_dir()?;
+
+    // Build Rust static libs for the selected iOS targets.
+    build_apple_staticlibs(root, &dev_dir, core_pkg, targets, profile, verbose)?;
+
+    // Ensure headers exist from UniFFI swift generation.
+    let bindings_dir = root.join("ios/Bindings");
+    let hdr_name = format!("{core_lib}FFI.h");
+    let mm_name = format!("{core_lib}FFI.modulemap");
+    let hdr = bindings_dir.join(&hdr_name);
+    let mm = bindings_dir.join(&mm_name);
+    if !hdr.is_file() || !mm.is_file() {
+        return Err(CliError::operational(
+            "missing ios/Bindings headers; run `rmp bindings swift` first",
+        ));
+    }
+
+    // Assemble xcframework.
+    let build_dir = root.join("ios/.build");
+    let headers_dir = build_dir.join(format!("headers/{core_lib}FFI"));
+    let frameworks_dir = root.join("ios/Frameworks");
+    let _ = std::fs::remove_dir_all(&build_dir);
+    let _ = std::fs::remove_dir_all(&frameworks_dir);
+    std::fs::create_dir_all(&headers_dir)
+        .map_err(|e| CliError::operational(format!("failed to create ios/.build: {e}")))?;
+    std::fs::create_dir_all(&frameworks_dir)
+        .map_err(|e| CliError::operational(format!("failed to create ios/Frameworks: {e}")))?;
+
+    std::fs::copy(&hdr, headers_dir.join(&hdr_name))
+        .map_err(|e| CliError::operational(format!("copy header: {e}")))?;
+    std::fs::copy(&mm, headers_dir.join("module.modulemap"))
+        .map_err(|e| CliError::operational(format!("copy modulemap: {e}")))?;
+
+    let mut selected: Vec<&str> = Vec::with_capacity(targets.len());
+    for target in targets {
+        if !selected.contains(target) {
+            selected.push(*target);
+        }
+    }
+
+    let mut libraries: Vec<PathBuf> = vec![];
+    let has_sim_arm64 = selected.contains(&"aarch64-apple-ios-sim");
+    let has_sim_x86_64 = selected.contains(&"x86_64-apple-ios");
+    if has_sim_arm64 && has_sim_x86_64 {
+        let sim_a = build_dir.join(format!("lib{core_lib}_sim.a"));
+        let status = Command::new("/usr/bin/xcrun")
+            .env("DEVELOPER_DIR", &dev_dir)
+            .arg("lipo")
+            .arg("-create")
+            .arg(ios_staticlib_path(
+                root,
+                "aarch64-apple-ios-sim",
+                core_lib,
+                profile,
+            ))
+            .arg(ios_staticlib_path(
+                root,
+                "x86_64-apple-ios",
+                core_lib,
+                profile,
+            ))
+            .arg("-output")
+            .arg(&sim_a)
+            .stdout(Stdio::inherit())
+            .stderr(Stdio::inherit())
+            .status()
+            .map_err(|e| CliError::operational(format!("failed to run lipo: {e}")))?;
+        if !status.success() {
+            return Err(CliError::operational("lipo failed"));
+        }
+        libraries.push(sim_a);
+        selected.retain(|t| *t != "aarch64-apple-ios-sim" && *t != "x86_64-apple-ios");
+    }
+    let has_macos_arm64 = selected.contains(&"aarch64-apple-darwin");
+    let has_macos_x86_64 = selected.contains(&"x86_64-apple-darwin");
+    if has_macos_arm64 && has_macos_x86_64 {
+        let macos_a = build_dir.join(format!("lib{core_lib}_macos.a"));
+        let status = Command::new("/usr/bin/xcrun")
+            .env("DEVELOPER_DIR", &dev_dir)
+            .arg("lipo")
+            .arg("-create")
+            .arg(macos_staticlib_path(
+                root,
+                "aarch64-apple-darwin",
+                core_lib,
+                profile,
+            ))
+            .arg(macos_staticlib_path(
+                root,
+                "x86_64-apple-darwin",
+                core_lib,
+                profile,
+            ))
+            .arg("-output")
+            .arg(&macos_a)
+            .stdout(Stdio::inherit())
+            .stderr(Stdio::inherit())
+            .status()
+            .map_err(|e| CliError::operational(format!("failed to run lipo: {e}")))?;
+        if !status.success() {
+            return Err(CliError::operational("lipo failed"));
+        }
+        libraries.push(macos_a);
+        selected.retain(|t| *t != "aarch64-apple-darwin" && *t != "x86_64-apple-darwin");
+    }
+    for target in selected {
+        libraries.push(apple_staticlib_path(root, target, core_lib, profile));
+    }
+
+    let xcf_name = pascal_case(core_lib);
+    let out_xcf = frameworks_dir.join(format!("{xcf_name}.xcframework"));
+    let mut cmd = Command::new("/usr/bin/xcrun");
+    cmd.env("DEVELOPER_DIR", &dev_dir)
+        .arg("xcodebuild")
+        .arg("-create-xcframework");
+    for lib in &libraries {
+        cmd.arg("-library")
+            .arg(lib)
+            .arg("-headers")
+            .arg(&headers_dir);
+    }
+    cmd.arg("-output").arg(&out_xcf);
+    let status = cmd
+        .stdout(Stdio::inherit())
+        .stderr(Stdio::inherit())
+        .status()
+        .map_err(|e| {
+            CliError::operational(format!("failed to run xcodebuild -create-xcframework: {e}"))
+        })?;
+    if !status.success() {
+        return Err(CliError::operational(
+            "xcodebuild -create-xcframework failed",
+        ));
+    }
+
+    Ok(())
+}
+
+fn build_apple_staticlibs(
+    root: &Path,
+    dev_dir: &Path,
+    core_pkg: &str,
+    targets: &[&str],
+    profile: BuildProfile,
+    verbose: bool,
+) -> Result<(), CliError> {
+    let (ios_targets, macos_targets): (Vec<&str>, Vec<&str>) = targets
+        .iter()
+        .copied()
+        .partition(|target| is_ios_target(target));
+
+    if !ios_targets.is_empty() {
+        build_ios_staticlibs(root, dev_dir, core_pkg, &ios_targets, profile, verbose)?;
+    }
+
+    if !macos_targets.is_empty() {
+        build_macos_staticlibs(root, dev_dir, core_pkg, &macos_targets, profile, verbose)?;
+    }
+
+    Ok(())
+}
+
+fn is_ios_target(target: &str) -> bool {
+    matches!(
+        target,
+        "aarch64-apple-ios" | "aarch64-apple-ios-sim" | "x86_64-apple-ios"
+    )
+}
+
+fn build_ios_staticlibs(
+    root: &Path,
+    dev_dir: &Path,
+    core_pkg: &str,
+    targets: &[&str],
+    profile: BuildProfile,
+    verbose: bool,
+) -> Result<(), CliError> {
+    if which("cargo").is_none() {
+        return Err(CliError::operational("missing `cargo` on PATH"));
+    }
+    if targets.is_empty() {
+        return Err(CliError::user("no iOS Rust target selected"));
+    }
+
+    // Replicate `just ios-rust` env behavior.
+    let toolchain_bin = dev_dir.join("Toolchains/XcodeDefault.xctoolchain/usr/bin");
+    let cc = toolchain_bin.join("clang");
+    let cxx = toolchain_bin.join("clang++");
+    let ar = toolchain_bin.join("ar");
+    let ranlib = toolchain_bin.join("ranlib");
+    let ios_min = "17.0";
+
+    // sdk roots
+    let sdk_ios = {
+        let mut cmd = Command::new("/usr/bin/xcrun");
+        cmd.env("DEVELOPER_DIR", dev_dir)
+            .arg("--sdk")
+            .arg("iphoneos")
+            .arg("--show-sdk-path");
+        let out = run_capture(cmd)?;
+        if !out.status.success() {
+            return Err(CliError::operational(
+                "xcrun --sdk iphoneos --show-sdk-path failed",
+            ));
+        }
+        String::from_utf8_lossy(&out.stdout).trim().to_string()
+    };
+    let sdk_sim = {
+        let mut cmd = Command::new("/usr/bin/xcrun");
+        cmd.env("DEVELOPER_DIR", dev_dir)
+            .arg("--sdk")
+            .arg("iphonesimulator")
+            .arg("--show-sdk-path");
+        let out = run_capture(cmd)?;
+        if !out.status.success() {
+            return Err(CliError::operational(
+                "xcrun --sdk iphonesimulator --show-sdk-path failed",
+            ));
+        }
+        String::from_utf8_lossy(&out.stdout).trim().to_string()
+    };
+
+    human_log(
+        verbose,
+        format!("cargo build (iOS staticlib, profile={})", profile.display()),
+    );
+    for target in targets {
+        let (sdkroot, min_flag) = match *target {
+            "aarch64-apple-ios" => (sdk_ios.as_str(), "-miphoneos-version-min="),
+            "aarch64-apple-ios-sim" | "x86_64-apple-ios" => {
+                (sdk_sim.as_str(), "-mios-simulator-version-min=")
+            }
+            _ => {
+                return Err(CliError::user(format!(
+                    "unsupported iOS Rust target: {target}"
+                )))
+            }
+        };
+        let mut cmd = Command::new("cargo");
+        cmd.current_dir(root)
+            .arg("build")
+            .arg("-p")
+            .arg(core_pkg)
+            .arg("--lib")
+            .arg("--target")
+            .arg(target);
+        if let Some(flag) = profile.cargo_release_arg() {
+            cmd.arg(flag);
+        }
+        apply_cargo_features(&mut cmd);
+
+        // Clean out Nix/toolchain vars that break iOS builds.
+        for k in [
+            "LIBRARY_PATH",
+            "SDKROOT",
+            "MACOSX_DEPLOYMENT_TARGET",
+            "CC",
+            "CXX",
+            "AR",
+            "RANLIB",
+            "LD",
+        ] {
+            cmd.env_remove(k);
+        }
+
+        cmd.env("DEVELOPER_DIR", dev_dir)
+            .env("CC", &cc)
+            .env("CXX", &cxx)
+            .env("AR", &ar)
+            .env("RANLIB", &ranlib)
+            .env("SDKROOT", sdkroot)
+            .env("IPHONEOS_DEPLOYMENT_TARGET", ios_min)
+            .env(
+                "RUSTFLAGS",
+                format!(
+                    "-C linker={} -C link-arg={}{}",
+                    cc.to_string_lossy(),
+                    min_flag,
+                    ios_min
+                ),
+            );
+
+        // Ensure linker is clang for relevant targets.
+        match *target {
+            "aarch64-apple-ios" => {
+                cmd.env("CARGO_TARGET_AARCH64_APPLE_IOS_LINKER", &cc);
+            }
+            "aarch64-apple-ios-sim" => {
+                cmd.env("CARGO_TARGET_AARCH64_APPLE_IOS_SIM_LINKER", &cc);
+            }
+            "x86_64-apple-ios" => {
+                cmd.env("CARGO_TARGET_X86_64_APPLE_IOS_LINKER", &cc);
+            }
+            _ => {}
+        }
+
+        let status = cmd
+            .stdout(Stdio::inherit())
+            .stderr(Stdio::inherit())
+            .status()
+            .map_err(|e| CliError::operational(format!("failed to run cargo for {target}: {e}")))?;
+        if !status.success() {
+            return Err(CliError::operational(format!(
+                "cargo build failed for target {target}"
+            )));
+        }
+    }
+
+    Ok(())
+}
+
+fn build_macos_staticlibs(
+    root: &Path,
+    dev_dir: &Path,
+    core_pkg: &str,
+    targets: &[&str],
+    profile: BuildProfile,
+    verbose: bool,
+) -> Result<(), CliError> {
+    if which("cargo").is_none() {
+        return Err(CliError::operational("missing `cargo` on PATH"));
+    }
+    if targets.is_empty() {
+        return Err(CliError::user("no macOS Rust target selected"));
+    }
+
+    let toolchain_bin = dev_dir.join("Toolchains/XcodeDefault.xctoolchain/usr/bin");
+    let cc = toolchain_bin.join("clang");
+    let cxx = toolchain_bin.join("clang++");
+    let ar = toolchain_bin.join("ar");
+    let ranlib = toolchain_bin.join("ranlib");
+    let macos_min = "26.0";
+
+    let sdk_macos = {
+        let mut cmd = Command::new("/usr/bin/xcrun");
+        cmd.env("DEVELOPER_DIR", dev_dir)
+            .arg("--sdk")
+            .arg("macosx")
+            .arg("--show-sdk-path");
+        let out = run_capture(cmd)?;
+        if !out.status.success() {
+            return Err(CliError::operational(
+                "xcrun --sdk macosx --show-sdk-path failed",
+            ));
+        }
+        String::from_utf8_lossy(&out.stdout).trim().to_string()
+    };
+
+    human_log(
+        verbose,
+        format!(
+            "cargo build (macOS staticlib, profile={})",
+            profile.display()
+        ),
+    );
+    for target in targets {
+        let linker_env = match *target {
+            "aarch64-apple-darwin" => "CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER",
+            "x86_64-apple-darwin" => "CARGO_TARGET_X86_64_APPLE_DARWIN_LINKER",
+            _ => {
+                return Err(CliError::user(format!(
+                    "unsupported macOS Rust target: {target}"
+                )))
+            }
+        };
+
+        let mut cmd = Command::new("cargo");
+        cmd.current_dir(root)
+            .arg("build")
+            .arg("-p")
+            .arg(core_pkg)
+            .arg("--lib")
+            .arg("--target")
+            .arg(target);
+        if let Some(flag) = profile.cargo_release_arg() {
+            cmd.arg(flag);
+        }
+        apply_cargo_features(&mut cmd);
+
+        for k in [
+            "LIBRARY_PATH",
+            "SDKROOT",
+            "MACOSX_DEPLOYMENT_TARGET",
+            "CC",
+            "CXX",
+            "AR",
+            "RANLIB",
+            "LD",
+        ] {
+            cmd.env_remove(k);
+        }
+
+        cmd.env("DEVELOPER_DIR", dev_dir)
+            .env("CC", &cc)
+            .env("CXX", &cxx)
+            .env("AR", &ar)
+            .env("RANLIB", &ranlib)
+            .env("SDKROOT", &sdk_macos)
+            .env("MACOSX_DEPLOYMENT_TARGET", macos_min)
+            .env(linker_env, &cc)
+            .env(
+                "RUSTFLAGS",
+                format!(
+                    "-C linker={} -C link-arg=-mmacosx-version-min={}",
+                    cc.to_string_lossy(),
+                    macos_min
+                ),
+            );
+
+        let status = cmd
+            .stdout(Stdio::inherit())
+            .stderr(Stdio::inherit())
+            .status()
+            .map_err(|e| CliError::operational(format!("failed to run cargo for {target}: {e}")))?;
+        if !status.success() {
+            return Err(CliError::operational(format!(
+                "cargo build failed for target {target}"
+            )));
+        }
+    }
+
+    Ok(())
+}
+
+fn build_android_so(
+    root: &Path,
+    core_pkg: &str,
+    abis: &[&str],
+    profile: BuildProfile,
+    verbose: bool,
+) -> Result<(), CliError> {
+    if abis.is_empty() {
+        return Err(CliError::user("no Android ABI selected"));
+    }
+    // Ensure local.properties so Gradle doesn't require Android Studio.
+    let sdk = std::env::var("ANDROID_HOME")
+        .ok()
+        .or_else(|| std::env::var("ANDROID_SDK_ROOT").ok())
+        .unwrap_or_default();
+    if !sdk.is_empty() {
+        let lp = root.join("android/local.properties");
+        let _ = std::fs::create_dir_all(root.join("android"));
+        let contents = format!("sdk.dir={}\n", sdk);
+        let _ = std::fs::write(lp, contents);
+    }
+
+    let out_dir = root.join("android/app/src/main/jniLibs");
+    // Clear old slices first so the package exactly matches the requested ABI set.
+    let _ = std::fs::remove_dir_all(&out_dir);
+    std::fs::create_dir_all(&out_dir)
+        .map_err(|e| CliError::operational(format!("failed to create jniLibs dir: {e}")))?;
+
+    human_log(
+        verbose,
+        format!(
+            "cargo ndk build (android .so, profile={}, abis={})",
+            profile.display(),
+            abis.join(",")
+        ),
+    );
+    let mut cmd = Command::new("cargo");
+    cmd.current_dir(root)
+        .arg("ndk")
+        .arg("-o")
+        .arg(&out_dir)
+        .arg("-P")
+        .arg("26");
+    for abi in abis {
+        cmd.arg("-t").arg(abi);
+    }
+    cmd.arg("build").arg("-p").arg(core_pkg);
+    if let Some(flag) = profile.cargo_release_arg() {
+        cmd.arg(flag);
+    }
+    apply_cargo_features(&mut cmd);
+    let status = cmd
+        .stdout(Stdio::inherit())
+        .stderr(Stdio::inherit())
+        .status()
+        .map_err(|e| CliError::operational(format!("failed to run cargo-ndk: {e}")))?;
+    if !status.success() {
+        return Err(CliError::operational("cargo ndk build failed"));
+    }
+
+    Ok(())
+}
+
+fn ios_staticlib_path(root: &Path, target: &str, core_lib: &str, profile: BuildProfile) -> PathBuf {
+    root.join(format!(
+        "target/{}/{}/lib{core_lib}.a",
+        target,
+        profile.cargo_dir()
+    ))
+}
+
+fn macos_staticlib_path(
+    root: &Path,
+    target: &str,
+    core_lib: &str,
+    profile: BuildProfile,
+) -> PathBuf {
+    root.join(format!(
+        "target/{}/{}/lib{core_lib}.a",
+        target,
+        profile.cargo_dir()
+    ))
+}
+
+fn apple_staticlib_path(
+    root: &Path,
+    target: &str,
+    core_lib: &str,
+    profile: BuildProfile,
+) -> PathBuf {
+    if is_ios_target(target) {
+        ios_staticlib_path(root, target, core_lib, profile)
+    } else {
+        macos_staticlib_path(root, target, core_lib, profile)
+    }
+}
+
+fn swift_bindings_present(root: &Path) -> Result<bool, CliError> {
+    let dir = root.join("ios/Bindings");
+    if !dir.is_dir() {
+        return Ok(false);
+    }
+    let mut has_swift = false;
+    let mut has_header = false;
+    let mut has_modulemap = false;
+    for ent in std::fs::read_dir(&dir)
+        .map_err(|e| CliError::operational(format!("failed to read {}: {e}", dir.display())))?
+    {
+        let ent =
+            ent.map_err(|e| CliError::operational(format!("failed to read dir entry: {e}")))?;
+        let p = ent.path();
+        if !p.is_file() {
+            continue;
+        }
+        let name = p.file_name().and_then(|v| v.to_str()).unwrap_or("");
+        if name.ends_with(".swift") {
+            has_swift = true;
+        } else if name.ends_with("FFI.h") {
+            has_header = true;
+        } else if name.ends_with("FFI.modulemap") {
+            has_modulemap = true;
+        }
+    }
+    Ok(has_swift && has_header && has_modulemap)
+}
+
+fn kotlin_bindings_present(root: &Path) -> Result<bool, CliError> {
+    let dir = kotlin_bindings_dir(root)?;
+    if !dir.is_dir() {
+        return Ok(false);
+    }
+    for ent in WalkDir::new(&dir).into_iter().flatten() {
+        if ent.file_type().is_file()
+            && ent
+                .path()
+                .extension()
+                .and_then(|v| v.to_str())
+                .is_some_and(|ext| ext == "kt")
+        {
+            return Ok(true);
+        }
+    }
+    Ok(false)
+}
+
+fn bindgen_cache_hit(
+    root: &Path,
+    outputs_present: bool,
+    key: &str,
+    verbose: bool,
+) -> Result<bool, CliError> {
+    if !outputs_present {
+        return Ok(false);
+    }
+    let hash = compute_bindgen_inputs_hash(root)?;
+    let cache_path = bindgen_hash_path(root, key);
+    let cached = std::fs::read_to_string(cache_path).ok();
+    let cached = cached.as_deref().map(str::trim);
+    if cached == Some(hash.as_str()) {
+        human_log(
+            verbose,
+            "bindgen cache hit; skipping host build + UniFFI generation",
+        );
+        return Ok(true);
+    }
+    Ok(false)
+}
+
+fn write_bindgen_hash(root: &Path, key: &str) -> Result<(), CliError> {
+    let hash = compute_bindgen_inputs_hash(root)?;
+    let path = bindgen_hash_path(root, key);
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent).map_err(|e| {
+            CliError::operational(format!("failed to create {}: {e}", parent.display()))
+        })?;
+    }
+    std::fs::write(&path, format!("{hash}\n"))
+        .map_err(|e| CliError::operational(format!("failed to write {}: {e}", path.display())))?;
+    Ok(())
+}
+
+fn bindgen_hash_path(root: &Path, key: &str) -> PathBuf {
+    root.join(format!("{BINDGEN_HASH_FILE_PREFIX}-{key}"))
+}
+
+fn compute_bindgen_inputs_hash(root: &Path) -> Result<String, CliError> {
+    let mut files: Vec<PathBuf> = vec![];
+    let src_dir = root.join("rust/src");
+    for ent in WalkDir::new(&src_dir).into_iter().flatten() {
+        if ent.file_type().is_file() {
+            files.push(ent.path().to_path_buf());
+        }
+    }
+    files.push(uniffi_toml_path(root)?);
+    for extra in [
+        root.join("Cargo.toml"),
+        root.join("Cargo.lock"),
+        root.join("rust/Cargo.toml"),
+        root.join("rust/Cargo.lock"),
+    ] {
+        if extra.is_file() {
+            files.push(extra);
+        }
+    }
+    files.sort();
+
+    let mut hash: u64 = 0xcbf29ce484222325;
+    for file in files {
+        let rel = file
+            .strip_prefix(root)
+            .unwrap_or(file.as_path())
+            .to_string_lossy();
+        fnv1a_update(&mut hash, rel.as_bytes());
+        fnv1a_update(&mut hash, &[0u8]);
+        let data = std::fs::read(&file).map_err(|e| {
+            CliError::operational(format!(
+                "failed to read bindgen input {}: {e}",
+                file.display()
+            ))
+        })?;
+        fnv1a_update(&mut hash, &data);
+        fnv1a_update(&mut hash, &[0u8]);
+    }
+    Ok(format!("{hash:016x}"))
+}
+
+fn fnv1a_update(hash: &mut u64, data: &[u8]) {
+    const FNV_PRIME: u64 = 0x0000_0100_0000_01b3;
+    for b in data {
+        *hash ^= u64::from(*b);
+        *hash = hash.wrapping_mul(FNV_PRIME);
+    }
+}
+
+fn kotlin_bindings_dir(root: &Path) -> Result<PathBuf, CliError> {
+    Ok(root
+        .join("android/app/src/main/java")
+        .join(kotlin_bindings_relpath(root)?))
+}
+
+fn kotlin_bindings_relpath(root: &Path) -> Result<PathBuf, CliError> {
+    let uniffi = uniffi_toml_path(root)?;
+    let s = std::fs::read_to_string(&uniffi)
+        .map_err(|e| CliError::operational(format!("failed to read {}: {e}", uniffi.display())))?;
+    let v: toml::Value = toml::from_str(&s)
+        .map_err(|e| CliError::user(format!("failed to parse rust/uniffi.toml: {e}")))?;
+    let pkg = v
+        .get("bindings")
+        .and_then(|x| x.get("kotlin"))
+        .and_then(|x| x.get("package_name"))
+        .and_then(|x| x.as_str())
+        .ok_or_else(|| CliError::user("rust/uniffi.toml missing [bindings.kotlin].package_name"))?;
+    if pkg.trim().is_empty() {
+        return Err(CliError::user(
+            "rust/uniffi.toml has empty [bindings.kotlin].package_name",
+        ));
+    }
+    Ok(PathBuf::from(pkg.replace('.', "/")))
+}
+
+fn uniffi_toml_path(root: &Path) -> Result<PathBuf, CliError> {
+    let primary = root.join("rust/uniffi.toml");
+    if primary.is_file() {
+        return Ok(primary);
+    }
+    let fallback = root.join("uniffi.toml");
+    if fallback.is_file() {
+        return Ok(fallback);
+    }
+    Err(CliError::user(
+        "missing UniFFI config (expected rust/uniffi.toml or uniffi.toml)",
+    ))
+}
+
+/// Convert a snake_case lib name to PascalCase (e.g., "pika_core" → "PikaCore").
+fn pascal_case(s: &str) -> String {
+    s.split('_')
+        .filter(|seg| !seg.is_empty())
+        .map(|seg| {
+            let mut c = seg.chars();
+            match c.next() {
+                Some(first) => {
+                    let mut part = first.to_uppercase().to_string();
+                    part.extend(c);
+                    part
+                }
+                None => String::new(),
+            }
+        })
+        .collect()
+}
diff --git a/native/rmp-cli/src/cli.rs b/native/rmp-cli/src/cli.rs
new file mode 100644
index 00000000..1ed619d8
--- /dev/null
+++ b/native/rmp-cli/src/cli.rs
@@ -0,0 +1,337 @@
+use std::collections::BTreeMap;
+use std::process::ExitCode;
+
+use clap::{ArgAction, Parser, Subcommand, ValueEnum};
+use serde::Serialize;
+
+#[derive(Parser, Debug)]
+#[command(
+    name = "rmp",
+    version,
+    about = "RMP: Rust Multiplatform orchestrator (MVP)"
+)]
+pub struct Cli {
+    /// Machine-readable output. When set, stdout is JSON only; logs go to stderr.
+    #[arg(long, global = true)]
+    pub json: bool,
+
+    /// More logs to stderr.
+    #[arg(long, global = true)]
+    pub verbose: bool,
+
+    #[command(subcommand)]
+    pub cmd: Cmd,
+}
+
+#[derive(Subcommand, Debug)]
+pub enum Cmd {
+    /// Scaffold a new Rust + iOS + Android + desktop app repository.
+    Init(InitArgs),
+
+    /// Fast diagnostics; must not build.
+    Doctor,
+
+    /// Device discovery across iOS + Android.
+    Devices {
+        #[command(subcommand)]
+        cmd: DevicesCmd,
+    },
+
+    /// Generate bindings and build platform artifacts.
+    Bindings(BindingsArgs),
+
+    /// Build/install/launch on iOS/Android/desktop (debug).
+    Run(RunArgs),
+}
+
+#[derive(clap::Args, Debug)]
+pub struct InitArgs {
+    /// Project directory name to create.
+    pub name: String,
+
+    /// Include iOS app scaffolding.
+    #[arg(long, conflicts_with = "no_ios")]
+    pub ios: bool,
+
+    /// Exclude iOS app scaffolding.
+    #[arg(long = "no-ios", action = ArgAction::SetTrue)]
+    pub no_ios: bool,
+
+    /// Include Android app scaffolding.
+    #[arg(long, conflicts_with = "no_android")]
+    pub android: bool,
+
+    /// Exclude Android app scaffolding.
+    #[arg(long = "no-android", action = ArgAction::SetTrue)]
+    pub no_android: bool,
+
+    /// Include ICED desktop app scaffolding.
+    #[arg(long, conflicts_with = "no_iced")]
+    pub iced: bool,
+
+    /// Exclude ICED desktop app scaffolding.
+    #[arg(long = "no-iced", action = ArgAction::SetTrue)]
+    pub no_iced: bool,
+
+    /// Include a local flake.nix dev shell with an `rmp` wrapper.
+    #[arg(long, conflicts_with = "no_flake")]
+    pub flake: bool,
+
+    /// Exclude flake.nix generation.
+    #[arg(long = "no-flake", action = ArgAction::SetTrue)]
+    pub no_flake: bool,
+
+    /// Initialize a local git repo and stage scaffold files.
+    #[arg(long, conflicts_with = "no_git")]
+    pub git: bool,
+
+    /// Skip local git repo initialization.
+    #[arg(long = "no-git", action = ArgAction::SetTrue)]
+    pub no_git: bool,
+
+    /// Reverse-DNS org prefix (e.g. com.example).
+    #[arg(long)]
+    pub org: Option<String>,
+
+    /// iOS bundle identifier override.
+    #[arg(long)]
+    pub bundle_id: Option<String>,
+
+    /// Android application ID override.
+    #[arg(long)]
+    pub app_id: Option<String>,
+
+    /// Non-interactive mode.
+    #[arg(long)]
+    pub yes: bool,
+}
+
+#[derive(Subcommand, Debug)]
+pub enum DevicesCmd {
+    /// List devices/simulators/emulators.
+    List,
+
+    /// Start a simulator/emulator target and wait until ready.
+    Start(DevicesStartArgs),
+}
+
+#[derive(clap::Args, Debug)]
+pub struct DevicesStartArgs {
+    #[arg(value_enum)]
+    pub platform: DeviceStartPlatform,
+
+    #[command(flatten)]
+    pub ios: DevicesStartIosArgs,
+
+    #[command(flatten)]
+    pub android: DevicesStartAndroidArgs,
+}
+
+#[derive(ValueEnum, Debug, Clone, Copy)]
+pub enum DeviceStartPlatform {
+    Ios,
+    Android,
+}
+
+#[derive(clap::Args, Debug, Default)]
+pub struct DevicesStartIosArgs {
+    /// iOS simulator UDID to target.
+    #[arg(long)]
+    pub udid: Option<String>,
+}
+
+#[derive(clap::Args, Debug, Default)]
+pub struct DevicesStartAndroidArgs {
+    /// Android emulator serial to target.
+    #[arg(long)]
+    pub serial: Option<String>,
+
+    /// Android AVD name to start if no emulator is running.
+    #[arg(long)]
+    pub avd: Option<String>,
+}
+
+#[derive(clap::Args, Debug)]
+pub struct BindingsArgs {
+    #[arg(value_enum)]
+    pub target: BindingsTarget,
+
+    /// Remove build outputs first.
+    #[arg(long)]
+    pub clean: bool,
+
+    /// Fail if generated sources differ from what's in-tree; also require builds succeed.
+    #[arg(long)]
+    pub check: bool,
+}
+
+#[derive(ValueEnum, Debug, Clone, Copy)]
+pub enum BindingsTarget {
+    Swift,
+    Kotlin,
+    All,
+}
+
+#[derive(clap::Args, Debug)]
+pub struct RunArgs {
+    #[arg(value_enum)]
+    pub platform: RunPlatform,
+
+    /// Build Rust artifacts in release mode (default is debug for faster iteration).
+    #[arg(long)]
+    pub release: bool,
+
+    #[command(flatten)]
+    pub ios: RunIosArgs,
+
+    #[command(flatten)]
+    pub android: RunAndroidArgs,
+}
+
+#[derive(ValueEnum, Debug, Clone, Copy)]
+pub enum RunPlatform {
+    Ios,
+    Android,
+    Iced,
+    Gtk4,
+}
+
+#[derive(clap::Args, Debug, Default)]
+pub struct RunIosArgs {
+    /// iOS simulator UDID to target.
+    #[arg(long)]
+    pub udid: Option<String>,
+}
+
+#[derive(clap::Args, Debug, Default)]
+pub struct RunAndroidArgs {
+    /// Android emulator serial to target.
+    #[arg(long)]
+    pub serial: Option<String>,
+
+    /// Android AVD name to start if no emulator is running.
+    #[arg(long)]
+    pub avd: Option<String>,
+
+    /// Optional host->device port reverses (e.g. "18080:32820,9090").
+    #[arg(long)]
+    pub adb_reverse: Option<String>,
+}
+
+#[derive(Serialize)]
+pub struct JsonOk<T: Serialize> {
+    pub ok: bool,
+    #[serde(flatten)]
+    pub data: T,
+}
+
+#[derive(Serialize)]
+pub struct JsonErr {
+    pub ok: bool,
+    pub error: JsonErrInner,
+}
+
+#[derive(Serialize)]
+pub struct JsonErrInner {
+    pub message: String,
+    pub exit_code: i32,
+    #[serde(skip_serializing_if = "Vec::is_empty", default)]
+    pub choices: Vec<JsonChoice>,
+    #[serde(skip_serializing_if = "BTreeMap::is_empty", default)]
+    pub details: BTreeMap<String, serde_json::Value>,
+}
+
+#[derive(Serialize, Clone, Debug)]
+pub struct JsonChoice {
+    pub id: String,
+    pub platform: String, // "ios" | "android" | "iced" | "gtk4"
+    pub kind: String,     // "device" | "simulator" | "emulator"
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub os: Option<String>,
+}
+
+#[derive(thiserror::Error, Debug)]
+#[error("{message}")]
+pub struct CliError {
+    pub message: String,
+    pub exit_code: i32,
+    pub choices: Vec<JsonChoice>,
+    pub details: BTreeMap<String, serde_json::Value>,
+}
+
+impl CliError {
+    pub fn user(message: impl Into<String>) -> Self {
+        Self {
+            message: message.into(),
+            exit_code: 2,
+            choices: vec![],
+            details: BTreeMap::new(),
+        }
+    }
+
+    pub fn operational(message: impl Into<String>) -> Self {
+        Self {
+            message: message.into(),
+            exit_code: 1,
+            choices: vec![],
+            details: BTreeMap::new(),
+        }
+    }
+
+    #[allow(dead_code)]
+    pub fn with_choices(mut self, choices: Vec<JsonChoice>) -> Self {
+        self.choices = choices;
+        self
+    }
+
+    #[allow(dead_code)]
+    pub fn with_detail(mut self, k: &str, v: serde_json::Value) -> Self {
+        self.details.insert(k.to_string(), v);
+        self
+    }
+}
+
+pub fn json_print<T: Serialize>(v: &T) {
+    println!("{}", serde_json::to_string(v).expect("json serialize"));
+}
+
+pub fn human_log(verbose: bool, msg: impl AsRef<str>) {
+    if verbose {
+        eprintln!("{}", msg.as_ref());
+    }
+}
+
+pub fn render_err(json: bool, e: CliError) -> ExitCode {
+    if json {
+        json_print(&JsonErr {
+            ok: false,
+            error: JsonErrInner {
+                message: e.message,
+                exit_code: e.exit_code,
+                choices: e.choices,
+                details: e.details,
+            },
+        });
+        ExitCode::from(e.exit_code as u8)
+    } else {
+        eprintln!("error: {}", e.message);
+        if !e.choices.is_empty() {
+            eprintln!("choices:");
+            for c in e.choices {
+                eprintln!(
+                    "  {} {}: {}{}",
+                    c.platform,
+                    c.kind,
+                    c.id,
+                    c.name.map(|n| format!("  {n}")).unwrap_or_default()
+                );
+            }
+        }
+        ExitCode::from(e.exit_code as u8)
+    }
+}
+
+// Intentionally no shared "require_success" helper yet: behavior differs slightly across
+// commands (some stream output, some capture).
diff --git a/native/rmp-cli/src/config.rs b/native/rmp-cli/src/config.rs
new file mode 100644
index 00000000..780fba88
--- /dev/null
+++ b/native/rmp-cli/src/config.rs
@@ -0,0 +1,89 @@
+use std::path::{Path, PathBuf};
+
+use crate::cli::CliError;
+
+pub fn find_workspace_root(start: &Path) -> Result<PathBuf, CliError> {
+    let mut cur = start
+        .canonicalize()
+        .map_err(|e| CliError::operational(format!("failed to resolve cwd: {e}")))?;
+    loop {
+        if cur.join("rmp.toml").is_file() {
+            return Ok(cur);
+        }
+        if !cur.pop() {
+            break;
+        }
+    }
+    Err(CliError::user(
+        "could not find rmp.toml (searches current dir and parents)",
+    ))
+}
+
+#[allow(dead_code)]
+#[derive(serde::Deserialize, Debug, Clone)]
+pub struct RmpToml {
+    pub project: RmpProject,
+    pub core: RmpCore,
+    pub ios: Option<RmpIos>,
+    pub android: Option<RmpAndroid>,
+    pub desktop: Option<RmpDesktop>,
+}
+
+#[allow(dead_code)]
+#[derive(serde::Deserialize, Debug, Clone)]
+pub struct RmpProject {
+    pub name: String,
+    pub org: String,
+}
+
+#[allow(dead_code)]
+#[derive(serde::Deserialize, Debug, Clone)]
+pub struct RmpCore {
+    #[serde(rename = "crate")]
+    pub crate_: String,
+    pub bindings: String,
+}
+
+#[allow(dead_code)]
+#[derive(serde::Deserialize, Debug, Clone)]
+pub struct RmpIos {
+    pub bundle_id: String,
+    pub scheme: Option<String>,
+}
+
+#[allow(dead_code)]
+#[derive(serde::Deserialize, Debug, Clone)]
+pub struct RmpAndroid {
+    pub app_id: String,
+    pub avd_name: Option<String>,
+}
+
+#[allow(dead_code)]
+#[derive(serde::Deserialize, Debug, Clone)]
+pub struct RmpDesktop {
+    #[serde(default)]
+    pub targets: Vec<String>,
+    pub iced: Option<RmpDesktopIced>,
+    pub gtk4: Option<RmpDesktopGtk4>,
+}
+
+#[allow(dead_code)]
+#[derive(serde::Deserialize, Debug, Clone)]
+pub struct RmpDesktopIced {
+    pub package: Option<String>,
+}
+
+#[allow(dead_code)]
+#[derive(serde::Deserialize, Debug, Clone)]
+pub struct RmpDesktopGtk4 {
+    pub package: Option<String>,
+}
+
+pub fn load_rmp_toml(root: &Path) -> Result<RmpToml, CliError> {
+    let p = root.join("rmp.toml");
+    let s = std::fs::read_to_string(&p)
+        .map_err(|e| CliError::operational(format!("failed to read rmp.toml: {e}")))?;
+    let cfg: RmpToml =
+        toml::from_str(&s).map_err(|e| CliError::user(format!("failed to parse rmp.toml: {e}")))?;
+    Ok(cfg)
+}
diff --git a/native/rmp-cli/src/devices.rs b/native/rmp-cli/src/devices.rs
new file mode 100644
index 00000000..252cedc1
--- /dev/null
+++ b/native/rmp-cli/src/devices.rs
@@ -0,0 +1,396 @@
+use std::path::Path;
+use std::process::Command;
+
+use serde::Serialize;
+
+use crate::cli::{human_log, json_print, CliError, DeviceStartPlatform, DevicesStartArgs, JsonOk};
+use crate::config::load_rmp_toml;
+use crate::run::{ensure_android_emulator, ensure_ios_simulator};
+use crate::util::{discover_xcode_dev_dir, run_capture};
+
+#[derive(Serialize)]
+struct DevicesJson {
+    devices: Vec<DeviceItem>,
+}
+
+#[derive(Serialize)]
+struct DeviceItem {
+    id: String,
+    platform: String, // ios|android
+    kind: String,     // device|simulator|emulator
+    name: Option<String>,
+    os: Option<String>,
+    boot_state: Option<String>, // booted|shutdown (simulators/emulators)
+    connection_state: Option<String>, // connected|... (devices)
+}
+
+#[derive(Serialize)]
+struct DeviceStartJson {
+    platform: String,
+    kind: String,
+    id: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    avd: Option<String>,
+}
+
+#[derive(Debug)]
+struct IosDev {
+    udid: String,
+    name: String,
+    os: Option<String>,
+}
+
+fn ios_connected_devices(dev_dir: &Path) -> Result<Vec<IosDev>, CliError> {
+    let mut cmd = Command::new("/usr/bin/xcrun");
+    cmd.env("DEVELOPER_DIR", dev_dir)
+        .arg("xctrace")
+        .arg("list")
+        .arg("devices");
+    let out = run_capture(cmd)?;
+    if !out.status.success() {
+        return Err(CliError::operational(
+            "failed to list iOS devices (xcrun xctrace list devices)",
+        ));
+    }
+    let s = String::from_utf8_lossy(&out.stdout);
+    let mut in_devices = false;
+    let mut res = vec![];
+    for line in s.lines() {
+        let ln = line.trim();
+        if ln == "== Devices ==" {
+            in_devices = true;
+            continue;
+        }
+        if ln == "== Simulators ==" {
+            in_devices = false;
+            continue;
+        }
+        if !in_devices {
+            continue;
+        }
+        if !(ln.contains("iPhone") || ln.contains("iPad")) {
+            continue;
+        }
+        // Format: "<name> (<os>) (<udid>)"
+        let Some(i1) = ln.rfind(" (") else { continue };
+        let Some(i0) = ln[..i1].rfind(" (") else {
+            continue;
+        };
+        let name = ln[..i0].to_string();
+        let mut os = ln[i0 + 2..i1].to_string();
+        os = os.trim_end_matches(')').to_string();
+        let udid = ln[i1 + 2..].trim_end_matches(')').to_string();
+        if udid.len() < 25 {
+            continue;
+        }
+        res.push(IosDev {
+            udid,
+            name,
+            os: Some(os),
+        });
+    }
+    res.sort_by(|a, b| (a.name.as_str(), a.udid.as_str()).cmp(&(b.name.as_str(), b.udid.as_str())));
+    Ok(res)
+}
+
+#[derive(Debug)]
+struct IosSim {
+    udid: String,
+    name: String,
+    state: String, // Booted|Shutdown
+    os: Option<String>,
+}
+
+fn ios_simulators(dev_dir: &Path) -> Result<Vec<IosSim>, CliError> {
+    let mut cmd = Command::new("/usr/bin/xcrun");
+    cmd.env("DEVELOPER_DIR", dev_dir)
+        .arg("simctl")
+        .arg("list")
+        .arg("-j")
+        .arg("devices")
+        .arg("available");
+    let out = run_capture(cmd)?;
+    if !out.status.success() {
+        return Err(CliError::operational(
+            "failed to list iOS simulators (xcrun simctl list -j devices available)",
+        ));
+    }
+    let j: serde_json::Value = serde_json::from_slice(&out.stdout)
+        .map_err(|e| CliError::operational(format!("failed to parse simctl JSON output: {e}")))?;
+    let mut sims: Vec<IosSim> = vec![];
+    let devices = j
+        .get("devices")
+        .and_then(|v| v.as_object())
+        .cloned()
+        .unwrap_or_default();
+    for (runtime, devs) in devices {
+        if !runtime.contains("iOS") {
+            continue;
+        }
+        let Some(list) = devs.as_array() else {
+            continue;
+        };
+        for d in list {
+            if d.get("isAvailable").and_then(|v| v.as_bool()) == Some(false) {
+                continue;
+            }
+            let udid = d
+                .get("udid")
+                .and_then(|v| v.as_str())
+                .unwrap_or("")
+                .to_string();
+            let name = d
+                .get("name")
+                .and_then(|v| v.as_str())
+                .unwrap_or("")
+                .to_string();
+            let state = d
+                .get("state")
+                .and_then(|v| v.as_str())
+                .unwrap_or("")
+                .to_string();
+            let os = d
+                .get("osVersion")
+                .and_then(|v| v.as_str())
+                .map(|s| s.to_string());
+            if udid.is_empty() || name.is_empty() {
+                continue;
+            }
+            sims.push(IosSim {
+                udid,
+                name,
+                state,
+                os,
+            });
+        }
+    }
+    sims.sort_by(|a, b| {
+        (a.state != "Booted", a.name.as_str(), a.udid.as_str()).cmp(&(
+            b.state != "Booted",
+            b.name.as_str(),
+            b.udid.as_str(),
+        ))
+    });
+    Ok(sims)
+}
+
+#[derive(Debug)]
+struct AndroidTarget {
+    serial: String,
+    model: Option<String>,
+    product: Option<String>,
+}
+
+fn android_targets() -> Result<Vec<AndroidTarget>, CliError> {
+    let mut cmd = Command::new("adb");
+    cmd.arg("devices").arg("-l");
+    let out = run_capture(cmd)?;
+    if !out.status.success() {
+        return Err(CliError::operational(
+            "failed to list android devices (adb devices -l)",
+        ));
+    }
+    let s = String::from_utf8_lossy(&out.stdout);
+    let mut res: Vec<AndroidTarget> = vec![];
+    for line in s.lines() {
+        let ln = line.trim();
+        if ln.is_empty() || ln.starts_with("List of devices") {
+            continue;
+        }
+        let parts: Vec<&str> = ln.split_whitespace().collect();
+        if parts.len() < 2 {
+            continue;
+        }
+        let serial = parts[0].to_string();
+        let state = parts[1];
+        if state != "device" {
+            continue;
+        }
+        let mut model: Option<String> = None;
+        let mut product: Option<String> = None;
+        for tok in parts.iter().skip(2) {
+            if let Some((k, v)) = tok.split_once(':') {
+                match k {
+                    "model" => model = Some(v.to_string()),
+                    "product" => product = Some(v.to_string()),
+                    _ => {}
+                }
+            }
+        }
+        res.push(AndroidTarget {
+            serial,
+            model,
+            product,
+        });
+    }
+    res.sort_by(|a, b| {
+        (!a.serial.starts_with("emulator-"), a.serial.as_str())
+            .cmp(&(!b.serial.starts_with("emulator-"), b.serial.as_str()))
+    });
+    Ok(res)
+}
+
+pub fn devices_list(root: &Path, json: bool, verbose: bool) -> Result<(), CliError> {
+    let _cfg = load_rmp_toml(root)?;
+    let dev_dir = discover_xcode_dev_dir()?;
+
+    let ios_devs = ios_connected_devices(&dev_dir)?;
+    let ios_sims = ios_simulators(&dev_dir)?;
+    let android = android_targets()?;
+
+    let mut out: Vec<DeviceItem> = vec![];
+    for d in ios_devs {
+        out.push(DeviceItem {
+            id: d.udid,
+            platform: "ios".into(),
+            kind: "device".into(),
+            name: Some(d.name),
+            os: d.os,
+            boot_state: None,
+            connection_state: Some("connected".into()),
+        });
+    }
+    for s in ios_sims {
+        out.push(DeviceItem {
+            id: s.udid,
+            platform: "ios".into(),
+            kind: "simulator".into(),
+            name: Some(s.name),
+            os: s.os,
+            boot_state: Some(s.state.to_lowercase()),
+            connection_state: None,
+        });
+    }
+    for a in android {
+        let is_emulator = a.serial.starts_with("emulator-");
+        let kind = if is_emulator { "emulator" } else { "device" };
+        out.push(DeviceItem {
+            id: a.serial,
+            platform: "android".into(),
+            kind: kind.into(),
+            name: a.model.or(a.product),
+            os: None,
+            boot_state: if is_emulator {
+                Some("booted".into())
+            } else {
+                None
+            },
+            connection_state: if is_emulator {
+                None
+            } else {
+                Some("connected".into())
+            },
+        });
+    }
+
+    out.sort_by(|a, b| {
+        (
+            a.platform.as_str(),
+            a.kind.as_str(),
+            a.name.as_deref().unwrap_or(""),
+            a.id.as_str(),
+        )
+            .cmp(&(
+                b.platform.as_str(),
+                b.kind.as_str(),
+                b.name.as_deref().unwrap_or(""),
+                b.id.as_str(),
+            ))
+    });
+    human_log(verbose, format!("found {} devices", out.len()));
+
+    if json {
+        json_print(&JsonOk {
+            ok: true,
+            data: DevicesJson { devices: out },
+        });
+    } else {
+        eprintln!("Devices:");
+        for d in &out {
+            let extra = match (&d.name, &d.os, &d.boot_state) {
+                (Some(n), Some(os), Some(bs)) => format!("{n} ({os}) [{bs}]"),
+                (Some(n), Some(os), None) => format!("{n} ({os})"),
+                (Some(n), None, Some(bs)) => format!("{n} [{bs}]"),
+                (Some(n), None, None) => n.clone(),
+                _ => "".into(),
+            };
+            eprintln!(
+                "  {} {}: {}{}",
+                d.platform,
+                d.kind,
+                d.id,
+                if extra.is_empty() {
+                    "".into()
+                } else {
+                    format!("  {extra}")
+                }
+            );
+        }
+    }
+
+    Ok(())
+}
+
+pub fn devices_start(
+    root: &Path,
+    json: bool,
+    verbose: bool,
+    args: DevicesStartArgs,
+) -> Result<(), CliError> {
+    let cfg = load_rmp_toml(root)?;
+    match args.platform {
+        DeviceStartPlatform::Android => {
+            let android = cfg
+                .android
+                .ok_or_else(|| CliError::user("rmp.toml missing [android] section"))?;
+            let avd = args
+                .android
+                .avd
+                .or(android.avd_name)
+                .unwrap_or_else(|| "rmp_api35".into());
+            let serial =
+                ensure_android_emulator(root, &avd, args.android.serial.as_deref(), verbose)?;
+
+            if json {
+                json_print(&JsonOk {
+                    ok: true,
+                    data: DeviceStartJson {
+                        platform: "android".into(),
+                        kind: if serial.starts_with("emulator-") {
+                            "emulator".into()
+                        } else {
+                            "device".into()
+                        },
+                        id: serial,
+                        avd: Some(avd),
+                    },
+                });
+            } else {
+                eprintln!("ok: android target ready");
+            }
+        }
+        DeviceStartPlatform::Ios => {
+            let _ios = cfg
+                .ios
+                .ok_or_else(|| CliError::user("rmp.toml missing [ios] section"))?;
+            let dev_dir = discover_xcode_dev_dir()?;
+            let udid = ensure_ios_simulator(&dev_dir, args.ios.udid.as_deref(), verbose)?;
+            let _ = Command::new("open").arg("-a").arg("Simulator").status();
+
+            if json {
+                json_print(&JsonOk {
+                    ok: true,
+                    data: DeviceStartJson {
+                        platform: "ios".into(),
+                        kind: "simulator".into(),
+                        id: udid,
+                        avd: None,
+                    },
+                });
+            } else {
+                eprintln!("ok: ios simulator ready");
+            }
+        }
+    }
+    Ok(())
+}
diff --git a/native/rmp-cli/src/doctor.rs b/native/rmp-cli/src/doctor.rs
new file mode 100644
index 00000000..5713897d
--- /dev/null
+++ b/native/rmp-cli/src/doctor.rs
@@ -0,0 +1,124 @@
+use std::path::Path;
+use std::process::Command;
+
+use crate::cli::{human_log, json_print, CliError, JsonOk};
+use crate::config::load_rmp_toml;
+use crate::util::{discover_xcode_dev_dir, run_capture, which};
+
+#[derive(serde::Serialize)]
+struct DoctorJson {
+    in_nix_shell: bool,
+    xcode_developer_dir: Option<String>,
+    android_home: Option<String>,
+    desktop_targets: Vec<String>,
+}
+
+pub fn doctor(root: &Path, json: bool, verbose: bool) -> Result<(), CliError> {
+    let cfg = load_rmp_toml(root)?;
+
+    let in_nix = std::env::var("IN_NIX_SHELL")
+        .ok()
+        .filter(|v| !v.is_empty())
+        .is_some();
+    if !in_nix && !json {
+        human_log(
+            verbose,
+            "note: IN_NIX_SHELL not set; recommended: run via `nix develop` for a consistent toolchain",
+        );
+    }
+
+    if which("cargo").is_none() {
+        return Err(CliError::operational(
+            "missing `cargo` on PATH (run inside nix develop)",
+        ));
+    }
+    if which("rustc").is_none() {
+        return Err(CliError::operational(
+            "missing `rustc` on PATH (run inside nix develop)",
+        ));
+    }
+
+    let mut xcode_developer_dir = None;
+    if cfg.ios.is_some() {
+        // iOS: Xcode + sim runtimes.
+        let dev_dir = discover_xcode_dev_dir()?;
+        let mut cmd = Command::new("/usr/bin/xcrun");
+        cmd.env("DEVELOPER_DIR", &dev_dir)
+            .arg("simctl")
+            .arg("list")
+            .arg("runtimes");
+        let out = run_capture(cmd)?;
+        if !out.status.success() {
+            return Err(CliError::operational(
+                "failed to run `xcrun simctl list runtimes` (check Xcode install)",
+            ));
+        }
+        let runtimes = String::from_utf8_lossy(&out.stdout);
+        if runtimes.lines().count() <= 1 {
+            return Err(CliError::operational(
+                "no iOS simulator runtimes installed (simctl list runtimes is empty)",
+            ));
+        }
+        xcode_developer_dir = Some(dev_dir.to_string_lossy().to_string());
+    }
+
+    let mut android_home = None;
+    if cfg.android.is_some() {
+        // Android: adb/emulator + ANDROID_HOME best-effort.
+        if which("adb").is_none() {
+            return Err(CliError::operational(
+                "missing `adb` on PATH (run inside nix develop)",
+            ));
+        }
+        if which("emulator").is_none() {
+            return Err(CliError::operational(
+                "missing `emulator` on PATH (run inside nix develop)",
+            ));
+        }
+        android_home = std::env::var("ANDROID_HOME").ok().filter(|s| !s.is_empty());
+        if android_home.is_none() && !json {
+            human_log(
+                verbose,
+                "note: ANDROID_HOME not set (may be set by nix develop)",
+            );
+        }
+    }
+
+    let desktop_targets = cfg
+        .desktop
+        .as_ref()
+        .map(|d| d.targets.clone())
+        .unwrap_or_default();
+    let desktop_iced_enabled = desktop_targets
+        .iter()
+        .any(|t| t.eq_ignore_ascii_case("iced"));
+    let desktop_gtk4_enabled = desktop_targets
+        .iter()
+        .any(|t| t.eq_ignore_ascii_case("gtk4"));
+    if desktop_iced_enabled && cfg!(target_os = "linux") && !json {
+        eprintln!(
+            "note: ICED on Linux may require Wayland/X11 runtime libs (for example libxkbcommon, libwayland-client, libX11)"
+        );
+    }
+    if desktop_gtk4_enabled && cfg!(target_os = "linux") && !json {
+        eprintln!(
+            "note: GTK4 on Linux requires GTK4 runtime/dev packages (for example gtk4, graphene, pango, cairo, wayland/X11 libs)"
+        );
+    }
+
+    if json {
+        json_print(&JsonOk {
+            ok: true,
+            data: DoctorJson {
+                in_nix_shell: in_nix,
+                xcode_developer_dir,
+                android_home,
+                desktop_targets,
+            },
+        });
+    } else {
+        eprintln!("ok: doctor checks passed");
+    }
+
+    Ok(())
+}
diff --git a/native/rmp-cli/src/init.rs b/native/rmp-cli/src/init.rs
new file mode 100644
index 00000000..8c087923
--- /dev/null
+++ b/native/rmp-cli/src/init.rs
@@ -0,0 +1,1923 @@
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+use crate::cli::{human_log, json_print, CliError, JsonOk};
+
+pub fn init(
+    cwd: &Path,
+    json: bool,
+    verbose: bool,
+    args: crate::cli::InitArgs,
+) -> Result<(), CliError> {
+    let include_ios = resolve_toggle(args.ios, args.no_ios, true);
+    let include_android = resolve_toggle(args.android, args.no_android, true);
+    let include_iced = resolve_toggle(args.iced, args.no_iced, false);
+    let include_flake = resolve_toggle(args.flake, args.no_flake, false);
+    let include_git = resolve_toggle(args.git, args.no_git, include_flake);
+    if !include_ios && !include_android && !include_iced {
+        return Err(CliError::user(
+            "at least one platform must be enabled (use --ios, --android, or --iced)",
+        ));
+    }
+
+    let requested = PathBuf::from(&args.name);
+    let project_dir_name = requested
+        .file_name()
+        .and_then(|s| s.to_str())
+        .map(|s| s.to_string())
+        .ok_or_else(|| CliError::user("project name must be a valid path segment"))?;
+
+    let dest = if requested.is_absolute() {
+        requested.clone()
+    } else {
+        cwd.join(&requested)
+    };
+
+    if dest.exists() {
+        return Err(CliError::user(format!(
+            "destination already exists: {}",
+            dest.to_string_lossy()
+        )));
+    }
+
+    let org = args.org.unwrap_or_else(|| "com.example".to_string());
+    validate_org(&org)?;
+
+    let id_segment = java_identifier_segment(&project_dir_name);
+    let bundle_id = args
+        .bundle_id
+        .unwrap_or_else(|| format!("{org}.{id_segment}"));
+    let app_id = args.app_id.unwrap_or_else(|| format!("{org}.{id_segment}"));
+
+    validate_bundle_like("bundle id", &bundle_id)?;
+    validate_bundle_like("app id", &app_id)?;
+
+    let display_name = display_name(&project_dir_name);
+
+    // Derive Rust crate/lib name from the project name.
+    let crate_name = rust_crate_name(&project_dir_name);
+    let lib_name = crate_name.replace('-', "_");
+    let iced_package = format!("{crate_name}_desktop_iced");
+
+    // Kotlin package path segments from the app_id (e.g., "com.example.myapp" → "com/example/myapp").
+    let kotlin_pkg = &app_id;
+    let kotlin_pkg_path = kotlin_pkg.replace('.', "/");
+
+    human_log(
+        verbose,
+        format!(
+            "initializing project '{}' at {}",
+            project_dir_name,
+            dest.to_string_lossy()
+        ),
+    );
+
+    std::fs::create_dir_all(&dest)
+        .map_err(|e| CliError::operational(format!("failed to create destination: {e}")))?;
+
+    // ── Root files ──────────────────────────────────────────────────────
+    write_text(&dest.join(".gitignore"), &tpl_gitignore())?;
+    write_text(&dest.join("Cargo.toml"), &tpl_workspace_toml(include_iced))?;
+    write_text(
+        &dest.join("rmp.toml"),
+        &tpl_rmp_toml(
+            &project_dir_name,
+            &org,
+            &crate_name,
+            &bundle_id,
+            &app_id,
+            include_ios,
+            include_android,
+            include_iced,
+            &iced_package,
+        ),
+    )?;
+    write_text(
+        &dest.join("justfile"),
+        &tpl_justfile(
+            include_ios,
+            include_android,
+            include_iced,
+            &crate_name,
+            &lib_name,
+            &iced_package,
+        ),
+    )?;
+    write_text(
+        &dest.join("README.md"),
+        &tpl_readme(
+            &display_name,
+            include_ios,
+            include_android,
+            include_iced,
+            include_flake,
+        ),
+    )?;
+    if include_flake {
+        write_text(&dest.join("flake.nix"), &tpl_flake_nix())?;
+        write_text(&dest.join(".envrc"), &tpl_envrc())?;
+    }
+
+    // ── Rust core ───────────────────────────────────────────────────────
+    let rust_dir = dest.join("rust");
+    std::fs::create_dir_all(rust_dir.join("src"))
+        .map_err(|e| CliError::operational(format!("create rust/src: {e}")))?;
+    write_text(&rust_dir.join("Cargo.toml"), &tpl_rust_cargo(&crate_name))?;
+    write_text(&rust_dir.join("build.rs"), "fn main() {}\n")?;
+    write_text(&rust_dir.join("src/lib.rs"), &tpl_rust_lib())?;
+    write_text(
+        &rust_dir.join("uniffi.toml"),
+        &tpl_uniffi_toml(kotlin_pkg, &lib_name),
+    )?;
+
+    // ── uniffi-bindgen ──────────────────────────────────────────────────
+    let ub_dir = dest.join("uniffi-bindgen");
+    std::fs::create_dir_all(ub_dir.join("src"))
+        .map_err(|e| CliError::operational(format!("create uniffi-bindgen/src: {e}")))?;
+    write_text(&ub_dir.join("Cargo.toml"), &tpl_uniffi_bindgen_cargo())?;
+    write_text(
+        &ub_dir.join("src/main.rs"),
+        "fn main() {\n    uniffi::uniffi_bindgen_main()\n}\n",
+    )?;
+
+    // ── iOS ─────────────────────────────────────────────────────────────
+    if include_ios {
+        let ios_dir = dest.join("ios");
+        let src_dir = ios_dir.join("Sources");
+        let assets_dir = src_dir.join("Assets.xcassets/AppIcon.appiconset");
+        std::fs::create_dir_all(&assets_dir)
+            .map_err(|e| CliError::operational(format!("create ios dirs: {e}")))?;
+        std::fs::create_dir_all(src_dir.join("Assets.xcassets"))
+            .map_err(|e| CliError::operational(format!("create assets dir: {e}")))?;
+
+        write_text(
+            &ios_dir.join("project.yml"),
+            &tpl_ios_project_yml(&bundle_id, &lib_name),
+        )?;
+        write_text(
+            &ios_dir.join("Info.plist"),
+            &tpl_ios_info_plist(&display_name),
+        )?;
+        write_text(
+            &src_dir.join("App.swift"),
+            &tpl_ios_app_swift(&display_name),
+        )?;
+        write_text(&src_dir.join("AppManager.swift"), &tpl_ios_app_manager())?;
+        write_text(
+            &src_dir.join("ContentView.swift"),
+            &tpl_ios_content_view(&display_name),
+        )?;
+        write_text(
+            &assets_dir.join("Contents.json"),
+            &tpl_ios_appicon_contents(),
+        )?;
+        write_text(
+            &src_dir.join("Assets.xcassets/Contents.json"),
+            "{\"info\":{\"version\":1,\"author\":\"xcode\"}}\n",
+        )?;
+    }
+
+    // ── Android ─────────────────────────────────────────────────────────
+    if include_android {
+        let android_dir = dest.join("android");
+        let app_dir = android_dir.join("app");
+        let main_dir = app_dir.join("src/main");
+        let java_dir = main_dir.join(format!("java/{kotlin_pkg_path}"));
+        let ui_dir = java_dir.join("ui");
+        let theme_dir = ui_dir.join("theme");
+        let res_dir = main_dir.join("res");
+        let rust_bindings_dir = java_dir.join("rust");
+        let gradle_dir = android_dir.join("gradle/wrapper");
+
+        for d in [
+            &java_dir,
+            &ui_dir,
+            &theme_dir,
+            &rust_bindings_dir,
+            &res_dir.join("values"),
+            &res_dir.join("mipmap-hdpi"),
+            &gradle_dir,
+        ] {
+            std::fs::create_dir_all(d)
+                .map_err(|e| CliError::operational(format!("create android dirs: {e}")))?;
+        }
+
+        write_text(
+            &android_dir.join("build.gradle.kts"),
+            &tpl_android_root_gradle(),
+        )?;
+        write_text(
+            &android_dir.join("settings.gradle.kts"),
+            &tpl_android_settings_gradle(&display_name),
+        )?;
+        write_text(
+            &android_dir.join("gradle.properties"),
+            &tpl_android_gradle_properties(),
+        )?;
+        write_text(
+            &app_dir.join("build.gradle.kts"),
+            &tpl_android_app_gradle(&app_id, kotlin_pkg, &lib_name),
+        )?;
+        write_text(
+            &main_dir.join("AndroidManifest.xml"),
+            &tpl_android_manifest(kotlin_pkg, &display_name),
+        )?;
+        write_text(
+            &java_dir.join("MainActivity.kt"),
+            &tpl_android_main_activity(kotlin_pkg, &display_name),
+        )?;
+        write_text(
+            &java_dir.join("AppManager.kt"),
+            &tpl_android_app_manager(kotlin_pkg, &lib_name),
+        )?;
+        write_text(
+            &ui_dir.join("MainApp.kt"),
+            &tpl_android_main_app(kotlin_pkg, &display_name),
+        )?;
+        write_text(&theme_dir.join("Theme.kt"), &tpl_android_theme(kotlin_pkg))?;
+        write_text(
+            &res_dir.join("values/strings.xml"),
+            &tpl_android_strings(&display_name),
+        )?;
+        write_text(&res_dir.join("values/themes.xml"), &tpl_android_themes())?;
+        // Placeholder empty Kotlin file so Gradle's ensureUniffiGenerated doesn't fail
+        // before bindings are generated.
+        write_text(
+            &rust_bindings_dir.join(format!("{lib_name}.kt")),
+            &tpl_android_placeholder_bindings(kotlin_pkg, &lib_name),
+        )?;
+
+        // Minimal gradlew (just enough to exist; users normally get this from wrapper).
+        write_gradlew(&android_dir)?;
+    }
+
+    // ── Desktop (ICED) ────────────────────────────────────────────────────
+    if include_iced {
+        let desktop_dir = dest.join("desktop/iced");
+        std::fs::create_dir_all(desktop_dir.join("src"))
+            .map_err(|e| CliError::operational(format!("create desktop/iced/src: {e}")))?;
+        write_text(
+            &desktop_dir.join("Cargo.toml"),
+            &tpl_desktop_iced_cargo(&iced_package, &crate_name),
+        )?;
+        write_text(
+            &desktop_dir.join("src/main.rs"),
+            &tpl_desktop_iced_main(&display_name, &lib_name),
+        )?;
+    }
+
+    if include_git {
+        init_git_repo(&dest)?;
+    }
+
+    // ── Done ────────────────────────────────────────────────────────────
+    if json {
+        let mut platforms: Vec<&str> = vec![];
+        if include_ios {
+            platforms.push("ios");
+        }
+        if include_android {
+            platforms.push("android");
+        }
+        if include_iced {
+            platforms.push("iced");
+        }
+        json_print(&JsonOk {
+            ok: true,
+            data: serde_json::json!({
+                "path": dest,
+                "project": {
+                    "name": project_dir_name,
+                    "org": org,
+                    "bundle_id": bundle_id,
+                    "app_id": app_id,
+                    "crate_name": crate_name,
+                    "iced_package": iced_package,
+                    "flake": include_flake,
+                    "git": include_git,
+                },
+                "platforms": platforms,
+            }),
+        });
+    } else {
+        eprintln!("ok: initialized project at {}", dest.to_string_lossy());
+        if include_ios {
+            eprintln!("  ios bundle id: {bundle_id}");
+        }
+        if include_android {
+            eprintln!("  android app id: {app_id}");
+        }
+        if include_iced {
+            eprintln!("  desktop package: {iced_package}");
+        }
+        if include_flake {
+            eprintln!("  nix shell: flake.nix + .envrc generated (--flake)");
+        }
+        if include_git {
+            eprintln!("  git: initialized local repo + staged scaffold");
+        }
+        if include_flake {
+            eprintln!(
+                "  next: cd {} && nix develop -c just doctor",
+                dest.to_string_lossy()
+            );
+        } else {
+            eprintln!("  next: cd {} && rmp doctor", dest.to_string_lossy());
+        }
+    }
+
+    Ok(())
+}
+
+// ── Helpers ─────────────────────────────────────────────────────────────────
+
+fn resolve_toggle(include_flag: bool, exclude_flag: bool, default_value: bool) -> bool {
+    if exclude_flag {
+        false
+    } else if include_flag {
+        true
+    } else {
+        default_value
+    }
+}
+
+fn write_text(path: &Path, content: &str) -> Result<(), CliError> {
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent).map_err(|e| {
+            CliError::operational(format!("failed to create {}: {e}", parent.display()))
+        })?;
+    }
+    std::fs::write(path, content)
+        .map_err(|e| CliError::operational(format!("failed to write {}: {e}", path.display())))?;
+    Ok(())
+}
+
+fn init_git_repo(dest: &Path) -> Result<(), CliError> {
+    let init = Command::new("git")
+        .args(["init", "-q"])
+        .current_dir(dest)
+        .status()
+        .map_err(|e| CliError::operational(format!("failed to run `git init`: {e}")))?;
+    if !init.success() {
+        return Err(CliError::operational(
+            "failed to initialize git repo (`git init` exited non-zero)",
+        ));
+    }
+
+    let add = Command::new("git")
+        .args(["add", "."])
+        .current_dir(dest)
+        .status()
+        .map_err(|e| CliError::operational(format!("failed to run `git add .`: {e}")))?;
+    if !add.success() {
+        return Err(CliError::operational(
+            "failed to stage scaffold files (`git add .` exited non-zero)",
+        ));
+    }
+
+    Ok(())
+}
+
+fn validate_org(org: &str) -> Result<(), CliError> {
+    if org.trim().is_empty() || !org.contains('.') {
+        return Err(CliError::user(
+            "--org must be reverse-DNS style (for example: com.example)",
+        ));
+    }
+    validate_bundle_like("org", org)
+}
+
+fn validate_bundle_like(label: &str, value: &str) -> Result<(), CliError> {
+    if value.trim().is_empty() || !value.contains('.') {
+        return Err(CliError::user(format!(
+            "{label} must be dot-separated (for example: com.example.app)",
+        )));
+    }
+    for seg in value.split('.') {
+        if seg.is_empty()
+            || !seg
+                .chars()
+                .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
+        {
+            return Err(CliError::user(format!(
+                "{label} has invalid segment `{seg}` in `{value}`",
+            )));
+        }
+    }
+    Ok(())
+}
+
+fn java_identifier_segment(input: &str) -> String {
+    let mut out = String::new();
+    for c in input.chars() {
+        if c.is_ascii_alphanumeric() {
+            out.push(c.to_ascii_lowercase());
+        }
+    }
+    if out.is_empty() {
+        "app".to_string()
+    } else if out.chars().next().unwrap().is_ascii_digit() {
+        format!("app{out}")
+    } else {
+        out
+    }
+}
+
+fn rust_crate_name(input: &str) -> String {
+    let mut out = String::new();
+    for c in input.chars() {
+        if c.is_ascii_alphanumeric() || c == '-' || c == '_' {
+            out.push(c.to_ascii_lowercase());
+        } else if c == ' ' {
+            out.push('_');
+        }
+    }
+    if out.is_empty() {
+        "app_core".to_string()
+    } else {
+        // Ensure it ends with _core for clarity.
+        if !out.ends_with("_core") && !out.ends_with("-core") {
+            out.push_str("_core");
+        }
+        out
+    }
+}
+
+fn display_name(input: &str) -> String {
+    let mut parts: Vec<String> = vec![];
+    for tok in input
+        .split(|c: char| !c.is_ascii_alphanumeric())
+        .filter(|s| !s.is_empty())
+    {
+        let mut chars = tok.chars();
+        if let Some(first) = chars.next() {
+            let mut part = String::new();
+            part.push(first.to_ascii_uppercase());
+            for ch in chars {
+                part.push(ch.to_ascii_lowercase());
+            }
+            parts.push(part);
+        }
+    }
+    if parts.is_empty() {
+        "App".to_string()
+    } else {
+        parts.join(" ")
+    }
+}
+
+// ── Template functions ──────────────────────────────────────────────────────
+
+fn tpl_gitignore() -> String {
+    r#"/target
+.direnv/
+.DS_Store
+*.swp
+*.swo
+flake.lock
+staging/
+ios/Bindings/
+ios/Frameworks/
+ios/.build/
+ios/*.xcodeproj
+android/app/src/main/jniLibs/
+android/.gradle/
+android/build/
+android/app/build/
+android/local.properties
+"#
+    .to_string()
+}
+
+fn tpl_workspace_toml(include_iced: bool) -> String {
+    let mut members = vec!["  \"rust\",", "  \"uniffi-bindgen\","];
+    if include_iced {
+        members.push("  \"desktop/iced\",");
+    }
+    format!(
+        "[workspace]\nresolver = \"2\"\nmembers = [\n{}\n]\n",
+        members.join("\n")
+    )
+}
+
+fn tpl_rmp_toml(
+    project_name: &str,
+    org: &str,
+    crate_name: &str,
+    bundle_id: &str,
+    app_id: &str,
+    include_ios: bool,
+    include_android: bool,
+    include_iced: bool,
+    iced_package: &str,
+) -> String {
+    let mut out = format!(
+        r#"[project]
+name = "{project_name}"
+org = "{org}"
+
+[core]
+crate = "{crate_name}"
+bindings = "uniffi"
+"#
+    );
+
+    if include_ios {
+        out.push_str(&format!(
+            r#"
+[ios]
+bundle_id = "{bundle_id}"
+"#
+        ));
+    }
+
+    if include_android {
+        out.push_str(&format!(
+            r#"
+[android]
+app_id = "{app_id}"
+"#
+        ));
+    }
+
+    if include_iced {
+        out.push_str(&format!(
+            r#"
+[desktop]
+targets = ["iced"]
+
+[desktop.iced]
+package = "{iced_package}"
+"#
+        ));
+    }
+
+    out
+}
+
+fn tpl_justfile(
+    include_ios: bool,
+    include_android: bool,
+    include_iced: bool,
+    crate_name: &str,
+    lib_name: &str,
+    iced_package: &str,
+) -> String {
+    let xcf_name = pascal_case(lib_name);
+    let header = format!(
+        "set shell := [\"bash\", \"-c\"]\n\
+         \n\
+         CORE_CRATE := \"{crate_name}\"\n\
+         LIB_NAME := \"{lib_name}\"\n\
+         XCF_NAME := \"{xcf_name}\"\n\
+         ICED_PACKAGE := \"{iced_package}\"\n",
+    );
+    let mut out = header;
+    out.push_str(
+        r#"
+default:
+  @just --list
+
+doctor:
+  rmp doctor
+
+# Build Rust core for the host (needed for uniffi-bindgen).
+rust-build-host:
+  cargo build -p {{CORE_CRATE}} --release
+
+bindings:
+  rmp bindings all
+"#,
+    );
+
+    if include_ios {
+        out.push_str(
+            r#"
+# ── iOS ──────────────────────────────────────────────────────────────────────
+
+XCODE_DEV := "/Applications/Xcode.app/Contents/Developer"
+TOOLCHAIN_BIN := XCODE_DEV / "Toolchains/XcodeDefault.xctoolchain/usr/bin"
+
+run-ios:
+  rmp run ios
+
+ios-gen-swift: rust-build-host
+  rmp bindings swift
+
+# Cross-compile Rust for iOS device and simulator (arm64).
+ios-rust:
+  #!/usr/bin/env bash
+  set -e
+  IOS_SDK="{{XCODE_DEV}}/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS.sdk"
+  SIM_SDK="{{XCODE_DEV}}/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator.sdk"
+  for pair in "aarch64-apple-ios $IOS_SDK -miphoneos-version-min=17.0" \
+              "aarch64-apple-ios-sim $SIM_SDK -mios-simulator-version-min=17.0"; do
+    set -- $pair; TARGET=$1; SDK=$2; VFLAG=$3
+    env -u SDKROOT -u MACOSX_DEPLOYMENT_TARGET -u CC -u CXX -u AR -u RANLIB -u LIBRARY_PATH \
+      DEVELOPER_DIR="{{XCODE_DEV}}" SDKROOT="$SDK" CC="{{TOOLCHAIN_BIN}}/clang" \
+      RUSTFLAGS="-C linker={{TOOLCHAIN_BIN}}/clang -C link-arg=$VFLAG -C link-arg=-isysroot -C link-arg=$SDK" \
+      cargo build -p {{CORE_CRATE}} --lib --target "$TARGET" --release
+  done
+
+# Package static libs into an xcframework.
+ios-xcframework:
+  #!/usr/bin/env bash
+  set -e
+  rm -rf ios/Frameworks/{{XCF_NAME}}.xcframework staging
+  mkdir -p staging/headers
+  cp ios/Bindings/{{LIB_NAME}}FFI.h staging/headers/
+  cp ios/Bindings/{{LIB_NAME}}FFI.modulemap staging/headers/module.modulemap
+  xcodebuild -create-xcframework \
+    -library target/aarch64-apple-ios/release/lib{{LIB_NAME}}.a -headers staging/headers \
+    -library target/aarch64-apple-ios-sim/release/lib{{LIB_NAME}}.a -headers staging/headers \
+    -output ios/Frameworks/{{XCF_NAME}}.xcframework
+  rm -rf staging
+
+ios-xcodeproj:
+  cd ios && xcodegen generate
+
+# Build the iOS app for simulator (run outside Nix shell if linking fails).
+ios-build:
+  #!/usr/bin/env bash
+  set -e
+  env -u NIX_LDFLAGS -u NIX_CFLAGS_COMPILE -u SDKROOT -u MACOSX_DEPLOYMENT_TARGET \
+    -u CC -u CXX -u AR -u RANLIB -u LIBRARY_PATH \
+    DEVELOPER_DIR="{{XCODE_DEV}}" \
+    xcodebuild build \
+      -project ios/App.xcodeproj -scheme App \
+      -destination "generic/platform=iOS Simulator" \
+      -configuration Debug CODE_SIGNING_ALLOWED=NO ARCHS=arm64 ONLY_ACTIVE_ARCH=YES
+
+# Full iOS pipeline: host build → bindings → cross-compile → xcframework → xcodegen → build.
+ios-full: ios-gen-swift ios-rust ios-xcframework ios-xcodeproj ios-build
+"#,
+        );
+    }
+
+    if include_android {
+        out.push_str(
+            r#"
+# ── Android ──────────────────────────────────────────────────────────────────
+
+run-android:
+  rmp run android
+
+gen-kotlin: rust-build-host
+  rmp bindings kotlin
+
+# Cross-compile Rust for Android ABIs.
+android-rust:
+  cargo ndk -o android/app/src/main/jniLibs -P 26 \
+    -t arm64-v8a -t armeabi-v7a -t x86_64 \
+    build -p {{CORE_CRATE}} --release
+
+android-assemble:
+  cd android && ./gradlew :app:assembleDebug
+
+# Full Android pipeline: host build → bindings → cross-compile → assemble.
+android-full: gen-kotlin android-rust android-assemble
+"#,
+        );
+    }
+
+    if include_iced {
+        out.push_str(
+            r#"
+# ── Desktop (iced) ───────────────────────────────────────────────────────────
+
+run-iced:
+  cargo run -p {{ICED_PACKAGE}}
+"#,
+        );
+    }
+
+    out.push_str(
+        r#"
+# ── Utilities ────────────────────────────────────────────────────────────────
+
+# Rebuild Rust + regenerate bindings for all platforms (no platform build).
+rebind: rust-build-host bindings
+"#,
+    );
+
+    out
+}
+
+fn tpl_readme(
+    display_name: &str,
+    include_ios: bool,
+    include_android: bool,
+    include_iced: bool,
+    include_flake: bool,
+) -> String {
+    let mut s = if include_flake {
+        format!(
+            r#"# {display_name}
+
+A cross-platform app built with [RMP](https://github.com/nickthecook/rmp) (Rust Multiplatform).
+
+## Quick Start
+
+```bash
+nix develop -c just doctor
+nix develop -c just bindings
+"#
+        )
+    } else {
+        format!(
+            r#"# {display_name}
+
+A cross-platform app built with [RMP](https://github.com/nickthecook/rmp) (Rust Multiplatform).
+
+## Quick Start
+
+```bash
+rmp doctor
+rmp bindings all
+"#
+        )
+    };
+    if include_ios {
+        if include_flake {
+            s.push_str("nix develop -c just run-ios\n");
+        } else {
+            s.push_str("rmp run ios\n");
+        }
+    }
+    if include_android {
+        if include_flake {
+            s.push_str("nix develop -c just run-android\n");
+        } else {
+            s.push_str("rmp run android\n");
+        }
+    }
+    if include_iced {
+        if include_flake {
+            s.push_str("nix develop -c just run-iced\n");
+        } else {
+            s.push_str("rmp run iced\n");
+        }
+    }
+    s.push_str("```\n");
+    if include_flake {
+        s.push_str("\nOptional: enable direnv (`.envrc` is included and uses `use flake`).\n");
+    }
+    s
+}
+
+fn tpl_envrc() -> String {
+    "use flake\n".to_string()
+}
+
+fn tpl_flake_nix() -> String {
+    r#"{
+  description = "RMP app dev environment";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    android-nixpkgs = {
+      url = "github:tadfisher/android-nixpkgs";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs = { nixpkgs, flake-utils, rust-overlay, android-nixpkgs, ... }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = import nixpkgs {
+          inherit system;
+          overlays = [ (import rust-overlay) ];
+          config.allowUnfree = true;
+          config.android_sdk.accept_license = true;
+        };
+
+        rustToolchain = pkgs.rust-bin.stable.latest.default.override {
+          extensions = [ "rust-src" "rust-analyzer" ];
+          targets = [
+            "aarch64-linux-android"
+            "armv7-linux-androideabi"
+            "x86_64-linux-android"
+            "aarch64-apple-ios"
+            "aarch64-apple-ios-sim"
+            "x86_64-apple-ios"
+          ];
+        };
+
+        androidSdk = android-nixpkgs.sdk.${system} (sdkPkgs: with sdkPkgs; [
+          cmdline-tools-latest
+          platform-tools
+          build-tools-34-0-0
+          build-tools-35-0-0
+          platforms-android-34
+          platforms-android-35
+          ndk-28-2-13676358
+          emulator
+          (if pkgs.stdenv.isDarwin
+           then system-images-android-35-google-apis-arm64-v8a
+           else system-images-android-35-google-apis-x86-64)
+        ]);
+
+        rmp = pkgs.writeShellScriptBin "rmp" ''
+          set -euo pipefail
+          if [ -z "''${RMP_REPO:-}" ]; then
+            echo "error: set RMP_REPO to a checkout containing the rmp-cli crate" >&2
+            exit 2
+          fi
+          # Support both workspace layout ($RMP_REPO/Cargo.toml with -p rmp-cli)
+          # and standalone layout ($RMP_REPO/rmp-cli/Cargo.toml).
+          if [ -f "$RMP_REPO/Cargo.toml" ] && grep -q "rmp-cli" "$RMP_REPO/Cargo.toml" 2>/dev/null; then
+            exec cargo run --manifest-path "$RMP_REPO/Cargo.toml" -p rmp-cli -- "$@"
+          elif [ -f "$RMP_REPO/rmp-cli/Cargo.toml" ]; then
+            exec cargo run --manifest-path "$RMP_REPO/rmp-cli/Cargo.toml" -- "$@"
+          else
+            echo "error: RMP_REPO=$RMP_REPO does not contain rmp-cli (checked workspace and standalone layouts)" >&2
+            exit 2
+          fi
+        '';
+
+        shell = pkgs.mkShell {
+          buildInputs = pkgs.lib.optionals pkgs.stdenv.isDarwin [
+            pkgs.libiconv
+          ];
+
+          packages = [
+            rustToolchain
+            androidSdk
+            pkgs.just
+            pkgs.nodejs_22
+            pkgs.python3
+            pkgs.curl
+            pkgs.git
+            pkgs.gradle
+            rmp
+          ] ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [
+            pkgs.xcodegen
+          ];
+
+          shellHook = ''
+            export IN_NIX_SHELL=1
+            export ANDROID_HOME=${androidSdk}/share/android-sdk
+            export ANDROID_SDK_ROOT=${androidSdk}/share/android-sdk
+            export ANDROID_NDK_HOME="$ANDROID_HOME/ndk/28.2.13676358"
+            export PATH=$ANDROID_HOME/emulator:$ANDROID_HOME/platform-tools:$ANDROID_HOME/cmdline-tools/latest/bin:$PATH
+
+            # Auto-detect rmp-cli in parent directory (common monorepo layout).
+            if [ -z "''${RMP_REPO:-}" ]; then
+              _parent="$(cd .. 2>/dev/null && pwd)"
+              if [ -f "$_parent/rmp-cli/Cargo.toml" ]; then
+                export RMP_REPO="$_parent"
+              fi
+            fi
+
+            if [ "$(uname -s)" = "Darwin" ]; then
+              if [ -n "''${DEVELOPER_DIR:-}" ] && [ -x "''${DEVELOPER_DIR}/usr/bin/simctl" ]; then
+                DEV_DIR="$DEVELOPER_DIR"
+              else
+                DEV_DIR="$(xcode-select -p 2>/dev/null || true)"
+              fi
+              if [ -n "$DEV_DIR" ] && [ -d "$DEV_DIR/Toolchains/XcodeDefault.xctoolchain/usr/bin" ]; then
+                export DEVELOPER_DIR="$DEV_DIR"
+                TOOLCHAIN_BIN="$DEV_DIR/Toolchains/XcodeDefault.xctoolchain/usr/bin"
+                export CC="$TOOLCHAIN_BIN/clang"
+                export CXX="$TOOLCHAIN_BIN/clang++"
+                export AR="$TOOLCHAIN_BIN/ar"
+                export RANLIB="$TOOLCHAIN_BIN/ranlib"
+              fi
+            fi
+
+            mkdir -p android
+            cat > android/local.properties <<EOF
+            sdk.dir=$ANDROID_HOME
+EOF
+
+            echo ""
+            echo "RMP app dev environment ready"
+            echo "  Rust: $(rustc --version)"
+            echo "  RMP repo: ''${RMP_REPO:-(not set)}"
+            echo ""
+          '';
+        };
+      in {
+        devShells.default = shell;
+      }
+    );
+}
+"#
+    .to_string()
+}
+
+fn tpl_rust_cargo(crate_name: &str) -> String {
+    format!(
+        r#"[package]
+name = "{crate_name}"
+version = "0.1.0"
+edition = "2021"
+
+[lib]
+crate-type = ["cdylib", "staticlib", "rlib"]
+
+[dependencies]
+flume = "0.11"
+uniffi = "0.31.0"
+"#
+    )
+}
+
+fn tpl_rust_lib() -> String {
+    r#"use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, RwLock};
+use std::thread;
+
+use flume::{Receiver, Sender};
+
+uniffi::setup_scaffolding!();
+
+// ── State ───────────────────────────────────────────────────────────────────
+
+#[derive(uniffi::Record, Clone, Debug)]
+pub struct AppState {
+    pub rev: u64,
+    pub greeting: String,
+}
+
+impl AppState {
+    fn empty() -> Self {
+        Self {
+            rev: 0,
+            greeting: "Hello from Rust!".to_string(),
+        }
+    }
+}
+
+// ── Actions & Updates ───────────────────────────────────────────────────────
+
+#[derive(uniffi::Enum, Clone, Debug)]
+pub enum AppAction {
+    SetName { name: String },
+}
+
+#[derive(uniffi::Enum, Clone, Debug)]
+pub enum AppUpdate {
+    FullState(AppState),
+}
+
+// ── Callback interface ──────────────────────────────────────────────────────
+
+#[uniffi::export(callback_interface)]
+pub trait AppReconciler: Send + Sync + 'static {
+    fn reconcile(&self, update: AppUpdate);
+}
+
+// ── FFI entry point ─────────────────────────────────────────────────────────
+
+enum CoreMsg {
+    Action(AppAction),
+}
+
+#[derive(uniffi::Object)]
+pub struct FfiApp {
+    core_tx: Sender<CoreMsg>,
+    update_rx: Receiver<AppUpdate>,
+    listening: AtomicBool,
+    shared_state: Arc<RwLock<AppState>>,
+}
+
+#[uniffi::export]
+impl FfiApp {
+    #[uniffi::constructor]
+    pub fn new(data_dir: String) -> Arc<Self> {
+        let _ = data_dir; // reserved for future use
+
+        let (update_tx, update_rx) = flume::unbounded();
+        let (core_tx, core_rx) = flume::unbounded::<CoreMsg>();
+        let shared_state = Arc::new(RwLock::new(AppState::empty()));
+
+        let shared_for_core = shared_state.clone();
+        thread::spawn(move || {
+            let mut state = AppState::empty();
+            let mut rev: u64 = 0;
+
+            // Emit initial state.
+            {
+                let snapshot = state.clone();
+                match shared_for_core.write() {
+                    Ok(mut g) => *g = snapshot.clone(),
+                    Err(p) => *p.into_inner() = snapshot.clone(),
+                }
+                let _ = update_tx.send(AppUpdate::FullState(snapshot));
+            }
+
+            while let Ok(msg) = core_rx.recv() {
+                match msg {
+                    CoreMsg::Action(action) => match action {
+                        AppAction::SetName { name } => {
+                            rev += 1;
+                            state.rev = rev;
+                            if name.trim().is_empty() {
+                                state.greeting = "Hello from Rust!".to_string();
+                            } else {
+                                state.greeting = format!("Hello, {}!", name.trim());
+                            }
+                            let snapshot = state.clone();
+                            match shared_for_core.write() {
+                                Ok(mut g) => *g = snapshot.clone(),
+                                Err(p) => *p.into_inner() = snapshot.clone(),
+                            }
+                            let _ = update_tx.send(AppUpdate::FullState(snapshot));
+                        }
+                    },
+                }
+            }
+        });
+
+        Arc::new(Self {
+            core_tx,
+            update_rx,
+            listening: AtomicBool::new(false),
+            shared_state,
+        })
+    }
+
+    pub fn state(&self) -> AppState {
+        match self.shared_state.read() {
+            Ok(g) => g.clone(),
+            Err(poison) => poison.into_inner().clone(),
+        }
+    }
+
+    pub fn dispatch(&self, action: AppAction) {
+        let _ = self.core_tx.send(CoreMsg::Action(action));
+    }
+
+    pub fn listen_for_updates(&self, reconciler: Box<dyn AppReconciler>) {
+        if self
+            .listening
+            .compare_exchange(false, true, Ordering::SeqCst, Ordering::SeqCst)
+            .is_err()
+        {
+            return;
+        }
+
+        let rx = self.update_rx.clone();
+        thread::spawn(move || {
+            while let Ok(update) = rx.recv() {
+                reconciler.reconcile(update);
+            }
+        });
+    }
+}
+"#
+    .to_string()
+}
+
+fn tpl_uniffi_toml(kotlin_pkg: &str, lib_name: &str) -> String {
+    format!(
+        r#"[bindings.kotlin]
+package_name = "{kotlin_pkg}.rust"
+cdylib_name = "{lib_name}"
+"#
+    )
+}
+
+fn tpl_uniffi_bindgen_cargo() -> String {
+    r#"[package]
+name = "uniffi-bindgen"
+version = "0.1.0"
+edition = "2021"
+publish = false
+
+[dependencies]
+uniffi = { version = "0.31.0", features = ["cli"] }
+"#
+    .to_string()
+}
+
+// ── Desktop (ICED) templates ───────────────────────────────────────────────
+
+fn tpl_desktop_iced_cargo(package: &str, core_crate: &str) -> String {
+    format!(
+        r#"[package]
+name = "{package}"
+version = "0.1.0"
+edition = "2021"
+publish = false
+
+[dependencies]
+{core_crate} = {{ path = "../../rust" }}
+iced = "0.14"
+flume = "0.11"
+dirs-next = "2"
+"#
+    )
+}
+
+fn tpl_desktop_iced_main(display_name: &str, core_lib: &str) -> String {
+    format!(
+        r#"use iced::Center;
+use iced::widget::{{button, column, container, text, text_input}};
+use iced::{{Element, Fill, Subscription, Task, Theme}};
+use std::sync::Arc;
+use {core_lib}::{{AppAction, AppState, FfiApp}};
+
+fn main() -> iced::Result {{
+    iced::application(App::new, App::update, App::view)
+        .title("{display_name}")
+        .subscription(App::subscription)
+        .run()
+}}
+
+// ── AppManager ──────────────────────────────────────────────────────────────
+
+#[derive(Clone)]
+struct AppManager {{
+    ffi: Arc<FfiApp>,
+    update_rx: flume::Receiver<()>,
+}}
+
+impl AppManager {{
+    fn new() -> Result<Self, String> {{
+        let data_dir = dirs_next::data_dir()
+            .unwrap_or_else(|| std::path::PathBuf::from("."))
+            .join("{display_name}")
+            .to_string_lossy()
+            .to_string();
+        let _ = std::fs::create_dir_all(&data_dir);
+
+        let ffi = FfiApp::new(data_dir);
+        let (notify_tx, update_rx) = flume::unbounded();
+        ffi.listen_for_updates(Box::new(DesktopReconciler {{ tx: notify_tx }}));
+
+        Ok(Self {{ ffi, update_rx }})
+    }}
+
+    fn state(&self) -> AppState {{
+        self.ffi.state()
+    }}
+
+    fn dispatch(&self, action: AppAction) {{
+        self.ffi.dispatch(action);
+    }}
+
+    fn subscribe_updates(&self) -> flume::Receiver<()> {{
+        self.update_rx.clone()
+    }}
+}}
+
+struct DesktopReconciler {{
+    tx: flume::Sender<()>,
+}}
+
+impl {core_lib}::AppReconciler for DesktopReconciler {{
+    fn reconcile(&self, _update: {core_lib}::AppUpdate) {{
+        let _ = self.tx.send(());
+    }}
+}}
+
+fn manager_update_stream(manager: &AppManager) -> impl iced::futures::Stream<Item = ()> {{
+    let rx = manager.subscribe_updates();
+    iced::futures::stream::unfold(rx, |rx| async move {{
+        match rx.recv_async().await {{
+            Ok(()) => Some(((), rx)),
+            Err(_) => None,
+        }}
+    }})
+}}
+
+// ── App ─────────────────────────────────────────────────────────────────────
+
+enum App {{
+    BootError {{ error: String }},
+    Loaded {{
+        manager: AppManager,
+        state: AppState,
+        name_input: String,
+    }},
+}}
+
+#[derive(Debug, Clone)]
+enum Message {{
+    CoreUpdated,
+    NameChanged(String),
+    Apply,
+}}
+
+impl App {{
+    fn new() -> (Self, Task<Message>) {{
+        let app = match AppManager::new() {{
+            Ok(manager) => {{
+                let state = manager.state();
+                Self::Loaded {{
+                    manager,
+                    state,
+                    name_input: String::new(),
+                }}
+            }}
+            Err(error) => Self::BootError {{ error }},
+        }};
+        (app, Task::none())
+    }}
+
+    fn subscription(&self) -> Subscription<Message> {{
+        match self {{
+            App::BootError {{ .. }} => Subscription::none(),
+            App::Loaded {{ manager, .. }} => {{
+                Subscription::run_with(manager.clone(), manager_update_stream)
+                    .map(|_| Message::CoreUpdated)
+            }}
+        }}
+    }}
+
+    fn update(&mut self, message: Message) -> Task<Message> {{
+        match self {{
+            App::BootError {{ .. }} => {{}}
+            App::Loaded {{
+                manager,
+                state,
+                name_input,
+            }} => match message {{
+                Message::CoreUpdated => {{
+                    let latest = manager.state();
+                    if latest.rev > state.rev {{
+                        *state = latest;
+                    }}
+                }}
+                Message::NameChanged(name) => {{
+                    *name_input = name;
+                }}
+                Message::Apply => {{
+                    manager.dispatch(AppAction::SetName {{
+                        name: name_input.clone(),
+                    }});
+                }}
+            }},
+        }}
+        Task::none()
+    }}
+
+    fn view(&self) -> Element<'_, Message> {{
+        match self {{
+            App::BootError {{ error }} => container(
+                column![
+                    text("{display_name}").size(24),
+                    text(error).color([0.8, 0.2, 0.2]),
+                ]
+                .spacing(12),
+            )
+            .center_x(Fill)
+            .center_y(Fill)
+            .into(),
+            App::Loaded {{
+                state, name_input, ..
+            }} => container(
+                column![
+                    text("{display_name}").size(24),
+                    text(&state.greeting).size(20),
+                    text_input("Enter a name", name_input)
+                        .on_input(Message::NameChanged)
+                        .on_submit(Message::Apply),
+                    button("Apply").on_press(Message::Apply),
+                ]
+                .padding(24)
+                .spacing(12)
+                .align_x(Center),
+            )
+            .center_x(Fill)
+            .center_y(Fill)
+            .into()
+        }}
+    }}
+}}
+"#
+    )
+}
+
+// ── iOS templates ───────────────────────────────────────────────────────────
+
+fn tpl_ios_project_yml(bundle_id: &str, lib_name: &str) -> String {
+    // The Xcode project and target are always called "App" — neutral, no renaming needed.
+    // The xcframework name derives from the lib name using PascalCase.
+    let xcf_name = pascal_case(lib_name);
+    format!(
+        r#"name: App
+options:
+  bundleIdPrefix: {bundle_id}
+  deploymentTarget:
+    iOS: "17.0"
+  createIntermediateGroups: true
+
+settings:
+  base:
+    PRODUCT_BUNDLE_IDENTIFIER: {bundle_id}
+    MARKETING_VERSION: 0.1.0
+    CURRENT_PROJECT_VERSION: 1
+    SWIFT_VERSION: 5.0
+  configs:
+    Debug:
+      PRODUCT_BUNDLE_IDENTIFIER: {bundle_id}.dev
+
+targets:
+  App:
+    type: application
+    platform: iOS
+    sources:
+      - path: Sources
+      - path: Bindings
+        excludes:
+          - "*.h"
+          - "*.modulemap"
+    settings:
+      base:
+        INFOPLIST_FILE: Info.plist
+        ASSETCATALOG_COMPILER_APPICON_NAME: AppIcon
+    dependencies:
+      - framework: Frameworks/{xcf_name}.xcframework
+        embed: false
+
+schemes:
+  App:
+    build:
+      targets:
+        App: all
+"#
+    )
+}
+
+fn tpl_ios_info_plist(display_name: &str) -> String {
+    format!(
+        r#"<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>en</string>
+	<key>CFBundleDisplayName</key>
+	<string>{display_name}</string>
+	<key>CFBundleExecutable</key>
+	<string>$(EXECUTABLE_NAME)</string>
+	<key>CFBundleIdentifier</key>
+	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+	<key>CFBundleName</key>
+	<string>$(PRODUCT_NAME)</string>
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>$(MARKETING_VERSION)</string>
+	<key>CFBundleVersion</key>
+	<string>$(CURRENT_PROJECT_VERSION)</string>
+	<key>UILaunchScreen</key>
+	<dict/>
+	<key>UISupportedInterfaceOrientations</key>
+	<array>
+		<string>UIInterfaceOrientationPortrait</string>
+	</array>
+</dict>
+</plist>
+"#
+    )
+}
+
+fn tpl_ios_app_swift(display_name: &str) -> String {
+    format!(
+        r#"import SwiftUI
+
+@main
+struct {entry_name}: App {{
+    @State private var manager = AppManager()
+
+    var body: some Scene {{
+        WindowGroup {{
+            ContentView(manager: manager)
+        }}
+    }}
+}}
+"#,
+        entry_name = swift_app_entry_name(display_name),
+    )
+}
+
+fn tpl_ios_app_manager() -> String {
+    r#"import Foundation
+import Observation
+
+@MainActor
+@Observable
+final class AppManager: AppReconciler {
+    let rust: FfiApp
+    var state: AppState
+    private var lastRevApplied: UInt64
+
+    init() {
+        let fm = FileManager.default
+        let dataDirUrl = fm.urls(for: .applicationSupportDirectory, in: .userDomainMask).first!
+        let dataDir = dataDirUrl.path
+        try? fm.createDirectory(at: dataDirUrl, withIntermediateDirectories: true)
+
+        let rust = FfiApp(dataDir: dataDir)
+        self.rust = rust
+
+        let initial = rust.state()
+        self.state = initial
+        self.lastRevApplied = initial.rev
+
+        rust.listenForUpdates(reconciler: self)
+    }
+
+    nonisolated func reconcile(update: AppUpdate) {
+        Task { @MainActor [weak self] in
+            self?.apply(update: update)
+        }
+    }
+
+    private func apply(update: AppUpdate) {
+        switch update {
+        case .fullState(let s):
+            if s.rev <= lastRevApplied { return }
+            lastRevApplied = s.rev
+            state = s
+        }
+    }
+
+    func dispatch(_ action: AppAction) {
+        rust.dispatch(action: action)
+    }
+}
+"#
+    .to_string()
+}
+
+fn tpl_ios_content_view(display_name: &str) -> String {
+    format!(
+        r#"import SwiftUI
+
+struct ContentView: View {{
+    @Bindable var manager: AppManager
+    @State private var nameInput = ""
+
+    var body: some View {{
+        VStack(spacing: 24) {{
+            Text("{display_name}")
+                .font(.largeTitle.weight(.semibold))
+
+            Text(manager.state.greeting)
+                .font(.title3)
+
+            TextField("Enter your name", text: $nameInput)
+                .textFieldStyle(.roundedBorder)
+                .onSubmit {{
+                    manager.dispatch(.setName(name: nameInput))
+                }}
+
+            Button("Greet") {{
+                manager.dispatch(.setName(name: nameInput))
+            }}
+            .buttonStyle(.borderedProminent)
+        }}
+        .padding(20)
+    }}
+}}
+"#
+    )
+}
+
+fn tpl_ios_appicon_contents() -> String {
+    r#"{
+  "images" : [
+    {
+      "idiom" : "universal",
+      "platform" : "ios",
+      "size" : "1024x1024"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}
+"#
+    .to_string()
+}
+
+// ── Android templates ───────────────────────────────────────────────────────
+
+fn tpl_android_root_gradle() -> String {
+    r#"plugins {
+    id("com.android.application") version "8.5.1" apply false
+    id("org.jetbrains.kotlin.android") version "1.9.24" apply false
+}
+"#
+    .to_string()
+}
+
+fn tpl_android_settings_gradle(display_name: &str) -> String {
+    format!(
+        r#"pluginManagement {{
+    repositories {{
+        google()
+        mavenCentral()
+        gradlePluginPortal()
+    }}
+}}
+dependencyResolutionManagement {{
+    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
+    repositories {{
+        google()
+        mavenCentral()
+    }}
+}}
+rootProject.name = "{display_name}"
+include(":app")
+"#
+    )
+}
+
+fn tpl_android_gradle_properties() -> String {
+    r#"android.useAndroidX=true
+kotlin.code.style=official
+org.gradle.jvmargs=-Xmx2048m
+"#
+    .to_string()
+}
+
+fn tpl_android_app_gradle(app_id: &str, kotlin_pkg: &str, lib_name: &str) -> String {
+    format!(
+        r#"plugins {{
+    id("com.android.application")
+    id("org.jetbrains.kotlin.android")
+}}
+
+android {{
+    namespace = "{kotlin_pkg}"
+    compileSdk = 35
+    ndkVersion = "28.2.13676358"
+
+    defaultConfig {{
+        applicationId = "{app_id}"
+        minSdk = 26
+        targetSdk = 35
+        versionCode = 1
+        versionName = "0.1.0"
+    }}
+
+    buildTypes {{
+        debug {{
+            applicationIdSuffix = ".dev"
+            versionNameSuffix = "-dev"
+        }}
+        release {{
+            isMinifyEnabled = false
+            proguardFiles(
+                getDefaultProguardFile("proguard-android-optimize.txt"),
+            )
+        }}
+    }}
+
+    buildFeatures {{
+        compose = true
+    }}
+
+    composeOptions {{
+        kotlinCompilerExtensionVersion = "1.5.14"
+    }}
+
+    compileOptions {{
+        sourceCompatibility = JavaVersion.VERSION_17
+        targetCompatibility = JavaVersion.VERSION_17
+    }}
+
+    kotlinOptions {{
+        jvmTarget = "17"
+    }}
+
+    packaging {{
+        resources.excludes.addAll(
+            listOf("/META-INF/{{AL2.0,LGPL2.1}}", "META-INF/DEPENDENCIES"),
+        )
+    }}
+
+    sourceSets {{
+        getByName("main") {{
+            jniLibs.srcDirs("src/main/jniLibs")
+        }}
+    }}
+}}
+
+tasks.register("ensureUniffiGenerated") {{
+    doLast {{
+        val out = file("src/main/java/{pkg_path}/rust/{lib_name}.kt")
+        if (!out.exists()) {{
+            throw GradleException("Missing UniFFI Kotlin bindings. Run `rmp bindings kotlin` first.")
+        }}
+    }}
+}}
+
+tasks.named("preBuild") {{
+    dependsOn("ensureUniffiGenerated")
+}}
+
+dependencies {{
+    val composeBom = platform("androidx.compose:compose-bom:2024.06.00")
+    implementation(composeBom)
+
+    implementation("androidx.core:core-ktx:1.13.1")
+    implementation("androidx.activity:activity-compose:1.9.0")
+    implementation("androidx.lifecycle:lifecycle-runtime-ktx:2.8.3")
+
+    implementation("androidx.compose.ui:ui")
+    implementation("androidx.compose.ui:ui-tooling-preview")
+    implementation("androidx.compose.material3:material3")
+
+    debugImplementation("androidx.compose.ui:ui-tooling")
+
+    // UniFFI JNA
+    implementation("net.java.dev.jna:jna:5.14.0@aar")
+}}
+"#,
+        pkg_path = kotlin_pkg.replace('.', "/"),
+    )
+}
+
+fn tpl_android_manifest(_kotlin_pkg: &str, display_name: &str) -> String {
+    format!(
+        r#"<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <uses-permission android:name="android.permission.INTERNET" />
+
+    <application
+        android:allowBackup="true"
+        android:label="{display_name}"
+        android:supportsRtl="true"
+        android:theme="@style/Theme.App">
+
+        <activity
+            android:name=".MainActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+
+    </application>
+
+</manifest>
+"#
+    )
+}
+
+fn tpl_android_main_activity(kotlin_pkg: &str, _display_name: &str) -> String {
+    format!(
+        r#"package {kotlin_pkg}
+
+import android.os.Bundle
+import androidx.activity.ComponentActivity
+import androidx.activity.compose.setContent
+import {kotlin_pkg}.ui.MainApp
+import {kotlin_pkg}.ui.theme.AppTheme
+
+class MainActivity : ComponentActivity() {{
+    private lateinit var manager: AppManager
+
+    override fun onCreate(savedInstanceState: Bundle?) {{
+        super.onCreate(savedInstanceState)
+        manager = AppManager.getInstance(applicationContext)
+        setContent {{
+            AppTheme {{
+                MainApp(manager = manager)
+            }}
+        }}
+    }}
+}}
+"#
+    )
+}
+
+fn tpl_android_app_manager(kotlin_pkg: &str, _lib_name: &str) -> String {
+    format!(
+        r#"package {kotlin_pkg}
+
+import android.content.Context
+import android.os.Handler
+import android.os.Looper
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.setValue
+import {kotlin_pkg}.rust.AppAction
+import {kotlin_pkg}.rust.AppReconciler
+import {kotlin_pkg}.rust.AppState
+import {kotlin_pkg}.rust.AppUpdate
+import {kotlin_pkg}.rust.FfiApp
+
+class AppManager private constructor(context: Context) : AppReconciler {{
+    private val mainHandler = Handler(Looper.getMainLooper())
+    private val rust: FfiApp
+    private var lastRevApplied: ULong = 0UL
+
+    // NOTE: This placeholder is immediately replaced by the Rust core's
+    // initial state snapshot in init{{}}. If you change AppState fields in
+    // Rust, update this placeholder to match or the Kotlin code will not
+    // compile -- this is intentional, ensuring the types stay in sync.
+    var state: AppState by mutableStateOf(
+        AppState(rev = 0UL, greeting = ""),
+    )
+        private set
+
+    init {{
+        val dataDir = context.filesDir.absolutePath
+        rust = FfiApp(dataDir)
+        val initial = rust.state()
+        state = initial
+        lastRevApplied = initial.rev
+        rust.listenForUpdates(this)
+    }}
+
+    fun dispatch(action: AppAction) {{
+        rust.dispatch(action)
+    }}
+
+    override fun reconcile(update: AppUpdate) {{
+        mainHandler.post {{
+            when (update) {{
+                is AppUpdate.FullState -> {{
+                    if (update.v1.rev <= lastRevApplied) return@post
+                    lastRevApplied = update.v1.rev
+                    state = update.v1
+                }}
+            }}
+        }}
+    }}
+
+    companion object {{
+        @Volatile
+        private var instance: AppManager? = null
+
+        fun getInstance(context: Context): AppManager =
+            instance ?: synchronized(this) {{
+                instance ?: AppManager(context.applicationContext).also {{ instance = it }}
+            }}
+    }}
+}}
+"#
+    )
+}
+
+fn tpl_android_main_app(kotlin_pkg: &str, display_name: &str) -> String {
+    format!(
+        r#"package {kotlin_pkg}.ui
+
+import androidx.compose.foundation.layout.*
+import androidx.compose.material3.*
+import androidx.compose.runtime.*
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.unit.dp
+import {kotlin_pkg}.AppManager
+import {kotlin_pkg}.rust.AppAction
+
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+fun MainApp(manager: AppManager) {{
+    var nameInput by remember {{ mutableStateOf("") }}
+    val state = manager.state
+
+    Scaffold(
+        topBar = {{
+            TopAppBar(title = {{ Text("{display_name}") }})
+        }},
+    ) {{ padding ->
+        Column(
+            modifier = Modifier
+                .fillMaxSize()
+                .padding(padding)
+                .padding(20.dp),
+            horizontalAlignment = Alignment.CenterHorizontally,
+            verticalArrangement = Arrangement.spacedBy(16.dp),
+        ) {{
+            Text(
+                state.greeting,
+                style = MaterialTheme.typography.headlineMedium,
+            )
+
+            OutlinedTextField(
+                value = nameInput,
+                onValueChange = {{ nameInput = it }},
+                label = {{ Text("Enter your name") }},
+                modifier = Modifier.fillMaxWidth(),
+                singleLine = true,
+            )
+
+            Button(
+                onClick = {{ manager.dispatch(AppAction.SetName(nameInput)) }},
+                modifier = Modifier.fillMaxWidth(),
+            ) {{
+                Text("Greet")
+            }}
+        }}
+    }}
+}}
+"#
+    )
+}
+
+fn tpl_android_theme(kotlin_pkg: &str) -> String {
+    format!(
+        r#"package {kotlin_pkg}.ui.theme
+
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.lightColorScheme
+import androidx.compose.runtime.Composable
+
+private val LightColors = lightColorScheme()
+
+@Composable
+fun AppTheme(content: @Composable () -> Unit) {{
+    MaterialTheme(
+        colorScheme = LightColors,
+        content = content,
+    )
+}}
+"#
+    )
+}
+
+fn tpl_android_strings(display_name: &str) -> String {
+    format!(
+        r#"<resources>
+    <string name="app_name">{display_name}</string>
+</resources>
+"#
+    )
+}
+
+fn tpl_android_themes() -> String {
+    r#"<resources>
+    <style name="Theme.App" parent="android:Theme.Material.Light.NoActionBar" />
+</resources>
+"#
+    .to_string()
+}
+
+fn tpl_android_placeholder_bindings(kotlin_pkg: &str, _lib_name: &str) -> String {
+    // This is a placeholder that will be overwritten by `rmp bindings kotlin`.
+    // It exists so Gradle's `ensureUniffiGenerated` task doesn't block the first build.
+    format!(
+        r#"// Placeholder — will be replaced by `rmp bindings kotlin`.
+package {kotlin_pkg}.rust
+"#
+    )
+}
+
+fn write_gradlew(android_dir: &Path) -> Result<(), CliError> {
+    // Gradle wrapper script — minimal version that delegates to system Gradle.
+    // Real projects should run `gradle wrapper` to get the full wrapper.
+    let gradlew = android_dir.join("gradlew");
+    write_text(
+        &gradlew,
+        r#"#!/bin/sh
+exec gradle "$@"
+"#,
+    )?;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let _ = std::fs::set_permissions(&gradlew, std::fs::Permissions::from_mode(0o755));
+    }
+    Ok(())
+}
+
+/// Convert a snake_case lib name to PascalCase (e.g., "my_app_core" → "MyAppCore").
+fn pascal_case(s: &str) -> String {
+    s.split('_')
+        .filter(|seg| !seg.is_empty())
+        .map(|seg| {
+            let mut c = seg.chars();
+            match c.next() {
+                Some(first) => {
+                    let mut part = first.to_uppercase().to_string();
+                    part.extend(c);
+                    part
+                }
+                None => String::new(),
+            }
+        })
+        .collect()
+}
+
+fn swift_app_entry_name(display_name: &str) -> String {
+    // Turn "My App" into "MyAppApp" (SwiftUI convention).
+    let cleaned: String = display_name
+        .chars()
+        .filter(|c| c.is_ascii_alphanumeric())
+        .collect();
+    if cleaned.is_empty() {
+        "MainApp".to_string()
+    } else {
+        format!("{}App", cleaned)
+    }
+}
diff --git a/native/rmp-cli/src/main.rs b/native/rmp-cli/src/main.rs
new file mode 100644
index 00000000..27fc8363
--- /dev/null
+++ b/native/rmp-cli/src/main.rs
@@ -0,0 +1,45 @@
+mod bindings;
+mod cli;
+mod config;
+mod devices;
+mod doctor;
+mod init;
+mod run;
+mod util;
+
+use std::path::PathBuf;
+use std::process::ExitCode;
+
+use clap::Parser;
+
+fn main() -> ExitCode {
+    let args = cli::Cli::parse();
+
+    let cwd = std::env::current_dir().unwrap_or_else(|_| PathBuf::from("."));
+    let res: Result<(), cli::CliError> = match args.cmd {
+        cli::Cmd::Init(i) => init::init(&cwd, args.json, args.verbose, i),
+        cmd => {
+            let root = match config::find_workspace_root(&cwd) {
+                Ok(v) => v,
+                Err(e) => return cli::render_err(args.json, e),
+            };
+            match cmd {
+                cli::Cmd::Doctor => doctor::doctor(&root, args.json, args.verbose),
+                cli::Cmd::Devices {
+                    cmd: cli::DevicesCmd::List,
+                } => devices::devices_list(&root, args.json, args.verbose),
+                cli::Cmd::Devices {
+                    cmd: cli::DevicesCmd::Start(s),
+                } => devices::devices_start(&root, args.json, args.verbose, s),
+                cli::Cmd::Bindings(b) => bindings::bindings(&root, args.json, args.verbose, b),
+                cli::Cmd::Run(r) => run::run(&root, args.json, args.verbose, r),
+                cli::Cmd::Init(_) => unreachable!(),
+            }
+        }
+    };
+
+    match res {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(e) => cli::render_err(args.json, e),
+    }
+}
diff --git a/native/rmp-cli/src/run.rs b/native/rmp-cli/src/run.rs
new file mode 100644
index 00000000..cd5216a9
--- /dev/null
+++ b/native/rmp-cli/src/run.rs
@@ -0,0 +1,1114 @@
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+use std::thread;
+use std::time::{Duration, Instant};
+
+use crate::bindings;
+use crate::bindings::BuildProfile;
+use crate::cli::{human_log, json_print, CliError, JsonOk};
+use crate::config::load_rmp_toml;
+use crate::util::{apply_cargo_features, discover_xcode_dev_dir, run_capture};
+
+pub fn run(
+    root: &Path,
+    json: bool,
+    verbose: bool,
+    args: crate::cli::RunArgs,
+) -> Result<(), CliError> {
+    match args.platform {
+        crate::cli::RunPlatform::Ios => run_ios(root, json, verbose, args.ios, args.release),
+        crate::cli::RunPlatform::Android => {
+            run_android(root, json, verbose, args.android, args.release)
+        }
+        crate::cli::RunPlatform::Iced => run_iced(root, json, verbose, args.release),
+        crate::cli::RunPlatform::Gtk4 => run_gtk4(root, json, verbose, args.release),
+    }
+}
+
+fn run_ios(
+    root: &Path,
+    json: bool,
+    verbose: bool,
+    args: crate::cli::RunIosArgs,
+    release: bool,
+) -> Result<(), CliError> {
+    let cfg = load_rmp_toml(root)?;
+    let ios = cfg
+        .ios
+        .ok_or_else(|| CliError::user("rmp.toml missing [ios] section"))?;
+    let dev_dir = discover_xcode_dev_dir()?;
+    let profile = build_profile(release);
+    let (rust_target, xcode_arch) = ios_sim_target_for_host()?;
+
+    let udid = ensure_ios_simulator(&dev_dir, args.udid.as_deref(), verbose)?;
+
+    // Build bindings + xcframework for a single simulator arch.
+    bindings::build_swift_for_run(root, rust_target, profile, verbose)?;
+
+    // Generate Xcode project.
+    human_log(verbose, "xcodegen generate");
+    let status = Command::new("xcodegen")
+        .current_dir(root.join("ios"))
+        .arg("generate")
+        .stdout(Stdio::inherit())
+        .stderr(Stdio::inherit())
+        .status()
+        .map_err(|e| CliError::operational(format!("failed to run xcodegen: {e}")))?;
+    if !status.success() {
+        return Err(CliError::operational("xcodegen generate failed"));
+    }
+
+    let bundle_id = format!("{}.dev", ios.bundle_id);
+    let xcode_name = read_xcode_project_name(root).unwrap_or_else(|| "App".to_string());
+    let xcode_scheme = ios.scheme.clone().unwrap_or_else(|| xcode_name.clone());
+    let xcode_config = if release { "Release" } else { "Debug" };
+
+    let xcode_project_path = root.join(format!("ios/{xcode_name}.xcodeproj"));
+
+    // Build simulator .app.
+    human_log(
+        verbose,
+        format!("xcodebuild ({xcode_config}, iphonesimulator, arch={xcode_arch})"),
+    );
+    let mut cmd = Command::new("/usr/bin/xcrun");
+    cmd.env("DEVELOPER_DIR", &dev_dir)
+        .env_remove("LD")
+        .env_remove("CC")
+        .env_remove("CXX")
+        .arg("xcodebuild")
+        .arg("-project")
+        .arg(&xcode_project_path)
+        .arg("-scheme")
+        .arg(&xcode_scheme)
+        .arg("-destination")
+        .arg(format!("id={udid}"))
+        .arg("-configuration")
+        .arg(xcode_config)
+        .arg("-sdk")
+        .arg("iphonesimulator")
+        .arg("build")
+        .arg(format!("ARCHS={xcode_arch}"))
+        .arg("ONLY_ACTIVE_ARCH=YES")
+        .arg(format!("PRODUCT_BUNDLE_IDENTIFIER={bundle_id}"));
+
+    if let Ok(api_url) = std::env::var("OPEN_SECRET_API_URL") {
+        let api_url = api_url.trim();
+        if !api_url.is_empty() {
+            cmd.arg(format!("OPEN_SECRET_API_URL={api_url}"));
+        }
+    }
+
+    let status = cmd
+        .stdout(Stdio::inherit())
+        .stderr(Stdio::inherit())
+        .status()
+        .map_err(|e| CliError::operational(format!("failed to run xcodebuild: {e}")))?;
+    if !status.success() {
+        return Err(CliError::operational("xcodebuild failed"));
+    }
+
+    let app_path = resolve_ios_app_path(
+        &dev_dir,
+        &xcode_project_path,
+        &xcode_scheme,
+        &udid,
+        xcode_config,
+        xcode_arch,
+    )?;
+    if !app_path.is_dir() {
+        return Err(CliError::operational(format!(
+            "missing built app at {}",
+            app_path.to_string_lossy()
+        )));
+    }
+
+    // Install.
+    human_log(verbose, format!("simctl install (udid={udid})"));
+    let status = Command::new("/usr/bin/xcrun")
+        .env("DEVELOPER_DIR", &dev_dir)
+        .arg("simctl")
+        .arg("install")
+        .arg(&udid)
+        .arg(&app_path)
+        .stdout(Stdio::inherit())
+        .stderr(Stdio::inherit())
+        .status()
+        .map_err(|e| CliError::operational(format!("failed to run simctl install: {e}")))?;
+    if !status.success() {
+        return Err(CliError::operational("simctl install failed"));
+    }
+
+    // Launch.
+    let _ = Command::new("/usr/bin/xcrun")
+        .env("DEVELOPER_DIR", &dev_dir)
+        .arg("simctl")
+        .arg("terminate")
+        .arg(&udid)
+        .arg(&bundle_id)
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .status();
+
+    human_log(verbose, "simctl launch");
+    let status = Command::new("/usr/bin/xcrun")
+        .env("DEVELOPER_DIR", &dev_dir)
+        .arg("simctl")
+        .arg("launch")
+        .arg(&udid)
+        .arg(&bundle_id)
+        .stdout(Stdio::inherit())
+        .stderr(Stdio::inherit())
+        .status()
+        .map_err(|e| CliError::operational(format!("failed to run simctl launch: {e}")))?;
+    if !status.success() {
+        return Err(CliError::operational("simctl launch failed"));
+    }
+
+    let _ = Command::new("open").arg("-a").arg("Simulator").status();
+
+    if json {
+        json_print(&JsonOk {
+            ok: true,
+            data: serde_json::json!({"platform":"ios","kind":"simulator","udid":udid,"bundle_id":bundle_id}),
+        });
+    } else {
+        eprintln!("ok: ios app launched (simulator)");
+    }
+    Ok(())
+}
+
+pub(crate) fn ensure_ios_simulator(
+    dev_dir: &Path,
+    explicit_udid: Option<&str>,
+    verbose: bool,
+) -> Result<String, CliError> {
+    if let Some(u) = explicit_udid {
+        // Validate exists.
+        let mut cmd = Command::new("/usr/bin/xcrun");
+        cmd.env("DEVELOPER_DIR", dev_dir)
+            .arg("simctl")
+            .arg("list")
+            .arg("devices");
+        let out = run_capture(cmd)?;
+        if !out.status.success() {
+            return Err(CliError::operational("failed to list simulators"));
+        }
+        let s = String::from_utf8_lossy(&out.stdout);
+        if !s.contains(u) {
+            return Err(CliError::user(format!(
+                "requested simulator udid not found: {u}"
+            )));
+        }
+        boot_sim(dev_dir, u, verbose)?;
+        return Ok(u.to_string());
+    }
+
+    // Ensure at least one runtime exists.
+    let mut cmd = Command::new("/usr/bin/xcrun");
+    cmd.env("DEVELOPER_DIR", dev_dir)
+        .arg("simctl")
+        .arg("list")
+        .arg("-j")
+        .arg("runtimes");
+    let out = run_capture(cmd)?;
+    if !out.status.success() {
+        return Err(CliError::operational("failed to list simulator runtimes"));
+    }
+    let j: serde_json::Value = serde_json::from_slice(&out.stdout)
+        .map_err(|e| CliError::operational(format!("failed to parse runtimes JSON: {e}")))?;
+    let mut runtimes: Vec<(u32, u32, String)> = vec![];
+    for rt in j
+        .get("runtimes")
+        .and_then(|v| v.as_array())
+        .into_iter()
+        .flatten()
+    {
+        let name = rt.get("name").and_then(|v| v.as_str()).unwrap_or("");
+        let ident = rt.get("identifier").and_then(|v| v.as_str()).unwrap_or("");
+        let avail = rt
+            .get("isAvailable")
+            .and_then(|v| v.as_bool())
+            .unwrap_or(true);
+        if !name.starts_with("iOS ") || !avail {
+            continue;
+        }
+        // ident ends with iOS-18-6 style; parse.
+        if let Some((maj, min)) = parse_ios_runtime_ident(ident) {
+            runtimes.push((maj, min, ident.to_string()));
+        }
+    }
+    runtimes.sort();
+    let runtime_id = runtimes
+        .last()
+        .map(|t| t.2.clone())
+        .ok_or_else(|| CliError::operational("no iOS simulator runtimes installed"))?;
+
+    let device_type_id = pick_device_type_id(dev_dir, "iPhone 15")?;
+
+    let device_name = "RMP iPhone 15";
+    let udid = match find_simulator_udid_by_name_and_runtime(dev_dir, device_name, &runtime_id)? {
+        Some(u) => u,
+        None => create_simulator(dev_dir, device_name, &device_type_id, &runtime_id)?,
+    };
+
+    boot_sim(dev_dir, &udid, verbose)?;
+    Ok(udid)
+}
+
+fn parse_ios_runtime_ident(ident: &str) -> Option<(u32, u32)> {
+    // com.apple.CoreSimulator.SimRuntime.iOS-18-6
+    let tail = ident.rsplit('.').next().unwrap_or("");
+    let mut it = tail.split('-').skip_while(|s| *s != "iOS").skip(1);
+    let maj = it.next()?.parse().ok()?;
+    let min = it.next()?.parse().ok()?;
+    Some((maj, min))
+}
+
+fn pick_device_type_id(dev_dir: &Path, prefer: &str) -> Result<String, CliError> {
+    let mut cmd = Command::new("/usr/bin/xcrun");
+    cmd.env("DEVELOPER_DIR", dev_dir)
+        .arg("simctl")
+        .arg("list")
+        .arg("devicetypes");
+    let out = run_capture(cmd)?;
+    if !out.status.success() {
+        return Err(CliError::operational("failed to list sim device types"));
+    }
+    let s = String::from_utf8_lossy(&out.stdout);
+    let mut first_iphone: Option<String> = None;
+    for ln in s.lines() {
+        if let Some((name, rest)) = ln.split_once('(') {
+            let name = name.trim();
+            let id = rest.trim_end_matches(')').trim();
+            if first_iphone.is_none() && name.contains("iPhone") {
+                first_iphone = Some(id.to_string());
+            }
+            if name.contains(prefer) {
+                return Ok(id.to_string());
+            }
+        }
+    }
+    first_iphone.ok_or_else(|| CliError::operational("no iPhone simulator device types found"))
+}
+
+fn find_simulator_udid_by_name_and_runtime(
+    dev_dir: &Path,
+    name: &str,
+    runtime_id: &str,
+) -> Result<Option<String>, CliError> {
+    let mut cmd = Command::new("/usr/bin/xcrun");
+    cmd.env("DEVELOPER_DIR", dev_dir)
+        .arg("simctl")
+        .arg("list")
+        .arg("-j")
+        .arg("devices");
+    let out = run_capture(cmd)?;
+    if !out.status.success() {
+        return Err(CliError::operational("failed to list simulators"));
+    }
+    let j: serde_json::Value = serde_json::from_slice(&out.stdout)
+        .map_err(|e| CliError::operational(format!("failed to parse simulator JSON: {e}")))?;
+    let Some(runtime_devices) = j.get("devices").and_then(|v| v.get(runtime_id)) else {
+        return Ok(None);
+    };
+    for dev in runtime_devices.as_array().into_iter().flatten() {
+        let dev_name = dev.get("name").and_then(|v| v.as_str()).unwrap_or("");
+        let udid = dev.get("udid").and_then(|v| v.as_str()).unwrap_or("");
+        let available = dev
+            .get("isAvailable")
+            .and_then(|v| v.as_bool())
+            .unwrap_or(true);
+        if available && dev_name == name && udid.len() >= 25 {
+            return Ok(Some(udid.to_string()));
+        }
+    }
+    Ok(None)
+}
+
+fn create_simulator(
+    dev_dir: &Path,
+    name: &str,
+    device_type_id: &str,
+    runtime_id: &str,
+) -> Result<String, CliError> {
+    let out = Command::new("/usr/bin/xcrun")
+        .env("DEVELOPER_DIR", dev_dir)
+        .arg("simctl")
+        .arg("create")
+        .arg(name)
+        .arg(device_type_id)
+        .arg(runtime_id)
+        .output()
+        .map_err(|e| CliError::operational(format!("simctl create failed: {e}")))?;
+    if !out.status.success() {
+        return Err(CliError::operational("simctl create failed"));
+    }
+    Ok(String::from_utf8_lossy(&out.stdout).trim().to_string())
+}
+
+fn boot_sim(dev_dir: &Path, udid: &str, verbose: bool) -> Result<(), CliError> {
+    let _ = Command::new("/usr/bin/xcrun")
+        .env("DEVELOPER_DIR", dev_dir)
+        .arg("simctl")
+        .arg("boot")
+        .arg(udid)
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .status();
+
+    // Avoid an unbounded `simctl bootstatus -b` wait in CI; poll with timeout.
+    human_log(verbose, "waiting for simulator boot");
+    let start = Instant::now();
+    while start.elapsed() < Duration::from_secs(180) {
+        if simulator_is_booted(dev_dir, udid)? {
+            return Ok(());
+        }
+        thread::sleep(Duration::from_secs(1));
+    }
+
+    Err(CliError::operational(format!(
+        "simulator did not boot in time: {udid}"
+    )))
+}
+
+fn simulator_is_booted(dev_dir: &Path, udid: &str) -> Result<bool, CliError> {
+    let mut cmd = Command::new("/usr/bin/xcrun");
+    cmd.env("DEVELOPER_DIR", dev_dir)
+        .arg("simctl")
+        .arg("list")
+        .arg("devices");
+    let out = run_capture(cmd)?;
+    if !out.status.success() {
+        return Err(CliError::operational("failed to list simulators"));
+    }
+    let s = String::from_utf8_lossy(&out.stdout);
+    for line in s.lines() {
+        if line.contains(udid) && line.contains("(Booted)") {
+            return Ok(true);
+        }
+    }
+    Ok(false)
+}
+
+fn run_android(
+    root: &Path,
+    json: bool,
+    verbose: bool,
+    args: crate::cli::RunAndroidArgs,
+    release: bool,
+) -> Result<(), CliError> {
+    let cfg = load_rmp_toml(root)?;
+    let android = cfg
+        .android
+        .ok_or_else(|| CliError::user("rmp.toml missing [android] section"))?;
+    let app_id = android.app_id;
+    let avd = args
+        .avd
+        .or(android.avd_name)
+        .unwrap_or_else(|| "rmp_api35".into());
+
+    let serial = ensure_android_emulator(root, &avd, args.serial.as_deref(), verbose)?;
+    let abi = detect_android_abi(&serial, verbose)?;
+    let profile = build_profile(release);
+
+    // Build bindings (kotlin + .so) for the connected ABI only.
+    bindings::build_kotlin_for_run(root, &abi, profile, verbose)?;
+
+    // Assemble debug APK.
+    human_log(verbose, "gradle assembleDebug");
+    let ci = is_ci();
+    let mut cmd = Command::new("./gradlew");
+    cmd.current_dir(root.join("android"))
+        .arg(":app:assembleDebug");
+    if ci {
+        // CI stability + debuggability.
+        cmd.arg("--no-daemon")
+            .arg("--console=plain")
+            .arg("--stacktrace");
+    } else if verbose {
+        cmd.arg("--console=plain");
+    }
+    let status = cmd
+        .stdout(Stdio::inherit())
+        .stderr(Stdio::inherit())
+        .status()
+        .map_err(|e| CliError::operational(format!("failed to run gradlew: {e}")))?;
+    if !status.success() {
+        return Err(CliError::operational("gradle assembleDebug failed"));
+    }
+
+    let apk = root.join("android/app/build/outputs/apk/debug/app-debug.apk");
+    if !apk.is_file() {
+        return Err(CliError::operational(format!(
+            "expected apk not found: {}",
+            apk.to_string_lossy()
+        )));
+    }
+
+    let pkg = format!("{app_id}.dev");
+
+    // Install.
+    human_log(verbose, format!("adb install (serial={serial})"));
+    let status = Command::new("adb")
+        .arg("-s")
+        .arg(&serial)
+        .arg("install")
+        .arg("-r")
+        .arg(&apk)
+        .stdout(Stdio::inherit())
+        .stderr(Stdio::inherit())
+        .status()
+        .map_err(|e| CliError::operational(format!("failed to run adb install: {e}")))?;
+    if !status.success() {
+        return Err(CliError::operational("adb install failed"));
+    }
+
+    if let Some(rev) = args.adb_reverse {
+        setup_adb_reverse(&serial, &rev, verbose)?;
+    }
+
+    launch_android(&serial, &pkg, verbose)?;
+
+    if json {
+        json_print(&JsonOk {
+            ok: true,
+            data: serde_json::json!({"platform":"android","kind":"emulator","serial":serial,"app_id":pkg}),
+        });
+    } else {
+        eprintln!("ok: android app launched");
+    }
+    Ok(())
+}
+
+fn run_iced(root: &Path, json: bool, verbose: bool, release: bool) -> Result<(), CliError> {
+    let cfg = load_rmp_toml(root)?;
+    let desktop = cfg
+        .desktop
+        .ok_or_else(|| CliError::user("rmp.toml missing [desktop] section"))?;
+
+    if !desktop
+        .targets
+        .iter()
+        .any(|t| t.eq_ignore_ascii_case("iced"))
+    {
+        return Err(CliError::user(
+            "desktop target `iced` is not enabled in rmp.toml ([desktop].targets)",
+        ));
+    }
+
+    let package = desktop
+        .iced
+        .and_then(|i| i.package)
+        .filter(|s| !s.trim().is_empty())
+        .unwrap_or_else(|| default_iced_package_name(&cfg.project.name));
+
+    human_log(verbose, format!("cargo run -p {package}"));
+    let mut cmd = Command::new("cargo");
+    cmd.current_dir(root).arg("run").arg("-p").arg(&package);
+    if release {
+        cmd.arg("--release");
+    }
+    apply_cargo_features(&mut cmd);
+    let status = cmd
+        .stdout(Stdio::inherit())
+        .stderr(Stdio::inherit())
+        .status()
+        .map_err(|e| CliError::operational(format!("failed to run cargo: {e}")))?;
+    if !status.success() {
+        return Err(CliError::operational(format!(
+            "cargo run failed for desktop package `{package}`"
+        )));
+    }
+
+    if json {
+        json_print(&JsonOk {
+            ok: true,
+            data: serde_json::json!({"platform":"iced","package":package}),
+        });
+    } else {
+        eprintln!("ok: iced app exited");
+    }
+
+    Ok(())
+}
+
+fn run_gtk4(root: &Path, json: bool, verbose: bool, release: bool) -> Result<(), CliError> {
+    let cfg = load_rmp_toml(root)?;
+    let desktop = cfg
+        .desktop
+        .ok_or_else(|| CliError::user("rmp.toml missing [desktop] section"))?;
+
+    if !desktop
+        .targets
+        .iter()
+        .any(|t| t.eq_ignore_ascii_case("gtk4"))
+    {
+        return Err(CliError::user(
+            "desktop target `gtk4` is not enabled in rmp.toml ([desktop].targets)",
+        ));
+    }
+
+    let package = desktop
+        .gtk4
+        .and_then(|g| g.package)
+        .filter(|s| !s.trim().is_empty())
+        .unwrap_or_else(|| default_gtk4_package_name(&cfg.project.name));
+
+    human_log(verbose, format!("cargo run -p {package}"));
+    let mut cmd = Command::new("cargo");
+    cmd.current_dir(root).arg("run").arg("-p").arg(&package);
+    if release {
+        cmd.arg("--release");
+    }
+    apply_cargo_features(&mut cmd);
+    let status = cmd
+        .stdout(Stdio::inherit())
+        .stderr(Stdio::inherit())
+        .status()
+        .map_err(|e| CliError::operational(format!("failed to run cargo: {e}")))?;
+    if !status.success() {
+        return Err(CliError::operational(format!(
+            "cargo run failed for desktop package `{package}`"
+        )));
+    }
+
+    if json {
+        json_print(&JsonOk {
+            ok: true,
+            data: serde_json::json!({"platform":"gtk4","package":package}),
+        });
+    } else {
+        eprintln!("ok: gtk4 app exited");
+    }
+
+    Ok(())
+}
+
+pub(crate) fn ensure_android_emulator(
+    root: &Path,
+    avd: &str,
+    explicit_serial: Option<&str>,
+    verbose: bool,
+) -> Result<String, CliError> {
+    let allow_headless = android_allow_headless();
+
+    if let Some(s) = explicit_serial {
+        if !adb_serial_exists(s)? {
+            return Err(CliError::user(format!(
+                "requested android serial not connected: {s}"
+            )));
+        }
+        if !allow_headless && s.starts_with("emulator-") {
+            let avd_name = emulator_avd_name(s).unwrap_or_else(|| avd.to_string());
+            if emulator_is_headless_only(&avd_name)? {
+                if avd_exists(&avd_name)? {
+                    human_log(
+                        verbose,
+                        format!("emulator is headless (avd={avd_name}); restarting with GUI"),
+                    );
+                    kill_emulator(s, verbose)?;
+                    return start_emulator_and_wait(root, &avd_name, verbose);
+                }
+                human_log(
+                    verbose,
+                    format!(
+                        "emulator is headless (avd={avd_name}) but AVD is not available locally; keeping existing emulator"
+                    ),
+                );
+            }
+        }
+        return Ok(s.to_string());
+    }
+
+    if let Some(s) = pick_any_emulator_serial()? {
+        if !allow_headless {
+            let avd_name = emulator_avd_name(&s).unwrap_or_else(|| avd.to_string());
+            if emulator_is_headless_only(&avd_name)? {
+                if avd_exists(&avd_name)? {
+                    human_log(
+                        verbose,
+                        format!("emulator is headless (avd={avd_name}); restarting with GUI"),
+                    );
+                    kill_emulator(&s, verbose)?;
+                    return start_emulator_and_wait(root, &avd_name, verbose);
+                }
+                human_log(
+                    verbose,
+                    format!(
+                        "emulator is headless (avd={avd_name}) but AVD is not available locally; keeping existing emulator"
+                    ),
+                );
+            }
+        }
+        human_log(
+            verbose,
+            format!("ok: android emulator already connected ({s})"),
+        );
+        return Ok(s);
+    }
+
+    let _ = Command::new("adb")
+        .arg("start-server")
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .status();
+
+    // Ensure AVD exists.
+    let mut cmd = Command::new("emulator");
+    cmd.arg("-list-avds");
+    let out = run_capture(cmd)?;
+    if !out.status.success() {
+        return Err(CliError::operational(
+            "failed to list AVDs (emulator -list-avds)",
+        ));
+    }
+    let list = String::from_utf8_lossy(&out.stdout);
+    if !list.lines().any(|l| l.trim() == avd) {
+        return Err(CliError::user(format!(
+            "android AVD not found: {avd} (create it, then re-run)"
+        )));
+    }
+
+    start_emulator_and_wait(root, avd, verbose)
+}
+
+fn start_emulator_and_wait(root: &Path, avd: &str, verbose: bool) -> Result<String, CliError> {
+    human_log(verbose, format!("starting android emulator: {avd}"));
+    let allow_headless = android_allow_headless();
+    let log_path = root.join("emulator.log");
+    let log = std::fs::OpenOptions::new()
+        .create(true)
+        .append(true)
+        .open(&log_path)
+        .map_err(|e| CliError::operational(format!("failed to open emulator log: {e}")))?;
+    let log2 = log
+        .try_clone()
+        .map_err(|e| CliError::operational(format!("failed to clone emulator log handle: {e}")))?;
+
+    let mut child = Command::new("emulator");
+    child
+        .arg("-avd")
+        .arg(avd)
+        .arg("-no-snapshot")
+        .arg("-no-audio")
+        .arg("-no-boot-anim")
+        .arg("-gpu")
+        .arg("swiftshader_indirect");
+    if allow_headless {
+        child.arg("-no-window");
+    }
+    child.stdout(Stdio::from(log)).stderr(Stdio::from(log2));
+
+    let _ = child
+        .spawn()
+        .map_err(|e| CliError::operational(format!("failed to start emulator: {e}")))?;
+
+    // Wait for boot.
+    let start = Instant::now();
+    while start.elapsed() < Duration::from_secs(180) {
+        if let Some(serial) = pick_any_emulator_serial()? {
+            let boot = adb_shell(&serial, &["getprop", "sys.boot_completed"])?;
+            if boot.trim() == "1" {
+                human_log(verbose, format!("ok: android emulator booted ({serial})"));
+                return Ok(serial);
+            }
+        }
+        thread::sleep(Duration::from_secs(1));
+    }
+
+    Err(CliError::operational(
+        "android emulator did not boot in time (see emulator.log)",
+    ))
+}
+
+fn kill_emulator(serial: &str, verbose: bool) -> Result<(), CliError> {
+    human_log(verbose, format!("killing emulator: {serial}"));
+    let _ = Command::new("adb")
+        .arg("-s")
+        .arg(serial)
+        .arg("emu")
+        .arg("kill")
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .status();
+
+    let start = Instant::now();
+    while start.elapsed() < Duration::from_secs(30) {
+        if !adb_serial_exists(serial)? {
+            return Ok(());
+        }
+        thread::sleep(Duration::from_millis(500));
+    }
+    Err(CliError::operational(format!(
+        "timed out waiting for emulator {serial} to exit"
+    )))
+}
+
+fn emulator_avd_name(serial: &str) -> Option<String> {
+    let mut cmd = Command::new("adb");
+    cmd.arg("-s").arg(serial).arg("emu").arg("avd").arg("name");
+    let out = run_capture(cmd).ok()?;
+    if !out.status.success() {
+        return None;
+    }
+    let s = String::from_utf8_lossy(&out.stdout);
+    let avd = s.lines().last()?.trim();
+    if avd.is_empty() || avd.eq_ignore_ascii_case("ok") {
+        return None;
+    }
+    Some(avd.to_string())
+}
+
+fn emulator_is_headless_only(avd: &str) -> Result<bool, CliError> {
+    // Mirrors previous shell behavior:
+    // headless qemu exists AND no emulator frontend process exists for this AVD.
+    let mut cmd = Command::new("ps");
+    cmd.arg("ax").arg("-o").arg("command=");
+    let out = run_capture(cmd)?;
+    if !out.status.success() {
+        return Err(CliError::operational(
+            "failed to inspect emulator processes",
+        ));
+    }
+
+    let needle = format!("-avd {avd}");
+    let mut has_headless_qemu = false;
+    let mut has_frontend = false;
+    let s = String::from_utf8_lossy(&out.stdout);
+    for line in s.lines() {
+        if !line.contains(&needle) {
+            continue;
+        }
+        if line.contains("qemu-system") && line.contains("headless") {
+            has_headless_qemu = true;
+        }
+        if line.contains("/emulator") || line.starts_with("emulator ") {
+            has_frontend = true;
+        }
+    }
+    Ok(has_headless_qemu && !has_frontend)
+}
+
+fn android_allow_headless() -> bool {
+    if std::env::var("RMP_ANDROID_ALLOW_HEADLESS").ok().as_deref() == Some("1") {
+        return true;
+    }
+    is_ci()
+}
+
+fn is_ci() -> bool {
+    std::env::var("CI")
+        .ok()
+        .map(|v| !v.trim().is_empty())
+        .unwrap_or(false)
+}
+
+fn build_profile(release: bool) -> BuildProfile {
+    if release {
+        BuildProfile::Release
+    } else {
+        BuildProfile::Debug
+    }
+}
+
+fn default_iced_package_name(project_name: &str) -> String {
+    let mut out = String::new();
+    for c in project_name.chars() {
+        if c.is_ascii_alphanumeric() || c == '_' || c == '-' {
+            out.push(c.to_ascii_lowercase());
+        }
+    }
+    if out.is_empty() {
+        out.push_str("app");
+    }
+    format!("{out}_desktop_iced")
+}
+
+fn default_gtk4_package_name(project_name: &str) -> String {
+    let mut out = String::new();
+    for c in project_name.chars() {
+        if c.is_ascii_alphanumeric() || c == '_' || c == '-' {
+            out.push(c.to_ascii_lowercase());
+        }
+    }
+    if out.is_empty() {
+        out.push_str("app");
+    }
+    format!("{out}_desktop_gtk")
+}
+
+fn ios_sim_target_for_host() -> Result<(&'static str, &'static str), CliError> {
+    match std::env::consts::ARCH {
+        "aarch64" => Ok(("aarch64-apple-ios-sim", "arm64")),
+        "x86_64" => Ok(("x86_64-apple-ios", "x86_64")),
+        arch => Err(CliError::operational(format!(
+            "unsupported host arch for iOS simulator builds: {arch}"
+        ))),
+    }
+}
+
+fn avd_exists(avd: &str) -> Result<bool, CliError> {
+    let mut cmd = Command::new("emulator");
+    cmd.arg("-list-avds");
+    let out = run_capture(cmd)?;
+    if !out.status.success() {
+        return Err(CliError::operational(
+            "failed to list AVDs (emulator -list-avds)",
+        ));
+    }
+    let s = String::from_utf8_lossy(&out.stdout);
+    Ok(s.lines().any(|l| l.trim() == avd))
+}
+
+fn adb_serial_exists(serial: &str) -> Result<bool, CliError> {
+    let mut cmd = Command::new("adb");
+    cmd.arg("devices");
+    let out = run_capture(cmd)?;
+    if !out.status.success() {
+        return Err(CliError::operational("adb devices failed"));
+    }
+    let s = String::from_utf8_lossy(&out.stdout);
+    Ok(s.lines()
+        .skip(1)
+        .any(|l| l.split_whitespace().next() == Some(serial)))
+}
+
+fn pick_any_emulator_serial() -> Result<Option<String>, CliError> {
+    let mut cmd = Command::new("adb");
+    cmd.arg("devices");
+    let out = run_capture(cmd)?;
+    if !out.status.success() {
+        return Err(CliError::operational("adb devices failed"));
+    }
+    let s = String::from_utf8_lossy(&out.stdout);
+    for ln in s.lines().skip(1) {
+        let parts: Vec<&str> = ln.split_whitespace().collect();
+        if parts.len() < 2 {
+            continue;
+        }
+        if parts[1] != "device" {
+            continue;
+        }
+        if parts[0].starts_with("emulator-") {
+            return Ok(Some(parts[0].to_string()));
+        }
+    }
+    Ok(None)
+}
+
+fn adb_shell(serial: &str, args: &[&str]) -> Result<String, CliError> {
+    let mut cmd = Command::new("adb");
+    cmd.arg("-s").arg(serial).arg("shell").args(args);
+    let out = run_capture(cmd)?;
+    if !out.status.success() {
+        return Err(CliError::operational("adb shell failed"));
+    }
+    Ok(String::from_utf8_lossy(&out.stdout).replace('\r', ""))
+}
+
+fn detect_android_abi(serial: &str, verbose: bool) -> Result<String, CliError> {
+    let raw = adb_shell(serial, &["getprop", "ro.product.cpu.abi"])?;
+    let raw = raw.lines().next().unwrap_or("").trim();
+    if raw.is_empty() {
+        return Err(CliError::operational(
+            "failed to detect Android ABI (getprop ro.product.cpu.abi returned empty)",
+        ));
+    }
+    let abi = normalize_android_abi(raw).unwrap_or(raw).to_string();
+    human_log(
+        verbose,
+        format!("android ABI detected: {raw} (using {abi})"),
+    );
+    Ok(abi)
+}
+
+fn normalize_android_abi(raw: &str) -> Option<&'static str> {
+    match raw {
+        "arm64-v8a" | "aarch64" => Some("arm64-v8a"),
+        "armeabi-v7a" | "armeabi" => Some("armeabi-v7a"),
+        "x86_64" => Some("x86_64"),
+        "x86" => Some("x86"),
+        _ => None,
+    }
+}
+
+fn setup_adb_reverse(serial: &str, spec: &str, verbose: bool) -> Result<(), CliError> {
+    for item in spec.split(',').map(|s| s.trim()).filter(|s| !s.is_empty()) {
+        let (dev_port, host_port) = if let Some((a, b)) = item.split_once(':') {
+            (a.trim(), b.trim())
+        } else {
+            (item, item)
+        };
+        human_log(
+            verbose,
+            format!("adb reverse tcp:{dev_port} -> tcp:{host_port}"),
+        );
+        let status = Command::new("adb")
+            .arg("-s")
+            .arg(serial)
+            .arg("reverse")
+            .arg(format!("tcp:{dev_port}"))
+            .arg(format!("tcp:{host_port}"))
+            .stdout(Stdio::inherit())
+            .stderr(Stdio::inherit())
+            .status()
+            .map_err(|e| CliError::operational(format!("failed to run adb reverse: {e}")))?;
+        if !status.success() {
+            return Err(CliError::operational("adb reverse failed"));
+        }
+    }
+    Ok(())
+}
+
+fn launch_android(serial: &str, pkg: &str, verbose: bool) -> Result<(), CliError> {
+    human_log(verbose, format!("launching {pkg}"));
+
+    let resolved = adb_shell(
+        serial,
+        &[
+            "cmd",
+            "package",
+            "resolve-activity",
+            "--brief",
+            "-a",
+            "android.intent.action.MAIN",
+            "-c",
+            "android.intent.category.LAUNCHER",
+            pkg,
+        ],
+    )
+    .unwrap_or_default();
+    let resolved = resolved.lines().last().unwrap_or("").trim().to_string();
+
+    if resolved.contains('/') {
+        let _ = Command::new("adb")
+            .arg("-s")
+            .arg(serial)
+            .arg("shell")
+            .arg("am")
+            .arg("start")
+            .arg("-W")
+            .arg("-n")
+            .arg(resolved)
+            .stdout(Stdio::inherit())
+            .stderr(Stdio::inherit())
+            .status()
+            .map_err(|e| CliError::operational(format!("failed to run adb am start: {e}")))?;
+    } else {
+        let _ = Command::new("adb")
+            .arg("-s")
+            .arg(serial)
+            .arg("shell")
+            .arg("am")
+            .arg("start")
+            .arg("-W")
+            .arg("-a")
+            .arg("android.intent.action.MAIN")
+            .arg("-c")
+            .arg("android.intent.category.LAUNCHER")
+            .arg("-n")
+            .arg(format!("{pkg}/.MainActivity"))
+            .stdout(Stdio::inherit())
+            .stderr(Stdio::inherit())
+            .status()
+            .map_err(|e| CliError::operational(format!("failed to run adb am start: {e}")))?;
+    }
+
+    for _ in 0..20 {
+        let out = Command::new("adb")
+            .arg("-s")
+            .arg(serial)
+            .arg("shell")
+            .arg("pidof")
+            .arg(pkg)
+            .stdout(Stdio::piped())
+            .stderr(Stdio::null())
+            .output();
+        if let Ok(out) = out {
+            if out.status.success() && !String::from_utf8_lossy(&out.stdout).trim().is_empty() {
+                return Ok(());
+            }
+        }
+        thread::sleep(Duration::from_millis(500));
+    }
+
+    Err(CliError::operational(format!(
+        "app did not appear to start (pidof {pkg} empty)"
+    )))
+}
+
+fn resolve_ios_app_path(
+    dev_dir: &Path,
+    xcode_project_path: &Path,
+    xcode_scheme: &str,
+    udid: &str,
+    xcode_config: &str,
+    xcode_arch: &str,
+) -> Result<PathBuf, CliError> {
+    let mut cmd = Command::new("/usr/bin/xcrun");
+    cmd.env("DEVELOPER_DIR", dev_dir)
+        .env_remove("LD")
+        .env_remove("CC")
+        .env_remove("CXX")
+        .arg("xcodebuild")
+        .arg("-project")
+        .arg(xcode_project_path)
+        .arg("-scheme")
+        .arg(xcode_scheme)
+        .arg("-destination")
+        .arg(format!("id={udid}"))
+        .arg("-configuration")
+        .arg(xcode_config)
+        .arg("-sdk")
+        .arg("iphonesimulator")
+        .arg(format!("ARCHS={xcode_arch}"))
+        .arg("ONLY_ACTIVE_ARCH=YES")
+        .arg("-showBuildSettings");
+    let out = run_capture(cmd)?;
+    if !out.status.success() {
+        return Err(CliError::operational(
+            "xcodebuild -showBuildSettings failed",
+        ));
+    }
+
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let mut target_build_dir: Option<String> = None;
+    let mut full_product_name: Option<String> = None;
+    for line in stdout.lines() {
+        let line = line.trim();
+        if let Some(v) = line.strip_prefix("TARGET_BUILD_DIR = ") {
+            target_build_dir = Some(v.trim().to_string());
+            continue;
+        }
+        if let Some(v) = line.strip_prefix("FULL_PRODUCT_NAME = ") {
+            full_product_name = Some(v.trim().to_string());
+        }
+    }
+
+    let target_build_dir = target_build_dir.ok_or_else(|| {
+        CliError::operational("xcodebuild -showBuildSettings missing TARGET_BUILD_DIR")
+    })?;
+    let full_product_name = full_product_name.ok_or_else(|| {
+        CliError::operational("xcodebuild -showBuildSettings missing FULL_PRODUCT_NAME")
+    })?;
+
+    Ok(PathBuf::from(target_build_dir).join(full_product_name))
+}
+
+/// Read the `name:` field from `ios/project.yml` to derive the Xcode project/target/app name.
+fn read_xcode_project_name(root: &Path) -> Option<String> {
+    let yml_path = root.join("ios/project.yml");
+    let content = std::fs::read_to_string(&yml_path).ok()?;
+    for line in content.lines() {
+        let trimmed = line.trim();
+        if trimmed.starts_with("name:") {
+            let name = trimmed.strip_prefix("name:")?.trim();
+            // Strip optional quotes.
+            let name = name.trim_matches('"').trim_matches('\'').trim();
+            if !name.is_empty() {
+                return Some(name.to_string());
+            }
+        }
+    }
+    None
+}
diff --git a/native/rmp-cli/src/util.rs b/native/rmp-cli/src/util.rs
new file mode 100644
index 00000000..149f8707
--- /dev/null
+++ b/native/rmp-cli/src/util.rs
@@ -0,0 +1,87 @@
+use std::path::PathBuf;
+use std::process::{Command, Output, Stdio};
+
+use crate::cli::CliError;
+
+pub fn which(bin: &str) -> Option<PathBuf> {
+    let path = std::env::var_os("PATH")?;
+    for dir in std::env::split_paths(&path) {
+        let p = dir.join(bin);
+        if p.is_file() {
+            return Some(p);
+        }
+        #[cfg(windows)]
+        {
+            let p = dir.join(format!("{bin}.exe"));
+            if p.is_file() {
+                return Some(p);
+            }
+        }
+    }
+    None
+}
+
+pub fn run_capture(mut cmd: Command) -> Result<Output, CliError> {
+    let out = cmd
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .output()
+        .map_err(|e| CliError::operational(format!("failed to spawn process: {e}")))?;
+    Ok(out)
+}
+
+pub fn discover_xcode_dev_dir() -> Result<PathBuf, CliError> {
+    if let Ok(v) = std::env::var("DEVELOPER_DIR") {
+        let p = PathBuf::from(v);
+        if (p.join("usr/bin/xcrun").exists() || p.join("usr/bin/simctl").exists())
+            && developer_dir_supports_iphoneos(&p)
+        {
+            return Ok(p);
+        }
+    }
+    let apps = std::fs::read_dir("/Applications")
+        .map_err(|e| CliError::operational(format!("failed to read /Applications: {e}")))?;
+    let mut candidates: Vec<PathBuf> = vec![];
+    for ent in apps.flatten() {
+        let name = ent.file_name();
+        let name = name.to_string_lossy();
+        if !name.starts_with("Xcode") || !name.ends_with(".app") {
+            continue;
+        }
+        let dev = ent.path().join("Contents/Developer");
+        if dev.is_dir() {
+            candidates.push(dev);
+        }
+    }
+    candidates.sort();
+    for dev in candidates.into_iter().rev() {
+        if developer_dir_supports_iphoneos(&dev) {
+            return Ok(dev);
+        }
+    }
+    Err(CliError::operational(
+        "Xcode with iPhoneOS SDK not found under /Applications",
+    ))
+}
+
+fn developer_dir_supports_iphoneos(dev_dir: &PathBuf) -> bool {
+    let out = Command::new("/usr/bin/xcrun")
+        .env("DEVELOPER_DIR", dev_dir)
+        .arg("--sdk")
+        .arg("iphoneos")
+        .arg("--show-sdk-path")
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .status();
+    matches!(out, Ok(status) if status.success())
+}
+
+/// Append `--features <value>` to a cargo command if the `RMP_FEATURES` env var is set.
+pub fn apply_cargo_features(cmd: &mut Command) {
+    if let Ok(features) = std::env::var("RMP_FEATURES") {
+        let features = features.trim().to_string();
+        if !features.is_empty() {
+            cmd.arg("--features").arg(features);
+        }
+    }
+}
diff --git a/native/rmp.toml b/native/rmp.toml
new file mode 100644
index 00000000..2f200b30
--- /dev/null
+++ b/native/rmp.toml
@@ -0,0 +1,19 @@
+[project]
+name = "maple"
+org = "cloud.opensecret"
+
+[core]
+crate = "maple_core"
+bindings = "uniffi"
+
+[ios]
+bundle_id = "cloud.opensecret.maple"
+
+[android]
+app_id = "cloud.opensecret.maple"
+
+[desktop]
+targets = ["gtk4"]
+
+[desktop.gtk4]
+package = "maple_desktop_gtk"
diff --git a/native/rust/Cargo.toml b/native/rust/Cargo.toml
new file mode 100644
index 00000000..752391c5
--- /dev/null
+++ b/native/rust/Cargo.toml
@@ -0,0 +1,20 @@
+[package]
+name = "maple_core"
+version = "3.0.0"
+edition = "2021"
+
+[lib]
+crate-type = ["cdylib", "staticlib", "rlib"]
+
+[dependencies]
+base64 = "0.22"
+chrono = "0.4"
+flume = "0.11"
+futures = "0.3"
+uniffi = "0.31.0"
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
+serde_cbor = "0.11"
+serde_json = "1"
+opensecret = "3.0.0-alpha.0"
+tokio = { version = "1.41", features = ["rt-multi-thread", "time"] }
+uuid = { version = "1.11", features = ["v4"] }
diff --git a/native/rust/build.rs b/native/rust/build.rs
new file mode 100644
index 00000000..f328e4d9
--- /dev/null
+++ b/native/rust/build.rs
@@ -0,0 +1 @@
+fn main() {}
diff --git a/native/rust/src/lib.rs b/native/rust/src/lib.rs
new file mode 100644
index 00000000..bc6c384c
--- /dev/null
+++ b/native/rust/src/lib.rs
@@ -0,0 +1,1538 @@
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, RwLock};
+use std::thread;
+
+use base64::{
+    engine::general_purpose::{STANDARD as BASE64, URL_SAFE, URL_SAFE_NO_PAD},
+    Engine,
+};
+use chrono::{DateTime, Local, Utc};
+use flume::{Receiver, Sender};
+use opensecret::attestation::{AttestationDocument, AttestationVerifier};
+use opensecret::crypto::{self, PublicKey};
+use opensecret::types::{
+    AttestationResponse, ConversationContent, ConversationItem, EncryptedRequest,
+    EncryptedResponse, KeyExchangeRequest, KeyExchangeResponse, RefreshRequest, RefreshResponse,
+    UserResponse,
+};
+use reqwest::header::{HeaderMap, HeaderValue, CONTENT_TYPE};
+use serde_cbor::Value as CborValue;
+use serde_json::Value as JsonValue;
+
+uniffi::setup_scaffolding!();
+
+const DEFAULT_API_URL: &str = "http://0.0.0.0:3000";
+
+#[uniffi::export]
+pub fn default_api_url() -> String {
+    DEFAULT_API_URL.to_string()
+}
+
+const PAGE_SIZE: i64 = 20;
+const AGENT_MESSAGE_STAGGER_MS: u64 = 1_500;
+
+fn format_relative_time(epoch_secs: i64) -> String {
+    let msg_time = DateTime::from_timestamp(epoch_secs, 0)
+        .unwrap_or_else(Utc::now)
+        .with_timezone(&Local);
+    let now = Local::now();
+    let diff = now.signed_duration_since(msg_time);
+
+    let secs = diff.num_seconds();
+    if secs < 0 {
+        return "now".to_string();
+    }
+    if secs < 60 {
+        return "now".to_string();
+    }
+
+    let mins = diff.num_minutes();
+    if mins == 1 {
+        return "1 min ago".to_string();
+    }
+    if mins < 60 {
+        return format!("{mins} min ago");
+    }
+
+    let hours = diff.num_hours();
+    if hours == 1 {
+        return "1 hour ago".to_string();
+    }
+    if hours < 24 {
+        return format!("{hours} hours ago");
+    }
+
+    // Check if it was yesterday
+    let msg_date = msg_time.date_naive();
+    let today = now.date_naive();
+    let days = (today - msg_date).num_days();
+
+    if days == 1 {
+        return format!("Yesterday, {}", msg_time.format("%-I:%M %p"));
+    }
+
+    // Within the last week: show day name + time
+    if days < 7 {
+        return msg_time.format("%A, %-I:%M %p").to_string();
+    }
+
+    // Older: show full date + time
+    msg_time.format("%b %-d, %Y, %-I:%M %p").to_string()
+}
+
+fn parse_conversation_item(item: &ConversationItem) -> Option<ChatMessage> {
+    match item {
+        ConversationItem::Message {
+            id,
+            role,
+            content,
+            created_at,
+            ..
+        } => {
+            let is_user = role == "user";
+            let text: String = content
+                .iter()
+                .filter_map(|c| match c {
+                    ConversationContent::Text { text }
+                    | ConversationContent::InputText { text }
+                    | ConversationContent::OutputText { text } => Some(text.as_str()),
+                    _ => None,
+                })
+                .collect::<Vec<_>>()
+                .join("\n");
+
+            if text.is_empty() {
+                return None;
+            }
+
+            let ts = created_at.unwrap_or_else(|| Utc::now().timestamp());
+
+            Some(ChatMessage {
+                id: id.to_string(),
+                content: text,
+                is_user,
+                is_streaming: false,
+                timestamp: ts,
+                timestamp_display: format_relative_time(ts),
+                show_sender: true,
+                show_timestamp: true,
+            })
+        }
+        _ => None,
+    }
+}
+
+enum ErrorContext {
+    Auth,
+    History,
+    Agent,
+    Delete,
+}
+
+fn is_recoverable_secure_session_error(error: &opensecret::Error) -> bool {
+    matches!(
+        error,
+        opensecret::Error::Session(_)
+            | opensecret::Error::Encryption(_)
+            | opensecret::Error::Decryption(_)
+            | opensecret::Error::Api { status: 400, .. }
+    )
+}
+
+fn is_recoverable_secure_session_error_text(error: &str) -> bool {
+    let normalized = error.to_ascii_lowercase();
+
+    normalized.contains("session error")
+        || normalized.contains("encryption error")
+        || normalized.contains("decryption error")
+        || normalized.contains("failed to decrypt session key")
+        || normalized.contains("aead::error")
+        || normalized.contains("no active session")
+}
+
+fn user_visible_error(context: ErrorContext, error: &str) -> String {
+    if !is_recoverable_secure_session_error_text(error) {
+        return error.to_string();
+    }
+
+    match context {
+        ErrorContext::Auth => "Couldn't complete the secure sign-in. Please try again.".into(),
+        ErrorContext::History => "Couldn't refresh the conversation. Please try again.".into(),
+        ErrorContext::Agent => "Secure connection interrupted. Please send that again.".into(),
+        ErrorContext::Delete => "Couldn't complete that securely. Please try again.".into(),
+    }
+}
+
+async fn perform_attestation_handshake_with_retry(
+    os: &opensecret::OpenSecretClient,
+) -> Result<(), opensecret::Error> {
+    match os.perform_attestation_handshake().await {
+        Ok(()) => Ok(()),
+        Err(error) if is_recoverable_secure_session_error(&error) => {
+            eprintln!("Retrying transient attestation failure: {error}");
+            os.perform_attestation_handshake().await
+        }
+        Err(error) => Err(error),
+    }
+}
+
+fn api_uses_mock_attestation(api_url: &str) -> bool {
+    api_url.contains("localhost")
+        || api_url.contains("127.0.0.1")
+        || api_url.contains("0.0.0.0")
+        || api_url.contains("10.0.2.2")
+}
+
+fn jwt_payload(token: &str) -> Option<JsonValue> {
+    let payload = token.split('.').nth(1)?;
+    let decoded = URL_SAFE_NO_PAD.decode(payload).or_else(|_| {
+        let mut padded = payload.to_string();
+        while padded.len() % 4 != 0 {
+            padded.push('=');
+        }
+        URL_SAFE.decode(padded)
+    });
+
+    serde_json::from_slice(&decoded.ok()?).ok()
+}
+
+fn token_fingerprint(token: &str) -> String {
+    let checksum = token.bytes().fold(0u64, |acc, byte| {
+        acc.wrapping_mul(131).wrapping_add(byte as u64)
+    });
+    format!("{checksum:016x}")
+}
+
+fn token_debug_summary(label: &str, token: &str) -> String {
+    let mut pieces = vec![
+        format!("len={}", token.len()),
+        format!("fp={}", token_fingerprint(token)),
+        format!("segments={}", token.split('.').count()),
+    ];
+
+    if let Some(payload) = jwt_payload(token) {
+        if let Some(exp) = payload.get("exp").and_then(|value| value.as_i64()) {
+            pieces.push(format!("exp_delta={}s", exp - Utc::now().timestamp()));
+        }
+
+        if let Some(token_type) = payload
+            .get("type")
+            .or_else(|| payload.get("token_type"))
+            .or_else(|| payload.get("typ"))
+            .and_then(|value| value.as_str())
+        {
+            pieces.push(format!("type={token_type}"));
+        }
+    } else {
+        pieces.push("jwt=unparsed".to_string());
+    }
+
+    format!("{label}{{{}}}", pieces.join(", "))
+}
+
+fn session_token_debug_summary(access_token: &str, refresh_token: &str) -> String {
+    format!(
+        "{} {} same={}",
+        token_debug_summary("access", access_token),
+        token_debug_summary("refresh", refresh_token),
+        access_token == refresh_token,
+    )
+}
+
+fn parse_attestation_document_for_refresh(
+    api_url: &str,
+    document_b64: &str,
+    expected_nonce: &str,
+) -> Result<AttestationDocument, opensecret::Error> {
+    if !api_uses_mock_attestation(api_url) {
+        return AttestationVerifier::new()
+            .verify_attestation_document(document_b64, expected_nonce);
+    }
+
+    let document_bytes = BASE64.decode(document_b64)?;
+    let cbor_value: CborValue = serde_cbor::from_slice(&document_bytes)?;
+
+    let cose_sign1 = match &cbor_value {
+        CborValue::Array(arr) if arr.len() == 4 => arr,
+        _ => {
+            return Err(opensecret::Error::AttestationVerificationFailed(
+                "Invalid COSE_Sign1 structure".to_string(),
+            ));
+        }
+    };
+
+    let payload = match &cose_sign1[2] {
+        CborValue::Bytes(bytes) => bytes,
+        _ => {
+            return Err(opensecret::Error::AttestationVerificationFailed(
+                "Invalid payload".to_string(),
+            ));
+        }
+    };
+
+    let doc_cbor: CborValue = serde_cbor::from_slice(payload)?;
+    let map = match &doc_cbor {
+        CborValue::Map(entries) => entries,
+        _ => {
+            return Err(opensecret::Error::AttestationVerificationFailed(
+                "Invalid attestation document format".to_string(),
+            ));
+        }
+    };
+
+    let mut public_key = None;
+    let mut nonce = None;
+
+    for (key, value) in map {
+        if let CborValue::Text(key_str) = key {
+            match key_str.as_str() {
+                "public_key" => {
+                    public_key = match value {
+                        CborValue::Bytes(bytes) => Some(bytes.clone()),
+                        _ => None,
+                    };
+                }
+                "nonce" => {
+                    nonce = match value {
+                        CborValue::Bytes(bytes) => Some(bytes.clone()),
+                        _ => None,
+                    };
+                }
+                _ => {}
+            }
+        }
+    }
+
+    match nonce.as_deref() {
+        Some(raw_nonce) if raw_nonce == expected_nonce.as_bytes() => {}
+        Some(_) => {
+            return Err(opensecret::Error::AttestationVerificationFailed(
+                "Nonce mismatch".to_string(),
+            ));
+        }
+        None => {
+            return Err(opensecret::Error::AttestationVerificationFailed(
+                "Missing nonce in attestation document".to_string(),
+            ));
+        }
+    }
+
+    Ok(AttestationDocument {
+        module_id: "mock-module".to_string(),
+        timestamp: 0,
+        digest: "SHA384".to_string(),
+        pcrs: std::collections::HashMap::new(),
+        certificate: vec![],
+        cabundle: vec![],
+        public_key,
+        user_data: None,
+        nonce,
+    })
+}
+
+async fn response_to_api_error(response: reqwest::Response) -> opensecret::Error {
+    let status = response.status().as_u16();
+    let message = response
+        .text()
+        .await
+        .unwrap_or_else(|_| "Unknown error".to_string());
+
+    opensecret::Error::Api { status, message }
+}
+
+async fn refresh_session_tokens_without_auth(
+    api_url: &str,
+    refresh_token: String,
+) -> Result<SessionTokenPair, opensecret::Error> {
+    let client = reqwest::Client::new();
+    let base_url = api_url.trim_end_matches('/');
+    let nonce = uuid::Uuid::new_v4().to_string();
+
+    let attestation_response = client
+        .get(format!("{base_url}/attestation/{nonce}"))
+        .send()
+        .await?;
+    if !attestation_response.status().is_success() {
+        eprintln!(
+            "Session restore refresh path: attestation failed with status {}",
+            attestation_response.status()
+        );
+        return Err(response_to_api_error(attestation_response).await);
+    }
+
+    let attestation_doc: AttestationResponse = attestation_response.json().await?;
+    let doc = parse_attestation_document_for_refresh(
+        api_url,
+        &attestation_doc.attestation_document,
+        &nonce,
+    )?;
+    let server_public_key_bytes = doc.public_key.ok_or_else(|| {
+        opensecret::Error::AttestationVerificationFailed(
+            "No public key in attestation document".to_string(),
+        )
+    })?;
+
+    let (secret, public_key) = crypto::generate_static_keypair();
+    let key_exchange_request = KeyExchangeRequest {
+        client_public_key: BASE64.encode(public_key.as_bytes()),
+        nonce,
+    };
+
+    let key_exchange_response = client
+        .post(format!("{base_url}/key_exchange"))
+        .header(CONTENT_TYPE, "application/json")
+        .json(&key_exchange_request)
+        .send()
+        .await?;
+    if !key_exchange_response.status().is_success() {
+        eprintln!(
+            "Session restore refresh path: key_exchange failed with status {}",
+            key_exchange_response.status()
+        );
+        return Err(response_to_api_error(key_exchange_response).await);
+    }
+
+    let key_exchange: KeyExchangeResponse = key_exchange_response.json().await?;
+    let server_public_key = PublicKey::from(
+        <[u8; 32]>::try_from(server_public_key_bytes.as_slice()).map_err(|_| {
+            opensecret::Error::KeyExchange("Invalid server public key length".to_string())
+        })?,
+    );
+    let shared_secret = crypto::perform_static_key_exchange(&secret, &server_public_key);
+    let session_key =
+        crypto::decrypt_session_key(&shared_secret, &key_exchange.encrypted_session_key)?;
+    let session_id = uuid::Uuid::parse_str(&key_exchange.session_id).map_err(|error| {
+        opensecret::Error::Session(format!("Invalid session ID format: {error}"))
+    })?;
+
+    let encrypted_request = EncryptedRequest {
+        encrypted: BASE64.encode(crypto::encrypt_data(
+            &session_key,
+            serde_json::to_string(&RefreshRequest { refresh_token })?.as_bytes(),
+        )?),
+    };
+
+    let mut headers = HeaderMap::new();
+    headers.insert(CONTENT_TYPE, HeaderValue::from_static("application/json"));
+    headers.insert(
+        "x-session-id",
+        HeaderValue::from_str(&session_id.to_string())
+            .map_err(|error| opensecret::Error::Session(format!("Invalid session ID: {error}")))?,
+    );
+
+    let refresh_response = client
+        .post(format!("{base_url}/refresh"))
+        .headers(headers)
+        .json(&encrypted_request)
+        .send()
+        .await?;
+    if !refresh_response.status().is_success() {
+        eprintln!(
+            "Session restore refresh path: /refresh failed with status {}",
+            refresh_response.status()
+        );
+        return Err(response_to_api_error(refresh_response).await);
+    }
+
+    let encrypted_response: EncryptedResponse<RefreshResponse> = refresh_response.json().await?;
+    let decrypted =
+        crypto::decrypt_data(&session_key, &BASE64.decode(&encrypted_response.encrypted)?)?;
+    let refreshed: RefreshResponse = serde_json::from_slice(&decrypted)?;
+
+    eprintln!(
+        "Session restore refresh path: refresh succeeded with {}",
+        session_token_debug_summary(&refreshed.access_token, &refreshed.refresh_token)
+    );
+
+    Ok((refreshed.access_token, refreshed.refresh_token))
+}
+
+async fn restore_user_session(
+    os: &opensecret::OpenSecretClient,
+    api_url: &str,
+) -> Result<UserResponse, opensecret::Error> {
+    match os.get_user().await {
+        Ok(response) => Ok(response),
+        Err(opensecret::Error::Api {
+            status: 401,
+            message,
+        }) => {
+            let refresh_token = match os.get_refresh_token()? {
+                Some(token) if !token.trim().is_empty() => token,
+                _ => {
+                    return Err(opensecret::Error::Api {
+                        status: 401,
+                        message,
+                    });
+                }
+            };
+
+            eprintln!(
+                "Session restore got 401 from /protected/user; attempting token refresh: {message}"
+            );
+
+            let (access_token, refresh_token) =
+                refresh_session_tokens_without_auth(api_url, refresh_token).await?;
+            eprintln!("Session restore refreshed tokens successfully; retrying /protected/user");
+
+            os.set_tokens(access_token, Some(refresh_token))?;
+            os.get_user().await
+        }
+        Err(error) => Err(error),
+    }
+}
+
+type SessionTokenPair = (String, String);
+
+fn current_session_tokens(os: &opensecret::OpenSecretClient) -> Option<SessionTokenPair> {
+    let access_token = os
+        .get_access_token()
+        .ok()
+        .flatten()
+        .map(|token| token.trim().to_string())?;
+    let refresh_token = os
+        .get_refresh_token()
+        .ok()
+        .flatten()
+        .map(|token| token.trim().to_string())?;
+
+    if access_token.is_empty() || refresh_token.is_empty() {
+        return None;
+    }
+
+    Some((access_token, refresh_token))
+}
+
+fn emit_session_tokens_if_changed(
+    update_tx: &Sender<AppUpdate>,
+    rev: &mut u64,
+    last_synced_session_tokens: &mut Option<SessionTokenPair>,
+    tokens: Option<SessionTokenPair>,
+) {
+    if *last_synced_session_tokens == tokens {
+        return;
+    }
+
+    match tokens.as_ref() {
+        Some((access_token, refresh_token)) => {
+            eprintln!(
+                "Session tokens updated: {}",
+                session_token_debug_summary(access_token, refresh_token)
+            );
+        }
+        None => eprintln!("Session tokens cleared"),
+    }
+
+    *rev += 1;
+    let emitted_rev = *rev;
+    let (access_token, refresh_token) = tokens
+        .clone()
+        .unwrap_or_else(|| (String::new(), String::new()));
+
+    *last_synced_session_tokens = tokens;
+
+    let _ = update_tx.send(AppUpdate::SessionTokens {
+        rev: emitted_rev,
+        access_token,
+        refresh_token,
+    });
+}
+
+fn sync_session_tokens_from_client(
+    os: &opensecret::OpenSecretClient,
+    update_tx: &Sender<AppUpdate>,
+    rev: &mut u64,
+    last_synced_session_tokens: &mut Option<SessionTokenPair>,
+) {
+    emit_session_tokens_if_changed(
+        update_tx,
+        rev,
+        last_synced_session_tokens,
+        current_session_tokens(os),
+    );
+}
+
+// ── State ───────────────────────────────────────────────────────────────────
+
+#[derive(uniffi::Enum, Clone, Debug)]
+pub enum AuthState {
+    Initializing,
+    Ready,
+    LoggingIn,
+    SigningUp,
+    LoggedIn {
+        user_id: String,
+        email: Option<String>,
+        name: Option<String>,
+    },
+}
+
+#[derive(uniffi::Enum, Clone, Debug, PartialEq)]
+pub enum OAuthProvider {
+    Github,
+    Google,
+    Apple,
+}
+
+#[derive(uniffi::Record, Clone, Debug)]
+pub struct ChatMessage {
+    pub id: String,
+    pub content: String,
+    pub is_user: bool,
+    pub is_streaming: bool,
+    pub timestamp: i64,
+    pub timestamp_display: String,
+    pub show_sender: bool,
+    pub show_timestamp: bool,
+}
+
+const TIMESTAMP_GAP_SECS: i64 = 300; // 5 minutes
+
+fn recompute_display_flags(messages: &mut [ChatMessage]) {
+    let len = messages.len();
+    for i in 0..len {
+        // Show sender label when sender changes from previous message
+        let prev = if i > 0 { Some(&messages[i - 1]) } else { None };
+        messages[i].show_sender = match prev {
+            Some(p) => messages[i].is_user != p.is_user,
+            None => true,
+        };
+
+        // Show timestamp on the LAST message before a sender change or time gap
+        let next = if i + 1 < len {
+            Some(&messages[i + 1])
+        } else {
+            None
+        };
+        messages[i].show_timestamp = match next {
+            Some(n) => {
+                messages[i].is_user != n.is_user
+                    || (n.timestamp - messages[i].timestamp).abs() >= TIMESTAMP_GAP_SECS
+            }
+            None => true, // always show on the last message
+        };
+    }
+}
+
+#[derive(uniffi::Record, Clone, Debug)]
+pub struct AppState {
+    pub rev: u64,
+    pub auth: AuthState,
+    pub pending_auth_url: Option<String>,
+    pub router: Router,
+    pub messages: Vec<ChatMessage>,
+    pub is_agent_typing: bool,
+    pub is_loading_history: bool,
+    pub has_older_messages: bool,
+    pub compose_text: String,
+    pub toast: Option<String>,
+    pub show_settings: bool,
+    pub confirm_delete_agent: bool,
+    pub is_deleting_agent: bool,
+}
+
+#[derive(uniffi::Record, Clone, Debug, PartialEq)]
+pub struct Router {
+    pub default_screen: Screen,
+    pub screen_stack: Vec<Screen>,
+}
+
+#[derive(uniffi::Enum, Clone, Debug, PartialEq)]
+pub enum Screen {
+    Loading,
+    Login,
+    Chat,
+}
+
+impl AppState {
+    fn initial() -> Self {
+        Self {
+            rev: 0,
+            auth: AuthState::Initializing,
+            pending_auth_url: None,
+            router: Router {
+                default_screen: Screen::Loading,
+                screen_stack: vec![],
+            },
+            messages: vec![],
+            is_agent_typing: false,
+            is_loading_history: false,
+            has_older_messages: false,
+            compose_text: String::new(),
+            toast: None,
+            show_settings: false,
+            confirm_delete_agent: false,
+            is_deleting_agent: false,
+        }
+    }
+}
+
+// ── Actions & Updates ───────────────────────────────────────────────────────
+
+#[derive(uniffi::Enum, Clone, Debug)]
+pub enum AppAction {
+    // Auth
+    LoginWithEmail {
+        email: String,
+        password: String,
+    },
+    SignUpWithEmail {
+        email: String,
+        password: String,
+        name: String,
+    },
+    InitiateOAuth {
+        provider: OAuthProvider,
+        invite_code: Option<String>,
+    },
+    HandleOAuthCallback {
+        provider: OAuthProvider,
+        code: String,
+        state: String,
+        invite_code: String,
+    },
+    RestoreSession {
+        access_token: String,
+        refresh_token: String,
+    },
+    CompleteStartup,
+    ClearPendingAuthUrl,
+    Logout,
+
+    // Chat
+    SendMessage {
+        content: String,
+    },
+    LoadOlderMessages,
+    RefreshTimestamps,
+    ClearToast,
+
+    // Settings
+    ToggleSettings,
+    RequestDeleteAgent,
+    ConfirmDeleteAgent,
+    CancelDeleteAgent,
+}
+
+#[derive(uniffi::Enum, Clone, Debug)]
+pub enum AppUpdate {
+    FullState(AppState),
+    SessionTokens {
+        rev: u64,
+        access_token: String,
+        refresh_token: String,
+    },
+}
+
+// ── Callback interface ──────────────────────────────────────────────────────
+
+#[uniffi::export(callback_interface)]
+pub trait AppReconciler: Send + Sync + 'static {
+    fn reconcile(&self, update: AppUpdate);
+}
+
+// ── Internal events (async results, not FFI-visible) ────────────────────────
+
+enum InternalEvent {
+    LoginSuccess {
+        user_id: String,
+        email: Option<String>,
+        name: Option<String>,
+        access_token: String,
+        refresh_token: String,
+    },
+    SessionRestored {
+        user_id: String,
+        email: Option<String>,
+        name: Option<String>,
+    },
+    SessionRestoreFailed(String),
+    AuthFailed(String),
+    OAuthUrlReady {
+        url: String,
+    },
+    // History loading
+    HistoryLoaded {
+        messages: Vec<ChatMessage>,
+        has_more: bool,
+        is_initial: bool,
+    },
+    HistoryLoadFailed(String),
+    // Agent streaming events
+    AgentMessageChunk {
+        messages: Vec<String>,
+        step: usize,
+    },
+    AgentDone,
+    AgentError(String),
+    // Settings
+    AgentDeleted,
+    AgentDeleteFailed(String),
+}
+
+enum CoreMsg {
+    Action(AppAction),
+    Internal(Box<InternalEvent>),
+}
+
+// ── FFI entry point ─────────────────────────────────────────────────────────
+
+#[derive(uniffi::Object)]
+pub struct FfiApp {
+    core_tx: Sender<CoreMsg>,
+    update_rx: Receiver<AppUpdate>,
+    listening: AtomicBool,
+    shared_state: Arc<RwLock<AppState>>,
+}
+
+#[uniffi::export]
+impl FfiApp {
+    #[uniffi::constructor]
+    pub fn new(api_url: String, client_id: String, data_dir: String) -> Arc<Self> {
+        let _ = data_dir;
+
+        let (update_tx, update_rx) = flume::unbounded();
+        let (core_tx, core_rx) = flume::unbounded::<CoreMsg>();
+        let shared_state = Arc::new(RwLock::new(AppState::initial()));
+
+        let shared_for_core = shared_state.clone();
+        let core_tx_async = core_tx.clone();
+
+        thread::spawn(move || {
+            let rt = tokio::runtime::Builder::new_multi_thread()
+                .worker_threads(2)
+                .enable_all()
+                .build()
+                .expect("Failed to create tokio runtime");
+
+            let client_uuid = uuid::Uuid::parse_str(&client_id).expect("Invalid client_id UUID");
+
+            let os_client = Arc::new(
+                opensecret::OpenSecretClient::new(&api_url)
+                    .expect("Failed to create OpenSecret client"),
+            );
+
+            let mut state = AppState::initial();
+            let mut rev: u64 = 0;
+            let mut next_msg_id: u64 = 0;
+            let mut oldest_cursor: Option<String> = None;
+            let mut last_synced_session_tokens: Option<SessionTokenPair> = None;
+
+            let emit =
+                |state: &AppState, shared: &Arc<RwLock<AppState>>, tx: &Sender<AppUpdate>| {
+                    let snapshot = state.clone();
+                    match shared.write() {
+                        Ok(mut g) => *g = snapshot.clone(),
+                        Err(p) => *p.into_inner() = snapshot.clone(),
+                    }
+                    let _ = tx.send(AppUpdate::FullState(snapshot));
+                };
+
+            emit(&state, &shared_for_core, &update_tx);
+
+            // Helper: spawn a history fetch (initial or older pages)
+            macro_rules! spawn_history_fetch {
+                ($cursor:expr, $is_initial:expr) => {{
+                    let os = os_client.clone();
+                    let tx = core_tx_async.clone();
+                    let cursor = $cursor;
+                    let is_initial: bool = $is_initial;
+                    rt.spawn(async move {
+                        let params = opensecret::types::AgentItemsListParams {
+                            limit: Some(PAGE_SIZE),
+                            order: Some("desc".to_string()),
+                            after: cursor.and_then(|c: String| uuid::Uuid::parse_str(&c).ok()),
+                            include: None,
+                        };
+                        let event = match os.list_main_agent_items(Some(params)).await {
+                            Ok(resp) => {
+                                let mut msgs: Vec<ChatMessage> = resp
+                                    .data
+                                    .iter()
+                                    .filter_map(|item| parse_conversation_item(item))
+                                    .collect();
+                                // API returns desc order; reverse to chronological
+                                msgs.reverse();
+                                InternalEvent::HistoryLoaded {
+                                    messages: msgs,
+                                    has_more: resp.has_more,
+                                    is_initial,
+                                }
+                            }
+                            Err(e) => InternalEvent::HistoryLoadFailed(e.to_string()),
+                        };
+                        let _ = tx.send(CoreMsg::Internal(Box::new(event)));
+                    });
+                }};
+            }
+
+            while let Ok(msg) = core_rx.recv() {
+                let mut should_sync_session_tokens = true;
+
+                match msg {
+                    CoreMsg::Internal(event) => match *event {
+                        InternalEvent::LoginSuccess {
+                            user_id,
+                            email,
+                            name,
+                            access_token,
+                            refresh_token,
+                        } => {
+                            state.auth = AuthState::LoggedIn {
+                                user_id,
+                                email,
+                                name,
+                            };
+                            state.router = Router {
+                                default_screen: Screen::Chat,
+                                screen_stack: vec![],
+                            };
+                            state.messages.clear();
+                            state.pending_auth_url = None;
+                            state.is_loading_history = true;
+                            oldest_cursor = None;
+
+                            emit_session_tokens_if_changed(
+                                &update_tx,
+                                &mut rev,
+                                &mut last_synced_session_tokens,
+                                Some((access_token, refresh_token)),
+                            );
+                            should_sync_session_tokens = false;
+
+                            spawn_history_fetch!(None::<String>, true);
+                        }
+                        InternalEvent::SessionRestored {
+                            user_id,
+                            email,
+                            name,
+                        } => {
+                            state.auth = AuthState::LoggedIn {
+                                user_id,
+                                email,
+                                name,
+                            };
+                            state.router = Router {
+                                default_screen: Screen::Chat,
+                                screen_stack: vec![],
+                            };
+                            state.pending_auth_url = None;
+                            state.messages.clear();
+                            state.is_loading_history = true;
+                            oldest_cursor = None;
+                            spawn_history_fetch!(None::<String>, true);
+                        }
+                        InternalEvent::SessionRestoreFailed(error) => {
+                            eprintln!("Session restore failed: {error}");
+                            state.auth = AuthState::Ready;
+                            state.router = Router {
+                                default_screen: Screen::Login,
+                                screen_stack: vec![],
+                            };
+                            state.toast = Some(user_visible_error(ErrorContext::Auth, &error));
+                        }
+                        InternalEvent::AuthFailed(error) => {
+                            state.auth = AuthState::Ready;
+                            state.toast = Some(user_visible_error(ErrorContext::Auth, &error));
+                            state.pending_auth_url = None;
+                        }
+                        InternalEvent::OAuthUrlReady { url } => {
+                            state.pending_auth_url = Some(url);
+                        }
+                        InternalEvent::HistoryLoaded {
+                            messages,
+                            has_more,
+                            is_initial,
+                        } => {
+                            state.is_loading_history = false;
+                            state.has_older_messages = has_more;
+
+                            if !messages.is_empty() {
+                                oldest_cursor = Some(messages[0].id.clone());
+
+                                if is_initial {
+                                    state.messages = messages;
+                                } else {
+                                    let mut combined = messages;
+                                    combined.append(&mut state.messages);
+                                    state.messages = combined;
+                                }
+                                recompute_display_flags(&mut state.messages);
+                            }
+                        }
+                        InternalEvent::HistoryLoadFailed(error) => {
+                            state.is_loading_history = false;
+                            state.toast = Some(user_visible_error(ErrorContext::History, &error));
+                        }
+                        InternalEvent::AgentMessageChunk { messages, step } => {
+                            // Each event carries new messages for this step.
+                            // Finalize any currently-streaming message, then
+                            // append all new messages (last one stays streaming).
+                            eprintln!("[agent] step={step} messages={messages:?}");
+
+                            // Finalize previous streaming message
+                            if let Some(msg) = state.messages.last_mut().filter(|m| m.is_streaming)
+                            {
+                                msg.is_streaming = false;
+                            }
+
+                            for (i, text) in messages.iter().enumerate() {
+                                let is_last = i == messages.len() - 1;
+                                next_msg_id += 1;
+                                let ts = Utc::now().timestamp();
+                                state.messages.push(ChatMessage {
+                                    id: format!("agent_s{step}_{next_msg_id}"),
+                                    content: text.clone(),
+                                    is_user: false,
+                                    is_streaming: is_last,
+                                    timestamp: ts,
+                                    timestamp_display: format_relative_time(ts),
+                                    show_sender: true,
+                                    show_timestamp: true,
+                                });
+                            }
+                            recompute_display_flags(&mut state.messages);
+                            state.is_agent_typing = true;
+                        }
+                        InternalEvent::AgentDone => {
+                            // Finalize any streaming message
+                            if let Some(msg) = state.messages.last_mut().filter(|m| m.is_streaming)
+                            {
+                                msg.is_streaming = false;
+                            }
+                            state.is_agent_typing = false;
+                        }
+                        InternalEvent::AgentError(error) => {
+                            // Finalize any streaming message
+                            if let Some(msg) = state.messages.last_mut().filter(|m| m.is_streaming)
+                            {
+                                msg.is_streaming = false;
+                            }
+                            state.is_agent_typing = false;
+                            state.toast = Some(user_visible_error(ErrorContext::Agent, &error));
+                        }
+                        InternalEvent::AgentDeleted => {
+                            state.is_deleting_agent = false;
+                            state.show_settings = false;
+                            state.messages.clear();
+                            state.is_agent_typing = false;
+                            state.has_older_messages = false;
+                            oldest_cursor = None;
+                            state.toast = Some("Agent conversation deleted".to_string());
+                        }
+                        InternalEvent::AgentDeleteFailed(error) => {
+                            state.is_deleting_agent = false;
+                            state.toast = Some(user_visible_error(ErrorContext::Delete, &error));
+                        }
+                    },
+
+                    CoreMsg::Action(action) => match action {
+                        // ── Auth ─────────────────────────────────────────
+                        AppAction::LoginWithEmail { email, password } => {
+                            state.auth = AuthState::LoggingIn;
+                            let os = os_client.clone();
+                            let tx = core_tx_async.clone();
+                            let cid = client_uuid;
+                            rt.spawn(async move {
+                                let event = match os.login(email, password, cid).await {
+                                    Ok(resp) => InternalEvent::LoginSuccess {
+                                        user_id: resp.id.to_string(),
+                                        email: resp.email,
+                                        name: None,
+                                        access_token: resp.access_token,
+                                        refresh_token: resp.refresh_token,
+                                    },
+                                    Err(e) => {
+                                        InternalEvent::AuthFailed(format!("Login failed: {e}"))
+                                    }
+                                };
+                                let _ = tx.send(CoreMsg::Internal(Box::new(event)));
+                            });
+                        }
+
+                        AppAction::SignUpWithEmail {
+                            email,
+                            password,
+                            name,
+                        } => {
+                            state.auth = AuthState::SigningUp;
+                            let os = os_client.clone();
+                            let tx = core_tx_async.clone();
+                            let cid = client_uuid;
+                            let name_opt = if name.is_empty() { None } else { Some(name) };
+                            rt.spawn(async move {
+                                let event = match os.register(email, password, cid, name_opt).await
+                                {
+                                    Ok(resp) => InternalEvent::LoginSuccess {
+                                        user_id: resp.id.to_string(),
+                                        email: resp.email,
+                                        name: None,
+                                        access_token: resp.access_token,
+                                        refresh_token: resp.refresh_token,
+                                    },
+                                    Err(e) => {
+                                        InternalEvent::AuthFailed(format!("Sign up failed: {e}"))
+                                    }
+                                };
+                                let _ = tx.send(CoreMsg::Internal(Box::new(event)));
+                            });
+                        }
+
+                        AppAction::InitiateOAuth {
+                            provider,
+                            invite_code,
+                        } => {
+                            state.auth = AuthState::LoggingIn;
+                            let os = os_client.clone();
+                            let tx = core_tx_async.clone();
+                            let cid = client_uuid;
+                            rt.spawn(async move {
+                                let result = match provider {
+                                    OAuthProvider::Github => os
+                                        .initiate_github_auth(cid, invite_code)
+                                        .await
+                                        .map(|r| r.auth_url),
+                                    OAuthProvider::Google => os
+                                        .initiate_google_auth(cid, invite_code)
+                                        .await
+                                        .map(|r| r.auth_url),
+                                    OAuthProvider::Apple => os
+                                        .initiate_apple_auth(cid, invite_code)
+                                        .await
+                                        .map(|r| r.auth_url),
+                                };
+                                let event = match result {
+                                    Ok(url) => InternalEvent::OAuthUrlReady { url },
+                                    Err(e) => InternalEvent::AuthFailed(format!(
+                                        "OAuth initiation failed: {e}"
+                                    )),
+                                };
+                                let _ = tx.send(CoreMsg::Internal(Box::new(event)));
+                            });
+                        }
+
+                        AppAction::HandleOAuthCallback {
+                            provider,
+                            code,
+                            state: oauth_state,
+                            invite_code,
+                        } => {
+                            state.auth = AuthState::LoggingIn;
+                            state.pending_auth_url = None;
+                            let os = os_client.clone();
+                            let tx = core_tx_async.clone();
+                            rt.spawn(async move {
+                                let result = match provider {
+                                    OAuthProvider::Github => {
+                                        os.handle_github_callback(code, oauth_state, invite_code)
+                                            .await
+                                    }
+                                    OAuthProvider::Google => {
+                                        os.handle_google_callback(code, oauth_state, invite_code)
+                                            .await
+                                    }
+                                    OAuthProvider::Apple => {
+                                        os.handle_apple_callback(code, oauth_state, invite_code)
+                                            .await
+                                    }
+                                };
+                                let event = match result {
+                                    Ok(resp) => InternalEvent::LoginSuccess {
+                                        user_id: resp.id.to_string(),
+                                        email: resp.email,
+                                        name: None,
+                                        access_token: resp.access_token,
+                                        refresh_token: resp.refresh_token,
+                                    },
+                                    Err(e) => InternalEvent::AuthFailed(format!(
+                                        "OAuth callback failed: {e}"
+                                    )),
+                                };
+                                let _ = tx.send(CoreMsg::Internal(Box::new(event)));
+                            });
+                        }
+
+                        AppAction::RestoreSession {
+                            access_token,
+                            refresh_token,
+                        } => {
+                            eprintln!(
+                                "Attempting session restore with {}",
+                                session_token_debug_summary(&access_token, &refresh_token)
+                            );
+                            state.auth = AuthState::Initializing;
+                            state.router = Router {
+                                default_screen: Screen::Loading,
+                                screen_stack: vec![],
+                            };
+                            state.pending_auth_url = None;
+                            let os = os_client.clone();
+                            let tx = core_tx_async.clone();
+                            if let Err(e) = os.set_tokens(access_token, Some(refresh_token)) {
+                                let _ = tx.send(CoreMsg::Internal(Box::new(
+                                    InternalEvent::SessionRestoreFailed(format!(
+                                        "Failed to set tokens: {e}"
+                                    )),
+                                )));
+                            } else {
+                                let restore_api_url = api_url.clone();
+                                rt.spawn(async move {
+                                    match restore_user_session(os.as_ref(), &restore_api_url).await
+                                    {
+                                        Ok(resp) => {
+                                            let _ = tx.send(CoreMsg::Internal(Box::new(
+                                                InternalEvent::SessionRestored {
+                                                    user_id: resp.user.id.to_string(),
+                                                    email: resp.user.email,
+                                                    name: resp.user.name,
+                                                },
+                                            )));
+                                        }
+                                        Err(e) => {
+                                            let _ = tx.send(CoreMsg::Internal(Box::new(
+                                                InternalEvent::SessionRestoreFailed(e.to_string()),
+                                            )));
+                                        }
+                                    }
+                                });
+                            }
+                        }
+
+                        AppAction::CompleteStartup => {
+                            if matches!(state.auth, AuthState::Initializing) {
+                                state.auth = AuthState::Ready;
+                                state.router = Router {
+                                    default_screen: Screen::Login,
+                                    screen_stack: vec![],
+                                };
+                                state.pending_auth_url = None;
+                            }
+                        }
+
+                        AppAction::ClearPendingAuthUrl => {
+                            state.pending_auth_url = None;
+                        }
+
+                        AppAction::Logout => {
+                            let os = os_client.clone();
+                            rt.spawn(async move {
+                                let _ = os.logout().await;
+                            });
+                            state.auth = AuthState::Ready;
+                            state.router = Router {
+                                default_screen: Screen::Login,
+                                screen_stack: vec![],
+                            };
+                            state.messages.clear();
+                            state.is_agent_typing = false;
+                            state.is_loading_history = false;
+                            state.has_older_messages = false;
+                            state.compose_text.clear();
+                            state.show_settings = false;
+                            state.confirm_delete_agent = false;
+                            state.is_deleting_agent = false;
+                            oldest_cursor = None;
+
+                            emit_session_tokens_if_changed(
+                                &update_tx,
+                                &mut rev,
+                                &mut last_synced_session_tokens,
+                                None,
+                            );
+                            should_sync_session_tokens = false;
+                        }
+
+                        // ── Chat ─────────────────────────────────────────
+                        AppAction::LoadOlderMessages => {
+                            if state.is_loading_history || !state.has_older_messages {
+                                continue;
+                            }
+                            state.is_loading_history = true;
+                            spawn_history_fetch!(oldest_cursor.clone(), false);
+                        }
+                        AppAction::SendMessage { content } => {
+                            let content = content.trim().to_string();
+                            if content.is_empty() || state.is_agent_typing {
+                                continue;
+                            }
+
+                            // Add user message to state
+                            next_msg_id += 1;
+                            let ts = Utc::now().timestamp();
+                            state.messages.push(ChatMessage {
+                                id: format!("user_{next_msg_id}"),
+                                content: content.clone(),
+                                is_user: true,
+                                is_streaming: false,
+                                timestamp: ts,
+                                timestamp_display: format_relative_time(ts),
+                                show_sender: true,
+                                show_timestamp: true,
+                            });
+                            recompute_display_flags(&mut state.messages);
+                            state.is_agent_typing = true;
+                            state.compose_text.clear();
+
+                            let (stagger_tx, stagger_rx) = flume::unbounded::<InternalEvent>();
+                            let paced_core_tx = core_tx_async.clone();
+                            rt.spawn(async move {
+                                use std::time::Duration;
+                                use tokio::time::{sleep_until, Instant};
+
+                                let mut next_emit_at: Option<Instant> = None;
+
+                                while let Ok(event) = stagger_rx.recv_async().await {
+                                    let is_message =
+                                        matches!(&event, InternalEvent::AgentMessageChunk { .. });
+                                    let is_terminal = matches!(
+                                        &event,
+                                        InternalEvent::AgentDone | InternalEvent::AgentError(_)
+                                    );
+
+                                    if is_message {
+                                        if let Some(deadline) = next_emit_at {
+                                            sleep_until(deadline).await;
+                                        }
+                                        next_emit_at = Some(
+                                            Instant::now()
+                                                + Duration::from_millis(AGENT_MESSAGE_STAGGER_MS),
+                                        );
+                                    }
+
+                                    let _ = paced_core_tx.send(CoreMsg::Internal(Box::new(event)));
+
+                                    if is_terminal {
+                                        break;
+                                    }
+                                }
+                            });
+
+                            // Spawn agent_chat streaming task
+                            let os = os_client.clone();
+                            let tx = stagger_tx;
+                            rt.spawn(async move {
+                                use futures::StreamExt;
+                                let mut retried_session = false;
+
+                                'agent_stream: loop {
+                                    match os.agent_chat(&content).await {
+                                        Ok(mut stream) => {
+                                            let mut received_message = false;
+
+                                            while let Some(event) = stream.next().await {
+                                                match event {
+                                                    Ok(opensecret::types::AgentSseEvent::Message(
+                                                        msg,
+                                                    )) => {
+                                                        if !msg.messages.is_empty() {
+                                                            received_message = true;
+                                                            let step = msg.step;
+
+                                                            for text in msg.messages {
+                                                                let _ = tx.send(
+                                                                    InternalEvent::AgentMessageChunk {
+                                                                        messages: vec![text],
+                                                                        step,
+                                                                    },
+                                                                );
+                                                            }
+                                                        }
+                                                    }
+                                                    Ok(opensecret::types::AgentSseEvent::Typing(_)) => {
+                                                        continue;
+                                                    }
+                                                    Ok(opensecret::types::AgentSseEvent::Done(_)) => {
+                                                        let _ = tx.send(InternalEvent::AgentDone);
+                                                        return;
+                                                    }
+                                                    Ok(opensecret::types::AgentSseEvent::Error(
+                                                        err,
+                                                    )) => {
+                                                        if !received_message
+                                                            && !retried_session
+                                                            && is_recoverable_secure_session_error_text(
+                                                                &err.error,
+                                                            )
+                                                        {
+                                                            retried_session = true;
+                                                            match perform_attestation_handshake_with_retry(
+                                                                os.as_ref(),
+                                                            )
+                                                            .await
+                                                            {
+                                                                Ok(()) => continue 'agent_stream,
+                                                                Err(handshake_error) => {
+                                                                    let _ = tx.send(
+                                                                        InternalEvent::AgentError(
+                                                                            handshake_error
+                                                                                .to_string(),
+                                                                        ),
+                                                                    );
+                                                                    return;
+                                                                }
+                                                            }
+                                                        }
+
+                                                        let _ = tx.send(InternalEvent::AgentError(err.error));
+                                                        return;
+                                                    }
+                                                    Err(error) => {
+                                                        if !received_message
+                                                            && !retried_session
+                                                            && is_recoverable_secure_session_error(
+                                                                &error,
+                                                            )
+                                                        {
+                                                            retried_session = true;
+                                                            match perform_attestation_handshake_with_retry(
+                                                                os.as_ref(),
+                                                            )
+                                                            .await
+                                                            {
+                                                                Ok(()) => continue 'agent_stream,
+                                                                Err(handshake_error) => {
+                                                                    let _ = tx.send(
+                                                                        InternalEvent::AgentError(
+                                                                            handshake_error
+                                                                                .to_string(),
+                                                                        ),
+                                                                    );
+                                                                    return;
+                                                                }
+                                                            }
+                                                        }
+
+                                                        let _ =
+                                                            tx.send(InternalEvent::AgentError(
+                                                                error.to_string(),
+                                                            ));
+                                                        return;
+                                                    }
+                                                }
+                                            }
+
+                                            let _ = tx.send(InternalEvent::AgentDone);
+                                            return;
+                                        }
+                                        Err(error)
+                                            if !retried_session
+                                                && is_recoverable_secure_session_error(&error) =>
+                                        {
+                                            retried_session = true;
+                                            match perform_attestation_handshake_with_retry(
+                                                os.as_ref(),
+                                            )
+                                            .await
+                                            {
+                                                Ok(()) => continue,
+                                                Err(handshake_error) => {
+                                                    let _ = tx.send(InternalEvent::AgentError(
+                                                        handshake_error.to_string(),
+                                                    ));
+                                                    return;
+                                                }
+                                            }
+                                        }
+                                        Err(error) => {
+                                            let _ =
+                                                tx.send(InternalEvent::AgentError(error.to_string()));
+                                            return;
+                                        }
+                                    }
+                                }
+                            });
+                        }
+                        AppAction::RefreshTimestamps => {
+                            for msg in &mut state.messages {
+                                msg.timestamp_display = format_relative_time(msg.timestamp);
+                            }
+                        }
+                        AppAction::ClearToast => {
+                            state.toast = None;
+                        }
+
+                        // ── Settings ─────────────────────────────────
+                        AppAction::ToggleSettings => {
+                            state.show_settings = !state.show_settings;
+                            state.confirm_delete_agent = false;
+                        }
+                        AppAction::RequestDeleteAgent => {
+                            state.confirm_delete_agent = true;
+                        }
+                        AppAction::CancelDeleteAgent => {
+                            state.confirm_delete_agent = false;
+                        }
+                        AppAction::ConfirmDeleteAgent => {
+                            state.is_deleting_agent = true;
+                            state.confirm_delete_agent = false;
+                            let os = os_client.clone();
+                            let tx = core_tx_async.clone();
+                            rt.spawn(async move {
+                                match os.delete_main_agent().await {
+                                    Ok(_) => {
+                                        let _ = tx.send(CoreMsg::Internal(Box::new(
+                                            InternalEvent::AgentDeleted,
+                                        )));
+                                    }
+                                    Err(e) => {
+                                        let _ = tx.send(CoreMsg::Internal(Box::new(
+                                            InternalEvent::AgentDeleteFailed(e.to_string()),
+                                        )));
+                                    }
+                                }
+                            });
+                        }
+                    },
+                }
+
+                if should_sync_session_tokens {
+                    sync_session_tokens_from_client(
+                        os_client.as_ref(),
+                        &update_tx,
+                        &mut rev,
+                        &mut last_synced_session_tokens,
+                    );
+                }
+
+                rev += 1;
+                state.rev = rev;
+                emit(&state, &shared_for_core, &update_tx);
+            }
+        });
+
+        Arc::new(Self {
+            core_tx,
+            update_rx,
+            listening: AtomicBool::new(false),
+            shared_state,
+        })
+    }
+
+    pub fn state(&self) -> AppState {
+        match self.shared_state.read() {
+            Ok(g) => g.clone(),
+            Err(poison) => poison.into_inner().clone(),
+        }
+    }
+
+    pub fn dispatch(&self, action: AppAction) {
+        let _ = self.core_tx.send(CoreMsg::Action(action));
+    }
+
+    pub fn listen_for_updates(&self, reconciler: Box<dyn AppReconciler>) {
+        if self
+            .listening
+            .compare_exchange(false, true, Ordering::SeqCst, Ordering::SeqCst)
+            .is_err()
+        {
+            return;
+        }
+
+        let rx = self.update_rx.clone();
+        thread::spawn(move || {
+            while let Ok(update) = rx.recv() {
+                reconciler.reconcile(update);
+            }
+        });
+    }
+}
diff --git a/native/rust/uniffi.toml b/native/rust/uniffi.toml
new file mode 100644
index 00000000..068cba46
--- /dev/null
+++ b/native/rust/uniffi.toml
@@ -0,0 +1,3 @@
+[bindings.kotlin]
+package_name = "cloud.opensecret.maple.rust"
+cdylib_name = "maple_core"
diff --git a/native/scripts/bundle-gtk-linux.sh b/native/scripts/bundle-gtk-linux.sh
new file mode 100755
index 00000000..ce8cb3ec
--- /dev/null
+++ b/native/scripts/bundle-gtk-linux.sh
@@ -0,0 +1,400 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "$(uname -s)" != "Linux" ]]; then
+  echo "bundle-gtk-linux.sh only supports Linux" >&2
+  exit 2
+fi
+
+if (( $# < 2 || $# > 3 )); then
+  echo "usage: $0 <binary-path> <bundle-dir> [launcher-name]" >&2
+  exit 2
+fi
+
+binary_path="$(readlink -f "$1")"
+bundle_dir="$2"
+launcher_name="${3:-Maple}"
+
+if [[ ! -x "$binary_path" ]]; then
+  echo "Missing executable binary: $binary_path" >&2
+  exit 2
+fi
+
+require_command() {
+  local missing=()
+  for cmd in "$@"; do
+    if ! command -v "$cmd" >/dev/null 2>&1; then
+      missing+=("$cmd")
+    fi
+  done
+
+  if (( ${#missing[@]} > 0 )); then
+    printf 'Missing required commands: %s\n' "${missing[*]}" >&2
+    exit 2
+  fi
+}
+
+require_command awk chmod cp file grep ldd mkdir patchelf readelf sed sort strings tar
+
+shopt -s nullglob
+
+binary_name="$(basename "$binary_path")"
+bundle_binary="$bundle_dir/$binary_name"
+bundle_lib_dir="$bundle_dir/lib"
+bundle_bin_dir="$bundle_dir/bin"
+bundle_share_dir="$bundle_dir/share"
+
+declare -A copied_libs=()
+declare -A copied_gio_modules=()
+
+is_elf() {
+  readelf -h "$1" >/dev/null 2>&1
+}
+
+first_glob() {
+  local entries=( $1 )
+  if (( ${#entries[@]} > 0 )); then
+    printf '%s\n' "${entries[0]}"
+  fi
+}
+
+copy_tree() {
+  local src="$1"
+  local dest="$2"
+
+  if [[ ! -d "$src" ]]; then
+    return 0
+  fi
+
+  mkdir -p "$(dirname "$dest")"
+  rm -rf "$dest"
+  cp -aL "$src" "$dest"
+  chmod -R u+w "$dest" 2>/dev/null || true
+}
+
+copy_tree_contents() {
+  local src="$1"
+  local dest="$2"
+
+  if [[ ! -d "$src" ]]; then
+    return 0
+  fi
+
+  mkdir -p "$dest"
+  cp -aL "$src"/. "$dest"/
+  chmod -R u+w "$dest" 2>/dev/null || true
+}
+
+patch_absolute_needed() {
+  local target="$1"
+  local needed=()
+  local dep
+
+  while IFS= read -r dep; do
+    needed+=("$dep")
+  done < <(readelf -d "$target" 2>/dev/null | sed -n 's/.*Shared library: \[\(\/[^]]*\)\].*/\1/p')
+
+  for dep in "${needed[@]}"; do
+    patchelf --replace-needed "$dep" "$(basename "$dep")" "$target"
+  done
+}
+
+patch_elf() {
+  local target="$1"
+  local runpath="$2"
+
+  if ! is_elf "$target"; then
+    return 0
+  fi
+
+  chmod u+w "$target"
+  patch_absolute_needed "$target"
+  patchelf --set-rpath "$runpath" "$target"
+}
+
+should_bundle_dep() {
+  local dep="$1"
+
+  if [[ -z "$dep" || ! -e "$dep" ]]; then
+    return 1
+  fi
+
+  case "$dep" in
+    */ld-linux-*.so.*|*/libc.so.6|*/libm.so.6|*/libpthread.so.0|*/libdl.so.2|*/librt.so.1|*/libutil.so.1|*/libresolv.so.2|*/libnss_*.so.*)
+      return 1
+      ;;
+  esac
+
+  return 0
+}
+
+list_deps() {
+  {
+    ldd "$1" 2>/dev/null | awk '
+      /=> \/[^ ]+/ { print $3 }
+      /^[[:space:]]*\/[[:graph:]]+ \(/ { print $1 }
+    '
+    readelf -d "$1" 2>/dev/null | sed -n 's/.*Shared library: \[\(\/[^]]*\)\].*/\1/p'
+  } | sort -u
+}
+
+copy_library() {
+  local src="$1"
+  local base="$(basename "$src")"
+  local dest="$bundle_lib_dir/$base"
+
+  if [[ -n "${copied_libs[$base]:-}" ]]; then
+    return 0
+  fi
+
+  copied_libs[$base]="$src"
+  mkdir -p "$bundle_lib_dir"
+  cp -L "$src" "$dest"
+  patch_elf "$dest" '$ORIGIN'
+  copy_dependency_closure "$src"
+}
+
+copy_dependency_closure() {
+  local source="$1"
+  local dep
+
+  while IFS= read -r dep; do
+    if should_bundle_dep "$dep"; then
+      copy_library "$dep"
+    fi
+  done < <(list_deps "$source")
+}
+
+copy_helper_binary() {
+  local src="$1"
+  local dest="$bundle_bin_dir/$(basename "$src")"
+
+  mkdir -p "$bundle_bin_dir"
+  cp -L "$src" "$dest"
+  patch_elf "$dest" '$ORIGIN/../lib'
+  copy_dependency_closure "$src"
+}
+
+copy_gio_module() {
+  local src="$1"
+  local base="$(basename "$src")"
+  local dest="$bundle_lib_dir/gio/modules/$base"
+
+  if [[ -n "${copied_gio_modules[$base]:-}" ]]; then
+    return 0
+  fi
+
+  copied_gio_modules[$base]="$src"
+  mkdir -p "$bundle_lib_dir/gio/modules"
+  cp -L "$src" "$dest"
+  patch_elf "$dest" '$ORIGIN/../../..'
+  copy_dependency_closure "$src"
+}
+
+extract_store_string() {
+  local target="$1"
+  local pattern="$2"
+
+  strings "$target" | grep -E -m1 "$pattern" || true
+}
+
+version_from_store_path() {
+  local store_path="$1"
+  local prefix="$2"
+  local store_name="$(basename "$store_path")"
+
+  printf '%s\n' "${store_name##*-${prefix}-}"
+}
+
+bundle_runtime_data() {
+  local xkb_src
+  local xlocale_src
+  local gtk_share_root
+  local iso_codes_root
+  local gdk_lib_root
+  local gdk_store_root
+  local gdk_version
+  local gdk_query_bin
+  local gdk_loaders_src
+  local glib_modules_root
+  local glib_store_root
+  local glib_version
+  local glib_dev_root
+  local glib_compile_schemas_bin
+  local gsettings_schema_root
+  local adwaita_icons_root
+  local hicolor_icons_root
+  local mime_root
+  local gio_module
+
+  xkb_src="$(extract_store_string "$bundle_lib_dir/libxkbcommon.so.0" '^/nix/store/[^ ]+-xkeyboard-config-[^/]+/etc/X11/xkb$')"
+  xlocale_src="$(extract_store_string "$bundle_lib_dir/libX11.so.6" '^/nix/store/[^ ]+-libx11-[^/]+/share/X11/locale$')"
+  gtk_share_root="$(extract_store_string "$bundle_lib_dir/libgtk-4.so.1" '^/nix/store/[^ ]+-gtk4-[^/]+/share$')"
+  iso_codes_root="$(extract_store_string "$bundle_lib_dir/libgtk-4.so.1" '^/nix/store/[^ ]+-iso-codes-[^/]+/share/xml/iso-codes$')"
+  gdk_lib_root="$(extract_store_string "$bundle_lib_dir/libgdk_pixbuf-2.0.so.0" '^/nix/store/[^ ]+-gdk-pixbuf-[^/]+/lib$')"
+  glib_modules_root="$(extract_store_string "$bundle_lib_dir/libgio-2.0.so.0" '^/nix/store/[^ ]+-glib-[^/]+/lib/gio/modules$')"
+
+  if [[ -n "$xkb_src" ]]; then
+    copy_tree "$xkb_src" "$bundle_share_dir/X11/xkb"
+  fi
+
+  if [[ -n "$xlocale_src" ]]; then
+    copy_tree "$xlocale_src" "$bundle_share_dir/X11/locale"
+  fi
+
+  if [[ -n "$gtk_share_root" ]]; then
+    copy_tree "$gtk_share_root/gtk-4.0" "$bundle_share_dir/gtk-4.0"
+  fi
+
+  if [[ -n "$iso_codes_root" ]]; then
+    copy_tree "$iso_codes_root" "$bundle_share_dir/xml/iso-codes"
+  fi
+
+  if [[ -n "$gdk_lib_root" ]]; then
+    gdk_store_root="$(dirname "$gdk_lib_root")"
+    gdk_version="$(version_from_store_path "$gdk_store_root" 'gdk-pixbuf')"
+    gdk_loaders_src="$gdk_lib_root/gdk-pixbuf-2.0/2.10.0/loaders"
+    gdk_query_bin="$(first_glob "/nix/store/*-gdk-pixbuf-${gdk_version}-dev/bin/gdk-pixbuf-query-loaders")"
+
+    copy_tree "$gdk_loaders_src" "$bundle_lib_dir/gdk-pixbuf-2.0/2.10.0/loaders"
+
+    if [[ -n "$gdk_query_bin" ]]; then
+      copy_helper_binary "$gdk_query_bin"
+    fi
+
+    for gio_module in "$gdk_loaders_src"/*.so; do
+      [[ -f "$gio_module" ]] || continue
+      copy_dependency_closure "$gio_module"
+      patch_elf "$bundle_lib_dir/gdk-pixbuf-2.0/2.10.0/loaders/$(basename "$gio_module")" '$ORIGIN/../../..'
+    done
+  fi
+
+  if [[ -n "$glib_modules_root" ]]; then
+    glib_store_root="$(dirname "$(dirname "$(dirname "$glib_modules_root")")")"
+    glib_version="$(version_from_store_path "$glib_store_root" 'glib')"
+    glib_dev_root="$(first_glob "/nix/store/*-glib-${glib_version}-dev")"
+
+    if [[ -n "$glib_dev_root" ]]; then
+      glib_compile_schemas_bin="$glib_dev_root/bin/glib-compile-schemas"
+
+      copy_tree_contents "$glib_dev_root/share/glib-2.0/schemas" "$bundle_share_dir/glib-2.0/schemas"
+
+      gsettings_schema_root="$(first_glob "/nix/store/*-gsettings-desktop-schemas-*/share/gsettings-schemas/*/glib-2.0/schemas")"
+      if [[ -z "$gsettings_schema_root" ]]; then
+        gsettings_schema_root="$(first_glob "/nix/store/*-gsettings-desktop-schemas-*/share/glib-2.0/schemas")"
+      fi
+      if [[ -n "$gsettings_schema_root" ]]; then
+        copy_tree_contents "$gsettings_schema_root" "$bundle_share_dir/glib-2.0/schemas"
+      fi
+
+      if ls "$bundle_share_dir/glib-2.0/schemas"/*.xml >/dev/null 2>&1; then
+        "$glib_compile_schemas_bin" "$bundle_share_dir/glib-2.0/schemas"
+      fi
+    fi
+  fi
+
+  adwaita_icons_root="$(first_glob '/nix/store/*-adwaita-icon-theme-*/share/icons/Adwaita')"
+  hicolor_icons_root="$(first_glob '/nix/store/*-hicolor-icon-theme-*/share/icons/hicolor')"
+  mime_root="$(first_glob '/nix/store/*-shared-mime-info-*/share/mime')"
+
+  if [[ -n "$adwaita_icons_root" ]]; then
+    copy_tree "$adwaita_icons_root" "$bundle_share_dir/icons/Adwaita"
+  fi
+
+  if [[ -n "$hicolor_icons_root" ]]; then
+    copy_tree "$hicolor_icons_root" "$bundle_share_dir/icons/hicolor"
+  fi
+
+  if [[ -n "$mime_root" ]]; then
+    copy_tree "$mime_root" "$bundle_share_dir/mime"
+  fi
+}
+
+write_launcher() {
+  local launcher_path="$bundle_dir/$launcher_name"
+  local binary_interpreter=""
+
+  if command -v patchelf >/dev/null 2>&1; then
+    binary_interpreter="$(patchelf --print-interpreter "$bundle_binary" 2>/dev/null || true)"
+  fi
+
+  cat > "$launcher_path" <<EOF
+#!/bin/sh
+set -eu
+HERE=\$(CDPATH= cd -- "\$(dirname -- "\$0")" && pwd)
+LIB="\$HERE/lib"
+DATA="\$HERE/share"
+LOADERS_DIR="\$LIB/gdk-pixbuf-2.0/2.10.0/loaders"
+LOADERS_CACHE="\$LIB/gdk-pixbuf-2.0/2.10.0/loaders.cache"
+GIO_MODULES_DIR="\$LIB/gio/modules"
+APP_BINARY="\$HERE/$binary_name"
+export XKB_CONFIG_ROOT="\${XKB_CONFIG_ROOT:-\$DATA/X11/xkb}"
+export XLOCALEDIR="\${XLOCALEDIR:-\$DATA/X11/locale}"
+export GSETTINGS_SCHEMA_DIR="\${GSETTINGS_SCHEMA_DIR:-\$DATA/glib-2.0/schemas}"
+export XDG_DATA_DIRS="\$DATA\${XDG_DATA_DIRS:+:\$XDG_DATA_DIRS}"
+export GTK_DATA_PREFIX="\${GTK_DATA_PREFIX:-\$HERE}"
+export GTK_EXE_PREFIX="\${GTK_EXE_PREFIX:-\$HERE}"
+export GDK_PIXBUF_MODULEDIR="\$LOADERS_DIR"
+export GDK_PIXBUF_MODULE_FILE="\$LOADERS_CACHE"
+export GDK_BACKEND="\${GDK_BACKEND:-wayland,x11}"
+export GSK_RENDERER="\${GSK_RENDERER:-cairo}"
+PRIMARY_INTERPRETER="${binary_interpreter}"
+
+if [ -d "\$GIO_MODULES_DIR" ]; then
+  export GIO_EXTRA_MODULES="\${GIO_EXTRA_MODULES:-\$GIO_MODULES_DIR}"
+fi
+
+candidate_interpreters=""
+if [ -n "\$PRIMARY_INTERPRETER" ]; then
+  candidate_interpreters="\$PRIMARY_INTERPRETER"
+fi
+
+case "\$(uname -m)" in
+  x86_64|amd64)
+    candidate_interpreters="\$candidate_interpreters /lib64/ld-linux-x86-64.so.2 /lib/ld-linux-x86-64.so.2"
+    ;;
+  aarch64|arm64)
+    candidate_interpreters="\$candidate_interpreters /lib/ld-linux-aarch64.so.1 /lib64/ld-linux-aarch64.so.1"
+    ;;
+esac
+
+for ld in \$candidate_interpreters; do
+  if [ -x "\$ld" ]; then
+    if [ -x "\$HERE/bin/gdk-pixbuf-query-loaders" ] && [ -d "\$LOADERS_DIR" ]; then
+      if ls "\$LOADERS_DIR"/*.so >/dev/null 2>&1; then
+        tmp="\$LOADERS_CACHE.tmp"
+        "\$ld" --library-path "\$LIB\${LD_LIBRARY_PATH:+:\$LD_LIBRARY_PATH}" \
+          "\$HERE/bin/gdk-pixbuf-query-loaders" "\$LOADERS_DIR"/*.so > "\$tmp" 2>/dev/null || true
+        if [ -s "\$tmp" ]; then
+          mv "\$tmp" "\$LOADERS_CACHE"
+        else
+          rm -f "\$tmp"
+        fi
+      fi
+    fi
+
+    exec "\$ld" --library-path "\$LIB\${LD_LIBRARY_PATH:+:\$LD_LIBRARY_PATH}" "\$APP_BINARY" "\$@"
+  fi
+done
+
+printf '%s\n' "Could not find a supported system dynamic loader." >&2
+exit 1
+EOF
+
+  chmod 755 "$launcher_path"
+}
+
+mkdir -p "$bundle_dir"
+chmod -R u+w "$bundle_dir" 2>/dev/null || true
+rm -rf "$bundle_dir"
+mkdir -p "$bundle_dir" "$bundle_lib_dir" "$bundle_bin_dir" "$bundle_share_dir"
+
+cp -L "$binary_path" "$bundle_binary"
+patch_elf "$bundle_binary" '$ORIGIN/lib'
+copy_dependency_closure "$binary_path"
+bundle_runtime_data
+write_launcher
+
+ldd "$binary_path" > "$bundle_dir/deps.txt" || true
+
+printf '%s\n' "$bundle_dir"
diff --git a/native/scripts/ci/build-android-release.sh b/native/scripts/ci/build-android-release.sh
new file mode 100644
index 00000000..0db0551e
--- /dev/null
+++ b/native/scripts/ci/build-android-release.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+source "$(cd "$(dirname "$0")" && pwd)/common.sh"
+
+require_command cargo
+
+if [[ ! -f "$native_root/android/gradlew" ]]; then
+  echo "Missing executable Gradle wrapper at $native_root/android/gradlew" >&2
+  exit 1
+fi
+
+chmod +x "$native_root/android/gradlew"
+
+android_build_root="$ci_build_root/android"
+android_version_name="${MAPLE_ANDROID_VERSION_NAME:-${maple_version_value}-beta.${maple_build_number}}"
+android_version_code="${MAPLE_ANDROID_VERSION_CODE:-$((300000000 + maple_build_number))}"
+
+ensure_dir "$android_build_root"
+
+if [[ -n "${ANDROID_SDK_ROOT:-}" ]]; then
+  cat > "$native_root/android/local.properties" <<EOF
+sdk.dir=${ANDROID_SDK_ROOT}
+EOF
+elif [[ -n "${ANDROID_HOME:-}" ]]; then
+  cat > "$native_root/android/local.properties" <<EOF
+sdk.dir=${ANDROID_HOME}
+EOF
+fi
+
+export OPEN_SECRET_API_URL="$open_secret_api_url"
+export MAPLE_ANDROID_VERSION_NAME="$android_version_name"
+export MAPLE_ANDROID_VERSION_CODE="$android_version_code"
+
+(
+  cd "$native_root"
+  cargo run --manifest-path "$native_root/rmp-cli/Cargo.toml" -- bindings kotlin
+)
+
+(
+  cd "$native_root/android"
+  ./gradlew --no-daemon clean :app:assembleRelease :app:bundleRelease
+)
+
+apk_path="$native_root/android/app/build/outputs/apk/release/app-release.apk"
+aab_path="$native_root/android/app/build/outputs/bundle/release/app-release.aab"
+
+if [[ ! -f "$apk_path" || ! -f "$aab_path" ]]; then
+  echo "Expected signed Android artifacts were not produced" >&2
+  exit 1
+fi
+
+cp "$apk_path" "$android_build_root/Maple-${android_version_name}.apk"
+cp "$aab_path" "$android_build_root/Maple-${android_version_name}.aab"
+
+printf 'Android APK: %s\n' "$android_build_root/Maple-${android_version_name}.apk"
+printf 'Android AAB: %s\n' "$android_build_root/Maple-${android_version_name}.aab"
diff --git a/native/scripts/ci/build-ios-testflight.sh b/native/scripts/ci/build-ios-testflight.sh
new file mode 100644
index 00000000..171dc70d
--- /dev/null
+++ b/native/scripts/ci/build-ios-testflight.sh
@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+source "$(cd "$(dirname "$0")" && pwd)/common.sh"
+
+require_env APPLE_API_KEY APPLE_API_ISSUER APPLE_API_KEY_PATH APPLE_TEAM_ID
+require_command cargo xcodebuild xcodegen xcrun
+
+ios_build_root="$ci_build_root/ios"
+archive_path="$ios_build_root/Maple.xcarchive"
+export_path="$ios_build_root/export"
+export_options_plist="$ios_build_root/ExportOptions.plist"
+
+ensure_dir "$ios_build_root"
+rm -rf "$archive_path" "$export_path"
+
+cat > "$export_options_plist" <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>destination</key>
+  <string>export</string>
+  <key>manageAppVersionAndBuildNumber</key>
+  <false/>
+  <key>method</key>
+  <string>app-store-connect</string>
+  <key>signingStyle</key>
+  <string>automatic</string>
+  <key>teamID</key>
+  <string>${APPLE_TEAM_ID}</string>
+  <key>uploadSymbols</key>
+  <true/>
+</dict>
+</plist>
+EOF
+
+export OPEN_SECRET_API_URL="$open_secret_api_url"
+
+(
+  cd "$native_root"
+  cargo run --manifest-path "$native_root/rmp-cli/Cargo.toml" -- bindings swift
+)
+
+(
+  cd "$native_root/ios"
+  xcodegen generate
+)
+
+env -u NIX_LDFLAGS -u LD -u CC -u CXX \
+  xcrun xcodebuild \
+    -project "$native_root/ios/App.xcodeproj" \
+    -scheme App \
+    -configuration Release \
+    -destination generic/platform=iOS \
+    -archivePath "$archive_path" \
+    -allowProvisioningUpdates \
+    -authenticationKeyPath "$APPLE_API_KEY_PATH" \
+    -authenticationKeyID "$APPLE_API_KEY" \
+    -authenticationKeyIssuerID "$APPLE_API_ISSUER" \
+    clean archive \
+    DEVELOPMENT_TEAM="$APPLE_TEAM_ID" \
+    PRODUCT_BUNDLE_IDENTIFIER=cloud.opensecret.maple \
+    MARKETING_VERSION="$maple_version_value" \
+    CURRENT_PROJECT_VERSION="$maple_build_number" \
+    OPEN_SECRET_API_URL="$open_secret_api_url" \
+    COMPILER_INDEX_STORE_ENABLE=NO
+
+env -u NIX_LDFLAGS -u LD -u CC -u CXX \
+  xcrun xcodebuild \
+    -exportArchive \
+    -archivePath "$archive_path" \
+    -exportPath "$export_path" \
+    -exportOptionsPlist "$export_options_plist" \
+    -allowProvisioningUpdates \
+    -authenticationKeyPath "$APPLE_API_KEY_PATH" \
+    -authenticationKeyID "$APPLE_API_KEY" \
+    -authenticationKeyIssuerID "$APPLE_API_ISSUER"
+
+ipa_path="$(find "$export_path" -name '*.ipa' -print -quit)"
+
+if [[ -z "$ipa_path" ]]; then
+  echo "Failed to locate exported IPA" >&2
+  exit 1
+fi
+
+private_keys_dir="$HOME/.private_keys"
+mkdir -p "$private_keys_dir"
+install -m 600 "$APPLE_API_KEY_PATH" "$private_keys_dir/AuthKey_${APPLE_API_KEY}.p8"
+
+upload_log="$(mktemp)"
+set +e
+xcrun altool --upload-app --type ios \
+  --file "$ipa_path" \
+  --apiKey "$APPLE_API_KEY" \
+  --apiIssuer "$APPLE_API_ISSUER" 2>&1 | tee "$upload_log"
+upload_status=${PIPESTATUS[0]}
+set -e
+
+if (( upload_status != 0 )) || grep -Eq 'UPLOAD FAILED|Validation failed|Failed to upload package' "$upload_log"; then
+  cat "$upload_log" >&2
+  rm -f "$upload_log"
+  exit 1
+fi
+
+if ! grep -q 'No errors uploading archive' "$upload_log"; then
+  cat "$upload_log" >&2
+  rm -f "$upload_log"
+  echo "Could not confirm successful TestFlight upload" >&2
+  exit 1
+fi
+
+rm -f "$upload_log"
+
+printf 'IPA exported to %s\n' "$ipa_path"
diff --git a/native/scripts/ci/common.sh b/native/scripts/ci/common.sh
new file mode 100644
index 00000000..f4e00d25
--- /dev/null
+++ b/native/scripts/ci/common.sh
@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+
+native_ci_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+native_root="$(cd "$native_ci_dir/../.." && pwd)"
+repo_root="$(cd "$native_root/.." && pwd)"
+
+function require_env() {
+  local missing=()
+  for name in "$@"; do
+    if [[ -z "${!name:-}" ]]; then
+      missing+=("$name")
+    fi
+  done
+
+  if (( ${#missing[@]} > 0 )); then
+    printf 'Missing required environment variables: %s\n' "${missing[*]}" >&2
+    exit 1
+  fi
+}
+
+function require_command() {
+  local missing=()
+  for name in "$@"; do
+    if ! command -v "$name" >/dev/null 2>&1; then
+      missing+=("$name")
+    fi
+  done
+
+  if (( ${#missing[@]} > 0 )); then
+    printf 'Missing required commands: %s\n' "${missing[*]}" >&2
+    exit 1
+  fi
+}
+
+function maple_version() {
+  awk -F '"' '/^version = "/ { print $2; exit }' "$native_root/rust/Cargo.toml"
+}
+
+function api_url_for_env() {
+  case "$1" in
+    local) echo "http://0.0.0.0:3000" ;;
+    dev) echo "https://enclave.secretgpt.ai" ;;
+    prod) echo "https://enclave.trymaple.ai" ;;
+    *)
+      printf 'Unsupported MAPLE_API_ENV: %s\n' "$1" >&2
+      exit 1
+      ;;
+  esac
+}
+
+function ensure_dir() {
+  mkdir -p "$1"
+}
+
+function tauri_sign_artifact() {
+  local artifact="$1"
+
+  if [[ -z "${TAURI_SIGNING_PRIVATE_KEY:-}" || -z "${TAURI_SIGNING_PRIVATE_KEY_PASSWORD:-}" ]]; then
+    return 0
+  fi
+
+  require_command cargo-tauri
+
+  local key_file
+  key_file="$(mktemp)"
+  printf '%s' "$TAURI_SIGNING_PRIVATE_KEY" > "$key_file"
+
+  cargo-tauri signer sign \
+    --private-key-path "$key_file" \
+    --password "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" \
+    "$artifact"
+
+  rm -f "$key_file"
+
+  if [[ ! -f "${artifact}.sig" ]]; then
+    printf 'Expected detached signature at %s.sig\n' "$artifact" >&2
+    exit 1
+  fi
+}
+
+function maple_artifact_version() {
+  if [[ -n "$maple_prerelease_label" ]]; then
+    printf '%s-%s.%s' "$maple_version_value" "$maple_prerelease_label" "$maple_build_number"
+  else
+    printf '%s' "$maple_version_value"
+  fi
+}
+
+function maple_deb_version() {
+  if [[ -n "$maple_prerelease_label" ]]; then
+    printf '%s~%s.%s' "$maple_version_value" "$maple_prerelease_label" "$maple_build_number"
+  else
+    printf '%s' "$maple_version_value"
+  fi
+}
+
+run_number="${GITHUB_RUN_NUMBER:-1}"
+run_attempt="${GITHUB_RUN_ATTEMPT:-1}"
+
+maple_api_env="${MAPLE_API_ENV:-dev}"
+maple_version_value="${MAPLE_VERSION:-$(maple_version)}"
+maple_build_number="${MAPLE_BUILD_NUMBER:-$((run_number * 10 + run_attempt))}"
+if [[ "${MAPLE_PRERELEASE_LABEL+x}" == "x" ]]; then
+  maple_prerelease_label="$MAPLE_PRERELEASE_LABEL"
+else
+  maple_prerelease_label="beta"
+fi
+open_secret_api_url="${OPEN_SECRET_API_URL:-$(api_url_for_env "$maple_api_env")}"
+ci_build_root="${MAPLE_CI_BUILD_ROOT:-${RUNNER_TEMP:-$native_root/target}/maple-ci}"
diff --git a/native/scripts/ci/package-linux.sh b/native/scripts/ci/package-linux.sh
new file mode 100644
index 00000000..420aac87
--- /dev/null
+++ b/native/scripts/ci/package-linux.sh
@@ -0,0 +1,158 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+source "$(cd "$(dirname "$0")" && pwd)/common.sh"
+
+if [[ "${MAPLE_NATIVE_NIX_SHELL:-}" != "1" ]] && command -v nix >/dev/null 2>&1; then
+  exec env PATH="$HOME/.cargo/bin:$PATH" \
+    nix develop --no-write-lock-file "$native_root" --command bash -c \
+    "set -euo pipefail; exec bash '$native_root/scripts/ci/package-linux.sh'"
+fi
+
+require_command cargo curl dpkg-deb dpkg-shlibdeps magick
+
+bundle_script="$native_root/scripts/bundle-gtk-linux.sh"
+
+host_arch="$(uname -m)"
+case "$host_arch" in
+  x86_64)
+    deb_arch="amd64"
+    appimage_arch="x86_64"
+    ;;
+  aarch64|arm64)
+    deb_arch="arm64"
+    appimage_arch="aarch64"
+    ;;
+  *)
+    printf 'Unsupported Linux architecture: %s\n' "$host_arch" >&2
+    exit 1
+    ;;
+esac
+
+linux_build_root="$ci_build_root/desktop-linux"
+artifact_version="$(maple_artifact_version)"
+deb_version="$(maple_deb_version)"
+binary_path="$native_root/target/release/maple_desktop_gtk"
+bundle_root="$linux_build_root/Maple-bundle"
+icon_source="$native_root/ios/Sources/Assets.xcassets/AppIcon.appiconset/icon_1024.png"
+resized_icon="$linux_build_root/maple-512.png"
+deb_desktop_file="$linux_build_root/Maple-deb.desktop"
+appimage_desktop_file="$linux_build_root/Maple-appimage.desktop"
+deb_root="$linux_build_root/deb-root"
+deb_output="$linux_build_root/Maple-${artifact_version}-${deb_arch}.deb"
+appdir="$linux_build_root/AppDir"
+appimage_entry_executable="$appdir/usr/lib/maple/maple_desktop_gtk"
+appimage_output="$linux_build_root/Maple-${artifact_version}-${appimage_arch}.AppImage"
+linuxdeploy_path="$linux_build_root/linuxdeploy-${appimage_arch}.AppImage"
+
+ensure_dir "$linux_build_root"
+rm -rf "$bundle_root" "$deb_root" "$appdir" "$deb_desktop_file" "$appimage_desktop_file" "$deb_output" "$appimage_output" "$resized_icon"
+
+export OPEN_SECRET_API_URL="$open_secret_api_url"
+
+magick "$icon_source" -resize 512x512 "$resized_icon"
+
+cargo build --manifest-path "$native_root/Cargo.toml" -p maple_desktop_gtk --release
+"$bundle_script" "$binary_path" "$bundle_root"
+
+cat > "$deb_desktop_file" <<EOF
+[Desktop Entry]
+Name=Maple
+Comment=Maple native desktop beta
+Exec=maple
+Icon=maple
+Terminal=false
+Type=Application
+Categories=Network;Utility;
+StartupWMClass=Maple
+EOF
+
+cat > "$appimage_desktop_file" <<EOF
+[Desktop Entry]
+Name=Maple
+Comment=Maple native desktop beta
+Exec=Maple
+Icon=maple
+Terminal=false
+Type=Application
+Categories=Network;Utility;
+StartupWMClass=Maple
+EOF
+
+mkdir -p "$deb_root/DEBIAN" "$deb_root/opt/Maple" "$deb_root/usr/bin" "$deb_root/usr/share/applications" "$deb_root/usr/share/icons/hicolor/512x512/apps"
+cp -a "$bundle_root"/. "$deb_root/opt/Maple/"
+chmod 755 "$deb_root/opt/Maple/Maple"
+cat > "$deb_root/usr/bin/maple" <<'EOF'
+#!/bin/sh
+exec /opt/Maple/Maple "$@"
+EOF
+chmod 755 "$deb_root/usr/bin/maple"
+cp "$deb_desktop_file" "$deb_root/usr/share/applications/cloud.opensecret.maple.desktop"
+cp "$resized_icon" "$deb_root/usr/share/icons/hicolor/512x512/apps/maple.png"
+
+deb_dependencies=""
+if ! deb_dependencies="$(dpkg-shlibdeps -l"$deb_root/opt/Maple/lib" -O "$deb_root/opt/Maple/maple_desktop_gtk" 2>/dev/null | sed -n 's/^shlibs:Depends=//p')"; then
+  deb_dependencies=""
+fi
+if [[ -z "$deb_dependencies" ]]; then
+  deb_dependencies="libc6"
+fi
+
+cat > "$deb_root/DEBIAN/control" <<EOF
+Package: maple
+Version: ${deb_version}
+Section: utils
+Priority: optional
+Architecture: ${deb_arch}
+Maintainer: OpenSecret
+Depends: ${deb_dependencies}
+Description: Maple native desktop beta
+ Maple native desktop beta build.
+EOF
+
+dpkg-deb --build --root-owner-group "$deb_root" "$deb_output"
+
+mkdir -p "$appdir/usr/bin" "$appdir/usr/lib/maple" "$appdir/usr/share/applications" "$appdir/usr/share/icons/hicolor/512x512/apps"
+cp -a "$bundle_root"/. "$appdir/usr/lib/maple/"
+cat > "$appdir/usr/bin/Maple" <<'EOF'
+#!/bin/sh
+HERE=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec "$HERE/../lib/maple/Maple" "$@"
+EOF
+chmod 755 "$appdir/usr/bin/Maple"
+cat > "$appdir/AppRun" <<'EOF'
+#!/bin/sh
+HERE=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+exec "$HERE/usr/lib/maple/Maple" "$@"
+EOF
+chmod 755 "$appdir/AppRun"
+cp "$appimage_desktop_file" "$appdir/usr/share/applications/cloud.opensecret.maple.desktop"
+cp "$resized_icon" "$appdir/usr/share/icons/hicolor/512x512/apps/maple.png"
+
+curl -fsSL "https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-${appimage_arch}.AppImage" -o "$linuxdeploy_path"
+chmod +x "$linuxdeploy_path"
+
+(
+  cd "$linux_build_root"
+  APPIMAGE_EXTRACT_AND_RUN=1 "$linuxdeploy_path" \
+    --appdir "$appdir" \
+    -e "$appimage_entry_executable" \
+    -d "$appimage_desktop_file" \
+    -i "$resized_icon" \
+    --output appimage
+)
+
+generated_appimage="$(find "$linux_build_root" -maxdepth 1 -name '*.AppImage' ! -name 'linuxdeploy-*.AppImage' -print -quit)"
+
+if [[ -z "$generated_appimage" ]]; then
+  echo "Failed to locate generated AppImage" >&2
+  exit 1
+fi
+
+mv "$generated_appimage" "$appimage_output"
+
+tauri_sign_artifact "$deb_output"
+tauri_sign_artifact "$appimage_output"
+
+printf 'Linux DEB: %s\n' "$deb_output"
+printf 'Linux AppImage: %s\n' "$appimage_output"
diff --git a/native/scripts/ci/package-macos.sh b/native/scripts/ci/package-macos.sh
new file mode 100644
index 00000000..9a7953da
--- /dev/null
+++ b/native/scripts/ci/package-macos.sh
@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+source "$(cd "$(dirname "$0")" && pwd)/common.sh"
+
+require_env APPLE_API_KEY APPLE_API_ISSUER APPLE_API_KEY_PATH APPLE_SIGNING_IDENTITY
+require_command cargo codesign ditto hdiutil spctl xcodebuild xcodegen xcrun
+
+macos_build_root="$ci_build_root/desktop-macos"
+derived_data="$macos_build_root/DerivedData"
+built_app="$derived_data/Build/Products/Release/Maple.app"
+app_bundle="$macos_build_root/Maple.app"
+artifact_version="$(maple_artifact_version)"
+artifact_prefix="Maple-${artifact_version}-macos-universal"
+app_zip="$macos_build_root/${artifact_prefix}.app.zip"
+dmg_path="$macos_build_root/${artifact_prefix}.dmg"
+
+ensure_dir "$macos_build_root"
+rm -rf "$app_bundle" "$app_zip" "$dmg_path" "$macos_build_root/dmg" "$derived_data"
+
+export OPEN_SECRET_API_URL="$open_secret_api_url"
+
+(
+  cd "$native_root"
+  RMP_SWIFT_UNIVERSAL_MACOS=1 cargo run --manifest-path "$native_root/rmp-cli/Cargo.toml" -- bindings swift
+)
+
+(
+  cd "$native_root/ios"
+  xcodegen generate
+)
+
+env -u NIX_LDFLAGS -u LD -u CC -u CXX -u AR -u RANLIB \
+  xcrun xcodebuild \
+    -project "$native_root/ios/App.xcodeproj" \
+    -scheme AppMac \
+    -configuration Release \
+    -derivedDataPath "$derived_data" \
+    -destination generic/platform=macOS \
+    ARCHS="arm64 x86_64" \
+    ONLY_ACTIVE_ARCH=NO \
+    CODE_SIGNING_ALLOWED=NO \
+    CODE_SIGNING_REQUIRED=NO \
+    CODE_SIGN_IDENTITY="" \
+    MARKETING_VERSION="$maple_version_value" \
+    CURRENT_PROJECT_VERSION="$maple_build_number" \
+    OPEN_SECRET_API_URL="$open_secret_api_url" \
+    COMPILER_INDEX_STORE_ENABLE=NO \
+    clean build
+
+if [[ ! -d "$built_app" ]]; then
+  echo "Failed to locate built AppMac bundle at $built_app" >&2
+  exit 1
+fi
+
+cp -R "$built_app" "$app_bundle"
+
+codesign --force --deep --options runtime --timestamp --sign "$APPLE_SIGNING_IDENTITY" "$app_bundle"
+codesign --verify --deep --strict --verbose=2 "$app_bundle"
+
+ditto -c -k --keepParent "$app_bundle" "$app_zip"
+
+xcrun notarytool submit "$app_zip" \
+  --key "$APPLE_API_KEY_PATH" \
+  --key-id "$APPLE_API_KEY" \
+  --issuer "$APPLE_API_ISSUER" \
+  --wait
+
+xcrun stapler staple "$app_bundle"
+
+dmg_stage="$macos_build_root/dmg"
+mkdir -p "$dmg_stage"
+cp -R "$app_bundle" "$dmg_stage/"
+ln -s /Applications "$dmg_stage/Applications"
+
+hdiutil create -volname "Maple" -srcfolder "$dmg_stage" -ov -format UDZO "$dmg_path"
+
+codesign --force --timestamp --sign "$APPLE_SIGNING_IDENTITY" "$dmg_path"
+
+xcrun notarytool submit "$dmg_path" \
+  --key "$APPLE_API_KEY_PATH" \
+  --key-id "$APPLE_API_KEY" \
+  --issuer "$APPLE_API_ISSUER" \
+  --wait
+
+xcrun stapler staple "$dmg_path"
+spctl --assess --type open --context context:primary-signature "$dmg_path"
+
+tauri_sign_artifact "$app_zip"
+tauri_sign_artifact "$dmg_path"
+
+printf 'macOS ZIP: %s\n' "$app_zip"
+printf 'macOS DMG: %s\n' "$dmg_path"
diff --git a/native/uniffi-bindgen/Cargo.toml b/native/uniffi-bindgen/Cargo.toml
new file mode 100644
index 00000000..78edc4b6
--- /dev/null
+++ b/native/uniffi-bindgen/Cargo.toml
@@ -0,0 +1,8 @@
+[package]
+name = "uniffi-bindgen"
+version = "0.1.0"
+edition = "2021"
+publish = false
+
+[dependencies]
+uniffi = { version = "0.31.0", features = ["cli"] }
diff --git a/native/uniffi-bindgen/src/main.rs b/native/uniffi-bindgen/src/main.rs
new file mode 100644
index 00000000..f6cff6cf
--- /dev/null
+++ b/native/uniffi-bindgen/src/main.rs
@@ -0,0 +1,3 @@
+fn main() {
+    uniffi::uniffi_bindgen_main()
+}