commit c1fdfba3fecd01d42abab23cd914dc98fdbd40d0
Author: Roman Kivalin <roman@shl.dev>
Date:   Sun Apr 12 20:07:27 2026 +0200

    Initial implementation of certforge ACME certificate manager
    
    Rust CLI tool for automated ACME certificate management with:
    - DNS-01 challenge via RFC 2136 dynamic DNS updates with TSIG auth
    - DANE TLSA record publication (RFC 6698/7671/7672)
    - systemd credential integration (systemd-creds encrypt/decrypt)
    - systemd unit management via D-Bus (zbus)
    - Post-renewal hooks (systemctl reload/restart, arbitrary commands)
    - Key rotation with DANE pre-publication protocol
    - TOML configuration with per-zone DNS overrides
    
    Tested against Let's Encrypt staging. 12 unit tests, zero warnings.
    
    Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..08a7e13
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+/target
+/testing
diff --git a/Cargo.lock b/Cargo.lock
new file mode 100644
index 0000000..1262928
--- /dev/null
+++ b/Cargo.lock
@@ -0,0 +1,3138 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
+[[package]]
+name = "asn1-rs"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5493c3bedbacf7fd7382c6346bbd66687d12bbaad3a89a2d2c303ee6cf20b048"
+dependencies = [
+ "asn1-rs-derive 0.5.1",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+ "time",
+]
+
+[[package]]
+name = "asn1-rs"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56624a96882bb8c26d61312ae18cb45868e5a9992ea73c58e45c3101e56a1e60"
+dependencies = [
+ "asn1-rs-derive 0.6.0",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror 2.0.18",
+ "time",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "965c2d33e53cb6b267e148a4cb0760bc01f4904c1cd4bb4002a085bb016d1490"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "async-broadcast"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "435a87a52755b8f27fcf321ac4f04b2802e337c8c4872923137471ec39c37532"
+dependencies = [
+ "event-listener",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-channel"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "924ed96dd52d1b75e9c1a3e6275715fd320f5f9439fb5a4a11fa51f4221158d2"
+dependencies = [
+ "concurrent-queue",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-executor"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c96bf972d85afc50bf5ab8fe2d54d1586b4e0b46c97c50a0c9e71e2f7bcd812a"
+dependencies = [
+ "async-task",
+ "concurrent-queue",
+ "fastrand",
+ "futures-lite",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "async-io"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "456b8a8feb6f42d237746d4b3e9a178494627745c3c56c6ea55d92ba50d026fc"
+dependencies = [
+ "autocfg",
+ "cfg-if",
+ "concurrent-queue",
+ "futures-io",
+ "futures-lite",
+ "parking",
+ "polling",
+ "rustix",
+ "slab",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "async-lock"
+version = "3.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
+dependencies = [
+ "event-listener",
+ "event-listener-strategy",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-process"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc50921ec0055cdd8a16de48773bfeec5c972598674347252c0399676be7da75"
+dependencies = [
+ "async-channel",
+ "async-io",
+ "async-lock",
+ "async-signal",
+ "async-task",
+ "blocking",
+ "cfg-if",
+ "event-listener",
+ "futures-lite",
+ "rustix",
+]
+
+[[package]]
+name = "async-recursion"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "async-signal"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52b5aaafa020cf5053a01f2a60e8ff5dccf550f0f77ec54a4e47285ac2bab485"
+dependencies = [
+ "async-io",
+ "async-lock",
+ "atomic-waker",
+ "cfg-if",
+ "futures-core",
+ "futures-io",
+ "rustix",
+ "signal-hook-registry",
+ "slab",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "async-task"
+version = "4.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
+
+[[package]]
+name = "async-trait"
+version = "0.1.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
+[[package]]
+name = "aws-lc-rs"
+version = "1.16.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a054912289d18629dc78375ba2c3726a3afe3ff71b4edba9dedfca0e3446d1fc"
+dependencies = [
+ "aws-lc-sys",
+ "untrusted 0.7.1",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.39.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83a25cf98105baa966497416dbd42565ce3a8cf8dbfd59803ec9ad46f3126399"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+]
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bitflags"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "blocking"
+version = "1.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e83f8d02be6967315521be875afa792a316e28d57b5a2d401897e2a7921b7f21"
+dependencies = [
+ "async-channel",
+ "async-task",
+ "futures-io",
+ "futures-lite",
+ "piper",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
+
+[[package]]
+name = "bytes"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+
+[[package]]
+name = "cc"
+version = "1.2.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43c5703da9466b66a946814e1adf53ea2c90f10063b86290cc9eb67ce3478a20"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "certforge"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base64",
+ "chrono",
+ "clap",
+ "hex",
+ "hickory-client",
+ "hickory-proto",
+ "instant-acme",
+ "pem",
+ "rcgen 0.13.2",
+ "ring",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "sha2",
+ "thiserror 2.0.18",
+ "tokio",
+ "toml",
+ "tracing",
+ "tracing-subscriber",
+ "x509-parser 0.16.0",
+ "zbus",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "chrono"
+version = "0.4.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+dependencies = [
+ "iana-time-zone",
+ "num-traits",
+ "serde",
+ "windows-link",
+]
+
+[[package]]
+name = "clap"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b193af5b67834b676abd72466a96c1024e6a6ad978a1f484bd90b85c94041351"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1110bd8a634a1ab8cb04345d8d878267d57c3cf1b38d91b71af6686408bbca6a"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "combine"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "critical-section"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7a1e2f27636f116493b8b860f5546edb47c8d8f8ea73e1d2a20be88e28d1fea"
+
+[[package]]
+name = "der-parser"
+version = "9.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cd0a5c643689626bec213c4d8bd4d96acc8ffdb4ad4bb6bc16abf27d5f4b553"
+dependencies = [
+ "asn1-rs 0.6.2",
+ "displaydoc",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
+[[package]]
+name = "der-parser"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6"
+dependencies = [
+ "asn1-rs 0.7.1",
+ "displaydoc",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "powerfmt",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "endi"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
+
+[[package]]
+name = "endian-type"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c34f04666d835ff5d62e058c3995147c06f42fe86ff053337632bca83e42702d"
+
+[[package]]
+name = "enum-as-inner"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "enumflags2"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1027f7680c853e056ebcec683615fb6fbbc07dbaa13b4d5d9442b146ded4ecef"
+dependencies = [
+ "enumflags2_derive",
+ "serde",
+]
+
+[[package]]
+name = "enumflags2_derive"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67c78a4d8fdf9953a5c9d458f9efe940fd97a0cab0941c075a813ac594733827"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "event-listener"
+version = "5.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+dependencies = [
+ "concurrent-queue",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event-listener-strategy"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
+dependencies = [
+ "event-listener",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-lite"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f78e10609fe0e0b3f4157ffab1876319b5b0db102a2c60dc4626306dc46b44ad"
+dependencies = [
+ "fastrand",
+ "futures-core",
+ "futures-io",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "wasip2",
+ "wasip3",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hermit-abi"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hickory-client"
+version = "0.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c466cd63a4217d5b2b8e32f23f58312741ce96e3c84bf7438677d2baff0fc555"
+dependencies = [
+ "cfg-if",
+ "data-encoding",
+ "futures-channel",
+ "futures-util",
+ "hickory-proto",
+ "once_cell",
+ "radix_trie",
+ "rand",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "hickory-proto"
+version = "0.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8a6fe56c0038198998a6f217ca4e7ef3a5e51f46163bd6dd60b5c71ca6c6502"
+dependencies = [
+ "async-trait",
+ "bitflags",
+ "cfg-if",
+ "data-encoding",
+ "enum-as-inner",
+ "futures-channel",
+ "futures-io",
+ "futures-util",
+ "idna",
+ "ipnet",
+ "once_cell",
+ "rand",
+ "ring",
+ "rustls-pki-types",
+ "thiserror 2.0.18",
+ "time",
+ "tinyvec",
+ "tokio",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "http"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6299f016b246a94207e63da54dbe807655bf9e00044f73ded42c3ac5305fbcca"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2b52f86d1d4bc0d6b4e6826d960b1b333217e07d36b882dca570a5e1c48895b"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "libc",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_properties"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+
+[[package]]
+name = "icu_provider"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.0",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "instant-acme"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f05ad37c421b962354c358d347d4a6130151df9407978372d3ad7f0c8f71a64"
+dependencies = [
+ "async-trait",
+ "aws-lc-rs",
+ "base64",
+ "bytes",
+ "http",
+ "http-body",
+ "http-body-util",
+ "httpdate",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "rcgen 0.14.7",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.18",
+ "tokio",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys",
+ "log",
+ "simd_cesu8",
+ "thiserror 2.0.18",
+ "walkdir",
+ "windows-link",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
+dependencies = [
+ "getrandom 0.3.4",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.95"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2964e92d1d9dc3364cae4d718d93f227e3abb088e747d92e0395bfdedf1c12ca"
+dependencies = [
+ "once_cell",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "libc"
+version = "0.2.184"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48f5d2a454e16a5ea0f4ced81bd44e4cfc7bd3a507b61887c99fd3538b28e4af"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "mio"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "nibble_vec"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77a5d83df9f36fe23f0c3648c6bbb8b0298bb5f1939c8f2704431371f4b84d43"
+dependencies = [
+ "smallvec",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6673768db2d862beb9b39a78fdcb1a69439615d5794a1be50caa9bc92c81967"
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "oid-registry"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8d8034d9489cdaf79228eb9f6a3b8d7bb32ba00d6645ebd48eef4077ceb5bd9"
+dependencies = [
+ "asn1-rs 0.6.2",
+]
+
+[[package]]
+name = "oid-registry"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f40cff3dde1b6087cc5d5f5d4d65712f34016a03ed60e9c08dcc392736b5b7"
+dependencies = [
+ "asn1-rs 0.7.1",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+dependencies = [
+ "critical-section",
+ "portable-atomic",
+]
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "ordered-stream"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aa2b01e1d916879f73a53d01d1d6cee68adbb31d6d9177a8cfce093cced1d50"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "pem"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
+dependencies = [
+ "base64",
+ "serde_core",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "piper"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c835479a4443ded371d6c535cbfd8d31ad92c5d23ae9770a61bc155e4992a3c1"
+dependencies = [
+ "atomic-waker",
+ "fastrand",
+ "futures-io",
+]
+
+[[package]]
+name = "polling"
+version = "3.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0e4f59085d47d8241c88ead0f274e8a0cb551f3625263c05eb8dd897c34218"
+dependencies = [
+ "cfg-if",
+ "concurrent-queue",
+ "hermit-abi",
+ "pin-project-lite",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
+dependencies = [
+ "toml_edit 0.25.11+spec-1.1.0",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "radix_trie"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c069c179fcdc6a2fe24d8d18305cf085fdbd4f922c041943e203685d6a1c58fd"
+dependencies = [
+ "endian-type",
+ "nibble_vec",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ec095654a25171c2124e9e3393a930bddbffdc939556c914957a4c3e0a87166"
+dependencies = [
+ "rand_chacha",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "rcgen"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75e669e5202259b5314d1ea5397316ad400819437857b90861765f24c4cf80a2"
+dependencies = [
+ "pem",
+ "ring",
+ "rustls-pki-types",
+ "time",
+ "yasna",
+]
+
+[[package]]
+name = "rcgen"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10b99e0098aa4082912d4c649628623db6aba77335e4f4569ff5083a6448b32e"
+dependencies = [
+ "aws-lc-rs",
+ "pem",
+ "rustls-pki-types",
+ "time",
+ "x509-parser 0.18.1",
+ "yasna",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted 0.9.0",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4"
+dependencies = [
+ "aws-lc-rs",
+ "once_cell",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
+dependencies = [
+ "core-foundation",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20a6af516fea4b20eccceaf166e8aa666ac996208e8a644ce3ef5aa783bc7cd4"
+dependencies = [
+ "aws-lc-rs",
+ "ring",
+ "rustls-pki-types",
+ "untrusted 0.9.0",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.149"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_repr"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "simd_cesu8"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94f90157bb87cddf702797c5dadfa0be7d266cdf49e22da2fcaa32eff75b2c33"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+
+[[package]]
+name = "socket2"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.2",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl 2.0.18",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "time"
+version = "0.3.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+
+[[package]]
+name = "time-macros"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.51.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f66bf9585cda4b724d3e78ab34b73fb2bbaba9011b9bfdf69dc836382ea13b8c"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "parking_lot",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "toml"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime 0.6.11",
+ "toml_edit 0.22.27",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.22.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_spanned",
+ "toml_datetime 0.6.11",
+ "toml_write",
+ "winnow 0.7.15",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.25.11+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b59c4d22ed448339746c59b905d24568fcbb3ab65a500494f7b8c3e97739f2b"
+dependencies = [
+ "indexmap",
+ "toml_datetime 1.1.1+spec-1.1.0",
+ "toml_parser",
+ "winnow 1.0.1",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
+dependencies = [
+ "winnow 1.0.1",
+]
+
+[[package]]
+name = "toml_write"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typenum"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+
+[[package]]
+name = "uds_windows"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
+dependencies = [
+ "memoffset",
+ "tempfile",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "uuid"
+version = "1.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ac8b6f42ead25368cf5b098aeb3dc8a1a2c05a3eee8a9a1a68c640edbfc79d9"
+dependencies = [
+ "js-sys",
+ "serde_core",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.2+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.118"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf938a0bacb0469e83c1e148908bd7d5a6010354cf4fb73279b7447422e3a89"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.118"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eeff24f84126c0ec2db7a449f0c2ec963c6a49efe0698c4242929da037ca28ed"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.118"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d08065faf983b2b80a79fd87d8254c409281cf7de75fc4b773019824196c904"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.118"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd04d9e306f1907bd13c6361b5c6bfc7b3b3c095ed3f8a9246390f8dbdee129"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.15.5",
+ "indexmap",
+ "semver",
+]
+
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "804f18a4ac2676ffb4e8b5b5fa9ae38af06df08162314f96a68d2a363e21a8ca"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "winnow"
+version = "0.7.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winnow"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09dac053f1cd375980747450bfc7250c264eaae0583872e845c0c7cd578872b5"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+
+[[package]]
+name = "x509-parser"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcbc162f30700d6f3f82a24bf7cc62ffe7caea42c0b2cba8bf7f3ae50cf51f69"
+dependencies = [
+ "asn1-rs 0.6.2",
+ "data-encoding",
+ "der-parser 9.0.0",
+ "lazy_static",
+ "nom",
+ "oid-registry 0.7.1",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+ "time",
+]
+
+[[package]]
+name = "x509-parser"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d43b0f71ce057da06bc0851b23ee24f3f86190b07203dd8f567d0b706a185202"
+dependencies = [
+ "asn1-rs 0.7.1",
+ "aws-lc-rs",
+ "data-encoding",
+ "der-parser 10.0.0",
+ "lazy_static",
+ "nom",
+ "oid-registry 0.8.1",
+ "rusticata-macros",
+ "thiserror 2.0.18",
+ "time",
+]
+
+[[package]]
+name = "yasna"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd"
+dependencies = [
+ "time",
+]
+
+[[package]]
+name = "yoke"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zbus"
+version = "5.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca82f95dbd3943a40a53cfded6c2d0a2ca26192011846a1810c4256ef92c60bc"
+dependencies = [
+ "async-broadcast",
+ "async-executor",
+ "async-io",
+ "async-lock",
+ "async-process",
+ "async-recursion",
+ "async-task",
+ "async-trait",
+ "blocking",
+ "enumflags2",
+ "event-listener",
+ "futures-core",
+ "futures-lite",
+ "hex",
+ "libc",
+ "ordered-stream",
+ "rustix",
+ "serde",
+ "serde_repr",
+ "tracing",
+ "uds_windows",
+ "uuid",
+ "windows-sys 0.61.2",
+ "winnow 0.7.15",
+ "zbus_macros",
+ "zbus_names",
+ "zvariant",
+]
+
+[[package]]
+name = "zbus_macros"
+version = "5.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "897e79616e84aac4b2c46e9132a4f63b93105d54fe8c0e8f6bffc21fa8d49222"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "zbus_names",
+ "zvariant",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zbus_names"
+version = "4.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffd8af6d5b78619bab301ff3c560a5bd22426150253db278f164d6cf3b72c50f"
+dependencies = [
+ "serde",
+ "winnow 0.7.15",
+ "zvariant",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.48"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eed437bf9d6692032087e337407a86f04cd8d6a16a37199ed57949d415bd68e9"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.48"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70e3cd084b1788766f53af483dd21f93881ff30d7320490ec3ef7526d203bad4"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
+
+[[package]]
+name = "zvariant"
+version = "5.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5708299b21903bbe348e94729f22c49c55d04720a004aa350f1f9c122fd2540b"
+dependencies = [
+ "endi",
+ "enumflags2",
+ "serde",
+ "winnow 0.7.15",
+ "zvariant_derive",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zvariant_derive"
+version = "5.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b59b012ebe9c46656f9cc08d8da8b4c726510aef12559da3e5f1bf72780752c"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zvariant_utils"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f75c23a64ef8f40f13a6989991e643554d9bef1d682a281160cf0c1bc389c5e9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde",
+ "syn",
+ "winnow 0.7.15",
+]
diff --git a/Cargo.toml b/Cargo.toml
new file mode 100644
index 0000000..e67fac0
--- /dev/null
+++ b/Cargo.toml
@@ -0,0 +1,49 @@
+[package]
+name = "certforge"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+# ACME
+instant-acme = "0.8"
+
+# DNS
+hickory-proto = { version = "0.25", features = ["dnssec-ring"] }
+hickory-client = { version = "0.25", features = ["dnssec-ring"] }
+
+# Crypto / Certificates
+rcgen = "0.13"
+ring = "0.17"
+x509-parser = "0.16"
+pem = "3"
+sha2 = "0.10"
+base64 = "0.22"
+hex = "0.4"
+rustls-pki-types = "1"
+
+# Async
+tokio = { version = "1", features = ["full"] }
+
+# CLI
+clap = { version = "4", features = ["derive"] }
+
+# Config
+serde = { version = "1", features = ["derive"] }
+toml = "0.8"
+
+# Logging
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+
+# Error handling
+thiserror = "2"
+anyhow = "1"
+
+# Time
+chrono = { version = "0.4", default-features = false, features = ["clock", "serde"] }
+
+# State persistence
+serde_json = "1"
+
+# systemd D-Bus
+zbus = "5"
diff --git a/examples/certforge.service b/examples/certforge.service
new file mode 100644
index 0000000..e0b22ce
--- /dev/null
+++ b/examples/certforge.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=Certforge ACME certificate renewal
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/certforge renew
+
+# Hardening
+ProtectSystem=strict
+ReadWritePaths=/etc/certforge/certs /var/lib/certforge /etc/credstore.encrypted
+PrivateTmp=yes
+NoNewPrivileges=yes
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
diff --git a/examples/certforge.timer b/examples/certforge.timer
new file mode 100644
index 0000000..8372999
--- /dev/null
+++ b/examples/certforge.timer
@@ -0,0 +1,10 @@
+[Unit]
+Description=Certforge daily certificate check
+
+[Timer]
+OnCalendar=*-*-* 02:30:00
+RandomizedDelaySec=1800
+Persistent=true
+
+[Install]
+WantedBy=timers.target
diff --git a/examples/config.toml b/examples/config.toml
new file mode 100644
index 0000000..5639cb8
--- /dev/null
+++ b/examples/config.toml
@@ -0,0 +1,85 @@
+# Example certforge configuration
+#
+# Full documentation: see the project README
+
+[acme]
+directory_url = "https://acme-v02.api.letsencrypt.org/directory"
+# Use staging for testing:
+# directory_url = "https://acme-staging-v02.api.letsencrypt.org/directory"
+
+# ACME account key: stored as encrypted systemd credential
+account_key_credential = "/etc/credstore.encrypted/acme-account-key"
+# Or as a plain file:
+# account_key_path = "/etc/certforge/account.key"
+
+contact = ["mailto:admin@example.com"]
+
+# Default DNS server for RFC 2136 updates
+[dns.defaults]
+server = "ns1.example.com"
+tsig_key_credential = "/etc/credstore.encrypted/dns-tsig-key"
+# tsig_key_path = "/etc/certforge/tsig.key"
+tsig_key_name = "certforge-update."
+tsig_algorithm = "hmac-sha256"
+port = 53
+protocol = "tcp"
+
+# Per-zone DNS overrides (optional)
+# [dns.zones."example.org"]
+# server = "ns2.example.org"
+# tsig_key_credential = "/etc/credstore.encrypted/dns-tsig-org"
+
+# Mail server certificate
+[[certificate]]
+name = "mail"
+domains = ["mail.example.com"]
+key_type = "ecdsa-p256"
+key_credential = "/etc/credstore.encrypted/mail-tls-key"
+cert_path = "/etc/certforge/certs/mail.pem"
+renew_before_days = 30
+rotate_key = false
+
+  # DANE TLSA for SMTP (port 25)
+  [[certificate.dane]]
+  usage = "ee"
+  selector = "spki"
+  matching = "sha256"
+  names = ["_25._tcp.mail.example.com"]
+  ttl = 300
+  pre_publish = true
+
+  # DANE TLSA for IMAP (port 993)
+  [[certificate.dane]]
+  usage = "ee"
+  selector = "spki"
+  matching = "sha256"
+  names = ["_993._tcp.mail.example.com"]
+  ttl = 300
+
+  [[certificate.hook]]
+  type = "systemd-reload"
+  unit = "postfix.service"
+
+  [[certificate.hook]]
+  type = "systemd-restart"
+  unit = "dovecot.service"
+
+# Web server certificate
+[[certificate]]
+name = "web"
+domains = ["example.com", "www.example.com"]
+key_type = "ecdsa-p256"
+key_credential = "/etc/credstore.encrypted/web-tls-key"
+cert_path = "/etc/certforge/certs/web.pem"
+renew_before_days = 30
+
+  [[certificate.dane]]
+  usage = "ee"
+  selector = "spki"
+  matching = "sha256"
+  names = ["_443._tcp.example.com", "_443._tcp.www.example.com"]
+  ttl = 3600
+
+  [[certificate.hook]]
+  type = "systemd-reload"
+  unit = "nginx.service"
diff --git a/src/acme.rs b/src/acme.rs
new file mode 100644
index 0000000..71e1a04
--- /dev/null
+++ b/src/acme.rs
@@ -0,0 +1,222 @@
+use std::time::Duration;
+
+use instant_acme::{
+    Account, AccountCredentials, ChallengeType, Identifier, NewAccount, NewOrder, Order,
+    OrderStatus,
+};
+
+use crate::config::AcmeConfig;
+use crate::credentials;
+use crate::error::{Error, Result};
+
+/// ACME client wrapping instant-acme with credential management.
+pub struct AcmeClient {
+    account: Account,
+}
+
+/// Information about a pending DNS-01 challenge.
+pub struct DnsChallenge {
+    /// The domain being validated
+    pub domain: String,
+    /// The full DNS name for the TXT record: _acme-challenge.<domain>
+    pub txt_name: String,
+    /// The TXT record value (base64url-encoded SHA-256 of key authorization)
+    pub txt_value: String,
+}
+
+impl AcmeClient {
+    /// Load or create an ACME account.
+    pub async fn new(config: &AcmeConfig) -> Result<Self> {
+        let cred_data = credentials::load_secret(
+            config.account_key_credential.as_deref(),
+            config.account_key_path.as_deref(),
+        )
+        .await;
+
+        match cred_data {
+            Ok(data) => {
+                let creds: AccountCredentials = serde_json::from_slice(&data).map_err(|e| {
+                    Error::Config(format!("invalid account credentials: {e}"))
+                })?;
+                let account = Account::builder()
+                    .map_err(|e| Error::Acme(e))?
+                    .from_credentials(creds)
+                    .await?;
+                tracing::info!(id = %account.id(), "loaded existing ACME account");
+                Ok(Self { account })
+            }
+            Err(_) => {
+                tracing::info!(directory = %config.directory_url, "creating new ACME account");
+                let (account, creds) = Account::builder()
+                    .map_err(|e| Error::Acme(e))?
+                    .create(
+                        &NewAccount {
+                            contact: &config
+                                .contact
+                                .iter()
+                                .map(|s| s.as_str())
+                                .collect::<Vec<_>>(),
+                            terms_of_service_agreed: true,
+                            only_return_existing: false,
+                        },
+                        config.directory_url.clone(),
+                        None,
+                    )
+                    .await?;
+
+                tracing::info!(id = %account.id(), "created new ACME account");
+
+                let creds_json = serde_json::to_vec(&creds)
+                    .map_err(|e| Error::Config(format!("failed to serialize credentials: {e}")))?;
+
+                if let Some(cred_path) = &config.account_key_credential {
+                    credentials::encrypt_credential("acme-account-key", &creds_json, cred_path)
+                        .await?;
+                    tracing::info!(path = %cred_path.display(), "saved account credentials (encrypted)");
+                } else if let Some(file_path) = &config.account_key_path {
+                    if let Some(parent) = file_path.parent() {
+                        std::fs::create_dir_all(parent)?;
+                    }
+                    std::fs::write(file_path, &creds_json)?;
+                    #[cfg(unix)]
+                    {
+                        use std::os::unix::fs::PermissionsExt;
+                        std::fs::set_permissions(
+                            file_path,
+                            std::fs::Permissions::from_mode(0o600),
+                        )?;
+                    }
+                    tracing::info!(path = %file_path.display(), "saved account credentials");
+                }
+
+                Ok(Self { account })
+            }
+        }
+    }
+
+    /// Create a new certificate order, extract DNS-01 challenge info, and set challenges ready.
+    ///
+    /// The caller should publish DNS TXT records for the returned challenges BEFORE calling
+    /// this method. This method collects challenge info, publishes DNS, then sets challenges ready.
+    ///
+    /// Returns the order and challenge info needed for DNS TXT records.
+    pub async fn create_order(&self, domains: &[String]) -> Result<(Order, Vec<DnsChallenge>)> {
+        let identifiers: Vec<Identifier> = domains
+            .iter()
+            .map(|d| Identifier::Dns(d.clone()))
+            .collect();
+
+        let order = self
+            .account
+            .new_order(&NewOrder::new(&identifiers))
+            .await?;
+
+        Ok((order, Vec::new()))
+    }
+
+    /// Collect DNS-01 challenge info from an order's authorizations.
+    pub async fn collect_challenges(order: &mut Order) -> Result<Vec<DnsChallenge>> {
+        let mut challenges = Vec::new();
+
+        let mut auths = order.authorizations();
+        while let Some(auth_result) = auths.next().await {
+            let mut auth = auth_result?;
+
+            let domain = auth.identifier().to_string();
+
+            let dns01 = auth.challenge(ChallengeType::Dns01).ok_or_else(|| {
+                Error::Acme(instant_acme::Error::Other(
+                    format!("no DNS-01 challenge for {domain}").into(),
+                ))
+            })?;
+
+            let key_auth = dns01.key_authorization();
+            let txt_value = key_auth.dns_value();
+
+            challenges.push(DnsChallenge {
+                txt_name: format!("_acme-challenge.{domain}"),
+                domain,
+                txt_value,
+            });
+        }
+
+        Ok(challenges)
+    }
+
+    /// Set all DNS-01 challenges as ready (call after publishing TXT records).
+    pub async fn set_challenges_ready(order: &mut Order) -> Result<()> {
+        let mut auths = order.authorizations();
+        while let Some(auth_result) = auths.next().await {
+            let mut auth = auth_result?;
+            if let Some(mut dns01) = auth.challenge(ChallengeType::Dns01) {
+                dns01.set_ready().await?;
+            }
+        }
+        Ok(())
+    }
+
+    /// Wait for the order to become ready, then finalize with a CSR.
+    pub async fn finalize_order(order: &mut Order, csr_der: &[u8]) -> Result<()> {
+        let mut retries = 20;
+        loop {
+            let state = order.refresh().await?;
+            match state.status {
+                OrderStatus::Ready => break,
+                OrderStatus::Pending => {
+                    if retries == 0 {
+                        return Err(Error::Acme(instant_acme::Error::Other(
+                            "order still pending after max retries".into(),
+                        )));
+                    }
+                    retries -= 1;
+                    tokio::time::sleep(Duration::from_secs(3)).await;
+                }
+                OrderStatus::Invalid => {
+                    return Err(Error::Acme(instant_acme::Error::Other(
+                        "order became invalid".into(),
+                    )));
+                }
+                OrderStatus::Processing | OrderStatus::Valid => break,
+            }
+        }
+
+        order.finalize_csr(csr_der).await?;
+        Ok(())
+    }
+
+    /// Wait for the certificate to be available and download it.
+    pub async fn download_certificate(order: &mut Order) -> Result<String> {
+        let mut retries = 20;
+        loop {
+            let state = order.refresh().await?;
+            match state.status {
+                OrderStatus::Valid => {
+                    let cert = order.certificate().await?.ok_or_else(|| {
+                        Error::Acme(instant_acme::Error::Other(
+                            "order valid but no certificate available".into(),
+                        ))
+                    })?;
+                    return Ok(cert);
+                }
+                OrderStatus::Processing => {
+                    if retries == 0 {
+                        return Err(Error::Acme(instant_acme::Error::Other(
+                            "certificate still processing after max retries".into(),
+                        )));
+                    }
+                    retries -= 1;
+                    tokio::time::sleep(Duration::from_secs(3)).await;
+                }
+                status => {
+                    return Err(Error::Acme(instant_acme::Error::Other(
+                        format!("unexpected order status: {status:?}").into(),
+                    )));
+                }
+            }
+        }
+    }
+
+    pub fn account(&self) -> &Account {
+        &self.account
+    }
+}
diff --git a/src/certs.rs b/src/certs.rs
new file mode 100644
index 0000000..feaaad5
--- /dev/null
+++ b/src/certs.rs
@@ -0,0 +1,135 @@
+use std::path::Path;
+use x509_parser::prelude::*;
+
+use crate::error::{Error, Result};
+
+/// Parsed certificate information.
+pub struct CertInfo {
+    /// The full certificate chain PEM
+    #[allow(dead_code)]
+    pub pem_chain: String,
+    /// DER-encoded leaf certificate
+    pub leaf_der: Vec<u8>,
+    /// Not-after (expiry) timestamp
+    pub not_after: chrono::DateTime<chrono::Utc>,
+    /// Subject Alternative Names
+    pub san: Vec<String>,
+    /// SubjectPublicKeyInfo DER bytes
+    pub spki_der: Vec<u8>,
+}
+
+impl CertInfo {
+    /// Load and parse a certificate from a PEM file.
+    pub fn load(path: &Path) -> Result<Self> {
+        let pem_chain = std::fs::read_to_string(path).map_err(|e| {
+            Error::Certificate(format!("failed to read cert {}: {e}", path.display()))
+        })?;
+        Self::from_pem(&pem_chain)
+    }
+
+    /// Parse a certificate from PEM data.
+    pub fn from_pem(pem_data: &str) -> Result<Self> {
+        let pem_blocks: Vec<::pem::Pem> = ::pem::parse_many(pem_data.as_bytes())
+            .map_err(|e| Error::Certificate(format!("failed to parse PEM: {e}")))?;
+
+        if pem_blocks.is_empty() {
+            return Err(Error::Certificate("no certificates found in PEM data".into()));
+        }
+
+        let leaf_der = pem_blocks[0].contents().to_vec();
+        let (_, cert) = X509Certificate::from_der(&leaf_der)
+            .map_err(|e| Error::Certificate(format!("failed to parse X.509: {e}")))?;
+
+        let not_after = asn1_time_to_chrono(cert.validity().not_after)?;
+
+        let san = extract_san(&cert);
+
+        let spki_der = cert.public_key().raw.to_vec();
+
+        Ok(Self {
+            pem_chain: pem_data.to_string(),
+            leaf_der,
+            not_after,
+            san,
+            spki_der,
+        })
+    }
+
+    /// Check if the certificate expires within the given number of days.
+    pub fn expires_within_days(&self, days: u32) -> bool {
+        let now = chrono::Utc::now();
+        let threshold = now + chrono::Duration::days(days as i64);
+        self.not_after <= threshold
+    }
+
+    /// Days until expiry (negative if already expired).
+    pub fn days_until_expiry(&self) -> i64 {
+        let now = chrono::Utc::now();
+        (self.not_after - now).num_days()
+    }
+}
+
+fn extract_san(cert: &X509Certificate) -> Vec<String> {
+    let mut names = Vec::new();
+
+    if let Ok(Some(san_ext)) = cert.subject_alternative_name() {
+        for name in &san_ext.value.general_names {
+            match name {
+                GeneralName::DNSName(dns) => names.push(dns.to_string()),
+                GeneralName::IPAddress(ip) => {
+                    // IP addresses come as byte slices
+                    if ip.len() == 4 {
+                        names.push(format!("{}.{}.{}.{}", ip[0], ip[1], ip[2], ip[3]));
+                    } else if ip.len() == 16 {
+                        let parts: Vec<String> = ip
+                            .chunks(2)
+                            .map(|c| format!("{:02x}{:02x}", c[0], c[1]))
+                            .collect();
+                        names.push(parts.join(":"));
+                    }
+                }
+                _ => {}
+            }
+        }
+    }
+
+    names
+}
+
+fn asn1_time_to_chrono(time: ASN1Time) -> Result<chrono::DateTime<chrono::Utc>> {
+    let ts = time.timestamp();
+    chrono::DateTime::from_timestamp(ts, 0)
+        .ok_or_else(|| Error::Certificate(format!("invalid timestamp: {ts}")))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn generate_test_cert() -> String {
+        use rcgen::{CertificateParams, KeyPair};
+
+        let mut params = CertificateParams::new(vec!["test.example.com".to_string()]).unwrap();
+        params.not_after = rcgen::date_time_ymd(2030, 1, 1);
+        let key_pair = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256).unwrap();
+        let cert = params.self_signed(&key_pair).unwrap();
+        cert.pem()
+    }
+
+    #[test]
+    fn parse_cert() {
+        let pem_data = generate_test_cert();
+        let info = CertInfo::from_pem(&pem_data).unwrap();
+        assert!(info.san.contains(&"test.example.com".to_string()));
+        assert!(!info.spki_der.is_empty());
+        assert!(info.days_until_expiry() > 0);
+    }
+
+    #[test]
+    fn expiry_check() {
+        let pem_data = generate_test_cert();
+        let info = CertInfo::from_pem(&pem_data).unwrap();
+        // Cert expires in 2030, so it should not expire within 30 days
+        assert!(!info.expires_within_days(30));
+    }
+}
diff --git a/src/cli.rs b/src/cli.rs
new file mode 100644
index 0000000..0adbc73
--- /dev/null
+++ b/src/cli.rs
@@ -0,0 +1,89 @@
+use clap::{Parser, Subcommand};
+use std::path::PathBuf;
+
+#[derive(Parser)]
+#[command(name = "certforge", about = "ACME certificate manager with DANE and systemd integration")]
+pub struct Cli {
+    /// Config file path
+    #[arg(short, long, default_value = "/etc/certforge/config.toml")]
+    pub config: PathBuf,
+
+    /// Increase verbosity (-v, -vv, -vvv)
+    #[arg(short, long, action = clap::ArgAction::Count)]
+    pub verbose: u8,
+
+    /// Show what would be done without making changes
+    #[arg(short = 'n', long)]
+    pub dry_run: bool,
+
+    /// State directory
+    #[arg(long, default_value = "/var/lib/certforge")]
+    pub state_dir: PathBuf,
+
+    #[command(subcommand)]
+    pub command: Command,
+}
+
+#[derive(Subcommand)]
+pub enum Command {
+    /// Check all certificates and renew those expiring soon
+    Renew {
+        /// Only renew the named certificate
+        #[arg(long)]
+        name: Option<String>,
+
+        /// Force renewal even if not expiring soon
+        #[arg(long)]
+        force: bool,
+    },
+
+    /// Show status of all configured certificates
+    Status {
+        /// Only show status for the named certificate
+        #[arg(long)]
+        name: Option<String>,
+    },
+
+    /// Force-issue a specific certificate
+    Issue {
+        /// Certificate name
+        #[arg(long)]
+        name: String,
+    },
+
+    /// Force-(re)publish DANE TLSA records
+    DanePublish {
+        /// Only publish for the named certificate
+        #[arg(long)]
+        name: Option<String>,
+    },
+
+    /// Query and verify published TLSA records against current certs
+    DaneCheck {
+        /// Only check the named certificate
+        #[arg(long)]
+        name: Option<String>,
+    },
+
+    /// Validate configuration file
+    ConfigCheck,
+
+    /// Print systemd-creds encrypt commands for initial setup
+    Init,
+
+    /// Manage ACME account
+    Account {
+        #[command(subcommand)]
+        action: AccountAction,
+    },
+}
+
+#[derive(Subcommand)]
+pub enum AccountAction {
+    /// Create a new ACME account
+    Create,
+    /// Show account information
+    Show,
+    /// Deactivate the account
+    Deactivate,
+}
diff --git a/src/config.rs b/src/config.rs
new file mode 100644
index 0000000..cea6756
--- /dev/null
+++ b/src/config.rs
@@ -0,0 +1,462 @@
+use serde::Deserialize;
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+
+use crate::error::{Error, Result};
+
+#[derive(Debug, Deserialize)]
+pub struct Config {
+    pub acme: AcmeConfig,
+    pub dns: DnsConfig,
+    #[serde(rename = "certificate")]
+    pub certificates: Vec<CertificateConfig>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct AcmeConfig {
+    #[serde(default = "default_directory_url")]
+    pub directory_url: String,
+
+    /// Full path to encrypted credential file for the ACME account key
+    pub account_key_credential: Option<PathBuf>,
+    /// Plain file path for the ACME account key (fallback)
+    pub account_key_path: Option<PathBuf>,
+
+    pub contact: Vec<String>,
+}
+
+fn default_directory_url() -> String {
+    "https://acme-v02.api.letsencrypt.org/directory".to_string()
+}
+
+#[derive(Debug, Deserialize)]
+pub struct DnsConfig {
+    pub defaults: DnsServerConfig,
+    #[serde(default)]
+    pub zones: HashMap<String, DnsZoneOverride>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct DnsServerConfig {
+    pub server: String,
+
+    /// Full path to encrypted credential file for the TSIG key
+    pub tsig_key_credential: Option<PathBuf>,
+    /// Plain file path for the TSIG key (fallback)
+    pub tsig_key_path: Option<PathBuf>,
+
+    pub tsig_key_name: String,
+    #[serde(default = "default_tsig_algorithm")]
+    pub tsig_algorithm: TsigAlgorithm,
+    #[serde(default = "default_dns_port")]
+    pub port: u16,
+    #[serde(default = "default_dns_protocol")]
+    pub protocol: DnsProtocol,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct DnsZoneOverride {
+    pub server: Option<String>,
+    pub tsig_key_credential: Option<PathBuf>,
+    pub tsig_key_path: Option<PathBuf>,
+    pub tsig_key_name: Option<String>,
+    pub tsig_algorithm: Option<TsigAlgorithm>,
+    pub port: Option<u16>,
+    pub protocol: Option<DnsProtocol>,
+}
+
+#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "kebab-case")]
+pub enum TsigAlgorithm {
+    HmacSha256,
+    HmacSha512,
+}
+
+#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum DnsProtocol {
+    Tcp,
+    Udp,
+}
+
+fn default_tsig_algorithm() -> TsigAlgorithm {
+    TsigAlgorithm::HmacSha256
+}
+
+fn default_dns_port() -> u16 {
+    53
+}
+
+fn default_dns_protocol() -> DnsProtocol {
+    DnsProtocol::Tcp
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CertificateConfig {
+    pub name: String,
+    pub domains: Vec<String>,
+
+    #[serde(default = "default_key_type")]
+    pub key_type: KeyType,
+
+    /// Full path to encrypted credential file for the private key.
+    /// Services access the same file via LoadCredentialEncrypted= in their units.
+    pub key_credential: Option<PathBuf>,
+    /// Plain file path for the private key (fallback for services that can't use credentials)
+    pub key_path: Option<PathBuf>,
+
+    pub cert_path: PathBuf,
+
+    #[serde(default = "default_renew_before_days")]
+    pub renew_before_days: u32,
+
+    #[serde(default)]
+    pub rotate_key: bool,
+
+    #[serde(default)]
+    pub dane: Vec<DaneConfig>,
+
+    #[serde(default, rename = "hook")]
+    pub hooks: Vec<HookConfig>,
+}
+
+#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "kebab-case")]
+pub enum KeyType {
+    EcdsaP256,
+    EcdsaP384,
+    Rsa2048,
+    Rsa4096,
+}
+
+fn default_key_type() -> KeyType {
+    KeyType::EcdsaP256
+}
+
+fn default_renew_before_days() -> u32 {
+    30
+}
+
+#[derive(Debug, Deserialize)]
+pub struct DaneConfig {
+    #[serde(default = "default_dane_usage")]
+    pub usage: DaneUsage,
+    #[serde(default = "default_dane_selector")]
+    pub selector: DaneSelector,
+    #[serde(default = "default_dane_matching")]
+    pub matching: DaneMatching,
+
+    /// TLSA record DNS names (e.g., _25._tcp.mx1.example.com)
+    pub names: Vec<String>,
+
+    #[serde(default = "default_dane_ttl")]
+    pub ttl: u32,
+
+    /// Pre-publish new TLSA before key rotation to avoid DANE breakage
+    #[serde(default)]
+    pub pre_publish: bool,
+}
+
+#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum DaneUsage {
+    /// PKIX-TA (0)
+    #[serde(rename = "pkix-ta")]
+    PkixTa,
+    /// PKIX-EE (1)
+    #[serde(rename = "pkix-ee")]
+    PkixEe,
+    /// DANE-TA (2)
+    #[serde(rename = "ta")]
+    Ta,
+    /// DANE-EE (3)
+    #[serde(rename = "ee")]
+    Ee,
+}
+
+#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum DaneSelector {
+    /// Full certificate (0)
+    Full,
+    /// SubjectPublicKeyInfo (1)
+    Spki,
+}
+
+#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum DaneMatching {
+    /// Exact match (0)
+    Full,
+    /// SHA-256 (1)
+    Sha256,
+    /// SHA-512 (2)
+    Sha512,
+}
+
+fn default_dane_usage() -> DaneUsage {
+    DaneUsage::Ee
+}
+
+fn default_dane_selector() -> DaneSelector {
+    DaneSelector::Spki
+}
+
+fn default_dane_matching() -> DaneMatching {
+    DaneMatching::Sha256
+}
+
+fn default_dane_ttl() -> u32 {
+    300
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(tag = "type", rename_all = "kebab-case")]
+pub enum HookConfig {
+    SystemdReload { unit: String },
+    SystemdRestart { unit: String },
+    Command { command: Vec<String> },
+}
+
+impl DnsConfig {
+    /// Resolve DNS server config for a given zone, applying overrides on top of defaults.
+    pub fn resolve_for_zone(&self, zone: &str) -> DnsServerConfig {
+        let Some(ovr) = self.zones.get(zone) else {
+            return self.defaults.clone();
+        };
+
+        DnsServerConfig {
+            server: ovr.server.clone().unwrap_or_else(|| self.defaults.server.clone()),
+            tsig_key_credential: ovr
+                .tsig_key_credential
+                .clone()
+                .or_else(|| self.defaults.tsig_key_credential.clone()),
+            tsig_key_path: ovr
+                .tsig_key_path
+                .clone()
+                .or_else(|| self.defaults.tsig_key_path.clone()),
+            tsig_key_name: ovr
+                .tsig_key_name
+                .clone()
+                .unwrap_or_else(|| self.defaults.tsig_key_name.clone()),
+            tsig_algorithm: ovr
+                .tsig_algorithm
+                .clone()
+                .unwrap_or_else(|| self.defaults.tsig_algorithm.clone()),
+            port: ovr.port.unwrap_or(self.defaults.port),
+            protocol: ovr.protocol.clone().unwrap_or_else(|| self.defaults.protocol.clone()),
+        }
+    }
+}
+
+impl Config {
+    pub fn load(path: &Path) -> Result<Self> {
+        let content = std::fs::read_to_string(path).map_err(|e| {
+            Error::Config(format!("failed to read config file {}: {e}", path.display()))
+        })?;
+        let config: Config = toml::from_str(&content)
+            .map_err(|e| Error::Config(format!("failed to parse config: {e}")))?;
+        config.validate()?;
+        Ok(config)
+    }
+
+    fn validate(&self) -> Result<()> {
+        if self.acme.account_key_credential.is_none() && self.acme.account_key_path.is_none() {
+            return Err(Error::Config(
+                "acme: either account_key_credential or account_key_path must be set".into(),
+            ));
+        }
+
+        if self.acme.contact.is_empty() {
+            return Err(Error::Config("acme: contact must not be empty".into()));
+        }
+
+        if self.dns.defaults.tsig_key_credential.is_none()
+            && self.dns.defaults.tsig_key_path.is_none()
+        {
+            return Err(Error::Config(
+                "dns.defaults: either tsig_key_credential or tsig_key_path must be set".into(),
+            ));
+        }
+
+        for cert in &self.certificates {
+            if cert.name.is_empty() {
+                return Err(Error::Config("certificate: name must not be empty".into()));
+            }
+            if cert.domains.is_empty() {
+                return Err(Error::Config(format!(
+                    "certificate {}: domains must not be empty",
+                    cert.name
+                )));
+            }
+            if cert.key_credential.is_none() && cert.key_path.is_none() {
+                return Err(Error::Config(format!(
+                    "certificate {}: either key_credential or key_path must be set",
+                    cert.name
+                )));
+            }
+
+            for dane in &cert.dane {
+                if dane.names.is_empty() {
+                    return Err(Error::Config(format!(
+                        "certificate {}: dane block has empty names",
+                        cert.name
+                    )));
+                }
+            }
+
+            for hook in &cert.hooks {
+                match hook {
+                    HookConfig::Command { command } if command.is_empty() => {
+                        return Err(Error::Config(format!(
+                            "certificate {}: command hook has empty command",
+                            cert.name
+                        )));
+                    }
+                    _ => {}
+                }
+            }
+        }
+
+        Ok(())
+    }
+
+    /// Find a certificate config by name.
+    #[allow(dead_code)]
+    pub fn find_certificate(&self, name: &str) -> Option<&CertificateConfig> {
+        self.certificates.iter().find(|c| c.name == name)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parse_full_config() {
+        let toml = r#"
+[acme]
+directory_url = "https://acme-staging-v02.api.letsencrypt.org/directory"
+account_key_credential = "/etc/credstore.encrypted/acme-account-key"
+contact = ["mailto:admin@example.com"]
+
+[dns.defaults]
+server = "ns1.example.com"
+tsig_key_credential = "/etc/credstore.encrypted/dns-tsig-key"
+tsig_key_name = "certforge-update."
+tsig_algorithm = "hmac-sha256"
+port = 53
+protocol = "tcp"
+
+[dns.zones."example.org"]
+server = "ns2.example.org"
+tsig_key_credential = "/etc/credstore.encrypted/dns-tsig-org"
+
+[[certificate]]
+name = "mail"
+domains = ["mail.example.com", "mail.example.org"]
+key_type = "ecdsa-p256"
+key_credential = "/etc/credstore.encrypted/mail-tls-key"
+cert_path = "/etc/certforge/certs/mail.pem"
+renew_before_days = 30
+rotate_key = false
+
+  [[certificate.dane]]
+  usage = "ee"
+  selector = "spki"
+  matching = "sha256"
+  names = ["_25._tcp.mx1.example.com", "_25._tcp.mx2.example.com"]
+  ttl = 300
+  pre_publish = true
+
+  [[certificate.hook]]
+  type = "systemd-reload"
+  unit = "postfix.service"
+
+  [[certificate.hook]]
+  type = "command"
+  command = ["/usr/local/bin/deploy-cert.sh", "--cert", "mail"]
+"#;
+
+        let config: Config = toml::from_str(toml).unwrap();
+        assert_eq!(config.certificates.len(), 1);
+        let cert = &config.certificates[0];
+        assert_eq!(cert.name, "mail");
+        assert_eq!(cert.domains, vec!["mail.example.com", "mail.example.org"]);
+        assert_eq!(cert.key_type, KeyType::EcdsaP256);
+        assert_eq!(
+            cert.key_credential.as_deref(),
+            Some(Path::new("/etc/credstore.encrypted/mail-tls-key"))
+        );
+        assert!(!cert.rotate_key);
+        assert_eq!(cert.dane.len(), 1);
+        assert_eq!(cert.dane[0].usage, DaneUsage::Ee);
+        assert_eq!(cert.dane[0].selector, DaneSelector::Spki);
+        assert_eq!(cert.dane[0].names.len(), 2);
+        assert!(cert.dane[0].pre_publish);
+        assert_eq!(cert.hooks.len(), 2);
+
+        // Test zone override resolution
+        let resolved = config.dns.resolve_for_zone("example.org");
+        assert_eq!(resolved.server, "ns2.example.org");
+        assert_eq!(
+            resolved.tsig_key_credential.as_deref(),
+            Some(Path::new("/etc/credstore.encrypted/dns-tsig-org"))
+        );
+        assert_eq!(resolved.tsig_key_name, "certforge-update.");
+
+        // Test default zone resolution
+        let default_resolved = config.dns.resolve_for_zone("example.com");
+        assert_eq!(default_resolved.server, "ns1.example.com");
+    }
+
+    #[test]
+    fn parse_minimal_config() {
+        let toml = r#"
+[acme]
+account_key_path = "/etc/certforge/account.key"
+contact = ["mailto:admin@example.com"]
+
+[dns.defaults]
+server = "ns1.example.com"
+tsig_key_path = "/etc/certforge/tsig.key"
+tsig_key_name = "certforge."
+
+[[certificate]]
+name = "web"
+domains = ["example.com"]
+key_path = "/etc/certforge/keys/web.key"
+cert_path = "/etc/certforge/certs/web.pem"
+"#;
+
+        let config: Config = toml::from_str(toml).unwrap();
+        config.validate().unwrap();
+        assert_eq!(config.certificates[0].key_type, KeyType::EcdsaP256);
+        assert_eq!(config.certificates[0].renew_before_days, 30);
+        assert!(config.certificates[0].dane.is_empty());
+        assert!(config.certificates[0].hooks.is_empty());
+    }
+
+    #[test]
+    fn validation_rejects_missing_key() {
+        let toml = r#"
+[acme]
+account_key_path = "/etc/certforge/account.key"
+contact = ["mailto:admin@example.com"]
+
+[dns.defaults]
+server = "ns1.example.com"
+tsig_key_path = "/etc/certforge/tsig.key"
+tsig_key_name = "certforge."
+
+[[certificate]]
+name = "web"
+domains = ["example.com"]
+cert_path = "/etc/certforge/certs/web.pem"
+"#;
+
+        let config: Config = toml::from_str(toml).unwrap();
+        let err = config.validate().unwrap_err();
+        assert!(err.to_string().contains("key_credential or key_path"));
+    }
+}
diff --git a/src/credentials.rs b/src/credentials.rs
new file mode 100644
index 0000000..577ba05
--- /dev/null
+++ b/src/credentials.rs
@@ -0,0 +1,83 @@
+use std::path::Path;
+use tokio::process::Command;
+
+use crate::error::{Error, Result};
+
+/// Load a secret from either a systemd encrypted credential file or a plain file.
+///
+/// If `credential` is set, decrypts it at runtime via `systemd-creds decrypt`.
+/// If only `path` is set, reads the file directly.
+pub async fn load_secret(credential: Option<&Path>, path: Option<&Path>) -> Result<Vec<u8>> {
+    if let Some(cred_path) = credential {
+        decrypt_credential(cred_path).await
+    } else if let Some(file_path) = path {
+        std::fs::read(file_path).map_err(|_| Error::CredentialNotFound {
+            name: file_path.display().to_string(),
+            path: file_path.to_path_buf(),
+        })
+    } else {
+        Err(Error::Config(
+            "neither credential nor path configured".into(),
+        ))
+    }
+}
+
+/// Decrypt an encrypted credential file using `systemd-creds decrypt`.
+async fn decrypt_credential(path: &Path) -> Result<Vec<u8>> {
+    let output = Command::new("systemd-creds")
+        .arg("decrypt")
+        .arg(path)
+        .arg("-")
+        .output()
+        .await
+        .map_err(|e| Error::SystemdCreds(format!("failed to run systemd-creds: {e}")))?;
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        return Err(Error::SystemdCreds(format!(
+            "systemd-creds decrypt {} failed: {stderr}",
+            path.display()
+        )));
+    }
+
+    Ok(output.stdout)
+}
+
+/// Encrypt data and write it to an encrypted credential file.
+///
+/// Uses `systemd-creds encrypt --name=<name> - <path>`.
+pub async fn encrypt_credential(name: &str, data: &[u8], path: &Path) -> Result<()> {
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent)?;
+    }
+
+    let mut child = Command::new("systemd-creds")
+        .arg("encrypt")
+        .arg(format!("--name={name}"))
+        .arg("-")
+        .arg(path)
+        .stdin(std::process::Stdio::piped())
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        .spawn()
+        .map_err(|e| Error::SystemdCreds(format!("failed to run systemd-creds: {e}")))?;
+
+    use tokio::io::AsyncWriteExt;
+    if let Some(mut stdin) = child.stdin.take() {
+        stdin.write_all(data).await?;
+        // Drop stdin to close it so systemd-creds can proceed
+    }
+
+    let output = child.wait_with_output().await?;
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        return Err(Error::SystemdCreds(format!(
+            "systemd-creds encrypt to {} failed: {stderr}",
+            path.display()
+        )));
+    }
+
+    Ok(())
+}
+
diff --git a/src/dane.rs b/src/dane.rs
new file mode 100644
index 0000000..3679033
--- /dev/null
+++ b/src/dane.rs
@@ -0,0 +1,133 @@
+use hickory_proto::rr::Name;
+
+use crate::certs::CertInfo;
+use crate::config::DaneConfig;
+use crate::dns::tlsa::TlsaRecord;
+use crate::dns::update::DnsUpdater;
+use crate::error::{Error, Result};
+use crate::keys::CertKeyPair;
+
+/// Compute all TLSA records needed for a certificate's DANE config.
+pub fn compute_tlsa_records(
+    cert: &CertInfo,
+    dane: &DaneConfig,
+) -> Result<Vec<TlsaRecord>> {
+    let mut records = Vec::new();
+
+    let record = TlsaRecord::from_certificate(
+        &cert.leaf_der,
+        &cert.spki_der,
+        &dane.usage,
+        &dane.selector,
+        &dane.matching,
+    )?;
+
+    // Same TLSA rdata for all names in this block
+    for _ in &dane.names {
+        records.push(record.clone());
+    }
+
+    Ok(records)
+}
+
+/// Compute TLSA records from a key pair (for pre-publication before cert issuance).
+/// Only valid with SPKI selector.
+pub fn compute_tlsa_from_key(
+    key: &CertKeyPair,
+    dane: &DaneConfig,
+) -> Result<Vec<TlsaRecord>> {
+    use crate::config::DaneSelector;
+
+    if dane.selector != DaneSelector::Spki {
+        return Err(Error::Certificate(
+            "DANE pre-publication requires SPKI selector".into(),
+        ));
+    }
+
+    let spki = key.spki_der()?;
+    let record = TlsaRecord::from_spki(&spki, &dane.usage, &dane.matching)?;
+
+    Ok(vec![record; dane.names.len()])
+}
+
+/// Publish TLSA records for a certificate via DNS updates.
+pub async fn publish_tlsa(
+    updater: &mut DnsUpdater,
+    dane: &DaneConfig,
+    records: &[TlsaRecord],
+) -> Result<()> {
+    // All names in a DANE block share the same TLSA rdata
+    let record = &records[0];
+
+    for name_str in &dane.names {
+        let name = Name::from_ascii(name_str)
+            .map_err(|e| Error::DnsUpdate(format!("invalid TLSA name {name_str}: {e}")))?;
+
+        let zone = find_zone(&name)?;
+
+        updater
+            .replace_tlsa_records(&zone, &name, &[record.clone()], dane.ttl)
+            .await?;
+    }
+
+    Ok(())
+}
+
+/// Add TLSA records alongside existing ones (for pre-publication).
+pub async fn add_tlsa(
+    updater: &mut DnsUpdater,
+    dane: &DaneConfig,
+    record: &TlsaRecord,
+) -> Result<()> {
+    for name_str in &dane.names {
+        let name = Name::from_ascii(name_str)
+            .map_err(|e| Error::DnsUpdate(format!("invalid TLSA name {name_str}: {e}")))?;
+
+        let zone = find_zone(&name)?;
+
+        updater
+            .add_tlsa_record(&zone, &name, record, dane.ttl)
+            .await?;
+    }
+
+    Ok(())
+}
+
+/// Extract the zone (parent domain) from a TLSA name like _25._tcp.mx1.example.com.
+///
+/// Strategy: strip the _port._proto prefix, then take the last two labels as zone.
+/// This is a heuristic; a proper implementation would query for SOA.
+fn find_zone(name: &Name) -> Result<Name> {
+    // TLSA names are like _25._tcp.host.example.com.
+    // We need the zone, which is typically example.com.
+    // Strip underscore-prefixed labels, then take parent as zone.
+    let labels: Vec<&[u8]> = name.iter().collect();
+
+    // Find the first non-underscore label
+    let mut start = 0;
+    for (i, label) in labels.iter().enumerate() {
+        if !label.starts_with(b"_") {
+            start = i;
+            break;
+        }
+    }
+
+    // The zone is everything after the hostname
+    // e.g., for _25._tcp.mx1.example.com, start=2 (mx1), zone = example.com
+    if labels.len() > start + 1 {
+        // Take from start+1 onwards as zone
+        let zone_labels = &labels[start + 1..];
+        let zone_str = zone_labels
+            .iter()
+            .map(|l| String::from_utf8_lossy(l).to_string())
+            .collect::<Vec<_>>()
+            .join(".");
+
+        Name::from_ascii(&zone_str)
+            .map_err(|e| Error::DnsUpdate(format!("invalid zone name: {e}")))
+    } else {
+        Err(Error::DnsUpdate(format!(
+            "cannot determine zone from TLSA name: {name}"
+        )))
+    }
+}
diff --git a/src/dns/mod.rs b/src/dns/mod.rs
new file mode 100644
index 0000000..ac965bc
--- /dev/null
+++ b/src/dns/mod.rs
@@ -0,0 +1,3 @@
+pub mod tlsa;
+pub mod tsig;
+pub mod update;
diff --git a/src/dns/tlsa.rs b/src/dns/tlsa.rs
new file mode 100644
index 0000000..298cf03
--- /dev/null
+++ b/src/dns/tlsa.rs
@@ -0,0 +1,210 @@
+use sha2::{Digest, Sha256, Sha512};
+
+use crate::config::{DaneMatching, DaneSelector, DaneUsage};
+use crate::error::Result;
+
+/// Represents a TLSA record's rdata fields.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct TlsaRecord {
+    pub usage: u8,
+    pub selector: u8,
+    pub matching_type: u8,
+    pub association_data: Vec<u8>,
+}
+
+impl TlsaRecord {
+    /// Compute a TLSA record from a DER-encoded certificate.
+    pub fn from_certificate(
+        cert_der: &[u8],
+        spki_der: &[u8],
+        usage: &DaneUsage,
+        selector: &DaneSelector,
+        matching: &DaneMatching,
+    ) -> Result<Self> {
+        let data = match selector {
+            DaneSelector::Full => cert_der.to_vec(),
+            DaneSelector::Spki => spki_der.to_vec(),
+        };
+
+        let association_data = match matching {
+            DaneMatching::Full => data,
+            DaneMatching::Sha256 => {
+                let mut hasher = Sha256::new();
+                hasher.update(&data);
+                hasher.finalize().to_vec()
+            }
+            DaneMatching::Sha512 => {
+                let mut hasher = Sha512::new();
+                hasher.update(&data);
+                hasher.finalize().to_vec()
+            }
+        };
+
+        Ok(Self {
+            usage: usage.to_u8(),
+            selector: selector.to_u8(),
+            matching_type: matching.to_u8(),
+            association_data,
+        })
+    }
+
+    /// Compute a TLSA record from a public key's SPKI DER.
+    /// Only valid with Selector::Spki.
+    pub fn from_spki(
+        spki_der: &[u8],
+        usage: &DaneUsage,
+        matching: &DaneMatching,
+    ) -> Result<Self> {
+        let association_data = match matching {
+            DaneMatching::Full => spki_der.to_vec(),
+            DaneMatching::Sha256 => {
+                let mut hasher = Sha256::new();
+                hasher.update(spki_der);
+                hasher.finalize().to_vec()
+            }
+            DaneMatching::Sha512 => {
+                let mut hasher = Sha512::new();
+                hasher.update(spki_der);
+                hasher.finalize().to_vec()
+            }
+        };
+
+        Ok(Self {
+            usage: usage.to_u8(),
+            selector: DaneSelector::Spki.to_u8(),
+            matching_type: matching.to_u8(),
+            association_data,
+        })
+    }
+
+    /// Format the association data as a hex string (for display / DNS zone format).
+    pub fn association_data_hex(&self) -> String {
+        hex::encode(&self.association_data)
+    }
+
+    /// Format as a DNS record data string: "usage selector matching hex"
+    pub fn to_rdata_string(&self) -> String {
+        format!(
+            "{} {} {} {}",
+            self.usage,
+            self.selector,
+            self.matching_type,
+            self.association_data_hex()
+        )
+    }
+}
+
+impl DaneUsage {
+    pub fn to_u8(&self) -> u8 {
+        match self {
+            DaneUsage::PkixTa => 0,
+            DaneUsage::PkixEe => 1,
+            DaneUsage::Ta => 2,
+            DaneUsage::Ee => 3,
+        }
+    }
+}
+
+impl DaneSelector {
+    pub fn to_u8(&self) -> u8 {
+        match self {
+            DaneSelector::Full => 0,
+            DaneSelector::Spki => 1,
+        }
+    }
+}
+
+impl DaneMatching {
+    pub fn to_u8(&self) -> u8 {
+        match self {
+            DaneMatching::Full => 0,
+            DaneMatching::Sha256 => 1,
+            DaneMatching::Sha512 => 2,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn tlsa_from_spki_sha256() {
+        let fake_spki = b"this is a fake spki for testing";
+        let record = TlsaRecord::from_spki(
+            fake_spki,
+            &DaneUsage::Ee,
+            &DaneMatching::Sha256,
+        )
+        .unwrap();
+
+        assert_eq!(record.usage, 3);
+        assert_eq!(record.selector, 1);
+        assert_eq!(record.matching_type, 1);
+        assert_eq!(record.association_data.len(), 32); // SHA-256 output
+    }
+
+    #[test]
+    fn tlsa_from_spki_sha512() {
+        let fake_spki = b"this is a fake spki for testing";
+        let record = TlsaRecord::from_spki(
+            fake_spki,
+            &DaneUsage::Ee,
+            &DaneMatching::Sha512,
+        )
+        .unwrap();
+
+        assert_eq!(record.association_data.len(), 64); // SHA-512 output
+    }
+
+    #[test]
+    fn tlsa_rdata_string() {
+        let record = TlsaRecord {
+            usage: 3,
+            selector: 1,
+            matching_type: 1,
+            association_data: vec![0xab, 0xcd, 0xef],
+        };
+        assert_eq!(record.to_rdata_string(), "3 1 1 abcdef");
+    }
+
+    #[test]
+    fn tlsa_from_cert_with_spki_selector() {
+        use crate::keys::CertKeyPair;
+        use crate::config::KeyType;
+
+        let kp = CertKeyPair::generate(&KeyType::EcdsaP256).unwrap();
+        let spki = kp.spki_der().unwrap();
+
+        // Generate a self-signed cert to get DER
+        let pkcs8_der = rustls_pki_types::PrivatePkcs8KeyDer::from(kp.pkcs8_der.as_slice());
+        let rcgen_kp = rcgen::KeyPair::from_pkcs8_der_and_sign_algo(
+            &pkcs8_der,
+            &rcgen::PKCS_ECDSA_P256_SHA256,
+        )
+        .unwrap();
+        let params =
+            rcgen::CertificateParams::new(vec!["test.example.com".to_string()]).unwrap();
+        let cert = params.self_signed(&rcgen_kp).unwrap();
+        let cert_der = cert.der().to_vec();
+
+        let record = TlsaRecord::from_certificate(
+            &cert_der,
+            &spki,
+            &DaneUsage::Ee,
+            &DaneSelector::Spki,
+            &DaneMatching::Sha256,
+        )
+        .unwrap();
+
+        // SPKI-based TLSA from cert should match SPKI-based TLSA from key
+        let record_from_key = TlsaRecord::from_spki(
+            &spki,
+            &DaneUsage::Ee,
+            &DaneMatching::Sha256,
+        )
+        .unwrap();
+
+        assert_eq!(record.association_data, record_from_key.association_data);
+    }
+}
diff --git a/src/dns/tsig.rs b/src/dns/tsig.rs
new file mode 100644
index 0000000..67b85cf
--- /dev/null
+++ b/src/dns/tsig.rs
@@ -0,0 +1,58 @@
+use std::sync::Arc;
+
+use base64::Engine;
+use hickory_proto::dnssec::tsig::TSigner;
+use hickory_proto::dnssec::rdata::tsig::TsigAlgorithm;
+use hickory_proto::op::MessageFinalizer;
+use hickory_proto::rr::Name;
+
+use crate::config;
+use crate::credentials;
+use crate::error::{Error, Result};
+
+/// Load a TSIG signer from the DNS server config.
+pub async fn load_tsig_signer(
+    dns_config: &config::DnsServerConfig,
+) -> Result<Arc<dyn MessageFinalizer>> {
+    let raw_key = credentials::load_secret(
+        dns_config.tsig_key_credential.as_deref(),
+        dns_config.tsig_key_path.as_deref(),
+    )
+    .await?;
+
+    // TSIG keys are typically stored as base64 (matching BIND's key format).
+    // Try to decode as base64; if that fails, use the raw bytes as-is.
+    let key_data = decode_tsig_key(&raw_key)?;
+
+    let algorithm = match dns_config.tsig_algorithm {
+        config::TsigAlgorithm::HmacSha256 => TsigAlgorithm::HmacSha256,
+        config::TsigAlgorithm::HmacSha512 => TsigAlgorithm::HmacSha512,
+    };
+
+    let signer_name = Name::from_ascii(&dns_config.tsig_key_name)
+        .map_err(|e| Error::DnsUpdate(format!("invalid TSIG key name: {e}")))?;
+
+    // Default TSIG fudge is 300 seconds (5 minutes)
+    let signer = TSigner::new(key_data, algorithm, signer_name, 300)
+        .map_err(|e| Error::DnsUpdate(format!("failed to create TSIG signer: {e}")))?;
+
+    Ok(Arc::new(signer))
+}
+
+/// Decode a TSIG key from base64 or return raw bytes.
+///
+/// Strips whitespace/newlines before decoding. If the data looks like
+/// valid base64, decode it; otherwise use as-is (already binary).
+fn decode_tsig_key(raw: &[u8]) -> Result<Vec<u8>> {
+    let trimmed: Vec<u8> = raw.iter().copied().filter(|b| !b.is_ascii_whitespace()).collect();
+
+    // Try standard base64 first, then URL-safe
+    if let Ok(decoded) = base64::engine::general_purpose::STANDARD.decode(&trimmed) {
+        if !decoded.is_empty() {
+            return Ok(decoded);
+        }
+    }
+
+    // If it doesn't decode as base64, assume it's already raw binary
+    Ok(raw.to_vec())
+}
diff --git a/src/dns/update.rs b/src/dns/update.rs
new file mode 100644
index 0000000..0c49d06
--- /dev/null
+++ b/src/dns/update.rs
@@ -0,0 +1,285 @@
+use std::net::{SocketAddr, ToSocketAddrs};
+use std::sync::Arc;
+use std::time::Duration;
+
+use hickory_client::client::{Client, ClientHandle};
+use hickory_proto::op::{MessageFinalizer, ResponseCode};
+use hickory_proto::rr::rdata::{TLSA, TXT};
+use hickory_proto::rr::rdata::tlsa::{CertUsage, Matching, Selector};
+use hickory_proto::rr::{Name, RData, Record, RecordType};
+use hickory_proto::tcp::TcpClientStream;
+use hickory_proto::xfer::DnsResponse;
+use tokio::task::JoinHandle;
+
+use hickory_client::{ClientError, ClientErrorKind};
+use hickory_proto::ProtoErrorKind;
+
+use crate::config::{DnsProtocol, DnsServerConfig};
+use crate::dns::tlsa::TlsaRecord;
+use crate::error::{Error, Result};
+
+/// Produce a clear error message from a hickory ClientError.
+fn dns_err(operation: &str, e: ClientError) -> Error {
+    let detail = match e.kind() {
+        ClientErrorKind::Proto(proto) => match proto.kind() {
+            ProtoErrorKind::Busy => "server busy".into(),
+            ProtoErrorKind::Timeout => "request timed out".into(),
+            ProtoErrorKind::RequestRefused => {
+                "update REFUSED by server (check TSIG key and update policy)".into()
+            }
+            ProtoErrorKind::NoRecordsFound { response_code, .. } => {
+                format!("server responded with {response_code}")
+            }
+            _ => format!("{proto}"),
+        },
+        _ => format!("{e}"),
+    };
+    Error::DnsUpdate(format!("{operation}: {detail}"))
+}
+
+fn dns_proto_err(operation: &str, e: hickory_proto::ProtoError) -> Error {
+    dns_err(operation, ClientError::from(e))
+}
+
+/// Check the DNS response code from an update operation.
+/// Hickory doesn't check response codes for updates, so we must do it ourselves.
+fn check_update_response(operation: &str, response: &DnsResponse) -> Result<()> {
+    let code = response.response_code();
+    match code {
+        ResponseCode::NoError => Ok(()),
+        ResponseCode::Refused => Err(Error::DnsUpdate(format!(
+            "{operation}: update REFUSED by server (check TSIG key name, secret, and update-policy/allow-update in zone config)"
+        ))),
+        ResponseCode::NotAuth => Err(Error::DnsUpdate(format!(
+            "{operation}: server is not authoritative for this zone (NOTAUTH)"
+        ))),
+        ResponseCode::NXRRSet => Err(Error::DnsUpdate(format!(
+            "{operation}: prerequisite failed - RRset does not exist (NXRRSET)"
+        ))),
+        ResponseCode::YXRRSet => Err(Error::DnsUpdate(format!(
+            "{operation}: prerequisite failed - RRset already exists (YXRRSET)"
+        ))),
+        ResponseCode::NotZone => Err(Error::DnsUpdate(format!(
+            "{operation}: update name is not within the zone (NOTZONE)"
+        ))),
+        _ => Err(Error::DnsUpdate(format!(
+            "{operation}: server responded with {code}"
+        ))),
+    }
+}
+
+/// DNS update client for RFC 2136 operations.
+pub struct DnsUpdater {
+    client: Client,
+    _bg: JoinHandle<()>,
+}
+
+impl DnsUpdater {
+    /// Connect to a DNS server with TSIG authentication.
+    pub async fn connect(
+        config: &DnsServerConfig,
+        signer: Arc<dyn MessageFinalizer>,
+    ) -> Result<Self> {
+        let addr_str = format!("{}:{}", config.server, config.port);
+        let addr: SocketAddr = addr_str
+            .to_socket_addrs()
+            .map_err(|e| Error::DnsUpdate(format!("failed to resolve DNS server {addr_str}: {e}")))?
+            .next()
+            .ok_or_else(|| Error::DnsUpdate(format!("DNS server {addr_str} resolved to no addresses")))?;
+
+        tracing::debug!(%addr, server = %config.server, "resolved DNS server address");
+        let timeout = Duration::from_secs(10);
+
+        match config.protocol {
+            DnsProtocol::Tcp => Self::connect_tcp(addr, signer, timeout).await,
+            DnsProtocol::Udp => {
+                tracing::warn!("UDP requested but using TCP for DNS updates (RFC 2136 recommendation)");
+                Self::connect_tcp(addr, signer, timeout).await
+            }
+        }
+    }
+
+    async fn connect_tcp(
+        addr: SocketAddr,
+        signer: Arc<dyn MessageFinalizer>,
+        timeout: Duration,
+    ) -> Result<Self> {
+        let (stream, sender) = TcpClientStream::new::<hickory_proto::runtime::TokioRuntimeProvider>(
+            addr, None, Some(timeout), Default::default(),
+        );
+
+        let (client, bg) = Client::with_timeout(
+            stream,
+            sender,
+            timeout,
+            Some(signer),
+        )
+        .await
+        .map_err(|e| dns_proto_err("TCP connection failed", e))?;
+
+        let bg_handle = tokio::spawn(async move {
+            let _ = bg.await;
+        });
+
+        Ok(Self {
+            client,
+            _bg: bg_handle,
+        })
+    }
+
+    /// Add a TXT record (for ACME DNS-01 challenge).
+    ///
+    /// Uses `append` (not `create`) so it succeeds even if a stale record
+    /// from a previous failed run is still present.
+    pub async fn add_txt_record(
+        &mut self,
+        zone: &Name,
+        name: &Name,
+        value: &str,
+        ttl: u32,
+    ) -> Result<()> {
+        let txt = TXT::new(vec![value.to_string()]);
+        let record = Record::from_rdata(name.clone(), ttl, RData::TXT(txt));
+
+        let response = self
+            .client
+            .append(record, zone.clone(), false)
+            .await
+            .map_err(|e| dns_err("failed to add TXT record", e))?;
+        check_update_response("failed to add TXT record", &response)?;
+
+        tracing::debug!(%name, %value, "added TXT record");
+        Ok(())
+    }
+
+    /// Delete a specific TXT record (cleanup after ACME challenge).
+    pub async fn delete_txt_record(
+        &mut self,
+        zone: &Name,
+        name: &Name,
+        value: &str,
+    ) -> Result<()> {
+        let txt = TXT::new(vec![value.to_string()]);
+        let record = Record::from_rdata(name.clone(), 0, RData::TXT(txt));
+
+        let response = self
+            .client
+            .delete_by_rdata(record, zone.clone())
+            .await
+            .map_err(|e| dns_err("failed to delete TXT record", e))?;
+        check_update_response("failed to delete TXT record", &response)?;
+
+        tracing::debug!(%name, "deleted TXT record");
+        Ok(())
+    }
+
+    /// Add a TLSA record (for DANE pre-publication or initial publish).
+    pub async fn add_tlsa_record(
+        &mut self,
+        zone: &Name,
+        name: &Name,
+        tlsa: &TlsaRecord,
+        ttl: u32,
+    ) -> Result<()> {
+        let rdata = tlsa_to_rdata(tlsa);
+        let record = Record::from_rdata(name.clone(), ttl, rdata);
+
+        let response = self
+            .client
+            .create(record, zone.clone())
+            .await
+            .map_err(|e| dns_err("failed to add TLSA record", e))?;
+        check_update_response("failed to add TLSA record", &response)?;
+
+        tracing::debug!(%name, rdata = %tlsa.to_rdata_string(), "added TLSA record");
+        Ok(())
+    }
+
+    /// Replace all TLSA records at a name (delete all, then add new ones).
+    pub async fn replace_tlsa_records(
+        &mut self,
+        zone: &Name,
+        name: &Name,
+        records: &[TlsaRecord],
+        ttl: u32,
+    ) -> Result<()> {
+        // First delete all existing TLSA records at this name
+        let response = self
+            .client
+            .delete_rrset(
+                Record::update0(name.clone(), 0, RecordType::TLSA),
+                zone.clone(),
+            )
+            .await
+            .map_err(|e| dns_err("failed to delete TLSA RRset", e))?;
+        check_update_response("failed to delete TLSA RRset", &response)?;
+
+        // Then add the new ones
+        for tlsa in records {
+            let rdata = tlsa_to_rdata(tlsa);
+            let record = Record::from_rdata(name.clone(), ttl, rdata);
+
+            let response = self
+                .client
+                .create(record, zone.clone())
+                .await
+                .map_err(|e| dns_err("failed to add TLSA record", e))?;
+            check_update_response("failed to add TLSA record", &response)?;
+        }
+
+        tracing::debug!(%name, count = records.len(), "replaced TLSA records");
+        Ok(())
+    }
+
+    /// Delete a specific TLSA record.
+    #[allow(dead_code)]
+    pub async fn delete_tlsa_record(
+        &mut self,
+        zone: &Name,
+        name: &Name,
+        tlsa: &TlsaRecord,
+    ) -> Result<()> {
+        let rdata = tlsa_to_rdata(tlsa);
+        let record = Record::from_rdata(name.clone(), 0, rdata);
+
+        let response = self
+            .client
+            .delete_by_rdata(record, zone.clone())
+            .await
+            .map_err(|e| dns_err("failed to delete TLSA record", e))?;
+        check_update_response("failed to delete TLSA record", &response)?;
+
+        tracing::debug!(%name, rdata = %tlsa.to_rdata_string(), "deleted TLSA record");
+        Ok(())
+    }
+
+}
+
+/// Convert our TlsaRecord to hickory RData.
+fn tlsa_to_rdata(tlsa: &TlsaRecord) -> RData {
+    let cert_usage = match tlsa.usage {
+        0 => CertUsage::PkixTa,
+        1 => CertUsage::PkixEe,
+        2 => CertUsage::DaneTa,
+        3 => CertUsage::DaneEe,
+        n => CertUsage::Unassigned(n),
+    };
+    let selector = match tlsa.selector {
+        0 => Selector::Full,
+        1 => Selector::Spki,
+        n => Selector::Unassigned(n),
+    };
+    let matching = match tlsa.matching_type {
+        0 => Matching::Raw,
+        1 => Matching::Sha256,
+        2 => Matching::Sha512,
+        n => Matching::Unassigned(n),
+    };
+
+    RData::TLSA(TLSA::new(
+        cert_usage,
+        selector,
+        matching,
+        tlsa.association_data.clone(),
+    ))
+}
diff --git a/src/error.rs b/src/error.rs
new file mode 100644
index 0000000..7d70132
--- /dev/null
+++ b/src/error.rs
@@ -0,0 +1,39 @@
+use std::path::PathBuf;
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("ACME error: {0}")]
+    Acme(#[from] instant_acme::Error),
+
+    #[error("DNS update failed: {0}")]
+    DnsUpdate(String),
+
+    #[error("certificate error: {0}")]
+    Certificate(String),
+
+    #[error("key error: {0}")]
+    Key(String),
+
+    #[error("config error: {0}")]
+    Config(String),
+
+    #[error("credential {name} not found at {path}")]
+    CredentialNotFound { name: String, path: PathBuf },
+
+    #[error("systemd-creds failed: {0}")]
+    SystemdCreds(String),
+
+    #[error("hook {hook} failed: {message}")]
+    Hook { hook: String, message: String },
+
+    #[error("state error: {0}")]
+    State(String),
+
+    #[error(transparent)]
+    Io(#[from] std::io::Error),
+
+    #[error(transparent)]
+    Other(#[from] anyhow::Error),
+}
+
+pub type Result<T> = std::result::Result<T, Error>;
diff --git a/src/hooks.rs b/src/hooks.rs
new file mode 100644
index 0000000..14c7945
--- /dev/null
+++ b/src/hooks.rs
@@ -0,0 +1,117 @@
+use crate::config::HookConfig;
+use crate::error::{Error, Result};
+
+/// Execute post-renewal hooks.
+///
+/// Hooks run sequentially. A hook failure is logged but does not prevent
+/// subsequent hooks from running.
+pub async fn run_hooks(hooks: &[HookConfig], dry_run: bool) -> Vec<Result<()>> {
+    let mut results = Vec::new();
+
+    for hook in hooks {
+        let result = run_hook(hook, dry_run).await;
+        if let Err(ref e) = result {
+            tracing::error!(%e, "hook failed");
+        }
+        results.push(result);
+    }
+
+    results
+}
+
+async fn run_hook(hook: &HookConfig, dry_run: bool) -> Result<()> {
+    match hook {
+        HookConfig::SystemdReload { unit } => {
+            tracing::info!(%unit, "reloading systemd unit");
+            if dry_run {
+                tracing::info!(%unit, "dry-run: would reload unit");
+                return Ok(());
+            }
+            systemd_unit_action(unit, "reload").await
+        }
+        HookConfig::SystemdRestart { unit } => {
+            tracing::info!(%unit, "restarting systemd unit");
+            if dry_run {
+                tracing::info!(%unit, "dry-run: would restart unit");
+                return Ok(());
+            }
+            systemd_unit_action(unit, "restart").await
+        }
+        HookConfig::Command { command } => {
+            let cmd_str = command.join(" ");
+            tracing::info!(command = %cmd_str, "running command hook");
+            if dry_run {
+                tracing::info!(command = %cmd_str, "dry-run: would run command");
+                return Ok(());
+            }
+            run_command(command).await
+        }
+    }
+}
+
+/// Reload or restart a systemd unit via D-Bus.
+async fn systemd_unit_action(unit: &str, action: &str) -> Result<()> {
+    let connection = zbus::Connection::system()
+        .await
+        .map_err(|e| Error::Hook {
+            hook: format!("systemd-{action}({unit})"),
+            message: format!("failed to connect to system bus: {e}"),
+        })?;
+
+    let proxy: zbus::Proxy<'_> = zbus::proxy::Builder::new(&connection)
+        .interface("org.freedesktop.systemd1.Manager")
+        .expect("valid interface")
+        .path("/org/freedesktop/systemd1")
+        .expect("valid path")
+        .destination("org.freedesktop.systemd1")
+        .expect("valid destination")
+        .build()
+        .await
+        .map_err(|e| Error::Hook {
+            hook: format!("systemd-{action}({unit})"),
+            message: format!("failed to create proxy: {e}"),
+        })?;
+
+    let method = match action {
+        "reload" => "ReloadUnit",
+        "restart" => "RestartUnit",
+        _ => unreachable!(),
+    };
+
+    let _: zbus::zvariant::OwnedObjectPath = proxy
+        .call(method, &(unit, "replace"))
+        .await
+        .map_err(|e| Error::Hook {
+            hook: format!("systemd-{action}({unit})"),
+            message: format!("{method} failed: {e}"),
+        })?;
+
+    tracing::info!(%unit, %action, "systemd unit action completed");
+    Ok(())
+}
+
+async fn run_command(command: &[String]) -> Result<()> {
+    let (program, args) = command.split_first().ok_or_else(|| Error::Hook {
+        hook: "command".into(),
+        message: "empty command".into(),
+    })?;
+
+    let output = tokio::process::Command::new(program)
+        .args(args)
+        .output()
+        .await
+        .map_err(|e| Error::Hook {
+            hook: format!("command({})", command.join(" ")),
+            message: format!("failed to execute: {e}"),
+        })?;
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        return Err(Error::Hook {
+            hook: format!("command({})", command.join(" ")),
+            message: format!("exited with {}: {stderr}", output.status),
+        });
+    }
+
+    Ok(())
+}
diff --git a/src/keys.rs b/src/keys.rs
new file mode 100644
index 0000000..dcbfd25
--- /dev/null
+++ b/src/keys.rs
@@ -0,0 +1,222 @@
+use ring::rand::SystemRandom;
+use ring::signature::{self, EcdsaKeyPair, KeyPair as _};
+
+use crate::config::KeyType;
+use crate::credentials;
+use crate::error::{Error, Result};
+use std::path::Path;
+
+/// A generated or loaded key pair with its type metadata.
+pub struct CertKeyPair {
+    pub key_type: KeyType,
+    /// PKCS#8 v1 DER-encoded private key
+    pub pkcs8_der: Vec<u8>,
+}
+
+impl CertKeyPair {
+    /// Generate a new key pair of the specified type.
+    pub fn generate(key_type: &KeyType) -> Result<Self> {
+        let rng = SystemRandom::new();
+
+        let pkcs8_der = match key_type {
+            KeyType::EcdsaP256 => {
+                EcdsaKeyPair::generate_pkcs8(&signature::ECDSA_P256_SHA256_ASN1_SIGNING, &rng)
+                    .map_err(|e| Error::Key(format!("failed to generate ECDSA P-256 key: {e}")))?
+                    .as_ref()
+                    .to_vec()
+            }
+            KeyType::EcdsaP384 => {
+                EcdsaKeyPair::generate_pkcs8(&signature::ECDSA_P384_SHA384_ASN1_SIGNING, &rng)
+                    .map_err(|e| Error::Key(format!("failed to generate ECDSA P-384 key: {e}")))?
+                    .as_ref()
+                    .to_vec()
+            }
+            KeyType::Rsa2048 | KeyType::Rsa4096 => {
+                return Err(Error::Key(
+                    "RSA key generation not yet supported; use ecdsa-p256 or ecdsa-p384".into(),
+                ));
+            }
+        };
+
+        Ok(Self {
+            key_type: key_type.clone(),
+            pkcs8_der,
+        })
+    }
+
+    /// Load a key pair from a credential or file path.
+    pub async fn load(
+        credential: Option<&Path>,
+        path: Option<&Path>,
+        key_type: &KeyType,
+    ) -> Result<Self> {
+        let pem_or_der = credentials::load_secret(credential, path).await?;
+        Self::from_pem_or_der(&pem_or_der, key_type)
+    }
+
+    /// Parse a key from PEM or raw DER bytes.
+    pub fn from_pem_or_der(data: &[u8], key_type: &KeyType) -> Result<Self> {
+        // Try PEM first
+        let der = if let Ok(pem) = pem::parse(data) {
+            pem.contents().to_vec()
+        } else {
+            data.to_vec()
+        };
+
+        // Validate the key can be parsed
+        match key_type {
+            KeyType::EcdsaP256 => {
+                EcdsaKeyPair::from_pkcs8(
+                    &signature::ECDSA_P256_SHA256_ASN1_SIGNING,
+                    &der,
+                    &SystemRandom::new(),
+                )
+                .map_err(|e| Error::Key(format!("invalid ECDSA P-256 key: {e}")))?;
+            }
+            KeyType::EcdsaP384 => {
+                EcdsaKeyPair::from_pkcs8(
+                    &signature::ECDSA_P384_SHA384_ASN1_SIGNING,
+                    &der,
+                    &SystemRandom::new(),
+                )
+                .map_err(|e| Error::Key(format!("invalid ECDSA P-384 key: {e}")))?;
+            }
+            KeyType::Rsa2048 | KeyType::Rsa4096 => {
+                return Err(Error::Key("RSA keys not yet supported".into()));
+            }
+        }
+
+        Ok(Self {
+            key_type: key_type.clone(),
+            pkcs8_der: der,
+        })
+    }
+
+    /// Encode the private key as PEM.
+    pub fn to_pem(&self) -> String {
+        pem::encode(&pem::Pem::new("PRIVATE KEY", self.pkcs8_der.clone()))
+    }
+
+    /// Extract the SubjectPublicKeyInfo (SPKI) in DER format.
+    pub fn spki_der(&self) -> Result<Vec<u8>> {
+        match self.key_type {
+            KeyType::EcdsaP256 => {
+                let kp = EcdsaKeyPair::from_pkcs8(
+                    &signature::ECDSA_P256_SHA256_ASN1_SIGNING,
+                    &self.pkcs8_der,
+                    &SystemRandom::new(),
+                )
+                .map_err(|e| Error::Key(format!("failed to parse key for SPKI: {e}")))?;
+                // ring's public_key() returns the raw public key bytes.
+                // We need to wrap it in SPKI ASN.1 structure.
+                Ok(wrap_ec_spki(
+                    kp.public_key().as_ref(),
+                    EC_P256_OID,
+                ))
+            }
+            KeyType::EcdsaP384 => {
+                let kp = EcdsaKeyPair::from_pkcs8(
+                    &signature::ECDSA_P384_SHA384_ASN1_SIGNING,
+                    &self.pkcs8_der,
+                    &SystemRandom::new(),
+                )
+                .map_err(|e| Error::Key(format!("failed to parse key for SPKI: {e}")))?;
+                Ok(wrap_ec_spki(
+                    kp.public_key().as_ref(),
+                    EC_P384_OID,
+                ))
+            }
+            KeyType::Rsa2048 | KeyType::Rsa4096 => {
+                Err(Error::Key("RSA SPKI extraction not yet supported".into()))
+            }
+        }
+    }
+}
+
+// OID for id-ecPublicKey (1.2.840.10045.2.1)
+const EC_PUBLIC_KEY_OID: &[u8] = &[0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01];
+
+// OID for secp256r1 (1.2.840.10045.3.1.7)
+const EC_P256_OID: &[u8] = &[0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07];
+
+// OID for secp384r1 (1.3.132.0.34)
+const EC_P384_OID: &[u8] = &[0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x22];
+
+/// Wrap an EC public key in a SubjectPublicKeyInfo ASN.1 structure.
+///
+/// SPKI = SEQUENCE {
+///   algorithm AlgorithmIdentifier = SEQUENCE { id-ecPublicKey, namedCurve },
+///   subjectPublicKey BIT STRING
+/// }
+fn wrap_ec_spki(public_key_bytes: &[u8], curve_oid: &[u8]) -> Vec<u8> {
+    // AlgorithmIdentifier = SEQUENCE { ecPublicKey OID, curve OID }
+    let alg_id_content_len = EC_PUBLIC_KEY_OID.len() + curve_oid.len();
+    let mut alg_id = vec![0x30]; // SEQUENCE
+    encode_asn1_length(alg_id_content_len, &mut alg_id);
+    alg_id.extend_from_slice(EC_PUBLIC_KEY_OID);
+    alg_id.extend_from_slice(curve_oid);
+
+    // BIT STRING wrapping the public key
+    // BIT STRING = 0x03 | length | 0x00 (no unused bits) | public_key_bytes
+    let bit_string_content_len = 1 + public_key_bytes.len();
+    let mut bit_string = vec![0x03];
+    encode_asn1_length(bit_string_content_len, &mut bit_string);
+    bit_string.push(0x00); // no unused bits
+    bit_string.extend_from_slice(public_key_bytes);
+
+    // SPKI = SEQUENCE { alg_id, bit_string }
+    let spki_content_len = alg_id.len() + bit_string.len();
+    let mut spki = vec![0x30]; // SEQUENCE
+    encode_asn1_length(spki_content_len, &mut spki);
+    spki.extend_from_slice(&alg_id);
+    spki.extend_from_slice(&bit_string);
+
+    spki
+}
+
+fn encode_asn1_length(len: usize, buf: &mut Vec<u8>) {
+    if len < 0x80 {
+        buf.push(len as u8);
+    } else if len < 0x100 {
+        buf.push(0x81);
+        buf.push(len as u8);
+    } else {
+        buf.push(0x82);
+        buf.push((len >> 8) as u8);
+        buf.push(len as u8);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn generate_ecdsa_p256() {
+        let kp = CertKeyPair::generate(&KeyType::EcdsaP256).unwrap();
+        assert!(!kp.pkcs8_der.is_empty());
+        let pem = kp.to_pem();
+        assert!(pem.starts_with("-----BEGIN PRIVATE KEY-----"));
+
+        let spki = kp.spki_der().unwrap();
+        assert!(!spki.is_empty());
+        // SPKI should start with SEQUENCE tag
+        assert_eq!(spki[0], 0x30);
+    }
+
+    #[test]
+    fn generate_ecdsa_p384() {
+        let kp = CertKeyPair::generate(&KeyType::EcdsaP384).unwrap();
+        assert!(!kp.pkcs8_der.is_empty());
+        let spki = kp.spki_der().unwrap();
+        assert!(!spki.is_empty());
+    }
+
+    #[test]
+    fn roundtrip_pem() {
+        let kp = CertKeyPair::generate(&KeyType::EcdsaP256).unwrap();
+        let pem_str = kp.to_pem();
+        let kp2 = CertKeyPair::from_pem_or_der(pem_str.as_bytes(), &KeyType::EcdsaP256).unwrap();
+        assert_eq!(kp.pkcs8_der, kp2.pkcs8_der);
+    }
+}
diff --git a/src/main.rs b/src/main.rs
new file mode 100644
index 0000000..b91f1a0
--- /dev/null
+++ b/src/main.rs
@@ -0,0 +1,285 @@
+mod acme;
+mod certs;
+mod cli;
+mod config;
+mod credentials;
+mod dane;
+mod dns;
+mod error;
+mod hooks;
+mod keys;
+mod renew;
+mod state;
+
+use clap::Parser;
+use tracing_subscriber::EnvFilter;
+
+use cli::{AccountAction, Cli, Command};
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    let cli = Cli::parse();
+
+    let filter = match cli.verbose {
+        0 => "certforge=info",
+        1 => "certforge=debug",
+        2 => "certforge=trace",
+        _ => "trace",
+    };
+    tracing_subscriber::fmt()
+        .with_env_filter(
+            EnvFilter::try_from_default_env().unwrap_or_else(|_| EnvFilter::new(filter)),
+        )
+        .init();
+
+    match cli.command {
+        Command::Renew { name, force } => {
+            let config = config::Config::load(&cli.config)?;
+            renew::run(&config, &cli.state_dir, name.as_deref(), force, cli.dry_run).await?;
+        }
+
+        Command::Status { name } => {
+            let config = config::Config::load(&cli.config)?;
+            print_status(&config, name.as_deref());
+        }
+
+        Command::Issue { name } => {
+            let config = config::Config::load(&cli.config)?;
+            renew::run(&config, &cli.state_dir, Some(&name), true, cli.dry_run).await?;
+        }
+
+        Command::DanePublish { name } => {
+            let config = config::Config::load(&cli.config)?;
+            dane_publish(&config, name.as_deref(), cli.dry_run).await?;
+        }
+
+        Command::DaneCheck { name } => {
+            let config = config::Config::load(&cli.config)?;
+            dane_check(&config, name.as_deref()).await?;
+        }
+
+        Command::ConfigCheck => {
+            let config = config::Config::load(&cli.config)?;
+            println!(
+                "Configuration is valid. {} certificate(s) configured.",
+                config.certificates.len()
+            );
+            for cert in &config.certificates {
+                println!(
+                    "  - {}: {} domain(s), {} DANE block(s), {} hook(s)",
+                    cert.name,
+                    cert.domains.len(),
+                    cert.dane.len(),
+                    cert.hooks.len()
+                );
+            }
+        }
+
+        Command::Init => {
+            let config = config::Config::load(&cli.config)?;
+            print_init_commands(&config);
+        }
+
+        Command::Account { action } => {
+            let config = config::Config::load(&cli.config)?;
+            match action {
+                AccountAction::Create => {
+                    let client = acme::AcmeClient::new(&config.acme).await?;
+                    println!("Account ID: {}", client.account().id());
+                }
+                AccountAction::Show => {
+                    let client = acme::AcmeClient::new(&config.acme).await?;
+                    println!("Account ID: {}", client.account().id());
+                }
+                AccountAction::Deactivate => {
+                    tracing::warn!("account deactivation not yet implemented");
+                }
+            }
+        }
+    }
+
+    Ok(())
+}
+
+fn print_status(config: &config::Config, name_filter: Option<&str>) {
+    for cert_config in &config.certificates {
+        if let Some(filter) = name_filter {
+            if cert_config.name != filter {
+                continue;
+            }
+        }
+
+        println!("Certificate: {}", cert_config.name);
+        println!("  Domains: {}", cert_config.domains.join(", "));
+        println!("  Key type: {:?}", cert_config.key_type);
+        println!("  Rotate key: {}", cert_config.rotate_key);
+        println!("  Cert path: {}", cert_config.cert_path.display());
+
+        match certs::CertInfo::load(&cert_config.cert_path) {
+            Ok(info) => {
+                let days = info.days_until_expiry();
+                println!("  Expires: {} ({days} days)", info.not_after.format("%Y-%m-%d %H:%M UTC"));
+                if info.expires_within_days(cert_config.renew_before_days) {
+                    println!("  Status: NEEDS RENEWAL");
+                } else {
+                    println!("  Status: OK");
+                }
+                if !info.san.is_empty() {
+                    println!("  SANs: {}", info.san.join(", "));
+                }
+            }
+            Err(_) => {
+                println!("  Status: NOT ISSUED");
+            }
+        }
+
+        for (i, dane) in cert_config.dane.iter().enumerate() {
+            println!("  DANE block {}: {:?}/{:?}/{:?}", i, dane.usage, dane.selector, dane.matching);
+            println!("    Names: {}", dane.names.join(", "));
+            println!("    TTL: {}, Pre-publish: {}", dane.ttl, dane.pre_publish);
+        }
+
+        println!();
+    }
+}
+
+async fn dane_publish(
+    config: &config::Config,
+    name_filter: Option<&str>,
+    dry_run: bool,
+) -> anyhow::Result<()> {
+    for cert_config in &config.certificates {
+        if let Some(filter) = name_filter {
+            if cert_config.name != filter {
+                continue;
+            }
+        }
+
+        if cert_config.dane.is_empty() {
+            continue;
+        }
+
+        let cert_info = certs::CertInfo::load(&cert_config.cert_path)?;
+
+        for dane_config in &cert_config.dane {
+            let records = dane::compute_tlsa_records(&cert_info, dane_config)?;
+
+            if dry_run {
+                for (name, record) in dane_config.names.iter().zip(records.iter()) {
+                    println!("{name}. IN TLSA {}", record.to_rdata_string());
+                }
+                continue;
+            }
+
+            let zone_hint = dane_config.names.first().unwrap();
+            let parts: Vec<&str> = zone_hint.split('.').filter(|p| !p.starts_with('_')).collect();
+            let zone_str = if parts.len() >= 2 {
+                parts[parts.len() - 2..].join(".")
+            } else {
+                zone_hint.to_string()
+            };
+
+            let dns_config = config.dns.resolve_for_zone(&zone_str);
+            let signer = dns::tsig::load_tsig_signer(&dns_config).await?;
+            let mut updater = dns::update::DnsUpdater::connect(&dns_config, signer).await?;
+            dane::publish_tlsa(&mut updater, dane_config, &records).await?;
+        }
+
+        tracing::info!(name = %cert_config.name, "DANE TLSA records published");
+    }
+
+    Ok(())
+}
+
+async fn dane_check(
+    config: &config::Config,
+    name_filter: Option<&str>,
+) -> anyhow::Result<()> {
+    for cert_config in &config.certificates {
+        if let Some(filter) = name_filter {
+            if cert_config.name != filter {
+                continue;
+            }
+        }
+
+        if cert_config.dane.is_empty() {
+            continue;
+        }
+
+        println!("Certificate: {}", cert_config.name);
+
+        let cert_result = certs::CertInfo::load(&cert_config.cert_path);
+
+        for dane_config in &cert_config.dane {
+            match &cert_result {
+                Ok(cert_info) => {
+                    let records = dane::compute_tlsa_records(cert_info, dane_config)?;
+                    let record = &records[0];
+                    for name in &dane_config.names {
+                        println!("  {name}: expected TLSA {}", record.to_rdata_string());
+                        // Actual DNS query verification would go here
+                        // For now, just show what we expect
+                    }
+                }
+                Err(_) => {
+                    println!("  Certificate not found, cannot compute expected TLSA records");
+                }
+            }
+        }
+
+        println!();
+    }
+
+    Ok(())
+}
+
+fn print_init_commands(config: &config::Config) {
+    println!("# Run these commands to set up encrypted credentials.");
+    println!("# Pipe the secret data into each command via stdin.\n");
+
+    if let Some(path) = &config.acme.account_key_credential {
+        println!(
+            "# ACME account key (will be auto-generated if not present)\nsystemd-creds encrypt --name=acme-account-key - {}\n",
+            path.display()
+        );
+    }
+
+    if let Some(path) = &config.dns.defaults.tsig_key_credential {
+        println!(
+            "# DNS TSIG key (default)\nsystemd-creds encrypt --name={} - {}\n",
+            config.dns.defaults.tsig_key_name,
+            path.display()
+        );
+    }
+
+    for (zone, ovr) in &config.dns.zones {
+        if let Some(path) = &ovr.tsig_key_credential {
+            let name = ovr
+                .tsig_key_name
+                .as_deref()
+                .unwrap_or(&config.dns.defaults.tsig_key_name);
+            println!(
+                "# DNS TSIG key for zone {zone}\nsystemd-creds encrypt --name={name} - {}\n",
+                path.display()
+            );
+        }
+    }
+
+    for cert in &config.certificates {
+        if let Some(path) = &cert.key_credential {
+            println!(
+                "# TLS private key for certificate '{}'\nsystemd-creds encrypt --name={}-tls-key - {}\n",
+                cert.name,
+                cert.name,
+                path.display()
+            );
+        }
+    }
+
+    println!("# Example systemd unit LoadCredentialEncrypted directives:");
+    for cert in &config.certificates {
+        if let Some(path) = &cert.key_credential {
+            println!("# LoadCredentialEncrypted={}-tls-key:{}", cert.name, path.display());
+        }
+    }
+}
diff --git a/src/renew.rs b/src/renew.rs
new file mode 100644
index 0000000..2ed2d24
--- /dev/null
+++ b/src/renew.rs
@@ -0,0 +1,407 @@
+use std::path::Path;
+
+use hickory_proto::rr::Name;
+
+use crate::acme::{AcmeClient, DnsChallenge};
+use crate::certs::CertInfo;
+use crate::config::{CertificateConfig, Config, DaneSelector};
+use crate::credentials;
+use crate::dane;
+use crate::dns::tsig;
+use crate::dns::update::DnsUpdater;
+use crate::error::{Error, Result};
+use crate::hooks;
+use crate::keys::CertKeyPair;
+use crate::state::{PendingRotation, State};
+
+/// Run the renewal process for all certificates (or a specific one).
+pub async fn run(
+    config: &Config,
+    state_dir: &Path,
+    name_filter: Option<&str>,
+    force: bool,
+    dry_run: bool,
+) -> Result<()> {
+    let mut state = State::load(state_dir)?;
+    let mut state_dirty = false;
+
+    let acme = AcmeClient::new(&config.acme).await?;
+
+    for cert_config in &config.certificates {
+        if let Some(filter) = name_filter {
+            if cert_config.name != filter {
+                continue;
+            }
+        }
+
+        match renew_certificate(config, &acme, cert_config, &mut state, state_dir, force, dry_run)
+            .await
+        {
+            Ok(renewed) => {
+                if renewed {
+                    tracing::info!(name = %cert_config.name, "certificate renewed successfully");
+                    state_dirty = true;
+                }
+                // "does not need renewal" is logged inside renew_certificate with days_remaining
+            }
+            Err(e) => {
+                tracing::error!(name = %cert_config.name, error = %e, "certificate renewal failed");
+            }
+        }
+    }
+
+    if state_dirty {
+        state.save(state_dir)?;
+    }
+    Ok(())
+}
+
+async fn renew_certificate(
+    config: &Config,
+    acme: &AcmeClient,
+    cert_config: &CertificateConfig,
+    state: &mut State,
+    state_dir: &Path,
+    force: bool,
+    dry_run: bool,
+) -> Result<bool> {
+    // Check if there's a pending key rotation to complete
+    if let Some(pending) = state.pending_rotations.get(&cert_config.name) {
+        if pending.ttl_expired() {
+            tracing::info!(
+                name = %cert_config.name,
+                "pending key rotation TTL expired, completing renewal"
+            );
+            // Continue with renewal using the pending key
+        } else {
+            tracing::info!(
+                name = %cert_config.name,
+                "pending key rotation, waiting for TTL expiry"
+            );
+            return Ok(false);
+        }
+    }
+
+    // Check if existing certificate needs renewal
+    if !force {
+        if let Ok(cert) = CertInfo::load(&cert_config.cert_path) {
+            let days = cert.days_until_expiry();
+            if !cert.expires_within_days(cert_config.renew_before_days) {
+                tracing::info!(
+                    name = %cert_config.name,
+                    days_remaining = days,
+                    "certificate does not need renewal"
+                );
+                return Ok(false);
+            }
+            tracing::info!(
+                name = %cert_config.name,
+                days_remaining = days,
+                "certificate expiring soon, renewing"
+            );
+        }
+        // If cert doesn't exist or can't be parsed, proceed with issuance
+    }
+
+    // Determine key pair
+    let key = if let Some(pending) = state.pending_rotations.remove(&cert_config.name) {
+        // Use the pending key from pre-publication
+        let key_data = std::fs::read(&pending.pending_key_path)
+            .map_err(|e| Error::Key(format!("failed to read pending key: {e}")))?;
+        CertKeyPair::from_pem_or_der(&key_data, &cert_config.key_type)?
+    } else if cert_config.rotate_key {
+        // Check if DANE pre-publication is needed
+        let needs_pre_publish = cert_config
+            .dane
+            .iter()
+            .any(|d| d.pre_publish && d.selector == DaneSelector::Spki);
+
+        let new_key = CertKeyPair::generate(&cert_config.key_type)?;
+
+        if needs_pre_publish {
+            // Pre-publish TLSA with new key, defer renewal
+            tracing::info!(name = %cert_config.name, "pre-publishing TLSA for key rotation");
+
+            if !dry_run {
+                // Save pending key
+                let pending_dir = state_dir.join("pending");
+                std::fs::create_dir_all(&pending_dir)?;
+                let pending_key_path = pending_dir.join(format!("{}.key", cert_config.name));
+                std::fs::write(&pending_key_path, new_key.to_pem())?;
+
+                #[cfg(unix)]
+                {
+                    use std::os::unix::fs::PermissionsExt;
+                    std::fs::set_permissions(
+                        &pending_key_path,
+                        std::fs::Permissions::from_mode(0o600),
+                    )?;
+                }
+
+                // Publish new TLSA alongside old
+                let max_ttl = pre_publish_dane(config, cert_config, &new_key, dry_run).await?;
+
+                state.pending_rotations.insert(
+                    cert_config.name.clone(),
+                    PendingRotation {
+                        pending_key_path,
+                        published_at: chrono::Utc::now(),
+                        old_ttl: max_ttl,
+                    },
+                );
+                state.save(state_dir)?;
+            }
+
+            tracing::info!(
+                name = %cert_config.name,
+                "TLSA pre-published, renewal deferred to next run"
+            );
+            return Ok(false);
+        }
+
+        new_key
+    } else {
+        // Load existing key or generate if first time
+        match CertKeyPair::load(
+            cert_config.key_credential.as_deref(),
+            cert_config.key_path.as_deref(),
+            &cert_config.key_type,
+        )
+        .await
+        {
+            Ok(key) => key,
+            Err(_) => {
+                tracing::info!(name = %cert_config.name, "generating new key pair");
+                CertKeyPair::generate(&cert_config.key_type)?
+            }
+        }
+    };
+
+    if dry_run {
+        tracing::info!(name = %cert_config.name, "dry-run: would issue certificate");
+        return Ok(true);
+    }
+
+    // Generate CSR
+    tracing::debug!(
+        name = %cert_config.name,
+        domains = ?cert_config.domains,
+        key_type = ?cert_config.key_type,
+        "generating CSR"
+    );
+    let pkcs8_der = rustls_pki_types::PrivatePkcs8KeyDer::from(key.pkcs8_der.as_slice());
+    let rcgen_alg = match cert_config.key_type {
+        crate::config::KeyType::EcdsaP256 => &rcgen::PKCS_ECDSA_P256_SHA256,
+        crate::config::KeyType::EcdsaP384 => &rcgen::PKCS_ECDSA_P384_SHA384,
+        _ => return Err(Error::Key("unsupported key type for CSR generation".into())),
+    };
+    let rcgen_kp = rcgen::KeyPair::from_pkcs8_der_and_sign_algo(&pkcs8_der, rcgen_alg)
+        .map_err(|e| Error::Key(format!("failed to load key for CSR: {e}")))?;
+
+    let mut params =
+        rcgen::CertificateParams::new(cert_config.domains.clone())
+            .map_err(|e| Error::Certificate(format!("invalid CSR params: {e}")))?;
+    // Clear the default distinguished name - ACME uses SANs only,
+    // and the default CN "rcgen self signed cert" causes rejection.
+    params.distinguished_name = rcgen::DistinguishedName::new();
+
+    let csr = params
+        .serialize_request(&rcgen_kp)
+        .map_err(|e| Error::Certificate(format!("failed to generate CSR: {e}")))?;
+
+    // ACME order
+    tracing::debug!(name = %cert_config.name, domains = ?cert_config.domains, "creating ACME order");
+    let (mut order, _) = acme.create_order(&cert_config.domains).await?;
+
+    // Collect DNS-01 challenge info
+    let challenges = AcmeClient::collect_challenges(&mut order).await?;
+
+    // Publish DNS-01 challenge TXT records
+    for challenge in &challenges {
+        tracing::debug!(
+            domain = %challenge.domain,
+            txt_name = %challenge.txt_name,
+            txt_value = %challenge.txt_value,
+            "publishing DNS-01 challenge TXT record"
+        );
+        publish_challenge_txt(config, challenge).await?;
+    }
+
+    // Run the ACME order flow, ensuring TXT cleanup happens even on failure
+    let order_result = async {
+        // Tell ACME server challenges are ready
+        tracing::debug!(name = %cert_config.name, "setting challenges ready");
+        AcmeClient::set_challenges_ready(&mut order).await?;
+
+        // Finalize and download
+        tracing::debug!(name = %cert_config.name, "finalizing order");
+        AcmeClient::finalize_order(&mut order, csr.der()).await?;
+        tracing::debug!(name = %cert_config.name, "downloading certificate");
+        AcmeClient::download_certificate(&mut order).await
+    }
+    .await;
+
+    // Always clean up challenge TXT records
+    for challenge in &challenges {
+        if let Err(e) = cleanup_challenge_txt(config, challenge).await {
+            tracing::warn!(
+                domain = %challenge.domain,
+                error = %e,
+                "failed to clean up challenge TXT record"
+            );
+        }
+    }
+
+    let cert_pem = order_result?;
+
+    // Save certificate
+    if let Some(parent) = cert_config.cert_path.parent() {
+        std::fs::create_dir_all(parent)?;
+    }
+    std::fs::write(&cert_config.cert_path, &cert_pem)?;
+    tracing::info!(path = %cert_config.cert_path.display(), "saved certificate");
+
+    // Save key
+    save_key(&key, cert_config).await?;
+
+    // Publish DANE TLSA records
+    if !cert_config.dane.is_empty() {
+        let cert_info = CertInfo::from_pem(&cert_pem)?;
+        for dane_config in &cert_config.dane {
+            let records = dane::compute_tlsa_records(&cert_info, dane_config)?;
+
+            let dns_config = config.dns.resolve_for_zone(&extract_zone_from_tlsa_name(
+                dane_config.names.first().unwrap(),
+            ));
+            let signer = tsig::load_tsig_signer(&dns_config).await?;
+            let mut updater = DnsUpdater::connect(&dns_config, signer).await?;
+
+            dane::publish_tlsa(&mut updater, dane_config, &records).await?;
+        }
+    }
+
+    // Run hooks
+    let hook_results = hooks::run_hooks(&cert_config.hooks, false).await;
+    for result in &hook_results {
+        if let Err(e) = result {
+            tracing::warn!(error = %e, "hook failed (non-fatal)");
+        }
+    }
+
+    Ok(true)
+}
+
+async fn save_key(key: &CertKeyPair, cert_config: &CertificateConfig) -> Result<()> {
+    let pem = key.to_pem();
+
+    if let Some(cred_path) = &cert_config.key_credential {
+        let cred_name = format!("{}-tls-key", cert_config.name);
+        credentials::encrypt_credential(&cred_name, pem.as_bytes(), cred_path).await?;
+        tracing::info!(path = %cred_path.display(), "saved private key (encrypted)");
+    } else if let Some(key_path) = &cert_config.key_path {
+        if let Some(parent) = key_path.parent() {
+            std::fs::create_dir_all(parent)?;
+        }
+        std::fs::write(key_path, &pem)?;
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            std::fs::set_permissions(key_path, std::fs::Permissions::from_mode(0o600))?;
+        }
+        tracing::info!(path = %key_path.display(), "saved private key");
+    }
+
+    Ok(())
+}
+
+async fn publish_challenge_txt(config: &Config, challenge: &DnsChallenge) -> Result<()> {
+    let zone_str = extract_zone_from_domain(&challenge.domain);
+    let dns_config = config.dns.resolve_for_zone(&zone_str);
+    tracing::debug!(
+        domain = %challenge.domain,
+        zone = %zone_str,
+        server = %dns_config.server,
+        txt_name = %challenge.txt_name,
+        "publishing challenge TXT via RFC 2136"
+    );
+    let signer = tsig::load_tsig_signer(&dns_config).await?;
+    let mut updater = DnsUpdater::connect(&dns_config, signer).await?;
+
+    let name = Name::from_ascii(&challenge.txt_name)
+        .map_err(|e| Error::DnsUpdate(format!("invalid TXT name: {e}")))?;
+    let zone = Name::from_ascii(&zone_str)
+        .map_err(|e| Error::DnsUpdate(format!("invalid zone: {e}")))?;
+
+    updater.add_txt_record(&zone, &name, &challenge.txt_value, 60).await
+}
+
+async fn cleanup_challenge_txt(config: &Config, challenge: &DnsChallenge) -> Result<()> {
+    let zone_str = extract_zone_from_domain(&challenge.domain);
+    let dns_config = config.dns.resolve_for_zone(&zone_str);
+    let signer = tsig::load_tsig_signer(&dns_config).await?;
+    let mut updater = DnsUpdater::connect(&dns_config, signer).await?;
+
+    let name = Name::from_ascii(&challenge.txt_name)
+        .map_err(|e| Error::DnsUpdate(format!("invalid TXT name: {e}")))?;
+    let zone = Name::from_ascii(&zone_str)
+        .map_err(|e| Error::DnsUpdate(format!("invalid zone: {e}")))?;
+
+    updater.delete_txt_record(&zone, &name, &challenge.txt_value).await
+}
+
+async fn pre_publish_dane(
+    config: &Config,
+    cert_config: &CertificateConfig,
+    new_key: &CertKeyPair,
+    dry_run: bool,
+) -> Result<u32> {
+    let mut max_ttl = 0;
+
+    for dane_config in &cert_config.dane {
+        if !dane_config.pre_publish || dane_config.selector != DaneSelector::Spki {
+            continue;
+        }
+
+        max_ttl = max_ttl.max(dane_config.ttl);
+
+        if dry_run {
+            tracing::info!("dry-run: would pre-publish TLSA for {:?}", dane_config.names);
+            continue;
+        }
+
+        let records = dane::compute_tlsa_from_key(new_key, dane_config)?;
+        let record = &records[0];
+
+        let dns_config = config.dns.resolve_for_zone(&extract_zone_from_tlsa_name(
+            dane_config.names.first().unwrap(),
+        ));
+        let signer = tsig::load_tsig_signer(&dns_config).await?;
+        let mut updater = DnsUpdater::connect(&dns_config, signer).await?;
+
+        dane::add_tlsa(&mut updater, dane_config, record).await?;
+    }
+
+    Ok(max_ttl)
+}
+
+/// Extract zone from a domain (heuristic: last two labels).
+fn extract_zone_from_domain(domain: &str) -> String {
+    let parts: Vec<&str> = domain.split('.').collect();
+    if parts.len() >= 2 {
+        parts[parts.len() - 2..].join(".")
+    } else {
+        domain.to_string()
+    }
+}
+
+/// Extract zone from a TLSA name like _25._tcp.mx1.example.com.
+fn extract_zone_from_tlsa_name(name: &str) -> String {
+    let parts: Vec<&str> = name.split('.').collect();
+    // Skip underscore-prefixed parts, then skip hostname, take zone
+    let non_underscore: Vec<&&str> = parts.iter().filter(|p| !p.starts_with('_')).collect();
+    if non_underscore.len() >= 2 {
+        non_underscore[non_underscore.len() - 2..].iter().map(|s| **s).collect::<Vec<&str>>().join(".")
+    } else {
+        name.to_string()
+    }
+}
diff --git a/src/state.rs b/src/state.rs
new file mode 100644
index 0000000..d76290e
--- /dev/null
+++ b/src/state.rs
@@ -0,0 +1,60 @@
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+use crate::error::{Error, Result};
+
+/// Persistent state for tracking pre-publication and pending operations.
+#[derive(Debug, Default, Serialize, Deserialize)]
+pub struct State {
+    /// Pending key rotations keyed by certificate name.
+    #[serde(default)]
+    pub pending_rotations: HashMap<String, PendingRotation>,
+}
+
+/// State for a pending key rotation with DANE pre-publication.
+#[derive(Debug, Serialize, Deserialize)]
+pub struct PendingRotation {
+    /// Path to the encrypted pending key
+    pub pending_key_path: PathBuf,
+    /// When the new TLSA was published
+    pub published_at: DateTime<Utc>,
+    /// The old TLSA TTL in seconds (we must wait this long)
+    pub old_ttl: u32,
+}
+
+impl PendingRotation {
+    /// Check if enough time has elapsed for the old TLSA TTL to expire.
+    pub fn ttl_expired(&self) -> bool {
+        let elapsed = Utc::now() - self.published_at;
+        elapsed.num_seconds() >= self.old_ttl as i64
+    }
+}
+
+impl State {
+    /// Load state from the state directory.
+    pub fn load(state_dir: &Path) -> Result<Self> {
+        let path = state_dir.join("state.json");
+        if !path.exists() {
+            return Ok(Self::default());
+        }
+
+        let data = std::fs::read_to_string(&path)
+            .map_err(|e| Error::State(format!("failed to read state file: {e}")))?;
+        let state: State = serde_json::from_str(&data)
+            .map_err(|e| Error::State(format!("failed to parse state file: {e}")))?;
+        Ok(state)
+    }
+
+    /// Save state to the state directory.
+    pub fn save(&self, state_dir: &Path) -> Result<()> {
+        std::fs::create_dir_all(state_dir)?;
+        let path = state_dir.join("state.json");
+        let data = serde_json::to_string_pretty(self)
+            .map_err(|e| Error::State(format!("failed to serialize state: {e}")))?;
+        std::fs::write(&path, data)?;
+        Ok(())
+    }
+}