From 37ace0ff30b4b1d5f47475b0a0e8dc3fad84eede Mon Sep 17 00:00:00 2001
From: Shaheen Gandhi <visigoth@gmail.com>
Date: Fri, 13 Feb 2026 20:49:42 -0800
Subject: [PATCH] Add signal-call-tunnel Rust binary crate

Create the signal-call-tunnel binary that uses RingRTC's native Rust
API for ICE/SRTP/call state management. Includes:
- config.rs: Config struct read from stdin JSON
- control.rs: Unix socket JSON-lines control channel with auth
- platform.rs: RingRTC SignalingSender/CallStateHandler/GroupUpdateHandler impls
- main.rs: Entry point with CallManager setup and event loop

Supports --host-audio flag for system audio, defaults to socket
audio mode using the new AudioDeviceModule::new_socket().

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .gitmodules                                   |    3 +
 signal-call-tunnel/Cargo.lock                 | 2858 +++++++++++++++++
 signal-call-tunnel/Cargo.toml                 |   19 +
 signal-call-tunnel/build.rs                   |   66 +
 .../patches/ringrtc-disable-vpio.patch        |   41 +
 signal-call-tunnel/src/config.rs              |   92 +
 signal-call-tunnel/src/control.rs             |  521 +++
 signal-call-tunnel/src/main.rs                |  410 +++
 signal-call-tunnel/src/platform.rs            |  481 +++
 third-party/ringrtc                           |    1 +
 10 files changed, 4492 insertions(+)
 create mode 100644 .gitmodules
 create mode 100644 signal-call-tunnel/Cargo.lock
 create mode 100644 signal-call-tunnel/Cargo.toml
 create mode 100644 signal-call-tunnel/build.rs
 create mode 100644 signal-call-tunnel/patches/ringrtc-disable-vpio.patch
 create mode 100644 signal-call-tunnel/src/config.rs
 create mode 100644 signal-call-tunnel/src/control.rs
 create mode 100644 signal-call-tunnel/src/main.rs
 create mode 100644 signal-call-tunnel/src/platform.rs
 create mode 160000 third-party/ringrtc

diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 00000000..45e16d46
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "third-party/ringrtc"]
+	path = third-party/ringrtc
+	url = https://github.com/signalapp/ringrtc
diff --git a/signal-call-tunnel/Cargo.lock b/signal-call-tunnel/Cargo.lock
new file mode 100644
index 00000000..43a705ee
--- /dev/null
+++ b/signal-call-tunnel/Cargo.lock
@@ -0,0 +1,2858 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common",
+ "generic-array",
+]
+
+[[package]]
+name = "aes"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+ "zeroize",
+]
+
+[[package]]
+name = "aes-gcm-siv"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae0784134ba9375416d469ec31e7c5f9fa94405049cf08c5ce5b4698be673e0d"
+dependencies = [
+ "aead",
+ "aes",
+ "cipher",
+ "ctr",
+ "polyval",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anstream"
+version = "0.6.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43d5b281e737544384e969a5ccad3f1cdd24b48086a0fc1b2a5262a26b8f4f4a"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.101"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f0e0fee31ef5ed1ba1316088939cea399010ed7731dba877ed44aeb407a75ea"
+
+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures",
+ "password-hash",
+ "zeroize",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
+[[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
+
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block-padding"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.19.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5dd9dc738b7a8311c7ade152424974d8115f2cdad61e8dab8dac9f2362298510"
+
+[[package]]
+name = "bytes"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+
+[[package]]
+name = "cbc"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
+dependencies = [
+ "cipher",
+]
+
+[[package]]
+name = "cc"
+version = "1.2.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aebf35691d1bfb0ac386a69bac2fde4dd276fb618cf8bf4f5318fe285e821bb2"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cesu8"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "chrono"
+version = "0.4.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fac4744fb15ae8337dc853fee7fb3f4e48c0fbaa23d0afe49c447b4fab126118"
+dependencies = [
+ "iana-time-zone",
+ "num-traits",
+ "serde",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+ "zeroize",
+]
+
+[[package]]
+name = "cmake"
+version = "0.1.57"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75443c44cd6b379beb8c5b45d85d0773baf31cce901fe7bb252f4eff3008ef7d"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "colorchoice"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+
+[[package]]
+name = "combine"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "const-str"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18f12cc9948ed9604230cdddc7c86e270f9401ccbe3c2e98a4378c5e7632212f"
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "core-models"
+version = "0.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "657f625ff361906f779745d08375ae3cc9fef87a35fba5f22874cf773010daf4"
+dependencies = [
+ "hax-lib",
+ "pastey",
+ "rand 0.9.2",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "typenum",
+]
+
+[[package]]
+name = "ctr"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+dependencies = [
+ "cipher",
+]
+
+[[package]]
+name = "cubeb"
+version = "0.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99aeb3c93cdecdcad9a4d22cb4496ddee52fd4c83cdb5e41d5cce3fe5102026d"
+dependencies = [
+ "cubeb-core",
+]
+
+[[package]]
+name = "cubeb-core"
+version = "0.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "740c14febbf94c5321f50f4fd28a8fae7db38fd8e321ee497083e841c9f821b3"
+dependencies = [
+ "bitflags 1.3.2",
+ "cc",
+ "cubeb-sys",
+]
+
+[[package]]
+name = "cubeb-sys"
+version = "0.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a361f8e991dbe3f01dac3e10713e19defe618beaf0844ed005272c2075fef547"
+dependencies = [
+ "cmake",
+ "pkg-config",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "git+https://github.com/signalapp/curve25519-dalek?tag=signal-curve25519-4.1.3#7c6d34756355a3566a704da84dce7b1c039a6572"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "digest",
+ "fiat-crypto",
+ "rustc_version",
+ "serde",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "git+https://github.com/signalapp/curve25519-dalek?tag=signal-curve25519-4.1.3#7c6d34756355a3566a704da84dce7b1c039a6572"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "darling"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc3dc5ad92c2e2d1c193bbbbdf2ea477cb81331de4f3103f267ca18368b988c4"
+dependencies = [
+ "powerfmt",
+ "serde_core",
+]
+
+[[package]]
+name = "derive-where"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef941ded77d15ca19b40374869ac6000af1c9f2a4c0f3d4c70926287e6364a8f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "derive_more"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
+dependencies = [
+ "derive_more-impl",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "syn",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+
+[[package]]
+name = "env_filter"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a1c3cc8e57274ec99de65301228b537f1e4eedc1b8e0f9411c6caac8ae7308f"
+dependencies = [
+ "log",
+ "regex",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2daee4ea451f429a58296525ddf28b45a3b64f1acf6587e2067437bb11e218d"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "env_filter",
+ "jiff",
+ "log",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "fixedbitset"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "wasip2",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139ef39800118c7683f2fd3c98c1b23c09ae076556b435f8e9064ae108aaeeec"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "wasip2",
+ "wasip3",
+]
+
+[[package]]
+name = "ghash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
+dependencies = [
+ "opaque-debug",
+ "polyval",
+ "zeroize",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+
+[[package]]
+name = "hax-lib"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "543f93241d32b3f00569201bfce9d7a93c92c6421b23c77864ac929dc947b9fc"
+dependencies = [
+ "hax-lib-macros",
+ "num-bigint",
+ "num-traits",
+]
+
+[[package]]
+name = "hax-lib-macros"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8755751e760b11021765bb04cb4a6c4e24742688d9f3aa14c2079638f537b0f"
+dependencies = [
+ "hax-lib-macros-types",
+ "proc-macro-error2",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "hax-lib-macros-types"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f177c9ae8ea456e2f71ff3c1ea47bf4464f772a05133fcbba56cd5ba169035a2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "uuid",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "hpke-rs"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fcd4b22e7fc3318a1674085f943a35794023ecfe8b24a1691d1d1e016f869c8"
+dependencies = [
+ "hpke-rs-crypto",
+ "libcrux-sha3",
+ "log",
+ "rand_core 0.9.5",
+ "zeroize",
+]
+
+[[package]]
+name = "hpke-rs-crypto"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dd92b7d7f0deaae59c152e01c01f5280ea92dfac82090e5c025879b32df9193"
+dependencies = [
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core 0.62.2",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.16.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "block-padding",
+ "generic-array",
+]
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+
+[[package]]
+name = "jiff"
+version = "0.2.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c867c356cc096b33f4981825ab281ecba3db0acefe60329f044c1789d94c6543"
+dependencies = [
+ "jiff-static",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7946b4325269738f270bb55b3c19ab5c5040525f83fd625259422a9d25d9be5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "jni"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97"
+dependencies = [
+ "cesu8",
+ "cfg-if",
+ "combine",
+ "jni-sys",
+ "log",
+ "thiserror 1.0.69",
+ "walkdir",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
+
+[[package]]
+name = "js-sys"
+version = "0.3.85"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c942ebf8e95485ca0d52d97da7c5a2c387d0e7f0ba4c35e93bfcaee045955b3"
+dependencies = [
+ "once_cell",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "libc"
+version = "0.2.182"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6800badb6cb2082ffd7b6a67e6125bb39f18782f793520caee8cb8846be06112"
+
+[[package]]
+name = "libcrux-intrinsics"
+version = "0.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0aa4779454e853d1de200cd12f19a8185aac47d99a5ec404cea3295c943d48f1"
+dependencies = [
+ "core-models",
+ "hax-lib",
+]
+
+[[package]]
+name = "libcrux-platform"
+version = "0.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d9e21d7ed31a92ac539bd69a8c970b183ee883872d2d19ce27036e24cb8ecc4"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "libcrux-secrets"
+version = "0.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ce650f3041b44ba40d4263852347d007cd2cd9d1cc856a6f6c8b2e10c3fd40b"
+dependencies = [
+ "hax-lib",
+]
+
+[[package]]
+name = "libcrux-sha3"
+version = "0.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3dabce2795479bd7294f853f7966a678cadf7a26d3d29f61cf15f5123e7ba4f"
+dependencies = [
+ "hax-lib",
+ "libcrux-intrinsics",
+ "libcrux-platform",
+ "libcrux-traits",
+]
+
+[[package]]
+name = "libcrux-traits"
+version = "0.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "695ff2fb97627e4d57315a2fdfbfe50df1c80c6ef7d91ba34216169bd6f41c00"
+dependencies = [
+ "libcrux-secrets",
+ "rand 0.9.2",
+]
+
+[[package]]
+name = "libsignal-account-keys"
+version = "0.1.0"
+source = "git+https://github.com/signalapp/libsignal?tag=v0.87.1#f08390b0e2f67d5faf47bb9d1a3db191314db93c"
+dependencies = [
+ "argon2",
+ "derive_more",
+ "displaydoc",
+ "hkdf",
+ "libsignal-core",
+ "partial-default",
+ "protobuf 3.7.2",
+ "protobuf-codegen",
+ "rand 0.9.2",
+ "rand_core 0.9.5",
+ "serde",
+ "sha2",
+ "signal-crypto",
+ "static_assertions",
+ "thiserror 2.0.18",
+ "zerocopy",
+]
+
+[[package]]
+name = "libsignal-core"
+version = "0.1.0"
+source = "git+https://github.com/signalapp/libsignal?tag=v0.87.1#f08390b0e2f67d5faf47bb9d1a3db191314db93c"
+dependencies = [
+ "curve25519-dalek",
+ "derive_more",
+ "displaydoc",
+ "log",
+ "rand 0.9.2",
+ "sha2",
+ "subtle",
+ "thiserror 2.0.18",
+ "uuid",
+ "x25519-dalek",
+ "zerocopy",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
+
+[[package]]
+name = "log"
+version = "0.4.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+
+[[package]]
+name = "memchr"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+
+[[package]]
+name = "mrp"
+version = "2.65.1"
+dependencies = [
+ "anyhow",
+ "log",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "multimap"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d87ecb2933e8aeadb3e3a02b828fed80a7528047e68b4f424523a0981a3a084"
+
+[[package]]
+name = "ntapi"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3b335231dfd352ffb0f8017f3b6027a4917f7df785ea2143d8af2adc66980ae"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050"
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_enum"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1207a7e20ad57b847bbddc6776b968420d38292bbfe2089accff5e19e82454c"
+dependencies = [
+ "num_enum_derive",
+ "rustversion",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff32365de1b6743cb203b710788263c44a03de03802daf96092f2da4fe6ba4d7"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "objc2-core-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
+dependencies = [
+ "bitflags 2.11.0",
+]
+
+[[package]]
+name = "objc2-io-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33fafba39597d6dc1fb709123dfa8289d39406734be322956a69f0931c73bb15"
+dependencies = [
+ "libc",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
+[[package]]
+name = "partial-default"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "124dc3c21ffb6fb3a0562d129929a8a54998766ef7adc1ba09ddc467d092c14b"
+dependencies = [
+ "partial-default-derive",
+]
+
+[[package]]
+name = "partial-default-derive"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7459127d7a18cb202d418e4b7df1103ffd6d82a106e9b2091c250624c2ace70d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "pastey"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b867cad97c0791bbd3aaa6472142568c6c9e8f71937e98379f584cfb0cf35bec"
+
+[[package]]
+name = "petgraph"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
+dependencies = [
+ "fixedbitset",
+ "hashbrown 0.15.5",
+ "indexmap 2.13.0",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+
+[[package]]
+name = "poksho"
+version = "0.7.0"
+source = "git+https://github.com/signalapp/libsignal?tag=v0.87.1#f08390b0e2f67d5faf47bb9d1a3db191314db93c"
+dependencies = [
+ "curve25519-dalek",
+ "hmac",
+ "sha2",
+]
+
+[[package]]
+name = "polyval"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "opaque-debug",
+ "universal-hash",
+]
+
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a9db96d7fa8782dd8c15ce32ffe8680bbd1e978a43bf51a34d39483540495f5"
+dependencies = [
+ "portable-atomic",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983"
+dependencies = [
+ "toml_edit",
+]
+
+[[package]]
+name = "proc-macro-error-attr2"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96de42df36bb9bba5542fe9f1a054b8cc87e172759a1868aa05c1f3acc89dfc5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "proc-macro-error2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11ec05c52be0a07b08061f7dd003e7d7092e0472bc731b4af7bb1ef876109802"
+dependencies = [
+ "proc-macro-error-attr2",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "prost"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2ea70524a2f82d518bce41317d0fae74151505651af45faf1ffbd6fd33f0568"
+dependencies = [
+ "bytes",
+ "prost-derive",
+]
+
+[[package]]
+name = "prost-build"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "343d3bd7056eda839b03204e68deff7d1b13aba7af2b2fd16890697274262ee7"
+dependencies = [
+ "heck",
+ "itertools",
+ "log",
+ "multimap",
+ "petgraph",
+ "prettyplease",
+ "prost",
+ "prost-types",
+ "pulldown-cmark",
+ "pulldown-cmark-to-cmark",
+ "regex",
+ "syn",
+ "tempfile",
+]
+
+[[package]]
+name = "prost-derive"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
+dependencies = [
+ "anyhow",
+ "itertools",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "prost-types"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8991c4cbdb8bc5b11f0b074ffe286c30e523de90fee5ba8132f1399f23cb3dd7"
+dependencies = [
+ "prost",
+]
+
+[[package]]
+name = "protobuf"
+version = "2.65.1"
+dependencies = [
+ "prost-build",
+ "tonic-prost-build",
+]
+
+[[package]]
+name = "protobuf"
+version = "3.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d65a1d4ddae7d8b5de68153b48f6aa3bba8cb002b243dbdbc55a5afbc98f99f4"
+dependencies = [
+ "once_cell",
+ "protobuf-support",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "protobuf-codegen"
+version = "3.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d3976825c0014bbd2f3b34f0001876604fe87e0c86cd8fa54251530f1544ace"
+dependencies = [
+ "anyhow",
+ "once_cell",
+ "protobuf 3.7.2",
+ "protobuf-parse",
+ "regex",
+ "tempfile",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "protobuf-parse"
+version = "3.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4aeaa1f2460f1d348eeaeed86aea999ce98c1bded6f089ff8514c9d9dbdc973"
+dependencies = [
+ "anyhow",
+ "indexmap 2.13.0",
+ "log",
+ "protobuf 3.7.2",
+ "protobuf-support",
+ "tempfile",
+ "thiserror 1.0.69",
+ "which",
+]
+
+[[package]]
+name = "protobuf-support"
+version = "3.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e36c2f31e0a47f9280fb347ef5e461ffcd2c52dd520d8e216b52f93b0b0d7d6"
+dependencies = [
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "pulldown-cmark"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e8bbe1a966bd2f362681a44f6edce3c2310ac21e4d5067a6e7ec396297a6ea0"
+dependencies = [
+ "bitflags 2.11.0",
+ "memchr",
+ "unicase",
+]
+
+[[package]]
+name = "pulldown-cmark-to-cmark"
+version = "22.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50793def1b900256624a709439404384204a5dc3a6ec580281bfaac35e882e90"
+dependencies = [
+ "pulldown-cmark",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "rayon"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "368f01d005bf8fd9b1206fb6fa653e6c4a81ceb1466406b81792d87c5677a58f"
+dependencies = [
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
+dependencies = [
+ "crossbeam-deque",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "regex"
+version = "1.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-aot"
+version = "0.1.0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "regex-automata",
+ "syn",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a96887878f22d7bad8a3b6dc5b7440e0ada9a245242924394987b21cf2210a4c"
+
+[[package]]
+name = "ringrtc"
+version = "2.65.1"
+dependencies = [
+ "aes",
+ "aes-gcm-siv",
+ "anyhow",
+ "base64",
+ "bincode",
+ "bytes",
+ "ctr",
+ "cubeb",
+ "cubeb-core",
+ "hex",
+ "hkdf",
+ "hmac",
+ "jni",
+ "lazy_static",
+ "libc",
+ "log",
+ "mrp",
+ "num_enum",
+ "prost",
+ "protobuf 2.65.1",
+ "rand 0.8.5",
+ "regex",
+ "regex-aot",
+ "regex-automata",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "sha2",
+ "sketches-ddsketch",
+ "static_assertions",
+ "strum",
+ "strum_macros",
+ "subtle",
+ "sysinfo",
+ "thiserror 2.0.18",
+ "windows 0.62.2",
+ "x25519-dalek",
+ "zkgroup",
+]
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "0.38.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
+dependencies = [
+ "bitflags 2.11.0",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.4.15",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
+dependencies = [
+ "bitflags 2.11.0",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.11.0",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schemars"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.149"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_with"
+version = "3.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fa237f2807440d238e0364a218270b98f767a00d3dada77b1c53ae88940e2e7"
+dependencies = [
+ "base64",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.13.0",
+ "schemars 0.9.0",
+ "schemars 1.2.1",
+ "serde_core",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52a8e3ca0ca629121f70ab50f95249e5a6f925cc0f6ffe8256c45b728875706c"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "signal-call-tunnel"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base64",
+ "env_logger",
+ "log",
+ "ringrtc",
+ "serde",
+ "serde_json",
+ "subtle",
+]
+
+[[package]]
+name = "signal-crypto"
+version = "0.1.0"
+source = "git+https://github.com/signalapp/libsignal?tag=v0.87.1#f08390b0e2f67d5faf47bb9d1a3db191314db93c"
+dependencies = [
+ "aes",
+ "cbc",
+ "ctr",
+ "derive_more",
+ "displaydoc",
+ "ghash",
+ "hkdf",
+ "hmac",
+ "hpke-rs",
+ "hpke-rs-crypto",
+ "libsignal-core",
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
+ "sha1",
+ "sha2",
+ "subtle",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "sketches-ddsketch"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1e9a774a6c28142ac54bb25d25562e6bcf957493a184f15ad4eebccb23e410a"
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "strum"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf"
+dependencies = [
+ "strum_macros",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.116"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3df424c70518695237746f84cede799c9c58fcb37450d7b23716568cc8bc69cb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sysinfo"
+version = "0.37.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16607d5caffd1c07ce073528f9ed972d88db15dd44023fa57142963be3feb11f"
+dependencies = [
+ "libc",
+ "memchr",
+ "ntapi",
+ "objc2-core-foundation",
+ "objc2-io-kit",
+ "windows 0.61.3",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0136791f7c95b1f6dd99f9cc786b91bb81c3800b639b3478e561ddb7be95e5f1"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.1",
+ "once_cell",
+ "rustix 1.1.3",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl 2.0.18",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "time"
+version = "0.3.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+
+[[package]]
+name = "time-macros"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.7.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.23.10+spec-1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "84c8b9f757e028cee9fa244aea147aab2a9ec09d5325a9b01e0a49730c2b5269"
+dependencies = [
+ "indexmap 2.13.0",
+ "toml_datetime",
+ "toml_parser",
+ "winnow",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.0.9+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "702d4415e08923e7e1ef96cd5727c0dfed80b4d2fa25db9647fe5eb6f7c5a4c4"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "tonic-build"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6d8958ed3be404120ca43ffa0fb1e1fc7be214e96c8d33bd43a131b6eebc9e"
+dependencies = [
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tonic-prost-build"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65873ace111e90344b8973e94a1fc817c924473affff24629281f90daed1cd2e"
+dependencies = [
+ "prettyplease",
+ "proc-macro2",
+ "prost-build",
+ "prost-types",
+ "quote",
+ "syn",
+ "tempfile",
+ "tonic-build",
+]
+
+[[package]]
+name = "typenum"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+
+[[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "uuid"
+version = "1.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b672338555252d43fd2240c714dc444b8c6fb0a5c5335e65a07bba7742735ddb"
+dependencies = [
+ "getrandom 0.4.1",
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.2+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.108"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64024a30ec1e37399cf85a7ffefebdb72205ca1c972291c51512360d90bd8566"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.108"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "008b239d9c740232e71bd39e8ef6429d27097518b6b30bdf9086833bd5b6d608"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.108"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5256bae2d58f54820e6490f9839c49780dff84c65aeab9e772f15d5f0e913a55"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.108"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f01b580c9ac74c8d8f0c0e4afb04eeef2acf145458e52c03845ee9cd23e3d12"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap 2.13.0",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags 2.11.0",
+ "hashbrown 0.15.5",
+ "indexmap 2.13.0",
+ "semver",
+]
+
+[[package]]
+name = "which"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
+dependencies = [
+ "either",
+ "home",
+ "once_cell",
+ "rustix 0.38.44",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows"
+version = "0.61.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893"
+dependencies = [
+ "windows-collections 0.2.0",
+ "windows-core 0.61.2",
+ "windows-future 0.2.1",
+ "windows-link 0.1.3",
+ "windows-numerics 0.2.0",
+]
+
+[[package]]
+name = "windows"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "527fadee13e0c05939a6a05d5bd6eec6cd2e3dbd648b9f8e447c6518133d8580"
+dependencies = [
+ "windows-collections 0.3.2",
+ "windows-core 0.62.2",
+ "windows-future 0.3.2",
+ "windows-numerics 0.3.1",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8"
+dependencies = [
+ "windows-core 0.61.2",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b2d95af1a8a14a3c7367e1ed4fc9c20e0a26e79551b1454d72583c97cc6610"
+dependencies = [
+ "windows-core 0.62.2",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link 0.1.3",
+ "windows-result 0.3.4",
+ "windows-strings 0.4.2",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link 0.2.1",
+ "windows-result 0.4.1",
+ "windows-strings 0.5.1",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e"
+dependencies = [
+ "windows-core 0.61.2",
+ "windows-link 0.1.3",
+ "windows-threading 0.1.0",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1d6f90251fe18a279739e78025bd6ddc52a7e22f921070ccdc67dde84c605cb"
+dependencies = [
+ "windows-core 0.62.2",
+ "windows-link 0.2.1",
+ "windows-threading 0.2.1",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-numerics"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1"
+dependencies = [
+ "windows-core 0.61.2",
+ "windows-link 0.1.3",
+]
+
+[[package]]
+name = "windows-numerics"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2e40844ac143cdb44aead537bbf727de9b044e107a0f1220392177d15b0f26"
+dependencies = [
+ "windows-core 0.62.2",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
+dependencies = [
+ "windows-link 0.1.3",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
+dependencies = [
+ "windows-link 0.1.3",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets 0.42.2",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows-threading"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b66463ad2e0ea3bbf808b7f1d371311c80e115c0b71d60efc142cafbcfb057a6"
+dependencies = [
+ "windows-link 0.1.3",
+]
+
+[[package]]
+name = "windows-threading"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3949bd5b99cafdf1c7ca86b43ca564028dfe27d66958f2470940f73d86d75b37"
+dependencies = [
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "winnow"
+version = "0.7.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap 2.13.0",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags 2.11.0",
+ "indexmap 2.13.0",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap 2.13.0",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
+
+[[package]]
+name = "x25519-dalek"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
+dependencies = [
+ "curve25519-dalek",
+ "rand_core 0.6.4",
+ "serde",
+ "zeroize",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.39"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db6d35d663eadb6c932438e763b262fe1a70987f9ae936e60158176d710cae4a"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.39"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4122cd3169e94605190e77839c9a40d40ed048d305bfdc146e7df40ab0f3e517"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zkcredential"
+version = "0.1.0"
+source = "git+https://github.com/signalapp/libsignal?tag=v0.87.1#f08390b0e2f67d5faf47bb9d1a3db191314db93c"
+dependencies = [
+ "cfg-if",
+ "curve25519-dalek",
+ "derive-where",
+ "displaydoc",
+ "partial-default",
+ "poksho",
+ "rayon",
+ "serde",
+ "sha2",
+ "subtle",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "zkgroup"
+version = "0.9.0"
+source = "git+https://github.com/signalapp/libsignal?tag=v0.87.1#f08390b0e2f67d5faf47bb9d1a3db191314db93c"
+dependencies = [
+ "aes",
+ "aes-gcm-siv",
+ "bincode",
+ "const-str",
+ "curve25519-dalek",
+ "derive-where",
+ "derive_more",
+ "displaydoc",
+ "hex",
+ "hkdf",
+ "libsignal-account-keys",
+ "libsignal-core",
+ "partial-default",
+ "poksho",
+ "rand 0.9.2",
+ "rayon",
+ "serde",
+ "sha2",
+ "static_assertions",
+ "subtle",
+ "thiserror 2.0.18",
+ "uuid",
+ "zkcredential",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/signal-call-tunnel/Cargo.toml b/signal-call-tunnel/Cargo.toml
new file mode 100644
index 00000000..c63dabcf
--- /dev/null
+++ b/signal-call-tunnel/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "signal-call-tunnel"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+ringrtc = { path = "../third-party/ringrtc/src/rust", features = ["prebuilt_webrtc", "virtual_audio"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+log = "0.4"
+env_logger = "0.11"
+base64 = "0.22"
+anyhow = "1"
+
+subtle = "2"
+
+[patch.crates-io]
+# Use Signal's fork of curve25519-dalek for zkgroup compatibility (matches ringrtc workspace).
+curve25519-dalek = { git = 'https://github.com/signalapp/curve25519-dalek', tag = 'signal-curve25519-4.1.3' }
diff --git a/signal-call-tunnel/build.rs b/signal-call-tunnel/build.rs
new file mode 100644
index 00000000..f153efd1
--- /dev/null
+++ b/signal-call-tunnel/build.rs
@@ -0,0 +1,66 @@
+use std::path::Path;
+use std::process::Command;
+
+fn main() {
+    // Apply the VPIO-disable patch to ringrtc if it hasn't been applied yet.
+    // This is a build-time patch: cargo re-runs build.rs when the patch file
+    // or the target source file changes.
+    let ringrtc_dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("../third-party/ringrtc");
+    let patch_file = Path::new(env!("CARGO_MANIFEST_DIR")).join("patches/ringrtc-disable-vpio.patch");
+
+    let adm_file = ringrtc_dir.join("src/rust/src/webrtc/audio_device_module.rs");
+
+    println!("cargo::rerun-if-changed={}", patch_file.display());
+    println!("cargo::rerun-if-changed={}", adm_file.display());
+
+    if !patch_file.exists() {
+        return;
+    }
+
+    // Check if the patch is already applied by looking for the marker function.
+    if let Ok(content) = std::fs::read_to_string(&adm_file) {
+        if content.contains("RINGRTC_NO_VOICE_PROCESSING") {
+            // Already applied
+            return;
+        }
+    }
+
+    // Canonicalize paths so git apply works regardless of how cargo sets cwd.
+    // Run from within the ringrtc directory to avoid parent-repo submodule issues.
+    let ringrtc_canonical = match ringrtc_dir.canonicalize() {
+        Ok(p) => p,
+        Err(e) => {
+            eprintln!("cargo:warning=Cannot resolve ringrtc path: {e}");
+            return;
+        }
+    };
+    let patch_canonical = match patch_file.canonicalize() {
+        Ok(p) => p,
+        Err(e) => {
+            eprintln!("cargo:warning=Cannot resolve patch path: {e}");
+            return;
+        }
+    };
+
+    let status = Command::new("git")
+        .arg("apply")
+        .arg(&patch_canonical)
+        .current_dir(&ringrtc_canonical)
+        .status();
+
+    match status {
+        Ok(s) if s.success() => {
+            eprintln!("cargo:warning=Applied ringrtc VPIO-disable patch for virtual audio support");
+        }
+        Ok(s) => {
+            eprintln!(
+                "cargo:warning=Failed to apply ringrtc patch (exit {}); \
+                 VPIO may hang with virtual audio devices",
+                s
+            );
+        }
+        Err(e) => {
+            eprintln!("cargo:warning=Could not run git apply: {e}");
+        }
+    }
+}
diff --git a/signal-call-tunnel/patches/ringrtc-disable-vpio.patch b/signal-call-tunnel/patches/ringrtc-disable-vpio.patch
new file mode 100644
index 00000000..46a46cee
--- /dev/null
+++ b/signal-call-tunnel/patches/ringrtc-disable-vpio.patch
@@ -0,0 +1,41 @@
+diff --git a/src/rust/src/webrtc/audio_device_module.rs b/src/rust/src/webrtc/audio_device_module.rs
+index 5e3a6ecf..a9b76c12 100644
+--- a/src/rust/src/webrtc/audio_device_module.rs
++++ b/src/rust/src/webrtc/audio_device_module.rs
+@@ -265,6 +265,18 @@ impl Worker {
+         }
+     }
+
++    /// Returns the stream preferences for cubeb audio streams.
++    ///
++    /// When `RINGRTC_NO_VOICE_PROCESSING` is set, returns `StreamPrefs::NONE`
++    /// to skip macOS VoiceProcessingIO which hangs with virtual audio drivers.
++    fn stream_prefs() -> StreamPrefs {
++        if std::env::var("RINGRTC_NO_VOICE_PROCESSING").is_ok() {
++            StreamPrefs::NONE
++        } else {
++            StreamPrefs::VOICE
++        }
++    }
++
+     fn init_playout(&mut self) -> anyhow::Result<()> {
+         let out_device = if let Some(device) = self.playout_device {
+             device
+@@ -276,7 +288,7 @@ impl Worker {
+             .rate(SAMPLE_FREQUENCY)
+             .channels(2)
+             .layout(cubeb::ChannelLayout::STEREO)
+-            .prefs(StreamPrefs::VOICE)
++            .prefs(Self::stream_prefs())
+             .take();
+         let mut builder = cubeb::StreamBuilder::<OutFrame>::new();
+         let transport = Arc::clone(&self.audio_transport);
+@@ -411,7 +423,7 @@ impl Worker {
+             .rate(SAMPLE_FREQUENCY)
+             .channels(NUM_CHANNELS)
+             .layout(cubeb::ChannelLayout::MONO)
+-            .prefs(StreamPrefs::VOICE)
++            .prefs(Self::stream_prefs())
+             .take();
+
+         let mut builder = cubeb::StreamBuilder::<Frame>::new();
diff --git a/signal-call-tunnel/src/config.rs b/signal-call-tunnel/src/config.rs
new file mode 100644
index 00000000..105eacda
--- /dev/null
+++ b/signal-call-tunnel/src/config.rs
@@ -0,0 +1,92 @@
+use serde::Deserialize;
+
+#[derive(Debug, Deserialize)]
+pub struct Config {
+    pub call_id: u64,
+    pub is_outgoing: bool,
+    pub control_socket_path: String,
+    pub control_token: String,
+    pub local_device_id: u32,
+    pub input_device_name: Option<String>,
+    pub output_device_name: Option<String>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn deserialize_valid_config() {
+        let json = r#"{
+            "call_id": 12345678,
+            "is_outgoing": true,
+            "control_socket_path": "/tmp/sc-abc/ctrl.sock",
+            "control_token": "dG9rZW4=",
+            "local_device_id": 1
+        }"#;
+        let config: Config = serde_json::from_str(json).unwrap();
+        assert_eq!(config.call_id, 12345678);
+        assert!(config.is_outgoing);
+        assert_eq!(config.control_socket_path, "/tmp/sc-abc/ctrl.sock");
+        assert_eq!(config.control_token, "dG9rZW4=");
+        assert_eq!(config.local_device_id, 1);
+        assert!(config.input_device_name.is_none());
+        assert!(config.output_device_name.is_none());
+    }
+
+    #[test]
+    fn deserialize_with_device_names() {
+        let json = r#"{
+            "call_id": 99,
+            "is_outgoing": false,
+            "control_socket_path": "/tmp/ctrl.sock",
+            "control_token": "tok",
+            "local_device_id": 2,
+            "input_device_name": "signal_input",
+            "output_device_name": "signal_output"
+        }"#;
+        let config: Config = serde_json::from_str(json).unwrap();
+        assert_eq!(config.call_id, 99);
+        assert!(!config.is_outgoing);
+        assert_eq!(config.local_device_id, 2);
+        assert_eq!(config.input_device_name.as_deref(), Some("signal_input"));
+        assert_eq!(config.output_device_name.as_deref(), Some("signal_output"));
+    }
+
+    #[test]
+    fn deserialize_missing_field_fails() {
+        let json = r#"{
+            "call_id": 1,
+            "is_outgoing": true
+        }"#;
+        let result: Result<Config, _> = serde_json::from_str(json);
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn deserialize_wrong_type_fails() {
+        let json = r#"{
+            "call_id": "not_a_number",
+            "is_outgoing": true,
+            "control_socket_path": "/tmp/ctrl.sock",
+            "control_token": "tok",
+            "local_device_id": 1
+        }"#;
+        let result: Result<Config, _> = serde_json::from_str(json);
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn deserialize_extra_fields_ok() {
+        let json = r#"{
+            "call_id": 1,
+            "is_outgoing": true,
+            "control_socket_path": "/tmp/ctrl.sock",
+            "control_token": "tok",
+            "local_device_id": 1,
+            "extra_field": "ignored"
+        }"#;
+        let config: Config = serde_json::from_str(json).unwrap();
+        assert_eq!(config.call_id, 1);
+    }
+}
diff --git a/signal-call-tunnel/src/control.rs b/signal-call-tunnel/src/control.rs
new file mode 100644
index 00000000..0ab1e792
--- /dev/null
+++ b/signal-call-tunnel/src/control.rs
@@ -0,0 +1,521 @@
+use std::io::{BufRead, BufReader, Write};
+use std::os::unix::net::UnixListener;
+use std::sync::mpsc;
+
+use anyhow::{Context, Result, bail};
+use base64::Engine;
+use base64::engine::general_purpose::STANDARD as BASE64;
+use log::{error, info, warn};
+use serde_json::Value;
+use subtle::ConstantTimeEq;
+
+use crate::platform::PlatformEvent;
+
+/// Messages parsed from the parent process.
+#[derive(Debug)]
+pub enum ControlMessage {
+    Auth { token: String },
+    CreateOutgoingCall { call_id: u64, peer_id: String },
+    Proceed { call_id: u64, ice_servers: Vec<IceServerConfig>, hide_ip: bool },
+    ReceivedOffer {
+        call_id: u64,
+        peer_id: String,
+        sender_device_id: u32,
+        opaque: Vec<u8>,
+        age_ms: u64,
+        sender_identity_key: Vec<u8>,
+        receiver_identity_key: Vec<u8>,
+    },
+    ReceivedAnswer {
+        opaque: Vec<u8>,
+        sender_device_id: u32,
+        sender_identity_key: Vec<u8>,
+        receiver_identity_key: Vec<u8>,
+    },
+    ReceivedIce { candidates: Vec<Vec<u8>> },
+    Accept,
+    Hangup,
+}
+
+#[derive(Debug, Clone)]
+pub struct IceServerConfig {
+    pub username: String,
+    pub password: String,
+    pub urls: Vec<String>,
+}
+
+/// Parse a JSON line into a ControlMessage.
+pub fn parse_message(line: &str) -> Result<ControlMessage> {
+    let v: Value = serde_json::from_str(line).context("invalid JSON")?;
+    let msg_type = v["type"].as_str().unwrap_or("");
+
+    match msg_type {
+        "auth" => Ok(ControlMessage::Auth {
+            token: v["token"].as_str().unwrap_or("").to_string(),
+        }),
+        "createOutgoingCall" => Ok(ControlMessage::CreateOutgoingCall {
+            call_id: v["callId"].as_u64().unwrap_or(0),
+            peer_id: v["peerId"].as_str().unwrap_or("").to_string(),
+        }),
+        "proceed" => {
+            let ice_servers = if let Some(servers) = v["iceServers"].as_array() {
+                servers
+                    .iter()
+                    .map(|s| IceServerConfig {
+                        username: s["username"].as_str().unwrap_or("").to_string(),
+                        password: s["password"].as_str().unwrap_or("").to_string(),
+                        urls: s["urls"]
+                            .as_array()
+                            .map(|urls| {
+                                urls.iter()
+                                    .filter_map(|u| u.as_str().map(String::from))
+                                    .collect()
+                            })
+                            .unwrap_or_default(),
+                    })
+                    .collect()
+            } else {
+                Vec::new()
+            };
+            Ok(ControlMessage::Proceed {
+                call_id: v["callId"].as_u64().unwrap_or(0),
+                ice_servers,
+                hide_ip: v["hideIp"].as_bool().unwrap_or(false),
+            })
+        }
+        "receivedOffer" => Ok(ControlMessage::ReceivedOffer {
+            call_id: v["callId"].as_u64().unwrap_or(0),
+            peer_id: v["peerId"].as_str().unwrap_or("remote").to_string(),
+            sender_device_id: v["senderDeviceId"].as_u64().unwrap_or(1) as u32,
+            opaque: BASE64
+                .decode(v["opaque"].as_str().unwrap_or(""))
+                .unwrap_or_default(),
+            age_ms: v["age"].as_u64().unwrap_or(0),
+            sender_identity_key: BASE64
+                .decode(v["senderIdentityKey"].as_str().unwrap_or(""))
+                .unwrap_or_default(),
+            receiver_identity_key: BASE64
+                .decode(v["receiverIdentityKey"].as_str().unwrap_or(""))
+                .unwrap_or_default(),
+        }),
+        "receivedAnswer" => Ok(ControlMessage::ReceivedAnswer {
+            opaque: BASE64
+                .decode(v["opaque"].as_str().unwrap_or(""))
+                .unwrap_or_default(),
+            sender_device_id: v["senderDeviceId"].as_u64().unwrap_or(1) as u32,
+            sender_identity_key: BASE64
+                .decode(v["senderIdentityKey"].as_str().unwrap_or(""))
+                .unwrap_or_default(),
+            receiver_identity_key: BASE64
+                .decode(v["receiverIdentityKey"].as_str().unwrap_or(""))
+                .unwrap_or_default(),
+        }),
+        "receivedIce" => {
+            let candidates = if let Some(arr) = v["candidates"].as_array() {
+                arr.iter()
+                    .filter_map(|c| {
+                        let b64 = c.as_str()?;
+                        BASE64.decode(b64).ok()
+                    })
+                    .collect()
+            } else {
+                Vec::new()
+            };
+            Ok(ControlMessage::ReceivedIce { candidates })
+        }
+        "accept" => Ok(ControlMessage::Accept),
+        "hangup" => Ok(ControlMessage::Hangup),
+        _ => bail!("unknown message type: {}", msg_type),
+    }
+}
+
+/// Validate the auth token using constant-time comparison.
+pub fn validate_token(received: &str, expected: &str) -> bool {
+    let received_bytes = received.as_bytes();
+    let expected_bytes = expected.as_bytes();
+    if received_bytes.len() != expected_bytes.len() {
+        return false;
+    }
+    received_bytes.ct_eq(expected_bytes).into()
+}
+
+/// Runs the control channel server. Binds a Unix socket, accepts one connection,
+/// validates auth, then reads messages and sends events.
+///
+/// Returns a channel receiver for incoming control messages and a writer for
+/// sending events to the parent.
+pub struct ControlChannel {
+    pub msg_receiver: mpsc::Receiver<ControlMessage>,
+    pub writer: ControlWriter,
+}
+
+#[derive(Clone)]
+pub struct ControlWriter {
+    sender: mpsc::Sender<String>,
+}
+
+impl ControlWriter {
+    pub fn send_line(&self, line: &str) {
+        if let Err(e) = self.sender.send(line.to_string()) {
+            error!("Failed to send to control writer: {}", e);
+        }
+    }
+
+    pub fn send_event(&self, event: &PlatformEvent) {
+        self.send_line(&event.to_json());
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // --- parse_message tests ---
+
+    #[test]
+    fn parse_auth() {
+        let msg = parse_message(r#"{"type":"auth","token":"secret123"}"#).unwrap();
+        match msg {
+            ControlMessage::Auth { token } => assert_eq!(token, "secret123"),
+            _ => panic!("expected Auth, got {:?}", msg),
+        }
+    }
+
+    #[test]
+    fn parse_create_outgoing_call() {
+        let msg = parse_message(
+            r#"{"type":"createOutgoingCall","callId":42,"peerId":"abc-def"}"#,
+        )
+        .unwrap();
+        match msg {
+            ControlMessage::CreateOutgoingCall { call_id, peer_id } => {
+                assert_eq!(call_id, 42);
+                assert_eq!(peer_id, "abc-def");
+            }
+            _ => panic!("expected CreateOutgoingCall, got {:?}", msg),
+        }
+    }
+
+    #[test]
+    fn parse_proceed_with_ice_servers() {
+        let json = r#"{
+            "type": "proceed",
+            "callId": 99,
+            "hideIp": true,
+            "iceServers": [
+                {
+                    "username": "user1",
+                    "password": "pass1",
+                    "urls": ["turn:example.com:3478", "stun:example.com:3478"]
+                },
+                {
+                    "username": "user2",
+                    "password": "pass2",
+                    "urls": ["turn:other.com:443"]
+                }
+            ]
+        }"#;
+        let msg = parse_message(json).unwrap();
+        match msg {
+            ControlMessage::Proceed {
+                call_id,
+                ice_servers,
+                hide_ip,
+            } => {
+                assert_eq!(call_id, 99);
+                assert!(hide_ip);
+                assert_eq!(ice_servers.len(), 2);
+                assert_eq!(ice_servers[0].username, "user1");
+                assert_eq!(ice_servers[0].password, "pass1");
+                assert_eq!(ice_servers[0].urls.len(), 2);
+                assert_eq!(ice_servers[0].urls[0], "turn:example.com:3478");
+                assert_eq!(ice_servers[1].username, "user2");
+                assert_eq!(ice_servers[1].urls.len(), 1);
+            }
+            _ => panic!("expected Proceed, got {:?}", msg),
+        }
+    }
+
+    #[test]
+    fn parse_proceed_no_ice_servers() {
+        let msg = parse_message(r#"{"type":"proceed","callId":1}"#).unwrap();
+        match msg {
+            ControlMessage::Proceed {
+                call_id,
+                ice_servers,
+                hide_ip,
+            } => {
+                assert_eq!(call_id, 1);
+                assert!(!hide_ip);
+                assert!(ice_servers.is_empty());
+            }
+            _ => panic!("expected Proceed, got {:?}", msg),
+        }
+    }
+
+    #[test]
+    fn parse_received_offer() {
+        // "aGVsbG8=" is base64 for "hello"
+        let json = r#"{
+            "type": "receivedOffer",
+            "callId": 100,
+            "peerId": "0b949a17-dc53-41b1-9ebc-dea99cb93920",
+            "senderDeviceId": 3,
+            "opaque": "aGVsbG8=",
+            "age": 500,
+            "senderIdentityKey": "AQID",
+            "receiverIdentityKey": "BAUG"
+        }"#;
+        let msg = parse_message(json).unwrap();
+        match msg {
+            ControlMessage::ReceivedOffer {
+                call_id,
+                peer_id,
+                sender_device_id,
+                opaque,
+                age_ms,
+                sender_identity_key,
+                receiver_identity_key,
+            } => {
+                assert_eq!(call_id, 100);
+                assert_eq!(peer_id, "0b949a17-dc53-41b1-9ebc-dea99cb93920");
+                assert_eq!(sender_device_id, 3);
+                assert_eq!(opaque, b"hello");
+                assert_eq!(age_ms, 500);
+                assert_eq!(sender_identity_key, vec![1, 2, 3]);
+                assert_eq!(receiver_identity_key, vec![4, 5, 6]);
+            }
+            _ => panic!("expected ReceivedOffer, got {:?}", msg),
+        }
+    }
+
+    #[test]
+    fn parse_received_answer() {
+        let json = r#"{
+            "type": "receivedAnswer",
+            "opaque": "AQID",
+            "senderDeviceId": 2,
+            "senderIdentityKey": "BAUG",
+            "receiverIdentityKey": "BwgJ"
+        }"#;
+        let msg = parse_message(json).unwrap();
+        match msg {
+            ControlMessage::ReceivedAnswer {
+                opaque,
+                sender_device_id,
+                sender_identity_key,
+                receiver_identity_key,
+            } => {
+                assert_eq!(opaque, vec![1, 2, 3]);
+                assert_eq!(sender_device_id, 2);
+                assert_eq!(sender_identity_key, vec![4, 5, 6]);
+                assert_eq!(receiver_identity_key, vec![7, 8, 9]);
+            }
+            _ => panic!("expected ReceivedAnswer, got {:?}", msg),
+        }
+    }
+
+    #[test]
+    fn parse_received_ice() {
+        // Two base64-encoded candidates
+        let json = r#"{"type":"receivedIce","candidates":["AQID","BAUG"]}"#;
+        let msg = parse_message(json).unwrap();
+        match msg {
+            ControlMessage::ReceivedIce { candidates } => {
+                assert_eq!(candidates.len(), 2);
+                assert_eq!(candidates[0], vec![1, 2, 3]);
+                assert_eq!(candidates[1], vec![4, 5, 6]);
+            }
+            _ => panic!("expected ReceivedIce, got {:?}", msg),
+        }
+    }
+
+    #[test]
+    fn parse_received_ice_empty() {
+        let msg = parse_message(r#"{"type":"receivedIce","candidates":[]}"#).unwrap();
+        match msg {
+            ControlMessage::ReceivedIce { candidates } => {
+                assert!(candidates.is_empty());
+            }
+            _ => panic!("expected ReceivedIce, got {:?}", msg),
+        }
+    }
+
+    #[test]
+    fn parse_accept() {
+        let msg = parse_message(r#"{"type":"accept"}"#).unwrap();
+        assert!(matches!(msg, ControlMessage::Accept));
+    }
+
+    #[test]
+    fn parse_hangup() {
+        let msg = parse_message(r#"{"type":"hangup"}"#).unwrap();
+        assert!(matches!(msg, ControlMessage::Hangup));
+    }
+
+    #[test]
+    fn parse_unknown_type_fails() {
+        let result = parse_message(r#"{"type":"foobar"}"#);
+        assert!(result.is_err());
+        assert!(result.unwrap_err().to_string().contains("unknown message type"));
+    }
+
+    #[test]
+    fn parse_invalid_json_fails() {
+        let result = parse_message("not json at all");
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn parse_missing_type_fails() {
+        let result = parse_message(r#"{"callId":1}"#);
+        assert!(result.is_err());
+    }
+
+    // --- validate_token tests ---
+
+    #[test]
+    fn validate_token_matching() {
+        assert!(validate_token("my-secret-token", "my-secret-token"));
+    }
+
+    #[test]
+    fn validate_token_mismatch() {
+        assert!(!validate_token("wrong-token", "my-secret-token"));
+    }
+
+    #[test]
+    fn validate_token_different_lengths() {
+        assert!(!validate_token("short", "a-much-longer-token"));
+    }
+
+    #[test]
+    fn validate_token_empty() {
+        assert!(validate_token("", ""));
+    }
+
+    #[test]
+    fn validate_token_one_empty() {
+        assert!(!validate_token("", "notempty"));
+        assert!(!validate_token("notempty", ""));
+    }
+}
+
+pub fn start_control_channel(
+    control_socket_path: &str,
+    expected_token: &str,
+    input_device_name: &str,
+    output_device_name: &str,
+) -> Result<ControlChannel> {
+    // Remove stale socket file
+    let _ = std::fs::remove_file(control_socket_path);
+
+    let listener = UnixListener::bind(control_socket_path)
+        .with_context(|| format!("failed to bind control socket at {}", control_socket_path))?;
+    info!("Control channel listening on {}", control_socket_path);
+
+    let (msg_sender, msg_receiver) = mpsc::channel::<ControlMessage>();
+    let (write_sender, write_receiver) = mpsc::channel::<String>();
+    let writer = ControlWriter {
+        sender: write_sender,
+    };
+
+    // Send ready message immediately (parent can connect after this)
+    let ready_msg = format!(
+        r#"{{"type":"ready","inputDeviceName":"{}","outputDeviceName":"{}"}}"#,
+        input_device_name, output_device_name
+    );
+
+    let expected_token = expected_token.to_string();
+
+    // Spawn reader thread
+    std::thread::spawn(move || {
+        // Accept one connection
+        let (stream, _) = match listener.accept() {
+            Ok(s) => s,
+            Err(e) => {
+                error!("Failed to accept control connection: {}", e);
+                return;
+            }
+        };
+        info!("Control channel: parent connected");
+
+        let mut writer_stream = match stream.try_clone() {
+            Ok(s) => s,
+            Err(e) => {
+                error!("Failed to clone control stream: {}", e);
+                return;
+            }
+        };
+
+        // Spawn writer thread
+        std::thread::spawn(move || {
+            for line in write_receiver {
+                if let Err(e) = writeln!(writer_stream, "{}", line) {
+                    error!("Failed to write to control channel: {}", e);
+                    break;
+                }
+                if let Err(e) = writer_stream.flush() {
+                    error!("Failed to flush control channel: {}", e);
+                    break;
+                }
+            }
+        });
+
+        let reader = BufReader::new(stream);
+        let mut authenticated = false;
+
+        for line in reader.lines() {
+            let line = match line {
+                Ok(l) => l,
+                Err(e) => {
+                    info!("Control channel read ended: {}", e);
+                    break;
+                }
+            };
+
+            if line.trim().is_empty() {
+                continue;
+            }
+
+            let msg = match parse_message(&line) {
+                Ok(m) => m,
+                Err(e) => {
+                    warn!("Failed to parse control message: {} (line: {})", e, line);
+                    continue;
+                }
+            };
+
+            // First message must be auth
+            if !authenticated {
+                if let ControlMessage::Auth { ref token } = msg {
+                    if validate_token(token, &expected_token) {
+                        authenticated = true;
+                        info!("Control channel: authenticated");
+                        continue;
+                    } else {
+                        error!("Control channel: auth failed");
+                        break;
+                    }
+                } else {
+                    error!("Control channel: first message must be auth");
+                    break;
+                }
+            }
+
+            if let Err(e) = msg_sender.send(msg) {
+                info!("Control message receiver dropped: {}", e);
+                break;
+            }
+        }
+    });
+
+    // Send the ready message through the writer channel
+    // (it will be sent once the writer thread starts)
+    writer.send_line(&ready_msg);
+
+    Ok(ControlChannel {
+        msg_receiver,
+        writer,
+    })
+}
diff --git a/signal-call-tunnel/src/main.rs b/signal-call-tunnel/src/main.rs
new file mode 100644
index 00000000..bc253f41
--- /dev/null
+++ b/signal-call-tunnel/src/main.rs
@@ -0,0 +1,410 @@
+mod config;
+mod control;
+mod platform;
+
+use std::io::Read;
+use std::sync::mpsc;
+use std::time::Duration;
+
+use anyhow::{Context, Result};
+use log::{debug, error, info};
+
+use ringrtc::common::{CallConfig, CallId, CallMediaType, DataMode, DeviceId};
+use ringrtc::core::{call_manager::CallManager, signaling};
+use ringrtc::lite::http;
+use ringrtc::native::{NativeCallContext, NativePlatform, PeerId};
+use ringrtc::virtual_audio::VirtualAudioDevicePair;
+use ringrtc::webrtc::{
+    media::{VideoFrame, VideoSink},
+    peer_connection_factory::{AudioConfig, IceServer, PeerConnectionFactory},
+};
+
+use crate::config::Config;
+use crate::control::{ControlMessage, start_control_channel};
+use crate::platform::{
+    PlatformEvent, TunnelGroupHandler, TunnelSignalingSender, TunnelStateHandler,
+};
+
+/// Dummy video sink that discards all frames.
+#[derive(Debug)]
+struct NullVideoSink;
+
+impl VideoSink for NullVideoSink {
+    fn on_video_frame(&self, _track_id: u32, _frame: VideoFrame) {}
+    fn box_clone(&self) -> Box<dyn VideoSink> {
+        Box::new(NullVideoSink)
+    }
+}
+
+/// Dummy HTTP client for CallManager (no SFU needed for 1:1 calls).
+#[derive(Clone)]
+struct NullHttpClient;
+
+impl http::Delegate for NullHttpClient {
+    fn send_request(&self, _request_id: u32, _request: http::Request) {
+        // No-op -- no group call SFU requests
+    }
+}
+
+fn main() -> Result<()> {
+    env_logger::Builder::from_env(env_logger::Env::default().default_filter_or("info"))
+        .format_timestamp_millis()
+        .init();
+
+    // Read config from stdin
+    let mut config_str = String::new();
+    std::io::stdin()
+        .read_to_string(&mut config_str)
+        .context("failed to read config from stdin")?;
+    let config: Config =
+        serde_json::from_str(&config_str).context("failed to parse config JSON")?;
+
+    info!(
+        "signal-call-tunnel starting: call_id={}, is_outgoing={}",
+        config.call_id, config.is_outgoing
+    );
+
+    // Create virtual audio devices (signal-call-tunnel owns their lifecycle).
+    // On macOS, BlackHole drivers must be pre-installed with matching names (requires
+    // root), so we default to fixed names.  On Linux, PulseAudio virtual sinks are
+    // created dynamically, so per-call unique names avoid collisions.
+    let input_name = config.input_device_name.clone().unwrap_or_else(|| {
+        if cfg!(target_os = "macos") {
+            "signal_input".to_string()
+        } else {
+            format!("signal_input_{}", config.call_id)
+        }
+    });
+    let output_name = config.output_device_name.clone().unwrap_or_else(|| {
+        if cfg!(target_os = "macos") {
+            "signal_output".to_string()
+        } else {
+            format!("signal_output_{}", config.call_id)
+        }
+    });
+
+    let virtual_audio = VirtualAudioDevicePair::new(&input_name, &output_name)?;
+    info!(
+        "Virtual audio devices: input={}, output={}",
+        virtual_audio.input_source(),
+        virtual_audio.output_sink()
+    );
+
+    // Channel for platform events (signaling + state changes)
+    let (event_sender, event_receiver) = mpsc::channel::<PlatformEvent>();
+
+    // Start control channel
+    let control = start_control_channel(
+        &config.control_socket_path,
+        &config.control_token,
+        virtual_audio.input_source(),
+        virtual_audio.output_sink(),
+    )?;
+
+    // Show WebRTC logs while debugging
+    #[cfg(debug_assertions)]
+    ringrtc::webrtc::logging::set_logger(log::LevelFilter::Debug);
+
+    #[cfg(not(debug_assertions))]
+    ringrtc::webrtc::logging::set_logger(log::LevelFilter::Warn);
+
+    // Disable macOS VPIO (VoiceProcessingIO) for cubeb audio streams.
+    // VPIO creates an aggregate device that hangs with BlackHole virtual audio
+    // drivers.  Voice processing (AEC/AGC/NS) is unnecessary for virtual audio.
+    // Safety: called before any threads are spawned, single-threaded at this point.
+    unsafe { std::env::set_var("RINGRTC_NO_VOICE_PROCESSING", "1") };
+
+    let audio_config = AudioConfig::default();
+    let mut pcf = PeerConnectionFactory::new(&audio_config, false, "", None)?;
+
+    // Wait for cubeb to enumerate the virtual devices
+    loop {
+        std::thread::sleep(Duration::from_millis(100));
+        if pcf
+            .get_audio_playout_devices()
+            .is_ok_and(|d| !d.is_empty())
+            && pcf
+                .get_audio_recording_devices()
+                .is_ok_and(|d| !d.is_empty())
+        {
+            break;
+        }
+    }
+
+    // Select virtual devices by name.
+    //
+    // We can't use set_audio_*_device_by_id() because the ADM matches on the
+    // cubeb unique_id (e.g. "signal_input2ch_UID"), not the friendly name we
+    // know ("signal_input").  Instead, enumerate and find the index by name.
+    let input_name = virtual_audio.input_source();
+    let recording_devices = pcf.get_audio_recording_devices()?;
+    let recording_index = recording_devices
+        .iter()
+        .position(|d| d.name == input_name)
+        .ok_or_else(|| anyhow::anyhow!("recording device '{}' not found", input_name))?
+        as u16;
+    pcf.set_audio_recording_device(recording_index)?;
+    info!("Selected recording device: index={}, name={}", recording_index, input_name);
+
+    let output_name = virtual_audio.output_sink();
+    let playout_devices = pcf.get_audio_playout_devices()?;
+    let playout_index = playout_devices
+        .iter()
+        .position(|d| d.name == output_name)
+        .ok_or_else(|| anyhow::anyhow!("playout device '{}' not found", output_name))?
+        as u16;
+    pcf.set_audio_playout_device(playout_index)?;
+    info!("Selected playout device: index={}, name={}", playout_index, output_name);
+
+    // Create platform with our trait implementations
+    let signaling_sender = Box::new(TunnelSignalingSender {
+        event_sender: event_sender.clone(),
+    });
+    let state_handler = Box::new(TunnelStateHandler {
+        event_sender: event_sender.clone(),
+    });
+    let group_handler = Box::new(TunnelGroupHandler);
+
+    let platform = NativePlatform::new(
+        pcf.clone(),
+        signaling_sender,
+        true, // should_assume_messages_sent
+        state_handler,
+        group_handler,
+    );
+
+    let http_client = http::DelegatingClient::new(NullHttpClient);
+    let mut call_manager = CallManager::new(platform, http_client)?;
+
+    // Peer ID is set by the first createOutgoingCall or receivedOffer message.
+    let mut active_peer_id = PeerId::from("remote");
+    let call_id = CallId::from(config.call_id);
+    let local_device_id = config.local_device_id as DeviceId;
+
+    info!("CallManager initialized, entering event loop");
+
+    // Spawn a thread to forward platform events to control channel
+    let control_writer = control.writer.clone();
+    std::thread::spawn(move || {
+        for event in event_receiver {
+            control_writer.send_event(&event);
+        }
+    });
+
+    // Main event loop: process control messages
+    loop {
+        let msg = match control.msg_receiver.recv_timeout(Duration::from_millis(100)) {
+            Ok(msg) => msg,
+            Err(mpsc::RecvTimeoutError::Timeout) => continue,
+            Err(mpsc::RecvTimeoutError::Disconnected) => {
+                info!("Control channel disconnected, exiting");
+                break;
+            }
+        };
+
+        match msg {
+            ControlMessage::Auth { .. } => {
+                // Already handled by control channel
+            }
+            ControlMessage::CreateOutgoingCall {
+                call_id: cid,
+                peer_id: pid,
+            } => {
+                let call_id = CallId::from(cid);
+                let peer_id = PeerId::from(pid.as_str());
+                active_peer_id = peer_id.clone();
+                info!("Creating outgoing call: call_id={}, peer_id={}", cid, pid);
+                if let Err(e) = call_manager.create_outgoing_call(
+                    peer_id,
+                    call_id,
+                    CallMediaType::Audio,
+                    local_device_id,
+                ) {
+                    error!("Failed to create outgoing call: {}", e);
+                    control.writer.send_line(&format!(
+                        r#"{{"type":"error","message":"failed to create outgoing call: {}"}}"#,
+                        e
+                    ));
+                }
+            }
+            ControlMessage::Proceed {
+                call_id: cid,
+                ice_servers,
+                hide_ip,
+            } => {
+                let call_id = CallId::from(cid);
+                info!("Proceeding with call: call_id={}", cid);
+
+                let ice_server_list: Vec<IceServer> = ice_servers
+                    .iter()
+                    .map(|s| IceServer::new(
+                        s.username.clone(),
+                        s.password.clone(),
+                        String::new(),
+                        s.urls.clone(),
+                    ))
+                    .collect();
+
+                let outgoing_audio_track = match pcf.create_outgoing_audio_track() {
+                    Ok(t) => t,
+                    Err(e) => {
+                        error!("Failed to create audio track: {}", e);
+                        continue;
+                    }
+                };
+                let outgoing_video_source = match pcf.create_outgoing_video_source() {
+                    Ok(s) => s,
+                    Err(e) => {
+                        error!("Failed to create video source: {}", e);
+                        continue;
+                    }
+                };
+                let outgoing_video_track =
+                    match pcf.create_outgoing_video_track(&outgoing_video_source) {
+                        Ok(t) => t,
+                        Err(e) => {
+                            error!("Failed to create video track: {}", e);
+                            continue;
+                        }
+                    };
+
+                let call_context = NativeCallContext::new(
+                    hide_ip,
+                    ice_server_list,
+                    outgoing_audio_track,
+                    outgoing_video_track,
+                    Box::new(NullVideoSink),
+                );
+
+                let call_config = CallConfig {
+                    data_mode: DataMode::Low,
+                    ..Default::default()
+                };
+
+                if let Err(e) =
+                    call_manager.proceed(call_id, call_context, call_config, None)
+                {
+                    error!("Failed to proceed: {}", e);
+                    control.writer.send_line(&format!(
+                        r#"{{"type":"error","message":"failed to proceed: {}"}}"#,
+                        e
+                    ));
+                }
+            }
+            ControlMessage::ReceivedOffer {
+                call_id: cid,
+                peer_id: pid,
+                sender_device_id,
+                opaque,
+                age_ms,
+                sender_identity_key,
+                receiver_identity_key,
+            } => {
+                let call_id = CallId::from(cid);
+                let peer_id = PeerId::from(pid.as_str());
+                active_peer_id = peer_id.clone();
+                info!(
+                    "Received offer: call_id={}, peer_id={}, sender_device={}",
+                    cid, pid, sender_device_id
+                );
+
+                let offer = match signaling::Offer::new(CallMediaType::Audio, opaque) {
+                    Ok(o) => o,
+                    Err(e) => {
+                        error!("Failed to parse offer: {}", e);
+                        continue;
+                    }
+                };
+
+                let received = signaling::ReceivedOffer {
+                    offer,
+                    age: Duration::from_millis(age_ms),
+                    sender_device_id: sender_device_id as DeviceId,
+                    receiver_device_id: local_device_id,
+                    sender_identity_key,
+                    receiver_identity_key,
+                };
+
+                if let Err(e) = call_manager.received_offer(
+                    peer_id,
+                    call_id,
+                    received,
+                ) {
+                    error!("Failed to process received offer: {}", e);
+                }
+            }
+            ControlMessage::ReceivedAnswer {
+                opaque,
+                sender_device_id,
+                sender_identity_key,
+                receiver_identity_key,
+            } => {
+                info!("Received answer from device {}", sender_device_id);
+
+                let answer = match signaling::Answer::new(opaque) {
+                    Ok(a) => a,
+                    Err(e) => {
+                        error!("Failed to parse answer: {}", e);
+                        continue;
+                    }
+                };
+
+                let received = signaling::ReceivedAnswer {
+                    answer,
+                    sender_device_id: sender_device_id as DeviceId,
+                    sender_identity_key,
+                    receiver_identity_key,
+                };
+
+                if let Err(e) = call_manager.received_answer(
+                    active_peer_id.clone(),
+                    call_id,
+                    received,
+                ) {
+                    error!("Failed to process received answer: {}", e);
+                }
+            }
+            ControlMessage::ReceivedIce { candidates } => {
+                debug!("Received {} ICE candidates", candidates.len());
+
+                let ice_candidates: Vec<signaling::IceCandidate> = candidates
+                    .into_iter()
+                    .map(signaling::IceCandidate::new)
+                    .collect();
+
+                let received = signaling::ReceivedIce {
+                    ice: signaling::Ice {
+                        candidates: ice_candidates,
+                    },
+                    sender_device_id: 1 as DeviceId,
+                };
+
+                if let Err(e) = call_manager.received_ice(
+                    active_peer_id.clone(),
+                    call_id,
+                    received,
+                ) {
+                    error!("Failed to process received ICE: {}", e);
+                }
+            }
+            ControlMessage::Accept => {
+                info!("Accepting call");
+                if let Err(e) = call_manager.accept_call(call_id) {
+                    error!("Failed to accept call: {}", e);
+                }
+            }
+            ControlMessage::Hangup => {
+                info!("Hanging up");
+                if let Err(e) = call_manager.hangup() {
+                    error!("Failed to hangup: {}", e);
+                }
+                // Give time for hangup to be sent
+                std::thread::sleep(Duration::from_millis(500));
+                break;
+            }
+        }
+    }
+
+    info!("signal-call-tunnel exiting");
+    Ok(())
+}
diff --git a/signal-call-tunnel/src/platform.rs b/signal-call-tunnel/src/platform.rs
new file mode 100644
index 00000000..f9e25036
--- /dev/null
+++ b/signal-call-tunnel/src/platform.rs
@@ -0,0 +1,481 @@
+use std::collections::{HashMap, HashSet};
+use std::sync::mpsc;
+
+use anyhow::Result;
+use base64::Engine;
+use base64::engine::general_purpose::STANDARD as BASE64;
+use log::{debug, error, info, warn};
+
+use ringrtc::common::{CallId, CallMediaType, DeviceId};
+use ringrtc::core::{group_call, signaling};
+use ringrtc::lite::sfu::UserId;
+use ringrtc::native::{
+    CallState, CallStateHandler, GroupUpdate, GroupUpdateHandler, SignalingSender,
+};
+use ringrtc::webrtc::peer_connection::AudioLevel;
+use ringrtc::webrtc::peer_connection_observer::NetworkRoute;
+
+/// Events sent from the platform callbacks to the control channel writer.
+#[derive(Debug)]
+pub enum PlatformEvent {
+    /// A signaling message to send to the parent process.
+    SendSignaling {
+        call_id: CallId,
+        message: SignalingEvent,
+    },
+    /// A call state change.
+    StateChange {
+        state: String,
+        reason: Option<String>,
+    },
+}
+
+#[derive(Debug)]
+pub enum SignalingEvent {
+    SendOffer {
+        opaque: Vec<u8>,
+        call_media_type: CallMediaType,
+    },
+    SendAnswer {
+        opaque: Vec<u8>,
+    },
+    SendIce {
+        candidates: Vec<Vec<u8>>,
+    },
+    SendHangup {
+        hangup_type: String,
+    },
+    SendBusy,
+}
+
+impl PlatformEvent {
+    pub fn to_json(&self) -> String {
+        match self {
+            PlatformEvent::SendSignaling { call_id, message } => match message {
+                SignalingEvent::SendOffer {
+                    opaque,
+                    call_media_type,
+                } => {
+                    let media_type = match call_media_type {
+                        CallMediaType::Audio => "audio",
+                        CallMediaType::Video => "video",
+                    };
+                    format!(
+                        r#"{{"type":"sendOffer","callId":{},"opaque":"{}","callMediaType":"{}"}}"#,
+                        u64::from(*call_id),
+                        BASE64.encode(opaque),
+                        media_type,
+                    )
+                }
+                SignalingEvent::SendAnswer { opaque } => {
+                    format!(
+                        r#"{{"type":"sendAnswer","callId":{},"opaque":"{}"}}"#,
+                        u64::from(*call_id),
+                        BASE64.encode(opaque),
+                    )
+                }
+                SignalingEvent::SendIce { candidates } => {
+                    let candidates_json: Vec<String> = candidates
+                        .iter()
+                        .map(|c| format!(r#"{{"opaque":"{}"}}"#, BASE64.encode(c)))
+                        .collect();
+                    format!(
+                        r#"{{"type":"sendIce","callId":{},"candidates":[{}]}}"#,
+                        u64::from(*call_id),
+                        candidates_json.join(","),
+                    )
+                }
+                SignalingEvent::SendHangup { hangup_type } => {
+                    format!(
+                        r#"{{"type":"sendHangup","callId":{},"hangupType":"{}"}}"#,
+                        u64::from(*call_id),
+                        hangup_type,
+                    )
+                }
+                SignalingEvent::SendBusy => {
+                    format!(
+                        r#"{{"type":"sendBusy","callId":{}}}"#,
+                        u64::from(*call_id),
+                    )
+                }
+            },
+            PlatformEvent::StateChange { state, reason } => {
+                if let Some(reason) = reason {
+                    format!(
+                        r#"{{"type":"stateChange","state":"{}","reason":"{}"}}"#,
+                        state, reason,
+                    )
+                } else {
+                    format!(r#"{{"type":"stateChange","state":"{}"}}"#, state)
+                }
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::Value;
+
+    fn parse_event_json(event: &PlatformEvent) -> Value {
+        serde_json::from_str(&event.to_json()).expect("event JSON should be valid")
+    }
+
+    #[test]
+    fn send_offer_json() {
+        let event = PlatformEvent::SendSignaling {
+            call_id: CallId::from(42u64),
+            message: SignalingEvent::SendOffer {
+                opaque: vec![1, 2, 3],
+                call_media_type: CallMediaType::Audio,
+            },
+        };
+        let json = parse_event_json(&event);
+        assert_eq!(json["type"], "sendOffer");
+        assert_eq!(json["callId"], 42);
+        assert_eq!(json["callMediaType"], "audio");
+        // Verify opaque is valid base64 that decodes back
+        let opaque_b64 = json["opaque"].as_str().unwrap();
+        let decoded = BASE64.decode(opaque_b64).unwrap();
+        assert_eq!(decoded, vec![1, 2, 3]);
+    }
+
+    #[test]
+    fn send_offer_video_json() {
+        let event = PlatformEvent::SendSignaling {
+            call_id: CallId::from(1u64),
+            message: SignalingEvent::SendOffer {
+                opaque: vec![],
+                call_media_type: CallMediaType::Video,
+            },
+        };
+        let json = parse_event_json(&event);
+        assert_eq!(json["callMediaType"], "video");
+    }
+
+    #[test]
+    fn send_answer_json() {
+        let event = PlatformEvent::SendSignaling {
+            call_id: CallId::from(99u64),
+            message: SignalingEvent::SendAnswer {
+                opaque: vec![4, 5, 6],
+            },
+        };
+        let json = parse_event_json(&event);
+        assert_eq!(json["type"], "sendAnswer");
+        assert_eq!(json["callId"], 99);
+        let decoded = BASE64.decode(json["opaque"].as_str().unwrap()).unwrap();
+        assert_eq!(decoded, vec![4, 5, 6]);
+    }
+
+    #[test]
+    fn send_ice_json() {
+        let event = PlatformEvent::SendSignaling {
+            call_id: CallId::from(7u64),
+            message: SignalingEvent::SendIce {
+                candidates: vec![vec![10, 20], vec![30, 40]],
+            },
+        };
+        let json = parse_event_json(&event);
+        assert_eq!(json["type"], "sendIce");
+        assert_eq!(json["callId"], 7);
+        let candidates = json["candidates"].as_array().unwrap();
+        assert_eq!(candidates.len(), 2);
+        let c0 = BASE64
+            .decode(candidates[0]["opaque"].as_str().unwrap())
+            .unwrap();
+        assert_eq!(c0, vec![10, 20]);
+        let c1 = BASE64
+            .decode(candidates[1]["opaque"].as_str().unwrap())
+            .unwrap();
+        assert_eq!(c1, vec![30, 40]);
+    }
+
+    #[test]
+    fn send_ice_empty_candidates_json() {
+        let event = PlatformEvent::SendSignaling {
+            call_id: CallId::from(1u64),
+            message: SignalingEvent::SendIce {
+                candidates: vec![],
+            },
+        };
+        let json = parse_event_json(&event);
+        assert_eq!(json["candidates"].as_array().unwrap().len(), 0);
+    }
+
+    #[test]
+    fn send_hangup_json() {
+        let event = PlatformEvent::SendSignaling {
+            call_id: CallId::from(50u64),
+            message: SignalingEvent::SendHangup {
+                hangup_type: "normal".to_string(),
+            },
+        };
+        let json = parse_event_json(&event);
+        assert_eq!(json["type"], "sendHangup");
+        assert_eq!(json["callId"], 50);
+        assert_eq!(json["hangupType"], "normal");
+    }
+
+    #[test]
+    fn send_busy_json() {
+        let event = PlatformEvent::SendSignaling {
+            call_id: CallId::from(8u64),
+            message: SignalingEvent::SendBusy,
+        };
+        let json = parse_event_json(&event);
+        assert_eq!(json["type"], "sendBusy");
+        assert_eq!(json["callId"], 8);
+    }
+
+    #[test]
+    fn state_change_with_reason_json() {
+        let event = PlatformEvent::StateChange {
+            state: "Ended".to_string(),
+            reason: Some("Timeout".to_string()),
+        };
+        let json = parse_event_json(&event);
+        assert_eq!(json["type"], "stateChange");
+        assert_eq!(json["state"], "Ended");
+        assert_eq!(json["reason"], "Timeout");
+    }
+
+    #[test]
+    fn state_change_without_reason_json() {
+        let event = PlatformEvent::StateChange {
+            state: "Connected".to_string(),
+            reason: None,
+        };
+        let json = parse_event_json(&event);
+        assert_eq!(json["type"], "stateChange");
+        assert_eq!(json["state"], "Connected");
+        assert!(json.get("reason").is_none());
+    }
+
+    // --- Round-trip tests: platform event -> JSON -> parse as control message ---
+
+    #[test]
+    fn round_trip_offer() {
+        let opaque = vec![0xDE, 0xAD, 0xBE, 0xEF];
+        let event = PlatformEvent::SendSignaling {
+            call_id: CallId::from(123u64),
+            message: SignalingEvent::SendOffer {
+                opaque: opaque.clone(),
+                call_media_type: CallMediaType::Audio,
+            },
+        };
+        let json_str = event.to_json();
+        // The parent would receive this JSON and could extract the opaque
+        let parsed: Value = serde_json::from_str(&json_str).unwrap();
+        let decoded = BASE64
+            .decode(parsed["opaque"].as_str().unwrap())
+            .unwrap();
+        assert_eq!(decoded, opaque);
+    }
+
+    #[test]
+    fn round_trip_ice() {
+        let candidates = vec![vec![1, 2, 3], vec![4, 5, 6, 7, 8]];
+        let event = PlatformEvent::SendSignaling {
+            call_id: CallId::from(456u64),
+            message: SignalingEvent::SendIce {
+                candidates: candidates.clone(),
+            },
+        };
+        let json_str = event.to_json();
+        let parsed: Value = serde_json::from_str(&json_str).unwrap();
+        let arr = parsed["candidates"].as_array().unwrap();
+        assert_eq!(arr.len(), 2);
+        for (i, c) in arr.iter().enumerate() {
+            let decoded = BASE64.decode(c["opaque"].as_str().unwrap()).unwrap();
+            assert_eq!(decoded, candidates[i]);
+        }
+    }
+}
+
+/// Implements SignalingSender -- relays signaling messages to the control channel.
+pub struct TunnelSignalingSender {
+    pub event_sender: mpsc::Sender<PlatformEvent>,
+}
+
+impl SignalingSender for TunnelSignalingSender {
+    fn send_signaling(
+        &self,
+        _recipient_id: &str,
+        call_id: CallId,
+        _receiver_device_id: Option<DeviceId>,
+        message: signaling::Message,
+    ) -> Result<()> {
+        let event = match message {
+            signaling::Message::Offer(offer) => SignalingEvent::SendOffer {
+                opaque: offer.opaque,
+                call_media_type: offer.call_media_type,
+            },
+            signaling::Message::Answer(answer) => SignalingEvent::SendAnswer {
+                opaque: answer.opaque,
+            },
+            signaling::Message::Ice(ice) => SignalingEvent::SendIce {
+                candidates: ice.candidates.into_iter().map(|c| c.opaque).collect(),
+            },
+            signaling::Message::Hangup(hangup) => {
+                let (hangup_type, _device_id) = hangup.to_type_and_device_id();
+                SignalingEvent::SendHangup {
+                    hangup_type: format!("{:?}", hangup_type).to_lowercase(),
+                }
+            }
+            signaling::Message::Busy => SignalingEvent::SendBusy,
+        };
+
+        if let Err(e) = self.event_sender.send(PlatformEvent::SendSignaling {
+            call_id,
+            message: event,
+        }) {
+            error!("Failed to send signaling event: {}", e);
+        }
+        Ok(())
+    }
+
+    fn send_call_message(
+        &self,
+        _recipient_id: UserId,
+        _message: Vec<u8>,
+        _urgency: group_call::SignalingMessageUrgency,
+    ) -> Result<()> {
+        // No-op for 1:1 calls
+        Ok(())
+    }
+
+    fn send_call_message_to_group(
+        &self,
+        _group_id: group_call::GroupId,
+        _message: Vec<u8>,
+        _urgency: group_call::SignalingMessageUrgency,
+        _recipients_override: HashSet<UserId>,
+    ) -> Result<()> {
+        // No-op for 1:1 calls
+        Ok(())
+    }
+
+    fn send_call_message_to_adhoc_group(
+        &self,
+        _message: Vec<u8>,
+        _urgency: group_call::SignalingMessageUrgency,
+        _expiration: u64,
+        _recipients_to_endorsements: HashMap<UserId, Vec<u8>>,
+    ) -> Result<()> {
+        // No-op for 1:1 calls
+        Ok(())
+    }
+}
+
+/// Implements CallStateHandler -- relays state changes to the control channel.
+pub struct TunnelStateHandler {
+    pub event_sender: mpsc::Sender<PlatformEvent>,
+}
+
+impl CallStateHandler for TunnelStateHandler {
+    fn handle_call_state(
+        &self,
+        _remote_peer_id: &str,
+        _call_id: CallId,
+        call_state: CallState,
+    ) -> Result<()> {
+        let (state, reason) = match call_state {
+            CallState::Incoming(media_type) => {
+                (format!("Incoming({:?})", media_type), None)
+            }
+            CallState::Outgoing(media_type) => {
+                (format!("Outgoing({:?})", media_type), None)
+            }
+            CallState::Ringing => ("Ringing".to_string(), None),
+            CallState::Connected => ("Connected".to_string(), None),
+            CallState::Connecting => ("Connecting".to_string(), None),
+            CallState::Ended(reason, _summary) => {
+                ("Ended".to_string(), Some(format!("{:?}", reason)))
+            }
+            CallState::Rejected(reason) => {
+                ("Rejected".to_string(), Some(format!("{:?}", reason)))
+            }
+            CallState::Concluded => ("Concluded".to_string(), None),
+        };
+
+        info!("Call state: {} (reason: {:?})", state, reason);
+
+        if let Err(e) = self
+            .event_sender
+            .send(PlatformEvent::StateChange { state, reason })
+        {
+            error!("Failed to send state change event: {}", e);
+        }
+        Ok(())
+    }
+
+    fn handle_remote_audio_state(
+        &self,
+        _remote_peer_id: &str,
+        enabled: bool,
+    ) -> Result<()> {
+        debug!("Remote audio state: {}", enabled);
+        Ok(())
+    }
+
+    fn handle_remote_video_state(
+        &self,
+        _remote_peer_id: &str,
+        enabled: bool,
+    ) -> Result<()> {
+        debug!("Remote video state: {}", enabled);
+        Ok(())
+    }
+
+    fn handle_remote_sharing_screen(
+        &self,
+        _remote_peer_id: &str,
+        enabled: bool,
+    ) -> Result<()> {
+        debug!("Remote sharing screen: {}", enabled);
+        Ok(())
+    }
+
+    fn handle_network_route(
+        &self,
+        _remote_peer_id: &str,
+        network_route: NetworkRoute,
+    ) -> Result<()> {
+        info!("Network route: {:?}", network_route);
+        Ok(())
+    }
+
+    fn handle_audio_levels(
+        &self,
+        _remote_peer_id: &str,
+        _captured_level: AudioLevel,
+        _received_level: AudioLevel,
+    ) -> Result<()> {
+        // Don't log -- too noisy
+        Ok(())
+    }
+
+    fn handle_low_bandwidth_for_video(
+        &self,
+        _remote_peer_id: &str,
+        recovered: bool,
+    ) -> Result<()> {
+        if recovered {
+            info!("Low bandwidth for video: recovered");
+        } else {
+            warn!("Low bandwidth for video");
+        }
+        Ok(())
+    }
+}
+
+/// Implements GroupUpdateHandler -- all no-ops for 1:1 calls.
+pub struct TunnelGroupHandler;
+
+impl GroupUpdateHandler for TunnelGroupHandler {
+    fn handle_group_update(&self, _update: GroupUpdate) -> Result<()> {
+        Ok(())
+    }
+}
diff --git a/third-party/ringrtc b/third-party/ringrtc
new file mode 160000
index 00000000..a86f8a68
--- /dev/null
+++ b/third-party/ringrtc
@@ -0,0 +1 @@
+Subproject commit a86f8a6832cec291ef4f77e4ee9b941e5b91a01f