diff --git a/Cargo.lock b/Cargo.lock
index d9d285dc99..a2439cffe2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8847,8 +8847,6 @@ dependencies = [
 [[package]]
 name = "tauri-plugin-updater"
 version = "2.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "806d9dac662c2e4594ff03c647a552f2c9bd544e7d0f683ec58f872f952ce4af"
 dependencies = [
  "base64 0.22.1",
  "dirs",
diff --git a/Cargo.toml b/Cargo.toml
index a8a21f4147..6303e6325f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,9 +1,11 @@
 [workspace]
 resolver = "2"
 members = ["src-tauri", "crates/dbx-core", "crates/dbx-web", "crates/dbx-mcp", "crates/dbx-cli", "crates/dbx-sqlite-worker"]
-exclude = ["vendor/ctor", "vendor/dirs-sys", "vendor/pageant", "vendor/rumqttc", "vendor/tiberius", "vendor/wry"]
+exclude = ["vendor/tauri-plugin-updater", "vendor/ctor", "vendor/dirs-sys", "vendor/pageant", "vendor/rumqttc", "vendor/tiberius", "vendor/wry"]
 
 [patch.crates-io]
+# Offline signed update restoration and checked Windows installer launch.
+tauri-plugin-updater = { path = "vendor/tauri-plugin-updater" }
 # Tauri 2.11 uses ctor 0.8, which excludes Rust's win7 vendor. This vendors
 # upstream rust-ctor#443 until tauri-utils moves to ctor 1.x.
 ctor = { path = "vendor/ctor" }
diff --git a/README.zh-CN.md b/README.zh-CN.md
index b413db3472..c08c8e21a2 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -526,7 +526,7 @@ DBX 是免费开源项目，但持续维护、数据库兼容性测试、基础
 
 <details>
 <summary><strong>DBX 会收集用户数据吗？</strong></summary>
-不会。DBX 不收集任何遥测数据。自动更新功能仅检查 GitHub Releases 获取新版本——你可以在设置中禁用它。
+不会。DBX 不收集任何遥测数据。开启更新通知时，桌面端会通过所选更新源检查新版本并静默下载安装包；下载并校验完成后，更新入口显示提示，只有点击“重启并更新”才会安装。已下载的安装包会保留到下次启动，也可忽略该版本。你可以在设置中关闭自动检查和下载。
 </details>
 
 <details>
diff --git a/apps/desktop/src/App.vue b/apps/desktop/src/App.vue
index ecf041c34c..0fd1e52d19 100644
--- a/apps/desktop/src/App.vue
+++ b/apps/desktop/src/App.vue
@@ -1,4 +1,6 @@
 <script setup lang="ts">
+import { blockingDesktopAiRunsForUpdate } from "@/lib/ai/desktopAiRunRegistry";
+import { setupUpdatePreparation, prepareUpdateWithDraftRecovery, isUpdatePreparationActive } from "@/lib/app/updatePreparation";
 import { ref, computed, watch, onMounted, onUnmounted, nextTick, defineAsyncComponent, provide } from "vue";
 import { useI18n } from "vue-i18n";
 import { FileText } from "@lucide/vue";
@@ -202,6 +204,9 @@ const { isDark, themeMode, applyTheme, setThemeMode } = useTheme();
 const { activeCount: activeBackgroundTaskCount } = useExportTracker();
 const trackedUpdateTaskCount = computed(() => countActiveUpdateBlockingTasks(activeBackgroundTaskCount.value, queryStore.tabs));
 const {
+  initialize: initializeUpdater,
+  dispose: disposeUpdater,
+  isPreparingUpdate,
   checkingUpdates,
   updateInfo,
   updateCheckMessage,
@@ -226,6 +231,10 @@ const {
   restartApp,
 } = useAppUpdater({
   getActiveTaskCount: () => trackedUpdateTaskCount.value,
+  prepareForUpdate: async () => {
+    if (!updatePreparation) throw new Error(t("updates.preparationNotReady"));
+    return prepareUpdateWithDraftRecovery(() => updatePreparation!.prepare());
+  },
 });
 const { setupFileDrop } = useFileDrop();
 const { openInStreamingExecutorOnTooLarge } = useLargeSqlFileStreamingFallback();
@@ -234,6 +243,55 @@ const isDesktop = isTauriRuntime();
 const windowContext = resolveWindowContext();
 const isDetachedWindowContext = windowContext.kind === "detached-tab";
 const detachedContextTabId = windowContext.kind === "detached-tab" ? windowContext.tabId : undefined;
+let updateWindowReady = false;
+let updatePreparation: Awaited<ReturnType<typeof setupUpdatePreparation>> | undefined;
+async function initializeUpdatePreparation() {
+  if (!isDesktop || updatePreparation) return;
+  updatePreparation = await setupUpdatePreparation({
+    translate: (key) => t(key),
+    assertSafe() {
+      if (!updateWindowReady) throw new Error(t("updates.preparationNotReady"));
+      if (trackedUpdateTaskCount.value > 0 || blockingDesktopAiRunsForUpdate().length > 0 || queryStore.tabs.some((tab) => tab.isCancelling || tab.isExplaining || tab.txnSessionId)) {
+        throw new Error(t("updates.preparationTasks"));
+      }
+      if (queryStore.tabs.some((tab) => (tab.pendingDataChangeCount ?? 0) > 0 || tab.hasPendingDataEditorDraft)) {
+        throw new Error(t("updates.preparationDrafts"));
+      }
+      if (
+        pendingAppCloseAction.value ||
+        showConnectionDialog.value ||
+        showSaveSqlDialog.value ||
+        showQueryEditorDdlDialog.value ||
+        showQueryEditorObjectSourceDialog.value ||
+        showSqlParameterDialog.value ||
+        showDangerDialog.value ||
+        showMultiDbExecuteDialog.value ||
+        [
+          dialogs.showTransferDialog,
+          dialogs.showSqlFileDialog,
+          dialogs.showTableImportDialog,
+          dialogs.showTableDataGenerateDialog,
+          dialogs.showDatabaseExportDialog,
+          dialogs.showSchemaDiffDialog,
+          dialogs.showDataCompareDialog,
+          dialogs.showConfigPassphraseDialog,
+          dialogs.showConfigConnectionSelectDialog,
+          dialogs.showConfigUnencryptedExportConfirm,
+          dialogs.showImportLayoutConfirm,
+          dialogs.configExportBusy,
+          dialogs.applyingImportSelection,
+        ].some((state) => state.value)
+      ) {
+        throw new Error(t("updates.preparationConfig"));
+      }
+    },
+    async persist() {
+      await nextTick();
+      await queryStore.flushPendingPersist();
+    },
+  });
+}
+
 const activeAiRunCount = computed(() => (isDesktop ? activeDesktopAiRuns().length : 0));
 /** Runs waiting for a write confirmation — the panel-entry badge shows these
  *  with a higher-priority indicator (parent PRD §4 line 71 / §9). */
@@ -265,7 +323,7 @@ const driverStoreActive = ref(false);
 const driverStoreActiveTab = ref<"agent" | "jdbc" | "storage" | "runtime">("agent");
 const settingsReturnSurface = ref<"query" | "driverStore" | "welcome">("welcome");
 const showDriverStore = computed(() => driverStoreTabOpen.value && driverStoreActive.value);
-const showSettingsPage = computed(() => settingsPageTabOpen.value && settingsStore.settingsPageActive);
+const showSettingsPage = computed(() => Boolean(settingsPageTabOpen.value && settingsStore.settingsPageActive));
 const showQuickOpen = ref(false);
 const showTabSwitcher = ref(false);
 const tabSwitcherIndex = ref(0);
@@ -1542,6 +1600,7 @@ function cancelPendingAppClose() {
 }
 
 async function finishPendingAppClose(action: AppCloseAction) {
+  if (isUpdatePreparationActive()) return;
   if (action === "quit" && !aiRunsQuitConfirmed && blockingAiRunCount.value > 0) {
     pendingAppCloseAction.value = action;
     showAiRunsClosePrompt.value = true;
@@ -1594,6 +1653,7 @@ function continuePendingAppCloseAfterSave() {
 }
 
 function requestAppClose(action: AppCloseAction, options: AppCloseRequestOptions = {}) {
+  if (isUpdatePreparationActive()) return;
   pendingCloseActionChoice.value = !!options.requireCloseActionChoice;
   if (queryStore.hasDirtyTabs) {
     pendingAppCloseAction.value = action;
@@ -3216,6 +3276,11 @@ async function initApp() {
       });
     }
     await settingsStore.initDesktopSettings().catch(() => {});
+    if (isDesktop) {
+      updateWindowReady = true;
+      await initializeUpdatePreparation();
+      await initializeUpdater();
+    }
 
     void promptTemplateStore.init();
 
@@ -3281,7 +3346,6 @@ function openDriverStoreFromEvent(event: Event) {
 
 function runUpdateNotificationChecks() {
   if (!updateNotificationsEnabled.value) return;
-  checkUpdates({ silent: true });
   void refreshAgentDriverUpdateCount();
   void refreshMcpUpdateStatus();
 }
@@ -3306,12 +3370,17 @@ onMounted(async () => {
   console.log("[STARTUP] onMounted begin");
   const mountStart = performance.now();
   if (isDetachedWindowContext) {
+    await initializeUpdatePreparation();
     await setupDetachedWindowEvents();
-    await initDetachedWindow().catch((error) => {
-      console.error("[STARTUP] detached window initialization failed", error);
-      toast(error?.message || String(error), 5000);
-      void finishDetachedWindowClose();
-    });
+    await initDetachedWindow()
+      .then(() => {
+        updateWindowReady = true;
+      })
+      .catch((error) => {
+        console.error("[STARTUP] detached window initialization failed", error);
+        toast(error?.message || String(error), 5000);
+        void finishDetachedWindowClose();
+      });
     return;
   }
   requestAnimationFrame(() => {
@@ -3390,6 +3459,8 @@ onMounted(async () => {
 });
 
 onUnmounted(() => {
+  disposeUpdater();
+  updatePreparation?.dispose();
   detachedEventUnlisteners.forEach((unlisten) => unlisten());
   detachedEventUnlisteners = [];
   cleanupTauriListeners();
@@ -3439,6 +3510,7 @@ onUnmounted(() => {
           :has-update-available="toolbarHasUpdateAvailable"
           :is-downloading-update="isDownloadingUpdate"
           :download-progress="downloadProgress"
+          :update-version="updateInfo?.latest_version"
           :update-ready-to-install="updateDownloaded"
           :update-ready="updateReady"
           :agent-driver-update-count="toolbarAgentDriverUpdateCount"
@@ -3814,6 +3886,7 @@ onUnmounted(() => {
           :is-downloading-update="isDownloadingUpdate"
           :download-progress="downloadProgress"
           :update-downloaded="updateDownloaded"
+          :is-preparing-update="isPreparingUpdate"
           :is-installing-update="isInstallingUpdate"
           :update-ready="updateReady"
           :is-ignoring-update="isIgnoringUpdate"
diff --git a/apps/desktop/src/components/grid/DataGrid.vue b/apps/desktop/src/components/grid/DataGrid.vue
index 2f04441d6d..e72fc160d1 100644
--- a/apps/desktop/src/components/grid/DataGrid.vue
+++ b/apps/desktop/src/components/grid/DataGrid.vue
@@ -1,4 +1,5 @@
 <script setup lang="ts">
+import { useUpdateBlocker } from "@/lib/app/updatePreparation";
 import { computed, nextTick, onMounted, onUnmounted, onActivated, onDeactivated, ref, shallowRef, toRaw, useSlots, watch, defineAsyncComponent, type Component, type CSSProperties } from "vue";
 import { useI18n } from "vue-i18n";
 import {
@@ -11365,6 +11366,7 @@ function openGridSnapshot() {
   };
   gridSnapshotOpen.value = true;
 }
+useUpdateBlocker(() => (hasPendingChanges.value || hasPendingDataEditorDraft.value || isSaving.value ? t("updates.preparationDrafts") : undefined));
 </script>
 
 <template>
diff --git a/apps/desktop/src/components/layout/AppToolbar.vue b/apps/desktop/src/components/layout/AppToolbar.vue
index 8b8602e008..37fa34ef55 100644
--- a/apps/desktop/src/components/layout/AppToolbar.vue
+++ b/apps/desktop/src/components/layout/AppToolbar.vue
@@ -40,6 +40,7 @@ const props = defineProps<{
   showDriverStore: boolean;
   showSettingsPage: boolean;
   checkingUpdates: boolean;
+  updateVersion?: string;
   hasUpdateAvailable: boolean;
   isDownloadingUpdate: boolean;
   downloadProgress: number | null;
@@ -75,15 +76,12 @@ const { toast } = useToast();
 const settingsStore = useSettingsStore();
 const toolbarItems = computed(() => settingsStore.editorSettings.toolbarItems);
 const { isMac, isDesktop, showControls, isMaximized, isFullscreen, minimize, toggleMaximize, close } = useWindowControls();
-const checkingUpdates = computed(() => props.checkingUpdates);
 const updateTooltip = computed(() => {
-  if (props.isDownloadingUpdate) return t("updates.downloading", { progress: props.downloadProgress ?? 0 });
-  if (props.updateReady) return t("updates.restartRequiredTooltip");
-  if (props.updateReadyToInstall) return t("updates.updateReadyTooltip");
+  if (props.hasUpdateAvailable && props.updateReady) return t("updates.restartRequiredTooltip");
+  if (props.hasUpdateAvailable && props.updateReadyToInstall) return t("updates.downloadedReady", { version: props.updateVersion ?? "" });
   return t("updates.check");
 });
-// ToolbarUpdateIcon takes a 0..1 fraction, with null meaning the download size is unknown.
-const updateDownloadProgress = computed(() => (props.downloadProgress == null ? null : Math.min(1, Math.max(0, props.downloadProgress / 100))));
+
 const sqlLibrarySaveFeedbackActive = ref(false);
 const SQL_LIBRARY_BOOKMARK_PATH = "M10 2 L10 10 L13 7 L16 10 L16 2";
 const SQL_LIBRARY_CHECK_PATH = "M9 9.5 L9 9.5 L11 11.5 L15 7.5 L15 7.5";
@@ -199,7 +197,7 @@ const collapsibleRightItemDefs = computed(() => {
       label: t("updates.check"),
       icon: CloudDownload,
       action: () => emit("check-updates"),
-      disabled: checkingUpdates.value,
+      disabled: false,
     });
   }
   items.push({
@@ -612,10 +610,9 @@ const toolbarStyle = computed(() => {
       <template v-if="toolbarItems.checkUpdates">
         <Tooltip>
           <TooltipTrigger as-child>
-            <Button v-show="isRightItemVisible('checkUpdates')" data-toolbar-update-trigger variant="ghost" size="icon" class="toolbar-action-button relative h-8 w-8 shrink-0" :disabled="checkingUpdates" @click="emit('check-updates')">
-              <ToolbarUpdateIcon :loading="checkingUpdates" :downloading="isDownloadingUpdate" :progress="updateDownloadProgress" />
-              <span v-if="updateReady || updateReadyToInstall" class="absolute right-1.5 top-1.5 h-2 w-2 rounded-full bg-emerald-500 ring-2 ring-background" />
-              <span v-else-if="hasUpdateAvailable && !isDownloadingUpdate" class="absolute right-1.5 top-1.5 h-2 w-2 rounded-full bg-red-500 ring-2 ring-background" />
+            <Button v-show="isRightItemVisible('checkUpdates')" data-toolbar-update-trigger variant="ghost" size="icon" class="toolbar-action-button relative h-8 w-8 shrink-0" @click="emit('check-updates')">
+              <ToolbarUpdateIcon />
+              <span v-if="hasUpdateAvailable" class="absolute right-1.5 top-1.5 h-2 w-2 rounded-full bg-red-500 ring-2 ring-background" />
             </Button>
           </TooltipTrigger>
           <TooltipContent>{{ updateTooltip }}</TooltipContent>
diff --git a/apps/desktop/src/components/layout/ToolbarUpdateIcon.vue b/apps/desktop/src/components/layout/ToolbarUpdateIcon.vue
index 3cbbc5a466..1d91675475 100644
--- a/apps/desktop/src/components/layout/ToolbarUpdateIcon.vue
+++ b/apps/desktop/src/components/layout/ToolbarUpdateIcon.vue
@@ -1,82 +1,11 @@
 <script setup lang="ts">
-import { computed } from "vue";
-import { Cloud, CloudDownload } from "@lucide/vue";
-
-const props = defineProps<{
-  loading: boolean;
-  /** Whether an update is downloading; takes precedence over `loading`. */
-  downloading?: boolean;
-  /** Download completion in 0..1, or null when the backend reports no total. */
-  progress?: number | null;
-}>();
-
-const progressRingStyle = computed(() => {
-  // Without a known total the ring cannot grow, so render a rotating partial arc
-  // instead of an invisible 0% one.
-  const percent = props.progress == null ? 25 : Math.round(Math.min(1, Math.max(0, props.progress)) * 100);
-  return {
-    background: `conic-gradient(var(--primary) ${percent}%, transparent ${percent}%)`,
-  };
-});
+import { CloudDownload } from "@lucide/vue";
+// Background checking/downloading deliberately never animates the toolbar.
+defineProps<{ loading?: boolean; downloading?: boolean; progress?: number | null }>();
 </script>
 
 <template>
-  <span data-toolbar-update-icon class="relative block h-4 w-4" :class="{ 'toolbar-update-icon--loading': loading }" aria-hidden="true">
-    <span v-if="downloading" data-toolbar-update-progress class="toolbar-update-progress absolute inset-0 rounded-full" :class="{ 'toolbar-update-progress--indeterminate': progress == null }" :style="progressRingStyle" />
-    <CloudDownload v-else-if="!loading" data-toolbar-update-idle class="toolbar-update-idle h-4 w-4" />
-    <template v-else>
-      <Cloud data-toolbar-update-cloud class="toolbar-update-cloud absolute inset-0 h-4 w-4" />
-      <Cloud data-toolbar-update-scan class="toolbar-update-scan absolute inset-0 h-4 w-4" />
-    </template>
+  <span data-toolbar-update-icon class="relative block h-4 w-4" aria-hidden="true">
+    <CloudDownload data-toolbar-update-idle class="h-4 w-4" />
   </span>
 </template>
-
-<style scoped>
-.toolbar-update-cloud {
-  opacity: 0.38;
-}
-
-.toolbar-update-scan {
-  color: #000;
-  stroke-dasharray: 7 36;
-  stroke-dashoffset: 0;
-  animation: toolbar-update-outline-scan 1100ms linear infinite;
-}
-
-:global(.dark) .toolbar-update-scan {
-  color: #fff;
-}
-
-.toolbar-update-progress {
-  /* Same 1.75px ring the toolbar previously drew inline for background downloads. */
-  mask: radial-gradient(farthest-side, transparent calc(100% - 1.75px), #000 calc(100% - 1.75px));
-  -webkit-mask: radial-gradient(farthest-side, transparent calc(100% - 1.75px), #000 calc(100% - 1.75px));
-}
-
-.toolbar-update-progress--indeterminate {
-  animation: toolbar-update-progress-spin 1100ms linear infinite;
-}
-
-@keyframes toolbar-update-outline-scan {
-  to {
-    stroke-dashoffset: -43;
-  }
-}
-
-@keyframes toolbar-update-progress-spin {
-  to {
-    transform: rotate(360deg);
-  }
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .toolbar-update-scan {
-    animation: none;
-    stroke-dasharray: none;
-  }
-
-  .toolbar-update-progress--indeterminate {
-    animation: none;
-  }
-}
-</style>
diff --git a/apps/desktop/src/components/layout/UpdateDialog.spec.ts b/apps/desktop/src/components/layout/UpdateDialog.spec.ts
index 095a9e495b..79b0249b26 100644
--- a/apps/desktop/src/components/layout/UpdateDialog.spec.ts
+++ b/apps/desktop/src/components/layout/UpdateDialog.spec.ts
@@ -14,6 +14,7 @@ const mountedApps: App[] = [];
 interface DialogState {
   open: boolean;
   portableMode: boolean;
+  releaseNotes: string;
   manualUpdateOnly: boolean;
   isDownloadingUpdate: boolean;
   downloadProgress: number | null;
@@ -32,6 +33,7 @@ async function mountDialog(activeTaskCount: number, initialState: Partial<Dialog
   const state = reactive<DialogState>({
     open: true,
     portableMode: false,
+    releaseNotes: "",
     manualUpdateOnly: false,
     isDownloadingUpdate: false,
     downloadProgress: 0,
@@ -76,7 +78,7 @@ async function mountDialog(activeTaskCount: number, initialState: Partial<Dialog
               manual_update_only: state.manualUpdateOnly,
               release_name: "DBX v0.5.61",
               release_url: "https://github.com/t8y2/dbx/releases/tag/v0.5.61",
-              release_notes: "",
+              release_notes: state.releaseNotes,
             },
             updateCheckMessage: "",
             checkingUpdates: false,
@@ -110,7 +112,7 @@ function buttonWithText(text: string): HTMLButtonElement | undefined {
 }
 
 function downloadButton(): HTMLButtonElement | undefined {
-  return buttonWithText("Download in Background");
+  return buttonWithText("Retry Download");
 }
 
 function cancelDownloadButton(): HTMLButtonElement | undefined {
@@ -118,7 +120,7 @@ function cancelDownloadButton(): HTMLButtonElement | undefined {
 }
 
 function installDownloadedButton(): HTMLButtonElement | undefined {
-  return buttonWithText("Exit & Update");
+  return buttonWithText("Restart & Update");
 }
 
 async function pressEscape() {
@@ -338,10 +340,10 @@ describe("UpdateDialog ignore version", () => {
     expect(ignoreVersion).toHaveBeenCalledOnce();
   });
 
-  it("hides the ignore button once an update has been downloaded", async () => {
+  it("allows ignoring a downloaded update", async () => {
     await mountDialog(0, { updateDownloaded: true, downloadProgress: 100 });
 
-    expect(buttonWithText("Ignore this version")).toBeUndefined();
+    expect(buttonWithText("Ignore this version")).toBeDefined();
   });
 
   it("disables the ignore button while the setting is being persisted", async () => {
@@ -350,3 +352,14 @@ describe("UpdateDialog ignore version", () => {
     expect(buttonWithText("Ignore this version")?.disabled).toBe(true);
   });
 });
+
+describe("UpdateDialog release notes safety", () => {
+  it("renders remote HTML as text and never creates unsafe links or image requests", async () => {
+    await mountDialog(0, { releaseNotes: '<img src="https://example.com/tracker" onerror="alert(1)"><script>alert(1)</script> [bad](javascript:alert) ![remote](https://example.com/image) [safe](https://example.com/release)' });
+    await vi.waitFor(() => {
+      expect(document.body.querySelector('a[href="https://example.com/release"]')).not.toBeNull();
+    });
+    expect(document.body.querySelector("script, img")).toBeNull();
+    expect(Array.from(document.body.querySelectorAll("a")).every((anchor) => anchor.href.startsWith("https://"))).toBe(true);
+  });
+});
diff --git a/apps/desktop/src/components/layout/UpdateDialog.vue b/apps/desktop/src/components/layout/UpdateDialog.vue
index 9aa168c7ba..828cebed8e 100644
--- a/apps/desktop/src/components/layout/UpdateDialog.vue
+++ b/apps/desktop/src/components/layout/UpdateDialog.vue
@@ -19,6 +19,7 @@ const props = defineProps<{
   downloadProgress: number | null;
   updateDownloaded: boolean;
   isInstallingUpdate: boolean;
+  isPreparingUpdate?: boolean;
   updateReady: boolean;
   isIgnoringUpdate: boolean;
   activeTaskCount: number;
@@ -45,7 +46,7 @@ const renderedNotes = ref("");
 // download survives the dialog closing, so closing it never cancels the download.
 const isCloseBlocked = computed(() => props.isInstallingUpdate);
 const blocksImplicitDismiss = computed(() => props.isInstallingUpdate);
-const canIgnoreVersion = computed(() => props.updateInfo?.update_available === true && !props.updateDownloaded && !props.isDownloadingUpdate && !props.isInstallingUpdate && !props.updateReady);
+const canIgnoreVersion = computed(() => props.updateInfo?.update_available === true && !props.isDownloadingUpdate && !props.isInstallingUpdate && !props.updateReady);
 
 function handleCancel() {
   handleOpenChange(false);
@@ -66,7 +67,7 @@ function handleReleaseNotesClick(event: MouseEvent) {
   if (!anchor) return;
   event.preventDefault();
   const url = anchor.getAttribute("href");
-  if (!url) return;
+  if (!url || !/^https?:\/\//i.test(url)) return;
   if (isTauriRuntime()) {
     import("@tauri-apps/plugin-shell").then(({ open }) => open(url));
   } else {
@@ -82,7 +83,19 @@ watch(
       return;
     }
     const { Marked } = await import("marked");
-    const marked = new Marked({ breaks: true, gfm: true });
+    const escapeHtml = (value: string) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+    const marked = new Marked({
+      breaks: true,
+      gfm: true,
+      renderer: {
+        html: ({ text }) => escapeHtml(text),
+        link({ href, tokens }) {
+          const text = this.parser.parseInline(tokens);
+          return /^https?:\/\//i.test(href) ? `<a href="${escapeHtml(href)}" rel="noopener noreferrer">${text}</a>` : text;
+        },
+        image: ({ text }) => escapeHtml(text),
+      },
+    });
     renderedNotes.value = marked.parse(notes) as string;
   },
   { immediate: true },
@@ -117,7 +130,7 @@ watch(
             })
           }}
         </p>
-        <p v-else class="text-muted-foreground">
+        <p v-else-if="!checkingUpdates" class="text-muted-foreground">
           {{ updateCheckMessage || t("updates.upToDate", { version: updateInfo?.current_version || "" }) }}
         </p>
         <div
@@ -142,10 +155,13 @@ watch(
           <span>{{ t("updates.activeTasksBlockUpdate", { count: activeTaskCount }) }}</span>
         </div>
       </div>
+      <p v-if="checkingUpdates" class="text-sm text-muted-foreground">{{ t("updates.checking") }}</p>
+      <p v-if="updateDownloaded && !isInstallingUpdate" class="text-sm">{{ t("updates.downloadedReady", { version: updateInfo?.latest_version }) }}</p>
+      <p v-if="updateCheckFailed && updateInfo?.update_available" role="alert" class="text-sm text-destructive">{{ updateCheckMessage }}</p>
       <DialogFooter class="relative min-w-0 sm:justify-end">
-        <div v-if="updateCheckFailed && !isDownloadingUpdate && !updateReady" class="flex items-center gap-1.5 self-start sm:absolute sm:left-4 sm:top-1/2 sm:-translate-y-1/2">
+        <div v-if="!updateReady && !isInstallingUpdate && !updateDownloaded && (updateInfo?.update_available || updateCheckFailed)" class="flex items-center gap-1.5 self-start sm:absolute sm:left-4 sm:top-1/2 sm:-translate-y-1/2">
           <span class="text-xs text-muted-foreground">{{ t("updates.source") }}</span>
-          <Select :model-value="updateDownloadSource" :disabled="checkingUpdates" @update:model-value="(value) => value && emit('change-download-source', value as UpdateDownloadSource)">
+          <Select :model-value="updateDownloadSource" :disabled="checkingUpdates || isIgnoringUpdate" @update:model-value="(value) => value && emit('change-download-source', value as UpdateDownloadSource)">
             <SelectTrigger class="h-8 w-[150px] text-xs">
               <SelectValue />
             </SelectTrigger>
@@ -165,10 +181,10 @@ watch(
             <Button variant="outline" class="shrink-0" @click="emit('open-latest-release')">{{ t("updates.openRelease") }}</Button>
           </div>
           <template v-if="canDownloadAndInstallUpdate(updateInfo, isDesktop)">
-            <Button v-if="updateReady" class="shrink-0" :disabled="activeTaskCount > 0" @click="emit('restart')">{{ t("updates.restart") }}</Button>
+            <Button v-if="updateReady" class="shrink-0" :disabled="activeTaskCount > 0 || isIgnoringUpdate" @click="emit('restart')">{{ t("updates.restart") }}</Button>
             <Button v-else-if="isInstallingUpdate" class="shrink-0" disabled>
               <Loader2 class="h-4 w-4 animate-spin" />
-              {{ t("updates.installing") }}
+              {{ t(isPreparingUpdate ? "updates.preparing" : "updates.installing") }}
             </Button>
             <template v-else-if="isDownloadingUpdate">
               <Button variant="ghost" class="shrink-0" @click="emit('cancel-download')">{{ t("updates.cancelDownload") }}</Button>
@@ -177,8 +193,8 @@ watch(
                 {{ t("updates.downloading", { progress: downloadProgress ?? 0 }) }}
               </Button>
             </template>
-            <Button v-else-if="updateDownloaded" class="shrink-0" :disabled="activeTaskCount > 0" @click="emit('install-downloaded')">{{ t("updates.exitAndUpdate") }}</Button>
-            <Button v-else class="shrink-0" @click="emit('download-in-background')">{{ t("updates.downloadInBackground") }}</Button>
+            <Button v-else-if="updateDownloaded" class="shrink-0" :disabled="activeTaskCount > 0 || isIgnoringUpdate" @click="emit('install-downloaded')">{{ t("updates.restartAndUpdate") }}</Button>
+            <Button v-else-if="!checkingUpdates" class="shrink-0" :disabled="isIgnoringUpdate" @click="emit('download-in-background')">{{ t("updates.retryDownload") }}</Button>
           </template>
         </template>
         <template v-else>
diff --git a/apps/desktop/src/components/layout/__tests__/ToolbarUpdateIcon.spec.ts b/apps/desktop/src/components/layout/__tests__/ToolbarUpdateIcon.spec.ts
index 98622a3c5a..e877db39f2 100644
--- a/apps/desktop/src/components/layout/__tests__/ToolbarUpdateIcon.spec.ts
+++ b/apps/desktop/src/components/layout/__tests__/ToolbarUpdateIcon.spec.ts
@@ -1,89 +1,14 @@
 // @vitest-environment happy-dom
-
-import { createApp, defineComponent, h, nextTick, reactive, type App } from "vue";
-import { afterEach, describe, expect, it } from "vitest";
+import { createApp, h } from "vue";
+import { describe, expect, it } from "vitest";
 import ToolbarUpdateIcon from "../ToolbarUpdateIcon.vue";
-
-const mountedApps: App[] = [];
-
-afterEach(() => {
-  for (const app of mountedApps.splice(0)) app.unmount();
-  document.body.innerHTML = "";
-});
-
-describe("ToolbarUpdateIcon", () => {
-  it("uses cloud download while idle and a cloud outline scan while checking", async () => {
-    const state = reactive({ loading: false });
+describe("silent toolbar update icon", () => {
+  it.each([{ loading: false }, { loading: true }, { downloading: true, progress: 0.4 }, { downloading: true, progress: null }])("keeps the ordinary icon for %o", (props) => {
     const container = document.createElement("div");
-    document.body.append(container);
-    const app = createApp(
-      defineComponent({
-        setup: () => () => h(ToolbarUpdateIcon, { loading: state.loading }),
-      }),
-    );
-    mountedApps.push(app);
+    const app = createApp({ render: () => h(ToolbarUpdateIcon, props) });
     app.mount(container);
-    await nextTick();
-
     expect(container.querySelector("[data-toolbar-update-idle]")).not.toBeNull();
-    expect(container.querySelector("[data-toolbar-update-cloud]")).toBeNull();
-
-    state.loading = true;
-    await nextTick();
-    expect(container.querySelector("[data-toolbar-update-idle]")).toBeNull();
-    expect(container.querySelector("[data-toolbar-update-cloud]")).not.toBeNull();
-    expect(container.querySelector("[data-toolbar-update-scan]")).not.toBeNull();
-  });
-
-  it("shows a progress ring while downloading, growing with progress", async () => {
-    const state = reactive({ downloading: true, progress: 0.42 });
-    const container = document.createElement("div");
-    document.body.append(container);
-    const app = createApp(
-      defineComponent({
-        setup: () => () => h(ToolbarUpdateIcon, { loading: false, downloading: state.downloading, progress: state.progress }),
-      }),
-    );
-    mountedApps.push(app);
-    app.mount(container);
-    await nextTick();
-
-    const ring = container.querySelector<HTMLElement>("[data-toolbar-update-progress]");
-    expect(ring).not.toBeNull();
-    expect(ring?.classList.contains("toolbar-update-progress--indeterminate")).toBe(false);
-    expect(ring?.style.background).toBe("conic-gradient(var(--primary) 42%, transparent 42%)");
-    // The idle and checking glyphs stay hidden behind the ring.
-    expect(container.querySelector("[data-toolbar-update-idle]")).toBeNull();
-    expect(container.querySelector("[data-toolbar-update-cloud]")).toBeNull();
-
-    state.progress = 1;
-    await nextTick();
-    expect(ring?.style.background).toBe("conic-gradient(var(--primary) 100%, transparent 100%)");
-
-    state.downloading = false;
-    await nextTick();
-    expect(container.querySelector("[data-toolbar-update-progress]")).toBeNull();
-    expect(container.querySelector("[data-toolbar-update-idle]")).not.toBeNull();
-  });
-
-  it("falls back to a rotating indeterminate arc when the download size is unknown", async () => {
-    const state = reactive({ downloading: true, progress: null as number | null });
-    const container = document.createElement("div");
-    document.body.append(container);
-    const app = createApp(
-      defineComponent({
-        setup: () => () => h(ToolbarUpdateIcon, { loading: true, downloading: state.downloading, progress: state.progress }),
-      }),
-    );
-    mountedApps.push(app);
-    app.mount(container);
-    await nextTick();
-
-    const ring = container.querySelector<HTMLElement>("[data-toolbar-update-progress]");
-    expect(ring).not.toBeNull();
-    // Indeterminate downloading outranks the checking animation.
-    expect(container.querySelector("[data-toolbar-update-cloud]")).toBeNull();
-    expect(ring?.classList.contains("toolbar-update-progress--indeterminate")).toBe(true);
-    expect(ring?.style.background).toBe("conic-gradient(var(--primary) 25%, transparent 25%)");
+    expect(container.querySelector("[data-toolbar-update-progress], [data-toolbar-update-scan]")).toBeNull();
+    app.unmount();
   });
 });
diff --git a/apps/desktop/src/components/nacos/NacosAdminConsole.vue b/apps/desktop/src/components/nacos/NacosAdminConsole.vue
index cf7ce75f9f..a4e7ce97fb 100644
--- a/apps/desktop/src/components/nacos/NacosAdminConsole.vue
+++ b/apps/desktop/src/components/nacos/NacosAdminConsole.vue
@@ -1,4 +1,5 @@
 <script setup lang="ts">
+import { useUpdateBlocker } from "@/lib/app/updatePreparation";
 import { computed, nextTick, onActivated, onBeforeUnmount, onDeactivated, onMounted, ref, shallowRef, useId, watch } from "vue";
 import { Compartment, StateEffect, StateField } from "@codemirror/state";
 import { ensureSyntaxTree } from "@codemirror/language";
@@ -2659,6 +2660,29 @@ function openNacosConsole() {
   }
   window.open(url, "_blank", "noopener,noreferrer");
 }
+useUpdateBlocker(() =>
+  isConfigDirty.value ||
+  isCreatingConfig.value ||
+  savingConfig.value ||
+  deletingConfig.value ||
+  pendingConfigSave.value ||
+  pendingDeleteConfig.value ||
+  pendingBatchDelete.value ||
+  pendingHistoryRollback.value ||
+  rollingBackHistory.value ||
+  instanceEditorOpen.value ||
+  serviceEditorOpen.value ||
+  registerInstanceOpen.value ||
+  pendingInstanceUpdate.value ||
+  pendingInstanceDeregister.value ||
+  pendingServiceDelete.value ||
+  deletingService.value ||
+  registeringInstance.value ||
+  Object.keys(updatingInstanceKeys.value).length > 0 ||
+  Object.keys(instanceWeightDrafts.value).length > 0
+    ? t("updates.preparationDrafts")
+    : undefined,
+);
 </script>
 
 <template>
diff --git a/apps/desktop/src/components/nacos/__tests__/NacosAdminConsoleDelete.spec.ts b/apps/desktop/src/components/nacos/__tests__/NacosAdminConsoleDelete.spec.ts
index 1b7887e71b..ea4aebde46 100644
--- a/apps/desktop/src/components/nacos/__tests__/NacosAdminConsoleDelete.spec.ts
+++ b/apps/desktop/src/components/nacos/__tests__/NacosAdminConsoleDelete.spec.ts
@@ -16,7 +16,10 @@ const mocks = vi.hoisted(() => ({
   toast: vi.fn(),
 }));
 
-vi.mock("vue-i18n", () => ({ useI18n: () => ({ t: (key: string) => key }) }));
+vi.mock("vue-i18n", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("vue-i18n")>()),
+  useI18n: () => ({ t: (key: string) => key }),
+}));
 
 vi.mock("@/lib/backend/api", () => ({
   nacosDeleteConfig: mocks.nacosDeleteConfig,
diff --git a/apps/desktop/src/components/redis/RedisValueViewer.vue b/apps/desktop/src/components/redis/RedisValueViewer.vue
index 4002d0fb10..dd933a6273 100644
--- a/apps/desktop/src/components/redis/RedisValueViewer.vue
+++ b/apps/desktop/src/components/redis/RedisValueViewer.vue
@@ -1,4 +1,5 @@
 <script setup lang="ts">
+import { useUpdateBlocker } from "@/lib/app/updatePreparation";
 import { computed, ref, shallowRef, nextTick, onActivated, onBeforeUnmount, onDeactivated, onMounted, watch } from "vue";
 import type { CalendarDateTime } from "@internationalized/date";
 import { useI18n } from "vue-i18n";
@@ -2710,6 +2711,7 @@ onBeforeUnmount(() => {
 });
 
 defineExpose({ focusSearch });
+useUpdateBlocker(() => (hasUnsavedRedisDraft.value || editingTtl.value || savingTtl.value || savingString.value || savingJson.value || savingMember.value || savingZsetMember.value || savingHashFieldTtl.value || showRenameKeyDialog.value ? t("updates.preparationDrafts") : undefined));
 </script>
 
 <template>
diff --git a/apps/desktop/src/composables/__tests__/useAppUpdater.spec.ts b/apps/desktop/src/composables/__tests__/useAppUpdater.spec.ts
index eb8d07f1d0..d927806883 100644
--- a/apps/desktop/src/composables/__tests__/useAppUpdater.spec.ts
+++ b/apps/desktop/src/composables/__tests__/useAppUpdater.spec.ts
@@ -1,59 +1,32 @@
 // @vitest-environment happy-dom
-
-import { createApp, defineComponent, h, ref, type App } from "vue";
+import { createApp, defineComponent, h, reactive, nextTick, type App } from "vue";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import i18n from "@/i18n";
 import { useAppUpdater } from "@/composables/useAppUpdater";
-
-const apiMock = vi.hoisted(() => ({
-  cancelUpdateDownload: vi.fn<() => Promise<void>>(),
-  downloadUpdate: vi.fn<() => Promise<void>>(),
-  installDownloadedUpdate: vi.fn<() => Promise<void>>(),
+const mocks = vi.hoisted(() => ({
   checkForUpdates: vi.fn(),
+  downloadUpdate: vi.fn(),
+  cancelUpdateDownload: vi.fn(),
+  installDownloadedUpdate: vi.fn(),
+  getDownloadedUpdate: vi.fn(),
+  discardDownloadedUpdate: vi.fn(),
+  getAppVersion: vi.fn(),
+  listen: vi.fn(),
+  relaunch: vi.fn(),
+  persist: vi.fn(),
+  toast: vi.fn(),
 }));
-const listenMock = vi.hoisted(() => vi.fn());
-const toastMock = vi.hoisted(() => vi.fn());
-
-vi.mock("@/lib/backend/api", () => apiMock);
-vi.mock("@/lib/backend/tauriRuntime", () => ({
-  isTauriRuntime: () => true,
-}));
-vi.mock("@/composables/useToast", () => ({
-  useToast: () => ({ toast: toastMock }),
-}));
-const settingsStoreMock = vi.hoisted(() => ({
-  editorSettings: { updateDownloadSource: "official", ignoredUpdateVersion: "" },
-  updateEditorSettingsAndPersist: vi.fn<() => Promise<void>>(),
-}));
-vi.mock("@/stores/settingsStore", () => ({
-  useSettingsStore: () => settingsStoreMock,
-}));
-vi.mock("@tauri-apps/api/event", () => ({
-  listen: listenMock,
-}));
-
-interface Deferred<T> {
-  promise: Promise<T>;
-  resolve: (value: T | PromiseLike<T>) => void;
-  reject: (reason?: unknown) => void;
-}
-
-function deferred<T>(): Deferred<T> {
-  let resolve!: Deferred<T>["resolve"];
-  let reject!: Deferred<T>["reject"];
-  const promise = new Promise<T>((resolvePromise, rejectPromise) => {
-    resolve = resolvePromise;
-    reject = rejectPromise;
-  });
-  return { promise, resolve, reject };
-}
-
-let app: App | undefined;
-let container: HTMLDivElement | undefined;
-
-function mountUpdater(options: { getActiveTaskCount?: () => number } = {}) {
-  container = document.createElement("div");
-  document.body.append(container);
+vi.mock("@/lib/backend/api", () => mocks);
+vi.mock("@/lib/backend/tauriRuntime", () => ({ isTauriRuntime: () => true }));
+vi.mock("@tauri-apps/api/event", () => ({ listen: mocks.listen }));
+vi.mock("@tauri-apps/plugin-process", () => ({ relaunch: mocks.relaunch }));
+vi.mock("@/composables/useToast", () => ({ useToast: () => ({ toast: mocks.toast }) }));
+const settings = reactive({ updateDownloadSource: "official", ignoredUpdateVersion: "", updateNotificationsEnabled: true });
+vi.mock("@/stores/settingsStore", () => ({ useSettingsStore: () => ({ editorSettings: settings, updateEditorSettingsAndPersist: mocks.persist }) }));
+const info = { current_version: "1.0.0", latest_version: "1.1.0", update_available: true, portable_mode: false, manual_update_only: false, release_name: "v1.1.0", release_url: "https://example.com", release_notes: "Changes" };
+const cache = { cache_id: "cached", version: "1.1.0", portable_mode: false, release_url: "https://example.com", release_notes: "Changes", downloaded_at: 1 };
+let app: App;
+function mount(options: Parameters<typeof useAppUpdater>[0] = {}) {
   let updater!: ReturnType<typeof useAppUpdater>;
   app = createApp(
     defineComponent({
@@ -64,299 +37,258 @@ function mountUpdater(options: { getActiveTaskCount?: () => number } = {}) {
     }),
   );
   app.use(i18n);
-  app.mount(container);
-  updater.updateInfo.value = {
-    current_version: "0.5.69",
-    latest_version: "0.5.70",
-    update_available: true,
-    release_name: "DBX v0.5.70",
-    release_url: "https://github.com/t8y2/dbx/releases/tag/v0.5.70",
-    release_notes: "",
-  };
+  app.mount(document.createElement("div"));
   return updater;
 }
-
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  let reject!: (error: Error) => void;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+}
+async function flush() {
+  for (let i = 0; i < 12; i++) await Promise.resolve();
+  await nextTick();
+}
 beforeEach(() => {
-  vi.clearAllMocks();
-  settingsStoreMock.editorSettings.ignoredUpdateVersion = "";
-  settingsStoreMock.updateEditorSettingsAndPersist.mockResolvedValue();
-  listenMock.mockResolvedValue(vi.fn());
-  apiMock.installDownloadedUpdate.mockResolvedValue();
+  vi.resetAllMocks();
+  settings.updateDownloadSource = "official";
+  settings.ignoredUpdateVersion = "";
+  settings.updateNotificationsEnabled = true;
+  mocks.checkForUpdates.mockResolvedValue(info);
+  mocks.downloadUpdate.mockResolvedValue(cache);
+  mocks.getDownloadedUpdate.mockResolvedValue(null);
+  mocks.getAppVersion.mockResolvedValue("1.0.0");
+  mocks.listen.mockResolvedValue(vi.fn());
+  mocks.persist.mockImplementation(async (values) => Object.assign(settings, values));
 });
-
 afterEach(() => {
   app?.unmount();
-  container?.remove();
-  app = undefined;
-  container = undefined;
+  vi.useRealTimers();
 });
-
-describe("useAppUpdater download attempts", () => {
-  it("waits for cancellation and ignores stale completion from the previous attempt", async () => {
-    const firstDownload = deferred<void>();
-    const secondDownload = deferred<void>();
-    const cancellation = deferred<void>();
-    apiMock.downloadUpdate.mockImplementationOnce(() => firstDownload.promise).mockImplementationOnce(() => secondDownload.promise);
-    apiMock.cancelUpdateDownload.mockReturnValueOnce(cancellation.promise);
-
-    const updater = mountUpdater();
-
-    const firstAttempt = updater.downloadUpdateInBackground();
-    await vi.waitFor(() => expect(apiMock.downloadUpdate).toHaveBeenCalledTimes(1));
-
-    const cancelAttempt = updater.cancelDownload();
-    expect(updater.isDownloadingUpdate.value).toBe(false);
-
-    const retryAttempt = updater.downloadUpdateInBackground();
-    await Promise.resolve();
-    expect(apiMock.downloadUpdate).toHaveBeenCalledTimes(1);
-    expect(updater.isDownloadingUpdate.value).toBe(true);
-
-    cancellation.resolve();
-    await cancelAttempt;
-    await vi.waitFor(() => expect(apiMock.downloadUpdate).toHaveBeenCalledTimes(2));
-
-    firstDownload.reject(new Error("Download canceled by user."));
-    await firstAttempt;
-    expect(updater.isDownloadingUpdate.value).toBe(true);
-    // The retry is in flight with no progress event yet, so progress is indeterminate.
-    expect(updater.downloadProgress.value).toBeNull();
-
-    secondDownload.resolve();
-    await retryAttempt;
-
-    // No active tasks by default, so the successful download auto-installs and lands on
-    // "ready to restart" instead of waiting for a manual "Install Now" click.
-    expect(apiMock.installDownloadedUpdate).toHaveBeenCalledOnce();
-    expect(updater.isDownloadingUpdate.value).toBe(false);
-    expect(updater.downloadProgress.value).toBe(100);
-    expect(updater.updateDownloaded.value).toBe(false);
-    expect(updater.updateReady.value).toBe(true);
-    expect(toastMock).toHaveBeenLastCalledWith("DBX has been updated. Restart to finish.", 10000, expect.objectContaining({ label: "Exit & Restart", onClick: expect.any(Function) }));
-  });
-
-  it("auto-installs once the download finishes while idle, without waiting for a manual click", async () => {
-    apiMock.downloadUpdate.mockResolvedValueOnce();
-    const updater = mountUpdater();
-    updater.showUpdateDialog.value = true;
-
-    const attempt = updater.downloadUpdateInBackground();
+describe("silent update lifecycle", () => {
+  it("automatically downloads without surfacing or installing, even while idle", async () => {
+    const updater = mount();
+    await updater.checkUpdates({ silent: true });
+    expect(mocks.downloadUpdate).toHaveBeenCalledWith("official", "1.1.0", expect.any(String), "Changes");
+    expect(updater.phase.value).toBe("ready");
+    expect(updater.hasUpdateAvailable.value).toBe(true);
     expect(updater.showUpdateDialog.value).toBe(false);
-    await attempt;
-
-    expect(apiMock.installDownloadedUpdate).toHaveBeenCalledOnce();
-    expect(updater.updateDownloaded.value).toBe(false);
-    expect(updater.updateReady.value).toBe(true);
-    expect(toastMock).toHaveBeenLastCalledWith("DBX has been updated. Restart to finish.", 10000, expect.objectContaining({ label: "Exit & Restart", onClick: expect.any(Function) }));
+    expect(mocks.toast).not.toHaveBeenCalled();
+    expect(mocks.installDownloadedUpdate).not.toHaveBeenCalled();
+    expect(mocks.relaunch).not.toHaveBeenCalled();
   });
-
-  it("falls back to a manual Install Now toast when tasks are still active once the download finishes", async () => {
-    apiMock.downloadUpdate.mockResolvedValueOnce();
-    // Must be a reactive ref, not a plain closure variable — useAppUpdater's activeTaskCount
-    // is a computed(), which only invalidates its cache when a tracked reactive source changes.
-    const activeTaskCount = ref(2);
-    const updater = mountUpdater({ getActiveTaskCount: () => activeTaskCount.value });
-
-    await updater.downloadUpdateInBackground();
-
-    expect(apiMock.installDownloadedUpdate).not.toHaveBeenCalled();
+  it("shows no badge until a download finishes, and closing does not cancel", async () => {
+    const pending = deferred<typeof cache>();
+    mocks.downloadUpdate.mockReturnValue(pending.promise);
+    const updater = mount();
+    const checking = updater.checkUpdates();
+    await flush();
+    expect(updater.hasUpdateAvailable.value).toBe(false);
+    updater.showUpdateDialog.value = false;
+    pending.resolve(cache);
+    await checking;
     expect(updater.updateDownloaded.value).toBe(true);
-    expect(toastMock).toHaveBeenLastCalledWith("DBX v0.5.70 is ready to install.", 10000, expect.objectContaining({ label: "Install Now", onClick: expect.any(Function) }));
-
-    activeTaskCount.value = 0;
-    const [, , action] = toastMock.mock.lastCall!;
-    action.onClick();
-
-    await vi.waitFor(() => expect(apiMock.installDownloadedUpdate).toHaveBeenCalledOnce());
-    await vi.waitFor(() => expect(toastMock).toHaveBeenLastCalledWith("DBX has been updated. Restart to finish.", 10000, expect.objectContaining({ label: "Exit & Restart", onClick: expect.any(Function) })));
-    expect(updater.updateReady.value).toBe(true);
+    expect(mocks.cancelUpdateDownload).not.toHaveBeenCalled();
   });
-
-  it("tracks download progress and stays indeterminate when the backend reports no total", async () => {
-    const download = deferred<void>();
-    apiMock.downloadUpdate.mockReturnValueOnce(download.promise);
-    const updater = mountUpdater();
-
-    const downloadAttempt = updater.downloadUpdateInBackground();
-    await vi.waitFor(() => expect(listenMock).toHaveBeenCalledOnce());
-    // No progress event yet — the size is unknown, so progress stays indeterminate.
-    expect(updater.downloadProgress.value).toBeNull();
-
-    const onProgress = listenMock.mock.calls[0][1] as (event: { payload: { downloaded: number; total: number | null } }) => void;
-    onProgress({ payload: { downloaded: 25, total: 100 } });
-    expect(updater.downloadProgress.value).toBe(25);
-
-    // Mirrors may stream chunks without a total; progress must not freeze at a stale percentage.
-    onProgress({ payload: { downloaded: 64, total: null } });
-    expect(updater.downloadProgress.value).toBeNull();
-
-    download.resolve();
-    await downloadAttempt;
-    expect(updater.downloadProgress.value).toBe(100);
+  it("restores offline and one click saves before installing and restarting without downloading", async () => {
+    mocks.getDownloadedUpdate.mockResolvedValue(cache);
+    const release = vi.fn();
+    const prepare = vi.fn(async () => release);
+    const updater = mount({ prepareForUpdate: prepare });
+    await updater.initialize();
+    await updater.installDownloadedUpdate();
+    expect(mocks.checkForUpdates).not.toHaveBeenCalled();
+    expect(mocks.downloadUpdate).not.toHaveBeenCalled();
+    expect(mocks.installDownloadedUpdate).toHaveBeenCalledWith("cached", "1.1.0");
+    expect(prepare.mock.invocationCallOrder[0]).toBeLessThan(mocks.installDownloadedUpdate.mock.invocationCallOrder[0]);
+    expect(mocks.installDownloadedUpdate.mock.invocationCallOrder[0]).toBeLessThan(mocks.relaunch.mock.invocationCallOrder[0]);
+    expect(release).not.toHaveBeenCalled();
   });
-});
-
-describe("useAppUpdater reopening the dialog from the toolbar", () => {
-  it("resurfaces the dialog without re-checking while a download is in progress", async () => {
-    const download = deferred<void>();
-    apiMock.downloadUpdate.mockReturnValueOnce(download.promise);
-    const updater = mountUpdater();
-
-    const downloadAttempt = updater.downloadUpdateInBackground();
-    await vi.waitFor(() => expect(updater.isDownloadingUpdate.value).toBe(true));
-
-    await updater.checkUpdates();
-
-    expect(apiMock.checkForUpdates).not.toHaveBeenCalled();
-    expect(updater.showUpdateDialog.value).toBe(true);
-
-    download.resolve();
-    await downloadAttempt;
+  it("preparation failure retains the package and repeated clicks cannot bypass preparation", async () => {
+    mocks.getDownloadedUpdate.mockResolvedValue(cache);
+    const pending = deferred<() => void>();
+    const updater = mount({ prepareForUpdate: () => pending.promise });
+    await updater.checkUpdates({ silent: true });
+    const install = updater.installDownloadedUpdate();
+    await updater.installDownloadedUpdate();
+    pending.reject(new Error("unsaved grid"));
+    await install;
+    expect(mocks.installDownloadedUpdate).not.toHaveBeenCalled();
+    expect(updater.phase.value).toBe("ready");
+    expect(updater.updateCheckMessage.value).toContain("unsaved grid");
   });
-
-  it("resurfaces the dialog without re-checking once the update is downloaded and ready to install", async () => {
-    apiMock.downloadUpdate.mockResolvedValueOnce();
-    // Busy at download-completion time so the install step stays pending instead of auto-running.
-    const updater = mountUpdater({ getActiveTaskCount: () => 1 });
-
-    await updater.downloadUpdateInBackground();
+  it("blocks installation for active work but never blocks automatic download", async () => {
+    const updater = mount({ getActiveTaskCount: () => 2 });
+    await updater.checkUpdates({ silent: true });
     expect(updater.updateDownloaded.value).toBe(true);
+    await updater.installDownloadedUpdate();
+    expect(mocks.installDownloadedUpdate).not.toHaveBeenCalled();
+  });
+  it("retries only restart after relaunch fails", async () => {
+    mocks.relaunch.mockRejectedValueOnce(new Error("restart failed"));
+    const updater = mount();
+    await updater.checkUpdates({ silent: true });
+    await updater.installDownloadedUpdate();
+    await updater.restartApp();
+    expect(mocks.installDownloadedUpdate).toHaveBeenCalledOnce();
+    expect(mocks.relaunch).toHaveBeenCalledTimes(2);
+  });
+  it("persists ignore before deleting a ready cache", async () => {
+    const updater = mount();
+    await updater.checkUpdates({ silent: true });
+    await updater.ignoreCurrentVersion();
+    expect(mocks.persist).toHaveBeenCalledWith({ ignoredUpdateVersion: "1.1.0" });
+    expect(mocks.discardDownloadedUpdate).toHaveBeenCalledWith("cached");
+    expect(updater.updateDownloaded.value).toBe(false);
+  });
+  it("keeps ready cache if ignoring cannot persist", async () => {
+    mocks.persist.mockRejectedValue(new Error("disk full"));
+    const updater = mount();
+    await updater.checkUpdates({ silent: true });
+    await updater.ignoreCurrentVersion();
+    expect(mocks.discardDownloadedUpdate).not.toHaveBeenCalled();
+    expect(updater.updateDownloaded.value).toBe(true);
+  });
+  it("hides ready badge when notifications disabled but preserves manual installation", async () => {
+    mocks.getDownloadedUpdate.mockResolvedValue(cache);
+    const updater = mount();
+    await updater.initialize();
+    settings.updateNotificationsEnabled = false;
+    await flush();
+    expect(updater.hasUpdateAvailable.value).toBe(false);
+    expect(updater.updateDownloaded.value).toBe(true);
+    expect(mocks.discardDownloadedUpdate).not.toHaveBeenCalled();
+  });
+  it("ignores progress belonging to another version or download attempt", async () => {
+    const pending = deferred<typeof cache>();
+    mocks.downloadUpdate.mockReturnValue(pending.promise);
+    const updater = mount();
+    const checking = updater.checkUpdates({ silent: true });
+    await vi.waitFor(() => expect(mocks.listen).toHaveBeenCalled());
+    const callback = mocks.listen.mock.calls[0][1];
+    const attempt = mocks.downloadUpdate.mock.calls[0][2];
+    callback({ payload: { downloaded: 90, total: 100, attempt_id: "old", version: "1.1.0" } });
+    expect(updater.downloadProgress.value).toBeNull();
+    callback({ payload: { downloaded: 30, total: 100, attempt_id: attempt, version: "1.1.0" } });
+    expect(updater.downloadProgress.value).toBe(30);
+    pending.resolve(cache);
+    await checking;
+  });
+  it("silently backs off after failed downloads at 1, 5 and 15 minutes", async () => {
+    vi.useFakeTimers();
+    mocks.downloadUpdate.mockRejectedValue(new Error("network down"));
+    const updater = mount();
+    await updater.initialize();
+    await vi.advanceTimersByTimeAsync(0);
+    expect(mocks.downloadUpdate).toHaveBeenCalledTimes(1);
+    for (const [index, delay] of [60_000, 300_000, 900_000].entries()) {
+      await vi.advanceTimersByTimeAsync(delay);
+      expect(mocks.downloadUpdate).toHaveBeenCalledTimes(index + 2);
+    }
+    await vi.advanceTimersByTimeAsync(60_000);
+    expect(mocks.downloadUpdate).toHaveBeenCalledTimes(4);
     expect(updater.showUpdateDialog.value).toBe(false);
-
-    await updater.checkUpdates();
-
-    expect(apiMock.checkForUpdates).not.toHaveBeenCalled();
-    expect(updater.showUpdateDialog.value).toBe(true);
+    expect(mocks.toast).not.toHaveBeenCalled();
+  });
+  it("changing source keeps an already prepared package", async () => {
+    const updater = mount();
+    await updater.checkUpdates({ silent: true });
+    await updater.changeUpdateDownloadSource("cnb");
+    expect(mocks.downloadUpdate).toHaveBeenCalledOnce();
+    expect(mocks.checkForUpdates).toHaveBeenCalledOnce();
+  });
+  it("reconciles a download that commits just before cancellation without installing it", async () => {
+    const pending = deferred<typeof cache>();
+    mocks.downloadUpdate.mockReturnValue(pending.promise);
+    mocks.getDownloadedUpdate.mockResolvedValue(cache);
+    mocks.cancelUpdateDownload.mockImplementation(async () => {
+      pending.resolve(cache);
+    });
+    const updater = mount();
+    const check = updater.checkUpdates({ silent: true });
+    await vi.waitFor(() => expect(mocks.downloadUpdate).toHaveBeenCalled());
+    await updater.cancelDownload();
+    await check;
+    expect(updater.updateDownloaded.value).toBe(true);
+    expect(mocks.installDownloadedUpdate).not.toHaveBeenCalled();
+  });
+  it("does not resurrect a logically ignored package if removing its files fails", async () => {
+    mocks.discardDownloadedUpdate.mockRejectedValue(new Error("file busy"));
+    const updater = mount();
+    await updater.checkUpdates({ silent: true });
+    await updater.ignoreCurrentVersion();
+    expect(settings.ignoredUpdateVersion).toBe("1.1.0");
+    expect(updater.updateDownloaded.value).toBe(false);
+    expect(updater.hasUpdateAvailable.value).toBe(false);
+    expect(updater.updateCheckMessage.value).toContain("file busy");
+  });
+  it("clears a corrupt installation cache so download can be retried", async () => {
+    mocks.installDownloadedUpdate.mockRejectedValue(new Error("signature invalid"));
+    const updater = mount();
+    await updater.checkUpdates({ silent: true });
+    await updater.installDownloadedUpdate();
+    expect(updater.phase.value).toBe("idle");
+    expect(updater.updateDownloaded.value).toBe(false);
+    expect(mocks.relaunch).not.toHaveBeenCalled();
   });
 
-  it("resurfaces the dialog without re-checking once the update is installed and awaiting restart", async () => {
-    apiMock.downloadUpdate.mockResolvedValueOnce();
-    const updater = mountUpdater();
+  it("holds the preparation barrier through install and releases it only on failure", async () => {
+    const release = vi.fn();
+    mocks.installDownloadedUpdate.mockRejectedValue(new Error("installer failed"));
+    mocks.getDownloadedUpdate.mockResolvedValue(cache);
+    const updater = mount({ prepareForUpdate: async () => release });
+    await updater.checkUpdates({ silent: true });
+    await updater.installDownloadedUpdate();
+    expect(release).toHaveBeenCalledOnce();
+    expect(updater.updateDownloaded.value).toBe(true);
+  });
+  it("checks fresh metadata immediately once when the downloaded version changes", async () => {
+    mocks.downloadUpdate.mockRejectedValueOnce(new Error("Update version changed; check for updates again."));
+    const updater = mount();
+    await updater.checkUpdates({ silent: true });
+    await vi.waitFor(() => expect(mocks.downloadUpdate).toHaveBeenCalledTimes(2));
+    expect(mocks.checkForUpdates).toHaveBeenCalledTimes(2);
+    expect(updater.updateDownloaded.value).toBe(true);
+  });
 
+  it("cannot install or switch sources while an ignore setting is being persisted", async () => {
+    const persist = deferred<void>();
+    mocks.persist.mockReturnValue(persist.promise);
+    const updater = mount();
+    await updater.checkUpdates({ silent: true });
+    const ignoring = updater.ignoreCurrentVersion();
+    await updater.installDownloadedUpdate();
+    await updater.changeUpdateDownloadSource("cnb");
+    await updater.checkUpdates({ silent: true });
     await updater.downloadUpdateInBackground();
-    expect(updater.updateReady.value).toBe(true);
-
-    await updater.checkUpdates();
-
-    expect(apiMock.checkForUpdates).not.toHaveBeenCalled();
-    expect(updater.showUpdateDialog.value).toBe(true);
+    expect(mocks.checkForUpdates).toHaveBeenCalledTimes(1);
+    expect(mocks.downloadUpdate).toHaveBeenCalledTimes(1);
+    expect(mocks.installDownloadedUpdate).not.toHaveBeenCalled();
+    expect(mocks.persist).toHaveBeenCalledTimes(1);
+    persist.resolve();
+    await ignoring;
+    expect(updater.updateDownloaded.value).toBe(false);
   });
 
-  it("still checks the network for a silent background check even mid-download", async () => {
-    const download = deferred<void>();
-    apiMock.downloadUpdate.mockReturnValueOnce(download.promise);
-    apiMock.checkForUpdates.mockResolvedValueOnce({
-      current_version: "0.5.69",
-      latest_version: "0.5.70",
-      update_available: true,
-      release_name: "DBX v0.5.70",
-      release_url: "https://github.com/t8y2/dbx/releases/tag/v0.5.70",
-      release_notes: "",
-    });
-    const updater = mountUpdater();
-
-    const downloadAttempt = updater.downloadUpdateInBackground();
-    await vi.waitFor(() => expect(updater.isDownloadingUpdate.value).toBe(true));
-
-    await updater.checkUpdates({ silent: true });
-
-    expect(apiMock.checkForUpdates).toHaveBeenCalledOnce();
-
-    download.resolve();
-    await downloadAttempt;
-  });
-});
-
-describe("useAppUpdater failure state handling", () => {
-  interface UpdateInfo {
-    current_version: string;
-    latest_version: string;
-    update_available: boolean;
-    release_name: string;
-    release_url: string;
-    release_notes: string;
-  }
-
-  it("keeps the failed state visible while a retry is in flight and clears it on success", async () => {
-    apiMock.checkForUpdates.mockRejectedValueOnce(new Error("boom"));
-    const updater = mountUpdater();
-
-    await updater.checkUpdates();
-    expect(updater.updateCheckFailed.value).toBe(true);
-    expect(updater.updateCheckMessage.value).not.toBe("");
-
-    const retry = deferred<UpdateInfo>();
-    apiMock.checkForUpdates.mockReturnValueOnce(retry.promise);
-    const pending = updater.checkUpdates();
-    await vi.waitFor(() => expect(updater.checkingUpdates.value).toBe(true));
-
-    // Mid-retry: the source switcher stays mounted (updateCheckFailed) and
-    // the dialog must not fall through to "up to date" with an empty version.
-    expect(updater.updateCheckFailed.value).toBe(true);
-    expect(updater.updateCheckMessage.value).not.toBe("");
-
-    retry.resolve({
-      current_version: "0.5.69",
-      latest_version: "0.5.69",
-      update_available: false,
-      release_name: "",
-      release_url: "",
-      release_notes: "",
-    });
-    await pending;
-
-    expect(updater.updateCheckFailed.value).toBe(false);
-    expect(updater.updateCheckMessage.value).toContain("0.5.69");
-  });
-
-  it("keeps the last update info when a silent background check fails", async () => {
-    apiMock.checkForUpdates.mockResolvedValueOnce({
-      current_version: "0.5.69",
-      latest_version: "0.5.70",
-      update_available: true,
-      release_name: "DBX v0.5.70",
-      release_url: "https://github.com/t8y2/dbx/releases/tag/v0.5.70",
-      release_notes: "",
-    });
-    const updater = mountUpdater();
-    await updater.checkUpdates({ silent: true });
-    expect(updater.updateInfo.value?.update_available).toBe(true);
-
-    apiMock.checkForUpdates.mockRejectedValueOnce(new Error("network down"));
-    await updater.checkUpdates({ silent: true });
-
-    expect(updater.updateInfo.value?.update_available).toBe(true);
-    expect(updater.updateCheckFailed.value).toBe(false);
-    expect(updater.showUpdateDialog.value).toBe(false);
-  });
-});
-
-describe("useAppUpdater ignore version", () => {
-  it("persists the ignored latest version and closes the update dialog", async () => {
-    const updater = mountUpdater();
-    updater.showUpdateDialog.value = true;
-
-    await updater.ignoreCurrentVersion();
-
-    expect(settingsStoreMock.updateEditorSettingsAndPersist).toHaveBeenCalledWith({ ignoredUpdateVersion: "0.5.70" });
-    expect(updater.showUpdateDialog.value).toBe(false);
-    expect(toastMock).toHaveBeenCalledWith("Version v0.5.70 ignored. You'll be reminded when the next version releases.", 5000);
-  });
-
-  it("keeps the dialog open and allows retry when persistence fails", async () => {
-    settingsStoreMock.updateEditorSettingsAndPersist.mockRejectedValueOnce(new Error("storage unavailable")).mockResolvedValueOnce();
-    const updater = mountUpdater();
-    updater.showUpdateDialog.value = true;
-
-    await updater.ignoreCurrentVersion();
-
-    expect(updater.showUpdateDialog.value).toBe(true);
-    expect(updater.isIgnoringUpdate.value).toBe(false);
-    expect(toastMock).toHaveBeenLastCalledWith("Failed to save the ignored version: storage unavailable", 5000);
-
-    await updater.ignoreCurrentVersion();
-
-    expect(settingsStoreMock.updateEditorSettingsAndPersist).toHaveBeenCalledTimes(2);
-    expect(updater.showUpdateDialog.value).toBe(false);
+  it("resumes after notifications are reenabled while cancellation is pending", async () => {
+    const pendingDownload = deferred<typeof cache>();
+    const pendingCancel = deferred<void>();
+    mocks.downloadUpdate.mockReturnValueOnce(pendingDownload.promise);
+    mocks.cancelUpdateDownload.mockReturnValue(pendingCancel.promise);
+    const updater = mount();
+    await updater.initialize();
+    await vi.waitFor(() => expect(mocks.downloadUpdate).toHaveBeenCalledTimes(1));
+    settings.updateNotificationsEnabled = false;
+    await nextTick();
+    settings.updateNotificationsEnabled = true;
+    await nextTick();
+    pendingDownload.reject(new Error("cancelled"));
+    pendingCancel.resolve();
+    await vi.waitFor(() => expect(mocks.downloadUpdate).toHaveBeenCalledTimes(2));
+    expect(updater.updateDownloaded.value).toBe(true);
   });
 });
diff --git a/apps/desktop/src/composables/__tests__/useSidebarConnectionMutationRuntime.selection.spec.ts b/apps/desktop/src/composables/__tests__/useSidebarConnectionMutationRuntime.selection.spec.ts
index 1bc524e377..96ce8befa0 100644
--- a/apps/desktop/src/composables/__tests__/useSidebarConnectionMutationRuntime.selection.spec.ts
+++ b/apps/desktop/src/composables/__tests__/useSidebarConnectionMutationRuntime.selection.spec.ts
@@ -7,7 +7,8 @@ const mocks = vi.hoisted(() => ({
   toast: vi.fn(),
 }));
 
-vi.mock("vue-i18n", () => ({
+vi.mock("vue-i18n", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("vue-i18n")>()),
   useI18n: () => ({
     t: (key: string, params?: Record<string, unknown>) => (params ? `${key}:${JSON.stringify(params)}` : key),
   }),
diff --git a/apps/desktop/src/composables/useAppUpdater.ts b/apps/desktop/src/composables/useAppUpdater.ts
index 113d1de65f..887738dfa4 100644
--- a/apps/desktop/src/composables/useAppUpdater.ts
+++ b/apps/desktop/src/composables/useAppUpdater.ts
@@ -1,17 +1,16 @@
-import { computed, ref } from "vue";
+import { computed, ref, watch, onScopeDispose } from "vue";
 import { useI18n } from "vue-i18n";
 import { isTauriRuntime } from "@/lib/backend/tauriRuntime";
-import { useToast } from "@/composables/useToast";
 import * as api from "@/lib/backend/api";
 import { useSettingsStore } from "@/stores/settingsStore";
 import type { UpdateDownloadSource as SettingsUpdateDownloadSource } from "@/stores/settingsStore";
 import type { UpdateDownloadProgress } from "@/lib/backend/tauri";
 import { currentLocale } from "@/i18n";
 import { shouldBlockAppUpdate } from "@/lib/app/appUpdateTaskGuard";
-import { installDownloadedUpdateWhenIdle } from "@/lib/app/appUpdateInstallFlow";
 
 interface UseAppUpdaterOptions {
   getActiveTaskCount?: () => number;
+  prepareForUpdate?: () => Promise<() => void>;
 }
 
 export function shouldOpenUpdateDialog(options: { silent?: boolean }) {
@@ -110,252 +109,324 @@ export async function resolveUpdaterProxy(): Promise<string | undefined> {
 
 export function useAppUpdater(options: UseAppUpdaterOptions = {}) {
   const { t } = useI18n();
-  const { toast } = useToast();
   const settingsStore = useSettingsStore();
-
-  const checkingUpdates = ref(false);
+  type Phase = "idle" | "checking" | "downloading" | "ready" | "preparing" | "installing" | "restart";
+  const phase = ref<Phase>("idle");
+  const downloaded = ref<api.DownloadedUpdate | null>(null);
   const updateInfo = ref<api.UpdateInfo | null>(null);
   const updateCheckMessage = ref("");
   const updateCheckFailed = ref(false);
   const showUpdateDialog = ref(false);
-  const isDownloadingUpdate = ref(false);
-  // null while the download size is unknown (backend reported no total) — the UI shows an indeterminate state.
-  const downloadProgress = ref<number | null>(0);
-  const updateDownloaded = ref(false);
-  const isInstallingUpdate = ref(false);
-  const updateReady = ref(false);
+  const downloadProgress = ref<number | null>(null);
   const isIgnoringUpdate = ref(false);
+  const checkingUpdates = computed(() => phase.value === "checking");
+  const isDownloadingUpdate = computed(() => phase.value === "downloading");
+  const updateDownloaded = computed(() => downloaded.value !== null);
+  const isPreparingUpdate = computed(() => phase.value === "preparing");
+  const isInstallingUpdate = computed(() => phase.value === "installing" || isPreparingUpdate.value);
+  const updateReady = computed(() => phase.value === "restart");
   const activeTaskCount = computed(() => Math.max(0, Math.trunc(options.getActiveTaskCount?.() ?? 0)));
-  const hasUpdateAvailable = computed(() => updateInfo.value?.update_available === true && !isUpdateIgnored(updateInfo.value, settingsStore.editorSettings.ignoredUpdateVersion));
+  const notificationsEnabled = computed(() => settingsStore.editorSettings.updateNotificationsEnabled !== false);
+  const hasUpdateAvailable = computed(
+    () => notificationsEnabled.value && (updateDownloaded.value || updateReady.value || (updateInfo.value?.update_available === true && (!isTauriRuntime() || updateInfo.value.manual_update_only))) && !isUpdateIgnored(updateInfo.value, settingsStore.editorSettings.ignoredUpdateVersion),
+  );
   const latestReleaseUrl = "https://github.com/t8y2/dbx/releases/latest";
-  let activeDownloadAttempt = 0;
-  let pendingCancellation: Promise<void> | undefined;
+  let generation = 0;
+  let activeDownload: Promise<void> | undefined;
+  let cancellation: Promise<void> | undefined;
+  let cancelOperation: Promise<void> | undefined;
+  let retryTimer: ReturnType<typeof setTimeout> | undefined;
+  let hourlyTimer: ReturnType<typeof setInterval> | undefined;
+  let retries = 0;
+  let initialized = false;
+  let disposed = false;
+  let versionRecheckPending = false;
+  let updatePreparationRelease: (() => void) | undefined;
 
+  function clearRetry() {
+    clearTimeout(retryTimer);
+    retryTimer = undefined;
+  }
+  function fail(error: unknown) {
+    updateCheckFailed.value = true;
+    updateCheckMessage.value = formatUpdateError(error instanceof Error ? error.message : String(error));
+  }
+  function clearError() {
+    updateCheckFailed.value = false;
+    updateCheckMessage.value = "";
+  }
+  function scheduleRetry() {
+    clearRetry();
+    if (!initialized || disposed || !notificationsEnabled.value || retries >= 3) return;
+    const delay = [60_000, 300_000, 900_000][retries++];
+    retryTimer = setTimeout(() => {
+      retryTimer = undefined;
+      void checkUpdates({ silent: true });
+    }, delay);
+  }
+  function setDownloaded(cache: api.DownloadedUpdate) {
+    downloaded.value = cache;
+    updateInfo.value = {
+      current_version: updateInfo.value?.current_version ?? "",
+      latest_version: cache.version,
+      update_available: true,
+      portable_mode: cache.portable_mode,
+      manual_update_only: false,
+      release_name: tagVersion(cache.version),
+      release_url: cache.release_url,
+      release_notes: cache.release_notes,
+    };
+    phase.value = "ready";
+    downloadProgress.value = 100;
+    retries = 0;
+    clearRetry();
+    clearError();
+  }
   function openUrl(url: string) {
-    if (isTauriRuntime()) {
-      import("@tauri-apps/plugin-shell").then(({ open }) => open(url));
-    } else {
-      window.open(url, "_blank");
-    }
+    if (isTauriRuntime()) void import("@tauri-apps/plugin-shell").then(({ open }) => open(url));
+    else window.open(url, "_blank", "noopener,noreferrer");
   }
-
-  async function checkUpdates(options: { silent?: boolean } = {}) {
-    if (checkingUpdates.value) return;
-    // The toolbar icon reuses this as its click handler. If a download/install is already
-    // in flight or finished, just resurface the dialog instead of hitting the network again.
-    if (!options.silent && (isDownloadingUpdate.value || updateDownloaded.value || updateReady.value)) {
-      showUpdateDialog.value = true;
-      return;
-    }
-    checkingUpdates.value = true;
-    // Keep the previous message/failed state visible while the check is in
-    // flight: pre-clearing would flip the dialog to "up to date" with an empty
-    // version and unmount the source switcher until the request settles.
-    try {
-      const info = await api.checkForUpdates(currentLocale(), normalizeUpdateDownloadSource(settingsStore.editorSettings.updateDownloadSource));
-      updateInfo.value = info;
-      updateCheckMessage.value = "";
-      updateCheckFailed.value = false;
-      if (info.update_available) {
-        if (shouldOpenUpdateDialog({ silent: options.silent })) {
-          showUpdateDialog.value = true;
-        }
-      } else if (!options.silent) {
-        updateCheckMessage.value = t("updates.upToDate", { version: info.current_version });
-        showUpdateDialog.value = true;
-      }
-    } catch (e: any) {
-      if (!options.silent) {
-        // Drop the stale update info only on a surfaced failure; silent
-        // background checks keep the last known state so the toolbar
-        // indicator and an in-flight download's portable-mode flag survive
-        // a single failed poll.
-        updateInfo.value = null;
-        updateCheckMessage.value = formatUpdateError(String(e));
-        updateCheckFailed.value = true;
-        showUpdateDialog.value = true;
-      }
-    } finally {
-      checkingUpdates.value = false;
-    }
+  function openLatestRelease() {
+    openUrl(resolveUpdateReleaseUrl(updateInfo.value, settingsStore.editorSettings.updateDownloadSource, latestReleaseUrl));
   }
-
   function formatUpdateError(message: string): string {
     const lower = message.toLowerCase();
-    if (lower.includes("canceled") || lower.includes("cancelled")) {
-      return t("updates.downloadCanceled");
-    }
-    if (lower.includes("403") || lower.includes("rate limit")) {
-      return t("updates.rateLimited");
-    }
-    if (lower.includes("stalled") || lower.includes("timeout") || lower.includes("all available mirrors") || lower.includes("error sending request") || lower.includes("failed to download")) {
-      return t("updates.networkOrMirrorFailed");
-    }
+    if (lower.includes("cancel")) return t("updates.downloadCanceled");
+    if (lower.includes("403") || lower.includes("rate limit")) return t("updates.rateLimited");
+    if (["stalled", "timeout", "all available mirrors", "error sending request", "failed to download"].some((part) => lower.includes(part))) return t("updates.networkOrMirrorFailed");
     return t("updates.downloadFailed", { error: message });
   }
-
-  function openLatestRelease() {
-    const url = resolveUpdateReleaseUrl(updateInfo.value, settingsStore.editorSettings.updateDownloadSource, latestReleaseUrl);
-    openUrl(url);
+  async function checkUpdates(checkOptions: { silent?: boolean } = {}) {
+    if (disposed || isIgnoringUpdate.value) return;
+    if (!checkOptions.silent) showUpdateDialog.value = true;
+    if (phase.value !== "idle" || downloaded.value || (checkOptions.silent && !notificationsEnabled.value)) return;
+    clearRetry();
+    const token = ++generation;
+    phase.value = "checking";
+    clearError();
+    try {
+      const info = await api.checkForUpdates(currentLocale(), normalizeUpdateDownloadSource(settingsStore.editorSettings.updateDownloadSource));
+      if (token !== generation || disposed) return;
+      updateInfo.value = info;
+      phase.value = "idle";
+      if (!info.update_available) updateCheckMessage.value = t("updates.upToDate", { version: info.current_version });
+      if (canDownloadAndInstallUpdate(info, isTauriRuntime()) && !isUpdateIgnored(info, settingsStore.editorSettings.ignoredUpdateVersion)) {
+        await downloadUpdateInBackground();
+      }
+    } catch (error) {
+      if (token !== generation || disposed) return;
+      phase.value = "idle";
+      fail(error);
+      scheduleRetry();
+    }
+  }
+  async function downloadUpdateInBackground() {
+    if (disposed || isIgnoringUpdate.value || phase.value !== "idle" || downloaded.value || !canDownloadAndInstallUpdate(updateInfo.value, isTauriRuntime())) return;
+    const version = updateInfo.value!.latest_version;
+    const token = ++generation;
+    const attemptId = crypto.randomUUID();
+    phase.value = "downloading";
+    downloadProgress.value = null;
+    clearError();
+    clearRetry();
+    const run = async () => {
+      let unlisten: (() => void) | undefined;
+      try {
+        await cancellation;
+        if (token !== generation || disposed) return;
+        const { listen } = await import("@tauri-apps/api/event");
+        unlisten = await listen<UpdateDownloadProgress>("update-download-progress", ({ payload }) => {
+          if (token !== generation || payload.attempt_id !== attemptId || payload.version !== version) return;
+          downloadProgress.value = payload.total && payload.total > 0 ? Math.min(100, Math.round((payload.downloaded / payload.total) * 100)) : null;
+        });
+        if (token !== generation || disposed) return;
+        const cache = await api.downloadUpdate(normalizeUpdateDownloadSource(settingsStore.editorSettings.updateDownloadSource), version, attemptId, updateInfo.value?.release_notes);
+        if (token !== generation || disposed) return;
+        if (cache.version !== version) throw new Error("Downloaded update version changed; check for updates again.");
+        setDownloaded(cache);
+      } catch (error) {
+        if (token !== generation || disposed) return;
+        phase.value = "idle";
+        fail(error);
+        if ((String(error).includes("VERSION_CHANGED") || String(error).toLowerCase().includes("version changed")) && !versionRecheckPending) {
+          versionRecheckPending = true;
+          setTimeout(() => {
+            void checkUpdates({ silent: true }).finally(() => {
+              versionRecheckPending = false;
+            });
+          });
+        } else scheduleRetry();
+      } finally {
+        unlisten?.();
+      }
+    };
+    activeDownload = run();
+    await activeDownload;
+    activeDownload = undefined;
+  }
+  function cancelDownload(): Promise<void> {
+    if (cancelOperation) return cancelOperation;
+    cancelOperation = cancelDownloadImpl().finally(() => {
+      cancelOperation = undefined;
+    });
+    return cancelOperation;
+  }
+  async function cancelDownloadImpl() {
+    clearRetry();
+    generation++;
+    const running = activeDownload;
+    if (phase.value === "checking") phase.value = "idle";
+    if (!running) return;
+    const pending = api.cancelUpdateDownload();
+    cancellation = pending;
+    try {
+      await pending;
+      await running;
+      if (!disposed) {
+        const cache = await api.getDownloadedUpdate();
+        if (cache && !isUpdateIgnored({ latest_version: cache.version } as api.UpdateInfo, settingsStore.editorSettings.ignoredUpdateVersion)) setDownloaded(cache);
+      }
+    } finally {
+      if (cancellation === pending) cancellation = undefined;
+      if (phase.value === "downloading") phase.value = "idle";
+    }
   }
-
   async function changeUpdateDownloadSource(source: SettingsUpdateDownloadSource) {
-    await settingsStore.updateEditorSettingsAndPersist({ updateDownloadSource: source });
-    await checkUpdates();
+    if (isIgnoringUpdate.value || isInstallingUpdate.value) return;
+    try {
+      await settingsStore.updateEditorSettingsAndPersist({ updateDownloadSource: source });
+      if (downloaded.value || updateReady.value || isInstallingUpdate.value) return;
+      await cancelDownload();
+      retries = 0;
+      await checkUpdates();
+    } catch (error) {
+      fail(error);
+    }
   }
-
   async function ignoreCurrentVersion() {
-    const latest = updateInfo.value?.latest_version;
-    if (!latest || isIgnoringUpdate.value) return;
+    const version = updateInfo.value?.latest_version;
+    if (!version || isIgnoringUpdate.value || isInstallingUpdate.value || updateReady.value) return;
     isIgnoringUpdate.value = true;
     try {
-      await settingsStore.updateEditorSettingsAndPersist({ ignoredUpdateVersion: latest });
+      await cancelDownload();
+      await settingsStore.updateEditorSettingsAndPersist({ ignoredUpdateVersion: version });
+      const cache = downloaded.value;
+      downloaded.value = null;
+      phase.value = "idle";
+      if (cache) await api.discardDownloadedUpdate(cache.cache_id);
       showUpdateDialog.value = false;
-      toast(t("updates.versionIgnored", { version: tagVersion(latest) }), 5000);
     } catch (error) {
-      toast(t("updates.ignoreVersionFailed", { error: error instanceof Error ? error.message : String(error) }), 5000);
+      fail(error);
     } finally {
       isIgnoringUpdate.value = false;
     }
   }
-
-  function blockUpdateForActiveTasks(): boolean {
-    if (!shouldBlockAppUpdate(activeTaskCount.value)) return false;
-    toast(t("updates.activeTasksBlockUpdate", { count: activeTaskCount.value }), 5000);
-    return true;
-  }
-
-  async function downloadUpdateInBackground() {
-    if (!isTauriRuntime() || isDownloadingUpdate.value || isInstallingUpdate.value || updateDownloaded.value || updateReady.value) return;
-    if (!canDownloadAndInstallUpdate(updateInfo.value, true)) {
-      openLatestRelease();
-      return;
-    }
-    // Starting the download never has to wait on active work — only installing
-    // (file replacement) is disruptive, so that guard applies at install time instead.
-    showUpdateDialog.value = false;
-    const attempt = ++activeDownloadAttempt;
-    isDownloadingUpdate.value = true;
-    // The total is unknown until the first progress event arrives.
-    downloadProgress.value = null;
-    let unlisten: (() => void) | undefined;
-    const latestVersion = updateInfo.value?.latest_version;
-    toast(t("updates.downloadStarted", { version: latestVersion ? tagVersion(latestVersion) : "" }), 3000);
+  async function performInstall(restartOnly: boolean) {
+    if (!isTauriRuntime() || isInstallingUpdate.value || isIgnoringUpdate.value || (!restartOnly && !downloaded.value)) return;
+    const cache = downloaded.value;
+    let release: (() => void) | undefined;
+    phase.value = "preparing";
+    clearError();
+    let installed = restartOnly;
+    let failed = false;
     try {
-      await pendingCancellation;
-      if (attempt !== activeDownloadAttempt) return;
-      const { listen } = await import("@tauri-apps/api/event");
-      unlisten = await listen<UpdateDownloadProgress>("update-download-progress", (event) => {
-        if (attempt !== activeDownloadAttempt) return;
-        const total = event.payload.total ?? 0;
-        downloadProgress.value = total > 0 ? Math.round((event.payload.downloaded / total) * 100) : null;
-      });
-      await api.downloadUpdate(normalizeUpdateDownloadSource(settingsStore.editorSettings.updateDownloadSource), latestVersion);
-      if (attempt !== activeDownloadAttempt) return;
-      downloadProgress.value = 100;
-      updateDownloaded.value = true;
-      // The download phase is truly finished — flip this now so the install guard (which
-      // checks isDownloadingUpdate) can evaluate freely instead of treating us as still busy.
-      isDownloadingUpdate.value = false;
-      if (shouldBlockAppUpdate(activeTaskCount.value)) {
-        // Matches the pre-refactor behavior: installing waits for active work to finish, but
-        // unlike before, only installing waits — the download itself never blocked on it.
-        toast(t("updates.readyToInstall", { version: latestVersion ? tagVersion(latestVersion) : "" }), 10000, {
-          label: t("updates.installNow"),
-          onClick: () => {
-            void installDownloadedUpdate();
-          },
-        });
-      } else {
-        // Restores the pre-refactor auto-install-when-idle behavior for the install step.
-        await installDownloadedUpdate();
+      release = await options.prepareForUpdate?.();
+      updatePreparationRelease = release;
+      if (shouldBlockAppUpdate(activeTaskCount.value)) throw new Error(t("updates.activeTasksBlockUpdate", { count: activeTaskCount.value }));
+      phase.value = "installing";
+      if (!restartOnly && cache) {
+        await api.installDownloadedUpdate(cache.cache_id, cache.version);
+        installed = true;
+        downloaded.value = null;
       }
-    } catch (e: any) {
-      if (attempt !== activeDownloadAttempt) return;
-      downloadProgress.value = 0;
-      const rawMsg = e?.message || String(e);
-      console.error("[DBX update error]", rawMsg);
-      const lower = rawMsg.toLowerCase();
-      if (lower.includes("canceled") || lower.includes("cancelled")) {
-        return;
+      // Windows installers and the portable helper own process replacement/relaunch.
+      if (!cache?.portable_mode && !navigator.userAgent.includes("Windows")) {
+        phase.value = "restart";
+        const { relaunch } = await import("@tauri-apps/plugin-process");
+        await relaunch();
       }
-      toast(formatUpdateError(rawMsg), 5000);
+    } catch (error) {
+      failed = true;
+      phase.value = installed ? "restart" : "ready";
+      updateCheckFailed.value = true;
+      updateCheckMessage.value = t(installed ? "updates.restartFailed" : "updates.installFailed", { error: error instanceof Error ? error.message : String(error) });
     } finally {
-      unlisten?.();
-      if (attempt === activeDownloadAttempt) {
-        isDownloadingUpdate.value = false;
+      // Successful handoff must keep every window frozen until the process exits.
+      if (failed) {
+        release?.();
+        updatePreparationRelease = undefined;
       }
-    }
-  }
-
-  async function installPendingUpdate() {
-    isInstallingUpdate.value = true;
-    try {
-      const portableMode = updateInfo.value?.portable_mode === true;
-      await api.installDownloadedUpdate();
-      updateDownloaded.value = false;
-      // The portable helper exits and relaunches DBX after the invoke response is delivered.
-      updateReady.value = !portableMode;
-    } finally {
-      isInstallingUpdate.value = false;
-    }
-  }
-
-  async function installDownloadedUpdate() {
-    if (!isTauriRuntime() || isDownloadingUpdate.value || isInstallingUpdate.value || !updateDownloaded.value) return;
-    try {
-      const installed = await installDownloadedUpdateWhenIdle({
-        getActiveTaskCount: () => activeTaskCount.value,
-        install: installPendingUpdate,
-      });
-      if (!installed) {
-        blockUpdateForActiveTasks();
-        return;
-      }
-      if (updateReady.value) {
-        toast(t("updates.installedReadyToRestart"), 10000, {
-          label: t("updates.restart"),
-          onClick: () => {
-            void restartApp();
-          },
-        });
-      }
-    } catch (e: any) {
-      toast(t("updates.installFailed", { error: e?.message || String(e) }), 5000);
-    }
-  }
-
-  async function restartApp() {
-    if (!isTauriRuntime()) return;
-    if (blockUpdateForActiveTasks()) return;
-    try {
-      const { relaunch } = await import("@tauri-apps/plugin-process");
-      await relaunch();
-    } catch (e: any) {
-      toast(t("updates.restartFailed", { error: e?.message || String(e) }), 5000);
-    }
-  }
-
-  async function cancelDownload() {
-    if (isDownloadingUpdate.value) {
-      activeDownloadAttempt += 1;
-      isDownloadingUpdate.value = false;
-      downloadProgress.value = 0;
-      if (isTauriRuntime()) {
-        const cancellation = api.cancelUpdateDownload().catch(() => {});
-        pendingCancellation = cancellation;
+      if (!installed && cache) {
         try {
-          await cancellation;
-        } finally {
-          if (pendingCancellation === cancellation) {
-            pendingCancellation = undefined;
+          const restored = await api.getDownloadedUpdate();
+          if (!restored || restored.cache_id !== cache.cache_id) {
+            downloaded.value = null;
+            phase.value = "idle";
           }
+        } catch {
+          /* Keep the original installation error available for retry. */
         }
       }
     }
   }
-
+  async function installDownloadedUpdate() {
+    await performInstall(false);
+  }
+  async function restartApp() {
+    if (updateReady.value) await performInstall(true);
+  }
+  async function initialize() {
+    if (initialized || disposed) return;
+    initialized = true;
+    if (isTauriRuntime()) {
+      phase.value = "checking";
+      try {
+        const cache = await api.getDownloadedUpdate();
+        if (disposed) return;
+        if (cache) {
+          const ignored = isUpdateIgnored({ latest_version: cache.version } as api.UpdateInfo, settingsStore.editorSettings.ignoredUpdateVersion);
+          if (ignored) await api.discardDownloadedUpdate(cache.cache_id);
+          else {
+            setDownloaded(cache);
+            updateInfo.value!.current_version = await api.getAppVersion();
+          }
+        }
+      } catch (error) {
+        fail(error);
+      } finally {
+        if (phase.value === "checking") phase.value = "idle";
+      }
+    }
+    if (disposed) return;
+    hourlyTimer = setInterval(() => {
+      if (!retryTimer) {
+        retries = 0;
+        void checkUpdates({ silent: true });
+      }
+    }, 3_600_000);
+    void checkUpdates({ silent: true });
+  }
+  const stopSettingsWatch = watch(notificationsEnabled, (enabled) => {
+    if (!initialized || disposed) return;
+    const settle = enabled ? (cancelOperation ?? Promise.resolve()) : cancelDownload();
+    void settle
+      .then(() => {
+        if (notificationsEnabled.value && !disposed) void checkUpdates({ silent: true });
+      })
+      .catch(fail);
+  });
+  function dispose() {
+    disposed = true;
+    clearRetry();
+    clearInterval(hourlyTimer);
+    stopSettingsWatch();
+    updatePreparationRelease?.();
+    updatePreparationRelease = undefined;
+    void cancelDownload().catch(() => {});
+  }
+  onScopeDispose(dispose);
   return {
+    phase,
     checkingUpdates,
     updateInfo,
     updateCheckMessage,
@@ -365,6 +436,7 @@ export function useAppUpdater(options: UseAppUpdaterOptions = {}) {
     downloadProgress,
     updateDownloaded,
     isInstallingUpdate,
+    isPreparingUpdate,
     updateReady,
     isIgnoringUpdate,
     activeTaskCount,
@@ -380,5 +452,7 @@ export function useAppUpdater(options: UseAppUpdaterOptions = {}) {
     cancelDownload,
     installDownloadedUpdate,
     restartApp,
+    initialize,
+    dispose,
   };
 }
diff --git a/apps/desktop/src/i18n/locales/az.ts b/apps/desktop/src/i18n/locales/az.ts
index ca26213d72..603d0df355 100644
--- a/apps/desktop/src/i18n/locales/az.ts
+++ b/apps/desktop/src/i18n/locales/az.ts
@@ -285,6 +285,19 @@ export default withEnglishFallback({
     changedAgain: "Fayl yadda saxlanılarkən yenidən dəyişdirildi. Yenidən cəhd edin.",
   },
   updates: {
+    preparationWindowOperation: "Yeniləmədən əvvəl cari pəncərə əməliyyatının bitməsini gözləyin.",
+    preparationBusy: "Yeniləmə artıq hazırlanır.",
+    preparationCancelled: "Yeniləmə hazırlığı ləğv edildi.",
+    preparationTimeout: "Pəncərə 5 saniyə ərzində saxlanmadı. Yenidən sınayın.",
+    preparationWindowsChanged: "Açıq pəncərələr dəyişdi. Yenidən sınayın.",
+    preparationTasks: "Aktiv tapşırıqları və tranzaksiyaları bitirin.",
+    preparationDrafts: "Dəyişiklikləri saxlayın və ya ləğv edin.",
+    preparationConfig: "Konfiqurasiya redaktəsini bitirin.",
+    preparationNotReady: "Yeniləmə hazır deyil. Yenidən sınayın.",
+    downloadedReady: "v{version} versiyası endirilib. Yeniləmək üçün yenidən başladın.",
+    restartAndUpdate: "Yenidən başladın və yeniləyin",
+    preparing: "Yeniləmə hazırlanır…",
+    retryDownload: "Endirməni yenidən sınayın",
     title: "Yeniləmələr",
     check: "Yeniləmələri yoxla",
     updateReadyTooltip: "Yeniləmə hazırdır — quraşdırmaq üçün klikləyin",
@@ -6743,7 +6756,7 @@ export default withEnglishFallback({
     closeActionQuit: "DBX-dən çıx",
     closeActionMinimize: "Sistem treyinə kiçilt",
     updateNotificationsEnabled: "Yeniləmə xatırlatmalarını aktiv et",
-    updateNotificationsEnabledDescription: "Deaktiv olduqda DBX tətbiq və ya drayver yeniləmələrini avtomatik yoxlamayacaq və yeniləmə nişanlarını göstərməyəcək. Əl ilə yoxlama yenə mümkündür.",
+    updateNotificationsEnabledDescription: "Tətbiq və sürücü yeniləmələrini avtomatik yoxlayır, tətbiq yeniləmələrini səssiz endirir. Söndürüldükdə avtomatik yoxlamalar, endirmələr və nişanlar dayanır. Əl ilə yoxlama və endirilmiş yeniləmələrin quraşdırılması mümkündür.",
     updateDownloadSource: "Yeniləmələrin endirmə mənbəyi",
     updateDownloadSourceDescription: "Tətbiq yeniləmələrinin, verilənlər bazası agentlərinin, drayverlərin və idarə olunan JRE-lərin haradan endiriləcəyini seçin. Rəsmi mənbə tövsiyə olunur; CNB materik Çin şəbəkələrində daha sürətli ola bilər.",
     updateDownloadSourceOfficial: "Rəsmi mənbə (tövsiyə olunur)",
diff --git a/apps/desktop/src/i18n/locales/en.ts b/apps/desktop/src/i18n/locales/en.ts
index dd708d7322..cb03cd4d47 100644
--- a/apps/desktop/src/i18n/locales/en.ts
+++ b/apps/desktop/src/i18n/locales/en.ts
@@ -286,6 +286,19 @@ export default {
     changedAgain: "The file changed again while it was being saved. Try again.",
   },
   updates: {
+    preparationWindowOperation: "Please wait for the current window operation to finish before updating.",
+    preparationBusy: "An update is already being prepared.",
+    preparationCancelled: "Update preparation was cancelled.",
+    preparationTimeout: "A window did not save within 5 seconds. Try again.",
+    preparationWindowsChanged: "Open windows changed. Try the update again.",
+    preparationTasks: "Finish active tasks and transactions before updating.",
+    preparationDrafts: "Save or discard unsaved changes before updating.",
+    preparationConfig: "Finish editing the current configuration before updating.",
+    preparationNotReady: "Update preparation is not ready. Try again.",
+    downloadedReady: "New version v{version} is downloaded. Restart to update.",
+    restartAndUpdate: "Restart & Update",
+    preparing: "Preparing update…",
+    retryDownload: "Retry Download",
     title: "Updates",
     check: "Check for updates",
     updateReadyTooltip: "Update ready — click to install",
@@ -6740,7 +6753,7 @@ export default {
     closeActionQuit: "Quit DBX",
     closeActionMinimize: "Minimize to tray",
     updateNotificationsEnabled: "Enable update reminders",
-    updateNotificationsEnabledDescription: "When disabled, DBX will not automatically check app or driver updates or show update badges. Manual checks are still available.",
+    updateNotificationsEnabledDescription: "Automatically check for app and driver updates and silently download app updates. When disabled, automatic checks, app downloads and update badges stop. You can still check manually and install downloaded updates.",
     updateDownloadSource: "Update download source",
     updateDownloadSourceDescription: "Choose where app updates, database agents, drivers, and managed JREs are downloaded from. The official source is recommended; CNB can be faster on mainland China networks.",
     updateDownloadSourceOfficial: "Official source (recommended)",
diff --git a/apps/desktop/src/i18n/locales/es.ts b/apps/desktop/src/i18n/locales/es.ts
index 843e3f11f1..fc08ed92c6 100644
--- a/apps/desktop/src/i18n/locales/es.ts
+++ b/apps/desktop/src/i18n/locales/es.ts
@@ -288,6 +288,19 @@ export default withEnglishFallback({
     changedAgain: "El archivo volvió a cambiar durante el guardado. Inténtalo de nuevo.",
   },
   updates: {
+    preparationWindowOperation: "Espera a que termine la operación de ventana actual antes de actualizar.",
+    preparationBusy: "Ya se está preparando una actualización.",
+    preparationCancelled: "Se canceló la preparación.",
+    preparationTimeout: "Una ventana no se guardó en 5 segundos. Reintenta.",
+    preparationWindowsChanged: "Las ventanas abiertas cambiaron. Reintenta.",
+    preparationTasks: "Finaliza las tareas y transacciones activas.",
+    preparationDrafts: "Guarda o descarta los cambios pendientes.",
+    preparationConfig: "Finaliza la edición de configuración.",
+    preparationNotReady: "La actualización no está lista. Reintenta.",
+    downloadedReady: "La versión v{version} está descargada. Reinicia para actualizar.",
+    restartAndUpdate: "Reiniciar y actualizar",
+    preparing: "Preparando actualización…",
+    retryDownload: "Reintentar descarga",
     title: "Actualizaciones",
     check: "Buscar actualizaciones",
     updateReadyTooltip: "Actualización lista, haz clic para instalar",
@@ -6314,7 +6327,7 @@ export default withEnglishFallback({
     closeActionQuit: "Salir de DBX",
     closeActionMinimize: "Minimizar a la bandeja",
     updateNotificationsEnabled: "Activar recordatorios de actualización",
-    updateNotificationsEnabledDescription: "Al desactivarlo, DBX no comprobará automáticamente actualizaciones de la app ni de los controladores, ni mostrará indicadores. Las comprobaciones manuales siguen disponibles.",
+    updateNotificationsEnabledDescription: "Comprueba actualizaciones de la app y los controladores y descarga las de la app en silencio. Al desactivar se detienen las comprobaciones, descargas e indicadores. Puedes comprobar manualmente e instalar actualizaciones descargadas.",
     updateDownloadSource: "Origen de descarga de actualizaciones",
     updateDownloadSourceDescription: "Elige de dónde se descargan los instaladores de actualización. Se recomienda la fuente oficial; CNB puede ser más rápido en redes de China continental.",
     updateDownloadSourceOfficial: "Fuente oficial (recomendada)",
diff --git a/apps/desktop/src/i18n/locales/it.ts b/apps/desktop/src/i18n/locales/it.ts
index 85d7090f5d..fa1a31e13a 100644
--- a/apps/desktop/src/i18n/locales/it.ts
+++ b/apps/desktop/src/i18n/locales/it.ts
@@ -287,6 +287,19 @@ export default withEnglishFallback({
     changedAgain: "Il file è cambiato di nuovo durante il salvataggio. Riprova.",
   },
   updates: {
+    preparationWindowOperation: "Attendi il completamento dell’operazione sulla finestra prima di aggiornare.",
+    preparationBusy: "Un aggiornamento è già in preparazione.",
+    preparationCancelled: "Preparazione annullata.",
+    preparationTimeout: "Una finestra non ha salvato entro 5 secondi. Riprova.",
+    preparationWindowsChanged: "Le finestre aperte sono cambiate. Riprova.",
+    preparationTasks: "Termina attività e transazioni in corso.",
+    preparationDrafts: "Salva o scarta le modifiche non salvate.",
+    preparationConfig: "Completa la modifica della configurazione.",
+    preparationNotReady: "Aggiornamento non pronto. Riprova.",
+    downloadedReady: "La versione v{version} è scaricata. Riavvia per aggiornare.",
+    restartAndUpdate: "Riavvia e aggiorna",
+    preparing: "Preparazione aggiornamento…",
+    retryDownload: "Riprova download",
     title: "Aggiornamenti",
     check: "Verifica aggiornamenti",
     updateReadyTooltip: "Aggiornamento pronto, clicca per installare",
@@ -6314,7 +6327,7 @@ export default withEnglishFallback({
     closeActionQuit: "Esci da DBX",
     closeActionMinimize: "Riduci a icona",
     updateNotificationsEnabled: "Abilita promemoria aggiornamenti",
-    updateNotificationsEnabledDescription: "Se disattivato, DBX non controllerà automaticamente gli aggiornamenti dell'app o dei driver e non mostrerà badge. I controlli manuali restano disponibili.",
+    updateNotificationsEnabledDescription: "Controlla gli aggiornamenti di app e driver e scarica quelli dell’app senza notifiche. Disattivando, controlli automatici, download e indicatori si fermano. Restano disponibili controlli manuali e installazione degli aggiornamenti scaricati.",
     updateDownloadSource: "Fonte download aggiornamenti",
     updateDownloadSourceDescription: "Scegli da dove scaricare gli installer degli aggiornamenti. La fonte ufficiale è consigliata; CNB può essere più veloce sulle reti della Cina continentale.",
     updateDownloadSourceOfficial: "Fonte ufficiale (consigliata)",
diff --git a/apps/desktop/src/i18n/locales/ja.ts b/apps/desktop/src/i18n/locales/ja.ts
index 011e093ed7..21c97dbb06 100644
--- a/apps/desktop/src/i18n/locales/ja.ts
+++ b/apps/desktop/src/i18n/locales/ja.ts
@@ -288,6 +288,19 @@ export default withEnglishFallback({
     changedAgain: "保存中にファイルが再度変更されました。もう一度お試しください。",
   },
   updates: {
+    preparationWindowOperation: "更新する前に、現在のウィンドウ操作が完了するまでお待ちください。",
+    preparationBusy: "更新を準備中です。",
+    preparationCancelled: "更新準備をキャンセルしました。",
+    preparationTimeout: "5 秒以内に保存できないウィンドウがあります。再試行してください。",
+    preparationWindowsChanged: "ウィンドウ構成が変わりました。再試行してください。",
+    preparationTasks: "実行中のタスクとトランザクションを終了してください。",
+    preparationDrafts: "未保存の変更を保存または破棄してください。",
+    preparationConfig: "設定の編集を終了してください。",
+    preparationNotReady: "更新の準備ができていません。再試行してください。",
+    downloadedReady: "新バージョン v{version} をダウンロード済みです。再起動して更新できます。",
+    restartAndUpdate: "再起動して更新",
+    preparing: "更新を準備中…",
+    retryDownload: "ダウンロードを再試行",
     title: "アップデート",
     check: "アップデートを確認",
     updateReadyTooltip: "アップデートの準備ができました。クリックしてインストール",
@@ -6352,7 +6365,7 @@ export default withEnglishFallback({
     closeActionQuit: "DBXを終了",
     closeActionMinimize: "トレイに最小化",
     updateNotificationsEnabled: "アップデート通知を有効にする",
-    updateNotificationsEnabledDescription: "無効時、DBXはアプリやドライバーのアップデートを自動確認せず、アップデートバッジも表示しません。手動確認は引き続き利用可能です。",
+    updateNotificationsEnabledDescription: "アプリとドライバーの更新を自動確認し、アプリ更新を通知せずにダウンロードします。無効にすると自動確認、ダウンロード、更新バッジが停止します。手動確認とダウンロード済み更新のインストールは可能です。",
     debugLoggingEnabled: "デバッグログを有効にする",
     debugLoggingEnabledDescription: "トラブルシューティング時に、より詳細なローカル診断ログを記録します。デフォルトでは無効です。",
     metadataCacheMemoryLimit: "メタデータメモリキャッシュ上限",
diff --git a/apps/desktop/src/i18n/locales/ko.ts b/apps/desktop/src/i18n/locales/ko.ts
index c6229015fa..bc0265ad80 100644
--- a/apps/desktop/src/i18n/locales/ko.ts
+++ b/apps/desktop/src/i18n/locales/ko.ts
@@ -286,6 +286,19 @@ export default withEnglishFallback({
     changedAgain: "저장하는 동안 파일이 다시 변경되었습니다. 다시 시도하세요.",
   },
   updates: {
+    preparationWindowOperation: "업데이트하기 전에 현재 창 작업이 완료될 때까지 기다려 주세요.",
+    preparationBusy: "업데이트를 준비 중입니다.",
+    preparationCancelled: "업데이트 준비가 취소되었습니다.",
+    preparationTimeout: "창이 5초 안에 저장되지 않았습니다. 다시 시도하세요.",
+    preparationWindowsChanged: "열린 창이 변경되었습니다. 다시 시도하세요.",
+    preparationTasks: "실행 중인 작업과 트랜잭션을 종료하세요.",
+    preparationDrafts: "변경 사항을 저장하거나 버리세요.",
+    preparationConfig: "현재 설정 편집을 완료하세요.",
+    preparationNotReady: "업데이트 준비가 안 되었습니다. 다시 시도하세요.",
+    downloadedReady: "새 버전 v{version} 다운로드 완료. 다시 시작하여 업데이트하세요.",
+    restartAndUpdate: "다시 시작 및 업데이트",
+    preparing: "업데이트 준비 중…",
+    retryDownload: "다운로드 재시도",
     title: "업데이트",
     check: "업데이트 확인",
     updateReadyTooltip: "업데이트 준비 완료 — 클릭하여 설치",
@@ -6057,7 +6070,7 @@ export default withEnglishFallback({
     closeActionQuit: "DBX 종료",
     closeActionMinimize: "트레이로 최소화",
     updateNotificationsEnabled: "업데이트 알림 활성화",
-    updateNotificationsEnabledDescription: "비활성화하면 DBX가 앱이나 드라이버 업데이트를 자동으로 확인하거나 업데이트 배지를 표시하지 않습니다. 수동 확인은 여전히 가능합니다.",
+    updateNotificationsEnabledDescription: "앱과 드라이버 업데이트를 자동 확인하고 앱 업데이트를 조용히 다운로드합니다. 끄면 자동 확인, 앱 다운로드와 배지가 중지됩니다. 수동 확인 및 다운로드된 업데이트 설치는 가능합니다.",
     updateDownloadSource: "업데이트 다운로드 소스",
     updateDownloadSourceDescription: "앱 업데이트, 데이터베이스 에이전트, 드라이버, 관리 JRE를 다운로드할 위치를 선택하세요. 공식 소스를 권장합니다. 중국 본토 네트워크에서는 CNB가 더 빠를 수 있습니다.",
     updateDownloadSourceOfficial: "공식 소스 (권장)",
diff --git a/apps/desktop/src/i18n/locales/pt-BR.ts b/apps/desktop/src/i18n/locales/pt-BR.ts
index c2434024c8..a849ffaeeb 100644
--- a/apps/desktop/src/i18n/locales/pt-BR.ts
+++ b/apps/desktop/src/i18n/locales/pt-BR.ts
@@ -288,6 +288,19 @@ export default withEnglishFallback({
     changedAgain: "O arquivo mudou novamente durante o salvamento. Tente outra vez.",
   },
   updates: {
+    preparationWindowOperation: "Aguarde a operação atual da janela terminar antes de atualizar.",
+    preparationBusy: "Uma atualização já está sendo preparada.",
+    preparationCancelled: "Preparação cancelada.",
+    preparationTimeout: "Uma janela não salvou em 5 segundos. Tente novamente.",
+    preparationWindowsChanged: "As janelas abertas mudaram. Tente novamente.",
+    preparationTasks: "Conclua as tarefas e transações ativas.",
+    preparationDrafts: "Salve ou descarte as alterações pendentes.",
+    preparationConfig: "Conclua a edição da configuração.",
+    preparationNotReady: "A atualização não está pronta. Tente novamente.",
+    downloadedReady: "A versão v{version} foi baixada. Reinicie para atualizar.",
+    restartAndUpdate: "Reiniciar e atualizar",
+    preparing: "Preparando atualização…",
+    retryDownload: "Tentar baixar novamente",
     title: "Atualizações",
     check: "Verificar atualizações",
     updateReadyTooltip: "Atualização pronta, clique para instalar",
@@ -6316,7 +6329,7 @@ export default withEnglishFallback({
     closeActionQuit: "Sair do DBX",
     closeActionMinimize: "Minimizar para a bandeja",
     updateNotificationsEnabled: "Ativar lembretes de atualização",
-    updateNotificationsEnabledDescription: "Quando desativado, o DBX não verificará automaticamente atualizações do app ou dos drivers nem mostrará indicadores. Verificações manuais continuam disponíveis.",
+    updateNotificationsEnabledDescription: "Verifica atualizações do app e dos drivers e baixa as do app silenciosamente. Ao desativar, as verificações, downloads e indicadores param. Você ainda pode verificar manualmente e instalar atualizações baixadas.",
     updateDownloadSource: "Fonte de download de atualização",
     updateDownloadSourceDescription: "Escolha de onde os instaladores de atualização no aplicativo são baixados. A fonte oficial é recomendada; CNB pode ser mais rápido em redes da China continental.",
     updateDownloadSourceOfficial: "Fonte oficial (recomendada)",
diff --git a/apps/desktop/src/i18n/locales/tr.ts b/apps/desktop/src/i18n/locales/tr.ts
index c100f8e1c2..7f4c320f1b 100644
--- a/apps/desktop/src/i18n/locales/tr.ts
+++ b/apps/desktop/src/i18n/locales/tr.ts
@@ -287,6 +287,19 @@ export default withEnglishFallback({
     changedAgain: "Dosya kaydedilirken yeniden değişti. Tekrar deneyin.",
   },
   updates: {
+    preparationWindowOperation: "Güncellemeden önce geçerli pencere işleminin tamamlanmasını bekleyin.",
+    preparationBusy: "Güncelleme zaten hazırlanıyor.",
+    preparationCancelled: "Güncelleme hazırlığı iptal edildi.",
+    preparationTimeout: "Bir pencere 5 saniyede kaydetmedi. Yeniden deneyin.",
+    preparationWindowsChanged: "Açık pencereler değişti. Yeniden deneyin.",
+    preparationTasks: "Etkin görevleri ve işlemleri bitirin.",
+    preparationDrafts: "Kaydedilmemiş değişiklikleri kaydedin veya atın.",
+    preparationConfig: "Yapılandırma düzenlemesini bitirin.",
+    preparationNotReady: "Güncelleme hazır değil. Yeniden deneyin.",
+    downloadedReady: "v{version} sürümü indirildi. Güncellemek için yeniden başlatın.",
+    restartAndUpdate: "Yeniden başlat ve güncelle",
+    preparing: "Güncelleme hazırlanıyor…",
+    retryDownload: "İndirmeyi yeniden dene",
     title: "Güncellemeler",
     check: "Güncellemeleri denetle",
     updateReadyTooltip: "Güncelleme hazır — kurmak için tıklayın",
@@ -6625,7 +6638,7 @@ export default withEnglishFallback({
     closeActionQuit: "DBX'ten çık",
     closeActionMinimize: "Tepsiye küçült",
     updateNotificationsEnabled: "Güncelleme anımsatıcılarını etkinleştir",
-    updateNotificationsEnabledDescription: "Kapatıldığında DBX, uygulama veya sürücü güncellemelerini otomatik denetlemez ve güncelleme rozetleri göstermez. Elle denetim yine kullanılabilir.",
+    updateNotificationsEnabledDescription: "Uygulama ve sürücü güncellemelerini otomatik kontrol eder, uygulama güncellemelerini sessizce indirir. Kapatıldığında otomatik kontroller, indirmeler ve rozetler durur. Elle kontrol ve indirilen güncellemeleri yükleme kullanılabilir.",
     updateDownloadSource: "Güncelleme indirme kaynağı",
     updateDownloadSourceDescription: "Uygulama güncellemelerinin, veritabanı agent'larının, sürücülerin ve yönetilen JRE'lerin nereden indirileceğini seçin. Resmî kaynak önerilir; Çin anakarası ağlarında CNB daha hızlı olabilir.",
     updateDownloadSourceOfficial: "Resmî kaynak (önerilen)",
diff --git a/apps/desktop/src/i18n/locales/zh-CN.ts b/apps/desktop/src/i18n/locales/zh-CN.ts
index a53d2d80a9..eb9fc63fca 100644
--- a/apps/desktop/src/i18n/locales/zh-CN.ts
+++ b/apps/desktop/src/i18n/locales/zh-CN.ts
@@ -211,6 +211,19 @@ export default withEnglishFallback({
     changedAgain: "保存过程中该文件再次发生变化，请重试。",
   },
   updates: {
+    preparationWindowOperation: "请等待当前窗口操作完成后再更新。",
+    preparationBusy: "正在准备更新，请稍候。",
+    preparationCancelled: "更新准备已取消。",
+    preparationTimeout: "有窗口未在 5 秒内完成保存，请重试。",
+    preparationWindowsChanged: "打开的窗口发生变化，请重新尝试更新。",
+    preparationTasks: "请先结束正在运行的任务和事务。",
+    preparationDrafts: "请先保存或放弃尚未保存的修改。",
+    preparationConfig: "请先完成当前配置编辑。",
+    preparationNotReady: "更新准备尚未就绪，请重试。",
+    downloadedReady: "新版本 v{version} 已下载，重启即可更新",
+    restartAndUpdate: "重启并更新",
+    preparing: "正在准备更新…",
+    retryDownload: "重试下载",
     title: "更新",
     check: "检查更新",
     updateReadyTooltip: "更新已就绪，点击安装",
@@ -6723,7 +6736,7 @@ export default withEnglishFallback({
     closeActionQuit: "退出程序",
     closeActionMinimize: "最小化到托盘",
     updateNotificationsEnabled: "启用更新提醒",
-    updateNotificationsEnabledDescription: "关闭后，DBX 不会自动检查应用和驱动更新，也不会显示更新红点；仍可手动检查更新。",
+    updateNotificationsEnabledDescription: "自动检查应用和驱动更新，并静默下载应用更新。关闭后停止自动检查、应用下载和更新红点；仍可手动检查并安装已下载的更新。",
     updateDownloadSource: "更新下载源",
     updateDownloadSourceDescription: "选择应用更新、数据库 Agent、驱动和托管 JRE 的下载来源。官方源为推荐选项，CNB 适合国内网络环境。",
     updateDownloadSourceOfficial: "官方源（推荐）",
diff --git a/apps/desktop/src/i18n/locales/zh-TW.ts b/apps/desktop/src/i18n/locales/zh-TW.ts
index eed99274bd..ff11ad0369 100644
--- a/apps/desktop/src/i18n/locales/zh-TW.ts
+++ b/apps/desktop/src/i18n/locales/zh-TW.ts
@@ -288,6 +288,19 @@ export default withEnglishFallback({
     changedAgain: "儲存期間檔案再次發生變更，請重試。",
   },
   updates: {
+    preparationWindowOperation: "請等待目前視窗操作完成後再更新。",
+    preparationBusy: "正在準備更新，請稍候。",
+    preparationCancelled: "更新準備已取消。",
+    preparationTimeout: "有視窗未在 5 秒內完成儲存，請重試。",
+    preparationWindowsChanged: "開啟的視窗發生變化，請重新嘗試更新。",
+    preparationTasks: "請先結束正在執行的工作和交易。",
+    preparationDrafts: "請先儲存或捨棄尚未儲存的修改。",
+    preparationConfig: "請先完成目前設定編輯。",
+    preparationNotReady: "更新準備尚未就緒，請重試。",
+    downloadedReady: "新版本 v{version} 已下載，重新啟動即可更新",
+    restartAndUpdate: "重新啟動並更新",
+    preparing: "正在準備更新…",
+    retryDownload: "重試下載",
     title: "更新",
     check: "檢查更新",
     updateReadyTooltip: "更新已就緒，點擊安裝",
@@ -5633,7 +5646,7 @@ export default withEnglishFallback({
     closeActionQuit: "退出程式",
     closeActionMinimize: "最小化到系統匣",
     updateNotificationsEnabled: "啟用更新提醒",
-    updateNotificationsEnabledDescription: "關閉後，DBX 不會自動檢查應用程式和驅動程式更新，也不會顯示更新紅點；仍可手動檢查更新。",
+    updateNotificationsEnabledDescription: "自動檢查應用程式和驅動程式更新，並靜默下載應用程式更新。關閉後停止自動檢查、應用程式下載和更新紅點；仍可手動檢查並安裝已下載的更新。",
     debugLoggingEnabled: "啟用偵錯日誌",
     debugLoggingEnabledDescription: "開啟後在本機記錄更詳細的使用者側診斷日誌，回報問題時可暫時開啟；預設關閉。",
     metadataCacheMemoryLimit: "中繼資料記憶體快取上限",
diff --git a/apps/desktop/src/lib/__tests__/app/openTabsPersistence.spec.ts b/apps/desktop/src/lib/__tests__/app/openTabsPersistence.spec.ts
index 319dfbf84e..eb07378143 100644
--- a/apps/desktop/src/lib/__tests__/app/openTabsPersistence.spec.ts
+++ b/apps/desktop/src/lib/__tests__/app/openTabsPersistence.spec.ts
@@ -21,6 +21,12 @@ function roundTrip(tabs: QueryTab[]) {
 }
 
 describe("openTabsPersistence originalSql round-trip", () => {
+  it("keeps clean saved SQL tabs eligible for file hydration", () => {
+    const [restored] = roundTrip([queryTab({ savedSqlId: "saved", sql: "SELECT 1", originalSql: "SELECT 1" })]);
+    expect(restored.sql).toBe("");
+    expect(restored.originalSql).toBeUndefined();
+  });
+
   it("preserves read-only source intent without adding editable source metadata", () => {
     const [restored] = roundTrip([queryTab({ sourceView: true, sql: "CREATE SEQUENCE seq_users" })]);
     expect(restored.sourceView).toBe(true);
diff --git a/apps/desktop/src/lib/ai/desktopAiRunRegistry.ts b/apps/desktop/src/lib/ai/desktopAiRunRegistry.ts
index c02036ec03..6de85f60fa 100644
--- a/apps/desktop/src/lib/ai/desktopAiRunRegistry.ts
+++ b/apps/desktop/src/lib/ai/desktopAiRunRegistry.ts
@@ -128,6 +128,11 @@ export function hasActiveDesktopAiRun(conversationId: string): boolean {
   return run.status === "preparing" || run.status === "queued" || run.status === "running" || run.status === "awaiting_write_confirmation" || run.status === "pending_recoverable";
 }
 
+/** Restart has no opportunity to recover an in-memory AI run after process exit. */
+export function blockingDesktopAiRunsForUpdate(): DesktopAiRunRuntime[] {
+  return [...runsByConversation.values()].filter((run) => !isTerminalDesktopAiRunStatus(run.status));
+}
+
 export function blockingDesktopAiRunsForQuit(): DesktopAiRunRuntime[] {
   return [...runsByConversation.values()].filter((run) => run.status === "preparing" || run.status === "queued" || run.status === "running");
 }
diff --git a/apps/desktop/src/lib/app/__tests__/detachedTabWindow.update.spec.ts b/apps/desktop/src/lib/app/__tests__/detachedTabWindow.update.spec.ts
new file mode 100644
index 0000000000..595a040ae7
--- /dev/null
+++ b/apps/desktop/src/lib/app/__tests__/detachedTabWindow.update.spec.ts
@@ -0,0 +1,87 @@
+// @vitest-environment happy-dom
+import { readFileSync } from "node:fs";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { acquireUpdateBarrier, assertUpdateSafe } from "../updatePreparation";
+import { openDetachedTabWindow } from "../detachedTabWindow";
+const mocks = vi.hoisted(() => ({ getByLabel: vi.fn(), created: vi.fn(), callbacks: new Map<string, (event?: unknown) => unknown>(), show: vi.fn(), focus: vi.fn(), destroy: vi.fn() }));
+vi.mock("@/lib/backend/tauriRuntime", () => ({ isTauriRuntime: () => true }));
+vi.mock("@/lib/app/windowContext", () => ({ detachedWindowLabel: (id: string) => `detached-${id}`, detachedWindowUrl: () => "http://localhost/" }));
+vi.mock("@tauri-apps/api/webviewWindow", () => ({
+  WebviewWindow: class {
+    static getByLabel = mocks.getByLabel;
+    constructor() {
+      mocks.created();
+    }
+    once(event: string, callback: (event?: unknown) => unknown) {
+      mocks.callbacks.set(event, callback);
+      return Promise.resolve(() => {});
+    }
+    show = mocks.show;
+    setFocus = mocks.focus;
+    destroy = mocks.destroy;
+  },
+}));
+afterEach(() => {
+  vi.clearAllMocks();
+  mocks.callbacks.clear();
+  vi.useRealTimers();
+});
+function pendingLookup() {
+  let resolve!: (value: unknown) => void;
+  const promise = new Promise((done) => {
+    resolve = done;
+  });
+  mocks.getByLabel.mockReturnValueOnce(promise);
+  return resolve;
+}
+describe("detached window update exclusion", () => {
+  it("grants the capability required to remove never-shown late windows", () => {
+    const capability = JSON.parse(readFileSync("src-tauri/capabilities/default.json", "utf8"));
+    expect(capability.permissions).toContain("core:window:allow-destroy");
+  });
+
+  it("blocks update preparation while the asynchronous existing-window lookup is pending", async () => {
+    const resolve = pendingLookup();
+    const operation = openDetachedTabWindow("one", "SQL");
+    await vi.waitFor(() => expect(mocks.getByLabel).toHaveBeenCalled());
+    expect(assertUpdateSafe).toThrow("window operation");
+    resolve({ show: async () => {}, setFocus: async () => {} });
+    expect(await operation).toEqual({ opened: true });
+    expect(assertUpdateSafe).not.toThrow();
+  });
+  it("does not create a window if preparation starts during the awaited lookup", async () => {
+    const resolve = pendingLookup();
+    const operation = openDetachedTabWindow("two", "SQL");
+    await vi.waitFor(() => expect(mocks.getByLabel).toHaveBeenCalled());
+    const release = acquireUpdateBarrier();
+    resolve(null);
+    const result = await operation;
+    expect(result.opened).toBe(false);
+    expect(result.error).toContain("Update preparation");
+    expect(mocks.created).not.toHaveBeenCalled();
+    release();
+    expect(assertUpdateSafe).not.toThrow();
+  });
+  it("keeps a timed-out native creation blocked and closes a late child without showing it", async () => {
+    vi.useFakeTimers();
+    mocks.getByLabel.mockResolvedValueOnce(null);
+    mocks.destroy.mockResolvedValue(undefined);
+    const operation = openDetachedTabWindow("late", "SQL");
+    await vi.waitFor(() => expect(mocks.created).toHaveBeenCalled());
+    await vi.advanceTimersByTimeAsync(10_000);
+    expect((await operation).opened).toBe(false);
+    expect(assertUpdateSafe).toThrow("window operation");
+    await mocks.callbacks.get("tauri://created")?.();
+    expect(mocks.destroy).toHaveBeenCalledOnce();
+    expect(mocks.show).not.toHaveBeenCalled();
+    expect(mocks.focus).not.toHaveBeenCalled();
+    expect(assertUpdateSafe).not.toThrow();
+  });
+  it("rejects a new detach before starting native lookup while preparation is active", async () => {
+    const release = acquireUpdateBarrier();
+    expect((await openDetachedTabWindow("three", "SQL")).opened).toBe(false);
+    expect(mocks.getByLabel).not.toHaveBeenCalled();
+    release();
+    expect(assertUpdateSafe).not.toThrow();
+  });
+});
diff --git a/apps/desktop/src/lib/app/__tests__/updatePreparation.spec.ts b/apps/desktop/src/lib/app/__tests__/updatePreparation.spec.ts
new file mode 100644
index 0000000000..ece334c434
--- /dev/null
+++ b/apps/desktop/src/lib/app/__tests__/updatePreparation.spec.ts
@@ -0,0 +1,155 @@
+// @vitest-environment happy-dom
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { effectScope } from "vue";
+import { acquireUpdateBarrier, beginUpdateSensitiveOperation, prepareUpdateWithDraftRecovery, UPDATE_RESTORE_KEY, assertUpdateAllowsCommand, assertUpdateSafe, setupUpdatePreparation, useUpdateBlocker } from "../updatePreparation";
+import i18n, { loadLocaleMessages } from "@/i18n";
+
+const bus = vi.hoisted(() => ({ label: "main", members: ["main"] as string[], listeners: new Map<string, Set<{ label: string; callback: (event: any) => unknown }>>() }));
+vi.mock("@tauri-apps/api/webviewWindow", () => ({ getCurrentWebviewWindow: () => ({ label: bus.label }), getAllWebviewWindows: async () => bus.members.map((label) => ({ label })) }));
+vi.mock("@tauri-apps/api/event", () => ({
+  listen: async (event: string, callback: (event: any) => unknown) => {
+    const entry = { label: bus.label, callback };
+    const listeners = bus.listeners.get(event) ?? new Set();
+    listeners.add(entry);
+    bus.listeners.set(event, listeners);
+    return () => listeners.delete(entry);
+  },
+  emit: async (event: string, payload: unknown) => {
+    for (const listener of bus.listeners.get(event) ?? []) void listener.callback({ payload });
+  },
+  emitTo: async (label: string, event: string, payload: unknown) => {
+    for (const listener of bus.listeners.get(event) ?? []) if (listener.label === label) void listener.callback({ payload });
+  },
+}));
+afterEach(() => {
+  bus.listeners.clear();
+  bus.members = ["main"];
+  bus.label = "main";
+  vi.useRealTimers();
+});
+
+describe("update restart preparation", () => {
+  it("translates a pending window operation using the current locale", async () => {
+    const previousLocale = i18n.global.locale.value;
+    await loadLocaleMessages("zh-CN");
+    const release = beginUpdateSensitiveOperation();
+    try {
+      i18n.global.locale.value = "zh-CN";
+      expect(assertUpdateSafe).toThrow("请等待当前窗口操作完成后再更新。");
+      i18n.global.locale.value = "en";
+      expect(assertUpdateSafe).toThrow("Please wait for the current window operation to finish before updating.");
+    } finally {
+      release();
+      i18n.global.locale.value = previousLocale;
+    }
+  });
+
+  it("marks recovery only after all preparation succeeds and preserves recovery when relaunch fails", async () => {
+    const storage = new Map<string, string>();
+    const disk = {
+      setItem: (key: string, value: string) => {
+        storage.set(key, value);
+      },
+    };
+    await expect(
+      prepareUpdateWithDraftRecovery(async () => {
+        throw new Error("companion failed");
+      }, disk),
+    ).rejects.toThrow("companion failed");
+    expect(storage.has(UPDATE_RESTORE_KEY)).toBe(false);
+    const release = vi.fn();
+    const undo = await prepareUpdateWithDraftRecovery(async () => release, disk);
+    expect(storage.get(UPDATE_RESTORE_KEY)).toBe("1");
+    undo();
+    expect(storage.get(UPDATE_RESTORE_KEY)).toBe("1");
+    expect(release).toHaveBeenCalledOnce();
+  });
+  it("releases the barrier when saving the recovery marker fails", async () => {
+    const release = vi.fn();
+    const disk = {
+      getItem: () => null,
+      setItem: () => {
+        throw new Error("storage unavailable");
+      },
+      removeItem: vi.fn(),
+    };
+    await expect(prepareUpdateWithDraftRecovery(async () => release, disk)).rejects.toThrow("storage unavailable");
+    expect(release).toHaveBeenCalledOnce();
+  });
+
+  it("blocks native task commands and input until explicitly released", () => {
+    const release = acquireUpdateBarrier();
+    expect(() => assertUpdateAllowsCommand("execute_query")).toThrow();
+    expect(() => assertUpdateAllowsCommand("unknown_future_mutation")).toThrow();
+    expect(() => assertUpdateAllowsCommand("save_open_tabs_state")).not.toThrow();
+    expect(() => assertUpdateAllowsCommand("install_downloaded_update")).not.toThrow();
+    const event = new Event("beforeinput", { cancelable: true });
+    window.dispatchEvent(event);
+    expect(event.defaultPrevented).toBe(true);
+    release();
+    release();
+    expect(() => assertUpdateAllowsCommand("execute_query")).not.toThrow();
+  });
+  it("removes editor vetoes when their scope is disposed", () => {
+    const scope = effectScope();
+    scope.run(() => useUpdateBlocker(() => "unsaved Redis value"));
+    expect(assertUpdateSafe).toThrow("unsaved Redis value");
+    scope.stop();
+    expect(assertUpdateSafe).not.toThrow();
+  });
+  it("waits for every window to save and holds the barrier until release", async () => {
+    bus.members = ["main", "detached-tab-one"];
+    const persist = vi.fn(async () => {});
+    const main = await setupUpdatePreparation({ assertSafe() {}, persist });
+    bus.label = "detached-tab-one";
+    const detached = await setupUpdatePreparation({ assertSafe() {}, persist });
+    const release = await main.prepare();
+    expect(persist).toHaveBeenCalledTimes(2);
+    expect(() => assertUpdateAllowsCommand("execute_query")).toThrow();
+    release();
+    expect(() => assertUpdateAllowsCommand("execute_query")).not.toThrow();
+    main.dispose();
+    detached.dispose();
+  });
+  it("releases all windows if a draft write fails", async () => {
+    const main = await setupUpdatePreparation({
+      assertSafe() {},
+      persist: async () => {
+        throw new Error("disk full");
+      },
+    });
+    await expect(main.prepare()).rejects.toThrow("disk full");
+    expect(() => assertUpdateAllowsCommand("execute_query")).not.toThrow();
+    main.dispose();
+  });
+  it("fails if a new window appears while saving", async () => {
+    const main = await setupUpdatePreparation({
+      assertSafe() {},
+      persist: async () => {
+        bus.members.push("late-window");
+      },
+    });
+    await expect(main.prepare()).rejects.toThrow("Open windows changed");
+    expect(() => assertUpdateAllowsCommand("execute_query")).not.toThrow();
+    main.dispose();
+  });
+  it("times out a hung local disk write even without other windows", async () => {
+    vi.useFakeTimers();
+    const main = await setupUpdatePreparation({ assertSafe() {}, persist: () => new Promise(() => {}) });
+    const result = expect(main.prepare()).rejects.toThrow("5 seconds");
+    await vi.advanceTimersByTimeAsync(5000);
+    await result;
+    expect(() => assertUpdateAllowsCommand("execute_query")).not.toThrow();
+    main.dispose();
+  });
+  it("times out an unresponsive window after five seconds", async () => {
+    vi.useFakeTimers();
+    bus.members.push("unresponsive");
+    const main = await setupUpdatePreparation({ assertSafe() {}, persist: async () => {} });
+    const result = expect(main.prepare()).rejects.toThrow("5 seconds");
+    await vi.advanceTimersByTimeAsync(5000);
+    await result;
+    expect(() => assertUpdateAllowsCommand("execute_query")).not.toThrow();
+    main.dispose();
+  });
+});
diff --git a/apps/desktop/src/lib/app/detachedTabWindow.ts b/apps/desktop/src/lib/app/detachedTabWindow.ts
index 0fb4e1a1ea..de1a0f2131 100644
--- a/apps/desktop/src/lib/app/detachedTabWindow.ts
+++ b/apps/desktop/src/lib/app/detachedTabWindow.ts
@@ -1,3 +1,4 @@
+import { assertUpdateAllowsInteraction, beginUpdateSensitiveOperation } from "@/lib/app/updatePreparation";
 import { detachedWindowLabel, detachedWindowUrl } from "@/lib/app/windowContext";
 import { isTauriRuntime } from "@/lib/backend/tauriRuntime";
 
@@ -19,7 +20,9 @@ function errorMessage(error: unknown): string {
 
 export async function openDetachedTabWindow(tabId: string, title: string, position?: DetachedWindowOpenPosition): Promise<DetachedWindowOpenResult> {
   if (!isTauriRuntime()) return { opened: false, error: "Detached windows are only available in the desktop app." };
+  let finishOperation: (() => void) | undefined;
   try {
+    finishOperation = beginUpdateSensitiveOperation();
     const { WebviewWindow } = await import("@tauri-apps/api/webviewWindow");
     const label = detachedWindowLabel(tabId);
     const existing = await WebviewWindow.getByLabel(label);
@@ -29,6 +32,7 @@ export async function openDetachedTabWindow(tabId: string, title: string, positi
       return { opened: true };
     }
 
+    assertUpdateAllowsInteraction();
     const child = new WebviewWindow(label, {
       url: detachedWindowUrl(tabId),
       title,
@@ -42,14 +46,32 @@ export async function openDetachedTabWindow(tabId: string, title: string, positi
       center: false,
     });
 
+    // A caller timeout does not prove native window creation has stopped.
+    // Keep this second reservation until a native terminal event arrives.
+    const finishNativeCreation = beginUpdateSensitiveOperation();
     return await new Promise((resolve) => {
       let settled = false;
+      let timedOut = false;
+      let timeout: ReturnType<typeof setTimeout> | undefined;
       const finish = (result: DetachedWindowOpenResult) => {
         if (settled) return;
         settled = true;
+        clearTimeout(timeout);
         resolve(result);
       };
       void child.once("tauri://created", async () => {
+        if (timedOut) {
+          try {
+            // The caller already restored its tab; never surface a duplicate.
+            await child.destroy();
+            finishNativeCreation();
+          } catch (error) {
+            // Keep the reservation if removal is uncertain, rather than
+            // allowing restart to race a still-initializing webview.
+            console.error("[DBX][detached-tab:late-create:close-error]", error);
+          }
+          return;
+        }
         try {
           if (position) {
             const { PhysicalPosition } = await import("@tauri-apps/api/dpi");
@@ -60,18 +82,26 @@ export async function openDetachedTabWindow(tabId: string, title: string, positi
           finish({ opened: true });
         } catch (error) {
           finish({ opened: false, error: errorMessage(error) });
+        } finally {
+          finishNativeCreation();
         }
       });
       void child.once("tauri://error", (event) => {
         const error = errorMessage(event?.payload);
         console.error("[DBX][detached-tab:create:error]", error);
         finish({ opened: false, error });
+        finishNativeCreation();
       });
-      setTimeout(() => finish({ opened: false, error: "Timed out while creating the detached window." }), 10_000);
+      timeout = setTimeout(() => {
+        timedOut = true;
+        finish({ opened: false, error: "Timed out while creating the detached window." });
+      }, 10_000);
     });
   } catch (error) {
     const message = errorMessage(error);
     console.error("[DBX][detached-tab:create:error]", error);
     return { opened: false, error: message };
+  } finally {
+    finishOperation?.();
   }
 }
diff --git a/apps/desktop/src/lib/app/openTabsPersistence.ts b/apps/desktop/src/lib/app/openTabsPersistence.ts
index 9bdcde930e..e945bb8da5 100644
--- a/apps/desktop/src/lib/app/openTabsPersistence.ts
+++ b/apps/desktop/src/lib/app/openTabsPersistence.ts
@@ -52,6 +52,7 @@ export interface SavedOpenTab {
   nacosNamespace?: string;
   nacosNamespaceName?: string;
   structureTableName?: string;
+  structureDraft?: QueryTab["structureDraft"];
   objectBrowser?: QueryTab["objectBrowser"];
   objectSource?: QueryTab["objectSource"];
   sourceView?: boolean;
@@ -102,7 +103,7 @@ function shouldPersistTabSql(tab: QueryTab) {
 function restoredOriginalSql(tab: SavedOpenTab, mode: QueryTab["mode"], sql: string) {
   if (mode !== "query") return undefined;
   if (tab.externalSqlPath) return tab.originalSql ?? sql;
-  if (tab.savedSqlId) return sql ? "" : undefined;
+  if (tab.savedSqlId) return tab.originalSql ?? (sql ? "" : undefined);
   // Prefer the persisted originalSql so a clean prefilled query tab (sql === originalSql)
   // restores clean instead of being marked dirty. Older saved state without this field
   // falls through to "" (preserving prior behavior for user-edited scratch tabs).
@@ -141,9 +142,9 @@ export function serializeOpenTabs(tabs: QueryTab[]): SavedOpenTab[] {
     sql: shouldPersistTabSql(tab) ? tab.sql : "",
     ...(tab.editorViewport ? { editorViewport: tab.editorViewport } : {}),
     ...(tab.editorSelection ? { editorSelection: tab.editorSelection } : {}),
-    // Plain query tabs always round-trip originalSql. External-file tabs only persist it
-    // while dirty so their disk baseline survives restart without duplicating clean SQL.
-    ...(tab.originalSql !== undefined && !tab.savedSqlId && (!tab.externalSqlPath || tab.sql !== tab.originalSql) ? { originalSql: tab.originalSql } : {}),
+    // File-backed drafts retain their baseline, including when the edited SQL is empty.
+    // Clean file-backed tabs omit it so startup can hydrate the current file content.
+    ...(tab.originalSql !== undefined && ((!tab.savedSqlId && !tab.externalSqlPath) || tab.sql !== tab.originalSql) ? { originalSql: tab.originalSql } : {}),
     savedSqlId: tab.savedSqlId,
     externalSqlPath: tab.externalSqlPath,
     ...(tab.externalSqlFileVersion ? { externalSqlFileVersion: tab.externalSqlFileVersion } : {}),
@@ -168,6 +169,7 @@ export function serializeOpenTabs(tabs: QueryTab[]): SavedOpenTab[] {
     ...(tab.nacosNamespace !== undefined ? { nacosNamespace: tab.nacosNamespace } : {}),
     ...(tab.nacosNamespaceName !== undefined ? { nacosNamespaceName: tab.nacosNamespaceName } : {}),
     ...(tab.structureTableName !== undefined ? { structureTableName: tab.structureTableName } : {}),
+    ...(tab.structureDraft ? { structureDraft: JSON.parse(JSON.stringify(tab.structureDraft)) } : {}),
     objectBrowser: tab.objectBrowser,
     objectSource: tab.objectSource,
     ...(tab.sourceView ? { sourceView: true } : {}),
diff --git a/apps/desktop/src/lib/app/updatePreparation.ts b/apps/desktop/src/lib/app/updatePreparation.ts
new file mode 100644
index 0000000000..16d28bfe11
--- /dev/null
+++ b/apps/desktop/src/lib/app/updatePreparation.ts
@@ -0,0 +1,176 @@
+import { onScopeDispose } from "vue";
+import i18n from "@/i18n";
+
+const blockers = new Set<() => string | undefined>();
+let barrierDepth = 0;
+export const UPDATE_RESTORE_KEY = "dbx-update-restore-tabs";
+
+/** Editors with non-durable drafts must explicitly veto a restart. */
+export function useUpdateBlocker(blocker: () => string | undefined): void {
+  blockers.add(blocker);
+  onScopeDispose(() => blockers.delete(blocker));
+}
+
+/** Reserve a window/task transition before its first asynchronous boundary. */
+export function beginUpdateSensitiveOperation(reason?: string): () => void {
+  assertUpdateAllowsInteraction();
+  const blocker = () => reason ?? i18n.global.t("updates.preparationWindowOperation");
+  blockers.add(blocker);
+  return () => {
+    blockers.delete(blocker);
+  };
+}
+
+export function assertUpdateSafe(): void {
+  for (const blocker of blockers) {
+    const reason = blocker();
+    if (reason) throw new Error(reason);
+  }
+}
+
+export function assertUpdateAllowsCommand(command: string): void {
+  if (!barrierDepth) return;
+  // During the short install barrier only updater and durable-draft I/O are allowed.
+  const allowed = new Set(["save_open_tabs_state", "save_detached_tab_handoff", "load_detached_tab_handoff", "save_tab_result_snapshot", "get_downloaded_update", "install_downloaded_update", "discard_downloaded_update"]);
+  if (!allowed.has(command)) throw new Error("Update preparation is in progress. Please wait.");
+}
+
+export function isUpdatePreparationActive(): boolean {
+  return barrierDepth > 0;
+}
+
+export function assertUpdateAllowsInteraction(): void {
+  if (barrierDepth) throw new Error("Update preparation is in progress. Please wait.");
+}
+
+// Register during module evaluation, before App mounts its capture-phase shortcuts.
+// Registering only at installation time would let older listeners run first.
+const inputEvents = ["keydown", "keyup", "pointerdown", "mousedown", "click", "dblclick", "beforeinput", "paste", "cut", "drop", "contextmenu"];
+const stopDuringPreparation = (event: Event) => {
+  if (!barrierDepth) return;
+  event.preventDefault();
+  event.stopImmediatePropagation();
+};
+if (typeof window !== "undefined" && window.addEventListener) {
+  for (const event of inputEvents) window.addEventListener(event, stopDuringPreparation, true);
+}
+
+export function acquireUpdateBarrier(): () => void {
+  barrierDepth++;
+  let released = false;
+  return () => {
+    if (released) return;
+    released = true;
+    barrierDepth--;
+  };
+}
+
+/** Mark only fully prepared attempts; retain recovery if install succeeds but relaunch fails. */
+export async function prepareUpdateWithDraftRecovery(prepare: () => Promise<() => void>, storage: Pick<Storage, "setItem"> = window.localStorage): Promise<() => void> {
+  const release = await prepare();
+  try {
+    storage.setItem(UPDATE_RESTORE_KEY, "1");
+  } catch (error) {
+    release();
+    throw error;
+  }
+  // The release callback does not know whether native installation succeeded.
+  // Conservatively keep drafts recoverable after any fully prepared attempt.
+  return release;
+}
+
+export interface UpdatePreparationParticipant {
+  assertSafe(): void;
+  persist(): Promise<void>;
+  translate?(key: string): string;
+}
+
+/** ACK every live webview before the installer can terminate the process. */
+export async function setupUpdatePreparation(participant: UpdatePreparationParticipant): Promise<{ prepare(): Promise<() => void>; dispose(): void }> {
+  const { listen, emit, emitTo } = await import("@tauri-apps/api/event");
+  const { getAllWebviewWindows, getCurrentWebviewWindow } = await import("@tauri-apps/api/webviewWindow");
+  const label = getCurrentWebviewWindow().label;
+  const message = (key: string, fallback: string) => participant.translate?.(`updates.${key}`) ?? fallback;
+  const held = new Map<string, () => void>();
+  const released = new Set<string>();
+  const pending = new Map<string, (payload: { label: string; error?: string }) => void>();
+  const prepareLocal = async (id: string) => {
+    if (released.has(id)) throw new Error(message("preparationCancelled", "Update preparation was cancelled"));
+    if (held.has(id)) throw new Error(message("preparationBusy", "Update preparation already in progress"));
+    held.set(id, acquireUpdateBarrier());
+    participant.assertSafe();
+    assertUpdateSafe();
+    await participant.persist();
+    participant.assertSafe();
+    assertUpdateSafe();
+  };
+  const release = (id: string) => {
+    released.add(id);
+    held.get(id)?.();
+    held.delete(id);
+  };
+  const unlisteners = [
+    await listen<{ id: string; owner: string }>("dbx:update-prepare", async ({ payload }) => {
+      if (payload.owner === label) return;
+      let error: string | undefined;
+      try {
+        await prepareLocal(payload.id);
+      } catch (cause) {
+        error = String(cause);
+        release(payload.id);
+      }
+      await emitTo(payload.owner, "dbx:update-prepared", { id: payload.id, label, error });
+    }),
+    await listen<{ id: string; label: string; error?: string }>("dbx:update-prepared", ({ payload }) => pending.get(payload.id)?.(payload)),
+    await listen<{ id: string }>("dbx:update-release", ({ payload }) => release(payload.id)),
+  ];
+  return {
+    async prepare() {
+      if (held.size) throw new Error(message("preparationBusy", "Update preparation already in progress"));
+      const id = crypto.randomUUID();
+      const members = (await getAllWebviewWindows()).map((item) => item.label).sort();
+      const expected = new Set(members.filter((item) => item !== label));
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      const acknowledgements = new Promise<void>((resolve, reject) => {
+        pending.set(id, (payload) => {
+          if (!expected.has(payload.label)) return;
+          if (payload.error) {
+            reject(new Error(payload.error));
+            return;
+          }
+          expected.delete(payload.label);
+          if (!expected.size) resolve();
+        });
+        if (!expected.size) resolve();
+      });
+      // Attach the rejection handler immediately while the local disk flush runs.
+      const timeout = new Promise<never>((_, reject) => {
+        timer = setTimeout(() => reject(new Error(message("preparationTimeout", "A window did not save its drafts within 5 seconds. Please retry."))), 5000);
+      });
+      const work = Promise.race([Promise.all([acknowledgements, prepareLocal(id), emit("dbx:update-prepare", { id, owner: label })]), timeout]);
+      try {
+        await work;
+        const current = (await getAllWebviewWindows()).map((item) => item.label).sort();
+        if (JSON.stringify(current) !== JSON.stringify(members)) throw new Error(message("preparationWindowsChanged", "Open windows changed during update preparation. Please retry."));
+        participant.assertSafe();
+        assertUpdateSafe();
+        return () => {
+          release(id);
+          void emit("dbx:update-release", { id });
+        };
+      } catch (error) {
+        release(id);
+        await emit("dbx:update-release", { id });
+        throw error;
+      } finally {
+        clearTimeout(timer);
+        pending.delete(id);
+      }
+    },
+    dispose() {
+      unlisteners.forEach((unlisten) => unlisten());
+      held.forEach((unlock) => unlock());
+      held.clear();
+    },
+  };
+}
diff --git a/apps/desktop/src/lib/backend/api.ts b/apps/desktop/src/lib/backend/api.ts
index 669251f264..355d596f4f 100644
--- a/apps/desktop/src/lib/backend/api.ts
+++ b/apps/desktop/src/lib/backend/api.ts
@@ -833,6 +833,8 @@ export const fetchChangelog = forward("fetchChangelog");
 export const getSystemProxyUrl = forward("getSystemProxyUrl");
 export const downloadUpdate = forward("downloadUpdate");
 export const cancelUpdateDownload = forward("cancelUpdateDownload");
+export const getDownloadedUpdate = forward("getDownloadedUpdate");
+export const discardDownloadedUpdate = forward("discardDownloadedUpdate");
 export const installDownloadedUpdate = forward("installDownloadedUpdate");
 export const getAppVersion = forward("getAppVersion");
 export const getAppSupportInfo = forward("getAppSupportInfo");
@@ -891,6 +893,7 @@ export type {
   McpHttpServerStatus,
   WebMcpHttpStatus,
   UpdateInfo,
+  DownloadedUpdate,
   RedisBlob,
   RedisCollectionPage,
   RedisDatabaseInfo,
diff --git a/apps/desktop/src/lib/backend/http.ts b/apps/desktop/src/lib/backend/http.ts
index b2e69be2d4..278b21b322 100644
--- a/apps/desktop/src/lib/backend/http.ts
+++ b/apps/desktop/src/lib/backend/http.ts
@@ -77,6 +77,7 @@ import type {
   DriverInstallProgress,
   JavaRuntimeConfig,
   UpdateInfo,
+  DownloadedUpdate,
   UpdateDownloadSource,
   RedisCollectionPage,
   RedisDatabaseInfo,
@@ -4482,13 +4483,19 @@ export async function getSystemProxyUrl(): Promise<string | null> {
   return null;
 }
 
-export async function downloadUpdate(_source: UpdateDownloadSource, _latestVersion?: string): Promise<void> {
+export async function downloadUpdate(_source: UpdateDownloadSource, _latestVersion: string, _attemptId: string, _releaseNotes?: string): Promise<DownloadedUpdate> {
   throw new Error("In-app update downloads are only available in the desktop app.");
 }
 
 export async function cancelUpdateDownload(): Promise<void> {}
 
-export async function installDownloadedUpdate(): Promise<void> {
+export async function getDownloadedUpdate(): Promise<DownloadedUpdate | null> {
+  return null;
+}
+
+export async function discardDownloadedUpdate(_cacheId: string): Promise<void> {}
+
+export async function installDownloadedUpdate(_cacheId: string, _expectedVersion: string): Promise<void> {
   throw new Error("In-app update installation is only available in the desktop app.");
 }
 
diff --git a/apps/desktop/src/lib/backend/tauri.ts b/apps/desktop/src/lib/backend/tauri.ts
index fe65cab39e..f9e696df98 100644
--- a/apps/desktop/src/lib/backend/tauri.ts
+++ b/apps/desktop/src/lib/backend/tauri.ts
@@ -1,4 +1,10 @@
-import { invoke } from "@tauri-apps/api/core";
+import { invoke as tauriInvoke } from "@tauri-apps/api/core";
+import { assertUpdateAllowsCommand } from "@/lib/app/updatePreparation";
+
+function invoke<T>(command: string, args?: Record<string, unknown>): Promise<T> {
+  assertUpdateAllowsCommand(command);
+  return tauriInvoke<T>(command, args);
+}
 import type { DetachedTabHandoff } from "@/lib/app/detachedTabHandoff";
 import { BackendErrorException, type BackendError } from "@/lib/backend/errorUtils";
 import { listen, type UnlistenFn } from "@tauri-apps/api/event";
@@ -2469,7 +2475,18 @@ export interface UpdateInfo {
 
 export type UpdateDownloadSource = "official" | "cnb";
 
+export interface DownloadedUpdate {
+  cache_id: string;
+  version: string;
+  portable_mode: boolean;
+  release_url: string;
+  release_notes: string;
+  downloaded_at: number;
+}
+
 export interface UpdateDownloadProgress {
+  attempt_id: string;
+  version: string;
   downloaded: number;
   total: number | null;
 }
@@ -2516,16 +2533,24 @@ export async function getSystemProxyUrl(): Promise<string | null> {
   return invoke("get_system_proxy_url");
 }
 
-export async function downloadUpdate(source: UpdateDownloadSource, latestVersion?: string): Promise<void> {
-  return invoke("download_update", { source, latestVersion });
+export async function downloadUpdate(source: UpdateDownloadSource, latestVersion: string, attemptId: string, releaseNotes?: string): Promise<DownloadedUpdate> {
+  return invoke("download_update", { source, latestVersion, attemptId, releaseNotes });
 }
 
 export async function cancelUpdateDownload(): Promise<void> {
   return invoke("cancel_update_download");
 }
 
-export async function installDownloadedUpdate(): Promise<void> {
-  return invoke("install_downloaded_update");
+export async function getDownloadedUpdate(): Promise<DownloadedUpdate | null> {
+  return invoke("get_downloaded_update");
+}
+
+export async function discardDownloadedUpdate(cacheId: string): Promise<void> {
+  return invoke("discard_downloaded_update", { cacheId });
+}
+
+export async function installDownloadedUpdate(cacheId: string, expectedVersion: string): Promise<void> {
+  return invoke("install_downloaded_update", { cacheId, expectedVersion });
 }
 
 export async function getAppVersion(): Promise<string> {
diff --git a/apps/desktop/src/stores/__tests__/queryStore.detachedTab.spec.ts b/apps/desktop/src/stores/__tests__/queryStore.detachedTab.spec.ts
index 1c3d326778..1bac396c9e 100644
--- a/apps/desktop/src/stores/__tests__/queryStore.detachedTab.spec.ts
+++ b/apps/desktop/src/stores/__tests__/queryStore.detachedTab.spec.ts
@@ -71,15 +71,15 @@ describe("queryStore adoptDetachedTab", () => {
     expect(queryStore.isTabDirty(tab)).toBe(false);
   });
 
-  it("does not touch the backend when the handoff already carries unsaved edits", async () => {
+  it.each(["SELECT 2;", ""])("does not replace unsaved edits %j with file content", async (sql) => {
     const { useQueryStore } = await import("@/stores/queryStore");
     const queryStore = useQueryStore();
 
-    const tabId = await queryStore.adoptDetachedTab(handoffFor({ sql: "SELECT 2;", originalSql: "SELECT 1;" }));
+    const tabId = await queryStore.adoptDetachedTab(handoffFor({ sql, originalSql: "SELECT 1;" }));
 
     expect(mocks.loadSavedSqlFile).not.toHaveBeenCalled();
     const tab = queryStore.tabs.find((candidate) => candidate.id === tabId)!;
-    expect(tab.sql).toBe("SELECT 2;");
+    expect(tab.sql).toBe(sql);
     expect(queryStore.isTabDirty(tab)).toBe(true);
   });
 
diff --git a/apps/desktop/src/stores/__tests__/queryStore.updateDrafts.spec.ts b/apps/desktop/src/stores/__tests__/queryStore.updateDrafts.spec.ts
new file mode 100644
index 0000000000..be4c33af24
--- /dev/null
+++ b/apps/desktop/src/stores/__tests__/queryStore.updateDrafts.spec.ts
@@ -0,0 +1,96 @@
+import { createPinia, setActivePinia } from "pinia";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+const savedFile = { id: "saved", connectionId: "conn", database: "db", name: "saved.sql", sql: "SELECT 1;", createdAt: "2026-09-10T00:00:00Z", updatedAt: "2026-09-10T00:00:00Z" };
+const mocks = vi.hoisted(() => ({ saved: null as any }));
+vi.mock("@/lib/backend/api", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/lib/backend/api")>()),
+  loadOpenTabsState: async () => mocks.saved,
+  saveOpenTabsState: async (payload: unknown) => {
+    mocks.saved = payload;
+  },
+  listDetachedTabHandoffs: async () => [],
+}));
+describe("update draft recovery", () => {
+  beforeEach(() => {
+    vi.resetModules();
+    mocks.saved = null;
+    const storage = new Map<string, string>();
+    vi.stubGlobal("localStorage", { getItem: (key: string) => storage.get(key) ?? null, setItem: (key: string, value: string) => storage.set(key, value), removeItem: (key: string) => storage.delete(key) });
+    setActivePinia(createPinia());
+  });
+  it.each(["", "SELECT 2;"])("preserves a saved SQL draft %j through recovery and file hydration", async (sql) => {
+    const { useQueryStore } = await import("@/stores/queryStore");
+    const { useSettingsStore } = await import("@/stores/settingsStore");
+    const { useSavedSqlStore } = await import("@/stores/savedSqlStore");
+    const { UPDATE_RESTORE_KEY } = await import("@/lib/app/updatePreparation");
+    const store = useQueryStore();
+    const id = store.createTab("conn", "db");
+    Object.assign(store.tabs.find((tab) => tab.id === id)!, { savedSqlId: "saved", sql, originalSql: "SELECT 1;" });
+    await store.flushPendingPersist();
+    localStorage.setItem(UPDATE_RESTORE_KEY, "1");
+    setActivePinia(createPinia());
+    useSettingsStore().updateEditorSettings({ openTabsRestoreMode: "none", confirmUnsavedSqlClose: false });
+    const ensureFileContent = vi.spyOn(useSavedSqlStore(), "ensureFileContent");
+    const restored = useQueryStore();
+    await restored.initOpenTabs({ validConnectionIds: ["conn"] });
+    await restored.hydrateSavedSqlTabs();
+    const tab = restored.tabs.find((tab) => tab.id === id)!;
+    expect(tab.sql).toBe(sql);
+    expect(tab.originalSql).toBe("SELECT 1;");
+    expect(restored.isTabDirty(tab)).toBe(true);
+    expect(ensureFileContent).not.toHaveBeenCalled();
+    expect(localStorage.getItem(UPDATE_RESTORE_KEY)).toBeNull();
+    expect(restored.openSavedSql(savedFile)).toBe(id);
+    expect(tab.sql).toBe(sql);
+    expect(tab.originalSql).toBe("SELECT 1;");
+    expect(restored.isTabDirty(tab)).toBe(true);
+    ensureFileContent.mockRestore();
+  });
+
+  it("loads file content when reopening a clean restored SQL library tab", async () => {
+    const { useQueryStore } = await import("@/stores/queryStore");
+    const { UPDATE_RESTORE_KEY } = await import("@/lib/app/updatePreparation");
+    const store = useQueryStore();
+    const id = store.openSavedSql(savedFile);
+    await store.flushPendingPersist();
+    localStorage.setItem(UPDATE_RESTORE_KEY, "1");
+    setActivePinia(createPinia());
+    const restored = useQueryStore();
+    await restored.initOpenTabs({ validConnectionIds: ["conn"] });
+    const tab = restored.tabs.find((tab) => tab.id === id)!;
+    expect(tab.sql).toBe("");
+    expect(tab.originalSql).toBeUndefined();
+    expect(restored.openSavedSql(savedFile)).toBe(id);
+    expect(tab.sql).toBe(savedFile.sql);
+    expect(tab.originalSql).toBe(savedFile.sql);
+    expect(restored.isTabDirty(tab)).toBe(false);
+  });
+
+  it("recovers SQL and structure drafts once even when normal restore and close protection are disabled", async () => {
+    const { useQueryStore } = await import("@/stores/queryStore");
+    const { useSettingsStore } = await import("@/stores/settingsStore");
+    const { UPDATE_RESTORE_KEY } = await import("@/lib/app/updatePreparation");
+    const settings = useSettingsStore();
+    settings.updateEditorSettings({ openTabsRestoreMode: "none", confirmUnsavedSqlClose: false });
+    const store = useQueryStore();
+    const sqlId = store.createTab("conn", "db");
+    store.updateSql(sqlId, "select unsaved;");
+    const structureId = store.openTableStructure("conn", "db", undefined, "users");
+    const draft = { dirty: true, initialized: true, ddlDraft: "alter table users add column name text" };
+    store.tabs.find((tab) => tab.id === structureId)!.structureDraft = draft as any;
+    await store.flushPendingPersist();
+    localStorage.setItem(UPDATE_RESTORE_KEY, "1");
+    setActivePinia(createPinia());
+    useSettingsStore().updateEditorSettings({ openTabsRestoreMode: "none", confirmUnsavedSqlClose: false });
+    const restored = useQueryStore();
+    await restored.initOpenTabs({ validConnectionIds: ["conn"] });
+    expect(restored.tabs.find((tab) => tab.id === sqlId)?.sql).toBe("select unsaved;");
+    expect(restored.tabs.find((tab) => tab.id === structureId)?.structureDraft).toEqual(draft);
+    expect(localStorage.getItem(UPDATE_RESTORE_KEY)).toBeNull();
+    setActivePinia(createPinia());
+    useSettingsStore().updateEditorSettings({ openTabsRestoreMode: "none" });
+    const subsequent = useQueryStore();
+    await subsequent.initOpenTabs({ validConnectionIds: ["conn"] });
+    expect(subsequent.tabs).toEqual([]);
+  });
+});
diff --git a/apps/desktop/src/stores/queryStore.ts b/apps/desktop/src/stores/queryStore.ts
index cdcd923b36..547718e84c 100644
--- a/apps/desktop/src/stores/queryStore.ts
+++ b/apps/desktop/src/stores/queryStore.ts
@@ -1,3 +1,4 @@
+import { UPDATE_RESTORE_KEY, assertUpdateAllowsInteraction } from "@/lib/app/updatePreparation";
 import { defineStore } from "pinia";
 import { uuid } from "@/lib/common/utils";
 import { computed, markRaw, nextTick, onScopeDispose, reactive, ref, watch } from "vue";
@@ -741,7 +742,7 @@ function restoreSavedTabsFromPayload(
   payload: { tabs?: unknown; activeTabId?: unknown; groups?: unknown; focusedGroupId?: unknown; orientation?: unknown; sizes?: unknown } | null | undefined,
   options: { validConnectionIds?: Iterable<string> } = {},
 ): { tabs: QueryTab[]; activeTabId: string | null; workspace?: unknown } {
-  const restoreMode = useSettingsStore().editorSettings.openTabsRestoreMode;
+  const restoreMode = safeLocalStorageGet(UPDATE_RESTORE_KEY) === "1" ? "all" : useSettingsStore().editorSettings.openTabsRestoreMode;
   if (restoreMode === "none") {
     return { tabs: [], activeTabId: null, workspace: undefined };
   }
@@ -764,7 +765,7 @@ function restoreSavedTabsFromPayload(
 }
 
 function restoreLegacySavedTabs(options: { validConnectionIds?: Iterable<string> } = {}): { tabs: QueryTab[]; activeTabId: string | null; workspace?: undefined } {
-  const restoreMode = useSettingsStore().editorSettings.openTabsRestoreMode;
+  const restoreMode = safeLocalStorageGet(UPDATE_RESTORE_KEY) === "1" ? "all" : useSettingsStore().editorSettings.openTabsRestoreMode;
   if (restoreMode === "none") {
     return { tabs: [], activeTabId: null, workspace: undefined };
   }
@@ -1034,6 +1035,7 @@ export const useQueryStore = defineStore("query", () => {
    * the new tab ownerless until a post-flush watcher repaired the groups.
    */
   function registerOpenTab(tab: QueryTab, options: { activate?: boolean; insertAfterTabId?: string } = {}): string {
+    assertUpdateAllowsInteraction();
     const anchorIndex = options.insertAfterTabId ? tabs.value.findIndex((item) => item.id === options.insertAfterTabId) : -1;
     if (anchorIndex >= 0) {
       tabs.value.splice(anchorIndex + 1, 0, tab);
@@ -2215,7 +2217,7 @@ export const useQueryStore = defineStore("query", () => {
     if (saved?.tabs && Array.isArray(saved.tabs)) {
       const restored = restoreSavedTabsFromPayload(saved, options);
       applyRestoredOpenTabs(restored);
-      if (useSettingsStore().editorSettings.openTabsRestoreMode === "none") {
+      if (safeLocalStorageGet(UPDATE_RESTORE_KEY) !== "1" && useSettingsStore().editorSettings.openTabsRestoreMode === "none") {
         // Restore is explicitly disabled, so stale saved payloads should not
         // reappear if the user later changes the setting.
         clearLegacySavedTabs();
@@ -2223,6 +2225,7 @@ export const useQueryStore = defineStore("query", () => {
       }
       await recoverDetachedTabsToMain(options);
       await saveTabs(tabs.value, activeTabId.value).catch(() => undefined);
+      safeLocalStorageRemove(UPDATE_RESTORE_KEY);
       isOpenTabsLoaded.value = true;
       scheduleResultCacheMaintenance();
       return;
@@ -2232,7 +2235,7 @@ export const useQueryStore = defineStore("query", () => {
     if (legacy.rawTabs || legacy.rawActiveTabId) {
       const restored = restoreLegacySavedTabs(options);
       applyRestoredOpenTabs(restored);
-      if (useSettingsStore().editorSettings.openTabsRestoreMode === "none") {
+      if (safeLocalStorageGet(UPDATE_RESTORE_KEY) !== "1" && useSettingsStore().editorSettings.openTabsRestoreMode === "none") {
         // Restore is explicitly disabled, so keeping the legacy startup payload
         // would resurrect old tabs if the user later changes the setting.
         clearLegacySavedTabs();
@@ -2287,6 +2290,7 @@ export const useQueryStore = defineStore("query", () => {
       autoCommit: t.autoCommit,
       resultAutoSave: t.resultAutoSave,
       structureTableName: t.structureTableName,
+      structureDraft: t.structureDraft,
       objectBrowser: t.objectBrowser,
       objectSource: t.objectSource,
       sourceView: t.sourceView,
@@ -2431,7 +2435,7 @@ export const useQueryStore = defineStore("query", () => {
     // A freshly created detached window never runs the main-window bootstrap that
     // populates savedSqlStore's local file index, so useSavedSqlStore().ensureFileContent()
     // can't find the file locally either — go straight to the backend instead.
-    if (restoredTab.savedSqlId && restoredTab.mode === "query" && !restoredTab.sql) {
+    if (restoredTab.savedSqlId && restoredTab.mode === "query" && !restoredTab.sql && restoredTab.originalSql === undefined) {
       const file = await api.loadSavedSqlFile(restoredTab.savedSqlId).catch(() => undefined);
       if (file) {
         restoredTab.title = restoredTab.customTitle ? restoredTab.title : file.name;
@@ -3155,7 +3159,7 @@ export const useQueryStore = defineStore("query", () => {
       return !!tab.structureDraft && tab.structureDraft.dirty !== false;
     }
     if (tab.mode !== "query") return false;
-    if (!tab.externalSqlPath && !tab.sql.trim()) return false;
+    if (!tab.externalSqlPath && !tab.sql.trim() && !(tab.savedSqlId && tab.originalSql !== undefined)) return false;
     const original = tab.originalSql;
     if (original === undefined) return !!tab.savedSqlId;
     return tab.sql !== original;
@@ -4277,7 +4281,7 @@ export const useQueryStore = defineStore("query", () => {
     const existing = tabs.value.find((tab) => tab.savedSqlId === file.id);
     if (existing) {
       persistSavedSqlEditorPosition(existing);
-      if (!existing.sql && file.sql) {
+      if (!existing.sql && file.sql && existing.originalSql === undefined) {
         existing.sql = file.sql;
         existing.originalSql = file.sql;
         const restored = restoreSavedSqlEditorPosition(file.id, file.sql);
@@ -4317,7 +4321,7 @@ export const useQueryStore = defineStore("query", () => {
   async function hydrateSavedSqlTabs() {
     await initSavedSqlEditorPositions();
     const savedSqlStore = useSavedSqlStore();
-    const linkedTabs = tabs.value.filter((tab) => tab.savedSqlId && tab.sql === "");
+    const linkedTabs = tabs.value.filter((tab) => tab.savedSqlId && tab.sql === "" && tab.originalSql === undefined);
     for (const tab of linkedTabs) {
       const file = await savedSqlStore.ensureFileContent(tab.savedSqlId!);
       if (!file) continue;
@@ -4602,6 +4606,7 @@ export const useQueryStore = defineStore("query", () => {
   }
 
   async function executeCurrentTab() {
+    assertUpdateAllowsInteraction();
     const tab = tabs.value.find((t) => t.id === activeTabId.value);
     if (!tab || !tab.sql.trim()) return;
 
@@ -5525,6 +5530,7 @@ export const useQueryStore = defineStore("query", () => {
       batchResume?: BatchSqlResumeOptions;
     },
   ) {
+    assertUpdateAllowsInteraction();
     const tab = findExecutionTab(id);
     if (!tab || !sql.trim()) return;
 
@@ -6780,6 +6786,7 @@ export const useQueryStore = defineStore("query", () => {
   }
 
   async function explainTabSql(id: string, sql: string, databaseType?: DatabaseType, explainMode?: string) {
+    assertUpdateAllowsInteraction();
     const tab = tabs.value.find((t) => t.id === id);
     if (!tab) return { ok: false as const, reason: "empty" as const };
     const conn = useConnectionStore().getConfig(tab.connectionId);
diff --git a/docs/testing/software-update.md b/docs/testing/software-update.md
new file mode 100644
index 0000000000..28abb58e12
--- /dev/null
+++ b/docs/testing/software-update.md
@@ -0,0 +1,52 @@
+# 桌面更新验收
+
+本清单用于打包后的真实升级测试。单元测试不能证明系统安装器能够替换文件、重新启动应用或恢复窗口内容。使用测试签名与独立测试配置发布两个连续版本，避免给正式用户推送测试版本。
+
+## 环境
+
+- macOS：从安装到 Applications 的旧版应用升级。
+- Windows：当前用户安装的 NSIS 版本，以及带 `portable.dbx` 的便携版本；发布 MSI 时追加 MSI 验收。
+- 两种 CPU 架构分别验证实际发布的安装产物；不支持自动更新的 Windows 7 包继续手动升级。
+- 升级前记录应用版本、用户数据目录、连接列表、SQL 草稿和窗口布局；使用可丢弃的测试数据库。
+
+## 静默下载与就绪
+
+1. 开启更新通知，启动旧版本，发布或提供新版本元数据。
+2. 不操作更新入口：确认没有通知、弹窗、工具栏下载动画，也没有安装器启动或应用退出。
+3. 主动打开更新面板，确认可见下载进度；关闭面板，下载继续。
+4. 包完成下载、验签和缓存提交后才出现红点，面板显示准确版本与“重启并更新”。
+5. 不点击安装，等待任务完成、关闭面板、正常退出应用，均不得开始安装。
+
+## 本地缓存与失败恢复
+
+1. 下载就绪后退出应用、断网、重新启动：应恢复同一版本的就绪状态。
+2. 点击“重启并更新”，确认安装过程不请求更新元数据或重新下载安装包。
+3. 分别截断安装包、修改签名、放入未完成缓存、使用不匹配架构或已安装版本：不能显示为可安装，不能启动安装器。
+4. 模拟网络断开、下载超时、磁盘满：后台无提示；主动打开面板可查看原因、重试或切源。
+5. 下载中取消或切源，确认旧批次的进度/完成事件不覆盖新批次；缓存已经就绪时切源不重下。
+6. 忽略就绪版本后，重开应用不再提示或下载该版本；关闭更新通知停止未完成下载，但保留完整缓存供手动安装。
+
+## 工作与草稿保护
+
+1. 分别保留新 SQL、已保存 SQL 的修改、外部 SQL 文件修改和可恢复的结构草稿；普通退出设置切换到不保留草稿，仍应在更新后恢复本次编辑。
+2. 在分离窗口修改 SQL；更新前必须收到该窗口的持久化成功确认，升级后核对实际内容。
+3. 模拟保存失败或分离窗口无响应超过 5 秒：安装不执行，已有缓存不丢失，界面恢复操作能力。
+4. 保留未提交网格修改、活动事务、无法恢复的配置编辑：更新被阻止，不得自动提交或丢弃内容。
+5. 查询、导入导出或 AI 任务运行时不能安装；任务结束后仍需主动点击。
+6. 在准备保存期间尝试启动任务、编辑或打开新分离窗口：不能漏过保护；准备失败后这些操作应恢复正常。
+
+## 安装与重启
+
+1. macOS：点击一次后安装并立即重启；不再要求第二次点击。模拟重启失败后，再次操作只重启、不重复安装。
+2. Windows 安装版：只在明确点击后启动一次安装器并退出应用；安装成功后自动启动新版。
+3. Windows：取消系统权限请求或模拟安装器启动失败，应用不能直接退出或永久停在安装中；允许重试。
+4. Windows 便携版：替换并重启后继续使用原用户数据目录；模拟替换/启动失败，检查原程序回退。
+5. 重启后确认版本、草稿、连接列表与用户数据正确；旧缓存已清理。
+
+## 记录
+
+每次验收记录旧版/新版号、系统与架构、安装类型、结果以及失败日志。只有实际执行通过的项目才能标记通过；尚未执行的平台明确标记“未验证”。
+
+## 当前保护边界
+
+更新准备屏障覆盖主窗口、分离窗口及桌面 API 调用，不是数据库引擎的全局任务锁。独立 MCP 客户端或原生后端直接发起的工作不受这一前端屏障原子控制。没有可靠编辑基线的配置对话框会保守地阻止更新，关闭该对话框后才能继续。
diff --git a/packages/app-tests/appUpdater.test.ts b/packages/app-tests/appUpdater.test.ts
index 5dfe5734a3..9916e34196 100644
--- a/packages/app-tests/appUpdater.test.ts
+++ b/packages/app-tests/appUpdater.test.ts
@@ -122,9 +122,9 @@ test("wires the active task guard into update installation and restart, but not
   assert.match(appSource, /getActiveTaskCount: \(\) => trackedUpdateTaskCount\.value/);
   // Only restarting/exiting to finish the install has to wait on active work;
   // starting the background download itself never blocks.
-  assert.equal(updaterSource.match(/if \(blockUpdateForActiveTasks\(\)\) return;/g)?.length, 1);
+  assert.match(updaterSource, /shouldBlockAppUpdate\(activeTaskCount.value\)/);
   assert.match(dialogSource, /role="alert"[\s\S]*updates\.activeTasksBlockUpdate/);
-  assert.equal(dialogSource.match(/:disabled="activeTaskCount > 0"/g)?.length, 2);
+  assert.equal(dialogSource.match(/:disabled="activeTaskCount > 0 \|\| isIgnoringUpdate"/g)?.length, 2);
   assert.match(dialogSource, /ignore-version/);
   assert.match(updaterSource, /ignoreCurrentVersion/);
 });
diff --git a/packages/app-tests/queryStore.test.ts b/packages/app-tests/queryStore.test.ts
index 908e0540dd..dadcf2b1e5 100644
--- a/packages/app-tests/queryStore.test.ts
+++ b/packages/app-tests/queryStore.test.ts
@@ -515,7 +515,9 @@ test("hydrating saved SQL content preserves its restored runtime target", async
     store.createTab("current-connection", "runtime_database", "current.sql", "query", "runtime_schema");
     const tabId = store.openSavedSql(file);
     const tab = store.tabs.find((item) => item.id === tabId)!;
+    // Clean restored tabs omit both fields until their saved file is hydrated.
     tab.sql = "";
+    tab.originalSql = undefined;
 
     await store.hydrateSavedSqlTabs();
 
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 3a8f742ceb..33b77b4cd2 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -46,7 +46,7 @@ tauri-plugin-dialog = "2.7.0"
 tauri-plugin-fs = "2.5.0"
 tauri-plugin-single-instance = "2.4.2"
 tauri-plugin-shell = "2"
-tauri-plugin-updater = "2"
+tauri-plugin-updater = "=2.10.1"
 tauri-plugin-process = "2"
 tauri-plugin-window-state = "2"
 redis = { version = "0.32.2", features = ["tokio-comp", "tls-rustls", "tokio-rustls-comp", "cluster-async"] }
diff --git a/src-tauri/capabilities/default.json b/src-tauri/capabilities/default.json
index e8c21bf16f..64c5c60b6e 100644
--- a/src-tauri/capabilities/default.json
+++ b/src-tauri/capabilities/default.json
@@ -16,6 +16,7 @@
     "core:window:allow-is-fullscreen",
     "core:window:allow-set-fullscreen",
     "core:window:allow-close",
+    "core:window:allow-destroy",
     "core:window:allow-start-dragging",
     "core:window:allow-set-focus",
     "core:window:allow-set-position",
diff --git a/src-tauri/src/commands/mod.rs b/src-tauri/src/commands/mod.rs
index 3e6a919ab5..da25644c7b 100644
--- a/src-tauri/src/commands/mod.rs
+++ b/src-tauri/src/commands/mod.rs
@@ -58,6 +58,7 @@ pub mod text_export;
 pub mod transfer;
 pub mod tunnel_profiles;
 pub mod update;
+mod update_cache;
 mod update_portable;
 pub mod vector_cmd;
 pub mod window_controls;
diff --git a/src-tauri/src/commands/update.rs b/src-tauri/src/commands/update.rs
index 3c7b9cce40..e5b3704e9f 100644
--- a/src-tauri/src/commands/update.rs
+++ b/src-tauri/src/commands/update.rs
@@ -5,7 +5,11 @@ use std::sync::{
 };
 use std::time::Duration;
 
-use super::update_portable;
+pub use super::update_cache::DownloadedUpdate;
+use super::{
+    update_cache::{self, CacheRecord},
+    update_portable,
+};
 pub use dbx_core::update::UpdateInfo;
 use semver::Version;
 use serde::{Deserialize, Serialize};
@@ -37,6 +41,8 @@ pub enum UpdateDownloadSource {
 pub struct UpdateDownloadProgress {
     pub downloaded: u64,
     pub total: Option<u64>,
+    pub attempt_id: String,
+    pub version: String,
 }
 
 #[derive(Default)]
@@ -64,7 +70,12 @@ impl UpdateDownloadProgressGate {
 enum PendingUpdate {
     Downloading(Arc<DownloadCancellation>),
     Installing,
-    Ready(ReadyUpdate),
+    Ready(Box<CachedUpdate>),
+}
+
+struct CachedUpdate {
+    record: CacheRecord,
+    ready: ReadyUpdate,
 }
 
 enum ReadyUpdate {
@@ -128,7 +139,12 @@ impl PendingUpdateState {
         Ok(cancellation)
     }
 
-    fn finish_download(&self, cancellation: &Arc<DownloadCancellation>, update: ReadyUpdate) -> Result<(), String> {
+    fn finish_download(
+        &self,
+        cancellation: &Arc<DownloadCancellation>,
+        update: CachedUpdate,
+        root: &std::path::Path,
+    ) -> Result<(), String> {
         let mut pending = self.pending.lock().map_err(|_| "Update state is unavailable.".to_string())?;
         let is_current = matches!(
             pending.as_ref(),
@@ -138,7 +154,12 @@ impl PendingUpdateState {
         if !is_current {
             return Err(DOWNLOAD_CANCELED_ERROR.to_string());
         }
-        *pending = Some(PendingUpdate::Ready(update));
+        let bytes = match &update.ready {
+            ReadyUpdate::Installer { bytes, .. } => bytes,
+            ReadyUpdate::Portable { archive, .. } => archive,
+        };
+        update_cache::commit(root, &update.record, bytes)?;
+        *pending = Some(PendingUpdate::Ready(Box::new(update)));
         Ok(())
     }
 
@@ -163,12 +184,14 @@ impl PendingUpdateState {
         }
     }
 
-    fn take_ready(&self) -> Result<ReadyUpdate, String> {
+    fn take_ready(&self, cache_id: &str, expected_version: &str) -> Result<CachedUpdate, String> {
         let mut pending = self.pending.lock().map_err(|_| "Update state is unavailable.".to_string())?;
         match pending.take() {
-            Some(PendingUpdate::Ready(update)) => {
+            Some(PendingUpdate::Ready(update))
+                if update.record.info.cache_id == cache_id && update.record.info.version == expected_version =>
+            {
                 *pending = Some(PendingUpdate::Installing);
-                Ok(update)
+                Ok(*update)
             }
             other => {
                 *pending = other;
@@ -177,12 +200,24 @@ impl PendingUpdateState {
         }
     }
 
-    fn restore_ready(&self, update: ReadyUpdate) -> Result<(), String> {
+    fn restore_ready(&self, update: CachedUpdate) -> Result<(), String> {
         let mut pending = self.pending.lock().map_err(|_| "Update state is unavailable.".to_string())?;
-        *pending = Some(PendingUpdate::Ready(update));
+        *pending = Some(PendingUpdate::Ready(Box::new(update)));
         Ok(())
     }
 
+    fn discard_ready(&self, cache_id: &str, root: &std::path::Path) -> Result<(), String> {
+        let mut pending = self.pending.lock().map_err(|_| "Update state is unavailable.")?;
+        match pending.as_ref() {
+            Some(PendingUpdate::Ready(cached)) if cached.record.info.cache_id == cache_id => {}
+            _ => return Err("Cached update changed or is busy.".into()),
+        }
+        // Logical eviction must succeed even if disk cleanup fails. A later download
+        // retries cleanup before any network work or cache commit.
+        *pending = None;
+        update_cache::discard(root)
+    }
+
     fn finish_install(&self) -> Result<(), String> {
         let mut pending = self.pending.lock().map_err(|_| "Update state is unavailable.".to_string())?;
         *pending = None;
@@ -351,47 +386,175 @@ pub fn cancel_update_download(state: tauri::State<'_, PendingUpdateState>) {
     state.cancel_download();
 }
 
+fn package_kind(app: &AppHandle) -> Result<String, String> {
+    if crate::data_dir::is_portable_mode() {
+        return Ok("portable".into());
+    }
+    Ok(app.updater_builder().build().map_err(|e| e.to_string())?.package_kind().into())
+}
+
+fn validate_cache_target(record: &CacheRecord, portable_mode: bool, package_kind: &str) -> Result<(), String> {
+    if record.package_kind != package_kind
+        || record.os != std::env::consts::OS
+        || record.arch != std::env::consts::ARCH
+        || record.info.portable_mode != portable_mode
+    {
+        return Err("Cached update does not match this installation.".into());
+    }
+    Ok(())
+}
+
+fn restore_cached(app: &AppHandle) -> Result<Option<CachedUpdate>, String> {
+    let root = update_cache::root(app)?;
+    if requires_manual_update(IS_WINDOWS_7_TARGET) {
+        update_cache::discard(&root)?;
+        return Ok(None);
+    }
+    let restored = (|| {
+        let Some((record, bytes)) = update_cache::read(&root)? else { return Ok(None) };
+        validate_cache_target(&record, crate::data_dir::is_portable_mode(), &package_kind(app)?)?;
+        let version =
+            update_portable::validate_requested_portable_version(&record.info.version, env!("CARGO_PKG_VERSION"))?;
+        let ready = if record.info.portable_mode {
+            update_portable::verify_portable_archive(
+                &bytes,
+                record.signature.as_deref().ok_or("Missing cached signature")?,
+                &version,
+                std::env::consts::ARCH,
+            )?;
+            ReadyUpdate::Portable { archive: bytes, version }
+        } else {
+            let update = app
+                .updater_builder()
+                .build()
+                .map_err(|e| e.to_string())?
+                .restore_update(record.manifest.clone().ok_or("Missing cached release metadata")?)
+                .map_err(|e| e.to_string())?
+                .ok_or("Cached update is no longer newer")?;
+            if update.version != record.info.version {
+                return Err("Cached release version mismatch".into());
+            }
+            update.verify(&bytes).map_err(|e| e.to_string())?;
+            ReadyUpdate::Installer { update: Box::new(update), bytes }
+        };
+        Ok(Some(CachedUpdate { record, ready }))
+    })();
+    if restored.is_err() {
+        update_cache::discard(&root)?;
+    }
+    restored
+}
+
+#[tauri::command(async)]
+pub fn get_downloaded_update(
+    app: AppHandle,
+    state: tauri::State<'_, PendingUpdateState>,
+) -> Result<Option<DownloadedUpdate>, String> {
+    let mut pending = state.pending.lock().map_err(|_| "Update state is unavailable.")?;
+    match pending.as_ref() {
+        Some(PendingUpdate::Ready(cached)) => return Ok(Some(cached.record.info.clone())),
+        Some(_) => return Ok(None),
+        None => {}
+    }
+    update_cache::cleanup_partial(&update_cache::root(&app)?)?;
+    match restore_cached(&app) {
+        Ok(Some(cached)) => {
+            let info = cached.record.info.clone();
+            *pending = Some(PendingUpdate::Ready(Box::new(cached)));
+            Ok(Some(info))
+        }
+        Ok(None) => Ok(None),
+        Err(error) => {
+            eprintln!("[DBX updater] discarded invalid cache: {error}");
+            Ok(None)
+        }
+    }
+}
+
+#[tauri::command(async)]
+pub fn discard_downloaded_update(
+    app: AppHandle,
+    state: tauri::State<'_, PendingUpdateState>,
+    cache_id: String,
+) -> Result<(), String> {
+    state.discard_ready(&cache_id, &update_cache::root(&app)?)
+}
+
 #[tauri::command]
 pub async fn download_update(
     app: AppHandle,
     state: tauri::State<'_, PendingUpdateState>,
     source: UpdateDownloadSource,
-    latest_version: Option<String>,
-) -> Result<(), String> {
+    latest_version: String,
+    attempt_id: String,
+    release_notes: Option<String>,
+) -> Result<DownloadedUpdate, String> {
     let portable_mode = crate::data_dir::is_portable_mode();
     if requires_manual_update(IS_WINDOWS_7_TARGET) {
         return Err("Windows 7 builds must be updated with the dedicated Windows 7 offline installer.".to_string());
     }
-    let portable_version = if portable_mode {
-        let requested_version =
-            latest_version.as_deref().ok_or_else(|| "Latest version is required for portable updates.".to_string())?;
-        Some(update_portable::validate_requested_portable_version(requested_version, env!("CARGO_PKG_VERSION"))?)
-    } else {
-        None
-    };
-    let cancellation = state.begin_download()?;
-    let result = if let Some(version) = portable_version {
-        download_portable_update_inner(&app, &source, &version, &cancellation)
-            .await
-            .map(|archive| ReadyUpdate::Portable { archive, version })
-    } else {
-        download_update_inner(&app, &source, latest_version.as_deref(), &cancellation)
-            .await
-            .map(|(update, bytes)| ReadyUpdate::Installer { update: Box::new(update), bytes })
-    };
-    match result {
-        Ok(update) => state.finish_download(&cancellation, update),
-        Err(error) => {
-            state.finish_failed_download(&cancellation)?;
-            Err(error)
-        }
+    let version = update_portable::validate_requested_portable_version(&latest_version, env!("CARGO_PKG_VERSION"))?;
+    if attempt_id.is_empty() || attempt_id.len() > 128 {
+        return Err("Invalid download attempt identifier.".into());
     }
+    let cancellation = state.begin_download()?;
+    let result = async {
+        update_cache::discard(&update_cache::root(&app)?)?;
+        let (ready, manifest, signature, notes) = if portable_mode {
+            let (archive, signature) =
+                download_portable_update_inner(&app, &source, &version, &attempt_id, &cancellation).await?;
+            (ReadyUpdate::Portable { archive, version: version.clone() }, None, Some(signature), String::new())
+        } else {
+            let (update, bytes) =
+                download_update_inner(&app, &source, Some(&latest_version), &attempt_id, &cancellation).await?;
+            let manifest = Some(update.raw_json.clone());
+            let notes = update.body.clone().unwrap_or_default();
+            (ReadyUpdate::Installer { update: Box::new(update), bytes }, manifest, None, notes)
+        };
+        let info = DownloadedUpdate {
+            cache_id: uuid::Uuid::new_v4().to_string(),
+            version: version.to_string(),
+            portable_mode,
+            release_url: format!("https://github.com/t8y2/dbx/releases/tag/v{version}"),
+            release_notes: release_notes.unwrap_or(notes),
+            downloaded_at: std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .map_err(|e| e.to_string())?
+                .as_millis() as u64,
+        };
+        let bytes = match &ready {
+            ReadyUpdate::Installer { bytes, .. } => bytes,
+            ReadyUpdate::Portable { archive, .. } => archive,
+        };
+        let cached = CachedUpdate {
+            record: CacheRecord {
+                schema_version: 1,
+                package_kind: package_kind(&app)?,
+                package_length: bytes.len() as u64,
+                package_sha256: update_cache::digest(bytes),
+                info: info.clone(),
+                os: std::env::consts::OS.into(),
+                arch: std::env::consts::ARCH.into(),
+                manifest,
+                signature,
+            },
+            ready,
+        };
+        state.finish_download(&cancellation, cached, &update_cache::root(&app)?)?;
+        Ok(info)
+    }
+    .await;
+    if result.is_err() {
+        state.finish_failed_download(&cancellation)?;
+    }
+    result
 }
 
 async fn download_update_inner(
     app: &AppHandle,
     source: &UpdateDownloadSource,
     latest_version: Option<&str>,
+    attempt_id: &str,
     cancellation: &Arc<DownloadCancellation>,
 ) -> Result<(Update, Vec<u8>), String> {
     let endpoint_urls = source.endpoints(latest_version)?;
@@ -409,11 +572,21 @@ async fn download_update_inner(
     }
 
     let updater = builder.build().map_err(|e| format!("Failed to create updater: {e}"))?;
-    let update = updater.check().await.map_err(|e| format!("Failed to check updates: {e}"))?;
+    let update = wait_for_download_step(
+        updater.check(),
+        cancellation,
+        Duration::from_secs(30),
+        "Update check timed out.".into(),
+    )
+    .await?
+    .map_err(|e| format!("Failed to check updates: {e}"))?;
     let Some(update) = update else {
         return Err("No update available.".to_string());
     };
 
+    if Some(update.version.as_str()) != latest_version.map(|v| v.trim().trim_start_matches('v')) {
+        return Err("Update version changed; check for updates again.".into());
+    }
     let candidates = source.installer_asset_candidates(update.download_url.as_str(), latest_version);
     println!("[DBX updater] candidates for installer download: {:?}", candidates);
 
@@ -440,6 +613,10 @@ async fn download_update_inner(
 
         let (progress_tx, progress_rx) = tokio::sync::mpsc::channel::<()>(16);
 
+        let attempt_id = attempt_id.to_string();
+        let version = update.version.clone();
+        let finish_attempt_id = attempt_id.clone();
+        let finish_version = version.clone();
         let download_result = {
             let mut candidate_update = update.clone();
             candidate_update.download_url = parsed_url.clone();
@@ -452,8 +629,15 @@ async fn download_update_inner(
                                 .fetch_add(chunk_len as u64, Ordering::Relaxed)
                                 .saturating_add(chunk_len as u64);
                             if progress_gate.should_emit(downloaded, total) {
-                                let _ = progress_app_chunk
-                                    .emit(UPDATE_DOWNLOAD_PROGRESS_EVENT, UpdateDownloadProgress { downloaded, total });
+                                let _ = progress_app_chunk.emit(
+                                    UPDATE_DOWNLOAD_PROGRESS_EVENT,
+                                    UpdateDownloadProgress {
+                                        downloaded,
+                                        total,
+                                        attempt_id: attempt_id.clone(),
+                                        version: version.clone(),
+                                    },
+                                );
                             }
                             let _ = progress_tx.try_send(());
                         },
@@ -461,7 +645,12 @@ async fn download_update_inner(
                             let downloaded = finished_downloaded.load(Ordering::Relaxed);
                             let _ = progress_app_finish.emit(
                                 UPDATE_DOWNLOAD_PROGRESS_EVENT,
-                                UpdateDownloadProgress { downloaded, total: Some(downloaded) },
+                                UpdateDownloadProgress {
+                                    downloaded,
+                                    total: Some(downloaded),
+                                    attempt_id: finish_attempt_id,
+                                    version: finish_version,
+                                },
                             );
                         },
                     )
@@ -495,8 +684,9 @@ async fn download_portable_update_inner(
     app: &AppHandle,
     source: &UpdateDownloadSource,
     latest_version: &Version,
+    attempt_id: &str,
     cancellation: &Arc<DownloadCancellation>,
-) -> Result<Vec<u8>, String> {
+) -> Result<(Vec<u8>, String), String> {
     let latest_version_text = latest_version.to_string();
     let candidates = source.portable_asset_candidates(&latest_version_text, std::env::consts::ARCH)?;
     let client = portable_update_http_client()?;
@@ -513,6 +703,8 @@ async fn download_portable_update_inner(
                 &candidate.signature_url,
                 MAX_PORTABLE_SIGNATURE_BYTES,
                 None,
+                attempt_id,
+                &latest_version_text,
                 cancellation,
             )
             .await?;
@@ -523,11 +715,13 @@ async fn download_portable_update_inner(
                 &candidate.archive_url,
                 MAX_PORTABLE_ARCHIVE_BYTES,
                 Some(app),
+                attempt_id,
+                &latest_version_text,
                 cancellation,
             )
             .await?;
             update_portable::verify_portable_archive(&archive, &signature, latest_version, std::env::consts::ARCH)?;
-            Ok::<Vec<u8>, String>(archive)
+            Ok::<(Vec<u8>, String), String>((archive, signature))
         }
         .await;
 
@@ -563,6 +757,8 @@ async fn download_bounded_bytes(
     url: &str,
     max_bytes: usize,
     progress_app: Option<&AppHandle>,
+    attempt_id: &str,
+    version: &str,
     cancellation: &DownloadCancellation,
 ) -> Result<Vec<u8>, String> {
     if cancellation.is_canceled() {
@@ -589,7 +785,10 @@ async fn download_bounded_bytes(
     }
 
     if let Some(app) = progress_app {
-        let _ = app.emit(UPDATE_DOWNLOAD_PROGRESS_EVENT, UpdateDownloadProgress { downloaded: 0, total });
+        let _ = app.emit(
+            UPDATE_DOWNLOAD_PROGRESS_EVENT,
+            UpdateDownloadProgress { downloaded: 0, total, attempt_id: attempt_id.into(), version: version.into() },
+        );
     }
     let mut progress_gate = UpdateDownloadProgressGate::default();
     progress_gate.should_emit(0, total);
@@ -623,7 +822,12 @@ async fn download_bounded_bytes(
             if let Some(app) = progress_app {
                 let _ = app.emit(
                     UPDATE_DOWNLOAD_PROGRESS_EVENT,
-                    UpdateDownloadProgress { downloaded: bytes.len() as u64, total },
+                    UpdateDownloadProgress {
+                        downloaded: bytes.len() as u64,
+                        total,
+                        attempt_id: attempt_id.into(),
+                        version: version.into(),
+                    },
                 );
             }
         }
@@ -672,11 +876,30 @@ async fn wait_for_download_step<T>(
     }
 }
 
-#[tauri::command]
-pub fn install_downloaded_update(app: AppHandle, state: tauri::State<'_, PendingUpdateState>) -> Result<(), String> {
-    let ready = state.take_ready()?;
-    let portable = matches!(&ready, ReadyUpdate::Portable { .. });
-    let install_result = match &ready {
+#[tauri::command(async)]
+pub fn install_downloaded_update(
+    app: AppHandle,
+    state: tauri::State<'_, PendingUpdateState>,
+    cache_id: String,
+    expected_version: String,
+) -> Result<(), String> {
+    let cached = state.take_ready(&cache_id, &expected_version)?;
+    // Read and reverify disk bytes immediately before installation; never trust memory alone.
+    let refreshed = match restore_cached(&app) {
+        Ok(Some(ready)) if ready.record.info.cache_id == cache_id && ready.record.info.version == expected_version => {
+            ready
+        }
+        other => {
+            state.finish_install()?;
+            return Err(match other {
+                Err(e) => e,
+                _ => "Cached update is missing or changed.".into(),
+            });
+        }
+    };
+    let ready = &refreshed.ready;
+    let portable = matches!(ready, ReadyUpdate::Portable { .. });
+    let install_result = match ready {
         ReadyUpdate::Installer { update, bytes } => {
             update.install(bytes).map_err(|error| format!("Failed to install update: {error}"))
         }
@@ -686,12 +909,16 @@ pub fn install_downloaded_update(app: AppHandle, state: tauri::State<'_, Pending
         }
     };
     if let Err(error) = install_result {
-        state.restore_ready(ready)?;
+        state.restore_ready(cached)?;
         return Err(error);
     }
-    state.finish_install()?;
     if portable {
+        // The helper can still fail or roll back after this process exits. Keep
+        // the verified package until the upgraded application validates its version.
         schedule_portable_update_exit(app);
+    } else {
+        state.finish_install()?;
+        let _ = update_cache::discard(&update_cache::root(&app)?);
     }
     Ok(())
 }
@@ -716,6 +943,80 @@ mod tests {
     };
     use std::{future::pending, sync::Arc, time::Duration};
 
+    fn cached_fixture() -> super::CachedUpdate {
+        super::CachedUpdate {
+            record: super::CacheRecord {
+                schema_version: 1,
+                package_kind: "portable".into(),
+                package_length: 0,
+                package_sha256: super::update_cache::digest(&[]),
+                info: super::DownloadedUpdate {
+                    cache_id: "cached-id".into(),
+                    version: "99.0.0".into(),
+                    portable_mode: true,
+                    release_url: String::new(),
+                    release_notes: String::new(),
+                    downloaded_at: 0,
+                },
+                os: std::env::consts::OS.into(),
+                arch: std::env::consts::ARCH.into(),
+                manifest: None,
+                signature: None,
+            },
+            ready: super::ReadyUpdate::Portable { archive: vec![], version: semver::Version::new(99, 0, 0) },
+        }
+    }
+
+    #[test]
+    fn stale_cache_identity_and_double_install_are_rejected() {
+        let state = PendingUpdateState::default();
+        state.restore_ready(cached_fixture()).unwrap();
+        assert!(state.take_ready("wrong-id", "99.0.0").is_err());
+        assert!(state.take_ready("cached-id", "98.0.0").is_err());
+        let ready = state.take_ready("cached-id", "99.0.0").unwrap();
+        assert!(state.take_ready("cached-id", "99.0.0").is_err());
+        state.restore_ready(ready).unwrap();
+        assert!(state.take_ready("cached-id", "99.0.0").is_ok());
+    }
+
+    #[test]
+    fn canceled_attempt_cannot_commit_or_publish_cache() {
+        let state = PendingUpdateState::default();
+        let attempt = state.begin_download().unwrap();
+        state.cancel_download();
+        let root = std::env::temp_dir().join(uuid::Uuid::new_v4().to_string());
+        assert!(state.finish_download(&attempt, cached_fixture(), &root).is_err());
+        assert!(!root.exists());
+        assert!(state.begin_download().is_ok());
+    }
+
+    #[test]
+    fn cleanup_failure_does_not_leave_ready_state_or_block_new_attempts() {
+        let state = PendingUpdateState::default();
+        state.restore_ready(cached_fixture()).unwrap();
+        let root = std::env::temp_dir().join(uuid::Uuid::new_v4().to_string());
+        // A file in place of the cache root makes deletion fail on every platform.
+        std::fs::write(&root, b"not a directory").unwrap();
+        assert!(state.discard_ready("cached-id", &root).is_err());
+        assert!(state.take_ready("cached-id", "99.0.0").is_err());
+        assert!(state.begin_download().is_ok());
+        std::fs::remove_file(root).unwrap();
+    }
+
+    #[test]
+    fn cache_target_requires_architecture_os_and_installation_type() {
+        let record = cached_fixture().record;
+        assert!(super::validate_cache_target(&record, true, "portable").is_ok());
+        assert!(super::validate_cache_target(&record, false, "portable").is_err());
+        assert!(super::validate_cache_target(&record, true, "nsis").is_err());
+        let mut wrong_arch = record.clone();
+        wrong_arch.arch = "different-architecture".into();
+        assert!(super::validate_cache_target(&wrong_arch, true, "portable").is_err());
+        let mut wrong_os = record;
+        wrong_os.os = "different-os".into();
+        assert!(super::validate_cache_target(&wrong_os, true, "portable").is_err());
+    }
+
     #[test]
     fn all_windows_7_builds_require_manual_updates() {
         assert!(requires_manual_update(true));
diff --git a/src-tauri/src/commands/update_cache.rs b/src-tauri/src/commands/update_cache.rs
new file mode 100644
index 0000000000..3f6c2e6c42
--- /dev/null
+++ b/src-tauri/src/commands/update_cache.rs
@@ -0,0 +1,202 @@
+//! A single committed update. The directory rename is the commit point; partial writes are never read.
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::{
+    fs,
+    io::{Read, Write},
+    path::{Path, PathBuf},
+};
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct DownloadedUpdate {
+    pub cache_id: String,
+    pub version: String,
+    pub portable_mode: bool,
+    pub release_url: String,
+    pub release_notes: String,
+    pub downloaded_at: u64,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub(super) struct CacheRecord {
+    pub schema_version: u32,
+    pub package_kind: String,
+    pub package_length: u64,
+    pub package_sha256: String,
+    pub info: DownloadedUpdate,
+    pub os: String,
+    pub arch: String,
+    pub manifest: Option<serde_json::Value>,
+    pub signature: Option<String>,
+}
+
+fn write_synced(path: &Path, bytes: &[u8]) -> Result<(), String> {
+    let mut file = fs::OpenOptions::new().write(true).create_new(true).open(path).map_err(|e| e.to_string())?;
+    file.write_all(bytes).and_then(|_| file.sync_all()).map_err(|e| e.to_string())
+}
+
+pub(super) fn commit(root: &Path, record: &CacheRecord, bytes: &[u8]) -> Result<(), String> {
+    let metadata = serde_json::to_vec(record).map_err(|e| e.to_string())?;
+    if metadata.len() > 4 * 1024 * 1024 || bytes.len() > 512 * 1024 * 1024 {
+        return Err("Cached update exceeds size limits.".into());
+    }
+    fs::create_dir_all(root).map_err(|e| e.to_string())?;
+    let staging = root.join(format!("partial-{}", uuid::Uuid::new_v4()));
+    fs::create_dir(&staging).map_err(|e| e.to_string())?;
+    let result = (|| {
+        write_synced(&staging.join("package"), bytes)?;
+        write_synced(&staging.join("metadata.json"), &metadata)?;
+        #[cfg(unix)]
+        fs::File::open(&staging).and_then(|dir| dir.sync_all()).map_err(|e| e.to_string())?;
+        fs::rename(&staging, root.join("ready")).map_err(|e| e.to_string())?;
+        #[cfg(unix)]
+        fs::File::open(root).and_then(|dir| dir.sync_all()).map_err(|e| e.to_string())?;
+        Ok(())
+    })();
+    if result.is_err() {
+        let _ = fs::remove_dir_all(staging);
+    }
+    result
+}
+
+pub(super) fn digest(bytes: &[u8]) -> String {
+    format!("{:x}", Sha256::digest(bytes))
+}
+
+fn read_bounded(path: &Path, limit: u64) -> Result<Vec<u8>, String> {
+    let metadata = fs::symlink_metadata(path).map_err(|e| e.to_string())?;
+    if !metadata.file_type().is_file() || metadata.len() > limit {
+        return Err("Invalid cached update file.".into());
+    }
+    let mut bytes = Vec::new();
+    fs::File::open(path)
+        .map_err(|e| e.to_string())?
+        .take(limit + 1)
+        .read_to_end(&mut bytes)
+        .map_err(|e| e.to_string())?;
+    if bytes.len() as u64 > limit {
+        return Err("Cached update file exceeds limit.".into());
+    }
+    Ok(bytes)
+}
+
+pub(super) fn read(root: &Path) -> Result<Option<(CacheRecord, Vec<u8>)>, String> {
+    let ready = root.join("ready");
+    let metadata = match fs::symlink_metadata(&ready) {
+        Ok(metadata) => metadata,
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+        Err(e) => return Err(e.to_string()),
+    };
+    if !metadata.file_type().is_dir() {
+        return Err("Invalid cached update directory.".into());
+    }
+    let record: CacheRecord = serde_json::from_slice(&read_bounded(&ready.join("metadata.json"), 4 * 1024 * 1024)?)
+        .map_err(|e| e.to_string())?;
+    if record.schema_version != 1 {
+        return Err("Unsupported cached update schema.".into());
+    }
+    let bytes = read_bounded(&ready.join("package"), 512 * 1024 * 1024)?;
+    if record.package_length != bytes.len() as u64 || record.package_sha256 != digest(&bytes) {
+        return Err("Cached update package is corrupt.".into());
+    }
+    Ok(Some((record, bytes)))
+}
+
+/// Only called while the updater state is idle and exclusively locked.
+pub(super) fn cleanup_partial(root: &Path) -> Result<(), String> {
+    let entries = match fs::read_dir(root) {
+        Ok(entries) => entries,
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(()),
+        Err(e) => return Err(e.to_string()),
+    };
+    for entry in entries {
+        let entry = entry.map_err(|e| e.to_string())?;
+        if entry.file_name().to_string_lossy().starts_with("partial-") {
+            if entry.file_type().map_err(|e| e.to_string())?.is_dir() {
+                fs::remove_dir_all(entry.path()).map_err(|e| e.to_string())?;
+            } else {
+                fs::remove_file(entry.path()).map_err(|e| e.to_string())?;
+            }
+        }
+    }
+    Ok(())
+}
+
+pub(super) fn discard(root: &Path) -> Result<(), String> {
+    let ready = root.join("ready");
+    let result = if fs::symlink_metadata(&ready).is_ok_and(|m| !m.file_type().is_dir()) {
+        fs::remove_file(ready)
+    } else {
+        fs::remove_dir_all(ready)
+    };
+    match result {
+        Ok(()) => Ok(()),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(e) => Err(e.to_string()),
+    }
+}
+
+pub(super) fn root(app: &tauri::AppHandle) -> Result<PathBuf, String> {
+    use tauri::Manager;
+    app.path().app_cache_dir().map(|p| p.join("signed-update-v1")).map_err(|e| e.to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[cfg(unix)]
+    #[test]
+    fn rejects_symlink_without_deleting_its_target() {
+        let root = std::env::temp_dir().join(uuid::Uuid::new_v4().to_string());
+        let outside = root.join("outside");
+        fs::create_dir_all(&outside).unwrap();
+        fs::write(outside.join("keep"), b"unchanged").unwrap();
+        std::os::unix::fs::symlink(&outside, root.join("ready")).unwrap();
+        assert!(read(&root).is_err());
+        discard(&root).unwrap();
+        assert!(outside.join("keep").exists());
+        fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn incomplete_writes_are_invisible_and_commit_roundtrips() {
+        let root = std::env::temp_dir().join(uuid::Uuid::new_v4().to_string());
+        fs::create_dir_all(root.join("partial-abandoned")).unwrap();
+        assert!(read(&root).unwrap().is_none());
+        let record = CacheRecord {
+            schema_version: 1,
+            package_kind: "test".into(),
+            package_length: 14,
+            package_sha256: digest(b"signed payload"),
+            info: DownloadedUpdate {
+                cache_id: "test".into(),
+                version: "99.0.0".into(),
+                portable_mode: false,
+                release_url: String::new(),
+                release_notes: String::new(),
+                downloaded_at: 1,
+            },
+            os: std::env::consts::OS.into(),
+            arch: std::env::consts::ARCH.into(),
+            manifest: None,
+            signature: None,
+        };
+        commit(&root, &record, b"signed payload").unwrap();
+        assert_eq!(read(&root).unwrap().unwrap().1, b"signed payload");
+        assert!(commit(&root, &record, b"replacement").is_err());
+        fs::write(root.join("ready/package"), b"changed payload").unwrap();
+        assert!(read(&root).unwrap_err().contains("corrupt"));
+        fs::write(root.join("ready/package"), b"signed payload").unwrap();
+        let mut wrong_schema = record.clone();
+        wrong_schema.schema_version = 99;
+        fs::write(root.join("ready/metadata.json"), serde_json::to_vec(&wrong_schema).unwrap()).unwrap();
+        assert!(read(&root).unwrap_err().contains("schema"));
+        fs::write(root.join("ready/metadata.json"), b"truncated").unwrap();
+        assert!(read(&root).is_err());
+        discard(&root).unwrap();
+        assert!(read(&root).unwrap().is_none());
+        cleanup_partial(&root).unwrap();
+        assert!(!root.join("partial-abandoned").exists());
+        fs::remove_dir_all(root).unwrap();
+    }
+}
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index cfa9887ee7..fc00fccb88 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -2466,6 +2466,8 @@ pub fn run() {
             commands::update::check_for_updates,
             commands::update::fetch_changelog,
             commands::update::get_system_proxy_url,
+            commands::update::get_downloaded_update,
+            commands::update::discard_downloaded_update,
             commands::update::download_update,
             commands::update::cancel_update_download,
             commands::update::install_downloaded_update,
diff --git a/vendor/tauri-plugin-updater/CHANGELOG.md b/vendor/tauri-plugin-updater/CHANGELOG.md
new file mode 100644
index 0000000000..8e84961f1d
--- /dev/null
+++ b/vendor/tauri-plugin-updater/CHANGELOG.md
@@ -0,0 +1,210 @@
+# Changelog
+
+## \[2.10.1]
+
+- [`31ab6f8d`](https://github.com/tauri-apps/plugins-workspace/commit/31ab6f8d2466d86c80b1d70510c0400ce2cdcb0a) ([#3285](https://github.com/tauri-apps/plugins-workspace/pull/3285) by [@hrzlgnm](https://github.com/tauri-apps/plugins-workspace/../../hrzlgnm)) fix: preserve file extension of updater package, otherwise users may get confused when presented with a sudo dialog suggesting to install a file with the extension `.rpm` using `dpkg -i`
+
+## \[2.10.0]
+
+- [`4375c98b`](https://github.com/tauri-apps/plugins-workspace/commit/4375c98bed1769a1fc1be26eded4db9f7c095d95) ([#3073](https://github.com/tauri-apps/plugins-workspace/pull/3073)) Add no_proxy config to disable system proxy for updater plugin.
+- [`f122ee98`](https://github.com/tauri-apps/plugins-workspace/commit/f122ee98c6954075891ac3cd530f5e29da117b39) Allow configuring the updater client to accept invalid TLS certificates and hostnames for internal/self-signed update servers. These options are available via the plugin config (`dangerousAcceptInvalidCerts`, `dangerousAcceptInvalidHostnames`) and via the `UpdaterBuilder` (`dangerous_accept_invalid_certs`, `dangerous_accept_invalid_hostnames`).
+- [`f122ee98`](https://github.com/tauri-apps/plugins-workspace/commit/f122ee98c6954075891ac3cd530f5e29da117b39) Updater plugin now supports all bundle types: Deb, Rpm and AppImage for Linux; NSiS, MSI for Windows. This was added in https://github.com/tauri-apps/plugins-workspace/pull/2624
+- [`05c5da07`](https://github.com/tauri-apps/plugins-workspace/commit/05c5da072b6e3254c19ee69024f80f4dfe1b779b) ([#3213](https://github.com/tauri-apps/plugins-workspace/pull/3213)) Updated `reqwest` to 0.13, make sure to update your `reqwest` dependency if you're using `UpdaterBuilder::configure_client`
+
+## \[2.9.0]
+
+- [`f209b2f2`](https://github.com/tauri-apps/plugins-workspace/commit/f209b2f23cb29133c97ad5961fb46ef794dbe063) ([#2804](https://github.com/tauri-apps/plugins-workspace/pull/2804) by [@renovate](https://github.com/tauri-apps/plugins-workspace/../../renovate)) Updated tauri to 2.6
+
+## \[2.8.1]
+
+- [`735d209d`](https://github.com/tauri-apps/plugins-workspace/commit/735d209d5d1d92dcac70c6083bcfcd34ec7d84be) ([#2761](https://github.com/tauri-apps/plugins-workspace/pull/2761) by [@FabianLars](https://github.com/tauri-apps/plugins-workspace/../../FabianLars)) Fixed an issue preventing updates via the NSIS installer from succeeding when the app was launched with command line arguments containing spaces.
+
+## \[2.8.0]
+
+- [`87afa23c`](https://github.com/tauri-apps/plugins-workspace/commit/87afa23cad077c09bc1eb743800ae3396b531146) ([#2726](https://github.com/tauri-apps/plugins-workspace/pull/2726)) Add allowDowngrades parameter to check command
+
+  Added a new optional `allowDowngrades` parameter to the JavaScript check command that allows the updater to consider versions that are lower than the current version as valid updates. When enabled, the version comparator will accept any version that is different from the current version, effectively allowing downgrades.
+- [`73ff15de`](https://github.com/tauri-apps/plugins-workspace/commit/73ff15de5d07d476693e40e8e5d138c16da5211e) ([#2757](https://github.com/tauri-apps/plugins-workspace/pull/2757)) Fix headers option in `Update.download` and `Update.downloadAndInstall` doesn't work with `Record<string, string> | Headers` types
+
+## \[2.7.1]
+
+- [`c5b0f51c`](https://github.com/tauri-apps/plugins-workspace/commit/c5b0f51cfd911cca9317b59efc718b570980129b) ([#2621](https://github.com/tauri-apps/plugins-workspace/pull/2621) by [@Legend-Master](https://github.com/tauri-apps/plugins-workspace/../../Legend-Master)) Fix `check` and `download` overrides the `accept` header
+
+## \[2.7.0]
+
+### bug
+
+- [`2d731f80`](https://github.com/tauri-apps/plugins-workspace/commit/2d731f80224f74faf1b7170b25e04f5da1da49c8) ([#2573](https://github.com/tauri-apps/plugins-workspace/pull/2573)) Fix JS API `Update.date` not formatted to RFC 3339
+- [`0bc5d588`](https://github.com/tauri-apps/plugins-workspace/commit/0bc5d5887420ba1eb718254490b7995c771c0447) ([#2572](https://github.com/tauri-apps/plugins-workspace/pull/2572)) Fix `timeout` passed to `check` gets re-used by `download` and `downloadAndinstall`
+
+## \[2.6.1]
+
+- [`12c4537b`](https://github.com/tauri-apps/plugins-workspace/commit/12c4537b8e4fed29b415ff817434b664c0596dac) ([#2541](https://github.com/tauri-apps/plugins-workspace/pull/2541) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Add support to the `riscv64` architecture.
+
+## \[2.6.0]
+
+- [`faefcc9f`](https://github.com/tauri-apps/plugins-workspace/commit/faefcc9fd8c61f709d491649e255a7fcac82c09a) ([#2430](https://github.com/tauri-apps/plugins-workspace/pull/2430) by [@goenning](https://github.com/tauri-apps/plugins-workspace/../../goenning)) Add `UpdaterBuilder::configure_client` method on Rust side, to configure the `reqwest` client used to check and download the update.
+- [`ac60d589`](https://github.com/tauri-apps/plugins-workspace/commit/ac60d589eca2bbc4aed040feb18da148e66ec171) ([#2513](https://github.com/tauri-apps/plugins-workspace/pull/2513) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Enhance error logging.
+
+## \[2.5.1]
+
+- [`6f881293`](https://github.com/tauri-apps/plugins-workspace/commit/6f881293fcd67838f6f3f8063f536292431dd1f7) ([#2439](https://github.com/tauri-apps/plugins-workspace/pull/2439) by [@FabianLars](https://github.com/tauri-apps/plugins-workspace/../../FabianLars)) Fixed an issue that caused the plugin to emit a `ReleaseNotFound` error instead of a `Reqwest` error when the http request in `check()` failed.
+
+## \[2.5.0]
+
+- [`5369898d`](https://github.com/tauri-apps/plugins-workspace/commit/5369898db7a6098e3e2f43436100ea556d405628) ([#2067](https://github.com/tauri-apps/plugins-workspace/pull/2067) by [@jLynx](https://github.com/tauri-apps/plugins-workspace/../../jLynx)) Fix update installation on macOS when using an user without admin privileges.
+- [`5369898d`](https://github.com/tauri-apps/plugins-workspace/commit/5369898db7a6098e3e2f43436100ea556d405628) ([#2067](https://github.com/tauri-apps/plugins-workspace/pull/2067) by [@jLynx](https://github.com/tauri-apps/plugins-workspace/../../jLynx)) Remove the `UpdaterBuilder::new` function, use `UpdaterExt::updater_builder` instead.
+
+## \[2.4.0]
+
+- [`0afc9b6b`](https://github.com/tauri-apps/plugins-workspace/commit/0afc9b6be07bee1077f05a86285d977e57810ed9) ([#2325](https://github.com/tauri-apps/plugins-workspace/pull/2325) by [@FabianLars](https://github.com/tauri-apps/plugins-workspace/../../FabianLars)) The `Update` struct/object will now contain a `raw_json`/`rawJson` property to be able to read parts of server's json response that are not handled by the plugin.
+
+## \[2.3.1]
+
+- [`57efb47c`](https://github.com/tauri-apps/plugins-workspace/commit/57efb47c116f880477f72f02a8e4239e88007d44) ([#2235](https://github.com/tauri-apps/plugins-workspace/pull/2235) by [@amrbashir](https://github.com/tauri-apps/plugins-workspace/../../amrbashir)) Add `Builder::header` and `Builder::headers` method to configure default headers for updater.
+
+## \[2.3.0]
+
+- [`829b6326`](https://github.com/tauri-apps/plugins-workspace/commit/829b63265030bc9c61d1738c4eaca0ffb3178677) ([#1919](https://github.com/tauri-apps/plugins-workspace/pull/1919) by [@n1ght-hunter](https://github.com/tauri-apps/plugins-workspace/../../n1ght-hunter)) Add `tauri_plugin_updater::Builder::default_version_comparator` method to set the default version comparator for the updater.
+
+## \[2.2.0]
+
+- [`3a79266b`](https://github.com/tauri-apps/plugins-workspace/commit/3a79266b8cf96a55b1ae6339d725567d45a44b1d) ([#2173](https://github.com/tauri-apps/plugins-workspace/pull/2173) by [@FabianLars](https://github.com/tauri-apps/plugins-workspace/../../FabianLars)) Bumped all plugins to `v2.2.0`. From now, the versions for the Rust and JavaScript packages of each plugin will be in sync with each other.
+
+## \[2.1.0]
+
+- [`f8f2eefe`](https://github.com/tauri-apps/plugins-workspace/commit/f8f2eefe03ab231beafbd6a88d61b53d77f0400d) ([#1991](https://github.com/tauri-apps/plugins-workspace/pull/1991) by [@jLynx](https://github.com/tauri-apps/plugins-workspace/../../jLynx)) Added support for `.deb` package updates on Linux systems.
+
+## \[2.0.2]
+
+- [`a1a82208`](https://github.com/tauri-apps/plugins-workspace/commit/a1a82208ed4ab87f83310be0dc95428aec9ab241) ([#1873](https://github.com/tauri-apps/plugins-workspace/pull/1873) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Downgrade MSRV to 1.77.2 to support Windows 7.
+
+## \[2.0.1]
+
+- [`9501cfa5`](https://github.com/tauri-apps/plugins-workspace/commit/9501cfa5f5385b2d7eb43a8378b322ee97cba06f) ([#1868](https://github.com/tauri-apps/plugins-workspace/pull/1868) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Fix configuration parser incorrectly warning about the endpoint scheme.
+
+## \[2.0.0]
+
+- [`e2c4dfb6`](https://github.com/tauri-apps/plugins-workspace/commit/e2c4dfb6af43e5dd8d9ceba232c315f5febd55c1) Update to tauri v2 stable release.
+
+## \[2.0.0-rc.4]
+
+- [`221f50f5`](https://github.com/tauri-apps/plugins-workspace/commit/221f50f53bd7a87dbd404e4cb1aaf502a5047785) ([#1816](https://github.com/tauri-apps/plugins-workspace/pull/1816) by [@amrbashir](https://github.com/tauri-apps/plugins-workspace/../../amrbashir)) Encode `+` when making updater requests which can be cause incorrectly interpolating the endpoint when using `{{current_version}}` in the endpoint where the current version contains a build number, for example `1.8.0+1`.
+- [`04a0aea0`](https://github.com/tauri-apps/plugins-workspace/commit/04a0aea0ab9f8750200bc2fe5aff99c1c488082d) ([#1814](https://github.com/tauri-apps/plugins-workspace/pull/1814) by [@amrbashir](https://github.com/tauri-apps/plugins-workspace/../../amrbashir)) **Breaking change**, Changed `UpdaterBuilder::endpoints` method to return a `Result`.
+- [`04a0aea0`](https://github.com/tauri-apps/plugins-workspace/commit/04a0aea0ab9f8750200bc2fe5aff99c1c488082d) ([#1814](https://github.com/tauri-apps/plugins-workspace/pull/1814) by [@amrbashir](https://github.com/tauri-apps/plugins-workspace/../../amrbashir)) Add `dangerousInsecureTransportProtocol` config option to allow using insecure transport protocols, like `http`
+
+## \[2.0.0-rc.3]
+
+- [`d00519e3`](https://github.com/tauri-apps/plugins-workspace/commit/d00519e3e3a3234f9eb6c2ba82c92d4199f03e53) ([#1735](https://github.com/tauri-apps/plugins-workspace/pull/1735) by [@FabianLars](https://github.com/tauri-apps/plugins-workspace/../../FabianLars)) This releases the changes from 2.0.0-rc.2 to crates.io. Please see the links below for the actual changes.
+
+## \[2.0.0-rc.2]
+
+- [`f8255e1d`](https://github.com/tauri-apps/plugins-workspace/commit/f8255e1db5df6cf562b9334fbefe5e62f4a28e0a) ([#1661](https://github.com/tauri-apps/plugins-workspace/pull/1661) by [@amrbashir](https://github.com/tauri-apps/plugins-workspace/../../amrbashir)) Add a second argument in `Update.download` and `Update.donloadAndInstall` JS APIs to modify headers and timeout when downloading the update.
+
+## \[2.0.0-rc.1]
+
+- [`e2e97db5`](https://github.com/tauri-apps/plugins-workspace/commit/e2e97db51983267f5be84d4f6f0278d58834d1f5) ([#1701](https://github.com/tauri-apps/plugins-workspace/pull/1701) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Update to tauri 2.0.0-rc.8
+
+## \[2.0.0-rc.1]
+
+- [`77013925`](https://github.com/tauri-apps/plugins-workspace/commit/7701392500f375340045880fce5fb8f867bfe670) ([#1636](https://github.com/tauri-apps/plugins-workspace/pull/1636) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Fixes the updater not preserving AppImage file permissions.
+- [`5d170a54`](https://github.com/tauri-apps/plugins-workspace/commit/5d170a5444982dcc14135f6f1fc3e5da359f0eb0) ([#1671](https://github.com/tauri-apps/plugins-workspace/pull/1671) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Update to tauri 2.0.0-rc.3.
+
+## \[2.0.0-rc.0]
+
+- [`9887d1`](https://github.com/tauri-apps/plugins-workspace/commit/9887d14bd0e971c4c0f5c1188fc4005d3fc2e29e) Update to tauri RC.
+
+## \[2.0.0-beta.8]
+
+- [`99d6ac0f`](https://github.com/tauri-apps/plugins-workspace/commit/99d6ac0f9506a6a4a1aa59c728157190a7441af6) ([#1606](https://github.com/tauri-apps/plugins-workspace/pull/1606) by [@FabianLars](https://github.com/tauri-apps/plugins-workspace/../../FabianLars)) The JS packages now specify the *minimum* `@tauri-apps/api` version instead of a single exact version.
+- [`6de87966`](https://github.com/tauri-apps/plugins-workspace/commit/6de87966ecc00ad9d91c25be452f1f46bd2b7e1f) ([#1597](https://github.com/tauri-apps/plugins-workspace/pull/1597) by [@Legend-Master](https://github.com/tauri-apps/plugins-workspace/../../Legend-Master)) Update to tauri beta.25.
+
+## \[2.0.0-beta.11]
+
+- [`f83b9e98`](https://github.com/tauri-apps/plugins-workspace/commit/f83b9e9813843df19b03b6af1018d848111b2a62) ([#1544](https://github.com/tauri-apps/plugins-workspace/pull/1544) by [@Legend-Master](https://github.com/tauri-apps/plugins-workspace/../../Legend-Master)) On Windows, use a named tempfile with `<app name>-<version>-installer.exe` (or `.msi`) for v2 updater
+
+  **Breaking Change**: `UpdaterBuilder::new` now takes one more argument `app_name: String`
+
+## \[2.0.0-beta.7]
+
+- [`22a17980`](https://github.com/tauri-apps/plugins-workspace/commit/22a17980ff4f6f8c40adb1b8f4ffc6dae2fe7e30) ([#1537](https://github.com/tauri-apps/plugins-workspace/pull/1537) by [@lucasfernog](https://github.com/tauri-apps/plugins-workspace/../../lucasfernog)) Update to tauri beta.24.
+
+## \[2.0.0-beta.6]
+
+- [`76daee7a`](https://github.com/tauri-apps/plugins-workspace/commit/76daee7aafece34de3092c86e531cf9eb1138989) ([#1512](https://github.com/tauri-apps/plugins-workspace/pull/1512) by [@renovate](https://github.com/tauri-apps/plugins-workspace/../../renovate)) Update to tauri beta.23.
+
+## \[2.0.0-beta.8]
+
+- [`bf29a72b`](https://github.com/tauri-apps/plugins-workspace/commit/bf29a72baaff15214a21989df23081eee84e3b8b) ([#1454](https://github.com/tauri-apps/plugins-workspace/pull/1454) by [@amrbashir](https://github.com/tauri-apps/plugins-workspace/../../amrbashir)) Fix regression in updater plugin failing to update using `.msi` installer.
+
+## \[2.0.0-beta.5]
+
+- [`9013854f`](https://github.com/tauri-apps/plugins-workspace/commit/9013854f42a49a230b9dbb9d02774765528a923f)([#1382](https://github.com/tauri-apps/plugins-workspace/pull/1382)) Update to tauri beta.22.
+
+## \[2.0.0-beta.4]
+
+- [`430bd6f4`](https://github.com/tauri-apps/plugins-workspace/commit/430bd6f4f379bee5d232ae6b098ae131db7f178a)([#1363](https://github.com/tauri-apps/plugins-workspace/pull/1363)) Update to tauri beta.20.
+- [`43224c5d`](https://github.com/tauri-apps/plugins-workspace/commit/43224c5d5cfe2dd676e79ebafe424027c62c51c3)([#1330](https://github.com/tauri-apps/plugins-workspace/pull/1330)) Add `Update.download` and `Update.install` functions to the JavaScript API
+
+## \[2.0.0-beta.3]
+
+- [`bd1ed590`](https://github.com/tauri-apps/plugins-workspace/commit/bd1ed5903ffcce5500310dac1e59e8c67674ef1e)([#1237](https://github.com/tauri-apps/plugins-workspace/pull/1237)) Update to tauri beta.17.
+
+## \[2.0.0-beta.4]
+
+- [`293f363`](https://github.com/tauri-apps/plugins-workspace/commit/293f363c0dccc43e8403729fdc8cc2b4311c2d5b)([#1175](https://github.com/tauri-apps/plugins-workspace/pull/1175)) Add a `on_before_exit` hook for cleanup before spawning the updater on Windows, defaults to `app.cleanup_before_exit` when used through `UpdaterExt`
+- [`293f363`](https://github.com/tauri-apps/plugins-workspace/commit/293f363c0dccc43e8403729fdc8cc2b4311c2d5b)([#1175](https://github.com/tauri-apps/plugins-workspace/pull/1175)) **Breaking change:** The `rustls-tls` feature flag is now enabled by default.
+- [`e3d41f4`](https://github.com/tauri-apps/plugins-workspace/commit/e3d41f4011bd3ea3ce281bb38bbe31d3709f8e0f)([#1191](https://github.com/tauri-apps/plugins-workspace/pull/1191)) Internally use the webview scoped resources table instead of the app one, so other webviews can't access other webviews resources.
+- [`7e2fcc5`](https://github.com/tauri-apps/plugins-workspace/commit/7e2fcc5e74df7c3c718e40f75bfb0eafc7d69d8d)([#1146](https://github.com/tauri-apps/plugins-workspace/pull/1146)) Update dependencies to align with tauri 2.0.0-beta.14.
+- [`e3d41f4`](https://github.com/tauri-apps/plugins-workspace/commit/e3d41f4011bd3ea3ce281bb38bbe31d3709f8e0f)([#1191](https://github.com/tauri-apps/plugins-workspace/pull/1191)) Update for tauri 2.0.0-beta.15.
+
+## \[2.0.0-beta.3]
+
+- [`4e37316`](https://github.com/tauri-apps/plugins-workspace/commit/4e37316af0d6532bf9a9bd0e712b5b14b0598285)([#1051](https://github.com/tauri-apps/plugins-workspace/pull/1051)) Fix deserialization of `windows > installerArgs` config field.
+- [`4e37316`](https://github.com/tauri-apps/plugins-workspace/commit/4e37316af0d6532bf9a9bd0e712b5b14b0598285)([#1051](https://github.com/tauri-apps/plugins-workspace/pull/1051)) On Windows, fallback to `passive` install mode when not defined in config.
+- [`a3b5396`](https://github.com/tauri-apps/plugins-workspace/commit/a3b5396113ca93912274f6890d9ef5b1a409587a)([#1054](https://github.com/tauri-apps/plugins-workspace/pull/1054)) Fix Windows powershell window flashing on update
+- [`a04ea2f`](https://github.com/tauri-apps/plugins-workspace/commit/a04ea2f38294d5a3987578283badc8eec87a7752)([#1071](https://github.com/tauri-apps/plugins-workspace/pull/1071)) The global API script is now only added to the binary when the `withGlobalTauri` config is true.
+
+## \[2.0.0-beta.2]
+
+- [`99bea25`](https://github.com/tauri-apps/plugins-workspace/commit/99bea2559c2c0648c2519c50a18cd124dacef57b)([#1005](https://github.com/tauri-apps/plugins-workspace/pull/1005)) Update to tauri beta.8.
+
+## \[2.0.0-beta.1]
+
+- [`569defb`](https://github.com/tauri-apps/plugins-workspace/commit/569defbe9492e38938554bb7bdc1be9151456d21) Update to tauri beta.4.
+
+## \[2.0.0-beta.0]
+
+- [`d198c01`](https://github.com/tauri-apps/plugins-workspace/commit/d198c014863ee260cb0de88a14b7fc4356ef7474)([#862](https://github.com/tauri-apps/plugins-workspace/pull/862)) Update to tauri beta.
+- [`0879a87`](https://github.com/tauri-apps/plugins-workspace/commit/0879a87a7ecc83c9e886e6f1412fe253082b8d34)([#899](https://github.com/tauri-apps/plugins-workspace/pull/899)) Fix `Started` event not emitted to JS when downloading update.
+- [`8505a75`](https://github.com/tauri-apps/plugins-workspace/commit/8505a756b569d88757ec58e452bfe4814d8107bf)([#907](https://github.com/tauri-apps/plugins-workspace/pull/907)) Add support for specifying proxy to use for checking and downloading updates.
+
+## \[2.0.0-alpha.5]
+
+- [`387c2f9`](https://github.com/tauri-apps/plugins-workspace/commit/387c2f9e0ce4c75c07ffa3fd76391a25b58f5daf)([#802](https://github.com/tauri-apps/plugins-workspace/pull/802)) Update to @tauri-apps/api v2.0.0-alpha.13.
+- [`e5f979f`](https://github.com/tauri-apps/plugins-workspace/commit/e5f979f91abbb1775fa048af3219b30ff30ed691)([#818](https://github.com/tauri-apps/plugins-workspace/pull/818)) Fix NSIS updater failing to launch when using `basicUi` mode.
+
+## \[2.0.0-alpha.4]
+
+- [`387c2f9`](https://github.com/tauri-apps/plugins-workspace/commit/387c2f9e0ce4c75c07ffa3fd76391a25b58f5daf)([#802](https://github.com/tauri-apps/plugins-workspace/pull/802)) Update to @tauri-apps/api v2.0.0-alpha.12.
+
+## \[2.0.0-alpha.3]
+
+- [`e438e0a`](https://github.com/tauri-apps/plugins-workspace/commit/e438e0a62d4b430a5159f05f13ecd397dd891a0d)([#676](https://github.com/tauri-apps/plugins-workspace/pull/676)) Update to @tauri-apps/api v2.0.0-alpha.11.
+
+## \[2.0.0-alpha.2]
+
+- [`5c13736`](https://github.com/tauri-apps/plugins-workspace/commit/5c137365c60790e8d4037d449e8237aa3fffdab0)([#673](https://github.com/tauri-apps/plugins-workspace/pull/673)) Update to @tauri-apps/api v2.0.0-alpha.9.
+
+## \[2.0.0-alpha.2]
+
+- [`4e2cef9`](https://github.com/tauri-apps/plugins-workspace/commit/4e2cef9b702bbbb9cf4ee17de50791cb21f1b2a4)([#593](https://github.com/tauri-apps/plugins-workspace/pull/593)) Update to alpha.12.
+
+## \[2.0.0-alpha.1]
+
+- [`d74fc0a`](https://github.com/tauri-apps/plugins-workspace/commit/d74fc0a097996e90a37be8f57d50b7d1f6ca616f)([#555](https://github.com/tauri-apps/plugins-workspace/pull/555)) Update to alpha.11.
+- [`4ab90f0`](https://github.com/tauri-apps/plugins-workspace/commit/4ab90f048eab2918344f97dc8e04413a404e392d)([#431](https://github.com/tauri-apps/plugins-workspace/pull/431)) The updater plugin is recieving a few changes to improve consistency and ergonomics of the Rust and JS APIs
+
+## \[2.0.0-alpha.0]
+
+- [`717ae67`](https://github.com/tauri-apps/plugins-workspace/commit/717ae670978feb4492fac1f295998b93f2b9347f)([#371](https://github.com/tauri-apps/plugins-workspace/pull/371)) First v2 alpha release!
diff --git a/vendor/tauri-plugin-updater/Cargo.lock b/vendor/tauri-plugin-updater/Cargo.lock
new file mode 100644
index 0000000000..6afe78c86b
--- /dev/null
+++ b/vendor/tauri-plugin-updater/Cargo.lock
@@ -0,0 +1,4580 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "addr2line"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
+dependencies = [
+ "gimli",
+]
+
+[[package]]
+name = "adler2"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "android-tzdata"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.98"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487"
+
+[[package]]
+name = "arbitrary"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dde20b3d026af13f561bdd0f15edf01fc734f0dafcedbaf42bba506a9517f223"
+dependencies = [
+ "derive_arbitrary",
+]
+
+[[package]]
+name = "atk"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "241b621213072e993be4f6f3a9e4b45f65b7e6faad43001be957184b7bb1824b"
+dependencies = [
+ "atk-sys",
+ "glib",
+ "libc",
+]
+
+[[package]]
+name = "atk-sys"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5e48b684b0ca77d2bbadeef17424c2ea3c897d44d566a1617e7e8f30614d086"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+
+[[package]]
+name = "backtrace"
+version = "0.3.74"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d82cb332cdfaed17ae235a638438ac4d4839913cc2af585c3c6746e8f8bee1a"
+dependencies = [
+ "addr2line",
+ "cfg-if",
+ "libc",
+ "miniz_oxide",
+ "object",
+ "rustc-demangle",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "base64"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block2"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5"
+dependencies = [
+ "objc2",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1628fb46dfa0b37568d12e5edd512553eccf6a22a78e8bde00bb4aed84d5bdbf"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "cairo-rs"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ca26ef0159422fb77631dc9d17b102f253b876fe1586b03b803e63a309b4ee2"
+dependencies = [
+ "bitflags 2.9.0",
+ "cairo-sys-rs",
+ "glib",
+ "libc",
+ "once_cell",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "cairo-sys-rs"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "685c9fa8e590b8b3d678873528d83411db17242a73fccaed827770ea0fedda51"
+dependencies = [
+ "glib-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "camino"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b96ec4966b5813e2c0507c1f86115c8c5abaadc3980879c3424042a02fd1ad3"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "cargo-platform"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24b1f0365a6c6bb4020cd05806fd0d33c44d38046b8bd7f0e40814b9763cabfc"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "cargo_metadata"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "afc309ed89476c8957c50fb818f56fe894db857866c3e163335faa91dc34eb85"
+dependencies = [
+ "camino",
+ "cargo-platform",
+ "semver",
+ "serde",
+ "serde_json",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "cargo_toml"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02260d489095346e5cafd04dea8e8cb54d1d74fcd759022a9b72986ebe9a1257"
+dependencies = [
+ "serde",
+ "toml 0.8.20",
+]
+
+[[package]]
+name = "cc"
+version = "1.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e3a13707ac958681c13b39b458c073d0d9bc8a22cb1b2f4c8e55eb72c13f362"
+dependencies = [
+ "shlex",
+]
+
+[[package]]
+name = "cesu8"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
+
+[[package]]
+name = "cfb"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d38f2da7a0a2c4ccf0065be06397cc26a81f4e528be095826eee9d4adbb8c60f"
+dependencies = [
+ "byteorder",
+ "fnv",
+ "uuid",
+]
+
+[[package]]
+name = "cfg-expr"
+version = "0.15.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d067ad48b8650848b989a59a86c6c36a995d02d2bf778d45c3c5d57bc2718f02"
+dependencies = [
+ "smallvec",
+ "target-lexicon",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "chrono"
+version = "0.4.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a7964611d71df112cb1730f2ee67324fcf4d0fc6606acbbe9bfe06df124637c"
+dependencies = [
+ "android-tzdata",
+ "iana-time-zone",
+ "num-traits",
+ "serde",
+ "windows-link",
+]
+
+[[package]]
+name = "combine"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "convert_case"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6245d59a3e82a7fc217c5828a6692dbc6dfb63a0c8c90495621f7b9d79704a0e"
+
+[[package]]
+name = "cookie"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
+dependencies = [
+ "time",
+ "version_check",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b55271e5c8c478ad3f38ad24ef34923091e0548492a266d19b3c0b4d82574c63"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "cssparser"
+version = "0.29.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f93d03419cb5950ccfd3daf3ff1c7a36ace64609a1a8746d493df1ca0afde0fa"
+dependencies = [
+ "cssparser-macros",
+ "dtoa-short",
+ "itoa",
+ "matches",
+ "phf 0.10.1",
+ "proc-macro2",
+ "quote",
+ "smallvec",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "cssparser-macros"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331"
+dependencies = [
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "ctor"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a2785755761f3ddc1492979ce1e48d2c00d09311c39e4466429188f3dd6501"
+dependencies = [
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "darling"
+version = "0.20.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.20.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d00b9596d185e565c2207a0b01f8bd1a135483d02d9b7b0a54b11da8d53412e"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.20.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "deranged"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c9e6a11ca8224451684bc0d7d5a7adbf8f2fd6887261a1cfc3c0432f9d4068e"
+dependencies = [
+ "powerfmt",
+ "serde",
+]
+
+[[package]]
+name = "derive_arbitrary"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30542c1ad912e0e3d22a1935c290e12e8a29d704a420177a31faad4a601a0800"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "derive_more"
+version = "0.99.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3da29a38df43d6f156149c9b43ded5e018ddff2a855cf2cfd62e8cd7d079c69f"
+dependencies = [
+ "convert_case",
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "dirs"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
+dependencies = [
+ "libc",
+ "option-ext",
+ "redox_users",
+ "windows-sys 0.60.2",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "dpi"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f25c0e292a7ca6d6498557ff1df68f32c99850012b6ea401cf8daf771f22ff53"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "dtoa"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6add3b8cff394282be81f3fc1a0605db594ed69890078ca6e2cab1c408bcf04"
+
+[[package]]
+name = "dtoa-short"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87"
+dependencies = [
+ "dtoa",
+]
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "dyn-clone"
+version = "1.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c7a8fb8a9fbf66c1f703fe16184d10ca0ee9d23be5b4436400408ba54a95005"
+
+[[package]]
+name = "embed-resource"
+version = "3.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fbc6e0d8e0c03a655b53ca813f0463d2c956bc4db8138dbc89f120b066551e3"
+dependencies = [
+ "cc",
+ "memchr",
+ "rustc_version",
+ "toml 0.8.20",
+ "vswhom",
+ "winreg",
+]
+
+[[package]]
+name = "embed_plist"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ef6b89e5b37196644d8796de5268852ff179b44e96276cf4290264843743bb7"
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "erased-serde"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e004d887f51fcb9fef17317a2f3525c887d8aa3f4f50fed920816a688284a5b7"
+dependencies = [
+ "serde",
+ "typeid",
+]
+
+[[package]]
+name = "errno"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "976dd42dc7e85965fe702eb8164f21f450704bdde31faefd6471dba214cb594e"
+dependencies = [
+ "libc",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+
+[[package]]
+name = "fdeflate"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
+dependencies = [
+ "simd-adler32",
+]
+
+[[package]]
+name = "field-offset"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38e2275cc4e4fc009b0669731a1e5ab7ebf11f469eaede2bab9309a5b4d6057f"
+dependencies = [
+ "memoffset",
+ "rustc_version",
+]
+
+[[package]]
+name = "filetime"
+version = "0.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35c0522e981e68cbfa8c3f978441a5f34b30b96e146b33cd3359176b50fe8586"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "libredox",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "flate2"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ced92e76e966ca2fd84c8f7aa01a4aea65b0eb6648d72f7c8f3e2764a67fece"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df420e2e84819663797d1ec6544b13c5be84629e7bb00dc960d6917db2987843"
+dependencies = [
+ "mac",
+ "new_debug_unreachable",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
+
+[[package]]
+name = "futures-task"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
+
+[[package]]
+name = "futures-util"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
+dependencies = [
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "pin-utils",
+ "slab",
+]
+
+[[package]]
+name = "fxhash"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c31b6d751ae2c7f11320402d34e41349dd1016f8d5d45e48c4312bc8625af50c"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "gdk"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9f245958c627ac99d8e529166f9823fb3b838d1d41fd2b297af3075093c2691"
+dependencies = [
+ "cairo-rs",
+ "gdk-pixbuf",
+ "gdk-sys",
+ "gio",
+ "glib",
+ "libc",
+ "pango",
+]
+
+[[package]]
+name = "gdk-pixbuf"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50e1f5f1b0bfb830d6ccc8066d18db35c487b1b2b1e8589b5dfe9f07e8defaec"
+dependencies = [
+ "gdk-pixbuf-sys",
+ "gio",
+ "glib",
+ "libc",
+ "once_cell",
+]
+
+[[package]]
+name = "gdk-pixbuf-sys"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9839ea644ed9c97a34d129ad56d38a25e6756f99f3a88e15cd39c20629caf7"
+dependencies = [
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "gdk-sys"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c2d13f38594ac1e66619e188c6d5a1adb98d11b2fcf7894fc416ad76aa2f3f7"
+dependencies = [
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "pango-sys",
+ "pkg-config",
+ "system-deps",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi 0.9.0+wasi-snapshot-preview1",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi 0.11.0+wasi-snapshot-preview1",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73fea8450eea4bac3940448fb7ae50d91f034f941199fcd9d909a5a07aa455f0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "wasi 0.14.2+wasi-0.2.4",
+]
+
+[[package]]
+name = "gimli"
+version = "0.31.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
+
+[[package]]
+name = "gio"
+version = "0.18.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4fc8f532f87b79cbc51a79748f16a6828fb784be93145a322fa14d06d354c73"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "gio-sys",
+ "glib",
+ "libc",
+ "once_cell",
+ "pin-project-lite",
+ "smallvec",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "gio-sys"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37566df850baf5e4cb0dfb78af2e4b9898d817ed9263d1090a2df958c64737d2"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+ "winapi",
+]
+
+[[package]]
+name = "glib"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "233daaf6e83ae6a12a52055f568f9d7cf4671dabb78ff9560ab6da230ce00ee5"
+dependencies = [
+ "bitflags 2.9.0",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-task",
+ "futures-util",
+ "gio-sys",
+ "glib-macros",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "memchr",
+ "once_cell",
+ "smallvec",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "glib-macros"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bb0228f477c0900c880fd78c8759b95c7636dbd7842707f49e132378aa2acdc"
+dependencies = [
+ "heck 0.4.1",
+ "proc-macro-crate 2.0.0",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "glib-sys"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "063ce2eb6a8d0ea93d2bf8ba1957e78dbab6be1c2220dd3daca57d5a9d869898"
+dependencies = [
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "glob"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
+
+[[package]]
+name = "gobject-sys"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0850127b514d1c4a4654ead6dedadb18198999985908e6ffe4436f53c785ce44"
+dependencies = [
+ "glib-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "gtk"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd56fb197bfc42bd5d2751f4f017d44ff59fbb58140c6b49f9b3b2bdab08506a"
+dependencies = [
+ "atk",
+ "cairo-rs",
+ "field-offset",
+ "futures-channel",
+ "gdk",
+ "gdk-pixbuf",
+ "gio",
+ "glib",
+ "gtk-sys",
+ "gtk3-macros",
+ "libc",
+ "pango",
+ "pkg-config",
+]
+
+[[package]]
+name = "gtk-sys"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f29a1c21c59553eb7dd40e918be54dccd60c52b049b75119d5d96ce6b624414"
+dependencies = [
+ "atk-sys",
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gdk-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "pango-sys",
+ "system-deps",
+]
+
+[[package]]
+name = "gtk3-macros"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ff3c5b21f14f0736fed6dcfc0bfb4225ebf5725f3c0209edeec181e4d73e9d"
+dependencies = [
+ "proc-macro-crate 1.3.1",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashbrown"
+version = "0.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf151400ff0baff5465007dd2f3e717f3fe502074ca563069ce3a6629d07b289"
+
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "html5ever"
+version = "0.29.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b7410cae13cbc75623c98ac4cbfd1f0bedddf3227afc24f370cf0f50a44a11c"
+dependencies = [
+ "log",
+ "mac",
+ "markup5ever",
+ "match_token",
+]
+
+[[package]]
+name = "http"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4a85d31aea989eead29a3aaf9e1115a180df8282431156e533de47660892565"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "hyper"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "itoa",
+ "pin-project-lite",
+ "pin-utils",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d191583f3da1305256f22463b9bb0471acad48a4e534a5218b9963e9c1f59b2"
+dependencies = [
+ "futures-util",
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-tls"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
+dependencies = [
+ "bytes",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "727805d60e7938b76b826a6ef209eb70eaa1812794f9424d4a4e2d740662df5f"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0c919e5debc312ad217002b8048a17b7d83f80703865bbfcfebb0458b0b27d8"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "ico"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e795dff5605e0f04bff85ca41b51a96b83e80b281e96231bcaaf1ac35103371"
+dependencies = [
+ "byteorder",
+ "png",
+]
+
+[[package]]
+name = "icu_collections"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db2fa452206ebee18c4b5c2274dbf1de17008e874b4dc4f0aea9d01ca79e4526"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13acbb8371917fc971be86fc8057c41a64b521c184808a698c02acc242dbf637"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid_transform"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01d11ac35de8e40fdeda00d9e1e9d92525f3f9d887cdd7aa81d727596788b54e"
+dependencies = [
+ "displaydoc",
+ "icu_locid",
+ "icu_locid_transform_data",
+ "icu_provider",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid_transform_data"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7515e6d781098bf9f7205ab3fc7e9709d34554ae0b21ddbcb5febfa4bc7df11d"
+
+[[package]]
+name = "icu_normalizer"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19ce3e0da2ec68599d193c93d088142efd7f9c5d6fc9b803774855747dc6a84f"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "utf16_iter",
+ "utf8_iter",
+ "write16",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5e8338228bdc8ab83303f16b797e177953730f601a96c25d10cb3ab0daa0cb7"
+
+[[package]]
+name = "icu_properties"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93d6020766cfc6302c15dbbc9c8778c37e62c14427cb7f6e601d849e092aeef5"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locid_transform",
+ "icu_properties_data",
+ "icu_provider",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85fb8799753b75aee8d2a21d7c14d9f38921b54b3dbda10f5a3c7a7b82dba5e2"
+
+[[package]]
+name = "icu_provider"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ed421c8a8ef78d3e2dbc98a973be2f3770cb42b606e3ab18d6237c4dfde68d9"
+dependencies = [
+ "displaydoc",
+ "icu_locid",
+ "icu_provider_macros",
+ "stable_deref_trait",
+ "tinystr",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_provider_macros"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "idna"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "686f825264d630750a544639377bae737628043f20d38bbc029e8f29ea968a7e"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daca1df1c957320b2cf139ac61e7bd64fed304c5040df000a745aa1de3b4ef71"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.15.2",
+ "serde",
+]
+
+[[package]]
+name = "infer"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a588916bfdfd92e71cacef98a63d9b1f0d74d6599980d11894290e7ddefffcf7"
+dependencies = [
+ "cfb",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
+
+[[package]]
+name = "iri-string"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c91338f0783edbd6195decb37bae672fd3b165faffb89bf7b9e6942f8b1a731a"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+
+[[package]]
+name = "javascriptcore-rs"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca5671e9ffce8ffba57afc24070e906da7fc4b1ba66f2cabebf61bf2ea257fcc"
+dependencies = [
+ "bitflags 1.3.2",
+ "glib",
+ "javascriptcore-rs-sys",
+]
+
+[[package]]
+name = "javascriptcore-rs-sys"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af1be78d14ffa4b75b66df31840478fef72b51f8c2465d4ca7c194da9f7a5124"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "jni"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97"
+dependencies = [
+ "cesu8",
+ "cfg-if",
+ "combine",
+ "jni-sys",
+ "log",
+ "thiserror 1.0.69",
+ "walkdir",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
+
+[[package]]
+name = "js-sys"
+version = "0.3.77"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1cfaf33c695fc6e08064efbc1f72ec937429614f25eef83af942d0e227c3a28f"
+dependencies = [
+ "once_cell",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "json-patch"
+version = "3.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "863726d7afb6bc2590eeff7135d923545e5e964f004c2ccf8716c25e70a86f08"
+dependencies = [
+ "jsonptr",
+ "serde",
+ "serde_json",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "jsonptr"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5dea2b27dd239b2556ed7a25ba842fe47fd602e7fc7433c2a8d6106d4d9edd70"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "keyboard-types"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b750dcadc39a09dbadd74e118f6dd6598df77fa01df0cfcdc52c28dece74528a"
+dependencies = [
+ "bitflags 2.9.0",
+ "serde",
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "kuchikiki"
+version = "0.8.8-speedreader"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02cb977175687f33fa4afa0c95c112b987ea1443e5a51c8f8ff27dc618270cc2"
+dependencies = [
+ "cssparser",
+ "html5ever",
+ "indexmap 2.9.0",
+ "selectors",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.180"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
+
+[[package]]
+name = "libredox"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
+dependencies = [
+ "bitflags 2.9.0",
+ "libc",
+ "redox_syscall",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
+
+[[package]]
+name = "litemap"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ee93343901ab17bd981295f2cf0026d4ad018c7c31ba84549a4ddbb47a45104"
+
+[[package]]
+name = "lock_api"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
+
+[[package]]
+name = "mac"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4"
+
+[[package]]
+name = "markup5ever"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7a7213d12e1864c0f002f52c2923d4556935a43dec5e71355c2760e0f6e7a18"
+dependencies = [
+ "log",
+ "phf 0.11.3",
+ "phf_codegen 0.11.3",
+ "string_cache",
+ "string_cache_codegen",
+ "tendril",
+]
+
+[[package]]
+name = "match_token"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88a9689d8d44bf9964484516275f5cd4c9b59457a6940c1d5d0ecbb94510a36b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "matches"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2532096657941c2fea9c289d370a250971c689d4f143798ff67113ec042024a5"
+
+[[package]]
+name = "memchr"
+version = "2.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "minisign-verify"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6367d84fb54d4242af283086402907277715b8fe46976963af5ebf173f8efba3"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3be647b768db090acb35d5ec5db2b0e1f1de11133ca123b9eacf5137868f892a"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "mio"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
+dependencies = [
+ "libc",
+ "wasi 0.11.0+wasi-snapshot-preview1",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "muda"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01c1738382f66ed56b3b9c8119e794a2e23148ac8ea214eda86622d4cb9d415a"
+dependencies = [
+ "crossbeam-channel",
+ "dpi",
+ "gtk",
+ "keyboard-types",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+ "once_cell",
+ "png",
+ "serde",
+ "thiserror 2.0.12",
+ "windows-sys 0.60.2",
+]
+
+[[package]]
+name = "native-tls"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8614eb2c83d59d1c8cc974dd3f920198647674a0a035e1af1fa58707e317466"
+dependencies = [
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework 2.11.1",
+ "security-framework-sys",
+ "tempfile",
+]
+
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+
+[[package]]
+name = "nodrop"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72ef4a56884ca558e5ddb05a1d1e7e1bfd9a68d9ed024c21704cc98872dae1bb"
+
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "objc2"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c2599ce0ec54857b29ce62166b0ed9b4f6f1a70ccc9a71165b6154caca8c05"
+dependencies = [
+ "objc2-encode",
+]
+
+[[package]]
+name = "objc2-app-kit"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5906f93257178e2f7ae069efb89fbd6ee94f0592740b5f8a1512ca498814d0fb"
+dependencies = [
+ "bitflags 2.9.0",
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-core-foundation"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daeaf60f25471d26948a1c2f840e3f7d86f4109e3af4e8e4b5cd70c39690d925"
+dependencies = [
+ "bitflags 2.9.0",
+ "objc2",
+]
+
+[[package]]
+name = "objc2-encode"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33"
+
+[[package]]
+name = "objc2-foundation"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a21c6c9014b82c39515db5b396f91645182611c97d24637cf56ac01e5f8d998"
+dependencies = [
+ "bitflags 2.9.0",
+ "block2",
+ "libc",
+ "objc2",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-osa-kit"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1ac59da3ceebc4a82179b35dc550431ad9458f9cc326e053f49ba371ce76c5a"
+dependencies = [
+ "bitflags 2.9.0",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-security"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3126341c65c5d5728423ae95d788e1b660756486ad0592307ab87ba02d9a7268"
+dependencies = [
+ "bitflags 2.9.0",
+ "objc2",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-ui-kit"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "777a571be14a42a3990d4ebedaeb8b54cd17377ec21b92e8200ac03797b3bee1"
+dependencies = [
+ "bitflags 2.9.0",
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-web-kit"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b717127e4014b0f9f3e8bba3d3f2acec81f1bde01f656823036e823ed2c94dce"
+dependencies = [
+ "bitflags 2.9.0",
+ "block2",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+ "objc2-security",
+]
+
+[[package]]
+name = "object"
+version = "0.36.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+
+[[package]]
+name = "openssl"
+version = "0.10.72"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fedfea7d58a1f73118430a55da6a286e7b044961736ce96a16a17068ea25e5da"
+dependencies = [
+ "bitflags 2.9.0",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
+
+[[package]]
+name = "openssl-src"
+version = "300.5.0+3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8ce546f549326b0e6052b649198487d91320875da901e7bd11a06d1ee3f9c2f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8288979acd84749c744a9014b4382d42b8f7b2592847b5afb2ed29e5d16ede07"
+dependencies = [
+ "cc",
+ "libc",
+ "openssl-src",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "option-ext"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
+
+[[package]]
+name = "osakit"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "732c71caeaa72c065bb69d7ea08717bd3f4863a4f451402fc9513e29dbd5261b"
+dependencies = [
+ "objc2",
+ "objc2-foundation",
+ "objc2-osa-kit",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.12",
+]
+
+[[package]]
+name = "pango"
+version = "0.18.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ca27ec1eb0457ab26f3036ea52229edbdb74dee1edd29063f5b9b010e7ebee4"
+dependencies = [
+ "gio",
+ "glib",
+ "libc",
+ "once_cell",
+ "pango-sys",
+]
+
+[[package]]
+name = "pango-sys"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "436737e391a843e5933d6d9aa102cb126d501e815b83601365a948a518555dc5"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "parking_lot"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
+
+[[package]]
+name = "phf"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3dfb61232e34fcb633f43d12c58f83c1df82962dcdfa565a4e866ffc17dafe12"
+dependencies = [
+ "phf_shared 0.8.0",
+]
+
+[[package]]
+name = "phf"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fabbf1ead8a5bcbc20f5f8b939ee3f5b0f6f281b6ad3468b84656b658b455259"
+dependencies = [
+ "phf_macros 0.10.0",
+ "phf_shared 0.10.0",
+ "proc-macro-hack",
+]
+
+[[package]]
+name = "phf"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
+dependencies = [
+ "phf_macros 0.11.3",
+ "phf_shared 0.11.3",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cbffee61585b0411840d3ece935cce9cb6321f01c45477d30066498cd5e1a815"
+dependencies = [
+ "phf_generator 0.8.0",
+ "phf_shared 0.8.0",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a"
+dependencies = [
+ "phf_generator 0.11.3",
+ "phf_shared 0.11.3",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17367f0cc86f2d25802b2c26ee58a7b23faeccf78a396094c13dced0d0182526"
+dependencies = [
+ "phf_shared 0.8.0",
+ "rand 0.7.3",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d5285893bb5eb82e6aaf5d59ee909a06a16737a8970984dd7746ba9283498d6"
+dependencies = [
+ "phf_shared 0.10.0",
+ "rand 0.8.5",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
+dependencies = [
+ "phf_shared 0.11.3",
+ "rand 0.8.5",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58fdf3184dd560f160dd73922bea2d5cd6e8f064bf4b13110abd81b03697b4e0"
+dependencies = [
+ "phf_generator 0.10.0",
+ "phf_shared 0.10.0",
+ "proc-macro-hack",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f84ac04429c13a7ff43785d75ad27569f2951ce0ffd30a3321230db2fc727216"
+dependencies = [
+ "phf_generator 0.11.3",
+ "phf_shared 0.11.3",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c00cf8b9eafe68dde5e9eaa2cef8ee84a9336a47d566ec55ca16589633b65af7"
+dependencies = [
+ "siphasher 0.3.11",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6796ad771acdc0123d2a88dc428b5e38ef24456743ddb1744ed628f9815c096"
+dependencies = [
+ "siphasher 0.3.11",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
+dependencies = [
+ "siphasher 1.0.1",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+
+[[package]]
+name = "plist"
+version = "1.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eac26e981c03a6e53e0aee43c113e3202f5581d5360dae7bd2c70e800dd0451d"
+dependencies = [
+ "base64 0.22.1",
+ "indexmap 2.9.0",
+ "quick-xml",
+ "serde",
+ "time",
+]
+
+[[package]]
+name = "png"
+version = "0.17.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82151a2fc869e011c153adc57cf2789ccb8d9906ce52c0b39a6b5697749d7526"
+dependencies = [
+ "bitflags 1.3.2",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
+[[package]]
+name = "proc-macro-crate"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919"
+dependencies = [
+ "once_cell",
+ "toml_edit 0.19.15",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e8366a6159044a37876a2b9817124296703c586a5c92e2c53751fa06d8d43e8"
+dependencies = [
+ "toml_edit 0.20.7",
+]
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-hack"
+version = "0.5.20+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.94"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a31971752e70b8b2686d7e46ec17fb38dad4051d94024c88df49b667caea9c84"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quick-xml"
+version = "0.32.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d3a6e5838b60e0e8fa7a43f22ade549a37d61f8bdbe636d0d7816191de969c2"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
+
+[[package]]
+name = "rand"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
+dependencies = [
+ "getrandom 0.1.16",
+ "libc",
+ "rand_chacha 0.2.2",
+ "rand_core 0.5.1",
+ "rand_hc",
+ "rand_pcg",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.5.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
+dependencies = [
+ "getrandom 0.1.16",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.15",
+]
+
+[[package]]
+name = "rand_hc"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
+dependencies = [
+ "rand_core 0.5.1",
+]
+
+[[package]]
+name = "rand_pcg"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16abd0c1b639e9eb4d7c50c0b8100b0d0f849be2349829c740fe8e6eb4816429"
+dependencies = [
+ "rand_core 0.5.1",
+]
+
+[[package]]
+name = "raw-window-handle"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20675572f6f24e9e76ef639bc5552774ed45f1c30e2951e1e99c59888861c539"
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f103c6d277498fbceb16e84d317e2a400f160f46904d5f5410848c829511a3"
+dependencies = [
+ "bitflags 2.9.0",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd6f9d3d47bdd2ad6945c5015a226ec6155d0bcdfd8f7cd29f86b71f8de99d2b"
+dependencies = [
+ "getrandom 0.2.15",
+ "libredox",
+ "thiserror 2.0.12",
+]
+
+[[package]]
+name = "regex"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+
+[[package]]
+name = "reqwest"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04e9018c9d814e5f30cc16a0f03271aeab3571e609612d9fe78c1aa8d11c2f62"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-tls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "native-tls",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "serde",
+ "serde_json",
+ "sync_wrapper",
+ "tokio",
+ "tokio-native-tls",
+ "tokio-rustls",
+ "tokio-util",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams",
+ "web-sys",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.15",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustc-demangle"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
+dependencies = [
+ "bitflags 2.9.0",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7160e3e10bf4535308537f3c4e1641468cd0e485175d6163087c0393c7d46643"
+dependencies = [
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fcff2dd52b58a8d98a70243663a0d234c4e2b79235637849d15913394a247d3"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework 3.5.1",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d99feebc72bae7ab76ba994bb5e121b8d83d910ca40b36e0921f53becc41784"
+dependencies = [
+ "core-foundation 0.10.0",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework 3.5.1",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df33b2b81ac578cabaf06b89b0631153a3f416b0a886e8a7a1707fb51abbd1ef"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eded382c5f5f786b989652c49544c4877d9f015cc22e145a5ea8ea66c2921cd2"
+
+[[package]]
+name = "ryu"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schannel"
+version = "0.1.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f29ebaa345f945cec9fbbc532eb307f0fdad8161f281b6369539c8d84876b3d"
+dependencies = [
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "schemars"
+version = "0.8.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fbf2ae1b8bc8e02df939598064d22402220cd5bbcca1c76f7d6a310974d5615"
+dependencies = [
+ "dyn-clone",
+ "indexmap 1.9.3",
+ "schemars_derive",
+ "serde",
+ "serde_json",
+ "url",
+ "uuid",
+]
+
+[[package]]
+name = "schemars_derive"
+version = "0.8.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e265784ad618884abaea0600a9adf15393368d840e0222d101a072f3f7534d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde_derive_internals",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "security-framework"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
+dependencies = [
+ "bitflags 2.9.0",
+ "core-foundation 0.9.4",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework"
+version = "3.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3297343eaf830f66ede390ea39da1d462b6b0c1b000f420d0a83f898bbbe6ef"
+dependencies = [
+ "bitflags 2.9.0",
+ "core-foundation 0.10.0",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc1f0cbffaac4852523ce30d8bd3c5cdc873501d96ff467ca09b6767bb8cd5c0"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "selectors"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c37578180969d00692904465fb7f6b3d50b9a2b952b87c23d0e2e5cb5013416"
+dependencies = [
+ "bitflags 1.3.2",
+ "cssparser",
+ "derive_more",
+ "fxhash",
+ "log",
+ "phf 0.8.0",
+ "phf_codegen 0.8.0",
+ "precomputed-hash",
+ "servo_arc",
+ "smallvec",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde-untagged"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "299d9c19d7d466db4ab10addd5703e4c615dec2a5a16dbbafe191045e87ee66e"
+dependencies = [
+ "erased-serde",
+ "serde",
+ "typeid",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "serde_derive_internals"
+version = "0.29.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.140"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
+dependencies = [
+ "itoa",
+ "memchr",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_repr"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87607cb1398ed59d48732e575a4c28a7a8ebf2454b964fe3f224f2afc07909e1"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40734c41988f7306bb04f0ecf60ec0f3f1caa34290e4e8ea471dcd3346483b83"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde_with"
+version = "3.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6b6f7f2fcb69f747921f79f3926bd1e203fce4fef62c268dd3abfb6d86029aa"
+dependencies = [
+ "base64 0.22.1",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.9.0",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d00caa5193a3c8362ac2b73be6b9e768aa5a4b2f721d8f4b339600c3cb51f8e"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "serialize-to-javascript"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04f3666a07a197cdb77cdf306c32be9b7f598d7060d50cfd4d5aa04bfd92f6c5"
+dependencies = [
+ "serde",
+ "serde_json",
+ "serialize-to-javascript-impl",
+]
+
+[[package]]
+name = "serialize-to-javascript-impl"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "772ee033c0916d670af7860b6e1ef7d658a4629a6d0b4c8c3e67f09b3765b75d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "servo_arc"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d52aa42f8fdf0fed91e5ce7f23d8138441002fa31dca008acf47e6fd4721f741"
+dependencies = [
+ "nodrop",
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
+
+[[package]]
+name = "siphasher"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d"
+
+[[package]]
+name = "siphasher"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56199f7ddabf13fe5074ce809e7d3f42b42ae711800501b5b16ea82ad029c39d"
+
+[[package]]
+name = "slab"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8917285742e9f3e1683f0a9c4e6b57960b7314d0b08d30d1ecd426713ee2eee9"
+
+[[package]]
+name = "socket2"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f5fd57c80058a56cf5c777ab8a126398ece8e442983605d280a44ce79d0edef"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "soup3"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "471f924a40f31251afc77450e781cb26d55c0b650842efafc9c6cbd2f7cc4f9f"
+dependencies = [
+ "futures-channel",
+ "gio",
+ "glib",
+ "libc",
+ "soup3-sys",
+]
+
+[[package]]
+name = "soup3-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ebe8950a680a12f24f15ebe1bf70db7af98ad242d9db43596ad3108aab86c27"
+dependencies = [
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+
+[[package]]
+name = "string_cache"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf776ba3fa74f83bf4b63c3dcbbf82173db2632ed8452cb2d891d33f459de70f"
+dependencies = [
+ "new_debug_unreachable",
+ "parking_lot",
+ "phf_shared 0.11.3",
+ "precomputed-hash",
+ "serde",
+]
+
+[[package]]
+name = "string_cache_codegen"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c711928715f1fe0fe509c53b43e993a9a557babc2d0a3567d0a3006f1ac931a0"
+dependencies = [
+ "phf_generator 0.11.3",
+ "phf_shared 0.11.3",
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "swift-rs"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4057c98e2e852d51fdcfca832aac7b571f6b351ad159f9eda5db1655f8d0c4d7"
+dependencies = [
+ "base64 0.21.7",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b09a44accad81e1ba1cd74a32461ba89dee89095ba17b32f5d03683b1b1fc2a0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "system-deps"
+version = "6.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3e535eb8dded36d55ec13eddacd30dec501792ff23a0b1682c38601b8cf2349"
+dependencies = [
+ "cfg-expr",
+ "heck 0.5.0",
+ "pkg-config",
+ "toml 0.8.20",
+ "version-compare",
+]
+
+[[package]]
+name = "tar"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973"
+dependencies = [
+ "filetime",
+ "libc",
+ "xattr",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.12.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
+
+[[package]]
+name = "tauri"
+version = "2.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e19299a5f2ccb6bcb2a38b1eb7999e8bbdbd5bdd3cf74a4f8ab412726cbd65e7"
+dependencies = [
+ "anyhow",
+ "bytes",
+ "cookie",
+ "dirs",
+ "dunce",
+ "embed_plist",
+ "getrandom 0.3.2",
+ "glob",
+ "gtk",
+ "heck 0.5.0",
+ "http",
+ "jni",
+ "libc",
+ "log",
+ "mime",
+ "muda",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-foundation",
+ "objc2-ui-kit",
+ "objc2-web-kit",
+ "percent-encoding",
+ "plist",
+ "raw-window-handle",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "serde_repr",
+ "serialize-to-javascript",
+ "swift-rs",
+ "tauri-build",
+ "tauri-macros",
+ "tauri-runtime",
+ "tauri-utils",
+ "thiserror 2.0.12",
+ "tokio",
+ "url",
+ "window-vibrancy",
+ "windows",
+]
+
+[[package]]
+name = "tauri-build"
+version = "2.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76809f63061c8b25537b87f46b8733b31397cf419706dc874e1602be6479ba90"
+dependencies = [
+ "anyhow",
+ "cargo_toml",
+ "dirs",
+ "glob",
+ "heck 0.5.0",
+ "json-patch",
+ "schemars",
+ "semver",
+ "serde",
+ "serde_json",
+ "tauri-utils",
+ "tauri-winres",
+ "toml 0.9.5",
+ "walkdir",
+]
+
+[[package]]
+name = "tauri-codegen"
+version = "2.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2ebe49d690ccaea93aa81fff99277d4f445968f085ba13be67859151e9e4b8"
+dependencies = [
+ "base64 0.22.1",
+ "ico",
+ "json-patch",
+ "plist",
+ "png",
+ "proc-macro2",
+ "quote",
+ "semver",
+ "serde",
+ "serde_json",
+ "sha2",
+ "syn 2.0.100",
+ "tauri-utils",
+ "thiserror 2.0.12",
+ "time",
+ "url",
+ "uuid",
+ "walkdir",
+]
+
+[[package]]
+name = "tauri-macros"
+version = "2.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1119f651b0187c686c0fc72c66bba311e560e1b5f61869086ce788d43be6cf41"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+ "tauri-codegen",
+ "tauri-utils",
+]
+
+[[package]]
+name = "tauri-plugin"
+version = "2.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "692a77abd8b8773e107a42ec0e05b767b8d2b7ece76ab36c6c3947e34df9f53f"
+dependencies = [
+ "anyhow",
+ "glob",
+ "plist",
+ "schemars",
+ "serde",
+ "serde_json",
+ "tauri-utils",
+ "toml 0.9.5",
+ "walkdir",
+]
+
+[[package]]
+name = "tauri-plugin-updater"
+version = "2.10.1"
+dependencies = [
+ "base64 0.22.1",
+ "dirs",
+ "flate2",
+ "futures-util",
+ "http",
+ "infer",
+ "log",
+ "minisign-verify",
+ "osakit",
+ "percent-encoding",
+ "reqwest",
+ "rustls",
+ "semver",
+ "serde",
+ "serde_json",
+ "tar",
+ "tauri",
+ "tauri-plugin",
+ "tempfile",
+ "thiserror 2.0.12",
+ "time",
+ "tokio",
+ "url",
+ "windows-sys 0.60.2",
+ "zip",
+]
+
+[[package]]
+name = "tauri-runtime"
+version = "2.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b885ffeac82b00f1f6fd292b6e5aabfa7435d537cef57d11e38a489956535651"
+dependencies = [
+ "cookie",
+ "dpi",
+ "gtk",
+ "http",
+ "jni",
+ "objc2",
+ "objc2-ui-kit",
+ "objc2-web-kit",
+ "raw-window-handle",
+ "serde",
+ "serde_json",
+ "tauri-utils",
+ "thiserror 2.0.12",
+ "url",
+ "webkit2gtk",
+ "webview2-com",
+ "windows",
+]
+
+[[package]]
+name = "tauri-utils"
+version = "2.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcd169fccdff05eff2c1033210b9b94acd07a47e6fa9a3431cf09cfd4f01c87e"
+dependencies = [
+ "anyhow",
+ "cargo_metadata",
+ "ctor",
+ "dunce",
+ "glob",
+ "html5ever",
+ "http",
+ "infer",
+ "json-patch",
+ "kuchikiki",
+ "log",
+ "memchr",
+ "phf 0.11.3",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "schemars",
+ "semver",
+ "serde",
+ "serde-untagged",
+ "serde_json",
+ "serde_with",
+ "swift-rs",
+ "thiserror 2.0.12",
+ "toml 0.9.5",
+ "url",
+ "urlpattern",
+ "uuid",
+ "walkdir",
+]
+
+[[package]]
+name = "tauri-winres"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56eaa45f707bedf34d19312c26d350bc0f3c59a47e58e8adbeecdc850d2c13a0"
+dependencies = [
+ "embed-resource",
+ "toml 0.8.20",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "655da9c7eb6305c55742045d5a8d2037996d61d8de95806335c7c86ce0f82e9c"
+dependencies = [
+ "fastrand",
+ "getrandom 0.3.2",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "tendril"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d24a120c5fc464a3458240ee02c299ebcb9d67b5249c8848b09d639dca8d7bb0"
+dependencies = [
+ "futf",
+ "mac",
+ "utf-8",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
+dependencies = [
+ "thiserror-impl 2.0.12",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "time"
+version = "0.3.41"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7619e19bc266e0f9c5e6686659d394bc57973859340060a69221e57dbc0c40"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9e9a38711f559d9e3ce1cdb06dd7c5b8ea546bc90052da6d06bb76da74bb07c"
+
+[[package]]
+name = "time-macros"
+version = "0.2.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3526739392ec93fd8b359c8e98514cb3e8e021beb4e5f597b00a0221f8ed8a49"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9117f5d4db391c1cf6927e7bea3db74b9a1c1add8f7eda9ffd5364f40f57b82f"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tokio"
+version = "1.44.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6b88822cbe49de4185e3a4cbf8321dd487cf5fe0c5c65695fef6346371e9c48"
+dependencies = [
+ "backtrace",
+ "bytes",
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "socket2",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "tokio-native-tls"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
+dependencies = [
+ "native-tls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e727b36a1a0e8b74c376ac2211e40c2c8af09fb4013c60d910495810f008e9b"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b9590b93e6fcc1739458317cccd391ad3955e2bde8913edf6f95f9e65a8f034"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "toml"
+version = "0.8.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd87a5cdd6ffab733b2f74bc4fd7ee5fff6634124999ac278c35fc78c6120148"
+dependencies = [
+ "serde",
+ "serde_spanned 0.6.8",
+ "toml_datetime 0.6.8",
+ "toml_edit 0.22.24",
+]
+
+[[package]]
+name = "toml"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75129e1dc5000bfbaa9fee9d1b21f974f9fbad9daec557a521ee6e080825f6e8"
+dependencies = [
+ "indexmap 2.9.0",
+ "serde",
+ "serde_spanned 1.0.0",
+ "toml_datetime 0.7.0",
+ "toml_parser",
+ "toml_writer",
+ "winnow 0.7.12",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dd7358ecb8fc2f8d014bf86f6f638ce72ba252a2c3a2572f2a795f1d23efb41"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bade1c3e902f58d73d3f294cd7f20391c1cb2fbcb643b73566bc773971df91e3"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.19.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
+dependencies = [
+ "indexmap 2.9.0",
+ "toml_datetime 0.6.8",
+ "winnow 0.5.40",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.20.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70f427fce4d84c72b5b732388bf4a9f4531b53f74e2887e3ecb2481f68f66d81"
+dependencies = [
+ "indexmap 2.9.0",
+ "toml_datetime 0.6.8",
+ "winnow 0.5.40",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.22.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17b4795ff5edd201c7cd6dca065ae59972ce77d1b80fa0a84d94950ece7d1474"
+dependencies = [
+ "indexmap 2.9.0",
+ "serde",
+ "serde_spanned 0.6.8",
+ "toml_datetime 0.6.8",
+ "winnow 0.7.12",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b551886f449aa90d4fe2bdaa9f4a2577ad2dde302c61ecf262d80b116db95c10"
+dependencies = [
+ "winnow 0.7.12",
+]
+
+[[package]]
+name = "toml_writer"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcc842091f2def52017664b53082ecbbeb5c7731092bad69d2c63050401dfd64"
+
+[[package]]
+name = "tower"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+dependencies = [
+ "bitflags 2.9.0",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "iri-string",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.41"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
+dependencies = [
+ "pin-project-lite",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e672c95779cf947c5311f83787af4fa8fffd12fb27e4993211a84bdfd9610f9c"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typeid"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
+
+[[package]]
+name = "typenum"
+version = "1.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
+
+[[package]]
+name = "unic-char-property"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8c57a407d9b6fa02b4795eb81c5b6652060a15a7903ea981f3d723e6c0be221"
+dependencies = [
+ "unic-char-range",
+]
+
+[[package]]
+name = "unic-char-range"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0398022d5f700414f6b899e10b8348231abf9173fa93144cbc1a43b9793c1fbc"
+
+[[package]]
+name = "unic-common"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80d7ff825a6a654ee85a63e80f92f054f904f21e7d12da4e22f9834a4aaa35bc"
+
+[[package]]
+name = "unic-ucd-ident"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e230a37c0381caa9219d67cf063aa3a375ffed5bf541a452db16e744bdab6987"
+dependencies = [
+ "unic-char-property",
+ "unic-char-range",
+ "unic-ucd-version",
+]
+
+[[package]]
+name = "unic-ucd-version"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96bd2f2237fe450fcd0a1d2f5f4e91711124f7857ba2e964247776ebeeb7b0c4"
+dependencies = [
+ "unic-common",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32f8b686cadd1473f4bd0117a5d28d36b1ade384ea9b5069a1c40aefed7fda60"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "urlpattern"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70acd30e3aa1450bc2eece896ce2ad0d178e9c079493819301573dae3c37ba6d"
+dependencies = [
+ "regex",
+ "serde",
+ "unic-ucd-ident",
+ "url",
+]
+
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
+[[package]]
+name = "utf16_iter"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "uuid"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2e054861b4bd027cd373e18e8d8d8e6548085000e41290d95ce0c373a654b4a"
+dependencies = [
+ "getrandom 0.3.2",
+ "js-sys",
+ "serde_core",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version-compare"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "852e951cb7832cb45cb1169900d19760cfa39b82bc0ea9c0e5a14ae88411c98b"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "vswhom"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be979b7f07507105799e854203b470ff7c78a1639e330a58f183b5fea574608b"
+dependencies = [
+ "libc",
+ "vswhom-sys",
+]
+
+[[package]]
+name = "vswhom-sys"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb067e4cbd1ff067d1df46c9194b5de0e98efd2810bbc95c5d5e5f25a3231150"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.9.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "wasi"
+version = "0.14.2+wasi-0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
+dependencies = [
+ "wit-bindgen-rt",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1edc8929d7499fc4e8f0be2262a241556cfc54a0bea223790e71446f2aab1ef5"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f0a0651a5c2bc21487bde11ee802ccaf4c51935d0d3d42a6101f98161700bc6"
+dependencies = [
+ "bumpalo",
+ "log",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.50"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "555d470ec0bc3bb57890405e5d4322cc9ea83cebb085523ced7be4144dac1e61"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "once_cell",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-streams"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.77"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33b6dd2ef9186f1f2072e409e99cd22a975331a6b3591b12c764e0e55c60d5d2"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webkit2gtk"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1027150013530fb2eaf806408df88461ae4815a45c541c8975e61d6f2fc4793"
+dependencies = [
+ "bitflags 1.3.2",
+ "cairo-rs",
+ "gdk",
+ "gdk-sys",
+ "gio",
+ "gio-sys",
+ "glib",
+ "glib-sys",
+ "gobject-sys",
+ "gtk",
+ "gtk-sys",
+ "javascriptcore-rs",
+ "libc",
+ "once_cell",
+ "soup3",
+ "webkit2gtk-sys",
+]
+
+[[package]]
+name = "webkit2gtk-sys"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "916a5f65c2ef0dfe12fff695960a2ec3d4565359fdbb2e9943c974e06c734ea5"
+dependencies = [
+ "bitflags 1.3.2",
+ "cairo-sys-rs",
+ "gdk-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "gtk-sys",
+ "javascriptcore-rs-sys",
+ "libc",
+ "pkg-config",
+ "soup3-sys",
+ "system-deps",
+]
+
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36a29fc0408b113f68cf32637857ab740edfafdf460c326cd2afaa2d84cc05dc"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "webview2-com"
+version = "0.38.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4ba622a989277ef3886dd5afb3e280e3dd6d974b766118950a08f8f678ad6a4"
+dependencies = [
+ "webview2-com-macros",
+ "webview2-com-sys",
+ "windows",
+ "windows-core",
+ "windows-implement",
+ "windows-interface",
+]
+
+[[package]]
+name = "webview2-com-macros"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d228f15bba3b9d56dde8bddbee66fa24545bd17b48d5128ccf4a8742b18e431"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "webview2-com-sys"
+version = "0.38.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36695906a1b53a3bf5c4289621efedac12b73eeb0b89e7e1a89b517302d5d75c"
+dependencies = [
+ "thiserror 2.0.12",
+ "windows",
+ "windows-core",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
+dependencies = [
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "window-vibrancy"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9bec5a31f3f9362f2258fd0e9c9dd61a9ca432e7306cc78c444258f0dce9a9c"
+dependencies = [
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+ "raw-window-handle",
+ "windows-sys 0.59.0",
+ "windows-version",
+]
+
+[[package]]
+name = "windows"
+version = "0.61.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5ee8f3d025738cb02bad7868bbb5f8a6327501e870bf51f1b455b0a2454a419"
+dependencies = [
+ "windows-collections",
+ "windows-core",
+ "windows-future",
+ "windows-link",
+ "windows-numerics",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8"
+dependencies = [
+ "windows-core",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.61.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4763c1de310c86d75a878046489e2e5ba02c649d185f21c67d4cf8a56d098980"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a1d6bbefcb7b60acd19828e1bc965da6fcf18a7e39490c5f8be71e54a19ba32"
+dependencies = [
+ "windows-core",
+ "windows-link",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a47fddd13af08290e67f4acabf4b459f647552718f683a7b415d290ac744a836"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd9211b69f8dcdfa817bfd14bf1c97c9188afa36f4750130fcdf3f400eca9fa8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76840935b766e1b0a05c0066835fb9ec80071d4c09a16f6bd5f7e655e3c14c38"
+
+[[package]]
+name = "windows-numerics"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1"
+dependencies = [
+ "windows-core",
+ "windows-link",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c64fd11a4fd95df68efcfee5f44a294fe71b8bc6a91993e2791938abcc712252"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a2ba9642430ee452d5a7aa78d72907ebe8cfda358e8cb7918a2050581322f97"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets 0.42.2",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.2",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm 0.52.6",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.53.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c66f69fcc9ce11da9966ddb31a40968cad001c5bedeb5c2b82ede4253ab48aef"
+dependencies = [
+ "windows_aarch64_gnullvm 0.53.0",
+ "windows_aarch64_msvc 0.53.0",
+ "windows_i686_gnu 0.53.0",
+ "windows_i686_gnullvm 0.53.0",
+ "windows_i686_msvc 0.53.0",
+ "windows_x86_64_gnu 0.53.0",
+ "windows_x86_64_gnullvm 0.53.0",
+ "windows_x86_64_msvc 0.53.0",
+]
+
+[[package]]
+name = "windows-version"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e04a5c6627e310a23ad2358483286c7df260c964eb2d003d8efd6d0f4e79265c"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86b8d5f90ddd19cb4a147a5fa63ca848db3df085e25fee3cc10b39b6eebae764"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7651a1f62a11b8cbd5e0d42526e55f2c99886c77e007179efff86c2b137e66c"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1dc67659d35f387f5f6c479dc4e28f1d4bb90ddd1a5d3da2e5d97b42d6272c3"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce6ccbdedbf6d6354471319e781c0dfef054c81fbc7cf83f338a4296c0cae11"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "581fee95406bb13382d2f65cd4a908ca7b1e4c2f1917f143ba16efe98a589b5d"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e55b5ac9ea33f2fc1716d1742db15574fd6fc8dadc51caab1c16a3d3b4190ba"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a6e035dd0599267ce1ee132e51c27dd29437f63325753051e71dd9e42406c57"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"
+
+[[package]]
+name = "winnow"
+version = "0.5.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f593a95398737aeed53e489c785df13f3618e41dbcd6718c6addbf1395aa6876"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winnow"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3edebf492c8125044983378ecb5766203ad3b4c2f7a922bd7dd207f6d443e95"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winreg"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a277a57398d4bfa075df44f501a17cfdf8542d224f0d36095a2adc7aee4ef0a5"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "wit-bindgen-rt"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
+dependencies = [
+ "bitflags 2.9.0",
+]
+
+[[package]]
+name = "write16"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936"
+
+[[package]]
+name = "writeable"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e9df38ee2d2c3c5948ea468a8406ff0db0b29ae1ffde1bcf20ef305bcc95c51"
+
+[[package]]
+name = "xattr"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d65cbf2f12c15564212d48f4e3dfb87923d25d611f2aed18f4cb23f0413d89e"
+dependencies = [
+ "libc",
+ "rustix",
+]
+
+[[package]]
+name = "yoke"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "120e6aef9aa629e3d4f52dc8cc43a015c7724194c97dfaf45180d2daf2b77f40"
+dependencies = [
+ "serde",
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2380878cad4ac9aac1e2435f3eb4020e8374b5f13c296cb75b4620ff8e229154"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2586fea28e186957ef732a5f8b3be2da217d65c5969d4b1e17f973ebbe876879"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a996a8f63c5c4448cd959ac1bab0aaa3306ccfd060472f85943ee0750f0169be"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cff3ee08c995dee1859d998dea82f7374f2826091dd9cd47def953cae446cd2e"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
+
+[[package]]
+name = "zerovec"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa2b893d79df23bfb12d5461018d408ea19dfafe76c2c7ef6d4eba614f8ff079"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.100",
+]
+
+[[package]]
+name = "zip"
+version = "4.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "153a6fff49d264c4babdcfa6b4d534747f520e56e8f0f384f3b808c4b64cc1fd"
+dependencies = [
+ "arbitrary",
+ "crc32fast",
+ "indexmap 2.9.0",
+ "memchr",
+]
diff --git a/vendor/tauri-plugin-updater/Cargo.toml b/vendor/tauri-plugin-updater/Cargo.toml
new file mode 100644
index 0000000000..edf4bfc867
--- /dev/null
+++ b/vendor/tauri-plugin-updater/Cargo.toml
@@ -0,0 +1,180 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
+#
+# When uploading crates to the registry Cargo will automatically
+# "normalize" Cargo.toml files for maximal compatibility
+# with all versions of Cargo and also rewrite `path` dependencies
+# to registry (e.g., crates.io) dependencies.
+#
+# If you are reading this file be aware that the original Cargo.toml
+# will likely look very different (and much more reasonable).
+# See Cargo.toml.orig for the original contents.
+
+[package]
+edition = "2021"
+rust-version = "1.77.2"
+name = "tauri-plugin-updater"
+version = "2.10.1"
+authors = ["Tauri Programme within The Commons Conservancy"]
+build = "build.rs"
+links = "tauri-plugin-updater"
+autolib = false
+autobins = false
+autoexamples = false
+autotests = false
+autobenches = false
+description = "In-app updates for Tauri applications."
+readme = "README.md"
+license = "Apache-2.0 OR MIT"
+repository = "https://github.com/tauri-apps/plugins-workspace"
+
+[package.metadata.docs.rs]
+no-default-features = true
+features = ["zip"]
+
+[package.metadata.platforms.support.windows]
+level = "full"
+notes = ""
+
+[package.metadata.platforms.support.linux]
+level = "full"
+notes = ""
+
+[package.metadata.platforms.support.macos]
+level = "full"
+notes = ""
+
+[package.metadata.platforms.support.android]
+level = "none"
+notes = ""
+
+[package.metadata.platforms.support.ios]
+level = "none"
+notes = ""
+
+[features]
+default = [
+    "rustls-tls",
+    "zip",
+]
+native-tls = ["reqwest/native-tls"]
+native-tls-vendored = ["reqwest/native-tls-vendored"]
+rustls-tls = [
+    "reqwest/rustls-no-provider",
+    "dep:rustls",
+]
+zip = [
+    "dep:zip",
+    "dep:tar",
+    "dep:flate2",
+]
+
+[lib]
+name = "tauri_plugin_updater"
+path = "src/lib.rs"
+
+[dependencies.base64]
+version = "0.22"
+
+[dependencies.futures-util]
+version = "0.3"
+
+[dependencies.http]
+version = "1"
+
+[dependencies.infer]
+version = "0.19"
+
+[dependencies.log]
+version = "0.4"
+
+[dependencies.minisign-verify]
+version = "0.2"
+
+[dependencies.percent-encoding]
+version = "2.3"
+
+[dependencies.reqwest]
+version = "0.13"
+features = [
+    "json",
+    "stream",
+]
+default-features = false
+
+[dependencies.rustls]
+version = "0.23"
+features = ["ring"]
+optional = true
+default-features = false
+
+[dependencies.semver]
+version = "1"
+features = ["serde"]
+
+[dependencies.serde]
+version = "1"
+features = ["derive"]
+
+[dependencies.serde_json]
+version = "1"
+
+[dependencies.tauri]
+version = "2.10"
+default-features = false
+
+[dependencies.tempfile]
+version = "3.20"
+
+[dependencies.thiserror]
+version = "2"
+
+[dependencies.time]
+version = "0.3"
+features = [
+    "parsing",
+    "formatting",
+]
+
+[dependencies.tokio]
+version = "1"
+
+[dependencies.url]
+version = "2"
+
+[build-dependencies.tauri-plugin]
+version = "2.5"
+features = ["build"]
+
+[target.'cfg(target_os = "linux")'.dependencies.dirs]
+version = "6"
+
+[target.'cfg(target_os = "linux")'.dependencies.flate2]
+version = "1"
+optional = true
+
+[target.'cfg(target_os = "linux")'.dependencies.tar]
+version = "0.4"
+optional = true
+
+[target.'cfg(target_os = "macos")'.dependencies.flate2]
+version = "1"
+
+[target.'cfg(target_os = "macos")'.dependencies.osakit]
+version = "0.3"
+features = ["full"]
+
+[target.'cfg(target_os = "macos")'.dependencies.tar]
+version = "0.4"
+
+[target.'cfg(target_os = "windows")'.dependencies.windows-sys]
+version = "0.60.0"
+features = [
+    "Win32_Foundation",
+    "Win32_UI_WindowsAndMessaging",
+    "Win32_UI_Shell",
+]
+
+[target.'cfg(target_os = "windows")'.dependencies.zip]
+version = "4"
+optional = true
+default-features = false
diff --git a/vendor/tauri-plugin-updater/Cargo.toml.orig b/vendor/tauri-plugin-updater/Cargo.toml.orig
new file mode 100644
index 0000000000..3324825082
--- /dev/null
+++ b/vendor/tauri-plugin-updater/Cargo.toml.orig
@@ -0,0 +1,74 @@
+[package]
+name = "tauri-plugin-updater"
+version = "2.10.1"
+description = "In-app updates for Tauri applications."
+edition = { workspace = true }
+authors = { workspace = true }
+license = { workspace = true }
+rust-version = { workspace = true }
+repository = { workspace = true }
+links = "tauri-plugin-updater"
+
+[package.metadata.docs.rs]
+no-default-features = true
+features = ["zip"]
+
+[package.metadata.platforms.support]
+windows = { level = "full", notes = "" }
+linux = { level = "full", notes = "" }
+macos = { level = "full", notes = "" }
+android = { level = "none", notes = "" }
+ios = { level = "none", notes = "" }
+
+[build-dependencies]
+tauri-plugin = { workspace = true, features = ["build"] }
+
+[dependencies]
+tauri = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+thiserror = { workspace = true }
+log = { workspace = true }
+tokio = "1"
+reqwest = { version = "0.13", default-features = false, features = [
+  "json",
+  "stream",
+] }
+rustls = { version = "0.23", default-features = false, features = [
+  "ring",
+], optional = true }
+url = { workspace = true }
+http = "1"
+minisign-verify = "0.2"
+time = { version = "0.3", features = ["parsing", "formatting"] }
+base64 = "0.22"
+semver = { version = "1", features = ["serde"] }
+futures-util = "0.3"
+tempfile = "3.20"
+infer = "0.19"
+percent-encoding = "2.3"
+
+[target."cfg(target_os = \"windows\")".dependencies]
+zip = { version = "4", default-features = false, optional = true }
+windows-sys = { version = "0.60.0", features = [
+  "Win32_Foundation",
+  "Win32_UI_WindowsAndMessaging",
+  "Win32_UI_Shell",
+] }
+
+[target."cfg(target_os = \"linux\")".dependencies]
+dirs = "6"
+tar = { version = "0.4", optional = true }
+flate2 = { version = "1", optional = true }
+
+[target."cfg(target_os = \"macos\")".dependencies]
+tar = "0.4"
+flate2 = "1"
+osakit = { version = "0.3", features = ["full"] }
+
+[features]
+default = ["rustls-tls", "zip"]
+zip = ["dep:zip", "dep:tar", "dep:flate2"]
+native-tls = ["reqwest/native-tls"]
+native-tls-vendored = ["reqwest/native-tls-vendored"]
+rustls-tls = ["reqwest/rustls-no-provider", "dep:rustls"]
diff --git a/vendor/tauri-plugin-updater/DBX-PATCH.md b/vendor/tauri-plugin-updater/DBX-PATCH.md
new file mode 100644
index 0000000000..e5cebd2331
--- /dev/null
+++ b/vendor/tauri-plugin-updater/DBX-PATCH.md
@@ -0,0 +1 @@
+Based on tauri-plugin-updater 2.10.1. Keeps upstream licenses. Adds offline restore_update using the same construction as network check, verify using the configured signing key, and checks ShellExecuteW before Windows process exit. Cached metadata never supplies executable paths or runtime configuration.
diff --git a/vendor/tauri-plugin-updater/LICENSE.spdx b/vendor/tauri-plugin-updater/LICENSE.spdx
new file mode 100644
index 0000000000..cdd0df5ad7
--- /dev/null
+++ b/vendor/tauri-plugin-updater/LICENSE.spdx
@@ -0,0 +1,20 @@
+SPDXVersion: SPDX-2.1
+DataLicense: CC0-1.0
+PackageName: tauri
+DataFormat: SPDXRef-1
+PackageSupplier: Organization: The Tauri Programme in the Commons Conservancy
+PackageHomePage: https://tauri.app
+PackageLicenseDeclared: Apache-2.0
+PackageLicenseDeclared: MIT
+PackageCopyrightText: 2019-2022, The Tauri Programme in the Commons Conservancy
+PackageSummary: <text>Tauri is a rust project that enables developers to make secure
+and small desktop applications using a web frontend.
+                </text>
+PackageComment: <text>The package includes the following libraries; see
+Relationship information.
+                </text>
+Created: 2019-05-20T09:00:00Z
+PackageDownloadLocation: git://github.com/tauri-apps/tauri
+PackageDownloadLocation: git+https://github.com/tauri-apps/tauri.git
+PackageDownloadLocation: git+ssh://github.com/tauri-apps/tauri.git
+Creator: Person: Daniel Thompson-Yvetot
\ No newline at end of file
diff --git a/vendor/tauri-plugin-updater/LICENSE_APACHE-2.0 b/vendor/tauri-plugin-updater/LICENSE_APACHE-2.0
new file mode 100644
index 0000000000..4947287f7b
--- /dev/null
+++ b/vendor/tauri-plugin-updater/LICENSE_APACHE-2.0
@@ -0,0 +1,177 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
\ No newline at end of file
diff --git a/vendor/tauri-plugin-updater/LICENSE_MIT b/vendor/tauri-plugin-updater/LICENSE_MIT
new file mode 100644
index 0000000000..4d75472566
--- /dev/null
+++ b/vendor/tauri-plugin-updater/LICENSE_MIT
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017 - Present Tauri Apps Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
\ No newline at end of file
diff --git a/vendor/tauri-plugin-updater/README.md b/vendor/tauri-plugin-updater/README.md
new file mode 100644
index 0000000000..b3afb818a9
--- /dev/null
+++ b/vendor/tauri-plugin-updater/README.md
@@ -0,0 +1,102 @@
+![plugin-updater](https://github.com/tauri-apps/plugins-workspace/raw/v2/plugins/updater/banner.png)
+
+In-app updates for Tauri applications.
+
+| Platform | Supported |
+| -------- | --------- |
+| Linux    | ✓         |
+| Windows  | ✓         |
+| macOS    | ✓         |
+| Android  | x         |
+| iOS      | x         |
+
+## Install
+
+_This plugin requires a Rust version of at least **1.77.2**_
+
+There are three general methods of installation that we can recommend.
+
+1. Use crates.io and npm (easiest, and requires you to trust that our publishing pipeline worked)
+2. Pull sources directly from Github using git tags / revision hashes (most secure)
+3. Git submodule install this repo in your tauri project and then use file protocol to ingest the source (most secure, but inconvenient to use)
+
+Install the Core plugin by adding the following to your `Cargo.toml` file:
+
+`src-tauri/Cargo.toml`
+
+```toml
+# you can add the dependencies on the `[dependencies]` section if you do not target mobile
+[target."cfg(not(any(target_os = \"android\", target_os = \"ios\")))".dependencies]
+tauri-plugin-updater = "2.0.0"
+# alternatively with Git:
+tauri-plugin-updater = { git = "https://github.com/tauri-apps/plugins-workspace", branch = "v2" }
+```
+
+You can install the JavaScript Guest bindings using your preferred JavaScript package manager:
+
+```sh
+pnpm add @tauri-apps/plugin-updater
+# or
+npm add @tauri-apps/plugin-updater
+# or
+yarn add @tauri-apps/plugin-updater
+```
+
+## Usage
+
+First you need to register the core plugin with Tauri:
+
+`src-tauri/src/lib.rs`
+
+```rust
+fn main() {
+    tauri::Builder::default()
+        .setup(|app| {
+            #[cfg(desktop)]
+            app.handle().plugin(tauri_plugin_updater::Builder::new().build())?;
+            Ok(())
+        })
+        .run(tauri::generate_context!())
+        .expect("error while running tauri application");
+}
+```
+
+Afterwards all the plugin's APIs are available through the JavaScript guest bindings:
+
+```javascript
+import { check } from '@tauri-apps/plugin-updater'
+import { relaunch } from '@tauri-apps/plugin-process'
+const update = await check()
+if (update) {
+  await update.downloadAndInstall()
+  await relaunch()
+}
+```
+
+Note that for these APIs to work you have to properly configure the updater first and generate updater artifacts. Please refer to the [guide on our website](https://v2.tauri.app/plugin/updater/) for this.
+
+## Contributing
+
+PRs accepted. Please make sure to read the Contributing Guide before making a pull request.
+
+## Partners
+
+<table>
+  <tbody>
+    <tr>
+      <td align="center" valign="middle">
+        <a href="https://crabnebula.dev" target="_blank">
+          <img src="https://github.com/tauri-apps/plugins-workspace/raw/v2/.github/sponsors/crabnebula.svg" alt="CrabNebula" width="283">
+        </a>
+      </td>
+    </tr>
+  </tbody>
+</table>
+
+For the complete list of sponsors please visit our [website](https://tauri.app#sponsors) and [Open Collective](https://opencollective.com/tauri).
+
+## License
+
+Code: (c) 2015 - Present - The Tauri Programme within The Commons Conservancy.
+
+MIT or MIT/Apache 2.0 where applicable.
diff --git a/vendor/tauri-plugin-updater/SECURITY.md b/vendor/tauri-plugin-updater/SECURITY.md
new file mode 100644
index 0000000000..4f09bbacd4
--- /dev/null
+++ b/vendor/tauri-plugin-updater/SECURITY.md
@@ -0,0 +1,23 @@
+# Security Policy
+
+**Do not report security vulnerabilities through public GitHub issues.**
+
+**Please use the [Private Vulnerability Disclosure](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability) feature of GitHub.**
+
+Include as much of the following information:
+
+- Type of issue (e.g. improper input parsing, privilege escalation, etc.)
+- The location of the affected source code (tag/branch/commit or direct URL)
+- Any special configuration required to reproduce the issue
+- The distribution affected or used to help us with reproduction of the issue
+- Step-by-step instructions to reproduce the issue
+- Ideally a reproduction repository
+- Impact of the issue, including how an attacker might exploit the issue
+
+We prefer to receive reports in English.
+
+## Contact
+
+Please disclose a vulnerability or security relevant issue here: [https://github.com/tauri-apps/plugins-workspace/security/advisories/new](https://github.com/tauri-apps/plugins-workspace/security/advisories/new).
+
+Alternatively, you can also contact us by email via [security@tauri.app](mailto:security@tauri.app).
diff --git a/vendor/tauri-plugin-updater/api-iife.js b/vendor/tauri-plugin-updater/api-iife.js
new file mode 100644
index 0000000000..e13f5191a2
--- /dev/null
+++ b/vendor/tauri-plugin-updater/api-iife.js
@@ -0,0 +1 @@
+if("__TAURI__"in window){var __TAURI_PLUGIN_UPDATER__=function(t){"use strict";function e(t,e,s,n){if("function"==typeof e?t!==e||!n:!e.has(t))throw new TypeError("Cannot read private member from an object whose class did not declare it");return"m"===s?n:"a"===s?n.call(t):n?n.value:e.get(t)}function s(t,e,s,n,i){if("function"==typeof e||!e.has(t))throw new TypeError("Cannot write private member to an object whose class did not declare it");return e.set(t,s),s}var n,i,a,r,o;"function"==typeof SuppressedError&&SuppressedError;const d="__TAURI_TO_IPC_KEY__";class c{constructor(t){n.set(this,void 0),i.set(this,0),a.set(this,[]),r.set(this,void 0),s(this,n,t||(()=>{})),this.id=function(t,e=!1){return window.__TAURI_INTERNALS__.transformCallback(t,e)}(t=>{const o=t.index;if("end"in t)return void(o==e(this,i,"f")?this.cleanupCallback():s(this,r,o));const d=t.message;if(o==e(this,i,"f")){for(e(this,n,"f").call(this,d),s(this,i,e(this,i,"f")+1);e(this,i,"f")in e(this,a,"f");){const t=e(this,a,"f")[e(this,i,"f")];e(this,n,"f").call(this,t),delete e(this,a,"f")[e(this,i,"f")],s(this,i,e(this,i,"f")+1)}e(this,i,"f")===e(this,r,"f")&&this.cleanupCallback()}else e(this,a,"f")[o]=d})}cleanupCallback(){window.__TAURI_INTERNALS__.unregisterCallback(this.id)}set onmessage(t){s(this,n,t)}get onmessage(){return e(this,n,"f")}[(n=new WeakMap,i=new WeakMap,a=new WeakMap,r=new WeakMap,d)](){return`__CHANNEL__:${this.id}`}toJSON(){return this[d]()}}async function l(t,e={},s){return window.__TAURI_INTERNALS__.invoke(t,e,s)}class h{get rid(){return e(this,o,"f")}constructor(t){o.set(this,void 0),s(this,o,t)}async close(){return l("plugin:resources|close",{rid:this.rid})}}o=new WeakMap;class u extends h{constructor(t){super(t.rid),this.available=!0,this.currentVersion=t.currentVersion,this.version=t.version,this.date=t.date,this.body=t.body,this.rawJson=t.rawJson}async download(t,e){_(e);const s=new c;t&&(s.onmessage=t);const n=await l("plugin:updater|download",{onEvent:s,rid:this.rid,...e});this.downloadedBytes=new h(n)}async install(){if(!this.downloadedBytes)throw new Error("Update.install called before Update.download");await l("plugin:updater|install",{updateRid:this.rid,bytesRid:this.downloadedBytes.rid}),this.downloadedBytes=void 0}async downloadAndInstall(t,e){_(e);const s=new c;t&&(s.onmessage=t),await l("plugin:updater|download_and_install",{onEvent:s,rid:this.rid,...e})}async close(){await(this.downloadedBytes?.close()),await super.close()}}function _(t){t?.headers&&(t.headers=Array.from(new Headers(t.headers).entries()))}return t.Update=u,t.check=async function(t){_(t);const e=await l("plugin:updater|check",{...t});return e?new u(e):null},t}({});Object.defineProperty(window.__TAURI__,"updater",{value:__TAURI_PLUGIN_UPDATER__})}
diff --git a/vendor/tauri-plugin-updater/banner.png b/vendor/tauri-plugin-updater/banner.png
new file mode 100644
index 0000000000..439110d842
Binary files /dev/null and b/vendor/tauri-plugin-updater/banner.png differ
diff --git a/vendor/tauri-plugin-updater/build.rs b/vendor/tauri-plugin-updater/build.rs
new file mode 100644
index 0000000000..db3efac713
--- /dev/null
+++ b/vendor/tauri-plugin-updater/build.rs
@@ -0,0 +1,23 @@
+// Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT
+
+const COMMANDS: &[&str] = &["check", "download", "install", "download_and_install"];
+
+fn main() {
+    tauri_plugin::Builder::new(COMMANDS).global_api_script_path("./api-iife.js").build();
+
+    let target_os = std::env::var("CARGO_CFG_TARGET_OS").unwrap();
+    let mobile = target_os == "ios" || target_os == "android";
+    alias("desktop", !mobile);
+    alias("mobile", mobile);
+}
+
+// creates a cfg alias if `has_feature` is true.
+// `alias` must be a snake case string.
+fn alias(alias: &str, has_feature: bool) {
+    println!("cargo:rustc-check-cfg=cfg({alias})");
+    if has_feature {
+        println!("cargo:rustc-cfg={alias}");
+    }
+}
diff --git a/vendor/tauri-plugin-updater/guest-js/index.ts b/vendor/tauri-plugin-updater/guest-js/index.ts
new file mode 100644
index 0000000000..b651843671
--- /dev/null
+++ b/vendor/tauri-plugin-updater/guest-js/index.ts
@@ -0,0 +1,155 @@
+// Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT
+
+import { invoke, Channel, Resource } from '@tauri-apps/api/core'
+
+/** Options used when checking for updates */
+interface CheckOptions {
+  /**
+   * Request headers
+   */
+  headers?: HeadersInit
+  /**
+   * Timeout in milliseconds
+   */
+  timeout?: number
+  /**
+   * A proxy url to be used when checking and downloading updates.
+   */
+  proxy?: string
+  /**
+   * Target identifier for the running application. This is sent to the backend.
+   */
+  target?: string
+  /**
+   * Allow downgrades to previous versions by not checking if the current version is greater than the available version.
+   */
+  allowDowngrades?: boolean
+}
+
+/** Options used when downloading an update */
+interface DownloadOptions {
+  /**
+   * Request headers
+   */
+  headers?: HeadersInit
+  /**
+   * Timeout in milliseconds
+   */
+  timeout?: number
+}
+
+interface UpdateMetadata {
+  rid: number
+  currentVersion: string
+  version: string
+  date?: string
+  body?: string
+  rawJson: Record<string, unknown>
+}
+
+/** Updater download event */
+type DownloadEvent =
+  | { event: 'Started'; data: { contentLength?: number } }
+  | { event: 'Progress'; data: { chunkLength: number } }
+  | { event: 'Finished' }
+
+class Update extends Resource {
+  // TODO: remove this field in v3
+  /** @deprecated This is always true, check if the return value is `null` instead when using {@linkcode check} */
+  available: boolean
+  currentVersion: string
+  version: string
+  date?: string
+  body?: string
+  rawJson: Record<string, unknown>
+  private downloadedBytes?: Resource
+
+  constructor(metadata: UpdateMetadata) {
+    super(metadata.rid)
+    this.available = true
+    this.currentVersion = metadata.currentVersion
+    this.version = metadata.version
+    this.date = metadata.date
+    this.body = metadata.body
+    this.rawJson = metadata.rawJson
+  }
+
+  /** Download the updater package */
+  async download(
+    onEvent?: (progress: DownloadEvent) => void,
+    options?: DownloadOptions
+  ): Promise<void> {
+    convertToRustHeaders(options)
+    const channel = new Channel<DownloadEvent>()
+    if (onEvent) {
+      channel.onmessage = onEvent
+    }
+    const downloadedBytesRid = await invoke<number>('plugin:updater|download', {
+      onEvent: channel,
+      rid: this.rid,
+      ...options
+    })
+    this.downloadedBytes = new Resource(downloadedBytesRid)
+  }
+
+  /** Install downloaded updater package */
+  async install(): Promise<void> {
+    if (!this.downloadedBytes) {
+      throw new Error('Update.install called before Update.download')
+    }
+
+    await invoke('plugin:updater|install', {
+      updateRid: this.rid,
+      bytesRid: this.downloadedBytes.rid
+    })
+
+    // Don't need to call close, we did it in rust side already
+    this.downloadedBytes = undefined
+  }
+
+  /** Downloads the updater package and installs it */
+  async downloadAndInstall(
+    onEvent?: (progress: DownloadEvent) => void,
+    options?: DownloadOptions
+  ): Promise<void> {
+    convertToRustHeaders(options)
+    const channel = new Channel<DownloadEvent>()
+    if (onEvent) {
+      channel.onmessage = onEvent
+    }
+    await invoke('plugin:updater|download_and_install', {
+      onEvent: channel,
+      rid: this.rid,
+      ...options
+    })
+  }
+
+  async close(): Promise<void> {
+    await this.downloadedBytes?.close()
+    await super.close()
+  }
+}
+
+/** Check for updates, resolves to `null` if no updates are available */
+async function check(options?: CheckOptions): Promise<Update | null> {
+  convertToRustHeaders(options)
+
+  const metadata = await invoke<UpdateMetadata | null>('plugin:updater|check', {
+    ...options
+  })
+  return metadata ? new Update(metadata) : null
+}
+
+/**
+ * Converts the headers in options to be an {@linkcode Array<[string, string]>} which is what the Rust side expects
+ */
+function convertToRustHeaders(options?: { headers?: HeadersInit }) {
+  if (options?.headers) {
+    options.headers = Array.from(new Headers(options.headers).entries())
+  }
+}
+
+export type { CheckOptions, DownloadOptions, DownloadEvent }
+export { check, Update }
diff --git a/vendor/tauri-plugin-updater/package.json b/vendor/tauri-plugin-updater/package.json
new file mode 100644
index 0000000000..1eceda8ee8
--- /dev/null
+++ b/vendor/tauri-plugin-updater/package.json
@@ -0,0 +1,29 @@
+{
+  "name": "@tauri-apps/plugin-updater",
+  "version": "2.10.1",
+  "license": "MIT OR Apache-2.0",
+  "authors": [
+    "Tauri Programme within The Commons Conservancy"
+  ],
+  "repository": "https://github.com/tauri-apps/plugins-workspace",
+  "type": "module",
+  "types": "./dist-js/index.d.ts",
+  "main": "./dist-js/index.cjs",
+  "module": "./dist-js/index.js",
+  "exports": {
+    "types": "./dist-js/index.d.ts",
+    "import": "./dist-js/index.js",
+    "require": "./dist-js/index.cjs"
+  },
+  "scripts": {
+    "build": "rollup -c"
+  },
+  "files": [
+    "dist-js",
+    "README.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "@tauri-apps/api": "^2.10.1"
+  }
+}
diff --git a/vendor/tauri-plugin-updater/permissions/autogenerated/commands/check.toml b/vendor/tauri-plugin-updater/permissions/autogenerated/commands/check.toml
new file mode 100644
index 0000000000..fca73ce9f6
--- /dev/null
+++ b/vendor/tauri-plugin-updater/permissions/autogenerated/commands/check.toml
@@ -0,0 +1,13 @@
+# Automatically generated - DO NOT EDIT!
+
+"$schema" = "../../schemas/schema.json"
+
+[[permission]]
+identifier = "allow-check"
+description = "Enables the check command without any pre-configured scope."
+commands.allow = ["check"]
+
+[[permission]]
+identifier = "deny-check"
+description = "Denies the check command without any pre-configured scope."
+commands.deny = ["check"]
diff --git a/vendor/tauri-plugin-updater/permissions/autogenerated/commands/download.toml b/vendor/tauri-plugin-updater/permissions/autogenerated/commands/download.toml
new file mode 100644
index 0000000000..896b30ce25
--- /dev/null
+++ b/vendor/tauri-plugin-updater/permissions/autogenerated/commands/download.toml
@@ -0,0 +1,13 @@
+# Automatically generated - DO NOT EDIT!
+
+"$schema" = "../../schemas/schema.json"
+
+[[permission]]
+identifier = "allow-download"
+description = "Enables the download command without any pre-configured scope."
+commands.allow = ["download"]
+
+[[permission]]
+identifier = "deny-download"
+description = "Denies the download command without any pre-configured scope."
+commands.deny = ["download"]
diff --git a/vendor/tauri-plugin-updater/permissions/autogenerated/commands/download_and_install.toml b/vendor/tauri-plugin-updater/permissions/autogenerated/commands/download_and_install.toml
new file mode 100644
index 0000000000..40858d1b37
--- /dev/null
+++ b/vendor/tauri-plugin-updater/permissions/autogenerated/commands/download_and_install.toml
@@ -0,0 +1,13 @@
+# Automatically generated - DO NOT EDIT!
+
+"$schema" = "../../schemas/schema.json"
+
+[[permission]]
+identifier = "allow-download-and-install"
+description = "Enables the download_and_install command without any pre-configured scope."
+commands.allow = ["download_and_install"]
+
+[[permission]]
+identifier = "deny-download-and-install"
+description = "Denies the download_and_install command without any pre-configured scope."
+commands.deny = ["download_and_install"]
diff --git a/vendor/tauri-plugin-updater/permissions/autogenerated/commands/install.toml b/vendor/tauri-plugin-updater/permissions/autogenerated/commands/install.toml
new file mode 100644
index 0000000000..4c6a29d468
--- /dev/null
+++ b/vendor/tauri-plugin-updater/permissions/autogenerated/commands/install.toml
@@ -0,0 +1,13 @@
+# Automatically generated - DO NOT EDIT!
+
+"$schema" = "../../schemas/schema.json"
+
+[[permission]]
+identifier = "allow-install"
+description = "Enables the install command without any pre-configured scope."
+commands.allow = ["install"]
+
+[[permission]]
+identifier = "deny-install"
+description = "Denies the install command without any pre-configured scope."
+commands.deny = ["install"]
diff --git a/vendor/tauri-plugin-updater/permissions/autogenerated/reference.md b/vendor/tauri-plugin-updater/permissions/autogenerated/reference.md
new file mode 100644
index 0000000000..938ca2e3fb
--- /dev/null
+++ b/vendor/tauri-plugin-updater/permissions/autogenerated/reference.md
@@ -0,0 +1,130 @@
+## Default Permission
+
+This permission set configures which kind of
+updater functions are exposed to the frontend.
+
+#### Granted Permissions
+
+The full workflow from checking for updates to installing them
+is enabled.
+
+#### This default permission set includes the following:
+
+- `allow-check`
+- `allow-download`
+- `allow-install`
+- `allow-download-and-install`
+
+## Permission Table
+
+<table>
+<tr>
+<th>Identifier</th>
+<th>Description</th>
+</tr>
+
+
+<tr>
+<td>
+
+`updater:allow-check`
+
+</td>
+<td>
+
+Enables the check command without any pre-configured scope.
+
+</td>
+</tr>
+
+<tr>
+<td>
+
+`updater:deny-check`
+
+</td>
+<td>
+
+Denies the check command without any pre-configured scope.
+
+</td>
+</tr>
+
+<tr>
+<td>
+
+`updater:allow-download`
+
+</td>
+<td>
+
+Enables the download command without any pre-configured scope.
+
+</td>
+</tr>
+
+<tr>
+<td>
+
+`updater:deny-download`
+
+</td>
+<td>
+
+Denies the download command without any pre-configured scope.
+
+</td>
+</tr>
+
+<tr>
+<td>
+
+`updater:allow-download-and-install`
+
+</td>
+<td>
+
+Enables the download_and_install command without any pre-configured scope.
+
+</td>
+</tr>
+
+<tr>
+<td>
+
+`updater:deny-download-and-install`
+
+</td>
+<td>
+
+Denies the download_and_install command without any pre-configured scope.
+
+</td>
+</tr>
+
+<tr>
+<td>
+
+`updater:allow-install`
+
+</td>
+<td>
+
+Enables the install command without any pre-configured scope.
+
+</td>
+</tr>
+
+<tr>
+<td>
+
+`updater:deny-install`
+
+</td>
+<td>
+
+Denies the install command without any pre-configured scope.
+
+</td>
+</tr>
+</table>
diff --git a/vendor/tauri-plugin-updater/permissions/default.toml b/vendor/tauri-plugin-updater/permissions/default.toml
new file mode 100644
index 0000000000..fcf08fa82e
--- /dev/null
+++ b/vendor/tauri-plugin-updater/permissions/default.toml
@@ -0,0 +1,18 @@
+"$schema" = "schemas/schema.json"
+[default]
+description = """
+This permission set configures which kind of
+updater functions are exposed to the frontend.
+
+#### Granted Permissions
+
+The full workflow from checking for updates to installing them
+is enabled.
+
+"""
+permissions = [
+  "allow-check",
+  "allow-download",
+  "allow-install",
+  "allow-download-and-install",
+]
diff --git a/vendor/tauri-plugin-updater/permissions/schemas/schema.json b/vendor/tauri-plugin-updater/permissions/schemas/schema.json
new file mode 100644
index 0000000000..7f29591614
--- /dev/null
+++ b/vendor/tauri-plugin-updater/permissions/schemas/schema.json
@@ -0,0 +1,354 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "PermissionFile",
+  "description": "Permission file that can define a default permission, a set of permissions or a list of inlined permissions.",
+  "type": "object",
+  "properties": {
+    "default": {
+      "description": "The default permission set for the plugin",
+      "anyOf": [
+        {
+          "$ref": "#/definitions/DefaultPermission"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "set": {
+      "description": "A list of permissions sets defined",
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/PermissionSet"
+      }
+    },
+    "permission": {
+      "description": "A list of inlined permissions",
+      "default": [],
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/Permission"
+      }
+    }
+  },
+  "definitions": {
+    "DefaultPermission": {
+      "description": "The default permission set of the plugin.\n\nWorks similarly to a permission with the \"default\" identifier.",
+      "type": "object",
+      "required": [
+        "permissions"
+      ],
+      "properties": {
+        "version": {
+          "description": "The version of the permission.",
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint64",
+          "minimum": 1.0
+        },
+        "description": {
+          "description": "Human-readable description of what the permission does. Tauri convention is to use `<h4>` headings in markdown content for Tauri documentation generation purposes.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "permissions": {
+          "description": "All permissions this set contains.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "PermissionSet": {
+      "description": "A set of direct permissions grouped together under a new name.",
+      "type": "object",
+      "required": [
+        "description",
+        "identifier",
+        "permissions"
+      ],
+      "properties": {
+        "identifier": {
+          "description": "A unique identifier for the permission.",
+          "type": "string"
+        },
+        "description": {
+          "description": "Human-readable description of what the permission does.",
+          "type": "string"
+        },
+        "permissions": {
+          "description": "All permissions this set contains.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/PermissionKind"
+          }
+        }
+      }
+    },
+    "Permission": {
+      "description": "Descriptions of explicit privileges of commands.\n\nIt can enable commands to be accessible in the frontend of the application.\n\nIf the scope is defined it can be used to fine grain control the access of individual or multiple commands.",
+      "type": "object",
+      "required": [
+        "identifier"
+      ],
+      "properties": {
+        "version": {
+          "description": "The version of the permission.",
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint64",
+          "minimum": 1.0
+        },
+        "identifier": {
+          "description": "A unique identifier for the permission.",
+          "type": "string"
+        },
+        "description": {
+          "description": "Human-readable description of what the permission does. Tauri internal convention is to use `<h4>` headings in markdown content for Tauri documentation generation purposes.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "commands": {
+          "description": "Allowed or denied commands when using this permission.",
+          "default": {
+            "allow": [],
+            "deny": []
+          },
+          "allOf": [
+            {
+              "$ref": "#/definitions/Commands"
+            }
+          ]
+        },
+        "scope": {
+          "description": "Allowed or denied scoped when using this permission.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/Scopes"
+            }
+          ]
+        },
+        "platforms": {
+          "description": "Target platforms this permission applies. By default all platforms are affected by this permission.",
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "$ref": "#/definitions/Target"
+          }
+        }
+      }
+    },
+    "Commands": {
+      "description": "Allowed and denied commands inside a permission.\n\nIf two commands clash inside of `allow` and `deny`, it should be denied by default.",
+      "type": "object",
+      "properties": {
+        "allow": {
+          "description": "Allowed command.",
+          "default": [],
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "deny": {
+          "description": "Denied command, which takes priority.",
+          "default": [],
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "Scopes": {
+      "description": "An argument for fine grained behavior control of Tauri commands.\n\nIt can be of any serde serializable type and is used to allow or prevent certain actions inside a Tauri command. The configured scope is passed to the command and will be enforced by the command implementation.\n\n## Example\n\n```json { \"allow\": [{ \"path\": \"$HOME/**\" }], \"deny\": [{ \"path\": \"$HOME/secret.txt\" }] } ```",
+      "type": "object",
+      "properties": {
+        "allow": {
+          "description": "Data that defines what is allowed by the scope.",
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "$ref": "#/definitions/Value"
+          }
+        },
+        "deny": {
+          "description": "Data that defines what is denied by the scope. This should be prioritized by validation logic.",
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "$ref": "#/definitions/Value"
+          }
+        }
+      }
+    },
+    "Value": {
+      "description": "All supported ACL values.",
+      "anyOf": [
+        {
+          "description": "Represents a null JSON value.",
+          "type": "null"
+        },
+        {
+          "description": "Represents a [`bool`].",
+          "type": "boolean"
+        },
+        {
+          "description": "Represents a valid ACL [`Number`].",
+          "allOf": [
+            {
+              "$ref": "#/definitions/Number"
+            }
+          ]
+        },
+        {
+          "description": "Represents a [`String`].",
+          "type": "string"
+        },
+        {
+          "description": "Represents a list of other [`Value`]s.",
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/Value"
+          }
+        },
+        {
+          "description": "Represents a map of [`String`] keys to [`Value`]s.",
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/Value"
+          }
+        }
+      ]
+    },
+    "Number": {
+      "description": "A valid ACL number.",
+      "anyOf": [
+        {
+          "description": "Represents an [`i64`].",
+          "type": "integer",
+          "format": "int64"
+        },
+        {
+          "description": "Represents a [`f64`].",
+          "type": "number",
+          "format": "double"
+        }
+      ]
+    },
+    "Target": {
+      "description": "Platform target.",
+      "oneOf": [
+        {
+          "description": "MacOS.",
+          "type": "string",
+          "enum": [
+            "macOS"
+          ]
+        },
+        {
+          "description": "Windows.",
+          "type": "string",
+          "enum": [
+            "windows"
+          ]
+        },
+        {
+          "description": "Linux.",
+          "type": "string",
+          "enum": [
+            "linux"
+          ]
+        },
+        {
+          "description": "Android.",
+          "type": "string",
+          "enum": [
+            "android"
+          ]
+        },
+        {
+          "description": "iOS.",
+          "type": "string",
+          "enum": [
+            "iOS"
+          ]
+        }
+      ]
+    },
+    "PermissionKind": {
+      "type": "string",
+      "oneOf": [
+        {
+          "description": "Enables the check command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-check",
+          "markdownDescription": "Enables the check command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the check command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-check",
+          "markdownDescription": "Denies the check command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the download command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-download",
+          "markdownDescription": "Enables the download command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the download command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-download",
+          "markdownDescription": "Denies the download command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the download_and_install command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-download-and-install",
+          "markdownDescription": "Enables the download_and_install command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the download_and_install command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-download-and-install",
+          "markdownDescription": "Denies the download_and_install command without any pre-configured scope."
+        },
+        {
+          "description": "Enables the install command without any pre-configured scope.",
+          "type": "string",
+          "const": "allow-install",
+          "markdownDescription": "Enables the install command without any pre-configured scope."
+        },
+        {
+          "description": "Denies the install command without any pre-configured scope.",
+          "type": "string",
+          "const": "deny-install",
+          "markdownDescription": "Denies the install command without any pre-configured scope."
+        },
+        {
+          "description": "This permission set configures which kind of\nupdater functions are exposed to the frontend.\n\n#### Granted Permissions\n\nThe full workflow from checking for updates to installing them\nis enabled.\n\n\n#### This default permission set includes:\n\n- `allow-check`\n- `allow-download`\n- `allow-install`\n- `allow-download-and-install`",
+          "type": "string",
+          "const": "default",
+          "markdownDescription": "This permission set configures which kind of\nupdater functions are exposed to the frontend.\n\n#### Granted Permissions\n\nThe full workflow from checking for updates to installing them\nis enabled.\n\n\n#### This default permission set includes:\n\n- `allow-check`\n- `allow-download`\n- `allow-install`\n- `allow-download-and-install`"
+        }
+      ]
+    }
+  }
+}
\ No newline at end of file
diff --git a/vendor/tauri-plugin-updater/rollup.config.js b/vendor/tauri-plugin-updater/rollup.config.js
new file mode 100644
index 0000000000..1f349ec8a2
--- /dev/null
+++ b/vendor/tauri-plugin-updater/rollup.config.js
@@ -0,0 +1,7 @@
+// Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT
+
+import { createConfig } from '../../shared/rollup.config.js'
+
+export default createConfig()
diff --git a/vendor/tauri-plugin-updater/src/commands.rs b/vendor/tauri-plugin-updater/src/commands.rs
new file mode 100644
index 0000000000..446997009c
--- /dev/null
+++ b/vendor/tauri-plugin-updater/src/commands.rs
@@ -0,0 +1,194 @@
+// Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT
+
+use crate::{Result, Update, UpdaterExt};
+
+use http::{HeaderMap, HeaderName, HeaderValue};
+use serde::Serialize;
+use tauri::{ipc::Channel, Manager, Resource, ResourceId, Runtime, Webview};
+
+use std::{str::FromStr, time::Duration};
+use url::Url;
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(tag = "event", content = "data")]
+pub enum DownloadEvent {
+    #[serde(rename_all = "camelCase")]
+    Started {
+        content_length: Option<u64>,
+    },
+    #[serde(rename_all = "camelCase")]
+    Progress {
+        chunk_length: usize,
+    },
+    Finished,
+}
+
+#[derive(Serialize, Default)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct Metadata {
+    rid: ResourceId,
+    current_version: String,
+    version: String,
+    date: Option<String>,
+    body: Option<String>,
+    raw_json: serde_json::Value,
+}
+
+struct DownloadedBytes(pub Vec<u8>);
+impl Resource for DownloadedBytes {}
+
+#[tauri::command]
+pub(crate) async fn check<R: Runtime>(
+    webview: Webview<R>,
+    headers: Option<Vec<(String, String)>>,
+    timeout: Option<u64>,
+    proxy: Option<String>,
+    target: Option<String>,
+    allow_downgrades: Option<bool>,
+) -> Result<Option<Metadata>> {
+    let mut builder = webview.updater_builder();
+    if let Some(headers) = headers {
+        for (k, v) in headers {
+            builder = builder.header(k, v)?;
+        }
+    }
+    if let Some(timeout) = timeout {
+        builder = builder.timeout(Duration::from_millis(timeout));
+    }
+    if let Some(ref proxy) = proxy {
+        let url = Url::parse(proxy.as_str())?;
+        builder = builder.proxy(url);
+    }
+    if let Some(target) = target {
+        builder = builder.target(target);
+    }
+    if allow_downgrades.unwrap_or(false) {
+        builder = builder.version_comparator(|current, update| update.version != current);
+    }
+
+    let updater = builder.build()?;
+    let update = updater.check().await?;
+
+    if let Some(update) = update {
+        let formatted_date = if let Some(date) = update.date {
+            let formatted_date =
+                date.format(&time::format_description::well_known::Rfc3339).map_err(|_| crate::Error::FormatDate)?;
+            Some(formatted_date)
+        } else {
+            None
+        };
+        let metadata = Metadata {
+            current_version: update.current_version.clone(),
+            version: update.version.clone(),
+            date: formatted_date,
+            body: update.body.clone(),
+            raw_json: update.raw_json.clone(),
+            rid: webview.resources_table().add(update),
+        };
+        Ok(Some(metadata))
+    } else {
+        Ok(None)
+    }
+}
+
+#[tauri::command]
+pub(crate) async fn download<R: Runtime>(
+    webview: Webview<R>,
+    rid: ResourceId,
+    on_event: Channel<DownloadEvent>,
+    headers: Option<Vec<(String, String)>>,
+    timeout: Option<u64>,
+) -> Result<ResourceId> {
+    let update = webview.resources_table().get::<Update>(rid)?;
+
+    let mut update = (*update).clone();
+
+    if let Some(headers) = headers {
+        let mut map = HeaderMap::new();
+        for (k, v) in headers {
+            map.append(HeaderName::from_str(&k)?, HeaderValue::from_str(&v)?);
+        }
+        update.headers = map;
+    }
+
+    if let Some(timeout) = timeout {
+        update.timeout = Some(Duration::from_millis(timeout));
+    }
+
+    let mut first_chunk = true;
+    let bytes = update
+        .download(
+            |chunk_length, content_length| {
+                if first_chunk {
+                    first_chunk = !first_chunk;
+                    let _ = on_event.send(DownloadEvent::Started { content_length });
+                }
+                let _ = on_event.send(DownloadEvent::Progress { chunk_length });
+            },
+            || {
+                let _ = on_event.send(DownloadEvent::Finished);
+            },
+        )
+        .await?;
+
+    Ok(webview.resources_table().add(DownloadedBytes(bytes)))
+}
+
+#[tauri::command]
+pub(crate) async fn install<R: Runtime>(
+    webview: Webview<R>,
+    update_rid: ResourceId,
+    bytes_rid: ResourceId,
+) -> Result<()> {
+    let update = webview.resources_table().get::<Update>(update_rid)?;
+    let bytes = webview.resources_table().get::<DownloadedBytes>(bytes_rid)?;
+    update.install(&bytes.0)?;
+    let _ = webview.resources_table().close(bytes_rid);
+    Ok(())
+}
+
+#[tauri::command]
+pub(crate) async fn download_and_install<R: Runtime>(
+    webview: Webview<R>,
+    rid: ResourceId,
+    on_event: Channel<DownloadEvent>,
+    headers: Option<Vec<(String, String)>>,
+    timeout: Option<u64>,
+) -> Result<()> {
+    let update = webview.resources_table().get::<Update>(rid)?;
+
+    let mut update = (*update).clone();
+
+    if let Some(headers) = headers {
+        let mut map = HeaderMap::new();
+        for (k, v) in headers {
+            map.append(HeaderName::from_str(&k)?, HeaderValue::from_str(&v)?);
+        }
+        update.headers = map;
+    }
+
+    if let Some(timeout) = timeout {
+        update.timeout = Some(Duration::from_millis(timeout));
+    }
+
+    let mut first_chunk = true;
+
+    update
+        .download_and_install(
+            |chunk_length, content_length| {
+                if first_chunk {
+                    first_chunk = !first_chunk;
+                    let _ = on_event.send(DownloadEvent::Started { content_length });
+                }
+                let _ = on_event.send(DownloadEvent::Progress { chunk_length });
+            },
+            || {
+                let _ = on_event.send(DownloadEvent::Finished);
+            },
+        )
+        .await?;
+
+    Ok(())
+}
diff --git a/vendor/tauri-plugin-updater/src/config.rs b/vendor/tauri-plugin-updater/src/config.rs
new file mode 100644
index 0000000000..540090a71e
--- /dev/null
+++ b/vendor/tauri-plugin-updater/src/config.rs
@@ -0,0 +1,151 @@
+// Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT
+
+use std::{ffi::OsString, fmt::Display};
+
+use serde::{Deserialize, Deserializer};
+use url::Url;
+
+/// Install modes for the Windows update.
+#[derive(Debug, PartialEq, Eq, Clone, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[derive(Default)]
+pub enum WindowsUpdateInstallMode {
+    /// Specifies there's a basic UI during the installation process, including a final dialog box at the end.
+    BasicUi,
+    /// The quiet mode means there's no user interaction required.
+    /// Requires admin privileges if the installer does.
+    Quiet,
+    /// Specifies unattended mode, which means the installation only shows a progress bar.
+    #[default]
+    Passive,
+}
+
+impl WindowsUpdateInstallMode {
+    /// Returns the associated `msiexec.exe` arguments.
+    pub fn msiexec_args(&self) -> &'static [&'static str] {
+        match self {
+            Self::BasicUi => &["/qb+"],
+            Self::Quiet => &["/quiet"],
+            Self::Passive => &["/passive"],
+        }
+    }
+
+    /// Returns the associated nsis arguments.
+    pub fn nsis_args(&self) -> &'static [&'static str] {
+        // `/P`: Passive
+        // `/S`: Silent
+        // `/R`: Restart
+        match self {
+            Self::Passive => &["/P", "/R"],
+            Self::Quiet => &["/S", "/R"],
+            _ => &[],
+        }
+    }
+}
+
+impl Display for WindowsUpdateInstallMode {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "{}",
+            match self {
+                Self::BasicUi => "basicUi",
+                Self::Quiet => "quiet",
+                Self::Passive => "passive",
+            }
+        )
+    }
+}
+
+#[derive(Debug, Clone, Deserialize, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct WindowsConfig {
+    /// Additional arguments given to the NSIS or WiX installer.
+    #[serde(default, alias = "installer-args", deserialize_with = "deserialize_os_string")]
+    pub installer_args: Vec<OsString>,
+    /// Updating mode, defaults to `passive` mode.
+    ///
+    /// See [`WindowsUpdateInstallMode`] for more info.
+    #[serde(default, alias = "install-mode")]
+    pub install_mode: WindowsUpdateInstallMode,
+}
+
+fn deserialize_os_string<'de, D>(deserializer: D) -> Result<Vec<OsString>, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    Ok(Vec::<String>::deserialize(deserializer)?.into_iter().map(OsString::from).collect::<Vec<_>>())
+}
+
+/// Updater configuration.
+#[derive(Debug, Clone, Default)]
+pub struct Config {
+    /// Dangerously allow using insecure transport protocols for update endpoints.
+    pub dangerous_insecure_transport_protocol: bool,
+    /// Dangerously accept invalid TLS certificates for update requests.
+    pub dangerous_accept_invalid_certs: bool,
+    /// Dangerously accept invalid hostnames for TLS certificates for update requests.
+    pub dangerous_accept_invalid_hostnames: bool,
+    /// Updater endpoints.
+    pub endpoints: Vec<Url>,
+    /// Signature public key.
+    pub pubkey: String,
+    /// The Windows configuration for the updater.
+    pub windows: Option<WindowsConfig>,
+}
+
+impl<'de> Deserialize<'de> for Config {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        #[serde(rename_all = "camelCase")]
+        pub struct Config {
+            #[serde(default, alias = "dangerous-insecure-transport-protocol")]
+            pub dangerous_insecure_transport_protocol: bool,
+            #[serde(default, alias = "dangerous-accept-invalid-certs")]
+            pub dangerous_accept_invalid_certs: bool,
+            #[serde(default, alias = "dangerous-accept-invalid-hostnames")]
+            pub dangerous_accept_invalid_hostnames: bool,
+            #[serde(default)]
+            pub endpoints: Vec<Url>,
+            pub pubkey: String,
+            pub windows: Option<WindowsConfig>,
+        }
+
+        let config = Config::deserialize(deserializer)?;
+
+        validate_endpoints(&config.endpoints, config.dangerous_insecure_transport_protocol)
+            .map_err(serde::de::Error::custom)?;
+
+        Ok(Self {
+            dangerous_insecure_transport_protocol: config.dangerous_insecure_transport_protocol,
+            dangerous_accept_invalid_certs: config.dangerous_accept_invalid_certs,
+            dangerous_accept_invalid_hostnames: config.dangerous_accept_invalid_hostnames,
+            endpoints: config.endpoints,
+            pubkey: config.pubkey,
+            windows: config.windows,
+        })
+    }
+}
+
+pub(crate) fn validate_endpoints(endpoints: &[Url], dangerous_insecure_transport_protocol: bool) -> crate::Result<()> {
+    if !dangerous_insecure_transport_protocol {
+        for url in endpoints {
+            if url.scheme() != "https" {
+                #[cfg(debug_assertions)]
+                {
+                    eprintln!("[\x1b[33mWARNING\x1b[0m] The updater endpoint \"{url}\" doesn't use `https` protocol. This is allowed in development but will fail in release builds.");
+                    eprintln!("[\x1b[33mWARNING\x1b[0m] if this is a desired behavior, you can enable `dangerousInsecureTransportProtocol` in the plugin configuration");
+                }
+                #[cfg(not(debug_assertions))]
+                return Err(crate::Error::InsecureTransportProtocol);
+            }
+        }
+    }
+
+    Ok(())
+}
diff --git a/vendor/tauri-plugin-updater/src/error.rs b/vendor/tauri-plugin-updater/src/error.rs
new file mode 100644
index 0000000000..06fa758461
--- /dev/null
+++ b/vendor/tauri-plugin-updater/src/error.rs
@@ -0,0 +1,103 @@
+// Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT
+
+use serde::{Serialize, Serializer};
+use thiserror::Error;
+
+/// All errors that can occur while running the updater.
+#[derive(Debug, Error)]
+#[non_exhaustive]
+pub enum Error {
+    /// Endpoints are not sent.
+    #[error("Updater does not have any endpoints set.")]
+    EmptyEndpoints,
+    /// IO errors.
+    #[error(transparent)]
+    Io(#[from] std::io::Error),
+    /// Semver errors.
+    #[error(transparent)]
+    Semver(#[from] semver::Error),
+    /// Serialization errors.
+    #[error(transparent)]
+    Serialization(#[from] serde_json::Error),
+    /// Could not fetch a valid response from the server.
+    #[error("Could not fetch a valid release JSON from the remote")]
+    ReleaseNotFound,
+    /// Unsupported app architecture.
+    #[error("Unsupported application architecture, expected one of `x86`, `x86_64`, `arm` or `aarch64`.")]
+    UnsupportedArch,
+    /// Operating system is not supported.
+    #[error("Unsupported OS, expected one of `linux`, `darwin` or `windows`.")]
+    UnsupportedOs,
+    /// Failed to determine updater package extract path
+    #[error("Failed to determine updater package extract path.")]
+    FailedToDetermineExtractPath,
+    /// Url parsing errors.
+    #[error(transparent)]
+    UrlParse(#[from] url::ParseError),
+    /// `reqwest` crate errors.
+    #[error(transparent)]
+    Reqwest(#[from] reqwest::Error),
+    /// The platform was not found in the updater JSON response.
+    #[error("the platform `{0}` was not found in the response `platforms` object")]
+    TargetNotFound(String),
+    /// Neither the platform nor the fallback platform was found in the updater JSON response.
+    #[error("None of the fallback platforms `{0:?}` were found in the response `platforms` object")]
+    TargetsNotFound(Vec<String>),
+    /// Download failed
+    #[error("`{0}`")]
+    Network(String),
+    /// `minisign_verify` errors.
+    #[error(transparent)]
+    Minisign(#[from] minisign_verify::Error),
+    /// `base64` errors.
+    #[error(transparent)]
+    Base64(#[from] base64::DecodeError),
+    /// UTF8 Errors in signature.
+    #[error("The signature {0} could not be decoded, please check if it is a valid base64 string. The signature must be the contents of the `.sig` file generated by the Tauri bundler, as a string.")]
+    SignatureUtf8(String),
+    #[cfg(all(target_os = "windows", feature = "zip"))]
+    /// `zip` errors.
+    #[error(transparent)]
+    Extract(#[from] zip::result::ZipError),
+    /// Temp dir is not on same mount mount. This prevents our updater to rename the AppImage to a temp file.
+    #[error("temp directory is not on the same mount point as the AppImage")]
+    TempDirNotOnSameMountPoint,
+    #[error("binary for the current target not found in the archive")]
+    BinaryNotFoundInArchive,
+    #[error("failed to create temporary directory")]
+    TempDirNotFound,
+    #[error("Authentication failed or was cancelled")]
+    AuthenticationFailed,
+    #[error("Failed to install .deb package")]
+    DebInstallFailed,
+    #[error("Failed to install package")]
+    PackageInstallFailed,
+    #[error("invalid updater binary format")]
+    InvalidUpdaterFormat,
+    #[error(transparent)]
+    Http(#[from] http::Error),
+    #[error(transparent)]
+    InvalidHeaderValue(#[from] http::header::InvalidHeaderValue),
+    #[error(transparent)]
+    InvalidHeaderName(#[from] http::header::InvalidHeaderName),
+    #[error("Failed to format date")]
+    FormatDate,
+    /// The configured updater endpoint must use a secure protocol like `https`
+    #[error("The configured updater endpoint must use a secure protocol like `https`.")]
+    InsecureTransportProtocol,
+    #[error(transparent)]
+    Tauri(#[from] tauri::Error),
+}
+
+impl Serialize for Error {
+    fn serialize<S>(&self, serializer: S) -> std::result::Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        serializer.serialize_str(self.to_string().as_ref())
+    }
+}
+
+pub type Result<T> = std::result::Result<T, Error>;
diff --git a/vendor/tauri-plugin-updater/src/lib.rs b/vendor/tauri-plugin-updater/src/lib.rs
new file mode 100644
index 0000000000..610f7e0e28
--- /dev/null
+++ b/vendor/tauri-plugin-updater/src/lib.rs
@@ -0,0 +1,227 @@
+// Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT
+
+//! In-app updates for Tauri applications.
+//!
+//! - Supported platforms: Windows, Linux and macOS.crypted database and secure runtime.
+
+#![doc(
+    html_logo_url = "https://github.com/tauri-apps/tauri/raw/dev/app-icon.png",
+    html_favicon_url = "https://github.com/tauri-apps/tauri/raw/dev/app-icon.png"
+)]
+
+use std::{ffi::OsString, sync::Arc};
+
+use http::{HeaderMap, HeaderName, HeaderValue};
+use semver::Version;
+use tauri::{
+    plugin::{Builder as PluginBuilder, TauriPlugin},
+    Manager, Runtime,
+};
+
+mod commands;
+mod config;
+mod error;
+mod updater;
+
+pub use config::Config;
+pub use error::{Error, Result};
+pub use updater::*;
+
+/// Extensions to [`tauri::App`], [`tauri::AppHandle`], [`tauri::WebviewWindow`], [`tauri::Webview`] and [`tauri::Window`] to access the updater APIs.
+pub trait UpdaterExt<R: Runtime> {
+    /// Gets the updater builder to build and updater
+    /// that can manually check if an update is available.
+    ///
+    /// # Examples
+    ///
+    /// ```no_run
+    /// use tauri_plugin_updater::UpdaterExt;
+    /// tauri::Builder::default()
+    ///   .setup(|app| {
+    ///     let handle = app.handle().clone();
+    ///     tauri::async_runtime::spawn(async move {
+    ///         let response = handle.updater_builder().build().unwrap().check().await;
+    ///     });
+    ///     Ok(())
+    ///   });
+    /// ```
+    fn updater_builder(&self) -> UpdaterBuilder;
+
+    /// Gets the updater to manually check if an update is available.
+    ///
+    /// # Examples
+    ///
+    /// ```no_run
+    /// use tauri_plugin_updater::UpdaterExt;
+    /// tauri::Builder::default()
+    ///   .setup(|app| {
+    ///     let handle = app.handle().clone();
+    ///     tauri::async_runtime::spawn(async move {
+    ///         let response = handle.updater().unwrap().check().await;
+    ///     });
+    ///     Ok(())
+    ///   });
+    /// ```
+    fn updater(&self) -> Result<Updater>;
+}
+
+impl<R: Runtime, T: Manager<R>> UpdaterExt<R> for T {
+    fn updater_builder(&self) -> UpdaterBuilder {
+        let app = self.app_handle();
+        let UpdaterState { config, target, version_comparator, headers } = self.state::<UpdaterState>().inner();
+
+        let mut builder = UpdaterBuilder::new(app, config.clone()).headers(headers.clone());
+
+        if let Some(target) = target {
+            builder = builder.target(target);
+        }
+
+        let args = self.env().args_os;
+        if !args.is_empty() {
+            builder = builder.current_exe_args(args);
+        }
+
+        builder.version_comparator = version_comparator.clone();
+
+        #[cfg(any(
+            target_os = "linux",
+            target_os = "dragonfly",
+            target_os = "freebsd",
+            target_os = "netbsd",
+            target_os = "openbsd"
+        ))]
+        {
+            let env = app.env();
+            if let Some(appimage) = env.appimage {
+                builder = builder.executable_path(appimage);
+            }
+        }
+
+        let app_handle = app.app_handle().clone();
+        builder = builder.on_before_exit(move || {
+            app_handle.cleanup_before_exit();
+        });
+
+        builder
+    }
+
+    fn updater(&self) -> Result<Updater> {
+        self.updater_builder().build()
+    }
+}
+
+struct UpdaterState {
+    target: Option<String>,
+    config: Config,
+    version_comparator: Option<VersionComparator>,
+    headers: HeaderMap,
+}
+
+#[derive(Default)]
+pub struct Builder {
+    target: Option<String>,
+    pubkey: Option<String>,
+    installer_args: Vec<OsString>,
+    headers: HeaderMap,
+    default_version_comparator: Option<VersionComparator>,
+}
+
+impl Builder {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn target(mut self, target: impl Into<String>) -> Self {
+        self.target.replace(target.into());
+        self
+    }
+
+    pub fn pubkey<S: Into<String>>(mut self, pubkey: S) -> Self {
+        self.pubkey.replace(pubkey.into());
+        self
+    }
+
+    /// Adds an additional argument to pass to the Windows installer.
+    pub fn installer_args<I, S>(mut self, args: I) -> Self
+    where
+        I: IntoIterator<Item = S>,
+        S: Into<OsString>,
+    {
+        self.installer_args.extend(args.into_iter().map(Into::into));
+        self
+    }
+
+    /// Adds multiple additional arguments to pass to the Windows installer.
+    pub fn installer_arg<S>(mut self, arg: S) -> Self
+    where
+        S: Into<OsString>,
+    {
+        self.installer_args.push(arg.into());
+        self
+    }
+
+    /// Removes all the additional arguments to pass to the Windows installer.
+    ///
+    /// Note: this only removes the additional arguments added through [`Self::installer_args`],
+    /// not the ones managed by us (e.g. `/UPDATER` flag passed to the NSIS installer)
+    pub fn clear_installer_args(mut self) -> Self {
+        self.installer_args.clear();
+        self
+    }
+
+    pub fn header<K, V>(mut self, key: K, value: V) -> Result<Self>
+    where
+        HeaderName: TryFrom<K>,
+        <HeaderName as TryFrom<K>>::Error: Into<http::Error>,
+        HeaderValue: TryFrom<V>,
+        <HeaderValue as TryFrom<V>>::Error: Into<http::Error>,
+    {
+        let key: std::result::Result<HeaderName, http::Error> = key.try_into().map_err(Into::into);
+        let value: std::result::Result<HeaderValue, http::Error> = value.try_into().map_err(Into::into);
+        self.headers.insert(key?, value?);
+
+        Ok(self)
+    }
+
+    pub fn headers(mut self, headers: HeaderMap) -> Self {
+        self.headers = headers;
+        self
+    }
+
+    pub fn default_version_comparator<F: Fn(Version, RemoteRelease) -> bool + Send + Sync + 'static>(
+        mut self,
+        f: F,
+    ) -> Self {
+        self.default_version_comparator.replace(Arc::new(f));
+        self
+    }
+
+    pub fn build<R: Runtime>(self) -> TauriPlugin<R, Config> {
+        let pubkey = self.pubkey;
+        let target = self.target;
+        let version_comparator = self.default_version_comparator;
+        let installer_args = self.installer_args;
+        let headers = self.headers;
+        PluginBuilder::<R, Config>::new("updater")
+            .setup(move |app, api| {
+                let mut config = api.config().clone();
+                if let Some(pubkey) = pubkey {
+                    config.pubkey = pubkey;
+                }
+                if let Some(windows) = &mut config.windows {
+                    windows.installer_args.extend(installer_args);
+                }
+                app.manage(UpdaterState { target, config, version_comparator, headers });
+                Ok(())
+            })
+            .invoke_handler(tauri::generate_handler![
+                commands::check,
+                commands::download,
+                commands::install,
+                commands::download_and_install,
+            ])
+            .build()
+    }
+}
diff --git a/vendor/tauri-plugin-updater/src/updater.rs b/vendor/tauri-plugin-updater/src/updater.rs
new file mode 100644
index 0000000000..383784d727
--- /dev/null
+++ b/vendor/tauri-plugin-updater/src/updater.rs
@@ -0,0 +1,1605 @@
+// Copyright 2019-2023 Tauri Programme within The Commons Conservancy
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT
+
+use std::{
+    collections::HashMap,
+    ffi::OsString,
+    io::Cursor,
+    path::{Path, PathBuf},
+    str::FromStr,
+    sync::Arc,
+    time::Duration,
+};
+
+#[cfg(not(target_os = "macos"))]
+use std::ffi::OsStr;
+
+use base64::Engine;
+use futures_util::StreamExt;
+use http::{header::ACCEPT, HeaderName};
+use minisign_verify::{PublicKey, Signature};
+use percent_encoding::{AsciiSet, CONTROLS};
+use reqwest::{
+    header::{HeaderMap, HeaderValue},
+    ClientBuilder, StatusCode,
+};
+use semver::Version;
+use serde::{de::Error as DeError, Deserialize, Deserializer, Serialize};
+use tauri::{
+    utils::{
+        config::BundleType,
+        platform::{bundle_type, current_exe},
+    },
+    AppHandle, Resource, Runtime,
+};
+use time::OffsetDateTime;
+use url::Url;
+
+use crate::{
+    error::{Error, Result},
+    Config,
+};
+
+const UPDATER_USER_AGENT: &str = concat!(env!("CARGO_PKG_NAME"), "/", env!("CARGO_PKG_VERSION"),);
+
+#[derive(Copy, Clone)]
+pub enum Installer {
+    AppImage,
+    Deb,
+    Rpm,
+
+    App,
+
+    Msi,
+    Nsis,
+}
+
+impl Installer {
+    fn name(self) -> &'static str {
+        match self {
+            Self::AppImage => "appimage",
+            Self::Deb => "deb",
+            Self::Rpm => "rpm",
+            Self::App => "app",
+            Self::Msi => "msi",
+            Self::Nsis => "nsis",
+        }
+    }
+}
+
+#[derive(Debug, Deserialize, Serialize, Clone)]
+pub struct ReleaseManifestPlatform {
+    /// Download URL for the platform
+    pub url: Url,
+    /// Signature for the platform
+    pub signature: String,
+}
+
+#[derive(Debug, Deserialize, Serialize, Clone)]
+#[serde(untagged)]
+pub enum RemoteReleaseInner {
+    Dynamic(ReleaseManifestPlatform),
+    Static { platforms: HashMap<String, ReleaseManifestPlatform> },
+}
+
+/// Information about a release returned by the remote update server.
+///
+/// This type can have one of two shapes: Server Format (Dynamic Format) and Static Format.
+#[derive(Debug, Clone)]
+pub struct RemoteRelease {
+    /// Version to install.
+    pub version: Version,
+    /// Release notes.
+    pub notes: Option<String>,
+    /// Release date.
+    pub pub_date: Option<OffsetDateTime>,
+    /// Release data.
+    pub data: RemoteReleaseInner,
+}
+
+impl RemoteRelease {
+    /// The release's download URL for the given target.
+    pub fn download_url(&self, target: &str) -> Result<&Url> {
+        match self.data {
+            RemoteReleaseInner::Dynamic(ref platform) => Ok(&platform.url),
+            RemoteReleaseInner::Static { ref platforms } => {
+                platforms.get(target).map_or(Err(Error::TargetNotFound(target.to_string())), |p| Ok(&p.url))
+            }
+        }
+    }
+
+    /// The release's signature for the given target.
+    pub fn signature(&self, target: &str) -> Result<&String> {
+        match self.data {
+            RemoteReleaseInner::Dynamic(ref platform) => Ok(&platform.signature),
+            RemoteReleaseInner::Static { ref platforms } => platforms
+                .get(target)
+                .map_or(Err(Error::TargetNotFound(target.to_string())), |platform| Ok(&platform.signature)),
+        }
+    }
+}
+
+pub type OnBeforeExit = Arc<dyn Fn() + Send + Sync + 'static>;
+pub type OnBeforeRequest = Arc<dyn Fn(ClientBuilder) -> ClientBuilder + Send + Sync + 'static>;
+pub type VersionComparator = Arc<dyn Fn(Version, RemoteRelease) -> bool + Send + Sync>;
+type MainThreadClosure = Box<dyn FnOnce() + Send + Sync + 'static>;
+type RunOnMainThread = Box<dyn Fn(MainThreadClosure) -> std::result::Result<(), tauri::Error> + Send + Sync + 'static>;
+
+pub struct UpdaterBuilder {
+    #[allow(dead_code)]
+    run_on_main_thread: RunOnMainThread,
+    app_name: String,
+    current_version: Version,
+    config: Config,
+    pub(crate) version_comparator: Option<VersionComparator>,
+    executable_path: Option<PathBuf>,
+    target: Option<String>,
+    endpoints: Option<Vec<Url>>,
+    headers: HeaderMap,
+    timeout: Option<Duration>,
+    proxy: Option<Url>,
+    no_proxy: bool,
+    installer_args: Vec<OsString>,
+    current_exe_args: Vec<OsString>,
+    on_before_exit: Option<OnBeforeExit>,
+    configure_client: Option<OnBeforeRequest>,
+}
+
+impl UpdaterBuilder {
+    pub(crate) fn new<R: Runtime>(app: &AppHandle<R>, config: crate::Config) -> Self {
+        let app_ = app.clone();
+        let run_on_main_thread = move |f| app_.run_on_main_thread(f);
+        Self {
+            run_on_main_thread: Box::new(run_on_main_thread),
+            installer_args: config.windows.as_ref().map(|w| w.installer_args.clone()).unwrap_or_default(),
+            current_exe_args: Vec::new(),
+            app_name: app.package_info().name.clone(),
+            current_version: app.package_info().version.clone(),
+            config,
+            version_comparator: None,
+            executable_path: None,
+            target: None,
+            endpoints: None,
+            headers: Default::default(),
+            timeout: None,
+            proxy: None,
+            no_proxy: false,
+            on_before_exit: None,
+            configure_client: None,
+        }
+    }
+
+    pub fn version_comparator<F: Fn(Version, RemoteRelease) -> bool + Send + Sync + 'static>(mut self, f: F) -> Self {
+        self.version_comparator = Some(Arc::new(f));
+        self
+    }
+
+    pub fn target(mut self, target: impl Into<String>) -> Self {
+        self.target.replace(target.into());
+        self
+    }
+
+    pub fn endpoints(mut self, endpoints: Vec<Url>) -> Result<Self> {
+        crate::config::validate_endpoints(&endpoints, self.config.dangerous_insecure_transport_protocol)?;
+
+        self.endpoints.replace(endpoints);
+        Ok(self)
+    }
+
+    pub fn executable_path<P: AsRef<Path>>(mut self, p: P) -> Self {
+        self.executable_path.replace(p.as_ref().into());
+        self
+    }
+
+    pub fn header<K, V>(mut self, key: K, value: V) -> Result<Self>
+    where
+        HeaderName: TryFrom<K>,
+        <HeaderName as TryFrom<K>>::Error: Into<http::Error>,
+        HeaderValue: TryFrom<V>,
+        <HeaderValue as TryFrom<V>>::Error: Into<http::Error>,
+    {
+        let key: std::result::Result<HeaderName, http::Error> = key.try_into().map_err(Into::into);
+        let value: std::result::Result<HeaderValue, http::Error> = value.try_into().map_err(Into::into);
+        self.headers.insert(key?, value?);
+
+        Ok(self)
+    }
+
+    pub fn headers(mut self, headers: HeaderMap) -> Self {
+        self.headers = headers;
+        self
+    }
+
+    pub fn clear_headers(mut self) -> Self {
+        self.headers.clear();
+        self
+    }
+
+    pub fn timeout(mut self, timeout: Duration) -> Self {
+        self.timeout = Some(timeout);
+        self
+    }
+
+    pub fn proxy(mut self, proxy: Url) -> Self {
+        self.proxy.replace(proxy);
+        self
+    }
+
+    /// Clear all proxies. See [`reqwest::ClientBuilder::no_proxy`](https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.no_proxy).
+    pub fn no_proxy(mut self) -> Self {
+        self.no_proxy = true;
+        self
+    }
+
+    pub fn pubkey<S: Into<String>>(mut self, pubkey: S) -> Self {
+        self.config.pubkey = pubkey.into();
+        self
+    }
+
+    /// Adds an argument to pass to the Windows installer.
+    pub fn installer_arg<S>(mut self, arg: S) -> Self
+    where
+        S: Into<OsString>,
+    {
+        self.installer_args.push(arg.into());
+        self
+    }
+
+    /// Adds multiple arguments to pass to the Windows installer.
+    pub fn installer_args<I, S>(mut self, args: I) -> Self
+    where
+        I: IntoIterator<Item = S>,
+        S: Into<OsString>,
+    {
+        self.installer_args.extend(args.into_iter().map(Into::into));
+        self
+    }
+
+    /// Removes all the additional arguments to pass to the Windows installer.
+    ///
+    /// Note: this only removes the additional arguments added through
+    /// [`Self::installer_arg`], [`crate::Builder::installer_arg`]
+    /// and the `plugins > updater > windows > installerArgs` config,
+    /// not the ones managed by us (e.g. `/UPDATER` flag passed to the NSIS installer)
+    pub fn clear_installer_args(mut self) -> Self {
+        self.installer_args.clear();
+        self
+    }
+
+    /// Function to run before we run the installer and exit the app through `std::process::exit(0)` on Windows
+    pub fn on_before_exit<F: Fn() + Send + Sync + 'static>(mut self, f: F) -> Self {
+        self.on_before_exit.replace(Arc::new(f));
+        self
+    }
+
+    /// Allows you to modify the `reqwest` client builder before the HTTP request is sent.
+    ///
+    /// Note that `reqwest` crate may be updated in minor releases of tauri-plugin-updater.
+    /// Therefore it's recommended to pin the plugin to at least a minor version when you're using `configure_client`.
+    pub fn configure_client<F: Fn(ClientBuilder) -> ClientBuilder + Send + Sync + 'static>(mut self, f: F) -> Self {
+        self.configure_client.replace(Arc::new(f));
+        self
+    }
+
+    pub fn build(self) -> Result<Updater> {
+        let endpoints = self.endpoints.unwrap_or_else(|| self.config.endpoints.clone());
+
+        if endpoints.is_empty() {
+            return Err(Error::EmptyEndpoints);
+        };
+
+        let arch = updater_arch().ok_or(Error::UnsupportedArch)?;
+
+        let executable_path = self.executable_path.clone().unwrap_or(current_exe()?);
+
+        // Get the extract_path from the provided executable_path
+        let extract_path =
+            if cfg!(target_os = "linux") { executable_path } else { extract_path_from_executable(&executable_path)? };
+
+        Ok(Updater {
+            run_on_main_thread: Arc::new(self.run_on_main_thread),
+            config: self.config,
+            app_name: self.app_name,
+            current_version: self.current_version,
+            version_comparator: self.version_comparator,
+            timeout: self.timeout,
+            proxy: self.proxy,
+            no_proxy: self.no_proxy,
+            endpoints,
+            installer_args: self.installer_args,
+            current_exe_args: self.current_exe_args,
+            arch,
+            target: self.target,
+            headers: self.headers,
+            extract_path,
+            on_before_exit: self.on_before_exit,
+            configure_client: self.configure_client,
+        })
+    }
+}
+
+impl UpdaterBuilder {
+    pub(crate) fn current_exe_args<I, S>(mut self, args: I) -> Self
+    where
+        I: IntoIterator<Item = S>,
+        S: Into<OsString>,
+    {
+        self.current_exe_args.extend(args.into_iter().map(Into::into));
+        self
+    }
+}
+
+pub struct Updater {
+    #[allow(dead_code)]
+    run_on_main_thread: Arc<RunOnMainThread>,
+    config: Config,
+    app_name: String,
+    current_version: Version,
+    version_comparator: Option<VersionComparator>,
+    timeout: Option<Duration>,
+    proxy: Option<Url>,
+    no_proxy: bool,
+    endpoints: Vec<Url>,
+    arch: &'static str,
+    // The `{{target}}` variable we replace in the endpoint and serach for in the JSON,
+    // this is either the user provided target or the current operating system by default
+    target: Option<String>,
+    headers: HeaderMap,
+    extract_path: PathBuf,
+    on_before_exit: Option<OnBeforeExit>,
+    configure_client: Option<OnBeforeRequest>,
+    #[allow(unused)]
+    installer_args: Vec<OsString>,
+    #[allow(unused)]
+    current_exe_args: Vec<OsString>,
+}
+
+impl Updater {
+    pub async fn check(&self) -> Result<Option<Update>> {
+        // we want JSON only
+        let mut headers = self.headers.clone();
+        if !headers.contains_key(ACCEPT) {
+            headers.insert(ACCEPT, HeaderValue::from_static("application/json"));
+        }
+
+        // Set SSL certs for linux if they aren't available.
+        #[cfg(target_os = "linux")]
+        {
+            if std::env::var_os("SSL_CERT_FILE").is_none() {
+                std::env::set_var("SSL_CERT_FILE", "/etc/ssl/certs/ca-certificates.crt");
+            }
+            if std::env::var_os("SSL_CERT_DIR").is_none() {
+                std::env::set_var("SSL_CERT_DIR", "/etc/ssl/certs");
+            }
+        }
+        let target = if let Some(target) = &self.target { target } else { updater_os().ok_or(Error::UnsupportedOs)? };
+
+        let mut remote_release: Option<RemoteRelease> = None;
+        let mut raw_json: Option<serde_json::Value> = None;
+        let mut last_error: Option<Error> = None;
+        for url in &self.endpoints {
+            // replace {{current_version}}, {{target}}, {{arch}} and {{bundle_type}} in the provided URL
+            // this is useful if we need to query example
+            // https://releases.myapp.com/update/{{target}}/{{arch}}/{{current_version}}
+            // will be translated into ->
+            // https://releases.myapp.com/update/darwin/aarch64/1.0.0
+            // The main objective is if the update URL is defined via the Cargo.toml
+            // the URL will be generated dynamically
+            let version = self.current_version.to_string();
+            let version = version.as_bytes();
+            const CONTROLS_ADD: &AsciiSet = &CONTROLS.add(b'+');
+            let encoded_version = percent_encoding::percent_encode(version, CONTROLS_ADD);
+            let encoded_version = encoded_version.to_string();
+            let installer = installer_for_bundle_type(bundle_type()).map(|i| i.name()).unwrap_or("unknown");
+
+            let url: Url = url
+                .to_string()
+                // url::Url automatically url-encodes the path components
+                .replace("%7B%7Bcurrent_version%7D%7D", &encoded_version)
+                .replace("%7B%7Btarget%7D%7D", target)
+                .replace("%7B%7Barch%7D%7D", self.arch)
+                .replace("%7B%7Bbundle_type%7D%7D", installer)
+                // but not query parameters
+                .replace("{{current_version}}", &encoded_version)
+                .replace("{{target}}", target)
+                .replace("{{arch}}", self.arch)
+                .replace("{{bundle_type}}", installer)
+                .parse()?;
+
+            log::debug!("checking for updates {url}");
+
+            #[cfg(feature = "rustls-tls")]
+            if rustls::crypto::CryptoProvider::get_default().is_none() {
+                // This can only fail if there is already a default provider which we checked for already.
+                let _ = rustls::crypto::ring::default_provider().install_default();
+            }
+
+            let mut request = ClientBuilder::new().user_agent(UPDATER_USER_AGENT);
+            if self.config.dangerous_accept_invalid_certs {
+                request = request.danger_accept_invalid_certs(true);
+            }
+            if self.config.dangerous_accept_invalid_hostnames {
+                request = request.danger_accept_invalid_hostnames(true);
+            }
+            if let Some(timeout) = self.timeout {
+                request = request.timeout(timeout);
+            }
+            if self.no_proxy {
+                log::debug!("disabling proxy");
+                request = request.no_proxy();
+            } else if let Some(ref proxy) = self.proxy {
+                log::debug!("using proxy {proxy}");
+                let proxy = reqwest::Proxy::all(proxy.as_str())?;
+                request = request.proxy(proxy);
+            }
+
+            if let Some(ref configure_client) = self.configure_client {
+                request = configure_client(request);
+            }
+
+            let response = request.build()?.get(url).headers(headers.clone()).send().await;
+
+            match response {
+                Ok(res) => {
+                    if res.status().is_success() {
+                        // no updates found!
+                        if StatusCode::NO_CONTENT == res.status() {
+                            log::debug!("update endpoint returned 204 No Content");
+                            return Ok(None);
+                        };
+
+                        let update_response: serde_json::Value = res.json().await?;
+                        log::debug!("update response: {update_response:?}");
+                        raw_json = Some(update_response.clone());
+                        match serde_json::from_value::<RemoteRelease>(update_response).map_err(Into::into) {
+                            Ok(release) => {
+                                log::debug!("parsed release response {release:?}");
+                                last_error = None;
+                                remote_release = Some(release);
+                                // we found a release, break the loop
+                                break;
+                            }
+                            Err(err) => {
+                                log::error!("failed to deserialize update response: {err}");
+                                last_error = Some(err)
+                            }
+                        }
+                    } else {
+                        log::error!("update endpoint did not respond with a successful status code");
+                    }
+                }
+                Err(err) => {
+                    log::error!("failed to check for updates: {err}");
+                    last_error = Some(err.into())
+                }
+            }
+        }
+
+        // Last error is cleaned on success.
+        // Shouldn't be triggered if we had a successfull call
+        if let Some(error) = last_error {
+            return Err(error);
+        }
+
+        // Extracted remote metadata
+        remote_release.ok_or(Error::ReleaseNotFound)?;
+
+        self.restore_update(raw_json.ok_or(Error::ReleaseNotFound)?)
+    }
+
+    /// Construct an installable update from cached release metadata without networking.
+    /// Callers must verify the cached bytes with `Update::verify` before using them.
+    pub fn package_kind(&self) -> &'static str {
+        installer_for_bundle_type(bundle_type()).map(|i| i.name()).unwrap_or("unknown")
+    }
+
+    pub fn restore_update(&self, raw_json: serde_json::Value) -> Result<Option<Update>> {
+        let release: RemoteRelease = serde_json::from_value(raw_json.clone())?;
+        let target = self.target.as_deref().unwrap_or(updater_os().ok_or(Error::UnsupportedOs)?);
+        let should_update = match self.version_comparator.as_ref() {
+            Some(comparator) => comparator(self.current_version.clone(), release.clone()),
+            None => release.version > self.current_version,
+        };
+
+        let installer = installer_for_bundle_type(bundle_type());
+        let (download_url, signature) = self.get_urls(&release, &installer)?;
+
+        let update = if should_update {
+            Some(Update {
+                run_on_main_thread: self.run_on_main_thread.clone(),
+                config: self.config.clone(),
+                on_before_exit: self.on_before_exit.clone(),
+                app_name: self.app_name.clone(),
+                current_version: self.current_version.to_string(),
+                target: target.to_owned(),
+                extract_path: self.extract_path.clone(),
+                version: release.version.to_string(),
+                date: release.pub_date,
+                download_url: download_url.clone(),
+                signature: signature.to_owned(),
+                body: release.notes,
+                raw_json,
+                timeout: None,
+                proxy: self.proxy.clone(),
+                no_proxy: self.no_proxy,
+                headers: self.headers.clone(),
+                installer_args: self.installer_args.clone(),
+                current_exe_args: self.current_exe_args.clone(),
+                configure_client: self.configure_client.clone(),
+            })
+        } else {
+            None
+        };
+
+        Ok(update)
+    }
+
+    fn get_urls<'a>(&self, release: &'a RemoteRelease, installer: &Option<Installer>) -> Result<(&'a Url, &'a String)> {
+        // Use the user provided target
+        if let Some(target) = &self.target {
+            return Ok((release.download_url(target)?, release.signature(target)?));
+        }
+
+        // Or else we search for [`{os}-{arch}-{installer}`, `{os}-{arch}`] in order
+        let os = updater_os().ok_or(Error::UnsupportedOs)?;
+        let arch = self.arch;
+        let mut targets = Vec::new();
+        if let Some(installer) = installer {
+            let installer = installer.name();
+            targets.push(format!("{os}-{arch}-{installer}"));
+        }
+        targets.push(format!("{os}-{arch}"));
+
+        for target in &targets {
+            log::debug!("Searching for updater target '{target}' in release data");
+            if let (Ok(download_url), Ok(signature)) = (release.download_url(target), release.signature(target)) {
+                return Ok((download_url, signature));
+            };
+        }
+
+        Err(Error::TargetsNotFound(targets))
+    }
+}
+
+#[derive(Clone)]
+pub struct Update {
+    #[allow(dead_code)]
+    run_on_main_thread: Arc<RunOnMainThread>,
+    config: Config,
+    #[allow(unused)]
+    on_before_exit: Option<OnBeforeExit>,
+    /// Update description
+    pub body: Option<String>,
+    /// Version used to check for update
+    pub current_version: String,
+    /// Version announced
+    pub version: String,
+    /// Update publish date
+    pub date: Option<OffsetDateTime>,
+    /// The `{{target}}` variable we replace in the endpoint and search for in the JSON,
+    /// this is either the user provided target or the current operating system by default
+    pub target: String,
+    /// Download URL announced
+    pub download_url: Url,
+    /// Signature announced
+    pub signature: String,
+    /// The raw version of server's JSON response. Useful if the response contains additional fields that the updater doesn't handle.
+    pub raw_json: serde_json::Value,
+    /// Request timeout
+    pub timeout: Option<Duration>,
+    /// Request proxy
+    pub proxy: Option<Url>,
+    /// Disable system proxy
+    pub no_proxy: bool,
+    /// Request headers
+    pub headers: HeaderMap,
+    /// Extract path
+    #[allow(unused)]
+    extract_path: PathBuf,
+    /// App name, used for creating named tempfiles on Windows
+    #[allow(unused)]
+    app_name: String,
+    #[allow(unused)]
+    installer_args: Vec<OsString>,
+    #[allow(unused)]
+    current_exe_args: Vec<OsString>,
+    configure_client: Option<OnBeforeRequest>,
+}
+
+impl Resource for Update {}
+
+impl Update {
+    /// Verify bytes against the release signature using the current configured public key.
+    pub fn verify(&self, bytes: &[u8]) -> Result<()> {
+        verify_signature(bytes, &self.signature, &self.config.pubkey).map(|_| ())
+    }
+
+    /// Downloads the updater package, verifies it then return it as bytes.
+    ///
+    /// Use [`Update::install`] to install it
+    pub async fn download<C: FnMut(usize, Option<u64>), D: FnOnce()>(
+        &self,
+        mut on_chunk: C,
+        on_download_finish: D,
+    ) -> Result<Vec<u8>> {
+        // set our headers
+        let mut headers = self.headers.clone();
+        if !headers.contains_key(ACCEPT) {
+            headers.insert(ACCEPT, HeaderValue::from_static("application/octet-stream"));
+        }
+
+        let mut request = ClientBuilder::new().user_agent(UPDATER_USER_AGENT);
+        if self.config.dangerous_accept_invalid_certs {
+            request = request.danger_accept_invalid_certs(true);
+        }
+        if self.config.dangerous_accept_invalid_hostnames {
+            request = request.danger_accept_invalid_hostnames(true);
+        }
+        if let Some(timeout) = self.timeout {
+            request = request.timeout(timeout);
+        }
+        if self.no_proxy {
+            request = request.no_proxy();
+        } else if let Some(ref proxy) = self.proxy {
+            let proxy = reqwest::Proxy::all(proxy.as_str())?;
+            request = request.proxy(proxy);
+        }
+        if let Some(ref configure_client) = self.configure_client {
+            request = configure_client(request);
+        }
+        let response = request.build()?.get(self.download_url.clone()).headers(headers).send().await?;
+
+        if !response.status().is_success() {
+            return Err(Error::Network(format!("Download request failed with status: {}", response.status())));
+        }
+
+        let content_length: Option<u64> = response
+            .headers()
+            .get("Content-Length")
+            .and_then(|value| value.to_str().ok())
+            .and_then(|value| value.parse().ok());
+
+        const MAX_UPDATE_BYTES: usize = 512 * 1024 * 1024;
+        if content_length.is_some_and(|length| length > MAX_UPDATE_BYTES as u64) {
+            return Err(Error::Network("Update package exceeds size limit".into()));
+        }
+        let mut buffer = Vec::new();
+
+        let mut stream = response.bytes_stream();
+        while let Some(chunk) = stream.next().await {
+            let chunk = chunk?;
+            if buffer.len().saturating_add(chunk.len()) > MAX_UPDATE_BYTES {
+                return Err(Error::Network("Update package exceeds size limit".into()));
+            }
+            on_chunk(chunk.len(), content_length);
+            buffer.extend(chunk);
+        }
+        on_download_finish();
+
+        verify_signature(&buffer, &self.signature, &self.config.pubkey)?;
+
+        Ok(buffer)
+    }
+
+    /// Installs the updater package downloaded by [`Update::download`]
+    pub fn install(&self, bytes: impl AsRef<[u8]>) -> Result<()> {
+        self.install_inner(bytes.as_ref())
+    }
+
+    /// Downloads and installs the updater package
+    pub async fn download_and_install<C: FnMut(usize, Option<u64>), D: FnOnce()>(
+        &self,
+        on_chunk: C,
+        on_download_finish: D,
+    ) -> Result<()> {
+        let bytes = self.download(on_chunk, on_download_finish).await?;
+        self.install(bytes)
+    }
+
+    #[cfg(mobile)]
+    fn install_inner(&self, _bytes: &[u8]) -> Result<()> {
+        Ok(())
+    }
+}
+
+#[cfg(windows)]
+enum WindowsUpdaterType {
+    Nsis {
+        path: PathBuf,
+        #[allow(unused)]
+        temp: Option<tempfile::TempPath>,
+    },
+    Msi {
+        path: PathBuf,
+        #[allow(unused)]
+        temp: Option<tempfile::TempPath>,
+    },
+}
+
+#[cfg(windows)]
+impl WindowsUpdaterType {
+    fn nsis(path: PathBuf, temp: Option<tempfile::TempPath>) -> Self {
+        Self::Nsis { path, temp }
+    }
+
+    fn msi(path: PathBuf, temp: Option<tempfile::TempPath>) -> Self {
+        Self::Msi { path: path.wrap_in_quotes(), temp }
+    }
+}
+
+#[cfg(windows)]
+impl Config {
+    fn install_mode(&self) -> crate::config::WindowsUpdateInstallMode {
+        self.windows.as_ref().map(|w| w.install_mode.clone()).unwrap_or_default()
+    }
+}
+
+/// Windows
+#[cfg(windows)]
+impl Update {
+    /// ### Expected structure:
+    /// ├── [AppName]_[version]_x64.msi              # Application MSI
+    /// ├── [AppName]_[version]_x64-setup.exe        # NSIS installer
+    /// ├── [AppName]_[version]_x64.msi.zip          # ZIP generated by tauri-bundler
+    /// │   └──[AppName]_[version]_x64.msi           # Application MSI
+    /// ├── [AppName]_[version]_x64-setup.exe.zip          # ZIP generated by tauri-bundler
+    /// │   └──[AppName]_[version]_x64-setup.exe           # NSIS installer
+    /// └── ...
+    fn install_inner(&self, bytes: &[u8]) -> Result<()> {
+        use std::iter::once;
+        use windows_sys::{
+            w,
+            Win32::UI::{Shell::ShellExecuteW, WindowsAndMessaging::SW_SHOW},
+        };
+
+        let updater_type = self.extract(bytes)?;
+
+        let install_mode = self.config.install_mode();
+        let current_args = &self.current_exe_args()[1..];
+        let msi_args;
+        let nsis_args;
+
+        let installer_args: Vec<&OsStr> = match &updater_type {
+            WindowsUpdaterType::Nsis { .. } => {
+                nsis_args = current_args.iter().map(escape_nsis_current_exe_arg).collect::<Vec<_>>();
+
+                install_mode
+                    .nsis_args()
+                    .iter()
+                    .map(OsStr::new)
+                    .chain(once(OsStr::new("/UPDATE")))
+                    .chain(once(OsStr::new("/ARGS")))
+                    .chain(nsis_args.iter().map(OsStr::new))
+                    .chain(self.installer_args())
+                    .collect()
+            }
+            WindowsUpdaterType::Msi { path, .. } => {
+                let escaped_args = current_args.iter().map(escape_msi_property_arg).collect::<Vec<_>>().join(" ");
+                msi_args = OsString::from(format!("LAUNCHAPPARGS=\"{escaped_args}\""));
+
+                [OsStr::new("/i"), path.as_os_str()]
+                    .into_iter()
+                    .chain(install_mode.msiexec_args().iter().map(OsStr::new))
+                    .chain(once(OsStr::new("/promptrestart")))
+                    .chain(self.installer_args())
+                    .chain(once(OsStr::new("AUTOLAUNCHAPP=True")))
+                    .chain(once(msi_args.as_os_str()))
+                    .collect()
+            }
+        };
+
+        let file = match &updater_type {
+            WindowsUpdaterType::Nsis { path, .. } => path.as_os_str().to_os_string(),
+            WindowsUpdaterType::Msi { .. } => std::env::var("SYSTEMROOT").as_ref().map_or_else(
+                |_| OsString::from("msiexec.exe"),
+                |p| OsString::from(format!("{p}\\System32\\msiexec.exe")),
+            ),
+        };
+        let file = encode_wide(file);
+
+        let parameters = installer_args.join(OsStr::new(" "));
+        let parameters = encode_wide(parameters);
+
+        let launch_result = unsafe {
+            ShellExecuteW(
+                std::ptr::null_mut(),
+                w!("open"),
+                file.as_ptr(),
+                parameters.as_ptr(),
+                std::ptr::null(),
+                SW_SHOW,
+            )
+        };
+
+        if launch_result as isize <= 32 {
+            return Err(std::io::Error::other(format!("Installer launch failed: {}", launch_result as isize)).into());
+        }
+        if let Some(on_before_exit) = self.on_before_exit.as_ref() {
+            log::debug!("running on_before_exit hook");
+            on_before_exit();
+        }
+
+        std::process::exit(0);
+    }
+
+    fn installer_args(&self) -> Vec<&OsStr> {
+        self.installer_args.iter().map(OsStr::new).collect::<Vec<_>>()
+    }
+
+    fn current_exe_args(&self) -> Vec<&OsStr> {
+        self.current_exe_args.iter().map(OsStr::new).collect::<Vec<_>>()
+    }
+
+    fn extract(&self, bytes: &[u8]) -> Result<WindowsUpdaterType> {
+        #[cfg(feature = "zip")]
+        if infer::archive::is_zip(bytes) {
+            return self.extract_zip(bytes);
+        }
+
+        self.extract_exe(bytes)
+    }
+
+    fn make_temp_dir(&self) -> Result<PathBuf> {
+        Ok(tempfile::Builder::new().prefix(&format!("{}-{}-updater-", self.app_name, self.version)).tempdir()?.keep())
+    }
+
+    #[cfg(feature = "zip")]
+    fn extract_zip(&self, bytes: &[u8]) -> Result<WindowsUpdaterType> {
+        let temp_dir = self.make_temp_dir()?;
+
+        let archive = Cursor::new(bytes);
+        let mut extractor = zip::ZipArchive::new(archive)?;
+        extractor.extract(&temp_dir)?;
+
+        let paths = std::fs::read_dir(&temp_dir)?;
+        for path in paths {
+            let path = path?.path();
+            let ext = path.extension();
+            if ext == Some(OsStr::new("exe")) {
+                return Ok(WindowsUpdaterType::nsis(path, None));
+            } else if ext == Some(OsStr::new("msi")) {
+                return Ok(WindowsUpdaterType::msi(path, None));
+            }
+        }
+
+        Err(crate::Error::BinaryNotFoundInArchive)
+    }
+
+    fn extract_exe(&self, bytes: &[u8]) -> Result<WindowsUpdaterType> {
+        if infer::app::is_exe(bytes) {
+            let (path, temp) = self.write_to_temp(bytes, ".exe")?;
+            Ok(WindowsUpdaterType::nsis(path, temp))
+        } else if infer::archive::is_msi(bytes) {
+            let (path, temp) = self.write_to_temp(bytes, ".msi")?;
+            Ok(WindowsUpdaterType::msi(path, temp))
+        } else {
+            Err(crate::Error::InvalidUpdaterFormat)
+        }
+    }
+
+    fn write_to_temp(&self, bytes: &[u8], ext: &str) -> Result<(PathBuf, Option<tempfile::TempPath>)> {
+        use std::io::Write;
+
+        let temp_dir = self.make_temp_dir()?;
+        let mut temp_file = tempfile::Builder::new()
+            .prefix(&format!("{}-{}-installer", self.app_name, self.version))
+            .suffix(ext)
+            .rand_bytes(0)
+            .tempfile_in(temp_dir)?;
+        temp_file.write_all(bytes)?;
+
+        let temp = temp_file.into_temp_path();
+        Ok((temp.to_path_buf(), Some(temp)))
+    }
+}
+
+/// Linux (AppImage, Deb, RPM)
+#[cfg(any(
+    target_os = "linux",
+    target_os = "dragonfly",
+    target_os = "freebsd",
+    target_os = "netbsd",
+    target_os = "openbsd"
+))]
+impl Update {
+    /// ### Expected structure:
+    /// ├── [AppName]_[version]_amd64.AppImage.tar.gz    # GZ generated by tauri-bundler
+    /// │   └──[AppName]_[version]_amd64.AppImage        # Application AppImage
+    /// ├── [AppName]_[version]_amd64.deb                # Debian package
+    /// ├── [AppName]_[version]_amd64.rpm                # RPM package
+    /// └── ...
+    ///
+    fn install_inner(&self, bytes: &[u8]) -> Result<()> {
+        match installer_for_bundle_type(bundle_type()) {
+            Some(Installer::Deb) => self.install_deb(bytes),
+            Some(Installer::Rpm) => self.install_rpm(bytes),
+            _ => self.install_appimage(bytes),
+        }
+    }
+
+    fn install_appimage(&self, bytes: &[u8]) -> Result<()> {
+        use std::os::unix::fs::{MetadataExt, PermissionsExt};
+        let extract_path_metadata = self.extract_path.metadata()?;
+
+        let tmp_dir_locations = vec![
+            Box::new(|| Some(std::env::temp_dir())) as Box<dyn FnOnce() -> Option<PathBuf>>,
+            Box::new(dirs::cache_dir),
+            Box::new(|| Some(self.extract_path.parent().unwrap().to_path_buf())),
+        ];
+
+        for tmp_dir_location in tmp_dir_locations {
+            if let Some(tmp_dir_location) = tmp_dir_location() {
+                let tmp_dir = tempfile::Builder::new().prefix("tauri_current_app").tempdir_in(tmp_dir_location)?;
+                let tmp_dir_metadata = tmp_dir.path().metadata()?;
+
+                if extract_path_metadata.dev() == tmp_dir_metadata.dev() {
+                    let mut perms = tmp_dir_metadata.permissions();
+                    perms.set_mode(0o700);
+                    std::fs::set_permissions(tmp_dir.path(), perms)?;
+
+                    let tmp_app_image = &tmp_dir.path().join("current_app.AppImage");
+
+                    let permissions = std::fs::metadata(&self.extract_path)?.permissions();
+
+                    // create a backup of our current app image
+                    std::fs::rename(&self.extract_path, tmp_app_image)?;
+
+                    #[cfg(feature = "zip")]
+                    if infer::archive::is_gz(bytes) {
+                        log::debug!("extracting AppImage");
+                        // extract the buffer to the tmp_dir
+                        // we extract our signed archive into our final directory without any temp file
+                        let archive = Cursor::new(bytes);
+                        let decoder = flate2::read::GzDecoder::new(archive);
+                        let mut archive = tar::Archive::new(decoder);
+                        for mut entry in archive.entries()?.flatten() {
+                            if let Ok(path) = entry.path() {
+                                if path.extension() == Some(OsStr::new("AppImage")) {
+                                    // if something went wrong during the extraction, we should restore previous app
+                                    if let Err(err) = entry.unpack(&self.extract_path) {
+                                        std::fs::rename(tmp_app_image, &self.extract_path)?;
+                                        return Err(err.into());
+                                    }
+                                    // early finish we have everything we need here
+                                    return Ok(());
+                                }
+                            }
+                        }
+                        // if we have not returned early we should restore the backup
+                        std::fs::rename(tmp_app_image, &self.extract_path)?;
+                        return Err(Error::BinaryNotFoundInArchive);
+                    }
+
+                    log::debug!("rewriting AppImage");
+                    return match std::fs::write(&self.extract_path, bytes)
+                        .and_then(|_| std::fs::set_permissions(&self.extract_path, permissions))
+                    {
+                        Err(err) => {
+                            // if something went wrong during the extraction, we should restore previous app
+                            std::fs::rename(tmp_app_image, &self.extract_path)?;
+                            Err(err.into())
+                        }
+                        Ok(_) => Ok(()),
+                    };
+                }
+            }
+        }
+
+        Err(Error::TempDirNotOnSameMountPoint)
+    }
+
+    fn install_deb(&self, bytes: &[u8]) -> Result<()> {
+        // First verify the bytes are actually a .deb package
+        if !infer::archive::is_deb(bytes) {
+            log::warn!("update is not a valid deb package");
+            return Err(Error::InvalidUpdaterFormat);
+        }
+
+        self.try_tmp_locations(bytes, "dpkg", "-i", "deb")
+    }
+
+    fn install_rpm(&self, bytes: &[u8]) -> Result<()> {
+        // First verify the bytes are actually a .rpm package
+        if !infer::archive::is_rpm(bytes) {
+            return Err(Error::InvalidUpdaterFormat);
+        }
+        self.try_tmp_locations(bytes, "rpm", "-U", "rpm")
+    }
+
+    fn try_tmp_locations(
+        &self,
+        bytes: &[u8],
+        install_cmd: &str,
+        install_arg: &str,
+        package_extension: &str,
+    ) -> Result<()> {
+        // Try different temp directories
+        let tmp_dir_locations = vec![
+            Box::new(|| Some(std::env::temp_dir())) as Box<dyn FnOnce() -> Option<PathBuf>>,
+            Box::new(dirs::cache_dir),
+            Box::new(|| Some(self.extract_path.parent().unwrap().to_path_buf())),
+        ];
+
+        // Try writing to multiple temp locations until one succeeds
+        for tmp_dir_location in tmp_dir_locations {
+            if let Some(path) = tmp_dir_location() {
+                let prefix = format!("tauri_{package_extension}_update");
+                if let Ok(tmp_dir) = tempfile::Builder::new().prefix(&prefix).tempdir_in(path) {
+                    let pkg_path = tmp_dir.path().join(format!("package.{package_extension}"));
+
+                    // Try writing the .deb / .rpm file
+                    if std::fs::write(&pkg_path, bytes).is_ok() {
+                        // If write succeeds, proceed with installation
+                        return self.try_install_with_privileges(&pkg_path, install_cmd, install_arg);
+                    }
+                    // If write fails, continue to next temp location
+                }
+            }
+        }
+
+        // If we get here, all temp locations failed
+        Err(Error::TempDirNotFound)
+    }
+
+    fn try_install_with_privileges(&self, pkg_path: &Path, install_cmd: &str, install_arg: &str) -> Result<()> {
+        // 1. First try using pkexec (graphical sudo prompt)
+        if let Ok(status) =
+            std::process::Command::new("pkexec").arg(install_cmd).arg(install_arg).arg(pkg_path).status()
+        {
+            if status.success() {
+                log::debug!("installed {pkg_path:?} with pkexec");
+                return Ok(());
+            }
+        }
+
+        // 2. Try zenity or kdialog for a graphical sudo experience
+        if let Ok(password) = self.get_password_graphically() {
+            if self.install_with_sudo(pkg_path, &password, install_cmd, install_arg)? {
+                log::debug!("installed {pkg_path:?} with GUI sudo");
+                return Ok(());
+            }
+        }
+
+        // 3. Final fallback: terminal sudo
+        let status = std::process::Command::new("sudo").arg(install_cmd).arg(install_arg).arg(pkg_path).status()?;
+
+        if status.success() {
+            log::debug!("installed {pkg_path:?} with sudo");
+            Ok(())
+        } else {
+            Err(Error::PackageInstallFailed)
+        }
+    }
+
+    fn get_password_graphically(&self) -> Result<String> {
+        // Try zenity first
+        let zenity_result = std::process::Command::new("zenity")
+            .args([
+                "--password",
+                "--title=Authentication Required",
+                "--text=Enter your password to install the update:",
+            ])
+            .output();
+
+        if let Ok(output) = zenity_result {
+            if output.status.success() {
+                return Ok(String::from_utf8_lossy(&output.stdout).trim().to_string());
+            }
+        }
+
+        // Fall back to kdialog if zenity fails or isn't available
+        let kdialog_result = std::process::Command::new("kdialog")
+            .args(["--password", "Enter your password to install the update:"])
+            .output();
+
+        if let Ok(output) = kdialog_result {
+            if output.status.success() {
+                return Ok(String::from_utf8_lossy(&output.stdout).trim().to_string());
+            }
+        }
+
+        Err(Error::AuthenticationFailed)
+    }
+
+    fn install_with_sudo(&self, pkg_path: &Path, password: &str, install_cmd: &str, install_arg: &str) -> Result<bool> {
+        use std::io::Write;
+        use std::process::{Command, Stdio};
+
+        let mut child = Command::new("sudo")
+            .arg("-S") // read password from stdin
+            .arg(install_cmd)
+            .arg(install_arg)
+            .arg(pkg_path)
+            .stdin(Stdio::piped())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()?;
+
+        if let Some(mut stdin) = child.stdin.take() {
+            // Write password to stdin
+            writeln!(stdin, "{password}")?;
+        }
+
+        let status = child.wait()?;
+        Ok(status.success())
+    }
+}
+
+/// MacOS
+#[cfg(target_os = "macos")]
+impl Update {
+    /// ### Expected structure:
+    /// ├── [AppName]_[version]_x64.app.tar.gz       # GZ generated by tauri-bundler
+    /// │   └──[AppName].app                         # Main application
+    /// │      └── Contents                          # Application contents...
+    /// │          └── ...
+    /// └── ...
+    fn install_inner(&self, bytes: &[u8]) -> Result<()> {
+        use flate2::read::GzDecoder;
+
+        let cursor = Cursor::new(bytes);
+        let mut extracted_files: Vec<PathBuf> = Vec::new();
+
+        // Create temp directories for backup and extraction
+        let tmp_backup_dir = tempfile::Builder::new().prefix("tauri_current_app").tempdir()?;
+
+        let tmp_extract_dir = tempfile::Builder::new().prefix("tauri_updated_app").tempdir()?;
+
+        let decoder = GzDecoder::new(cursor);
+        let mut archive = tar::Archive::new(decoder);
+
+        // Extract files to temporary directory
+        for entry in archive.entries()? {
+            let mut entry = entry?;
+            let collected_path: PathBuf = entry.path()?.iter().skip(1).collect();
+            let extraction_path = tmp_extract_dir.path().join(&collected_path);
+
+            // Ensure parent directories exist
+            if let Some(parent) = extraction_path.parent() {
+                std::fs::create_dir_all(parent)?;
+            }
+
+            if let Err(err) = entry.unpack(&extraction_path) {
+                // Cleanup on error
+                std::fs::remove_dir_all(tmp_extract_dir.path()).ok();
+                return Err(err.into());
+            }
+            extracted_files.push(extraction_path);
+        }
+
+        // Try to move the current app to backup
+        let move_result = std::fs::rename(&self.extract_path, tmp_backup_dir.path().join("current_app"));
+        let need_authorization = if let Err(err) = move_result {
+            if err.kind() == std::io::ErrorKind::PermissionDenied {
+                true
+            } else {
+                std::fs::remove_dir_all(tmp_extract_dir.path()).ok();
+                return Err(err.into());
+            }
+        } else {
+            false
+        };
+
+        if need_authorization {
+            log::debug!("app installation needs admin privileges");
+            // Use AppleScript to perform moves with admin privileges
+            let apple_script = format!(
+                "do shell script \"rm -rf '{src}' && mv -f '{new}' '{src}'\" with administrator privileges",
+                src = self.extract_path.display(),
+                new = tmp_extract_dir.path().display()
+            );
+
+            let (tx, rx) = std::sync::mpsc::channel();
+            let res = (self.run_on_main_thread)(Box::new(move || {
+                let mut script = osakit::Script::new_from_source(osakit::Language::AppleScript, &apple_script);
+                script.compile().expect("invalid AppleScript");
+                let r = script.execute();
+                tx.send(r).unwrap();
+            }));
+            let result = rx.recv().unwrap();
+
+            if res.is_err() || result.is_err() {
+                std::fs::remove_dir_all(tmp_extract_dir.path()).ok();
+                return Err(Error::Io(std::io::Error::new(
+                    std::io::ErrorKind::PermissionDenied,
+                    "Failed to move the new app into place",
+                )));
+            }
+        } else {
+            // Remove existing directory if it exists
+            if self.extract_path.exists() {
+                std::fs::remove_dir_all(&self.extract_path)?;
+            }
+            // Move the new app to the target path
+            std::fs::rename(tmp_extract_dir.path(), &self.extract_path)?;
+        }
+
+        let _ = std::process::Command::new("touch").arg(&self.extract_path).status();
+
+        Ok(())
+    }
+}
+
+/// Gets the base target string used by the updater. If bundle type is available it
+/// will be added to this string when selecting the download URL and signature.
+/// `tauri::utils::platform::bundle_type` method is used to obtain current bundle type.
+pub fn target() -> Option<String> {
+    if let (Some(target), Some(arch)) = (updater_os(), updater_arch()) {
+        Some(format!("{target}-{arch}"))
+    } else {
+        None
+    }
+}
+
+fn updater_os() -> Option<&'static str> {
+    if cfg!(target_os = "linux") {
+        Some("linux")
+    } else if cfg!(target_os = "macos") {
+        // TODO shouldn't this be macos instead?
+        Some("darwin")
+    } else if cfg!(target_os = "windows") {
+        Some("windows")
+    } else {
+        None
+    }
+}
+
+fn updater_arch() -> Option<&'static str> {
+    if cfg!(target_arch = "x86") {
+        Some("i686")
+    } else if cfg!(target_arch = "x86_64") {
+        Some("x86_64")
+    } else if cfg!(target_arch = "arm") {
+        Some("armv7")
+    } else if cfg!(target_arch = "aarch64") {
+        Some("aarch64")
+    } else if cfg!(target_arch = "riscv64") {
+        Some("riscv64")
+    } else {
+        None
+    }
+}
+
+pub fn extract_path_from_executable(executable_path: &Path) -> Result<PathBuf> {
+    // Return the path of the current executable by default
+    // Example C:\Program Files\My App\
+    let extract_path = executable_path.parent().map(PathBuf::from).ok_or(Error::FailedToDetermineExtractPath)?;
+
+    // MacOS example binary is in /Applications/TestApp.app/Contents/MacOS/myApp
+    // We need to get /Applications/<app>.app
+    // TODO(lemarier): Need a better way here
+    // Maybe we could search for <*.app> to get the right path
+    #[cfg(target_os = "macos")]
+    if extract_path.display().to_string().contains("Contents/MacOS") {
+        return extract_path
+            .parent()
+            .map(PathBuf::from)
+            .ok_or(Error::FailedToDetermineExtractPath)?
+            .parent()
+            .map(PathBuf::from)
+            .ok_or(Error::FailedToDetermineExtractPath);
+    }
+
+    Ok(extract_path)
+}
+
+impl<'de> Deserialize<'de> for RemoteRelease {
+    fn deserialize<D>(deserializer: D) -> std::result::Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        struct InnerRemoteRelease {
+            #[serde(alias = "name", deserialize_with = "parse_version")]
+            version: Version,
+            notes: Option<String>,
+            pub_date: Option<String>,
+            platforms: Option<HashMap<String, ReleaseManifestPlatform>>,
+            // dynamic platform response
+            url: Option<Url>,
+            signature: Option<String>,
+        }
+
+        let release = InnerRemoteRelease::deserialize(deserializer)?;
+
+        let pub_date = if let Some(date) = release.pub_date {
+            Some(
+                OffsetDateTime::parse(&date, &time::format_description::well_known::Rfc3339)
+                    .map_err(|e| DeError::custom(format!("invalid value for `pub_date`: {e}")))?,
+            )
+        } else {
+            None
+        };
+
+        Ok(RemoteRelease {
+            version: release.version,
+            notes: release.notes,
+            pub_date,
+            data: if let Some(platforms) = release.platforms {
+                RemoteReleaseInner::Static { platforms }
+            } else {
+                RemoteReleaseInner::Dynamic(ReleaseManifestPlatform {
+                    url: release
+                        .url
+                        .ok_or_else(|| DeError::custom("the `url` field was not set on the updater response"))?,
+                    signature: release
+                        .signature
+                        .ok_or_else(|| DeError::custom("the `signature` field was not set on the updater response"))?,
+                })
+            },
+        })
+    }
+}
+
+fn installer_for_bundle_type(bundle: Option<BundleType>) -> Option<Installer> {
+    match bundle? {
+        BundleType::Deb => Some(Installer::Deb),
+        BundleType::Rpm => Some(Installer::Rpm),
+        BundleType::AppImage => Some(Installer::AppImage),
+        BundleType::Msi => Some(Installer::Msi),
+        BundleType::Nsis => Some(Installer::Nsis),
+        BundleType::App => Some(Installer::App), // App is also returned for Dmg type
+        _ => None,
+    }
+}
+
+fn parse_version<'de, D>(deserializer: D) -> std::result::Result<Version, D::Error>
+where
+    D: serde::Deserializer<'de>,
+{
+    let str = String::deserialize(deserializer)?;
+
+    Version::from_str(str.trim_start_matches('v')).map_err(serde::de::Error::custom)
+}
+
+// Validate signature
+fn verify_signature(data: &[u8], release_signature: &str, pub_key: &str) -> Result<bool> {
+    // we need to convert the pub key
+    let pub_key_decoded = base64_to_string(pub_key)?;
+    let public_key = PublicKey::decode(&pub_key_decoded)?;
+    let signature_base64_decoded = base64_to_string(release_signature)?;
+    let signature = Signature::decode(&signature_base64_decoded)?;
+
+    // Validate signature or bail out
+    public_key.verify(data, &signature, true)?;
+    Ok(true)
+}
+
+fn base64_to_string(base64_string: &str) -> Result<String> {
+    let decoded_string = &base64::engine::general_purpose::STANDARD.decode(base64_string)?;
+    let result =
+        std::str::from_utf8(decoded_string).map_err(|_| Error::SignatureUtf8(base64_string.into()))?.to_string();
+    Ok(result)
+}
+
+#[cfg(windows)]
+fn encode_wide(string: impl AsRef<OsStr>) -> Vec<u16> {
+    use std::os::windows::ffi::OsStrExt;
+
+    string.as_ref().encode_wide().chain(std::iter::once(0)).collect()
+}
+
+#[cfg(windows)]
+trait PathExt {
+    fn wrap_in_quotes(&self) -> Self;
+}
+
+#[cfg(windows)]
+impl PathExt for PathBuf {
+    fn wrap_in_quotes(&self) -> Self {
+        let mut msi_path = OsString::from("\"");
+        msi_path.push(self.as_os_str());
+        msi_path.push("\"");
+        PathBuf::from(msi_path)
+    }
+}
+
+// adapted from https://github.com/rust-lang/rust/blob/1c047506f94cd2d05228eb992b0a6bbed1942349/library/std/src/sys/args/windows.rs#L174
+#[cfg(windows)]
+fn escape_nsis_current_exe_arg(arg: &&OsStr) -> String {
+    let arg = arg.to_string_lossy();
+    let mut cmd: Vec<char> = Vec::new();
+
+    // compared to std we additionally escape `/` so that nsis won't interpret them as a beginning of an nsis argument.
+    let quote = arg.chars().any(|c| c == ' ' || c == '\t' || c == '/') || arg.is_empty();
+    let escape = true;
+    if quote {
+        cmd.push('"');
+    }
+    let mut backslashes: usize = 0;
+    for x in arg.chars() {
+        if escape {
+            if x == '\\' {
+                backslashes += 1;
+            } else {
+                if x == '"' {
+                    // Add n+1 backslashes to total 2n+1 before internal '"'.
+                    cmd.extend((0..=backslashes).map(|_| '\\'));
+                }
+                backslashes = 0;
+            }
+        }
+        cmd.push(x);
+    }
+    if quote {
+        // Add n backslashes to total 2n before ending '"'.
+        cmd.extend((0..backslashes).map(|_| '\\'));
+        cmd.push('"');
+    }
+    cmd.into_iter().collect()
+}
+
+#[cfg(windows)]
+fn escape_msi_property_arg(arg: impl AsRef<OsStr>) -> String {
+    let mut arg = arg.as_ref().to_string_lossy().to_string();
+
+    // Otherwise this argument will get lost in ShellExecute
+    if arg.is_empty() {
+        return "\"\"\"\"".to_string();
+    } else if !arg.contains(' ') && !arg.contains('"') {
+        return arg;
+    }
+
+    if arg.contains('"') {
+        arg = arg.replace('"', r#""""""#);
+    }
+
+    if arg.starts_with('-') {
+        if let Some((a1, a2)) = arg.split_once('=') {
+            format!("{a1}=\"\"{a2}\"\"")
+        } else {
+            format!("\"\"{arg}\"\"")
+        }
+    } else {
+        format!("\"\"{arg}\"\"")
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    // Public test vector from minisign-verify 0.2.5 (MIT); no production key material.
+    #[test]
+    fn offline_restore_verifies_signature_and_rejects_tampered_bytes() {
+        use super::*;
+        use base64::Engine;
+        let encode = |s: &str| base64::engine::general_purpose::STANDARD.encode(s);
+        let key = encode("untrusted comment: minisign public key E7620F1842B4E81F\nRWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3");
+        let signature = encode("untrusted comment: signature from minisign secret key\nRUQf6LRCGA9i559r3g7V1qNyJDApGip8MfqcadIgT9CuhV3EMhHoN1mGTkUidF/z7SrlQgXdy8ofjb7bNJJylDOocrCo8KLzZwo=\ntrusted comment: timestamp:1633700835\tfile:test\tprehashed\nwLMDjy9FLAuxZ3q4NlEvkgtyhrr0gtTu6KC4KBJdITbbOeAi1zBIYo0v4iTgt8jJpIidRJnp94ABQkJAgAooBQ==");
+        let updater = Updater {
+            run_on_main_thread: Arc::new(Box::new(|_| Ok(()))),
+            config: Config { pubkey: key, ..Default::default() },
+            app_name: "DBX test".into(),
+            current_version: Version::new(1, 0, 0),
+            version_comparator: None,
+            timeout: None,
+            proxy: None,
+            no_proxy: true,
+            endpoints: vec![],
+            arch: std::env::consts::ARCH,
+            target: Some("test-target".into()),
+            headers: HeaderMap::new(),
+            extract_path: PathBuf::from("runtime-path"),
+            on_before_exit: None,
+            configure_client: None,
+            installer_args: vec![],
+            current_exe_args: vec![],
+        };
+        let manifest = serde_json::json!({ "version": "2.0.0", "notes": "cached notes", "platforms": { "test-target": { "url": "https://invalid.test/package", "signature": signature } } });
+        // No endpoints and no runtime make network/main-thread calls impossible here.
+        let update = updater.restore_update(manifest.clone()).unwrap().unwrap();
+        assert_eq!(update.extract_path, PathBuf::from("runtime-path"));
+        assert_eq!(update.version, "2.0.0");
+        update.verify(b"test").unwrap();
+        assert!(update.verify(b"tampered").is_err());
+        let mut incompatible = manifest.clone();
+        incompatible["platforms"] = serde_json::json!({});
+        assert!(updater.restore_update(incompatible).is_err());
+        let mut older = manifest;
+        older["version"] = serde_json::json!("0.9.0");
+        assert!(updater.restore_update(older).unwrap().is_none());
+    }
+
+    #[test]
+    #[cfg(windows)]
+    fn it_wraps_correctly() {
+        use super::PathExt;
+        use std::path::PathBuf;
+
+        assert_eq!(
+            PathBuf::from("C:\\Users\\Some User\\AppData\\tauri-example.exe").wrap_in_quotes(),
+            PathBuf::from("\"C:\\Users\\Some User\\AppData\\tauri-example.exe\"")
+        )
+    }
+
+    #[test]
+    #[cfg(windows)]
+    fn it_escapes_correctly_for_msi() {
+        use crate::updater::escape_msi_property_arg;
+
+        // Explanation for quotes:
+        // The output of escape_msi_property_args() will be used in `LAUNCHAPPARGS=\"{HERE}\"`. This is the first quote level.
+        // To escape a quotation mark we use a second quotation mark, so "" is interpreted as " later.
+        // This means that the escaped strings can't ever have a single quotation mark!
+        // Now there are 3 major things to look out for to not break the msiexec call:
+        //   1) Wrap spaces in quotation marks, otherwise it will be interpreted as the end of the msiexec argument.
+        //   2) Escape escaping quotation marks, otherwise they will either end the msiexec argument or be ignored.
+        //   3) Escape emtpy args in quotation marks, otherwise the argument will get lost.
+        let cases = [
+            "something",
+            "--flag",
+            "--empty=",
+            "--arg=value",
+            "some space",                     // This simulates `./my-app "some string"`.
+            "--arg value", // -> This simulates `./my-app "--arg value"`. Same as above but it triggers the startsWith(`-`) logic.
+            "--arg=unwrapped space", // `./my-app --arg="unwrapped space"`
+            "--arg=\"wrapped\"", // `./my-app --args=""wrapped""`
+            "--arg=\"wrapped space\"", // `./my-app --args=""wrapped space""`
+            "--arg=midword\"wrapped space\"", // `./my-app --args=midword""wrapped""`
+            "",            // `./my-app '""'`
+        ];
+        let cases_escaped = [
+            "something",
+            "--flag",
+            "--empty=",
+            "--arg=value",
+            "\"\"some space\"\"",
+            "\"\"--arg value\"\"",
+            "--arg=\"\"unwrapped space\"\"",
+            r#"--arg=""""""wrapped"""""""#,
+            r#"--arg=""""""wrapped space"""""""#,
+            r#"--arg=""midword""""wrapped space"""""""#,
+            "\"\"\"\"",
+        ];
+
+        // Just to be sure we didn't mess that up
+        assert_eq!(cases.len(), cases_escaped.len());
+
+        for (orig, escaped) in cases.iter().zip(cases_escaped) {
+            assert_eq!(escape_msi_property_arg(orig), escaped);
+        }
+    }
+
+    #[test]
+    #[cfg(windows)]
+    fn it_escapes_correctly_for_nsis() {
+        use crate::updater::escape_nsis_current_exe_arg;
+        use std::ffi::OsStr;
+
+        let cases = [
+            "something",
+            "--flag",
+            "--empty=",
+            "--arg=value",
+            "some space",                     // This simulates `./my-app "some string"`.
+            "--arg value", // -> This simulates `./my-app "--arg value"`. Same as above but it triggers the startsWith(`-`) logic.
+            "--arg=unwrapped space", // `./my-app --arg="unwrapped space"`
+            "--arg=\"wrapped\"", // `./my-app --args=""wrapped""`
+            "--arg=\"wrapped space\"", // `./my-app --args=""wrapped space""`
+            "--arg=midword\"wrapped space\"", // `./my-app --args=midword""wrapped""`
+            "",            // `./my-app '""'`
+        ];
+        // Note: These may not be the results we actually want (monitor this!).
+        // We only make sure the implementation doesn't unintentionally change.
+        let cases_escaped = [
+            "something",
+            "--flag",
+            "--empty=",
+            "--arg=value",
+            "\"some space\"",
+            "\"--arg value\"",
+            "\"--arg=unwrapped space\"",
+            "--arg=\\\"wrapped\\\"",
+            "\"--arg=\\\"wrapped space\\\"\"",
+            "\"--arg=midword\\\"wrapped space\\\"\"",
+            "\"\"",
+        ];
+
+        // Just to be sure we didn't mess that up
+        assert_eq!(cases.len(), cases_escaped.len());
+
+        for (orig, escaped) in cases.iter().zip(cases_escaped) {
+            assert_eq!(escape_nsis_current_exe_arg(&OsStr::new(orig)), escaped);
+        }
+    }
+}
diff --git a/vendor/tauri-plugin-updater/tsconfig.json b/vendor/tauri-plugin-updater/tsconfig.json
new file mode 100644
index 0000000000..5098169aa9
--- /dev/null
+++ b/vendor/tauri-plugin-updater/tsconfig.json
@@ -0,0 +1,4 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["guest-js/*.ts"]
+}