diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index d749833..367b65a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,17 +1,8 @@
 stages:
   - test
-  - e2e
 
 test-job:
   stage: test
   image: localhost:5000/huskbuilder:latest
   script:
     - cargo test
-
-e2e-job:
-  stage: e2e
-  image: localhost:5000/mta:latest
-  script:
-    - echo "new"
-    - bash /usr/bin/prepare.sh $CI_COMMIT_BRANCH && bash /opt/husk/husk-milter/e2e-tests/runner.sh
-
diff --git a/Cargo.lock b/Cargo.lock
index b5bbcf1..72c7e1a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1,6 +1,6 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
 
 [[package]]
 name = "adler2"
@@ -27,16 +27,66 @@ dependencies = [
 ]
 
 [[package]]
-name = "anyhow"
-version = "1.0.101"
+name = "anstream"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e0fee31ef5ed1ba1316088939cea399010ed7731dba877ed44aeb407a75ea"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
 [[package]]
 name = "arc-swap"
-version = "1.8.1"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ded5f9a03ac8f24d1b8a25101ee812cd32cdc8c50a4c50237de2c4915850e73"
+checksum = "6a3a1fd6f75306b68087b831f025c712524bcb19aad54e557b1129cfa0a2b207"
 dependencies = [
  "rustversion",
 ]
@@ -81,9 +131,9 @@ checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
 name = "autocfg"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "base64"
@@ -99,9 +149,9 @@ checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
 name = "bindgen"
-version = "0.70.1"
+version = "0.72.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f49d8fed880d473ea71efb9bf597651e77201bdd4893efe54c9e5d65ae04ce6f"
+checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895"
 dependencies = [
  "bitflags",
  "cexpr",
@@ -117,24 +167,24 @@ dependencies = [
 
 [[package]]
 name = "bit-set"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
+checksum = "34ddef2995421ab6a5c779542c81ee77c115206f4ad9d5a8e05f4ff49716a3dd"
 dependencies = [
  "bit-vec",
 ]
 
 [[package]]
 name = "bit-vec"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
 
 [[package]]
 name = "bitflags"
-version = "2.10.0"
+version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
 
 [[package]]
 name = "blake2"
@@ -167,9 +217,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.19.1"
+version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dd9dc738b7a8311c7ade152424974d8115f2cdad61e8dab8dac9f2362298510"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
 [[package]]
 name = "bytes"
@@ -207,9 +257,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.55"
+version = "1.2.62"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47b26a0954ae34af09b50f0de26458fa95369a0d478d8236d3f93082b219bd29"
+checksum = "a1dce859f0832a7d088c4f1119888ab94ef4b5d6795d1ce05afb7fe159d79f98"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -232,9 +282,9 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "chrono"
-version = "0.4.43"
+version = "0.4.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fac4744fb15ae8337dc853fee7fb3f4e48c0fbaa23d0afe49c447b4fab126118"
+checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
 dependencies = [
  "iana-time-zone",
  "js-sys",
@@ -254,6 +304,52 @@ dependencies = [
  "libloading",
 ]
 
+[[package]]
+name = "clap"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
@@ -264,6 +360,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -356,9 +462,9 @@ dependencies = [
 
 [[package]]
 name = "data-encoding"
-version = "2.10.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7a1e2f27636f116493b8b860f5546edb47c8d8f8ea73e1d2a20be88e28d1fea"
+checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
 
 [[package]]
 name = "derive_more"
@@ -460,15 +566,15 @@ checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
 [[package]]
 name = "either"
-version = "1.15.0"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
 
 [[package]]
 name = "ena"
-version = "0.14.3"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d248bdd43ce613d87415282f69b9bb99d947d290b10962dd6c56233312c2ad5"
+checksum = "eabffdaee24bd1bf95c5ef7cec31260444317e72ea56c4c91750e8b7ee58d5f1"
 dependencies = [
  "log",
 ]
@@ -530,9 +636,9 @@ checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
 
 [[package]]
 name = "fastrand"
-version = "2.3.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 
 [[package]]
 name = "fd-lock"
@@ -579,6 +685,12 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
 [[package]]
 name = "foreign-types"
 version = "0.3.2"
@@ -605,30 +717,30 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
 dependencies = [
  "futures-core",
 ]
 
 [[package]]
 name = "futures-core"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
 
 [[package]]
 name = "futures-io"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -637,27 +749,26 @@ dependencies = [
 
 [[package]]
 name = "futures-sink"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
 
 [[package]]
 name = "futures-task"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
 
 [[package]]
 name = "futures-util"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
 dependencies = [
  "futures-core",
  "futures-macro",
  "futures-task",
  "pin-project-lite",
- "pin-utils",
  "slab",
 ]
 
@@ -673,9 +784,9 @@ dependencies = [
 
 [[package]]
 name = "generic-array"
-version = "1.3.5"
+version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eaf57c49a95fd1fe24b90b3033bee6dc7e8f1288d51494cb44e627c295e38542"
+checksum = "dab9e9188e97a93276e1fe7b56401b851e2b45a46d045ca658100c1303ada649"
 dependencies = [
  "rustversion",
  "typenum",
@@ -712,10 +823,23 @@ checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
  "libc",
- "r-efi",
+ "r-efi 5.3.0",
  "wasip2",
 ]
 
+[[package]]
+name = "getrandom"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "wasip2",
+ "wasip3",
+]
+
 [[package]]
 name = "glob"
 version = "0.3.3"
@@ -724,9 +848,9 @@ checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
 [[package]]
 name = "h2"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+checksum = "171fefbc92fe4a4de27e0698d6a5b392d6a0e333506bc49133760b3bcf948733"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -747,7 +871,7 @@ version = "0.15.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 dependencies = [
- "foldhash",
+ "foldhash 0.1.5",
 ]
 
 [[package]]
@@ -755,14 +879,23 @@ name = "hashbrown"
 version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "foldhash 0.2.0",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 
 [[package]]
 name = "hashlink"
-version = "0.10.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
+checksum = "ea0b22561a9c04a7cb1a302c013e0259cd3b4bb619f145b32f72b8b4bcbed230"
 dependencies = [
- "hashbrown 0.15.5",
+ "hashbrown 0.16.1",
 ]
 
 [[package]]
@@ -790,7 +923,7 @@ dependencies = [
  "hickory-proto",
  "once_cell",
  "radix_trie",
- "rand 0.8.5",
+ "rand 0.8.6",
  "thiserror 1.0.69",
  "tokio",
  "tracing",
@@ -813,7 +946,7 @@ dependencies = [
  "ipnet",
  "once_cell",
  "openssl",
- "rand 0.8.5",
+ "rand 0.8.6",
  "thiserror 1.0.69",
  "tinyvec",
  "tokio",
@@ -834,7 +967,7 @@ dependencies = [
  "lru-cache",
  "once_cell",
  "parking_lot",
- "rand 0.8.5",
+ "rand 0.8.6",
  "resolv-conf",
  "smallvec",
  "thiserror 1.0.69",
@@ -844,9 +977,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "1.4.0"
+version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+checksum = "8be7462df143984c4598a256ef469b251d7d7f9e271135073e78fc535414f3d0"
 dependencies = [
  "bytes",
  "itoa",
@@ -891,8 +1024,10 @@ checksum = "135b12329e5e3ce057a9f972339ea52bc954fe1e9358ef27f95e89716fbc5424"
 name = "husk"
 version = "0.1.0"
 dependencies = [
+ "aho-corasick",
  "anyhow",
  "bytes",
+ "clap",
  "indymilter",
  "log",
  "log4rs",
@@ -910,9 +1045,9 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.8.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
+checksum = "6299f016b246a94207e63da54dbe807655bf9e00044f73ded42c3ac5305fbcca"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -924,7 +1059,6 @@ dependencies = [
  "httparse",
  "itoa",
  "pin-project-lite",
- "pin-utils",
  "smallvec",
  "tokio",
  "want",
@@ -932,15 +1066,14 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.7"
+version = "0.27.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
  "http",
  "hyper",
  "hyper-util",
  "rustls",
- "rustls-pki-types",
  "tokio",
  "tokio-rustls",
  "tower-service",
@@ -979,7 +1112,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.6.2",
+ "socket2",
  "system-configuration",
  "tokio",
  "tower-service",
@@ -1013,12 +1146,13 @@ dependencies = [
 
 [[package]]
 name = "icu_collections"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
 dependencies = [
  "displaydoc",
  "potential_utf",
+ "utf8_iter",
  "yoke",
  "zerofrom",
  "zerovec",
@@ -1026,9 +1160,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -1039,9 +1173,9 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
 dependencies = [
  "icu_collections",
  "icu_normalizer_data",
@@ -1053,15 +1187,15 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
 
 [[package]]
 name = "icu_properties"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
 dependencies = [
  "icu_collections",
  "icu_locale_core",
@@ -1073,15 +1207,15 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
 
 [[package]]
 name = "icu_provider"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
@@ -1092,6 +1226,12 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
 [[package]]
 name = "idna"
 version = "1.1.0"
@@ -1105,9 +1245,9 @@ dependencies = [
 
 [[package]]
 name = "idna_adapter"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
 dependencies = [
  "icu_normalizer",
  "icu_properties",
@@ -1115,12 +1255,14 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.13.0"
+version = "2.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown 0.16.1",
+ "hashbrown 0.17.1",
+ "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -1138,31 +1280,28 @@ dependencies = [
 
 [[package]]
 name = "ipconfig"
-version = "0.3.2"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b58db92f96b720de98181bbbe63c831e87005ab460c1bf306eb2622b4707997f"
+checksum = "4d40460c0ce33d6ce4b0630ad68ff63d6661961c48b6dba35e5a4d81cfb48222"
 dependencies = [
- "socket2 0.5.10",
+ "socket2",
  "widestring",
- "windows-sys 0.48.0",
- "winreg",
+ "windows-registry",
+ "windows-result",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "ipnet"
-version = "2.11.0"
+version = "2.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
 
 [[package]]
-name = "iri-string"
-version = "0.7.10"
+name = "is_terminal_polyfill"
+version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c91338f0783edbd6195decb37bae672fd3b165faffb89bf7b9e6942f8b1a731a"
-dependencies = [
- "memchr",
- "serde",
-]
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
 
 [[package]]
 name = "itertools"
@@ -1184,34 +1323,36 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "js-sys"
-version = "0.3.85"
+version = "0.3.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c942ebf8e95485ca0d52d97da7c5a2c387d0e7f0ba4c35e93bfcaee045955b3"
+checksum = "142bc4740e452c1e57ade0cbc129f139c9093e354346f0872ef985f4f5cf5f11"
 dependencies = [
+ "cfg-if",
+ "futures-util",
  "once_cell",
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "keccak"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecc2af9a1119c51f12a14607e783cb977bde58bc069ff0c3da1095e635d70654"
+checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
 dependencies = [
  "cpufeatures",
 ]
 
 [[package]]
 name = "lalrpop"
-version = "0.22.2"
+version = "0.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba4ebbd48ce411c1d10fb35185f5a51a7bfa3d8b24b4e330d30c9e3a34129501"
+checksum = "98a80a963123205c7157323c99611bc4abb65dcbd62ef46dc4bac74a3941bc75"
 dependencies = [
  "ascii-canvas",
  "bit-set",
@@ -1230,25 +1371,30 @@ dependencies = [
 
 [[package]]
 name = "lalrpop-util"
-version = "0.22.2"
+version = "0.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5baa5e9ff84f1aefd264e6869907646538a52147a755d494517a8007fb48733"
+checksum = "884f3e747ed2dcee867cda1b0c31a048f9e20de2d916a248949319921a2e666e"
 dependencies = [
  "regex-automata",
- "rustversion",
 ]
 
 [[package]]
-name = "libbz2-rs-sys"
-version = "0.2.2"
+name = "leb128fmt"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c4a545a15244c7d945065b5d392b2d2d7f21526fba56ce51467b06ed445e8f7"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "libbz2-rs-sys"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34b357333733e8260735ba5894eb928c02ecc69c78715f01a8019e7fa7f2db4c"
 
 [[package]]
 name = "libc"
-version = "0.2.180"
+version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
 [[package]]
 name = "libloading"
@@ -1262,19 +1408,18 @@ dependencies = [
 
 [[package]]
 name = "libredox"
-version = "0.1.12"
+version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d0b95e02c851351f877147b7deea7b1afb1df71b63aa5f8270716e0c5720616"
+checksum = "e02f3bb43d335493c96bf3fd3a321600bf6bd07ed34bc64118e9293bdffea46c"
 dependencies = [
- "bitflags",
  "libc",
 ]
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.35.0"
+version = "0.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "133c182a6a2c87864fe97778797e46c7e999672690dc9fa3ee8e241aa4a9c13f"
+checksum = "b1f111c8c41e7c61a49cd34e44c7619462967221a6443b0ec299e0ac30cfb9b1"
 dependencies = [
  "cc",
  "pkg-config",
@@ -1289,15 +1434,15 @@ checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.11.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "litemap"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6373607a59f0be73a39b6fe456b8192fcc3585f602af20751600e974dd455e77"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
 
 [[package]]
 name = "lock_api"
@@ -1310,9 +1455,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.29"
+version = "0.4.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+checksum = "616ec5685824bcc94416c6d4a7a446eea774a31efd7062c8480ba6fd06d7a6e5"
 dependencies = [
  "serde_core",
 ]
@@ -1340,7 +1485,7 @@ dependencies = [
  "log-mdc",
  "mock_instant",
  "parking_lot",
- "rand 0.9.2",
+ "rand 0.9.4",
  "serde",
  "serde-value",
  "serde_json",
@@ -1397,9 +1542,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.1.1"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
+checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
 dependencies = [
  "libc",
  "wasi",
@@ -1414,9 +1559,9 @@ checksum = "dce6dd36094cac388f119d2e9dc82dc730ef91c32a6222170d630e5414b956e6"
 
 [[package]]
 name = "native-tls"
-version = "0.2.14"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87de3442987e9dbec73158d5c715e7ad9072fda936bb03d19d7fa10e00520f0e"
+checksum = "465500e14ea162429d264d44189adc38b199b62b1c21eea9f69e4b73cb03bbf2"
 dependencies = [
  "libc",
  "log",
@@ -1431,22 +1576,22 @@ dependencies = [
 
 [[package]]
 name = "nettle"
-version = "7.4.0"
+version = "7.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44e6ff4a94e5d34a1fd5abbd39418074646e2fa51b257198701330f22fcd6936"
+checksum = "2578a3627c28fefb60f1680e20e85f38bd8c8bf98c288b370489a573b0640907"
 dependencies = [
- "getrandom 0.2.17",
+ "getrandom 0.4.2",
  "libc",
  "nettle-sys",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "typenum",
 ]
 
 [[package]]
 name = "nettle-sys"
-version = "2.3.1"
+version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61a3f5406064d310d59b1a219d3c5c9a49caf4047b6496032e3f930876488c34"
+checksum = "f35502358aa77e598570bbf9a79ad19c4985a1bcd157b5d70197688dafca9b48"
 dependencies = [
  "bindgen",
  "cc",
@@ -1502,9 +1647,15 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
 [[package]]
 name = "openpgp-cert-d"
@@ -1525,15 +1676,14 @@ dependencies = [
 
 [[package]]
 name = "openssl"
-version = "0.10.75"
+version = "0.10.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08838db121398ad17ab8531ce9de97b244589089e290a384c900cb9ff7434328"
+checksum = "a45fa2aa886c42762255da344f0a0d313e254066c46aad76f300c3d3da62d967"
 dependencies = [
  "bitflags",
  "cfg-if",
  "foreign-types",
  "libc",
- "once_cell",
  "openssl-macros",
  "openssl-sys",
 ]
@@ -1551,15 +1701,15 @@ dependencies = [
 
 [[package]]
 name = "openssl-probe"
-version = "0.1.6"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.111"
+version = "0.9.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82cab2d520aa75e3c58898289429321eb788c3106963d0dc886ec7a5f4adc321"
+checksum = "f28a22dc7140cda5f096e5e7724a6962ca81a7f8bfd2979f9b18c11af56318c4"
 dependencies = [
  "cc",
  "libc",
@@ -1624,46 +1774,41 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "petgraph"
-version = "0.7.1"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3672b37090dbd86368a4145bc067582552b29c27377cad4e0a306c97f9bd7772"
+checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
 dependencies = [
  "fixedbitset",
+ "hashbrown 0.15.5",
  "indexmap",
 ]
 
 [[package]]
 name = "phf_shared"
-version = "0.11.3"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
 dependencies = [
  "siphasher",
 ]
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
-
-[[package]]
-name = "pin-utils"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
 name = "pkg-config"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 
 [[package]]
 name = "potential_utf"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b73949432f5e2a09657003c25bca5e19a0e9c84f8058ca374f49e0ebe605af77"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
 dependencies = [
  "zerovec",
 ]
@@ -1683,6 +1828,16 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
 
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.106"
@@ -1694,9 +1849,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.44"
+version = "1.0.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
 dependencies = [
  "proc-macro2",
 ]
@@ -1707,6 +1862,12 @@ version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
 [[package]]
 name = "radix_trie"
 version = "0.2.1"
@@ -1719,9 +1880,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
 dependencies = [
  "libc",
  "rand_chacha 0.3.1",
@@ -1730,9 +1891,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.2"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.5",
@@ -1778,9 +1939,9 @@ dependencies = [
 
 [[package]]
 name = "rayon"
-version = "1.11.0"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "368f01d005bf8fd9b1206fb6fa653e6c4a81ceb1466406b81792d87c5677a58f"
+checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d"
 dependencies = [
  "either",
  "rayon-core",
@@ -1852,9 +2013,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.9"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a96887878f22d7bad8a3b6dc5b7440e0ada9a245242924394987b21cf2210a4c"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
 [[package]]
 name = "reqwest"
@@ -1917,10 +2078,20 @@ dependencies = [
 ]
 
 [[package]]
-name = "rusqlite"
-version = "0.37.0"
+name = "rsqlite-vfs"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "165ca6e57b20e1351573e3729b958bc62f0e48025386970b6e4d29e7a7e71f3f"
+checksum = "c51c9ae4df8a7fba42103df5c621fa3c37eccf3a3c650879e90fc48b11cc192c"
+dependencies = [
+ "hashbrown 0.16.1",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "rusqlite"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0d2b0146dd9661bf67bb107c0bb2a55064d556eeb3fc314151b957f313bcd4e"
 dependencies = [
  "bitflags",
  "fallible-iterator",
@@ -1928,13 +2099,14 @@ dependencies = [
  "hashlink",
  "libsqlite3-sys",
  "smallvec",
+ "sqlite-wasm-rs",
 ]
 
 [[package]]
 name = "rustc-hash"
-version = "1.1.0"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
 
 [[package]]
 name = "rustc_version"
@@ -1947,9 +2119,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "1.1.3"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
  "bitflags",
  "errno",
@@ -1960,9 +2132,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.36"
+version = "0.23.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c665f33d38cea657d9614f766881e4d510e0eda4239891eea56b4cadcf01801b"
+checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
 dependencies = [
  "once_cell",
  "rustls-pki-types",
@@ -1973,18 +2145,18 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.14.0"
+version = "1.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd"
+checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
 dependencies = [
  "zeroize",
 ]
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.9"
+version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -1999,9 +2171,9 @@ checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
 name = "ryu"
-version = "1.0.22"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a50f4cf475b65d88e057964e0e9bb1f0aa9bbb2036dc65c64596b42932536984"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "same-file"
@@ -2014,9 +2186,9 @@ dependencies = [
 
 [[package]]
 name = "schannel"
-version = "0.1.28"
+version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "891d81b926048e76efe18581bf793546b4c0eaf8448d72be8de2bbee5fd166e1"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
 dependencies = [
  "windows-sys 0.61.2",
 ]
@@ -2029,12 +2201,12 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "security-framework"
-version = "2.11.1"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
  "bitflags",
- "core-foundation",
+ "core-foundation 0.10.1",
  "core-foundation-sys",
  "libc",
  "security-framework-sys",
@@ -2042,9 +2214,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.15.0"
+version = "2.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc1f0cbffaac4852523ce30d8bd3c5cdc873501d96ff467ca09b6767bb8cd5c0"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -2052,15 +2224,15 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.27"
+version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
 
 [[package]]
 name = "sequoia-cert-store"
-version = "0.7.1"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e9640848aee656020e6ff817ca23805bf42d116cb228ec50eacdd7ec93bf9f2"
+checksum = "c4e07e420427eb5e0dc3bb61172d181fa3c87afb2a77e8c629e920f54a291a6d"
 dependencies = [
  "anyhow",
  "crossbeam",
@@ -2093,9 +2265,9 @@ dependencies = [
 
 [[package]]
 name = "sequoia-net"
-version = "0.30.0"
+version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "956ef5d37e41f53259cd3c6caac5f135351ee92f76f3ac6ee9cf771ee6e33925"
+checksum = "75c0ea4f555b2b109fb39d6c5ebdb614945d82da0105957591adf4641e9cc3b2"
 dependencies = [
  "anyhow",
  "base64",
@@ -2109,7 +2281,7 @@ dependencies = [
  "percent-encoding",
  "reqwest",
  "sequoia-openpgp",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "tokio",
  "url",
  "z-base-32",
@@ -2117,9 +2289,9 @@ dependencies = [
 
 [[package]]
 name = "sequoia-openpgp"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0620e44a7d514adf7df87b44db235f13b81fed7ddc265adb26f014d42626ac47"
+checksum = "c847f0f148cf238c3aec88d092fd3c4301c21e906829ea9e415ea7531f7ec094"
 dependencies = [
  "anyhow",
  "argon2",
@@ -2200,9 +2372,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.149"
+version = "1.0.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
 dependencies = [
  "itoa",
  "memchr",
@@ -2213,9 +2385,9 @@ dependencies = [
 
 [[package]]
 name = "serde_spanned"
-version = "1.0.4"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8bbf91e5a4d6315eee45e704372590b30e260ee83af6639d64557f51b067776"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
 dependencies = [
  "serde_core",
 ]
@@ -2252,7 +2424,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1f606421e4a6012877e893c399822a4ed4b089164c5969424e1b9d1e66e6964b"
 dependencies = [
  "digest",
- "generic-array 1.3.5",
+ "generic-array 1.4.1",
 ]
 
 [[package]]
@@ -2268,9 +2440,9 @@ dependencies = [
 
 [[package]]
 name = "sha3"
-version = "0.10.8"
+version = "0.10.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75872d278a8f37ef87fa0ddbda7802605cb18344497949862c0d4dcb291eba60"
+checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
 dependencies = [
  "digest",
  "keccak",
@@ -2294,15 +2466,15 @@ dependencies = [
 
 [[package]]
 name = "simd-adler32"
-version = "0.3.8"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2"
+checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
 
 [[package]]
 name = "siphasher"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2aa850e253778c88a04c3d7323b043aeda9d3e30d5971937c1855769763678e"
+checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
 
 [[package]]
 name = "slab"
@@ -2318,22 +2490,24 @@ checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
 
 [[package]]
 name = "socket2"
-version = "0.5.10"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
+checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
-name = "socket2"
-version = "0.6.2"
+name = "sqlite-wasm-rs"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86f4aa3ad99f2088c990dfa82d367e19cb29268ed67c574d10d0a4bfe71f07e0"
+checksum = "dc3efc0da82635d7e1ced0053bbbfa8c7ab9645d0bf36ceb4f7127bb85315d75"
 dependencies = [
- "libc",
- "windows-sys 0.60.2",
+ "cc",
+ "js-sys",
+ "rsqlite-vfs",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -2344,9 +2518,9 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "string_cache"
-version = "0.8.9"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf776ba3fa74f83bf4b63c3dcbbf82173db2632ed8452cb2d891d33f459de70f"
+checksum = "a18596f8c785a729f2819c0f6a7eae6ebeebdfffbfe4214ae6b087f690e31901"
 dependencies = [
  "new_debug_unreachable",
  "parking_lot",
@@ -2354,6 +2528,12 @@ dependencies = [
  "precomputed-hash",
 ]
 
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -2362,9 +2542,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "2.0.114"
+version = "2.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4d107df263a3013ef9b1879b0df87d706ff80f65a86ea879bd9c31f9b307c2a"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2398,7 +2578,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
 dependencies = [
  "bitflags",
- "core-foundation",
+ "core-foundation 0.9.4",
  "system-configuration-sys",
 ]
 
@@ -2414,12 +2594,12 @@ dependencies = [
 
 [[package]]
 name = "tempfile"
-version = "3.24.0"
+version = "3.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "655da9c7eb6305c55742045d5a8d2037996d61d8de95806335c7c86ce0f82e9c"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "once_cell",
  "rustix",
  "windows-sys 0.61.2",
@@ -2486,9 +2666,9 @@ dependencies = [
 
 [[package]]
 name = "tinystr"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
 dependencies = [
  "displaydoc",
  "zerovec",
@@ -2496,9 +2676,9 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa5fdc3bce6191a1dbc8c02d5c8bffcf557bafa17c124c5264a458f1b0613fa"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
 dependencies = [
  "tinyvec_macros",
 ]
@@ -2511,25 +2691,25 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.49.0"
+version = "1.52.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
+checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
 dependencies = [
  "bytes",
  "libc",
  "mio",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.6.2",
+ "socket2",
  "tokio-macros",
  "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "2.6.0"
+version = "2.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2571,9 +2751,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.9.11+spec-1.1.0"
+version = "0.9.12+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3afc9a848309fe1aaffaed6e1546a7a14de1f935dc9d89d32afd9a44bab7c46"
+checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
 dependencies = [
  "indexmap",
  "serde_core",
@@ -2581,7 +2761,7 @@ dependencies = [
  "toml_datetime",
  "toml_parser",
  "toml_writer",
- "winnow",
+ "winnow 0.7.15",
 ]
 
 [[package]]
@@ -2595,18 +2775,18 @@ dependencies = [
 
 [[package]]
 name = "toml_parser"
-version = "1.0.6+spec-1.1.0"
+version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3198b4b0a8e11f09dd03e133c0280504d0801269e9afa46362ffde1cbeebf44"
+checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
 dependencies = [
- "winnow",
+ "winnow 1.0.3",
 ]
 
 [[package]]
 name = "toml_writer"
-version = "1.0.6+spec-1.1.0"
+version = "1.1.1+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab16f14aed21ee8bfd8ec22513f7287cd4a91aa92e44edfe2c17ddd004e92607"
+checksum = "756daf9b1013ebe47a8776667b466417e2d4c5679d441c26230efd9ef78692db"
 
 [[package]]
 name = "tower"
@@ -2625,20 +2805,20 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.6.8"
+version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
  "bitflags",
  "bytes",
  "futures-util",
  "http",
  "http-body",
- "iri-string",
  "pin-project-lite",
  "tower",
  "tower-layer",
  "tower-service",
+ "url",
 ]
 
 [[package]]
@@ -2701,21 +2881,21 @@ dependencies = [
 
 [[package]]
 name = "typenum"
-version = "1.19.0"
+version = "1.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.22"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.12.0"
+version = "1.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+checksum = "9629274872b2bfaf8d66f5f15725007f635594914870f65218920345aa11aa8c"
 
 [[package]]
 name = "unicode-xid"
@@ -2762,6 +2942,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
 [[package]]
 name = "vcpkg"
 version = "0.2.15"
@@ -2801,18 +2987,27 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasip2"
-version = "1.0.2+wasi-0.2.9"
+version = "1.0.3+wasi-0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
+checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
 dependencies = [
- "wit-bindgen",
+ "wit-bindgen 0.57.1",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen 0.51.0",
 ]
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.108"
+version = "0.2.122"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64024a30ec1e37399cf85a7ffefebdb72205ca1c972291c51512360d90bd8566"
+checksum = "3ed04576f974d2b2fba0f38c51dbc5518011e38c36bf1143164be765528fd409"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -2823,23 +3018,19 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.58"
+version = "0.4.72"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70a6e77fd0ae8029c9ea0063f87c46fde723e7d887703d74ad2616d792e51e6f"
+checksum = "9473dbd2991ae90b6291c3c32c30c6187ac49aa32f9905d1cce280ec1e110b0f"
 dependencies = [
- "cfg-if",
- "futures-util",
  "js-sys",
- "once_cell",
  "wasm-bindgen",
- "web-sys",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.108"
+version = "0.2.122"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "008b239d9c740232e71bd39e8ef6429d27097518b6b30bdf9086833bd5b6d608"
+checksum = "916151b09da36bd82f6615cbf3a419e2f0ba23a03c6160e8e92eb6bd4aa1dec6"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -2847,9 +3038,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.108"
+version = "0.2.122"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5256bae2d58f54820e6490f9839c49780dff84c65aeab9e772f15d5f0e913a55"
+checksum = "299047362ccbfce148b67ab7e73349f77748e00c8296f9542adfad2ad82c5c5e"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -2860,18 +3051,52 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.108"
+version = "0.2.122"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f01b580c9ac74c8d8f0c0e4afb04eeef2acf145458e52c03845ee9cd23e3d12"
+checksum = "9a929b2c61f11ba3e9bc35b50c1f25cb38e0e892c0c231ae2b8cf78d5dad4437"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
-name = "web-sys"
-version = "0.3.85"
+name = "wasm-encoder"
+version = "0.244.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "312e32e551d92129218ea9a2452120f4aabc03529ef03e4d0d82fb2780608598"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.15.5",
+ "indexmap",
+ "semver",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d621441cfc37b84979402712047321980c178f299193a3589d05b99e8763436"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -3011,15 +3236,6 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.5",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.61.2"
@@ -3053,30 +3269,13 @@ dependencies = [
  "windows_aarch64_gnullvm 0.52.6",
  "windows_aarch64_msvc 0.52.6",
  "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
+ "windows_i686_gnullvm",
  "windows_i686_msvc 0.52.6",
  "windows_x86_64_gnu 0.52.6",
  "windows_x86_64_gnullvm 0.52.6",
  "windows_x86_64_msvc 0.52.6",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.53.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
-]
-
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.48.5"
@@ -3089,12 +3288,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.48.5"
@@ -3107,12 +3300,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.48.5"
@@ -3125,24 +3312,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.48.5"
@@ -3155,12 +3330,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.48.5"
@@ -3173,12 +3342,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.48.5"
@@ -3191,12 +3354,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.48.5"
@@ -3210,38 +3367,116 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
+name = "winnow"
+version = "0.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
 
 [[package]]
 name = "winnow"
-version = "0.7.14"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
-
-[[package]]
-name = "winreg"
-version = "0.50.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
-dependencies = [
- "cfg-if",
- "windows-sys 0.48.0",
-]
+checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
 
 [[package]]
 name = "wit-bindgen"
 version = "0.51.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
 
 [[package]]
 name = "writeable"
-version = "0.6.2"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
 
 [[package]]
 name = "xxhash-rust"
@@ -3251,9 +3486,9 @@ checksum = "fdd20c5420375476fbd4394763288da7eb0cc0b8c11deed431a91562af7335d3"
 
 [[package]]
 name = "yoke"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
+checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
 dependencies = [
  "stable_deref_trait",
  "yoke-derive",
@@ -3262,9 +3497,9 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3280,18 +3515,18 @@ checksum = "21bf7b4a78668416e1e8a332334e26fb2f377afe707f0c6feaf6ed5f9100133b"
 
 [[package]]
 name = "zerocopy"
-version = "0.8.39"
+version = "0.8.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db6d35d663eadb6c932438e763b262fe1a70987f9ae936e60158176d710cae4a"
+checksum = "eed437bf9d6692032087e337407a86f04cd8d6a16a37199ed57949d415bd68e9"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.39"
+version = "0.8.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4122cd3169e94605190e77839c9a40d40ed048d305bfdc146e7df40ab0f3e517"
+checksum = "70e3cd084b1788766f53af483dd21f93881ff30d7320490ec3ef7526d203bad4"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3300,18 +3535,18 @@ dependencies = [
 
 [[package]]
 name = "zerofrom"
-version = "0.1.6"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
 dependencies = [
  "zerofrom-derive",
 ]
 
 [[package]]
 name = "zerofrom-derive"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3327,9 +3562,9 @@ checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
 
 [[package]]
 name = "zerotrie"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
 dependencies = [
  "displaydoc",
  "yoke",
@@ -3338,9 +3573,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec"
-version = "0.11.5"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c28719294829477f525be0186d13efa9a3c602f7ec202ca9e353d310fb9a002"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -3349,9 +3584,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.2"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3360,6 +3595,6 @@ dependencies = [
 
 [[package]]
 name = "zmij"
-version = "1.0.19"
+version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ff05f8caa9038894637571ae6b9e29466c1f4f829d26c9b28f869a29cbe3445"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/Cargo.toml b/Cargo.toml
index 2f34943..294b94b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -8,21 +8,23 @@ authors = [ "Malte Meiboom <malte@netropol.de>" ]
 readme = "README.md"
 keywords = ["cryptography", "openpgp", "pgp", "encryption", "email"]
 categories = ["cryptography", "email"]
-rust-version = "1.79"
+rust-version = "1.85"
 
 [dependencies]
+aho-corasick = "1.1.4"
 anyhow = "1.0.100"
 bytes = "1.11.1"
+clap = { version = "4", features = ["derive"] }
 indymilter = "0.3.0"
-log = "0.4.27"
+log = "0.4.30"
 log4rs = "1.3.0"
-sequoia-cert-store = "0.7.1"
+sequoia-cert-store = "0.7.3"
 sequoia-directories = "0.1.0"
-sequoia-net = "0.30.0"
-sequoia-openpgp = "2.1.0"
+sequoia-net = "0.30.1"
+sequoia-openpgp = "2.3.0"
 sequoia-wot = "0.15.0"
 serde = "1.0.228"
 serde_derive = "1.0.228"
 thiserror = "2.0.17"
-tokio = { version = "1.47.1", features = [ "tokio-macros", "rt-multi-thread", "signal" ] }
+tokio = { version = "1.52.3", features = [ "tokio-macros", "rt-multi-thread", "signal" ] }
 toml = "0.9.8"
diff --git a/README.md b/README.md
index 1ef8734..fa95019 100644
--- a/README.md
+++ b/README.md
@@ -8,82 +8,23 @@ Husk is written in Rust and uses Sequoia PGP for encryption and certificate hand
 
 ## Status
 
-Milestone 2 is reached:
+Milestone 3 is reached and with it Husk has aquired a set of new features:
 
-Husk can encrypt passing mails for simple cases, meaning:
+- Online sources (keyservers, WKD, DANE) are now queried for missing
+  certificates.
+- Introducers are now available: certificates are only used if they are
+  certified by an introducer and match its list of configured domains.
+- Locals are available: These are certificates hand picked and added 
+  by the administrator.
 
-- for all recipients of an email, a valid certificate is locally available.
-- if that is not the case, Husk will not modify the email.
-- Husk will not query keyservers (or other sources) for certificates - this is part of milestone 3.
+## Documentation
 
-Please be patient.
+The documentation (with install instructions) can be found [here](https:://www.husk-project.org/documentation).
 
-## Build
-
-Make sure that you have a toolchain for Rust installed. 
-
-Building:
-```
-$ git clone https://gitlab.com/husk-project/husk-milter.git
-$ cd husk-milter
-$ cargo build --release
-```
-
-This creates the binary `./target/release/husk`.
-
-## Installation
-
-To use with `postfix`:
-
-- configure husk, there is an example configuration file in `./config/config.toml`.
-
-    ```
-    #
-    # Husk config file
-    #
-    connection = "localhost:3000"
-
-    logfile_config = "./config/log4rs.yml"
-    ```
-    
-    Husk uses `log4rs` for logging. There is an example configuration in the
-    `./config` subdirectory as well.
-
-- Configure `postfix`:
-    
-    Make sure that the `main.cf` configuration file contains a line like:
-    ```
-    smtpd_milters = inet:localhost:3000
-    ```
-    `smtpd_milters` is used to register milters with postfix, there might be 
-    more than one. The string `inet:localhost:3000` corresponds to the 
-    `connection` setting in `config.toml`.
-
-    You can add the line 
-
-    ```
-    non_smtpd_milters = $smtpd_milters
-    ```
-
-    directly after the line containing `smtpd_milters`, so that local calls to `sendmail` will also invoke `Husk`.
-
-- Start the milter:
-    
-    Assuming you are in the root directory of the project:
-
-    ```
-    $ ./target/release/husk ./config/config.toml
-    ```
-
-- Restart postfix:
-
-    In case you are using systemd:
-    ```
-    # systemctl restart postfix.service
-    ```
-
-- Send a mail and check the logfile.
+## Website
 
+This project has a [website](https:://www.husk-project.org/) with more background
+information.
 
 ## Funding
 
diff --git a/config/config.toml b/config/config.toml
index c2d21ae..9f7f7ec 100644
--- a/config/config.toml
+++ b/config/config.toml
@@ -5,6 +5,25 @@ connection = "localhost:3000"
 
 sequoia_home = "/tmp/sq_home"
 
-logfile_config = "./config/log4rs.yml"
+#keyservers = [ "hkps://keys.openpgp.org/", "hkps://mail-api.proton.me", "hkps://keys.mailvelope.com", "hkps://keyserver.ubuntu.com", "hkps://sks.pod01.fleetstreetops.com" ]
+keyservers = [ "hkp://example.com" ]
+
+[logging.appenders.console]
+kind = "console"
+[logging.appenders.console.encoder]
+pattern = "{d(%Y-%m-%d %H:%M:%S)(local)} {h({l})} [{t}] {m}{n}"
+
+[logging.appenders.file]
+kind = "file"
+path = "/tmp/husk.log"
+
+[logging.appenders.file.encoder]
+pattern = "{d(%Y-%m-%d %H:%M:%S)(local)} {h({l})} [{t}] {m}{n}"
+
+[logging.root]
+level = "debug"
+appenders = ["file"]
+
+[logging.loggers."husk"]
+level = "debug"
 
-keyservers = [ "hkps://keys.openpgp.org/", "hkps://mail-api.proton.me", "hkps://keys.mailvelope.com", "hkps://keyserver.ubuntu.com", "hkps://sks.pod01.fleetstreetops.com" ]
diff --git a/config/log4rs.yml b/config/log4rs.yml
index 9f614a4..64797bb 100644
--- a/config/log4rs.yml
+++ b/config/log4rs.yml
@@ -13,4 +13,4 @@ appenders:
 root:
   level: debug
   appenders:
-    - file_appender
+    - stdout_appender
diff --git a/docker/MTAContainerFile b/docker/MTAContainerFile
index f59b8b2..e4f4e59 100644
--- a/docker/MTAContainerFile
+++ b/docker/MTAContainerFile
@@ -52,10 +52,13 @@ RUN apt-get update -yqq && \
   openssh-client \
   sudo \
   postfix \
+  postfix-pcre \
   rsyslog \
   postgresql \
   openssl \
-  sq
+  sq \
+  bind9-host \
+  inotify-tools
 
 RUN adduser --shell /bin/bash --disabled-password --gecos "" hockeypuck
 
diff --git a/docker/mta_provision/etc/postfix/main.cf b/docker/mta_provision/etc/postfix/main.cf
index d511997..083eb2f 100644
--- a/docker/mta_provision/etc/postfix/main.cf
+++ b/docker/mta_provision/etc/postfix/main.cf
@@ -41,9 +41,9 @@ myhostname = example.com
 myorigin = example.com
 alias_maps = hash:/etc/aliases
 alias_database = hash:/etc/aliases
-mydestination = $myhostname, localhost.localdomain, localhost
+mydestination = $myhostname, localhost.localdomain, localhost, example.com, example.org
 #relayhost = 
-mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.1.0/24
+mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 0.0.0.0/0
 mailbox_size_limit = 0
 recipient_delimiter = +
 inet_interfaces = all
diff --git a/docker/mta_provision/opt/husk/config.toml b/docker/mta_provision/opt/husk/config.toml
index 0f983d9..f37141f 100644
--- a/docker/mta_provision/opt/husk/config.toml
+++ b/docker/mta_provision/opt/husk/config.toml
@@ -4,4 +4,24 @@ sequoia_home = "/tmp/sq_home"
 
 logfile_config = "./log4rs.yml"
 
-keyservers = [ "hkps://example.com" ]
+keyservers = [ "hkp://example.com" ]
+
+[logging.appenders.console]
+kind = "console"
+[logging.appenders.console.encoder]
+pattern = "{d(%Y-%m-%d %H:%M:%S)(local)} {h({l})} [{t}] {m}{n}"
+
+[logging.appenders.file]
+kind = "file"
+path = "/tmp/husk.log"
+
+[logging.appenders.file.encoder]
+pattern = "{d(%Y-%m-%d %H:%M:%S)(local)} {h({l})} [{t}] {m}{n}"
+
+[logging.root]
+level = "debug"
+appenders = ["file"]
+
+[logging.loggers."husk"]
+level = "debug"
+
diff --git a/docker/mta_provision/usr/bin/gen_hockeypuck_conf.sh b/docker/mta_provision/usr/bin/gen_hockeypuck_conf.sh
index fc3dffc..e749c04 100755
--- a/docker/mta_provision/usr/bin/gen_hockeypuck_conf.sh
+++ b/docker/mta_provision/usr/bin/gen_hockeypuck_conf.sh
@@ -35,7 +35,7 @@ webroot="/var/www/"
 bind="$IP:11371"
 
 [hockeypuck.hkps]
-bind="$IP:443"
+bind="$IP:4443"
 logRequestDetails=false
 cert="$CERTS/$DOMAIN.crt"
 key="$CERTS/$DOMAIN.key"
diff --git a/docker/mta_provision/usr/bin/gen_sq_home.sh b/docker/mta_provision/usr/bin/gen_sq_home.sh
index 2791391..bbf18b9 100644
--- a/docker/mta_provision/usr/bin/gen_sq_home.sh
+++ b/docker/mta_provision/usr/bin/gen_sq_home.sh
@@ -24,8 +24,8 @@ sq key export --cert $ALICE_FPR > $TMP/alice_sk.pgp
 sq key export --cert $CA_FPR > $TMP/ca_sk.pgp
 # only certs
 sq cert export --cert $BOB_FPR > $TMP/bob_pk.pgp
-sq network keyserver publish --server hkps://example.com --cert $CAROL_FPR
-sq network keyserver publish --server hkps://example.com --cert $DAVE_FPR
+sq network keyserver publish --server hkp://example.com --cert $CAROL_FPR
+sq network keyserver publish --server hkp://example.com --cert $DAVE_FPR
 
 # create store
 export SEQUOIA_HOME=$SEQUOIA_TARGET
@@ -41,4 +41,3 @@ sq pki link authorize --unconstrained --cert $CA_FPR --all --domain example.com
 # bob@example.com has a local cert, which is certified by ca@example.com
 # carol@example.com is published on a keyserver and certified by ca@example.com
 # dave@example.com is published on a keyserver but uncertified
-
diff --git a/docker/mta_provision/usr/bin/prepare.sh b/docker/mta_provision/usr/bin/prepare.sh
index 26bb6aa..5e4cdfc 100755
--- a/docker/mta_provision/usr/bin/prepare.sh
+++ b/docker/mta_provision/usr/bin/prepare.sh
@@ -3,29 +3,32 @@
 BRANCH=$1
 
 ## create domain
-echo "127.0.0.1 " $(hostname) > /etc/hosts
+echo "127.0.0.1 " $(hostname) >> /etc/hosts
 echo "127.0.0.2 example.com" >> /etc/hosts
+echo "127.0.0.3 example.org" >> /etc/hosts
 
 ## build milter
 if [ -f /opt/husk/mapped/Cargo.toml ] ; then
-  HUSK_BIN=/opt/husk/mapped/target/release/husk
-else 
+  HUSK_BIN=/opt/husk/mapped/target/debug/husk
+  HUSK_DIR=/opt/husk/mapped/
+else
   cd /opt/husk
   git clone https://gitlab.com/husk-project/husk-milter.git
   cd husk-milter
   if [ "$BRANCH" != "" ] ; then
     git checkout $BRANCH
   fi
-  cargo build --release
+  cargo build
 
-  HUSK_BIN=/opt/husk/husk-milter/target/release/husk
+  HUSK_BIN=/opt/husk/husk-milter/target/debug/husk
+  HUSK_DIR=/opt/husk/husk-milter/
 fi
 
 ## start rsyslogd
 /usr/sbin/rsyslogd -n -iNONE &
 
 ## start postfix
-sudo postfix start 
+sudo postfix start
 
 ## start and prepare postgres
 DOMAINS="example.com"
@@ -52,5 +55,14 @@ done
 bash /usr/bin/gen_sq_home.sh
 
 ## start milter
-cd /opt/husk
-$HUSK_BIN config.toml &
+cd $HUSK_DIR/config
+$HUSK_BIN daemon start --config config.toml &
+
+## extract SEQUOIA_HOME from the configuration
+SEQUOIA_HOME=$(grep "sequoia_home" config.toml | cut -d '=' -f 2 | tr -d ' ')
+
+cat << EO_ENV > /tmp/env.sh
+export HUSK_BIN=$HUSK_BIN
+export HUSK_DIR=$HUSK_DIR
+export SEQUOIA_HOME=$SEQUOIA_HOME
+EO_ENV
diff --git a/docker/mta_provision/usr/bin/test_1.sh b/docker/mta_provision/usr/bin/test_1.sh
index d09759a..d7cbfc7 100644
--- a/docker/mta_provision/usr/bin/test_1.sh
+++ b/docker/mta_provision/usr/bin/test_1.sh
@@ -1,19 +1,20 @@
 #!/usr/bin/bash
 
-echo "test message" | sendmail -t root@example.com
+adduser --shell /bin/bash --disabled-password --gecos "" mtatest
+echo "test message" | sendmail -t mtatest@example.com
 sleep 1
 
 ## simple test if mail passes
-if [ -f /var/mail/root ] ; then
+if [ -f /var/mail/mtatest ] ; then
   echo "success"
-  rm /var/mail/root
+  rm /var/mail/mtatest
 else
   echo "failure"
   exit 1
 fi
 
 ## test encryption
-## bob@example.com has an authenticated certificate in 
+## bob@example.com has an authenticated certificate in
 ## the cert store
 echo "test message" | sendmail -t bob@example.com
 sleep 1
diff --git a/e2e-tests/common.sh b/e2e-tests/common.sh
new file mode 100644
index 0000000..113b0aa
--- /dev/null
+++ b/e2e-tests/common.sh
@@ -0,0 +1,72 @@
+#!/usr/bin/bash
+
+# create a unix (shell) user
+create_unix_user() { # name
+  adduser --quiet --shell /bin/bash --disabled-password --gecos "" $1 > /dev/null 2>&1
+}
+
+# delete a unix user, plus remove $HOME and mails
+delete_unix_user() { # name
+  deluser --remove-home $1
+}
+
+# send a mail and wait for delivery
+send_test_mail() { # email_address
+  USER=$(echo $1 | cut -f 1 -d '@')
+  # create an empty mailbox file
+  touch /var/mail/$USER
+  chown $USER:mail /var/mail/$USER
+  chmod 600 /var/mail/$USER
+
+  echo "test mail" | sendmail $1
+  inotifywait -qq -t 3 -e close_write /var/mail/$USER
+}
+
+# test header
+test_header() { # text
+  echo "##############################################"
+  echo $1
+  echo "Workdir: $WORKDIR"
+  echo "##############################################"
+}
+
+# Generate a key outside the cert store. The key will not be
+# authenticated.
+gen_key() { # email
+  FILE=$(echo $1 | cut -f 1 -d '@')
+  FPR=$(sq key generate --home none --shared-key --without-password \
+    --email $1 \
+    --output $WORKDIR/${FILE}_sk.pgp \
+    --rev-cert $WORKDIR/${FILE}.rev |& grep "Fingerprint:" | cut -d ':' -f 2)
+  echo $FPR
+}
+
+expect_mail() { # unix_user mode
+  if [ -f /var/mail/$1 ] ; then
+    case $2 in
+      encrypted)
+        if grep -q "BEGIN PGP MESSAGE" /var/mail/$1 ; then
+          R=0
+        else
+          echo "expected encrypted mail for $1" >&2
+          R=1
+        fi
+        ;;
+      unencrypted)
+        if grep -q "BEGIN PGP MESSAGE" /var/mail/$1 ; then
+          echo "expected unencrypted mail for $1" >&2
+          R=1
+        else
+          R=0
+        fi
+        ;;
+      delivered)
+        R=0
+        ;;
+    esac
+  else
+    echo "no mail for $1" >&2
+    R=1
+  fi
+  echo $R
+}
diff --git a/e2e-tests/local_run.sh b/e2e-tests/local_run.sh
index 59003c5..184f94f 100644
--- a/e2e-tests/local_run.sh
+++ b/e2e-tests/local_run.sh
@@ -1,10 +1,10 @@
 #!/usr/bin/bash
 
-cargo build --release
+cargo build
 
 docker run -ti \
   --rm \
   --mount type=bind,src=$(pwd),dst=/opt/husk/mapped/ \
-  localhost/mta \
-  bash -c "/usr/bin/prepare.sh && bash /opt/husk/mapped/e2e-tests/runner.sh"
+  localhost/mta:latest \
+  bash -c "/usr/bin/prepare.sh && bash /opt/husk/mapped/e2e-tests/runner.sh && bash -i"
 
diff --git a/e2e-tests/runner.sh b/e2e-tests/runner.sh
index 80e251e..5fe2887 100755
--- a/e2e-tests/runner.sh
+++ b/e2e-tests/runner.sh
@@ -1,12 +1,26 @@
 #!/usr/bin/bash
 
+. /tmp/env.sh
+echo "bin:" $HUSK_BIN
+echo "home:" $SEQUOIA_HOME
+
 cd $(dirname $0)
 
 for TEST in ./tests/* ; do
+  # create a new WORKDIR
+  export WORKDIR=$(mktemp -d)
+
   if bash $TEST ; then
-    echo "success"
+    echo "SUCCESS"
   else
-    echo "failure"
-    exit 1 
+    echo "FAILURE"
+
+    # post mortem, leave WORKDIR intact for inspection
+    inotifywait -qq -t 3 -e close_write /tmp/husk.log
+    cat /tmp/husk.log
+    exit 1
   fi
+
+  # remove WORKDIR
+  rm -rf $WORKDIR
 done
diff --git a/e2e-tests/tests/10_basic.sh b/e2e-tests/tests/10_basic.sh
index adadf44..7724c66 100644
--- a/e2e-tests/tests/10_basic.sh
+++ b/e2e-tests/tests/10_basic.sh
@@ -1,18 +1,15 @@
 #!/usr/bin/bash
 
-echo "Basic: Test if MTA is working"
+# source some functions
+. common.sh
 
-adduser --shell /bin/bash --disabled-password --gecos "" mtatest
-echo "test mail" | sendmail mtatest@example.com
+test_header "Basic: Test if MTA is working"
 
-sleep 1
+create_unix_user mtatest
+send_test_mail mtatest@example.com
 
-if [ -f /var/mail/mtatest ] ; then
-  RESULT_CODE=0
-else
-  RESULT_CODE=1 
-fi
+RESULT_CODE=$(expect_mail mtatest delivered)
 
-deluser --remove-home mtatest
+delete_unix_user mtatest
 
 exit $RESULT_CODE
diff --git a/e2e-tests/tests/20_simple_encrypt.sh b/e2e-tests/tests/20_simple_encrypt.sh
index 305b28b..6563d87 100644
--- a/e2e-tests/tests/20_simple_encrypt.sh
+++ b/e2e-tests/tests/20_simple_encrypt.sh
@@ -1,25 +1,16 @@
 #!/usr/bin/bash
 
-echo "Simple: Test encryption for available certificate"
+# source some functions
+. common.sh
+
+test_header "Simple: Test encryption for available certificate"
 
 # There is an authenticated certificate for bob in the cert store
-adduser --shell /bin/bash --disabled-password --gecos "" bob
-echo "test mail" | sendmail bob@example.com
+create_unix_user bob
+send_test_mail bob@example.com
 
-sleep 1
+RESULT_CODE=$(expect_mail bob encrypted)
 
-if [ -f /var/mail/bob ] ; then
-  if grep -q "BEGIN PGP MESSAGE" /var/mail/bob ; then
-    RESULT_CODE=0
-  else
-    echo "no encryption detected"
-    RESULT_CODE=1
-  fi
-else
-  echo "no mail detected"
-  RESULT_CODE=1 
-fi
-
-deluser --remove-home bob
+delete_unix_user bob
 
 exit $RESULT_CODE
diff --git a/e2e-tests/tests/21_simple_not_encrypt.sh b/e2e-tests/tests/21_simple_not_encrypt.sh
index ad38101..0af5a43 100644
--- a/e2e-tests/tests/21_simple_not_encrypt.sh
+++ b/e2e-tests/tests/21_simple_not_encrypt.sh
@@ -1,25 +1,16 @@
 #!/usr/bin/bash
 
-echo "Simple: Test encryption for unavailable certificate"
+# source some functions
+. common.sh
+
+test_header "Simple: Test encryption for unavailable certificate"
 
 # There is no authenticated certificate for alice in the cert store
-adduser --shell /bin/bash --disabled-password --gecos "" alice
-echo "test mail" | sendmail alice@example.com
+create_unix_user alice
+send_test_mail alice@example.com
 
-sleep 1
+RESULT_CODE=$(expect_mail alice unencrypted)
 
-if [ -f /var/mail/alice ] ; then
-  if grep -q "BEGIN PGP MESSAGE" /var/mail/alice ; then
-    echo "encryption detected - that is wrong"
-    RESULT_CODE=1
-  else
-    RESULT_CODE=0
-  fi
-else
-  echo "no mail detected"
-  RESULT_CODE=1 
-fi
-
-deluser --remove-home alice
+delete_unix_user alice
 
 exit $RESULT_CODE
diff --git a/e2e-tests/tests/30_fetch.sh b/e2e-tests/tests/30_fetch.sh
index 85c797e..db6ed44 100644
--- a/e2e-tests/tests/30_fetch.sh
+++ b/e2e-tests/tests/30_fetch.sh
@@ -1,26 +1,17 @@
 #!/usr/bin/bash
 
-echo "Test encryption for certificate an a keyserver"
+# source some functions
+. common.sh
+
+test_header "Test encryption for certificate an a keyserver"
 
 # There is a certificate for carol on the keyserver
 # it's certified by an introducer
-adduser --shell /bin/bash --disabled-password --gecos "" carol
-echo "test mail" | sendmail carol@example.com
+create_unix_user carol
+send_test_mail carol@example.com
 
-sleep 1
+RESULT_CODE=$(expect_mail carol encrypted)
 
-if [ -f /var/mail/carol ] ; then
-  if grep -q "BEGIN PGP MESSAGE" /var/mail/carol ; then
-    RESULT_CODE=0
-  else
-    echo "no encryption detected"
-    RESULT_CODE=1
-  fi
-else
-  echo "no mail detected"
-  RESULT_CODE=1 
-fi
-
-deluser --remove-home carol
+delete_unix_user carol
 
 exit $RESULT_CODE
diff --git a/e2e-tests/tests/40_introducer_create.sh b/e2e-tests/tests/40_introducer_create.sh
new file mode 100644
index 0000000..77234bf
--- /dev/null
+++ b/e2e-tests/tests/40_introducer_create.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/bash
+
+# source some functions
+. common.sh
+
+test_header "Add introducer"
+
+ELLEN_FPR=$(sq key generate --shared-key --without-password --name "Ellen" --email "ellen@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
+
+cd $HUSK_DIR
+$HUSK_BIN introducer add --cert $ELLEN_FPR --domains "example.org" --config config/config.toml
+$HUSK_BIN introducer list --config config/config.toml
+
+create_unix_user fred
+FRED_FPR=$(sq key generate --shared-key --without-password --name "Fred" --email "fred@example.org" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
+sleep 1
+sq pki link retract --cert $FRED_FPR --all
+
+sq pki vouch add --certifier $ELLEN_FPR --cert $FRED_FPR --email "fred@example.org"
+
+send_test_mail fred@example.org
+
+RESULT_CODE=$(expect_mail fred encrypted)
+
+if [ "$RESULT_CODE" == "1" ] ; then
+  exit 1
+fi
+
+test_header "Remove introducer"
+
+$HUSK_BIN introducer remove --cert $ELLEN_FPR --config config/config.toml
+$HUSK_BIN introducer list --config config/config.toml
+
+rm /var/mail/fred
+send_test_mail fred@example.org
+
+RESULT_CODE=$(expect_mail fred unencrypted)
+
+delete_unix_user fred
+
+exit $RESULT_CODE
diff --git a/e2e-tests/tests/41_introducer_load.sh b/e2e-tests/tests/41_introducer_load.sh
new file mode 100644
index 0000000..8e4dabd
--- /dev/null
+++ b/e2e-tests/tests/41_introducer_load.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/bash
+
+# source some functions
+. common.sh
+
+export SEQUOIA_HOME=$(mktemp -d)
+
+test_header "Import introducer from file"
+
+# create ellen
+ELLEN_FPR=$(sq key generate --shared-key --without-password --name "Ellen" --email "ellen@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
+sq cert export --cert $ELLEN_FPR > /tmp/ellen_pk.pgp
+
+cd $HUSK_DIR
+$HUSK_BIN introducer add --cert-file /tmp/ellen_pk.pgp --domains example.org --config config/config.toml
+
+LIST=$($HUSK_BIN introducer list --config config/config.toml)
+
+echo $LIST | grep -q 'ellen@example.com'
diff --git a/e2e-tests/tests/50_locals.sh b/e2e-tests/tests/50_locals.sh
new file mode 100644
index 0000000..9364a5e
--- /dev/null
+++ b/e2e-tests/tests/50_locals.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/bash
+
+# source some functions
+. common.sh
+
+test_header "List locals"
+
+GINA_FPR=$(sq key generate --shared-key --without-password --name "Gina" --email "gina@example.com" 2>&1 | grep "Fingerprint:" | cut -d ':' -f 2)
+
+cd $HUSK_DIR
+$HUSK_BIN locals list --config config/config.toml | grep $GINA_FPR
diff --git a/e2e-tests/tests/51_add_locals.sh b/e2e-tests/tests/51_add_locals.sh
new file mode 100644
index 0000000..738f982
--- /dev/null
+++ b/e2e-tests/tests/51_add_locals.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/bash
+
+# source some functions
+. common.sh
+
+test_header "Add locals"
+
+sq key generate --shared-key --without-password --email 'hubert@example.com' --output /tmp/hubert.pgp --rev-cert /tmp/hubert_rev.pgp
+
+cd $HUSK_DIR
+
+$HUSK_BIN locals add --cert-file /tmp/hubert.pgp --config config/config.toml
+if ! $HUSK_BIN locals list --config config/config.toml | grep -q "hubert@example.com" ; then
+  echo "adding failed"
+  exit 1
+fi
+
+# send a mail, husk should encrypt it
+echo "send mail to hubert@example.com"
+create_unix_user hubert
+send_test_mail hubert@example.com
+
+if [ -f /var/mail/hubert ] ; then
+  if grep -q "BEGIN PGP MESSAGE" /var/mail/hubert ; then
+    RESULT_CODE=0
+  else
+    echo "no encryption detected"
+    delete_unix_user hubert
+    exit 1
+  fi
+  # remove mail
+  rm /var/mail/hubert
+else
+  echo "no mail detected"
+  delete_unix_user hubert
+  exit 1
+fi
+
+sleep 1
+# remove hubert as local
+HUBERT_FPR=$(sq cert list --cert-email hubert@example.com 2>/dev/null | head -n 1 | cut -d ' ' -f 3)
+$HUSK_BIN locals remove --cert $HUBERT_FPR --config config/config.toml
+
+echo "send mail to hubert@example.com"
+send_test_mail hubert@example.com
+
+if [ -f /var/mail/hubert ] ; then
+  if grep -q "BEGIN PGP MESSAGE" /var/mail/hubert ; then
+    echo "encryption detected where there should be none"
+    RESULT_CODE=1
+  else
+    RESULT_CODE=0
+  fi
+else
+  echo "no mail detected"
+  RESULT_CODE=1
+fi
+
+delete_unix_user hubert
+
+exit $RESULT_CODE
+
diff --git a/src/cli/cli_args.rs b/src/cli/cli_args.rs
new file mode 100644
index 0000000..a20d589
--- /dev/null
+++ b/src/cli/cli_args.rs
@@ -0,0 +1,181 @@
+use clap::Parser;
+use clap::Subcommand;
+
+#[derive(Parser, Debug)]
+#[clap(
+    name = "Husk milter",
+    about = "Encrypting milter.",
+    arg_required_else_help = true,
+)]
+pub struct CliArgs {
+    #[clap(
+        long, short,
+        global = true,
+        help = "Configuration file.",
+    )]
+    pub config: Option<String>,
+
+    #[clap(
+        long,
+        global = true,
+        help = "Certification store (SEQUOIA_HOME).",
+    )]
+    pub home: Option<String>,
+
+    #[clap(subcommand)]
+    pub subcommand: HuskSubcommands,
+}
+
+// Subcommands Level 1
+
+#[derive(Debug, Subcommand)]
+pub enum HuskSubcommands {
+    Daemon(DaemonCommand),
+    Introducer(IntroducerCommand),
+    Locals(LocalsCommand),
+}
+
+// Daemon subcommands
+
+#[derive(Parser, Debug)]
+#[clap(
+    name = "daemon",
+    about = "Manage milter daemon.",
+    subcommand_required = true,
+    arg_required_else_help = true,
+    disable_colored_help = true,
+    disable_version_flag = true,
+)]
+pub struct DaemonCommand {
+    #[clap(subcommand)]
+    pub subcommand: DaemonSubcommand,
+}
+#[derive(Debug, Subcommand)]
+pub enum DaemonSubcommand {
+    Start,
+    Stop,
+    Status
+}
+
+// Introducer subcommands
+
+#[derive(Parser, Debug)]
+#[clap(
+    name = "introducer",
+    about = "Manage introducers.",
+    subcommand_required = true,
+    arg_required_else_help = true,
+    disable_colored_help = true,
+    disable_version_flag = true,
+)]
+pub struct IntroducerCommand {
+    #[clap(subcommand)]
+    pub subcommand: IntroducerSubcommand,
+}
+#[derive(Debug, Subcommand)]
+pub enum IntroducerSubcommand {
+    Add(IntroducerAddCommand),
+    Remove(IntroducerRemoveCommand),
+    List
+}
+
+#[derive(Parser, Debug)]
+#[clap(
+    name = "introducer",
+    about = "Add introducers.",
+)]
+pub struct IntroducerAddCommand {
+    #[clap(
+        long = "cert",
+        help = "Certificate to declare as introducer.",
+        conflicts_with = "cert_file"
+    )]
+    pub cert: Option<String>,
+
+    #[clap(
+        long = "cert-file",
+        help = "Import certificate from <FILE> and declare it as introducer.",
+        value_name = "FILE",
+        conflicts_with = "cert"
+    )]
+    pub cert_file: Option<String>,
+
+    #[clap(
+        long = "domains",
+        help = "Domains this certificate introduces.",
+        required = true,
+        num_args = 1..,
+        value_delimiter = ' '
+    )]
+   pub domains: Vec<String>,
+}
+
+#[derive(Parser, Debug)]
+#[clap(
+    name = "introducer",
+    about = "Remove introducers.",
+)]
+pub struct IntroducerRemoveCommand {
+    #[clap(
+        long = "cert",
+        help = "Certificate to be removed as introducer."
+    )]
+    pub cert: String,
+
+    #[clap(
+        long = "demote",
+        help = "Remove introducing capabilities, but keep certificate authenticated.",
+        default_value_t = false,
+    )]
+   pub demote: bool,
+}
+
+// Local subcommands
+
+#[derive(Parser, Debug)]
+#[clap(
+    name = "local",
+    about = "Manage manually added certificates.",
+    subcommand_required = true,
+    arg_required_else_help = true,
+    disable_colored_help = true,
+    disable_version_flag = true,
+)]
+pub struct LocalsCommand {
+    #[clap(subcommand)]
+    pub subcommand: LocalsSubcommand,
+}
+#[derive(Debug, Subcommand)]
+pub enum LocalsSubcommand {
+    Add(LocalsAddCommand),
+    Remove(LocalsRemoveCommand),
+    List
+}
+
+#[derive(Parser, Debug)]
+#[clap(
+    name = "locals_add",
+    about = "Add an authenticated certificate.",
+)]
+pub struct LocalsAddCommand {
+    #[clap(
+        long,
+        help = "Import a certificate from <FILE>.",
+        value_name = "FILE",
+    )]
+    pub cert_file: String,
+}
+
+#[derive(Parser, Debug)]
+#[clap(
+    name = "locals_remove",
+    about = "Disable a Certificate.",
+)]
+pub struct LocalsRemoveCommand {
+    #[clap(
+        long = "cert",
+        help = "Certificate to be removed."
+    )]
+    pub cert: String,
+}
+
diff --git a/src/cli/mod.rs b/src/cli/mod.rs
new file mode 100644
index 0000000..aa6a42c
--- /dev/null
+++ b/src/cli/mod.rs
@@ -0,0 +1 @@
+pub mod cli_args;
diff --git a/src/commands.rs b/src/commands.rs
new file mode 100644
index 0000000..333cafb
--- /dev/null
+++ b/src/commands.rs
@@ -0,0 +1,40 @@
+use anyhow::Result;
+
+use sequoia_openpgp::Fingerprint;
+
+use crate::commands;
+use crate::cli::cli_args::{CliArgs, HuskSubcommands};
+use crate::config::HuskConfigContainer;
+
+pub mod daemon;
+pub mod introducer;
+pub mod locals;
+
+#[derive(thiserror::Error, Debug)]
+pub enum CommandError {
+    #[error("Certificate not found: {0}")]
+    CertNotFound(Fingerprint),
+    #[error("Certificate not usable: {0}")]
+    CertNotUsable(Fingerprint),
+    #[error("Certificate {0} is not alive (is expired or created in the future)")]
+    CertNotAlive(Fingerprint),
+    #[error("Certificate is revoked: {0}")]
+    CertRevoked(Fingerprint),
+}
+
+pub async fn dispatch(cli: CliArgs, config: HuskConfigContainer) -> Result<()> {
+
+    match cli.subcommand {
+        HuskSubcommands::Daemon(subcmd) => {
+            commands::daemon::dispatch(subcmd, config).await?;
+        },
+        HuskSubcommands::Introducer(subcmd) => {
+            commands::introducer::dispatch(subcmd, config).await?;
+        },
+        HuskSubcommands::Locals(subcmd) => {
+            commands::locals::dispatch(subcmd, config).await?;
+        },
+    }
+
+    Ok(())
+}
diff --git a/src/commands/daemon.rs b/src/commands/daemon.rs
new file mode 100644
index 0000000..3405484
--- /dev/null
+++ b/src/commands/daemon.rs
@@ -0,0 +1,21 @@
+use anyhow::Result;
+
+use crate::cli::cli_args::{DaemonCommand, DaemonSubcommand};
+use crate::config::HuskConfigContainer;
+use crate::Daemon;
+
+pub async fn dispatch(cmd: DaemonCommand, config: HuskConfigContainer) -> Result<()> {
+
+    match cmd.subcommand {
+        DaemonSubcommand::Start => {
+            Daemon::run(config).await?;
+        },
+        DaemonSubcommand::Stop => {
+            println!("stop");
+        },
+        DaemonSubcommand::Status => {
+            println!("status");
+        }
+    }
+    Ok(())
+}
diff --git a/src/commands/introducer.rs b/src/commands/introducer.rs
new file mode 100644
index 0000000..927d96c
--- /dev/null
+++ b/src/commands/introducer.rs
@@ -0,0 +1,34 @@
+//! introducer subcommand
+use anyhow::Result;
+
+use crate::cli::cli_args::{IntroducerCommand, IntroducerSubcommand};
+use crate::config::HuskConfigContainer;
+use crate::types::husk_context::HuskContext;
+use crate::common::crypto;
+
+pub mod add;
+pub mod remove;
+
+pub async fn dispatch(cmd: IntroducerCommand, config: HuskConfigContainer) -> Result<()> {
+    match cmd.subcommand {
+        IntroducerSubcommand::Add(add_cmd) => {
+            add::dispatch(add_cmd, config).await?;
+        },
+        IntroducerSubcommand::Remove(rm_cmd) => {
+            remove::dispatch(rm_cmd, config).await?;
+        },
+        IntroducerSubcommand::List => {
+            let context = HuskContext::new(&config.into())?;
+
+            for introducer in crypto::get_introducers(
+                &context.cert_store,
+                &context.policy,
+                context.local_trust_root.fingerprint()) {
+
+                println!("{}", introducer);
+            }
+        },
+    }
+
+    Ok(())
+}
diff --git a/src/commands/introducer/add.rs b/src/commands/introducer/add.rs
new file mode 100644
index 0000000..113b91b
--- /dev/null
+++ b/src/commands/introducer/add.rs
@@ -0,0 +1,58 @@
+//! introducer add subcommand
+
+use anyhow::Result;
+use sequoia_cert_store::Store;
+use sequoia_openpgp::cert::ValidCert;
+use sequoia_openpgp::cert;
+use sequoia_openpgp::parse::Parse;
+use sequoia_openpgp::{Fingerprint, KeyHandle};
+use sequoia_openpgp::types::RevocationStatus;
+
+use crate::cli::cli_args::IntroducerAddCommand;
+use crate::commands::CommandError;
+use crate::common::crypto;
+use crate::config::HuskConfigContainer;
+use crate::types::husk_context::HuskContext;
+use crate::types::introducer::Introducer;
+
+pub async fn dispatch(cmd: IntroducerAddCommand, config: HuskConfigContainer) -> Result<()> {
+    let context = HuskContext::new(&config.into())?;
+    let policy = &context.policy;
+    let cert_store = &context.cert_store;
+
+    if let Some(cert_file) = cmd.cert_file {
+        let c = cert::Cert::from_file(cert_file)?;
+        let vc = c.with_policy(policy, None)?;
+
+        // guards
+        if vc.alive().is_err() {
+            return Err(CommandError::CertNotAlive(vc.fingerprint()).into());
+        }
+        if matches!(vc.revocation_status(), RevocationStatus::Revoked(_)) {
+            return Err(CommandError::CertRevoked(vc.fingerprint()).into());
+        }
+        if !crypto::can_certify(&vc) {
+            return Err(CommandError::CertNotUsable(vc.fingerprint()).into());
+        }
+
+        Introducer::create(&context, &vc, cmd.domains)?;
+    } else if let Some(cert) = cmd.cert {
+        let fpr = Fingerprint::from_hex(cert.as_str())?;
+        let certs = cert_store.lookup_by_cert(&KeyHandle::from(&fpr))
+            .map_err(|_| CommandError::CertNotFound(fpr.clone()))?;
+
+        let certs: Vec<ValidCert> = certs.iter()
+            .filter_map(|c|
+                c.with_policy(policy, None).ok()
+            )
+            .collect();
+
+        if let Some(cert) = certs.first() {
+            Introducer::create(&context, cert, cmd.domains)?;
+        } else {
+            return Err(CommandError::CertNotUsable(fpr).into());
+        }
+    }
+    Ok(())
+}
+
diff --git a/src/commands/introducer/remove.rs b/src/commands/introducer/remove.rs
new file mode 100644
index 0000000..859089a
--- /dev/null
+++ b/src/commands/introducer/remove.rs
@@ -0,0 +1,40 @@
+//! introducer remove subcommand
+
+use anyhow::Result;
+
+use sequoia_openpgp::{Fingerprint, KeyHandle};
+use sequoia_openpgp::cert::ValidCert;
+use sequoia_cert_store::Store;
+
+use crate::cli::cli_args::IntroducerRemoveCommand;
+use crate::commands::CommandError;
+use crate::config::HuskConfigContainer;
+use crate::types::husk_context::HuskContext;
+use crate::types::introducer::Introducer;
+
+pub async fn dispatch(cmd: IntroducerRemoveCommand, config: HuskConfigContainer) -> Result<()> {
+    let context = HuskContext::new(&config.into())?;
+    let policy = &context.policy;
+    let cert_store = &context.cert_store;
+
+    // Get the certificate
+    let fpr = Fingerprint::from_hex(&cmd.cert)?;
+    let certs = cert_store.lookup_by_cert(&KeyHandle::from(&fpr))
+        .map_err(|_| CommandError::CertNotFound(fpr.clone()))?;
+
+    // Filter out valid certificates. If the certificate is not
+    // valid according to the policy, it is already no introducer.
+    let certs: Vec<ValidCert> = certs.iter()
+        .filter_map(|c|
+            c.with_policy(policy, None).ok()
+        )
+        .collect();
+
+    if let Some(cert) = certs.first() {
+        Introducer::remove(&context, cert, cmd.demote)?;
+    } else {
+        return Err(CommandError::CertNotUsable(fpr).into());
+    }
+    Ok(())
+}
+
diff --git a/src/commands/locals.rs b/src/commands/locals.rs
new file mode 100644
index 0000000..dc51ed2
--- /dev/null
+++ b/src/commands/locals.rs
@@ -0,0 +1,36 @@
+//! locals subcommand
+use anyhow::Result;
+
+use crate::cli::cli_args::{LocalsCommand, LocalsSubcommand};
+use crate::common::crypto;
+use crate::config::HuskConfigContainer;
+use crate::types::husk_context::HuskContext;
+
+pub mod add;
+pub mod remove;
+
+pub async fn dispatch(cmd: LocalsCommand, config: HuskConfigContainer) -> Result<()> {
+    match cmd.subcommand {
+        LocalsSubcommand::Add(add_cmd) => {
+            add::dispatch(add_cmd, config).await?;
+        },
+        LocalsSubcommand::Remove(rm_cmd) => {
+            remove::dispatch(rm_cmd, config).await?;
+        },
+        LocalsSubcommand::List => {
+            let context = HuskContext::new(&config.into())?;
+
+            println!("list locals");
+            for local in crypto::get_locals(
+                &context.cert_store,
+                &context.policy,
+                context.local_trust_root.fingerprint()) {
+
+                println!("{}", local);
+            }
+
+        },
+    }
+
+    Ok(())
+}
diff --git a/src/commands/locals/add.rs b/src/commands/locals/add.rs
new file mode 100644
index 0000000..37193f9
--- /dev/null
+++ b/src/commands/locals/add.rs
@@ -0,0 +1,42 @@
+use anyhow::Result;
+
+use sequoia_openpgp::cert;
+use sequoia_openpgp::parse::Parse;
+use sequoia_openpgp::types::RevocationStatus;
+
+use crate::cli::cli_args::LocalsAddCommand;
+use crate::config::HuskConfigContainer;
+use crate::types::husk_context::HuskContext;
+use crate::commands::CommandError;
+use crate::common::crypto;
+
+pub async fn dispatch(cmd: LocalsAddCommand, config: HuskConfigContainer) -> Result<()> {
+    let context = HuskContext::new(&config.into())?;
+    let policy = &context.policy;
+
+    let c = cert::Cert::from_file(cmd.cert_file)?;
+    let vc = c.with_policy(policy, None)?;
+
+    // guards
+    if vc.alive().is_err() {
+        return Err(CommandError::CertNotAlive(vc.fingerprint()).into());
+    }
+    if matches!(vc.revocation_status(), RevocationStatus::Revoked(_)) {
+        return Err(CommandError::CertRevoked(vc.fingerprint()).into());
+    }
+    if !crypto::can_encrypt(&vc) {
+        return Err(CommandError::CertNotUsable(vc.fingerprint()).into());
+    }
+    if vc.fingerprint() == context.local_trust_root.fingerprint() {
+        // XXX: find a better error
+        return Err(CommandError::CertNotUsable(vc.fingerprint()).into());
+    }
+
+    crypto::authenticate(
+        &context,
+        &vc,
+        crypto::Role::Local,
+        true,
+        None
+    )
+}
diff --git a/src/commands/locals/remove.rs b/src/commands/locals/remove.rs
new file mode 100644
index 0000000..85ac4f8
--- /dev/null
+++ b/src/commands/locals/remove.rs
@@ -0,0 +1,50 @@
+//! locals remove subcommand
+
+use anyhow::Result;
+
+use sequoia_openpgp::Fingerprint;
+use sequoia_openpgp::KeyHandle;
+use sequoia_openpgp::cert::ValidCert;
+use sequoia_cert_store::Store;
+
+use crate::cli::cli_args::LocalsRemoveCommand;
+use crate::common::crypto;
+use crate::config::HuskConfigContainer;
+use crate::commands::CommandError;
+use crate::types::husk_context::HuskContext;
+
+pub async fn dispatch(cmd: LocalsRemoveCommand, config: HuskConfigContainer) -> Result<()> {
+    let context = HuskContext::new(&config.into())?;
+    let policy = &context.policy;
+    let cert_store = &context.cert_store;
+
+    // Get the certificate
+    let fpr = Fingerprint::from_hex(&cmd.cert)?;
+    let certs = cert_store.lookup_by_cert(&KeyHandle::from(&fpr))
+        .map_err(|_| CommandError::CertNotFound(fpr.clone()))?;
+
+    // Filter out valid certificates. If the certificate is not
+    // valid according to the policy, it is already no local.
+    let certs: Vec<ValidCert> = certs.iter()
+        .filter_map(|c|
+            c.with_policy(policy, None).ok()
+        )
+        .collect();
+
+    if let Some(cert) = certs.first() {
+        // filter out the trust root
+        if cert.fingerprint() == context.local_trust_root.fingerprint() {
+            return Err(CommandError::CertNotUsable(fpr).into());
+        }
+        crypto::authenticate(
+            &context,
+            cert,
+            crypto::Role::Local,
+            false,
+            None)
+    } else {
+        Err(CommandError::CertNotUsable(fpr).into())
+    }
+}
+
+
diff --git a/src/crypto.rs b/src/common/crypto.rs
similarity index 62%
rename from src/crypto.rs
rename to src/common/crypto.rs
index a1d9824..51e9aa8 100644
--- a/src/crypto.rs
+++ b/src/common/crypto.rs
@@ -1,33 +1,36 @@
-//
-// Husk milter
-//
-// cryptographic functions
-//
+//! cryptographic functions
 
 use std::io::Write;
 use std::sync::Arc;
 use std::time::Duration;
 use std::collections::HashMap;
+use std::collections::HashSet;
 use std::collections::hash_map::Entry::{Occupied, Vacant};
 
 use anyhow;
+use sequoia_openpgp::cert::ValidCert;
 use tokio::task::JoinSet;
 use bytes::Bytes;
 use sequoia_net::{KeyServer, wkd, dane};
+use sequoia_openpgp::packet::prelude::SignatureBuilder;
 use sequoia_openpgp::parse::{PacketParser, PacketParserResult, Parse};
 use sequoia_openpgp::policy::StandardPolicy;
 use sequoia_openpgp::serialize::stream::{Message, Armorer, Encryptor, LiteralWriter};
 use sequoia_openpgp::{Fingerprint, Cert, Packet};
 use sequoia_openpgp::cert::raw::RawCertParser;
+use sequoia_openpgp::types::SignatureType;
 use sequoia_cert_store::{Store, CertStore, LazyCert, StoreUpdate};
-use sequoia_wot::{self as wot};
+use sequoia_cert_store::store::MergePublicCollectStats;
+use sequoia_wot::{self as wot, CertSynopsis};
 use wot::store::Store as _;
 use wot::{Depth, Path};
 
 use crate::types::errors::HuskError;
 use crate::types::husk_context::HuskContext;
-use crate::types::introducer::{self, Introducer};
+use crate::types::introducer::Introducer;
 use crate::types::recipient::Recipient;
+use crate::mail;
+use crate::common::escape;
 
 /// Returns the local trust root from the cert_store. If the trust root
 /// cannot be found, it returns an error.
@@ -46,10 +49,7 @@ pub fn get_local_trust_root(cert_store: &CertStore) -> anyhow::Result<Cert> {
                 Ok(mut parser) => {
                     match parser.next() {
                         Some(Ok(cert)) => {
-                            match Cert::from_bytes(cert.as_bytes()) {
-                                Ok(c) => Some(c),
-                                Err(_) => None,
-                            }
+                            Cert::from_bytes(cert.as_bytes()).ok()
                         },
                         Some(Err(_))
                         | None => None
@@ -72,7 +72,7 @@ pub fn get_local_trust_root(cert_store: &CertStore) -> anyhow::Result<Cert> {
 pub fn get_local_certificates<'hc>(context: &HuskContext<'hc>, email: &str)
     -> Vec<Arc<LazyCert<'hc>>> {
 
-    log::debug!("local lookup for {}", email); 
+    log::debug!("local lookup for {}", email);
 
     let cert_store = &context.cert_store;
     let trust_roots = vec![(context.local_trust_root.fingerprint(), wot::FULLY_TRUSTED)];
@@ -89,9 +89,9 @@ pub fn get_local_certificates<'hc>(context: &HuskContext<'hc>, email: &str)
     for (fpr, some_userid) in bindings {
         if let Some(userid) = some_userid {
             let paths = n.authenticate(userid, &fpr, wot::FULLY_TRUSTED);
-            if paths.len() > 0 {
-                log::debug!("{} authenticated!!!", email);
-                for (path, _) in paths.iter() {
+            for (path, _) in paths.iter() {
+                if path.amount() >= wot::FULLY_TRUSTED {
+                    log::debug!("{} authenticated!!!", email);
                     if let Ok(cert) = cert_store.lookup_by_cert_fpr(&path.target().fingerprint()) {
                         result.push(cert);
                     }
@@ -107,14 +107,14 @@ const USER_AGENT: &'static str = concat!("husk/", env!("CARGO_PKG_VERSION"));
 const CONNECT_TIMEOUT: Duration = Duration::new(5, 0);
 const REQUEST_TIMEOUT: Duration = Duration::new(5, 0);
 
-/// Try to fetch certificates for `email` from online sources (keyservers, wkd, 
-/// dane). 
-pub async fn lookup_certificates<'hc>(context: &HuskContext<'hc>, email: &str) 
+/// Try to fetch certificates for `email` from online sources (keyservers, wkd,
+/// dane).
+pub async fn lookup_certificates<'hc>(context: &HuskContext<'hc>, email: &str)
     -> anyhow::Result<Vec<Cert>> {
 
-    log::debug!("remote lookup for {}", email); 
+    log::debug!("remote lookup for {}", email);
 
-    let mut jobs = JoinSet::new();    
+    let mut jobs = JoinSet::new();
     let http_client = sequoia_net::reqwest::Client::builder()
         .user_agent(USER_AGENT)
         .connect_timeout(CONNECT_TIMEOUT)
@@ -125,55 +125,53 @@ pub async fn lookup_certificates<'hc>(context: &HuskContext<'hc>, email: &str)
     let collect_certs = |certs: Vec<Result<Cert, anyhow::Error>>, email: String, policy: &StandardPolicy| {
         let mut result = Vec::new();
 
-        for cert in certs {
-            if let Ok(c) = cert {
-                if let Ok(vc) = c.with_policy(policy, None) {
-                
-                    // check if the returned certificate contains a userid with the 
-                    // email address in question.
-                    let mut userid_found = false;
-                    for userid in vc.userids() {
-                        if let Ok(Some(u)) = userid.userid().email() {
-                            if u == email {
-                                userid_found = true;
-                            }
+        for cert in certs.into_iter().flatten() {
+            if let Ok(vc) = cert.with_policy(policy, None) {
+
+                // check if the returned certificate contains a userid with the
+                // email address in question.
+                let mut userid_found = false;
+                for userid in vc.userids() {
+                    if let Ok(Some(u)) = userid.userid().email() {
+                        if u == email {
+                            userid_found = true;
                         }
                     }
-               
-                    if userid_found {
-                        // check if the certificate can be used (for encryption).
-                        vc.keys()
-                            .supported()
-                            .alive()
-                            .revoked(false)
-                            .for_transport_encryption()
-                            .for_each(|_| { 
-                                // XXX: cert gets returned for each transport key
-                                // once would be enough
-                                result.push(c.clone()); 
-                            });
-                    }
+                }
+
+                if userid_found {
+                    // check if the certificate can be used (for encryption).
+                    vc.keys()
+                        .supported()
+                        .alive()
+                        .revoked(false)
+                        .for_transport_encryption()
+                        .for_each(|_| {
+                            // XXX: cert gets returned for each transport key
+                            // once would be enough
+                            result.push(cert.clone());
+                        });
                 }
             }
         }
         result
     };
-    
+
     // Keyservers
     for keyserver in &context.keyservers {
 
         log::debug!("querying {}", keyserver);
 
         if let Ok(ks) = KeyServer::with_client(keyserver.as_str(), http_client.clone()) {
-            
+
             let e = email.to_string();
             let p = StandardPolicy::new();
 
-            jobs.spawn(async move { 
+            jobs.spawn(async move {
                 let mut partial_result = Vec::new();
 
                 if let Ok(certs) = ks.search(e.as_str()).await {
-                    partial_result = collect_certs(certs, e, &p);       
+                    partial_result = collect_certs(certs, e, &p);
                 }
                 partial_result
             });
@@ -191,8 +189,8 @@ pub async fn lookup_certificates<'hc>(context: &HuskContext<'hc>, email: &str)
         }
         partial_result
     });
-    
-    // DANE 
+
+    // DANE
     let e = email.to_string();
     let p = StandardPolicy::new();
     jobs.spawn(async move {
@@ -215,13 +213,13 @@ pub async fn lookup_certificates<'hc>(context: &HuskContext<'hc>, email: &str)
             log::debug!("found cert {}", fpr);
 
             match set.entry(fpr.clone()) {
-                Occupied(entry) => { 
+                Occupied(entry) => {
                     let existing_cert = entry.into_mut();
                     if let Ok(merged_cert) = existing_cert.clone().merge_public(c) {
                         *existing_cert = merged_cert;
                     }
                 },
-                Vacant(_entry) => { 
+                Vacant(_entry) => {
                     set.insert(fpr.clone(), c);
                 },
             }
@@ -231,7 +229,7 @@ pub async fn lookup_certificates<'hc>(context: &HuskContext<'hc>, email: &str)
     Ok(result)
 
 }
- 
+
 
 pub async fn get_certificates<'hc>(context: &HuskContext<'hc>, email: &str)
     -> Vec<Arc<LazyCert<'hc>>> {
@@ -239,14 +237,14 @@ pub async fn get_certificates<'hc>(context: &HuskContext<'hc>, email: &str)
     log::debug!("get certificate for {}", email);
 
     let locals = get_local_certificates(context, email);
-    if locals.len() > 0 { 
-        return locals; 
+    if !locals.is_empty() {
+        return locals;
     }
 
     let mut result = Vec::new();
 
     for introducer in &context.introducers {
-        log::debug!("consider introducer {:?}", 
+        log::debug!("consider introducer {:?}",
             introducer.cert.userids().map(|u| u.userid()).collect::<Vec<_>>());
         if introducer.can_introduce(format!("<{}>", email).as_str()) {
             log::debug!("  introducer regex matches!");
@@ -312,6 +310,55 @@ pub fn get_introducers<'c>(cert_store: &CertStore<'c>, policy: &StandardPolicy,
     result
 }
 
+/// Returns all local certificates available in cert_store.
+pub fn get_locals<'c>(cert_store: &CertStore<'c>, policy: &StandardPolicy, local_trust_root: Fingerprint) -> Vec<CertSynopsis> {
+
+    let mut set = HashMap::new();
+    let mut introducers = HashSet::new();
+    let mut targets = Vec::new();
+    let local_root_fpr = local_trust_root.clone();
+
+    let trust_roots = vec![(local_trust_root, wot::FULLY_TRUSTED)];
+    let wot_store = wot::store::CertStore::from_store(cert_store, policy, None);
+    let n = wot::NetworkBuilder::rooted(&wot_store, &*trust_roots)
+        .build();
+
+    n.certified_userids().iter().for_each(|(fpr, user_id)| {
+        let paths = n.authenticate(user_id, fpr, wot::FULLY_TRUSTED);
+
+        paths.iter().for_each(|(path, amount)| {
+            if *amount == wot::FULLY_TRUSTED {
+                if path.residual_depth() == Depth::Limit(0) {
+                    // A leaf, which is not an introducer itself.
+                    targets.push(path.clone());
+                } else {
+                    // Introducer encountered. Do not add the local trust
+                    // root to the introducers HashSet, otherwise all local
+                    // certificates would be viewed as introduced.
+                    if path.target().fingerprint() != local_root_fpr {
+                        introducers.insert(path.target().fingerprint());
+                    }
+                }
+            }
+        });
+    });
+
+    for p in targets {
+        let cert_synopsis = p.target().clone();
+
+        if let Vacant(_) = set.entry(cert_synopsis.fingerprint()) {
+            // Only consider non introduced certificates.
+            if !p.certifications().any(|c|
+                introducers.contains(&c.issuer().fingerprint())) {
+
+                set.insert(cert_synopsis.fingerprint(), cert_synopsis);
+            }
+        }
+    }
+    set.into_values().collect()
+}
+
+
 /// Checks if a message contains the OpenPGP artifacts of an encrypted message.
 pub fn is_encrypted(body: &Bytes) -> bool {
 
@@ -347,7 +394,6 @@ pub fn encrypt(context: &HuskContext<'_>, body: &Bytes, recipients: &Vec<Recipie
 
     let mut keys = Vec::new();
 
-    // XXX: handle the case where a certificate misses an encryption subkey
     for rcpt in recipients {
         if rcpt.can_encrypt() {
             for cert in &rcpt.certs {
@@ -363,7 +409,7 @@ pub fn encrypt(context: &HuskContext<'_>, body: &Bytes, recipients: &Vec<Recipie
             }
         }
     }
-    if keys.len() > 0 {
+    if !keys.is_empty() {
         let mut sink = Vec::new();
         let message = Message::new(&mut sink);
         let message = Armorer::new(message).build()?;
@@ -378,14 +424,149 @@ pub fn encrypt(context: &HuskContext<'_>, body: &Bytes, recipients: &Vec<Recipie
     }
 }
 
+/// Roles for authenticate()
+#[derive(PartialEq)]
+pub enum Role {
+    Local,
+    Introducer,
+}
+
+/// Authenticate a certificate.
+///
+/// If `activate` is true, the certificate becomes an introducer for
+/// `domains`. Passing `None` or an empty list in this case is an error.
+/// If `activate` is false, create a certifiaction with minimal trust_roots
+/// amount and no depth. In this case `domains` is ignored.
+pub fn authenticate(context: &HuskContext, cert: &ValidCert, role: Role, activate: bool, domains: Option<Vec<String>>)
+    -> anyhow::Result<()> {
+
+    let policy = &context.policy;
+    let root_signing_key = match context.local_trust_root.with_policy(policy, None)?
+        .keys()
+        .supported()
+        .alive()
+        .revoked(false)
+        .for_certification()
+        .next() {
+            Some(k) => k.key(),
+            None => {
+                return Err(HuskError::DamagedLocalTrustRoot(
+                    "missing certification capability".to_string())
+                    .into());
+            }
+        };
+    let mut root_signer = root_signing_key
+        .clone()
+        .parts_into_secret()?
+        .into_keypair()?;
+
+    // Create the SignatureBuilder with a default preconfiguration.
+    let mut builder =
+        SignatureBuilder::new(SignatureType::GenericCertification)
+        .set_signature_creation_time(std::time::SystemTime::now())?
+        .set_exportable_certification(false)?
+        .set_revocable(true)?;
+        // set no expiration date
+
+    if activate {
+        // set the trust level and depth for an active local/introducer.
+        if role == Role::Local {
+            builder = builder.set_trust_signature(0, 120)?;
+        } else {
+            // Introducer
+            builder = builder.set_trust_signature(1, 120)?;
+
+            // Add domains
+            if let Some(domains) = domains {
+                if domains.is_empty() {
+                    // An introducer without domains would be unlimited.
+                    return Err(HuskError::UnlimitedIntroducer.into());
+                }
+
+                for domain in domains {
+                    if !mail::is_domain(domain.as_str()) {
+                        return Err(HuskError::InvalidDomainName(domain).into());
+                    }
+
+                    builder = builder.add_regular_expression(format!("<[^>]+[@.]{}>$",
+                        escape::regex_ctrl_escape(domain.as_str())?
+                    ))?;
+                }
+            } else {
+                // An introducer without domains would be unlimited.
+                return Err(HuskError::UnlimitedIntroducer.into());
+            }
+        }
+    } else {
+        // deactive the certificate
+        builder = builder.set_trust_signature(0, 1)?;
+    }
+
+    // For a certification, user ids are needed. Build a list of
+    // valid (non self revoked) user ids.
+    let user_ids: Vec<_> = cert.userids()
+        .filter(|u| {
+            u.self_revocations().count() == 0
+        })
+        .collect();
+
+    if user_ids.is_empty() {
+        return Err(HuskError::NoUserIDs(cert.fingerprint().to_hex()).into());
+    }
+
+    // now certify
+    let signatures: Vec<_> = user_ids.into_iter()
+        .filter_map(|u| {
+            let b = builder.clone();
+
+            b.sign_userid_binding(
+                &mut root_signer,
+                cert.primary_key().key(),
+                u.userid()).ok()
+        })
+        .collect();
+    let (new_cert, _) = cert.cert().clone().insert_packets(signatures)?;
+
+    // and (re)import
+    let new_cert = Arc::new(new_cert.into());
+    let stats = MergePublicCollectStats::new();
+    let cert_store = &context.cert_store;
+    cert_store.update_by(new_cert, &stats)?;
+
+    log::debug!("{:?}", stats);
+
+    // XXX: do something with the created stats
+    Ok(())
+}
+
+/// Returns true if `cert` can be used for certifications.
+pub fn can_certify(cert: &ValidCert) -> bool {
+    cert.keys()
+        .for_certification()
+        .alive()
+        .supported()
+        .revoked(false)
+        .count() > 0
+}
+
+/// Returns true if `cert` can be used for encryption.
+pub fn can_encrypt(cert: &ValidCert) -> bool {
+    cert.keys()
+        .for_transport_encryption()
+        .alive()
+        .supported()
+        .revoked(false)
+        .count() > 0
+}
+
+
 #[cfg(test)]
 pub mod tests {
-   use bytes::Bytes;
 
 #[test]
     pub fn test_is_encrypted() {
 
-        use crate::crypto::is_encrypted;
+        use super::*;
 
         // cleartext
         let body = b"Hello world";
diff --git a/src/common/escape.rs b/src/common/escape.rs
new file mode 100644
index 0000000..6501e51
--- /dev/null
+++ b/src/common/escape.rs
@@ -0,0 +1,75 @@
+//! Functions to escape/unescape control characters
+
+use aho_corasick::AhoCorasick;
+use anyhow::Result;
+
+const REGEX_CONTROL_CHARS: &[&str]
+    = &[ "\\", ".", "|", "(", ")", "*", "+", "?", "^", "$", "[", "]" ];
+const REGEX_ESCAPED_CHARS: &[&str]
+    = &[ "\\\\", "\\.", "\\|", "\\(", "\\)", "\\*", "\\+", "\\?", "\\^", "\\$", "\\[", "\\]" ];
+
+/// Escape characters in `value` which have a special meaning in regular
+/// expressions.
+pub fn regex_ctrl_escape(value: &str) -> Result<String> {
+    let r = AhoCorasick::new(REGEX_CONTROL_CHARS)?;
+    Ok(r.replace_all(value, REGEX_ESCAPED_CHARS))
+}
+
+/// Unescape characters in `value` which have a special meaning in regular
+/// expressions. This is the reverse of `regex_ctrl_escape`.
+pub fn regex_ctrl_unescape(value: &str) -> Result<String> {
+    let r = AhoCorasick::new(REGEX_ESCAPED_CHARS)?;
+    Ok(r.replace_all(value, REGEX_CONTROL_CHARS))
+}
+
+/// Create a regular expression for a domain name, including escaping
+/// control characters.
+pub fn regex_domain_escape(value: &str) -> Result<String> {
+    regex_ctrl_escape(format!("<[^>]+[@.]{}>$", value).as_str())
+}
+
+/// Unescape a regular expression made by `regex_domain_escape`.
+pub fn regex_domain_unescape(value: &str) -> Result<String> {
+    let value = regex_ctrl_unescape(value)?;
+
+    if let Some(stripped) = value.strip_prefix("<[^>]+[@.]") {
+        if let Some(inner) = stripped.strip_suffix(">$") {
+            Ok(inner.into())
+        } else {
+            Ok(value)
+        }
+    } else {
+        Ok(value)
+    }
+}
+
+#[cfg(test)]
+
+pub mod tests {
+
+    use super::*;
+
+    #[test]
+    fn regex_escape_test() -> Result<()> {
+        let original = "(\\.|[.abc])";
+        let escaped = regex_ctrl_escape(original)?;
+        let unescaped = regex_ctrl_unescape(&escaped)?;
+
+        assert_eq!("\\(\\\\\\.\\|\\[\\.abc\\]\\)", escaped);
+        assert_eq!(original, unescaped);
+        Ok(())
+    }
+
+    #[test]
+    fn domain_escape_test() -> Result<()> {
+
+        let domain = "example.com";
+        let escaped_domain = regex_domain_escape(domain)?;
+        let unescaped_domain = regex_domain_unescape(&escaped_domain)?;
+
+        assert_eq!("<\\[\\^>\\]\\+\\[@\\.\\]example\\.com>\\$", escaped_domain);
+        assert_eq!(unescaped_domain, domain);
+
+        Ok(())
+    }
+}
diff --git a/src/common/mod.rs b/src/common/mod.rs
new file mode 100644
index 0000000..b390873
--- /dev/null
+++ b/src/common/mod.rs
@@ -0,0 +1,2 @@
+pub mod crypto;
+pub mod escape;
diff --git a/src/config.rs b/src/config.rs
index 6e4eb0c..46311ba 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -1,48 +1,63 @@
-//
-// Parsing the config file
-//
+//! Parsing the config file
 
 use anyhow;
+
 use std::fs;
 use std::sync::{Arc, Mutex};
 use serde_derive::Deserialize;
+use toml;
+use log4rs;
 
 use crate::types::errors::HuskError;
+use crate::types::defaults::CONSOLE_LOGGING;
 
 #[derive(Deserialize, Debug, Clone)]
 pub struct HuskConfig {
     pub connection: String,
     pub sequoia_home: String,
-    logfile_config: Option<String>,
     pub keyservers: Option<Vec<String>>,
+    logging: Option<toml::Value>,
 }
 
 impl HuskConfig {
 
-    pub fn load(path: &String) -> anyhow::Result<Self> {
+    pub fn load(path: &str, home: Option<String>) -> anyhow::Result<Self> {
         match fs::read_to_string(path) {
             Ok(data) => {
-                match toml::from_str(data.as_str()) {
-                    Ok(configuration) => Ok(configuration),
+                match toml::from_str::<HuskConfig>(data.as_str()) {
+                    Ok(mut configuration) => {
+                        if let Some(home) = home {
+                            configuration.sequoia_home = home;
+                        }
+                        Ok(configuration)
+                    },
                     Err(e) => {
                         Err(HuskError::ConfigFileParseError(e.to_string()).into())
                     }
                 }
             },
             Err(e) => {
-                Err(HuskError::ConfigFileOpenError(e.to_string()).into())
+                Err(HuskError::ConfigFileOpenError(format!(
+                    "{} - {}",
+                    path,
+                    e.to_string())).into())
             }
         }
     }
 
-    pub fn logfile_config(&self) -> String {
-        match &self.logfile_config {
-            Some(c) => c.clone(),
-            None => {
-                eprintln!("Using logging configuration from 'log4rs.yml'");
-                "log4rs.yml".to_string()
-            },
-        }
+    pub fn init_logging(&self) -> anyhow::Result<()> {
+        let config = match toml::to_string(&self.logging) {
+            Ok(c) => c,
+            Err(e) => {
+                eprintln!("use default logging, because {}", e);
+                eprintln!("{:?}", self.logging);
+                CONSOLE_LOGGING.to_string()
+            }
+        };
+        let raw_config = toml::from_str::<log4rs::config::RawConfig>(config.as_str())?;
+        log4rs::init_raw_config(raw_config)?;
+
+        Ok(())
     }
 
     pub fn get_keyservers(&self) -> Vec<String> {
diff --git a/src/daemon/mod.rs b/src/daemon/mod.rs
index 5a94a23..2dd241b 100644
--- a/src/daemon/mod.rs
+++ b/src/daemon/mod.rs
@@ -1,8 +1,4 @@
-//
-// Husk milter
-//
-// the actual daemon
-//
+//! the actual daemon
 
 use anyhow;
 use bytes::Bytes;
@@ -15,19 +11,17 @@ use indymilter::{
     Callbacks,
     Context,
     EomContext,
-    Macros,
     NegotiateContext,
     ProtoOpts,
     SocketInfo,
     Status,
-    Config,
     ContextActions,
 };
 
 use crate::types::husk_context::HuskContext;
 use crate::config::{HuskConfig, HuskConfigContainer};
 use crate::mail;
-use crate::crypto;
+use crate::common::crypto;
 use crate::types::mail_context::ProtectionPossibility;
 
 pub struct Daemon { }
@@ -96,7 +90,7 @@ impl Daemon {
         match HuskContext::new(&config) {
             Ok(context) => {
                 log::debug!("found introducers: {:?}", context.introducers);
-                cx.data = Some(context).take();
+                cx.data = Some(context);
                 Status::Continue
             },
             Err(e) => {
@@ -140,13 +134,12 @@ impl Daemon {
                     break;
                 }
             }
-            if rcpt.is_none() {
-                Status::Tempfail
-            } else {
-                context.add_recipient(rcpt.unwrap()).await;
+            if let Some(rcpt) = rcpt {
+                context.add_recipient(rcpt).await;
                 Status::Continue
+            } else {
+                Status::Tempfail
             }
-
         } else {
             Status::Tempfail
         }
@@ -215,7 +208,7 @@ impl Daemon {
 
             if protection == ProtectionPossibility::Full {
                 // if an error occures the body is not exchanged
-                match crypto::encrypt(&context, &body, &context.mail.recipients) {
+                match crypto::encrypt(context, &body, &context.mail.recipients) {
                     Ok(encrypted) => {
                         if cx.actions.replace_body(&encrypted).await.is_err() {
                             log::error!("Cannot exchange body");
@@ -228,6 +221,7 @@ impl Daemon {
             }
         }
 
+        log::logger().flush();
         Status::Continue
     }
 
@@ -249,8 +243,9 @@ impl Daemon {
         Status::Continue
     }
 
+/*
     fn print_macros(macros: &Macros) {
         println!("  macros: {:?}", macros.to_hash_map());
     }
-
+*/
 }
diff --git a/src/mail.rs b/src/mail.rs
index 96ba6c7..b7b209a 100644
--- a/src/mail.rs
+++ b/src/mail.rs
@@ -1,8 +1,4 @@
-//
-// Husk milter
-//
-// mail functions
-//
+//! mail functions
 
 use std::ffi::CString;
 use sequoia_openpgp::packet::UserID;
@@ -20,3 +16,19 @@ pub fn to_email(rcpt: &CString) -> Option<String> {
        else { None }
     } else { None }
 }
+
+/// Checks if the parameter has a valid email format.
+pub fn is_email(email: &str) -> bool {
+    let uid = UserID::from(email);
+
+    if let Ok(Some(e)) = uid.email() {
+        e == email
+    } else {
+        false
+    }
+}
+
+/// Checks if the parameter has a valid domain format.
+pub fn is_domain(domain: &str) -> bool {
+    is_email(format!("test@{}", domain).as_str())
+}
diff --git a/src/main.rs b/src/main.rs
index 4c0c09e..046a9f9 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1,23 +1,33 @@
-//
-// Husk milter
-//
+//! Husk milter
 
-use std::{env, process};
+use std::process;
 use std::sync::{Arc, Mutex};
 
+use clap::Parser;
+use types::defaults;
+
+pub mod cli;
+use cli::cli_args::CliArgs;
+pub mod commands;
 pub mod config;
 use config::{HuskConfig, HuskConfigContainer};
 pub mod types;
-pub mod crypto;
 pub mod mail;
 pub mod daemon;
 use daemon::Daemon;
+pub mod common;
 
 #[tokio::main]
-async fn main() {
+async fn main() -> anyhow::Result<()> {
+    let args = CliArgs::parse();
 
-    let config_file = env::args().nth(1).expect("config file missing");
-    let husk_config = match HuskConfig::load(&config_file) {
+    let config_file = match &args.config {
+        Some(c) => c.as_str(),
+        None => defaults::CONFIG_FILE_LOCATION
+    };
+
+    // XXX: Improve the way cli parameters are passed into the configuration.
+    let husk_config = match HuskConfig::load(config_file, args.home.clone()) {
         Ok(config) => config,
         Err(e) => {
             eprintln!("{:?}", e);
@@ -25,18 +35,9 @@ async fn main() {
         }
     };
 
-    log4rs::init_file(husk_config.logfile_config(), Default::default()).unwrap();
-
-    log::info!("starting...");
+    husk_config.init_logging()?;
 
     let config_container: HuskConfigContainer = Arc::new(Mutex::new(husk_config));
 
-    match Daemon::run(config_container).await {
-        Ok(_) => {
-            println!("exiting...");
-        },
-        Err(e) => {
-            println!("exit with {:?}", e);
-        }
-    }
+    commands::dispatch(args, config_container).await
 }
diff --git a/src/types/defaults.rs b/src/types/defaults.rs
new file mode 100644
index 0000000..ab955ea
--- /dev/null
+++ b/src/types/defaults.rs
@@ -0,0 +1,24 @@
+//! Defaults
+
+pub const CONFIG_FILE_LOCATION: &'static str = "/etc/husk/config.toml";
+
+/// Default logging configuration.
+pub const CONSOLE_LOGGING: &'static str = "
+[appenders.console]
+kind = \"console\"
+
+[appenders.console.encoder]
+pattern = \"{d(%Y-%m-%d %H:%M:%S)(local)} {h({l})} [{t}] {m}{n}\"
+
+[[appenders.console.filters]]
+kind = \"threshold\"
+level = \"debug\"
+
+[root]
+level = \"info\"
+appenders = [\"console\"]
+
+[loggers.\"husk\"]
+level = \"debug\"
+";
+
diff --git a/src/types/errors.rs b/src/types/errors.rs
index ce92b0b..7ccf040 100644
--- a/src/types/errors.rs
+++ b/src/types/errors.rs
@@ -1,8 +1,4 @@
-//
-// Husk milter
-//
-// Error typ
-//
+//! Husk Error type
 
 use thiserror::Error;
 
@@ -12,12 +8,20 @@ pub enum HuskError {
     ConfigFileOpenError(String),
     #[error("Error while parsing config file: {0}")]
     ConfigFileParseError(String),
-    #[error("Cannot find local trust root")]
+    #[error("Cannot find the local trust root")]
     NoLocalTrustRoot,
+    #[error("The local trust root is damaged - {0}")]
+    DamagedLocalTrustRoot(String),
     #[error("Cannot access cert store")]
     NoCertStore,
     #[error("No encryption keys found")]
     NoEncryptionKeys,
     #[error("Error while looking up email {0}: {1}")]
     KeyLookupError(String, String),
+    #[error("Unlimited introducer")]
+    UnlimitedIntroducer,
+    #[error("Invalid domain name '{0}'")]
+    InvalidDomainName(String),
+    #[error("Certificate has no user ids - {0}")]
+    NoUserIDs(String),
 }
diff --git a/src/types/husk_context.rs b/src/types/husk_context.rs
index b3a7ae6..310a2bc 100644
--- a/src/types/husk_context.rs
+++ b/src/types/husk_context.rs
@@ -1,17 +1,22 @@
-//
-// Husk milter
-//
-// Context
-//
+//! HuskContext
+//!
+//! Keep data in `HuskContext` while processing emails. The HuskContext
+//! lives for a complete session with the MTA. A session might contain
+//! more than one email (the session is reused).
+//!
+//! The context of a single mail is stored in a `MailContext`. The
+//! `HuskContext` has a reference to the `MailContext` of the current
+//! email.
 
 use anyhow;
 use sequoia_openpgp::policy::StandardPolicy;
 use std::path::PathBuf;
 use sequoia_openpgp::Cert;
-use sequoia_cert_store::{CertStore, StoreUpdate};
+use sequoia_cert_store::CertStore;
 use sequoia_directories::Home;
 
-use crate::{config::HuskConfig, crypto};
+use crate::config::HuskConfig;
+use crate::common::crypto;
 use crate::types::mail_context::MailContext;
 
 use crate::types::introducer::Introducer;
@@ -27,7 +32,7 @@ pub struct HuskContext<'hc> {
 
 impl<'hc> HuskContext<'hc> {
 
-    /// Create a new HuskContext instance
+    /// Create a new HuskContext instance.
     pub fn new(config: &HuskConfig) -> anyhow::Result<HuskContext<'hc>> {
 
         let sequoia_home = Home::new(PathBuf::from(&config.sequoia_home))?;
@@ -49,17 +54,22 @@ impl<'hc> HuskContext<'hc> {
         })
     }
 
-    pub fn set_sender(&mut self, sender: String) {
-        self.mail.set_sender(sender);
-    }
-
+    /// If the `HuskContext` is reused for another email, `reset_mail`
+    /// creates the neccessary context for it.
     pub fn reset_mail(&mut self) {
         self.mail = MailContext::new();
     }
 
+    /// Store the sender of an email in the current `MailContext`.
+    pub fn set_sender(&mut self, sender: String) {
+        self.mail.set_sender(sender);
+    }
+
+    /// Add a recipient to the current `MailContext`, try to fetch the
+    /// corresponding certificate(s).
     pub async fn add_recipient(&mut self, rcpt: String) {
-        
-        let certs = crypto::get_certificates(&self, rcpt.as_str()).await;
+
+        let certs = crypto::get_certificates(self, rcpt.as_str()).await;
 
         self.mail.add_recipient(rcpt, certs)
     }
diff --git a/src/types/introducer.rs b/src/types/introducer.rs
index 4c0862f..a0c1a1e 100644
--- a/src/types/introducer.rs
+++ b/src/types/introducer.rs
@@ -1,12 +1,20 @@
-//
-// husk-milter
-//
-// introducers
-//
+//! introducers
+
+use anyhow::Result;
 
 use sequoia_wot as wot;
 use wot::{CertSynopsis, Certification};
-use sequoia_openpgp::{policy::StandardPolicy, Cert, KeyID};
+use sequoia_openpgp::{cert::ValidCert, policy::StandardPolicy};
+use sequoia_openpgp::Cert;
+
+use crate::types::husk_context::HuskContext;
+use crate::common::crypto;
+
+#[derive(thiserror::Error, Debug)]
+pub enum IntroducerError {
+    #[error("Unsuitable certificate")]
+    UnsuitableCertificate,
+}
 
 #[derive(Debug, Clone)]
 pub struct Introducer {
@@ -16,6 +24,10 @@ pub struct Introducer {
 
 impl Introducer {
 
+    /// Can this introducer potentially introduce `email`?
+    ///
+    /// This check matches the email with the list of domains of the
+    /// introducer.
     pub fn can_introduce(&self, email: &str) -> bool {
         if let Some(regexset) = self.certification.regular_expressions() {
             if regexset.matches_everything() {
@@ -30,6 +42,7 @@ impl Introducer {
         }
     }
 
+    /// Has this introducer certified cert?
     pub fn is_introducing(&self, cert: &Cert) -> bool {
 
         let policy = StandardPolicy::new();
@@ -44,7 +57,7 @@ impl Introducer {
                     u.certifications().for_each(|s| {
                         if s.signature_alive(None, None).is_ok() {
                             s.issuers().for_each(|i| {
-                                if i == &my_keyid { result = true; }          
+                                if i == &my_keyid { result = true; }
                             });
                         }
                     })
@@ -53,5 +66,56 @@ impl Introducer {
 
         result
     }
+
+    /// Create an introducer.
+    pub fn create(context: &HuskContext, cert: &ValidCert, domains: Vec<String>)
+        -> Result<()> {
+
+        // Check if the local trust root certificate should be made an
+        // introducer, which would be an error.
+        if cert.fingerprint() == context.local_trust_root.fingerprint() {
+            return Err(IntroducerError::UnsuitableCertificate.into());
+        }
+
+        crypto::authenticate(
+            context,
+            cert,
+            crypto::Role::Introducer,
+            true,
+            Some(domains))
+    }
+
+    /// Remove an introducer.
+    pub fn remove(context: &HuskContext, cert: &ValidCert, _demote: bool)
+        -> Result<()> {
+
+        // Check if the local trust root certificate is used as
+        // introducer, which would be an error.
+        if cert.fingerprint() == context.local_trust_root.fingerprint() {
+            return Err(IntroducerError::UnsuitableCertificate.into());
+        }
+
+        crypto::authenticate(
+            context,
+            cert,
+            crypto::Role::Introducer,
+            false,
+            None)
+    }
+}
+
+use std::fmt::{Display, Formatter};
+impl Display for Introducer {
+
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        // XXX: This is unsafe as ANSI control chars are not handled.
+        let uids = self.cert.userids()
+            .map(|u| String::from_utf8_lossy(u.userid().value()).to_string())
+            .collect::<Vec<String>>()
+            .join(", ");
+        writeln!(f, "Introducer: {}", self.cert.fingerprint())?;
+        writeln!(f, "  UserIDs: {}", uids)?;
+        Ok(())
+    }
 }
 
diff --git a/src/types/mail_context.rs b/src/types/mail_context.rs
index 2e7556a..9f16827 100644
--- a/src/types/mail_context.rs
+++ b/src/types/mail_context.rs
@@ -1,8 +1,7 @@
-//
-// Husk milter
-//
-// Mail Context
-//
+//! Mail Context
+//!
+//! As a mail gets processed by the milter, the `MailContext` is used
+//! to keep the bits and pieces together.
 
 use std::sync::Arc;
 use bytes::{Bytes, BytesMut};
@@ -66,6 +65,13 @@ impl<'mc> MailContext<'mc> {
 
 }
 
+/// Default Mailcontext
+impl<'mc> Default for MailContext<'mc> {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl From<&MailContext<'_>> for ProtectionPossibility {
     fn from(mail_context: &MailContext<'_>) -> ProtectionPossibility {
         let mut can_encrypt = false;
diff --git a/src/types/mod.rs b/src/types/mod.rs
index 16cda95..7d91ab1 100644
--- a/src/types/mod.rs
+++ b/src/types/mod.rs
@@ -1,5 +1,7 @@
+pub mod defaults;
 pub mod husk_context;
 pub mod mail_context;
 pub mod errors;
 pub mod recipient;
 pub mod introducer;
+
diff --git a/src/types/recipient.rs b/src/types/recipient.rs
index 4288b27..b803fac 100644
--- a/src/types/recipient.rs
+++ b/src/types/recipient.rs
@@ -1,8 +1,4 @@
-//
-// Husk milter
-//
-// Recipient
-//
+//! Recipient
 
 use anyhow;
 use std::sync::Arc;
@@ -17,8 +13,8 @@ pub struct Recipient<'r> {
 
 impl From<String> for Recipient<'_> {
     fn from(email: String) -> Self {
-        Recipient { 
-            email: email, 
+        Recipient {
+            email,
             certs: Vec::new()
         }
     }
@@ -40,7 +36,7 @@ impl Recipient<'_> {
     /// check if this Recipient can encrypt.
     // XXX: currently this check is naive
     pub fn can_encrypt(&self) -> bool {
-        if self.certs.len() == 0 { 
+        if self.certs.is_empty() {
             return false;
         }