diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..959d097
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,41 @@
+name: ci
+
+on: [push, pull_request]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v5
+    - name: Formatting checks
+      run: cargo fmt --all -- --check
+    - name: Clippy checks
+      run: cargo clippy --all-targets -- -D clippy::all -D clippy::cargo  -A clippy::multiple-crate-versions
+    - name: Build
+      run: cargo build --verbose
+    - name: Run tests
+      run: cargo test --verbose
+
+# Recommended pipeline if using advisories, to avoid sudden breakages
+# From: https://github.com/EmbarkStudios/cargo-deny-action
+  cargo-deny:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        checks:
+          - advisories
+          - bans licenses sources
+
+    # Prevent sudden announcement of a new advisory from failing ci:
+    continue-on-error: ${{ matrix.checks == 'advisories' }}
+
+    steps:
+    - uses: actions/checkout@v4
+    - uses: EmbarkStudios/cargo-deny-action@v2
+      with:
+        command: check ${{ matrix.checks }}
diff --git a/.gitignore b/.gitignore
index ad67955..f655827 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,3 +19,6 @@ target
 #  and can be added to the global gitignore or merged into this file.  For a more nuclear
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
 #.idea/
+
+coverage.xml
+*.cbor
\ No newline at end of file
diff --git a/Cargo.lock b/Cargo.lock
new file mode 100644
index 0000000..4b99ac8
--- /dev/null
+++ b/Cargo.lock
@@ -0,0 +1,3271 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
+[[package]]
+name = "assert-json-diff"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e4f2b81832e72834d7518d8487a0396a28cc408186a2e8854c0f98011faf12"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "async-lock"
+version = "3.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
+dependencies = [
+ "event-listener",
+ "event-listener-strategy",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-object-pool"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1ac0219111eb7bb7cb76d4cf2cb50c598e7ae549091d3616f9e95442c18486f"
+dependencies = [
+ "async-lock",
+ "event-listener",
+]
+
+[[package]]
+name = "async-trait"
+version = "0.1.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "aws-lc-rs"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00"
+dependencies = [
+ "aws-lc-sys",
+ "untrusted 0.7.1",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+]
+
+[[package]]
+name = "base64"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64-serde"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77c6d128af408d8ebd08331f0331cf2cf20d19e6c44a7aec58791641ecc8c0b5"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "bs58"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "cbor-codec"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e083a023562b37c52837e850131a51b1154cceb9d149f41ee3d386737b140f46"
+dependencies = [
+ "byteorder",
+ "libc",
+]
+
+[[package]]
+name = "cc"
+version = "1.2.64"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dad887fd958be91b5098c0248def011f4523ab786cd411be668777e55063501f"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "ccatoken"
+version = "0.1.0"
+source = "git+https://github.com/veraison/rust-ccatoken.git#870c83f83c9690643c4eb8e5986ef1a4779fc596"
+dependencies = [
+ "base64 0.21.7",
+ "bitflags 2.13.0",
+ "ciborium",
+ "clap",
+ "cose-rust",
+ "ear",
+ "hex",
+ "hex-literal",
+ "jsonwebtoken",
+ "multimap",
+ "openssl",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "iana-time-zone",
+ "num-traits",
+ "serde",
+ "windows-link",
+]
+
+[[package]]
+name = "ciborium"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42e69ffd6f0917f5c029256a24d0161db17cea3997d185db0d35926308770f0e"
+dependencies = [
+ "ciborium-io",
+ "ciborium-ll",
+ "serde",
+]
+
+[[package]]
+name = "ciborium-io"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05afea1e0a06c9be33d539b876f1ce3692f4afea2cb41f740e7743225ed1c757"
+
+[[package]]
+name = "ciborium-ll"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57663b653d948a338bfb3eeba9bb2fd5fcfaecb9e199e87e1eda4d9e8b240fd9"
+dependencies = [
+ "ciborium-io",
+ "half",
+]
+
+[[package]]
+name = "clap"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "cmw"
+version = "0.1.0"
+source = "git+https://github.com/veraison/rust-cmw#9c64abd29195a05ae59b57ae21eef3da89b8e3ee"
+dependencies = [
+ "base64 0.22.1",
+ "base64-serde",
+ "bitflags 1.3.2",
+ "hex",
+ "iri-string",
+ "lazy_static",
+ "mime",
+ "minicbor 1.1.0",
+ "minicbor-serde",
+ "once_cell",
+ "regex",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "simple_asn1",
+ "thiserror 2.0.18",
+ "xml-rs",
+]
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cose-rust"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a140f41f55ff1f2126aed96961bad2387ae31d7f9bbd0e98ec888073beaac6f"
+dependencies = [
+ "cbor-codec",
+ "openssl",
+ "rand 0.8.6",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+
+[[package]]
+name = "crunchy"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "darling"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
+[[package]]
+name = "ear"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5aec2877d084955915f48086ae07f49f4c89e33e3826d1f7af33b342274f8100"
+dependencies = [
+ "base64 0.22.1",
+ "ciborium",
+ "cose-rust",
+ "hex",
+ "jsonwebtoken",
+ "lazy_static",
+ "openssl",
+ "phf",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "env_filter"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e90c2accc4b07a8456ea0debdc2e7587bdd890680d71173a15d4ae604f6eef"
+dependencies = [
+ "log",
+ "regex",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.11.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0621c04f2196ac3f488dd583365b9c09be011a4ab8b9f37248ffcc8f6198b56a"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "env_filter",
+ "jiff",
+ "log",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "event-listener"
+version = "5.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+dependencies = [
+ "concurrent-queue",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event-listener-strategy"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
+dependencies = [
+ "event-listener",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-timer"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af43fadb8a98512d547e37b4e92e0ced13e205c061b87b4623eff01d918d6968"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "wasip2",
+ "wasip3",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "171fefbc92fe4a4de27e0698d6a5b392d6a0e333506bc49133760b3bcf948733"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap 2.14.0",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "half"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
+dependencies = [
+ "cfg-if",
+ "crunchy",
+ "zerocopy",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "headers"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3314d5adb5d94bcdf56771f2e50dbbc80bb4bdf88967526706205ac9eff24eb"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "headers-core",
+ "http",
+ "httpdate",
+ "mime",
+ "sha1",
+]
+
+[[package]]
+name = "headers-core"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54b4a22553d4242c49fddb9ba998a99962b5cc6f22cb5a3482bec22522403ce4"
+dependencies = [
+ "http",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "hex-literal"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fe2267d4ed49bc07b63801559be28c718ea06c4738b7a03c94df7386d2cde46"
+
+[[package]]
+name = "http"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "httpmock"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf4888a4d02d8e1f92ffb6b4965cf5ff56dda36ef41975f41c6fa0f6bde78c4e"
+dependencies = [
+ "assert-json-diff",
+ "async-object-pool",
+ "async-trait",
+ "base64 0.22.1",
+ "bytes",
+ "crossbeam-utils",
+ "form_urlencoded",
+ "futures-timer",
+ "futures-util",
+ "headers",
+ "http",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "path-tree",
+ "regex",
+ "serde",
+ "serde_json",
+ "serde_regex",
+ "similar",
+ "stringmetrics",
+ "tabwriter",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "hyper"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots",
+]
+
+[[package]]
+name = "hyper-tls"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
+dependencies = [
+ "bytes",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "system-configuration",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "windows-registry",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_properties"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+
+[[package]]
+name = "icu_provider"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+
+[[package]]
+name = "iri-string"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25e659a4bb38e810ebc252e53b5814ff908a8c58c2a9ce2fae1bbec24cbf4e20"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "jiff"
+version = "0.2.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4603d3033e49e2b0e31229fcab20a5d40089c607d975cd9c80551dc69eed9102"
+dependencies = [
+ "jiff-static",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "782d32378dddf207193ac91cefb848ad41abb58195c95168e1291227a0832b47"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
+dependencies = [
+ "getrandom 0.3.4",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2025f20d7a4fa7785846e7b63d10a76d3f1cee98ee5cb79ea59703f95e42162"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "jsonwebtoken"
+version = "10.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eba32bfb4ffdeaca3e34431072faf01745c9b26d25504aa7a6cf5684334fc4fc"
+dependencies = [
+ "aws-lc-rs",
+ "base64 0.22.1",
+ "getrandom 0.2.17",
+ "js-sys",
+ "pem",
+ "serde",
+ "serde_json",
+ "signature",
+ "simple_asn1",
+ "zeroize",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+
+[[package]]
+name = "log"
+version = "0.4.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "953f07c43838f8e6f9758cab68bf5bed85465e7587ebe0b823f1bcd81978ad3a"
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "memchr"
+version = "2.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "minicbor"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "734daad4ff3b880f23dc2a675dd74553fa8e583367aa7523f96a16e96a516b62"
+dependencies = [
+ "minicbor-derive",
+]
+
+[[package]]
+name = "minicbor"
+version = "2.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b7a5041e12946f8b7d3f5a9d96383a19d694b9335457c522be7815b9abafb02"
+
+[[package]]
+name = "minicbor-derive"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "512ce2c37128698ea15c99b3518936c78a8b112b92468e7b95b9fa045666ebd8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "minicbor-serde"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80047f75e28e3b38f6ab2ec3c2c7669f6b411fa6f8424e1a90a3fd784b19a3f4"
+dependencies = [
+ "minicbor 2.2.2",
+ "serde",
+]
+
+[[package]]
+name = "mio"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "multimap"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1a5d38b9b352dbd913288736af36af41c48d61b1a8cd34bcecd727561b7d511"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "native-tls"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "465500e14ea162429d264d44189adc38b199b62b1c21eea9f69e4b73cb03bbf2"
+dependencies = [
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework",
+ "security-framework-sys",
+ "tempfile",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "openssl"
+version = "0.10.80"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a45fa2aa886c42762255da344f0a0d313e254066c46aad76f300c3d3da62d967"
+dependencies = [
+ "bitflags 2.13.0",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "openssl-src"
+version = "300.6.1+3.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46eb8fb9fb3b61ce1c0f8a026c4c1a0714d3a9e138e7fbde78753ce2babc3846"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.116"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f28a22dc7140cda5f096e5e7724a6962ca81a7f8bfd2979f9b18c11af56318c4"
+dependencies = [
+ "cc",
+ "libc",
+ "openssl-src",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
+[[package]]
+name = "path-tree"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a97453bc21a968f722df730bfe11bd08745cb50d1300b0df2bda131dece136"
+dependencies = [
+ "smallvec",
+]
+
+[[package]]
+name = "pem"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
+dependencies = [
+ "base64 0.22.1",
+ "serde_core",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "phf"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+dependencies = [
+ "phf_macros",
+ "phf_shared",
+ "serde",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+dependencies = [
+ "fastrand",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
+dependencies = [
+ "portable-atomic",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+dependencies = [
+ "bytes",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand 0.9.4",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.18",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.60.2",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "regex"
+version = "1.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "regl"
+version = "0.1.0"
+dependencies = [
+ "base64 0.22.1",
+ "ccatoken",
+ "ciborium",
+ "clap",
+ "cmw",
+ "env_logger",
+ "httpmock",
+ "log",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "tempfile",
+ "thiserror 2.0.18",
+ "url",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "encoding_rs",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-tls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "mime",
+ "native-tls",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-native-tls",
+ "tokio-rustls",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "webpki-roots",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted 0.9.0",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags 2.13.0",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
+dependencies = [
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted 0.9.0",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "schemars"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags 2.13.0",
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.150"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_regex"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bafc8d0c5330cecff10f16b459b479fd9acaa5b4acd7167301414e21b0057012"
+dependencies = [
+ "regex",
+ "serde",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_with"
+version = "3.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76a5c54c7310e7b8b9577c286d7e399ddd876c3e12b3ed917a8aabc4b96e9e8c"
+dependencies = [
+ "base64 0.22.1",
+ "bs58",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.14.0",
+ "schemars 0.9.0",
+ "schemars 1.2.1",
+ "serde_core",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "84d57bc0c8b9a17920c178daa6bb924850d54a9c97ab45194bb8c17ad66bb660"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "similar"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbbb5d9659141646ae647b42fe094daf6c6192d1620870b449d9557f748b2daa"
+
+[[package]]
+name = "simple_asn1"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d585997b0ac10be3c5ee635f1bab02d512760d14b7c468801ac8a01d9ae5f1d"
+dependencies = [
+ "num-bigint",
+ "num-traits",
+ "thiserror 2.0.18",
+ "time",
+]
+
+[[package]]
+name = "siphasher"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "socket2"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "stringmetrics"
+version = "2.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b3c8667cd96245cbb600b8dec5680a7319edd719c5aa2b5d23c6bff94f39765"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
+dependencies = [
+ "bitflags 2.13.0",
+ "core-foundation 0.9.4",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "tabwriter"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fce91f2f0ec87dff7e6bcbbeb267439aa1188703003c6055193c821487400432"
+dependencies = [
+ "unicode-width",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.2",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl 2.0.18",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "time"
+version = "0.3.48"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1aa89044e7786ffb2ec017acb22cb7de5b0be46d0f21aea2b224b8561e5db2"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d3bfe86347f0cc659f586f01e26303ccd32418f26f30c7b0309b3ca3a07d695"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.52.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tokio-native-tls"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
+dependencies = [
+ "native-tls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags 2.13.0",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.3+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
+dependencies = [
+ "wit-bindgen 0.57.1",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen 0.51.0",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.123"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a254a4b10c19a76f09a27640e7ffbf9bc30bf67e16a3bf28aaefa4920fe81563"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.73"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54568702fabf5d4849ce2b90fadfa64168a097eaf4b351ce9df8b687a0086aaf"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.123"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24a40fc75b0ec6f3746ceb10d36f53a93dcd68a93b11b6445983945d79eba0dc"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.123"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "908f34bd9b9ce3d4caf07b72dfab63d61504d156856c6bd3cd87fa350cf3985b"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.123"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7acbf7616c27b194bbb550bf77ed0c2c3e5b7fd1260a93082b95fb7f47959b92"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap 2.14.0",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags 2.13.0",
+ "hashbrown 0.15.5",
+ "indexmap 2.14.0",
+ "semver",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e0871acf327f283dc6da28a1696cdc64fb355ba9f935d052021fa77f35cce69"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52f5ee44c96cf55f1b349600768e3ece3a8f26010c05265ab73f945bb1a2eb9d"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm 0.52.6",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.53.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
+dependencies = [
+ "windows-link",
+ "windows_aarch64_gnullvm 0.53.1",
+ "windows_aarch64_msvc 0.53.1",
+ "windows_i686_gnu 0.53.1",
+ "windows_i686_gnullvm 0.53.1",
+ "windows_i686_msvc 0.53.1",
+ "windows_x86_64_gnu 0.53.1",
+ "windows_x86_64_gnullvm 0.53.1",
+ "windows_x86_64_msvc 0.53.1",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
+
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap 2.14.0",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags 2.13.0",
+ "indexmap 2.14.0",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap 2.14.0",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+
+[[package]]
+name = "xml-rs"
+version = "0.8.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ae8337f8a065cfc972643663ea4279e04e7256de865aa66fe25cec5fb912d3f"
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerotrie"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/Cargo.toml b/Cargo.toml
new file mode 100644
index 0000000..3c33da1
--- /dev/null
+++ b/Cargo.toml
@@ -0,0 +1,27 @@
+[package]
+name = "regl"
+version = "0.1.0"
+edition = "2024"
+description = "Rust Evidence Generation Library — collects attestation evidence from TEE platforms"
+license = "Apache-2.0"
+repository = "https://github.com/veraison/rust-regl"
+keywords = ["cca", "attestation", "arm", "evidence", "tee"]
+categories = ["hardware-support", "cryptography"]
+
+[dependencies]
+thiserror = "2.0.18"
+tempfile = "3"
+ccatoken = { git = "https://github.com/veraison/rust-ccatoken.git" }
+cmw = { git = "https://github.com/veraison/rust-cmw" }
+reqwest = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls"] }
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"
+base64 = { version = "0.22", features = ["alloc"] }
+ciborium = "0.2"
+url = "2"
+
+[dev-dependencies]
+log = "0.4.29"
+env_logger = "0.11.10"
+clap = { version = "4.6.1", features = ["derive"] }
+httpmock = "0.8"
diff --git a/README.md b/README.md
index fbf6965..c64f89c 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,106 @@
 # rust-regl
-Evidence generation library in Rust
+
+Rust Evidence Generation Library (REGL) — collects attestation evidence from TEE platforms.
+
+## Attesters
+
+| Attester | Struct | Backend | Description |
+|---|---|---|---|
+| `cca-tsm` | `CcaTsmAttester` | Linux TSM (`/sys/kernel/config/tsm`) | Talks directly to the kernel TSM interface on Arm CCA hardware. Requires root or write access to configfs-tsm. |
+| `cca-ratsd` | `CcaRatsdAttester` | RATSD daemon | Posts a challenge to a [RATSD](https://github.com/veraison/ratsd) daemon, then parses the CMW envelope to extract the Arm CCA attestation token. "CCA-specific" means it knows how to find and decode CCA evidence inside the CMW — it looks for items whose content type contains `configfs-tsm` and whose provider is `arm_cca_guest`. |
+| `cca-sim` | `CcaSimulatedAttester` | Embedded blob | Returns a pre-built CCA token embedded at compile time. Useful for testing and development without hardware or a running RATSD. |
+| `ratsd` | `RatsdAttester` | RATSD daemon (generic) | Posts a challenge to a RATSD daemon and returns the raw JSON response as-is. No TEE-specific parsing — use this if you want the CMW envelope or other RATSD-level data directly. |
+
+## Usage
+
+```rust
+use regl::attesters::{cca, ratsd, Attester};
+use url::Url;
+
+// Generic RATSD — explicit URL required
+let url = Url::parse("http://localhost:8895").unwrap();
+let attester = ratsd::RatsdAttester::with_url(url);
+let response: Vec<u8> = attester.get_evidence(&challenge).unwrap();
+
+// CCA-specific RATSD — parses CMW envelope, returns CCA token bytes
+let url = Url::parse("http://localhost:8895").unwrap();
+let attester = cca::CcaRatsdAttester::with_url(url);
+let evidence = attester.get_evidence(&challenge).unwrap();
+
+// TSM-backed attester (requires Linux CCA TSM hardware and root/sudo)
+let attester = cca::CcaTsmAttester::default();
+let evidence = attester.get_evidence(&challenge).unwrap();
+```
+
+> **Note:** The library itself does not read environment variables. The
+> `RATSD_URL` env var is resolved only in the example binaries
+> (`examples/attester.rs`) for convenience — they fall back to
+> `http://localhost:8895` if the variable is not set. Production code
+> should pass an explicit `Url` via `with_url()`.
+
+> **Note:** If a system HTTP proxy is configured, set `NO_PROXY=localhost`
+> to prevent requests to the local RATSD daemon from being routed through
+> the proxy.
+
+## Prerequisites
+
+### RATSD (for `cca-ratsd` and `ratsd` attesters)
+
+A running [RATSD](https://github.com/veraison/ratsd) daemon is required.
+
+1. Clone and build RATSD:
+   ```sh
+   git clone https://github.com/veraison/ratsd.git
+   cd ratsd
+   make build
+   ```
+
+2. Start RATSD (requires root for configfs-tsm access):
+   ```sh
+   sudo ./ratsd --config config.yaml
+   ```
+
+   RATSD listens on `http://localhost:8895` by default.
+
+> **Note:** RATSD must be running on a machine with TSM hardware support
+> (Arm CCA-capable platform with `/sys/kernel/config/tsm/report`).
+> The RATSD daemon dispatches evidence requests to its TSM plugin, which
+> talks to the Linux kernel TSM interface. Without CCA hardware, the TSM
+> plugin will fail and REGL will receive an HTTP 500 error from RATSD.
+
+### TSM (for `cca-tsm` attester)
+
+The `cca-tsm` attester talks directly to `/sys/kernel/config/tsm/report` and
+requires root privileges (or write access granted via udev rules).
+
+## Examples
+
+```sh
+# CCA evidence via RATSD (requires a running RATSD daemon)
+NO_PROXY=localhost RATSD_URL=http://localhost:8895 \
+  cargo run --example attester -- --attester cca-ratsd --out evidence.cbor
+
+# CCA evidence via RATSD and pretty-print the decoded token
+NO_PROXY=localhost RATSD_URL=http://localhost:8895 \
+  cargo run --example attester -- --attester cca-ratsd --out evidence.cbor --print
+
+# CCA simulated evidence (no hardware needed)
+cargo run --example attester -- --attester cca-sim --out evidence.cbor
+
+# CCA evidence via TSM (requires CCA hardware and root)
+sudo cargo run --example tsm -- --out tsm-evidence.cbor
+```
+
+Set `RUST_LOG=info` to see progress logs from the attester.
+
+## Utilities
+
+`regl::attesters::cca::utils` provides CCA evidence decoding and pretty-printing:
+
+- `decode::decode_cca_token()` — decode raw CBOR evidence to typed Rust structs
+- `print::pretty_print_token()` — decode and format the evidence as JSON
+- `types` — serde-enabled CCA evidence structs with human-readable field names
+
+## License
+
+Apache-2.0
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000..7e684b8
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,249 @@
+# This template contains all of the possible sections and their default values
+
+# Note that all fields that take a lint level have these possible values:
+# * deny - An error will be produced and the check will fail
+# * warn - A warning will be produced, but the check will not fail
+# * allow - No warning or error will be produced, though in some cases a note
+# will be
+
+# The values provided in this template are the default values that will be used
+# when any section or field is not specified in your own configuration
+
+# Root options
+[graph]
+# If 1 or more target triples (and optionally, target_features) are specified,
+# only the specified targets will be checked when running `cargo deny check`.
+# This means, if a particular package is only ever used as a target specific
+# dependency, such as, for example, the `nix` crate only being used via the
+# `target_family = "unix"` configuration, that only having windows targets in
+# this list would mean the nix crate, as well as any of its exclusive
+# dependencies not shared by any other crates, would be ignored, as the target
+# list here is effectively saying which targets you are building for.
+targets = [
+    # The triple can be any string, but only the target triples built in to
+    # rustc (as of 1.40) can be checked against actual config expressions
+    #{ triple = "x86_64-unknown-linux-musl" },
+    # You can also specify which target_features you promise are enabled for a
+    # particular target. target_features are currently not validated against
+    # the actual valid features supported by the target architecture.
+    #{ triple = "wasm32-unknown-unknown", features = ["atomics"] },
+]
+# When creating the dependency graph used as the source of truth when checks are
+# executed, this field can be used to prune crates from the graph, removing them
+# from the view of cargo-deny. This is an extremely heavy hammer, as if a crate
+# is pruned from the graph, all of its dependencies will also be pruned unless
+# they are connected to another crate in the graph that hasn't been pruned,
+# so it should be used with care. The identifiers are [Package ID Specifications]
+# (https://doc.rust-lang.org/cargo/reference/pkgid-spec.html)
+#exclude = []
+# If true, metadata will be collected with `--all-features`. Note that this can't
+# be toggled off if true, if you want to conditionally enable `--all-features` it
+# is recommended to pass `--all-features` on the cmd line instead
+all-features = false
+# If true, metadata will be collected with `--no-default-features`. The same
+# caveat with `all-features` applies
+no-default-features = false
+# If set, these feature will be enabled when collecting metadata. If `--features`
+# is specified on the cmd line they will take precedence over this option.
+#features = []
+
+# This section is considered when running `cargo deny check advisories`
+# More documentation for the advisories section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
+[advisories]
+# The path where the advisory database is cloned/fetched into
+db-path = "~/.cargo/advisory-db"
+# The url(s) of the advisory databases to use
+db-urls = ["https://github.com/rustsec/advisory-db"]
+# The lint level for unmaintained crates
+unmaintained = "workspace"
+# The lint level for crates that have been yanked from their source registry
+yanked = "warn"
+# A list of advisory IDs to ignore. Note that ignored advisories will still
+# output a note when they are encountered.
+ignore = [
+# NOTE: This is a TEMPORARY recognition of the cbindgen use of clap+atty that
+# requires clap to update its dependencies
+    #"RUSTSEC-2021-0145",
+    "RUSTSEC-2026-0009",
+]
+# Threshold for security vulnerabilities, any vulnerability with a CVSS score
+# lower than the range specified will be ignored. Note that ignored advisories
+# will still output a note when they are encountered.
+# * None - CVSS Score 0.0
+# * Low - CVSS Score 0.1 - 3.9
+# * Medium - CVSS Score 4.0 - 6.9
+# * High - CVSS Score 7.0 - 8.9
+# * Critical - CVSS Score 9.0 - 10.0
+#severity-threshold =
+
+# If this is true, then cargo deny will use the git executable to fetch advisory database.
+# If this is false, then it uses a built-in git library.
+# Setting this to true can be helpful if you have special authentication requirements that cargo-deny does not support.
+# See Git Authentication for more information about setting up git authentication.
+#git-fetch-with-cli = true
+
+# This section is considered when running `cargo deny check licenses`
+# More documentation for the licenses section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
+[licenses]
+# List of explicitly allowed licenses
+# See https://spdx.org/licenses/ for list of possible licenses
+# [possible values: any SPDX 3.11 short identifier (+ optional exception)].
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "BSD-3-Clause",
+    "ISC",
+    "Unicode-3.0",
+    "Zlib",
+    "MIT-0",
+    "CDLA-Permissive-2.0",
+    "BlueOak-1.0.0",
+    #"Apache-2.0 WITH LLVM-exception",
+    # Considered Copyleft, but permitted in this project
+    "MPL-2.0",
+]
+# The confidence threshold for detecting a license from license text.
+# The higher the value, the more closely the license text must be to the
+# canonical license text of a valid SPDX license file.
+# [possible values: any between 0.0 and 1.0].
+confidence-threshold = 0.8
+# Allow 1 or more licenses on a per-crate basis, so that particular licenses
+# aren't accepted for every possible crate as with the normal allow list
+exceptions = [
+    # Each entry is the crate and version constraint, and its specific allow
+    # list
+    #{ allow = ["Zlib"], name = "adler32", version = "*" },
+]
+
+# Some crates don't have (easily) machine readable licensing information,
+# adding a clarification entry for it allows you to manually specify the
+# licensing information
+[[licenses.clarify]]
+# The name of the crate the clarification applies to
+name = "ring"
+# The optional version constraint for the crate
+version = "*"
+# The SPDX expression for the license requirements of the crate
+expression = "MIT AND ISC AND OpenSSL"
+# One or more files in the crate's source used as the "source of truth" for
+# the license expression. If the contents match, the clarification will be used
+# when running the license check, otherwise the clarification will be ignored
+# and the crate will be checked normally, which may produce warnings or errors
+# depending on the rest of your configuration
+license-files = [
+    # Each entry is a crate relative path, and the (opaque) hash of its contents
+    { path = "LICENSE", hash = 0xbd0eed23 }
+]
+
+[licenses.private]
+# If true, ignores workspace crates that aren't published, or are only
+# published to private registries.
+# To see how to mark a crate as unpublished (to the official registry),
+# visit https://doc.rust-lang.org/cargo/reference/manifest.html#the-publish-field.
+ignore = false
+# One or more private registries that you might publish crates to, if a crate
+# is only published to private registries, and ignore is true, the crate will
+# not have its license(s) checked
+registries = [
+    #"https://sekretz.com/registry
+]
+
+# This section is considered when running `cargo deny check bans`.
+# More documentation about the 'bans' section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
+[bans]
+# Lint level for when multiple versions of the same crate are detected
+# NOTE: Veraison has unusually complex dependencies across platforms
+# Explicitly allowing duplicates here TEMPORARILY.
+multiple-versions = "allow"
+# Lint level for when a crate version requirement is `*`
+wildcards = "allow"
+# The graph highlighting used when creating dotgraphs for crates
+# with multiple versions
+# * lowest-version - The path to the lowest versioned duplicate is highlighted
+# * simplest-path - The path to the version with the fewest edges is highlighted
+# * all - Both lowest-version and simplest-path are used
+highlight = "all"
+# The default lint level for `default` features for crates that are members of
+# the workspace that is being checked. This can be overriden by allowing/denying
+# `default` on a crate-by-crate basis if desired.
+workspace-default-features = "allow"
+# The default lint level for `default` features for external crates that are not
+# members of the workspace. This can be overriden by allowing/denying `default`
+# on a crate-by-crate basis if desired.
+external-default-features = "allow"
+# List of crates that are allowed. Use with care!
+allow = [
+    #{ name = "ansi_term", version = "=0.11.0" },
+]
+# List of crates to deny
+deny = [
+    # Each entry the name of a crate and a version range. If version is
+    # not specified, all versions will be matched.
+    #{ name = "ansi_term", version = "=0.11.0" },
+    #
+    # Wrapper crates can optionally be specified to allow the crate when it
+    # is a direct dependency of the otherwise banned crate
+    #{ name = "ansi_term", version = "=0.11.0", wrappers = [] },
+]
+
+# List of features to allow/deny
+# Each entry the name of a crate and a version range. If version is
+# not specified, all versions will be matched.
+#[[bans.features]]
+#name = "reqwest"
+# Features to not allow
+#deny = ["json"]
+# Features to allow
+#allow = [
+#    "rustls",
+#    "__rustls",
+#    "__tls",
+#    "hyper-rustls",
+#    "rustls",
+#    "rustls-pemfile",
+#    "rustls-tls-webpki-roots",
+#    "tokio-rustls",
+#    "webpki-roots",
+#]
+# If true, the allowed features must exactly match the enabled feature set. If
+# this is set there is no point setting `deny`
+#exact = true
+
+# Certain crates/versions that will be skipped when doing duplicate detection.
+skip = [
+    #{ name = "ansi_term", version = "=0.11.0" },
+]
+# Similarly to `skip` allows you to skip certain crates during duplicate
+# detection. Unlike skip, it also includes the entire tree of transitive
+# dependencies starting at the specified crate, up to a certain depth, which is
+# by default infinite.
+skip-tree = [
+    #{ name = "ansi_term", version = "=0.11.0", depth = 20 },
+]
+
+# This section is considered when running `cargo deny check sources`.
+# More documentation about the 'sources' section can be found here:
+# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
+[sources]
+# Lint level for what to happen when a crate from a crate registry that is not
+# in the allow list is encountered
+unknown-registry = "warn"
+# Lint level for what to happen when a crate from a git repository that is not
+# in the allow list is encountered
+unknown-git = "warn"
+# List of URLs for allowed crate registries. Defaults to the crates.io index
+# if not specified. If it is specified but empty, no registries are allowed.
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+# List of URLs for allowed Git repositories
+allow-git = []
+
+[sources.allow-org]
+# 1 or more github.com organizations to allow git sources for
+github = ["veraison"]
+# 1 or more gitlab.com organizations to allow git sources for
+# gitlab = [""]
+# 1 or more bitbucket.org organizations to allow git sources for
+# bitbucket = [""]
diff --git a/examples/attester.rs b/examples/attester.rs
new file mode 100644
index 0000000..374e42a
--- /dev/null
+++ b/examples/attester.rs
@@ -0,0 +1,65 @@
+use clap::{Parser, ValueEnum};
+use log::{error, info};
+use regl::attesters::cca::utils::print::pretty_print_token;
+use regl::attesters::{Attester, cca, cca::CcaError};
+use std::fs;
+use url::Url;
+
+#[derive(Parser, Debug)]
+struct Args {
+    /// Attester backend to use.
+    #[arg(short, long)]
+    attester: AttesterType,
+    #[arg(short, long)]
+    out: String,
+    /// Pretty-print the decoded token to stdout after writing.
+    #[arg(short, long, default_value_t = false)]
+    print: bool,
+}
+
+#[derive(Debug, Clone, ValueEnum)]
+#[allow(clippy::enum_variant_names)]
+enum AttesterType {
+    /// CCA TSM attester (requires CCA hardware)
+    CcaTsm,
+    /// CCA simulated attester (no hardware needed)
+    CcaSim,
+    /// CCA attester backed by a RATSD daemon
+    CcaRatsd,
+}
+
+fn create_attester(kind: &AttesterType) -> Box<dyn Attester<AttesterError = CcaError>> {
+    match kind {
+        AttesterType::CcaTsm => Box::new(cca::CcaTsmAttester::default()),
+        AttesterType::CcaSim => Box::new(cca::CcaSimulatedAttester::default()),
+        AttesterType::CcaRatsd => {
+            let raw = std::env::var("RATSD_URL").unwrap_or_else(|_| "http://localhost:8895".into());
+            let url = Url::parse(&raw).expect("RATSD_URL must be a valid URL");
+            Box::new(cca::CcaRatsdAttester::with_url(url))
+        }
+    }
+}
+
+fn main() {
+    let args = Args::parse();
+    env_logger::init();
+
+    let attester = create_attester(&args.attester);
+    info!("starting cca evidence collection");
+    let challenge = vec![0_u8; 64];
+    let evidence = attester
+        .get_evidence(&challenge)
+        .inspect_err(|e| error!("{e}"))
+        .unwrap();
+    info!("saving report to file");
+    fs::write(args.out.as_str(), evidence.as_slice())
+        .inspect_err(|e| error!("failed to write to file {e}"))
+        .unwrap();
+    info!("evidence generation successful!");
+    if args.print {
+        match pretty_print_token(&evidence) {
+            Ok(json) => println!("{json}"),
+            Err(e) => error!("pretty-print failed: {e}"),
+        }
+    }
+}
diff --git a/examples/tsm.rs b/examples/tsm.rs
new file mode 100644
index 0000000..7b5d1eb
--- /dev/null
+++ b/examples/tsm.rs
@@ -0,0 +1,29 @@
+use clap::Parser;
+use log::{error, info};
+use regl::tsm::{TsmReportBuilder, linuxtsm::LinuxTsmReportBuilder};
+use std::fs;
+
+#[derive(Parser, Debug)]
+struct Args {
+    #[arg(short, long)]
+    out: String,
+}
+
+fn main() {
+    let args = Args::parse();
+    env_logger::init();
+    info!("starting evidence collection");
+    let challenge = vec![0_u8; 64];
+    let report = LinuxTsmReportBuilder::create()
+        .inspect_err(|e| error!("{e}"))
+        .unwrap()
+        .inblob(challenge)
+        .get_report()
+        .inspect_err(|e| error!("{e}"))
+        .unwrap();
+    info!("saving outblob to file");
+    fs::write(args.out.as_str(), report.outblob.as_slice())
+        .inspect_err(|e| error!("failed to write to file {e}"))
+        .unwrap();
+    info!("tsm report outblob saved to file");
+}
diff --git a/src/attesters/cca/data/evidence.cbor b/src/attesters/cca/data/evidence.cbor
new file mode 100644
index 0000000..c51238d
Binary files /dev/null and b/src/attesters/cca/data/evidence.cbor differ
diff --git a/src/attesters/cca/mod.rs b/src/attesters/cca/mod.rs
new file mode 100644
index 0000000..4b13ba8
--- /dev/null
+++ b/src/attesters/cca/mod.rs
@@ -0,0 +1,136 @@
+use super::Attester;
+use crate::tsm::linuxtsm::LinuxTsmReportBuilder;
+use crate::tsm::{TsmError, TsmReport, TsmReportBuilder};
+use thiserror::Error;
+
+type Result<T> = std::result::Result<T, CcaError>;
+
+pub mod utils;
+
+mod ratsd;
+mod simulated;
+
+pub use ratsd::CcaRatsdAttester;
+use simulated::FakeTsmBuilder;
+
+/// Arm CCA nonce size in bytes, as required by the CCA specification
+/// (https://datatracker.ietf.org/doc/draft-ffm-rats-cca-token/).
+const NONCE_SIZE: usize = 64;
+
+#[derive(Debug, Default)]
+pub struct CcaTsmAttester {}
+
+#[derive(Debug, Default)]
+pub struct CcaSimulatedAttester {}
+
+impl Attester for CcaTsmAttester {
+    type AttesterError = CcaError;
+
+    fn get_evidence(&self, challenge: &[u8]) -> Result<Vec<u8>> {
+        if challenge.len() != NONCE_SIZE {
+            return Err(CcaError::InvalidNonce(format!(
+                "expected {NONCE_SIZE} bytes, got {}",
+                challenge.len()
+            )));
+        }
+        let builder = LinuxTsmReportBuilder::create()?;
+        let challenge = challenge.to_vec();
+        Ok(get_tsm_report(builder, challenge)?.outblob)
+    }
+}
+
+impl Attester for CcaSimulatedAttester {
+    type AttesterError = CcaError;
+
+    fn get_evidence(&self, challenge: &[u8]) -> Result<Vec<u8>> {
+        if challenge.len() != NONCE_SIZE {
+            return Err(CcaError::InvalidNonce(format!(
+                "expected {NONCE_SIZE} bytes, got {}",
+                challenge.len()
+            )));
+        }
+        let builder = FakeTsmBuilder::default();
+        let challenge = challenge.to_vec();
+        Ok(get_tsm_report(builder, challenge)?.outblob)
+    }
+}
+
+fn get_tsm_report<B>(generator: B, inblob: Vec<u8>) -> Result<TsmReport>
+where
+    B: TsmReportBuilder,
+{
+    Ok(generator.inblob(inblob).get_report()?)
+}
+
+#[derive(Error, Debug)]
+pub enum CcaError {
+    #[error("TSM error")]
+    Tsm(#[from] TsmError),
+
+    #[error("invalid nonce: {0}")]
+    InvalidNonce(String),
+
+    #[error("{0}")]
+    Custom(String),
+
+    #[error("RATSD error: {0}")]
+    Ratsd(#[from] crate::attesters::ratsd::RatsdError),
+}
+
+impl CcaError {
+    pub fn custom<T>(msg: T) -> Self
+    where
+        T: std::fmt::Display,
+    {
+        Self::Custom(msg.to_string())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::attesters::Attester;
+
+    // --- CcaTsmAttester nonce validation ---
+
+    #[test]
+    fn tsm_attester_rejects_short_nonce() {
+        // CCA requires exactly 64 bytes; anything shorter must be rejected.
+        let result = CcaTsmAttester::default().get_evidence(b"too-short");
+        assert!(matches!(result.unwrap_err(), CcaError::InvalidNonce(_)));
+    }
+
+    #[test]
+    fn tsm_attester_rejects_long_nonce() {
+        // Nonces longer than 64 bytes must also be rejected.
+        let long = vec![0u8; 65];
+        let result = CcaTsmAttester::default().get_evidence(&long);
+        assert!(matches!(result.unwrap_err(), CcaError::InvalidNonce(_)));
+    }
+
+    // --- Error propagation ---
+
+    #[test]
+    fn tsm_error_propagates_as_cca_tsm_variant() {
+        // From<TsmError> for CcaError must produce CcaError::Tsm, not any
+        // other variant, so callers can match on it specifically.
+        let cca: CcaError = TsmError::Unsupported.into();
+        assert!(matches!(cca, CcaError::Tsm(_)));
+    }
+
+    #[test]
+    fn generic_ratsd_error_propagates_as_cca_ratsd_variant() {
+        // From<RatsdError> for CcaError must produce CcaError::Ratsd,
+        // so callers get a single CcaError type regardless of the error source.
+        let generic = crate::attesters::ratsd::RatsdError::ResponseParse("test".into());
+        let cca: CcaError = generic.into();
+        assert!(matches!(cca, CcaError::Ratsd(_)));
+    }
+
+    #[test]
+    fn cca_error_custom_wraps_message() {
+        let err = CcaError::custom("something went wrong");
+        let msg = format!("{err}");
+        assert!(msg.contains("something went wrong"));
+    }
+}
diff --git a/src/attesters/cca/ratsd.rs b/src/attesters/cca/ratsd.rs
new file mode 100644
index 0000000..842c7f3
--- /dev/null
+++ b/src/attesters/cca/ratsd.rs
@@ -0,0 +1,222 @@
+//! CCA-specific RATSD attester.
+//!
+//! Uses the generic [`RatsdAttester`](crate::attesters::ratsd::RatsdAttester)
+//! to communicate with a RATSD daemon, then parses the CMW envelope to
+//! extract the CCA attestation token.
+//!
+//! The caller receives only the raw CCA token bytes (CBOR-encoded COSE_Sign1).
+
+use base64::{Engine, engine::general_purpose};
+use cmw::CMW as CmwEnum;
+use cmw::collection::{Collection, Label as CmwLabel};
+use cmw::monad::Monad;
+use serde_json::Value as JsonValue;
+use std::str;
+
+use super::{Attester, CcaError};
+use crate::attesters::ratsd::{RatsdAttester, RatsdError};
+
+const CCA_PROVIDER: &str = "arm_cca_guest";
+
+/// CCA attester backed by a running RATSD daemon.
+///
+/// Wraps a generic [`RatsdAttester`] and applies CCA-specific
+/// evidence extraction on top of the raw RATSD response.
+pub struct CcaRatsdAttester {
+    ratsd: RatsdAttester,
+}
+
+impl CcaRatsdAttester {
+    /// Construct a CCA RATSD attester that posts to `url`.
+    pub fn with_url(url: url::Url) -> Self {
+        Self {
+            ratsd: RatsdAttester::with_url(url),
+        }
+    }
+}
+
+impl Attester for CcaRatsdAttester {
+    type AttesterError = CcaError;
+
+    fn get_evidence(&self, challenge: &[u8]) -> std::result::Result<Vec<u8>, CcaError> {
+        if challenge.len() != super::NONCE_SIZE {
+            return Err(CcaError::InvalidNonce(format!(
+                "expected {} bytes, got {}",
+                super::NONCE_SIZE,
+                challenge.len()
+            )));
+        }
+        let resp_bytes = self.ratsd.get_evidence(challenge)?;
+        let resp_body = str::from_utf8(&resp_bytes)
+            .map_err(|e| RatsdError::ResponseParse(format!("invalid UTF-8: {e}")))?;
+        Ok(extract_cca_token(resp_body)?)
+    }
+}
+
+// ---------------------------------------------------------------------------
+// CCA evidence extraction
+// ---------------------------------------------------------------------------
+
+fn extract_cca_token(resp_body: &str) -> Result<Vec<u8>, RatsdError> {
+    let envelope: JsonValue = serde_json::from_str(resp_body)
+        .map_err(|e| RatsdError::ResponseParse(format!("invalid JSON: {e}")))?;
+
+    let cmw_b64 = envelope["cmw"]
+        .as_str()
+        .ok_or_else(|| RatsdError::ResponseParse("missing cmw field".into()))?;
+
+    let cmw_bytes = general_purpose::STANDARD
+        .decode(cmw_b64)
+        .map_err(|e| RatsdError::ResponseParse(format!("cmw base64 decode: {e}")))?;
+
+    let items = parse_cmw_items(&cmw_bytes)?;
+    find_cca_outblob(&items)
+}
+
+fn parse_cmw_items(cmw_json: &[u8]) -> Result<Vec<Monad>, RatsdError> {
+    let collection = Collection::unmarshal_json(cmw_json)
+        .map_err(|e| RatsdError::ResponseParse(format!("CMW collection: {e}")))?;
+
+    let mut items = Vec::new();
+    for meta in collection.get_meta() {
+        if matches!(&meta.key, CmwLabel::Str(s) if s == "__cmwc_t") {
+            continue;
+        }
+        if let Some(CmwEnum::Monad(monad)) = collection.get_item(&meta.key) {
+            items.push(monad.clone());
+        }
+    }
+
+    Ok(items)
+}
+
+fn find_cca_outblob(items: &[Monad]) -> Result<Vec<u8>, RatsdError> {
+    for item in items {
+        if !item.type_().contains("configfs-tsm") {
+            continue;
+        }
+
+        let json: JsonValue = match serde_json::from_slice(&item.value()) {
+            Ok(v) => v,
+            Err(_) => continue,
+        };
+
+        let provider = json
+            .get("provider")
+            .and_then(|v| v.as_str())
+            .unwrap_or("")
+            .trim();
+        if provider != CCA_PROVIDER {
+            continue;
+        }
+
+        let outblob_b64 =
+            json.get("outblob")
+                .and_then(|v| v.as_str())
+                .ok_or(RatsdError::Custom(
+                    "CCA evidence not found in RATSD response".into(),
+                ))?;
+
+        let outblob = general_purpose::URL_SAFE_NO_PAD
+            .decode(outblob_b64)
+            .map_err(|e| RatsdError::ResponseParse(format!("outblob decode: {e}")))?;
+
+        return Ok(outblob);
+    }
+
+    Err(RatsdError::Custom(
+        "CCA evidence not found in RATSD response".into(),
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::attesters::Attester;
+    use crate::attesters::cca::CcaError;
+
+    // -----------------------------------------------------------------------
+    // CcaRatsdAttester nonce validation
+    // -----------------------------------------------------------------------
+
+    #[test]
+    fn cca_ratsd_attester_rejects_invalid_nonce() {
+        // CCA requires exactly 64 bytes; the attester must enforce this
+        // before making any HTTP call.
+        let attester = CcaRatsdAttester::with_url(url::Url::parse("http://127.0.0.1").unwrap());
+        let result = attester.get_evidence(b"short");
+        assert!(matches!(result.unwrap_err(), CcaError::InvalidNonce(_)));
+    }
+
+    // -----------------------------------------------------------------------
+    // extract_cca_token — success case
+    // -----------------------------------------------------------------------
+
+    #[test]
+    fn extract_cca_token_returns_outblob_for_valid_cca_cmw_envelope() {
+        // A well-formed CMW envelope containing a CCA provider item must
+        // yield the decoded outblob bytes.
+        let outblob = b"fake-cca-token-bytes";
+        let outblob_b64 = general_purpose::URL_SAFE_NO_PAD.encode(outblob);
+
+        let tsm_report = serde_json::json!({
+            "provider": "arm_cca_guest",
+            "outblob": outblob_b64,
+        });
+        let evidence_b64 =
+            general_purpose::URL_SAFE_NO_PAD.encode(serde_json::to_vec(&tsm_report).unwrap());
+
+        let cmw_json = serde_json::json!({
+            "__cmwc_t": "tag:github.com,2025:veraison/ratsd/cmw",
+            "mock-cca": [
+                "application/vnd.veraison.configfs-tsm+json",
+                evidence_b64,
+            ],
+        });
+        let cmw_b64 = general_purpose::STANDARD.encode(serde_json::to_vec(&cmw_json).unwrap());
+        let envelope = format!(r#"{{"cmw": "{cmw_b64}"}}"#);
+
+        let result = extract_cca_token(&envelope).unwrap();
+        assert_eq!(result, outblob);
+    }
+
+    // -----------------------------------------------------------------------
+    // extract_cca_token — error cases
+    // -----------------------------------------------------------------------
+
+    #[test]
+    fn extract_cca_token_returns_error_on_invalid_json() {
+        // Completely malformed input must not panic.
+        assert!(extract_cca_token("not-json-at-all").is_err());
+    }
+
+    #[test]
+    fn extract_cca_token_returns_error_when_cmw_field_missing() {
+        // A valid JSON object that lacks "cmw" must be rejected.
+        let json = r#"{"other_field": "somevalue"}"#;
+        assert!(extract_cca_token(json).is_err());
+    }
+
+    #[test]
+    fn extract_cca_token_returns_error_when_no_cca_provider_in_cmw() {
+        // A well-formed envelope whose CMW contains only non-CCA items must
+        // return a custom error, not a panic or a spurious success.
+        // Build a minimal valid CMW collection with a non-CCA media type.
+        let cmw_json =
+            r#"{"__cmwc_t":"tag:example.com,2024:test","item1":["application/vnd.not-cca","YQ"]}"#;
+        let b64 = general_purpose::STANDARD.encode(cmw_json.as_bytes());
+        let envelope = format!(r#"{{"cmw": "{b64}"}}"#);
+        let err = extract_cca_token(&envelope).unwrap_err();
+        assert!(
+            matches!(err, RatsdError::Custom(_)),
+            "expected Custom error, got {err:?}"
+        );
+    }
+
+    #[test]
+    fn extract_cca_token_returns_error_on_invalid_cmw_base64() {
+        // An envelope with a "cmw" value that is not valid base64 must be rejected.
+        let envelope = r#"{"cmw": "!!!not-base64!!!"}"#;
+        assert!(extract_cca_token(envelope).is_err());
+    }
+}
diff --git a/src/attesters/cca/simulated.rs b/src/attesters/cca/simulated.rs
new file mode 100644
index 0000000..a6a3aaa
--- /dev/null
+++ b/src/attesters/cca/simulated.rs
@@ -0,0 +1,77 @@
+use crate::tsm::{TsmError, TsmReport, TsmReportBuilder};
+
+#[derive(Debug, Default)]
+pub struct FakeTsmBuilder {
+    provider: String,
+    inblob: Vec<u8>,
+}
+
+impl TsmReportBuilder for FakeTsmBuilder {
+    fn provider(&self) -> String {
+        self.provider.clone()
+    }
+
+    fn privlevel_floor(&self) -> u32 {
+        0
+    }
+
+    fn inblob(mut self, blob: Vec<u8>) -> Self {
+        self.inblob = blob;
+        self
+    }
+
+    fn privlevel(self, _: u32) -> Self {
+        self
+    }
+
+    fn service_provider(self, _: String) -> Self {
+        self
+    }
+
+    fn service_guid(self, _: [u8; 16]) -> Self {
+        self
+    }
+
+    fn get_report(self) -> Result<TsmReport, TsmError> {
+        generate_simulated_evidence(self.inblob)
+    }
+}
+
+fn generate_simulated_evidence(_challenge: Vec<u8>) -> Result<TsmReport, TsmError> {
+    Ok(TsmReport {
+        outblob: Vec::from(include_bytes!("data/evidence.cbor")),
+        auxblob: Vec::new(),
+        manifestblob: Vec::new(),
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::attesters::Attester;
+    use crate::attesters::cca::CcaSimulatedAttester;
+
+    const VALID_NONCE: &[u8; 64] = &[0u8; 64];
+
+    #[test]
+    fn fake_tsm_builder_chain_produces_report() {
+        let report = FakeTsmBuilder::default()
+            .inblob(vec![0u8; 64])
+            .privlevel(2)
+            .service_provider("test-provider".into())
+            .service_guid([0xAA; 16])
+            .get_report()
+            .unwrap();
+        assert!(!report.outblob.is_empty());
+        assert!(report.auxblob.is_empty());
+        assert!(report.manifestblob.is_empty());
+    }
+
+    #[test]
+    fn simulated_attester_returns_non_empty_evidence_for_valid_nonce() {
+        let evidence = CcaSimulatedAttester::default()
+            .get_evidence(VALID_NONCE)
+            .unwrap();
+        assert!(!evidence.is_empty());
+    }
+}
diff --git a/src/attesters/cca/utils/decode.rs b/src/attesters/cca/utils/decode.rs
new file mode 100644
index 0000000..abd4fbb
--- /dev/null
+++ b/src/attesters/cca/utils/decode.rs
@@ -0,0 +1,120 @@
+//! CCA token decoding and type conversion.
+//!
+//! The `ccatoken` crate decodes CBOR into its own internal types (`Platform`,
+//! `Realm`, `SwComponent`). This module provides bridge functions —
+//! `convert_platform`, `convert_sw_component`, `convert_realm` — that map
+//! those internal types into our public serde-enabled types (`PlatformClaims`,
+//! `RealmClaims`, `SwComponent`) for use by callers that need JSON output
+//! (e.g. `pretty_print_token`).
+//!
+//! This indirection keeps our public API stable even if the ccatoken library
+//! changes its field names.
+
+use ccatoken::token::SwComponent as CcaSwComponent;
+use ccatoken::token::{Evidence, Platform, Realm};
+
+use super::super::CcaError;
+use super::types::*;
+
+/// Decode raw CBOR bytes of a CCA token (tag 399) into a [`CcaToken`].
+///
+/// This uses the upstream `ccatoken` library to decode the CBOR into its
+/// internal types (`Platform`, `Realm`), then converts them to our own
+/// serde-enabled types (`PlatformClaims`, `RealmClaims`) for JSON output.
+pub fn decode_cca_token(data: &[u8]) -> Result<CcaToken, CcaError> {
+    let evidence =
+        Evidence::decode(data).map_err(|e| CcaError::custom(format!("ccatoken decode: {e}")))?;
+
+    Ok(CcaToken {
+        platform: convert_platform(&evidence.platform_claims),
+        realm: convert_realm(&evidence.realm_claims),
+    })
+}
+
+/// Convert the upstream `ccatoken::Platform` struct into our
+/// serde-enabled [`PlatformClaims`].
+///
+/// This is a simple field-by-field copy with minor transformations:
+/// - `lifecycle` is narrowed from `i128` to `u64`
+/// - `verification_service` is mapped to `service_indicator`
+/// - `hash_alg` is mapped to `hash_algo_id` (stored as `Option<String>`
+///   so that empty strings from the library become `None`)
+/// - each software component is converted via [`convert_sw_component`]
+fn convert_platform(p: &Platform) -> PlatformClaims {
+    PlatformClaims {
+        profile: p.profile.clone(),
+        challenge: p.challenge.to_vec(),
+        implementation_id: p.impl_id.to_vec(),
+        instance_id: p.inst_id.to_vec(),
+        config: p.config.clone(),
+        lifecycle: p.lifecycle as u64,
+        sw_components: p.sw_components.iter().map(convert_sw_component).collect(),
+        service_indicator: p.verification_service.clone(),
+        hash_algo_id: Some(p.hash_alg.clone()).filter(|s| !s.is_empty()),
+    }
+}
+
+/// Convert the upstream `ccatoken::SwComponent` into our
+/// serde-enabled [`SwComponent`].
+///
+/// Field name mapping from the ccatoken library:
+/// - `mtyp`  → `measurement_type`
+/// - `mval`  → `measurement_value`
+/// - `hash_alg` → `measurement_description`
+fn convert_sw_component(c: &CcaSwComponent) -> SwComponent {
+    SwComponent {
+        measurement_type: c.mtyp.clone(),
+        measurement_value: c.mval.clone(),
+        version: c.version.clone(),
+        signer_id: c.signer_id.clone(),
+        measurement_description: c.hash_alg.clone(),
+    }
+}
+
+/// Convert the upstream `ccatoken::Realm` struct into our
+/// serde-enabled [`RealmClaims`].
+///
+/// Uses `get_realm_key()` to select the correct public key encoding
+/// (COSE_Key for realm-profile tokens, raw bytes otherwise) — matching
+/// the logic in the ccatoken library itself.
+fn convert_realm(r: &Realm) -> RealmClaims {
+    let public_key = r.get_realm_key().unwrap_or_default();
+
+    RealmClaims {
+        profile: Some(r.profile.clone()).filter(|s| !s.is_empty()),
+        challenge: r.challenge.to_vec(),
+        personalization_value: r.perso.to_vec(),
+        initial_measurement: r.rim.clone(),
+        extensible_measurements: r.rem.to_vec(),
+        hash_algo_id: r.hash_alg.clone(),
+        public_key,
+        public_key_hash_algo_id: r.rak_hash_alg.clone(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn mock_evidence() -> &'static [u8] {
+        include_bytes!("../data/evidence.cbor")
+    }
+
+    #[test]
+    fn decode_produces_populated_token() {
+        // Verify the full CBOR → typed-struct pipeline works end-to-end
+        // and both platform and realm claims are populated.
+        let token = decode_cca_token(mock_evidence()).unwrap();
+        assert!(!token.platform.challenge.is_empty());
+        assert!(!token.platform.sw_components.is_empty());
+        assert!(!token.realm.challenge.is_empty());
+        assert!(!token.realm.extensible_measurements.is_empty());
+    }
+
+    #[test]
+    fn decode_rejects_invalid_input() {
+        // Both garbage data and empty input must be rejected without panicking.
+        assert!(decode_cca_token(b"not valid cbor").is_err());
+        assert!(decode_cca_token(b"").is_err());
+    }
+}
diff --git a/src/attesters/cca/utils/mod.rs b/src/attesters/cca/utils/mod.rs
new file mode 100644
index 0000000..d91a33d
--- /dev/null
+++ b/src/attesters/cca/utils/mod.rs
@@ -0,0 +1,3 @@
+pub mod decode;
+pub mod print;
+pub mod types;
diff --git a/src/attesters/cca/utils/print.rs b/src/attesters/cca/utils/print.rs
new file mode 100644
index 0000000..42e3574
--- /dev/null
+++ b/src/attesters/cca/utils/print.rs
@@ -0,0 +1,31 @@
+use super::super::CcaError;
+use super::decode::decode_cca_token;
+
+/// Decode a raw CCA token and serialize it as an indented JSON string.
+///
+/// This is a convenience wrapper that calls [`decode_cca_token`] followed
+/// by `serde_json::to_string_pretty`.
+pub fn pretty_print_token(data: &[u8]) -> Result<String, CcaError> {
+    let token = decode_cca_token(data)?;
+    serde_json::to_string_pretty(&token)
+        .map_err(|e| CcaError::custom(format!("JSON serialize: {e}")))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::attesters::Attester;
+    use crate::attesters::cca::CcaSimulatedAttester;
+
+    #[test]
+    fn pretty_print_token_produces_valid_json_with_expected_keys() {
+        let evidence = CcaSimulatedAttester::default()
+            .get_evidence(&[0u8; 64])
+            .unwrap();
+        let json = pretty_print_token(&evidence).unwrap();
+        assert!(json.contains("cca-platform-profile"));
+        assert!(json.contains("cca-realm-delegated-token"));
+        assert!(json.contains("cca-platform-challenge"));
+        assert!(json.contains("cca-realm-challenge"));
+    }
+}
diff --git a/src/attesters/cca/utils/types.rs b/src/attesters/cca/utils/types.rs
new file mode 100644
index 0000000..c260844
--- /dev/null
+++ b/src/attesters/cca/utils/types.rs
@@ -0,0 +1,186 @@
+use serde::{Deserialize, Serialize};
+
+/// Base64 (standard encoding) serde helpers for `Vec<u8>` fields.
+///
+/// Use as `#[serde(with = "b64")]` on any `Vec<u8>` field.
+pub mod b64 {
+    use base64::{Engine, engine::general_purpose};
+    use serde::{Deserialize, Deserializer, Serializer, de::Error};
+
+    pub fn serialize<S: Serializer>(v: &[u8], s: S) -> Result<S::Ok, S::Error> {
+        s.serialize_str(&general_purpose::STANDARD.encode(v))
+    }
+
+    pub fn deserialize<'de, D: Deserializer<'de>>(d: D) -> Result<Vec<u8>, D::Error> {
+        let encoded = String::deserialize(d)?;
+        general_purpose::STANDARD
+            .decode(&encoded)
+            .map_err(D::Error::custom)
+    }
+}
+
+/// Base64 (standard encoding) serde helpers for `Vec<Vec<u8>>` fields.
+///
+/// Use as `#[serde(with = "b64_vec")]` on any `Vec<Vec<u8>>` field.
+pub mod b64_vec {
+    use base64::{Engine, engine::general_purpose};
+    use serde::{Deserialize, Deserializer, Serialize, Serializer, de::Error};
+
+    pub fn serialize<S: Serializer>(v: &[Vec<u8>], s: S) -> Result<S::Ok, S::Error> {
+        let encoded: Vec<String> = v
+            .iter()
+            .map(|b| general_purpose::STANDARD.encode(b))
+            .collect();
+        encoded.serialize(s)
+    }
+
+    pub fn deserialize<'de, D: Deserializer<'de>>(d: D) -> Result<Vec<Vec<u8>>, D::Error> {
+        let encoded = Vec::<String>::deserialize(d)?;
+        encoded
+            .iter()
+            .map(|s| {
+                general_purpose::STANDARD
+                    .decode(s)
+                    .map_err(D::Error::custom)
+            })
+            .collect()
+    }
+}
+
+/// Top-level CCA attestation token.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct CcaToken {
+    #[serde(rename = "cca-platform-token")]
+    pub platform: PlatformClaims,
+
+    #[serde(rename = "cca-realm-delegated-token")]
+    pub realm: RealmClaims,
+}
+
+/// Platform claims extracted from the platform COSE_Sign1 payload.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PlatformClaims {
+    #[serde(rename = "cca-platform-profile")]
+    pub profile: String,
+
+    #[serde(rename = "cca-platform-challenge", with = "b64")]
+    pub challenge: Vec<u8>,
+
+    #[serde(rename = "cca-platform-implementation-id", with = "b64")]
+    pub implementation_id: Vec<u8>,
+
+    #[serde(rename = "cca-platform-instance-id", with = "b64")]
+    pub instance_id: Vec<u8>,
+
+    #[serde(rename = "cca-platform-config", with = "b64")]
+    pub config: Vec<u8>,
+
+    #[serde(rename = "cca-platform-lifecycle")]
+    pub lifecycle: u64,
+
+    #[serde(rename = "cca-platform-sw-components")]
+    pub sw_components: Vec<SwComponent>,
+
+    #[serde(
+        rename = "cca-platform-service-indicator",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub service_indicator: Option<String>,
+
+    #[serde(
+        rename = "cca-platform-hash-algo-id",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub hash_algo_id: Option<String>,
+}
+
+/// A single platform software component measurement.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SwComponent {
+    #[serde(rename = "measurement-type", skip_serializing_if = "Option::is_none")]
+    pub measurement_type: Option<String>,
+
+    #[serde(rename = "measurement-value", with = "b64")]
+    pub measurement_value: Vec<u8>,
+
+    #[serde(rename = "version", skip_serializing_if = "Option::is_none")]
+    pub version: Option<String>,
+
+    #[serde(rename = "signer-id", with = "b64")]
+    pub signer_id: Vec<u8>,
+
+    #[serde(
+        rename = "measurement-description",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub measurement_description: Option<String>,
+}
+
+/// Realm claims extracted from the realm COSE_Sign1 payload.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct RealmClaims {
+    #[serde(rename = "cca-realm-profile", skip_serializing_if = "Option::is_none")]
+    pub profile: Option<String>,
+
+    #[serde(rename = "cca-realm-challenge", with = "b64")]
+    pub challenge: Vec<u8>,
+
+    #[serde(rename = "cca-realm-personalization-value", with = "b64")]
+    pub personalization_value: Vec<u8>,
+
+    #[serde(rename = "cca-realm-initial-measurement", with = "b64")]
+    pub initial_measurement: Vec<u8>,
+
+    #[serde(rename = "cca-realm-extensible-measurements", with = "b64_vec")]
+    pub extensible_measurements: Vec<Vec<u8>>,
+
+    #[serde(rename = "cca-realm-hash-algo-id")]
+    pub hash_algo_id: String,
+
+    #[serde(rename = "cca-realm-public-key", with = "b64")]
+    pub public_key: Vec<u8>,
+
+    #[serde(rename = "cca-realm-public-key-hash-algo-id")]
+    pub public_key_hash_algo_id: String,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn round_trip_cca_token_serialize_deserialize() {
+        let token = CcaToken {
+            platform: PlatformClaims {
+                profile: "tag:arm.com,2023:cca_platform#1.0.0".into(),
+                challenge: vec![0u8; 32],
+                implementation_id: vec![1u8; 16],
+                instance_id: vec![2u8; 16],
+                config: vec![3u8; 8],
+                lifecycle: 12291,
+                sw_components: vec![],
+                service_indicator: Some("https://example.com".into()),
+                hash_algo_id: Some("sha-256".into()),
+            },
+            realm: RealmClaims {
+                profile: Some("tag:arm.com,2023:realm#1.0.0".into()),
+                challenge: vec![4u8; 64],
+                personalization_value: vec![5u8; 32],
+                initial_measurement: vec![6u8; 32],
+                extensible_measurements: vec![vec![7u8; 32]],
+                hash_algo_id: "sha-256".into(),
+                public_key: vec![8u8; 112],
+                public_key_hash_algo_id: "sha-256".into(),
+            },
+        };
+
+        let json = serde_json::to_string_pretty(&token).unwrap();
+        let back: CcaToken = serde_json::from_str(&json).unwrap();
+        assert_eq!(back.platform.profile, token.platform.profile);
+        assert_eq!(back.realm.hash_algo_id, token.realm.hash_algo_id);
+        assert_eq!(
+            back.platform.sw_components.len(),
+            token.platform.sw_components.len()
+        );
+    }
+}
diff --git a/src/attesters/mod.rs b/src/attesters/mod.rs
new file mode 100644
index 0000000..580da68
--- /dev/null
+++ b/src/attesters/mod.rs
@@ -0,0 +1,8 @@
+pub mod cca;
+pub mod ratsd;
+
+pub trait Attester {
+    type AttesterError: std::error::Error;
+
+    fn get_evidence(&self, challenge: &[u8]) -> Result<Vec<u8>, Self::AttesterError>;
+}
diff --git a/src/attesters/ratsd.rs b/src/attesters/ratsd.rs
new file mode 100644
index 0000000..a08dae6
--- /dev/null
+++ b/src/attesters/ratsd.rs
@@ -0,0 +1,158 @@
+//! Generic RATSD attester — posts a challenge to a RATSD daemon and
+//! returns the raw JSON response.
+//!
+//! This module handles only the HTTP transport layer. Attester-specific
+//! parsing (e.g. CCA evidence extraction from a CMW envelope) lives in
+//! the relevant submodule (e.g. `attesters::cca::ratsd`).
+
+use base64::{Engine, engine::general_purpose};
+use reqwest::blocking::Client;
+use reqwest::header::{ACCEPT, CONTENT_TYPE};
+use std::time::Duration;
+use thiserror::Error;
+use url::Url;
+
+use super::Attester;
+
+const CHARES_PATH: &str = "/ratsd/chares";
+const CHARES_CONTENT_TYPE: &str = "application/vnd.veraison.chares+json";
+const CHARES_ACCEPT: &str =
+    "application/eat-ucs+json; eat_profile=\"tag:github.com,2024:veraison/ratsd\"";
+/// Default HTTP timeout for RATSD requests.
+const TIMEOUT_SECS: u64 = 30;
+
+/// Errors that can arise from the RATSD HTTP transport layer.
+#[derive(Debug, Error)]
+pub enum RatsdError {
+    #[error("RATSD request failed: {0}")]
+    RequestFailed(#[from] reqwest::Error),
+
+    #[error("RATSD returned HTTP {status}: {body}")]
+    HttpError { status: u16, body: String },
+
+    #[error("failed to parse RATSD response: {0}")]
+    ResponseParse(String),
+
+    #[error("{0}")]
+    Custom(String),
+}
+
+/// Generic RATSD attester. Returns the raw JSON response from the
+/// daemon as bytes. Callers that need attester-specific parsing
+/// (e.g. extracting a CCA token from a CMW envelope) should wrap
+/// this attester.
+pub struct RatsdAttester {
+    url: Url,
+}
+
+impl RatsdAttester {
+    /// Construct an attester that posts to `url`.
+    pub fn with_url(url: Url) -> Self {
+        Self { url }
+    }
+}
+
+impl Attester for RatsdAttester {
+    type AttesterError = RatsdError;
+
+    fn get_evidence(&self, challenge: &[u8]) -> Result<Vec<u8>, Self::AttesterError> {
+        let resp = post_challenge(&self.url, challenge)?;
+        Ok(resp.into_bytes())
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+
+/// POST a challenge nonce to the RATSD `/ratsd/chares` endpoint.
+/// Returns the response body as a string.
+fn post_challenge(base_url: &Url, nonce: &[u8]) -> Result<String, RatsdError> {
+    let http = Client::builder()
+        .timeout(Duration::from_secs(TIMEOUT_SECS))
+        .build()?;
+
+    let nonce_b64 = general_purpose::URL_SAFE_NO_PAD.encode(nonce);
+    let body = serde_json::json!({ "nonce": nonce_b64 });
+
+    let url = base_url
+        .join(CHARES_PATH)
+        .map_err(|e| RatsdError::ResponseParse(format!("invalid RATSD URL: {e}")))?;
+
+    let resp = http
+        .post(url.clone())
+        .header(CONTENT_TYPE, CHARES_CONTENT_TYPE)
+        .header(ACCEPT, CHARES_ACCEPT)
+        .json(&body)
+        .send()?;
+
+    let status = resp.status();
+    let resp_body = resp.text()?;
+
+    if !status.is_success() {
+        return Err(RatsdError::HttpError {
+            status: status.as_u16(),
+            body: resp_body,
+        });
+    }
+
+    Ok(resp_body)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use httpmock::prelude::*;
+
+    // -----------------------------------------------------------------------
+    // Mock server — success path
+    // -----------------------------------------------------------------------
+
+    #[test]
+    fn get_evidence_posts_challenge_and_returns_json_response() {
+        // Use with_url() to avoid touching global env-var state, which races
+        // with other tests running in parallel.
+        let server = MockServer::start();
+        let mock = server.mock(|when, then| {
+            when.method(POST)
+                .path("/ratsd/chares")
+                .header("Content-Type", "application/vnd.veraison.chares+json");
+            then.status(200)
+                .header("Content-Type", "application/json")
+                .body(r#"{"cmw":"eyJfX2Ntd2NfdCI6InRlc3QifQ=="}"#);
+        });
+
+        let evidence = RatsdAttester::with_url(Url::parse(&server.base_url()).unwrap())
+            .get_evidence(&[0u8; 64])
+            .unwrap();
+        // Must return valid JSON.
+        assert!(!evidence.is_empty());
+        serde_json::from_slice::<serde_json::Value>(&evidence)
+            .expect("response should be valid JSON");
+        mock.assert();
+    }
+
+    // -----------------------------------------------------------------------
+    // Mock server — error path
+    // -----------------------------------------------------------------------
+
+    #[test]
+    fn get_evidence_returns_http_error_on_non_2xx_response() {
+        // A 500 from the server must produce RatsdError::HttpError with the
+        // correct status code, not a panic or a success result.
+        // Use with_url() to avoid global env-var races with parallel tests.
+        let server = MockServer::start();
+        server.mock(|when, then| {
+            when.method(POST).path("/ratsd/chares");
+            then.status(500).body("internal server error");
+        });
+
+        let err = RatsdAttester::with_url(Url::parse(&server.base_url()).unwrap())
+            .get_evidence(&[0u8; 64])
+            .unwrap_err();
+        assert!(
+            matches!(err, RatsdError::HttpError { status: 500, .. }),
+            "expected HttpError(500), got {err:?}"
+        );
+    }
+}
diff --git a/src/lib.rs b/src/lib.rs
new file mode 100644
index 0000000..4dd40dd
--- /dev/null
+++ b/src/lib.rs
@@ -0,0 +1,2 @@
+pub mod attesters;
+pub mod tsm;
diff --git a/src/tsm/error.rs b/src/tsm/error.rs
new file mode 100644
index 0000000..cda1689
--- /dev/null
+++ b/src/tsm/error.rs
@@ -0,0 +1,168 @@
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum TsmError {
+    #[error("TSM backend is unsupported")]
+    Unsupported,
+    #[error("{context}")]
+    IOError {
+        context: String,
+        #[source]
+        source: std::io::Error,
+    },
+    #[error("inblob write race detected: expected {exp} found {got}")]
+    GenerationError { exp: u32, got: u32 },
+    #[error("{context}")]
+    BytesToStringError {
+        context: String,
+        #[source]
+        source: std::string::FromUtf8Error,
+    },
+    #[error("{context}")]
+    StringToIntError {
+        context: String,
+        #[source]
+        source: std::num::ParseIntError,
+    },
+    #[error("TSM error: {0}")]
+    Custom(String),
+}
+
+impl TsmError {
+    pub fn custom<T>(msg: T) -> Self
+    where
+        T: std::fmt::Display,
+    {
+        Self::Custom(msg.to_string())
+    }
+
+    pub fn context<T>(self, ctx: T) -> Self
+    where
+        T: std::fmt::Display,
+    {
+        let context = ctx.to_string();
+        match self {
+            TsmError::IOError { source, .. } => TsmError::IOError { context, source },
+            TsmError::BytesToStringError { source, .. } => {
+                TsmError::BytesToStringError { context, source }
+            }
+            TsmError::StringToIntError { source, .. } => {
+                TsmError::StringToIntError { context, source }
+            }
+            _ => self,
+        }
+    }
+}
+
+impl From<std::io::Error> for TsmError {
+    fn from(value: std::io::Error) -> Self {
+        Self::IOError {
+            context: "I/O failed".to_owned(),
+            source: value,
+        }
+    }
+}
+
+impl From<std::string::FromUtf8Error> for TsmError {
+    fn from(value: std::string::FromUtf8Error) -> Self {
+        Self::BytesToStringError {
+            context: "error converting bytes to string".to_owned(),
+            source: value,
+        }
+    }
+}
+
+impl From<std::num::ParseIntError> for TsmError {
+    fn from(value: std::num::ParseIntError) -> Self {
+        Self::StringToIntError {
+            context: "error converting string to integer".to_owned(),
+            source: value,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn context_replaces_io_error_context_string() {
+        // context() must update the displayed message for IOError.
+        let io = std::io::Error::new(std::io::ErrorKind::PermissionDenied, "denied");
+        let err = TsmError::from(io).context("opening tsm config");
+        assert_eq!(format!("{err}"), "opening tsm config");
+    }
+
+    #[test]
+    fn context_is_noop_for_unsupported_and_generation_error() {
+        // context() should not alter variants it cannot enrich.
+        let unsupported = TsmError::Unsupported.context("ignored");
+        assert!(matches!(unsupported, TsmError::Unsupported));
+
+        let gen_err = TsmError::GenerationError { exp: 1, got: 2 }.context("ignored");
+        assert!(matches!(
+            gen_err,
+            TsmError::GenerationError { exp: 1, got: 2 }
+        ));
+    }
+
+    #[test]
+    fn generation_error_display_contains_both_counter_values() {
+        // The display format must include both exp and got so callers can diagnose races.
+        let err = TsmError::GenerationError { exp: 3, got: 7 };
+        let msg = format!("{err}");
+        assert!(msg.contains('3') && msg.contains('7'), "msg was: {msg}");
+    }
+
+    #[test]
+    fn from_utf8_error_produces_bytes_to_string_variant() {
+        let utf8_err = String::from_utf8(vec![0xff, 0xfe]).unwrap_err();
+        let tsm: TsmError = utf8_err.into();
+        assert!(matches!(tsm, TsmError::BytesToStringError { .. }));
+    }
+
+    #[test]
+    fn from_parse_int_error_produces_string_to_int_variant() {
+        let parse_err = "not-a-number".parse::<u32>().unwrap_err();
+        let tsm: TsmError = parse_err.into();
+        assert!(matches!(tsm, TsmError::StringToIntError { .. }));
+    }
+
+    #[test]
+    fn from_io_error_produces_io_error_variant() {
+        let io = std::io::Error::new(std::io::ErrorKind::NotFound, "file missing");
+        let tsm: TsmError = io.into();
+        assert!(matches!(tsm, TsmError::IOError { .. }));
+    }
+
+    #[test]
+    fn io_error_with_context_preserves_source() {
+        let io = std::io::Error::new(std::io::ErrorKind::PermissionDenied, "denied");
+        let tsm: TsmError = io.into();
+        let ctx = tsm.context("writing report");
+        let msg = format!("{ctx}");
+        assert!(msg.contains("writing report"));
+    }
+
+    #[test]
+    fn context_on_bytes_to_string_error_updates_message() {
+        let utf8_err = String::from_utf8(vec![0xff]).unwrap_err();
+        let tsm: TsmError = utf8_err.into();
+        let ctx = tsm.context("parsing outblob");
+        assert!(format!("{ctx}").contains("parsing outblob"));
+    }
+
+    #[test]
+    fn context_on_string_to_int_error_updates_message() {
+        let parse_err = "abc".parse::<u32>().unwrap_err();
+        let tsm: TsmError = parse_err.into();
+        let ctx = tsm.context("reading generation counter");
+        assert!(format!("{ctx}").contains("reading generation counter"));
+    }
+
+    #[test]
+    fn custom_error_wraps_message() {
+        let err = TsmError::custom("configuration missing");
+        assert!(format!("{err}").contains("configuration missing"));
+    }
+}
diff --git a/src/tsm/linuxtsm.rs b/src/tsm/linuxtsm.rs
new file mode 100644
index 0000000..4caf464
--- /dev/null
+++ b/src/tsm/linuxtsm.rs
@@ -0,0 +1,177 @@
+use super::{TsmError, TsmReport, TsmReportBuilder};
+
+use std::fs;
+use std::path::PathBuf;
+use tempfile::tempdir_in;
+
+const TSM_REPORT_PATH: &str = "/sys/kernel/config/tsm/report";
+
+type Result<T> = std::result::Result<T, TsmError>;
+
+#[derive(Debug, Default)]
+pub struct LinuxTsmReportBuilder {
+    provider: String,
+    privlevel_floor: u32,
+    inblob: Vec<u8>,
+    privlevel: Option<u32>,
+    service_provider: Option<String>,
+    service_guid: Option<[u8; 16]>,
+    num_writes: u32,
+    path: PathBuf,
+}
+
+impl LinuxTsmReportBuilder {
+    pub fn create() -> Result<Self> {
+        let s = fs::exists(TSM_REPORT_PATH)
+            .map_err(|e| TsmError::from(e).context("failed to check if TSM dir exists"))?;
+        if !s {
+            return Err(TsmError::Unsupported);
+        }
+        let dir = tempdir_in(TSM_REPORT_PATH)
+            .map_err(|e| TsmError::from(e).context("failed to create report instance"))?;
+        let path = dir.keep();
+        let mut builder = Self::default();
+        builder.path = path;
+        builder.provider = builder.read_to_string("provider", false)?;
+        builder.privlevel_floor = builder.read_to_int("privlevel_floor")?;
+        Ok(builder)
+    }
+
+    fn read_file(&self, file: &str) -> Result<Vec<u8>> {
+        let path = self.path.clone().join(file);
+        fs::read(&path)
+            .map_err(|e| TsmError::from(e).context(format!("failed to read from {file:?}")))
+    }
+
+    fn read_file_opt(&self, file: &str) -> Result<Vec<u8>> {
+        let path = self.path.clone().join(file);
+        if path.exists() {
+            fs::read(&path)
+                .map_err(|e| TsmError::from(e).context(format!("failed to read from {file:?}")))
+        } else {
+            Ok(Vec::new())
+        }
+    }
+
+    fn read_to_string(&self, file: &str, opt: bool) -> Result<String> {
+        let read_fn = if opt {
+            Self::read_file_opt
+        } else {
+            Self::read_file
+        };
+        String::from_utf8(read_fn(self, file)?)
+            .map(|s| s.trim_end().to_owned())
+            .map_err(|e| TsmError::from(e).context(format!("failed to read {file:?} as string")))
+    }
+
+    fn read_to_int(&self, file: &str) -> Result<u32> {
+        self.read_to_string(file, false)?
+            .parse()
+            .map_err(|e| TsmError::from(e).context(format!("failed to convert {file} to integer")))
+    }
+
+    fn generation(&self) -> Result<u32> {
+        self.read_to_int("generation")
+    }
+
+    fn write_file(&mut self, file: &str, data: &[u8]) -> Result<()> {
+        let path = self.path.clone().join(file);
+        fs::write(path, data)
+            .map_err(|e| TsmError::from(e).context(format!("failed to write to {file:?}")))?;
+        self.num_writes += 1;
+        generation_err(self.num_writes, self.generation()?)
+    }
+}
+
+impl Drop for LinuxTsmReportBuilder {
+    fn drop(&mut self) {
+        // note: fs::remove_dir calls the rmdir function. But
+        // https://doc.rust-lang.org/std/fs/fn.remove_dir.html
+        // says that this behaviour might change in future.
+        fs::remove_dir(&self.path).unwrap_or(());
+    }
+}
+
+impl TsmReportBuilder for LinuxTsmReportBuilder {
+    fn provider(&self) -> String {
+        self.provider.clone()
+    }
+
+    fn privlevel_floor(&self) -> u32 {
+        self.privlevel_floor
+    }
+
+    fn inblob(mut self, blob: Vec<u8>) -> Self {
+        self.inblob = blob;
+        self
+    }
+
+    fn privlevel(mut self, lev: u32) -> Self {
+        self.privlevel = Some(lev);
+        self
+    }
+
+    fn service_provider(mut self, provider: String) -> Self {
+        self.service_provider = Some(provider);
+        self
+    }
+
+    fn service_guid(mut self, guid: [u8; 16]) -> Self {
+        self.service_guid = Some(guid);
+        self
+    }
+
+    fn get_report(mut self) -> Result<TsmReport> {
+        if let Some(privlevel) = self.privlevel {
+            self.write_file("privlevel", privlevel.to_string().as_bytes())?
+        }
+        if let Some(service_provider) = self.service_provider.take() {
+            self.write_file("service_provider", service_provider.as_bytes())?
+        }
+        if let Some(service_guid) = self.service_guid.take() {
+            self.write_file("service_guid", service_guid.as_slice())?
+        }
+
+        let inblob: Vec<u8> = std::mem::take(&mut self.inblob);
+        self.write_file("inblob", inblob.as_slice())?;
+
+        Ok(TsmReport {
+            outblob: self.read_file("outblob")?,
+            auxblob: self.read_file_opt("auxblob")?,
+            manifestblob: self.read_file_opt("manifestblob")?,
+        })
+    }
+}
+
+fn generation_err(exp: u32, got: u32) -> Result<()> {
+    if exp != got {
+        Err(TsmError::GenerationError { exp, got })
+    } else {
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn generation_err_ok_when_exp_equals_got() {
+        // No race: write count equals the kernel's generation counter.
+        assert!(generation_err(0, 0).is_ok());
+        assert!(generation_err(5, 5).is_ok());
+    }
+
+    #[test]
+    fn generation_err_returns_error_with_correct_fields() {
+        // A mismatch must surface the exact exp/got values so callers can report them.
+        let err = generation_err(2, 5).unwrap_err();
+        match err {
+            TsmError::GenerationError { exp, got } => {
+                assert_eq!(exp, 2);
+                assert_eq!(got, 5);
+            }
+            other => panic!("expected GenerationError, got {other:?}"),
+        }
+    }
+}
diff --git a/src/tsm/mod.rs b/src/tsm/mod.rs
new file mode 100644
index 0000000..915bddf
--- /dev/null
+++ b/src/tsm/mod.rs
@@ -0,0 +1,60 @@
+mod error;
+pub mod linuxtsm;
+pub use error::TsmError;
+
+#[derive(Debug, Default)]
+pub struct TsmReport {
+    /// outblob that contains the report
+    pub outblob: Vec<u8>,
+    /// auxblob containing auxiliary data
+    pub auxblob: Vec<u8>,
+    /// manifest blob
+    pub manifestblob: Vec<u8>,
+}
+
+/// Trait implemented by builder of TsmReport.
+///
+/// The constructor of the builder does the mkdir of the report instance.
+/// This trait contains methods for inspecting the report instance and
+/// transforming it into the report (reading the information emitted by
+/// TSM).
+pub trait TsmReportBuilder {
+    /// get the provider attribute
+    fn provider(&self) -> String;
+
+    /// get the privlevel_floor attribute
+    fn privlevel_floor(&self) -> u32;
+
+    /// set inblob. The actual write system call may not happen
+    /// during this call, instead may happen during the get function
+    /// call.
+    fn inblob(self, blob: Vec<u8>) -> Self;
+
+    /// set privlevel
+    fn privlevel(self, lev: u32) -> Self;
+
+    /// set service_provider
+    fn service_provider(self, provider: String) -> Self;
+
+    /// set service_guid
+    fn service_guid(self, guid: [u8; 16]) -> Self;
+
+    /// construct the report. This involves reading the blobs
+    /// emitted by TSM
+    fn get_report(self) -> Result<TsmReport, TsmError>;
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn tsm_report_default_has_empty_blobs() {
+        // TsmReport::default() must initialise all three blobs to empty — a
+        // non-empty default would silently carry stale data into callers.
+        let report = TsmReport::default();
+        assert!(report.outblob.is_empty());
+        assert!(report.auxblob.is_empty());
+        assert!(report.manifestblob.is_empty());
+    }
+}