diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..f86f288
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,36 @@
+name: APT build checks
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  build-checks:
+    runs-on: apt-ci
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+
+      - name: Install locked dependencies
+        run: npm ci
+
+      - name: Run source policy and tests
+        run: npm run check
+
+      - name: Audit production dependencies
+        run: npm run audit:prod
+
+      - name: Build unpacked Windows application
+        run: npm run build-test
+
+      - name: Verify unpacked build and extension policy
+        run: node scripts/verify-kit.js --build dist/win-unpacked
diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
deleted file mode 100644
index 4892639..0000000
--- a/.github/workflows/deploy-pages.yml
+++ /dev/null
@@ -1,37 +0,0 @@
-name: Deploy GitHub Pages
-
-on:
-  push:
-    branches: [master]
-    paths:
-      - 'docs/**'
-      - '.github/workflows/deploy-pages.yml'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
-concurrency:
-  group: pages
-  cancel-in-progress: false
-
-jobs:
-  deploy:
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Configure Pages
-        uses: actions/configure-pages@v5
-      - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
-        with:
-          path: docs
-      - name: Deploy to GitHub Pages
-        id: deployment
-        uses: actions/deploy-pages@v4
diff --git a/CLAUDE.md b/CLAUDE.md
index 2b2a0cb..c1abb0a 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,112 +1,50 @@
 # CLAUDE.md
 
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+## Project
 
-## Project Overview
+Alta Proxy Tool (APT) is a Windows-only Electron app. Its source of record and releases are on GitPeji:
 
-Alta Proxy Tool (APT) — an Electron desktop app that authenticates with Avigilon Alta Video deployments via a companion Chrome extension, discovers cameras, and launches `aware-cam-proxy.exe` to establish camera connections. Authentication uses cookie import from Chrome — no username/password login flow. Windows-only due to the proxy executable.
+- Repository: `https://git.pejicorp.com/peji/Alta-Proxy-Tool`
+- Releases: `https://git.pejicorp.com/peji/Alta-Proxy-Tool/releases`
 
-## Repository
-
-- **GitHub**: https://github.com/PageZ948/Alta-Proxy-Tool (private)
-- **Branch**: master
-- **Git identity**: Zac <zpage948@gmail.com> (repo-local config)
+The app imports an Alta Video session through a stable-ID paired Chrome extension, discovers cameras, and directly launches the fixed `aware-cam-proxy.exe` helper.
 
 ## Commands
 
 ```bash
-npm start          # Run the app
-npm run dev        # Run with DevTools open (--dev flag)
-npm run build      # Build portable Windows .exe (output: dist/)
-npm run build-test # Build to directory without packaging
+npm start
+npm run dev
+npm test
+npm run check
+npm run build-test
+npm run build
 ```
 
-No test framework is configured. No linter is configured.
+## Required security architecture
 
-## Architecture
+- Main owns `SessionStore`, `AltaClient`, `ProxyProcessManager`, bridge authentication, and safe update checking.
+- Renderer/preload contracts must never carry the Alta deployment credential or cookie.
+- IPC methods are narrow and sender-validated against the main local file frame.
+- Bridge is exactly `127.0.0.1:18247`, exact committed extension origin, and `X-APT-Pairing` authenticated.
+- Persist only the pairing hash envelope under Electron `userData`; plaintext is shown once after first run/rotation.
+- Proxy helper launches directly with `shell: false`; passwordless launch uses the main-owned paired session only through the helper's required `-k` argument. Never expose that cookie to renderer IPC, UI, logs, files, shell commands, or tracked process metadata; stop only app-owned child processes.
+- Update behavior is check-only against the exact GitPeji API. The only follow-up action opens the fixed GitPeji releases page externally.
+- Never add download/install/replace logic, arbitrary URLs, redirect following, shell scripts, broad process killing, hardcoded bridge secrets, or credential-bearing renderer state.
+- Synthetic tests only: never use a real tenant or Alta session.
 
-This is a vanilla Electron app (no React/Vue/framework). Core files:
+## File map
 
-```
-main.js      → Electron main process: IPC handlers, API calls (axios),
-                cookie proxy process spawning, local HTTP cookie server
-preload.js   → contextBridge exposing window.electronAPI with IPC wrappers
-renderer.js  → All UI logic: DOM manipulation, state management, event handlers
-index.html   → Static HTML shell, no inline scripts (CSP enforced)
-styles.css   → Dark theme using CSS custom properties
-```
+- `main.js`: Electron adapter, lifecycle, trusted IPC registration, fixed bridge listener
+- `src/electron-runtime.js`: runtime orchestration, pairing persistence, bridge request contract
+- `src/session-store.js`: in-memory credential boundary
+- `src/alta-client.js`: bounded same-origin Alta API client
+- `src/proxy-launch.js`: Windows direct-spawn owned-child manager
+- `src/update-policy.js`: GitPeji check-only policy
+- `src/bridge-auth.js`: stable extension origin, scrypt pairing, limits/deadlines
+- `preload.js`: narrow methods and event payload stripping
+- `renderer.js`: non-secret connection/device/proxy/pairing/update UI
+- `test/runtime-contract.test.js`: integration and forbidden-source policy
 
-A companion Chrome extension lives in `chrome-extension/`:
+## Scope
 
-```
-chrome-extension/
-  manifest.json  → Manifest V3, cookies + activeTab permissions
-  popup.html     → Extension popup UI
-  popup.css      → Dark theme matching the Electron app
-  popup.js       → Tab detection, cookie retrieval, POST to localhost
-  icon*.png      → Placeholder icons
-```
-
-### Authentication Flow
-
-There is no login form or profile system. Authentication works exclusively through the Chrome extension cookie bridge:
-
-1. User logs into Alta deployment in Chrome
-2. Clicks the Chrome extension popup → "Send Cookie to APT"
-3. Extension POSTs `{deploymentUrl, cookieValue}` to `http://127.0.0.1:18247/cookie` with `X-APT-Token` header
-4. `main.js` HTTP server validates and forwards via IPC push to renderer
-5. `renderer.js` `handleExtensionCookie()` sets session state, auto-populates cookie key, fetches devices
-
-The extension is loaded unpacked via `chrome://extensions/` → Developer mode → Load unpacked → select `chrome-extension/`.
-
-### IPC Communication Pattern
-
-Most cross-process communication follows the request/response pattern:
-1. `main.js` registers handler: `ipcMain.handle('channel-name', async (event, params) => { ... })`
-2. `preload.js` exposes it: `channelName: (params) => ipcRenderer.invoke('channel-name', params)`
-3. `renderer.js` calls it: `const result = await window.electronAPI.channelName(params)`
-
-All handlers return `{ success: boolean, message?: string, ...data }`.
-
-There is one **push-pattern** channel for the Chrome extension cookie bridge:
-- `main.js` sends: `mainWindow.webContents.send('extension-cookie-received', data)`
-- `preload.js` bridges: `ipcRenderer.on('extension-cookie-received', callback)`
-- `renderer.js` listens via `window.electronAPI.onExtensionCookie(callback)`
-
-### IPC Channels
-
-| Channel | Purpose |
-|---------|---------|
-| `api-get-devices` | GET /api/v1/devices with cookie auth |
-| `api-get-auth-info` | GET /api/v1/auth to verify session |
-| `camera-proxy-cookie-launch` | Spawns aware-cam-proxy.exe (cookie method) |
-| `camera-proxy-stop` | Kills all proxy processes via taskkill/powershell |
-| `extension-cookie-received` | Push channel: cookie data from Chrome extension → renderer |
-
-### State Management (renderer.js)
-
-All connection state lives in the `sessionData` object (deploymentUrl, cookies, isConnected). There is no separate `isConnected` flag — always use `sessionData.isConnected`.
-
-Active cookie proxy processes are tracked in `activeCookieProxyConnections` Map, keyed by device GUID.
-
-### Security Model
-
-- Context isolation enabled, nodeIntegration disabled
-- CSP meta tag: `script-src 'self'` — no inline scripts or onclick handlers allowed
-- Batch file inputs are sanitized via `sanitizeBatchInput()` to prevent command injection
-- Local HTTP cookie server (port 18247) bound to `127.0.0.1` only
-- Cookie server validates: shared token header, CORS restricted to `chrome-extension://` origins, deployment URL must be `*.avasecurity.com` or `*.avigilon.com` over HTTPS, type/length limits on all inputs, 64KB body size limit
-
-## Key Conventions
-
-- No inline event handlers in HTML — all use `addEventListener` in renderer.js
-- All user-provided content rendered to DOM must go through `escapeHtml()` (XSS prevention)
-- External processes spawned with `detached: true` + `unref()` so they survive if the app closes
-- Device list filters out cloud cameras (`capabilities.localStorage === false` only)
-- `clearDeviceList()` must NOT clear proxy connection Maps (proxies may still be running)
-
-## External Executable
-
-- `aware-cam-proxy.exe` — cookie-based auth proxy (required)
-
-Not bundled via npm. Must be in the app root directory. Gitignored along with `*.pdf`, `node_modules/`, and `dist/`.
+Windows is the current supported runtime because `aware-cam-proxy.exe` is Windows-specific. Do not upgrade dependencies or change production/Tool Hub as part of runtime hardening unless explicitly requested.
diff --git a/README.md b/README.md
index 51b085b..805924c 100644
--- a/README.md
+++ b/README.md
@@ -1,186 +1,73 @@
-#  Alta Video Camera Proxy
+# Alta Video Camera Proxy
 
-An Electron desktop application for managing Alta Video camera proxy connections. Authenticates via a companion Chrome extension that imports your existing Alta session cookie, discovers cameras, and launches proxy connections.
+APT is a Windows Electron desktop app that imports an existing Alta Video session through its paired Chrome extension, discovers local cameras, and launches `aware-cam-proxy.exe` without exposing Alta credentials to the renderer.
 
-## Features
+## Security boundary
 
-- **Chrome Extension Authentication**: Import your Alta session cookie from Chrome with one click — no manual login
-- **API Integration**: Device discovery via Alta Video API using cookie auth
-- **Camera Proxy Management**: Launch and manage camera proxy connections
-- **Device Filtering**: Automatically filters to show only local (non-cloud) cameras
-- **Device Search**: Quick search functionality to find cameras by name, ID, IP, or model
-- **Real-time Status**: Live connection status and device online/offline indicators
-- **Auto-Update**: Checks for updates on startup via GitHub Releases, with one-click in-place update
-- **Modern Dark UI**: Professional dark-mode interface with responsive design
+- `main.js` owns the in-memory `SessionStore`, `AltaClient`, `ProxyProcessManager`, bridge pairing envelope, and update checker.
+- The renderer receives only connection origin/state, device/site/auth responses, and owned proxy metadata. It never receives or supplies the Alta session value.
+- The bridge listens only on `127.0.0.1:18247`, accepts only the committed extension origin, requires the `X-APT-Pairing` secret, limits concurrent/body/deadline work, and validates an exact canonical Alta HTTPS origin.
+- The pairing envelope is a scrypt hash stored atomically under Electron `userData` with restrictive permissions. The plaintext secret is shown once on first run or rotation. Revoke invalidates it.
+- Proxy launch is a direct, detached `spawn` of the fixed helper with `shell: false`. APT passes the main-process-only paired Alta session through the helper's supported `-k` cookie mode so users are not prompted for Alta credentials again. The cookie never crosses renderer IPC, enters a shell, or reaches logs, files, tracked process metadata, or UI state; it is necessarily present in the helper process arguments because the external helper exposes no pipe/stdin credential interface. Stop actions can target only children owned by this app.
+- Updates are **check-only**. APT checks the exact GitPeji release API and can open only `https://git.pejicorp.com/peji/Alta-Proxy-Tool/releases` in the system browser. It never downloads, replaces, or executes an update.
 
-## Prerequisites
+## Requirements
 
-- **Node.js** (version 14 or higher)
-- **npm** (comes with Node.js)
-- **Google Chrome** (for the authentication extension)
-- **Windows OS** (required for camera proxy executable)
-- **aware-cam-proxy.exe** (camera proxy executable) — must be placed in the application directory
-- **An active Alta Video session** in Chrome (logged in to your deployment)
+- Windows (current supported runtime scope)
+- Node.js 22.12 or newer and npm for development
+- Chrome with the bundled extension loaded unpacked
+- `aware-cam-proxy.exe` beside the development app or packaged portable executable
+- An active Alta Video login in Chrome
 
-## Installation
-
-1. Clone or download this project
-2. Install dependencies:
-   ```bash
-   npm install
-   ```
-3. Place `aware-cam-proxy.exe` in the project root directory
-
-### Chrome Extension Setup
-
-1. Open Chrome and navigate to `chrome://extensions/`
-2. Enable **Developer mode** (toggle in top-right)
-3. Click **Load unpacked**
-4. Select the `chrome-extension/` folder from this project
-5. The extension icon will appear in the Chrome toolbar
-
-## Usage
-
-### Starting the Application
+## Setup and pairing
 
 ```bash
+npm install
 npm start
 ```
 
-Or for development mode with DevTools:
-```bash
-npm run dev
-```
+1. Open `chrome://extensions`, enable Developer mode, and load `chrome-extension/` unpacked.
+2. Start APT. Under **Bridge Pairing**, copy the one-time secret.
+3. Open the extension pairing settings, paste the secret, and save it.
+4. Visit your Alta deployment in Chrome and use **Send to APT**.
+5. Select a local camera and choose **Start Proxy**. APT reuses the paired Chrome session; no Alta username, password, or 2FA prompt is required.
 
-### Connecting to Alta
+Use **Generate / Rotate** if a pairing may have been exposed, then update the extension. Use **Revoke** to immediately disable bridge authentication.
 
-1. **Log into your Alta deployment** in Chrome (e.g., `https://your-site.eu1.aware.avasecurity.com`)
-2. **Click the extension icon** in Chrome — it will detect the Alta tab
-3. **Click "Send Cookie to APT"** — the app will connect and load devices automatically
+## Camera hierarchy and large deployments
 
-### Launching Camera Proxy
+The sidebar presents collapsed Alta sites, then device groups, then cameras, including explicit fallback nodes for ungrouped, orphaned, unknown, or conflicting metadata. Search opens only matching ancestors and supports full tree keyboard navigation. A fixed-height virtual window keeps the mounted DOM bounded even when thousands of cameras are visible; selection and active-proxy state survive expansion, search, and scrolling. If site or group metadata cannot be loaded, every valid camera remains selectable in the fallback hierarchy and APT shows a warning.
 
-1. **Connect via Chrome extension** (above)
-2. **Select a device** from the left sidebar
-3. **Click "Start Camera Proxy"**
-4. A command prompt window will open with the proxy connection
-
-### Updating
-
-The app checks for updates automatically 2 seconds after launch. If a newer version is available on GitHub Releases, the "Check for Updates" button in the header will show a green badge.
-
-- **Manual check**: Click "Check for Updates" in the top-right corner
-- **Install**: The update modal shows release notes — click "Install Update" to download and replace the current executable
-- The app will quit, swap the `.exe`, and relaunch automatically
-
-## API Endpoints Used
-
-- **Device List**: `GET /api/v1/devices` — Retrieve all devices
-- **Auth Info**: `GET /api/v1/auth` — Verify authentication status
-
-## How It Works
-
-```
-Chrome Extension (popup click)
-  → POST http://127.0.0.1:18247/cookie
-  → Electron app HTTP server receives cookie
-  → Sets session state, fetches devices
-  → User selects device → launches aware-cam-proxy.exe
-```
-
-The Electron app runs a local HTTP server on port 18247 that only accepts requests from Chrome extensions with a shared token. The Chrome extension reads the `va` session cookie from the active Alta tab and sends it to the app.
-
-## Security
-
-- **Context Isolation**: Renderer process is isolated from Node.js APIs
-- **Preload Script**: Secure IPC communication between main and renderer processes
-- **CSP Enforced**: `script-src 'self'` — no inline scripts allowed
-- **Localhost Only**: Cookie server binds to `127.0.0.1`, not accessible from network
-- **CORS Restricted**: Only `chrome-extension://` origins accepted
-- **Domain Validation**: Only `*.avasecurity.com` and `*.avigilon.com` URLs accepted
-- **Input Sanitization**: Batch file inputs sanitized to prevent command injection
-- **Size Limits**: 64KB body limit on cookie server, type/length validation on all inputs
-
-## File Structure
-
-```
-├── main.js              # Main process (IPC, API calls, proxy spawning, cookie server)
-├── renderer.js          # Renderer process (UI logic, state management)
-├── preload.js           # Secure IPC bridge (contextBridge)
-├── index.html           # Static HTML shell (CSP enforced)
-├── styles.css           # Dark theme styling
-├── package.json         # Dependencies and build config
-├── chrome-extension/    # Chrome extension for cookie import
-│   ├── manifest.json    # Manifest V3
-│   ├── popup.html       # Extension popup UI
-│   ├── popup.css        # Dark theme styling
-│   ├── popup.js         # Tab detection, cookie retrieval
-│   └── icon*.png        # Extension icons
-├── assets/
-│   └── icon.png         # Application icon
-├── CLAUDE.md            # Claude Code project instructions
-└── README.md            # This file
-```
-
-**External executable** (not included in repo):
-- `aware-cam-proxy.exe` — cookie-based auth proxy (required, place in app root)
-
-## Troubleshooting
-
-### Connection Issues
-- Ensure you are **logged into Alta in Chrome** before clicking the extension
-- Verify the extension shows "Detected: [hostname]" in green
-- If extension shows "Alta Proxy Tool is not running" — start the Electron app first
-- If "Session cookie has expired" — log into Alta again in Chrome
-- Check that the app console shows "Cookie server listening on http://127.0.0.1:18247"
-
-### Camera Proxy Issues
-- **Executable not found**: Ensure `aware-cam-proxy.exe` is in the application directory
-- **Proxy won't start**: Check that you're connected and have selected a device
-- **Command window closes immediately**: Check network connectivity to the deployment
-
-### Device List Issues
-- Ensure you're connected via the Chrome extension first
-- Check that your user account has permissions to view devices
-- **No devices shown**: You may only have cloud cameras which are filtered out
-- Use the search box to find specific devices
-
-## Building for Distribution
+## Development and verification
+
+```bash
+npm test          # Node test suite, including synthetic runtime contracts
+npm run check     # Syntax checks plus tests
+npm run audit:prod
+npm run build-test
+```
+
+Tests use synthetic sessions/transports/processes only. Never add a real Alta tenant URL or session value to fixtures, logs, screenshots, or commits.
+
+Core files:
+
+- `main.js` — Electron lifecycle, trusted-sender IPC, fixed loopback server
+- `src/electron-runtime.js` — pairing persistence, bridge handler, narrow runtime orchestration
+- `src/session-store.js`, `src/alta-client.js` — main-only Alta session and requests
+- `src/proxy-launch.js` — fixed shell-free helper process management
+- `src/update-policy.js` — exact GitPeji check-only release policy
+- `preload.js` — narrow context bridge
+- `device-tree.js`, `sidebar-controller.js`, `sidebar-view.js` — pure hierarchy, interaction state, and bounded DOM adapter
+- `renderer.js`, `index.html`, `styles.css` — non-secret UI integration and Alta styling
+- `chrome-extension/` — stable-ID paired cookie sender
+- `test/` — pure and end-to-end contract tests
+
+## Building
 
 ```bash
-# Build portable Windows executable
 npm run build
-
-# Output: dist/AltaCameraProxy-1.0.0-portable.exe
 ```
 
-**Important**: Copy `aware-cam-proxy.exe` to the same directory as the built executable before distribution.
+The output remains Windows-only because the external camera helper is Windows-specific. Copy `aware-cam-proxy.exe` beside the portable APT executable before use.
 
-## Limitations
-
-- **Windows Only**: Camera proxy executable is Windows-specific
-- **Chrome Required**: Authentication requires the Chrome extension
-- **Local Cameras Only**: Automatically filters out cloud-based cameras
-- **No Session Refresh**: Sessions may expire and require re-import from Chrome
-- **Executable Required**: `aware-cam-proxy.exe` must be obtained separately
-- **Update Requires Write Access**: Self-update needs write permission to the directory containing the `.exe`
-
-## Development
-
-To modify or extend this application:
-
-1. **Main Process** ([main.js](main.js)): App lifecycle, API requests, proxy spawning, cookie server
-2. **Renderer Process** ([renderer.js](renderer.js)): UI interactions and state management
-3. **Preload Script** ([preload.js](preload.js)): Secure IPC bridge with context isolation
-4. **Chrome Extension** ([chrome-extension/](chrome-extension/)): Cookie import from browser
-5. **Styling** ([styles.css](styles.css)): Dark mode theme and responsive design
-
-### Adding New IPC Endpoints
-
-1. Add handler in [main.js](main.js) using `ipcMain.handle()`
-2. Expose method in [preload.js](preload.js) via `contextBridge.exposeInMainWorld()`
-3. Call from [renderer.js](renderer.js) using `window.electronAPI.yourMethod()`
-
-## License
-
-MIT License - Feel free to modify and distribute as needed.
+CI produces an unpacked Windows build only for verification. It does not publish, release, push, deploy, or sign artifacts. Windows code signing and verification with the approved certificate remain mandatory manual release gates; a successful build must not be represented as signed.
diff --git a/chrome-extension/manifest.json b/chrome-extension/manifest.json
index 7f457cb..b1f7f52 100644
--- a/chrome-extension/manifest.json
+++ b/chrome-extension/manifest.json
@@ -1,14 +1,16 @@
 {
   "manifest_version": 3,
   "name": "Alta Proxy Tool Bridge",
-  "version": "1.0.0",
-  "description": "Send Alta session cookies to the Alta Proxy Tool desktop app.",
-  "permissions": ["cookies", "activeTab", "clipboardWrite"],
+  "version": "1.2.5",
+  "description": "Send Alta session cookies to a paired Alta Proxy Tool desktop app.",
+  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt4EZdkSgOsyiy5DRe0JkX+BpK94FpMjBU59NVIqDPO8QBDwvqNDWT/UjqHK/0aqSxzed5KibX6MdAvc495+u1sCybFdjDdXyBewEvg+PDqGiJketlZKC9dcR1RXHuPgAoM3NaNbMb3TqYcS9J4iGq0UwadxubkQrEcPiuyR6oriOkop8q9/5DWGb15wOGmiCuVmlXfUjNJIvNBm9P/ZHtgFBYDI2PuSSI5GI4j04VFpEyfNlFCrpi8GQ7bYZzezigZWXRjhhNwkx39bNHlkAWYa8XGZseCpKKvi0EaeCoBPjoYSAt161SM1dqX+/UC61/sLOU/SpDB1SYGTm5DC+7wIDAQAB",
+  "permissions": ["cookies", "activeTab", "clipboardWrite", "storage"],
   "host_permissions": [
     "https://*.avasecurity.com/*",
     "https://*.avigilon.com/*",
     "http://127.0.0.1:18247/*"
   ],
+  "options_page": "options.html",
   "action": {
     "default_popup": "popup.html",
     "default_icon": {
diff --git a/chrome-extension/options.css b/chrome-extension/options.css
new file mode 100644
index 0000000..d659ef4
--- /dev/null
+++ b/chrome-extension/options.css
@@ -0,0 +1,77 @@
+:root {
+  color-scheme: dark;
+  font-family: 'Segoe UI', -apple-system, BlinkMacSystemFont, Roboto, sans-serif;
+}
+
+body {
+  margin: 0;
+  background: #1e1e1e;
+  color: #e0e0e0;
+}
+
+.options-card {
+  max-width: 560px;
+  margin: 48px auto;
+  padding: 28px;
+  border: 1px solid #3c3c3c;
+  border-radius: 8px;
+  background: #252526;
+  box-shadow: 0 12px 32px rgba(0, 0, 0, 0.25);
+}
+
+h1 { margin-top: 0; color: #75afff; }
+h2 { margin-bottom: 6px; font-size: 16px; }
+p { line-height: 1.5; }
+
+label {
+  display: block;
+  margin-bottom: 6px;
+  font-weight: 600;
+}
+
+input {
+  box-sizing: border-box;
+  width: 100%;
+  margin-bottom: 12px;
+  padding: 11px;
+  border: 1px solid #555;
+  border-radius: 4px;
+  background: #1e1e1e;
+  color: #fff;
+  font: inherit;
+}
+
+input:focus {
+  border-color: #0e7afe;
+  outline: 2px solid rgba(14, 122, 254, 0.3);
+}
+
+button {
+  padding: 10px 16px;
+  border-radius: 4px;
+  color: #fff;
+  cursor: pointer;
+  font: inherit;
+  font-weight: 700;
+}
+
+.primary-btn { border: 0; background: #0e7afe; }
+.danger-btn { border: 1px solid #f44336; background: transparent; color: #ff7b72; }
+button:disabled { cursor: not-allowed; opacity: 0.45; }
+
+.status {
+  min-height: 20px;
+  margin-top: 14px;
+  font-weight: 600;
+}
+
+.status.success,
+.paired { color: #7bd67e; }
+.status.error,
+.unpaired { color: #ffc36d; }
+
+.paired-controls {
+  margin-top: 24px;
+  padding-top: 14px;
+  border-top: 1px solid #3c3c3c;
+}
diff --git a/chrome-extension/options.html b/chrome-extension/options.html
new file mode 100644
index 0000000..c3a5c29
--- /dev/null
+++ b/chrome-extension/options.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'">
+  <title>Pair Alta Proxy Tool</title>
+  <link rel="stylesheet" href="options.css">
+</head>
+<body>
+  <main class="options-card">
+    <h1>Pair with Alta Proxy Tool</h1>
+    <p>Create a one-time pairing secret in APT, then paste it below.</p>
+    <form id="pairingForm">
+      <label for="pairingSecret">One-time pairing secret</label>
+      <input id="pairingSecret" name="pairingSecret" type="password" inputmode="text" autocomplete="off" spellcheck="false" required>
+      <button type="submit" class="primary-btn">Pair extension</button>
+    </form>
+    <div id="pairingStatus" class="status" role="status" aria-live="polite"></div>
+    <section class="paired-controls">
+      <h2>Current pairing</h2>
+      <p id="currentState">Checking...</p>
+      <button id="forgetBtn" type="button" class="danger-btn" disabled>Forget pairing</button>
+    </section>
+
+  </main>
+  <script src="options.js"></script>
+</body>
+</html>
diff --git a/chrome-extension/options.js b/chrome-extension/options.js
new file mode 100644
index 0000000..30c7ce2
--- /dev/null
+++ b/chrome-extension/options.js
@@ -0,0 +1,61 @@
+'use strict';
+
+const PAIRING_STORAGE_KEY = 'aptPairingSecret';
+const PAIRING_SECRET_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+
+const pairingForm = document.getElementById('pairingForm');
+const pairingSecretInput = document.getElementById('pairingSecret');
+const pairingStatus = document.getElementById('pairingStatus');
+const currentState = document.getElementById('currentState');
+const forgetBtn = document.getElementById('forgetBtn');
+
+function setStatus(message, type) {
+  pairingStatus.textContent = message;
+  pairingStatus.className = `status ${type}`;
+}
+
+function renderPairingState(paired) {
+  currentState.textContent = paired ? 'Paired on this Chrome profile.' : 'Not paired.';
+  currentState.className = paired ? 'paired' : 'unpaired';
+  forgetBtn.disabled = !paired;
+}
+
+async function refreshPairingState() {
+  const stored = await chrome.storage.local.get(PAIRING_STORAGE_KEY);
+  const candidate = stored && stored[PAIRING_STORAGE_KEY];
+  renderPairingState(PAIRING_SECRET_PATTERN.test(typeof candidate === 'string' ? candidate : ''));
+}
+
+pairingForm.addEventListener('submit', async (event) => {
+  event.preventDefault();
+  const candidate = pairingSecretInput.value.trim();
+  pairingSecretInput.value = '';
+
+  if (!PAIRING_SECRET_PATTERN.test(candidate)) {
+    setStatus('That secret is not valid. Generate a new pairing secret in APT and paste it exactly.', 'error');
+    return;
+  }
+
+  try {
+    await chrome.storage.local.set({ [PAIRING_STORAGE_KEY]: candidate });
+    setStatus('Pairing saved. You can now use Send to APT from an Alta tab.', 'success');
+    renderPairingState(true);
+  } catch {
+    setStatus('Chrome could not save the pairing. Try again.', 'error');
+  }
+});
+
+forgetBtn.addEventListener('click', async () => {
+  try {
+    await chrome.storage.local.remove(PAIRING_STORAGE_KEY);
+    renderPairingState(false);
+    setStatus('Pairing forgotten. Revoke or rotate it in APT as well.', 'success');
+  } catch {
+    setStatus('Chrome could not forget the pairing. Try again.', 'error');
+  }
+});
+
+refreshPairingState().catch(() => {
+  renderPairingState(false);
+  setStatus('Chrome could not read pairing state.', 'error');
+});
diff --git a/chrome-extension/popup.css b/chrome-extension/popup.css
index e4c5e8d..3bc2b57 100644
--- a/chrome-extension/popup.css
+++ b/chrome-extension/popup.css
@@ -2,120 +2,123 @@
 body {
   margin: 0;
   padding: 0;
-  font-family: 'Segoe UI', -apple-system, BlinkMacSystemFont, Roboto, sans-serif;
-  background: #1E1E1E;
-  color: #E0E0E0;
-  font-size: 14px;
-  min-width: 300px;
+  min-width: 320px;
+  background: #1e1e1e;
+  color: #e0e0e0;
+  font: 14px/1.4 'Segoe UI', -apple-system, BlinkMacSystemFont, Roboto, sans-serif;
 }
 
-.popup-container {
-  padding: 16px;
-}
+.popup-container { padding: 16px; }
 
 h1 {
+  margin: 0 0 12px;
+  color: #0e7afe;
   font-size: 16px;
   font-weight: 600;
-  color: #0E7AFE;
-  margin: 0 0 12px 0;
+  letter-spacing: 0.5px;
   text-align: center;
   text-transform: uppercase;
-  letter-spacing: 0.5px;
 }
 
-.tab-info {
-  background: #2D2D30;
-  border: 1px solid #3C3C3C;
+.tab-info,
+.pairing-info {
+  margin-bottom: 10px;
+  padding: 9px 11px;
+  border: 1px solid #3c3c3c;
   border-radius: 4px;
-  padding: 10px 12px;
-  margin-bottom: 12px;
+  background: #2d2d30;
+  color: #aaa;
   font-size: 13px;
-  color: #999999;
-  word-break: break-all;
+  overflow-wrap: anywhere;
 }
 
-.tab-info.detected {
-  color: #4CAF50;
-  border-color: #4CAF50;
+.tab-info.detected,
+.pairing-info.paired {
+  border-color: #4caf50;
+  color: #7bd67e;
 }
 
-.tab-info.not-detected {
-  color: #F44336;
-  border-color: #F44336;
+.tab-info.not-detected,
+.pairing-info.unpaired {
+  border-color: #f0a33a;
+  color: #ffc36d;
 }
 
-.action-buttons {
-  display: grid;
-  gap: 8px;
-}
+.action-buttons { display: grid; gap: 8px; }
 
 .primary-btn,
-.secondary-btn {
-  display: block;
+.secondary-btn,
+.link-btn {
   width: 100%;
   padding: 10px 16px;
-  font-family: inherit;
-  font-size: 14px;
-  font-weight: bold;
-  color: white;
-  background: #0E7AFE;
-  border: none;
   border-radius: 4px;
   cursor: pointer;
-  transition: background 0.2s ease;
+  font-family: inherit;
+  font-size: 14px;
+  font-weight: 700;
 }
 
 .primary-btn {
-  background: #0E7AFE;
+  border: 0;
+  background: #0e7afe;
+  color: #fff;
 }
 
 .secondary-btn {
-  background: #2D2D30;
-  border: 1px solid #0E7AFE;
-  color: #E0E0E0;
+  border: 1px solid #0e7afe;
+  background: #2d2d30;
+  color: #e0e0e0;
 }
 
-.primary-btn:hover:not(:disabled) {
-  background: #0A5FD9;
+.link-btn {
+  margin: -2px 0 10px;
+  padding: 5px;
+  border: 0;
+  background: transparent;
+  color: #75afff;
+  text-decoration: underline;
 }
 
-.secondary-btn:hover:not(:disabled) {
-  background: #0E7AFE;
-}
+.primary-btn:hover:not(:disabled) { background: #0a5fd9; }
+.secondary-btn:hover:not(:disabled) { background: #0e7afe; }
 
 .primary-btn:disabled,
 .secondary-btn:disabled {
-  opacity: 0.5;
   cursor: not-allowed;
+  opacity: 0.45;
 }
 
+
 .status-msg {
+  display: none;
   margin-top: 10px;
   padding: 8px 12px;
+  border: 1px solid transparent;
   border-radius: 4px;
   font-size: 13px;
-  font-weight: bold;
-  display: none;
-  border: 1px solid transparent;
+  font-weight: 700;
 }
 
+.status-msg.success,
+.status-msg.error,
+.status-msg.info { display: block; }
+
 .status-msg.success {
-  display: block;
+  border-color: #4caf50;
   background: rgba(76, 175, 80, 0.1);
-  color: #4CAF50;
-  border-color: #4CAF50;
+  color: #7bd67e;
 }
 
 .status-msg.error {
-  display: block;
+  border-color: #f44336;
   background: rgba(244, 67, 54, 0.1);
-  color: #F44336;
-  border-color: #F44336;
+  color: #ff7b72;
 }
 
 .status-msg.info {
-  display: block;
+  border-color: #0e7afe;
   background: rgba(14, 122, 254, 0.1);
-  color: #0E7AFE;
-  border-color: #0E7AFE;
+  color: #75afff;
 }
+
+[hidden] { display: none !important; }
diff --git a/chrome-extension/popup.html b/chrome-extension/popup.html
index a1e04a2..25214ac 100644
--- a/chrome-extension/popup.html
+++ b/chrome-extension/popup.html
@@ -3,19 +3,22 @@
 <head>
   <meta charset="UTF-8">
   <meta http-equiv="Content-Security-Policy" content="default-src 'self'; connect-src http://127.0.0.1:18247;">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>Alta Proxy Tool Bridge</title>
   <link rel="stylesheet" href="popup.css">
 </head>
 <body>
-  <div class="popup-container">
+  <main class="popup-container">
     <h1>Alta Proxy Tool</h1>
+    <div id="pairingInfo" class="pairing-info">Checking pairing...</div>
+    <button id="openOptionsBtn" class="link-btn" type="button" hidden>Open pairing settings</button>
     <div id="tabInfo" class="tab-info">Checking tab...</div>
     <div class="action-buttons">
-      <button id="sendBtn" class="primary-btn" disabled>Send to APT</button>
-      <button id="copyBtn" class="secondary-btn" disabled>Copy VA Token</button>
+      <button id="sendBtn" class="primary-btn" type="button" disabled>Send to APT</button>
+      <button id="copyBtn" class="secondary-btn" type="button" disabled>Copy VA Token</button>
     </div>
-    <div id="statusMsg" class="status-msg"></div>
-  </div>
+    <div id="statusMsg" class="status-msg" role="status" aria-live="polite"></div>
+  </main>
   <script src="popup.js"></script>
 </body>
 </html>
diff --git a/chrome-extension/popup.js b/chrome-extension/popup.js
index a43bb5d..fb91d9b 100644
--- a/chrome-extension/popup.js
+++ b/chrome-extension/popup.js
@@ -1,130 +1,238 @@
+'use strict';
+
 const APT_URL = 'http://127.0.0.1:18247/cookie';
-const APT_TOKEN = 'apt-local-bridge-token';
+const CHALLENGE_URL = 'http://127.0.0.1:18247/challenge';
+const PAIRING_STORAGE_KEY = 'aptPairingSecret';
+const PAIRING_SECRET_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const NONCE_PATTERN = PAIRING_SECRET_PATTERN;
+const BRIDGE_DEADLINE_MS = 3000;
 
-const tabInfo = document.getElementById('tabInfo');
-const sendBtn = document.getElementById('sendBtn');
-const copyBtn = document.getElementById('copyBtn');
-const statusMsg = document.getElementById('statusMsg');
-
-let detectedOrigin = null;
-
-function showStatus(message, type) {
-  statusMsg.textContent = message;
-  statusMsg.className = 'status-msg ' + type;
+function base64Url(bytes) {
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
 }
 
-function setActionButtonsDisabled(disabled) {
-  sendBtn.disabled = disabled;
-  copyBtn.disabled = disabled;
+async function hmacBase64Url(cryptoApi, secret, value) {
+  const encoder = new TextEncoder();
+  const key = await cryptoApi.subtle.importKey(
+    'raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']
+  );
+  const signature = await cryptoApi.subtle.sign('HMAC', key, encoder.encode(value));
+  return base64Url(new Uint8Array(signature));
 }
 
-async function getVaCookieValue() {
-  if (!detectedOrigin) {
-    throw new Error('No Alta deployment detected.');
-  }
-
-  const cookie = await chrome.cookies.get({ url: detectedOrigin, name: 'va' });
-
-  if (!cookie || !cookie.value) {
-    throw new Error('No "va" session cookie found. Are you logged in?');
-  }
-
-  if (cookie.expirationDate && cookie.expirationDate < Date.now() / 1000) {
-    throw new Error('Session cookie has expired. Please log in again.');
-  }
-
-  return cookie.value;
-}
-
-// Check the active tab on popup open
-chrome.tabs.query({ active: true, currentWindow: true }, (tabs) => {
-  if (!tabs || tabs.length === 0) {
-    tabInfo.textContent = 'No active tab found.';
-    tabInfo.className = 'tab-info not-detected';
-    return;
-  }
-
-  const tab = tabs[0];
-  let url;
+function isSupportedDeploymentUrl(value) {
   try {
-    url = new URL(tab.url);
+    const url = new URL(value);
+    const host = url.hostname.toLowerCase();
+    return url.protocol === 'https:' &&
+      (host.endsWith('.avasecurity.com') || host.endsWith('.avigilon.com'));
   } catch {
-    tabInfo.textContent = 'Cannot read this tab URL.';
-    tabInfo.className = 'tab-info not-detected';
-    return;
+    return false;
+  }
+}
+
+function createPopupController({
+  chromeApi,
+  documentApi,
+  navigatorApi,
+  fetchImpl,
+  confirmCopy,
+  cryptoApi
+}) {
+  const tabInfo = documentApi.getElementById('tabInfo');
+  const pairingInfo = documentApi.getElementById('pairingInfo');
+  const sendBtn = documentApi.getElementById('sendBtn');
+  const copyBtn = documentApi.getElementById('copyBtn');
+  const statusMsg = documentApi.getElementById('statusMsg');
+  const openOptionsBtn = documentApi.getElementById('openOptionsBtn');
+
+  let detectedOrigin = null;
+  let pairingSecret = null;
+  let busy = false;
+
+  async function bridgeFetch(url, options) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), BRIDGE_DEADLINE_MS);
+    try {
+      return await fetchImpl(url, { ...options, signal: controller.signal });
+    } finally {
+      clearTimeout(timer);
+    }
   }
 
-  const hostname = url.hostname;
-  const isAlta = hostname.endsWith('.avasecurity.com') || hostname.endsWith('.avigilon.com');
-
-  if (!isAlta) {
-    tabInfo.textContent = 'This tab is not an Alta deployment.';
-    tabInfo.className = 'tab-info not-detected';
-    return;
+  function showStatus(message, type) {
+    statusMsg.textContent = message;
+    statusMsg.className = `status-msg ${type}`;
   }
 
-  detectedOrigin = url.origin;
-  tabInfo.textContent = 'Detected: ' + hostname;
-  tabInfo.className = 'tab-info detected';
-  setActionButtonsDisabled(false);
-});
+  function updateActions() {
+    const disabled = busy || !detectedOrigin || !pairingSecret;
+    sendBtn.disabled = disabled;
+    copyBtn.disabled = disabled;
+  }
 
-// Send cookie on button click
-sendBtn.addEventListener('click', async () => {
-  if (!detectedOrigin) return;
+  function setBusy(value) {
+    busy = value;
+    updateActions();
+  }
 
-  setActionButtonsDisabled(true);
-  showStatus('Retrieving VA token...', 'info');
+  async function getVaCookieValue() {
+    if (!detectedOrigin) throw new Error('NO_DEPLOYMENT');
+    const cookie = await chromeApi.cookies.get({ url: detectedOrigin, name: 'va' });
+    if (!cookie || !cookie.value) throw new Error('MISSING_COOKIE');
+    if (cookie.expirationDate && cookie.expirationDate < Date.now() / 1000) {
+      throw new Error('EXPIRED_COOKIE');
+    }
+    return cookie.value;
+  }
 
-  try {
-    const cookieValue = await getVaCookieValue();
+  function showCookieError(error, copyOperation = false) {
+    if (error && error.message === 'MISSING_COOKIE') {
+      showStatus('No VA token found. Log in to Alta and try again.', 'error');
+    } else if (error && error.message === 'EXPIRED_COOKIE') {
+      showStatus('The VA token has expired. Log in to Alta again.', 'error');
+    } else if (copyOperation) {
+      showStatus('Could not copy the VA token. Check clipboard permission.', 'error');
+    } else {
+      showStatus('Could not reach Alta Proxy Tool on this computer.', 'error');
+    }
+  }
 
-    showStatus('Sending to Alta Proxy Tool...', 'info');
+  async function sendToApt() {
+    if (!detectedOrigin || !pairingSecret || busy) return;
+    setBusy(true);
+    let cookieValue = null;
+    try {
+      showStatus('Authenticating Alta Proxy Tool...', 'info');
+      if (!cryptoApi || !cryptoApi.subtle || typeof cryptoApi.getRandomValues !== 'function') {
+        throw new Error('CRYPTO_UNAVAILABLE');
+      }
+      const clientNonce = base64Url(cryptoApi.getRandomValues(new Uint8Array(32)));
+      const challengeResponse = await bridgeFetch(CHALLENGE_URL, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ clientNonce })
+      });
+      const challenge = await challengeResponse.json();
+      if (!challengeResponse.ok || !challenge || challenge.success !== true ||
+          !NONCE_PATTERN.test(challenge.serverNonce) || !NONCE_PATTERN.test(challenge.serverProof)) {
+        throw new Error('BRIDGE_REJECTED');
+      }
+      const expectedServerProof = await hmacBase64Url(
+        cryptoApi,
+        pairingSecret,
+        JSON.stringify(['apt-server-challenge-v1', clientNonce, challenge.serverNonce])
+      );
+      if (challenge.serverProof !== expectedServerProof) throw new Error('BRIDGE_AUTH_FAILED');
 
-    const response = await fetch(APT_URL, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'X-APT-Token': APT_TOKEN
-      },
-      body: JSON.stringify({
+      showStatus('Sending to Alta Proxy Tool...', 'info');
+      cookieValue = await getVaCookieValue();
+      const cookieRequest = {
+        clientNonce,
+        serverNonce: challenge.serverNonce,
         deploymentUrl: detectedOrigin,
         cookieValue
-      })
-    });
-
-    const data = await response.json();
-
-    if (data.success) {
-      showStatus('VA token sent successfully!', 'success');
-    } else {
-      showStatus('Error: ' + (data.message || 'Unknown error'), 'error');
+      };
+      cookieRequest.proof = await hmacBase64Url(
+        cryptoApi,
+        pairingSecret,
+        JSON.stringify(['apt-cookie-request-v1', clientNonce, challenge.serverNonce, detectedOrigin, cookieValue])
+      );
+      const response = await bridgeFetch(APT_URL, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(cookieRequest)
+      });
+      const data = await response.json();
+      if (!response.ok || !data || data.success !== true) throw new Error('BRIDGE_REJECTED');
+      showStatus('VA token sent successfully.', 'success');
+    } catch (error) {
+      showCookieError(error);
+    } finally {
+      cookieValue = null;
+      setBusy(false);
     }
-  } catch (err) {
-    if (err.message && err.message.includes('Failed to fetch')) {
-      showStatus('Alta Proxy Tool is not running.', 'error');
-    } else {
-      showStatus('Error: ' + err.message, 'error');
+  }
+
+  async function copyToken() {
+    if (!detectedOrigin || !pairingSecret || busy) return;
+    const confirmed = confirmCopy('Copy VA token?');
+    if (!confirmed) {
+      showStatus('Copy cancelled. The VA token was not read.', 'info');
+      return;
+    }
+
+    setBusy(true);
+    let cookieValue = null;
+    try {
+      cookieValue = await getVaCookieValue();
+      await navigatorApi.clipboard.writeText(cookieValue);
+      showStatus('VA token copied.', 'success');
+    } catch (error) {
+      showCookieError(error, true);
+    } finally {
+      cookieValue = null;
+      setBusy(false);
     }
-  } finally {
-    setActionButtonsDisabled(false);
   }
-});
 
-// Copy VA token on button click
-copyBtn.addEventListener('click', async () => {
-  if (!detectedOrigin) return;
+  async function init() {
+    sendBtn.addEventListener('click', sendToApt);
+    copyBtn.addEventListener('click', copyToken);
+    openOptionsBtn.addEventListener('click', () => chromeApi.runtime.openOptionsPage());
 
-  setActionButtonsDisabled(true);
-  showStatus('Retrieving VA token...', 'info');
+    const stored = await chromeApi.storage.local.get(PAIRING_STORAGE_KEY);
+    const candidate = stored && stored[PAIRING_STORAGE_KEY];
+    if (PAIRING_SECRET_PATTERN.test(typeof candidate === 'string' ? candidate : '')) {
+      pairingSecret = candidate;
+      pairingInfo.textContent = 'Paired with Alta Proxy Tool';
+      pairingInfo.className = 'pairing-info paired';
+      openOptionsBtn.hidden = true;
+    } else {
+      pairingInfo.textContent = 'Not paired. Add the one-time secret from APT.';
+      pairingInfo.className = 'pairing-info unpaired';
+      openOptionsBtn.hidden = false;
+    }
 
-  try {
-    const cookieValue = await getVaCookieValue();
-    await navigator.clipboard.writeText(cookieValue);
-    showStatus('VA token copied to clipboard!', 'success');
-  } catch (err) {
-    showStatus('Error: ' + err.message, 'error');
-  } finally {
-    setActionButtonsDisabled(false);
+    const tabs = await chromeApi.tabs.query({ active: true, currentWindow: true });
+    const tab = tabs && tabs[0];
+    if (!tab || !isSupportedDeploymentUrl(tab.url)) {
+      tabInfo.textContent = 'This tab is not an Alta deployment.';
+      tabInfo.className = 'tab-info not-detected';
+      updateActions();
+      return;
+    }
+
+    const url = new URL(tab.url);
+    detectedOrigin = url.origin;
+    tabInfo.textContent = `Detected: ${url.hostname}`;
+    tabInfo.className = 'tab-info detected';
+    updateActions();
   }
-});
+
+  return { copyToken, init, sendToApt };
+}
+
+if (typeof module !== 'undefined' && module.exports) {
+  module.exports = {
+    APT_URL,
+    PAIRING_STORAGE_KEY,
+    createPopupController,
+    isSupportedDeploymentUrl
+  };
+} else {
+  createPopupController({
+    chromeApi: chrome,
+    documentApi: document,
+    navigatorApi: navigator,
+    fetchImpl: fetch,
+    confirmCopy: (message) => window.confirm(message),
+    cryptoApi: crypto
+  }).init().catch(() => {
+    const status = document.getElementById('statusMsg');
+    status.textContent = 'Extension initialization failed. Open pairing settings and try again.';
+    status.className = 'status-msg error';
+  });
+}
diff --git a/device-tree.js b/device-tree.js
new file mode 100644
index 0000000..9f8b4ff
--- /dev/null
+++ b/device-tree.js
@@ -0,0 +1,368 @@
+'use strict';
+
+(function exposeDeviceTree(globalScope) {
+  const { toWellFormedString } = typeof module !== 'undefined' && module.exports
+    ? require('./well-formed-string')
+    : globalScope.AptWellFormedString;
+  const SPECIAL = Object.freeze({
+    ORPHAN_SITE: '__orphaned__',
+    UNGROUPED: '__ungrouped__',
+    UNKNOWN_GROUP_PREFIX: '__unknown_group__:',
+    UNKNOWN_SITE_PREFIX: '__unknown_site__:',
+  });
+
+  function text(value) {
+    return value === null || value === undefined ? '' : toWellFormedString(value).trim();
+  }
+
+  function normalized(value) {
+    return text(value).normalize('NFKD').toLocaleLowerCase();
+  }
+
+  function keyPart(value) {
+    const encoded = encodeURIComponent(toWellFormedString(value));
+    return `${encoded.length}:${encoded}`;
+  }
+
+  function compareNodes(left, right) {
+    const nameOrder = left.normalizedName === right.normalizedName
+      ? 0
+      : (left.normalizedName < right.normalizedName ? -1 : 1);
+    const idOrder = left.canonicalId === right.canonicalId
+      ? 0
+      : (left.canonicalId < right.canonicalId ? -1 : 1);
+    return nameOrder || idOrder || left.ordinal - right.ordinal;
+  }
+
+  function createIdentity(kind, item, ordinal, occurrences, diagnostics) {
+    const rawId = text(item && item.id);
+    const canonicalId = rawId || `__invalid_${kind}_${ordinal}`;
+    const count = (occurrences.get(canonicalId) || 0) + 1;
+    occurrences.set(canonicalId, count);
+    if (!rawId) diagnostics.push({ code: 'malformed-id', kind, ordinal, id: rawId });
+    if (count > 1) diagnostics.push({ code: 'duplicate-id', kind, ordinal, id: canonicalId });
+    return {
+      rawId,
+      canonicalId,
+      uniqueId: count === 1 ? canonicalId : `${canonicalId}~${count}`,
+    };
+  }
+
+  function makeSite(id, name, ordinal, extra) {
+    const syntheticType = extra && extra.syntheticType;
+    return Object.assign({
+      kind: 'site', id, canonicalId: id, name, normalizedName: normalized(name), ordinal,
+      key: syntheticType
+        ? `site:s:${keyPart(syntheticType)}:${keyPart(id)}`
+        : `site:t:${keyPart(id)}`,
+      pendingDeletion: false, groups: [], synthetic: false,
+    }, extra);
+  }
+
+  function makeGroup(site, id, name, ordinal, extra) {
+    const syntheticType = extra && extra.syntheticType;
+    return Object.assign({
+      kind: 'group', id, canonicalId: id, name, normalizedName: normalized(name), ordinal,
+      key: syntheticType
+        ? `group:s:${keyPart(syntheticType)}:${keyPart(site.key)}:${keyPart(id)}`
+        : `group:t:${keyPart(site.key)}:${keyPart(id)}`,
+      parentKey: site.key, site, cameras: [],
+      pendingDeletion: false, synthetic: false,
+    }, extra);
+  }
+
+  function buildDeviceTree(payload = {}) {
+    const diagnostics = [];
+    const sourceSites = Array.isArray(payload.sites) ? payload.sites : [];
+    const sourceGroups = Array.isArray(payload.groups) ? payload.groups : [];
+    const sourceDevices = Array.isArray(payload.devices) ? payload.devices : [];
+    const rowByKey = new Map();
+    const cameraByKey = new Map();
+    const sites = [];
+    const siteByRawId = new Map();
+    const groupByRawId = new Map();
+    const groupOccurrences = new Map();
+    const siteOccurrences = new Map();
+    const cameraOccurrences = new Map();
+    const syntheticSites = new Map();
+    let syntheticOrdinal = sourceSites.length + sourceGroups.length + sourceDevices.length;
+
+    function registerRow(node) {
+      if (!rowByKey.has(node.key)) {
+        rowByKey.set(node.key, node);
+        return true;
+      }
+      const collidedKey = node.key;
+      let collisionOrdinal = 2;
+      do {
+        node.key = `${collidedKey}:collision:${collisionOrdinal}`;
+        collisionOrdinal += 1;
+      } while (rowByKey.has(node.key));
+      diagnostics.push({
+        code: 'row-key-collision', key: collidedKey, resolvedKey: node.key,
+        kind: node.kind, id: node.canonicalId,
+      });
+      rowByKey.set(node.key, node);
+      return false;
+    }
+
+    sourceSites.forEach((item, ordinal) => {
+      const safe = item && typeof item === 'object' ? item : {};
+      const identity = createIdentity('site', safe, ordinal, siteOccurrences, diagnostics);
+      const site = makeSite(identity.uniqueId, text(safe.name) || identity.canonicalId, ordinal, {
+        canonicalId: identity.canonicalId,
+        pendingDeletion: safe.pendingDeletion === true || Boolean(text(safe.pendingDeletionStart)),
+        source: {
+          id: identity.canonicalId,
+          name: text(safe.name),
+          pendingDeletionStart: text(safe.pendingDeletionStart) || null,
+        },
+      });
+      sites.push(site);
+      registerRow(site);
+      if (identity.rawId && !siteByRawId.has(identity.rawId)) siteByRawId.set(identity.rawId, site);
+    });
+
+    function ensureUnknownSite(rawSiteId) {
+      const labelId = text(rawSiteId);
+      const id = labelId ? `${SPECIAL.UNKNOWN_SITE_PREFIX}${labelId}` : SPECIAL.ORPHAN_SITE;
+      const syntheticType = labelId ? 'unknown-site' : 'orphan';
+      const identity = `${syntheticType}:${keyPart(labelId)}`;
+      let site = syntheticSites.get(identity);
+      if (!site) {
+        const name = labelId ? `Unknown site: ${labelId}` : 'Orphaned cameras';
+        site = makeSite(id, name, syntheticOrdinal++, {
+          synthetic: true, syntheticType, hierarchyStatus: syntheticType,
+        });
+        sites.push(site);
+        registerRow(site);
+        syntheticSites.set(identity, site);
+      }
+      return site;
+    }
+
+    sourceGroups.forEach((item, ordinal) => {
+      const safe = item && typeof item === 'object' ? item : {};
+      const identity = createIdentity('group', safe, ordinal, groupOccurrences, diagnostics);
+      const parentId = text(safe.parentId);
+      const site = siteByRawId.get(parentId) || ensureUnknownSite(parentId);
+      if (!siteByRawId.has(parentId)) diagnostics.push({ code: parentId ? 'unknown-parent-site' : 'malformed-parent-site', key: `group:${site.id}:${identity.uniqueId}`, id: parentId });
+      const group = makeGroup(site, identity.uniqueId, text(safe.name) || identity.canonicalId, ordinal, {
+        canonicalId: identity.canonicalId,
+        rawParentId: parentId,
+        pendingDeletion: safe.pendingDeletion === true || Boolean(text(safe.pendingDeletionStart)),
+        source: {
+          id: identity.canonicalId,
+          name: text(safe.name),
+          parentId,
+          pendingDeletionStart: text(safe.pendingDeletionStart) || null,
+        },
+      });
+      site.groups.push(group);
+      registerRow(group);
+      if (identity.rawId && !groupByRawId.has(identity.rawId)) groupByRawId.set(identity.rawId, group);
+    });
+
+    function ensureGroup(site, id, name, status, template) {
+      const syntheticType = status === 'conflict' ? 'conflict' : status;
+      const key = `group:s:${keyPart(syntheticType)}:${keyPart(site.key)}:${keyPart(id)}`;
+      let group = rowByKey.get(key);
+      if (!group) {
+        group = makeGroup(site, id, name, syntheticOrdinal++, {
+          synthetic: true, syntheticType,
+          hierarchyStatus: status,
+          canonicalId: template ? template.canonicalId : id,
+          pendingDeletion: template ? template.pendingDeletion : false,
+          source: template ? template.source : undefined,
+        });
+        site.groups.push(group);
+        registerRow(group);
+      }
+      return group;
+    }
+
+    sourceDevices.forEach((item, ordinal) => {
+      const safe = item && typeof item === 'object' ? item : {};
+      const identity = createIdentity('camera', safe, ordinal, cameraOccurrences, diagnostics);
+      const cameraKey = `camera:t:${keyPart(identity.uniqueId)}`;
+      const directSiteId = text(safe.siteId);
+      const requestedGroupId = text(safe.deviceGroupId);
+      const knownGroup = requestedGroupId ? groupByRawId.get(requestedGroupId) : undefined;
+      let site;
+      let hierarchyStatus = text(safe.hierarchyStatus) || 'assigned';
+
+      if (directSiteId) {
+        site = siteByRawId.get(directSiteId) || ensureUnknownSite(directSiteId);
+        if (!siteByRawId.has(directSiteId)) hierarchyStatus = 'unknown-site';
+      } else if (knownGroup) {
+        site = knownGroup.site;
+        hierarchyStatus = 'inferred-site';
+      } else {
+        site = ensureUnknownSite('');
+        hierarchyStatus = requestedGroupId ? 'unknown-group' : 'orphan';
+      }
+
+      let group;
+      if (!requestedGroupId) {
+        group = ensureGroup(site, SPECIAL.UNGROUPED, 'Ungrouped', 'ungrouped');
+      } else if (!knownGroup) {
+        group = ensureGroup(site, `${SPECIAL.UNKNOWN_GROUP_PREFIX}${requestedGroupId}`, `Unknown group: ${requestedGroupId}`, 'unknown-group');
+        if (hierarchyStatus !== 'unknown-site') hierarchyStatus = 'unknown-group';
+        diagnostics.push({ code: 'unknown-group', key: cameraKey, id: requestedGroupId });
+      } else if (knownGroup.site !== site) {
+        group = ensureGroup(site, knownGroup.id, knownGroup.name, 'conflict', knownGroup);
+        hierarchyStatus = 'conflict';
+        diagnostics.push({ code: 'site-group-conflict', key: cameraKey, siteId: directSiteId, groupId: requestedGroupId, groupSiteId: knownGroup.site.canonicalId });
+      } else {
+        group = knownGroup;
+      }
+
+      const name = text(safe.name) || identity.canonicalId;
+      const source = {
+        id: identity.canonicalId,
+        name,
+        type: text(safe.type) || null,
+        model: text(safe.model) || null,
+        address: text(safe.address) || null,
+        siteId: directSiteId || null,
+        deviceGroupId: requestedGroupId || null,
+        displayStatus: text(safe.displayStatus) || null,
+        localStorage: typeof safe.localStorage === 'boolean' ? safe.localStorage : null,
+      };
+      const camera = {
+        kind: 'camera', id: identity.uniqueId, canonicalId: identity.canonicalId,
+        key: cameraKey, name, normalizedName: normalized(name), ordinal,
+        parentKey: group.key, site, group, hierarchyStatus, source,
+      };
+      camera.searchCorpus = normalized([
+        name, identity.canonicalId, safe.model, safe.type, safe.address, site.name, group.name,
+      ].map(text).join(' '));
+      group.cameras.push(camera);
+      registerRow(camera);
+      cameraByKey.set(camera.key, camera);
+    });
+
+    sites.forEach((site) => {
+      site.groups.sort(compareNodes);
+      site.groups.forEach((group) => group.cameras.sort(compareNodes));
+    });
+    sites.sort(compareNodes);
+
+    return Object.freeze({ sites, rowByKey, cameraByKey, diagnostics, cameraCount: cameraByKey.size });
+  }
+
+  function rowDescriptor(node, level, expanded, selectedKey, position, size) {
+    const aria = {
+      level,
+      expanded: node.kind === 'camera' ? undefined : expanded,
+      selected: node.key === selectedKey,
+      posinset: position,
+      setsize: size,
+    };
+    return {
+      key: node.key, parentKey: node.parentKey || null, kind: node.kind, id: node.id,
+      name: node.name, pendingDeletion: node.pendingDeletion === true,
+      hierarchyStatus: node.hierarchyStatus, aria,
+      ariaLevel: aria.level, ariaExpanded: aria.expanded, ariaSelected: aria.selected,
+      ariaPosInSet: aria.posinset, ariaSetSize: aria.setsize,
+    };
+  }
+
+  function flattenVisibleRows(model, options = {}) {
+    const expandedKeys = options.expandedKeys instanceof Set ? options.expandedKeys : new Set();
+    const selectedKey = typeof options.selectedKey === 'string' ? options.selectedKey : null;
+    const matches = options.matchCameraKeys instanceof Set ? options.matchCameraKeys : null;
+    const rows = [];
+    const includedGroups = (site) => site.groups.filter((group) => !matches || group.cameras.some((camera) => matches.has(camera.key)));
+    const includedSites = model.sites.filter((site) => !matches || includedGroups(site).length > 0);
+
+    includedSites.forEach((site, siteIndex) => {
+      const siteExpanded = expandedKeys.has(site.key);
+      rows.push(rowDescriptor(site, 1, siteExpanded, selectedKey, siteIndex + 1, includedSites.length));
+      if (!siteExpanded) return;
+      const groups = includedGroups(site);
+      groups.forEach((group, groupIndex) => {
+        const groupExpanded = expandedKeys.has(group.key);
+        rows.push(rowDescriptor(group, 2, groupExpanded, selectedKey, groupIndex + 1, groups.length));
+        if (!groupExpanded) return;
+        const cameras = matches ? group.cameras.filter((camera) => matches.has(camera.key)) : group.cameras;
+        cameras.forEach((camera, cameraIndex) => {
+          rows.push(rowDescriptor(camera, 3, undefined, selectedKey, cameraIndex + 1, cameras.length));
+        });
+      });
+    });
+    Object.defineProperty(rows, 'hiddenSelected', {
+      value: Boolean(selectedKey && model.rowByKey.has(selectedKey) && !rows.some((row) => row.key === selectedKey)),
+      enumerable: true,
+    });
+    return rows;
+  }
+
+  function calculateVirtualWindow(rows, options = {}) {
+    const rowHeight = Number.isFinite(options.rowHeight) && options.rowHeight > 0 ? options.rowHeight : 28;
+    const viewportHeight = Number.isFinite(options.viewportHeight) && options.viewportHeight >= 0 ? options.viewportHeight : 0;
+    const requestedScrollTop = Math.max(0, Number.isFinite(options.scrollTop) ? options.scrollTop : 0);
+    const overscan = Math.max(0, Number.isInteger(options.overscan) ? options.overscan : 16);
+    const scrollTop = Math.min(requestedScrollTop, Math.max(0, (rows.length * rowHeight) - viewportHeight));
+    const visibleStart = Math.floor(scrollTop / rowHeight);
+    const visibleEnd = Math.ceil((scrollTop + viewportHeight) / rowHeight);
+    const startIndex = Math.max(0, Math.min(rows.length, visibleStart - overscan));
+    const endIndex = Math.max(startIndex, Math.min(rows.length, visibleEnd + overscan));
+    return {
+      rows: rows.slice(startIndex, endIndex), startIndex, endIndex,
+      offsetTop: startIndex * rowHeight, totalHeight: rows.length * rowHeight, scrollTop,
+    };
+  }
+
+  function createSearchRunner(options = {}) {
+    const scheduler = typeof options.scheduler === 'function'
+      ? options.scheduler
+      : (work) => setTimeout(work, 0);
+    const chunkSize = Number.isInteger(options.chunkSize) && options.chunkSize > 0 ? options.chunkSize : 250;
+    let generation = 0;
+
+    function search(model, query, searchOptions = {}) {
+      const myGeneration = ++generation;
+      const terms = normalized(query).split(/\s+/).filter(Boolean);
+      const cameras = [...model.cameraByKey.values()];
+      const cameraKeys = new Set();
+      const expandedKeys = new Set(searchOptions.expandedKeys instanceof Set ? searchOptions.expandedKeys : []);
+      let index = 0;
+
+      return new Promise((resolve) => {
+        function finish(cancelled) {
+          resolve(Object.freeze({ generation: myGeneration, cancelled, count: cameraKeys.size, cameraKeys, expandedKeys }));
+        }
+        function work() {
+          if (myGeneration !== generation) return finish(true);
+          const end = Math.min(cameras.length, index + chunkSize);
+          for (; index < end; index += 1) {
+            const camera = cameras[index];
+            if (terms.every((term) => camera.searchCorpus.includes(term))) {
+              cameraKeys.add(camera.key);
+              expandedKeys.add(camera.site.key);
+              expandedKeys.add(camera.group.key);
+            }
+          }
+          if (index < cameras.length) scheduler(work);
+          else finish(false);
+        }
+        scheduler(work);
+      });
+    }
+
+    return Object.freeze({ search, cancel() { generation += 1; }, get generation() { return generation; } });
+  }
+
+  const api = Object.freeze({
+    SPECIAL,
+    buildDeviceTree,
+    buildDeviceTreeModel: buildDeviceTree,
+    flattenVisibleRows,
+    flattenRows: flattenVisibleRows,
+    createSearchRunner,
+    calculateVirtualWindow,
+  });
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+  if (globalScope) globalScope.AptDeviceTree = api;
+}(typeof window !== 'undefined' ? window : undefined));
diff --git a/docs/index.html b/docs/index.html
index f307442..13c756a 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html lang="en">
 <head>
-    <!-- GitHub Pages rebuild marker: 2026-05-22 -->
+
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Alta Proxy Tool</title>
@@ -303,7 +303,7 @@
                 <img src="icon.png" alt="Alta Proxy Tool">
                 <span>Alta Proxy Tool</span>
             </div>
-            <a href="https://github.com/PageZ948/Alta-Proxy-Tool" class="header-link">GitHub</a>
+            <a href="https://git.pejicorp.com/peji/Alta-Proxy-Tool" class="header-link">GitPeji</a>
         </div>
     </header>
 
@@ -313,7 +313,7 @@
             <div class="hero">
                 <img src="icon.png" alt="" class="hero-icon">
                 <h1>Alta Proxy Tool</h1>
-                <a href="https://github.com/PageZ948/Alta-Proxy-Tool/releases/latest/download/AltaProxyToolKit.zip" class="btn-download">Download Kit for Windows</a>
+                <a href="https://git.pejicorp.com/peji/Alta-Proxy-Tool/releases" class="btn-download">View Windows Releases</a>
             </div>
 
             <section class="setup">
@@ -321,8 +321,9 @@
                 <ol class="setup-steps">
                     <li>Extract the zip to any folder</li>
                     <li>Load <code>chrome-extension/</code> in Chrome via <code>chrome://extensions</code> (Developer mode)</li>
+                    <li>Start APT and paste its one-time pairing secret into the extension settings</li>
                     <li>Log into your Alta deployment in Chrome</li>
-                    <li>Click the extension icon and send cookies to the app</li>
+                    <li>Click the extension icon and securely send the session to the app</li>
                     <li>Run <strong>AltaCameraProxy.exe</strong> and start proxying</li>
                 </ol>
                 <p class="setup-note">Requires Windows 10+, Google Chrome, and an Avigilon Alta account.</p>
@@ -333,7 +334,7 @@
 
     <footer class="footer">
         <div class="container">
-            <a href="https://github.com/PageZ948/Alta-Proxy-Tool">Alta Proxy Tool on GitHub</a>
+            <a href="https://git.pejicorp.com/peji/Alta-Proxy-Tool">Alta Proxy Tool on GitPeji</a>
         </div>
     </footer>
 
diff --git a/docs/plans/2026-08-19-apt-security-foundation.md b/docs/plans/2026-08-19-apt-security-foundation.md
new file mode 100644
index 0000000..4b5f61b
--- /dev/null
+++ b/docs/plans/2026-08-19-apt-security-foundation.md
@@ -0,0 +1,533 @@
+# Alta Proxy Tool Security Foundation and Product Roadmap Implementation Plan
+
+> **For Hermes:** Use subagent-driven-development skill to implement this plan task-by-task.
+
+**Goal:** Remove APT’s Critical/Important security and release blockers, establish a reproducible Windows baseline, recover the Mac implementation into source control, and only then open a controlled lane for new features.
+
+**Architecture:** Keep Electron’s renderer unprivileged. Move session credentials, URL validation, proxy launching, process ownership, and update verification into small main-process modules with narrow IPC contracts. Development occurs in an isolated GitPeji worktree; existing Tool Hub downloads and production surfaces remain unchanged until a fully tested, exact-commit release is approved.
+
+**Tech Stack:** Electron, Node.js built-in `node:test`, Chrome Manifest V3 extension APIs, Electron Builder, GitPeji/Gitea Actions, SHA-256 release manifests, Windows Authenticode when available.
+
+---
+
+## Executive sequencing
+
+### Phase A — Security containment and proof
+
+No feature work enters this phase. It must close:
+
+1. arbitrary-code self-updater;
+2. CR/LF batch command injection;
+3. renderer-controlled URL/cookie exfiltration;
+4. cookie leakage through logs, temporary files, command lines, and broad clipboard handling;
+5. stale/vulnerable Electron, Axios, and build dependencies.
+
+### Phase B — Product/release foundation
+
+1. canonical GitPeji source and exact tagged builds;
+2. automated tests and CI;
+3. reproducible Windows kit with helper provenance;
+4. recover Mac source, then separately decide Intel/Rosetta versus native Apple Silicon;
+5. safe, signed/digest-bound updater only after all earlier gates pass.
+
+### Phase C — New features
+
+Feature discovery begins only after Phase A passes independent security review and Phase B has a reproducible development build. New functions go into a written backlog with user value, permissions, data touched, risk, and acceptance tests before implementation.
+
+## Non-negotiable guardrails
+
+- GitPeji is the only source of truth. Do not fetch from, push to, publish on, or update from alternate source hosts.
+- Use a fresh worktree from GitPeji `master` at `a80074ac57b7a4517837b5d95754f5e6433df3ac` or newer.
+- Preserve current Tool Hub downloads and production visibility until Zac approves replacement.
+- Do not use real Alta cookies in automated tests; use conspicuous synthetic sentinels.
+- Do not write cookies to logs, disk, command files, shell strings, crash reports, analytics, or test artifacts. The sole accepted exception is the fixed helper's required `-k` argv value for Zac's explicitly required paired-extension passwordless proxy flow; keep it main-process-only, direct-spawned with `shell: false`, redacted from errors, and absent from renderer IPC and tracked metadata.
+- No production release until the exact candidate passes controller verification plus independent security and release reviews.
+- Mac distribution remains approval-gated under Kanban task `t_42bad4d3`.
+
+---
+
+## Milestone 0: Establish an isolated hardening lane
+
+### Task 1: Create the clean GitPeji worktree and baseline evidence
+
+**Objective:** Start from an exact, clean canonical source without modifying the archived checkout.
+
+**Files:**
+- Create worktree: `/home/peji/worktrees/apt-security-foundation`
+- Create: `docs/security/2026-08-security-baseline.md`
+- Reference: `/home/peji/.hermes/reports/alta-proxy-tool-full-review-2026-08-19.md`
+
+**Steps:**
+
+1. Fetch only GitPeji and verify `origin/master`.
+2. Create branch `hardening/security-foundation` in the isolated worktree.
+3. Record full starting SHA, remote, branch, clean status, dependency audit counts, current package version, and the review report path.
+4. Confirm the archived checkout and Tool Hub checkout remain clean.
+5. Commit only the baseline document.
+
+**Commands:**
+
+```bash
+git fetch origin master
+git worktree add -b hardening/security-foundation /home/peji/worktrees/apt-security-foundation origin/master
+git -C /home/peji/worktrees/apt-security-foundation status --short --branch
+```
+
+**Expected:** clean branch based on exact GitPeji `origin/master`; no alternate-host remote used.
+
+**Commit:** `docs: record APT security hardening baseline`
+
+---
+
+## Milestone 1: Add a testable security boundary
+
+### Task 2: Introduce the smallest useful test harness
+
+**Objective:** Make security fixes test-first instead of relying on ad-hoc probes.
+
+**Files:**
+- Modify: `package.json`
+- Create: `test/url-policy.test.js`
+- Create: `test/error-redaction.test.js`
+- Create: `test/proxy-launch.test.js`
+- Create: `test/update-policy.test.js`
+- Create: `test/bridge-auth.test.js`
+- Create: `src/url-policy.js`
+- Create: `src/error-redaction.js`
+
+**Steps:**
+
+1. Add `npm test` using `node --test` and `npm run check` for syntax/tests.
+2. Write failing URL-policy tests for:
+   - HTTPS Alta subdomains accepted;
+   - HTTP rejected;
+   - non-Alta hosts rejected;
+   - userinfo, fragments, unexpected paths/ports, CR/LF, and malformed URLs rejected.
+3. Write failing error-redaction tests proving a synthetic `va=HERMES_SENTINEL_SECRET` never appears in formatted output.
+4. Implement minimal pure helpers.
+5. Run tests and syntax checks.
+
+**Commands:**
+
+```bash
+npm test
+npm run check
+```
+
+**Expected:** all tests pass; no source code needs Electron to test URL/redaction logic.
+
+**Commit:** `test: add APT security regression harness`
+
+---
+
+## Milestone 2: Remove the Critical updater path
+
+### Task 3: Disable executable self-update completely
+
+**Objective:** Remove the current arbitrary-native-code installation surface before redesigning updates.
+
+**Files:**
+- Modify: `main.js:454-630`
+- Modify: `preload.js:25-37`
+- Modify: `renderer.js:24-34,57-61,602-712,756-760`
+- Modify: `index.html:38-41,84-106`
+- Modify: `README.md:13,68-74,166`
+- Test: `test/update-policy.test.js`
+
+**Steps:**
+
+1. Write failing source/contract tests asserting no `download-and-install-update` IPC method is exposed and no executable replacement code remains.
+2. Remove updater IPC handlers, redirect downloader, executable overwrite batch script, progress event, and install controls.
+3. Replace the UI with either no update control or a safe informational link to an authenticated/internal release page; do not download or execute anything.
+4. Remove startup network update checks.
+5. Run tests and confirm the app still starts/builds.
+
+**Acceptance:** no renderer-to-main path can download, overwrite, or launch an executable.
+
+**Commit:** `fix: remove unsafe in-place updater`
+
+---
+
+## Milestone 3: Close command injection and process-control hazards
+
+### Task 4: Replace `.bat` construction with direct process spawning
+
+**Objective:** Eliminate command injection and plaintext cookie batch files.
+
+**Files:**
+- Create: `src/proxy-launch.js`
+- Modify: `main.js:26-31,274-387`
+- Test: `test/proxy-launch.test.js`
+
+**Steps:**
+
+1. Write failing tests for CR/LF, shell metacharacters, malformed UUIDs, invalid domains, oversized cookie values, and missing helper.
+2. Define strict input contracts:
+   - deployment host comes from validated main-process session state;
+   - device UUID matches the exact supported identifier shape;
+   - cookie length is bounded and never serialised into a command string;
+   - executable path is resolved from an approved fixed location.
+3. Spawn `aware-cam-proxy.exe` directly with an argument array and `shell: false`.
+4. Remove `sanitizeBatchInput()`, temporary `.bat` files, `cmd /c start`, and cookie-bearing echo output.
+5. Capture only process ID, device ID, start time, and safe status metadata.
+6. Add a Windows-specific smoke harness that substitutes a harmless fixture executable/script and records argv without exposing the cookie.
+
+**Acceptance:** the CR/LF reproducer is rejected; no batch/command file exists; cookie is not printed or persisted.
+
+**Commit:** `fix: launch proxy without shell command files`
+
+### Task 5: Stop only APT-owned proxy processes
+
+**Objective:** Prevent “Stop Proxy” from killing unrelated helper processes.
+
+**Files:**
+- Modify: `src/proxy-launch.js`
+- Modify: `main.js:389-452`
+- Modify: `renderer.js:147-177`
+- Test: `test/proxy-launch.test.js`
+
+**Steps:**
+
+1. Write a failing test proving only tracked child process IDs are terminated.
+2. Replace `taskkill /im aware-cam-proxy.exe` with tracked-process termination.
+3. Return per-device stop results and remove dead entries from the process map.
+4. Handle already-exited and permission-denied states honestly.
+5. Verify two fixture processes: stopping one leaves the other alive.
+
+**Commit:** `fix: scope proxy termination to APT processes`
+
+---
+
+## Milestone 4: Move trust and cookies into the main process
+
+### Task 6: Replace renderer-supplied URL/cookie IPC parameters
+
+**Objective:** Prevent a compromised renderer from sending Alta cookies to arbitrary destinations.
+
+**Files:**
+- Create: `src/session-store.js`
+- Create: `src/alta-client.js`
+- Modify: `main.js:192-272`
+- Modify: `preload.js:5-12`
+- Modify: `renderer.js:225-304,714-743`
+- Test: `test/url-policy.test.js`
+- Create: `test/alta-client.test.js`
+
+**Steps:**
+
+1. Write failing tests showing API methods reject renderer-provided URL/cookie fields.
+2. Store deployment origin and cookie only in main-process memory.
+3. Expose narrow IPC calls: `getDevices()`, `getDeviceSites()`, `getAuthInfo()`, `launchProxy(deviceId)`, `disconnect()`.
+4. Revalidate HTTPS Alta origin inside the main process before every request.
+5. Disable ambient proxy use for cookie-bearing requests unless a separately reviewed explicit enterprise-proxy configuration is later required.
+6. Disable cross-origin redirects or validate every redirect before forwarding credentials.
+7. Validate `event.senderFrame` against the app’s local file origin/window.
+8. On disconnect and app quit, overwrite references and clear session state.
+
+**Acceptance:** renderer messages cannot choose a destination or supply/receive the bearer cookie.
+
+**Commit:** `fix: keep Alta session authority in the main process`
+
+### Task 7: Redact all network and process errors
+
+**Objective:** Ensure failures cannot print cookies or secret-bearing request configuration.
+
+**Files:**
+- Modify: `src/error-redaction.js`
+- Modify: `src/alta-client.js`
+- Modify: `main.js`
+- Test: `test/error-redaction.test.js`
+
+**Steps:**
+
+1. Add synthetic Axios errors containing secrets in headers, URLs, nested config, causes, and response bodies.
+2. Format only bounded fields: operation, safe error code, HTTP status, timeout flag, and a sanitised message.
+3. Remove all full-object `console.error(..., error)` calls from credential-bearing paths.
+4. Add a source scan test for forbidden logging patterns.
+5. Run a sentinel failure probe and assert zero secret occurrences in stdout/stderr.
+
+**Commit:** `fix: redact credentials from APT errors`
+
+---
+
+## Milestone 5: Replace the public hard-coded bridge secret
+
+### Task 8: Add explicit extension pairing
+
+**Objective:** Stop treating `apt-local-bridge-token` as authentication.
+
+**Recommended v1 design:** keep loopback temporarily but pair the extension to the desktop app with a random per-install secret and a stable extension identity. Native Messaging is a later option if portability/setup proves acceptable.
+
+**Files:**
+- Create: `src/bridge-auth.js`
+- Modify: `main.js:12-145`
+- Modify: `chrome-extension/manifest.json`
+- Modify: `chrome-extension/popup.js`
+- Create: `chrome-extension/options.html`
+- Create: `chrome-extension/options.js`
+- Test: `test/bridge-auth.test.js`
+- Create: `test/extension-contract.test.js`
+
+**Steps:**
+
+1. Write failing tests for missing/wrong secret, unknown extension origin, replay/rotation, oversized body, slow body, and malformed JSON.
+2. Generate a cryptographically random pairing secret and store it with user-only permissions under Electron `userData`.
+3. Add a one-time pairing flow: desktop shows code; extension stores the resulting secret in `chrome.storage.local`.
+4. Give the extension a stable ID and accept only that exact extension origin.
+5. Compare secrets in constant time.
+6. Add request/body deadlines and bounded concurrency before body reads.
+7. Rotate/revoke pairing from the desktop UI.
+8. Remove `apt-local-bridge-token` from source.
+
+**Acceptance:** a different Chrome extension cannot submit data even when it knows the source code; pairing can be revoked without reinstalling APT.
+
+**Commit:** `feat: add paired authentication for the Chrome bridge`
+
+### Task 9: Make clipboard token copying explicitly guarded
+
+**Objective:** Retain Zac’s requested copy function without presenting it as harmless.
+
+**Files:**
+- Modify: `chrome-extension/popup.html`
+- Modify: `chrome-extension/popup.js`
+- Modify: `chrome-extension/popup.css`
+- Test: `test/extension-contract.test.js`
+
+**Steps:**
+
+1. Require a deliberate confirmation for copying the full bearer token.
+2. Show a concise warning that clipboard history/synchronisation may retain it.
+3. Never auto-copy.
+4. Clear extension references immediately after the operation.
+5. Test cancellation, permission denial, missing/expired cookie, and success messaging.
+
+**Commit:** `fix: guard VA token clipboard export`
+
+---
+
+## Milestone 6: Modernise dependencies and desktop hardening
+
+### Task 10: Upgrade Electron, Axios, and packaging dependencies
+
+**Objective:** Remove known dependency blockers without mixing in feature changes.
+
+**Files:**
+- Modify: `package.json`
+- Modify: `package-lock.json`
+- Modify: `main.js:148-167`
+- Remove dependency if unused: `crypto-js`
+- Remove/replace: `electron-packager`
+
+**Steps:**
+
+1. Create a dependency-upgrade branch commit separately from behaviour changes.
+2. Upgrade Electron to a currently supported major compatible with the target Windows estate.
+3. Upgrade Axios and transitive packages to patched releases.
+4. Remove unused `crypto-js` and deprecated `electron-packager` if source/runtime scans confirm no use.
+5. Enable explicit renderer sandboxing and deny unexpected navigation/window creation.
+6. Run full tests, `npm audit`, Electron smoke, and Windows package build.
+7. Do not accept Critical/High runtime findings; document any build-only exception with CVE reachability evidence.
+
+**Acceptance:** zero Critical/High production audit findings; supported Electron line; app smoke passes.
+
+**Commit:** `chore: modernize Electron runtime and dependencies`
+
+---
+
+## Milestone 7: Canonical source and reproducible releases
+
+### Task 11: Add helper provenance without committing the binary blindly
+
+**Objective:** Make the Windows kit reproducible and auditable while respecting vendor licensing.
+
+**Files:**
+- Create: `vendor/aware-cam-proxy/README.md`
+- Create: `vendor/aware-cam-proxy/checksums.json`
+- Modify: `build-kit.ps1`
+- Modify: `README.md`
+- Create: `LICENSE`
+- Create: `THIRD_PARTY_NOTICES.md`
+
+**Steps:**
+
+1. Confirm redistribution rights for Windows/macOS helper binaries; stop if unavailable.
+2. Record approved filename, platform, architecture, version/source owner, exact size, SHA-256, and acquisition procedure.
+3. Make the kit build reject any helper that does not match the approved manifest.
+4. Replace `author: "Your Name"` and add accurate project/third-party licensing.
+5. Add ZIP content, path-safety, extension-content, executable-presence, and checksum tests.
+
+**Commit:** `build: verify proxy helper provenance in release kits`
+
+### Task 12: Recover Mac implementation into GitPeji source
+
+**Objective:** Stop treating the Tool Hub Mac ZIP as source control.
+
+**Files:**
+- Recover into: `src/proxy-launch.js`
+- Modify: `package.json`
+- Modify: `README.md`
+- Create: `docs/platforms/macos.md`
+- Test: `test/proxy-launch.test.js`
+
+**Steps:**
+
+1. Extract and diff the current Tool Hub Mac `app.asar` against the hardened source.
+2. Port only reviewed platform logic; do not copy the stripped packaged `package.json` wholesale.
+3. Reuse the direct-spawn/no-shell/session rules from Windows.
+4. Add explicit x64 and arm64 packaging targets, but publish only architectures with a matching approved helper.
+5. Test on Intel/Rosetta and a current Apple Silicon Mac.
+6. Keep Kanban `t_42bad4d3` open until native Apple Silicon/helper support is proven or Zac explicitly accepts Rosetta-only scope.
+
+**Commit:** `feat: restore reviewed macOS source and build targets`
+
+### Task 13: Add GitPeji CI and exact-commit release evidence
+
+**Objective:** Build every release from one tagged GitPeji commit with retained evidence.
+
+**Files:**
+- Create: `.gitea/workflows/ci.yml`
+- Create: `.gitea/workflows/release.yml`
+- Remove or retire the legacy alternate-host Pages workflow.
+- Modify: `docs/index.html`
+- Create: `scripts/verify-kit.js`
+
+**Steps:**
+
+1. CI gate: `npm ci`, syntax, tests, audit policy, Windows unpacked build, kit verification, secret scan.
+2. Release gate: tag/version match, clean source, approved helper checksum, exact artifact hashes, SBOM, checksums, retained logs.
+3. Point docs/downloads to GitPeji or the approved Tool Hub route, never an alternate source host.
+4. Publish no artifact automatically until the first manual release rehearsal passes.
+5. Rehearse on a non-production candidate tag and verify fresh download/extraction.
+
+**Commit:** `ci: add GitPeji build and release gates`
+
+---
+
+## Milestone 8: Reintroduce updates safely, if still worthwhile
+
+### Task 14: Decide whether APT actually needs in-place updates
+
+**Objective:** Avoid rebuilding a dangerous feature merely because it existed before.
+
+**Decision gate:**
+
+- Preferred simplest option: notify that a verified update exists and open the trusted Tool Hub/GitPeji release page; user installs it manually.
+- In-place update is allowed only if code signing, digest verification, rollback, and platform-specific testing are available.
+
+**Deliverable:** `docs/decisions/0001-update-strategy.md`
+
+**Commit:** `docs: decide APT update strategy`
+
+### Task 15: Implement a verified updater only if the decision approves it
+
+**Objective:** Bind installation to an exact trusted release.
+
+**Files:**
+- Create: `src/update-manifest.js`
+- Create: `src/updater.js`
+- Modify: `main.js`
+- Modify: `preload.js`
+- Test: `test/update-policy.test.js`
+
+**Required tests:** wrong host, redirect host change, wrong size, wrong SHA-256, wrong signature, downgrade, wrong platform/architecture, truncated body, oversized body, interrupted download, failed replacement, successful rollback.
+
+**Acceptance:** only a manifest-authenticated, platform-matched artifact can reach replacement code; failure leaves the installed executable intact.
+
+**Commit:** `feat: add manifest-verified GitPeji updates`
+
+---
+
+## Milestone 9: Closure and controlled release
+
+### Task 16: Run adversarial security closure review
+
+**Objective:** Independently prove every Critical/Important finding is closed.
+
+**Required probes:**
+
+- arbitrary updater URL cannot execute;
+- CR/LF proxy parameters cannot become commands;
+- renderer cannot choose request destination or supply cookies;
+- Axios failures contain no sentinel secret;
+- bridge rejects unknown extension/wrong secret/slow bodies;
+- cookies never appear in files, process command strings, logs, tests, ZIP metadata, or analytics;
+- stop affects only APT-owned child processes;
+- dependency audit and Electron support policy pass.
+
+**Output:** finding-to-fix closure matrix with exact tests and commit.
+
+### Task 17: Build a DEV release candidate and preserve production
+
+**Objective:** Give Zac a testable candidate without replacing current downloads.
+
+**Steps:**
+
+1. Query usage/confirm release lane before changing Tool Hub visibility.
+2. Build exact tagged candidate and record artifact SHA-256.
+3. Publish only to an isolated DEV/download location clearly marked pre-release.
+4. Run Windows app, extension pairing, device discovery, proxy launch/stop, disconnect, error, and update-notification workflows.
+5. Verify current production Tool Hub/download hashes did not change.
+6. Request Zac acceptance.
+
+### Task 18: Promote only the accepted exact artifact
+
+**Objective:** Replace the existing release safely and reversibly.
+
+**Steps:**
+
+1. Preserve current Windows/Mac kits and hashes as rollback artifacts.
+2. Promote the exact accepted candidate—do not rebuild.
+3. Verify GitPeji tag/release, Tool Hub route, download size/hash, extension contents, Windows smoke, and analytics.
+4. Keep Mac separate until its own acceptance gate passes.
+5. Remove temporary DEV artifacts only after production verification and rollback proof.
+
+---
+
+## Feature roadmap gate
+
+### Task 19: Capture and prioritise new functions with Zac
+
+**Objective:** Turn feature ideas into a safe, ordered backlog after the red flags are closed.
+
+For each feature record:
+
+- user/problem and field-engineer value;
+- exact user journey;
+- read versus write operations;
+- Alta endpoints/data required;
+- cookie/session impact;
+- local helper/process impact;
+- Windows/macOS parity expectation;
+- failure and offline behaviour;
+- acceptance tests;
+- release risk and whether it can remain DEV-only.
+
+**Suggested buckets for the discussion:**
+
+1. **Proxy workflow improvements:** multi-camera queue, per-camera status, retry/diagnostics, safe logs.
+2. **Commissioning:** thumbnail/stream health, recording/site checks, readiness report.
+3. **Troubleshooting:** streams debug, recent alerts, support bundle.
+4. **Operator UX:** saved non-secret deployment aliases, clearer helper detection, version/support panel.
+5. **Platform:** native Apple Silicon, managed extension packaging, enterprise deployment.
+
+Do not implement feature buckets during the hardening branch. Create separate feature branches from the accepted security foundation.
+
+---
+
+## Definition of “major red flags fixed”
+
+All must be true:
+
+- [ ] Unsafe updater removed or cryptographically verified.
+- [ ] No shell/batch construction from user or renderer data.
+- [ ] Main process owns deployment origin and cookies.
+- [ ] Privileged IPC validates sender and strict schemas.
+- [ ] No cookie in logs, files, command strings, or automatic clipboard actions.
+- [ ] Loopback bridge uses revocable pairing and exact extension identity.
+- [ ] Proxy stop is process-scoped.
+- [ ] Supported Electron/Axios versions; no Critical/High runtime audit findings.
+- [ ] Automated tests and GitPeji CI pass.
+- [ ] Windows kit is exact-commit reproducible with helper provenance.
+- [ ] Mac source is canonical or Mac distribution remains explicitly withheld.
+- [ ] Independent security closure review returns PASS.
+- [ ] Existing production/download state remains unchanged until Zac approves promotion.
diff --git a/docs/security/2026-08-security-baseline.md b/docs/security/2026-08-security-baseline.md
new file mode 100644
index 0000000..5a5defb
--- /dev/null
+++ b/docs/security/2026-08-security-baseline.md
@@ -0,0 +1,22 @@
+# APT security hardening baseline
+
+- Canonical source: GitPeji `peji/Alta-Proxy-Tool`
+- Starting commit: `a80074ac57b7a4517837b5d95754f5e6433df3ac`
+- Branch: `hardening/security-foundation`
+- Original review: `/home/peji/.hermes/reports/alta-proxy-tool-full-review-2026-08-19.md`
+- Implementation plan: `docs/plans/2026-08-19-apt-security-foundation.md`
+- Starting package version: `1.0.0`
+- Starting audit: 25 findings (1 critical, 22 high, 2 moderate); production-only audit 3 findings (2 high, 1 moderate)
+- Starting release state: split release hosting, no application CI, unsafe unsigned updater, no automated tests
+
+## Guardrails
+
+- GitPeji only; alternate-host remote removed.
+- Production Tool Hub and existing downloads remain unchanged.
+- Synthetic sentinel credentials only in tests.
+- Work remains on the isolated hardening branch until review gates pass.
+- No feature additions until Critical/Important security closure.
+
+## Accepted passwordless proxy exception
+
+Zac explicitly requires the paired-extension **Connect → select camera → Start Proxy** flow without re-entering Alta credentials. The external `aware-cam-proxy.exe` helper supports cookie authentication only through `-k`; it exposes no stdin, named-pipe, environment-variable, or credential-file interface. APT therefore passes the validated main-owned session directly to the fixed helper as one argv value. This exception remains bounded by direct `shell: false` spawn, trusted-device allowlisting, no renderer/IPC credential parameter, no logs/files/shells, redacted launch errors, safe tracked metadata, and synthetic regression tests.
diff --git a/index.html b/index.html
index f1b9b6e..465aadb 100644
--- a/index.html
+++ b/index.html
@@ -3,45 +3,41 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;">
-    <title>Alta Video Camera Proxy with API</title>
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none';">
+    <title>Alta Video Camera Proxy</title>
     <link rel="stylesheet" href="styles.css">
 </head>
 <body>
     <div class="app-container">
-        <!-- Main Content Layout -->
         <div class="main-layout">
-            <!-- Left Sidebar - Available Devices -->
             <aside class="devices-sidebar">
-                <div class="sidebar-header">
-                    <h2>Available Devices</h2>
-                </div>
-
-                <div id="deviceStatus" class="status-message"></div>
-
-                <!-- Device Search -->
+                <div class="sidebar-header"><h2>Available Devices</h2></div>
+                <div id="deviceStatus" class="status-message" role="status" aria-live="polite"></div>
                 <div class="device-search-container">
-                    <input type="text" id="deviceSearch" placeholder="Search devices..." class="device-search-input">
+                    <label class="visually-hidden" for="deviceSearch">Search cameras</label>
+                    <input type="search" id="deviceSearch" placeholder="Search cameras..." class="device-search-input" autocomplete="off" aria-controls="deviceList">
+                    <p id="deviceResults" class="tree-results" role="status" aria-live="polite">Connect to load cameras</p>
                 </div>
-
                 <div class="device-list-container">
-                    <div id="deviceList" class="device-list">
-                        <p class="placeholder-text">Connect to API to load devices</p>
+                    <div id="deviceList" class="device-list virtual-tree" role="tree" tabindex="0" aria-label="Alta camera hierarchy" aria-activedescendant="" aria-describedby="deviceResults">
+                        <div id="treeSpacer" class="virtual-tree-spacer">
+                            <div id="treeWindow" class="virtual-tree-window">
+                                <p class="placeholder-text">Connect through the paired Chrome extension to load devices</p>
+                            </div>
+                        </div>
                     </div>
                 </div>
             </aside>
 
-            <!-- Main Content Area -->
             <main class="main-content">
                 <div class="content-header">
                     <h1>Alta Video Camera Proxy</h1>
-                    <button type="button" id="checkUpdateBtn" class="btn-update" title="Check for Updates">
+                    <button type="button" id="checkUpdateBtn" class="btn-update" title="Securely check GitPeji for a newer release">
                         <span class="update-icon">&#x21bb;</span>
                         <span class="update-text">Check for Updates</span>
                     </button>
                 </div>
 
-                <!-- API Connection Section -->
                 <section class="content-section">
                     <h2>API Connection</h2>
                     <div class="connection-status">
@@ -55,25 +51,41 @@
                     </div>
                     <div class="connection-controls">
                         <button type="button" id="disconnectBtn" class="btn-outline" disabled>Disconnect</button>
+                        <button type="button" id="managePairingBtn" class="btn-outline" hidden>Manage Pairing</button>
                     </div>
                     <div id="connectionStatus" class="status-message"></div>
                 </section>
 
-                <!-- Cookie-Based Camera Proxy Section -->
+                <section id="pairingSection" class="content-section pairing-section" hidden>
+                    <h2>Bridge Pairing</h2>
+                    <p class="section-help">Only the committed APT Chrome extension can send a session. Pair it with a one-time secret.</p>
+                    <div class="status-row">
+                        <label>Pairing:</label>
+                        <span id="pairingState" class="unpaired">Checking...</span>
+                    </div>
+                    <div id="pairingSecretRow" class="pairing-secret-row" style="display: none;">
+                        <label for="pairingSecret">One-time secret:</label>
+                        <input type="text" id="pairingSecret" readonly autocomplete="off" spellcheck="false">
+                        <small>Paste this into the extension pairing settings now. APT will not show it again.</small>
+                    </div>
+                    <div class="proxy-buttons">
+                        <button type="button" id="rotatePairingBtn" class="btn-primary">Generate / Rotate</button>
+                        <button type="button" id="revokePairingBtn" class="btn-outline">Revoke</button>
+                        <button type="button" id="hidePairingBtn" class="btn-outline" hidden>Done</button>
+                    </div>
+                </section>
+
                 <section class="content-section">
                     <h2>Camera Proxy</h2>
                     <div class="proxy-controls">
                         <div class="input-row">
-                            <label for="cookieDeviceUUID">Device UUID:</label>
-                            <input type="text" id="cookieDeviceUUID" placeholder="(Auto-filled when you select a device from the list)" readonly>
-                        </div>
-                        <div class="input-row" style="display: none;">
-                            <label for="cookieKey">Cookie Key:</label>
-                            <input type="text" id="cookieKey" placeholder="Paste your cookie key here">
+                            <label for="selectedDeviceId">Device UUID:</label>
+                            <input type="text" id="selectedDeviceId" placeholder="Select a device from the list" readonly>
                         </div>
+                        <p class="section-help">APT uses the paired Chrome extension session. Select a camera, then start the proxy—no Alta credentials need to be entered again.</p>
                         <div class="proxy-buttons">
-                            <button type="button" id="startCookieProxyBtn" class="btn-primary" disabled>Start Proxy</button>
-                            <button type="button" id="stopCookieProxyBtn" class="btn-outline" disabled>Stop Proxy</button>
+                            <button type="button" id="startProxyBtn" class="btn-primary" disabled>Start Proxy</button>
+                            <button type="button" id="stopProxyBtn" class="btn-outline" disabled>Stop Proxy</button>
                         </div>
                     </div>
                 </section>
@@ -81,30 +93,24 @@
         </div>
     </div>
 
-    <!-- Update Modal -->
-    <div id="updateModalOverlay" class="update-modal-overlay" style="display: none;">
+    <div id="updateNotice" class="update-modal-overlay" style="display: none;">
         <div class="update-modal-card">
-            <div class="update-modal-header">
-                <h3>Update Available</h3>
-                <button type="button" id="updateModalCloseBtn" class="update-modal-close">&times;</button>
-            </div>
+            <div class="update-modal-header"><h3>Update Available</h3></div>
             <div class="update-modal-body">
-                <p id="updateModalMessage" class="update-modal-message"></p>
-                <div id="updateModalNotes" class="update-modal-notes"></div>
-                <div id="updateProgressContainer" class="update-progress-container" style="display: none;">
-                    <div class="update-progress-track">
-                        <div id="updateProgressFill" class="update-progress-fill" style="width: 0%"></div>
-                    </div>
-                    <span id="updateProgressText" class="update-progress-text">0%</span>
-                </div>
+                <p id="updateMessage" class="update-modal-message"></p>
             </div>
             <div class="update-modal-footer">
-                <button type="button" id="updateInstallBtn" class="btn-primary">Install Update</button>
-                <button type="button" id="updateLaterBtn" class="btn-outline">Later</button>
+                <button type="button" id="openReleasesBtn" class="btn-primary">Open GitPeji Releases</button>
+                <button type="button" id="dismissUpdateBtn" class="btn-outline">Later</button>
             </div>
         </div>
     </div>
 
+    <script src="well-formed-string.js"></script>
+    <script src="renderer-controller.js"></script>
+    <script src="device-tree.js"></script>
+    <script src="sidebar-controller.js"></script>
+    <script src="sidebar-view.js"></script>
     <script src="renderer.js"></script>
 </body>
 </html>
diff --git a/main.js b/main.js
index 4bb5acd..15203f7 100644
--- a/main.js
+++ b/main.js
@@ -1,631 +1,241 @@
-const { app, BrowserWindow, ipcMain, shell } = require('electron');
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-const axios = require('axios');
-const https = require('https');
-const { spawn } = require('child_process');
-const http = require('http');
+'use strict';
 
-let mainWindow;
-let activeProxyProcesses = new Map(); // Track active camera proxy processes
-let cookieServer = null;
-const COOKIE_SERVER_PORT = 18247;
-const COOKIE_SERVER_TOKEN = 'apt-local-bridge-token';
+const { app, BrowserWindow, dialog, ipcMain, safeStorage, shell } = require('electron');
+const http = require('node:http');
+const path = require('node:path');
+const { pathToFileURL } = require('node:url');
+const { createSessionStore } = require('./src/session-store');
+const { createAltaClient } = require('./src/alta-client');
+const { createProxyManager } = require('./src/proxy-launch');
+const { checkForUpdate } = require('./src/update-policy');
+const {
+  AppRuntime,
+  PAIRING_ENVELOPE_FILENAME,
+  PairingController,
+  createBridgeHandler,
+} = require('./src/electron-runtime');
+
+const BRIDGE_HOST = '127.0.0.1';
+const BRIDGE_PORT = 18247;
+
+let mainWindow = null;
+let bridgeServer = null;
+let runtime = null;
+let pairingController = null;
+let firstRunPairingSecret = null;
+let quitCleanupInProgress = false;
+let allowConfirmedQuit = false;
 
-// Get the directory where the user-facing executable resides.
-// In portable builds, __dirname points to a temp extraction directory,
-// so we use the actual .exe location instead.
 function getAppDirectory() {
-  if (app.isPackaged) {
-    return path.dirname(process.env.PORTABLE_EXECUTABLE_FILE || app.getPath('exe'));
+  return app.isPackaged
+    ? path.dirname(process.env.PORTABLE_EXECUTABLE_FILE || app.getPath('exe'))
+    : __dirname;
+}
+
+function sendConnectionState() {
+  if (mainWindow && !mainWindow.isDestroyed() && runtime) {
+    mainWindow.webContents.send('connection-state-changed', runtime.getConnectionState());
   }
-  return __dirname;
-}
-
-// Sanitize strings before embedding in batch files to prevent command injection
-function sanitizeBatchInput(input) {
-  if (typeof input !== 'string') return '';
-  // Remove characters that have special meaning in batch/cmd: & | < > ^ % " ` !
-  return input.replace(/[&|<>^%"`!]/g, '');
-}
-
-function startCookieServer() {
-  cookieServer = http.createServer((req, res) => {
-    // CORS headers — only allow Chrome extension origins
-    const origin = req.headers.origin || '';
-    if (origin.startsWith('chrome-extension://')) {
-      res.setHeader('Access-Control-Allow-Origin', origin);
-    }
-    res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, X-APT-Token');
-
-    // Handle preflight
-    if (req.method === 'OPTIONS') {
-      res.writeHead(204);
-      res.end();
-      return;
-    }
-
-    // Only accept POST /cookie
-    if (req.method !== 'POST' || req.url !== '/cookie') {
-      res.writeHead(404, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ success: false, message: 'Not found' }));
-      return;
-    }
-
-    // Verify shared token
-    if (req.headers['x-apt-token'] !== COOKIE_SERVER_TOKEN) {
-      res.writeHead(403, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ success: false, message: 'Forbidden' }));
-      return;
-    }
-
-    // Read body with 64KB size limit
-    let body = '';
-    let bodySize = 0;
-    const MAX_BODY_SIZE = 65536;
-
-    req.on('data', (chunk) => {
-      bodySize += chunk.length;
-      if (bodySize > MAX_BODY_SIZE) {
-        res.writeHead(413, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ success: false, message: 'Payload too large' }));
-        req.destroy();
-        return;
-      }
-      body += chunk;
-    });
-
-    req.on('end', () => {
-      try {
-        const data = JSON.parse(body);
-        const { deploymentUrl, cookieValue } = data;
-
-        if (!deploymentUrl || !cookieValue) {
-          res.writeHead(400, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ success: false, message: 'Missing deploymentUrl or cookieValue' }));
-          return;
-        }
-
-        // Validate types and lengths
-        if (typeof deploymentUrl !== 'string' || typeof cookieValue !== 'string' ||
-            deploymentUrl.length > 512 || cookieValue.length > 4096) {
-          res.writeHead(400, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ success: false, message: 'Invalid parameter types or lengths' }));
-          return;
-        }
-
-        // Validate deployment URL is an Alta domain
-        try {
-          const parsed = new URL(deploymentUrl);
-          const isAltaDomain = parsed.hostname.endsWith('.avasecurity.com') ||
-                               parsed.hostname.endsWith('.avigilon.com');
-          if (!isAltaDomain || parsed.protocol !== 'https:') {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ success: false, message: 'Invalid deployment URL domain' }));
-            return;
-          }
-        } catch {
-          res.writeHead(400, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ success: false, message: 'Invalid deployment URL' }));
-          return;
-        }
-
-        if (mainWindow && !mainWindow.isDestroyed()) {
-          const cookies = ['va=' + cookieValue];
-          mainWindow.webContents.send('extension-cookie-received', {
-            deploymentUrl: deploymentUrl.replace(/\/$/, ''),
-            cookies,
-            cookieValue
-          });
-          res.writeHead(200, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ success: true, message: 'Cookie received' }));
-        } else {
-          res.writeHead(503, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ success: false, message: 'Application window not available' }));
-        }
-      } catch (e) {
-        res.writeHead(400, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ success: false, message: 'Invalid JSON' }));
-      }
-    });
-  });
-
-  cookieServer.listen(COOKIE_SERVER_PORT, '127.0.0.1', () => {
-    console.log(`Cookie server listening on http://127.0.0.1:${COOKIE_SERVER_PORT}`);
-  });
-
-  cookieServer.on('error', (err) => {
-    if (err.code === 'EADDRINUSE') {
-      console.error(`Cookie server error: Port ${COOKIE_SERVER_PORT} is already in use`);
-    } else {
-      console.error('Cookie server error:', err.message);
-    }
-  });
 }
 
 function createWindow() {
   mainWindow = new BrowserWindow({
     width: 1400,
     height: 900,
+    icon: path.join(__dirname, 'assets', 'icon.png'),
+    title: 'Alta Video Camera Proxy',
     webPreferences: {
       nodeIntegration: false,
       contextIsolation: true,
-      preload: path.join(__dirname, 'preload.js')
+      sandbox: true,
+      preload: path.join(__dirname, 'preload.js'),
     },
-    icon: path.join(__dirname, 'assets', 'icon.png'), // Optional icon
-    title: 'Alta Video Camera Proxy with API'
   });
 
-  mainWindow.loadFile('index.html');
+  mainWindow.webContents.setWindowOpenHandler(() => ({ action: 'deny' }));
+  mainWindow.webContents.on('will-navigate', (event) => event.preventDefault());
+  mainWindow.loadFile(path.join(__dirname, 'index.html'));
+  if (process.argv.includes('--dev')) mainWindow.webContents.openDevTools();
+}
 
-  // Open DevTools in development
-  if (process.argv.includes('--dev')) {
-    mainWindow.webContents.openDevTools();
-  }
+function isTrustedSender(event) {
+  if (!mainWindow || mainWindow.isDestroyed() || !event) return false;
+  const webContents = mainWindow.webContents;
+  const frame = event.senderFrame;
+  const expectedUrl = pathToFileURL(path.join(__dirname, 'index.html')).href;
+  return event.sender === webContents &&
+    frame === webContents.mainFrame &&
+    frame.url === expectedUrl;
+}
+
+function registerIpc(channel, handler) {
+  ipcMain.handle(channel, async (event, ...args) => {
+    if (!isTrustedSender(event)) throw new Error('Forbidden IPC sender');
+    return handler(...args);
+  });
+}
+
+function registerIpcHandlers() {
+  registerIpc('get-devices', () => runtime.getDevices());
+  registerIpc('get-device-sites', () => runtime.getDeviceSites());
+  registerIpc('get-device-groups', () => runtime.getDeviceGroups());
+  registerIpc('get-device-hierarchy', () => runtime.getDeviceHierarchy());
+  registerIpc('get-auth-info', () => runtime.getAuthInfo());
+  registerIpc('launch-proxy', (deviceId) => runtime.launchProxy(deviceId));
+  registerIpc('stop-proxy', async (key) => {
+    const result = await runtime.stopProxy(key);
+    sendConnectionState();
+    return result;
+  });
+  registerIpc('disconnect', async () => {
+    const state = await runtime.disconnect();
+    sendConnectionState();
+    return state;
+  });
+  registerIpc('get-connection-state', () => runtime.getConnectionState());
+  registerIpc('check-for-updates', () => runtime.checkForUpdates());
+  registerIpc('open-fixed-releases-page', () => runtime.openFixedReleasesPage());
+  registerIpc('rotate-pairing', () => {
+    firstRunPairingSecret = null;
+    return pairingController.rotate();
+  });
+  registerIpc('revoke-pairing', () => {
+    firstRunPairingSecret = null;
+    return pairingController.revoke();
+  });
+  registerIpc('get-pairing-status', () => {
+    const result = pairingController.getStatus();
+    if (firstRunPairingSecret) {
+      result.secret = firstRunPairingSecret;
+      firstRunPairingSecret = null;
+    }
+    return result;
+  });
+}
+
+function startBridgeServer() {
+  if (!pairingController.bridgeAuth) return;
+  const handler = createBridgeHandler({
+    bridgeAuth: pairingController.bridgeAuth,
+    sessionStore: runtime.sessionStore,
+    onConnectionStateChanged: () => {
+      runtime.onSessionChanged();
+      sendConnectionState();
+    },
+  });
+  bridgeServer = http.createServer((request, response) => {
+    handler(request, response).catch(() => {
+      if (!response.writableEnded) {
+        response.writeHead(500, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+        response.end(JSON.stringify({ success: false, message: 'Bridge request failed' }));
+      }
+    });
+  });
+  bridgeServer.on('clientError', (_error, socket) => socket.destroy());
+  bridgeServer.on('error', (error) => {
+    console.error(`Bridge server unavailable (${error.code || 'UNKNOWN'}).`);
+  });
+  bridgeServer.listen(BRIDGE_PORT, BRIDGE_HOST);
 }
 
 app.whenReady().then(() => {
+  const sessionStore = createSessionStore();
+  const altaClient = createAltaClient({ sessionStore });
+  const proxyManager = createProxyManager({ appDirectory: getAppDirectory() });
+  const secureStorageAvailable = safeStorage && safeStorage.isEncryptionAvailable();
+  pairingController = new PairingController({
+    envelopePath: path.join(app.getPath('userData'), PAIRING_ENVELOPE_FILENAME),
+    protect: secureStorageAvailable ? (value) => safeStorage.encryptString(value) : undefined,
+    unprotect: secureStorageAvailable ? (value) => safeStorage.decryptString(value) : undefined,
+  });
+  const pairingState = pairingController.initialize();
+  firstRunPairingSecret = pairingState.secret || null;
+  runtime = new AppRuntime({
+    sessionStore,
+    altaClient,
+    proxyManager,
+    checkForUpdate,
+    currentVersion: app.getVersion(),
+    openExternal: (url) => shell.openExternal(url),
+  });
+
+  registerIpcHandlers();
   createWindow();
-  startCookieServer();
+  startBridgeServer();
 });
 
-app.on('before-quit', () => {
-  if (cookieServer) {
-    cookieServer.close();
-  }
-});
-
-app.on('window-all-closed', () => {
-  if (process.platform !== 'darwin') {
-    app.quit();
-  }
-});
-
-app.on('activate', () => {
-  if (BrowserWindow.getAllWindows().length === 0) {
-    createWindow();
-  }
-});
-
-// IPC handlers for API communication
-ipcMain.handle('api-get-devices', async (event, { deploymentUrl, cookies }) => {
-  try {
-    const devicesUrl = `${deploymentUrl}/api/v1/devices`;
-    
-    // Create axios instance with cookies
-    const axiosInstance = axios.create({
-      timeout: 10000,
-      headers: {
-        'Cookie': cookies ? cookies.join('; ') : ''
+function closeBridgeServer() {
+  if (!bridgeServer) return Promise.resolve();
+  const server = bridgeServer;
+  return new Promise((resolve, reject) => {
+    const finish = (error) => {
+      if (!error || error.code === 'ERR_SERVER_NOT_RUNNING') {
+        if (bridgeServer === server) bridgeServer = null;
+        resolve();
+        return;
       }
-    });
-
-    const response = await axiosInstance.get(devicesUrl);
-    
-    return {
-      success: true,
-      devices: response.data,
-      message: `Found ${response.data.length} devices`
+      reject(error);
     };
-  } catch (error) {
-    console.error('Get devices error:', error);
-    return {
-      success: false,
-      message: error.response?.data?.message || error.message || 'Failed to get devices'
-    };
-  }
-});
-
-ipcMain.handle('api-get-device-sites', async (event, { deploymentUrl, cookies }) => {
-  try {
-    const sitesUrl = `${deploymentUrl}/api/v1/deviceSites`;
-
-    const axiosInstance = axios.create({
-      timeout: 10000,
-      headers: {
-        'Cookie': cookies ? cookies.join('; ') : ''
-      }
-    });
-
-    const response = await axiosInstance.get(sitesUrl);
-
-    return {
-      success: true,
-      sites: response.data
-    };
-  } catch (error) {
-    console.error('Get device sites error:', error);
-    return {
-      success: false,
-      sites: [],
-      message: error.response?.data?.message || error.message || 'Failed to get device sites'
-    };
-  }
-});
-
-ipcMain.handle('api-get-auth-info', async (event, { deploymentUrl, cookies }) => {
-  try {
-    const authUrl = `${deploymentUrl}/api/v1/auth`;
-    
-    const axiosInstance = axios.create({
-      timeout: 10000,
-      headers: {
-        'Cookie': cookies ? cookies.join('; ') : ''
-      }
-    });
-
-    const response = await axiosInstance.get(authUrl);
-    
-    return {
-      success: true,
-      authInfo: response.data
-    };
-  } catch (error) {
-    console.error('Get auth info error:', error);
-    return {
-      success: false,
-      message: error.response?.data?.message || error.message || 'Failed to get auth info'
-    };
-  }
-});
-
-// Cookie-based camera proxy functionality
-ipcMain.handle('camera-proxy-cookie-launch', async (event, { deploymentUrl, cookieKey, deviceUuid }) => {
-  try {
-    // Path to the cookie-based camera proxy executable
-    const proxyExePath = path.join(getAppDirectory(), 'aware-cam-proxy.exe');
-    
-    // Check if the executable exists
-    if (!fs.existsSync(proxyExePath)) {
-      return {
-        success: false,
-        message: 'Cookie-based camera proxy executable not found. Please ensure aware-cam-proxy.exe is in the application directory.'
-      };
-    }
-    
-    // Extract the domain from the deployment URL
-    let domain = deploymentUrl;
-    if (domain.startsWith('https://')) {
-      domain = domain.substring(8);
-    } else if (domain.startsWith('http://')) {
-      domain = domain.substring(7);
-    }
-    // Remove trailing path segments
-    domain = domain.split('/')[0];
-
-    // Sanitize all inputs before embedding in batch file
-    const safeDomain = sanitizeBatchInput(domain);
-    const safeDeviceUuid = sanitizeBatchInput(deviceUuid);
-    const safeCookieKey = sanitizeBatchInput(cookieKey);
-
-    if (!safeDomain || !safeDeviceUuid || !safeCookieKey) {
-      return {
-        success: false,
-        message: 'Invalid characters detected in connection parameters.'
-      };
-    }
-
-    // Create a batch file to launch the cookie-based camera proxy
-    const truncatedKey = safeCookieKey.length > 20 ? safeCookieKey.substring(0, 20) + '...' : safeCookieKey;
-    const batchContent = `@echo off
-title APT-Proxy-${safeDeviceUuid}
-echo Launching Alta Video Camera Proxy (Cookie Method)...
-echo Domain: ${safeDomain}
-echo Device UUID: ${safeDeviceUuid}
-echo Cookie Key: ${truncatedKey}
-echo.
-"${proxyExePath}" -a "${safeDomain}" -d "${safeDeviceUuid}" -k "${safeCookieKey}"
-echo.
-echo Cookie-based camera proxy has finished. Press any key to close this window.
-pause >nul`;
-    
-    const tempDir = os.tmpdir();
-    const batchPath = path.join(tempDir, `cookie-proxy-${Date.now()}.bat`);
-    
-    // Write the batch file
-    fs.writeFileSync(batchPath, batchContent);
-    
-    console.log('Launching cookie-based camera proxy via batch file:', batchPath);
-    console.log('Command will be: aware-cam-proxy.exe -a', safeDomain, '-d', safeDeviceUuid, '-k [REDACTED]');
-
-    // Launch the batch file in a new command prompt window with unique title
-    const windowTitle = `APT-Proxy-${safeDeviceUuid}`;
-    const cmdProcess = spawn('cmd', ['/c', 'start', `"${windowTitle}"`, 'cmd', '/c', batchPath], {
-      detached: true,
-      stdio: 'ignore'
-    });
-
-    // Store the process information for later termination
-    const processInfo = {
-      process: cmdProcess,
-      batchPath: batchPath,
-      deviceUuid: safeDeviceUuid,
-      startTime: Date.now(),
-      cookieKey: truncatedKey,
-      domain: safeDomain,
-      windowTitle: windowTitle, // Store window title for targeted cleanup
-      type: 'cookie' // Mark as cookie-based proxy
-    };
-
-    activeProxyProcesses.set(cmdProcess.pid, processInfo);
-    
-    // Clean up the batch file after a delay
-    setTimeout(() => {
-      try {
-        if (fs.existsSync(batchPath)) {
-          fs.unlinkSync(batchPath);
-        }
-      } catch (error) {
-        console.log('Could not clean up cookie proxy batch file:', error.message);
-      }
-    }, 60000); // Clean up after 1 minute
-    
-    cmdProcess.unref(); // Allow the parent process to exit independently
-    
-    // Clean up process tracking when it exits
-    cmdProcess.on('exit', () => {
-      activeProxyProcesses.delete(cmdProcess.pid);
-    });
-    
-    return {
-      success: true,
-      message: `Cookie-based camera proxy launched for ${deviceUuid}!`,
-      processId: cmdProcess.pid,
-      deviceUuid: deviceUuid,
-      type: 'cookie'
-    };
-    
-  } catch (error) {
-    console.error('Failed to launch cookie-based camera proxy:', error);
-    return {
-      success: false,
-      message: `Failed to launch cookie-based camera proxy: ${error.message}`
-    };
-  }
-});
-
-// Stop camera proxy functionality
-ipcMain.handle('camera-proxy-stop', async (event, { processId }) => {
-  try {
-    console.log('Attempting to stop camera proxy processes...');
-
-    return new Promise((resolve) => {
-      // Kill all aware-cam-proxy.exe processes by name
-      const killProxy = spawn('taskkill', ['/f', '/im', 'aware-cam-proxy.exe'], {
-        stdio: ['ignore', 'pipe', 'pipe']
-      });
-
-      let proxyOutput = '';
-      let proxyError = '';
-
-      killProxy.stdout.on('data', (data) => {
-        proxyOutput += data.toString();
-      });
-
-      killProxy.stderr.on('data', (data) => {
-        proxyError += data.toString();
-      });
-
-      killProxy.on('close', (code) => {
-        // Clean up our process tracking
-        activeProxyProcesses.clear();
-
-        if (code === 0 || proxyOutput.includes('SUCCESS')) {
-          console.log('Camera proxy processes terminated successfully');
-          resolve({
-            success: true,
-            message: 'Camera proxy processes stopped successfully'
-          });
-        } else if (proxyError.includes('not found') || proxyError.includes('No tasks')) {
-          console.log('No camera proxy processes were running');
-          resolve({
-            success: true,
-            message: 'No camera proxy processes were running'
-          });
-        } else {
-          resolve({
-            success: true,
-            message: 'Attempted to stop all camera proxy processes'
-          });
-        }
-      });
-
-      killProxy.on('error', (error) => {
-        console.error('Error with taskkill by name:', error);
-        activeProxyProcesses.clear();
-        resolve({
-          success: false,
-          message: `Failed to stop camera proxy: ${error.message}`
-        });
-      });
-    });
-
-  } catch (error) {
-    console.error('Failed to stop camera proxy:', error);
-    return {
-      success: false,
-      message: `Failed to stop camera proxy: ${error.message}`
-    };
-  }
-});
-
-// --- Self-Update Functionality ---
-
-// Compare semver versions: returns -1 if a < b, 0 if equal, 1 if a > b
-function compareVersions(a, b) {
-  // Strip pre-release tags (e.g. "1.2.3-beta.1" → "1.2.3")
-  const cleanA = a.replace(/-.*$/, '');
-  const cleanB = b.replace(/-.*$/, '');
-  const partsA = cleanA.split('.').map(Number);
-  const partsB = cleanB.split('.').map(Number);
-  for (let i = 0; i < 3; i++) {
-    const numA = partsA[i] || 0;
-    const numB = partsB[i] || 0;
-    if (numA < numB) return -1;
-    if (numA > numB) return 1;
-  }
-  return 0;
-}
-
-// Follow HTTPS redirects and return the final response (for GitHub asset downloads)
-function httpsGetFollowRedirects(url, callback, redirectCount = 0) {
-  if (redirectCount >= 5) {
-    return callback(null, new Error('Too many redirects'));
-  }
-  const parsed = new URL(url);
-  if (parsed.protocol !== 'https:') {
-    return callback(null, new Error('Only HTTPS URLs are allowed'));
-  }
-  https.get(url, { headers: { 'User-Agent': 'Alta-Proxy-Tool' } }, (res) => {
-    if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-      const redirectUrl = new URL(res.headers.location, url).href;
-      httpsGetFollowRedirects(redirectUrl, callback, redirectCount + 1);
-    } else {
-      callback(res);
-    }
-  }).on('error', (err) => {
-    callback(null, err);
+    try { server.close(finish); } catch (error) { finish(error); }
   });
 }
 
-ipcMain.handle('get-current-version', async () => {
-  return { success: true, version: app.getVersion() };
-});
+async function notifyQuitBlocked(state) {
+  sendConnectionState();
+  const activeCount = state && Array.isArray(state.activeProxies) ? state.activeProxies.length : 0;
+  const activeProxiesRemain = activeCount > 0;
+  const processDetail = activeProxiesRemain
+    ? `${activeCount} app-owned proxy process${activeCount === 1 ? '' : 'es'} remain active.`
+    : 'No app-owned proxy process remains active.';
+  const sessionDetail = state && state.connected
+    ? ' The Alta session is still connected; resolve the process error and try quitting again.'
+    : ' Resolve the shutdown error and try quitting again.';
+  await dialog.showMessageBox({
+    type: 'error',
+    title: activeProxiesRemain ? 'Alta Camera Proxy is still running' : 'Alta Camera Proxy could not close',
+    message: activeProxiesRemain
+      ? 'The app could not confirm that every proxy process exited.'
+      : 'The app could not complete shutdown safely.',
+    detail: `${processDetail}${sessionDetail}`,
+    buttons: ['OK'],
+    noLink: true,
+  });
+}
 
-ipcMain.handle('check-for-updates', async () => {
-  try {
-    const response = await axios.get(
-      'https://api.github.com/repos/PageZ948/Alta-Proxy-Tool/releases/latest',
-      {
-        timeout: 10000,
-        headers: { 'User-Agent': 'Alta-Proxy-Tool', 'Accept': 'application/vnd.github.v3+json' }
+app.on('before-quit', (event) => {
+  if (allowConfirmedQuit) return;
+  event.preventDefault();
+  if (quitCleanupInProgress) return;
+  quitCleanupInProgress = true;
+
+  (async () => {
+    try {
+      const state = runtime
+        ? await runtime.disconnect()
+        : { success: true, connected: false, activeProxies: [] };
+      if (!state.success || state.activeProxies.length > 0) {
+        await notifyQuitBlocked(state);
+        return;
       }
-    );
-
-    const release = response.data;
-    const latestVersion = release.tag_name.replace(/^v/, '');
-    const currentVersion = app.getVersion();
-
-    const updateAvailable = compareVersions(currentVersion, latestVersion) < 0;
-
-    // Find the portable .exe asset
-    const exeAsset = release.assets.find(a => /AltaCameraProxy-.*-portable\.exe$/i.test(a.name));
-    const downloadUrl = exeAsset ? exeAsset.browser_download_url : null;
-
-    return {
-      success: true,
-      updateAvailable,
-      currentVersion,
-      latestVersion,
-      downloadUrl,
-      releaseNotes: release.body || '',
-      releaseName: release.name || `v${latestVersion}`
-    };
-  } catch (error) {
-    if (error.response && error.response.status === 404) {
-      return { success: true, updateAvailable: false, currentVersion: app.getVersion(), message: 'No releases available yet' };
-    }
-    if (error.response && error.response.status === 403) {
-      return { success: false, message: 'GitHub API rate limit exceeded. Try again later.' };
-    }
-    console.error('Check for updates error:', error.message);
-    return { success: false, message: error.message || 'Failed to check for updates' };
-  }
-});
-
-ipcMain.handle('download-and-install-update', async (event, { downloadUrl }) => {
-  try {
-    // Determine the path to the currently running executable
-    const currentExePath = process.env.PORTABLE_EXECUTABLE_FILE || app.getPath('exe');
-    const currentDir = getAppDirectory();
-    const currentExeName = path.basename(currentExePath);
-
-    // Check write permission on the app directory
-    try {
-      fs.accessSync(currentDir, fs.constants.W_OK);
-    } catch {
-      return { success: false, message: 'No write permission to the application directory. Try running as administrator.' };
-    }
-
-    const tempDir = os.tmpdir();
-    const tempExePath = path.join(tempDir, `AltaCameraProxy-update-${Date.now()}.exe`);
-
-    // Download the file with progress reporting
-    await new Promise((resolve, reject) => {
-      httpsGetFollowRedirects(downloadUrl, (res, err) => {
-        if (err) return reject(err);
-        if (res.statusCode !== 200) {
-          res.resume();
-          return reject(new Error(`Download failed with status ${res.statusCode}`));
-        }
-
-        const totalSize = parseInt(res.headers['content-length'], 10) || 0;
-        let downloadedSize = 0;
-        const fileStream = fs.createWriteStream(tempExePath);
-
-        res.on('data', (chunk) => {
-          downloadedSize += chunk.length;
-          if (totalSize > 0 && mainWindow && !mainWindow.isDestroyed()) {
-            const percent = Math.round((downloadedSize / totalSize) * 100);
-            mainWindow.webContents.send('update-download-progress', { percent, downloadedSize, totalSize });
-          }
-        });
-
-        res.pipe(fileStream);
-
-        fileStream.on('finish', () => {
-          fileStream.close();
-          resolve();
-        });
-
-        fileStream.on('error', (err) => {
-          fs.unlink(tempExePath, () => {});
-          reject(err);
-        });
-      });
-    });
-
-    // Verify downloaded file size (sanity check: > 10MB for an Electron portable exe)
-    const stats = fs.statSync(tempExePath);
-    if (stats.size < 10 * 1024 * 1024) {
-      fs.unlinkSync(tempExePath);
-      return { success: false, message: 'Downloaded file is too small — update may be corrupt.' };
-    }
-
-    // Create batch script to replace the exe after this process exits
-    const batchPath = path.join(tempDir, `apt-update-${Date.now()}.bat`);
-    const pid = process.pid;
-    const batchContent = `@echo off\r\ntitle APT-Updater\r\necho Waiting for Alta Proxy Tool to close...\r\n:waitloop\r\ntasklist /fi "PID eq ${pid}" 2>nul | find "${pid}" >nul\r\nif not errorlevel 1 (\r\n  timeout /t 1 /nobreak >nul\r\n  goto waitloop\r\n)\r\necho Applying update...\r\ncopy /y "${tempExePath}" "${path.join(currentDir, currentExeName)}"\r\nif errorlevel 1 (\r\n  echo Update failed! Could not copy new version.\r\n  pause\r\n  del "${tempExePath}" >nul 2>&1\r\n  del "%~f0" >nul 2>&1\r\n  exit /b 1\r\n)\r\necho Update complete. Launching new version...\r\nstart "" "${path.join(currentDir, currentExeName)}"\r\ndel "${tempExePath}" >nul 2>&1\r\ndel "%~f0" >nul 2>&1\r\n`;
-
-    fs.writeFileSync(batchPath, batchContent);
-
-    // Spawn the updater batch script detached
-    let updater;
-    try {
-      updater = spawn('cmd', ['/c', batchPath], {
-        detached: true,
-        stdio: 'ignore',
-        windowsHide: true
-      });
-      updater.unref();
-    } catch (spawnError) {
-      console.error('Failed to spawn updater:', spawnError);
-      try { fs.unlinkSync(tempExePath); } catch {}
-      try { fs.unlinkSync(batchPath); } catch {}
-      return { success: false, message: 'Failed to start updater process.' };
-    }
-
-    // Quit the app after a delay to let the IPC response return to renderer
-    setTimeout(() => {
+      await closeBridgeServer();
+      if (runtime) runtime.sessionStore.dispose();
+      allowConfirmedQuit = true;
       app.quit();
-    }, 1500);
-
-    return { success: true, message: 'Update is being installed. The app will restart shortly.' };
-  } catch (error) {
-    console.error('Download and install update error:', error);
-    return { success: false, message: error.message || 'Failed to download and install update' };
-  }
+    } catch {
+      const state = runtime
+        ? runtime.getConnectionState()
+        : { connected: false, activeProxies: [] };
+      await notifyQuitBlocked(state);
+    } finally {
+      quitCleanupInProgress = false;
+    }
+  })();
 });
 
+app.on('window-all-closed', () => {
+  if (process.platform !== 'darwin') app.quit();
+});
+
+app.on('activate', () => {
+  if (BrowserWindow.getAllWindows().length === 0 && runtime) createWindow();
+});
diff --git a/package-lock.json b/package-lock.json
index 3850785..715defb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,39 +1,29 @@
 {
   "name": "alta-api-client",
-  "version": "1.0.0",
+  "version": "1.2.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "alta-api-client",
-      "version": "1.0.0",
+      "version": "1.2.5",
       "license": "MIT",
       "dependencies": {
-        "axios": "^1.6.0",
-        "crypto-js": "^4.2.0"
+        "axios": "1.19.0"
       },
       "devDependencies": {
-        "electron": "^28.0.0",
-        "electron-builder": "^26.4.0",
-        "electron-packager": "^17.1.2"
+        "electron": "43.4.1",
+        "electron-builder": "26.15.3"
       }
     },
-    "node_modules/@develar/schema-utils": {
-      "version": "2.6.5",
-      "resolved": "https://registry.npmjs.org/@develar/schema-utils/-/schema-utils-2.6.5.tgz",
-      "integrity": "sha512-0cp4PsWQ/9avqTVMCtZ+GirikIA36ikvjtHweU4/j8yLtgObI0+JUPhYFScgwlteveGB1rt3Cm8UhN04XayDig==",
+    "node_modules/@electron-internal/extract-zip": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/@electron-internal/extract-zip/-/extract-zip-1.0.5.tgz",
+      "integrity": "sha512-+bqFCP98pLI0Tt0XQo1TmlXtwjWchISndDOxCkEcIuUgXWpBnLyRI+2DU+mesvnMMX6L1XDqYNA0lXNDHd/yiA==",
       "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ajv": "^6.12.0",
-        "ajv-keywords": "^3.4.1"
-      },
+      "license": "BSD-2-Clause",
       "engines": {
-        "node": ">= 8.9.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/webpack"
+        "node": ">=22.12.0"
       }
     },
     "node_modules/@electron/asar": {
@@ -55,9 +45,9 @@
       }
     },
     "node_modules/@electron/asar/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -99,9 +89,9 @@
       }
     },
     "node_modules/@electron/fuses/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -121,28 +111,6 @@
         "node": ">= 10.0.0"
       }
     },
-    "node_modules/@electron/get": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/@electron/get/-/get-2.0.3.tgz",
-      "integrity": "sha512-Qkzpg2s9GnVV2I2BjRksUi43U5e6+zaQMcjoJy0C+C5oxaKl+fmckGDQFtRpZpZV0NQekuZZ+tGz7EA9TVnQtQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.1.1",
-        "env-paths": "^2.2.0",
-        "fs-extra": "^8.1.0",
-        "got": "^11.8.5",
-        "progress": "^2.0.3",
-        "semver": "^6.2.0",
-        "sumchecker": "^3.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "optionalDependencies": {
-        "global-agent": "^3.0.0"
-      }
-    },
     "node_modules/@electron/notarize": {
       "version": "2.5.0",
       "resolved": "https://registry.npmjs.org/@electron/notarize/-/notarize-2.5.0.tgz",
@@ -175,9 +143,9 @@
       }
     },
     "node_modules/@electron/notarize/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -271,26 +239,18 @@
       }
     },
     "node_modules/@electron/rebuild": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/@electron/rebuild/-/rebuild-4.0.1.tgz",
-      "integrity": "sha512-iMGXb6Ib7H/Q3v+BKZJoETgF9g6KMNZVbsO4b7Dmpgb5qTFqyFTzqW9F3TOSHdybv2vKYKzSS9OiZL+dcJb+1Q==",
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/@electron/rebuild/-/rebuild-4.2.0.tgz",
+      "integrity": "sha512-RKL/O+jGoXJMxrx/5771y1n0xTKmFuOYGO3gMmwypBM6rsH0kou0mswwdXA2JrhIkE4xyC7v9vGk0n6NPzgOxQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@malept/cross-spawn-promise": "^2.0.0",
-        "chalk": "^4.0.0",
         "debug": "^4.1.1",
-        "detect-libc": "^2.0.1",
-        "got": "^11.7.0",
-        "graceful-fs": "^4.2.11",
         "node-abi": "^4.2.0",
         "node-api-version": "^0.2.1",
-        "node-gyp": "^11.2.0",
-        "ora": "^5.1.0",
-        "read-binary-file-arch": "^1.0.6",
-        "semver": "^7.3.5",
-        "tar": "^6.0.5",
-        "yargs": "^17.0.1"
+        "node-gyp": "^12.2.0",
+        "read-binary-file-arch": "^1.0.6"
       },
       "bin": {
         "electron-rebuild": "lib/cli.js"
@@ -299,19 +259,6 @@
         "node": ">=22.12.0"
       }
     },
-    "node_modules/@electron/rebuild/node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
     "node_modules/@electron/universal": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/@electron/universal/-/universal-2.0.3.tgz",
@@ -332,9 +279,9 @@
       }
     },
     "node_modules/@electron/universal/node_modules/brace-expansion": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
+      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -342,9 +289,9 @@
       }
     },
     "node_modules/@electron/universal/node_modules/fs-extra": {
-      "version": "11.3.3",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.3.tgz",
-      "integrity": "sha512-VWSRii4t0AFm6ixFFmLLx1t7wS1gh+ckoa84aOeapGum0h+EZd1EhEumSB+ZdDLnEPuucsVB9oB7cxJHap6Afg==",
+      "version": "11.4.0",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.4.0.tgz",
+      "integrity": "sha512-EQsFzMUJkCKGr1ePqlYADkIUmHW1s3ZXr5Yqy6wbGrfUCphpl2maM/kyOIRA2HpP3AaFQTZXD4ldjek+nccddA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -357,9 +304,9 @@
       }
     },
     "node_modules/@electron/universal/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -370,13 +317,13 @@
       }
     },
     "node_modules/@electron/universal/node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^2.0.2"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -402,6 +349,7 @@
       "dev": true,
       "license": "BSD-2-Clause",
       "optional": true,
+      "peer": true,
       "dependencies": {
         "cross-dirname": "^0.1.0",
         "debug": "^4.3.4",
@@ -417,12 +365,13 @@
       }
     },
     "node_modules/@electron/windows-sign/node_modules/fs-extra": {
-      "version": "11.3.3",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.3.tgz",
-      "integrity": "sha512-VWSRii4t0AFm6ixFFmLLx1t7wS1gh+ckoa84aOeapGum0h+EZd1EhEumSB+ZdDLnEPuucsVB9oB7cxJHap6Afg==",
+      "version": "11.4.0",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.4.0.tgz",
+      "integrity": "sha512-EQsFzMUJkCKGr1ePqlYADkIUmHW1s3ZXr5Yqy6wbGrfUCphpl2maM/kyOIRA2HpP3AaFQTZXD4ldjek+nccddA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "dependencies": {
         "graceful-fs": "^4.2.0",
         "jsonfile": "^6.0.1",
@@ -433,12 +382,13 @@
       }
     },
     "node_modules/@electron/windows-sign/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "dependencies": {
         "universalify": "^2.0.0"
       },
@@ -453,136 +403,11 @@
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "engines": {
         "node": ">= 10.0.0"
       }
     },
-    "node_modules/@isaacs/balanced-match": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/@isaacs/balanced-match/-/balanced-match-4.0.1.tgz",
-      "integrity": "sha512-yzMTt9lEb8Gv7zRioUilSglI0c0smZ9k5D65677DLWLtWJaXIS3CqcGyUFByYKlnUj6TkjLVs54fBl6+TiGQDQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
-    "node_modules/@isaacs/brace-expansion": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/@isaacs/brace-expansion/-/brace-expansion-5.0.0.tgz",
-      "integrity": "sha512-ZT55BDLV0yv0RBm2czMiZ+SqCGO7AvmOM3G/w2xhVPH+te0aKgFjmBvGlL1dH+ql2tgGO3MVrbb3jCKyvpgnxA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@isaacs/balanced-match": "^4.0.1"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
-    "node_modules/@isaacs/cliui": {
-      "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
-      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "string-width": "^5.1.2",
-        "string-width-cjs": "npm:string-width@^4.2.0",
-        "strip-ansi": "^7.0.1",
-        "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
-        "wrap-ansi": "^8.1.0",
-        "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@isaacs/cliui/node_modules/ansi-regex": {
-      "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
-      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-regex?sponsor=1"
-      }
-    },
-    "node_modules/@isaacs/cliui/node_modules/ansi-styles": {
-      "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
-      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/@isaacs/cliui/node_modules/emoji-regex": {
-      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
-      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@isaacs/cliui/node_modules/string-width": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
-      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "eastasianwidth": "^0.2.0",
-        "emoji-regex": "^9.2.2",
-        "strip-ansi": "^7.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@isaacs/cliui/node_modules/strip-ansi": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
-      "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
-      }
-    },
-    "node_modules/@isaacs/cliui/node_modules/wrap-ansi": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
-      "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^6.1.0",
-        "string-width": "^5.0.1",
-        "strip-ansi": "^7.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
     "node_modules/@isaacs/fs-minipass": {
       "version": "4.0.1",
       "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
@@ -652,9 +477,9 @@
       }
     },
     "node_modules/@malept/flatpak-bundler/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -674,65 +499,69 @@
         "node": ">= 10.0.0"
       }
     },
-    "node_modules/@npmcli/agent": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/agent/-/agent-3.0.0.tgz",
-      "integrity": "sha512-S79NdEgDQd/NGCay6TCoVzXSj74skRZIKJcpJjC5lOq34SZzyI6MqtiiWoiVWoVrTcGjNeC4ipbh1VIHlpfF5Q==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "agent-base": "^7.1.0",
-        "http-proxy-agent": "^7.0.0",
-        "https-proxy-agent": "^7.0.1",
-        "lru-cache": "^10.0.1",
-        "socks-proxy-agent": "^8.0.3"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
-    "node_modules/@npmcli/agent/node_modules/lru-cache": {
-      "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/@npmcli/fs": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-4.0.0.tgz",
-      "integrity": "sha512-/xGlezI6xfGO9NwuJlnwz/K14qD1kCSAGtacBHnGzeAIuJGazcp45KP5NuyARXoKb7cwulAGWVsbeSxdG/cb0Q==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "semver": "^7.3.5"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
-    "node_modules/@npmcli/fs/node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/@pkgjs/parseargs": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
-      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
+    "node_modules/@noble/hashes": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.3.0.tgz",
+      "integrity": "sha512-oN+QwyX7VSHotibwubG3kpzbwKrfnyR6OOO+3Nk/53ADL7FmgHHz4TgrbaYKvvOw09u6QTx0oiH1cNCIOuN0CQ==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
-        "node": ">=14"
+        "node": ">= 20.19.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/@peculiar/asn1-schema": {
+      "version": "2.9.3",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-schema/-/asn1-schema-2.9.3.tgz",
+      "integrity": "sha512-SOux4+jikCnOwoJvpBp/grOqzFmJPnNSwe3sAg1Bn93YdmCiDtvolZifJIhiRq0UWMTnLRPj9/ZCMAc2W9VsMQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/utils": "^2.0.2",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/@peculiar/json-schema": {
+      "version": "1.1.12",
+      "resolved": "https://registry.npmjs.org/@peculiar/json-schema/-/json-schema-1.1.12.tgz",
+      "integrity": "sha512-coUfuoMeIB7B8/NMekxaDzLhaYmp0HZNPEjYRm9goRou8UZIC3z21s0sL9AWoCw4EG876QyO3kYrc61WNF9B/w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/@peculiar/utils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@peculiar/utils/-/utils-2.0.3.tgz",
+      "integrity": "sha512-+oL3HPFRIZ1St2K50lWCXiioIgSoxzz7R1J3uF6neO2yl1sgmpgY6XXJH4BdpoDkMWznQTeYF6oWNDZLCdQ4eQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/@peculiar/webcrypto": {
+      "version": "1.7.1",
+      "resolved": "https://registry.npmjs.org/@peculiar/webcrypto/-/webcrypto-1.7.1.tgz",
+      "integrity": "sha512-ODOov0sGMJMf3jPonOkgGqPknTsu+DdQ7kD++gz8aI+aFMOMHFbWAA2taqXXVTdP+OTOQR/znGvSpmkeI0WTYQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.7.0",
+        "@peculiar/json-schema": "^1.1.12",
+        "@peculiar/utils": "^2.0.2",
+        "tslib": "^2.8.1",
+        "webcrypto-core": "^1.9.2"
+      },
+      "engines": {
+        "node": ">=14.18.0"
       }
     },
     "node_modules/@sindresorhus/is": {
@@ -775,9 +604,9 @@
       }
     },
     "node_modules/@types/debug": {
-      "version": "4.1.12",
-      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.12.tgz",
-      "integrity": "sha512-vIChWdVG3LG1SMxEvI/AK+FWJthlrqlTu7fbrlywTkkaONwk/UAGaULXRlf8vkzFBLVm0zkMdCquhL5aOjhXPQ==",
+      "version": "4.1.13",
+      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
+      "integrity": "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -819,25 +648,13 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "18.19.130",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-18.19.130.tgz",
-      "integrity": "sha512-GRaXQx6jGfL8sKfaIDD6OupbIHBr9jv7Jnaml9tB7l4v068PAOXqfcujMMo5PhbIs6ggR1XODELqahT2R8v0fg==",
+      "version": "24.13.3",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
+      "integrity": "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "undici-types": "~5.26.4"
-      }
-    },
-    "node_modules/@types/plist": {
-      "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/@types/plist/-/plist-3.0.5.tgz",
-      "integrity": "sha512-E6OCaRmAe4WDmWNsL/9RMqdkkzDCY1etutkflWk4c+AcjDU07Pcz1fQwTX0TQz+Pxqn9i4L1TU3UFpjnrcDgxA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@types/node": "*",
-        "xmlbuilder": ">=11.0.1"
+        "undici-types": "~7.18.0"
       }
     },
     "node_modules/@types/responselike": {
@@ -850,50 +667,24 @@
         "@types/node": "*"
       }
     },
-    "node_modules/@types/verror": {
-      "version": "1.10.11",
-      "resolved": "https://registry.npmjs.org/@types/verror/-/verror-1.10.11.tgz",
-      "integrity": "sha512-RlDm9K7+o5stv0Co8i8ZRGxDbrTxhJtgjqjFyVh/tXQyl/rYtTKlnTvZ88oSTeYREWurwx20Js4kTuKCsFkUtg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/@types/yauzl": {
-      "version": "2.10.3",
-      "resolved": "https://registry.npmjs.org/@types/yauzl/-/yauzl-2.10.3.tgz",
-      "integrity": "sha512-oJoftv0LSuaDZE3Le4DbKX+KS9G36NzOeSap90UIK0yMA/NhKJhqlSGtNDORNRaIbQfzjXDrQa0ytJ6mNRGz/Q==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@types/node": "*"
-      }
-    },
     "node_modules/@xmldom/xmldom": {
-      "version": "0.8.11",
-      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.11.tgz",
-      "integrity": "sha512-cQzWCtO6C8TQiYl1ruKNn2U6Ao4o4WBBcbL61yJl84x+j5sOWWFU9X7DpND8XZG3daDppSsigMdfAIl2upQBRw==",
+      "version": "0.8.14",
+      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.14.tgz",
+      "integrity": "sha512-T4EDRUBVZYRldYApjEJiU0e1stYWaRAX7CuSnKzrpwdZKo53zGV8/pqfzV6FfwNl9YThD2OumQYvqtvjvgG7aQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
       }
     },
-    "node_modules/7zip-bin": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/7zip-bin/-/7zip-bin-5.2.0.tgz",
-      "integrity": "sha512-ukTPVhqG4jNzMro2qA9HSCSSVJN3aN7tlb+hfqYCt3ER0yWroeA2VR38MNrOHLQ/cVj+DaIMad0kFCtWWowh/A==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/abbrev": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-3.0.1.tgz",
-      "integrity": "sha512-AO2ac6pjRB3SJmGJo+v5/aK6Omggp6fsLrs6wN9bd35ulu4cCwaAU9+7ZhXjeqHVkaHThLuzH0nZr0YpCDhygg==",
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-4.0.0.tgz",
+      "integrity": "sha512-a1wflyaL0tHtJSmLSOVybYhy22vRih4eduhhrkcjgrWGnRfrZtovJ2FRjxuTtkkj47O/baf0R86QU5OuYpz8fA==",
       "dev": true,
       "license": "ISC",
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "node": "^20.17.0 || >=22.9.0"
       }
     },
     "node_modules/agent-base": {
@@ -907,33 +698,22 @@
       }
     },
     "node_modules/ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "fast-deep-equal": "^3.1.1",
-        "fast-json-stable-stringify": "^2.0.0",
-        "json-schema-traverse": "^0.4.1",
-        "uri-js": "^4.2.2"
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
       },
       "funding": {
         "type": "github",
         "url": "https://github.com/sponsors/epoberezkin"
       }
     },
-    "node_modules/ajv-keywords": {
-      "version": "3.5.2",
-      "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-3.5.2.tgz",
-      "integrity": "sha512-5p6WTN0DdTGVQk6VjcEju19IgaHudalcfabD7yhDGeA6bcQnmL+CpveLJq/3hvfwd1aof6L386Ougkx6RfyMIQ==",
-      "dev": true,
-      "license": "MIT",
-      "peerDependencies": {
-        "ajv": "^6.9.1"
-      }
-    },
     "node_modules/ansi-regex": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
@@ -960,39 +740,36 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
-    "node_modules/app-builder-bin": {
-      "version": "5.0.0-alpha.12",
-      "resolved": "https://registry.npmjs.org/app-builder-bin/-/app-builder-bin-5.0.0-alpha.12.tgz",
-      "integrity": "sha512-j87o0j6LqPL3QRr8yid6c+Tt5gC7xNfYo6uQIQkorAC6MpeayVMZrEDzKmJJ/Hlv7EnOQpaRm53k6ktDYZyB6w==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/app-builder-lib": {
-      "version": "26.4.0",
-      "resolved": "https://registry.npmjs.org/app-builder-lib/-/app-builder-lib-26.4.0.tgz",
-      "integrity": "sha512-Uas6hNe99KzP3xPWxh5LGlH8kWIVjZixzmMJHNB9+6hPyDpjc7NQMkVgi16rQDdpCFy22ZU5sp8ow7tvjeMgYQ==",
+      "version": "26.15.3",
+      "resolved": "https://registry.npmjs.org/app-builder-lib/-/app-builder-lib-26.15.3.tgz",
+      "integrity": "sha512-2VnyWkqsP5v5XbBhL3tD5Syx8iNPBYsoU7kY4S2fz7wg8Rj/nztWKCUzGKaFRTv0Xwf3/H058CR1Kvtd/3lRow==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@develar/schema-utils": "~2.6.5",
         "@electron/asar": "3.4.1",
         "@electron/fuses": "^1.8.0",
+        "@electron/get": "^3.0.0",
         "@electron/notarize": "2.5.0",
         "@electron/osx-sign": "1.3.3",
-        "@electron/rebuild": "4.0.1",
+        "@electron/rebuild": "^4.0.4",
         "@electron/universal": "2.0.3",
         "@malept/flatpak-bundler": "^0.4.0",
+        "@noble/hashes": "^2.2.0",
+        "@peculiar/webcrypto": "^1.7.1",
         "@types/fs-extra": "9.0.13",
+        "ajv": "^8.18.0",
+        "asn1js": "^3.0.10",
         "async-exit-hook": "^2.0.1",
-        "builder-util": "26.3.4",
-        "builder-util-runtime": "9.5.1",
+        "builder-util": "26.15.3",
+        "builder-util-runtime": "9.7.0",
         "chromium-pickle-js": "^0.2.0",
         "ci-info": "4.3.1",
         "debug": "^4.3.4",
         "dotenv": "^16.4.5",
         "dotenv-expand": "^11.0.6",
         "ejs": "^3.1.8",
-        "electron-publish": "26.3.4",
+        "electron-publish": "26.15.3",
         "fs-extra": "^10.1.0",
         "hosted-git-info": "^4.1.0",
         "isbinaryfile": "^5.0.0",
@@ -1000,21 +777,87 @@
         "js-yaml": "^4.1.0",
         "json5": "^2.2.3",
         "lazy-val": "^1.0.5",
-        "minimatch": "^10.0.3",
+        "minimatch": "^10.2.5",
+        "pkijs": "^3.4.0",
         "plist": "3.1.0",
+        "proper-lockfile": "^4.1.2",
         "resedit": "^1.7.0",
         "semver": "~7.7.3",
-        "tar": "^6.1.12",
+        "tar": "^7.5.7",
         "temp-file": "^3.4.0",
         "tiny-async-pool": "1.3.0",
+        "unzipper": "^0.12.3",
         "which": "^5.0.0"
       },
       "engines": {
         "node": ">=14.0.0"
       },
       "peerDependencies": {
-        "dmg-builder": "26.4.0",
-        "electron-builder-squirrel-windows": "26.4.0"
+        "dmg-builder": "26.15.3",
+        "electron-builder-squirrel-windows": "26.15.3"
+      }
+    },
+    "node_modules/app-builder-lib/node_modules/@electron/get": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@electron/get/-/get-3.1.0.tgz",
+      "integrity": "sha512-F+nKc0xW+kVbBRhFzaMgPy3KwmuNTYX1fx6+FxxoSnNgwYX6LD7AKBTWkU0MQ6IBoe7dz069CNkR673sPAgkCQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.1.1",
+        "env-paths": "^2.2.0",
+        "fs-extra": "^8.1.0",
+        "got": "^11.8.5",
+        "progress": "^2.0.3",
+        "semver": "^6.2.0",
+        "sumchecker": "^3.0.1"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "optionalDependencies": {
+        "global-agent": "^3.0.0"
+      }
+    },
+    "node_modules/app-builder-lib/node_modules/@electron/get/node_modules/fs-extra": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-8.1.0.tgz",
+      "integrity": "sha512-yhlQgA6mnOJUKOsRUFsgJdQCvkKhcz8tlZG5HBQfReYZy46OwLcY+Zia0mtdHsOo9y/hP+CxMN0TU9QxoOtG4g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^4.0.0",
+        "universalify": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=6 <7 || >=8"
+      }
+    },
+    "node_modules/app-builder-lib/node_modules/@electron/get/node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/app-builder-lib/node_modules/ci-info": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-4.3.1.tgz",
+      "integrity": "sha512-Wdy2Igu8OcBpI2pZePZ5oWjPC38tmDVx5WKUXKwlLYkA0ozo85sLsLvkBbBn/sZaSCMFOGZJ14fvW9t5/d7kdA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/sibiraj-s"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
       }
     },
     "node_modules/app-builder-lib/node_modules/fs-extra": {
@@ -1032,10 +875,10 @@
         "node": ">=12"
       }
     },
-    "node_modules/app-builder-lib/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+    "node_modules/app-builder-lib/node_modules/fs-extra/node_modules/jsonfile": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1045,20 +888,7 @@
         "graceful-fs": "^4.1.6"
       }
     },
-    "node_modules/app-builder-lib/node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/app-builder-lib/node_modules/universalify": {
+    "node_modules/app-builder-lib/node_modules/fs-extra/node_modules/universalify": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
       "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
@@ -1068,6 +898,19 @@
         "node": ">= 10.0.0"
       }
     },
+    "node_modules/app-builder-lib/node_modules/semver": {
+      "version": "7.7.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
+      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/argparse": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
@@ -1075,26 +918,19 @@
       "dev": true,
       "license": "Python-2.0"
     },
-    "node_modules/assert-plus": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/assert-plus/-/assert-plus-1.0.0.tgz",
-      "integrity": "sha512-NfJ4UzBCcQGLDlQq7nHxH+tv3kyZ0hHQqF5BO6J7tNJeP5do1llPr8dZ8zHonfhAu0PHAdMkSo+8o0wxg9lZWw==",
+    "node_modules/asn1js": {
+      "version": "3.0.10",
+      "resolved": "https://registry.npmjs.org/asn1js/-/asn1js-3.0.10.tgz",
+      "integrity": "sha512-S2s3aOytiKdFRdulw2qPE51MzjzVOisppcVv7jVFR+Kw0kxwvFrDcYA0h7Ndqbmj0HkMIXYWaoj7fli8kgx1eg==",
       "dev": true,
-      "license": "MIT",
-      "optional": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "pvtsutils": "^1.3.6",
+        "pvutils": "^1.1.5",
+        "tslib": "^2.8.1"
+      },
       "engines": {
-        "node": ">=0.8"
-      }
-    },
-    "node_modules/astral-regex": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/astral-regex/-/astral-regex-2.0.0.tgz",
-      "integrity": "sha512-Z7tMw1ytTXt5jqMcOP+OQteU1VuNK9Y02uuJtKQ1Sv69jXQKKg5cibLwGJow8yzZP+eAc18EmLGPal0bp36rvQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "engines": {
-        "node": ">=8"
+        "node": ">=12.0.0"
       }
     },
     "node_modules/async": {
@@ -1130,25 +966,23 @@
         "node": ">= 4.0.0"
       }
     },
-    "node_modules/author-regex": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/author-regex/-/author-regex-1.0.0.tgz",
-      "integrity": "sha512-KbWgR8wOYRAPekEmMXrYYdc7BRyhn2Ftk7KWfMUnQ43hFdojWEFRxhhRUm3/OFEdPa1r0KAvTTg9YQK57xTe0g==",
+    "node_modules/aws4": {
+      "version": "1.13.2",
+      "resolved": "https://registry.npmjs.org/aws4/-/aws4-1.13.2.tgz",
+      "integrity": "sha512-lHe62zvbTB5eEABUVi/AwVh0ZKY9rMMDhmm+eeyuuUQbQ3+J+fONVQOZyj+DdrvD4BY33uYniyRJ4UJIaSKAfw==",
       "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.8"
-      }
+      "license": "MIT"
     },
     "node_modules/axios": {
-      "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.2.tgz",
-      "integrity": "sha512-VPk9ebNqPcy5lRGuSlKx752IlDatOjT9paPlm8A7yOuW2Fbvp4X3JznJtT4f0GzGLLiWE9W8onz51SqLYwzGaA==",
+      "version": "1.19.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.19.0.tgz",
+      "integrity": "sha512-ht/iuYZXEjFxLH/Hkezgd7m6JKlHHXEUSneaDz8uZe1Gj5QZtCnpyDsckvAiEnT89OEbCLmnte4R4sn7P0EKFw==",
       "license": "MIT",
       "dependencies": {
-        "follow-redirects": "^1.15.6",
-        "form-data": "^4.0.4",
-        "proxy-from-env": "^1.1.0"
+        "follow-redirects": "^1.16.0",
+        "form-data": "^4.0.6",
+        "https-proxy-agent": "^5.0.1",
+        "proxy-from-env": "^2.1.0"
       }
     },
     "node_modules/balanced-match": {
@@ -1179,18 +1013,6 @@
       ],
       "license": "MIT"
     },
-    "node_modules/bl": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
-      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "buffer": "^5.5.0",
-        "inherits": "^2.0.4",
-        "readable-stream": "^3.4.0"
-      }
-    },
     "node_modules/bluebird": {
       "version": "3.7.2",
       "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz",
@@ -1208,9 +1030,9 @@
       "optional": true
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1218,54 +1040,6 @@
         "concat-map": "0.0.1"
       }
     },
-    "node_modules/buffer": {
-      "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
-      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "base64-js": "^1.3.1",
-        "ieee754": "^1.1.13"
-      }
-    },
-    "node_modules/buffer-crc32": {
-      "version": "0.2.13",
-      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
-      "integrity": "sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/buffer-equal": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/buffer-equal/-/buffer-equal-1.0.1.tgz",
-      "integrity": "sha512-QoV3ptgEaQpvVwbXdSO39iqPQTCxSF7A5U99AxbHYqUdCizL/lH2Z0A2y6nbZucxMEOtNyZfG2s6gsVugGpKkg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
     "node_modules/buffer-from": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
@@ -1274,16 +1048,14 @@
       "license": "MIT"
     },
     "node_modules/builder-util": {
-      "version": "26.3.4",
-      "resolved": "https://registry.npmjs.org/builder-util/-/builder-util-26.3.4.tgz",
-      "integrity": "sha512-aRn88mYMktHxzdqDMF6Ayj0rKoX+ZogJ75Ck7RrIqbY/ad0HBvnS2xA4uHfzrGr5D2aLL3vU6OBEH4p0KMV2XQ==",
+      "version": "26.15.3",
+      "resolved": "https://registry.npmjs.org/builder-util/-/builder-util-26.15.3.tgz",
+      "integrity": "sha512-q2hn7Mbo2nFNkVekPiHFx6Nfo3hURmES3tfBn+k5Pqxl2RkmP3QGqZUhH/q9Pch/4G05NRhPjDlVj1O8q4Txvw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/debug": "^4.1.6",
-        "7zip-bin": "~5.2.0",
-        "app-builder-bin": "5.0.0-alpha.12",
-        "builder-util-runtime": "9.5.1",
+        "builder-util-runtime": "9.7.0",
         "chalk": "^4.1.2",
         "cross-spawn": "^7.0.6",
         "debug": "^4.3.4",
@@ -1296,12 +1068,15 @@
         "stat-mode": "^1.0.0",
         "temp-file": "^3.4.0",
         "tiny-async-pool": "1.3.0"
+      },
+      "engines": {
+        "node": ">=14.0.0"
       }
     },
     "node_modules/builder-util-runtime": {
-      "version": "9.5.1",
-      "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.5.1.tgz",
-      "integrity": "sha512-qt41tMfgHTllhResqM5DcnHyDIWNgzHvuY2jDcYP9iaGpkWxTUzV6GQjDeLnlR1/DtdlcsWQbA7sByMpmJFTLQ==",
+      "version": "9.7.0",
+      "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.7.0.tgz",
+      "integrity": "sha512-g/kR520giAFYkSXTzcmF3kqQq7wi8F6N6SzeDgZrqTBN+VHdmgWOyTdD1yD7AATDId/yXLvuP34CxW46/BwCdw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1327,10 +1102,24 @@
         "node": ">=12"
       }
     },
+    "node_modules/builder-util/node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
     "node_modules/builder-util/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1350,119 +1139,14 @@
         "node": ">= 10.0.0"
       }
     },
-    "node_modules/cacache": {
-      "version": "19.0.1",
-      "resolved": "https://registry.npmjs.org/cacache/-/cacache-19.0.1.tgz",
-      "integrity": "sha512-hdsUxulXCi5STId78vRVYEtDAjq99ICAUktLTeTYsLoTE6Z8dS0c8pWNCxwdrk9YfJeobDZc2Y186hD/5ZQgFQ==",
+    "node_modules/bytestreamjs": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/bytestreamjs/-/bytestreamjs-2.0.1.tgz",
+      "integrity": "sha512-U1Z/ob71V/bXfVABvNr/Kumf5VyeQRBEm6Txb0PQ6S7V5GpBM3w4Cbqz/xPDicR5tN0uvDifng8C+5qECeGwyQ==",
       "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "@npmcli/fs": "^4.0.0",
-        "fs-minipass": "^3.0.0",
-        "glob": "^10.2.2",
-        "lru-cache": "^10.0.1",
-        "minipass": "^7.0.3",
-        "minipass-collect": "^2.0.1",
-        "minipass-flush": "^1.0.5",
-        "minipass-pipeline": "^1.2.4",
-        "p-map": "^7.0.2",
-        "ssri": "^12.0.0",
-        "tar": "^7.4.3",
-        "unique-filename": "^4.0.0"
-      },
+      "license": "BSD-3-Clause",
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
-    "node_modules/cacache/node_modules/brace-expansion": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0"
-      }
-    },
-    "node_modules/cacache/node_modules/chownr": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
-      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/cacache/node_modules/glob": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
-      "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "foreground-child": "^3.1.0",
-        "jackspeak": "^3.1.2",
-        "minimatch": "^9.0.4",
-        "minipass": "^7.1.2",
-        "package-json-from-dist": "^1.0.0",
-        "path-scurry": "^1.11.1"
-      },
-      "bin": {
-        "glob": "dist/esm/bin.mjs"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/cacache/node_modules/lru-cache": {
-      "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/cacache/node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/cacache/node_modules/tar": {
-      "version": "7.5.2",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.2.tgz",
-      "integrity": "sha512-7NyxrTE4Anh8km8iEy7o0QYPs+0JKBTj5ZaqHg6B39erLg0qYXN3BijtShwbsNSvQ+LN75+KV+C4QR/f6Gwnpg==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "@isaacs/fs-minipass": "^4.0.0",
-        "chownr": "^3.0.0",
-        "minipass": "^7.1.2",
-        "minizlib": "^3.1.0",
-        "yallist": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/cacache/node_modules/yallist": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
-      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=18"
+        "node": ">=6.0.0"
       }
     },
     "node_modules/cacheable-lookup": {
@@ -1525,13 +1209,13 @@
       }
     },
     "node_modules/chownr": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-2.0.0.tgz",
-      "integrity": "sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
+      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "engines": {
-        "node": ">=10"
+        "node": ">=18"
       }
     },
     "node_modules/chromium-pickle-js": {
@@ -1542,9 +1226,9 @@
       "license": "MIT"
     },
     "node_modules/ci-info": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-4.3.1.tgz",
-      "integrity": "sha512-Wdy2Igu8OcBpI2pZePZ5oWjPC38tmDVx5WKUXKwlLYkA0ozo85sLsLvkBbBn/sZaSCMFOGZJ14fvW9t5/d7kdA==",
+      "version": "4.4.0",
+      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-4.4.0.tgz",
+      "integrity": "sha512-77PSwercCZU2Fc4sX94eF8k8Pxte6JAwL4/ICZLFjJLqegs7kCuAsqqj/70NQF6TvDpgFjkubQB2FW2ZZddvQg==",
       "dev": true,
       "funding": [
         {
@@ -1557,50 +1241,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/cli-cursor": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-3.1.0.tgz",
-      "integrity": "sha512-I/zHAwsKf9FqGoXM4WWRACob9+SNukZTd94DWF57E4toouRulbCxcUh6RKUEOQlYTHJnzkPMySvPNaaSLNfLZw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "restore-cursor": "^3.1.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/cli-spinners": {
-      "version": "2.9.2",
-      "resolved": "https://registry.npmjs.org/cli-spinners/-/cli-spinners-2.9.2.tgz",
-      "integrity": "sha512-ywqV+5MmyL4E7ybXgKys4DugZbX0FC6LnwrhjuykIjnK9k8OQacQ7axGKnjDXWNhns0xot3bZI5h55H8yo9cJg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/cli-truncate": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/cli-truncate/-/cli-truncate-2.1.0.tgz",
-      "integrity": "sha512-n8fOixwDD6b/ObinzTrp1ZKFzbgvKZvuz/TvejnLn1aQfC6r52XEx85FmuC+3HI+JM7coBRXUvNqEU2PHVrHpg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "slice-ansi": "^3.0.0",
-        "string-width": "^4.2.0"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/cliui": {
       "version": "8.0.1",
       "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
@@ -1616,16 +1256,6 @@
         "node": ">=12"
       }
     },
-    "node_modules/clone": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/clone/-/clone-1.0.4.tgz",
-      "integrity": "sha512-JQHZ2QMW6l3aH/j6xCqQThY/9OH4D/9ls34cgkUBiEeocRTU04tHfKPBsUK1PqZCUQM7GiA0IIXJSuXHI64Kbg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.8"
-      }
-    },
     "node_modules/clone-response": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/clone-response/-/clone-response-1.0.3.tgz",
@@ -1699,23 +1329,11 @@
       "license": "MIT"
     },
     "node_modules/core-util-is": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz",
-      "integrity": "sha512-3lqz5YjWTYnW6dlDa5TLaTCcShfar1e40rmcJVwCBJC6mWlFuj0eCHIElmG1g5kyuJ/GD+8Wn4FFCcz4gJPfaQ==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
+      "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
       "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/crc": {
-      "version": "3.8.0",
-      "resolved": "https://registry.npmjs.org/crc/-/crc-3.8.0.tgz",
-      "integrity": "sha512-iX3mfgcTMIq3ZKLIsVFAbv7+Mc10kxabAGQb8HvjA1o3T1PIYprbakQ65d3I+2HGHt6nSKkM9PYjgoJO2KcFBQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "buffer": "^5.1.0"
-      }
+      "license": "MIT"
     },
     "node_modules/cross-dirname": {
       "version": "0.1.0",
@@ -1723,7 +1341,8 @@
       "integrity": "sha512-+R08/oI0nl3vfPcqftZRpytksBXDzOUveBq/NBVx0sUp1axwzPQrKinNx5yd5sxPu8j1wIy8AfnVQ+5eFdha6Q==",
       "dev": true,
       "license": "MIT",
-      "optional": true
+      "optional": true,
+      "peer": true
     },
     "node_modules/cross-spawn": {
       "version": "7.0.6",
@@ -1740,77 +1359,6 @@
         "node": ">= 8"
       }
     },
-    "node_modules/cross-spawn-windows-exe": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/cross-spawn-windows-exe/-/cross-spawn-windows-exe-1.2.0.tgz",
-      "integrity": "sha512-mkLtJJcYbDCxEG7Js6eUnUNndWjyUZwJ3H7bErmmtOYU/Zb99DyUkpamuIZE0b3bhmJyZ7D90uS6f+CGxRRjOw==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://github.com/sponsors/malept"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/subscription/pkg/npm-cross-spawn-windows-exe?utm_medium=referral&utm_source=npm_fund"
-        }
-      ],
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@malept/cross-spawn-promise": "^1.1.0",
-        "is-wsl": "^2.2.0",
-        "which": "^2.0.2"
-      },
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/cross-spawn-windows-exe/node_modules/@malept/cross-spawn-promise": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@malept/cross-spawn-promise/-/cross-spawn-promise-1.1.1.tgz",
-      "integrity": "sha512-RTBGWL5FWQcg9orDOCcp4LvItNzUPcyEU9bwaeJX0rJ1IQxzucC48Y0/sQLp/g6t99IQgAlGIaesJS+gTn7tVQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://github.com/sponsors/malept"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/subscription/pkg/npm-.malept-cross-spawn-promise?utm_medium=referral&utm_source=npm_fund"
-        }
-      ],
-      "license": "Apache-2.0",
-      "dependencies": {
-        "cross-spawn": "^7.0.1"
-      },
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/cross-spawn-windows-exe/node_modules/isexe": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/cross-spawn-windows-exe/node_modules/which": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "isexe": "^2.0.0"
-      },
-      "bin": {
-        "node-which": "bin/node-which"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
     "node_modules/cross-spawn/node_modules/isexe": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
@@ -1834,17 +1382,10 @@
         "node": ">= 8"
       }
     },
-    "node_modules/crypto-js": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/crypto-js/-/crypto-js-4.2.0.tgz",
-      "integrity": "sha512-KALDyEYgpY+Rlob/iriUtjV6d5Eq+Y191A5g4UqLAi8CyGP9N1+FdVbkc1SxKc2r4YAYqG8JzO2KGL+AizD70Q==",
-      "license": "MIT"
-    },
     "node_modules/debug": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
       "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "ms": "^2.1.3"
@@ -1887,19 +1428,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/defaults": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/defaults/-/defaults-1.0.4.tgz",
-      "integrity": "sha512-eFuaLoy/Rxalv2kr+lqMlUnrDWV+3j4pljOIJgLIhI058IQfWJ7vXhyEIHu+HtC738klGALYxOKDO0bQP3tg8A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "clone": "^1.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/defer-to-connect": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/defer-to-connect/-/defer-to-connect-2.0.1.tgz",
@@ -1957,16 +1485,6 @@
         "node": ">=0.4.0"
       }
     },
-    "node_modules/detect-libc": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
-      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/detect-node": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/detect-node/-/detect-node-2.1.0.tgz",
@@ -1987,9 +1505,9 @@
       }
     },
     "node_modules/dir-compare/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -2000,21 +1518,16 @@
       }
     },
     "node_modules/dmg-builder": {
-      "version": "26.4.0",
-      "resolved": "https://registry.npmjs.org/dmg-builder/-/dmg-builder-26.4.0.tgz",
-      "integrity": "sha512-ce4Ogns4VMeisIuCSK0C62umG0lFy012jd8LMZ6w/veHUeX4fqfDrGe+HTWALAEwK6JwKP+dhPvizhArSOsFbg==",
+      "version": "26.15.3",
+      "resolved": "https://registry.npmjs.org/dmg-builder/-/dmg-builder-26.15.3.tgz",
+      "integrity": "sha512-O3zJUFUYHJKgzPqioHxfxzBzlSC1eXCSr79gMSBKBP5AgjjpmrydMsMLotEg9fAJF36vdUncb+4ndRNxoPdlSQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "app-builder-lib": "26.4.0",
-        "builder-util": "26.3.4",
+        "app-builder-lib": "26.15.3",
+        "builder-util": "26.15.3",
         "fs-extra": "^10.1.0",
-        "iconv-lite": "^0.6.2",
         "js-yaml": "^4.1.0"
-      },
-      "optionalDependencies": {
-        "dmg-license": "^1.0.11"
       }
     },
     "node_modules/dmg-builder/node_modules/fs-extra": {
@@ -2033,9 +1546,9 @@
       }
     },
     "node_modules/dmg-builder/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2055,33 +1568,6 @@
         "node": ">= 10.0.0"
       }
     },
-    "node_modules/dmg-license": {
-      "version": "1.0.11",
-      "resolved": "https://registry.npmjs.org/dmg-license/-/dmg-license-1.0.11.tgz",
-      "integrity": "sha512-ZdzmqwKmECOWJpqefloC5OJy1+WZBBse5+MR88z9g9Zn4VY+WYUkAyojmhzJckH5YbbZGcYIuGAkY5/Ys5OM2Q==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "dependencies": {
-        "@types/plist": "^3.0.1",
-        "@types/verror": "^1.10.3",
-        "ajv": "^6.10.0",
-        "crc": "^3.8.0",
-        "iconv-corefoundation": "^1.1.7",
-        "plist": "^3.0.4",
-        "smart-buffer": "^4.0.2",
-        "verror": "^1.10.0"
-      },
-      "bin": {
-        "dmg-license": "bin/dmg-license.js"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/dotenv": {
       "version": "16.6.1",
       "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
@@ -2125,12 +1611,15 @@
         "node": ">= 0.4"
       }
     },
-    "node_modules/eastasianwidth": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
-      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
+    "node_modules/duplexer2": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/duplexer2/-/duplexer2-0.1.4.tgz",
+      "integrity": "sha512-asLFVfWWtJ90ZyOUHMqk7/S2w2guQKxUI2itj3d92ADHhxUSbCMGi1f1cBcJ7xM1To+pE/Khbwo1yuNbMEPKeA==",
       "dev": true,
-      "license": "MIT"
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "readable-stream": "^2.0.2"
+      }
     },
     "node_modules/ejs": {
       "version": "3.1.10",
@@ -2149,37 +1638,37 @@
       }
     },
     "node_modules/electron": {
-      "version": "28.3.3",
-      "resolved": "https://registry.npmjs.org/electron/-/electron-28.3.3.tgz",
-      "integrity": "sha512-ObKMLSPNhomtCOBAxFS8P2DW/4umkh72ouZUlUKzXGtYuPzgr1SYhskhFWgzAsPtUzhL2CzyV2sfbHcEW4CXqw==",
+      "version": "43.4.1",
+      "resolved": "https://registry.npmjs.org/electron/-/electron-43.4.1.tgz",
+      "integrity": "sha512-5b+EuiwkgG5iRcsEL34rimgRpkYp15SsfZOa0pC5kXs0Tb82TH4n95rpQzTZa7yRCbA7tm0WoEbuBL6NaAhAcA==",
       "dev": true,
-      "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
-        "@electron/get": "^2.0.0",
-        "@types/node": "^18.11.18",
-        "extract-zip": "^2.0.1"
+        "@electron-internal/extract-zip": "^1.0.1",
+        "@electron/get": "^5.0.0",
+        "@types/node": "^24.9.0"
       },
       "bin": {
-        "electron": "cli.js"
+        "electron": "cli.js",
+        "install-electron": "install.js"
       },
       "engines": {
-        "node": ">= 12.20.55"
+        "node": ">= 22.12.0"
       }
     },
     "node_modules/electron-builder": {
-      "version": "26.4.0",
-      "resolved": "https://registry.npmjs.org/electron-builder/-/electron-builder-26.4.0.tgz",
-      "integrity": "sha512-FCUqvdq2AULL+Db2SUGgjOYTbrgkPxZtCjqIZGnjH9p29pTWyesQqBIfvQBKa6ewqde87aWl49n/WyI/NyUBog==",
+      "version": "26.15.3",
+      "resolved": "https://registry.npmjs.org/electron-builder/-/electron-builder-26.15.3.tgz",
+      "integrity": "sha512-a1KM5heqS3gQCZzizXEI8RjJy3QVogULPdeSknt76uLDpBIW/HDGsMg/XgP0riP6PI9COsRvFITKKGDqA8fJxA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "app-builder-lib": "26.4.0",
-        "builder-util": "26.3.4",
-        "builder-util-runtime": "9.5.1",
+        "app-builder-lib": "26.15.3",
+        "builder-util": "26.15.3",
+        "builder-util-runtime": "9.7.0",
         "chalk": "^4.1.2",
         "ci-info": "^4.2.0",
-        "dmg-builder": "26.4.0",
+        "dmg-builder": "26.15.3",
         "fs-extra": "^10.1.0",
         "lazy-val": "^1.0.5",
         "simple-update-notifier": "2.0.0",
@@ -2194,15 +1683,15 @@
       }
     },
     "node_modules/electron-builder-squirrel-windows": {
-      "version": "26.4.0",
-      "resolved": "https://registry.npmjs.org/electron-builder-squirrel-windows/-/electron-builder-squirrel-windows-26.4.0.tgz",
-      "integrity": "sha512-7dvalY38xBzWNaoOJ4sqy2aGIEpl2S1gLPkkB0MHu1Hu5xKQ82il1mKSFlXs6fLpXUso/NmyjdHGlSHDRoG8/w==",
+      "version": "26.15.3",
+      "resolved": "https://registry.npmjs.org/electron-builder-squirrel-windows/-/electron-builder-squirrel-windows-26.15.3.tgz",
+      "integrity": "sha512-Jc19XPV9y9+2bAdZPkXuVNGNIEFBq9poHC61l8Kv6FdK7DRG3+Ic0rerC0DXOaeHNz8yW0fg/JnF8GQROOF5MA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
       "dependencies": {
-        "app-builder-lib": "26.4.0",
-        "builder-util": "26.3.4",
+        "app-builder-lib": "26.15.3",
+        "builder-util": "26.15.3",
         "electron-winstaller": "5.4.0"
       }
     },
@@ -2244,219 +1733,19 @@
         "node": ">= 10.0.0"
       }
     },
-    "node_modules/electron-packager": {
-      "version": "17.1.2",
-      "resolved": "https://registry.npmjs.org/electron-packager/-/electron-packager-17.1.2.tgz",
-      "integrity": "sha512-XofXdikjYI7MVBcnXeoOvRR+yFFFHOLs3J7PF5KYQweigtgLshcH4W660PsvHr4lYZ03JBpLyEcUB8DzHZ+BNw==",
-      "deprecated": "Please use @electron/packager moving forward. There is no API change, just a package name change",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "@electron/asar": "^3.2.1",
-        "@electron/get": "^2.0.0",
-        "@electron/notarize": "^1.2.3",
-        "@electron/osx-sign": "^1.0.5",
-        "@electron/universal": "^1.3.2",
-        "cross-spawn-windows-exe": "^1.2.0",
-        "debug": "^4.0.1",
-        "extract-zip": "^2.0.0",
-        "filenamify": "^4.1.0",
-        "fs-extra": "^11.1.0",
-        "galactus": "^1.0.0",
-        "get-package-info": "^1.0.0",
-        "junk": "^3.1.0",
-        "parse-author": "^2.0.0",
-        "plist": "^3.0.0",
-        "rcedit": "^3.0.1",
-        "resolve": "^1.1.6",
-        "semver": "^7.1.3",
-        "yargs-parser": "^21.1.1"
-      },
-      "bin": {
-        "electron-packager": "bin/electron-packager.js"
-      },
-      "engines": {
-        "node": ">= 14.17.5"
-      },
-      "funding": {
-        "url": "https://github.com/electron/electron-packager?sponsor=1"
-      }
-    },
-    "node_modules/electron-packager/node_modules/@electron/notarize": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@electron/notarize/-/notarize-1.2.4.tgz",
-      "integrity": "sha512-W5GQhJEosFNafewnS28d3bpQ37/s91CDWqxVchHfmv2dQSTWpOzNlUVQwYzC1ay5bChRV/A9BTL68yj0Pa+TSg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.1.1",
-        "fs-extra": "^9.0.1"
-      },
-      "engines": {
-        "node": ">= 10.0.0"
-      }
-    },
-    "node_modules/electron-packager/node_modules/@electron/notarize/node_modules/fs-extra": {
-      "version": "9.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
-      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "at-least-node": "^1.0.0",
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/electron-packager/node_modules/@electron/universal": {
-      "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/@electron/universal/-/universal-1.5.1.tgz",
-      "integrity": "sha512-kbgXxyEauPJiQQUNG2VgUeyfQNFk6hBF11ISN2PNI6agUgPl55pv4eQmaqHzTAzchBvqZ2tQuRVaPStGf0mxGw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@electron/asar": "^3.2.1",
-        "@malept/cross-spawn-promise": "^1.1.0",
-        "debug": "^4.3.1",
-        "dir-compare": "^3.0.0",
-        "fs-extra": "^9.0.1",
-        "minimatch": "^3.0.4",
-        "plist": "^3.0.4"
-      },
-      "engines": {
-        "node": ">=8.6"
-      }
-    },
-    "node_modules/electron-packager/node_modules/@electron/universal/node_modules/fs-extra": {
-      "version": "9.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
-      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "at-least-node": "^1.0.0",
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/electron-packager/node_modules/@malept/cross-spawn-promise": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@malept/cross-spawn-promise/-/cross-spawn-promise-1.1.1.tgz",
-      "integrity": "sha512-RTBGWL5FWQcg9orDOCcp4LvItNzUPcyEU9bwaeJX0rJ1IQxzucC48Y0/sQLp/g6t99IQgAlGIaesJS+gTn7tVQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://github.com/sponsors/malept"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/subscription/pkg/npm-.malept-cross-spawn-promise?utm_medium=referral&utm_source=npm_fund"
-        }
-      ],
-      "license": "Apache-2.0",
-      "dependencies": {
-        "cross-spawn": "^7.0.1"
-      },
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/electron-packager/node_modules/dir-compare": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/dir-compare/-/dir-compare-3.3.0.tgz",
-      "integrity": "sha512-J7/et3WlGUCxjdnD3HAAzQ6nsnc0WL6DD7WcwJb7c39iH1+AWfg+9OqzJNaI6PkBwBvm1mhZNL9iY/nRiZXlPg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "buffer-equal": "^1.0.0",
-        "minimatch": "^3.0.4"
-      }
-    },
-    "node_modules/electron-packager/node_modules/fs-extra": {
-      "version": "11.3.3",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.3.tgz",
-      "integrity": "sha512-VWSRii4t0AFm6ixFFmLLx1t7wS1gh+ckoa84aOeapGum0h+EZd1EhEumSB+ZdDLnEPuucsVB9oB7cxJHap6Afg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=14.14"
-      }
-    },
-    "node_modules/electron-packager/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "universalify": "^2.0.0"
-      },
-      "optionalDependencies": {
-        "graceful-fs": "^4.1.6"
-      }
-    },
-    "node_modules/electron-packager/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^1.1.7"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/electron-packager/node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/electron-packager/node_modules/universalify": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
-      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 10.0.0"
-      }
-    },
     "node_modules/electron-publish": {
-      "version": "26.3.4",
-      "resolved": "https://registry.npmjs.org/electron-publish/-/electron-publish-26.3.4.tgz",
-      "integrity": "sha512-5/ouDPb73SkKuay2EXisPG60LTFTMNHWo2WLrK5GDphnWK9UC+yzYrzVeydj078Yk4WUXi0+TaaZsNd6Zt5k/A==",
+      "version": "26.15.3",
+      "resolved": "https://registry.npmjs.org/electron-publish/-/electron-publish-26.15.3.tgz",
+      "integrity": "sha512-g/2bn8YTavY4cuS5F+jOS7zmZbXXBV8KZ8yHKfJjFPoKtzBqrpCdNPxBd3tqdBwP7BVd0lGzf7Bk2s0KesWZ4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/fs-extra": "^9.0.11",
-        "builder-util": "26.3.4",
-        "builder-util-runtime": "9.5.1",
+        "aws4": "^1.13.2",
+        "builder-util": "26.15.3",
+        "builder-util-runtime": "9.7.0",
         "chalk": "^4.1.2",
-        "form-data": "^4.0.0",
+        "form-data": "^4.0.5",
         "fs-extra": "^10.1.0",
         "lazy-val": "^1.0.5",
         "mime": "^2.5.2"
@@ -2478,9 +1767,9 @@
       }
     },
     "node_modules/electron-publish/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2507,6 +1796,7 @@
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@electron/asar": "^3.2.1",
         "debug": "^4.1.1",
@@ -2527,6 +1817,7 @@
       "integrity": "sha512-YJDaCJZEnBmcbw13fvdAM9AwNOJwOzrE4pqMqBq5nFiEqXUqHwlK4B+3pUw6JNvfSPtX05xFHtYy/1ni01eGCw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "graceful-fs": "^4.1.2",
         "jsonfile": "^4.0.0",
@@ -2536,6 +1827,64 @@
         "node": ">=6 <7 || >=8"
       }
     },
+    "node_modules/electron/node_modules/@electron/get": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@electron/get/-/get-5.1.0.tgz",
+      "integrity": "sha512-3kSBtG8ObcTVfXanm5vVJ6UnBLEVmVsRk1M+vGqCuMBV+XLCbJYuWQful+yIy0GQDsSlK0kHEriEHn7SPk4EnA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.1.1",
+        "env-paths": "^3.0.0",
+        "graceful-fs": "^4.2.11",
+        "progress": "^2.0.3",
+        "semver": "^7.6.3",
+        "sumchecker": "^3.0.1"
+      },
+      "engines": {
+        "node": ">=22.12.0"
+      },
+      "optionalDependencies": {
+        "undici": "^7.24.4"
+      }
+    },
+    "node_modules/electron/node_modules/env-paths": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-3.0.0.tgz",
+      "integrity": "sha512-dtJUTepzMW3Lm/NPxRf3wP4642UWhjL2sQxc+ym2YMj1m/H2zDNQOlezafzkHwn6sMstjHTwG6iQQsctDW/b1A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/electron/node_modules/semver": {
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/electron/node_modules/undici": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz",
+      "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=20.18.1"
+      }
+    },
     "node_modules/emoji-regex": {
       "version": "8.0.0",
       "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
@@ -2543,17 +1892,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/encoding": {
-      "version": "0.1.13",
-      "resolved": "https://registry.npmjs.org/encoding/-/encoding-0.1.13.tgz",
-      "integrity": "sha512-ETBauow1T35Y/WZMkio9jiM0Z5xjHHmJ4XmjZOq1l/dXz3lr2sRn87nJy20RupqSh1F2m3HHPSp8ShIPQJrJ3A==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "iconv-lite": "^0.6.2"
-      }
-    },
     "node_modules/end-of-stream": {
       "version": "1.4.5",
       "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
@@ -2581,16 +1919,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/error-ex": {
-      "version": "1.3.4",
-      "resolved": "https://registry.npmjs.org/error-ex/-/error-ex-1.3.4.tgz",
-      "integrity": "sha512-sqQamAnR14VgCr1A618A3sGrygcpK+HEbenA/HiEAkkUwcZIIB/tgWqHFxWgOyDh4nB4JCRimh79dR5Ywc9MDQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "is-arrayish": "^0.2.1"
-      }
-    },
     "node_modules/es-define-property": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
@@ -2610,9 +1938,9 @@
       }
     },
     "node_modules/es-object-atoms": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
-      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
+      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0"
@@ -2675,38 +2003,6 @@
       "dev": true,
       "license": "Apache-2.0"
     },
-    "node_modules/extract-zip": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/extract-zip/-/extract-zip-2.0.1.tgz",
-      "integrity": "sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "debug": "^4.1.1",
-        "get-stream": "^5.1.0",
-        "yauzl": "^2.10.0"
-      },
-      "bin": {
-        "extract-zip": "cli.js"
-      },
-      "engines": {
-        "node": ">= 10.17.0"
-      },
-      "optionalDependencies": {
-        "@types/yauzl": "^2.9.1"
-      }
-    },
-    "node_modules/extsprintf": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/extsprintf/-/extsprintf-1.4.1.tgz",
-      "integrity": "sha512-Wrk35e8ydCKDj/ArClo1VrPVmN8zph5V4AtHwIuHhvMXsKf73UT3BOD+azBIW+3wOJ4FhEH7zyaJCFvChjYvMA==",
-      "dev": true,
-      "engines": [
-        "node >=0.6.0"
-      ],
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -2714,22 +2010,22 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/fast-json-stable-stringify": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
-      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
+    "node_modules/fast-uri": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
+      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
       "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/fd-slicer": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz",
-      "integrity": "sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "pend": "~1.2.0"
-      }
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause"
     },
     "node_modules/fdir": {
       "version": "6.5.0",
@@ -2750,9 +2046,9 @@
       }
     },
     "node_modules/filelist": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/filelist/-/filelist-1.0.4.tgz",
-      "integrity": "sha512-w1cEuf3S+DrLCQL7ET6kz+gmlJdbq9J7yXCSjK/OZCPA+qEN1WyF4ZAf0YYJa4/shHJra2t/d/r8SV4Ji+x+8Q==",
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/filelist/-/filelist-1.0.6.tgz",
+      "integrity": "sha512-5giy2PkLYY1cP39p17Ech+2xlpTRL9HLspOfEgm0L6CwBXBTgsK5ou0JtzYuepxkaQ/tvhCFIJ5uXo0OrM2DxA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -2760,9 +2056,9 @@
       }
     },
     "node_modules/filelist/node_modules/brace-expansion": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
+      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2770,9 +2066,9 @@
       }
     },
     "node_modules/filelist/node_modules/minimatch": {
-      "version": "5.1.6",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
-      "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
+      "version": "5.1.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
+      "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -2782,103 +2078,10 @@
         "node": ">=10"
       }
     },
-    "node_modules/filename-reserved-regex": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/filename-reserved-regex/-/filename-reserved-regex-2.0.0.tgz",
-      "integrity": "sha512-lc1bnsSr4L4Bdif8Xb/qrtokGbq5zlsms/CYH8PP+WtCkGNF65DPiQY8vG3SakEdRn8Dlnm+gW/qWKKjS5sZzQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/filenamify": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/filenamify/-/filenamify-4.3.0.tgz",
-      "integrity": "sha512-hcFKyUG57yWGAzu1CMt/dPzYZuv+jAJUT85bL8mrXvNe6hWj6yEHEc4EdcgiA6Z3oi1/9wXJdZPXF2dZNgwgOg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "filename-reserved-regex": "^2.0.0",
-        "strip-outer": "^1.0.1",
-        "trim-repeated": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/find-up": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-2.1.0.tgz",
-      "integrity": "sha512-NWzkk0jSJtTt08+FBFMvXoeZnOJD+jTtsRmBYbAIzJdX6l7dLgR7CTubCM5/eDdPUBvLCeVasP1brfVR/9/EZQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "locate-path": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/flora-colossus": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/flora-colossus/-/flora-colossus-2.0.0.tgz",
-      "integrity": "sha512-dz4HxH6pOvbUzZpZ/yXhafjbR2I8cenK5xL0KtBFb7U2ADsR+OwXifnxZjij/pZWF775uSCMzWVd+jDik2H2IA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.3.4",
-        "fs-extra": "^10.1.0"
-      },
-      "engines": {
-        "node": ">= 12"
-      }
-    },
-    "node_modules/flora-colossus/node_modules/fs-extra": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-10.1.0.tgz",
-      "integrity": "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/flora-colossus/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "universalify": "^2.0.0"
-      },
-      "optionalDependencies": {
-        "graceful-fs": "^4.1.6"
-      }
-    },
-    "node_modules/flora-colossus/node_modules/universalify": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
-      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 10.0.0"
-      }
-    },
     "node_modules/follow-redirects": {
-      "version": "1.15.11",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.11.tgz",
-      "integrity": "sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==",
+      "version": "1.16.0",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
+      "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==",
       "funding": [
         {
           "type": "individual",
@@ -2895,80 +2098,22 @@
         }
       }
     },
-    "node_modules/foreground-child": {
-      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
-      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "cross-spawn": "^7.0.6",
-        "signal-exit": "^4.0.1"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/foreground-child/node_modules/signal-exit": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
-      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
-      "dev": true,
-      "license": "ISC",
-      "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/form-data": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
+      "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
         "combined-stream": "^1.0.8",
         "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.2",
-        "mime-types": "^2.1.12"
+        "hasown": "^2.0.4",
+        "mime-types": "^2.1.35"
       },
       "engines": {
         "node": ">= 6"
       }
     },
-    "node_modules/fs-extra": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-8.1.0.tgz",
-      "integrity": "sha512-yhlQgA6mnOJUKOsRUFsgJdQCvkKhcz8tlZG5HBQfReYZy46OwLcY+Zia0mtdHsOo9y/hP+CxMN0TU9QxoOtG4g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^4.0.0",
-        "universalify": "^0.1.0"
-      },
-      "engines": {
-        "node": ">=6 <7 || >=8"
-      }
-    },
-    "node_modules/fs-minipass": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-3.0.3.tgz",
-      "integrity": "sha512-XUBA9XClHbnJWSfBzjkm6RvPsyg3sryZt06BEQoXcF7EK/xpGaQYJgQKDJSUH5SGZ76Y7pFx1QBnXz09rU5Fbw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^7.0.3"
-      },
-      "engines": {
-        "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
-      }
-    },
     "node_modules/fs.realpath": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
@@ -2985,59 +2130,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/galactus": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/galactus/-/galactus-1.0.0.tgz",
-      "integrity": "sha512-R1fam6D4CyKQGNlvJne4dkNF+PvUUl7TAJInvTGa9fti9qAv95quQz29GXapA4d8Ec266mJJxFVh82M4GIIGDQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.3.4",
-        "flora-colossus": "^2.0.0",
-        "fs-extra": "^10.1.0"
-      },
-      "engines": {
-        "node": ">= 12"
-      }
-    },
-    "node_modules/galactus/node_modules/fs-extra": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-10.1.0.tgz",
-      "integrity": "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/galactus/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "universalify": "^2.0.0"
-      },
-      "optionalDependencies": {
-        "graceful-fs": "^4.1.6"
-      }
-    },
-    "node_modules/galactus/node_modules/universalify": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
-      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 10.0.0"
-      }
-    },
     "node_modules/get-caller-file": {
       "version": "2.0.5",
       "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
@@ -3072,39 +2164,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/get-package-info": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/get-package-info/-/get-package-info-1.0.0.tgz",
-      "integrity": "sha512-SCbprXGAPdIhKAXiG+Mk6yeoFH61JlYunqdFQFHDtLjJlDjFf6x07dsS8acO+xWt52jpdVo49AlVDnUVK1sDNw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "bluebird": "^3.1.1",
-        "debug": "^2.2.0",
-        "lodash.get": "^4.0.0",
-        "read-pkg-up": "^2.0.0"
-      },
-      "engines": {
-        "node": ">= 4.0"
-      }
-    },
-    "node_modules/get-package-info/node_modules/debug": {
-      "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ms": "2.0.0"
-      }
-    },
-    "node_modules/get-package-info/node_modules/ms": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/get-proto": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
@@ -3157,9 +2216,9 @@
       }
     },
     "node_modules/glob/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -3317,9 +2376,9 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
       "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"
@@ -3377,79 +2436,28 @@
       }
     },
     "node_modules/https-proxy-agent": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
-      "dev": true,
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
       "license": "MIT",
       "dependencies": {
-        "agent-base": "^7.1.2",
+        "agent-base": "6",
         "debug": "4"
       },
       "engines": {
-        "node": ">= 14"
+        "node": ">= 6"
       }
     },
-    "node_modules/iconv-corefoundation": {
-      "version": "1.1.7",
-      "resolved": "https://registry.npmjs.org/iconv-corefoundation/-/iconv-corefoundation-1.1.7.tgz",
-      "integrity": "sha512-T10qvkw0zz4wnm560lOEg0PovVqUXuOFhhHAkixw8/sycy7TJt7v/RrkEKEQnAw2viPSJu6iAkErxnzR0g8PpQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "dependencies": {
-        "cli-truncate": "^2.1.0",
-        "node-addon-api": "^1.6.3"
-      },
-      "engines": {
-        "node": "^8.11.2 || >=10"
-      }
-    },
-    "node_modules/iconv-lite": {
-      "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
-      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
-      "dev": true,
+    "node_modules/https-proxy-agent/node_modules/agent-base": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
       "license": "MIT",
       "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3.0.0"
+        "debug": "4"
       },
       "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/ieee754": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
-      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/imurmurhash": {
-      "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
-      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.8.19"
+        "node": ">= 6.0.0"
       }
     },
     "node_modules/inflight": {
@@ -3471,55 +2479,6 @@
       "dev": true,
       "license": "ISC"
     },
-    "node_modules/ip-address": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz",
-      "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 12"
-      }
-    },
-    "node_modules/is-arrayish": {
-      "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.2.1.tgz",
-      "integrity": "sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/is-core-module": {
-      "version": "2.16.1",
-      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.1.tgz",
-      "integrity": "sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "hasown": "^2.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-docker": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-2.2.1.tgz",
-      "integrity": "sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "is-docker": "cli.js"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/is-fullwidth-code-point": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
@@ -3530,41 +2489,12 @@
         "node": ">=8"
       }
     },
-    "node_modules/is-interactive": {
+    "node_modules/isarray": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-interactive/-/is-interactive-1.0.0.tgz",
-      "integrity": "sha512-2HvIEKRoqS62guEC+qBjpvRubdX910WCMuJTZ+I9yvqKU2/12eSL549HMwtabb4oupdj2sMP50k+XJfB/8JE6w==",
+      "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
+      "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
       "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/is-unicode-supported": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/is-unicode-supported/-/is-unicode-supported-0.1.0.tgz",
-      "integrity": "sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/is-wsl": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-2.2.0.tgz",
-      "integrity": "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "is-docker": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
+      "license": "MIT"
     },
     "node_modules/isbinaryfile": {
       "version": "5.0.7",
@@ -3580,29 +2510,13 @@
       }
     },
     "node_modules/isexe": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.1.tgz",
-      "integrity": "sha512-LpB/54B+/2J5hqQ7imZHfdU31OlgQqx7ZicVlkm9kzg9/w8GKLEcFfJl/t7DCEDueOyBAD6zCCwTO6Fzs0NoEQ==",
-      "dev": true,
-      "license": "ISC",
-      "engines": {
-        "node": ">=16"
-      }
-    },
-    "node_modules/jackspeak": {
-      "version": "3.4.3",
-      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
-      "integrity": "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.5.tgz",
+      "integrity": "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==",
       "dev": true,
       "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "@isaacs/cliui": "^8.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      },
-      "optionalDependencies": {
-        "@pkgjs/parseargs": "^0.11.0"
+      "engines": {
+        "node": ">=18"
       }
     },
     "node_modules/jake": {
@@ -3624,9 +2538,9 @@
       }
     },
     "node_modules/jiti": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.6.1.tgz",
-      "integrity": "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==",
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
+      "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -3634,10 +2548,20 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
       "license": "MIT",
       "dependencies": {
         "argparse": "^2.0.1"
@@ -3654,9 +2578,9 @@
       "license": "MIT"
     },
     "node_modules/json-schema-traverse": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
       "dev": true,
       "license": "MIT"
     },
@@ -3691,16 +2615,6 @@
         "graceful-fs": "^4.1.6"
       }
     },
-    "node_modules/junk": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/junk/-/junk-3.1.0.tgz",
-      "integrity": "sha512-pBxcB3LFc8QVgdggvZWyeys+hnrNWg4OcZIU/1X59k5jQdLBlCsYGRQaz234SqoRLTCgMH00fY0xRJH+F9METQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/keyv": {
       "version": "4.5.4",
       "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
@@ -3718,68 +2632,13 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/load-json-file": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/load-json-file/-/load-json-file-2.0.0.tgz",
-      "integrity": "sha512-3p6ZOGNbiX4CdvEd1VcE6yi78UrGNpjHO33noGwHCnT/o2fyllJDepsm8+mFFv/DvtwFHht5HIHSyOy5a+ChVQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "graceful-fs": "^4.1.2",
-        "parse-json": "^2.2.0",
-        "pify": "^2.0.0",
-        "strip-bom": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/locate-path": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-2.0.0.tgz",
-      "integrity": "sha512-NCI2kiDkyR7VeEKm27Kda/iQHyKJe1Bu0FlTbYp3CqJu+9IFe9bLyAjMxf5ZDDbEg+iMPzB5zYyUTSm8wVTKmA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "p-locate": "^2.0.0",
-        "path-exists": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/lodash.get": {
-      "version": "4.4.2",
-      "resolved": "https://registry.npmjs.org/lodash.get/-/lodash.get-4.4.2.tgz",
-      "integrity": "sha512-z+Uw/vLuy6gQe8cfaFWD7p0wVv8fJl3mbzXh33RS+0oW2wvUqiRXiQ69gLWSLpgB5/6sU+r6BlQR0MBILadqTQ==",
-      "deprecated": "This package is deprecated. Use the optional chaining (?.) operator instead.",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/log-symbols": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/log-symbols/-/log-symbols-4.1.0.tgz",
-      "integrity": "sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "chalk": "^4.1.0",
-        "is-unicode-supported": "^0.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/lowercase-keys": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/lowercase-keys/-/lowercase-keys-2.0.0.tgz",
@@ -3803,29 +2662,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/make-fetch-happen": {
-      "version": "14.0.3",
-      "resolved": "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-14.0.3.tgz",
-      "integrity": "sha512-QMjGbFTP0blj97EeidG5hk/QhKQ3T4ICckQGLgz38QF7Vgbk6e6FTARN8KhKxyBbWn8R0HU+bnw8aSoFPD4qtQ==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "@npmcli/agent": "^3.0.0",
-        "cacache": "^19.0.1",
-        "http-cache-semantics": "^4.1.1",
-        "minipass": "^7.0.2",
-        "minipass-fetch": "^4.0.0",
-        "minipass-flush": "^1.0.5",
-        "minipass-pipeline": "^1.2.4",
-        "negotiator": "^1.0.0",
-        "proc-log": "^5.0.0",
-        "promise-retry": "^2.0.1",
-        "ssri": "^12.0.0"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
     "node_modules/matcher": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/matcher/-/matcher-3.0.0.tgz",
@@ -3883,16 +2719,6 @@
         "node": ">= 0.6"
       }
     },
-    "node_modules/mimic-fn": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz",
-      "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
     "node_modules/mimic-response": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-1.0.1.tgz",
@@ -3904,21 +2730,44 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "10.1.1",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.1.1.tgz",
-      "integrity": "sha512-enIvLvRAFZYXJzkCYG5RKmPfrFArdLv+R+lbQ53BmIMLIry74bjKzX6iHAm8WYamJkhSSEabrWN5D97XnKObjQ==",
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "@isaacs/brace-expansion": "^5.0.0"
+        "brace-expansion": "^5.0.8"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/minimatch/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/minimatch/node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
     "node_modules/minimist": {
       "version": "1.2.8",
       "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
@@ -3930,124 +2779,15 @@
       }
     },
     "node_modules/minipass": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
-      "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=16 || 14 >=14.17"
       }
     },
-    "node_modules/minipass-collect": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/minipass-collect/-/minipass-collect-2.0.1.tgz",
-      "integrity": "sha512-D7V8PO9oaz7PWGLbCACuI1qEOsq7UKfLotx/C0Aet43fCUB/wfQ7DYeq2oR/svFJGYDHPr38SHATeaj/ZoKHKw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^7.0.3"
-      },
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      }
-    },
-    "node_modules/minipass-fetch": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/minipass-fetch/-/minipass-fetch-4.0.1.tgz",
-      "integrity": "sha512-j7U11C5HXigVuutxebFadoYBbd7VSdZWggSe64NVdvWNBqGAiXPL2QVCehjmw7lY1oF9gOllYbORh+hiNgfPgQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "minipass": "^7.0.3",
-        "minipass-sized": "^1.0.3",
-        "minizlib": "^3.0.1"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      },
-      "optionalDependencies": {
-        "encoding": "^0.1.13"
-      }
-    },
-    "node_modules/minipass-flush": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.5.tgz",
-      "integrity": "sha512-JmQSYYpPUqX5Jyn1mXaRwOda1uQ8HP5KAT/oDSLCzt1BYRhQU0/hDtsB1ufZfEEzMZ9aAVmsBw8+FWsIXlClWw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^3.0.0"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/minipass-flush/node_modules/minipass": {
-      "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/minipass-pipeline": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/minipass-pipeline/-/minipass-pipeline-1.2.4.tgz",
-      "integrity": "sha512-xuIq7cIOt09RPRJ19gdi4b+RiNvDFYe5JH+ggNvBqGqpQXcru3PcRmOZuHBKWK1Txf9+cQ+HMVN4d6z46LZP7A==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/minipass-pipeline/node_modules/minipass": {
-      "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/minipass-sized": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/minipass-sized/-/minipass-sized-1.0.3.tgz",
-      "integrity": "sha512-MbkQQ2CTiBMlA2Dm/5cY+9SWFEN8pzzOXi6rlM5Xxq0Yqbda5ZQy9sU75a673FE9ZK0Zsbr6Y5iP6u9nktfg2g==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/minipass-sized/node_modules/minipass": {
-      "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/minizlib": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
@@ -4062,39 +2802,29 @@
       }
     },
     "node_modules/mkdirp": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
-      "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
+      "version": "0.5.6",
+      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
+      "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "minimist": "^1.2.6"
+      },
       "bin": {
         "mkdirp": "bin/cmd.js"
-      },
-      "engines": {
-        "node": ">=10"
       }
     },
     "node_modules/ms": {
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
       "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "dev": true,
       "license": "MIT"
     },
-    "node_modules/negotiator": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
-      "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
     "node_modules/node-abi": {
-      "version": "4.24.0",
-      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-4.24.0.tgz",
-      "integrity": "sha512-u2EC1CeNe25uVtX3EZbdQ275c74zdZmmpzrHEQh2aIYqoVjlglfUpOX9YY85x1nlBydEKDVaSmMNhR7N82Qj8A==",
+      "version": "4.33.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-4.33.0.tgz",
+      "integrity": "sha512-vLBWCKb+7LWsX+TbfzWOkw0W81m377tyx3hOweBTjO43CXZnRGS1/JPWs20fr0PgZyDXk6ROYrylsEycK8raDA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4105,9 +2835,9 @@
       }
     },
     "node_modules/node-abi/node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -4117,14 +2847,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/node-addon-api": {
-      "version": "1.7.2",
-      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-1.7.2.tgz",
-      "integrity": "sha512-ibPK3iA+vaY1eEjESkQkM0BbCqFOaZMiXRTtdB0u7b4djtY6JnsjvPdUHVMg6xQt3B8fpTTWHI9A+ADjM9frzg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/node-api-version": {
       "version": "0.2.1",
       "resolved": "https://registry.npmjs.org/node-api-version/-/node-api-version-0.2.1.tgz",
@@ -4136,9 +2858,9 @@
       }
     },
     "node_modules/node-api-version/node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -4149,44 +2871,44 @@
       }
     },
     "node_modules/node-gyp": {
-      "version": "11.5.0",
-      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-11.5.0.tgz",
-      "integrity": "sha512-ra7Kvlhxn5V9Slyus0ygMa2h+UqExPqUIkfk7Pc8QTLT956JLSy51uWFwHtIYy0vI8cB4BDhc/S03+880My/LQ==",
+      "version": "12.4.0",
+      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-12.4.0.tgz",
+      "integrity": "sha512-OMcPNvqTCFUnNaBlmdgq+lfNqY7gTiSmNRDjY3uAXRyudeKZEZxu3CLtjMQrx4zZxCX2b/mpNqTtwuCJgXhHkw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "env-paths": "^2.2.0",
         "exponential-backoff": "^3.1.1",
         "graceful-fs": "^4.2.6",
-        "make-fetch-happen": "^14.0.3",
-        "nopt": "^8.0.0",
-        "proc-log": "^5.0.0",
+        "nopt": "^9.0.0",
+        "proc-log": "^6.0.0",
         "semver": "^7.3.5",
-        "tar": "^7.4.3",
+        "tar": "^7.5.4",
         "tinyglobby": "^0.2.12",
-        "which": "^5.0.0"
+        "undici": "^6.25.0",
+        "which": "^6.0.0"
       },
       "bin": {
         "node-gyp": "bin/node-gyp.js"
       },
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "node": "^20.17.0 || >=22.9.0"
       }
     },
-    "node_modules/node-gyp/node_modules/chownr": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
-      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
+    "node_modules/node-gyp/node_modules/isexe": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-4.0.0.tgz",
+      "integrity": "sha512-FFUtZMpoZ8RqHS3XeXEmHWLA4thH+ZxCv2lOiPIn1Xc7CxrqhWzNSDzD+/chS/zbYezmiwWLdQC09JdQKmthOw==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
-        "node": ">=18"
+        "node": ">=20"
       }
     },
     "node_modules/node-gyp/node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -4196,77 +2918,43 @@
         "node": ">=10"
       }
     },
-    "node_modules/node-gyp/node_modules/tar": {
-      "version": "7.5.2",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.2.tgz",
-      "integrity": "sha512-7NyxrTE4Anh8km8iEy7o0QYPs+0JKBTj5ZaqHg6B39erLg0qYXN3BijtShwbsNSvQ+LN75+KV+C4QR/f6Gwnpg==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "@isaacs/fs-minipass": "^4.0.0",
-        "chownr": "^3.0.0",
-        "minipass": "^7.1.2",
-        "minizlib": "^3.1.0",
-        "yallist": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/node-gyp/node_modules/yallist": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
-      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/nopt": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/nopt/-/nopt-8.1.0.tgz",
-      "integrity": "sha512-ieGu42u/Qsa4TFktmaKEwM6MQH0pOWnaB3htzh0JRtx84+Mebc0cbZYN5bC+6WTZ4+77xrL9Pn5m7CV6VIkV7A==",
+    "node_modules/node-gyp/node_modules/which": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/which/-/which-6.0.1.tgz",
+      "integrity": "sha512-oGLe46MIrCRqX7ytPUf66EAYvdeMIZYn3WaocqqKZAxrBpkqHfL/qvTyJ/bTk5+AqHCjXmrv3CEWgy368zhRUg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "abbrev": "^3.0.0"
+        "isexe": "^4.0.0"
+      },
+      "bin": {
+        "node-which": "bin/which.js"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/node-int64": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz",
+      "integrity": "sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/nopt": {
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/nopt/-/nopt-9.0.0.tgz",
+      "integrity": "sha512-Zhq3a+yFKrYwSBluL4H9XP3m3y5uvQkB/09CwDruCiRmR/UJYnn9W4R48ry0uGC70aeTPKLynBtscP9efFFcPw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "abbrev": "^4.0.0"
       },
       "bin": {
         "nopt": "bin/nopt.js"
       },
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
-    "node_modules/normalize-package-data": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-2.5.0.tgz",
-      "integrity": "sha512-/5CMN3T0R4XTj4DcGaexo+roZSdSFW/0AOOTROrjxzCG1wrWXEsGbRKevjlIL+ZDE4sZlJr5ED4YW0yqmkK+eA==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "hosted-git-info": "^2.1.4",
-        "resolve": "^1.10.0",
-        "semver": "2 || 3 || 4 || 5",
-        "validate-npm-package-license": "^3.0.1"
-      }
-    },
-    "node_modules/normalize-package-data/node_modules/hosted-git-info": {
-      "version": "2.8.9",
-      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.9.tgz",
-      "integrity": "sha512-mxIDAb9Lsm6DoOJ7xH+5+X4y1LU/4Hi50L9C5sIswK3JzULS4bwk1FvjdBgvYR4bzT4tuUQiC15FE2f5HbLvYw==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/normalize-package-data/node_modules/semver": {
-      "version": "5.7.2",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
-      "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver"
+        "node": "^20.17.0 || >=22.9.0"
       }
     },
     "node_modules/normalize-url": {
@@ -4303,46 +2991,6 @@
         "wrappy": "1"
       }
     },
-    "node_modules/onetime": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
-      "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "mimic-fn": "^2.1.0"
-      },
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/ora": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/ora/-/ora-5.4.1.tgz",
-      "integrity": "sha512-5b6Y85tPxZZ7QytO+BQzysW31HJku27cRIlkbAXaNx+BdcVi+LlRFmVXzeF6a7JCwJpyw5c4b+YSVImQIrBpuQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "bl": "^4.1.0",
-        "chalk": "^4.1.0",
-        "cli-cursor": "^3.1.0",
-        "cli-spinners": "^2.5.0",
-        "is-interactive": "^1.0.0",
-        "is-unicode-supported": "^0.1.0",
-        "log-symbols": "^4.1.0",
-        "strip-ansi": "^6.0.0",
-        "wcwidth": "^1.0.1"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/p-cancelable": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/p-cancelable/-/p-cancelable-2.1.1.tgz",
@@ -4369,98 +3017,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/p-locate": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-2.0.0.tgz",
-      "integrity": "sha512-nQja7m7gSKuewoVRen45CtVfODR3crN3goVQ0DDZ9N3yHxgpkuBhZqsaiotSQRrADUrne346peY7kT3TSACykg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "p-limit": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/p-locate/node_modules/p-limit": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-1.3.0.tgz",
-      "integrity": "sha512-vvcXsLAJ9Dr5rQOPk7toZQZJApBl2K4J6dANSsEuh6QI41JYcsS/qhTGa9ErIUUgK3WNQoJYvylxvjqmiqEA9Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "p-try": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/p-map": {
-      "version": "7.0.4",
-      "resolved": "https://registry.npmjs.org/p-map/-/p-map-7.0.4.tgz",
-      "integrity": "sha512-tkAQEw8ysMzmkhgw8k+1U/iPhWNhykKnSk4Rd5zLoPJCuJaGRPo6YposrZgaxHKzDHdDWWZvE/Sk7hsL2X/CpQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/p-try": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/p-try/-/p-try-1.0.0.tgz",
-      "integrity": "sha512-U1etNYuMJoIz3ZXSrrySFjsXQTWOx2/jdi86L+2pRvph/qMKL6sbcCYdH23fqsbm8TH2Gn0OybpT4eSFlCVHww==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/package-json-from-dist": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
-      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
-      "dev": true,
-      "license": "BlueOak-1.0.0"
-    },
-    "node_modules/parse-author": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/parse-author/-/parse-author-2.0.0.tgz",
-      "integrity": "sha512-yx5DfvkN8JsHL2xk2Os9oTia467qnvRgey4ahSm2X8epehBLx/gWLcy5KI+Y36ful5DzGbCS6RazqZGgy1gHNw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "author-regex": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/parse-json": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/parse-json/-/parse-json-2.2.0.tgz",
-      "integrity": "sha512-QR/GGaKCkhwk1ePQNYDRKYZ3mwU9ypsKhB0XyFnLQdomyEqk3e8wpW3V5Jp88zbxK4n5ST1nqo+g9juTpownhQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "error-ex": "^1.2.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/path-exists": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-3.0.0.tgz",
-      "integrity": "sha512-bpC7GYwiDYQ4wYLe+FA8lhRjhQCMcQGuSgGGqDkg/QerRWw9CmGRT0iSOVRSZJ29NMLZgIzqaljJ63oaL4NIJQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/path-is-absolute": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
@@ -4481,50 +3037,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/path-parse": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
-      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/path-scurry": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
-      "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "lru-cache": "^10.2.0",
-        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
-      },
-      "engines": {
-        "node": ">=16 || 14 >=14.18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/path-scurry/node_modules/lru-cache": {
-      "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/path-type": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/path-type/-/path-type-2.0.0.tgz",
-      "integrity": "sha512-dUnb5dXUf+kzhC/W/F4e5/SkluXIFf5VUHolW1Eg1irn1hGWjPGdsRcvYJ1nD6lhk8Ir7VM0bHJKsYTx8Jx9OQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "pify": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/pe-library": {
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/pe-library/-/pe-library-0.4.1.tgz",
@@ -4540,13 +3052,6 @@
         "url": "https://github.com/sponsors/jet2jet"
       }
     },
-    "node_modules/pend": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/pend/-/pend-1.2.0.tgz",
-      "integrity": "sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/picocolors": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ -4555,12 +3060,11 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -4568,14 +3072,35 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
-    "node_modules/pify": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/pify/-/pify-2.3.0.tgz",
-      "integrity": "sha512-udgsAY+fTnvv7kI7aaxbqwWNb0AHiB0qBO89PZKPkoTmGOgdbrHDKD+0B2X4uTfJ/FT1R09r9gTsjUjNJotuog==",
+    "node_modules/pkijs": {
+      "version": "3.4.0",
+      "resolved": "https://registry.npmjs.org/pkijs/-/pkijs-3.4.0.tgz",
+      "integrity": "sha512-emEcLuomt2j03vxD54giVB4SxTjnsqkU692xZOZXHDVoYyypEm+b3jpiTcc+Cf+myooc+/Ly0z01jqeNHVgJGw==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@noble/hashes": "1.4.0",
+        "asn1js": "^3.0.6",
+        "bytestreamjs": "^2.0.1",
+        "pvtsutils": "^1.3.6",
+        "pvutils": "^1.1.3",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
+    "node_modules/pkijs/node_modules/@noble/hashes": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.4.0.tgz",
+      "integrity": "sha512-V1JJ1WTRUqHHrOSh597hURcMqVKVGL/ea3kv0gSnEdsEZ0/+VyPghM1lMNGc00z7CIQorSvbKpuJkxvuHbvdbg==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=0.10.0"
+        "node": ">= 16"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
       }
     },
     "node_modules/plist": {
@@ -4600,6 +3125,7 @@
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "dependencies": {
         "commander": "^9.4.0"
       },
@@ -4617,20 +3143,28 @@
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "engines": {
         "node": "^12.20.0 || >=14"
       }
     },
     "node_modules/proc-log": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-5.0.0.tgz",
-      "integrity": "sha512-Azwzvl90HaF0aCz1JrDdXQykFakSSNPaPoiZ9fm5qJIMHioDZEi7OAdRwSm6rSoPtY3Qutnm3L7ogmg3dc+wbQ==",
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-6.1.0.tgz",
+      "integrity": "sha512-iG+GYldRf2BQ0UDUAd6JQ/RwzaQy6mXmsk/IzlYyal4A4SNFw54MeH4/tLkF4I5WoWG9SQwuqWzS99jaFQHBuQ==",
       "dev": true,
       "license": "ISC",
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "node": "^20.17.0 || >=22.9.0"
       }
     },
+    "node_modules/process-nextick-args": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
+      "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/progress": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/progress/-/progress-2.0.3.tgz",
@@ -4655,11 +3189,26 @@
         "node": ">=10"
       }
     },
+    "node_modules/proper-lockfile": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/proper-lockfile/-/proper-lockfile-4.1.2.tgz",
+      "integrity": "sha512-TjNPblN4BwAWMXU8s9AEz4JmQxnD1NNL7bNOY/AKUzyamc379FWASUhc/K1pL2noVb+XmZKLL68cjzLsiOAMaA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.4",
+        "retry": "^0.12.0",
+        "signal-exit": "^3.0.2"
+      }
+    },
     "node_modules/proxy-from-env": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
-      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
-      "license": "MIT"
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz",
+      "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
     },
     "node_modules/pump": {
       "version": "3.0.3",
@@ -4672,14 +3221,24 @@
         "once": "^1.3.1"
       }
     },
-    "node_modules/punycode": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
-      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
+    "node_modules/pvtsutils": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/pvtsutils/-/pvtsutils-1.3.6.tgz",
+      "integrity": "sha512-PLgQXQ6H2FWCaeRak8vvk1GW462lMxB5s3Jm673N82zI4vqtVUPuZdffdZbPDFRoU8kAhItWFtPCWiPpp4/EDg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/pvutils": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/pvutils/-/pvutils-1.2.0.tgz",
+      "integrity": "sha512-BbubeCEyTuQjVMakvJQ/Sxbc93F2pwmbsxONT/ZRrwU7Ua38d8unYTwXpTVLAKJ4BDuH9IGztCjQcd/N/39Dvg==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=6"
+        "node": ">=16.0.0"
       }
     },
     "node_modules/quick-lru": {
@@ -4695,19 +3254,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/rcedit": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/rcedit/-/rcedit-3.1.0.tgz",
-      "integrity": "sha512-WRlRdY1qZbu1L11DklT07KuHfRk42l0NFFJdaExELEu4fEQ982bP5Z6OWGPj/wLLIuKRQDCxZJGAwoFsxhZhNA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "cross-spawn-windows-exe": "^1.1.0"
-      },
-      "engines": {
-        "node": ">= 10.0.0"
-      }
-    },
     "node_modules/read-binary-file-arch": {
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/read-binary-file-arch/-/read-binary-file-arch-1.0.6.tgz",
@@ -4721,48 +3267,20 @@
         "read-binary-file-arch": "cli.js"
       }
     },
-    "node_modules/read-pkg": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/read-pkg/-/read-pkg-2.0.0.tgz",
-      "integrity": "sha512-eFIBOPW7FGjzBuk3hdXEuNSiTZS/xEMlH49HxMyzb0hyPfu4EhVjT2DH32K1hSSmVq4sebAWnZuuY5auISUTGA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "load-json-file": "^2.0.0",
-        "normalize-package-data": "^2.3.2",
-        "path-type": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/read-pkg-up": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/read-pkg-up/-/read-pkg-up-2.0.0.tgz",
-      "integrity": "sha512-1orxQfbWGUiTn9XsPlChs6rLie/AV9jwZTGmu2NZw/CUDJQchXJFYE0Fq5j7+n558T1JhDWLdhyd1Zj+wLY//w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "find-up": "^2.0.0",
-        "read-pkg": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/readable-stream": {
-      "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
-      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "version": "2.3.8",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
+      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "inherits": "^2.0.3",
-        "string_decoder": "^1.1.1",
-        "util-deprecate": "^1.0.1"
-      },
-      "engines": {
-        "node": ">= 6"
+        "core-util-is": "~1.0.0",
+        "inherits": "~2.0.3",
+        "isarray": "~1.0.0",
+        "process-nextick-args": "~2.0.0",
+        "safe-buffer": "~5.1.1",
+        "string_decoder": "~1.1.1",
+        "util-deprecate": "~1.0.1"
       }
     },
     "node_modules/require-directory": {
@@ -4775,6 +3293,16 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/resedit": {
       "version": "1.7.2",
       "resolved": "https://registry.npmjs.org/resedit/-/resedit-1.7.2.tgz",
@@ -4793,27 +3321,6 @@
         "url": "https://github.com/sponsors/jet2jet"
       }
     },
-    "node_modules/resolve": {
-      "version": "1.22.11",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.11.tgz",
-      "integrity": "sha512-RfqAvLnMl313r7c9oclB1HhUEAezcpLjz95wFH4LVuhk9JF/r22qmVP9AMmOU4vMX7Q8pN8jwNg/CSpdFnMjTQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "is-core-module": "^2.16.1",
-        "path-parse": "^1.0.7",
-        "supports-preserve-symlinks-flag": "^1.0.0"
-      },
-      "bin": {
-        "resolve": "bin/resolve"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
     "node_modules/resolve-alpn": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/resolve-alpn/-/resolve-alpn-1.2.1.tgz",
@@ -4834,20 +3341,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/restore-cursor": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-3.1.0.tgz",
-      "integrity": "sha512-l+sSefzHpj5qimhFSE5a8nufZYAM3sBSVMAPtYkmC+4EH2anSGaEMXSD0izRQbu9nfyQ9y5JrVmp7E8oZrUjvA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "onetime": "^5.1.0",
-        "signal-exit": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/retry": {
       "version": "0.12.0",
       "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
@@ -4865,6 +3358,7 @@
       "deprecated": "Rimraf versions prior to v4 are no longer supported",
       "dev": true,
       "license": "ISC",
+      "peer": true,
       "dependencies": {
         "glob": "^7.1.3"
       },
@@ -4892,37 +3386,16 @@
       }
     },
     "node_modules/safe-buffer": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
-      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/safer-buffer": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
-      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/sanitize-filename": {
-      "version": "1.6.3",
-      "resolved": "https://registry.npmjs.org/sanitize-filename/-/sanitize-filename-1.6.3.tgz",
-      "integrity": "sha512-y/52Mcy7aw3gRm7IrcGDFx/bCk4AhRh2eI9luHOQM86nZsqwiRkkq2GekHXBBD+SmPidc8i2PqtYZl+pWJ8Oeg==",
+      "version": "1.6.4",
+      "resolved": "https://registry.npmjs.org/sanitize-filename/-/sanitize-filename-1.6.4.tgz",
+      "integrity": "sha512-9ZyI08PsvdQl2r/bBIGubpVdR3RR9sY6RDiWFPreA21C/EFlQhmgo20UZlNjZMMZNubusLhAQozkA0Od5J21Eg==",
       "dev": true,
       "license": "WTFPL OR ISC",
       "dependencies": {
@@ -4930,25 +3403,15 @@
       }
     },
     "node_modules/sax": {
-      "version": "1.4.4",
-      "resolved": "https://registry.npmjs.org/sax/-/sax-1.4.4.tgz",
-      "integrity": "sha512-1n3r/tGXO6b6VXMdFT54SHzT9ytu9yr7TaELowdYpMqY/Ao7EnlQGmAQ1+RatX7Tkkdm6hONI2owqNx2aZj5Sw==",
+      "version": "1.6.1",
+      "resolved": "https://registry.npmjs.org/sax/-/sax-1.6.1.tgz",
+      "integrity": "sha512-42tBVwLWnaQvW5zc4HbZrTuWccECCZfBi92FDuwtqxasH+JbPB3/FOKb1m222K42R4WxuxzzMsTswfzgtSu64Q==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=11.0.0"
       }
     },
-    "node_modules/semver": {
-      "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
     "node_modules/semver-compare": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/semver-compare/-/semver-compare-1.0.0.tgz",
@@ -5030,63 +3493,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/slice-ansi": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-3.0.0.tgz",
-      "integrity": "sha512-pSyv7bSTC7ig9Dcgbw9AuRNUb5k5V6oDudjZoMBSr13qpLBG7tB+zgCkARjq7xIUgdz5P1Qe8u+rSGdouOOIyQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "astral-regex": "^2.0.0",
-        "is-fullwidth-code-point": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/smart-buffer": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
-      "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 6.0.0",
-        "npm": ">= 3.0.0"
-      }
-    },
-    "node_modules/socks": {
-      "version": "2.8.7",
-      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.7.tgz",
-      "integrity": "sha512-HLpt+uLy/pxB+bum/9DzAgiKS8CX1EvbWxI4zlmgGCExImLdiad2iCwXT5Z4c9c3Eq8rP2318mPW2c+QbtjK8A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ip-address": "^10.0.1",
-        "smart-buffer": "^4.2.0"
-      },
-      "engines": {
-        "node": ">= 10.0.0",
-        "npm": ">= 3.0.0"
-      }
-    },
-    "node_modules/socks-proxy-agent": {
-      "version": "8.0.5",
-      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-8.0.5.tgz",
-      "integrity": "sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "agent-base": "^7.1.2",
-        "debug": "^4.3.4",
-        "socks": "^2.8.3"
-      },
-      "engines": {
-        "node": ">= 14"
-      }
-    },
     "node_modules/source-map": {
       "version": "0.6.1",
       "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
@@ -5108,42 +3514,6 @@
         "source-map": "^0.6.0"
       }
     },
-    "node_modules/spdx-correct": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz",
-      "integrity": "sha512-kN9dJbvnySHULIluDHy32WHRUu3Og7B9sbY7tsFLctQkIqnMh3hErYgdMjTYuqmcXX+lK5T1lnUt3G7zNswmZA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "spdx-expression-parse": "^3.0.0",
-        "spdx-license-ids": "^3.0.0"
-      }
-    },
-    "node_modules/spdx-exceptions": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.5.0.tgz",
-      "integrity": "sha512-PiU42r+xO4UbUS1buo3LPJkjlO7430Xn5SVAhdpzzsPHsjbYVflnnFdATgabnLude+Cqu25p6N+g2lw/PFsa4w==",
-      "dev": true,
-      "license": "CC-BY-3.0"
-    },
-    "node_modules/spdx-expression-parse": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
-      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "spdx-exceptions": "^2.1.0",
-        "spdx-license-ids": "^3.0.0"
-      }
-    },
-    "node_modules/spdx-license-ids": {
-      "version": "3.0.22",
-      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.22.tgz",
-      "integrity": "sha512-4PRT4nh1EImPbt2jASOKHX7PB7I+e4IWNLvkKFDxNhJlfjbYlleYQh285Z/3mPTHSAK/AvdMmw5BNNuYH8ShgQ==",
-      "dev": true,
-      "license": "CC0-1.0"
-    },
     "node_modules/sprintf-js": {
       "version": "1.1.3",
       "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.1.3.tgz",
@@ -5152,19 +3522,6 @@
       "license": "BSD-3-Clause",
       "optional": true
     },
-    "node_modules/ssri": {
-      "version": "12.0.0",
-      "resolved": "https://registry.npmjs.org/ssri/-/ssri-12.0.0.tgz",
-      "integrity": "sha512-S7iGNosepx9RadX82oimUkvr0Ct7IjJbEbs4mJcTxst8um95J3sDYU1RBEOvdu6oL1Wek2ODI5i4MAw+dZ6cAQ==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^7.0.3"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
     "node_modules/stat-mode": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/stat-mode/-/stat-mode-1.0.0.tgz",
@@ -5176,13 +3533,13 @@
       }
     },
     "node_modules/string_decoder": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
-      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "safe-buffer": "~5.2.0"
+        "safe-buffer": "~5.1.0"
       }
     },
     "node_modules/string-width": {
@@ -5200,22 +3557,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/string-width-cjs": {
-      "name": "string-width",
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/strip-ansi": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
@@ -5229,53 +3570,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/strip-ansi-cjs": {
-      "name": "strip-ansi",
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/strip-bom": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-3.0.0.tgz",
-      "integrity": "sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/strip-outer": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/strip-outer/-/strip-outer-1.0.1.tgz",
-      "integrity": "sha512-k55yxKHwaXnpYGsOzg4Vl8+tDrWylxDEpknGjhTiZB8dFRU5rTo9CAzeycivxV3s+zlTKwrs6WxMxR95n26kwg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "escape-string-regexp": "^1.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/strip-outer/node_modules/escape-string-regexp": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
-      "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.8.0"
-      }
-    },
     "node_modules/sumchecker": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/sumchecker/-/sumchecker-3.0.1.tgz",
@@ -5302,98 +3596,31 @@
         "node": ">=8"
       }
     },
-    "node_modules/supports-preserve-symlinks-flag": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
-      "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
     "node_modules/tar": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-6.2.1.tgz",
-      "integrity": "sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==",
+      "version": "7.5.22",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+      "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "dependencies": {
-        "chownr": "^2.0.0",
-        "fs-minipass": "^2.0.0",
-        "minipass": "^5.0.0",
-        "minizlib": "^2.1.1",
-        "mkdirp": "^1.0.3",
-        "yallist": "^4.0.0"
+        "@isaacs/fs-minipass": "^4.0.0",
+        "chownr": "^3.0.0",
+        "minipass": "^7.1.2",
+        "minizlib": "^3.1.0",
+        "yallist": "^5.0.0"
       },
       "engines": {
-        "node": ">=10"
+        "node": ">=18"
       }
     },
-    "node_modules/tar/node_modules/fs-minipass": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz",
-      "integrity": "sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^3.0.0"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/tar/node_modules/fs-minipass/node_modules/minipass": {
-      "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/tar/node_modules/minipass": {
+    "node_modules/tar/node_modules/yallist": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-5.0.0.tgz",
-      "integrity": "sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
+      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/tar/node_modules/minizlib": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-2.1.2.tgz",
-      "integrity": "sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "minipass": "^3.0.0",
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/tar/node_modules/minizlib/node_modules/minipass": {
-      "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
+        "node": ">=18"
       }
     },
     "node_modules/temp": {
@@ -5402,6 +3629,7 @@
       "integrity": "sha512-yYrrsWnrXMcdsnu/7YMYAofM1ktpL5By7vZhf15CrXijWWrEYZks5AXBudalfSWJLlnen/QUJUB5aoB0kqZUGA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "mkdirp": "^0.5.1",
         "rimraf": "~2.6.2"
@@ -5437,9 +3665,9 @@
       }
     },
     "node_modules/temp-file/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5459,19 +3687,6 @@
         "node": ">= 10.0.0"
       }
     },
-    "node_modules/temp/node_modules/mkdirp": {
-      "version": "0.5.6",
-      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
-      "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "minimist": "^1.2.6"
-      },
-      "bin": {
-        "mkdirp": "bin/cmd.js"
-      }
-    },
     "node_modules/tiny-async-pool": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/tiny-async-pool/-/tiny-async-pool-1.3.0.tgz",
@@ -5493,14 +3708,14 @@
       }
     },
     "node_modules/tinyglobby": {
-      "version": "0.2.15",
-      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz",
-      "integrity": "sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==",
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "fdir": "^6.5.0",
-        "picomatch": "^4.0.3"
+        "picomatch": "^4.0.4"
       },
       "engines": {
         "node": ">=12.0.0"
@@ -5510,9 +3725,9 @@
       }
     },
     "node_modules/tmp": {
-      "version": "0.2.5",
-      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.5.tgz",
-      "integrity": "sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==",
+      "version": "0.2.7",
+      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.7.tgz",
+      "integrity": "sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5529,29 +3744,6 @@
         "tmp": "^0.2.0"
       }
     },
-    "node_modules/trim-repeated": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/trim-repeated/-/trim-repeated-1.0.0.tgz",
-      "integrity": "sha512-pkonvlKk8/ZuR0D5tLW8ljt5I8kmxp2XKymhepUeOdCEfKpZaktSArkLHZt76OB1ZvO9bssUsDty4SWhLvZpLg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "escape-string-regexp": "^1.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/trim-repeated/node_modules/escape-string-regexp": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
-      "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.8.0"
-      }
-    },
     "node_modules/truncate-utf8-bytes": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/truncate-utf8-bytes/-/truncate-utf8-bytes-1.0.2.tgz",
@@ -5562,6 +3754,13 @@
         "utf8-byte-length": "^1.0.1"
       }
     },
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "dev": true,
+      "license": "0BSD"
+    },
     "node_modules/type-fest": {
       "version": "0.13.1",
       "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.13.1.tgz",
@@ -5576,39 +3775,23 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/undici": {
+      "version": "6.28.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
+      "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.17"
+      }
+    },
     "node_modules/undici-types": {
-      "version": "5.26.5",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
-      "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==",
+      "version": "7.18.2",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
+      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/unique-filename": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/unique-filename/-/unique-filename-4.0.0.tgz",
-      "integrity": "sha512-XSnEewXmQ+veP7xX2dS5Q4yZAvO40cBN2MWkJ7D/6sW4Dg6wYBNwM1Vrnz1FhH5AdeLIlUXRI9e28z1YZi71NQ==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "unique-slug": "^5.0.0"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
-    "node_modules/unique-slug": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/unique-slug/-/unique-slug-5.0.0.tgz",
-      "integrity": "sha512-9OdaqO5kwqR+1kVgHAhsp5vPNU0hnxRa26rBFNfNgM7M6pNtgzeBn3s/xbyCQL3dcjzOatcef6UUHpB/6MaETg==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "imurmurhash": "^0.1.4"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
     "node_modules/universalify": {
       "version": "0.1.2",
       "resolved": "https://registry.npmjs.org/universalify/-/universalify-0.1.2.tgz",
@@ -5619,14 +3802,56 @@
         "node": ">= 4.0.0"
       }
     },
-    "node_modules/uri-js": {
-      "version": "4.4.1",
-      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
-      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
+    "node_modules/unzipper": {
+      "version": "0.12.5",
+      "resolved": "https://registry.npmjs.org/unzipper/-/unzipper-0.12.5.tgz",
+      "integrity": "sha512-tXYOi9R57Uj/2Z25SOs5RRSzq886MBQj2gY8dPL+xl/kv6s6SvByoKfAtvfVeEuhntWDgjd2o9p2lb4TVPAz0A==",
       "dev": true,
-      "license": "BSD-2-Clause",
+      "license": "MIT",
       "dependencies": {
-        "punycode": "^2.1.0"
+        "bluebird": "~3.7.2",
+        "duplexer2": "~0.1.4",
+        "fs-extra": "11.3.1",
+        "graceful-fs": "^4.2.2",
+        "node-int64": "^0.4.0"
+      }
+    },
+    "node_modules/unzipper/node_modules/fs-extra": {
+      "version": "11.3.1",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.1.tgz",
+      "integrity": "sha512-eXvGGwZ5CL17ZSwHWd3bbgk7UUpF6IFHtP57NYYakPvHOs8GDgDe5KJI36jIJzDkJ6eJjuzRA8eBQb6SkKue0g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^6.0.1",
+        "universalify": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=14.14"
+      }
+    },
+    "node_modules/unzipper/node_modules/jsonfile": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "universalify": "^2.0.0"
+      },
+      "optionalDependencies": {
+        "graceful-fs": "^4.1.6"
+      }
+    },
+    "node_modules/unzipper/node_modules/universalify": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
+      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 10.0.0"
       }
     },
     "node_modules/utf8-byte-length": {
@@ -5643,41 +3868,18 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/validate-npm-package-license": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/validate-npm-package-license/-/validate-npm-package-license-3.0.4.tgz",
-      "integrity": "sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "spdx-correct": "^3.0.0",
-        "spdx-expression-parse": "^3.0.0"
-      }
-    },
-    "node_modules/verror": {
-      "version": "1.10.1",
-      "resolved": "https://registry.npmjs.org/verror/-/verror-1.10.1.tgz",
-      "integrity": "sha512-veufcmxri4e3XSrT0xwfUR7kguIkaxBeosDg00yDWhk49wdwkSUrvvsm7nc75e1PUyvIeZj6nS8VQRYz2/S4Xg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "assert-plus": "^1.0.0",
-        "core-util-is": "1.0.2",
-        "extsprintf": "^1.2.0"
-      },
-      "engines": {
-        "node": ">=0.6.0"
-      }
-    },
-    "node_modules/wcwidth": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/wcwidth/-/wcwidth-1.0.1.tgz",
-      "integrity": "sha512-XHPEwS0q6TaxcvG85+8EYkbiCux2XtWG2mkc47Ng2A77BQu9+DqIOJldST4HgPkuea7dvKSj5VgX3P1d4rW8Tg==",
+    "node_modules/webcrypto-core": {
+      "version": "1.9.2",
+      "resolved": "https://registry.npmjs.org/webcrypto-core/-/webcrypto-core-1.9.2.tgz",
+      "integrity": "sha512-gsXecm82UQNlTBURJGuqOWy1Ww08S3kZUcr3aOJS02Pk0xLtkfeUAVC0u0xhgdonFme80edSJUIJyuvL/7250Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "defaults": "^1.0.3"
+        "@peculiar/asn1-schema": "^2.7.0",
+        "@peculiar/json-schema": "^1.1.12",
+        "@peculiar/utils": "^2.0.2",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
       }
     },
     "node_modules/which": {
@@ -5714,25 +3916,6 @@
         "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
       }
     },
-    "node_modules/wrap-ansi-cjs": {
-      "name": "wrap-ansi",
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
     "node_modules/wrappy": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
@@ -5768,9 +3951,9 @@
       "license": "ISC"
     },
     "node_modules/yargs": {
-      "version": "17.7.2",
-      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz",
-      "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==",
+      "version": "17.7.3",
+      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.3.tgz",
+      "integrity": "sha512-GZtjxm/J/4TSxuL3FNYjCmLktBTnIw/rVmKSIyKeYAZpmJB2ig9VauCC5xsa82GNKVKDAqpOn3KVzNt0zmrU0g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5796,17 +3979,6 @@
         "node": ">=12"
       }
     },
-    "node_modules/yauzl": {
-      "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz",
-      "integrity": "sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "buffer-crc32": "~0.2.3",
-        "fd-slicer": "~1.1.0"
-      }
-    },
     "node_modules/yocto-queue": {
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
diff --git a/package.json b/package.json
index 7cd11d3..cec0eeb 100644
--- a/package.json
+++ b/package.json
@@ -1,13 +1,16 @@
 {
   "name": "alta-api-client",
-  "version": "1.0.0",
-  "description": "Electron app for connecting to Alta API",
+  "version": "1.2.5",
+  "description": "Secure Windows Electron client for the Alta Camera Proxy",
   "main": "main.js",
   "scripts": {
     "start": "electron .",
     "dev": "electron . --dev",
+    "test": "node --test test/*.test.js",
+    "check": "node scripts/verify-kit.js && npm test",
+    "audit:prod": "npm audit --omit=dev --audit-level=low",
     "build": "electron-builder --win --publish=never",
-    "build-test": "electron-builder --win --dir",
+    "build-test": "electron-builder --win --dir --publish=never",
     "build-kit": "powershell -ExecutionPolicy Bypass -File build-kit.ps1",
     "prebuild": "echo Checking build requirements..."
   },
@@ -17,15 +20,29 @@
     "directories": {
       "output": "dist"
     },
+    "files": [
+      "main.js",
+      "preload.js",
+      "renderer.js",
+      "renderer-controller.js",
+      "well-formed-string.js",
+      "device-tree.js",
+      "sidebar-controller.js",
+      "sidebar-view.js",
+      "index.html",
+      "styles.css",
+      "src/**/*",
+      "chrome-extension/**/*",
+      "assets/**/*",
+      "package.json"
+    ],
     "win": {
       "target": "portable",
-      "icon": "assets/icon.png",
-      "signAndEditExecutable": false
+      "icon": "assets/icon.png"
     },
     "portable": {
       "artifactName": "AltaCameraProxy-${version}-portable.exe"
-    },
-    "forceCodeSigning": false
+    }
   },
   "keywords": [
     "electron",
@@ -33,15 +50,13 @@
     "api",
     "avigilon"
   ],
-  "author": "Your Name",
+  "author": "Peji",
   "license": "MIT",
   "devDependencies": {
-    "electron": "^28.0.0",
-    "electron-builder": "^26.4.0",
-    "electron-packager": "^17.1.2"
+    "electron": "43.4.1",
+    "electron-builder": "26.15.3"
   },
   "dependencies": {
-    "axios": "^1.6.0",
-    "crypto-js": "^4.2.0"
+    "axios": "1.19.0"
   }
 }
diff --git a/preload.js b/preload.js
index bc3131e..1d1b77c 100644
--- a/preload.js
+++ b/preload.js
@@ -1,38 +1,28 @@
+'use strict';
+
 const { contextBridge, ipcRenderer } = require('electron');
 
-// Expose protected methods that allow the renderer process to use
-// the ipcRenderer without exposing the entire object
-contextBridge.exposeInMainWorld('electronAPI', {
-  getDevices: (params) => ipcRenderer.invoke('api-get-devices', params),
-  getDeviceSites: (params) => ipcRenderer.invoke('api-get-device-sites', params),
-  getAuthInfo: (params) => ipcRenderer.invoke('api-get-auth-info', params),
+function onConnectionStateChanged(callback) {
+  if (typeof callback !== 'function') return () => {};
+  const listener = (_event, state) => callback(state);
+  ipcRenderer.on('connection-state-changed', listener);
+  return () => ipcRenderer.removeListener('connection-state-changed', listener);
+}
 
-  // Camera proxy functionality
-  launchCookieCameraProxy: (params) => ipcRenderer.invoke('camera-proxy-cookie-launch', params),
-  stopCameraProxy: (processId) => ipcRenderer.invoke('camera-proxy-stop', { processId }),
-
-  // Extension cookie bridge (push from main process)
-  onExtensionCookie: (callback) => {
-    ipcRenderer.on('extension-cookie-received', (event, data) => {
-      try {
-        callback(data);
-      } catch (error) {
-        console.error('Extension cookie handler error:', error);
-      }
-    });
-  },
-
-  // Self-update functionality
+contextBridge.exposeInMainWorld('electronAPI', Object.freeze({
+  getDevices: () => ipcRenderer.invoke('get-devices'),
+  getDeviceSites: () => ipcRenderer.invoke('get-device-sites'),
+  getDeviceGroups: () => ipcRenderer.invoke('get-device-groups'),
+  getDeviceHierarchy: () => ipcRenderer.invoke('get-device-hierarchy'),
+  getAuthInfo: () => ipcRenderer.invoke('get-auth-info'),
+  launchProxy: (deviceId) => ipcRenderer.invoke('launch-proxy', deviceId),
+  stopProxy: (key) => ipcRenderer.invoke('stop-proxy', key),
+  disconnect: () => ipcRenderer.invoke('disconnect'),
+  getConnectionState: () => ipcRenderer.invoke('get-connection-state'),
   checkForUpdates: () => ipcRenderer.invoke('check-for-updates'),
-  downloadAndInstallUpdate: (params) => ipcRenderer.invoke('download-and-install-update', params),
-  getCurrentVersion: () => ipcRenderer.invoke('get-current-version'),
-  onUpdateDownloadProgress: (callback) => {
-    ipcRenderer.on('update-download-progress', (event, data) => {
-      try {
-        callback(data);
-      } catch (error) {
-        console.error('Update download progress handler error:', error);
-      }
-    });
-  }
-});
\ No newline at end of file
+  openFixedReleasesPage: () => ipcRenderer.invoke('open-fixed-releases-page'),
+  rotatePairing: () => ipcRenderer.invoke('rotate-pairing'),
+  revokePairing: () => ipcRenderer.invoke('revoke-pairing'),
+  getPairingStatus: () => ipcRenderer.invoke('get-pairing-status'),
+  onConnectionStateChanged,
+}));
diff --git a/renderer-controller.js b/renderer-controller.js
new file mode 100644
index 0000000..942c602
--- /dev/null
+++ b/renderer-controller.js
@@ -0,0 +1,50 @@
+'use strict';
+
+(function exposeRendererController(globalScope) {
+  function shouldShowPairingOnboarding({
+    paired = false,
+    secretVisible = false,
+    connected = false,
+    manuallyOpen = false,
+  } = {}) {
+    return manuallyOpen || !paired || (secretVisible && !connected);
+  }
+
+  function createRendererController({
+    disconnect,
+    renderConnectionState,
+    clearDisconnectedState,
+    showConnectionStatus,
+  } = {}) {
+    if (
+      typeof disconnect !== 'function' ||
+      typeof renderConnectionState !== 'function' ||
+      typeof clearDisconnectedState !== 'function' ||
+      typeof showConnectionStatus !== 'function'
+    ) {
+      throw new TypeError('Renderer controller dependencies are invalid.');
+    }
+
+    return Object.freeze({
+      async disconnect() {
+        const result = await disconnect();
+        if (!result || result.success !== true) {
+          const message = result && typeof result.message === 'string'
+            ? result.message
+            : 'Failed to disconnect from Alta. The current connection remains active.';
+          showConnectionStatus(message, 'error');
+          return result;
+        }
+
+        renderConnectionState(result);
+        clearDisconnectedState();
+        showConnectionStatus('Disconnected from Alta.', 'info');
+        return result;
+      },
+    });
+  }
+
+  const api = Object.freeze({ createRendererController, shouldShowPairingOnboarding });
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+  if (globalScope) globalScope.AptRendererController = api;
+}(typeof window !== 'undefined' ? window : undefined));
diff --git a/renderer.js b/renderer.js
index 2ee09b7..e0ea6b2 100644
--- a/renderer.js
+++ b/renderer.js
@@ -1,764 +1,382 @@
-// Global variables to store session data
-let sessionData = {
-    deploymentUrl: '',
-    cookies: null,
-    isConnected: false
-};
+'use strict';
 
-// DOM elements
 const connectionStatus = document.getElementById('connectionStatus');
 const deviceStatus = document.getElementById('deviceStatus');
 const deviceList = document.getElementById('deviceList');
+const treeSpacer = document.getElementById('treeSpacer');
+const treeWindow = document.getElementById('treeWindow');
+const deviceResults = document.getElementById('deviceResults');
 const statusIndicator = document.getElementById('statusIndicator');
 const deviceSearch = document.getElementById('deviceSearch');
-
-// Connection buttons
 const disconnectBtn = document.getElementById('disconnectBtn');
-
-// Cookie proxy elements
-const cookieDeviceUUID = document.getElementById('cookieDeviceUUID');
-const cookieKey = document.getElementById('cookieKey');
-const startCookieProxyBtn = document.getElementById('startCookieProxyBtn');
-const stopCookieProxyBtn = document.getElementById('stopCookieProxyBtn');
-
-// Update elements
+const selectedDeviceId = document.getElementById('selectedDeviceId');
+const startProxyBtn = document.getElementById('startProxyBtn');
+const stopProxyBtn = document.getElementById('stopProxyBtn');
 const checkUpdateBtn = document.getElementById('checkUpdateBtn');
-const updateModalOverlay = document.getElementById('updateModalOverlay');
-const updateModalCloseBtn = document.getElementById('updateModalCloseBtn');
-const updateModalMessage = document.getElementById('updateModalMessage');
-const updateModalNotes = document.getElementById('updateModalNotes');
-const updateProgressContainer = document.getElementById('updateProgressContainer');
-const updateProgressFill = document.getElementById('updateProgressFill');
-const updateProgressText = document.getElementById('updateProgressText');
-const updateInstallBtn = document.getElementById('updateInstallBtn');
-const updateLaterBtn = document.getElementById('updateLaterBtn');
+const updateNotice = document.getElementById('updateNotice');
+const updateMessage = document.getElementById('updateMessage');
+const openReleasesBtn = document.getElementById('openReleasesBtn');
+const dismissUpdateBtn = document.getElementById('dismissUpdateBtn');
+const pairingSection = document.getElementById('pairingSection');
+const managePairingBtn = document.getElementById('managePairingBtn');
+const pairingState = document.getElementById('pairingState');
+const pairingSecret = document.getElementById('pairingSecret');
+const pairingSecretRow = document.getElementById('pairingSecretRow');
+const rotatePairingBtn = document.getElementById('rotatePairingBtn');
+const revokePairingBtn = document.getElementById('revokePairingBtn');
+const hidePairingBtn = document.getElementById('hidePairingBtn');
 
-// Track selected device
+const ROW_HEIGHT = window.AptSidebarView.ROW_HEIGHT;
+let connection = { connected: false, origin: null, activeProxies: [] };
 let selectedDevice = null;
-let activeCookieProxyConnections = new Map(); // Track cookie-based proxy connections
-let allDevices = []; // Store all devices for search functionality
-let allSites = {}; // Store site id → site name mapping
-let collapsedSites = new Set(); // Track which site groups are collapsed
-let pendingUpdateInfo = null; // Store update info for install action
+let hierarchyModel = null;
+let sidebarController = null;
+let loadGeneration = 0;
+let searchTimer = null;
+let scrollFrame = null;
+let pairingView = { paired: false, secretVisible: false, manuallyOpen: false };
 
-// Event listeners
-disconnectBtn.addEventListener('click', handleDisconnect);
-
-// Cookie proxy event listeners
-startCookieProxyBtn.addEventListener('click', handleStartCookieProxy);
-stopCookieProxyBtn.addEventListener('click', handleStopCookieProxy);
-
-// Cookie key input listener to update button states
-cookieKey.addEventListener('input', updateCookieProxyButtonStates);
-
-// Device search event listener
-deviceSearch.addEventListener('input', handleDeviceSearch);
-
-// Update event listeners
-checkUpdateBtn.addEventListener('click', handleCheckForUpdates);
-updateInstallBtn.addEventListener('click', handleInstallUpdate);
-updateLaterBtn.addEventListener('click', closeUpdateModal);
-updateModalCloseBtn.addEventListener('click', closeUpdateModal);
-
-// Handle disconnect
-function handleDisconnect() {
-    sessionData.isConnected = false;
-    sessionData.cookies = null;
-    sessionData.deploymentUrl = '';
-    selectedDevice = null;
-    activeCookieProxyConnections.clear();
-    allDevices = []; // Clear stored devices
-    allSites = {}; // Clear site data
-    collapsedSites.clear();
-
-    updateConnectionStatus(false);
-    updateButtonStates();
-    clearDeviceList();
-    cookieDeviceUUID.value = '';
-    cookieKey.value = '';
-    deviceSearch.value = ''; // Clear search input
-
-    // Clear device status message
-    deviceStatus.style.display = 'none';
-    deviceStatus.textContent = '';
-
-    showStatus(connectionStatus, 'Disconnected from API', 'info');
+function renderPairingVisibility() {
+  const visible = window.AptRendererController.shouldShowPairingOnboarding({
+    ...pairingView,
+    connected: connection.connected,
+  });
+  pairingSection.hidden = !visible;
+  managePairingBtn.hidden = visible || !pairingView.paired;
+  hidePairingBtn.hidden = !pairingView.paired;
 }
 
-// Handle start cookie proxy
-async function handleStartCookieProxy() {
-    if (!selectedDevice) {
-        showStatus(connectionStatus, 'Please select a device first', 'error');
-        return;
-    }
-
-    const cookieKeyValue = cookieKey.value.trim();
-    if (!cookieKeyValue) {
-        showStatus(connectionStatus, 'Please enter a cookie key', 'error');
-        return;
-    }
-
-    if (!sessionData.deploymentUrl) {
-        showStatus(connectionStatus, 'Please connect to API first to get deployment URL', 'error');
-        return;
-    }
-
-    // Check if this device already has an active cookie connection
-    const deviceId = selectedDevice.guid || selectedDevice.id;
-    if (activeCookieProxyConnections.has(deviceId)) {
-        showStatus(connectionStatus, `Cookie proxy already running for device ${selectedDevice.name}`, 'warning');
-        return;
-    }
-
-    // Disable button during launch
-    startCookieProxyBtn.disabled = true;
-    showStatus(connectionStatus, `Starting cookie proxy for device ${selectedDevice.name}...`, 'info');
-
-    try {
-        const result = await window.electronAPI.launchCookieCameraProxy({
-            deploymentUrl: sessionData.deploymentUrl,
-            cookieKey: cookieKeyValue,
-            deviceUuid: deviceId
-        });
-
-        if (result.success) {
-            // Track this connection
-            activeCookieProxyConnections.set(deviceId, {
-                processId: result.processId,
-                deviceName: selectedDevice.name,
-                deviceId: deviceId,
-                startTime: Date.now(),
-                type: 'cookie'
-            });
-
-            updateCookieProxyButtonStates();
-            showStatus(connectionStatus, `${result.message} (Cookie proxy active for ${selectedDevice.name})`, 'success');
-        } else {
-            showStatus(connectionStatus, `Failed to start cookie proxy: ${result.message}`, 'error');
-        }
-    } catch (error) {
-        console.error('Cookie proxy launch error:', error);
-        showStatus(connectionStatus, `Error launching cookie proxy: ${error.message}`, 'error');
-    } finally {
-        startCookieProxyBtn.disabled = false;
-    }
-}
-
-// Handle stop cookie proxy
-async function handleStopCookieProxy() {
-    if (activeCookieProxyConnections.size === 0) {
-        showStatus(connectionStatus, 'No active cookie proxy connections found', 'warning');
-        return;
-    }
-
-    showStatus(connectionStatus, 'Stopping cookie proxy connections...', 'info');
-
-    try {
-        const result = await window.electronAPI.stopCameraProxy(null); // Stop all processes
-
-        if (result.success) {
-            activeCookieProxyConnections.clear();
-            showStatus(connectionStatus, 'Cookie proxy connections stopped successfully', 'success');
-
-            // Update visual indicators for all devices
-            const deviceItems = deviceList.querySelectorAll('.device-item');
-            deviceItems.forEach(item => {
-                item.classList.remove('cookie-proxy-active');
-            });
-        } else {
-            showStatus(connectionStatus, `Failed to stop cookie proxy: ${result.message}`, 'warning');
-        }
-    } catch (error) {
-        console.error('Stop cookie proxy error:', error);
-        showStatus(connectionStatus, 'Error stopping cookie proxy', 'error');
-    }
-
-    updateCookieProxyButtonStates();
-}
-
-// Update cookie proxy button states
-function updateCookieProxyButtonStates() {
-    const hasSelectedDevice = selectedDevice !== null;
-    const hasCookieKey = cookieKey.value.trim().length > 0;
-    const hasActiveConnection = activeCookieProxyConnections.size > 0;
-
-    if (sessionData.isConnected && hasSelectedDevice && hasCookieKey) {
-        const deviceId = selectedDevice.guid || selectedDevice.id;
-        const isThisDeviceActive = activeCookieProxyConnections.has(deviceId);
-
-        startCookieProxyBtn.disabled = isThisDeviceActive;
-        stopCookieProxyBtn.disabled = !hasActiveConnection;
-    } else {
-        startCookieProxyBtn.disabled = true;
-        stopCookieProxyBtn.disabled = !hasActiveConnection;
-    }
-}
-
-// Update connection status indicator
-function updateConnectionStatus(connected) {
-    const statusDot = statusIndicator.querySelector('.status-dot');
-    const statusText = statusIndicator.querySelector('.status-text');
-
-    if (connected) {
-        statusDot.className = 'status-dot online';
-        statusText.textContent = 'Connected';
-    } else {
-        statusDot.className = 'status-dot offline';
-        statusText.textContent = 'Disconnected';
-    }
-}
-
-// Update button states based on connection status
-function updateButtonStates() {
-    if (sessionData.isConnected) {
-        disconnectBtn.disabled = false;
-    } else {
-        disconnectBtn.disabled = true;
-        startCookieProxyBtn.disabled = true;
-        stopCookieProxyBtn.disabled = true;
-    }
-
-    // Always update cookie proxy button states
-    updateCookieProxyButtonStates();
-}
-
-// Fetch device sites and build id → name map
-async function fetchDeviceSites() {
-    try {
-        const result = await window.electronAPI.getDeviceSites({
-            deploymentUrl: sessionData.deploymentUrl,
-            cookies: sessionData.cookies
-        });
-
-        if (result.success && Array.isArray(result.sites)) {
-            allSites = {};
-            result.sites.forEach(site => {
-                if (site.id) {
-                    allSites[site.id] = site.name || 'Unnamed Site';
-                }
-            });
-        }
-    } catch (error) {
-        console.log('Could not fetch device sites:', error.message);
-        allSites = {};
-    }
-}
-
-// Handle get devices (now called automatically)
-async function handleGetDevices() {
-    if (!sessionData.isConnected) {
-        showStatus(deviceStatus, 'Please connect to the API first', 'error');
-        return;
-    }
-
-    showStatus(deviceStatus, 'Fetching devices...', 'info');
-    clearDeviceList();
-
-    try {
-        // Fetch devices and sites in parallel
-        const [devicesResult] = await Promise.all([
-            window.electronAPI.getDevices({
-                deploymentUrl: sessionData.deploymentUrl,
-                cookies: sessionData.cookies
-            }),
-            fetchDeviceSites()
-        ]);
-
-        if (devicesResult.success) {
-            // Filter devices to only show non-cloud cameras (localStorage = false)
-            const filteredDevices = devicesResult.devices.filter(device => {
-                // Check if device has capabilities and localStorage property
-                if (device.capabilities && device.capabilities.localStorage !== undefined) {
-                    // Only show devices where localStorage is false (non-cloud cameras)
-                    return device.capabilities.localStorage === false;
-                }
-                // If no capabilities or localStorage property, include the device (fallback)
-                return true;
-            });
-
-            const totalDevices = devicesResult.devices.length;
-            const filteredCount = filteredDevices.length;
-            const cloudDevicesHidden = totalDevices - filteredCount;
-
-            const siteCount = Object.keys(allSites).length;
-            let statusMessage = `Found ${filteredCount} local camera${filteredCount !== 1 ? 's' : ''}`;
-            if (siteCount > 0) {
-                statusMessage += ` across ${siteCount} site${siteCount !== 1 ? 's' : ''}`;
-            }
-            if (cloudDevicesHidden > 0) {
-                statusMessage += ` (${cloudDevicesHidden} cloud camera${cloudDevicesHidden !== 1 ? 's' : ''} hidden)`;
-            }
-
-            showStatus(deviceStatus, statusMessage, 'success');
-
-            // Store all devices for search functionality
-            allDevices = filteredDevices;
-            displayDevices(filteredDevices);
-        } else {
-            showStatus(deviceStatus, `Failed to get devices: ${devicesResult.message}`, 'error');
-        }
-    } catch (error) {
-        console.error('Get devices error:', error);
-        showStatus(deviceStatus, `Error getting devices: ${error.message}`, 'error');
-    }
-}
-
-// Helper function to determine device status from API data
-function getDeviceStatus(device) {
-    // Check for live.display_status first (Alta API standard)
-    if (device.live && device.live.display_status) {
-        const status = device.live.display_status.toLowerCase();
-
-        // Handle color-based status responses from Alta API
-        if (status === 'green') {
-            return {
-                isOnline: true,
-                statusText: 'Online'
-            };
-        } else if (status === 'red') {
-            return {
-                isOnline: false,
-                statusText: 'Offline'
-            };
-        } else if (status === 'yellow' || status === 'orange') {
-            return {
-                isOnline: false,
-                statusText: 'Warning'
-            };
-        }
-
-        // Handle text-based status responses
-        return {
-            isOnline: status === 'online' || status === 'live' || status === 'connected',
-            statusText: status === 'online' || status === 'live' || status === 'connected' ? 'Online' : 'Offline'
-        };
-    }
-
-    // Fallback to other possible status fields
-    if (device.online !== undefined) {
-        return {
-            isOnline: device.online,
-            statusText: device.online ? 'Online' : 'Offline'
-        };
-    }
-
-    if (device.status) {
-        const status = device.status.toLowerCase();
-
-        // Handle color-based status in other fields
-        if (status === 'green') {
-            return {
-                isOnline: true,
-                statusText: 'Online'
-            };
-        } else if (status === 'red') {
-            return {
-                isOnline: false,
-                statusText: 'Offline'
-            };
-        }
-
-        return {
-            isOnline: status === 'online' || status === 'live' || status === 'connected',
-            statusText: status === 'online' || status === 'live' || status === 'connected' ? 'Online' : 'Offline'
-        };
-    }
-
-    // Default to offline if no status information available
-    return {
-        isOnline: false,
-        statusText: 'Offline'
-    };
-}
-
-// Handle device search
-function handleDeviceSearch() {
-    const searchTerm = deviceSearch.value.toLowerCase().trim();
-
-    if (!searchTerm) {
-        // Show all devices if search is empty
-        displayDevices(allDevices);
-        return;
-    }
-
-    // Filter devices based on search term (includes site name)
-    const filteredDevices = allDevices.filter(device => {
-        const deviceName = (device.name || '').toLowerCase();
-        const deviceId = (device.guid || device.id || '').toLowerCase();
-        const deviceType = (device.type || '').toLowerCase();
-        const deviceModel = (device.model || '').toLowerCase();
-        const deviceIp = (device.ipAddress || '').toLowerCase();
-        const siteName = (device.server_group_id && allSites[device.server_group_id] || '').toLowerCase();
-
-        return deviceName.includes(searchTerm) ||
-               deviceId.includes(searchTerm) ||
-               deviceType.includes(searchTerm) ||
-               deviceModel.includes(searchTerm) ||
-               deviceIp.includes(searchTerm) ||
-               siteName.includes(searchTerm);
-    });
-
-    displayDevices(filteredDevices);
-}
-
-// Group devices by their site using server_group_id → allSites mapping
-function groupDevicesBySite(devices) {
-    const groups = {};
-    const ungrouped = [];
-
-    devices.forEach(device => {
-        const siteId = device.server_group_id;
-        const siteName = siteId && allSites[siteId] ? allSites[siteId] : null;
-
-        if (siteName) {
-            if (!groups[siteId]) {
-                groups[siteId] = { name: siteName, devices: [] };
-            }
-            groups[siteId].devices.push(device);
-        } else {
-            ungrouped.push(device);
-        }
-    });
-
-    return { groups, ungrouped };
-}
-
-// Create a device item DOM element
-function createDeviceItem(device, index) {
-    const deviceItem = document.createElement('div');
-    deviceItem.className = 'device-item';
-    deviceItem.dataset.deviceIndex = index;
-    deviceItem.dataset.deviceId = device.guid || device.id;
-
-    const status = getDeviceStatus(device);
-    const deviceId = device.guid || device.id;
-    const isCookieProxyActive = activeCookieProxyConnections.has(deviceId);
-
-    if (isCookieProxyActive) {
-        deviceItem.classList.add('cookie-proxy-active');
-    }
-
-    deviceItem.innerHTML = `
-        <div class="device-name">${escapeHtml(device.name || 'Unnamed Device')}</div>
-        <div class="device-status-dot ${status.isOnline ? 'online' : 'offline'}"></div>
-    `;
-
-    deviceItem.addEventListener('click', () => selectDevice(device, deviceItem));
-    return deviceItem;
-}
-
-// Display devices in the UI, grouped by site
-function displayDevices(devices) {
-    clearDeviceList();
-
-    if (!devices || devices.length === 0) {
-        const searchTerm = deviceSearch.value.toLowerCase().trim();
-        const message = searchTerm ? 'No devices match your search' : 'No devices found';
-        deviceList.innerHTML = `<p class="no-devices">${message}</p>`;
-        return;
-    }
-
-    const hasSites = Object.keys(allSites).length > 0;
-
-    // If no sites were fetched, fall back to flat list
-    if (!hasSites) {
-        devices.forEach((device, index) => {
-            deviceList.appendChild(createDeviceItem(device, index));
-        });
-        updateCookieProxyButtonStates();
-        return;
-    }
-
-    const { groups, ungrouped } = groupDevicesBySite(devices);
-
-    // Sort site groups alphabetically by name
-    const sortedSiteIds = Object.keys(groups).sort((a, b) =>
-        groups[a].name.localeCompare(groups[b].name)
-    );
-
-    let globalIndex = 0;
-
-    sortedSiteIds.forEach(siteId => {
-        const group = groups[siteId];
-        const isCollapsed = collapsedSites.has(siteId);
-
-        // Site header
-        const siteHeader = document.createElement('div');
-        siteHeader.className = 'site-group-header' + (isCollapsed ? ' collapsed' : '');
-        siteHeader.innerHTML = `
-            <span class="site-group-arrow">${isCollapsed ? '\u25B6' : '\u25BC'}</span>
-            <span class="site-group-name">${escapeHtml(group.name)}</span>
-            <span class="site-group-count">${group.devices.length}</span>
-        `;
-
-        siteHeader.addEventListener('click', () => {
-            if (collapsedSites.has(siteId)) {
-                collapsedSites.delete(siteId);
-            } else {
-                collapsedSites.add(siteId);
-            }
-            // Re-render with current search filter
-            const searchTerm = deviceSearch.value.toLowerCase().trim();
-            if (searchTerm) {
-                handleDeviceSearch();
-            } else {
-                displayDevices(allDevices);
-            }
-        });
-
-        deviceList.appendChild(siteHeader);
-
-        // Device items (hidden if collapsed)
-        if (!isCollapsed) {
-            group.devices.forEach(device => {
-                deviceList.appendChild(createDeviceItem(device, globalIndex++));
-            });
-        }
-    });
-
-    // Ungrouped devices at the bottom
-    if (ungrouped.length > 0) {
-        if (sortedSiteIds.length > 0) {
-            const ungroupedHeader = document.createElement('div');
-            ungroupedHeader.className = 'site-group-header' + (collapsedSites.has('__ungrouped') ? ' collapsed' : '');
-            ungroupedHeader.innerHTML = `
-                <span class="site-group-arrow">${collapsedSites.has('__ungrouped') ? '\u25B6' : '\u25BC'}</span>
-                <span class="site-group-name">Ungrouped</span>
-                <span class="site-group-count">${ungrouped.length}</span>
-            `;
-
-            ungroupedHeader.addEventListener('click', () => {
-                if (collapsedSites.has('__ungrouped')) {
-                    collapsedSites.delete('__ungrouped');
-                } else {
-                    collapsedSites.add('__ungrouped');
-                }
-                const searchTerm = deviceSearch.value.toLowerCase().trim();
-                if (searchTerm) {
-                    handleDeviceSearch();
-                } else {
-                    displayDevices(allDevices);
-                }
-            });
-
-            deviceList.appendChild(ungroupedHeader);
-        }
-
-        if (!collapsedSites.has('__ungrouped') || sortedSiteIds.length === 0) {
-            ungrouped.forEach(device => {
-                deviceList.appendChild(createDeviceItem(device, globalIndex++));
-            });
-        }
-    }
-
-    updateCookieProxyButtonStates();
-}
-
-// Handle device selection
-function selectDevice(device, deviceElement) {
-    // Remove previous selection
-    const previousSelected = deviceList.querySelector('.device-item.selected');
-    if (previousSelected) {
-        previousSelected.classList.remove('selected');
-    }
-
-    // Select current device
-    deviceElement.classList.add('selected');
-    selectedDevice = device;
-
-    // Auto-populate cookie device UUID field
-    const uuid = device.guid || device.id || '';
-    cookieDeviceUUID.value = uuid;
-
-    // Show device selection feedback with connection status
-    if (uuid) {
-        const isCookieActive = activeCookieProxyConnections.has(uuid);
-        const cookieStatusText = isCookieActive ? ' (COOKIE PROXY ACTIVE)' : '';
-        showStatus(connectionStatus, `Selected device: ${device.name || 'Unnamed Device'} (UUID: ${uuid})${cookieStatusText}`, 'info');
-    }
-
-    updateCookieProxyButtonStates();
-}
-
-// Utility functions
 function showStatus(element, message, type) {
-    element.textContent = message;
-    element.className = `status-message ${type}`;
-    element.style.display = 'block';
+  element.textContent = message;
+  element.className = `status-message ${type}`;
+  element.style.display = 'block';
 }
 
-function clearDeviceList() {
-    deviceList.innerHTML = '<p class="placeholder-text">Connect to API to load devices</p>';
-    selectedDevice = null;
+function activeDeviceIds() {
+  return new Set((connection.activeProxies || []).map((proxy) => String(proxy.deviceId || '').toLowerCase()));
 }
 
-function escapeHtml(text) {
-    if (typeof text !== 'string') return text;
-    const div = document.createElement('div');
-    div.textContent = text;
-    return div.innerHTML;
+function deviceStatusFor(device) {
+  const value = String(device && (device.displayStatus ?? device.status ?? device.online) || '').toLowerCase();
+  return ['green', 'online', 'live', 'connected', 'true'].includes(value);
 }
 
-// --- Self-Update Functions ---
+function updateProxyButtons() {
+  const id = selectedDevice && selectedDevice.id;
+  const active = id ? activeDeviceIds().has(id.toLowerCase()) : false;
+  startProxyBtn.disabled = !connection.connected || !id || active;
+  stopProxyBtn.disabled = !id || !active;
+}
 
-async function handleCheckForUpdates() {
-    checkUpdateBtn.disabled = true;
+function renderConnectionState(state) {
+  connection = {
+    connected: state && state.connected === true,
+    origin: state && typeof state.origin === 'string' ? state.origin : null,
+    activeProxies: state && Array.isArray(state.activeProxies) ? state.activeProxies : [],
+  };
+  const dot = statusIndicator.querySelector('.status-dot');
+  const text = statusIndicator.querySelector('.status-text');
+  dot.className = `status-dot ${connection.connected ? 'online' : 'offline'}`;
+  text.textContent = connection.connected ? 'Connected' : 'Disconnected';
+  disconnectBtn.disabled = !connection.connected;
+  if (connection.connected) {
+    pairingView.secretVisible = false;
+    pairingView.manuallyOpen = false;
+    pairingSecret.value = '';
+    pairingSecretRow.style.display = 'none';
+  }
+  renderPairingVisibility();
+  updateProxyButtons();
+  if (sidebarController) sidebarController.refresh();
+}
 
-    try {
-        const result = await window.electronAPI.checkForUpdates();
+function showTreePlaceholder(message) {
+  treeSpacer.style.height = '0px';
+  treeWindow.style.transform = '';
+  const placeholder = document.createElement('p');
+  placeholder.className = 'placeholder-text';
+  placeholder.textContent = message;
+  treeWindow.replaceChildren(placeholder);
+  deviceList.removeAttribute('aria-activedescendant');
+}
 
-        if (!result.success) {
-            showStatus(connectionStatus, result.message || 'Failed to check for updates', 'error');
-            return;
-        }
+function clearHierarchy() {
+  loadGeneration += 1;
+  if (searchTimer) clearTimeout(searchTimer);
+  searchTimer = null;
+  if (sidebarController) sidebarController.destroy();
+  sidebarController = null;
+  hierarchyModel = null;
+  selectedDevice = null;
+  selectedDeviceId.value = '';
+  deviceSearch.value = '';
+  deviceResults.textContent = connection.connected ? 'Loading cameras' : 'Connect to load cameras';
+  showTreePlaceholder(connection.connected
+    ? 'Loading devices...'
+    : 'Connect through the paired Chrome extension to load devices');
+  updateProxyButtons();
+}
 
-        if (result.message === 'No releases available yet') {
-            showStatus(connectionStatus, 'No releases available yet', 'info');
-            return;
-        }
+function syncSelection(snapshot) {
+  const selectedKey = snapshot && snapshot.state.selectedKey;
+  const camera = selectedKey && hierarchyModel ? hierarchyModel.cameraByKey.get(selectedKey) : null;
+  if (!camera) return;
+  if (selectedDevice && selectedDevice.id === camera.source.id) return;
+  selectedDevice = camera.source;
+  selectedDeviceId.value = selectedDevice.id;
+  showStatus(connectionStatus, `Selected device: ${selectedDevice.name || 'Unnamed Device'}`, 'info');
+  updateProxyButtons();
+}
 
-        if (result.updateAvailable) {
-            showUpdateModal(result);
-        } else {
-            showStatus(connectionStatus, `You're on the latest version (v${result.currentVersion})`, 'success');
-        }
-    } catch (error) {
-        console.error('Check for updates error:', error);
-        showStatus(connectionStatus, 'Could not check for updates. Check your internet connection.', 'error');
-    } finally {
-        checkUpdateBtn.disabled = false;
+function syncTreeScroll(snapshot) {
+  if (!snapshot) return;
+  const target = snapshot.state.scrollTop;
+  if (Math.abs(deviceList.scrollTop - target) >= ROW_HEIGHT) deviceList.scrollTop = target;
+}
+
+function describeHierarchyWarning(hierarchy, model) {
+  const diagnostics = hierarchy && hierarchy.diagnostics && typeof hierarchy.diagnostics === 'object'
+    ? hierarchy.diagnostics
+    : {};
+  const metadataErrors = hierarchy && hierarchy.metadataErrors && typeof hierarchy.metadataErrors === 'object'
+    ? hierarchy.metadataErrors
+    : {};
+  const unavailable = ['sites', 'groups'].filter((kind) => metadataErrors[kind] || (diagnostics[kind] && diagnostics[kind].error));
+  const issueCount = model.diagnostics.length;
+  if (!unavailable.length && issueCount === 0) return '';
+  const parts = [];
+  if (unavailable.length) parts.push(`${unavailable.join(' and ')} metadata unavailable`);
+  if (issueCount) parts.push(`${issueCount} hierarchy warning${issueCount === 1 ? '' : 's'}`);
+  return parts.join('; ');
+}
+
+function installHierarchy(hierarchy) {
+  hierarchyModel = window.AptDeviceTree.buildDeviceTreeModel(hierarchy);
+  const view = window.AptSidebarView.createSidebarView({
+    document,
+    tree: deviceList,
+    spacer: treeSpacer,
+    windowElement: treeWindow,
+    model: hierarchyModel,
+    getActiveDeviceIds: activeDeviceIds,
+    isOnline: deviceStatusFor,
+    onCommit: (snapshot) => {
+      const count = snapshot.state.searchQuery && snapshot.state.searchCameraKeys
+        ? snapshot.state.searchCameraKeys.size
+        : hierarchyModel.cameraCount;
+      deviceResults.textContent = snapshot.state.searchQuery
+        ? `${count} exact search result${count === 1 ? '' : 's'}.`
+        : `${count} camera${count === 1 ? '' : 's'}.`;
+    },
+  });
+  sidebarController = window.AptSidebarController.createSidebarController({
+    model: hierarchyModel,
+    view,
+    rowHeight: ROW_HEIGHT,
+    overscan: 16,
+    initialState: { viewportHeight: deviceList.clientHeight },
+  });
+}
+
+async function loadDevices() {
+  if (!connection.connected) return;
+  const generation = ++loadGeneration;
+  const origin = connection.origin;
+  showStatus(deviceStatus, 'Fetching camera hierarchy...', 'info');
+  try {
+    const result = await window.electronAPI.getDeviceHierarchy();
+    if (generation !== loadGeneration || !connection.connected || connection.origin !== origin) return;
+    if (!result.success) {
+      showStatus(deviceStatus, result.message || 'Failed to load cameras', 'error');
+      showTreePlaceholder('Could not load cameras');
+      return;
     }
+    const hierarchy = result.hierarchy || { devices: [], sites: [], groups: [] };
+    installHierarchy(hierarchy);
+    const warning = describeHierarchyWarning(hierarchy, hierarchyModel);
+    const count = hierarchyModel.cameraCount;
+    showStatus(
+      deviceStatus,
+      warning ? `Found ${count} camera${count === 1 ? '' : 's'}; ${warning}. Cameras remain available in fallback hierarchy.` : `Found ${count} camera${count === 1 ? '' : 's'}`,
+      warning ? 'warning' : 'success',
+    );
+  } catch {
+    if (generation !== loadGeneration) return;
+    showStatus(deviceStatus, 'Could not load cameras.', 'error');
+    showTreePlaceholder('Could not load cameras');
+  }
 }
 
-function showUpdateModal(updateInfo) {
-    pendingUpdateInfo = updateInfo;
-    updateModalMessage.textContent = `A new version is available: v${updateInfo.latestVersion} (current: v${updateInfo.currentVersion})`;
-    updateModalNotes.textContent = updateInfo.releaseNotes || '';
-
-    // Reset progress state
-    updateProgressContainer.style.display = 'none';
-    updateProgressFill.style.width = '0%';
-    updateProgressText.textContent = '0%';
-
-    // Reset button states
-    updateInstallBtn.disabled = !updateInfo.downloadUrl;
-    updateLaterBtn.disabled = false;
-    updateInstallBtn.textContent = 'Install Update';
-
-    if (!updateInfo.downloadUrl) {
-        updateModalMessage.textContent += '\n(No downloadable asset found for this release)';
-    }
-
-    updateModalOverlay.style.display = 'flex';
+function dispatchTree(action) {
+  if (!sidebarController) return null;
+  const snapshot = sidebarController.dispatch(action);
+  syncSelection(snapshot);
+  syncTreeScroll(snapshot);
+  return snapshot;
 }
 
-async function handleInstallUpdate() {
-    if (!pendingUpdateInfo || !pendingUpdateInfo.downloadUrl) return;
-
-    // Disable controls during download
-    updateInstallBtn.disabled = true;
-    updateInstallBtn.textContent = 'Downloading...';
-    updateLaterBtn.disabled = true;
-    updateModalCloseBtn.style.display = 'none';
-    updateProgressContainer.style.display = 'flex';
-
-    try {
-        const result = await window.electronAPI.downloadAndInstallUpdate({
-            downloadUrl: pendingUpdateInfo.downloadUrl
-        });
-
-        if (result.success) {
-            updateInstallBtn.textContent = 'Restarting...';
-            updateProgressFill.style.width = '100%';
-            updateProgressText.textContent = '100%';
-        } else {
-            showStatus(connectionStatus, `Update failed: ${result.message}`, 'error');
-            closeUpdateModal();
-        }
-    } catch (error) {
-        console.error('Install update error:', error);
-        showStatus(connectionStatus, 'Update failed. Please try again.', 'error');
-        closeUpdateModal();
-    }
-}
-
-function closeUpdateModal() {
-    updateModalOverlay.style.display = 'none';
-    pendingUpdateInfo = null;
-    updateProgressContainer.style.display = 'none';
-    updateProgressFill.style.width = '0%';
-    updateProgressText.textContent = '0%';
-    updateInstallBtn.textContent = 'Install Update';
-    updateInstallBtn.disabled = false;
-    updateLaterBtn.disabled = false;
-    updateModalCloseBtn.style.display = '';
-}
-
-async function checkForUpdatesOnStartup() {
-    try {
-        const result = await window.electronAPI.checkForUpdates();
-
-        if (result.success && result.updateAvailable) {
-            checkUpdateBtn.classList.add('update-available');
-            checkUpdateBtn.title = `Update available: v${result.latestVersion}`;
-            showStatus(connectionStatus, `Update available: v${result.latestVersion}`, 'info');
-            // Store for quick modal open
-            pendingUpdateInfo = result;
-        }
-    } catch (error) {
-        // Silent fail on startup check
-        console.log('Startup update check failed:', error.message);
-    }
-}
-
-// Handle cookie received from Chrome extension via local HTTP bridge
-async function handleExtensionCookie(data) {
-    const { deploymentUrl, cookies, cookieValue } = data;
-
-    // If already connected, disconnect first
-    if (sessionData.isConnected) {
-        handleDisconnect();
-    }
-
-    // Set session state from extension cookie
-    sessionData.deploymentUrl = deploymentUrl;
-    sessionData.cookies = cookies;
-    sessionData.isConnected = true;
-
-    showStatus(connectionStatus, `Connected via Chrome extension to ${deploymentUrl}`, 'success');
-    updateConnectionStatus(true);
-    updateButtonStates();
-
-    // Auto-populate cookie key
-    cookieKey.value = cookieValue;
-    updateCookieProxyButtonStates();
-
-    // Fetch devices
-    try {
-        await handleGetDevices();
-    } catch (err) {
-        console.error('Failed to fetch devices after extension cookie:', err);
-        showStatus(deviceStatus, 'Connected, but failed to load devices.', 'warning');
-    }
-}
-
-// Initialize the app
-document.addEventListener('DOMContentLoaded', async () => {
-    console.log('Alta Video Camera Proxy loaded');
-
-    // Initialize connection status
-    updateConnectionStatus(false);
-    updateButtonStates();
-
-    // Listen for cookies pushed from Chrome extension
-    window.electronAPI.onExtensionCookie(handleExtensionCookie);
-
-    // Listen for update download progress
-    window.electronAPI.onUpdateDownloadProgress((data) => {
-        updateProgressFill.style.width = `${data.percent}%`;
-        updateProgressText.textContent = `${data.percent}%`;
-    });
-
-    // Auto-check for updates after 2 seconds
-    setTimeout(checkForUpdatesOnStartup, 2000);
+const rendererController = window.AptRendererController.createRendererController({
+  disconnect: () => window.electronAPI.disconnect(),
+  renderConnectionState,
+  clearDisconnectedState: () => {
+    clearHierarchy();
+  },
+  showConnectionStatus: (message, type) => showStatus(connectionStatus, message, type),
 });
+
+async function handleDisconnect() {
+  await rendererController.disconnect();
+}
+
+async function handleStartProxy() {
+  const id = selectedDevice && selectedDevice.id;
+  if (!id) return;
+  startProxyBtn.disabled = true;
+  showStatus(connectionStatus, `Starting proxy for ${selectedDevice.name || 'selected device'}...`, 'info');
+  const result = await window.electronAPI.launchProxy(id);
+  if (result.success) {
+    renderConnectionState(await window.electronAPI.getConnectionState());
+    showStatus(connectionStatus, 'Camera proxy started.', 'success');
+  } else {
+    showStatus(connectionStatus, result.message || 'Failed to start camera proxy.', 'error');
+    updateProxyButtons();
+  }
+}
+
+async function handleStopProxy() {
+  const id = selectedDevice && selectedDevice.id;
+  if (!id) return;
+  stopProxyBtn.disabled = true;
+  const result = await window.electronAPI.stopProxy(id);
+  renderConnectionState(await window.electronAPI.getConnectionState());
+  showStatus(connectionStatus, result.success ? 'Camera proxy stopped.' : result.message || 'Failed to stop camera proxy.', result.success ? 'success' : 'error');
+}
+
+async function checkForUpdates(showCurrent = true) {
+  checkUpdateBtn.disabled = true;
+  try {
+    const result = await window.electronAPI.checkForUpdates();
+    if (!result.success) {
+      if (showCurrent) showStatus(connectionStatus, result.message, 'error');
+      return;
+    }
+    if (result.status === 'update-available') {
+      updateMessage.textContent = `${result.releaseName || `Version ${result.latestVersion}`} is available. APT will not download or run updates; review it on GitPeji.`;
+      updateNotice.style.display = 'flex';
+      checkUpdateBtn.classList.add('update-available');
+    } else if (showCurrent) {
+      const message = result.status === 'no-release'
+        ? 'No published release is available on GitPeji.'
+        : `You are on the latest version (v${result.currentVersion}).`;
+      showStatus(connectionStatus, message, 'success');
+    }
+  } finally {
+    checkUpdateBtn.disabled = false;
+  }
+}
+
+function renderPairingStatus(result) {
+  pairingView = {
+    paired: result.paired === true,
+    secretVisible: Boolean(result.secret),
+    manuallyOpen: Boolean(result.secret) || result.paired !== true,
+  };
+  pairingState.textContent = result.paired ? 'Paired' : 'Revoked / not paired';
+  pairingState.className = result.paired ? 'paired' : 'unpaired';
+  revokePairingBtn.disabled = !result.paired;
+  if (result.secret) {
+    pairingSecret.value = result.secret;
+    pairingSecretRow.style.display = 'block';
+    showStatus(connectionStatus, 'One-time bridge pairing secret generated. Paste it into the extension now; it will not be shown again.', 'info');
+  } else {
+    pairingSecret.value = '';
+    pairingSecretRow.style.display = 'none';
+  }
+  renderPairingVisibility();
+}
+
+async function runSearch(query) {
+  if (!sidebarController) return;
+  const result = await sidebarController.search(query);
+  if (result && !result.cancelled) {
+    const count = result.count;
+    deviceResults.textContent = query.trim()
+      ? `${count} exact search result${count === 1 ? '' : 's'}.`
+      : `${hierarchyModel.cameraCount} camera${hierarchyModel.cameraCount === 1 ? '' : 's'}.`;
+  }
+}
+
+async function initialize() {
+  renderConnectionState(await window.electronAPI.getConnectionState());
+  renderPairingStatus(await window.electronAPI.getPairingStatus());
+  if (connection.connected) await loadDevices();
+  window.electronAPI.onConnectionStateChanged(async (state) => {
+    const wasConnected = connection.connected;
+    const previousOrigin = connection.origin;
+    renderConnectionState(state);
+    if (!state.connected) {
+      clearHierarchy();
+      return;
+    }
+    if (state.connected && (!wasConnected || state.origin !== previousOrigin)) {
+      clearHierarchy();
+      showStatus(connectionStatus, `Connected to ${state.origin}`, 'success');
+      await loadDevices();
+    }
+  });
+  setTimeout(() => checkForUpdates(false), 2000);
+}
+
+deviceList.addEventListener('click', (event) => {
+  const row = event.target.closest('.tree-row[data-row-key]');
+  if (!row || !deviceList.contains(row)) return;
+  dispatchTree({ type: 'CLICK', rowKey: row.dataset.rowKey });
+  deviceList.focus();
+});
+deviceList.addEventListener('keydown', (event) => {
+  if (!['ArrowUp', 'ArrowDown', 'ArrowLeft', 'ArrowRight', 'Home', 'End', 'Enter', ' ', 'Spacebar', 'Escape'].includes(event.key)) return;
+  event.preventDefault();
+  dispatchTree({ type: 'KEY', key: event.key });
+  if (event.key === 'Escape') {
+    deviceSearch.value = '';
+    runSearch('');
+  }
+});
+deviceList.addEventListener('scroll', () => {
+  if (scrollFrame || !sidebarController) return;
+  scrollFrame = requestAnimationFrame(() => {
+    scrollFrame = null;
+    sidebarController.dispatch({ type: 'SET_VIEWPORT', scrollTop: deviceList.scrollTop, viewportHeight: deviceList.clientHeight });
+  });
+});
+deviceSearch.addEventListener('input', () => {
+  if (searchTimer) clearTimeout(searchTimer);
+  searchTimer = setTimeout(() => runSearch(deviceSearch.value), 125);
+});
+deviceSearch.addEventListener('keydown', (event) => {
+  if (event.key !== 'Escape') return;
+  event.preventDefault();
+  if (searchTimer) clearTimeout(searchTimer);
+  deviceSearch.value = '';
+  runSearch('');
+});
+disconnectBtn.addEventListener('click', handleDisconnect);
+startProxyBtn.addEventListener('click', handleStartProxy);
+stopProxyBtn.addEventListener('click', handleStopProxy);
+checkUpdateBtn.addEventListener('click', () => checkForUpdates(true));
+openReleasesBtn.addEventListener('click', () => window.electronAPI.openFixedReleasesPage());
+dismissUpdateBtn.addEventListener('click', () => { updateNotice.style.display = 'none'; });
+rotatePairingBtn.addEventListener('click', async () => renderPairingStatus(await window.electronAPI.rotatePairing()));
+revokePairingBtn.addEventListener('click', async () => renderPairingStatus(await window.electronAPI.revokePairing()));
+managePairingBtn.addEventListener('click', () => {
+  pairingView.manuallyOpen = true;
+  renderPairingVisibility();
+});
+hidePairingBtn.addEventListener('click', () => {
+  pairingView.manuallyOpen = false;
+  pairingView.secretVisible = false;
+  pairingSecret.value = '';
+  pairingSecretRow.style.display = 'none';
+  renderPairingVisibility();
+});
+document.addEventListener('DOMContentLoaded', () => { initialize().catch(() => showStatus(connectionStatus, 'Application initialization failed.', 'error')); });
diff --git a/scripts/verify-kit.js b/scripts/verify-kit.js
new file mode 100644
index 0000000..fc863ec
--- /dev/null
+++ b/scripts/verify-kit.js
@@ -0,0 +1,227 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const zlib = require('node:zlib');
+const { spawnSync } = require('node:child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const REQUIRED_EXTENSION_FILES = Object.freeze([
+  'manifest.json', 'popup.html', 'popup.js', 'popup.css',
+  'options.html', 'options.js', 'options.css',
+]);
+const TEXT_EXTENSIONS = new Set(['.css', '.html', '.js', '.json', '.md', '.ps1', '.yml', '.yaml']);
+const FORBIDDEN_PATTERNS = Object.freeze([
+  ['legacy bridge token', /apt-local-bridge-token/i],
+  ['legacy pairing header', /X-APT-Token/i],
+  ['legacy cookie proxy', /cookie-proxy-/i],
+  ['GitHub release API', /api\.github\.com/i],
+  ['executable updater', /download-and-install-update/i],
+  ['broad process termination', /taskkill/i],
+]);
+
+function fail(message) {
+  throw new Error(message);
+}
+
+function normalizeRelative(name) {
+  if (typeof name !== 'string' || name.length === 0 || name.includes('\0')) fail(`Unsafe empty or NUL path: ${name}`);
+  const unix = name.replaceAll('\\', '/');
+  if (unix.startsWith('/') || /^[A-Za-z]:\//.test(unix)) fail(`Unsafe absolute path: ${name}`);
+  const normalized = path.posix.normalize(unix);
+  if (normalized === '..' || normalized.startsWith('../')) fail(`Unsafe parent path: ${name}`);
+  return normalized.replace(/^\.\//, '');
+}
+
+function assertTextPolicy(name, content) {
+  for (const [label, pattern] of FORBIDDEN_PATTERNS) {
+    if (pattern.test(content)) fail(`Forbidden ${label} string in ${name}`);
+  }
+}
+
+function listDirectory(root, { ignoreTopLevel = [] } = {}) {
+  const absoluteRoot = path.resolve(root);
+  if (!fs.statSync(absoluteRoot).isDirectory()) fail(`Expected a directory: ${root}`);
+  const files = new Map();
+  const ignored = new Set(ignoreTopLevel);
+  const walk = (directory) => {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const absolute = path.join(directory, entry.name);
+      const relative = normalizeRelative(path.relative(absoluteRoot, absolute));
+      if (!relative.includes('/') && ignored.has(relative)) continue;
+      if (entry.isSymbolicLink()) fail(`Unsafe symbolic link: ${relative}`);
+      if (entry.isDirectory()) walk(absolute);
+      else if (entry.isFile()) files.set(relative, () => fs.readFileSync(absolute));
+      else fail(`Unsupported filesystem entry: ${relative}`);
+    }
+  };
+  walk(absoluteRoot);
+  return files;
+}
+
+function findEndOfCentralDirectory(buffer) {
+  const minimum = Math.max(0, buffer.length - 65_557);
+  for (let offset = buffer.length - 22; offset >= minimum; offset -= 1) {
+    if (buffer.readUInt32LE(offset) === 0x06054b50) return offset;
+  }
+  fail('Invalid ZIP: end-of-central-directory record not found');
+}
+
+function listZip(zipPath) {
+  const zip = fs.readFileSync(zipPath);
+  const end = findEndOfCentralDirectory(zip);
+  const entryCount = zip.readUInt16LE(end + 10);
+  let offset = zip.readUInt32LE(end + 16);
+  const files = new Map();
+
+  for (let index = 0; index < entryCount; index += 1) {
+    if (zip.readUInt32LE(offset) !== 0x02014b50) fail('Invalid ZIP central-directory entry');
+    const flags = zip.readUInt16LE(offset + 8);
+    const method = zip.readUInt16LE(offset + 10);
+    const compressedSize = zip.readUInt32LE(offset + 20);
+    const uncompressedSize = zip.readUInt32LE(offset + 24);
+    const nameLength = zip.readUInt16LE(offset + 28);
+    const extraLength = zip.readUInt16LE(offset + 30);
+    const commentLength = zip.readUInt16LE(offset + 32);
+    const externalAttributes = zip.readUInt32LE(offset + 38);
+    const localOffset = zip.readUInt32LE(offset + 42);
+    const name = normalizeRelative(zip.subarray(offset + 46, offset + 46 + nameLength).toString('utf8'));
+    offset += 46 + nameLength + extraLength + commentLength;
+    if (name.endsWith('/')) continue;
+    const unixMode = externalAttributes >>> 16;
+    if ((unixMode & 0o170000) === 0o120000) fail(`Unsafe ZIP symbolic link: ${name}`);
+    if ((flags & 1) !== 0) fail(`Encrypted ZIP entries are unsupported: ${name}`);
+    if (files.has(name)) fail(`Duplicate ZIP entry: ${name}`);
+
+    files.set(name, () => {
+      if (zip.readUInt32LE(localOffset) !== 0x04034b50) fail(`Invalid ZIP local entry: ${name}`);
+      const localNameLength = zip.readUInt16LE(localOffset + 26);
+      const localExtraLength = zip.readUInt16LE(localOffset + 28);
+      const start = localOffset + 30 + localNameLength + localExtraLength;
+      const compressed = zip.subarray(start, start + compressedSize);
+      const content = method === 0 ? compressed : method === 8 ? zlib.inflateRawSync(compressed) : fail(`Unsupported ZIP method ${method}: ${name}`);
+      if (content.length !== uncompressedSize) fail(`Invalid ZIP size for ${name}`);
+      return content;
+    });
+  }
+  return files;
+}
+
+function listAsar(asarPath) {
+  const asar = require('@electron/asar');
+  const files = new Map();
+  for (const archiveName of asar.listPackage(asarPath)) {
+    if (!archiveName.startsWith('/')) fail(`Unsafe ASAR path: ${archiveName}`);
+    const name = normalizeRelative(archiveName.slice(1));
+    let stat;
+    try {
+      stat = asar.statFile(asarPath, name);
+    } catch (error) {
+      fail(`Invalid ASAR entry ${name}: ${error.message}`);
+    }
+    if (!Number.isSafeInteger(stat.size)) continue;
+    if (!name.startsWith('node_modules/')) files.set(name, () => asar.extractFile(asarPath, name));
+  }
+  return files;
+}
+
+function findFile(files, suffix) {
+  const matches = [...files.keys()].filter((name) => name === suffix || name.endsWith(`/${suffix}`));
+  if (matches.length !== 1) fail(`Expected exactly one ${suffix}, found ${matches.length}`);
+  return matches[0];
+}
+
+function verifyExtension(files, expectedVersion) {
+  const manifestName = findFile(files, 'chrome-extension/manifest.json');
+  const extensionRoot = manifestName.slice(0, -'manifest.json'.length);
+  for (const required of REQUIRED_EXTENSION_FILES) {
+    if (!files.has(`${extensionRoot}${required}`)) fail(`Missing expected extension file: ${required}`);
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(files.get(manifestName)().toString('utf8'));
+  } catch (error) {
+    fail(`Invalid extension manifest: ${error.message}`);
+  }
+  if (manifest.version !== expectedVersion) {
+    fail(`Extension version ${manifest.version} does not match application version ${expectedVersion}`);
+  }
+}
+
+function verifyTextFiles(files) {
+  for (const [name, load] of files) {
+    if (TEXT_EXTENSIONS.has(path.extname(name).toLowerCase())) assertTextPolicy(name, load().toString('utf8'));
+  }
+}
+
+function verifySyntax(files) {
+  const javascript = [...files.keys()].filter((name) => name.endsWith('.js'));
+  javascript.push('scripts/verify-kit.js');
+  for (const name of javascript) {
+    const result = spawnSync(process.execPath, ['--check', path.join(ROOT, name)], { encoding: 'utf8' });
+    if (result.status !== 0) fail(`JavaScript syntax check failed for ${name}: ${result.stderr.trim()}`);
+  }
+}
+
+function verifySource() {
+  const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
+  const lock = JSON.parse(fs.readFileSync(path.join(ROOT, 'package-lock.json'), 'utf8'));
+  const files = listDirectory(ROOT, { ignoreTopLevel: ['.git', 'dist', 'node_modules'] });
+  verifyExtension(files, pkg.version);
+  for (const [label, version] of [['lockfile', lock.version], ['lockfile root package', lock.packages?.['']?.version]]) {
+    if (version !== pkg.version) fail(`${label} version ${version} does not match application version ${pkg.version}`);
+  }
+  const productionRoots = [
+    'main.js', 'preload.js', 'renderer.js', 'renderer-controller.js', 'device-tree.js',
+    'sidebar-controller.js', 'sidebar-view.js', 'index.html', 'src/', 'chrome-extension/',
+  ];
+  const productionFiles = new Map([...files].filter(([name]) =>
+    productionRoots.some((root) => name === root || name.startsWith(root))
+  ));
+  verifyTextFiles(productionFiles);
+  verifySyntax(productionFiles);
+  return pkg.version;
+}
+
+function verifySupplied(target, expectedVersion, mode) {
+  const absolute = path.resolve(target);
+  if (!fs.existsSync(absolute)) fail(`Supplied ${mode} does not exist: ${target}`);
+  const isDirectory = fs.statSync(absolute).isDirectory();
+  const files = isDirectory ? listDirectory(absolute) : listZip(absolute);
+  const hostNames = [...files.keys()];
+  if (mode === 'build' && !hostNames.includes('chrome-extension/manifest.json')) {
+    const asarName = hostNames.find((name) => /(?:^|\/)resources\/app\.asar$/i.test(name));
+    if (!asarName || !isDirectory) fail('Missing packaged app.asar in supplied build');
+    for (const [name, load] of listAsar(path.join(absolute, asarName))) files.set(name, load);
+  }
+  verifyExtension(files, expectedVersion);
+  verifyTextFiles(files);
+  if (!hostNames.some((name) => /(?:^|\/)Alta(?:CameraProxy| Camera Proxy)(?:-[^/]*)?\.exe$/i.test(name))) {
+    fail(`Missing expected APT executable in supplied ${mode}`);
+  }
+  if (mode === 'kit' && !hostNames.some((name) => /(?:^|\/)aware-cam-proxy\.exe$/i.test(name))) {
+    fail('Missing expected aware-cam-proxy.exe in supplied kit');
+  }
+}
+
+function main(argv) {
+  const version = verifySource();
+  if (argv.length > 0) {
+    const buildMode = argv[0] === '--build';
+    const target = buildMode ? argv[1] : argv[0];
+    if (!target || argv.length !== (buildMode ? 2 : 1)) fail('Usage: node scripts/verify-kit.js [--build <directory>|<kit-directory-or-zip>]');
+    verifySupplied(target, version, buildMode ? 'build' : 'kit');
+  }
+  process.stdout.write(`APT source${argv.length ? ' and supplied artifact' : ''} verified at version ${version}.\n`);
+}
+
+if (require.main === module) {
+  try {
+    main(process.argv.slice(2));
+  } catch (error) {
+    process.stderr.write(`Verification failed: ${error.message}\n`);
+    process.exitCode = 1;
+  }
+}
+
+module.exports = { normalizeRelative, verifySource, verifySupplied };
diff --git a/sidebar-controller.js b/sidebar-controller.js
new file mode 100644
index 0000000..4e55061
--- /dev/null
+++ b/sidebar-controller.js
@@ -0,0 +1,229 @@
+'use strict';
+
+(function defineSidebarController(root, factory) {
+  const treeApi = typeof module !== 'undefined' && module.exports
+    ? require('./device-tree')
+    : root && root.AptDeviceTree;
+  const api = factory(treeApi);
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+  if (root) root.AptSidebarController = api;
+}(typeof window !== 'undefined' ? window : undefined, function sidebarFactory(treeApi) {
+  function validKey(key) {
+    return typeof key === 'string' && /^(site|group|camera):[^\s]+$/.test(key);
+  }
+
+  function copySet(value) {
+    return value instanceof Set ? new Set(value) : new Set();
+  }
+
+  function createInitialState(initial = {}) {
+    return {
+      expandedKeys: copySet(initial.expandedKeys),
+      activeKey: validKey(initial.activeKey) ? initial.activeKey : null,
+      selectedKey: validKey(initial.selectedKey) ? initial.selectedKey : null,
+      searchQuery: typeof initial.searchQuery === 'string' ? initial.searchQuery : '',
+      searchCameraKeys: initial.searchCameraKeys instanceof Set ? new Set(initial.searchCameraKeys) : null,
+      searchExpandedKeys: initial.searchExpandedKeys instanceof Set ? new Set(initial.searchExpandedKeys) : null,
+      searchGeneration: Number.isInteger(initial.searchGeneration) ? initial.searchGeneration : 0,
+      scrollTop: Number.isFinite(initial.scrollTop) ? Math.max(0, initial.scrollTop) : 0,
+      viewportHeight: Number.isFinite(initial.viewportHeight) ? Math.max(0, initial.viewportHeight) : 320,
+    };
+  }
+
+  function findRow(rows, key) {
+    if (!validKey(key) || !Array.isArray(rows)) return null;
+    return rows.find((row) => row && row.key === key) || null;
+  }
+
+  function expansionState(state) {
+    return state.searchQuery && state.searchExpandedKeys instanceof Set
+      ? { field: 'searchExpandedKeys', keys: state.searchExpandedKeys }
+      : { field: 'expandedKeys', keys: state.expandedKeys };
+  }
+
+  function changeExpansion(state, row, force) {
+    if (!row || row.kind === 'camera') return state;
+    const current = expansionState(state);
+    const expandedKeys = copySet(current.keys);
+    const shouldExpand = force === undefined ? !expandedKeys.has(row.key) : force;
+    if (shouldExpand) expandedKeys.add(row.key);
+    else expandedKeys.delete(row.key);
+    return Object.assign({}, state, { [current.field]: expandedKeys, activeKey: row.key });
+  }
+
+  function activate(state, row) {
+    if (!row) return state;
+    if (row.kind === 'camera') return Object.assign({}, state, { activeKey: row.key, selectedKey: row.key });
+    return changeExpansion(state, row);
+  }
+
+  function moveActive(state, rows, targetIndex) {
+    if (!rows.length) return state;
+    const index = Math.max(0, Math.min(rows.length - 1, targetIndex));
+    return Object.assign({}, state, { activeKey: rows[index].key });
+  }
+
+  function reduceSidebar(state, action, rows = []) {
+    if (!state || !action || typeof action.type !== 'string') return state;
+    if (action.type === 'ACTIVATE' || action.type === 'CLICK') {
+      return activate(state, findRow(rows, action.rowKey));
+    }
+    if (action.type === 'SET_SELECTION') {
+      if (!validKey(action.rowKey) || !action.rowKey.startsWith('camera:') ||
+          (!action.allowHidden && !findRow(rows, action.rowKey))) return state;
+      return Object.assign({}, state, { selectedKey: action.rowKey, activeKey: action.rowKey });
+    }
+    if (action.type === 'SET_ACTIVE') {
+      const row = findRow(rows, action.rowKey);
+      return row ? Object.assign({}, state, { activeKey: row.key }) : state;
+    }
+    if (action.type === 'SET_VIEWPORT') {
+      const scrollTop = Number.isFinite(action.scrollTop) ? Math.max(0, action.scrollTop) : state.scrollTop;
+      const viewportHeight = Number.isFinite(action.viewportHeight) ? Math.max(0, action.viewportHeight) : state.viewportHeight;
+      if (scrollTop === state.scrollTop && viewportHeight === state.viewportHeight) return state;
+      return Object.assign({}, state, { scrollTop, viewportHeight });
+    }
+    if (action.type === 'SET_SEARCH_QUERY') {
+      const searchQuery = typeof action.query === 'string' ? action.query : '';
+      return Object.assign({}, state, {
+        searchQuery,
+        searchCameraKeys: searchQuery ? state.searchCameraKeys : null,
+        searchExpandedKeys: searchQuery ? state.searchExpandedKeys : null,
+      });
+    }
+    if (action.type === 'SET_SEARCH_RESULTS') {
+      if (!Number.isInteger(action.generation) || action.generation < state.searchGeneration) return state;
+      return Object.assign({}, state, {
+        searchQuery: typeof action.query === 'string' ? action.query : state.searchQuery,
+        searchCameraKeys: action.cameraKeys instanceof Set ? new Set(action.cameraKeys) : null,
+        searchExpandedKeys: action.expandedKeys instanceof Set ? new Set(action.expandedKeys) : null,
+        searchGeneration: action.generation,
+      });
+    }
+    if (action.type !== 'KEY' || typeof action.key !== 'string') return state;
+
+    if (action.key === 'Escape') {
+      if (!state.searchQuery && !state.searchCameraKeys) return state;
+      return Object.assign({}, state, { searchQuery: '', searchCameraKeys: null, searchExpandedKeys: null });
+    }
+    if (!rows.length) return state;
+    let index = rows.findIndex((row) => row.key === state.activeKey);
+    if (index < 0) {
+      if (action.key === 'ArrowDown' || action.key === 'Home') return moveActive(state, rows, 0);
+      if (action.key === 'ArrowUp' || action.key === 'End') return moveActive(state, rows, rows.length - 1);
+      index = 0;
+    }
+    const row = rows[index];
+    const expandedKeys = expansionState(state).keys;
+    switch (action.key) {
+      case 'ArrowDown': return moveActive(state, rows, index + 1);
+      case 'ArrowUp': return moveActive(state, rows, index - 1);
+      case 'Home': return moveActive(state, rows, 0);
+      case 'End': return moveActive(state, rows, rows.length - 1);
+      case 'ArrowRight': {
+        if (row.kind === 'camera') return state;
+        if (!expandedKeys.has(row.key)) return changeExpansion(state, row, true);
+        const child = rows[index + 1];
+        return child && child.parentKey === row.key ? Object.assign({}, state, { activeKey: child.key }) : state;
+      }
+      case 'ArrowLeft':
+        if (row.kind !== 'camera' && expandedKeys.has(row.key)) return changeExpansion(state, row, false);
+        return row.parentKey && validKey(row.parentKey) ? Object.assign({}, state, { activeKey: row.parentKey }) : state;
+      case 'Enter':
+      case ' ':
+      case 'Spacebar': return activate(state, row);
+      default: return state;
+    }
+  }
+
+  function createSidebarController(options = {}) {
+    if (!treeApi || typeof treeApi.flattenVisibleRows !== 'function' || typeof treeApi.calculateVirtualWindow !== 'function') {
+      throw new Error('AptDeviceTree must be loaded before AptSidebarController.');
+    }
+    if (!options.model || !options.view || typeof options.view.commit !== 'function') {
+      throw new TypeError('Sidebar controller requires a model and view.commit adapter.');
+    }
+    const model = options.model;
+    const view = options.view;
+    const rowHeight = Number.isFinite(options.rowHeight) ? options.rowHeight : 30;
+    const overscan = Number.isInteger(options.overscan) ? options.overscan : 16;
+    const searchRunner = options.searchRunner || treeApi.createSearchRunner({ scheduler: options.scheduler, chunkSize: options.chunkSize });
+    let state = createInitialState(options.initialState);
+    let lastSnapshot;
+
+    function effectiveExpandedKeys() {
+      return state.searchQuery && state.searchExpandedKeys ? state.searchExpandedKeys : state.expandedKeys;
+    }
+
+    function commit(options = {}) {
+      const rows = treeApi.flattenVisibleRows(model, {
+        expandedKeys: effectiveExpandedKeys(),
+        selectedKey: state.selectedKey,
+        matchCameraKeys: state.searchQuery ? state.searchCameraKeys : null,
+      });
+      const activeIndex = rows.findIndex((row) => row.key === state.activeKey);
+      const maximumScrollTop = Math.max(0, (rows.length * rowHeight) - state.viewportHeight);
+      const clampedScrollTop = Math.max(0, Math.min(state.scrollTop, maximumScrollTop));
+      if (clampedScrollTop !== state.scrollTop) {
+        state = Object.assign({}, state, { scrollTop: clampedScrollTop });
+      }
+      if (options.ensureActive === true && activeIndex >= 0 && state.viewportHeight > 0) {
+        const activeTop = activeIndex * rowHeight;
+        const activeBottom = activeTop + rowHeight;
+        let scrollTop = state.scrollTop;
+        if (activeTop < scrollTop) scrollTop = activeTop;
+        else if (activeBottom > scrollTop + state.viewportHeight) scrollTop = activeBottom - state.viewportHeight;
+        if (scrollTop !== state.scrollTop) state = Object.assign({}, state, { scrollTop });
+      }
+      const window = treeApi.calculateVirtualWindow(rows, {
+        scrollTop: state.scrollTop, viewportHeight: state.viewportHeight, rowHeight, overscan,
+      });
+      lastSnapshot = Object.freeze({ state, rows, window });
+      view.commit(lastSnapshot);
+      return lastSnapshot;
+    }
+
+    function dispatch(action) {
+      const visibleRows = lastSnapshot ? lastSnapshot.rows : [];
+      let safeAction = action;
+      if (action && action.type === 'SET_SELECTION') {
+        if (!model.cameraByKey.has(action.rowKey)) return lastSnapshot;
+        safeAction = Object.assign({}, action, { allowHidden: true });
+      }
+      const next = reduceSidebar(state, safeAction, visibleRows);
+      if (next === state) return lastSnapshot;
+      state = next;
+      const ensureActive = safeAction.type === 'KEY' || safeAction.type === 'SET_ACTIVE';
+      return commit({ ensureActive });
+    }
+
+    async function search(query) {
+      const normalizedQuery = typeof query === 'string' ? query : '';
+      if (!normalizedQuery.trim()) {
+        searchRunner.cancel();
+        return dispatch({ type: 'SET_SEARCH_QUERY', query: '' });
+      }
+      state = reduceSidebar(state, { type: 'SET_SEARCH_QUERY', query: normalizedQuery }, lastSnapshot ? lastSnapshot.rows : []);
+      const result = await searchRunner.search(model, normalizedQuery, { expandedKeys: state.expandedKeys });
+      if (result.cancelled) return result;
+      dispatch({
+        type: 'SET_SEARCH_RESULTS', query: normalizedQuery, generation: result.generation,
+        cameraKeys: result.cameraKeys, expandedKeys: result.expandedKeys,
+      });
+      return result;
+    }
+
+    commit();
+    return Object.freeze({
+      dispatch, search, refresh: commit, getState: () => state, getSnapshot: () => lastSnapshot,
+      destroy() { searchRunner.cancel(); },
+    });
+  }
+
+  return Object.freeze({
+    createInitialState,
+    reduceSidebar,
+    sidebarReducer: reduceSidebar,
+    createSidebarController,
+  });
+}));
diff --git a/sidebar-view.js b/sidebar-view.js
new file mode 100644
index 0000000..e45b955
--- /dev/null
+++ b/sidebar-view.js
@@ -0,0 +1,142 @@
+'use strict';
+
+(function exposeSidebarView(root, factory) {
+  const api = factory();
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+  if (root) root.AptSidebarView = api;
+}(typeof window !== 'undefined' ? window : undefined, function sidebarViewFactory() {
+  const ROW_HEIGHT = 30;
+
+  function stableDomId(key) {
+    return `apt-tree-row-${Array.from(String(key || '')).map((character) => character.codePointAt(0).toString(16)).join('-')}`;
+  }
+
+  function describeVirtualRows(snapshot, options = {}) {
+    const activeIds = options.activeDeviceIds instanceof Set ? options.activeDeviceIds : new Set();
+    const model = options.model;
+    const isOnline = typeof options.isOnline === 'function' ? options.isOnline : () => false;
+    const windowRows = snapshot && snapshot.window && Array.isArray(snapshot.window.rows)
+      ? snapshot.window.rows
+      : [];
+    return windowRows.map((row, windowIndex) => {
+      const node = model && model.rowByKey ? model.rowByKey.get(row.key) : null;
+      const device = node && node.kind === 'camera' ? node.source : null;
+      const deviceId = device ? device.id : row.id;
+      const classes = ['tree-row', `tree-${row.kind}`];
+      if (row.ariaSelected) classes.push('selected');
+      if (snapshot.state && snapshot.state.activeKey === row.key) classes.push('active');
+      if (row.pendingDeletion) classes.push('pending-deletion');
+      if (row.hierarchyStatus && !['assigned', 'inferred-site'].includes(row.hierarchyStatus)) classes.push('hierarchy-warning');
+      if (row.kind === 'camera') {
+        classes.push(isOnline(device || row) ? 'online' : 'offline');
+        if (activeIds.has(String(deviceId || '').toLowerCase())) classes.push('proxy-active');
+      }
+      return Object.freeze({
+        key: row.key,
+        kind: row.kind,
+        name: row.name,
+        device,
+        deviceId,
+        role: 'treeitem',
+        domId: stableDomId(row.key),
+        top: windowIndex * ROW_HEIGHT,
+        classes: classes.join(' '),
+        pendingDeletion: row.pendingDeletion === true,
+        hierarchyStatus: row.hierarchyStatus,
+        address: device && device.address ? device.address : '',
+        aria: {
+          level: row.ariaLevel,
+          expanded: row.ariaExpanded,
+          selected: row.ariaSelected,
+          posinset: row.ariaPosInSet,
+          setsize: row.ariaSetSize,
+        },
+      });
+    });
+  }
+
+  function setAria(element, name, value) {
+    if (value === undefined || value === null) element.removeAttribute(`aria-${name}`);
+    else element.setAttribute(`aria-${name}`, String(value));
+  }
+
+  function createSidebarView(options = {}) {
+    const documentRef = options.document;
+    const tree = options.tree;
+    const spacer = options.spacer;
+    const windowElement = options.windowElement;
+    if (!documentRef || !tree || !spacer || !windowElement) {
+      throw new TypeError('Sidebar view requires document, tree, spacer, and windowElement.');
+    }
+
+    function createRow(descriptor) {
+      const element = documentRef.createElement('div');
+      element.id = descriptor.domId;
+      element.className = descriptor.classes;
+      element.dataset.rowKey = descriptor.key;
+      element.setAttribute('role', descriptor.role);
+      element.style.top = `${descriptor.top}px`;
+      setAria(element, 'level', descriptor.aria.level);
+      setAria(element, 'expanded', descriptor.aria.expanded);
+      setAria(element, 'selected', descriptor.aria.selected);
+      setAria(element, 'posinset', descriptor.aria.posinset);
+      setAria(element, 'setsize', descriptor.aria.setsize);
+
+      const disclosure = documentRef.createElement('span');
+      disclosure.className = 'tree-disclosure';
+      disclosure.setAttribute('aria-hidden', 'true');
+      disclosure.textContent = descriptor.kind === 'camera' ? '' : (descriptor.aria.expanded ? '\u25bc' : '\u25b6');
+      const label = documentRef.createElement('span');
+      label.className = 'tree-label';
+      label.textContent = descriptor.name;
+      element.append(disclosure, label);
+
+      if (descriptor.address) {
+        const address = documentRef.createElement('span');
+        address.className = 'tree-address';
+        address.textContent = descriptor.address;
+        element.appendChild(address);
+      }
+      if (descriptor.pendingDeletion) {
+        const pending = documentRef.createElement('span');
+        pending.className = 'tree-badge pending';
+        pending.textContent = 'Pending deletion';
+        element.appendChild(pending);
+      }
+      if (descriptor.hierarchyStatus && !['assigned', 'inferred-site'].includes(descriptor.hierarchyStatus)) {
+        const warning = documentRef.createElement('span');
+        warning.className = 'tree-warning';
+        warning.title = `Hierarchy: ${descriptor.hierarchyStatus}`;
+        warning.setAttribute('aria-label', `Hierarchy warning: ${descriptor.hierarchyStatus}`);
+        warning.textContent = '!';
+        element.appendChild(warning);
+      }
+      return element;
+    }
+
+    function commit(snapshot) {
+      const descriptors = describeVirtualRows(snapshot, {
+        model: options.model,
+        activeDeviceIds: typeof options.getActiveDeviceIds === 'function' ? options.getActiveDeviceIds() : new Set(),
+        isOnline: options.isOnline,
+      });
+      spacer.style.height = `${snapshot.window.totalHeight}px`;
+      windowElement.style.transform = `translateY(${snapshot.window.offsetTop}px)`;
+      windowElement.style.height = `${descriptors.length * ROW_HEIGHT}px`;
+      const fragment = documentRef.createDocumentFragment();
+      for (const descriptor of descriptors) fragment.appendChild(createRow(descriptor));
+      windowElement.replaceChildren(fragment);
+
+      const active = descriptors.find((row) => snapshot.state.activeKey === row.key);
+      if (active) tree.setAttribute('aria-activedescendant', active.domId);
+      else tree.removeAttribute('aria-activedescendant');
+      tree.classList.toggle('has-hidden-selection', snapshot.rows.hiddenSelected === true);
+      if (typeof options.onCommit === 'function') options.onCommit(snapshot, descriptors);
+      return descriptors;
+    }
+
+    return Object.freeze({ commit });
+  }
+
+  return Object.freeze({ ROW_HEIGHT, stableDomId, describeVirtualRows, createSidebarView });
+}));
diff --git a/src/alta-client.js b/src/alta-client.js
new file mode 100644
index 0000000..ff16611
--- /dev/null
+++ b/src/alta-client.js
@@ -0,0 +1,278 @@
+'use strict';
+
+const { canonicalizeAltaOrigin, assertSameAltaOrigin } = require('./url-policy');
+const { formatAltaError } = require('./error-redaction');
+
+const DEFAULT_TIMEOUT_MS = 30_000;
+const DEVICE_MAX_RESPONSE_BYTES = 32 * 1024 * 1024;
+const HIERARCHY_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+const AUTH_MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+const DEFAULT_MAX_RESPONSE_BYTES = DEVICE_MAX_RESPONSE_BYTES;
+const MAX_ARRAY_OBJECTS = 10_000;
+const DEFAULT_MAX_REDIRECTS = 3;
+const ENDPOINTS = Object.freeze({
+  getDevices: Object.freeze({
+    path: '/api/v1/devices', shape: 'array', maxResponseBytes: DEVICE_MAX_RESPONSE_BYTES, maxObjects: MAX_ARRAY_OBJECTS,
+  }),
+  getDeviceSites: Object.freeze({
+    path: '/api/v1/deviceSites', shape: 'array', maxResponseBytes: HIERARCHY_MAX_RESPONSE_BYTES, maxObjects: MAX_ARRAY_OBJECTS,
+  }),
+  getDeviceGroups: Object.freeze({
+    path: '/api/v1/deviceGroups', shape: 'array', maxResponseBytes: HIERARCHY_MAX_RESPONSE_BYTES, maxObjects: MAX_ARRAY_OBJECTS,
+  }),
+  getAuthInfo: Object.freeze({ path: '/api/v1/auth', shape: 'object', maxResponseBytes: AUTH_MAX_RESPONSE_BYTES }),
+});
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+
+function altaError(code, message, extra = {}) {
+  const error = new Error(message);
+  error.code = code;
+  Object.assign(error, extra);
+  return error;
+}
+
+async function axiosTransport(options) {
+  // Lazy loading keeps pure/injected transport tests independent of installed
+  // runtime dependencies while production still uses the pinned Axios package.
+  const axios = require('axios');
+  return axios.request({
+    method: options.method,
+    url: options.url,
+    headers: options.headers,
+    timeout: options.timeout,
+    signal: options.signal,
+    proxy: false,
+    maxRedirects: 0,
+    maxContentLength: options.maxResponseBytes,
+    maxBodyLength: 0,
+    responseType: 'arraybuffer',
+    validateStatus: () => true,
+    transitional: { clarifyTimeoutError: true },
+  });
+}
+
+function normalizeHeaders(headers) {
+  if (!headers || typeof headers !== 'object') return Object.freeze({});
+  const normalized = {};
+  for (const [key, value] of Object.entries(headers)) {
+    normalized[String(key).toLowerCase()] = Array.isArray(value) ? value[0] : value;
+  }
+  return Object.freeze(normalized);
+}
+
+function measuredData(data) {
+  if (Buffer.isBuffer(data) || data instanceof Uint8Array) {
+    return { bytes: data.byteLength, raw: Buffer.from(data).toString('utf8') };
+  }
+  if (typeof data === 'string') {
+    return { bytes: Buffer.byteLength(data), raw: data };
+  }
+  if (data === undefined) {
+    throw altaError('INVALID_ALTA_RESPONSE', 'Alta transport returned no response data');
+  }
+  try {
+    const raw = JSON.stringify(data);
+    if (raw === undefined) throw new Error('not serializable');
+    return { bytes: Buffer.byteLength(raw), value: data };
+  } catch {
+    throw altaError('INVALID_ALTA_RESPONSE_DATA', 'Alta response data is malformed');
+  }
+}
+
+function parseData(data, maxBytes) {
+  const measured = measuredData(data);
+  if (measured.bytes > maxBytes) {
+    throw altaError('ALTA_RESPONSE_TOO_LARGE', 'Alta response exceeded the size limit');
+  }
+  if (Object.prototype.hasOwnProperty.call(measured, 'value')) return measured.value;
+  try {
+    return JSON.parse(measured.raw);
+  } catch {
+    throw altaError('INVALID_ALTA_RESPONSE_DATA', 'Alta response was not valid JSON');
+  }
+}
+
+function enforceResponseSize(data, headers, maxBytes) {
+  const contentLength = headers['content-length'];
+  if (contentLength !== undefined) {
+    const parsedLength = Number(contentLength);
+    if (!Number.isSafeInteger(parsedLength) || parsedLength < 0) {
+      throw altaError('INVALID_ALTA_RESPONSE', 'Alta response had an invalid content length');
+    }
+    if (parsedLength > maxBytes) {
+      throw altaError('ALTA_RESPONSE_TOO_LARGE', 'Alta response exceeded the size limit');
+    }
+  }
+  if (data !== undefined && measuredData(data).bytes > maxBytes) {
+    throw altaError('ALTA_RESPONSE_TOO_LARGE', 'Alta response exceeded the size limit');
+  }
+}
+
+function safeTransportError(operation, error, cookie) {
+  const formatted = formatAltaError(operation, error, { secrets: [cookie, `va=${cookie}`] });
+  return altaError(formatted.code, formatted.message, {
+    status: formatted.status,
+    timeout: formatted.timeout,
+  });
+}
+
+class AltaClient {
+  constructor({
+    sessionStore,
+    transport = axiosTransport,
+    timeoutMs = DEFAULT_TIMEOUT_MS,
+    maxResponseBytes = DEFAULT_MAX_RESPONSE_BYTES,
+    maxRedirects = DEFAULT_MAX_REDIRECTS,
+  } = {}) {
+    if (!sessionStore || typeof sessionStore.requireSession !== 'function') {
+      throw new TypeError('AltaClient requires a session store');
+    }
+    if (typeof transport !== 'function') throw new TypeError('AltaClient transport must be a function');
+    if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > DEFAULT_TIMEOUT_MS) {
+      throw new RangeError('AltaClient timeout must be between 1 and 30000ms');
+    }
+    if (!Number.isInteger(maxResponseBytes) || maxResponseBytes < 1 || maxResponseBytes > DEFAULT_MAX_RESPONSE_BYTES) {
+      throw new RangeError('Invalid Alta response size limit');
+    }
+    if (!Number.isInteger(maxRedirects) || maxRedirects < 0 || maxRedirects > 5) {
+      throw new RangeError('Invalid Alta redirect limit');
+    }
+    this.sessionStore = sessionStore;
+    this.transport = transport;
+    this.timeoutMs = timeoutMs;
+    this.maxResponseBytes = maxResponseBytes;
+    this.maxRedirects = maxRedirects;
+  }
+
+  getDevices(...args) {
+    return this.#invoke('getDevices', args);
+  }
+
+  getDeviceSites(...args) {
+    return this.#invoke('getDeviceSites', args);
+  }
+
+  getDeviceGroups(...args) {
+    return this.#invoke('getDeviceGroups', args);
+  }
+
+  getAuthInfo(...args) {
+    return this.#invoke('getAuthInfo', args);
+  }
+
+  async #invoke(operation, args) {
+    if (args.length !== 0) {
+      throw altaError('INVALID_ALTA_ARGUMENTS', 'Alta API methods do not accept renderer parameters');
+    }
+    const endpoint = ENDPOINTS[operation];
+    const maxResponseBytes = Math.min(this.maxResponseBytes, endpoint.maxResponseBytes);
+    const session = this.sessionStore.requireSession();
+    const origin = canonicalizeAltaOrigin(session.origin);
+    const cookie = session.cookie;
+    const deadline = Date.now() + this.timeoutMs;
+    const controller = new AbortController();
+
+    try {
+      const data = await this.#request(
+        operation, `${origin}${endpoint.path}`, origin, cookie, deadline, controller, 0, maxResponseBytes,
+      );
+      if (endpoint.shape === 'array' && !Array.isArray(data)) {
+        throw altaError('INVALID_ALTA_RESPONSE_DATA', 'Alta response did not contain an array');
+      }
+      if (endpoint.shape === 'array' && data.length > endpoint.maxObjects) {
+        throw altaError('ALTA_RESPONSE_TOO_MANY_OBJECTS', 'Alta response exceeded the object limit');
+      }
+      if (endpoint.shape === 'object' && (!data || typeof data !== 'object' || Array.isArray(data))) {
+        throw altaError('INVALID_ALTA_RESPONSE_DATA', 'Alta response did not contain an object');
+      }
+      return data;
+    } catch (error) {
+      throw safeTransportError(operation, error, cookie);
+    } finally {
+      controller.abort();
+    }
+  }
+
+  async #request(operation, url, origin, cookie, deadline, controller, redirectCount, maxResponseBytes) {
+    assertSameAltaOrigin(url, origin);
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) throw altaError('ALTA_TIMEOUT', 'Alta request timed out', { timeout: true });
+
+    let timer;
+    const timeoutPromise = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        reject(altaError('ALTA_TIMEOUT', 'Alta request timed out', { timeout: true }));
+      }, remaining);
+    });
+
+    let response;
+    try {
+      response = await Promise.race([
+        Promise.resolve(this.transport(Object.freeze({
+          method: 'GET',
+          url,
+          headers: Object.freeze({ Cookie: `va=${cookie}`, Accept: 'application/json' }),
+          timeout: remaining,
+          signal: controller.signal,
+          proxy: false,
+          maxRedirects: 0,
+          maxResponseBytes,
+        }))),
+        timeoutPromise,
+      ]);
+    } finally {
+      clearTimeout(timer);
+    }
+
+    if (!response || typeof response !== 'object' || !Number.isInteger(response.status)) {
+      throw altaError('INVALID_ALTA_RESPONSE', 'Alta transport returned an invalid response');
+    }
+    const headers = normalizeHeaders(response.headers);
+    // Bound every response, including redirects and errors, before acting on it.
+    enforceResponseSize(response.data, headers, maxResponseBytes);
+
+    if (REDIRECT_STATUSES.has(response.status)) {
+      if (typeof headers.location !== 'string' || headers.location.length === 0) {
+        throw altaError('UNSAFE_ALTA_REDIRECT', 'Alta redirect did not contain a safe location');
+      }
+      if (redirectCount >= this.maxRedirects) {
+        throw altaError('TOO_MANY_ALTA_REDIRECTS', 'Alta response exceeded the redirect limit');
+      }
+      let target;
+      try {
+        target = new URL(headers.location, url);
+        assertSameAltaOrigin(target.href, origin);
+      } catch {
+        throw altaError('UNSAFE_ALTA_REDIRECT', 'Alta redirect changed the validated origin');
+      }
+      return this.#request(
+        operation, target.href, origin, cookie, deadline, controller, redirectCount + 1, maxResponseBytes,
+      );
+    }
+
+    if (response.status < 200 || response.status > 299) {
+      throw altaError('ALTA_HTTP_ERROR', 'Alta request returned an error status', { status: response.status });
+    }
+
+    return parseData(response.data, maxResponseBytes);
+  }
+}
+
+function createAltaClient(options) {
+  return new AltaClient(options);
+}
+
+module.exports = {
+  AltaClient,
+  AUTH_MAX_RESPONSE_BYTES,
+  DEFAULT_MAX_REDIRECTS,
+  DEFAULT_MAX_RESPONSE_BYTES,
+  DEFAULT_TIMEOUT_MS,
+  DEVICE_MAX_RESPONSE_BYTES,
+  ENDPOINTS,
+  HIERARCHY_MAX_RESPONSE_BYTES,
+  MAX_ARRAY_OBJECTS,
+  axiosTransport,
+  createAltaClient,
+};
diff --git a/src/bridge-auth.js b/src/bridge-auth.js
new file mode 100644
index 0000000..5c3c804
--- /dev/null
+++ b/src/bridge-auth.js
@@ -0,0 +1,315 @@
+'use strict';
+
+const crypto = require('node:crypto');
+
+const DEFAULT_SECRET_BYTES = 32;
+const DEFAULT_MAX_BODY_BYTES = 64 * 1024;
+const DEFAULT_BODY_DEADLINE_MS = 2_000;
+const DEFAULT_CHALLENGE_TTL_MS = 5_000;
+const DEFAULT_MAX_CHALLENGES = 64;
+const APT_EXTENSION_ID = 'onbkfpbggekakjddomjjnboippimlmch';
+const APT_EXTENSION_ORIGIN = `chrome-extension://${APT_EXTENSION_ID}`;
+const SECRET_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const NONCE_PATTERN = SECRET_PATTERN;
+const PROOF_PATTERN = SECRET_PATTERN;
+const EXTENSION_ORIGIN_PATTERN = /^chrome-extension:\/\/[a-p]{32}$/;
+const SERVER_PROOF_DOMAIN = 'apt-server-challenge-v1';
+const COOKIE_PROOF_DOMAIN = 'apt-cookie-request-v1';
+
+class BridgeAuthError extends Error {
+  constructor(code, message, statusCode = 400) {
+    super(message);
+    this.name = 'BridgeAuthError';
+    this.code = code;
+    this.statusCode = statusCode;
+  }
+}
+
+function dependencies(overrides = {}) {
+  return {
+    randomBytes: overrides.randomBytes || crypto.randomBytes,
+    timingSafeEqual: overrides.timingSafeEqual || crypto.timingSafeEqual,
+    createHmac: overrides.createHmac || crypto.createHmac,
+    createHash: overrides.createHash || crypto.createHash,
+    setTimeout: overrides.setTimeout || setTimeout,
+    clearTimeout: overrides.clearTimeout || clearTimeout,
+    now: overrides.now || Date.now
+  };
+}
+
+function generatePairingSecret(options = {}) {
+  const deps = dependencies(options);
+  const byteCount = options.byteCount || DEFAULT_SECRET_BYTES;
+  if (!Number.isSafeInteger(byteCount) || byteCount < DEFAULT_SECRET_BYTES) {
+    throw new BridgeAuthError('INVALID_SECRET_SIZE', 'Pairing secrets must contain at least 32 random bytes.');
+  }
+  return deps.randomBytes(byteCount).toString('base64url');
+}
+
+function assertPairingSecret(secret) {
+  if (typeof secret !== 'string' || !SECRET_PATTERN.test(secret)) {
+    throw new BridgeAuthError('INVALID_PAIRING_SECRET', 'The pairing secret has an invalid format.');
+  }
+}
+
+function canonicalServerProof(clientNonce, serverNonce) {
+  return JSON.stringify([SERVER_PROOF_DOMAIN, clientNonce, serverNonce]);
+}
+
+function canonicalCookieProof({ clientNonce, serverNonce, deploymentUrl, cookieValue } = {}) {
+  return JSON.stringify([COOKIE_PROOF_DOMAIN, clientNonce, serverNonce, deploymentUrl, cookieValue]);
+}
+
+function computeHmac(secret, message, options = {}) {
+  assertPairingSecret(secret);
+  return dependencies(options).createHmac('sha256', secret).update(message, 'utf8').digest('base64url');
+}
+
+function computeServerProof(secret, clientNonce, serverNonce, options = {}) {
+  return computeHmac(secret, canonicalServerProof(clientNonce, serverNonce), options);
+}
+
+function computeCookieProof(secret, request, options = {}) {
+  return computeHmac(secret, canonicalCookieProof(request), options);
+}
+
+function isValidEnvelope(envelope) {
+  return Boolean(
+    envelope &&
+    envelope.version === 2 &&
+    envelope.algorithm === 'electron-safe-storage' &&
+    typeof envelope.ciphertext === 'string' &&
+    /^[A-Za-z0-9+/]+={0,2}$/.test(envelope.ciphertext) &&
+    envelope.ciphertext.length >= 16 && envelope.ciphertext.length <= 8192 &&
+    typeof envelope.digest === 'string' &&
+    PROOF_PATTERN.test(envelope.digest)
+  );
+}
+
+function assertExtensionOrigin(origin) {
+  if (typeof origin !== 'string' || !EXTENSION_ORIGIN_PATTERN.test(origin) || origin !== APT_EXTENSION_ORIGIN) {
+    throw new BridgeAuthError('INVALID_EXTENSION_ORIGIN', 'The bridge only accepts the committed Alta Proxy Tool extension origin.');
+  }
+}
+
+function safeEqualText(left, right, deps) {
+  if (typeof left !== 'string' || typeof right !== 'string') return false;
+  const leftBytes = Buffer.from(left, 'utf8');
+  const rightBytes = Buffer.from(right, 'utf8');
+  return leftBytes.length === rightBytes.length && deps.timingSafeEqual(leftBytes, rightBytes);
+}
+
+class BridgeAuth {
+  constructor({
+    expectedOrigin = APT_EXTENSION_ORIGIN,
+    envelope = null,
+    protect,
+    unprotect,
+    maxChallenges = DEFAULT_MAX_CHALLENGES,
+    challengeTtlMs = DEFAULT_CHALLENGE_TTL_MS,
+    ...injected
+  } = {}) {
+    assertExtensionOrigin(expectedOrigin);
+    if (typeof protect !== 'function' || typeof unprotect !== 'function') {
+      throw new BridgeAuthError('SECURE_STORAGE_UNAVAILABLE', 'Secure pairing storage is unavailable.', 503);
+    }
+    if (!Number.isSafeInteger(maxChallenges) || maxChallenges < 1 || maxChallenges > 1024) {
+      throw new BridgeAuthError('INVALID_CHALLENGE_LIMIT', 'Challenge limit is invalid.');
+    }
+    if (!Number.isSafeInteger(challengeTtlMs) || challengeTtlMs < 1 || challengeTtlMs > 60_000) {
+      throw new BridgeAuthError('INVALID_CHALLENGE_TTL', 'Challenge lifetime is invalid.');
+    }
+    if (envelope !== null && !isValidEnvelope(envelope)) {
+      throw new BridgeAuthError('INVALID_SECRET_ENVELOPE', 'The persisted pairing envelope is invalid.');
+    }
+
+    this.expectedOrigin = expectedOrigin;
+    this._protect = protect;
+    this._unprotect = unprotect;
+    this._maxChallenges = maxChallenges;
+    this._challengeTtlMs = challengeTtlMs;
+    this._dependencies = dependencies(injected);
+    this._challenges = new Map();
+    this._secret = null;
+    this._envelope = envelope ? Object.freeze({ ...envelope }) : null;
+
+    if (envelope) {
+      try {
+        const secret = unprotect(Buffer.from(envelope.ciphertext, 'base64'));
+        assertPairingSecret(secret);
+        const digest = this._dependencies.createHash('sha256').update(secret, 'utf8').digest('base64url');
+        if (!safeEqualText(digest, envelope.digest, this._dependencies)) throw new Error('digest mismatch');
+        this._secret = secret;
+      } catch {
+        throw new BridgeAuthError('INVALID_SECRET_ENVELOPE', 'The persisted pairing envelope could not be decrypted.');
+      }
+    }
+  }
+
+  get envelope() {
+    return this._envelope ? { ...this._envelope } : null;
+  }
+
+  rotate() {
+    const secret = generatePairingSecret(this._dependencies);
+    let protectedBytes;
+    try {
+      protectedBytes = this._protect(secret);
+    } catch {
+      throw new BridgeAuthError('SECURE_STORAGE_UNAVAILABLE', 'Secure pairing storage is unavailable.', 503);
+    }
+    if (!Buffer.isBuffer(protectedBytes) || protectedBytes.length === 0 || protectedBytes.length > 6144) {
+      throw new BridgeAuthError('SECURE_STORAGE_UNAVAILABLE', 'Secure pairing storage returned invalid ciphertext.', 503);
+    }
+    this._secret = secret;
+    this._challenges.clear();
+    this._envelope = Object.freeze({
+      version: 2,
+      algorithm: 'electron-safe-storage',
+      ciphertext: protectedBytes.toString('base64'),
+      digest: this._dependencies.createHash('sha256').update(secret, 'utf8').digest('base64url')
+    });
+    return { secret, envelope: this.envelope };
+  }
+
+  revoke() {
+    this._secret = null;
+    this._envelope = null;
+    this._challenges.clear();
+  }
+
+  _purgeExpired(now) {
+    for (const [nonce, challenge] of this._challenges) {
+      if (challenge.expiresAt <= now) this._challenges.delete(nonce);
+    }
+  }
+
+  issueChallenge(clientNonce) {
+    if (!this._secret) throw new BridgeAuthError('PAIRING_UNAVAILABLE', 'Bridge pairing is unavailable.', 503);
+    if (typeof clientNonce !== 'string' || !NONCE_PATTERN.test(clientNonce)) {
+      throw new BridgeAuthError('INVALID_NONCE', 'Client nonce is invalid.');
+    }
+    const now = this._dependencies.now();
+    this._purgeExpired(now);
+    if (this._challenges.size >= this._maxChallenges) {
+      throw new BridgeAuthError('CHALLENGE_CAPACITY', 'Too many bridge challenges are outstanding.', 429);
+    }
+    let serverNonce;
+    do {
+      serverNonce = this._dependencies.randomBytes(32).toString('base64url');
+    } while (this._challenges.has(serverNonce));
+    const expiresAt = now + this._challengeTtlMs;
+    this._challenges.set(serverNonce, { clientNonce, expiresAt });
+    return {
+      serverNonce,
+      serverProof: computeServerProof(this._secret, clientNonce, serverNonce, this._dependencies)
+    };
+  }
+
+  authenticateCookie(request = {}) {
+    const { clientNonce, serverNonce, deploymentUrl, cookieValue, proof } = request;
+    if (!this._secret || !NONCE_PATTERN.test(typeof clientNonce === 'string' ? clientNonce : '') ||
+        !NONCE_PATTERN.test(typeof serverNonce === 'string' ? serverNonce : '') ||
+        !PROOF_PATTERN.test(typeof proof === 'string' ? proof : '') ||
+        typeof deploymentUrl !== 'string' || deploymentUrl.length < 1 || deploymentUrl.length > 2048 ||
+        typeof cookieValue !== 'string' || cookieValue.length < 1 || cookieValue.length > 4096) {
+      return false;
+    }
+    const challenge = this._challenges.get(serverNonce);
+    if (!challenge) return false;
+    this._challenges.delete(serverNonce);
+    if (challenge.expiresAt <= this._dependencies.now() || challenge.clientNonce !== clientNonce) return false;
+    const expected = computeCookieProof(this._secret, request, this._dependencies);
+    return safeEqualText(proof, expected, this._dependencies);
+  }
+}
+
+function readJsonBody(stream, options = {}) {
+  const maxBytes = options.maxBytes ?? DEFAULT_MAX_BODY_BYTES;
+  const deadlineMs = options.deadlineMs ?? DEFAULT_BODY_DEADLINE_MS;
+  const deps = dependencies(options);
+  if (!stream || typeof stream.on !== 'function') return Promise.reject(new BridgeAuthError('INVALID_BODY_STREAM', 'A readable request body is required.'));
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 1) return Promise.reject(new BridgeAuthError('INVALID_BODY_LIMIT', 'Body limit must be a positive integer.'));
+  if (!Number.isSafeInteger(deadlineMs) || deadlineMs < 1) return Promise.reject(new BridgeAuthError('INVALID_BODY_DEADLINE', 'Body deadline must be a positive integer.'));
+
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let total = 0;
+    let settled = false;
+    const cleanup = () => {
+      deps.clearTimeout(timer);
+      stream.removeListener('data', onData);
+      stream.removeListener('end', onEnd);
+      stream.removeListener('error', onError);
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      if (typeof stream.pause === 'function') stream.pause();
+      reject(error);
+    };
+    const onData = (chunk) => {
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      total += buffer.length;
+      if (total > maxBytes) return fail(new BridgeAuthError('BODY_TOO_LARGE', 'Request body exceeds the configured limit.', 413));
+      chunks.push(buffer);
+    };
+    const onError = () => fail(new BridgeAuthError('BODY_READ_ERROR', 'Could not read the request body.'));
+    const onEnd = () => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      let parsed;
+      try { parsed = JSON.parse(Buffer.concat(chunks).toString('utf8')); }
+      catch { reject(new BridgeAuthError('MALFORMED_JSON', 'Request body must be valid JSON.')); return; }
+      if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        reject(new BridgeAuthError('INVALID_JSON_BODY', 'Request body must be a JSON object.'));
+        return;
+      }
+      resolve(parsed);
+    };
+    const timer = deps.setTimeout(() => fail(new BridgeAuthError('BODY_DEADLINE_EXCEEDED', 'Request body deadline exceeded.', 408)), deadlineMs);
+    stream.on('data', onData);
+    stream.on('end', onEnd);
+    stream.on('error', onError);
+  });
+}
+
+function createRequestLimiter({ maxConcurrent = 4 } = {}) {
+  if (!Number.isSafeInteger(maxConcurrent) || maxConcurrent < 1) throw new BridgeAuthError('INVALID_CONCURRENCY_LIMIT', 'Concurrency limit must be a positive integer.');
+  let active = 0;
+  return {
+    get active() { return active; },
+    async run(work) {
+      if (typeof work !== 'function') throw new BridgeAuthError('INVALID_REQUEST_WORK', 'Request work must be a function.');
+      if (active >= maxConcurrent) throw new BridgeAuthError('TOO_MANY_REQUESTS', 'Too many bridge requests are active.', 429);
+      active += 1;
+      try { return await work(); } finally { active -= 1; }
+    }
+  };
+}
+
+module.exports = {
+  APT_EXTENSION_ID,
+  APT_EXTENSION_ORIGIN,
+  BridgeAuth,
+  BridgeAuthError,
+  COOKIE_PROOF_DOMAIN,
+  DEFAULT_BODY_DEADLINE_MS,
+  DEFAULT_CHALLENGE_TTL_MS,
+  DEFAULT_MAX_BODY_BYTES,
+  DEFAULT_MAX_CHALLENGES,
+  EXTENSION_ORIGIN_PATTERN,
+  NONCE_PATTERN,
+  SECRET_PATTERN,
+  SERVER_PROOF_DOMAIN,
+  canonicalCookieProof,
+  canonicalServerProof,
+  computeCookieProof,
+  computeServerProof,
+  createRequestLimiter,
+  generatePairingSecret,
+  isValidEnvelope,
+  readJsonBody
+};
diff --git a/src/device-projection.js b/src/device-projection.js
new file mode 100644
index 0000000..e29e14e
--- /dev/null
+++ b/src/device-projection.js
@@ -0,0 +1,135 @@
+'use strict';
+
+const { validateDeviceId } = require('./proxy-launch');
+const { toWellFormedString } = require('../well-formed-string');
+
+const MAX_PROJECTED_PAYLOAD_BYTES = 8 * 1024 * 1024;
+
+function projectionError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function nullableString(value) {
+  return typeof value === 'string' ? toWellFormedString(value) : null;
+}
+
+function nullableId(value) {
+  return typeof value === 'string' && value.length > 0 ? toWellFormedString(value) : null;
+}
+
+function nullableBoolean(value) {
+  return typeof value === 'boolean' ? value : null;
+}
+
+function projectDevice(raw) {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return null;
+  let id;
+  try {
+    id = validateDeviceId(raw.guid);
+  } catch {
+    return null;
+  }
+  return {
+    id,
+    name: nullableString(raw.name),
+    type: nullableString(raw.type),
+    model: nullableString(raw.model),
+    address: nullableString(raw.address),
+    // server_group_id identifies the Alta server/cloud connector, not a device site.
+    // The tree infers the site through device_group_id -> deviceGroups.parent_id.
+    siteId: null,
+    deviceGroupId: nullableId(raw.device_group_id),
+    displayStatus: nullableString(raw.live && raw.live.display_status),
+    localStorage: nullableBoolean(raw.capabilities && raw.capabilities.localStorage),
+  };
+}
+
+function projectSite(raw) {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return null;
+  const id = nullableId(raw.id);
+  if (!id) return null;
+  return {
+    id,
+    name: nullableString(raw.name),
+    pendingDeletionStart: nullableString(raw.pending_deletion_start),
+  };
+}
+
+function projectGroup(raw) {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return null;
+  const id = nullableId(raw.id);
+  if (!id) return null;
+  return {
+    id,
+    name: nullableString(raw.name),
+    parentId: nullableId(raw.parent_id),
+    pendingDeletionStart: nullableString(raw.pending_deletion_start),
+  };
+}
+
+function projectArray(values, projector) {
+  const projected = [];
+  let invalid = 0;
+  for (const value of Array.isArray(values) ? values : []) {
+    const item = projector(value);
+    if (item) projected.push(item);
+    else invalid += 1;
+  }
+  return { projected, invalid };
+}
+
+function safeMetadataError(value) {
+  return typeof value === 'string' && value.length > 0
+    ? Array.from(toWellFormedString(value)).slice(0, 512).join('')
+    : null;
+}
+
+function projectDeviceHierarchy({ devices = [], sites = [], groups = [], metadataErrors = {} } = {}) {
+  if (!Array.isArray(devices) || !Array.isArray(sites) || !Array.isArray(groups)) {
+    throw new TypeError('Hierarchy projection requires arrays');
+  }
+  const deviceProjection = projectArray(devices, projectDevice);
+  const eligibleDevices = deviceProjection.projected.filter((device) => device.localStorage !== true);
+  const cloudNativeExcluded = deviceProjection.projected.length - eligibleDevices.length;
+  const siteProjection = projectArray(sites, projectSite);
+  const groupProjection = projectArray(groups, projectGroup);
+  const payload = {
+    devices: eligibleDevices,
+    sites: siteProjection.projected,
+    groups: groupProjection.projected,
+    diagnostics: {
+      devices: {
+        received: devices.length,
+        eligible: eligibleDevices.length,
+        invalid: deviceProjection.invalid,
+        cloudNativeExcluded,
+      },
+      sites: {
+        received: sites.length,
+        projected: siteProjection.projected.length,
+        invalid: siteProjection.invalid,
+        error: safeMetadataError(metadataErrors.sites),
+      },
+      groups: {
+        received: groups.length,
+        projected: groupProjection.projected.length,
+        invalid: groupProjection.invalid,
+        error: safeMetadataError(metadataErrors.groups),
+      },
+    },
+  };
+  if (Buffer.byteLength(JSON.stringify(payload)) > MAX_PROJECTED_PAYLOAD_BYTES) {
+    throw projectionError('PROJECTED_PAYLOAD_TOO_LARGE', 'Projected Alta hierarchy exceeded the IPC size limit');
+  }
+  return payload;
+}
+
+module.exports = {
+  MAX_PROJECTED_PAYLOAD_BYTES,
+  projectDevice,
+  projectDeviceHierarchy,
+  projectGroup,
+  projectSite,
+};
diff --git a/src/electron-runtime.js b/src/electron-runtime.js
new file mode 100644
index 0000000..d0cdc74
--- /dev/null
+++ b/src/electron-runtime.js
@@ -0,0 +1,463 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const {
+  APT_EXTENSION_ORIGIN,
+  BridgeAuth,
+  BridgeAuthError,
+  createRequestLimiter,
+  readJsonBody,
+} = require('./bridge-auth');
+const { RELEASES_PAGE_URL } = require('./update-policy');
+const { projectDeviceHierarchy, projectGroup, projectSite } = require('./device-projection');
+const { validateCookie, validateDeviceId } = require('./proxy-launch');
+
+const DEFAULT_DISCOVERY_TIMEOUT_MS = 60_000;
+
+const PAIRING_ENVELOPE_FILENAME = 'bridge-pairing.json';
+
+function safeErrorMessage(error, fallback) {
+  const allowed = new Set([
+    'NO_ALTA_SESSION', 'INVALID_ALTA_ARGUMENTS', 'ALTA_TIMEOUT', 'ALTA_HTTP_ERROR',
+    'INVALID_ALTA_RESPONSE', 'INVALID_ALTA_RESPONSE_DATA', 'ALTA_RESPONSE_TOO_LARGE',
+    'ALTA_RESPONSE_TOO_MANY_OBJECTS', 'PROJECTED_PAYLOAD_TOO_LARGE',
+    'UNSAFE_ALTA_REDIRECT', 'TOO_MANY_ALTA_REDIRECTS', 'HELPER_NOT_FOUND',
+    'UNSUPPORTED_PLATFORM', 'INVALID_DEVICE_ID', 'INVALID_SESSION_COOKIE', 'SPAWN_FAILED',
+  ]);
+  return error && allowed.has(error.code) && typeof error.message === 'string'
+    ? error.message
+    : fallback;
+}
+
+function loadPairingEnvelope(envelopePath, { protect, unprotect } = {}) {
+  if (!fs.existsSync(envelopePath)) return null;
+  const bytes = fs.readFileSync(envelopePath);
+  if (bytes.length === 0 || bytes.length > 4096) throw new Error('Invalid pairing envelope file');
+  const parsed = JSON.parse(bytes.toString('utf8'));
+  // BridgeAuth performs the authoritative envelope schema validation.
+  return new BridgeAuth({ envelope: parsed, protect, unprotect }).envelope;
+}
+
+function atomicWritePairingEnvelope(envelopePath, envelope) {
+  const directory = path.dirname(envelopePath);
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  const temporaryPath = `${envelopePath}.${process.pid}.${Date.now()}.tmp`;
+  const payload = `${JSON.stringify(envelope)}\n`;
+  try {
+    fs.writeFileSync(temporaryPath, payload, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    fs.renameSync(temporaryPath, envelopePath);
+    fs.chmodSync(envelopePath, 0o600);
+  } catch (error) {
+    try { fs.unlinkSync(temporaryPath); } catch {}
+    throw error;
+  }
+}
+
+class PairingController {
+  constructor({ envelopePath, bridgeAuth, protect, unprotect } = {}) {
+    if (typeof envelopePath !== 'string' || envelopePath.length === 0) {
+      throw new TypeError('PairingController requires an envelope path');
+    }
+    this.envelopePath = envelopePath;
+    this.unavailable = false;
+    if (bridgeAuth) {
+      this.bridgeAuth = bridgeAuth;
+    } else if (typeof protect !== 'function' || typeof unprotect !== 'function') {
+      this.bridgeAuth = null;
+      this.unavailable = true;
+    } else {
+      let envelope = null;
+      try {
+        envelope = loadPairingEnvelope(envelopePath, { protect, unprotect });
+      } catch {
+        try { fs.unlinkSync(envelopePath); } catch {}
+      }
+      this.bridgeAuth = new BridgeAuth({ envelope, protect, unprotect });
+    }
+  }
+
+  initialize() {
+    if (this.unavailable) return { paired: false, unavailable: true };
+    if (this.bridgeAuth.envelope) return { paired: true };
+    return this.rotate();
+  }
+
+  rotate() {
+    if (this.unavailable || !this.bridgeAuth) {
+      throw new BridgeAuthError('SECURE_STORAGE_UNAVAILABLE', 'Secure pairing storage is unavailable.', 503);
+    }
+    const { secret, envelope } = this.bridgeAuth.rotate();
+    try {
+      atomicWritePairingEnvelope(this.envelopePath, envelope);
+    } catch (error) {
+      this.bridgeAuth.revoke();
+      throw error;
+    }
+    return { paired: true, secret };
+  }
+
+  revoke() {
+    if (this.bridgeAuth) this.bridgeAuth.revoke();
+    try {
+      fs.unlinkSync(this.envelopePath);
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+    }
+    return this.unavailable ? { paired: false, unavailable: true } : { paired: false };
+  }
+
+  getStatus() {
+    if (this.unavailable) return { paired: false, unavailable: true };
+    return { paired: Boolean(this.bridgeAuth && this.bridgeAuth.envelope) };
+  }
+}
+
+function writeJson(response, statusCode, payload) {
+  if (response.writableEnded) return;
+  response.writeHead(statusCode, {
+    'Content-Type': 'application/json',
+    'Cache-Control': 'no-store',
+    'X-Content-Type-Options': 'nosniff',
+  });
+  response.end(JSON.stringify(payload));
+}
+
+function createBridgeHandler({
+  bridgeAuth,
+  sessionStore,
+  onConnectionStateChanged = () => {},
+  limiter = createRequestLimiter({ maxConcurrent: 4 }),
+  maxBodyBytes,
+  deadlineMs,
+} = {}) {
+  if (!bridgeAuth || typeof bridgeAuth.issueChallenge !== 'function' || typeof bridgeAuth.authenticateCookie !== 'function') {
+    throw new TypeError('Bridge handler requires bridge authentication');
+  }
+  if (!sessionStore || typeof sessionStore.establish !== 'function') {
+    throw new TypeError('Bridge handler requires a session store');
+  }
+
+  return async function handleBridgeRequest(request, response) {
+    const origin = request && request.headers && request.headers.origin;
+    if (origin !== APT_EXTENSION_ORIGIN) {
+      writeJson(response, 403, { success: false, message: 'Forbidden' });
+      return;
+    }
+
+    response.setHeader('Access-Control-Allow-Origin', APT_EXTENSION_ORIGIN);
+    response.setHeader('Vary', 'Origin');
+    response.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
+    response.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+    response.setHeader('Access-Control-Max-Age', '600');
+
+    if (request.method === 'OPTIONS') {
+      response.writeHead(204, { 'Cache-Control': 'no-store' });
+      response.end();
+      return;
+    }
+    if (request.method !== 'POST' || (request.url !== '/challenge' && request.url !== '/cookie')) {
+      writeJson(response, 404, { success: false, message: 'Not found' });
+      return;
+    }
+
+    try {
+      let payload;
+      await limiter.run(async () => {
+        const data = await readJsonBody(request, { maxBytes: maxBodyBytes, deadlineMs });
+        if (request.url === '/challenge') {
+          payload = { success: true, ...bridgeAuth.issueChallenge(data.clientNonce) };
+          return;
+        }
+        if (!bridgeAuth.authenticateCookie(data)) {
+          throw new BridgeAuthError('FORBIDDEN', 'Cookie proof was rejected.', 403);
+        }
+        const state = sessionStore.establish(data.deploymentUrl, data.cookieValue);
+        onConnectionStateChanged({ connected: state.connected, origin: state.origin });
+        payload = { success: true, message: 'Session received' };
+      });
+      writeJson(response, 200, payload);
+    } catch (error) {
+      const statusCode = error instanceof BridgeAuthError
+        ? error.statusCode
+        : error && error.code === 'INVALID_SESSION_COOKIE'
+          ? 400
+          : 400;
+      const message = statusCode === 429 ? 'Too many requests'
+        : statusCode === 403 ? 'Forbidden'
+          : statusCode === 503 ? 'Pairing unavailable'
+            : 'Invalid request';
+      writeJson(response, statusCode, { success: false, message });
+    }
+  };
+}
+
+class AppRuntime {
+  constructor({
+    sessionStore,
+    altaClient,
+    proxyManager,
+    checkForUpdate,
+    currentVersion,
+    openExternal,
+    discoveryTimeoutMs = DEFAULT_DISCOVERY_TIMEOUT_MS,
+  } = {}) {
+    if (!Number.isInteger(discoveryTimeoutMs) || discoveryTimeoutMs < 1 ||
+        discoveryTimeoutMs > DEFAULT_DISCOVERY_TIMEOUT_MS) {
+      throw new RangeError('AppRuntime discovery timeout must be between 1 and 60000ms');
+    }
+    this.sessionStore = sessionStore;
+    this.altaClient = altaClient;
+    this.proxyManager = proxyManager;
+    this.checkForUpdatePolicy = checkForUpdate;
+    this.currentVersion = currentVersion;
+    this.openExternal = openExternal;
+    this.discoveryTimeoutMs = discoveryTimeoutMs;
+    this.allowedDeviceIds = new Set();
+    this.allowedDeviceDiscovery = null;
+    this.discoveryGeneration = 0;
+    this.proxyByDevice = new Map();
+  }
+
+  _reconcileProxies() {
+    const tracked = this.proxyManager && typeof this.proxyManager.listTrackedProxies === 'function'
+      ? this.proxyManager.listTrackedProxies()
+      : [];
+    this.proxyByDevice = new Map();
+    for (const proxy of tracked) {
+      try {
+        const deviceId = validateDeviceId(proxy.deviceId);
+        if (Number.isSafeInteger(proxy.processId) && proxy.processId > 0) {
+          this.proxyByDevice.set(deviceId, proxy.processId);
+        }
+      } catch {}
+    }
+    return tracked.filter((proxy) => this.proxyByDevice.get(proxy.deviceId) === proxy.processId);
+  }
+
+  _setAllowedDevices(devices, discovery) {
+    this.allowedDeviceIds = new Set(devices.map((device) => device.id));
+    this.allowedDeviceDiscovery = discovery;
+  }
+
+  _beginDiscovery() {
+    const state = this.sessionStore.describe();
+    this.allowedDeviceIds.clear();
+    this.allowedDeviceDiscovery = null;
+    return Object.freeze({
+      generation: ++this.discoveryGeneration,
+      connected: state.connected,
+      origin: state.origin,
+    });
+  }
+
+  _isCurrentDiscovery(discovery) {
+    const state = this.sessionStore.describe();
+    return discovery.generation === this.discoveryGeneration &&
+      discovery.connected === state.connected && discovery.origin === state.origin;
+  }
+
+  _staleDiscoveryResult() {
+    return {
+      success: false,
+      stale: true,
+      hierarchy: { devices: [], sites: [], groups: [] },
+      message: 'Alta device discovery result is stale',
+    };
+  }
+
+  invalidateDiscovery() {
+    this.discoveryGeneration += 1;
+    this.allowedDeviceIds.clear();
+    this.allowedDeviceDiscovery = null;
+  }
+
+  onSessionChanged() {
+    this.invalidateDiscovery();
+  }
+
+  async getDevices() {
+    const discovery = this._beginDiscovery();
+    try {
+      const hierarchy = projectDeviceHierarchy({
+        devices: await this.altaClient.getDevices(), sites: [], groups: [],
+      });
+      if (!this._isCurrentDiscovery(discovery)) return this._staleDiscoveryResult();
+      this._setAllowedDevices(hierarchy.devices, discovery);
+      return { success: true, devices: hierarchy.devices };
+    } catch (error) {
+      return { success: false, devices: [], message: safeErrorMessage(error, 'Failed to get devices') };
+    }
+  }
+
+  async getDeviceSites() {
+    try {
+      const sites = (await this.altaClient.getDeviceSites()).map(projectSite).filter(Boolean);
+      return { success: true, sites };
+    } catch (error) {
+      return { success: false, sites: [], message: safeErrorMessage(error, 'Failed to get device sites') };
+    }
+  }
+
+  async getDeviceGroups() {
+    try {
+      const groups = (await this.altaClient.getDeviceGroups()).map(projectGroup).filter(Boolean);
+      return { success: true, groups };
+    } catch (error) {
+      return { success: false, groups: [], message: safeErrorMessage(error, 'Failed to get device groups') };
+    }
+  }
+
+  async getDeviceHierarchy() {
+    const discoveryState = this._beginDiscovery();
+    let timer;
+    try {
+      const discovery = Promise.allSettled([
+        this.altaClient.getDevices(),
+        this.altaClient.getDeviceSites(),
+        this.altaClient.getDeviceGroups(),
+      ]);
+      const deadline = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+          const error = new Error('Alta device discovery timed out');
+          error.code = 'DISCOVERY_TIMEOUT';
+          reject(error);
+        }, this.discoveryTimeoutMs);
+      });
+      const [deviceResult, siteResult, groupResult] = await Promise.race([discovery, deadline]);
+      if (deviceResult.status === 'rejected') throw deviceResult.reason;
+
+      const metadataErrors = {};
+      if (siteResult.status === 'rejected') {
+        metadataErrors.sites = 'Device sites unavailable';
+      }
+      if (groupResult.status === 'rejected') {
+        metadataErrors.groups = 'Device groups unavailable';
+      }
+      const hierarchy = projectDeviceHierarchy({
+        devices: deviceResult.value,
+        sites: siteResult.status === 'fulfilled' ? siteResult.value : [],
+        groups: groupResult.status === 'fulfilled' ? groupResult.value : [],
+        metadataErrors,
+      });
+      if (!this._isCurrentDiscovery(discoveryState)) return this._staleDiscoveryResult();
+      this._setAllowedDevices(hierarchy.devices, discoveryState);
+      return { success: true, hierarchy };
+    } catch (error) {
+      if (!this._isCurrentDiscovery(discoveryState)) return this._staleDiscoveryResult();
+      this.allowedDeviceIds.clear();
+      const message = error && error.code === 'DISCOVERY_TIMEOUT'
+        ? 'Alta device discovery timed out'
+        : safeErrorMessage(error, 'Failed to discover Alta devices');
+      return { success: false, hierarchy: { devices: [], sites: [], groups: [] }, message };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
+  async getAuthInfo() {
+    try {
+      return { success: true, authInfo: await this.altaClient.getAuthInfo() };
+    } catch (error) {
+      return { success: false, message: safeErrorMessage(error, 'Failed to get authentication information') };
+    }
+  }
+
+  async launchProxy(deviceId) {
+    try {
+      const validatedId = validateDeviceId(deviceId);
+      this._reconcileProxies();
+      if (!this.allowedDeviceDiscovery || !this._isCurrentDiscovery(this.allowedDeviceDiscovery) ||
+          !this.allowedDeviceIds.has(validatedId)) {
+        return { success: false, message: 'Select a device from the current Alta device list.' };
+      }
+      if (this.proxyByDevice.has(validatedId)) {
+        return { success: false, message: 'A proxy is already running for this device.' };
+      }
+      const session = this.sessionStore.requireSession();
+      const result = this.proxyManager.launchProxy({
+        deploymentHost: new URL(session.origin).hostname,
+        cookie: validateCookie(session.cookie),
+        deviceId: validatedId,
+      });
+      this.proxyByDevice.set(validatedId, result.processId);
+      return { success: true, processId: result.processId, deviceId: validatedId, status: result.status };
+    } catch (error) {
+      return { success: false, message: safeErrorMessage(error, 'Failed to launch proxy') };
+    }
+  }
+
+  async stopProxy(key) {
+    this._reconcileProxies();
+    let deviceId = null;
+    let processId = null;
+    if (typeof key === 'string') {
+      try { deviceId = validateDeviceId(key); } catch { return { success: false, message: 'Invalid proxy key.' }; }
+      processId = this.proxyByDevice.get(deviceId);
+    } else if (Number.isSafeInteger(key) && key > 0) {
+      processId = key;
+      for (const [candidateDeviceId, candidateProcessId] of this.proxyByDevice) {
+        if (candidateProcessId === processId) deviceId = candidateDeviceId;
+      }
+    }
+    if (!processId || !deviceId) return { success: false, message: 'Proxy process is not owned by this app.' };
+
+    const result = await this.proxyManager.stopProxy(processId);
+    if (result.success) this.proxyByDevice.delete(deviceId);
+    return { ...result, deviceId };
+  }
+
+  async disconnect() {
+    this.invalidateDiscovery();
+    const tracked = this._reconcileProxies();
+    await Promise.all(tracked.map(async (proxy) => {
+      try {
+        await this.proxyManager.stopProxy(proxy.processId);
+      } catch {}
+    }));
+    const remaining = this._reconcileProxies();
+    if (remaining.length > 0) {
+      return {
+        success: false,
+        message: 'Could not confirm every active proxy exited. The Alta session remains connected.',
+        ...this.getConnectionState(),
+      };
+    }
+    this.sessionStore.clear();
+    this.allowedDeviceIds.clear();
+    return { success: true, ...this.getConnectionState() };
+  }
+
+  getConnectionState() {
+    this._reconcileProxies();
+    const state = this.sessionStore.describe();
+    return {
+      connected: state.connected,
+      origin: state.origin,
+      activeProxies: Array.from(this.proxyByDevice, ([deviceId, processId]) => ({ deviceId, processId })),
+    };
+  }
+
+  async checkForUpdates() {
+    try {
+      const result = await this.checkForUpdatePolicy({ currentVersion: this.currentVersion });
+      return { success: true, ...result };
+    } catch {
+      return { success: false, message: 'Could not securely check for updates.' };
+    }
+  }
+
+  async openFixedReleasesPage() {
+    await this.openExternal(RELEASES_PAGE_URL);
+    return { success: true };
+  }
+}
+
+module.exports = {
+  AppRuntime,
+  PAIRING_ENVELOPE_FILENAME,
+  PairingController,
+  atomicWritePairingEnvelope,
+  createBridgeHandler,
+  loadPairingEnvelope,
+};
diff --git a/src/error-redaction.js b/src/error-redaction.js
new file mode 100644
index 0000000..89a8bcf
--- /dev/null
+++ b/src/error-redaction.js
@@ -0,0 +1,85 @@
+'use strict';
+
+const MAX_OPERATION_LENGTH = 64;
+const MAX_CODE_LENGTH = 64;
+const MAX_MESSAGE_LENGTH = 240;
+const REDACTED = '[REDACTED]';
+
+function safeRead(object, key) {
+  try {
+    return object && typeof object === 'object' ? object[key] : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function redactKnownPatterns(message) {
+  return message
+    .replace(/\bauthorization\s*:\s*bearer\s+[^\s,;]+/gi, REDACTED)
+    .replace(/\bbearer\s+[^\s,;]+/gi, `Bearer ${REDACTED}`)
+    .replace(/\bcookie\s*:\s*[^\r\n]*/gi, REDACTED)
+    .replace(/\b(va\s*=\s*)[^\s;,]*/gi, `$1${REDACTED}`);
+}
+
+function sanitizeErrorMessage(value, options = {}) {
+  let message = typeof value === 'string' ? value : 'Alta request failed';
+  const secrets = Array.isArray(options.secrets) ? options.secrets : [];
+
+  for (const secret of secrets) {
+    if (typeof secret === 'string' && secret.length > 0) {
+      message = message.split(secret).join(REDACTED);
+    }
+  }
+
+  message = redactKnownPatterns(message)
+    .replace(/[\r\n\t]+/g, ' ')
+    .replace(/[\u0000-\u001f\u007f]/g, '')
+    .replace(/\s{2,}/g, ' ')
+    .trim();
+
+  if (!message) message = 'Alta request failed';
+  return message.slice(0, MAX_MESSAGE_LENGTH);
+}
+
+function includesSecret(value, secrets) {
+  return secrets.some((secret) => typeof secret === 'string' && secret.length > 0 && value.includes(secret));
+}
+
+function safeIdentifier(value, fallback, maxLength, secrets) {
+  if (typeof value !== 'string' || !/^[A-Za-z0-9_.:-]+$/.test(value)) return fallback;
+  if (includesSecret(value, secrets)) return fallback;
+  return value.slice(0, maxLength);
+}
+
+function safeStatus(error) {
+  const response = safeRead(error, 'response');
+  const candidate = safeRead(response, 'status') ?? safeRead(error, 'status');
+  return Number.isInteger(candidate) && candidate >= 100 && candidate <= 599 ? candidate : null;
+}
+
+function formatAltaError(operation, error, options = {}) {
+  const secrets = Array.isArray(options.secrets) ? options.secrets : [];
+  const rawMessage = safeRead(error, 'message');
+  const rawCode = safeRead(error, 'code');
+  const timeoutValue = safeRead(error, 'timeout');
+  const timeout = timeoutValue === true || rawCode === 'ECONNABORTED' || rawCode === 'ETIMEDOUT' || rawCode === 'ALTA_TIMEOUT';
+
+  // Deliberately construct a fresh allowlisted object. Never copy or spread the
+  // source error: Axios config/request/headers/data can carry the bearer cookie.
+  return Object.freeze({
+    operation: safeIdentifier(operation, 'altaRequest', MAX_OPERATION_LENGTH, secrets),
+    code: safeIdentifier(rawCode, 'ALTA_ERROR', MAX_CODE_LENGTH, secrets),
+    status: safeStatus(error),
+    timeout,
+    message: sanitizeErrorMessage(rawMessage, options),
+  });
+}
+
+module.exports = {
+  MAX_CODE_LENGTH,
+  MAX_MESSAGE_LENGTH,
+  MAX_OPERATION_LENGTH,
+  formatAltaError,
+  formatError: formatAltaError,
+  sanitizeErrorMessage,
+};
diff --git a/src/proxy-launch.js b/src/proxy-launch.js
new file mode 100644
index 0000000..f5da56d
--- /dev/null
+++ b/src/proxy-launch.js
@@ -0,0 +1,278 @@
+'use strict';
+
+const nodeFs = require('node:fs');
+const nodePath = require('node:path');
+const { spawn: nodeSpawn } = require('node:child_process');
+
+const HELPER_FILENAME = 'aware-cam-proxy.exe';
+const MAX_COOKIE_LENGTH = 4096;
+const MAX_HOST_LENGTH = 253;
+const DEVICE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const ALTA_SUFFIXES = ['.avasecurity.com', '.avigilon.com'];
+const DEFAULT_STOP_TIMEOUT_MS = 5_000;
+
+class ProxyLaunchError extends Error {
+  constructor(message, code) {
+    super(message);
+    this.name = 'ProxyLaunchError';
+    this.code = code;
+  }
+}
+
+function validateDeploymentHost(value) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > MAX_HOST_LENGTH) {
+    throw new ProxyLaunchError('Deployment host is invalid.', 'INVALID_DEPLOYMENT_HOST');
+  }
+
+  const host = value.toLowerCase();
+  const labels = host.split('.');
+  const hasAltaSuffix = ALTA_SUFFIXES.some((suffix) => host.endsWith(suffix));
+  if (!hasAltaSuffix || labels.some((label) => !DNS_LABEL_PATTERN.test(label))) {
+    throw new ProxyLaunchError('Deployment host is invalid.', 'INVALID_DEPLOYMENT_HOST');
+  }
+
+  return host;
+}
+
+function validateDeviceId(value) {
+  if (typeof value !== 'string' || value.length !== 36 || !DEVICE_ID_PATTERN.test(value)) {
+    throw new ProxyLaunchError('Device identifier is invalid.', 'INVALID_DEVICE_ID');
+  }
+  return value.toLowerCase();
+}
+
+function validateCookie(value) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > MAX_COOKIE_LENGTH) {
+    throw new ProxyLaunchError('Alta session cookie is invalid.', 'INVALID_SESSION_COOKIE');
+  }
+  if (/[;\u0000-\u001f\u007f-\u009f]/.test(value)) {
+    throw new ProxyLaunchError('Alta session cookie must not contain separators or control characters.', 'INVALID_SESSION_COOKIE');
+  }
+  return value;
+}
+
+function safeProcessError(error, secret) {
+  const source = error && typeof error.message === 'string' ? error.message : 'Unknown process error';
+  const redacted = secret ? source.split(secret).join('[REDACTED]') : source;
+  return redacted.replace(/[\u0000-\u001f\u007f-\u009f]/g, ' ').slice(0, 512);
+}
+
+function safeMetadata(entry, status = entry.status) {
+  return {
+    processId: entry.processId,
+    deviceId: entry.deviceId,
+    startedAt: entry.startedAt,
+    status
+  };
+}
+
+function createProxyManager({
+  appDirectory,
+  fs = nodeFs,
+  spawn = nodeSpawn,
+  platform = process.platform,
+  now = Date.now,
+  stopTimeoutMs = DEFAULT_STOP_TIMEOUT_MS,
+  setTimeout = global.setTimeout,
+  clearTimeout = global.clearTimeout
+} = {}) {
+  if (platform !== 'win32') {
+    throw new ProxyLaunchError('Proxy helper is supported only on the Windows platform.', 'UNSUPPORTED_PLATFORM');
+  }
+  if (typeof appDirectory !== 'string' || !nodePath.win32.isAbsolute(appDirectory)) {
+    throw new ProxyLaunchError('Approved application directory must be an absolute path.', 'INVALID_APP_DIRECTORY');
+  }
+  if (typeof fs.existsSync !== 'function' || typeof spawn !== 'function' || typeof now !== 'function' ||
+      !Number.isSafeInteger(stopTimeoutMs) || stopTimeoutMs <= 0 ||
+      typeof setTimeout !== 'function' || typeof clearTimeout !== 'function') {
+    throw new TypeError('Invalid proxy manager dependency.');
+  }
+
+  const helperPath = nodePath.win32.join(appDirectory, HELPER_FILENAME);
+  const trackedChildren = new Map();
+
+  function removeIfOwned(processId, child) {
+    const current = trackedChildren.get(processId);
+    if (current && current.child === child) trackedChildren.delete(processId);
+  }
+
+  function hasConfirmedExit(child) {
+    return (child.exitCode !== null && child.exitCode !== undefined) ||
+      (child.signalCode !== null && child.signalCode !== undefined);
+  }
+
+  function finishStopAttempt(entry, result) {
+    const attempt = entry.stopAttempt;
+    if (!attempt) return;
+    entry.stopAttempt = null;
+    entry.stopPromise = null;
+    clearTimeout(attempt.timer);
+    attempt.resolve(result);
+  }
+
+  function confirmExit(entry) {
+    const current = trackedChildren.get(entry.processId);
+    if (!current || current.child !== entry.child) return;
+    trackedChildren.delete(entry.processId);
+    finishStopAttempt(entry, {
+      success: true,
+      processId: entry.processId,
+      deviceId: entry.deviceId,
+      status: 'stopped'
+    });
+  }
+
+  function launchProxy(request) {
+    if (!request || typeof request !== 'object' || Array.isArray(request)) {
+      throw new ProxyLaunchError('Proxy launch request is invalid.', 'INVALID_REQUEST');
+    }
+
+    const deploymentHost = validateDeploymentHost(request.deploymentHost);
+    const deviceId = validateDeviceId(request.deviceId);
+    const cookie = validateCookie(request.cookie);
+
+    if (!fs.existsSync(helperPath)) {
+      throw new ProxyLaunchError('Proxy helper was not found in the approved application directory.', 'HELPER_NOT_FOUND');
+    }
+
+    let child;
+    try {
+      child = spawn(
+        helperPath,
+        ['-a', deploymentHost, '-d', deviceId, '-k', cookie],
+        {
+          shell: false,
+          detached: true,
+          stdio: 'ignore',
+          windowsHide: false
+        }
+      );
+    } catch (error) {
+      throw new ProxyLaunchError(
+        `Failed to launch proxy helper: ${safeProcessError(error, cookie)}`,
+        'SPAWN_FAILED'
+      );
+    }
+
+    if (!child || !Number.isSafeInteger(child.pid) || child.pid <= 0 || typeof child.kill !== 'function') {
+      throw new ProxyLaunchError('Proxy helper did not return a valid child process.', 'INVALID_CHILD_PROCESS');
+    }
+    if (trackedChildren.has(child.pid)) {
+      try {
+        child.kill('SIGTERM');
+      } catch {
+        // The new child is deliberately not tracked when its PID collides.
+      }
+      throw new ProxyLaunchError('Proxy helper returned a process identifier already in use.', 'DUPLICATE_PROCESS_ID');
+    }
+
+    const entry = {
+      child,
+      processId: child.pid,
+      deviceId,
+      startedAt: now(),
+      status: 'running',
+      stopAttempt: null,
+      stopPromise: null
+    };
+    trackedChildren.set(entry.processId, entry);
+
+    if (typeof child.once === 'function') {
+      child.once('exit', () => confirmExit(entry));
+      child.once('close', () => confirmExit(entry));
+      child.once('error', () => {
+        if (hasConfirmedExit(child)) confirmExit(entry);
+      });
+    }
+
+    return { success: true, ...safeMetadata(entry) };
+  }
+
+  async function stopProxy(processId) {
+    if (!Number.isSafeInteger(processId) || processId <= 0) {
+      throw new ProxyLaunchError('Process identifier is invalid.', 'INVALID_PROCESS_ID');
+    }
+
+    const entry = trackedChildren.get(processId);
+    if (!entry) return { success: false, processId, status: 'not-tracked' };
+
+    if (hasConfirmedExit(entry.child)) {
+      removeIfOwned(processId, entry.child);
+      return {
+        success: true,
+        processId,
+        deviceId: entry.deviceId,
+        status: 'already-exited'
+      };
+    }
+    if (entry.stopPromise) return entry.stopPromise;
+
+    entry.status = 'stopping';
+    entry.stopPromise = new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        finishStopAttempt(entry, {
+          success: false,
+          processId,
+          deviceId: entry.deviceId,
+          status: 'stop-timeout',
+          message: 'Timed out waiting for the tracked proxy process to exit.'
+        });
+      }, stopTimeoutMs);
+      entry.stopAttempt = { resolve, timer };
+    });
+    const stopPromise = entry.stopPromise;
+
+    try {
+      const requested = entry.child.kill('SIGTERM');
+      if (!requested) {
+        if (hasConfirmedExit(entry.child)) {
+          removeIfOwned(processId, entry.child);
+          finishStopAttempt(entry, {
+            success: true,
+            processId,
+            deviceId: entry.deviceId,
+            status: 'already-exited'
+          });
+        } else {
+          finishStopAttempt(entry, {
+            success: false,
+            processId,
+            deviceId: entry.deviceId,
+            status: 'stop-failed',
+            message: 'Unable to confirm that the tracked proxy process exited.'
+          });
+        }
+      }
+    } catch (error) {
+      const permissionDenied = error && (error.code === 'EPERM' || error.code === 'EACCES');
+      finishStopAttempt(entry, {
+        success: false,
+        processId,
+        deviceId: entry.deviceId,
+        status: permissionDenied ? 'permission-denied' : 'stop-failed',
+        message: permissionDenied
+          ? 'Unable to stop the tracked proxy process: permission denied.'
+          : 'Unable to stop the tracked proxy process.'
+      });
+    }
+    return stopPromise;
+  }
+
+  function listTrackedProxies() {
+    return Array.from(trackedChildren.values(), (entry) => safeMetadata(entry));
+  }
+
+  return Object.freeze({ launchProxy, stopProxy, listTrackedProxies });
+}
+
+module.exports = {
+  DEFAULT_STOP_TIMEOUT_MS,
+  HELPER_FILENAME,
+  MAX_COOKIE_LENGTH,
+  ProxyLaunchError,
+  createProxyManager,
+  validateCookie,
+  validateDeploymentHost,
+  validateDeviceId
+};
diff --git a/src/session-store.js b/src/session-store.js
new file mode 100644
index 0000000..5246930
--- /dev/null
+++ b/src/session-store.js
@@ -0,0 +1,81 @@
+'use strict';
+
+const { canonicalizeAltaOrigin } = require('./url-policy');
+
+const MAX_COOKIE_LENGTH = 4096;
+
+function sessionError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function validateCookie(cookie) {
+  if (
+    typeof cookie !== 'string' ||
+    cookie.length === 0 ||
+    cookie.length > MAX_COOKIE_LENGTH ||
+    /[;\r\n\0]/.test(cookie)
+  ) {
+    throw sessionError('INVALID_SESSION_COOKIE', 'Invalid Alta session cookie');
+  }
+  return cookie;
+}
+
+class SessionStore {
+  #origin = null;
+  #cookie = null;
+  #disposed = false;
+
+  establish(deploymentOrigin, cookie) {
+    if (this.#disposed) {
+      throw sessionError('SESSION_STORE_DISPOSED', 'Alta session store is disposed');
+    }
+
+    // Validate the complete replacement before dropping the current session.
+    const nextOrigin = canonicalizeAltaOrigin(deploymentOrigin);
+    const nextCookie = validateCookie(cookie);
+    this.#origin = nextOrigin;
+    this.#cookie = nextCookie;
+    return this.describe();
+  }
+
+  setSession(deploymentOrigin, cookie) {
+    return this.establish(deploymentOrigin, cookie);
+  }
+
+  requireSession() {
+    if (this.#disposed || this.#origin === null || this.#cookie === null) {
+      throw sessionError('NO_ALTA_SESSION', 'No active Alta session');
+    }
+    return Object.freeze({ origin: this.#origin, cookie: this.#cookie });
+  }
+
+  describe() {
+    return Object.freeze({
+      connected: !this.#disposed && this.#origin !== null && this.#cookie !== null,
+      origin: !this.#disposed ? this.#origin : null,
+    });
+  }
+
+  clear() {
+    this.#cookie = null;
+    this.#origin = null;
+  }
+
+  dispose() {
+    this.clear();
+    this.#disposed = true;
+  }
+}
+
+function createSessionStore() {
+  return new SessionStore();
+}
+
+module.exports = {
+  MAX_COOKIE_LENGTH,
+  SessionStore,
+  createSessionStore,
+  validateCookie,
+};
diff --git a/src/update-policy.js b/src/update-policy.js
new file mode 100644
index 0000000..4302d0f
--- /dev/null
+++ b/src/update-policy.js
@@ -0,0 +1,324 @@
+'use strict';
+
+const https = require('node:https');
+
+const LATEST_RELEASE_URL = 'https://git.pejicorp.com/api/v1/repos/peji/Alta-Proxy-Tool/releases/latest';
+const RELEASES_PAGE_URL = 'https://git.pejicorp.com/peji/Alta-Proxy-Tool/releases';
+const REQUEST_TIMEOUT_MS = 5000;
+const MAX_BODY_BYTES = 64 * 1024;
+const MAX_RELEASE_NAME_LENGTH = 200;
+
+// Strict SemVer 2.0.0 without loose forms such as omitted fields.
+const SEMVER_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
+
+class UpdatePolicyError extends Error {
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = 'UpdatePolicyError';
+    this.code = code;
+  }
+}
+
+function policyError(code, message, cause) {
+  return new UpdatePolicyError(code, message, cause ? { cause } : undefined);
+}
+
+function parseSemver(version, errorCode = 'INVALID_VERSION') {
+  if (typeof version !== 'string') {
+    throw policyError(errorCode, 'Version must be a strict semantic version string');
+  }
+
+  const match = SEMVER_PATTERN.exec(version);
+  if (!match) {
+    throw policyError(errorCode, 'Version must use strict SemVer 2.0.0 syntax');
+  }
+
+  return {
+    major: BigInt(match[1]),
+    minor: BigInt(match[2]),
+    patch: BigInt(match[3]),
+    prerelease: match[4] === undefined ? null : match[4].split('.'),
+  };
+}
+
+function normalizeReleaseTag(tag) {
+  const version = tag.startsWith('v') ? tag.slice(1) : tag;
+  parseSemver(version, 'INVALID_RELEASE_VERSION');
+  return version;
+}
+
+function compareIdentifier(left, right) {
+  const leftNumeric = /^\d+$/.test(left);
+  const rightNumeric = /^\d+$/.test(right);
+
+  if (leftNumeric && rightNumeric) {
+    const leftNumber = BigInt(left);
+    const rightNumber = BigInt(right);
+    return leftNumber < rightNumber ? -1 : leftNumber > rightNumber ? 1 : 0;
+  }
+  if (leftNumeric !== rightNumeric) {
+    return leftNumeric ? -1 : 1;
+  }
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
+function compareSemver(leftVersion, rightVersion) {
+  const left = parseSemver(leftVersion);
+  const right = parseSemver(rightVersion);
+
+  for (const key of ['major', 'minor', 'patch']) {
+    if (left[key] < right[key]) return -1;
+    if (left[key] > right[key]) return 1;
+  }
+
+  if (left.prerelease === null && right.prerelease === null) return 0;
+  if (left.prerelease === null) return 1;
+  if (right.prerelease === null) return -1;
+
+  const count = Math.max(left.prerelease.length, right.prerelease.length);
+  for (let index = 0; index < count; index += 1) {
+    if (left.prerelease[index] === undefined) return -1;
+    if (right.prerelease[index] === undefined) return 1;
+    const comparison = compareIdentifier(left.prerelease[index], right.prerelease[index]);
+    if (comparison !== 0) return comparison;
+  }
+  return 0;
+}
+
+function sanitizeText(value) {
+  return value
+    .trim()
+    .slice(0, MAX_RELEASE_NAME_LENGTH)
+    .replaceAll('&', '&amp;')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&#39;');
+}
+
+function validateRuntimeValue(value, field) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > 64 || !/^[a-zA-Z0-9_-]+$/.test(value)) {
+    throw policyError('INVALID_RUNTIME_METADATA', `Invalid ${field} metadata`);
+  }
+  return value;
+}
+
+function parseRelease(body) {
+  let release;
+  try {
+    release = JSON.parse(body.toString('utf8'));
+  } catch (error) {
+    throw policyError('INVALID_RESPONSE', 'Release response was not valid JSON', error);
+  }
+
+  if (!release || typeof release !== 'object' || Array.isArray(release)) {
+    throw policyError('INVALID_RESPONSE', 'Release response must be an object');
+  }
+  if (typeof release.tag_name !== 'string' || release.tag_name.length > 128) {
+    throw policyError('INVALID_RESPONSE', 'Release tag_name must be a bounded string');
+  }
+  if (release.name !== undefined && release.name !== null && typeof release.name !== 'string') {
+    throw policyError('INVALID_RESPONSE', 'Release name must be a string when provided');
+  }
+  if (typeof release.name === 'string' && release.name.length > 1000) {
+    throw policyError('INVALID_RESPONSE', 'Release name exceeds the schema limit');
+  }
+  if (release.published_at !== undefined && release.published_at !== null && typeof release.published_at !== 'string') {
+    throw policyError('INVALID_RESPONSE', 'Release published_at must be a string when provided');
+  }
+
+  let publishedAt;
+  if (typeof release.published_at === 'string') {
+    if (release.published_at.length > 64) {
+      throw policyError('INVALID_RESPONSE', 'Release published_at exceeds the schema limit');
+    }
+    const timestamp = new Date(release.published_at);
+    if (Number.isNaN(timestamp.getTime())) {
+      throw policyError('INVALID_RESPONSE', 'Release published_at must be a valid timestamp');
+    }
+    publishedAt = timestamp.toISOString();
+  }
+
+  return {
+    latestVersion: release.tag_name,
+    releaseName: sanitizeText(release.name || release.tag_name),
+    publishedAt,
+  };
+}
+
+function defaultRequest({
+  url,
+  timeoutMs,
+  maxBodyBytes,
+  httpsGet = https.get,
+  setTimer = setTimeout,
+  clearTimer = clearTimeout,
+}) {
+  if (url !== LATEST_RELEASE_URL) {
+    return Promise.reject(policyError('UNTRUSTED_REQUEST_URL', 'Update checks are restricted to GitPeji'));
+  }
+
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    let responseStream = null;
+    let deadlineTimer = null;
+    const clearDeadline = () => {
+      if (deadlineTimer !== null) {
+        clearTimer(deadlineTimer);
+        deadlineTimer = null;
+      }
+    };
+    const finishReject = (error) => {
+      if (!settled) {
+        settled = true;
+        clearDeadline();
+        reject(error);
+      }
+    };
+
+    const request = httpsGet(url, {
+      headers: {
+        accept: 'application/json',
+        'user-agent': 'Alta-Proxy-Tool-update-check',
+      },
+      agent: false,
+    }, (response) => {
+      responseStream = response;
+      const chunks = [];
+      let receivedBytes = 0;
+      const contentLength = Number(response.headers['content-length']);
+
+      if (Number.isFinite(contentLength) && contentLength > maxBodyBytes) {
+        response.destroy();
+        finishReject(policyError('RESPONSE_TOO_LARGE', 'Release response exceeded the size limit'));
+        return;
+      }
+
+      response.on('data', (chunk) => {
+        receivedBytes += chunk.length;
+        if (receivedBytes > maxBodyBytes) {
+          response.destroy();
+          finishReject(policyError('RESPONSE_TOO_LARGE', 'Release response exceeded the size limit'));
+          return;
+        }
+        chunks.push(chunk);
+      });
+      response.on('end', () => {
+        if (settled) return;
+        settled = true;
+        clearDeadline();
+        resolve({
+          statusCode: response.statusCode,
+          headers: response.headers,
+          body: Buffer.concat(chunks),
+          url,
+        });
+      });
+      response.on('error', finishReject);
+    });
+
+    deadlineTimer = setTimer(() => {
+      const timeoutError = policyError('REQUEST_TIMEOUT', 'Release check timed out');
+      if (responseStream && typeof responseStream.destroy === 'function') responseStream.destroy();
+      request.destroy(timeoutError);
+      finishReject(timeoutError);
+    }, timeoutMs);
+    request.on('error', (error) => {
+      if (error instanceof UpdatePolicyError) {
+        finishReject(error);
+      } else {
+        finishReject(policyError('REQUEST_FAILED', 'Release check failed', error));
+      }
+    });
+  });
+}
+
+async function checkForUpdate({
+  currentVersion,
+  request = defaultRequest,
+  platform = process.platform,
+  arch = process.arch,
+} = {}) {
+  parseSemver(currentVersion, 'INVALID_CURRENT_VERSION');
+  if (typeof request !== 'function') {
+    throw policyError('INVALID_REQUEST_ADAPTER', 'Request adapter must be a function');
+  }
+
+  const safePlatform = validateRuntimeValue(platform, 'platform');
+  const safeArch = validateRuntimeValue(arch, 'architecture');
+  const baseMetadata = {
+    currentVersion,
+    releasesPageUrl: RELEASES_PAGE_URL,
+    platform: safePlatform,
+    arch: safeArch,
+  };
+
+  const response = await request({
+    url: LATEST_RELEASE_URL,
+    timeoutMs: REQUEST_TIMEOUT_MS,
+    maxBodyBytes: MAX_BODY_BYTES,
+    redirects: 'error',
+  });
+
+  if (!response || typeof response !== 'object') {
+    throw policyError('INVALID_RESPONSE', 'Request adapter returned an invalid response');
+  }
+  if (response.url !== LATEST_RELEASE_URL) {
+    throw policyError('UNTRUSTED_RESPONSE_URL', 'Release response did not come from the exact GitPeji endpoint');
+  }
+
+  const statusCode = Number(response.statusCode);
+  if (statusCode >= 300 && statusCode < 400) {
+    throw policyError('REDIRECT_REJECTED', 'Release endpoint redirects are not allowed');
+  }
+  if (statusCode === 404) {
+    return { status: 'no-release', ...baseMetadata };
+  }
+  if (statusCode !== 200) {
+    throw policyError('HTTP_ERROR', `Release endpoint returned HTTP ${statusCode}`);
+  }
+
+  const contentType = response.headers && response.headers['content-type'];
+  if (typeof contentType !== 'string' || !/^application\/json(?:\s*;|$)/i.test(contentType)) {
+    throw policyError('INVALID_CONTENT_TYPE', 'Release endpoint did not return JSON');
+  }
+
+  const body = Buffer.isBuffer(response.body)
+    ? response.body
+    : typeof response.body === 'string'
+      ? Buffer.from(response.body)
+      : null;
+  if (!body) {
+    throw policyError('INVALID_RESPONSE', 'Release response body must be bytes or text');
+  }
+  if (body.length > MAX_BODY_BYTES) {
+    throw policyError('RESPONSE_TOO_LARGE', 'Release response exceeded the size limit');
+  }
+
+  const release = parseRelease(body);
+  const latestVersion = normalizeReleaseTag(release.latestVersion);
+
+  const metadata = {
+    status: compareSemver(latestVersion, currentVersion) > 0
+      ? 'update-available'
+      : 'up-to-date',
+    ...baseMetadata,
+    latestVersion,
+    releaseName: release.releaseName,
+  };
+  if (release.publishedAt !== undefined) {
+    metadata.publishedAt = release.publishedAt;
+  }
+  return metadata;
+}
+
+module.exports = {
+  LATEST_RELEASE_URL,
+  RELEASES_PAGE_URL,
+  REQUEST_TIMEOUT_MS,
+  MAX_BODY_BYTES,
+  UpdatePolicyError,
+  checkForUpdate,
+  compareSemver,
+  defaultRequest,
+};
diff --git a/src/url-policy.js b/src/url-policy.js
new file mode 100644
index 0000000..c6b5709
--- /dev/null
+++ b/src/url-policy.js
@@ -0,0 +1,92 @@
+'use strict';
+
+const MAX_ORIGIN_LENGTH = 512;
+const ALTA_SUFFIXES = Object.freeze(['avasecurity.com', 'avigilon.com']);
+
+function policyError(message = 'Invalid Alta deployment origin') {
+  const error = new TypeError(message);
+  error.code = 'INVALID_ALTA_ORIGIN';
+  return error;
+}
+
+function canonicalizeAltaOrigin(value) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > MAX_ORIGIN_LENGTH) {
+    throw policyError();
+  }
+  if (value !== value.trim() || /[\u0000-\u0020\u007f]/.test(value)) {
+    throw policyError();
+  }
+
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw policyError();
+  }
+
+  if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.hash || parsed.search) {
+    throw policyError();
+  }
+  if (parsed.port && parsed.port !== '443') {
+    throw policyError();
+  }
+  if (parsed.pathname !== '/' && parsed.pathname !== '') {
+    throw policyError();
+  }
+
+  const hostname = parsed.hostname.toLowerCase();
+  const suffix = ALTA_SUFFIXES.find((candidate) => hostname.endsWith(`.${candidate}`));
+  if (!suffix) {
+    throw policyError();
+  }
+
+  const subdomain = hostname.slice(0, -(suffix.length + 1));
+  const labels = subdomain.split('.');
+  if (labels.some((label) => !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label))) {
+    throw policyError();
+  }
+
+  return `https://${hostname}`;
+}
+
+function isAltaOrigin(value) {
+  try {
+    canonicalizeAltaOrigin(value);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function assertSameAltaOrigin(candidate, expectedOrigin) {
+  if (typeof candidate !== 'string' || /[\u0000-\u0020\u007f]/.test(candidate)) {
+    throw policyError('Invalid Alta request URL');
+  }
+  let target;
+  try {
+    target = new URL(candidate);
+  } catch {
+    throw policyError('Invalid Alta request URL');
+  }
+  const expected = canonicalizeAltaOrigin(expectedOrigin);
+  const actual = canonicalizeAltaOrigin(target.origin);
+  if (
+    actual !== expected ||
+    target.origin !== expected ||
+    target.username ||
+    target.password ||
+    target.hash
+  ) {
+    throw policyError('Alta request URL changed origin');
+  }
+  return target;
+}
+
+module.exports = {
+  ALTA_SUFFIXES,
+  MAX_ORIGIN_LENGTH,
+  assertSameAltaOrigin,
+  canonicalizeAltaOrigin,
+  isAltaOrigin,
+  validateAltaOrigin: canonicalizeAltaOrigin,
+};
diff --git a/styles.css b/styles.css
index 4012ae0..aff017a 100644
--- a/styles.css
+++ b/styles.css
@@ -51,7 +51,7 @@ body {
 
 /* Left Sidebar - Available Devices */
 .devices-sidebar {
-    width: 220px;
+    width: 300px;
     background: var(--card-bg);
     border-right: 1px solid var(--border);
     display: flex;
@@ -113,7 +113,175 @@ body {
 .device-list {
     flex: 1;
     overflow-y: auto;
-    padding: 8px;
+    padding: 0;
+}
+
+/* Accessible, bounded virtual hierarchy */
+.visually-hidden {
+    position: absolute;
+    width: 1px;
+    height: 1px;
+    padding: 0;
+    margin: -1px;
+    overflow: hidden;
+    clip: rect(0, 0, 0, 0);
+    white-space: nowrap;
+    border: 0;
+}
+
+.tree-results {
+    min-height: 16px;
+    margin-top: 6px;
+    color: var(--text-secondary);
+    font-size: 11px;
+}
+
+.virtual-tree {
+    position: relative;
+    outline: none;
+}
+
+.virtual-tree:focus-visible {
+    box-shadow: inset 0 0 0 2px var(--accent-primary);
+}
+
+.virtual-tree.has-hidden-selection::after {
+    content: 'Selected camera hidden';
+    position: sticky;
+    bottom: 4px;
+    left: 8px;
+    z-index: 3;
+    display: inline-block;
+    padding: 2px 6px;
+    border-radius: 3px;
+    background: var(--bg-primary);
+    color: var(--warning);
+    font-size: 10px;
+    pointer-events: none;
+}
+
+.virtual-tree-spacer {
+    position: relative;
+    min-height: 100%;
+}
+
+.virtual-tree-window {
+    position: absolute;
+    top: 0;
+    right: 0;
+    left: 0;
+    will-change: transform;
+}
+
+.tree-row {
+    position: absolute;
+    right: 0;
+    left: 0;
+    height: 30px;
+    display: flex;
+    align-items: center;
+    gap: 5px;
+    padding-right: 8px;
+    border-left: 2px solid transparent;
+    color: var(--text-primary);
+    cursor: default;
+    user-select: none;
+}
+
+.tree-row:hover,
+.tree-row.active {
+    background: var(--hover-bg);
+}
+
+.tree-row.active {
+    border-left-color: var(--accent-primary);
+    box-shadow: inset 0 0 0 1px rgba(14, 122, 254, 0.35);
+}
+
+.tree-row.selected {
+    background: rgba(14, 122, 254, 0.28);
+}
+
+.tree-site {
+    padding-left: 8px;
+    color: var(--accent-primary);
+    font-weight: 700;
+}
+
+.tree-group {
+    padding-left: 24px;
+    color: #b8cbea;
+    font-weight: 600;
+}
+
+.tree-camera {
+    padding-left: 42px;
+}
+
+.tree-camera::before {
+    content: '';
+    width: 7px;
+    height: 7px;
+    flex: 0 0 7px;
+    border-radius: 50%;
+    background: var(--error);
+}
+
+.tree-camera.online::before {
+    background: var(--success);
+}
+
+.tree-camera.proxy-active {
+    border-right: 3px solid var(--success);
+}
+
+.tree-disclosure {
+    width: 10px;
+    flex: 0 0 10px;
+    color: var(--text-secondary);
+    font-size: 9px;
+    text-align: center;
+}
+
+.tree-label {
+    min-width: 0;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+}
+
+.tree-address {
+    margin-left: auto;
+    overflow: hidden;
+    color: var(--text-secondary);
+    font-family: Consolas, monospace;
+    font-size: 10px;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+}
+
+.tree-badge {
+    flex: 0 0 auto;
+    padding: 1px 4px;
+    border-radius: 3px;
+    font-size: 9px;
+}
+
+.tree-badge.pending,
+.tree-row.pending-deletion {
+    color: var(--warning);
+}
+
+.tree-warning {
+    width: 14px;
+    height: 14px;
+    flex: 0 0 14px;
+    border: 1px solid var(--warning);
+    border-radius: 50%;
+    color: var(--warning);
+    font-size: 9px;
+    line-height: 12px;
+    text-align: center;
 }
 
 .device-item {
@@ -532,7 +700,47 @@ button:disabled {
     to { transform: rotate(360deg); }
 }
 
-/* Update Modal */
+/* Bridge pairing */
+.section-help {
+    color: var(--text-secondary);
+    font-size: 13px;
+    margin: 0 0 14px;
+}
+
+.pairing-section .paired {
+    color: var(--success);
+    font-weight: 600;
+}
+
+.pairing-section .unpaired {
+    color: var(--warning);
+    font-weight: 600;
+}
+
+.pairing-secret-row {
+    margin: 14px 0;
+}
+
+.pairing-secret-row label,
+.pairing-secret-row small {
+    display: block;
+    color: var(--text-secondary);
+    margin-bottom: 6px;
+}
+
+.pairing-secret-row input {
+    width: 100%;
+    box-sizing: border-box;
+    font-family: monospace;
+    background: var(--bg-primary);
+    color: var(--text-primary);
+    border: 1px solid var(--border);
+    border-radius: 4px;
+    padding: 10px;
+    margin-bottom: 6px;
+}
+
+/* Update notification */
 .update-modal-overlay {
     position: fixed;
     top: 0;
@@ -595,55 +803,7 @@ button:disabled {
 .update-modal-message {
     font-size: 14px;
     color: var(--text-primary);
-    margin: 0 0 12px 0;
-}
-
-.update-modal-notes {
-    font-size: 13px;
-    color: var(--text-secondary);
-    line-height: 1.5;
-    white-space: pre-wrap;
-    max-height: 200px;
-    overflow-y: auto;
-    padding: 12px;
-    background: var(--bg-primary);
-    border-radius: 4px;
-    border: 1px solid var(--border);
-}
-
-.update-modal-notes:empty {
-    display: none;
-}
-
-.update-progress-container {
-    margin-top: 16px;
-    display: flex;
-    align-items: center;
-    gap: 12px;
-}
-
-.update-progress-track {
-    flex: 1;
-    height: 8px;
-    background: var(--bg-primary);
-    border-radius: 4px;
-    overflow: hidden;
-    border: 1px solid var(--border);
-}
-
-.update-progress-fill {
-    height: 100%;
-    background: var(--accent-primary);
-    border-radius: 4px;
-    transition: width 0.3s ease;
-}
-
-.update-progress-text {
-    font-size: 12px;
-    font-weight: bold;
-    color: var(--text-secondary);
-    min-width: 36px;
-    text-align: right;
+    margin: 0;
 }
 
 .update-modal-footer {
diff --git a/test/alta-client.test.js b/test/alta-client.test.js
new file mode 100644
index 0000000..e276600
--- /dev/null
+++ b/test/alta-client.test.js
@@ -0,0 +1,280 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { SessionStore } = require('../src/session-store');
+const {
+  AltaClient,
+  DEVICE_MAX_RESPONSE_BYTES,
+  HIERARCHY_MAX_RESPONSE_BYTES,
+  MAX_ARRAY_OBJECTS,
+} = require('../src/alta-client');
+
+const ORIGIN = 'https://tenant.avasecurity.com';
+const SENTINEL = 'HERMES_SENTINEL_SECRET';
+
+function readyStore() {
+  const store = new SessionStore();
+  store.establish(ORIGIN, SENTINEL);
+  return store;
+}
+
+function response(data, overrides = {}) {
+  return { status: 200, headers: {}, data, ...overrides };
+}
+
+test('uses only stored authority, fixed endpoint paths and hardened transport options', async () => {
+  const calls = [];
+  const transport = async (options) => {
+    calls.push(options);
+    if (options.url.endsWith('/devices')) return response([]);
+    if (options.url.endsWith('/deviceSites')) return response([{ id: 'site-1' }]);
+    if (options.url.endsWith('/deviceGroups')) return response([{ id: 'group-1' }]);
+    return response({ user: 'engineer' });
+  };
+  const client = new AltaClient({ sessionStore: readyStore(), transport });
+
+  assert.deepEqual(await client.getDevices(), []);
+  assert.deepEqual(await client.getDeviceSites(), [{ id: 'site-1' }]);
+  assert.deepEqual(await client.getDeviceGroups(), [{ id: 'group-1' }]);
+  assert.deepEqual(await client.getAuthInfo(), { user: 'engineer' });
+
+  assert.deepEqual(calls.map((call) => call.url), [
+    `${ORIGIN}/api/v1/devices`,
+    `${ORIGIN}/api/v1/deviceSites`,
+    `${ORIGIN}/api/v1/deviceGroups`,
+    `${ORIGIN}/api/v1/auth`,
+  ]);
+  for (const call of calls) {
+    assert.equal(call.method, 'GET');
+    assert.equal(call.proxy, false);
+    assert.equal(call.maxRedirects, 0);
+    assert.match(call.headers.Cookie, /^va=HERMES_SENTINEL_SECRET$/);
+    assert.ok(call.timeout > 0 && call.timeout <= 30_000);
+    assert.ok(call.maxResponseBytes > 0);
+  }
+});
+
+test('uses endpoint-specific 32 MiB/4 MiB limits and a 30 second request deadline', async () => {
+  const calls = [];
+  const client = new AltaClient({
+    sessionStore: readyStore(),
+    transport: async (options) => { calls.push(options); return response([]); },
+  });
+
+  await client.getDevices();
+  await client.getDeviceSites();
+  await client.getDeviceGroups();
+
+  assert.deepEqual(calls.map(({ maxResponseBytes }) => maxResponseBytes), [
+    DEVICE_MAX_RESPONSE_BYTES,
+    HIERARCHY_MAX_RESPONSE_BYTES,
+    HIERARCHY_MAX_RESPONSE_BYTES,
+  ]);
+  assert.ok(calls.every(({ timeout }) => timeout > 0 && timeout <= 30_000));
+});
+
+test('accepts device bodies above 2 MiB and rejects bodies above 32 MiB before parsing', async () => {
+  const acceptedBody = JSON.stringify([{
+    guid: '550e8400-e29b-41d4-a716-446655440000',
+    padding: 'x'.repeat((2 * 1024 * 1024) + 1),
+  }]);
+  const accepted = new AltaClient({
+    sessionStore: readyStore(),
+    transport: async () => response(Buffer.from(acceptedBody)),
+  });
+  assert.equal((await accepted.getDevices()).length, 1);
+
+  const rejected = new AltaClient({
+    sessionStore: readyStore(),
+    transport: async () => response(Buffer.alloc(DEVICE_MAX_RESPONSE_BYTES + 1, 0x20)),
+  });
+  await assert.rejects(rejected.getDevices(), { code: 'ALTA_RESPONSE_TOO_LARGE' });
+});
+
+test('rejects plain array responses containing more than 10,000 objects', async () => {
+  const client = new AltaClient({
+    sessionStore: readyStore(),
+    transport: async () => response(Array.from({ length: MAX_ARRAY_OBJECTS + 1 }, () => ({}))),
+  });
+  await assert.rejects(client.getDevices(), { code: 'ALTA_RESPONSE_TOO_MANY_OBJECTS' });
+});
+
+test('rejects renderer-supplied URL/cookie parameters before transport', async () => {
+  let calls = 0;
+  const client = new AltaClient({
+    sessionStore: readyStore(),
+    transport: async () => { calls += 1; return response([]); },
+  });
+
+  await assert.rejects(
+    client.getDevices({ deploymentUrl: 'https://evil.example', cookies: [SENTINEL] }),
+    { code: 'INVALID_ALTA_ARGUMENTS' },
+  );
+  await assert.rejects(client.getAuthInfo(SENTINEL), { code: 'INVALID_ALTA_ARGUMENTS' });
+  assert.equal(calls, 0);
+});
+
+test('allows only bounded exact-same-origin redirects', async () => {
+  const seen = [];
+  const transport = async (options) => {
+    seen.push(options.url);
+    if (seen.length === 1) {
+      return response('', { status: 307, headers: { location: '/api/v1/devices?cursor=next' } });
+    }
+    return response([]);
+  };
+  const client = new AltaClient({ sessionStore: readyStore(), transport });
+  assert.deepEqual(await client.getDevices(), []);
+  assert.deepEqual(seen, [
+    `${ORIGIN}/api/v1/devices`,
+    `${ORIGIN}/api/v1/devices?cursor=next`,
+  ]);
+
+  for (const location of [
+    'https://evil.example/steal',
+    'https://other.avasecurity.com/api/v1/devices',
+    'http://tenant.avasecurity.com/api/v1/devices',
+    '//evil.example/steal',
+    `https://user:pass@tenant.avasecurity.com/api/v1/devices`,
+    `${ORIGIN}/api/v1/devices#not-sent-to-server`,
+  ]) {
+    let count = 0;
+    const blocked = new AltaClient({
+      sessionStore: readyStore(),
+      transport: async () => {
+        count += 1;
+        return response('', { status: 302, headers: { location } });
+      },
+    });
+    await assert.rejects(blocked.getDevices(), { code: 'UNSAFE_ALTA_REDIRECT' });
+    assert.equal(count, 1, location);
+  }
+});
+
+test('enforces redirect limit and rejects redirects without locations', async () => {
+  const looping = new AltaClient({
+    sessionStore: readyStore(),
+    maxRedirects: 2,
+    transport: async () => response('', { status: 302, headers: { location: '/api/v1/devices' } }),
+  });
+  await assert.rejects(looping.getDevices(), { code: 'TOO_MANY_ALTA_REDIRECTS' });
+
+  const missing = new AltaClient({
+    sessionStore: readyStore(),
+    transport: async () => response('', { status: 302, headers: {} }),
+  });
+  await assert.rejects(missing.getDevices(), { code: 'UNSAFE_ALTA_REDIRECT' });
+});
+
+test('enforces a total timeout even when injected transport does not cooperate', async () => {
+  const client = new AltaClient({
+    sessionStore: readyStore(),
+    timeoutMs: 25,
+    transport: async () => new Promise(() => {}),
+  });
+  await assert.rejects(client.getDevices(), { code: 'ALTA_TIMEOUT', timeout: true });
+});
+
+test('rejects oversized responses using content-length and actual data size', async () => {
+  const byHeader = new AltaClient({
+    sessionStore: readyStore(),
+    maxResponseBytes: 32,
+    transport: async () => response([], { headers: { 'content-length': '33' } }),
+  });
+  await assert.rejects(byHeader.getDevices(), { code: 'ALTA_RESPONSE_TOO_LARGE' });
+
+  const byBody = new AltaClient({
+    sessionStore: readyStore(),
+    maxResponseBytes: 32,
+    transport: async () => response(JSON.stringify([{ value: 'x'.repeat(40) }])),
+  });
+  await assert.rejects(byBody.getDevices(), { code: 'ALTA_RESPONSE_TOO_LARGE' });
+
+  for (const status of [302, 500]) {
+    const oversizedFailure = new AltaClient({
+      sessionStore: readyStore(),
+      maxResponseBytes: 32,
+      transport: async () => response('x'.repeat(33), {
+        status,
+        headers: status === 302 ? { location: '/api/v1/devices' } : {},
+      }),
+    });
+    await assert.rejects(oversizedFailure.getDevices(), { code: 'ALTA_RESPONSE_TOO_LARGE' });
+  }
+});
+
+test('rejects malformed response envelopes, JSON, status and endpoint data shapes', async () => {
+  const cases = [
+    [undefined, 'INVALID_ALTA_RESPONSE'],
+    [response('{broken'), 'INVALID_ALTA_RESPONSE_DATA'],
+    [response([], { status: 500 }), 'ALTA_HTTP_ERROR'],
+    [response({ not: 'an array' }), 'INVALID_ALTA_RESPONSE_DATA'],
+  ];
+  for (const [value, code] of cases) {
+    const client = new AltaClient({ sessionStore: readyStore(), transport: async () => value });
+    await assert.rejects(client.getDevices(), { code });
+  }
+
+  const authClient = new AltaClient({ sessionStore: readyStore(), transport: async () => response([]) });
+  await assert.rejects(authClient.getAuthInfo(), { code: 'INVALID_ALTA_RESPONSE_DATA' });
+});
+
+test('returns a fresh allowlisted error when transport throws an ALTA error with secret-bearing fields', async () => {
+  const source = Object.assign(new Error(`Alta request failed for va=${SENTINEL}`), {
+    code: 'ALTA_TRANSPORT_FAILURE',
+    status: 503,
+    timeout: true,
+    config: { headers: { Cookie: `va=${SENTINEL}` }, data: SENTINEL },
+    request: { headers: { Cookie: `va=${SENTINEL}` }, body: SENTINEL },
+    response: { status: 502, headers: { 'set-cookie': `va=${SENTINEL}` }, data: SENTINEL },
+    body: SENTINEL,
+  });
+  const client = new AltaClient({
+    sessionStore: readyStore(),
+    transport: async () => { throw source; },
+  });
+
+  const caught = await client.getDevices().catch((error) => error);
+  assert.notEqual(caught, source);
+  assert.equal(caught.code, 'ALTA_TRANSPORT_FAILURE');
+  assert.equal(caught.message, 'Alta request failed for va=[REDACTED]');
+  assert.equal(caught.status, 502);
+  assert.equal(caught.timeout, true);
+  assert.deepEqual(Object.keys(caught).sort(), ['code', 'status', 'timeout']);
+  for (const field of ['config', 'request', 'response', 'headers', 'data', 'body']) {
+    assert.equal(field in caught, false, field);
+  }
+  assert.doesNotMatch(JSON.stringify(caught), new RegExp(SENTINEL));
+});
+
+test('safely formats a transport error whose code getter throws a secret', async () => {
+  const source = new Error('Transport failed safely');
+  Object.defineProperty(source, 'code', {
+    enumerable: true,
+    get() { throw new Error(SENTINEL); },
+  });
+  source.config = { headers: { Cookie: `va=${SENTINEL}` } };
+  const client = new AltaClient({
+    sessionStore: readyStore(),
+    transport: async () => { throw source; },
+  });
+
+  const caught = await client.getDevices().catch((error) => error);
+  assert.notEqual(caught, source);
+  assert.equal(caught.code, 'ALTA_ERROR');
+  assert.equal(caught.message, 'Transport failed safely');
+  assert.equal(caught.status, null);
+  assert.equal(caught.timeout, false);
+  assert.deepEqual(Object.keys(caught).sort(), ['code', 'status', 'timeout']);
+  assert.equal('config' in caught, false);
+  assert.doesNotMatch(JSON.stringify(caught), new RegExp(SENTINEL));
+});
+
+test('revalidates the stored origin before each request', async () => {
+  const store = { requireSession: () => Object.freeze({ origin: 'https://evil.example', cookie: SENTINEL }) };
+  let called = false;
+  const client = new AltaClient({ sessionStore: store, transport: async () => { called = true; } });
+  await assert.rejects(client.getDevices(), { code: 'INVALID_ALTA_ORIGIN' });
+  assert.equal(called, false);
+});
diff --git a/test/bridge-auth.test.js b/test/bridge-auth.test.js
new file mode 100644
index 0000000..24b0e1c
--- /dev/null
+++ b/test/bridge-auth.test.js
@@ -0,0 +1,182 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { PassThrough, Readable } = require('node:stream');
+
+const {
+  BridgeAuth,
+  BridgeAuthError,
+  computeCookieProof,
+  computeServerProof,
+  generatePairingSecret,
+  readJsonBody,
+  createRequestLimiter
+} = require('../src/bridge-auth');
+
+const EXTENSION_ORIGIN = 'chrome-extension://onbkfpbggekakjddomjjnboippimlmch';
+const CLIENT_NONCE = Buffer.alloc(32, 1).toString('base64url');
+const protect = (plaintext) => Buffer.from(`protected:${plaintext}`, 'utf8');
+const unprotect = (ciphertext) => {
+  const value = Buffer.from(ciphertext).toString('utf8');
+  if (!value.startsWith('protected:')) throw new Error('bad ciphertext');
+  return value.slice('protected:'.length);
+};
+
+function createAuth(options = {}) {
+  return new BridgeAuth({ expectedOrigin: EXTENSION_ORIGIN, protect, unprotect, ...options });
+}
+
+test('pairing secrets are random and persisted only in a versioned protected envelope', () => {
+  const first = generatePairingSecret();
+  const second = generatePairingSecret();
+  assert.match(first, /^[A-Za-z0-9_-]{43}$/);
+  assert.notEqual(first, second);
+
+  const auth = createAuth();
+  const { secret, envelope } = auth.rotate();
+  assert.deepEqual(Object.keys(envelope).sort(), ['algorithm', 'ciphertext', 'digest', 'version']);
+  assert.equal(envelope.version, 2);
+  assert.equal(envelope.algorithm, 'electron-safe-storage');
+  assert.equal(JSON.stringify(envelope).includes(secret), false);
+  assert.equal(Buffer.from(envelope.ciphertext, 'base64').toString('utf8').includes(secret), true,
+    'test protector is intentionally transparent after decoding; disk JSON itself is never plaintext');
+});
+
+test('protected envelope restores server authentication without request-time scrypt', () => {
+  let protectCalls = 0;
+  let unprotectCalls = 0;
+  const first = new BridgeAuth({
+    protect(value) { protectCalls += 1; return protect(value); },
+    unprotect(value) { unprotectCalls += 1; return unprotect(value); }
+  });
+  const { secret, envelope } = first.rotate();
+  const restored = new BridgeAuth({
+    envelope: JSON.parse(JSON.stringify(envelope)),
+    protect,
+    unprotect(value) { unprotectCalls += 1; return unprotect(value); }
+  });
+  const challenge = restored.issueChallenge(CLIENT_NONCE);
+
+  assert.equal(protectCalls, 1);
+  assert.equal(unprotectCalls, 1);
+  assert.equal(challenge.serverProof, computeServerProof(secret, CLIENT_NONCE, challenge.serverNonce));
+  assert.equal(Object.hasOwn(challenge, 'secret'), false);
+});
+
+test('challenge proof and cookie proof are domain-separated, constant-time authenticated, and one-time', () => {
+  const auth = createAuth();
+  const secret = auth.rotate().secret;
+  const challenge = auth.issueChallenge(CLIENT_NONCE);
+  const cookieRequest = {
+    clientNonce: CLIENT_NONCE,
+    serverNonce: challenge.serverNonce,
+    deploymentUrl: 'https://customer.avasecurity.com',
+    cookieValue: 'synthetic-cookie'
+  };
+  cookieRequest.proof = computeCookieProof(secret, cookieRequest);
+
+  assert.notEqual(challenge.serverProof, cookieRequest.proof);
+  assert.equal(auth.authenticateCookie(cookieRequest), true);
+  assert.equal(auth.authenticateCookie(cookieRequest), false, 'challenge replay must fail');
+});
+
+test('challenge cache is bounded, expires entries, and rejects malformed nonces', () => {
+  let now = 100;
+  const auth = createAuth({ maxChallenges: 1, challengeTtlMs: 50, now: () => now });
+  auth.rotate();
+  auth.issueChallenge(CLIENT_NONCE);
+  assert.throws(() => auth.issueChallenge(Buffer.alloc(32, 2).toString('base64url')),
+    (error) => error.code === 'CHALLENGE_CAPACITY');
+  now = 151;
+  const replacement = auth.issueChallenge(Buffer.alloc(32, 2).toString('base64url'));
+  assert.match(replacement.serverNonce, /^[A-Za-z0-9_-]{43}$/);
+  assert.throws(() => auth.issueChallenge('short'), (error) => error.code === 'INVALID_NONCE');
+});
+
+test('expired and forged cookie proofs fail and consume the one-time challenge', () => {
+  let now = 100;
+  const auth = createAuth({ challengeTtlMs: 50, now: () => now });
+  const secret = auth.rotate().secret;
+  const expired = auth.issueChallenge(CLIENT_NONCE);
+  now = 151;
+  assert.equal(auth.authenticateCookie({
+    clientNonce: CLIENT_NONCE,
+    serverNonce: expired.serverNonce,
+    deploymentUrl: 'https://customer.avasecurity.com',
+    cookieValue: 'cookie',
+    proof: computeCookieProof(secret, {
+      clientNonce: CLIENT_NONCE,
+      serverNonce: expired.serverNonce,
+      deploymentUrl: 'https://customer.avasecurity.com',
+      cookieValue: 'cookie'
+    })
+  }), false);
+
+  now = 200;
+  const forged = auth.issueChallenge(CLIENT_NONCE);
+  const request = {
+    clientNonce: CLIENT_NONCE,
+    serverNonce: forged.serverNonce,
+    deploymentUrl: 'https://customer.avasecurity.com',
+    cookieValue: 'cookie',
+    proof: 'A'.repeat(43)
+  };
+  assert.equal(auth.authenticateCookie(request), false);
+  request.proof = computeCookieProof(secret, request);
+  assert.equal(auth.authenticateCookie(request), false, 'forged attempt consumes challenge');
+});
+
+test('rotation clears outstanding challenges and revoke disables challenge issuance', () => {
+  const auth = createAuth();
+  auth.rotate();
+  const prior = auth.issueChallenge(CLIENT_NONCE);
+  auth.rotate();
+  assert.equal(auth.authenticateCookie({
+    clientNonce: CLIENT_NONCE,
+    serverNonce: prior.serverNonce,
+    deploymentUrl: 'https://customer.avasecurity.com',
+    cookieValue: 'cookie',
+    proof: 'A'.repeat(43)
+  }), false);
+  auth.revoke();
+  assert.throws(() => auth.issueChallenge(CLIENT_NONCE), (error) => error.code === 'PAIRING_UNAVAILABLE');
+  assert.equal(auth.envelope, null);
+});
+
+test('invalid origin and protected-envelope dependencies fail closed', () => {
+  assert.throws(() => new BridgeAuth({ expectedOrigin: 'https://example.test', protect, unprotect }),
+    (error) => error instanceof BridgeAuthError && error.code === 'INVALID_EXTENSION_ORIGIN');
+  assert.throws(() => new BridgeAuth({ expectedOrigin: 'chrome-extension://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', protect, unprotect }),
+    (error) => error instanceof BridgeAuthError && error.code === 'INVALID_EXTENSION_ORIGIN');
+  assert.throws(() => new BridgeAuth(), (error) => error.code === 'SECURE_STORAGE_UNAVAILABLE');
+  assert.throws(() => new BridgeAuth({ protect, unprotect, envelope: { version: 1, algorithm: 'scrypt' } }),
+    (error) => error.code === 'INVALID_SECRET_ENVELOPE');
+});
+
+test('readJsonBody accepts a bounded JSON object and rejects malformed or oversized input', async () => {
+  assert.deepEqual(await readJsonBody(Readable.from(['{"ok":true}']), { maxBytes: 64 }), { ok: true });
+  await assert.rejects(readJsonBody(Readable.from(['{"nope"']), { maxBytes: 64 }), (error) => error.code === 'MALFORMED_JSON');
+  await assert.rejects(readJsonBody(Readable.from(['{"value":"', 'x'.repeat(100), '"}']), { maxBytes: 32 }),
+    (error) => error.code === 'BODY_TOO_LARGE');
+  await assert.rejects(readJsonBody(Readable.from(['[]']), { maxBytes: 64 }), (error) => error.code === 'INVALID_JSON_BODY');
+});
+
+test('readJsonBody aborts a slow body at its absolute deadline', async () => {
+  const stream = new PassThrough();
+  const pending = readJsonBody(stream, { maxBytes: 64, deadlineMs: 15 });
+  stream.write('{');
+  await assert.rejects(pending, (error) => error.code === 'BODY_DEADLINE_EXCEEDED');
+});
+
+test('request limiter rejects excess concurrent work before it begins', async () => {
+  const limiter = createRequestLimiter({ maxConcurrent: 1 });
+  let release;
+  const active = limiter.run(() => new Promise((resolve) => { release = resolve; }));
+  let entered = false;
+  await assert.rejects(limiter.run(async () => { entered = true; }), (error) => error.code === 'TOO_MANY_REQUESTS');
+  assert.equal(entered, false);
+  release('done');
+  assert.equal(await active, 'done');
+  assert.equal(limiter.active, 0);
+});
diff --git a/test/build-contract.test.js b/test/build-contract.test.js
new file mode 100644
index 0000000..46a7a47
--- /dev/null
+++ b/test/build-contract.test.js
@@ -0,0 +1,99 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const ROOT = path.join(__dirname, '..');
+const read = (name) => fs.readFileSync(path.join(ROOT, name), 'utf8');
+const readJson = (name) => JSON.parse(read(name));
+
+function writeKit(root, { version = '1.2.5', legacy = false } = {}) {
+  const extension = path.join(root, 'chrome-extension');
+  fs.mkdirSync(extension, { recursive: true });
+  fs.writeFileSync(path.join(root, 'AltaCameraProxy.exe'), 'synthetic executable');
+  fs.writeFileSync(path.join(root, 'aware-cam-proxy.exe'), 'synthetic helper');
+  for (const name of ['popup.html', 'popup.js', 'popup.css', 'options.html', 'options.js', 'options.css']) {
+    fs.writeFileSync(path.join(extension, name), legacy && name === 'popup.js' ? 'apt-local-bridge-token' : `'use strict';`);
+  }
+  fs.writeFileSync(path.join(extension, 'manifest.json'), JSON.stringify({
+    manifest_version: 3,
+    name: 'Alta Proxy Tool Bridge',
+    version,
+  }));
+}
+
+test('application and extension versions and supported dependencies stay coordinated', () => {
+  const pkg = readJson('package.json');
+  const lock = readJson('package-lock.json');
+  const manifest = readJson('chrome-extension/manifest.json');
+
+  assert.equal(pkg.version, '1.2.5');
+  assert.equal(manifest.version, pkg.version);
+  assert.equal(lock.version, pkg.version);
+  assert.equal(lock.packages[''].version, pkg.version);
+  assert.deepEqual(pkg.dependencies, { axios: '1.19.0' });
+  assert.deepEqual(pkg.devDependencies, {
+    electron: '43.4.1',
+    'electron-builder': '26.15.3',
+  });
+  for (const removed of ['crypto-js', 'electron-packager']) {
+    assert.equal(pkg.dependencies?.[removed], undefined);
+    assert.equal(pkg.devDependencies?.[removed], undefined);
+  }
+});
+
+test('build remains Windows portable without misleading signing overrides', () => {
+  const pkg = readJson('package.json');
+  assert.equal(pkg.build.win.target, 'portable');
+  assert.equal(pkg.build.portable.artifactName, 'AltaCameraProxy-${version}-portable.exe');
+  assert.equal(Object.hasOwn(pkg.build.win, 'signAndEditExecutable'), false);
+  assert.equal(Object.hasOwn(pkg.build, 'forceCodeSigning'), false);
+  assert.equal(pkg.scripts['audit:prod'], 'npm audit --omit=dev --audit-level=low');
+  assert.match(pkg.scripts.check, /verify-kit/);
+});
+
+test('GitPeji CI targets the live runner and is build-only on Node 22', () => {
+  const workflow = read('.gitea/workflows/ci.yml');
+  assert.match(workflow, /runs-on:\s*apt-ci/);
+  assert.doesNotMatch(workflow, /^\s*runs-on:\s*ubuntu-latest\s*$/m);
+  assert.match(workflow, /actions\/checkout@v4/);
+  assert.match(workflow, /actions\/setup-node@v4/);
+  assert.match(workflow, /node-version:\s*['"]?22['"]?/);
+  for (const command of ['npm ci', 'npm run check', 'npm run audit:prod', 'npm run build-test']) {
+    assert.ok(workflow.includes(command), `missing CI command: ${command}`);
+  }
+  assert.match(workflow, /verify-kit\.js\s+--build\s+dist\/win-unpacked/);
+  assert.doesNotMatch(workflow, /npm\s+(?:publish|run\s+(?:release|deploy))|actions\/(?:upload-release|deploy)|git\s+push/i);
+  assert.doesNotMatch(workflow, /secrets\./);
+});
+
+test('kit verifier accepts a complete synthetic kit and rejects version drift and legacy strings', () => {
+  const valid = fs.mkdtempSync(path.join(os.tmpdir(), 'apt-kit-valid-'));
+  writeKit(valid);
+  const accepted = spawnSync(process.execPath, ['scripts/verify-kit.js', valid], { cwd: ROOT, encoding: 'utf8' });
+  assert.equal(accepted.status, 0, accepted.stderr || accepted.stdout);
+
+  const drifted = fs.mkdtempSync(path.join(os.tmpdir(), 'apt-kit-drift-'));
+  writeKit(drifted, { version: '1.0.0' });
+  const rejectedDrift = spawnSync(process.execPath, ['scripts/verify-kit.js', drifted], { cwd: ROOT, encoding: 'utf8' });
+  assert.notEqual(rejectedDrift.status, 0);
+  assert.match(rejectedDrift.stderr, /version/i);
+
+  const legacy = fs.mkdtempSync(path.join(os.tmpdir(), 'apt-kit-legacy-'));
+  writeKit(legacy, { legacy: true });
+  const rejectedLegacy = spawnSync(process.execPath, ['scripts/verify-kit.js', legacy], { cwd: ROOT, encoding: 'utf8' });
+  assert.notEqual(rejectedLegacy.status, 0);
+  assert.match(rejectedLegacy.stderr, /forbidden/i);
+});
+
+test('kit verifier rejects unsafe relative archive paths', () => {
+  const { normalizeRelative } = require('../scripts/verify-kit');
+  for (const unsafe of ['../escape', 'folder/../../escape', '/absolute', 'C:\\absolute']) {
+    assert.throws(() => normalizeRelative(unsafe), /unsafe/i);
+  }
+  assert.equal(normalizeRelative('chrome-extension\\manifest.json'), 'chrome-extension/manifest.json');
+});
diff --git a/test/device-projection.test.js b/test/device-projection.test.js
new file mode 100644
index 0000000..64abe1a
--- /dev/null
+++ b/test/device-projection.test.js
@@ -0,0 +1,155 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const {
+  MAX_PROJECTED_PAYLOAD_BYTES,
+  projectDeviceHierarchy,
+} = require('../src/device-projection');
+const { buildDeviceTree } = require('../device-tree');
+
+function uuid(index) {
+  return `00000000-0000-4000-8000-${index.toString(16).padStart(12, '0')}`;
+}
+
+function rawDevice(index, overrides = {}) {
+  return {
+    guid: uuid(index),
+    name: `Camera ${index}`,
+    type: 'camera',
+    model: 'Synthetic',
+    address: `10.0.${Math.floor(index / 255)}.${index % 255}`,
+    server_group_id: 'server-group-1',
+    device_group_id: 'group-1',
+    capabilities: { localStorage: index % 2 === 0, secretCapability: 'drop-me' },
+    live: { display_status: 'online', private: 'drop-me' },
+    cookie: 'must-not-cross-ipc',
+    ...overrides,
+  };
+}
+
+test('projects only allowlisted fields and honestly diagnoses ineligible devices', () => {
+  const payload = projectDeviceHierarchy({
+    devices: [
+      rawDevice(1),
+      rawDevice(2, { guid: 'not-a-uuid' }),
+      rawDevice(4),
+    ],
+    sites: [{ id: 'site-1', name: 'HQ', pending_deletion_start: null, secret: 'drop-me' }],
+    groups: [{ id: 'group-1', name: 'Lobby', parent_id: null, pending_deletion_start: null, secret: 'drop-me' }],
+  });
+
+  assert.deepEqual(payload.devices, [{
+    id: uuid(1), name: 'Camera 1', type: 'camera', model: 'Synthetic', address: '10.0.0.1',
+    siteId: null, deviceGroupId: 'group-1', displayStatus: 'online', localStorage: false,
+  }]);
+  assert.deepEqual(payload.sites, [{ id: 'site-1', name: 'HQ', pendingDeletionStart: null }]);
+  assert.deepEqual(payload.groups, [{ id: 'group-1', name: 'Lobby', parentId: null, pendingDeletionStart: null }]);
+  assert.deepEqual(payload.diagnostics.devices, {
+    received: 3, eligible: 1, invalid: 1, cloudNativeExcluded: 1,
+  });
+  assert.doesNotMatch(JSON.stringify(payload), /drop-me|cookie|secretCapability|private/);
+});
+
+test('infers camera sites from device-group parents instead of server groups', () => {
+  const payload = projectDeviceHierarchy({
+    devices: [rawDevice(3, {
+      name: 'Front Door',
+      server_group_id: 'cloud-connector-server-group',
+      device_group_id: 'entrances',
+    })],
+    sites: [{ id: 'test-site', name: 'Test Site' }],
+    groups: [{ id: 'entrances', name: 'Entrances', parent_id: 'test-site' }],
+  });
+  const model = buildDeviceTree(payload);
+  const camera = [...model.cameraByKey.values()][0];
+
+  assert.equal(payload.devices[0].siteId, null);
+  assert.equal(camera.site.canonicalId, 'test-site');
+  assert.equal(camera.group.canonicalId, 'entrances');
+  assert.equal(camera.hierarchyStatus, 'inferred-site');
+  assert.deepEqual(model.diagnostics, []);
+});
+
+test('excludes cloud-native cameras while retaining Cloud Connector and unknown-storage devices', () => {
+  const payload = projectDeviceHierarchy({
+    devices: [
+      rawDevice(10, { name: 'Cloud Native', capabilities: { localStorage: true } }),
+      rawDevice(11, { name: 'Cloud Connector', capabilities: { localStorage: false } }),
+      rawDevice(12, { name: 'Unknown Storage', capabilities: {} }),
+    ],
+  });
+
+  assert.deepEqual(payload.devices.map((device) => device.name), ['Cloud Connector', 'Unknown Storage']);
+  assert.deepEqual(payload.diagnostics.devices, {
+    received: 3, eligible: 2, invalid: 0, cloudNativeExcluded: 1,
+  });
+});
+
+test('projects synthetic 1,500 and 10,000 camera deployments below the 8 MiB IPC cap', () => {
+  for (const count of [1_500, 10_000]) {
+    const payload = projectDeviceHierarchy({
+      devices: Array.from({ length: count }, (_, index) => rawDevice(index, {
+        capabilities: { localStorage: false },
+      })),
+      sites: [],
+      groups: [],
+    });
+    assert.equal(payload.devices.length, count);
+    assert.equal(payload.diagnostics.devices.received, count);
+    assert.ok(Buffer.byteLength(JSON.stringify(payload)) <= MAX_PROJECTED_PAYLOAD_BYTES);
+  }
+});
+
+test('malformed hierarchy metadata does not hide valid cameras', () => {
+  const payload = projectDeviceHierarchy({
+    devices: [rawDevice(7)],
+    sites: [null, { id: {}, name: 'bad' }],
+    groups: ['bad'],
+    metadataErrors: { sites: 'Unavailable', groups: 'Unavailable' },
+  });
+  assert.equal(payload.devices.length, 1);
+  assert.deepEqual(payload.sites, []);
+  assert.deepEqual(payload.groups, []);
+  assert.equal(payload.diagnostics.sites.invalid, 2);
+  assert.equal(payload.diagnostics.groups.invalid, 1);
+  assert.equal(payload.diagnostics.sites.error, 'Unavailable');
+});
+
+test('repairs lone UTF-16 surrogates without changing valid Unicode or hiding cameras', () => {
+  const payload = projectDeviceHierarchy({
+    devices: [rawDevice(8, {
+      name: 'Front \ud800 camera',
+      model: 'Model \udc00',
+      address: 'Hall \ud800\udc00 / \udc00',
+      server_group_id: 'site-\ud800',
+      device_group_id: 'group-\udc00',
+      capabilities: { localStorage: false },
+    })],
+    sites: [{ id: 'site-\ud800', name: 'Valid \ud83d\udcf7 \udc00', pending_deletion_start: '\ud800' }],
+    groups: [{ id: 'group-\udc00', name: 'Group \ud83d\udcf7 \ud800', parent_id: 'site-\ud800' }],
+    metadataErrors: { sites: 'warning \ud800', groups: 'warning \udc00' },
+  });
+
+  assert.equal(payload.devices.length, 1);
+  assert.equal(payload.devices[0].name, 'Front \ufffd camera');
+  assert.equal(payload.devices[0].model, 'Model \ufffd');
+  assert.equal(payload.devices[0].address, 'Hall \ud800\udc00 / \ufffd');
+  assert.equal(payload.devices[0].siteId, null);
+  assert.equal(payload.devices[0].deviceGroupId, 'group-\ufffd');
+  assert.deepEqual(payload.sites, [{ id: 'site-\ufffd', name: 'Valid \ud83d\udcf7 \ufffd', pendingDeletionStart: '\ufffd' }]);
+  assert.deepEqual(payload.groups, [{ id: 'group-\ufffd', name: 'Group \ud83d\udcf7 \ufffd', parentId: 'site-\ufffd', pendingDeletionStart: null }]);
+  assert.equal(payload.diagnostics.sites.error, 'warning \ufffd');
+  assert.doesNotMatch(JSON.stringify(payload), /[\ud800-\udfff]/u);
+});
+
+test('rejects a projected hierarchy payload above 8 MiB', () => {
+  const devices = Array.from({ length: 10_000 }, (_, index) => rawDevice(index, {
+    name: `Camera ${index} ${'x'.repeat(900)}`,
+    capabilities: { localStorage: false },
+  }));
+  assert.throws(
+    () => projectDeviceHierarchy({ devices, sites: [], groups: [] }),
+    { code: 'PROJECTED_PAYLOAD_TOO_LARGE' },
+  );
+});
diff --git a/test/device-tree.test.js b/test/device-tree.test.js
new file mode 100644
index 0000000..0920080
--- /dev/null
+++ b/test/device-tree.test.js
@@ -0,0 +1,235 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const {
+  buildDeviceTree,
+  flattenVisibleRows,
+  createSearchRunner,
+  calculateVirtualWindow,
+} = require('../device-tree');
+
+function baseFixture() {
+  return {
+    sites: [
+      { id: 's2', name: 'Zulu' },
+      { id: 's1', name: 'Alpha', pendingDeletionStart: '2026-08-19T12:00:00Z' },
+    ],
+    groups: [
+      { id: 'g2', name: 'Doors', parentId: 's2' },
+      { id: 'g1', name: 'Lobby', parentId: 's1', pendingDeletionStart: '2026-08-19T12:00:00Z' },
+    ],
+    devices: [
+      { id: 'c4', name: 'No Group', siteId: 's1', type: 'camera' },
+      { id: 'c2', name: 'Inferred', deviceGroupId: 'g2', model: 'H5A' },
+      { id: 'c1', name: 'Front', siteId: 's1', deviceGroupId: 'g1', address: '10.0.0.1' },
+      { id: 'c3', name: 'Conflict', siteId: 's1', deviceGroupId: 'g2' },
+      { id: 'c5', name: 'Unknown Group', siteId: 's1', deviceGroupId: 'missing-g' },
+      { id: 'c6', name: 'Unknown Site', siteId: 'missing-s' },
+      { id: 'c7', name: 'Orphan' },
+    ],
+  };
+}
+
+test('builds deterministic hierarchy with explicit exceptional buckets and diagnostics', () => {
+  const model = buildDeviceTree(baseFixture());
+  const camera = (id) => [...model.cameraByKey.values()].find((entry) => entry.canonicalId === id);
+  assert.deepEqual(model.sites.map((site) => site.name), ['Alpha', 'Orphaned cameras', 'Unknown site: missing-s', 'Zulu']);
+  assert.equal(model.sites[0].pendingDeletion, true);
+  assert.deepEqual(model.sites[0].groups.map((group) => group.name), ['Doors', 'Lobby', 'Ungrouped', 'Unknown group: missing-g']);
+  assert.equal(model.sites[0].groups.find((group) => group.id === 'g1').pendingDeletion, true);
+  assert.deepEqual(model.sites[3].groups[0].cameras.map((camera) => camera.name), ['Inferred']);
+
+  const conflict = camera('c3');
+  assert.equal(conflict.site.id, 's1');
+  assert.equal(conflict.group.name, 'Doors');
+  assert.equal(conflict.hierarchyStatus, 'conflict');
+  assert.equal(camera('c2').hierarchyStatus, 'inferred-site');
+  assert.ok(model.diagnostics.some((entry) => entry.code === 'site-group-conflict' && entry.key === conflict.key));
+});
+
+test('duplicate and malformed IDs get stable unique keys and diagnostics', () => {
+  const fixture = {
+    sites: [{ id: 's', name: 'A' }, { id: 's', name: 'B' }, { name: 'Bad' }],
+    groups: [{ id: 'g', name: 'G', parentId: 's' }, { id: 'g', name: 'G2', parentId: 's' }],
+    devices: [
+      { id: 'c', name: 'Same', siteId: 's', deviceGroupId: 'g' },
+      { id: 'c', name: 'Same', siteId: 's', deviceGroupId: 'g' },
+      { name: 'Missing', siteId: 's' },
+    ],
+  };
+  const first = buildDeviceTree(fixture);
+  const second = buildDeviceTree(fixture);
+  assert.deepEqual([...first.rowByKey.keys()], [...second.rowByKey.keys()]);
+  assert.equal(new Set(first.rowByKey.keys()).size, first.rowByKey.size);
+  assert.ok(first.diagnostics.filter((entry) => entry.code === 'duplicate-id').length >= 3);
+  assert.ok(first.diagnostics.filter((entry) => entry.code === 'malformed-id').length >= 2);
+});
+
+test('sites start collapsed; expansion produces levels and complete ARIA metadata', () => {
+  const model = buildDeviceTree(baseFixture());
+  const site = model.sites.find((entry) => entry.canonicalId === 's1' && !entry.synthetic);
+  const group = site.groups.find((entry) => entry.canonicalId === 'g1' && !entry.synthetic);
+  const selected = [...model.cameraByKey.values()].find((entry) => entry.canonicalId === 'c1');
+  let rows = flattenVisibleRows(model, { expandedKeys: new Set(), selectedKey: selected.key });
+  assert.equal(rows.length, 4);
+  assert.ok(rows.every((row) => row.kind === 'site' && row.aria.level === 1 && row.aria.expanded === false));
+  assert.ok(rows.every((row) => row.aria.setsize === 4));
+  assert.equal(rows.hiddenSelected, true);
+
+  rows = flattenVisibleRows(model, { expandedKeys: new Set([site.key]) });
+  assert.deepEqual(rows.slice(0, 5).map((row) => row.kind), ['site', 'group', 'group', 'group', 'group']);
+  assert.ok(rows.slice(1, 5).every((row) => row.aria.level === 2 && row.aria.expanded === false));
+
+  rows = flattenVisibleRows(model, {
+    expandedKeys: new Set([site.key, group.key]),
+    selectedKey: selected.key,
+  });
+  const camera = rows.find((row) => row.key === selected.key);
+  assert.equal(camera.parentKey, group.key);
+  assert.deepEqual(camera.aria, { level: 3, expanded: undefined, selected: true, posinset: 1, setsize: 1 });
+  assert.equal(rows.hiddenSelected, false);
+});
+
+test('search covers camera fields and ancestors without mutating saved expansion', async () => {
+  const model = buildDeviceTree(baseFixture());
+  const site = (id) => model.sites.find((entry) => entry.canonicalId === id && !entry.synthetic);
+  const camera = (id) => [...model.cameraByKey.values()].find((entry) => entry.canonicalId === id);
+  const scheduled = [];
+  const runner = createSearchRunner({ scheduler: (work) => scheduled.push(work), chunkSize: 2 });
+  const saved = new Set([site('s2').key]);
+  const promise = runner.search(model, 'alpha lobby 10.0.0.1', { expandedKeys: saved });
+  while (scheduled.length) scheduled.shift()();
+  const result = await promise;
+  assert.equal(result.count, 1);
+  assert.deepEqual([...result.cameraKeys], [camera('c1').key]);
+  assert.ok(result.expandedKeys.has(site('s1').key));
+  assert.ok(result.expandedKeys.has(camera('c1').group.key));
+  assert.deepEqual([...saved], [site('s2').key]);
+
+  const ancestorPromise = runner.search(model, 'zulu', { expandedKeys: new Set() });
+  while (scheduled.length) scheduled.shift()();
+  const ancestor = await ancestorPromise;
+  assert.deepEqual([...ancestor.cameraKeys], [camera('c2').key]);
+});
+
+test('new search cancels stale chunked generation', async () => {
+  const model = buildDeviceTree({
+    sites: [{ id: 's', name: 'Site' }],
+    groups: [],
+    devices: Array.from({ length: 700 }, (_, i) => ({ id: `c${i}`, name: `Camera ${i}`, siteId: 's' })),
+  });
+  const scheduled = [];
+  const runner = createSearchRunner({ scheduler: (work) => scheduled.push(work), chunkSize: 250 });
+  const stale = runner.search(model, 'camera', {});
+  scheduled.shift()();
+  const current = runner.search(model, 'camera 699', {});
+  while (scheduled.length) scheduled.shift()();
+  const [staleResult, currentResult] = await Promise.all([stale, current]);
+  assert.equal(staleResult.cancelled, true);
+  assert.equal(currentResult.cancelled, false);
+  assert.equal(currentResult.count, 1);
+});
+
+test('virtual window remains structurally bounded for 5,000 expanded shuffled cameras', () => {
+  const devices = Array.from({ length: 5000 }, (_, i) => ({ id: `id-${i}`, name: `Camera ${String(i).padStart(4, '0')}`, siteId: 's' }));
+  for (let i = devices.length - 1; i > 0; i -= 1) {
+    const j = (i * 48271) % (i + 1);
+    [devices[i], devices[j]] = [devices[j], devices[i]];
+  }
+  const model = buildDeviceTree({ sites: [{ id: 's', name: 'Large' }], groups: [], devices });
+  const rows = flattenVisibleRows(model, {
+    expandedKeys: new Set([model.sites[0].key, model.sites[0].groups[0].key]),
+  });
+  const window = calculateVirtualWindow(rows, { scrollTop: 50000, viewportHeight: 320, rowHeight: 28 });
+  assert.ok(window.rows.length >= 40 && window.rows.length <= 50, `mounted ${window.rows.length}`);
+  assert.equal(window.totalHeight, rows.length * 28);
+  assert.equal(window.offsetTop, window.startIndex * 28);
+});
+
+test('1,500-site/group fixture has deterministic stable ordering', () => {
+  const sites = Array.from({ length: 1500 }, (_, i) => ({ id: `s-${i}`, name: `Site ${i % 17}` }));
+  const groups = sites.map((site, i) => ({ id: `g-${i}`, name: `Group ${i % 11}`, parentId: site.id }));
+  const model = buildDeviceTree({ sites: sites.reverse(), groups: groups.reverse(), devices: [] });
+  const namesAndIds = model.sites.map((site) => `${site.normalizedName}|${site.id}`);
+  assert.deepEqual(namesAndIds, [...namesAndIds].sort((a, b) => a.localeCompare(b)));
+});
+
+test('tenant and synthetic namespaces stay distinct for reserved and ambiguous IDs', () => {
+  const model = buildDeviceTree({
+    sites: [
+      { id: '__orphaned__', name: 'Tenant Reserved Site' },
+      { id: '__unknown_site__:missing', name: 'Tenant Unknown-shaped Site' },
+      { id: 'a', name: 'A' },
+      { id: 'a:b', name: 'A colon B' },
+      { id: 'percent%:site', name: 'Percent Site' },
+    ],
+    groups: [
+      { id: '__ungrouped__', name: 'Tenant Reserved Group', parentId: '__orphaned__' },
+      { id: 'b:c', name: 'Tuple One', parentId: 'a' },
+      { id: 'c', name: 'Tuple Two', parentId: 'a:b' },
+      { id: 'g:%', name: 'Escaped Group', parentId: 'percent%:site' },
+    ],
+    devices: [
+      { id: 'tenant-group', siteId: '__orphaned__', deviceGroupId: '__ungrouped__' },
+      { id: 'synthetic-group', siteId: '__orphaned__' },
+      { id: 'orphan' },
+      { id: 'unknown-site', siteId: 'missing' },
+      { id: 'tuple-one', siteId: 'a', deviceGroupId: 'b:c' },
+      { id: 'tuple-two', siteId: 'a:b', deviceGroupId: 'c' },
+      { id: 'escaped', siteId: 'percent%:site', deviceGroupId: 'g:%' },
+    ],
+  });
+
+  const tenantReserved = model.sites.find((site) => !site.synthetic && site.id === '__orphaned__');
+  const orphanBucket = model.sites.find((site) => site.synthetic && site.hierarchyStatus === 'orphan');
+  const unknownBucket = model.sites.find((site) => site.synthetic && site.hierarchyStatus === 'unknown-site');
+  assert.ok(tenantReserved && orphanBucket && unknownBucket);
+  assert.notEqual(tenantReserved.key, orphanBucket.key);
+  const camera = (id) => [...model.cameraByKey.values()].find((entry) => entry.canonicalId === id);
+  assert.notEqual(camera('tenant-group').group.key, camera('synthetic-group').group.key);
+  assert.notEqual(camera('tuple-one').group.key, camera('tuple-two').group.key);
+  assert.equal(model.rowByKey.size, model.sites.length +
+    model.sites.reduce((count, site) => count + site.groups.length, 0) + model.cameraCount);
+  assert.ok([...model.rowByKey.keys()].every((key) => !/\s/.test(key)));
+});
+
+test('malformed Unicode metadata builds deterministically and remains searchable and visible', async () => {
+  const fixture = {
+    sites: [{ id: 'site-\ud800', name: 'Site \ud83d\udcf7 \udc00' }],
+    groups: [{ id: 'group-\udc00', name: 'Group \ud83d\udcf7 \ud800', parentId: 'site-\ud800' }],
+    devices: [{
+      id: 'camera-valid', name: 'Lobby \ud800 camera', siteId: 'site-\ud800',
+      deviceGroupId: 'group-\udc00', address: 'Floor \udc00',
+    }],
+  };
+
+  const first = buildDeviceTree(fixture);
+  const second = buildDeviceTree(fixture);
+  assert.equal(first.cameraCount, 1);
+  assert.deepEqual([...first.rowByKey.keys()], [...second.rowByKey.keys()]);
+  assert.doesNotMatch([...first.rowByKey.keys()].join(''), /[\ud800-\udfff]/u);
+  const camera = [...first.cameraByKey.values()][0];
+  assert.equal(camera.name, 'Lobby \ufffd camera');
+  assert.equal(camera.site.name, 'Site \ud83d\udcf7 \ufffd');
+  assert.equal(camera.group.name, 'Group \ud83d\udcf7 \ufffd');
+  assert.equal(camera.source.address, 'Floor \ufffd');
+  assert.doesNotMatch(JSON.stringify(camera.source), /[\ud800-\udfff]/u);
+  assert.match(camera.searchCorpus, /floor \ufffd/);
+
+  const result = await createSearchRunner().search(first, 'lobby \ufffd');
+  assert.deepEqual([...result.cameraKeys], [camera.key]);
+});
+
+test('virtual window clamps an obsolete scroll offset after rows shrink', () => {
+  const rows = [{ key: 'only-row' }];
+  const window = calculateVirtualWindow(rows, {
+    scrollTop: 10000,
+    viewportHeight: 320,
+    rowHeight: 28,
+    overscan: 0,
+  });
+  assert.deepEqual(window.rows, rows);
+  assert.equal(window.startIndex, 0);
+  assert.equal(window.endIndex, 1);
+});
diff --git a/test/error-redaction.test.js b/test/error-redaction.test.js
new file mode 100644
index 0000000..bcedd6e
--- /dev/null
+++ b/test/error-redaction.test.js
@@ -0,0 +1,109 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const {
+  formatAltaError,
+  sanitizeErrorMessage,
+} = require('../src/error-redaction');
+
+const SENTINEL = 'HERMES_SENTINEL_SECRET';
+
+function assertNoSecret(value) {
+  const serialized = JSON.stringify(value);
+  assert.equal(serialized.includes(SENTINEL), false, serialized);
+  assert.equal(serialized.includes('Cookie'), false, serialized);
+  assert.equal(serialized.includes('Authorization'), false, serialized);
+}
+
+test('formats only an allowlist of bounded safe fields', () => {
+  const error = new Error('request failed safely');
+  error.code = 'ECONNRESET';
+  error.timeout = false;
+  error.response = { status: 502 };
+
+  const formatted = formatAltaError('getDevices', error, { secrets: [SENTINEL] });
+  assert.deepEqual(formatted, {
+    operation: 'getDevices',
+    code: 'ECONNRESET',
+    status: 502,
+    timeout: false,
+    message: 'request failed safely',
+  });
+  assert.deepEqual(Object.keys(formatted), ['operation', 'code', 'status', 'timeout', 'message']);
+});
+
+test('never serializes Axios config, request, headers, URL, body, cause or response data', () => {
+  const error = new Error(`failed with va=${SENTINEL}`);
+  error.code = 'ERR_BAD_RESPONSE';
+  error.config = {
+    url: `https://evil.example/?token=${SENTINEL}`,
+    headers: { Cookie: `va=${SENTINEL}`, Authorization: `Bearer ${SENTINEL}` },
+    data: { token: SENTINEL },
+  };
+  error.request = { rawHeaders: `Cookie: va=${SENTINEL}` };
+  error.response = {
+    status: 401,
+    headers: { 'set-cookie': `va=${SENTINEL}` },
+    data: { message: SENTINEL, nested: { secret: SENTINEL } },
+  };
+  error.cause = { message: SENTINEL, headers: { Cookie: SENTINEL } };
+
+  const formatted = formatAltaError('getDevices', error, { secrets: [SENTINEL] });
+  assertNoSecret(formatted);
+  assert.deepEqual(Object.keys(formatted), ['operation', 'code', 'status', 'timeout', 'message']);
+  assert.equal(formatted.message, 'failed with va=[REDACTED]');
+});
+
+test('redacts cookie and bearer patterns without needing the exact secret', () => {
+  for (const message of [
+    `Cookie: va=${SENTINEL}; other=value`,
+    `va=${SENTINEL}`,
+    `Authorization: Bearer ${SENTINEL}`,
+    `Bearer ${SENTINEL}`,
+  ]) {
+    const clean = sanitizeErrorMessage(message);
+    assertNoSecret({ message: clean });
+  }
+});
+
+test('bounds and sanitizes operation, code, status and message', () => {
+  const error = {
+    message: `line one\r\nCookie: va=${SENTINEL} ${'x'.repeat(1000)}`,
+    code: 'BAD CODE WITH SPACES AND SECRET_' + SENTINEL,
+    response: { status: 9999 },
+  };
+  const formatted = formatAltaError(`unsafe operation ${SENTINEL}`, error, { secrets: [SENTINEL] });
+
+  assertNoSecret(formatted);
+  assert.ok(formatted.operation.length <= 64);
+  assert.equal(formatted.code, 'ALTA_ERROR');
+  assert.equal(formatted.status, null);
+  assert.ok(formatted.message.length <= 240);
+  assert.equal(/[\r\n]/.test(formatted.message), false);
+});
+
+test('handles hostile accessors, cycles and non-error values without leaking or throwing', () => {
+  const hostile = {};
+  Object.defineProperty(hostile, 'message', { get() { throw new Error(SENTINEL); } });
+  Object.defineProperty(hostile, 'code', { get() { throw new Error(SENTINEL); } });
+  hostile.self = hostile;
+
+  const formatted = formatAltaError('request', hostile, { secrets: [SENTINEL] });
+  assertNoSecret(formatted);
+  assert.equal(formatted.message, 'Alta request failed');
+  assert.equal(formatted.code, 'ALTA_ERROR');
+
+  assertNoSecret(formatAltaError('request', SENTINEL, { secrets: [SENTINEL] }));
+  assertNoSecret(formatAltaError('request', null, { secrets: [SENTINEL] }));
+});
+
+test('does not leak a supplied secret through valid-looking operation or code fields', () => {
+  const formatted = formatAltaError(SENTINEL, {
+    code: SENTINEL,
+    message: 'failed',
+  }, { secrets: [SENTINEL] });
+  assertNoSecret(formatted);
+  assert.equal(formatted.operation, 'altaRequest');
+  assert.equal(formatted.code, 'ALTA_ERROR');
+});
diff --git a/test/extension-contract.test.js b/test/extension-contract.test.js
new file mode 100644
index 0000000..b42e7e7
--- /dev/null
+++ b/test/extension-contract.test.js
@@ -0,0 +1,210 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { APT_EXTENSION_ID, APT_EXTENSION_ORIGIN } = require('../src/bridge-auth');
+
+const ROOT = path.join(__dirname, '..');
+const EXTENSION = path.join(ROOT, 'chrome-extension');
+const OLD_TOKEN = 'apt-local-' + 'bridge-token';
+const EXPECTED_ID = 'onbkfpbggekakjddomjjnboippimlmch';
+
+function read(name) {
+  return fs.readFileSync(path.join(EXTENSION, name), 'utf8');
+}
+
+function extensionIdFromKey(key) {
+  const digest = crypto.createHash('sha256').update(Buffer.from(key, 'base64')).digest().subarray(0, 16);
+  return [...digest].map((byte) =>
+    String.fromCharCode(97 + (byte >> 4), 97 + (byte & 0x0f))
+  ).join('');
+}
+
+function makeElement() {
+  const listeners = {};
+  return {
+    textContent: '',
+    className: '',
+    disabled: false,
+    hidden: false,
+    checked: false,
+    value: '',
+    addEventListener(type, listener) { listeners[type] = listener; },
+    async dispatch(type) { return listeners[type]?.({ preventDefault() {} }); }
+  };
+}
+
+function makePopupHarness({ paired = true, confirmCopy = false, clipboardReject = null, validServerProof = true } = {}) {
+  const elements = Object.fromEntries(
+    ['tabInfo', 'pairingInfo', 'sendBtn', 'copyBtn', 'statusMsg', 'openOptionsBtn']
+      .map((id) => [id, makeElement()])
+  );
+  const clipboardWrites = [];
+  const confirmationMessages = [];
+  const fetchCalls = [];
+  let cookieReads = 0;
+  const chromeApi = {
+    storage: { local: { get: async () => paired ? { aptPairingSecret: 'A'.repeat(43) } : {} } },
+    tabs: { query: async () => [{ url: 'https://customer.avasecurity.com/devices' }] },
+    cookies: { get: async () => { cookieReads += 1; return { value: 'sensitive-va-token' }; } },
+    runtime: { openOptionsPage() {} }
+  };
+  const navigatorApi = {
+    clipboard: {
+      async writeText(value) {
+        if (clipboardReject) throw clipboardReject;
+        clipboardWrites.push(value);
+      }
+    }
+  };
+  const documentApi = { getElementById: (id) => elements[id] };
+  const { createPopupController } = require('../chrome-extension/popup.js');
+  const controller = createPopupController({
+    chromeApi,
+    documentApi,
+    navigatorApi,
+    confirmCopy: (message) => { confirmationMessages.push(message); return confirmCopy; },
+    cryptoApi: crypto.webcrypto,
+    fetchImpl: async (...args) => {
+      fetchCalls.push(args);
+      if (args[0].endsWith('/challenge')) {
+        const { clientNonce } = JSON.parse(args[1].body);
+        const serverNonce = 'B'.repeat(43);
+        const canonical = JSON.stringify(['apt-server-challenge-v1', clientNonce, serverNonce]);
+        const serverProof = validServerProof
+          ? crypto.createHmac('sha256', 'A'.repeat(43)).update(canonical).digest('base64url')
+          : 'C'.repeat(43);
+        return { ok: true, json: async () => ({ success: true, serverNonce, serverProof }) };
+      }
+      return { ok: true, json: async () => ({ success: true }) };
+    }
+  });
+  return { controller, elements, clipboardWrites, confirmationMessages, fetchCalls, get cookieReads() { return cookieReads; } };
+}
+
+test('manifest commits only a public key, stable ID, local storage, and exact loopback host access', () => {
+  const manifest = JSON.parse(read('manifest.json'));
+  assert.equal(extensionIdFromKey(manifest.key), EXPECTED_ID);
+  assert.equal(APT_EXTENSION_ID, EXPECTED_ID);
+  assert.equal(APT_EXTENSION_ORIGIN, `chrome-extension://${EXPECTED_ID}`);
+  assert.ok(manifest.permissions.includes('storage'));
+  assert.equal(manifest.options_page, 'options.html');
+  assert.ok(manifest.host_permissions.includes('http://127.0.0.1:18247/*'));
+  assert.equal(manifest.host_permissions.some((entry) => entry.includes('localhost')), false);
+  assert.equal(/PRIVATE KEY/.test(manifest.key), false);
+});
+
+test('extension source contains no old token and sends only to the exact bridge endpoint', () => {
+  const sources = ['manifest.json', 'popup.js', 'popup.html', 'options.js', 'options.html']
+    .map(read).join('\n');
+  assert.equal(sources.includes(OLD_TOKEN), false);
+  assert.match(read('popup.js'), /http:\/\/127\.0\.0\.1:18247\/cookie/);
+  assert.doesNotMatch(sources, /http:\/\/(?:localhost|\[::1\]|0\.0\.0\.0):18247/);
+  assert.doesNotMatch(sources, /console\.(?:log|debug|info)\s*\(/);
+});
+
+test('popup stays disabled while unpaired and directs the user to pairing options', async () => {
+  const harness = makePopupHarness({ paired: false });
+  await harness.controller.init();
+  assert.equal(harness.elements.sendBtn.disabled, true);
+  assert.equal(harness.elements.copyBtn.disabled, true);
+  assert.match(harness.elements.pairingInfo.textContent, /Not paired/i);
+  assert.equal(harness.elements.openOptionsBtn.hidden, false);
+});
+
+test('paired popup enables preserved actions only on a supported Alta HTTPS tab', async () => {
+  const harness = makePopupHarness({ paired: true });
+  await harness.controller.init();
+  assert.equal(harness.elements.sendBtn.textContent || 'Send to APT', 'Send to APT');
+  assert.equal(harness.elements.copyBtn.textContent || 'Copy VA Token', 'Copy VA Token');
+  assert.equal(harness.elements.sendBtn.disabled, false);
+  assert.equal(harness.elements.copyBtn.disabled, false);
+  assert.match(harness.elements.pairingInfo.textContent, /Paired/i);
+});
+
+test('deployment detection rejects non-HTTPS, bare, and lookalike Alta hosts', () => {
+  const { isSupportedDeploymentUrl } = require('../chrome-extension/popup.js');
+  assert.equal(isSupportedDeploymentUrl('https://customer.avasecurity.com/path'), true);
+  assert.equal(isSupportedDeploymentUrl('http://customer.avasecurity.com/path'), false);
+  assert.equal(isSupportedDeploymentUrl('https://avasecurity.com/path'), false);
+  assert.equal(isSupportedDeploymentUrl('https://customer.avasecurity.com.evil.test/path'), false);
+});
+
+test('Send to APT authenticates the listener before reading or sending the cookie', async () => {
+  const harness = makePopupHarness({ paired: true });
+  await harness.controller.init();
+  await harness.controller.sendToApt();
+  assert.equal(harness.fetchCalls.length, 2);
+  const [challengeUrl, challengeRequest] = harness.fetchCalls[0];
+  assert.equal(challengeUrl, 'http://127.0.0.1:18247/challenge');
+  assert.equal(JSON.stringify(challengeRequest).includes('sensitive-va-token'), false);
+  assert.equal(JSON.stringify(challengeRequest).includes('A'.repeat(43)), false);
+  const [url, request] = harness.fetchCalls[1];
+  assert.equal(url, 'http://127.0.0.1:18247/cookie');
+  assert.equal(Object.keys(request.headers).some((name) => /pairing/i.test(name)), false);
+  const body = JSON.parse(request.body);
+  assert.equal(body.deploymentUrl, 'https://customer.avasecurity.com');
+  assert.equal(body.cookieValue, 'sensitive-va-token');
+  assert.match(body.clientNonce, /^[A-Za-z0-9_-]{43}$/);
+  assert.equal(body.serverNonce, 'B'.repeat(43));
+  assert.match(body.proof, /^[A-Za-z0-9_-]{43}$/);
+  assert.equal(request.body.includes('A'.repeat(43)), false);
+});
+
+test('a port-squatting fake server with an invalid proof receives no cookie or pairing secret', async () => {
+  const harness = makePopupHarness({ paired: true, validServerProof: false });
+  await harness.controller.init();
+  await harness.controller.sendToApt();
+  assert.equal(harness.fetchCalls.length, 1);
+  assert.equal(harness.fetchCalls[0][0], 'http://127.0.0.1:18247/challenge');
+  assert.equal(harness.cookieReads, 0);
+  const network = JSON.stringify(harness.fetchCalls);
+  assert.equal(network.includes('sensitive-va-token'), false);
+  assert.equal(network.includes('A'.repeat(43)), false);
+});
+
+test('copy cancellation occurs before cookie access and never writes the token', async () => {
+  const harness = makePopupHarness({ paired: true, confirmCopy: false });
+  await harness.controller.init();
+  await harness.controller.copyToken();
+  assert.equal(harness.cookieReads, 0);
+  assert.deepEqual(harness.clipboardWrites, []);
+  assert.match(harness.elements.statusMsg.textContent, /cancelled/i);
+});
+
+test('confirmed copy uses one concise prompt and reports success without exposing token', async () => {
+  const harness = makePopupHarness({ paired: true, confirmCopy: true });
+  await harness.controller.init();
+  await harness.controller.copyToken();
+  assert.deepEqual(harness.confirmationMessages, ['Copy VA token?']);
+  assert.deepEqual(harness.clipboardWrites, ['sensitive-va-token']);
+  assert.match(harness.elements.statusMsg.textContent, /copied/i);
+  assert.equal(harness.elements.statusMsg.textContent.includes('sensitive-va-token'), false);
+});
+
+test('clipboard permission denial is handled without leaking the token', async () => {
+  const harness = makePopupHarness({
+    paired: true,
+    confirmCopy: true,
+    clipboardReject: new Error('NotAllowedError')
+  });
+  await harness.controller.init();
+  await harness.controller.copyToken();
+  assert.match(harness.elements.statusMsg.textContent, /could not copy/i);
+  assert.equal(harness.elements.statusMsg.textContent.includes('sensitive-va-token'), false);
+});
+
+test('options UI stores a validated pairing secret locally and can forget pairing', () => {
+  const html = read('options.html');
+  const js = read('options.js');
+  assert.match(html, /pairingSecret/);
+  assert.match(html, /type="password"/);
+  assert.doesNotMatch(html, /treat it like a password|privacy-note/i);
+  assert.match(js, /chrome\.storage\.local\.set/);
+  assert.match(js, /chrome\.storage\.local\.remove/);
+  assert.match(js, /aptPairingSecret/);
+  assert.doesNotMatch(js, /console\./);
+});
diff --git a/test/fixtures/gitpeji-latest-release.json b/test/fixtures/gitpeji-latest-release.json
new file mode 100644
index 0000000..c2251d8
--- /dev/null
+++ b/test/fixtures/gitpeji-latest-release.json
@@ -0,0 +1,15 @@
+{
+  "id": 17,
+  "tag_name": "v1.0.0",
+  "target_commitish": "main",
+  "name": "Alta Proxy Tool v1.0.0",
+  "body": "Initial GitPeji release",
+  "draft": false,
+  "prerelease": false,
+  "created_at": "2026-08-19T12:30:00Z",
+  "published_at": "2026-08-19T12:34:56Z",
+  "html_url": "https://git.pejicorp.com/peji/Alta-Proxy-Tool/releases/tag/v1.0.0",
+  "tarball_url": "https://git.pejicorp.com/peji/Alta-Proxy-Tool/archive/v1.0.0.tar.gz",
+  "zipball_url": "https://git.pejicorp.com/peji/Alta-Proxy-Tool/archive/v1.0.0.zip",
+  "assets": []
+}
diff --git a/test/proxy-launch.test.js b/test/proxy-launch.test.js
new file mode 100644
index 0000000..73d603e
--- /dev/null
+++ b/test/proxy-launch.test.js
@@ -0,0 +1,391 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { EventEmitter } = require('node:events');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const MODULE_PATH = '../src/proxy-launch';
+const APPROVED_DIRECTORY = 'C:\\Program Files\\Alta Proxy Tool';
+const APPROVED_HELPER = 'C:\\Program Files\\Alta Proxy Tool\\aware-cam-proxy.exe';
+const VALID_HOST = 'tenant.avasecurity.com';
+const VALID_DEVICE_ID = '123e4567-e89b-42d3-a456-426614174000';
+const SYNTHETIC_COOKIE = 'HERMES_SENTINEL_SESSION_COOKIE';
+
+function loadModule() {
+  return require(MODULE_PATH);
+}
+
+class FakeChild extends EventEmitter {
+  constructor(pid, killResult = true) {
+    super();
+    this.pid = pid;
+    this.killResult = killResult;
+    this.killCalls = [];
+    this.killError = null;
+    this.exitCode = null;
+    this.signalCode = null;
+  }
+
+  kill(signal) {
+    this.killCalls.push(signal);
+    if (this.killError) throw this.killError;
+    return this.killResult;
+  }
+}
+
+function createHarness({
+  helperExists = true,
+  children = [new FakeChild(4101)],
+  stopTimeoutMs = 5_000,
+  setTimeout = global.setTimeout,
+  clearTimeout = global.clearTimeout,
+} = {}) {
+  const calls = [];
+  let childIndex = 0;
+  const spawn = (...args) => {
+    calls.push(args);
+    return children[childIndex++];
+  };
+  const fsStub = { existsSync: (candidate) => helperExists && candidate === APPROVED_HELPER };
+  const { createProxyManager } = loadModule();
+  const manager = createProxyManager({
+    appDirectory: APPROVED_DIRECTORY,
+    fs: fsStub,
+    spawn,
+    platform: 'win32',
+    now: () => 1_777_777_777_777,
+    stopTimeoutMs,
+    setTimeout,
+    clearTimeout,
+  });
+  return { manager, calls, children };
+}
+
+function validRequest(overrides = {}) {
+  return {
+    deploymentHost: VALID_HOST,
+    deviceId: VALID_DEVICE_ID,
+    cookie: SYNTHETIC_COOKIE,
+    ...overrides
+  };
+}
+
+test('exports the proxy manager module', () => {
+  assert.doesNotThrow(() => loadModule());
+});
+
+test('launches the approved helper directly with the paired Alta session', () => {
+  const { manager, calls } = createHarness();
+
+  const result = manager.launchProxy(validRequest());
+
+  assert.deepEqual(calls, [[
+    APPROVED_HELPER,
+    ['-a', VALID_HOST, '-d', VALID_DEVICE_ID, '-k', SYNTHETIC_COOKIE],
+    {
+      shell: false,
+      detached: true,
+      stdio: 'ignore',
+      windowsHide: false
+    }
+  ]]);
+  assert.deepEqual(result, {
+    success: true,
+    processId: 4101,
+    deviceId: VALID_DEVICE_ID,
+    startedAt: 1_777_777_777_777,
+    status: 'running'
+  });
+});
+
+test('passes the paired cookie literally without invoking a shell or console prompt', () => {
+  const cookie = 'abc_DEF-123.456==';
+  const { manager, calls } = createHarness();
+
+  manager.launchProxy(validRequest({ cookie }));
+
+  assert.equal(calls[0][1][5], cookie);
+  assert.equal(calls[0][2].shell, false);
+  assert.equal(calls[0][2].stdio, 'ignore');
+});
+
+test('rejects the CRLF calc.exe reproducer in every structured input', () => {
+  const { manager, calls } = createHarness();
+  const attacks = [
+    { deploymentHost: `${VALID_HOST}\r\ncalc.exe` },
+    { deviceId: `${VALID_DEVICE_ID}\r\ncalc.exe` },
+    { cookie: `${SYNTHETIC_COOKIE}\r\ncalc.exe` },
+    { cookie: `${SYNTHETIC_COOKIE}\0calc.exe` }
+  ];
+
+  for (const attack of attacks) {
+    assert.throws(() => manager.launchProxy(validRequest(attack)), /invalid|must not contain/i);
+  }
+  assert.equal(calls.length, 0);
+});
+
+test('rejects shell metacharacters in deployment hosts and device identifiers', () => {
+  const { manager, calls } = createHarness();
+  for (const deploymentHost of [
+    'tenant.avasecurity.com&calc.exe',
+    'tenant.avasecurity.com|calc.exe',
+    'https://tenant.avasecurity.com',
+    'tenant.avasecurity.com/path',
+    'tenant.avasecurity.com:443'
+  ]) {
+    assert.throws(() => manager.launchProxy(validRequest({ deploymentHost })), /deployment host/i);
+  }
+  for (const deviceId of [
+    `${VALID_DEVICE_ID}&calc.exe`,
+    `${VALID_DEVICE_ID}|calc.exe`,
+    '$(calc.exe)'
+  ]) {
+    assert.throws(() => manager.launchProxy(validRequest({ deviceId })), /device identifier/i);
+  }
+  assert.equal(calls.length, 0);
+});
+
+test('accepts only strict canonical UUID device identifiers', () => {
+  const invalidIds = [
+    '',
+    '123e4567-e89b-12d3-a456-42661417400',
+    '123e4567e89b42d3a456426614174000',
+    '123e4567-e89b-02d3-a456-426614174000',
+    '123e4567-e89b-42d3-c456-426614174000',
+    'g23e4567-e89b-42d3-a456-426614174000',
+    'a'.repeat(37)
+  ];
+
+  for (const deviceId of invalidIds) {
+    const { manager } = createHarness();
+    assert.throws(() => manager.launchProxy(validRequest({ deviceId })), /device identifier/i);
+  }
+});
+
+test('accepts only bounded Alta subdomain hostnames from trusted session state', () => {
+  const invalidHosts = [
+    '',
+    'avasecurity.com',
+    'avigilon.com',
+    'evil.example',
+    'tenant.avasecurity.com.evil.example',
+    '.avasecurity.com',
+    '-tenant.avasecurity.com',
+    'tenant..avasecurity.com',
+    'tenant_avasecurity.com',
+    `tenant.${'a'.repeat(240)}.avasecurity.com`
+  ];
+
+  for (const deploymentHost of invalidHosts) {
+    const { manager } = createHarness();
+    assert.throws(() => manager.launchProxy(validRequest({ deploymentHost })), /deployment host/i);
+  }
+});
+
+test('normalizes a valid Alta hostname to lowercase', () => {
+  const { manager, calls } = createHarness();
+  manager.launchProxy(validRequest({ deploymentHost: 'Tenant.AVIGILON.com' }));
+  assert.equal(calls[0][1][1], 'tenant.avigilon.com');
+});
+
+test('rejects empty, oversized, non-string, and control-character cookies', () => {
+  for (const cookie of ['', 'x'.repeat(4097), 42, 'abc\nxyz', 'abc\rxyz', 'abc\0xyz', 'abc;xyz']) {
+    const { manager } = createHarness();
+    assert.throws(() => manager.launchProxy(validRequest({ cookie })), /cookie/i);
+  }
+});
+
+test('fails closed when the fixed helper is missing and never spawns', () => {
+  const { manager, calls } = createHarness({ helperExists: false });
+  assert.throws(() => manager.launchProxy(validRequest()), /helper.*not found/i);
+  assert.equal(calls.length, 0);
+});
+
+test('requires an absolute approved application directory and Windows platform', () => {
+  const { createProxyManager } = loadModule();
+  const dependencies = { fs: { existsSync: () => true }, spawn: () => new FakeChild(1) };
+
+  assert.throws(
+    () => createProxyManager({ appDirectory: '..\\untrusted', platform: 'win32', ...dependencies }),
+    /absolute/i
+  );
+  assert.throws(
+    () => createProxyManager({ appDirectory: '/opt/apt', platform: 'linux', ...dependencies }),
+    /platform/i
+  );
+});
+
+test('redacts the cookie if spawn throws an error containing it', () => {
+  const { createProxyManager } = loadModule();
+  const manager = createProxyManager({
+    appDirectory: APPROVED_DIRECTORY,
+    fs: { existsSync: () => true },
+    platform: 'win32',
+    spawn: () => { throw new Error(`spawn failed for ${SYNTHETIC_COOKIE}`); }
+  });
+
+  assert.throws(
+    () => manager.launchProxy(validRequest()),
+    (error) => {
+      assert.match(error.message, /spawn failed/);
+      assert.match(error.message, /\[REDACTED\]/);
+      assert.doesNotMatch(error.message, /HERMES_SENTINEL_SESSION_COOKIE/);
+      return true;
+    }
+  );
+});
+
+test('tracks only safe process metadata and never exposes cookies', () => {
+  const { manager } = createHarness();
+  manager.launchProxy(validRequest());
+
+  const tracked = manager.listTrackedProxies();
+  assert.deepEqual(tracked, [{
+    processId: 4101,
+    deviceId: VALID_DEVICE_ID,
+    startedAt: 1_777_777_777_777,
+    status: 'running'
+  }]);
+  assert.doesNotMatch(JSON.stringify(tracked), /HERMES_SENTINEL_SESSION_COOKIE/);
+});
+
+test('stopping one tracked process waits for confirmed exit and leaves the other alive', async () => {
+  const first = new FakeChild(4101);
+  const second = new FakeChild(4102);
+  const { manager } = createHarness({ children: [first, second] });
+  manager.launchProxy(validRequest());
+  manager.launchProxy(validRequest({ deviceId: '123e4567-e89b-42d3-a456-426614174001' }));
+
+  const stopping = manager.stopProxy(4101);
+  assert.deepEqual(manager.listTrackedProxies().map((item) => [item.processId, item.status]), [
+    [4101, 'stopping'],
+    [4102, 'running'],
+  ]);
+  first.emit('exit', 0, 'SIGTERM');
+  const result = await stopping;
+
+  assert.deepEqual(result, {
+    success: true,
+    processId: 4101,
+    deviceId: VALID_DEVICE_ID,
+    status: 'stopped'
+  });
+  assert.deepEqual(first.killCalls, ['SIGTERM']);
+  assert.deepEqual(second.killCalls, []);
+  assert.deepEqual(manager.listTrackedProxies().map((item) => item.processId), [4102]);
+});
+
+test('never stops an untracked PID', async () => {
+  const child = new FakeChild(4101);
+  const { manager } = createHarness({ children: [child] });
+  manager.launchProxy(validRequest());
+
+  assert.deepEqual(await manager.stopProxy(9999), {
+    success: false,
+    processId: 9999,
+    status: 'not-tracked'
+  });
+  assert.deepEqual(child.killCalls, []);
+});
+
+test('reports already-exited and permission-denied states honestly', async () => {
+  const exited = new FakeChild(4101, false);
+  exited.exitCode = 0;
+  const denied = new FakeChild(4102);
+  denied.killError = Object.assign(new Error('operation not permitted'), { code: 'EPERM' });
+  const { manager } = createHarness({ children: [exited, denied] });
+  manager.launchProxy(validRequest());
+  manager.launchProxy(validRequest({ deviceId: '123e4567-e89b-42d3-a456-426614174001' }));
+
+  assert.deepEqual(await manager.stopProxy(4101), {
+    success: true,
+    processId: 4101,
+    deviceId: VALID_DEVICE_ID,
+    status: 'already-exited'
+  });
+  assert.deepEqual(await manager.stopProxy(4102), {
+    success: false,
+    processId: 4102,
+    deviceId: '123e4567-e89b-42d3-a456-426614174001',
+    status: 'permission-denied',
+    message: 'Unable to stop the tracked proxy process: permission denied.'
+  });
+  assert.deepEqual(manager.listTrackedProxies().map((item) => item.processId), [4102]);
+});
+
+test('kill true is only a request and times out while the child remains tracked as stopping', async () => {
+  let timeoutCallback;
+  const child = new FakeChild(4101, true);
+  const { manager } = createHarness({
+    children: [child],
+    stopTimeoutMs: 25,
+    setTimeout(callback, delay) {
+      assert.equal(delay, 25);
+      timeoutCallback = callback;
+      return 123;
+    },
+    clearTimeout() {},
+  });
+  manager.launchProxy(validRequest());
+
+  const stopping = manager.stopProxy(4101);
+  assert.deepEqual(manager.listTrackedProxies().map(({ processId, status }) => ({ processId, status })), [
+    { processId: 4101, status: 'stopping' },
+  ]);
+  timeoutCallback();
+
+  assert.deepEqual(await stopping, {
+    success: false,
+    processId: 4101,
+    deviceId: VALID_DEVICE_ID,
+    status: 'stop-timeout',
+    message: 'Timed out waiting for the tracked proxy process to exit.',
+  });
+  assert.equal(manager.listTrackedProxies()[0].status, 'stopping');
+});
+
+test('kill false does not claim success without confirmed exit', async () => {
+  const child = new FakeChild(4101, false);
+  const { manager } = createHarness({ children: [child] });
+  manager.launchProxy(validRequest());
+
+  assert.deepEqual(await manager.stopProxy(4101), {
+    success: false,
+    processId: 4101,
+    deviceId: VALID_DEVICE_ID,
+    status: 'stop-failed',
+    message: 'Unable to confirm that the tracked proxy process exited.',
+  });
+  assert.equal(manager.listTrackedProxies()[0].status, 'stopping');
+});
+
+test('generic child errors retain tracking unless process exit is confirmed', () => {
+  const child = new FakeChild(4101);
+  const { manager } = createHarness({ children: [child] });
+  manager.launchProxy(validRequest());
+  child.emit('error', new Error('transient process error'));
+  assert.deepEqual(manager.listTrackedProxies().map((entry) => entry.processId), [4101]);
+});
+
+test('exit events remove only the matching owned child', () => {
+  const original = new FakeChild(4101);
+  const replacement = new FakeChild(4101);
+  const { manager } = createHarness({ children: [original, replacement] });
+  manager.launchProxy(validRequest());
+  original.emit('exit', 0);
+  manager.launchProxy(validRequest({ deviceId: '123e4567-e89b-42d3-a456-426614174001' }));
+
+  original.emit('exit', 0);
+
+  assert.deepEqual(manager.listTrackedProxies().map((item) => item.processId), [4101]);
+});
+
+test('source contains no shell launchers, broad process killers, or credential persistence APIs', () => {
+  const source = fs.readFileSync(path.join(__dirname, '..', 'src', 'proxy-launch.js'), 'utf8');
+  assert.doesNotMatch(source, /\b(?:cmd(?:\.exe)?|powershell|taskkill|pkill|wmic)\b/i);
+  assert.doesNotMatch(source, /\.(?:bat|command)\b/i);
+  assert.doesNotMatch(source, /(?:writeFile|appendFile|mkdtemp|tmpdir)/);
+  assert.match(source, /shell:\s*false/);
+});
diff --git a/test/renderer-controller.test.js b/test/renderer-controller.test.js
new file mode 100644
index 0000000..b335241
--- /dev/null
+++ b/test/renderer-controller.test.js
@@ -0,0 +1,49 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { createRendererController, shouldShowPairingOnboarding } = require('../renderer-controller');
+
+function harness(result) {
+  const calls = [];
+  const controller = createRendererController({
+    disconnect: async () => result,
+    renderConnectionState: (state) => calls.push(['render', state]),
+    clearDisconnectedState: () => calls.push(['clear']),
+    showConnectionStatus: (message, type) => calls.push(['status', message, type]),
+  });
+  return { controller, calls };
+}
+
+test('failed disconnect retains visible connection, device, and proxy state', async () => {
+  const result = {
+    success: false,
+    connected: true,
+    activeProxies: [{ deviceId: '550e8400-e29b-41d4-a716-446655440000', processId: 4101 }],
+    message: 'Could not stop every active proxy. The Alta session remains connected.',
+  };
+  const { controller, calls } = harness(result);
+
+  assert.equal(await controller.disconnect(), result);
+  assert.deepEqual(calls, [['status', result.message, 'error']]);
+});
+
+test('successful disconnect renders disconnected state and clears device state', async () => {
+  const result = { success: true, connected: false, origin: null, activeProxies: [] };
+  const { controller, calls } = harness(result);
+
+  assert.equal(await controller.disconnect(), result);
+  assert.deepEqual(calls, [
+    ['render', result],
+    ['clear'],
+    ['status', 'Disconnected from Alta.', 'info'],
+  ]);
+});
+
+test('pairing onboarding is temporary but remains recoverable', () => {
+  assert.equal(shouldShowPairingOnboarding({ paired: false }), true);
+  assert.equal(shouldShowPairingOnboarding({ paired: true, secretVisible: true }), true);
+  assert.equal(shouldShowPairingOnboarding({ paired: true }), false);
+  assert.equal(shouldShowPairingOnboarding({ paired: true, secretVisible: true, connected: true }), false);
+  assert.equal(shouldShowPairingOnboarding({ paired: true, connected: true, manuallyOpen: true }), true);
+});
diff --git a/test/renderer-hierarchy.test.js b/test/renderer-hierarchy.test.js
new file mode 100644
index 0000000..8bf9998
--- /dev/null
+++ b/test/renderer-hierarchy.test.js
@@ -0,0 +1,77 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const { describeVirtualRows } = require('../sidebar-view');
+
+const ROOT = path.resolve(__dirname, '..');
+const read = (name) => fs.readFileSync(path.join(ROOT, name), 'utf8');
+
+function syntheticSnapshot(count) {
+  const rows = Array.from({ length: count }, (_, index) => ({
+    key: `camera:00000000-0000-4000-8000-${String(index).padStart(12, '0')}`,
+    id: `00000000-0000-4000-8000-${String(index).padStart(12, '0')}`,
+    kind: 'camera', name: `Camera ${index}`, ariaLevel: 3, ariaSelected: index === 4,
+    ariaPosInSet: index + 1, ariaSetSize: count,
+  }));
+  const startIndex = Math.max(0, Math.floor(count / 2) - 20);
+  return {
+    state: { activeKey: rows[startIndex].key, selectedKey: rows[4].key },
+    rows: Object.assign(rows, { hiddenSelected: true }),
+    window: { rows: rows.slice(startIndex, startIndex + 60), startIndex, offsetTop: startIndex * 30, totalHeight: count * 30 },
+  };
+}
+
+test('renderer loads hierarchy foundations in order and exposes an accessible virtual tree', () => {
+  const html = read('index.html');
+  const treeIndex = html.indexOf('device-tree.js');
+  const controllerIndex = html.indexOf('sidebar-controller.js');
+  const viewIndex = html.indexOf('sidebar-view.js');
+  const rendererIndex = html.indexOf('renderer.js');
+  assert.ok(treeIndex >= 0 && treeIndex < controllerIndex && controllerIndex < viewIndex && viewIndex < rendererIndex);
+  assert.match(html, /id="deviceList"[^>]*role="tree"[^>]*tabindex="0"[^>]*aria-activedescendant/);
+  assert.match(html, /id="deviceResults"[^>]*role="status"[^>]*aria-live="polite"/);
+});
+
+test('renderer uses one hierarchy request and no parallel flat discovery', () => {
+  const renderer = read('renderer.js');
+  assert.match(renderer, /electronAPI\.getDeviceHierarchy\(\)/);
+  assert.doesNotMatch(renderer, /electronAPI\.getDevices\(|electronAPI\.getDeviceSites\(|Promise\.all\(\s*\[\s*window\.electronAPI\.get/);
+  assert.doesNotMatch(renderer, /\ballDevices\b|\ballSites\b|\bcollapsedSites\b|groupDevicesBySite/);
+  assert.doesNotMatch(renderer, /Selected camera is hidden|hidden by the current view/i);
+  assert.match(renderer, /loadGeneration/);
+  assert.match(renderer, /generation\s*!==\s*loadGeneration/);
+});
+
+test('renderer uses delegated tree events, throttled scroll, and debounced search', () => {
+  const renderer = read('renderer.js');
+  assert.equal((renderer.match(/deviceList\.addEventListener\('click'/g) || []).length, 1);
+  assert.equal((renderer.match(/deviceList\.addEventListener\('keydown'/g) || []).length, 1);
+  assert.equal((renderer.match(/deviceList\.addEventListener\('scroll'/g) || []).length, 1);
+  assert.match(renderer, /requestAnimationFrame/);
+  assert.match(renderer, /setTimeout\([^,]+,\s*125\)/s);
+});
+
+test('virtual row descriptors stay bounded for 1,500 and 5,000 visible rows', () => {
+  for (const count of [1_500, 5_000]) {
+    const descriptors = describeVirtualRows(syntheticSnapshot(count), { activeDeviceIds: new Set() });
+    assert.ok(descriptors.length <= 80, `${count} rows mounted ${descriptors.length} descriptors`);
+    assert.equal(descriptors[0].role, 'treeitem');
+    assert.equal(descriptors[0].aria.level, 3);
+    assert.match(descriptors[0].domId, /^apt-tree-row-/);
+  }
+});
+
+test('view descriptors preserve selection and refresh proxy/status classes without rebuilding rows', () => {
+  const snapshot = syntheticSnapshot(1_500);
+  const selectedId = snapshot.rows[4].id;
+  const before = describeVirtualRows(snapshot, { activeDeviceIds: new Set() });
+  const camera = before.find((row) => row.kind === 'camera');
+  const after = describeVirtualRows(snapshot, { activeDeviceIds: new Set([camera.deviceId]), isOnline: () => true });
+  assert.ok(after.find((row) => row.key === camera.key).classes.includes('proxy-active'));
+  assert.ok(after.find((row) => row.key === camera.key).classes.includes('online'));
+  assert.equal(snapshot.rows[4].id, selectedId);
+  assert.equal(snapshot.rows.hiddenSelected, true);
+});
diff --git a/test/runtime-contract.test.js b/test/runtime-contract.test.js
new file mode 100644
index 0000000..7491144
--- /dev/null
+++ b/test/runtime-contract.test.js
@@ -0,0 +1,563 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { PassThrough } = require('node:stream');
+
+const {
+  AppRuntime,
+  PairingController,
+  createBridgeHandler,
+  loadPairingEnvelope,
+} = require('../src/electron-runtime');
+const {
+  APT_EXTENSION_ORIGIN,
+  BridgeAuth,
+  computeCookieProof,
+  createRequestLimiter,
+} = require('../src/bridge-auth');
+const { createSessionStore } = require('../src/session-store');
+
+const ROOT = path.join(__dirname, '..');
+const read = (name) => fs.readFileSync(path.join(ROOT, name), 'utf8');
+
+function responseHarness() {
+  return {
+    statusCode: 0,
+    headers: {},
+    body: '',
+    setHeader(name, value) { this.headers[name.toLowerCase()] = value; },
+    writeHead(statusCode, headers = {}) {
+      this.statusCode = statusCode;
+      for (const [name, value] of Object.entries(headers)) this.setHeader(name, value);
+    },
+    end(chunk = '') { this.body += chunk; },
+  };
+}
+
+function requestHarness({ method = 'POST', origin = APT_EXTENSION_ORIGIN, url = '/cookie', body = '{}' } = {}) {
+  const request = new PassThrough();
+  request.method = method;
+  request.url = url;
+  request.headers = { origin };
+  process.nextTick(() => request.end(body));
+  return request;
+}
+
+test('runtime keeps Alta credentials in main-owned modules and exposes only non-secret state', async () => {
+  const sessionStore = createSessionStore();
+  sessionStore.establish('https://customer.avasecurity.com', 'top-secret-cookie');
+  const calls = [];
+  const tracked = [];
+  const proxyManager = {
+    launchProxy(request) {
+      calls.push(request);
+      tracked.push({ processId: 91, deviceId: request.deviceId, status: 'running', startedAt: 1 });
+      return { success: true, processId: 91, deviceId: request.deviceId, status: 'running' };
+    },
+    stopProxy(processId) {
+      calls.push({ processId });
+      tracked.splice(0, tracked.length);
+      return { success: true, processId, status: 'stop-requested' };
+    },
+    listTrackedProxies() { return tracked.slice(); },
+  };
+  const runtime = new AppRuntime({
+    sessionStore,
+    altaClient: {
+      getDevices: async () => [{ guid: '550e8400-e29b-41d4-a716-446655440000' }],
+      getDeviceSites: async () => [],
+      getAuthInfo: async () => ({ user: 'safe' }),
+    },
+    proxyManager,
+    checkForUpdate: async ({ currentVersion }) => ({ status: 'up-to-date', currentVersion }),
+    currentVersion: '1.0.0',
+    openExternal: async () => {},
+  });
+
+  assert.deepEqual(await runtime.getDevices(), {
+    success: true,
+    devices: [{
+      id: '550e8400-e29b-41d4-a716-446655440000',
+      name: null,
+      type: null,
+      model: null,
+      address: null,
+      siteId: null,
+      deviceGroupId: null,
+      displayStatus: null,
+      localStorage: null,
+    }],
+  });
+  const launched = await runtime.launchProxy('550e8400-e29b-41d4-a716-446655440000');
+  assert.equal(launched.success, true);
+  assert.deepEqual(calls[0], {
+    deploymentHost: 'customer.avasecurity.com',
+    cookie: 'top-secret-cookie',
+    deviceId: '550e8400-e29b-41d4-a716-446655440000',
+  });
+  assert.deepEqual(runtime.getConnectionState(), {
+    connected: true,
+    origin: 'https://customer.avasecurity.com',
+    activeProxies: [{ deviceId: '550e8400-e29b-41d4-a716-446655440000', processId: 91 }],
+  });
+  assert.equal(JSON.stringify(launched).includes('top-secret-cookie'), false);
+  assert.equal(JSON.stringify(runtime.getConnectionState()).includes('top-secret-cookie'), false);
+
+  assert.equal((await runtime.stopProxy('550e8400-e29b-41d4-a716-446655440000')).success, true);
+  assert.deepEqual(calls[1], { processId: 91 });
+  assert.equal((await runtime.stopProxy(999)).success, false);
+});
+
+test('runtime discovers and projects hierarchy while metadata failures preserve cameras', async () => {
+  const deviceId = '550e8400-e29b-41d4-a716-446655440000';
+  const runtime = new AppRuntime({
+    sessionStore: createSessionStore(),
+    altaClient: {
+      getDevices: async () => [{
+        guid: deviceId,
+        name: 'Camera',
+        server_group_id: 'site-1',
+        secret: 'drop-me',
+      }],
+      getDeviceSites: async () => { throw Object.assign(new Error('tenant secret'), { code: 'ALTA_HTTP_ERROR' }); },
+      getDeviceGroups: async () => [{ id: 'group-1', name: 'Lobby', parent_id: null }],
+    },
+    proxyManager: { listTrackedProxies: () => [] },
+  });
+
+  const result = await runtime.getDeviceHierarchy();
+  assert.equal(result.success, true);
+  assert.deepEqual(result.hierarchy.devices.map(({ id }) => id), [deviceId]);
+  assert.deepEqual(result.hierarchy.sites, []);
+  assert.deepEqual(result.hierarchy.groups, [{
+    id: 'group-1', name: 'Lobby', parentId: null, pendingDeletionStart: null,
+  }]);
+  assert.equal(result.hierarchy.diagnostics.sites.error, 'Device sites unavailable');
+  assert.doesNotMatch(JSON.stringify(result), /drop-me|tenant secret/);
+});
+
+test('runtime enforces a bounded whole-discovery deadline', async () => {
+  const runtime = new AppRuntime({
+    sessionStore: createSessionStore(),
+    altaClient: {
+      getDevices: async () => new Promise(() => {}),
+      getDeviceSites: async () => [],
+      getDeviceGroups: async () => [],
+    },
+    proxyManager: { listTrackedProxies: () => [] },
+    discoveryTimeoutMs: 25,
+  });
+  const result = await runtime.getDeviceHierarchy();
+  assert.deepEqual(result, {
+    success: false,
+    hierarchy: { devices: [], sites: [], groups: [] },
+    message: 'Alta device discovery timed out',
+  });
+});
+
+test('newest hierarchy discovery owns the launch allowlist when completions arrive out of order', async () => {
+  const sessionStore = createSessionStore();
+  sessionStore.establish('https://customer.avasecurity.com', 'synthetic-cookie');
+  const deviceA = '550e8400-e29b-41d4-a716-44665544000a';
+  const deviceB = '550e8400-e29b-41d4-a716-44665544000b';
+  const pending = [];
+  const launches = [];
+  const runtime = new AppRuntime({
+    sessionStore,
+    altaClient: {
+      getDevices: () => new Promise((resolve) => pending.push(resolve)),
+      getDeviceSites: async () => [],
+      getDeviceGroups: async () => [],
+    },
+    proxyManager: {
+      launchProxy(request) {
+        launches.push(request.deviceId);
+        return { processId: 5000 + launches.length, deviceId: request.deviceId, status: 'running' };
+      },
+      listTrackedProxies: () => [],
+    },
+  });
+
+  const staleA = runtime.getDeviceHierarchy();
+  const freshB = runtime.getDeviceHierarchy();
+  pending[1]([{ guid: deviceB }]);
+  assert.equal((await freshB).success, true);
+  assert.equal((await runtime.launchProxy(deviceB)).success, true);
+  pending[0]([{ guid: deviceA }]);
+  assert.deepEqual(await staleA, {
+    success: false,
+    stale: true,
+    hierarchy: { devices: [], sites: [], groups: [] },
+    message: 'Alta device discovery result is stale',
+  });
+  assert.equal((await runtime.launchProxy(deviceA)).success, false);
+  assert.deepEqual(launches, [deviceB]);
+});
+
+test('disconnect and session changes invalidate pending discovery without repopulating the allowlist', async () => {
+  const deviceId = '550e8400-e29b-41d4-a716-44665544000c';
+  for (const invalidate of ['disconnect', 'session-change']) {
+    const sessionStore = createSessionStore();
+    sessionStore.establish('https://first.avasecurity.com', 'synthetic-cookie');
+    let resolveDevices;
+    const runtime = new AppRuntime({
+      sessionStore,
+      altaClient: {
+        getDevices: () => new Promise((resolve) => { resolveDevices = resolve; }),
+        getDeviceSites: async () => [],
+        getDeviceGroups: async () => [],
+      },
+      proxyManager: { listTrackedProxies: () => [] },
+    });
+    const discovery = runtime.getDeviceHierarchy();
+    if (invalidate === 'disconnect') {
+      assert.equal((await runtime.disconnect()).success, true);
+    } else {
+      sessionStore.establish('https://second.avasecurity.com', 'replacement-cookie');
+      runtime.onSessionChanged();
+    }
+    resolveDevices([{ guid: deviceId }]);
+    assert.equal((await discovery).stale, true, invalidate);
+    assert.equal(runtime.allowedDeviceIds.size, 0, invalidate);
+  }
+});
+
+test('launch allowlist remains bound to the session origin that produced it', async () => {
+  const deviceId = '550e8400-e29b-41d4-a716-44665544000d';
+  const sessionStore = createSessionStore();
+  sessionStore.establish('https://first.avasecurity.com', 'synthetic-cookie');
+  let launches = 0;
+  const runtime = new AppRuntime({
+    sessionStore,
+    altaClient: {
+      getDevices: async () => [{ guid: deviceId }],
+      getDeviceSites: async () => [],
+      getDeviceGroups: async () => [],
+    },
+    proxyManager: {
+      listTrackedProxies: () => [],
+      launchProxy() { launches += 1; },
+    },
+  });
+  assert.equal((await runtime.getDeviceHierarchy()).success, true);
+  sessionStore.establish('https://second.avasecurity.com', 'replacement-cookie');
+  assert.equal((await runtime.launchProxy(deviceId)).success, false);
+  assert.equal(launches, 0);
+});
+
+test('runtime rejects discovery deadlines above 60 seconds', () => {
+  assert.throws(() => new AppRuntime({ discoveryTimeoutMs: 60_001 }), /discovery timeout/i);
+});
+
+
+test('bridge authenticates itself before accepting a one-time HMAC cookie request', async () => {
+  const protect = (value) => Buffer.from(`protected:${value}`);
+  const unprotect = (value) => Buffer.from(value).toString().slice('protected:'.length);
+  const auth = new BridgeAuth({ protect, unprotect });
+  const secret = auth.rotate().secret;
+  const sessionStore = createSessionStore();
+  let stateNotifications = 0;
+  const handler = createBridgeHandler({
+    bridgeAuth: auth,
+    sessionStore,
+    onConnectionStateChanged: () => { stateNotifications += 1; },
+  });
+
+  const unknownPreflight = requestHarness({ method: 'OPTIONS', origin: 'chrome-extension://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' });
+  const unknownResponse = responseHarness();
+  await handler(unknownPreflight, unknownResponse);
+  assert.equal(unknownResponse.statusCode, 403);
+  assert.equal(unknownResponse.headers['access-control-allow-origin'], undefined);
+
+  const allowedPreflight = requestHarness({ method: 'OPTIONS' });
+  const allowedResponse = responseHarness();
+  await handler(allowedPreflight, allowedResponse);
+  assert.equal(allowedResponse.statusCode, 204);
+  assert.equal(allowedResponse.headers['access-control-allow-origin'], APT_EXTENSION_ORIGIN);
+  assert.doesNotMatch(allowedResponse.headers['access-control-allow-headers'], /X-APT-Pairing/i);
+
+  const clientNonce = Buffer.alloc(32, 3).toString('base64url');
+  const challengeResponse = responseHarness();
+  await handler(requestHarness({ url: '/challenge', body: JSON.stringify({ clientNonce }) }), challengeResponse);
+  assert.equal(challengeResponse.statusCode, 200);
+  const challenge = JSON.parse(challengeResponse.body);
+  assert.equal(JSON.stringify(challenge).includes(secret), false);
+
+  const cookieBody = {
+    clientNonce,
+    serverNonce: challenge.serverNonce,
+    deploymentUrl: 'https://customer.avasecurity.com',
+    cookieValue: 'valid-cookie',
+  };
+  cookieBody.proof = computeCookieProof(secret, cookieBody);
+  const acceptedResponse = responseHarness();
+  await handler(requestHarness({ body: JSON.stringify(cookieBody) }), acceptedResponse);
+  assert.equal(acceptedResponse.statusCode, 200);
+  assert.deepEqual(sessionStore.describe(), { connected: true, origin: 'https://customer.avasecurity.com' });
+  assert.equal(stateNotifications, 1);
+  assert.equal(acceptedResponse.body.includes('valid-cookie'), false);
+
+  const replayResponse = responseHarness();
+  await handler(requestHarness({ body: JSON.stringify(cookieBody) }), replayResponse);
+  assert.equal(replayResponse.statusCode, 403);
+});
+
+test('bridge limiter encloses body reads and HMAC authentication under forged floods', async () => {
+  const auth = new BridgeAuth({ protect: (value) => Buffer.from(value), unprotect: (value) => Buffer.from(value).toString() });
+  auth.rotate();
+  const limiter = createRequestLimiter({ maxConcurrent: 1 });
+  const handler = createBridgeHandler({ bridgeAuth: auth, sessionStore: createSessionStore(), limiter, deadlineMs: 50 });
+  const held = new PassThrough();
+  held.method = 'POST';
+  held.url = '/challenge';
+  held.headers = { origin: APT_EXTENSION_ORIGIN };
+  const first = handler(held, responseHarness());
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(limiter.active, 1);
+  const rejected = responseHarness();
+  await handler(requestHarness({ url: '/challenge', body: JSON.stringify({ clientNonce: 'A'.repeat(43) }) }), rejected);
+  assert.equal(rejected.statusCode, 429);
+  held.end('{}');
+  await first;
+});
+
+test('pairing envelope persists encrypted with restrictive permissions and secrets are returned once', () => {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'apt-pairing-'));
+  const envelopePath = path.join(directory, 'bridge-pairing.json');
+  const protect = (value) => Buffer.from(`dpapi:${value}`);
+  const unprotect = (value) => Buffer.from(value).toString().slice('dpapi:'.length);
+  const controller = new PairingController({ envelopePath, protect, unprotect });
+
+  const first = controller.initialize();
+  assert.equal(first.paired, true);
+  assert.match(first.secret, /^[A-Za-z0-9_-]{43}$/);
+  assert.deepEqual(controller.getStatus(), { paired: true });
+  const persisted = loadPairingEnvelope(envelopePath, { protect, unprotect });
+  assert.equal(Object.values(persisted).includes(first.secret), false);
+  assert.equal(fs.readFileSync(envelopePath, 'utf8').includes(first.secret), false);
+  if (process.platform !== 'win32') assert.equal(fs.statSync(envelopePath).mode & 0o777, 0o600);
+
+  const rotated = controller.rotate();
+  assert.match(rotated.secret, /^[A-Za-z0-9_-]{43}$/);
+  assert.notEqual(rotated.secret, first.secret);
+  assert.deepEqual(controller.getStatus(), { paired: true });
+  controller.revoke();
+  assert.deepEqual(controller.getStatus(), { paired: false });
+  assert.equal(fs.existsSync(envelopePath), false);
+});
+
+test('pairing fails closed and reports unavailable without secure storage', () => {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'apt-pairing-unavailable-'));
+  const controller = new PairingController({ envelopePath: path.join(directory, 'bridge-pairing.json') });
+  assert.deepEqual(controller.initialize(), { paired: false, unavailable: true });
+  assert.deepEqual(controller.getStatus(), { paired: false, unavailable: true });
+  assert.throws(() => controller.rotate(), (error) => error.code === 'SECURE_STORAGE_UNAVAILABLE');
+});
+
+test('runtime reconciles exited children and permits relaunch for the same device', async () => {
+  const sessionStore = createSessionStore();
+  sessionStore.establish('https://customer.avasecurity.com', 'synthetic-cookie');
+  const deviceId = '550e8400-e29b-41d4-a716-446655440000';
+  const tracked = [];
+  let nextPid = 4101;
+  const runtime = new AppRuntime({
+    sessionStore,
+    altaClient: { getDevices: async () => [{ guid: deviceId }] },
+    proxyManager: {
+      launchProxy() {
+        const entry = { processId: nextPid++, deviceId, status: 'running', startedAt: 1 };
+        tracked.push(entry);
+        return { success: true, ...entry };
+      },
+      stopProxy() { throw new Error('unused'); },
+      listTrackedProxies() { return tracked.slice(); },
+    },
+  });
+  await runtime.getDevices();
+  assert.equal((await runtime.launchProxy(deviceId)).processId, 4101);
+  tracked.length = 0;
+  assert.deepEqual(runtime.getConnectionState().activeProxies, []);
+  assert.equal((await runtime.launchProxy(deviceId)).processId, 4102);
+});
+
+test('disconnect stops every owned proxy before clearing the Alta session', async () => {
+  const sessionStore = createSessionStore();
+  sessionStore.establish('https://customer.avasecurity.com', 'synthetic-cookie');
+  const tracked = [
+    { processId: 4101, deviceId: '550e8400-e29b-41d4-a716-446655440000', status: 'running', startedAt: 1 },
+    { processId: 4102, deviceId: '550e8400-e29b-41d4-a716-446655440001', status: 'running', startedAt: 1 },
+  ];
+  const stopped = [];
+  const runtime = new AppRuntime({
+    sessionStore,
+    altaClient: {},
+    proxyManager: {
+      listTrackedProxies() { return tracked.slice(); },
+      stopProxy(processId) {
+        stopped.push(processId);
+        tracked.splice(tracked.findIndex((entry) => entry.processId === processId), 1);
+        return { success: true, processId, status: 'stop-requested' };
+      },
+    },
+  });
+  const state = await runtime.disconnect();
+  assert.deepEqual(stopped, [4101, 4102]);
+  assert.equal(state.connected, false);
+  assert.deepEqual(state.activeProxies, []);
+});
+
+test('disconnect reports failure truthfully and retains session when an owned proxy cannot stop', async () => {
+  const sessionStore = createSessionStore();
+  sessionStore.establish('https://customer.avasecurity.com', 'synthetic-cookie');
+  const tracked = [{ processId: 4101, deviceId: '550e8400-e29b-41d4-a716-446655440000', status: 'running', startedAt: 1 }];
+  const runtime = new AppRuntime({
+    sessionStore,
+    altaClient: {},
+    proxyManager: {
+      listTrackedProxies() { return tracked.slice(); },
+      stopProxy() { return { success: false, processId: 4101, status: 'permission-denied' }; },
+    },
+  });
+  const state = await runtime.disconnect();
+  assert.equal(state.success, false);
+  assert.equal(state.connected, true);
+  assert.deepEqual(state.activeProxies.map((entry) => entry.processId), [4101]);
+});
+
+test('kill request without exit keeps proxy tracked and session connected until confirmed exit', async () => {
+  const { EventEmitter } = require('node:events');
+  const { createProxyManager } = require('../src/proxy-launch');
+  const sessionStore = createSessionStore();
+  sessionStore.establish('https://customer.avasecurity.com', 'synthetic-cookie');
+  const deviceId = '550e8400-e29b-41d4-a716-446655440000';
+  const child = new EventEmitter();
+  child.pid = 4101;
+  child.exitCode = null;
+  child.signalCode = null;
+  child.kill = () => true;
+  let timeoutCallback;
+  const proxyManager = createProxyManager({
+    appDirectory: 'C:\\Program Files\\Alta Proxy Tool',
+    fs: { existsSync: () => true },
+    spawn: () => child,
+    platform: 'win32',
+    stopTimeoutMs: 10,
+    setTimeout(callback) { timeoutCallback = callback; return 1; },
+    clearTimeout() {},
+  });
+  proxyManager.launchProxy({ deploymentHost: 'customer.avasecurity.com', cookie: 'synthetic-cookie', deviceId });
+  const runtime = new AppRuntime({ sessionStore, altaClient: {}, proxyManager });
+
+  const firstDisconnect = runtime.disconnect();
+  assert.equal(proxyManager.listTrackedProxies()[0].status, 'stopping');
+  timeoutCallback();
+  const failed = await firstDisconnect;
+  assert.equal(failed.success, false);
+  assert.equal(failed.connected, true);
+  assert.deepEqual(failed.activeProxies, [{ deviceId, processId: 4101 }]);
+
+  child.exitCode = 0;
+  child.emit('exit', 0, null);
+  const disconnected = await runtime.disconnect();
+  assert.equal(disconnected.success, true);
+  assert.equal(disconnected.connected, false);
+  assert.deepEqual(disconnected.activeProxies, []);
+});
+
+test('update runtime is check-only and opens only the fixed GitPeji releases page', async () => {
+  const opened = [];
+  const runtime = new AppRuntime({
+    sessionStore: createSessionStore(),
+    altaClient: {},
+    proxyManager: {},
+    checkForUpdate: async ({ currentVersion }) => ({ status: 'update-available', currentVersion, latestVersion: '1.1.0' }),
+    currentVersion: '1.0.0',
+    openExternal: async (url) => { opened.push(url); },
+  });
+  assert.deepEqual(await runtime.checkForUpdates(), {
+    success: true,
+    status: 'update-available',
+    currentVersion: '1.0.0',
+    latestVersion: '1.1.0',
+  });
+  assert.deepEqual(await runtime.openFixedReleasesPage(), { success: true });
+  assert.deepEqual(opened, ['https://git.pejicorp.com/peji/Alta-Proxy-Tool/releases']);
+});
+
+test('preload and renderer expose only narrow, credential-free contracts', () => {
+  const preload = read('preload.js');
+  const renderer = read('renderer.js');
+  const html = read('index.html');
+  const expectedMethods = [
+    'getDevices', 'getDeviceSites', 'getDeviceGroups', 'getDeviceHierarchy', 'getAuthInfo',
+    'launchProxy', 'stopProxy', 'disconnect',
+    'getConnectionState', 'checkForUpdates', 'openFixedReleasesPage', 'rotatePairing',
+    'revokePairing', 'getPairingStatus', 'onConnectionStateChanged',
+  ];
+  for (const method of expectedMethods) assert.match(preload, new RegExp(`\\b${method}\\b`));
+  assert.doesNotMatch(preload, /downloadAndInstall|download-and-install|onUpdateDownloadProgress|onExtensionCookie/);
+  assert.match(preload, /launchProxy:\s*\(deviceId\)/);
+  assert.doesNotMatch(preload, /launchProxy:\s*\([^)]*(?:cookie|origin)/i);
+  assert.doesNotMatch(renderer, /cookieValue|sessionData\.cookies|cookies\s*:/);
+  assert.match(renderer, /state\.connected\s*&&\s*\(!wasConnected\s*\|\|\s*state\.origin\s*!==\s*previousOrigin\)/);
+  assert.match(read('main.js'), /onConnectionStateChanged:\s*\(\)\s*=>\s*\{\s*runtime\.onSessionChanged\(\)/);
+  assert.doesNotMatch(html, /id="cookieKey"|id="altaUsername"|type="password"|updateProgress|Install Update/);
+  assert.match(html, /paired Chrome extension session/i);
+  assert.match(html, /id="pairingSection"[^>]*hidden/);
+  assert.match(html, /id="managePairingBtn"/);
+  assert.match(renderer, /shouldShowPairingOnboarding/);
+  assert.match(renderer, /openFixedReleasesPage/);
+  assert.match(html, /Bridge Pairing/);
+});
+
+test('Electron quit waits for confirmed cleanup and reports a safe failure instead of disposing', () => {
+  const main = read('main.js');
+  const beforeQuit = main.slice(main.indexOf("app.on('before-quit'"), main.indexOf("app.on('window-all-closed'"));
+  const preventIndex = beforeQuit.indexOf('event.preventDefault()');
+  const disconnectIndex = beforeQuit.indexOf('await runtime.disconnect()');
+  const activeCheckIndex = beforeQuit.indexOf('state.activeProxies.length > 0');
+  const disposeIndex = beforeQuit.indexOf('runtime.sessionStore.dispose()');
+  const confirmedQuitIndex = beforeQuit.indexOf('allowConfirmedQuit = true');
+  const quitIndex = beforeQuit.indexOf('app.quit()');
+
+  assert.ok(preventIndex >= 0 && preventIndex < disconnectIndex);
+  assert.ok(disconnectIndex < activeCheckIndex && activeCheckIndex < disposeIndex);
+  assert.ok(disposeIndex < confirmedQuitIndex && confirmedQuitIndex < quitIndex);
+  assert.match(main, /dialog\.showMessageBox/);
+  assert.match(main, /could not confirm that every proxy process exited/i);
+  assert.doesNotMatch(beforeQuit, /taskkill|pkill|wmic/i);
+});
+
+test('source policy removes legacy credential IPC, shell launch, broad kill, and executable updater', () => {
+  const production = ['main.js', 'preload.js', 'renderer.js', 'index.html', 'src/electron-runtime.js']
+    .map(read).join('\n');
+  const forbidden = [
+    /sanitizeBatchInput/, /taskkill/i, /\.bat\b/i, /download-and-install-update/,
+    /httpsGetFollowRedirects/, /api\.github\.com/i, /github releases/i,
+    /apt-local-bridge-token/, /X-APT-Token/, /cookie-proxy-/,
+  ];
+  for (const pattern of forbidden) assert.doesNotMatch(production, pattern);
+  assert.doesNotMatch(read('main.js'), /axios/);
+  assert.match(read('main.js'), /event\.sender === webContents/);
+  assert.match(read('main.js'), /frame === webContents\.mainFrame/);
+  assert.match(read('main.js'), /pathToFileURL\(path\.join\(__dirname, 'index\.html'\)\)/);
+  assert.match(read('main.js'), /127\.0\.0\.1/);
+  assert.match(read('main.js'), /18247/);
+  assert.match(read('main.js'), /shell\.openExternal/);
+});
+
+test('production source and documentation are GitPeji-only with no active GitHub workflow', () => {
+  assert.equal(fs.existsSync(path.join(ROOT, '.github', 'workflows', 'deploy-pages.yml')), false);
+  const sourceAndDocs = [
+    'main.js', 'preload.js', 'renderer.js', 'renderer-controller.js', 'index.html',
+    'src/electron-runtime.js', 'src/proxy-launch.js', 'README.md', 'CLAUDE.md',
+    'docs/security/2026-08-security-baseline.md',
+    'docs/plans/2026-08-19-apt-security-foundation.md',
+  ].map(read).join('\n');
+  assert.doesNotMatch(sourceAndDocs, /github/i);
+  assert.match(sourceAndDocs, /GitPeji/);
+});
diff --git a/test/session-store.test.js b/test/session-store.test.js
new file mode 100644
index 0000000..cd74ce5
--- /dev/null
+++ b/test/session-store.test.js
@@ -0,0 +1,58 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { SessionStore } = require('../src/session-store');
+
+const SENTINEL = 'HERMES_SENTINEL_SECRET';
+
+test('stores a canonical origin and cookie only in main-process memory', () => {
+  const store = new SessionStore();
+  store.establish('https://Tenant.AVASECURITY.com/', SENTINEL);
+
+  assert.deepEqual(store.describe(), {
+    connected: true,
+    origin: 'https://tenant.avasecurity.com',
+  });
+  assert.equal(JSON.stringify(store.describe()).includes(SENTINEL), false);
+
+  const session = store.requireSession();
+  assert.equal(session.origin, 'https://tenant.avasecurity.com');
+  assert.equal(session.cookie, SENTINEL);
+  assert.equal(Object.isFrozen(session), true);
+});
+
+test('rejects malformed and header-injecting cookies', () => {
+  const store = new SessionStore();
+  for (const cookie of ['', null, 12, 'secret\r\nX-Evil: yes', `x${'a'.repeat(4096)}`, 'abc\0def', 'token; injected=yes']) {
+    assert.throws(() => store.establish('https://tenant.avasecurity.com', cookie), {
+      code: 'INVALID_SESSION_COOKIE',
+    });
+  }
+  assert.equal(store.describe().connected, false);
+});
+
+test('does not replace a valid session when a new session is invalid', () => {
+  const store = new SessionStore();
+  store.establish('https://one.avasecurity.com', SENTINEL);
+  assert.throws(() => store.establish('https://evil.example', 'replacement'));
+  assert.equal(store.requireSession().origin, 'https://one.avasecurity.com');
+  assert.equal(store.requireSession().cookie, SENTINEL);
+});
+
+test('clear removes session references and dispose permanently closes the store', () => {
+  const store = new SessionStore();
+  store.establish('https://tenant.avigilon.com', SENTINEL);
+  store.clear();
+
+  assert.deepEqual(store.describe(), { connected: false, origin: null });
+  assert.throws(() => store.requireSession(), { code: 'NO_ALTA_SESSION' });
+
+  store.establish('https://tenant.avigilon.com', 'new-token');
+  store.dispose();
+  assert.deepEqual(store.describe(), { connected: false, origin: null });
+  assert.throws(() => store.establish('https://tenant.avigilon.com', 'again'), {
+    code: 'SESSION_STORE_DISPOSED',
+  });
+  assert.doesNotThrow(() => store.dispose());
+});
diff --git a/test/sidebar-controller.test.js b/test/sidebar-controller.test.js
new file mode 100644
index 0000000..d558e74
--- /dev/null
+++ b/test/sidebar-controller.test.js
@@ -0,0 +1,238 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { buildDeviceTree, flattenVisibleRows } = require('../device-tree');
+const { createInitialState, reduceSidebar, createSidebarController } = require('../sidebar-controller');
+
+function fixture() {
+  const model = buildDeviceTree({
+    sites: [{ id: 's', name: 'Site' }],
+    groups: [{ id: 'g', name: 'Group', parentId: 's' }],
+    devices: [
+      { id: 'a', name: 'Alpha', siteId: 's', deviceGroupId: 'g' },
+      { id: 'b', name: 'Beta', siteId: 's', deviceGroupId: 'g' },
+    ],
+  });
+  return model;
+}
+
+function visible(model, state) {
+  return flattenVisibleRows(model, state);
+}
+
+function fixtureKeys(model) {
+  const site = model.sites[0];
+  const group = site.groups[0];
+  const cameras = Object.fromEntries(group.cameras.map((camera) => [camera.canonicalId, camera.key]));
+  return { site: site.key, group: group.key, cameras };
+}
+
+test('reducer expands, navigates, selects, collapses, and preserves hidden selection', () => {
+  const model = fixture();
+  const keys = fixtureKeys(model);
+  let state = createInitialState();
+  let rows = visible(model, state);
+  state = reduceSidebar(state, { type: 'KEY', key: 'Home' }, rows);
+  assert.equal(state.activeKey, keys.site);
+  state = reduceSidebar(state, { type: 'KEY', key: 'ArrowRight' }, rows);
+  assert.ok(state.expandedKeys.has(keys.site));
+
+  rows = visible(model, state);
+  state = reduceSidebar(state, { type: 'KEY', key: 'ArrowDown' }, rows);
+  assert.equal(state.activeKey, keys.group);
+  state = reduceSidebar(state, { type: 'KEY', key: 'ArrowRight' }, rows);
+  rows = visible(model, state);
+  state = reduceSidebar(state, { type: 'KEY', key: 'ArrowDown' }, rows);
+  state = reduceSidebar(state, { type: 'KEY', key: 'Enter' }, rows);
+  assert.equal(state.selectedKey, keys.cameras.a);
+
+  state = reduceSidebar(state, { type: 'ACTIVATE', rowKey: keys.site }, rows);
+  assert.equal(state.selectedKey, keys.cameras.a);
+  assert.equal(visible(model, state).hiddenSelected, true);
+});
+
+test('keyboard Left/Right parent behavior, bounds, Space and Escape', () => {
+  const model = fixture();
+  const keys = fixtureKeys(model);
+  let state = createInitialState({
+    expandedKeys: new Set([keys.site, keys.group]),
+    activeKey: keys.cameras.a,
+    searchQuery: 'alpha',
+  });
+  let rows = visible(model, state);
+  state = reduceSidebar(state, { type: 'KEY', key: 'ArrowLeft' }, rows);
+  assert.equal(state.activeKey, keys.group);
+  state = reduceSidebar(state, { type: 'KEY', key: 'ArrowLeft' }, rows);
+  assert.equal(state.expandedKeys.has(keys.group), false);
+  state = reduceSidebar(state, { type: 'KEY', key: 'End' }, visible(model, state));
+  assert.equal(state.activeKey, keys.group);
+  state = reduceSidebar(state, { type: 'KEY', key: ' ' }, visible(model, state));
+  assert.equal(state.expandedKeys.has(keys.group), true);
+  state = reduceSidebar(state, { type: 'KEY', key: 'Escape' }, visible(model, state));
+  assert.equal(state.searchQuery, '');
+});
+
+test('malformed and unknown delegated row keys are no-ops', () => {
+  const model = fixture();
+  const state = createInitialState({ activeKey: fixtureKeys(model).site });
+  const rows = visible(model, state);
+  assert.equal(reduceSidebar(state, { type: 'ACTIVATE', rowKey: '__proto__' }, rows), state);
+  assert.equal(reduceSidebar(state, { type: 'CLICK', rowKey: 'camera:not-there' }, rows), state);
+});
+
+test('controller commits exactly once per dispatch through view adapter', () => {
+  const model = fixture();
+  const keys = fixtureKeys(model);
+  const commits = [];
+  const view = { commit: (snapshot) => commits.push(snapshot) };
+  const controller = createSidebarController({ model, view, rowHeight: 28, overscan: 3 });
+  assert.equal(commits.length, 1);
+  controller.dispatch({ type: 'ACTIVATE', rowKey: keys.site });
+  assert.equal(commits.length, 2);
+  assert.equal(commits[1].state.expandedKeys.has(keys.site), true);
+  assert.ok(Array.isArray(commits[1].window.rows));
+  const modelReference = controller.getSnapshot().rows;
+  controller.refresh();
+  assert.equal(commits.length, 3);
+  assert.notEqual(controller.getSnapshot().rows, modelReference);
+  assert.equal(controller.getSnapshot().rows.length, modelReference.length);
+});
+
+test('active and selected state survive virtualization and selection is indicated when hidden', () => {
+  const model = fixture();
+  const keys = fixtureKeys(model);
+  const commits = [];
+  const controller = createSidebarController({ model, view: { commit: (value) => commits.push(value) } });
+  controller.dispatch({ type: 'SET_SELECTION', rowKey: keys.cameras.b });
+  controller.dispatch({ type: 'SET_VIEWPORT', scrollTop: 9999, viewportHeight: 20 });
+  const snapshot = commits.at(-1);
+  assert.equal(snapshot.state.selectedKey, keys.cameras.b);
+  assert.equal(snapshot.rows.hiddenSelected, true);
+});
+
+test('controller search temporarily expands matches with one completion commit', async () => {
+  const model = fixture();
+  const keys = fixtureKeys(model);
+  const commits = [];
+  const scheduled = [];
+  const controller = createSidebarController({
+    model,
+    view: { commit: (value) => commits.push(value) },
+    scheduler: (work) => scheduled.push(work),
+    chunkSize: 1,
+  });
+  const pending = controller.search('beta group');
+  while (scheduled.length) scheduled.shift()();
+  const result = await pending;
+  assert.equal(result.count, 1);
+  assert.equal(commits.length, 2);
+  assert.deepEqual(commits.at(-1).rows.map((row) => row.key), [keys.site, keys.group, keys.cameras.b]);
+  assert.equal(controller.getState().expandedKeys.size, 0);
+});
+
+test('first arrow press chooses the directional edge when no row is active', () => {
+  const model = buildDeviceTree({
+    sites: [{ id: 'b', name: 'B' }, { id: 'a', name: 'A' }, { id: 'c', name: 'C' }],
+  });
+  const rows = visible(model, createInitialState());
+  assert.equal(reduceSidebar(createInitialState(), { type: 'KEY', key: 'ArrowDown' }, rows).activeKey, rows[0].key);
+  assert.equal(reduceSidebar(createInitialState(), { type: 'KEY', key: 'ArrowUp' }, rows).activeKey, rows.at(-1).key);
+});
+
+test('manual viewport scrolling may virtualize selection until keyboard navigation restores the active row', () => {
+  const model = buildDeviceTree({
+    sites: [{ id: 'large', name: 'Large' }],
+    groups: [],
+    devices: Array.from({ length: 1500 }, (_, index) => ({
+      id: `c${String(index).padStart(4, '0')}`,
+      name: `Camera ${String(index).padStart(4, '0')}`,
+      siteId: 'large',
+    })),
+  });
+  const site = model.sites[0];
+  const group = site.groups[0];
+  const firstCamera = group.cameras[0];
+  const controller = createSidebarController({
+    model,
+    view: { commit() {} },
+    rowHeight: 20,
+    overscan: 0,
+    initialState: { expandedKeys: new Set([site.key, group.key]), viewportHeight: 100 },
+  });
+
+  controller.dispatch({ type: 'SET_SELECTION', rowKey: firstCamera.key });
+  controller.dispatch({ type: 'SET_VIEWPORT', scrollTop: 30000, viewportHeight: 100 });
+  let snapshot = controller.getSnapshot();
+  assert.equal(snapshot.state.selectedKey, firstCamera.key);
+  assert.equal(snapshot.state.activeKey, firstCamera.key);
+  assert.equal(snapshot.state.scrollTop, 29940);
+  assert.equal(snapshot.window.rows.some((row) => row.key === firstCamera.key), false);
+  assert.equal(snapshot.rows.hiddenSelected, false);
+
+  controller.dispatch({ type: 'KEY', key: 'Home' });
+  snapshot = controller.getSnapshot();
+  assert.equal(snapshot.state.activeKey, site.key);
+  assert.equal(snapshot.state.scrollTop, 0);
+  assert.equal(snapshot.window.rows.some((row) => row.key === site.key), true);
+});
+
+test('collapse clamps stale scroll and keyboard navigation scrolls active rows into the virtual window', () => {
+  const model = buildDeviceTree({
+    sites: [{ id: 'large', name: 'Large' }],
+    groups: [],
+    devices: Array.from({ length: 500 }, (_, index) => ({ id: `c${index}`, name: `Camera ${index}`, siteId: 'large' })),
+  });
+  const site = model.sites[0];
+  const group = site.groups[0];
+  const controller = createSidebarController({
+    model,
+    view: { commit() {} },
+    rowHeight: 20,
+    overscan: 0,
+    initialState: { expandedKeys: new Set([site.key, group.key]), scrollTop: 10000, viewportHeight: 100 },
+  });
+
+  controller.dispatch({ type: 'ACTIVATE', rowKey: site.key });
+  let snapshot = controller.getSnapshot();
+  assert.deepEqual(snapshot.window.rows.map((row) => row.key), [site.key]);
+  assert.equal(snapshot.state.scrollTop, 0);
+
+  controller.dispatch({ type: 'ACTIVATE', rowKey: site.key });
+  controller.dispatch({ type: 'SET_ACTIVE', rowKey: site.key });
+  controller.dispatch({ type: 'KEY', key: 'End' });
+  snapshot = controller.getSnapshot();
+  assert.equal(snapshot.window.rows.some((row) => row.key === snapshot.state.activeKey), true);
+  assert.ok(snapshot.state.scrollTop > 0);
+});
+
+test('search expansion controls rendered temporary state and restores saved expansion', async () => {
+  const model = fixture();
+  const scheduled = [];
+  const site = model.sites[0];
+  const group = site.groups[0];
+  const controller = createSidebarController({
+    model,
+    view: { commit() {} },
+    scheduler: (work) => scheduled.push(work),
+    initialState: { expandedKeys: new Set([site.key]) },
+  });
+  const pending = controller.search('alpha');
+  while (scheduled.length) scheduled.shift()();
+  await pending;
+
+  controller.dispatch({ type: 'SET_ACTIVE', rowKey: group.key });
+  controller.dispatch({ type: 'KEY', key: 'ArrowLeft' });
+  assert.equal(controller.getState().searchExpandedKeys.has(group.key), false);
+  assert.equal(controller.getSnapshot().rows.some((row) => row.kind === 'camera'), false);
+  assert.deepEqual(controller.getState().expandedKeys, new Set([site.key]));
+
+  controller.dispatch({ type: 'KEY', key: 'ArrowRight' });
+  assert.equal(controller.getState().searchExpandedKeys.has(group.key), true);
+  assert.equal(controller.getSnapshot().rows.some((row) => row.kind === 'camera'), true);
+  assert.deepEqual(controller.getState().expandedKeys, new Set([site.key]));
+
+  await controller.search('');
+  assert.deepEqual(controller.getState().expandedKeys, new Set([site.key]));
+  assert.equal(controller.getState().searchExpandedKeys, null);
+});
diff --git a/test/update-policy.test.js b/test/update-policy.test.js
new file mode 100644
index 0000000..9a24a4c
--- /dev/null
+++ b/test/update-policy.test.js
@@ -0,0 +1,257 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const test = require('node:test');
+const { EventEmitter } = require('node:events');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const {
+  LATEST_RELEASE_URL,
+  RELEASES_PAGE_URL,
+  MAX_BODY_BYTES,
+  checkForUpdate,
+  compareSemver,
+  defaultRequest,
+} = require('../src/update-policy');
+
+function response(body, overrides = {}) {
+  return {
+    statusCode: 200,
+    headers: { 'content-type': 'application/json; charset=utf-8' },
+    body: Buffer.from(body),
+    url: LATEST_RELEASE_URL,
+    ...overrides,
+  };
+}
+
+async function rejectsWithCode(promise, code) {
+  await assert.rejects(promise, (error) => {
+    assert.equal(error.code, code);
+    return true;
+  });
+}
+
+test('accepts a live-shape GitPeji v-tag and normalizes it to bare semver', async () => {
+  const fixture = fs.readFileSync(
+    path.join(__dirname, 'fixtures', 'gitpeji-latest-release.json'),
+    'utf8',
+  );
+
+  const result = await checkForUpdate({
+    currentVersion: '0.9.0',
+    request: async () => response(fixture),
+    platform: 'win32',
+    arch: 'x64',
+  });
+
+  assert.equal(result.status, 'update-available');
+  assert.equal(result.latestVersion, '1.0.0');
+  assert.equal(result.releaseName, 'Alta Proxy Tool v1.0.0');
+});
+
+test('valid update returns only sanitized, check-only metadata', async () => {
+  let requestOptions;
+  const request = async (options) => {
+    requestOptions = options;
+    return response(JSON.stringify({
+      id: 42,
+      tag_name: '1.2.3',
+      name: '  Security <Release>  ',
+      published_at: '2026-08-19T12:34:56Z',
+      body: 'untrusted release notes',
+      html_url: 'https://evil.example/download',
+      assets: [{ browser_download_url: 'https://evil.example/payload.exe' }],
+    }));
+  };
+
+  const result = await checkForUpdate({
+    currentVersion: '1.2.2',
+    request,
+    platform: 'win32',
+    arch: 'x64',
+  });
+
+  assert.deepEqual(requestOptions, {
+    url: LATEST_RELEASE_URL,
+    timeoutMs: 5000,
+    maxBodyBytes: MAX_BODY_BYTES,
+    redirects: 'error',
+  });
+  assert.deepEqual(result, {
+    status: 'update-available',
+    currentVersion: '1.2.2',
+    latestVersion: '1.2.3',
+    releaseName: 'Security &lt;Release&gt;',
+    publishedAt: '2026-08-19T12:34:56.000Z',
+    releasesPageUrl: RELEASES_PAGE_URL,
+    platform: 'win32',
+    arch: 'x64',
+  });
+  assert.equal(JSON.stringify(result).includes('payload.exe'), false);
+  assert.equal(JSON.stringify(result).includes('release notes'), false);
+});
+
+test('equal or older release is reported as up to date', async () => {
+  const request = async () => response(JSON.stringify({
+    tag_name: '2.0.0',
+    name: 'Current',
+    published_at: '2026-08-19T12:34:56Z',
+  }));
+
+  const result = await checkForUpdate({ currentVersion: '2.0.0', request });
+  assert.equal(result.status, 'up-to-date');
+  assert.equal(result.releasesPageUrl, RELEASES_PAGE_URL);
+});
+
+test('404 means there is no published release', async () => {
+  const request = async () => response('', { statusCode: 404 });
+  const result = await checkForUpdate({ currentVersion: '1.0.0', request });
+
+  assert.deepEqual(result, {
+    status: 'no-release',
+    currentVersion: '1.0.0',
+    releasesPageUrl: RELEASES_PAGE_URL,
+    platform: process.platform,
+    arch: process.arch,
+  });
+});
+
+test('malformed JSON and invalid response schema fail closed', async () => {
+  await rejectsWithCode(
+    checkForUpdate({ currentVersion: '1.0.0', request: async () => response('{') }),
+    'INVALID_RESPONSE',
+  );
+  await rejectsWithCode(
+    checkForUpdate({ currentVersion: '1.0.0', request: async () => response('[]') }),
+    'INVALID_RESPONSE',
+  );
+  await rejectsWithCode(
+    checkForUpdate({
+      currentVersion: '1.0.0',
+      request: async () => response(JSON.stringify({ tag_name: '1.1.0', name: 7 })),
+    }),
+    'INVALID_RESPONSE',
+  );
+});
+
+test('oversized bodies fail before parsing', async () => {
+  const oversized = Buffer.alloc(MAX_BODY_BYTES + 1, 0x20);
+  await rejectsWithCode(
+    checkForUpdate({
+      currentVersion: '1.0.0',
+      request: async () => response('', { body: oversized }),
+    }),
+    'RESPONSE_TOO_LARGE',
+  );
+});
+
+test('redirects and response host drift are rejected', async () => {
+  await rejectsWithCode(
+    checkForUpdate({
+      currentVersion: '1.0.0',
+      request: async () => response('', {
+        statusCode: 302,
+        headers: { location: 'https://evil.example/latest' },
+      }),
+    }),
+    'REDIRECT_REJECTED',
+  );
+
+  await rejectsWithCode(
+    checkForUpdate({
+      currentVersion: '1.0.0',
+      request: async () => response('{}', { url: 'https://evil.example/latest' }),
+    }),
+    'UNTRUSTED_RESPONSE_URL',
+  );
+});
+
+test('invalid or non-strict semver fails closed', async () => {
+  const invalidVersions = [
+    'V1.2.3',
+    'vv1.2.3',
+    ' v1.2.3',
+    'v1.2.3 ',
+    'v1.2',
+    'v01.2.3',
+    'v1.2.3.4',
+    'vlatest',
+    '1.2',
+    '01.2.3',
+    '1.2.3.4',
+    'latest',
+  ];
+
+  for (const tag_name of invalidVersions) {
+    await rejectsWithCode(
+      checkForUpdate({
+        currentVersion: '1.0.0',
+        request: async () => response(JSON.stringify({ tag_name })),
+      }),
+      'INVALID_RELEASE_VERSION',
+    );
+  }
+
+  await rejectsWithCode(
+    checkForUpdate({ currentVersion: 'v1.0.0', request: async () => response('{}') }),
+    'INVALID_CURRENT_VERSION',
+  );
+});
+
+test('strict semver comparison handles prerelease precedence', () => {
+  assert.equal(compareSemver('1.0.0', '1.0.0'), 0);
+  assert.equal(compareSemver('1.0.1', '1.0.0'), 1);
+  assert.equal(compareSemver('1.0.0-alpha.2', '1.0.0-alpha.10'), -1);
+  assert.equal(compareSemver('1.0.0-rc.1', '1.0.0'), -1);
+  assert.equal(compareSemver('2.0.0+build.1', '2.0.0+build.2'), 0);
+});
+
+test('unexpected HTTP and content types fail closed', async () => {
+  await rejectsWithCode(
+    checkForUpdate({
+      currentVersion: '1.0.0',
+      request: async () => response('server error', { statusCode: 500 }),
+    }),
+    'HTTP_ERROR',
+  );
+  await rejectsWithCode(
+    checkForUpdate({
+      currentVersion: '1.0.0',
+      request: async () => response('{}', { headers: { 'content-type': 'text/html' } }),
+    }),
+    'INVALID_CONTENT_TYPE',
+  );
+});
+
+test('default transport enforces an absolute deadline despite trickled response bytes', async () => {
+  const request = new EventEmitter();
+  const responseStream = new EventEmitter();
+  request.destroyedWith = null;
+  responseStream.destroyed = false;
+  request.destroy = (error) => { request.destroyedWith = error; request.emit('error', error); };
+  request.setTimeout = () => { throw new Error('inactivity timeout must not be used'); };
+  responseStream.destroy = () => { responseStream.destroyed = true; };
+  responseStream.headers = { 'content-type': 'application/json' };
+  responseStream.statusCode = 200;
+  let deadline;
+  let cleared = false;
+  const pending = defaultRequest({
+    url: LATEST_RELEASE_URL,
+    timeoutMs: 5000,
+    maxBodyBytes: MAX_BODY_BYTES,
+    httpsGet: (_url, _options, onResponse) => {
+      onResponse(responseStream);
+      return request;
+    },
+    setTimer: (callback, milliseconds) => { assert.equal(milliseconds, 5000); deadline = callback; return 7; },
+    clearTimer: (timer) => { assert.equal(timer, 7); cleared = true; },
+  });
+  responseStream.emit('data', Buffer.from('{'));
+  responseStream.emit('data', Buffer.from(' '));
+  deadline();
+  await rejectsWithCode(pending, 'REQUEST_TIMEOUT');
+  assert.equal(responseStream.destroyed, true);
+  assert.equal(request.destroyedWith.code, 'REQUEST_TIMEOUT');
+  assert.equal(cleared, true);
+});
diff --git a/test/url-policy.test.js b/test/url-policy.test.js
new file mode 100644
index 0000000..5b4f1d7
--- /dev/null
+++ b/test/url-policy.test.js
@@ -0,0 +1,57 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const {
+  canonicalizeAltaOrigin,
+  isAltaOrigin,
+} = require('../src/url-policy');
+
+test('accepts and canonicalizes HTTPS Alta deployment subdomains', () => {
+  assert.equal(canonicalizeAltaOrigin('https://Example.AVASECURITY.com/'), 'https://example.avasecurity.com');
+  assert.equal(canonicalizeAltaOrigin('https://edge.eu.avigilon.com:443'), 'https://edge.eu.avigilon.com');
+  assert.equal(isAltaOrigin('https://tenant.avasecurity.com'), true);
+});
+
+test('rejects roots, lookalikes, HTTP, and arbitrary exfiltration destinations', () => {
+  for (const value of [
+    'https://avasecurity.com',
+    'https://avigilon.com',
+    'https://avasecurity.com.evil.example',
+    'https://tenant.avasecurity.com.evil.example',
+    'https://evilavasecurity.com',
+    'http://tenant.avasecurity.com',
+    'https://example.com',
+    'file:///etc/passwd',
+  ]) {
+    assert.throws(() => canonicalizeAltaOrigin(value), { code: 'INVALID_ALTA_ORIGIN' }, value);
+  }
+});
+
+test('rejects authority tricks, fragments, paths, queries and non-default ports', () => {
+  for (const value of [
+    'https://user:pass@tenant.avasecurity.com',
+    'https://tenant.avasecurity.com/#fragment',
+    'https://tenant.avasecurity.com/api/v1/devices',
+    'https://tenant.avasecurity.com?next=https://evil.example',
+    'https://tenant.avasecurity.com:8443',
+    'https://tenant.avasecurity.com\\@evil.example',
+  ]) {
+    assert.throws(() => canonicalizeAltaOrigin(value), { code: 'INVALID_ALTA_ORIGIN' }, value);
+  }
+});
+
+test('rejects CRLF, whitespace, non-strings, oversized and malformed values', () => {
+  for (const value of [
+    'https://tenant.avasecurity.com\r\nX-Test: injected',
+    ' https://tenant.avasecurity.com',
+    'https://tenant.avasecurity.com ',
+    'not a URL',
+    '',
+    null,
+    7,
+    `https://${'a'.repeat(513)}.avasecurity.com`,
+  ]) {
+    assert.throws(() => canonicalizeAltaOrigin(value), { code: 'INVALID_ALTA_ORIGIN' }, String(value));
+  }
+});
diff --git a/well-formed-string.js b/well-formed-string.js
new file mode 100644
index 0000000..3dfb60c
--- /dev/null
+++ b/well-formed-string.js
@@ -0,0 +1,42 @@
+'use strict';
+
+(function exposeWellFormedString(root, factory) {
+  const api = factory();
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+  if (root) root.AptWellFormedString = api;
+}(typeof window !== 'undefined' ? window : undefined, function wellFormedStringFactory() {
+  function manualToWellFormed(value) {
+    let result = '';
+    for (let index = 0; index < value.length; index += 1) {
+      const codeUnit = value.charCodeAt(index);
+      if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
+        const next = value.charCodeAt(index + 1);
+        if (next >= 0xdc00 && next <= 0xdfff) {
+          result += value[index] + value[index + 1];
+          index += 1;
+        } else {
+          result += '\ufffd';
+        }
+      } else if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
+        result += '\ufffd';
+      } else {
+        result += value[index];
+      }
+    }
+    return result;
+  }
+
+  function toWellFormedString(value, fallback = '') {
+    let string;
+    try {
+      string = String(value);
+    } catch {
+      string = String(fallback);
+    }
+    return typeof string.toWellFormed === 'function'
+      ? string.toWellFormed()
+      : manualToWellFormed(string);
+  }
+
+  return Object.freeze({ toWellFormedString });
+}));