snapshot of https://github.com/mountain-loop/yaak.git (main, 2026-09-23; blobs > 131072B omitted)

2026-09-23 17:39:41 +05:00
commit 906fb231cc
1544 changed files with 164131 additions and 0 deletions
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -0,0 +1,3 @@
+# These are supported funding model platforms
+
+github: gschier
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -0,0 +1,40 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ""
+labels: ""
+assignees: ""
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Desktop (please complete the following information):**
+
+- OS: [e.g. iOS]
+- Browser [e.g. chrome, safari]
+- Version [e.g. 22]
+
+**Smartphone (please complete the following information):**
+
+- Device: [e.g. iPhone6]
+- OS: [e.g. iOS8.1]
+- Browser [e.g. stock browser, safari]
+- Version [e.g. 22]
+
+**Additional context**
+Add any other context about the problem here.
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Bugs, Feedback, Feature Requests, and Questions
+    url: https://feedback.yaak.app
+    about: "Please report to Yaak's public feedback board. Issues will be created and linked here when applicable."
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -0,0 +1,55 @@
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    ignore:
+      # Build tooling majors are opted into, not queued. These never reach a
+      # user, so the cost of being a release behind is low and the cost of a
+      # surprise is a broken build. Note this also suppresses security PRs for
+      # these, so Dependabot alerts are the backstop.
+      - dependency-name: typescript
+        update-types: ["version-update:semver-major"]
+      - dependency-name: vitest
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@types/*"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "vite-plugin-*"
+        update-types: ["version-update:semver-major"]
+      # 0.8 dropped stateExtensions and updateSchema from the package root and
+      # exposes no subpath to reach them, which GrpcEditor needs. Unpin once
+      # that editor moves to the jsonSchema helper.
+      - dependency-name: codemirror-json-schema
+    groups:
+      npm-production:
+        dependency-type: production
+        update-types:
+          - minor
+          - patch
+      npm-development:
+        dependency-type: development
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    ignore:
+      # Held at 11.10.0 to pin what rolldown_resolver ("^11") resolves to; it
+      # does not build against 11.11. See crates-cli/yaak-cli/Cargo.toml.
+      - dependency-name: oxc_resolver
+    groups:
+      cargo:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -0,0 +1,22 @@
+## Summary
+
+<!-- Describe the bug and the fix in 1-3 sentences. -->
+
+## Submission
+
+<!-- Check every box below except at most one of the first two (bug fixes only need the first). The last two must be checked even when they do not apply — checking confirms you considered them. -->
+
+- [ ] This PR is a bug fix.
+- [ ] If this PR is not a bug fix, I linked the feedback item where @gschier explicitly gave me permission to work on it.
+- [ ] I have read and followed [`CONTRIBUTING.md`](CONTRIBUTING.md).
+- [ ] I tested this change locally.
+- [ ] I added or updated tests, or tests are not reasonable for this change.
+- [ ] I added screenshots or recordings, or this change does not affect the UI.
+
+Explicit permission feedback item (required if not a bug fix):
+
+<!-- https://yaak.app/feedback/... -->
+
+## Related
+
+<!-- Link related issues, discussions, or feedback items. -->
--- a/.github/scripts/check-contribution-policy.js
+++ b/.github/scripts/check-contribution-policy.js
@@ -0,0 +1,881 @@
+const fs = require("node:fs");
+
+const COMMENT_MARKER = "<!-- yaak-contribution-policy -->";
+
+const MAINTAINER_LOGINS = new Set(["gschier"]);
+const MAINTAINER_ASSOCIATIONS = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
+const MAINTAINER_PERMISSIONS = new Set(["admin", "maintain", "write"]);
+const REVIEWER_LOGIN = "gschier";
+
+const LARGE_DIFF_CHANGED_FILES = 20;
+const LARGE_DIFF_CHANGED_LINES = 800;
+const SUMMARY_TITLE_MAX_LENGTH = 80;
+const MIN_AUTOMATIC_PR_NUMBER = 494;
+
+const LABELS = {
+  inScope: {
+    name: "contribution: in scope",
+    color: "0E8A16",
+    description: "Community PR appears to be in scope for maintainer review.",
+  },
+  outOfScope: {
+    name: "contribution: out of scope",
+    color: "B60205",
+    description: "Community PR does not match Yaak's contribution policy.",
+  },
+  explicitPermission: {
+    name: "contribution: explicit permission",
+    color: "5319E7",
+    description:
+      "Community PR links feedback where @gschier explicitly allowed the work.",
+  },
+  missingTemplate: {
+    name: "contribution: missing template",
+    color: "D93F0B",
+    description:
+      "Community PR is missing enough of the pull request template to review.",
+  },
+  policyUnmet: {
+    name: "contribution: policy unmet",
+    color: "B60205",
+    description:
+      "Community PR does not currently satisfy the contribution policy.",
+  },
+  needsScopeReview: {
+    name: "contribution: needs scope review",
+    color: "FBCA04",
+    description:
+      "Community PR may be broader than Yaak's bug-fix contribution policy.",
+  },
+};
+
+const MANAGED_LABEL_NAMES = [
+  ...new Set(Object.values(LABELS).map((label) => label.name)),
+];
+
+// Each checkbox lists its current label first, followed by legacy labels still
+// accepted from PRs opened against older versions of the template.
+const CHECKBOXES = {
+  bugFix: ["This PR is a bug fix."],
+  explicitPermission: [
+    "If this PR is not a bug fix, I linked the feedback item where @gschier explicitly gave me permission to work on it.",
+  ],
+  readContributing: [
+    "I have read and followed [`CONTRIBUTING.md`](CONTRIBUTING.md).",
+  ],
+  testedLocally: ["I tested this change locally."],
+  testsUpdated: [
+    "I added or updated tests, or tests are not reasonable for this change.",
+    "I added or updated tests when reasonable.",
+  ],
+  screenshotsAdded: [
+    "I added screenshots or recordings, or this change does not affect the UI.",
+    "I added screenshots or recordings for UI changes when reasonable.",
+  ],
+};
+
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function normalizeBody(body) {
+  return (body || "").replace(/\r\n/g, "\n");
+}
+
+function stripComments(value) {
+  return value.replace(/<!--[\s\S]*?-->/g, "").trim();
+}
+
+function getSection(body, heading) {
+  const pattern = new RegExp(`^##\\s+${escapeRegExp(heading)}\\s*$`, "gim");
+  const match = pattern.exec(body);
+
+  if (match == null) {
+    return null;
+  }
+
+  const rest = body.slice(match.index + match[0].length);
+  const nextHeadingIndex = rest.search(/^##\s+/m);
+  return nextHeadingIndex === -1 ? rest : rest.slice(0, nextHeadingIndex);
+}
+
+function hasMeaningfulText(value) {
+  return stripComments(value || "").length > 0;
+}
+
+function normalizeCheckboxLabel(label) {
+  return label
+    .replace(/\[([^\]]+)\]\([^)]+\)/g, "$1")
+    .replace(/`/g, "")
+    .replace(/\s+/g, " ")
+    .trim();
+}
+
+function checkboxState(body, labels) {
+  const expectedLabels = new Set(labels.map(normalizeCheckboxLabel));
+
+  for (const line of body.split("\n")) {
+    const match = line.match(/^\s*[-*]\s*\[([ xX])\]\s*(.*?)\s*$/i);
+
+    if (match == null) {
+      continue;
+    }
+
+    if (expectedLabels.has(normalizeCheckboxLabel(match[2]))) {
+      return match[1].toLowerCase() === "x";
+    }
+  }
+
+  return null;
+}
+
+function findFeedbackUrl(body) {
+  return (
+    body.match(
+      /https?:\/\/(?:www\.)?(?:yaak\.app\/feedback|feedback\.yaak\.app)\/[^\s)>\]]+/i,
+    )?.[0] ?? null
+  );
+}
+
+function getLabelNames(pr) {
+  return new Set((pr.labels || []).map((label) => label.name));
+}
+
+function analyzePullRequest(pr) {
+  const body = normalizeBody(pr.body);
+  const labelNames = getLabelNames(pr);
+  const states = Object.fromEntries(
+    Object.entries(CHECKBOXES).map(([key, label]) => [
+      key,
+      checkboxState(body, label),
+    ]),
+  );
+  const sectionCount = ["Summary", "Submission", "Related"].filter(
+    (heading) => getSection(body, heading) != null,
+  ).length;
+  const checkboxCount = Object.values(states).filter(
+    (state) => state != null,
+  ).length;
+  const templateUsed = sectionCount >= 2 && checkboxCount >= 3;
+  const blockers = [];
+  const totalChangedLines =
+    Number(pr.additions || 0) + Number(pr.deletions || 0);
+  const changedFiles = Number(pr.changed_files || 0);
+  const largeDiff =
+    changedFiles > LARGE_DIFF_CHANGED_FILES ||
+    totalChangedLines > LARGE_DIFF_CHANGED_LINES;
+
+  if (labelNames.has(LABELS.outOfScope.name)) {
+    return {
+      blockers: [
+        {
+          label: LABELS.outOfScope.name,
+          message: "Marked out of scope by maintainer label.",
+        },
+      ],
+      changedFiles,
+      desiredLabels: [LABELS.outOfScope.name],
+      largeDiff,
+      status: "out_of_scope",
+      templateUsed,
+      totalChangedLines,
+    };
+  }
+
+  if (labelNames.has(LABELS.inScope.name)) {
+    return {
+      blockers: [],
+      changedFiles,
+      desiredLabels: [LABELS.inScope.name],
+      largeDiff,
+      status: "in_scope",
+      templateUsed,
+      totalChangedLines,
+    };
+  }
+
+  if (labelNames.has(LABELS.explicitPermission.name)) {
+    return {
+      blockers: [],
+      changedFiles,
+      desiredLabels: [LABELS.explicitPermission.name],
+      largeDiff,
+      status: "in_scope",
+      templateUsed,
+      totalChangedLines,
+    };
+  }
+
+  if (!templateUsed) {
+    blockers.push({
+      label: LABELS.missingTemplate.name,
+      message:
+        "Update the PR description with the repository pull request template.",
+    });
+  } else {
+    const summary = getSection(body, "Summary");
+    const hasSummary = hasMeaningfulText(summary);
+    const feedbackUrl = findFeedbackUrl(body);
+    const bugFix = states.bugFix === true;
+    const explicitPermission = states.explicitPermission === true;
+
+    if (!hasSummary) {
+      blockers.push({
+        label: LABELS.policyUnmet.name,
+        message:
+          "Add a short summary describing the bug fix or permitted change.",
+      });
+    }
+
+    if (bugFix && explicitPermission) {
+      blockers.push({
+        label: LABELS.policyUnmet.name,
+        message:
+          "Choose either the bug-fix checkbox or the explicit-permission checkbox, not both.",
+      });
+    } else if (!bugFix && !explicitPermission) {
+      blockers.push({
+        label: LABELS.policyUnmet.name,
+        message:
+          "Check whether this is a bug fix, or confirm that explicit permission from @gschier is linked.",
+      });
+    } else if (explicitPermission && feedbackUrl == null) {
+      blockers.push({
+        label: LABELS.policyUnmet.name,
+        message:
+          "Link the feedback item where @gschier explicitly gave you permission to work on this.",
+      });
+    }
+
+    if (states.readContributing !== true) {
+      blockers.push({
+        label: LABELS.policyUnmet.name,
+        message: "Confirm that `CONTRIBUTING.md` was read and followed.",
+      });
+    }
+
+    if (states.testedLocally !== true) {
+      blockers.push({
+        label: LABELS.policyUnmet.name,
+        message: "Confirm that the change was tested locally.",
+      });
+    }
+
+    if (states.testsUpdated !== true) {
+      blockers.push({
+        label: LABELS.policyUnmet.name,
+        message:
+          "Confirm that tests were added or updated, or that tests are not reasonable for this change. Check the box either way.",
+      });
+    }
+
+    if (states.screenshotsAdded !== true) {
+      blockers.push({
+        label: LABELS.policyUnmet.name,
+        message:
+          "Confirm that screenshots or recordings were added, or that this change does not affect the UI. Check the box either way.",
+      });
+    }
+  }
+
+  const desiredLabels = new Set();
+
+  if (blockers.length === 0) {
+    desiredLabels.add(
+      largeDiff
+        ? LABELS.needsScopeReview.name
+        : states.explicitPermission
+          ? LABELS.explicitPermission.name
+          : LABELS.inScope.name,
+    );
+  } else if (
+    blockers.some((blocker) => blocker.label === LABELS.missingTemplate.name)
+  ) {
+    desiredLabels.add(LABELS.missingTemplate.name);
+  } else {
+    desiredLabels.add(LABELS.policyUnmet.name);
+  }
+
+  return {
+    blockers,
+    changedFiles,
+    desiredLabels: [...desiredLabels],
+    largeDiff,
+    status: blockers.length === 0 ? "in_scope" : "blocked",
+    templateUsed,
+    totalChangedLines,
+  };
+}
+
+function buildBlockingComment(analysis) {
+  const lines = [
+    COMMENT_MARKER,
+    "Thanks for the PR. Yaak currently accepts community PRs for bug fixes, plus larger changes that link a feedback item where @gschier explicitly gave permission to work on it.",
+    "",
+    "This PR cannot be accepted yet because the following contribution policy requirements were unmet:",
+    "",
+    ...analysis.blockers.map((blocker) => `- ${blocker.message}`),
+  ];
+
+  if (!analysis.templateUsed) {
+    lines.push(
+      "",
+      "You can copy this template into the PR description and keep any existing context that is still useful.",
+      "",
+      "<details>",
+      "<summary>PR description template</summary>",
+      "",
+      "```md",
+      getPullRequestTemplate(),
+      "```",
+      "",
+      "</details>",
+    );
+  }
+
+  if (analysis.largeDiff) {
+    lines.push(
+      "",
+      `This PR also changes ${analysis.changedFiles} files and ${analysis.totalChangedLines} lines, so it has been labeled as needing scope review. That label is advisory, but maintainers may ask for the scope to be reduced.`,
+    );
+  }
+
+  return lines.join("\n");
+}
+
+function getPullRequestTemplate() {
+  return fs.readFileSync(".github/pull_request_template.md", "utf8").trim();
+}
+
+function buildInScopeComment() {
+  return [
+    COMMENT_MARKER,
+    "Thanks for the PR. This appears to match Yaak's contribution policy and is awaiting review by @gschier.",
+    "",
+    "This only means the PR is in scope for review. It does not mean the change has been reviewed or accepted for merge.",
+  ].join("\n");
+}
+
+function buildOutOfScopeComment() {
+  return [
+    COMMENT_MARKER,
+    "Thanks for the PR. This does not appear to match Yaak's current contribution policy.",
+    "",
+    "Yaak currently accepts community PRs for bug fixes, or changes tied to a feedback item where @gschier explicitly gave permission to work on it.",
+    "",
+    "If this PR is tied to a feedback item where @gschier explicitly gave permission, please link it in the PR description.",
+  ].join("\n");
+}
+
+function buildPolicyComment(analysis) {
+  if (analysis.status === "out_of_scope") {
+    return buildOutOfScopeComment();
+  }
+
+  if (analysis.blockers.length > 0) {
+    return buildBlockingComment(analysis);
+  }
+
+  return buildInScopeComment();
+}
+
+function escapeHtml(value) {
+  return String(value)
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+function truncateTitle(title) {
+  if (title.length <= SUMMARY_TITLE_MAX_LENGTH) {
+    return title;
+  }
+
+  return `${title.slice(0, SUMMARY_TITLE_MAX_LENGTH - 3).trimEnd()}...`;
+}
+
+function escapeTableText(value) {
+  return escapeHtml(value).replace(/\n/g, "<br>");
+}
+
+function summarizeResult({ pr, analysis, skipped, skipReason }) {
+  const comment =
+    analysis == null
+      ? "None"
+      : buildPolicyComment(analysis).replace(COMMENT_MARKER, "").trim();
+  const summary = {
+    blocked: analysis?.blockers.length > 0,
+    comment,
+    details: "None",
+    labels:
+      analysis?.desiredLabels.length > 0
+        ? analysis.desiredLabels.join(", ")
+        : "None",
+    number: pr.number,
+    prLink: `<a href="${escapeHtml(pr.html_url)}">#${pr.number}</a>`,
+    status: "In scope",
+    title: escapeHtml(truncateTitle(pr.title)),
+  };
+
+  if (skipped) {
+    return {
+      ...summary,
+      blocked: false,
+      comment: "None",
+      details: escapeHtml(skipReason),
+      labels: "None",
+      status: "Skipped",
+    };
+  }
+
+  if (summary.blocked) {
+    return {
+      ...summary,
+      comment: escapeTableText(summary.comment),
+      details: escapeHtml(
+        analysis.blockers.map((blocker) => blocker.message).join("; "),
+      ),
+      labels: escapeHtml(summary.labels),
+      status: analysis.status === "out_of_scope" ? "Out of scope" : "Blocked",
+    };
+  }
+
+  return {
+    ...summary,
+    comment: escapeTableText(summary.comment),
+    labels: escapeHtml(summary.labels),
+  };
+}
+
+async function isOfficialMaintainer({ github, owner, repo, pr }) {
+  if (MAINTAINER_LOGINS.has(pr.user.login)) {
+    return true;
+  }
+
+  if (MAINTAINER_ASSOCIATIONS.has(pr.author_association)) {
+    return true;
+  }
+
+  try {
+    const response = await github.rest.repos.getCollaboratorPermissionLevel({
+      owner,
+      repo,
+      username: pr.user.login,
+    });
+
+    return MAINTAINER_PERMISSIONS.has(response.data.permission);
+  } catch (error) {
+    if (error.status === 404) {
+      return false;
+    }
+
+    throw error;
+  }
+}
+
+async function ensureManagedLabels({ github, owner, repo }) {
+  for (const label of Object.values(LABELS)) {
+    try {
+      await github.rest.issues.getLabel({
+        owner,
+        repo,
+        name: label.name,
+      });
+    } catch (error) {
+      if (error.status !== 404) {
+        throw error;
+      }
+
+      await github.rest.issues.createLabel({
+        owner,
+        repo,
+        name: label.name,
+        color: label.color,
+        description: label.description,
+      });
+    }
+  }
+}
+
+async function syncLabels({ github, owner, repo, issueNumber, desiredLabels }) {
+  const desired = new Set(desiredLabels);
+
+  await ensureManagedLabels({ github, owner, repo });
+
+  for (const labelName of MANAGED_LABEL_NAMES) {
+    if (desired.has(labelName)) {
+      continue;
+    }
+
+    try {
+      await github.rest.issues.removeLabel({
+        owner,
+        repo,
+        issue_number: issueNumber,
+        name: labelName,
+      });
+    } catch (error) {
+      if (error.status !== 404) {
+        throw error;
+      }
+    }
+  }
+
+  if (desired.size > 0) {
+    await github.rest.issues.addLabels({
+      owner,
+      repo,
+      issue_number: issueNumber,
+      labels: [...desired],
+    });
+  }
+}
+
+async function findPolicyComment({ github, owner, repo, issueNumber }) {
+  const comments = await github.paginate(github.rest.issues.listComments, {
+    owner,
+    repo,
+    issue_number: issueNumber,
+    per_page: 100,
+  });
+
+  return comments.find(
+    (comment) =>
+      comment.user.type === "Bot" && comment.body?.includes(COMMENT_MARKER),
+  );
+}
+
+async function upsertPolicyComment({ github, owner, repo, issueNumber, body }) {
+  const existingComment = await findPolicyComment({
+    github,
+    owner,
+    repo,
+    issueNumber,
+  });
+
+  if (existingComment == null) {
+    await github.rest.issues.createComment({
+      owner,
+      repo,
+      issue_number: issueNumber,
+      body,
+    });
+    return;
+  }
+
+  await github.rest.issues.updateComment({
+    owner,
+    repo,
+    comment_id: existingComment.id,
+    body,
+  });
+}
+
+async function deletePolicyComment({ github, owner, repo, issueNumber }) {
+  const existingComment = await findPolicyComment({
+    github,
+    owner,
+    repo,
+    issueNumber,
+  });
+
+  if (existingComment == null) {
+    return;
+  }
+
+  await github.rest.issues.deleteComment({
+    owner,
+    repo,
+    comment_id: existingComment.id,
+  });
+}
+
+async function requestMaintainerReview({ github, owner, repo, pr }) {
+  if (pr.user.login === REVIEWER_LOGIN) {
+    return;
+  }
+
+  try {
+    await github.rest.pulls.requestReviewers({
+      owner,
+      repo,
+      pull_number: pr.number,
+      reviewers: [REVIEWER_LOGIN],
+    });
+  } catch (error) {
+    if (error.status === 422) {
+      return;
+    }
+
+    throw error;
+  }
+}
+
+async function checkPullRequest({
+  github,
+  core,
+  owner,
+  repo,
+  pullNumber,
+  dryRun,
+  minimumAutomaticPullNumber,
+}) {
+  const response = await github.rest.pulls.get({
+    owner,
+    repo,
+    pull_number: pullNumber,
+  });
+  const pr = response.data;
+  const issueNumber = pr.number;
+
+  if (pr.user.type === "Bot") {
+    core.notice(
+      `Skipping contribution policy for bot PR #${pr.number} from @${pr.user.login}.`,
+    );
+    return {
+      blocked: false,
+      number: pr.number,
+      summary: summarizeResult({
+        pr,
+        skipped: true,
+        skipReason: `bot @${pr.user.login}`,
+      }),
+      skipped: true,
+    };
+  }
+
+  if (
+    minimumAutomaticPullNumber != null &&
+    pr.number < minimumAutomaticPullNumber
+  ) {
+    core.notice(
+      `Skipping contribution policy for PR #${pr.number} because automatic checks start at PR #${minimumAutomaticPullNumber}.`,
+    );
+    return {
+      blocked: false,
+      number: pr.number,
+      summary: summarizeResult({
+        pr,
+        skipped: true,
+        skipReason: `before automatic rollout PR #${minimumAutomaticPullNumber}`,
+      }),
+      skipped: true,
+    };
+  }
+
+  if (pr.draft) {
+    core.notice(`Skipping contribution policy for draft PR #${pr.number}.`);
+    return {
+      blocked: false,
+      number: pr.number,
+      summary: summarizeResult({
+        pr,
+        skipped: true,
+        skipReason: "draft",
+      }),
+      skipped: true,
+    };
+  }
+
+  if (await isOfficialMaintainer({ github, owner, repo, pr })) {
+    core.notice(
+      `Skipping contribution policy for maintainer PR #${pr.number} from @${pr.user.login}.`,
+    );
+    if (!dryRun) {
+      await syncLabels({ github, owner, repo, issueNumber, desiredLabels: [] });
+      await deletePolicyComment({ github, owner, repo, issueNumber });
+    }
+    return {
+      blocked: false,
+      number: pr.number,
+      summary: summarizeResult({
+        pr,
+        skipped: true,
+        skipReason: `maintainer @${pr.user.login}`,
+      }),
+      skipped: true,
+    };
+  }
+
+  const analysis = analyzePullRequest(pr);
+
+  if (dryRun) {
+    const summary = summarizeResult({ pr, analysis });
+    core.notice(
+      `[dry-run] PR #${summary.number}: ${summary.status}; labels: ${summary.labels}; details: ${summary.details}`,
+    );
+    return {
+      blocked: analysis.blockers.length > 0,
+      number: pr.number,
+      summary,
+      skipped: false,
+    };
+  }
+
+  await syncLabels({
+    github,
+    owner,
+    repo,
+    issueNumber,
+    desiredLabels: analysis.desiredLabels,
+  });
+
+  if (analysis.blockers.length > 0) {
+    await upsertPolicyComment({
+      github,
+      owner,
+      repo,
+      issueNumber,
+      body: buildPolicyComment(analysis),
+    });
+    return {
+      blocked: true,
+      number: pr.number,
+      summary: summarizeResult({ pr, analysis }),
+      skipped: false,
+    };
+  }
+
+  await upsertPolicyComment({
+    github,
+    owner,
+    repo,
+    issueNumber,
+    body: buildPolicyComment(analysis),
+  });
+  await requestMaintainerReview({ github, owner, repo, pr });
+  core.notice(`Contribution policy check passed for PR #${pr.number}.`);
+  return {
+    blocked: false,
+    number: pr.number,
+    summary: summarizeResult({ pr, analysis }),
+    skipped: false,
+  };
+}
+
+async function listOpenPullRequests({ github, owner, repo }) {
+  return github.paginate(github.rest.pulls.list, {
+    owner,
+    repo,
+    state: "open",
+    per_page: 100,
+  });
+}
+
+function getManualPullRequestNumbers({ context, core }) {
+  const value = String(context.payload.inputs?.pr || "all").trim();
+
+  if (value.toLowerCase() === "all") {
+    return null;
+  }
+
+  const pullNumber = Number(value);
+
+  if (!Number.isInteger(pullNumber) || pullNumber <= 0) {
+    core.setFailed('The "pr" input must be "all" or a positive PR number.');
+    return [];
+  }
+
+  return [pullNumber];
+}
+
+async function run({ github, context, core }) {
+  const { owner, repo } = context.repo;
+  const payloadPr = context.payload.pull_request;
+  const dryRunInput = context.payload.inputs?.dry_run;
+  const dryRun =
+    context.eventName === "workflow_dispatch" &&
+    dryRunInput !== false &&
+    dryRunInput !== "false";
+  const minimumAutomaticPullNumber =
+    payloadPr == null ? null : MIN_AUTOMATIC_PR_NUMBER;
+  let pullNumbers;
+
+  if (payloadPr != null) {
+    pullNumbers = [payloadPr.number];
+  } else {
+    pullNumbers = getManualPullRequestNumbers({ context, core });
+  }
+
+  if (pullNumbers?.length === 0) {
+    return;
+  }
+
+  const pullRequests =
+    pullNumbers == null
+      ? await listOpenPullRequests({ github, owner, repo })
+      : pullNumbers.map((number) => ({ number }));
+  const results = [];
+
+  if (dryRun) {
+    core.notice(
+      `Running contribution policy in dry-run mode for ${
+        pullNumbers == null
+          ? "all open PRs"
+          : pullNumbers.map((number) => `#${number}`).join(", ")
+      }.`,
+    );
+  }
+
+  for (const pr of pullRequests) {
+    results.push(
+      await checkPullRequest({
+        github,
+        core,
+        owner,
+        repo,
+        pullNumber: pr.number,
+        dryRun,
+        minimumAutomaticPullNumber,
+      }),
+    );
+  }
+
+  await core.summary
+    .addHeading(`Contribution Policy ${dryRun ? "Dry Run" : "Results"}`)
+    .addTable([
+      [
+        { data: "PR", header: true },
+        { data: "Title", header: true },
+        { data: "Status", header: true },
+        { data: "Labels", header: true },
+        { data: "Details", header: true },
+        { data: "Comment", header: true },
+      ],
+      ...results.map((result) => [
+        result.summary.prLink,
+        result.summary.title,
+        result.summary.status,
+        result.summary.labels,
+        result.summary.details,
+        result.summary.comment,
+      ]),
+    ])
+    .write();
+
+  const blockedPullRequests = results.filter((result) => result.blocked);
+
+  if (blockedPullRequests.length > 0) {
+    if (dryRun) {
+      core.warning(
+        `Dry run found contribution policy failures for PR(s): ${blockedPullRequests
+          .map((result) => `#${result.number}`)
+          .join(", ")}`,
+      );
+      return;
+    }
+
+    core.setFailed(
+      `Contribution policy failed for PR(s): ${blockedPullRequests
+        .map((result) => `#${result.number}`)
+        .join(", ")}`,
+    );
+  }
+}
+
+module.exports = {
+  analyzePullRequest,
+  run,
+};
--- a/.github/scripts/preserve-release-artifacts.mjs
+++ b/.github/scripts/preserve-release-artifacts.mjs
@@ -0,0 +1,79 @@
+// Retain only distributable bundle files, never the target tree or signing material.
+import { createHash } from "node:crypto";
+import {
+  copyFileSync,
+  createReadStream,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  writeFileSync,
+} from "node:fs";
+import { join, relative } from "node:path";
+
+const env = process.env;
+const bundle = join("target", env.RELEASE_TARGET || "", "release", "bundle");
+const destination = join(env.RUNNER_TEMP, "yaak-release-artifacts");
+const extensions =
+  /\.(dmg|deb|rpm|AppImage|exe|msi|app\.tar\.gz|AppImage\.tar\.gz|nsis\.zip|msi\.zip)(\.sig)?$/;
+const files = [];
+
+function snapshot(directory) {
+  if (!existsSync(directory)) return;
+  for (const entry of readdirSync(directory, { withFileTypes: true })) {
+    const source = join(directory, entry.name);
+    // Only descend through the bundler's immediate output folders. This excludes
+    // .app trees and the extracted CEF deb contents (which contain executables).
+    if (entry.isDirectory() && directory === bundle) {
+      snapshot(source);
+    } else if (
+      entry.isFile() &&
+      (extensions.test(entry.name) || /^yaak-cef_.*_linux_.*\.tar\.gz$/.test(entry.name))
+    ) {
+      // Match tauri-action's default macOS updater asset naming exactly.
+      const arch = env.RELEASE_ARCH === "arm64" ? "aarch64" : "x64";
+      const assetName = entry.name.replace(/\.app\.tar\.gz(\.sig)?$/, `_${arch}.app.tar.gz$1`);
+      mkdirSync(destination, { recursive: true });
+      const retained = join(destination, assetName);
+      // The second snapshot must not overwrite the original user installer/signature.
+      if (!existsSync(retained)) copyFileSync(source, retained);
+      files.push({ source: relative(".", source), assetName });
+    }
+  }
+}
+
+snapshot(bundle);
+if (existsSync(destination)) {
+  const assets = readdirSync(destination)
+    .filter((name) => name !== "provenance.json")
+    .sort();
+  const checksums = [];
+  for (const assetName of assets) {
+    const hash = createHash("sha256");
+    for await (const chunk of createReadStream(join(destination, assetName))) hash.update(chunk);
+    checksums.push({ assetName, sha256: hash.digest("hex") });
+  }
+  writeFileSync(
+    join(destination, "provenance.json"),
+    JSON.stringify(
+      {
+        repository: env.GITHUB_REPOSITORY,
+        tag: env.GITHUB_REF_NAME,
+        sha: env.GITHUB_SHA,
+        runId: env.GITHUB_RUN_ID,
+        runAttempt: env.GITHUB_RUN_ATTEMPT,
+        workflowRef: env.GITHUB_WORKFLOW_REF,
+        workflowSha: env.GITHUB_WORKFLOW_SHA,
+        tauriAction: "tauri-apps/tauri-action@v0",
+        platform: env.RELEASE_PLATFORM,
+        runtime: env.RELEASE_RUNTIME,
+        arch: env.RELEASE_ARCH,
+        target: env.RELEASE_TARGET,
+        args: env.RELEASE_ARGS,
+        assets: checksums,
+      },
+      null,
+      2,
+    ) + "\n",
+  );
+}
+console.log(`Found ${files.length} distributable bundle files in ${bundle}`);
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,37 @@
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+name: Lint and Test
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Lint/Test
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version: "24"
+          cache: true
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: ci
+          cache-on-failure: true
+
+      - run: vp install
+      - run: npm run bootstrap
+      - run: npm run lint
+      - name: Run JS Tests
+        run: vp test
+      - name: Run Rust Tests
+        run: cargo test --all --features yaak-app-client/wry
+      - name: OpenAPI import round-trip
+        run: |
+          cargo build -p yaak-cli
+          node plugins/importer-openapi/tests/roundtrip.mjs
--- a/.github/workflows/contribution-policy.yml
+++ b/.github/workflows/contribution-policy.yml
@@ -0,0 +1,48 @@
+name: Contribution Policy
+
+on:
+  workflow_dispatch:
+    inputs:
+      pr:
+        description: PR number or all
+        required: true
+        default: all
+        type: string
+      dry_run:
+        description: Dry run
+        required: true
+        default: true
+        type: boolean
+  pull_request_target:
+    types:
+      - opened
+      - edited
+      - reopened
+      - synchronize
+      - ready_for_review
+      - labeled
+      - unlabeled
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  check:
+    if: github.repository == 'mountain-loop/yaak'
+    name: Check contribution policy
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout policy script
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 1
+
+      - name: Check contribution policy
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { run } = require("./.github/scripts/check-contribution-policy.js");
+            await run({ github, context, core });
--- a/.github/workflows/flathub.yml
+++ b/.github/workflows/flathub.yml
@@ -0,0 +1,56 @@
+name: Update Flathub
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Release tag to publish to Flathub
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  update-flathub:
+    if: github.repository == 'mountain-loop/yaak'
+    name: Update Flathub manifest
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout app repo
+        uses: actions/checkout@v4
+
+      - name: Checkout Flathub repo
+        uses: actions/checkout@v4
+        with:
+          repository: flathub/app.yaak.Yaak
+          token: ${{ secrets.FLATHUB_TOKEN }}
+          path: flathub-repo
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
+      - name: Install source generators
+        run: |
+          pip install flatpak-node-generator tomlkit aiohttp
+          git clone --depth 1 https://github.com/flatpak/flatpak-builder-tools flatpak/flatpak-builder-tools
+
+      - name: Run update-manifest.sh
+        run: bash flatpak/update-manifest.sh "${{ inputs.tag }}" flathub-repo
+
+      - name: Commit and push to Flathub
+        working-directory: flathub-repo
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add -A
+          git diff --cached --quiet && echo "No changes to commit" && exit 0
+          git commit -m "Update to ${{ inputs.tag }}"
+          git push
--- a/.github/workflows/release-api-npm.yml
+++ b/.github/workflows/release-api-npm.yml
@@ -0,0 +1,60 @@
+name: Release API to NPM
+
+on:
+  push:
+    tags: [yaak-api-*]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: API version to publish (for example 0.9.0 or v0.9.0)
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  publish-npm:
+    if: github.repository == 'mountain-loop/yaak'
+    name: Publish @yaakapp/api
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+          registry-url: https://registry.npmjs.org
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Set @yaakapp/api version
+        shell: bash
+        env:
+          WORKFLOW_VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            VERSION="$WORKFLOW_VERSION"
+          else
+            VERSION="${GITHUB_REF_NAME#yaak-api-}"
+          fi
+          VERSION="${VERSION#v}"
+          echo "Preparing @yaakapp/api version: $VERSION"
+          cd packages/plugin-runtime-types
+          npm version "$VERSION" --no-git-tag-version --allow-same-version
+
+      - name: Build @yaakapp/api
+        working-directory: packages/plugin-runtime-types
+        run: npm run build
+
+      - name: Publish @yaakapp/api
+        working-directory: packages/plugin-runtime-types
+        run: npm publish --provenance --access public
--- a/.github/workflows/release-app.yml
+++ b/.github/workflows/release-app.yml
@@ -0,0 +1,292 @@
+name: Release App Artifacts
+on:
+  push:
+    tags: [v*]
+
+jobs:
+  build-artifacts:
+    if: github.repository == 'mountain-loop/yaak'
+    permissions:
+      contents: write
+
+    name: Build
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: "macos-latest" # for Arm-based Macs (M1 and above).
+            args: '--target aarch64-apple-darwin --config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}'''
+            yaak_arch: "arm64"
+            os: "macos"
+            runtime: "wry"
+            targets: "aarch64-apple-darwin"
+          - platform: "macos-latest" # for Intel-based Macs.
+            args: '--target x86_64-apple-darwin --config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}'''
+            yaak_arch: "x64"
+            os: "macos"
+            runtime: "wry"
+            targets: "x86_64-apple-darwin"
+          - platform: "ubuntu-22.04"
+            args: '--config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}'''
+            yaak_arch: "x64"
+            os: "ubuntu"
+            runtime: "wry"
+            targets: ""
+          - platform: "ubuntu-22.04-arm"
+            args: '--config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}'''
+            yaak_arch: "arm64"
+            os: "ubuntu"
+            runtime: "wry"
+            targets: ""
+          - platform: "ubuntu-22.04"
+            args: >-
+              --bundles deb
+              --config ./tauri.release.conf.json
+              --config '{"productName":"yaak-cef","mainBinaryName":"yaak-cef","identifier":"app.yaak.desktop.cef","build":{"features":["license","cef"]},"bundle":{"createUpdaterArtifacts":false}}'
+            yaak_arch: "x64"
+            os: "ubuntu"
+            runtime: "cef"
+            targets: ""
+          - platform: "ubuntu-22.04-arm"
+            args: >-
+              --bundles deb
+              --config ./tauri.release.conf.json
+              --config '{"productName":"yaak-cef","mainBinaryName":"yaak-cef","identifier":"app.yaak.desktop.cef","build":{"features":["license","cef"]},"bundle":{"createUpdaterArtifacts":false}}'
+            yaak_arch: "arm64"
+            os: "ubuntu"
+            runtime: "cef"
+            targets: ""
+          - platform: "windows-latest"
+            args: '--config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}'''
+            yaak_arch: "x64"
+            os: "windows"
+            runtime: "wry"
+            targets: ""
+          # Windows ARM64
+          - platform: "windows-latest"
+            args: '--target aarch64-pc-windows-msvc --config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}'''
+            yaak_arch: "arm64"
+            os: "windows"
+            runtime: "wry"
+            targets: "aarch64-pc-windows-msvc"
+    runs-on: ${{ matrix.platform }}
+    timeout-minutes: 360
+    steps:
+      - name: Checkout yaakapp/app
+        uses: actions/checkout@v4
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version: "24"
+          cache: true
+
+      - name: install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.targets }}
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: ci
+          cache-on-failure: true
+
+      - name: Cache CEF (Linux only)
+        if: matrix.os == 'ubuntu' && matrix.runtime == 'cef'
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/tauri-cef
+          key: cef-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Cargo.lock') }}
+
+      - name: install dependencies (Linux only)
+        if: matrix.os == 'ubuntu'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y cmake ninja-build libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev libnss3 patchelf xdg-utils
+          # crates/yaak-wasm compiles SQLite to wasm via sqlite-wasm-rs, whose C shim
+          # uses C23 [[noreturn]] and expects a freestanding wasm32 target. Ubuntu
+          # 22.04 ships only clang <=15: 14 rejects the attribute, and 15 falls
+          # through to host glibc headers ("bits/libc-header-start.h" not found).
+          # clang-18 handles it (it is what ubuntu-24.04 uses). Install it from
+          # apt.llvm.org since 22.04's repos stop at 15. Only the wasm build uses
+          # this compiler, so the shipped binary keeps 22.04's glibc floor.
+          wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh
+          chmod +x /tmp/llvm.sh
+          sudo /tmp/llvm.sh 18
+          echo "CC_wasm32_unknown_unknown=/usr/bin/clang-18" >> "$GITHUB_ENV"
+          echo "AR_wasm32_unknown_unknown=/usr/bin/llvm-ar-18" >> "$GITHUB_ENV"
+
+      - name: Install Protoc for plugin-runtime
+        uses: arduino/setup-protoc@v3
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install trusted-signing-cli (Windows only)
+        if: matrix.os == 'windows'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $dir = "$env:USERPROFILE\trusted-signing"
+          New-Item -ItemType Directory -Force -Path $dir | Out-Null
+          $url = "https://github.com/Levminer/trusted-signing-cli/releases/download/0.8.0/trusted-signing-cli.exe"
+          $exe = Join-Path $dir "trusted-signing-cli.exe"
+          Invoke-WebRequest -Uri $url -OutFile $exe
+          echo $dir >> $env:GITHUB_PATH
+          & $exe --version
+
+      - run: vp install
+      - run: npm run bootstrap
+        env:
+          YAAK_TARGET_ARCH: ${{ matrix.yaak_arch }}
+      - run: npm run lint
+      - name: Run JS Tests
+        run: vp test
+      - name: Run Rust Tests
+        run: cargo test --all --exclude yaak-cli --features yaak-app-client/wry
+
+      - name: Set version
+        run: npm run replace-version
+        env:
+          YAAK_VERSION: ${{ github.ref_name }}
+
+      - name: Sign vendored binaries (macOS only)
+        if: matrix.os == 'macos'
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        run: |
+          # Create keychain
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+
+          # Import certificate
+          echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12
+          security import certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
+
+          # Sign vendored binaries with hardened runtime and their specific entitlements
+          codesign --force --options runtime --entitlements crates-tauri/yaak-app-client/macos/entitlements.yaakprotoc.plist --sign "$APPLE_SIGNING_IDENTITY" crates-tauri/yaak-app-client/vendored/protoc/yaakprotoc || true
+          codesign --force --options runtime --entitlements crates-tauri/yaak-app-client/macos/entitlements.yaaknode.plist --sign "$APPLE_SIGNING_IDENTITY" crates-tauri/yaak-app-client/vendored/node/yaaknode || true
+
+      - name: Build and upload Tauri bundles
+        uses: tauri-apps/tauri-action@v0
+        env:
+          YAAK_TARGET_ARCH: ${{ matrix.yaak_arch }}
+
+          ENABLE_CODE_SIGNING: ${{ secrets.APPLE_CERTIFICATE }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
+
+          # Apple signing stuff
+          APPLE_CERTIFICATE: ${{ matrix.os == 'macos' && secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ matrix.os == 'macos' && secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_ID: ${{ matrix.os == 'macos' && secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ matrix.os == 'macos' && secrets.APPLE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ matrix.os == 'macos' && secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_TEAM_ID: ${{ matrix.os == 'macos' && secrets.APPLE_TEAM_ID }}
+
+          # Windows signing stuff
+          AZURE_CLIENT_ID: ${{ matrix.os == 'windows' && secrets.AZURE_CLIENT_ID }}
+          AZURE_CLIENT_SECRET: ${{ matrix.os == 'windows' && secrets.AZURE_CLIENT_SECRET }}
+          AZURE_TENANT_ID: ${{ matrix.os == 'windows' && secrets.AZURE_TENANT_ID }}
+        with:
+          # Also retries builds; upload retries alone cannot clean up starter assets.
+          retryAttempts: 3
+          tauriScript: "node ../../node_modules/@tauri-apps/cli/tauri.js"
+          tagName: "v__VERSION__"
+          releaseName: "Release __VERSION__"
+          releaseBody: "<!-- generated-by-yaak-releases -->"
+          releaseDraft: true
+          prerelease: true
+          projectPath: ./crates-tauri/yaak-app-client
+          args: "${{ matrix.args }}"
+
+      # Snapshot before the per-machine build overwrites the regular NSIS bundle/signature.
+      - name: Snapshot Tauri bundles
+        if: ${{ !cancelled() }}
+        run: node .github/scripts/preserve-release-artifacts.mjs
+        env:
+          RELEASE_TARGET: ${{ matrix.targets }}
+          RELEASE_PLATFORM: ${{ matrix.platform }}
+          RELEASE_RUNTIME: ${{ matrix.runtime }}
+          RELEASE_ARCH: ${{ matrix.yaak_arch }}
+          RELEASE_ARGS: ${{ matrix.args }}
+
+      - name: Build and upload CEF tarball from deb (Linux only)
+        if: matrix.os == 'ubuntu' && matrix.runtime == 'cef'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          deb=$(find target/release/bundle/deb -maxdepth 1 -type f -name '*.deb' | head -n 1)
+          version="${GITHUB_REF_NAME#v}"
+          extract_dir="target/release/bundle/deb/yaak-cef-linux-${{ matrix.yaak_arch }}"
+          tarball="target/release/bundle/deb/yaak-cef_${version}_linux_${{ matrix.yaak_arch }}.tar.gz"
+          rm -rf "$extract_dir"
+          mkdir -p "$extract_dir"
+          dpkg-deb -x "$deb" "$extract_dir"
+          tar -C "$extract_dir" -czf "$tarball" .
+          for attempt in 1 2 3 4; do
+            if gh release upload "$GITHUB_REF_NAME" "$tarball" --clobber; then
+              break
+            fi
+            if [ "$attempt" -eq 4 ]; then exit 1; fi
+            sleep 10
+          done
+
+      # Build a per-machine NSIS installer for enterprise deployment (PDQ, SCCM, Intune)
+      - name: Build and upload machine-wide installer (Windows only)
+        if: matrix.os == 'windows'
+        shell: pwsh
+        env:
+          YAAK_TARGET_ARCH: ${{ matrix.yaak_arch }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
+          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
+        run: |
+          Get-ChildItem -Recurse -Path target -File -Filter "*.exe.sig" | Remove-Item -Force
+          Push-Location crates-tauri/yaak-app-client
+          npx tauri bundle ${{ matrix.args }} --bundles nsis --config '{"bundle":{"createUpdaterArtifacts":true,"windows":{"nsis":{"installMode":"perMachine"}}}}'
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          Pop-Location
+          $setup = Get-ChildItem -Recurse -Path target -Filter "*setup*.exe" | Select-Object -First 1
+          $setupSig = "$($setup.FullName).sig"
+          $dest = $setup.FullName -replace '-setup\.exe$', '-setup-machine.exe'
+          $destSig = "$dest.sig"
+          Copy-Item $setup.FullName $dest
+          Copy-Item $setupSig $destSig
+          foreach ($asset in @($dest, $destSig)) {
+            for ($attempt = 1; $attempt -le 4; $attempt++) {
+              gh release upload "$env:GITHUB_REF_NAME" "$asset" --clobber
+              if ($LASTEXITCODE -eq 0) { break }
+              if ($attempt -eq 4) { exit $LASTEXITCODE }
+              Start-Sleep -Seconds 10
+            }
+          }
+
+      - name: Snapshot additional release bundles
+        if: ${{ !cancelled() }}
+        run: node .github/scripts/preserve-release-artifacts.mjs
+        env:
+          RELEASE_TARGET: ${{ matrix.targets }}
+          RELEASE_PLATFORM: ${{ matrix.platform }}
+          RELEASE_RUNTIME: ${{ matrix.runtime }}
+          RELEASE_ARCH: ${{ matrix.yaak_arch }}
+          RELEASE_ARGS: ${{ matrix.args }}
+
+      - name: Retain release bundles for recovery
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-${{ github.ref_name }}-${{ matrix.platform }}-${{ matrix.runtime }}-${{ matrix.yaak_arch }}-${{ github.run_id }}-attempt-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/yaak-release-artifacts/
+          retention-days: 7
+          if-no-files-found: warn
--- a/.github/workflows/release-cli-npm.yml
+++ b/.github/workflows/release-cli-npm.yml
@@ -0,0 +1,219 @@
+name: Release CLI to NPM
+
+on:
+  push:
+    tags: [v*]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: CLI version to publish (for example 0.4.0 or v0.4.0)
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  prepare-vendored-assets:
+    if: github.repository == 'mountain-loop/yaak'
+    name: Prepare vendored plugin assets
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build plugin assets
+        env:
+          SKIP_WASM_BUILD: "1"
+        run: |
+          npm run build
+          npm run vendor:vendor-plugins
+
+      - name: Upload vendored assets
+        uses: actions/upload-artifact@v4
+        with:
+          name: vendored-assets
+          path: |
+            crates-tauri/yaak-app-client/vendored/plugin-runtime/index.cjs
+            crates-tauri/yaak-app-client/vendored/plugins
+          if-no-files-found: error
+
+  build-binaries:
+    name: Build ${{ matrix.pkg }}
+    needs: prepare-vendored-assets
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - pkg: cli-darwin-arm64
+            runner: macos-latest
+            target: aarch64-apple-darwin
+            binary: yaak
+          - pkg: cli-darwin-x64
+            runner: macos-latest
+            target: x86_64-apple-darwin
+            binary: yaak
+          - pkg: cli-linux-arm64
+            runner: ubuntu-22.04-arm
+            target: aarch64-unknown-linux-gnu
+            binary: yaak
+          - pkg: cli-linux-x64
+            runner: ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+            binary: yaak
+          - pkg: cli-win32-arm64
+            runner: windows-latest
+            target: aarch64-pc-windows-msvc
+            binary: yaak.exe
+          - pkg: cli-win32-x64
+            runner: windows-latest
+            target: x86_64-pc-windows-msvc
+            binary: yaak.exe
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Restore Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: release-cli-npm
+          cache-on-failure: true
+
+      - name: Install Linux build dependencies
+        if: startsWith(matrix.runner, 'ubuntu')
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y pkg-config libdbus-1-dev
+
+      - name: Download vendored assets
+        uses: actions/download-artifact@v4
+        with:
+          name: vendored-assets
+          path: crates-tauri/yaak-app-client/vendored
+
+      - name: Set CLI build version
+        shell: bash
+        env:
+          WORKFLOW_VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            VERSION="$WORKFLOW_VERSION"
+          else
+            VERSION="${GITHUB_REF_NAME}"
+          fi
+          VERSION="${VERSION#v}"
+          echo "Building yaak version: $VERSION"
+          echo "YAAK_CLI_VERSION=$VERSION" >> "$GITHUB_ENV"
+
+      - name: Build yaak
+        run: cargo build --locked --release -p yaak-cli --bin yaak --target ${{ matrix.target }}
+
+      - name: Stage binary artifact
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "npm/dist/${{ matrix.pkg }}"
+          cp "target/${{ matrix.target }}/release/${{ matrix.binary }}" "npm/dist/${{ matrix.pkg }}/${{ matrix.binary }}"
+
+      - name: Upload binary artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.pkg }}
+          path: npm/dist/${{ matrix.pkg }}/${{ matrix.binary }}
+          if-no-files-found: error
+
+  publish-npm:
+    name: Publish @yaakapp/cli packages
+    needs: build-binaries
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+          registry-url: https://registry.npmjs.org
+
+      - name: Download binary artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: cli-*
+          path: npm/dist
+          merge-multiple: false
+
+      - name: Prepare npm packages
+        shell: bash
+        env:
+          WORKFLOW_VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            VERSION="$WORKFLOW_VERSION"
+          else
+            VERSION="${GITHUB_REF_NAME}"
+          fi
+          VERSION="${VERSION#v}"
+          if [[ "$VERSION" == *-* ]]; then
+            PRERELEASE="${VERSION#*-}"
+            NPM_TAG="${PRERELEASE%%.*}"
+          else
+            NPM_TAG="latest"
+          fi
+          echo "Preparing CLI npm packages for version: $VERSION"
+          echo "Publishing with npm dist-tag: $NPM_TAG"
+          echo "NPM_TAG=$NPM_TAG" >> "$GITHUB_ENV"
+          YAAK_CLI_VERSION="$VERSION" node npm/prepare-publish.js
+
+      - name: Publish @yaakapp/cli-darwin-arm64
+        run: npm publish --provenance --access public --tag "$NPM_TAG"
+        working-directory: npm/cli-darwin-arm64
+
+      - name: Publish @yaakapp/cli-darwin-x64
+        run: npm publish --provenance --access public --tag "$NPM_TAG"
+        working-directory: npm/cli-darwin-x64
+
+      - name: Publish @yaakapp/cli-linux-arm64
+        run: npm publish --provenance --access public --tag "$NPM_TAG"
+        working-directory: npm/cli-linux-arm64
+
+      - name: Publish @yaakapp/cli-linux-x64
+        run: npm publish --provenance --access public --tag "$NPM_TAG"
+        working-directory: npm/cli-linux-x64
+
+      - name: Publish @yaakapp/cli-win32-arm64
+        run: npm publish --provenance --access public --tag "$NPM_TAG"
+        working-directory: npm/cli-win32-arm64
+
+      - name: Publish @yaakapp/cli-win32-x64
+        run: npm publish --provenance --access public --tag "$NPM_TAG"
+        working-directory: npm/cli-win32-x64
+
+      - name: Publish @yaakapp/cli
+        run: npm publish --provenance --access public --tag "$NPM_TAG"
+        working-directory: npm/cli
--- a/.github/workflows/release-web-image.yml
+++ b/.github/workflows/release-web-image.yml
@@ -0,0 +1,123 @@
+name: Release web image
+
+# Builds ghcr.io/mountain-loop/yaak-web: the browser client and the server that serves it.
+# One image per architecture on its own native runner (emulating a Rust release build is hours),
+# joined into one multi-arch tag at the end.
+
+on:
+  push:
+    tags: [v*]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Version to publish, without the v (e.g. 2026.2.0). Empty publishes main and sha tags only.
+        required: false
+        type: string
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  IMAGE: ghcr.io/mountain-loop/yaak-web
+
+jobs:
+  build:
+    if: github.repository == 'mountain-loop/yaak'
+    name: Build ${{ matrix.platform }}
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-22.04
+            arch: amd64
+          - platform: linux/arm64
+            runner: ubuntu-22.04-arm
+            arch: arm64
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile.web
+          platforms: ${{ matrix.platform }}
+          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true
+
+      - name: Export digest
+        run: |
+          mkdir -p "${{ runner.temp }}/digests"
+          digest="${{ steps.build.outputs.digest }}"
+          touch "${{ runner.temp }}/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: digest-${{ matrix.arch }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  publish:
+    name: Publish manifest
+    needs: build
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: ${{ runner.temp }}/digests
+          pattern: digest-*
+          merge-multiple: true
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # `latest` follows a release tag, and a manual run that names a version — the way to
+      # publish before the first release. A prerelease (v2026.2.1-beta.1) never takes it.
+      - name: Tags
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.IMAGE }}
+          flavor: latest=false
+          tags: |
+            type=semver,pattern={{version}}
+            type=raw,value=${{ inputs.version }},enable=${{ inputs.version != '' }}
+            type=raw,value=latest,enable=${{ inputs.version != '' || (github.event_name == 'push' && !contains(github.ref_name, '-')) }}
+            type=ref,event=branch
+            type=sha,format=short
+
+      - name: Create and push the manifest
+        working-directory: ${{ runner.temp }}/digests
+        run: |
+          docker buildx imagetools create \
+            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ env.IMAGE }}@sha256:%s ' *)
+
+      - name: Inspect
+        run: docker buildx imagetools inspect ${{ env.IMAGE }}:${{ steps.meta.outputs.version }}
--- a/.github/workflows/sponsors.yml
+++ b/.github/workflows/sponsors.yml
@@ -0,0 +1,45 @@
+name: Generate Sponsors README
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: 30 15 * * 0-6
+permissions:
+  contents: write
+jobs:
+  deploy:
+    if: github.repository == 'mountain-loop/yaak'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout 🛎️
+        uses: actions/checkout@v2
+
+      - name: Generate Sponsors
+        uses: JamesIves/github-sponsors-readme-action@v1
+        with:
+          token: ${{ secrets.SPONSORS_PAT }}
+          file: "README.md"
+          maximum: 1999
+          template: '<a href="https://github.com/{{{ login }}}"><img src="{{{ avatarUrl }}}" width="50px" alt="User avatar: {{{ login }}}" /></a>&nbsp;&nbsp;'
+          active-only: false
+          include-private: true
+          marker: "sponsors-base"
+
+      - name: Generate Sponsors
+        uses: JamesIves/github-sponsors-readme-action@v1
+        with:
+          token: ${{ secrets.SPONSORS_PAT }}
+          file: "README.md"
+          minimum: 2000
+          template: '<a href="https://github.com/{{{ login }}}"><img src="{{{ avatarUrl }}}" width="80px" alt="User avatar: {{{ login }}}" /></a>&nbsp;&nbsp;'
+          active-only: false
+          include-private: true
+          marker: "sponsors-premium"
+
+      # ⚠️ Note: You can use any deployment step here to automatically push the README
+      # changes back to your branch.
+      - name: Commit Changes
+        uses: JamesIves/github-pages-deploy-action@v4
+        with:
+          branch: main
+          force: false
+          folder: "."