diff --git a/.cargo/config.toml b/.cargo/config.toml
new file mode 100644
index 0000000..bff29e6
--- /dev/null
+++ b/.cargo/config.toml
@@ -0,0 +1,2 @@
+[build]
+rustflags = ["--cfg", "tokio_unstable"]
diff --git a/.editorconfig b/.editorconfig
new file mode 100644
index 0000000..d17805f
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,3 @@
+[*.nix]
+indent_size = 2
+indent_stype = space
diff --git a/Cargo.lock b/Cargo.lock
index aee2282..2a630e0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -27,10 +27,19 @@ dependencies = [
 ]
 
 [[package]]
-name = "allocator-api2"
-version = "0.2.21"
+name = "android-tzdata"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
 
 [[package]]
 name = "anstream"
@@ -102,6 +111,39 @@ dependencies = [
  "zstd-safe",
 ]
 
+[[package]]
+name = "async-stream"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b5a71a6f37880a80d1d7f19efd781e4b5de42c88f0722cc13bcb6cc2cfe8476"
+dependencies = [
+ "async-stream-impl",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream-impl"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "async-trait"
+version = "0.1.88"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e539d3fca749fcee5236ab05e93a52867dd549cc157c8cb7f99595f3cedffdb5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "atomic-waker"
 version = "1.1.2"
@@ -115,442 +157,50 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
 
 [[package]]
-name = "aws-config"
-version = "1.6.1"
+name = "axum"
+version = "0.7.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c39646d1a6b51240a1a23bb57ea4eebede7e16fbc237fdc876980233dcecb4f"
+checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
 dependencies = [
- "aws-credential-types",
- "aws-runtime",
- "aws-sdk-sso",
- "aws-sdk-ssooidc",
- "aws-sdk-sts",
- "aws-smithy-async",
- "aws-smithy-http",
- "aws-smithy-json",
- "aws-smithy-runtime",
- "aws-smithy-runtime-api",
- "aws-smithy-types",
- "aws-types",
+ "async-trait",
+ "axum-core",
  "bytes",
- "fastrand",
- "hex",
- "http 1.3.1",
- "ring",
- "time",
- "tokio",
- "tracing",
- "url",
- "zeroize",
-]
-
-[[package]]
-name = "aws-credential-types"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4471bef4c22a06d2c7a1b6492493d3fdf24a805323109d6874f9c94d5906ac14"
-dependencies = [
- "aws-smithy-async",
- "aws-smithy-runtime-api",
- "aws-smithy-types",
- "zeroize",
-]
-
-[[package]]
-name = "aws-lc-rs"
-version = "1.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19b756939cb2f8dc900aa6dcd505e6e2428e9cae7ff7b028c49e3946efa70878"
-dependencies = [
- "aws-lc-sys",
- "zeroize",
-]
-
-[[package]]
-name = "aws-lc-sys"
-version = "0.28.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9f7720b74ed28ca77f90769a71fd8c637a0137f6fae4ae947e1050229cff57f"
-dependencies = [
- "bindgen",
- "cc",
- "cmake",
- "dunce",
- "fs_extra",
-]
-
-[[package]]
-name = "aws-runtime"
-version = "1.5.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0aff45ffe35196e593ea3b9dd65b320e51e2dda95aff4390bc459e461d09c6ad"
-dependencies = [
- "aws-credential-types",
- "aws-sigv4",
- "aws-smithy-async",
- "aws-smithy-eventstream",
- "aws-smithy-http",
- "aws-smithy-runtime",
- "aws-smithy-runtime-api",
- "aws-smithy-types",
- "aws-types",
- "bytes",
- "fastrand",
- "http 0.2.12",
- "http-body 0.4.6",
- "once_cell",
- "percent-encoding",
- "pin-project-lite",
- "tracing",
- "uuid",
-]
-
-[[package]]
-name = "aws-sdk-s3"
-version = "1.82.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6eab2900764411ab01c8e91a76fd11a63b4e12bc3da97d9e14a0ce1343d86d3"
-dependencies = [
- "aws-credential-types",
- "aws-runtime",
- "aws-sigv4",
- "aws-smithy-async",
- "aws-smithy-checksums",
- "aws-smithy-eventstream",
- "aws-smithy-http",
- "aws-smithy-json",
- "aws-smithy-runtime",
- "aws-smithy-runtime-api",
- "aws-smithy-types",
- "aws-smithy-xml",
- "aws-types",
- "bytes",
- "fastrand",
- "hex",
- "hmac",
- "http 0.2.12",
- "http 1.3.1",
- "http-body 0.4.6",
- "lru",
- "once_cell",
- "percent-encoding",
- "regex-lite",
- "sha2",
- "tracing",
- "url",
-]
-
-[[package]]
-name = "aws-sdk-sso"
-version = "1.64.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02d4bdb0e5f80f0689e61c77ab678b2b9304af329616af38aef5b6b967b8e736"
-dependencies = [
- "aws-credential-types",
- "aws-runtime",
- "aws-smithy-async",
- "aws-smithy-http",
- "aws-smithy-json",
- "aws-smithy-runtime",
- "aws-smithy-runtime-api",
- "aws-smithy-types",
- "aws-types",
- "bytes",
- "fastrand",
- "http 0.2.12",
- "once_cell",
- "regex-lite",
- "tracing",
-]
-
-[[package]]
-name = "aws-sdk-ssooidc"
-version = "1.65.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acbbb3ce8da257aedbccdcb1aadafbbb6a5fe9adf445db0e1ea897bdc7e22d08"
-dependencies = [
- "aws-credential-types",
- "aws-runtime",
- "aws-smithy-async",
- "aws-smithy-http",
- "aws-smithy-json",
- "aws-smithy-runtime",
- "aws-smithy-runtime-api",
- "aws-smithy-types",
- "aws-types",
- "bytes",
- "fastrand",
- "http 0.2.12",
- "once_cell",
- "regex-lite",
- "tracing",
-]
-
-[[package]]
-name = "aws-sdk-sts"
-version = "1.65.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96a78a8f50a1630db757b60f679c8226a8a70ee2ab5f5e6e51dc67f6c61c7cfd"
-dependencies = [
- "aws-credential-types",
- "aws-runtime",
- "aws-smithy-async",
- "aws-smithy-http",
- "aws-smithy-json",
- "aws-smithy-query",
- "aws-smithy-runtime",
- "aws-smithy-runtime-api",
- "aws-smithy-types",
- "aws-smithy-xml",
- "aws-types",
- "fastrand",
- "http 0.2.12",
- "once_cell",
- "regex-lite",
- "tracing",
-]
-
-[[package]]
-name = "aws-sigv4"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69d03c3c05ff80d54ff860fe38c726f6f494c639ae975203a101335f223386db"
-dependencies = [
- "aws-credential-types",
- "aws-smithy-eventstream",
- "aws-smithy-http",
- "aws-smithy-runtime-api",
- "aws-smithy-types",
- "bytes",
- "crypto-bigint 0.5.5",
- "form_urlencoded",
- "hex",
- "hmac",
- "http 0.2.12",
- "http 1.3.1",
- "once_cell",
- "p256",
- "percent-encoding",
- "ring",
- "sha2",
- "subtle",
- "time",
- "tracing",
- "zeroize",
-]
-
-[[package]]
-name = "aws-smithy-async"
-version = "1.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e190749ea56f8c42bf15dd76c65e14f8f765233e6df9b0506d9d934ebef867c"
-dependencies = [
  "futures-util",
- "pin-project-lite",
- "tokio",
-]
-
-[[package]]
-name = "aws-smithy-checksums"
-version = "0.63.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b65d21e1ba6f2cdec92044f904356a19f5ad86961acf015741106cdfafd747c0"
-dependencies = [
- "aws-smithy-http",
- "aws-smithy-types",
- "bytes",
- "crc32c",
- "crc32fast",
- "crc64fast-nvme",
- "hex",
- "http 0.2.12",
- "http-body 0.4.6",
- "md-5",
- "pin-project-lite",
- "sha1",
- "sha2",
- "tracing",
-]
-
-[[package]]
-name = "aws-smithy-eventstream"
-version = "0.60.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c45d3dddac16c5c59d553ece225a88870cf81b7b813c9cc17b78cf4685eac7a"
-dependencies = [
- "aws-smithy-types",
- "bytes",
- "crc32fast",
-]
-
-[[package]]
-name = "aws-smithy-http"
-version = "0.62.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5949124d11e538ca21142d1fba61ab0a2a2c1bc3ed323cdb3e4b878bfb83166"
-dependencies = [
- "aws-smithy-eventstream",
- "aws-smithy-runtime-api",
- "aws-smithy-types",
- "bytes",
- "bytes-utils",
- "futures-core",
- "http 0.2.12",
- "http 1.3.1",
- "http-body 0.4.6",
- "once_cell",
- "percent-encoding",
- "pin-project-lite",
- "pin-utils",
- "tracing",
-]
-
-[[package]]
-name = "aws-smithy-http-client"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8aff1159006441d02e57204bf57a1b890ba68bedb6904ffd2873c1c4c11c546b"
-dependencies = [
- "aws-smithy-async",
- "aws-smithy-runtime-api",
- "aws-smithy-types",
- "h2 0.4.9",
- "http 0.2.12",
- "http 1.3.1",
- "http-body 0.4.6",
- "hyper 0.14.32",
- "hyper 1.6.0",
- "hyper-rustls 0.24.2",
- "hyper-rustls 0.27.5",
- "hyper-util",
- "pin-project-lite",
- "rustls 0.21.12",
- "rustls 0.23.26",
- "rustls-native-certs 0.8.1",
- "rustls-pki-types",
- "tokio",
- "tower",
- "tracing",
-]
-
-[[package]]
-name = "aws-smithy-json"
-version = "0.61.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92144e45819cae7dc62af23eac5a038a58aa544432d2102609654376a900bd07"
-dependencies = [
- "aws-smithy-types",
-]
-
-[[package]]
-name = "aws-smithy-observability"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "445d065e76bc1ef54963db400319f1dd3ebb3e0a74af20f7f7630625b0cc7cc0"
-dependencies = [
- "aws-smithy-runtime-api",
- "once_cell",
-]
-
-[[package]]
-name = "aws-smithy-query"
-version = "0.60.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2fbd61ceb3fe8a1cb7352e42689cec5335833cd9f94103a61e98f9bb61c64bb"
-dependencies = [
- "aws-smithy-types",
- "urlencoding",
-]
-
-[[package]]
-name = "aws-smithy-runtime"
-version = "1.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0152749e17ce4d1b47c7747bdfec09dac1ccafdcbc741ebf9daa2a373356730f"
-dependencies = [
- "aws-smithy-async",
- "aws-smithy-http",
- "aws-smithy-http-client",
- "aws-smithy-observability",
- "aws-smithy-runtime-api",
- "aws-smithy-types",
- "bytes",
- "fastrand",
- "http 0.2.12",
- "http 1.3.1",
- "http-body 0.4.6",
- "http-body 1.0.1",
- "once_cell",
- "pin-project-lite",
- "pin-utils",
- "tokio",
- "tracing",
-]
-
-[[package]]
-name = "aws-smithy-runtime-api"
-version = "1.7.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3da37cf5d57011cb1753456518ec76e31691f1f474b73934a284eb2a1c76510f"
-dependencies = [
- "aws-smithy-async",
- "aws-smithy-types",
- "bytes",
- "http 0.2.12",
- "http 1.3.1",
- "pin-project-lite",
- "tokio",
- "tracing",
- "zeroize",
-]
-
-[[package]]
-name = "aws-smithy-types"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "836155caafba616c0ff9b07944324785de2ab016141c3550bd1c07882f8cee8f"
-dependencies = [
- "base64-simd",
- "bytes",
- "bytes-utils",
- "futures-core",
- "http 0.2.12",
- "http 1.3.1",
- "http-body 0.4.6",
- "http-body 1.0.1",
+ "http",
+ "http-body",
  "http-body-util",
  "itoa",
- "num-integer",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
  "pin-project-lite",
- "pin-utils",
- "ryu",
+ "rustversion",
  "serde",
- "time",
- "tokio",
- "tokio-util",
+ "sync_wrapper",
+ "tower 0.5.2",
+ "tower-layer",
+ "tower-service",
 ]
 
 [[package]]
-name = "aws-smithy-xml"
-version = "0.60.9"
+name = "axum-core"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab0b0166827aa700d3dc519f72f8b3a91c35d0b8d042dc5d643a91e6f80648fc"
+checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
 dependencies = [
- "xmlparser",
-]
-
-[[package]]
-name = "aws-types"
-version = "1.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3873f8deed8927ce8d04487630dc9ff73193bab64742a61d050e57a68dec4125"
-dependencies = [
- "aws-credential-types",
- "aws-smithy-async",
- "aws-smithy-runtime-api",
- "aws-smithy-types",
- "rustc_version",
- "tracing",
+ "async-trait",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "rustversion",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
 ]
 
 [[package]]
@@ -568,12 +218,6 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
-[[package]]
-name = "base16ct"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "349a06037c7bf932dd7e7d1f653678b2038b9ad46a74102f1fc7bd7872678cce"
-
 [[package]]
 name = "base64"
 version = "0.21.7"
@@ -586,45 +230,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
-[[package]]
-name = "base64-simd"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "339abbe78e73178762e23bea9dfd08e697eb3f3301cd4be981c0f78ba5859195"
-dependencies = [
- "outref",
- "vsimd",
-]
-
 [[package]]
 name = "base64ct"
 version = "1.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "89e25b6adfb930f02d1981565a6e5d9c547ac15a96606256d3b59040e5cd4ca3"
 
-[[package]]
-name = "bindgen"
-version = "0.69.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "271383c67ccabffb7381723dea0672a673f292304fcb45c01cc648c7a8d58088"
-dependencies = [
- "bitflags",
- "cexpr",
- "clang-sys",
- "itertools",
- "lazy_static",
- "lazycell",
- "log",
- "prettyplease",
- "proc-macro2",
- "quote",
- "regex",
- "rustc-hash",
- "shlex",
- "syn",
- "which",
-]
-
 [[package]]
 name = "bitflags"
 version = "2.9.0"
@@ -657,22 +268,18 @@ version = "3.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1628fb46dfa0b37568d12e5edd512553eccf6a22a78e8bde00bb4aed84d5bdbf"
 
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
 [[package]]
 name = "bytes"
 version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 
-[[package]]
-name = "bytes-utils"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dafe3a8757b027e2be6e4e5601ed563c55989fcf1546e933c66c8eb3a058d35"
-dependencies = [
- "bytes",
- "either",
-]
-
 [[package]]
 name = "cc"
 version = "1.2.19"
@@ -684,15 +291,6 @@ dependencies = [
  "shlex",
 ]
 
-[[package]]
-name = "cexpr"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
-dependencies = [
- "nom 7.1.3",
-]
-
 [[package]]
 name = "cfg-if"
 version = "1.0.0"
@@ -700,14 +298,22 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
-name = "clang-sys"
-version = "1.8.1"
+name = "cfg_aliases"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
+[[package]]
+name = "chrono"
+version = "0.4.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a7964611d71df112cb1730f2ee67324fcf4d0fc6606acbbe9bfe06df124637c"
 dependencies = [
- "glob",
- "libc",
- "libloading",
+ "android-tzdata",
+ "iana-time-zone",
+ "num-traits",
+ "serde",
+ "windows-link",
 ]
 
 [[package]]
@@ -751,12 +357,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"
 
 [[package]]
-name = "cmake"
-version = "0.1.54"
+name = "codespan-reporting"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7caa3f9de89ddbe2c607f4101924c5abec803763ae9534e4f4d7d8f84aa81f0"
+checksum = "fe6d2e5af09e8c8ad56c969f2157a3d4238cebc7c55f0a517728c38f7b200f81"
 dependencies = [
- "cc",
+ "serde",
+ "termcolor",
+ "unicode-width",
 ]
 
 [[package]]
@@ -765,6 +373,45 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
 
+[[package]]
+name = "console-api"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8030735ecb0d128428b64cd379809817e620a40e5001c54465b99ec5feec2857"
+dependencies = [
+ "futures-core",
+ "prost",
+ "prost-types",
+ "tonic",
+ "tracing-core",
+]
+
+[[package]]
+name = "console-subscriber"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6539aa9c6a4cd31f4b1c040f860a1eac9aa80e7df6b05d506a6e7179936d6a01"
+dependencies = [
+ "console-api",
+ "crossbeam-channel",
+ "crossbeam-utils",
+ "futures-task",
+ "hdrhistogram",
+ "humantime",
+ "hyper-util",
+ "prost",
+ "prost-types",
+ "serde",
+ "serde_json",
+ "thread_local",
+ "tokio",
+ "tokio-stream",
+ "tonic",
+ "tracing",
+ "tracing-core",
+ "tracing-subscriber",
+]
+
 [[package]]
 name = "const-oid"
 version = "0.9.6"
@@ -806,30 +453,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "crc"
-version = "3.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69e6e4d7b33a94f0991c26729976b10ebde1d34c3ee82408fb536164fa10d636"
-dependencies = [
- "crc-catalog",
-]
-
-[[package]]
-name = "crc-catalog"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19d374276b40fb8bbdee95aef7c7fa6b5316ec764510eb64b8dd0e2ed0d7e7f5"
-
-[[package]]
-name = "crc32c"
-version = "0.6.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a47af21622d091a8f0fb295b88bc886ac74efcc613efc19f5d0b21de5c89e47"
-dependencies = [
- "rustc_version",
-]
-
 [[package]]
 name = "crc32fast"
 version = "1.4.2"
@@ -840,35 +463,19 @@ dependencies = [
 ]
 
 [[package]]
-name = "crc64fast-nvme"
-version = "1.2.0"
+name = "crossbeam-channel"
+version = "0.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4955638f00a809894c947f85a024020a20815b65a5eea633798ea7924edab2b3"
+checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
 dependencies = [
- "crc",
+ "crossbeam-utils",
 ]
 
 [[package]]
-name = "crypto-bigint"
-version = "0.4.9"
+name = "crossbeam-utils"
+version = "0.8.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef2b4b23cddf68b89b8f8069890e8c270d54e2d5fe1b143820234805e4cb17ef"
-dependencies = [
- "generic-array",
- "rand_core",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "crypto-bigint"
-version = "0.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
-dependencies = [
- "rand_core",
- "subtle",
-]
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
 [[package]]
 name = "crypto-common"
@@ -907,22 +514,71 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "cxx"
+version = "1.0.157"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d6354e975ea4ec28033ec3a36fa9baa1a02e3eb22ad740eeb4929370d4f5ba8"
+dependencies = [
+ "cc",
+ "cxxbridge-cmd",
+ "cxxbridge-flags",
+ "cxxbridge-macro",
+ "foldhash",
+ "link-cplusplus",
+]
+
+[[package]]
+name = "cxx-build"
+version = "1.0.157"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b4400e26ea4b99417e4263b1ce2d8452404d750ba0809a7bd043072593d430d"
+dependencies = [
+ "cc",
+ "codespan-reporting",
+ "proc-macro2",
+ "quote",
+ "scratch",
+ "syn",
+]
+
+[[package]]
+name = "cxxbridge-cmd"
+version = "1.0.157"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31860c98f69fc14da5742c5deaf78983e846c7b27804ca8c8319e32eef421bde"
+dependencies = [
+ "clap",
+ "codespan-reporting",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "cxxbridge-flags"
+version = "1.0.157"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0402a66013f3b8d3d9f2d7c9994656cc81e671054822b0728d7454d9231892f"
+
+[[package]]
+name = "cxxbridge-macro"
+version = "1.0.157"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64c0b38f32d68f3324a981645ee39b2d686af36d03c98a386df3716108c9feae"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustversion",
+ "syn",
+]
+
 [[package]]
 name = "data-encoding"
 version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
 
-[[package]]
-name = "der"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1a467a65c5e759bce6e65eaf91cc29f466cdc57cb65777bd646872a8a1fd4de"
-dependencies = [
- "const-oid",
- "zeroize",
-]
-
 [[package]]
 name = "der"
 version = "0.7.9"
@@ -933,15 +589,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "deranged"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c9e6a11ca8224451684bc0d7d5a7adbf8f2fd6887261a1cfc3c0432f9d4068e"
-dependencies = [
- "powerfmt",
-]
-
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -950,7 +597,6 @@ checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer",
  "crypto-common",
- "subtle",
 ]
 
 [[package]]
@@ -964,32 +610,14 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "dunce"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
-
-[[package]]
-name = "ecdsa"
-version = "0.14.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "413301934810f597c1d19ca71c8710e99a3f1ba28a0d2ebc01551a2daeea3c5c"
-dependencies = [
- "der 0.6.1",
- "elliptic-curve",
- "rfc6979",
- "signature 1.6.4",
-]
-
 [[package]]
 name = "ed25519"
 version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
- "pkcs8 0.10.2",
- "signature 2.2.0",
+ "pkcs8",
+ "signature",
 ]
 
 [[package]]
@@ -1012,26 +640,6 @@ version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
 
-[[package]]
-name = "elliptic-curve"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7bb888ab5300a19b8e5bceef25ac745ad065f3c9f7efc6de1b91958110891d3"
-dependencies = [
- "base16ct",
- "crypto-bigint 0.4.9",
- "der 0.6.1",
- "digest",
- "ff",
- "generic-array",
- "group",
- "pkcs8 0.9.0",
- "rand_core",
- "sec1",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "encoding_rs"
 version = "0.8.35"
@@ -1074,22 +682,22 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
 
-[[package]]
-name = "ff"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d013fc25338cc558c5c2cfbad646908fb23591e2404481826742b651c9af7160"
-dependencies = [
- "rand_core",
- "subtle",
-]
-
 [[package]]
 name = "fiat-crypto"
 version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
+[[package]]
+name = "flate2"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ced92e76e966ca2fd84c8f7aa01a4aea65b0eb6648d72f7c8f3e2764a67fece"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
 [[package]]
 name = "fnv"
 version = "1.0.7"
@@ -1126,12 +734,6 @@ dependencies = [
  "percent-encoding",
 ]
 
-[[package]]
-name = "fs_extra"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
-
 [[package]]
 name = "futures"
 version = "0.3.31"
@@ -1238,8 +840,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -1249,9 +853,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73fea8450eea4bac3940448fb7ae50d91f034f941199fcd9d909a5a07aa455f0"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi",
  "wasi 0.14.2+wasi-0.2.4",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -1266,36 +872,6 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
 
-[[package]]
-name = "group"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dfbfb3a6cfbd390d5c9564ab283a0349b9b9fcd46a706c1eb10e0db70bfbac7"
-dependencies = [
- "ff",
- "rand_core",
- "subtle",
-]
-
-[[package]]
-name = "h2"
-version = "0.3.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81fe527a889e1532da5c525686d96d4c2e74cdd345badf8dfef9f6b39dd5f5e8"
-dependencies = [
- "bytes",
- "fnv",
- "futures-core",
- "futures-sink",
- "futures-util",
- "http 0.2.12",
- "indexmap",
- "slab",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
 [[package]]
 name = "h2"
 version = "0.4.9"
@@ -1307,23 +883,37 @@ dependencies = [
  "fnv",
  "futures-core",
  "futures-sink",
- "http 1.3.1",
- "indexmap",
+ "http",
+ "indexmap 2.9.0",
  "slab",
  "tokio",
  "tokio-util",
  "tracing",
 ]
 
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
 [[package]]
 name = "hashbrown"
 version = "0.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bf151400ff0baff5465007dd2f3e717f3fe502074ca563069ce3a6629d07b289"
+
+[[package]]
+name = "hdrhistogram"
+version = "7.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "765c9198f173dd59ce26ff9f95ef0aafd0a0fe01fb9d72841bc5066a4c06511d"
 dependencies = [
- "allocator-api2",
- "equivalent",
- "foldhash",
+ "base64 0.21.7",
+ "byteorder",
+ "flate2",
+ "nom 7.1.3",
+ "num-traits",
 ]
 
 [[package]]
@@ -1332,41 +922,6 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
-[[package]]
-name = "hex"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
-
-[[package]]
-name = "hmac"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
-dependencies = [
- "digest",
-]
-
-[[package]]
-name = "home"
-version = "0.5.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf"
-dependencies = [
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "http"
-version = "0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
-dependencies = [
- "bytes",
- "fnv",
- "itoa",
-]
-
 [[package]]
 name = "http"
 version = "1.3.1"
@@ -1378,17 +933,6 @@ dependencies = [
  "itoa",
 ]
 
-[[package]]
-name = "http-body"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
-dependencies = [
- "bytes",
- "http 0.2.12",
- "pin-project-lite",
-]
-
 [[package]]
 name = "http-body"
 version = "1.0.1"
@@ -1396,7 +940,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
 dependencies = [
  "bytes",
- "http 1.3.1",
+ "http",
 ]
 
 [[package]]
@@ -1407,8 +951,8 @@ checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.3.1",
- "http-body 1.0.1",
+ "http",
+ "http-body",
  "pin-project-lite",
 ]
 
@@ -1425,29 +969,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
-name = "hyper"
-version = "0.14.32"
+name = "humansize"
+version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7"
+checksum = "6cb51c9a029ddc91b07a787f1d86b53ccfa49b0e86688c946ebe8d3555685dd7"
 dependencies = [
- "bytes",
- "futures-channel",
- "futures-core",
- "futures-util",
- "h2 0.3.26",
- "http 0.2.12",
- "http-body 0.4.6",
- "httparse",
- "httpdate",
- "itoa",
- "pin-project-lite",
- "socket2",
- "tokio",
- "tower-service",
- "tracing",
- "want",
+ "libm",
 ]
 
+[[package]]
+name = "humantime"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b112acc8b3adf4b107a8ec20977da0273a8c386765a3ec0229bd500a1443f9f"
+
 [[package]]
 name = "hyper"
 version = "1.6.0"
@@ -1457,10 +992,11 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "h2 0.4.9",
- "http 1.3.1",
- "http-body 1.0.1",
+ "h2",
+ "http",
+ "http-body",
  "httparse",
+ "httpdate",
  "itoa",
  "pin-project-lite",
  "smallvec",
@@ -1468,22 +1004,6 @@ dependencies = [
  "want",
 ]
 
-[[package]]
-name = "hyper-rustls"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
-dependencies = [
- "futures-util",
- "http 0.2.12",
- "hyper 0.14.32",
- "log",
- "rustls 0.21.12",
- "rustls-native-certs 0.6.3",
- "tokio",
- "tokio-rustls 0.24.1",
-]
-
 [[package]]
 name = "hyper-rustls"
 version = "0.27.5"
@@ -1491,14 +1011,27 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2d191583f3da1305256f22463b9bb0471acad48a4e534a5218b9963e9c1f59b2"
 dependencies = [
  "futures-util",
- "http 1.3.1",
- "hyper 1.6.0",
+ "http",
+ "hyper",
  "hyper-util",
- "rustls 0.23.26",
- "rustls-native-certs 0.8.1",
+ "rustls",
+ "rustls-native-certs",
  "rustls-pki-types",
  "tokio",
- "tokio-rustls 0.26.2",
+ "tokio-rustls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-timeout"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
+dependencies = [
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
  "tower-service",
 ]
 
@@ -1510,7 +1043,7 @@ checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
  "bytes",
  "http-body-util",
- "hyper 1.6.0",
+ "hyper",
  "hyper-util",
  "native-tls",
  "tokio",
@@ -1527,9 +1060,9 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "http 1.3.1",
- "http-body 1.0.1",
- "hyper 1.6.0",
+ "http",
+ "http-body",
+ "hyper",
  "libc",
  "pin-project-lite",
  "socket2",
@@ -1538,6 +1071,30 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "iana-time-zone"
+version = "0.1.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0c919e5debc312ad217002b8048a17b7d83f80703865bbfcfebb0458b0b27d8"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "icu_collections"
 version = "1.5.0"
@@ -1677,6 +1234,16 @@ dependencies = [
  "icu_properties",
 ]
 
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+]
+
 [[package]]
 name = "indexmap"
 version = "2.9.0"
@@ -1684,7 +1251,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cea70ddb795996207ad57735b50c5982d8844f38ba9ee5f1aedcfb708a2aa11e"
 dependencies = [
  "equivalent",
- "hashbrown",
+ "hashbrown 0.15.2",
 ]
 
 [[package]]
@@ -1701,9 +1268,9 @@ checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
 
 [[package]]
 name = "itertools"
-version = "0.12.1"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
 dependencies = [
  "either",
 ]
@@ -1740,12 +1307,6 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
-[[package]]
-name = "lazycell"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
-
 [[package]]
 name = "libc"
 version = "0.2.172"
@@ -1753,14 +1314,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
 
 [[package]]
-name = "libloading"
-version = "0.8.6"
+name = "libm"
+version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc2f4eb4bc735547cfed7c0a4922cbd04a4655978c09b54f1f7b228750664c34"
-dependencies = [
- "cfg-if",
- "windows-targets 0.52.6",
-]
+checksum = "c9627da5196e5d8ed0b0495e61e518847578da83483c37288316d9b2e03a7f72"
 
 [[package]]
 name = "libmimalloc-sys"
@@ -1773,10 +1330,13 @@ dependencies = [
 ]
 
 [[package]]
-name = "linux-raw-sys"
-version = "0.4.15"
+name = "link-cplusplus"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
+checksum = "4a6f6da007f968f9def0d65a05b187e2960183de70c160204ecfccf0ee330212"
+dependencies = [
+ "cc",
+]
 
 [[package]]
 name = "linux-raw-sys"
@@ -1806,15 +1366,6 @@ version = "0.4.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
 
-[[package]]
-name = "lru"
-version = "0.12.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38"
-dependencies = [
- "hashbrown",
-]
-
 [[package]]
 name = "matchers"
 version = "0.1.0"
@@ -1824,6 +1375,12 @@ dependencies = [
  "regex-automata 0.1.10",
 ]
 
+[[package]]
+name = "matchit"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
+
 [[package]]
 name = "md-5"
 version = "0.10.6"
@@ -1942,20 +1499,28 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "async-compression",
- "aws-config",
- "aws-sdk-s3",
+ "bytes",
  "clap",
+ "console-subscriber",
+ "cxx",
+ "cxx-build",
  "ed25519-dalek",
  "futures",
+ "humansize",
  "nix-compat",
+ "object_store",
+ "pkg-config",
  "regex",
  "reqwest",
  "serde",
  "serde_json",
  "sha2",
+ "tempfile",
  "tokio",
+ "tokio-util",
  "tracing",
  "tracing-subscriber",
+ "ulid",
  "url",
 ]
 
@@ -1988,21 +1553,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "num-conv"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
-
-[[package]]
-name = "num-integer"
-version = "0.1.46"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
-dependencies = [
- "num-traits",
-]
-
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -2042,6 +1592,40 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "object_store"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9ce831b09395f933addbc56d894d889e4b226eba304d4e7adbab591e26daf1e"
+dependencies = [
+ "async-trait",
+ "base64 0.22.1",
+ "bytes",
+ "chrono",
+ "form_urlencoded",
+ "futures",
+ "http",
+ "http-body-util",
+ "humantime",
+ "hyper",
+ "itertools",
+ "md-5",
+ "parking_lot",
+ "percent-encoding",
+ "quick-xml",
+ "rand 0.8.5",
+ "reqwest",
+ "ring",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "thiserror",
+ "tokio",
+ "tracing",
+ "url",
+ "walkdir",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.21.3"
@@ -2092,29 +1676,12 @@ dependencies = [
  "vcpkg",
 ]
 
-[[package]]
-name = "outref"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a80800c0488c3a21695ea981a54918fbb37abf04f4d0720c453632255e2ff0e"
-
 [[package]]
 name = "overload"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
 
-[[package]]
-name = "p256"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51f44edd08f51e2ade572f141051021c5af22677e42b7dd28a88155151c33594"
-dependencies = [
- "ecdsa",
- "elliptic-curve",
- "sha2",
-]
-
 [[package]]
 name = "parking_lot"
 version = "0.12.3"
@@ -2144,6 +1711,26 @@ version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
+[[package]]
+name = "pin-project"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677f1add503faace112b9f1373e43e9e054bfdd22ff1a63c1bc485eaec6a6a8a"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e918e4ff8c4549eb882f14b3a4bc8c8bc93de829416eacf579f1207a8fbf861"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.16"
@@ -2156,24 +1743,14 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
-[[package]]
-name = "pkcs8"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9eca2c590a5f85da82668fa685c09ce2888b9430e83299debf1f34b65fd4a4ba"
-dependencies = [
- "der 0.6.1",
- "spki 0.6.0",
-]
-
 [[package]]
 name = "pkcs8"
 version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
 dependencies = [
- "der 0.7.9",
- "spki 0.7.3",
+ "der",
+ "spki",
 ]
 
 [[package]]
@@ -2183,19 +1760,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
 
 [[package]]
-name = "powerfmt"
-version = "0.2.0"
+name = "ppv-lite86"
+version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
-
-[[package]]
-name = "prettyplease"
-version = "0.2.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "664ec5419c51e34154eec046ebcba56312d5a2fc3b09a06da188e1ad21afadf6"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
 dependencies = [
- "proc-macro2",
- "syn",
+ "zerocopy",
 ]
 
 [[package]]
@@ -2216,6 +1786,102 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "prost"
+version = "0.13.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2796faa41db3ec313a31f7624d9286acf277b52de526150b7e69f3debf891ee5"
+dependencies = [
+ "bytes",
+ "prost-derive",
+]
+
+[[package]]
+name = "prost-derive"
+version = "0.13.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
+dependencies = [
+ "anyhow",
+ "itertools",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "prost-types"
+version = "0.13.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52c2c1bf36ddb1a1c396b3601a3cec27c2462e45f07c386894ec3ccf5332bd16"
+dependencies = [
+ "prost",
+]
+
+[[package]]
+name = "quick-xml"
+version = "0.37.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4ce8c88de324ff838700f36fb6ab86c96df0e3c4ab6ef3a9b2044465cce1369"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3bd15a6f2967aef83887dcb9fec0014580467e33720d073560cf015a5683012"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b820744eb4dc9b57a3398183639c511b5a26d2ed702cedd3febaa1393caa22cc"
+dependencies = [
+ "bytes",
+ "getrandom 0.3.2",
+ "rand 0.9.1",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "541d0f57c6ec747a90738a52741d3221f7960e8ac2f0ff4b1a63680e033b4ab5"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.40"
@@ -2231,6 +1897,47 @@ version = "5.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
 
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fbfd9d094a40bf3ae768db9361049ace4c0e04a4fd6b359518bd7b73a73dd97"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.3",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.3",
+]
+
 [[package]]
 name = "rand_core"
 version = "0.6.4"
@@ -2240,6 +1947,15 @@ dependencies = [
  "getrandom 0.2.15",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
+dependencies = [
+ "getrandom 0.3.2",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.5.11"
@@ -2281,12 +1997,6 @@ dependencies = [
  "regex-syntax 0.8.5",
 ]
 
-[[package]]
-name = "regex-lite"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53a49587ad06b26609c52e423de037e7f57f20d53535d66e08c695f347df952a"
-
 [[package]]
 name = "regex-syntax"
 version = "0.6.29"
@@ -2310,12 +2020,12 @@ dependencies = [
  "encoding_rs",
  "futures-core",
  "futures-util",
- "h2 0.4.9",
- "http 1.3.1",
- "http-body 1.0.1",
+ "h2",
+ "http",
+ "http-body",
  "http-body-util",
- "hyper 1.6.0",
- "hyper-rustls 0.27.5",
+ "hyper",
+ "hyper-rustls",
  "hyper-tls",
  "hyper-util",
  "ipnet",
@@ -2326,7 +2036,11 @@ dependencies = [
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
- "rustls-pemfile 2.2.0",
+ "quinn",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-pemfile",
+ "rustls-pki-types",
  "serde",
  "serde_json",
  "serde_urlencoded",
@@ -2334,26 +2048,18 @@ dependencies = [
  "system-configuration",
  "tokio",
  "tokio-native-tls",
- "tower",
+ "tokio-rustls",
+ "tokio-util",
+ "tower 0.5.2",
  "tower-service",
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
+ "wasm-streams",
  "web-sys",
  "windows-registry",
 ]
 
-[[package]]
-name = "rfc6979"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7743f17af12fa0b03b803ba12cd6a8d9483a587e89c69445e3909655c0b9fabb"
-dependencies = [
- "crypto-bigint 0.4.9",
- "hmac",
- "zeroize",
-]
-
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -2376,9 +2082,9 @@ checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
 
 [[package]]
 name = "rustc-hash"
-version = "1.1.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
 
 [[package]]
 name = "rustc_version"
@@ -2389,19 +2095,6 @@ dependencies = [
  "semver",
 ]
 
-[[package]]
-name = "rustix"
-version = "0.38.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
-dependencies = [
- "bitflags",
- "errno",
- "libc",
- "linux-raw-sys 0.4.15",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "rustix"
 version = "1.0.5"
@@ -2411,48 +2104,24 @@ dependencies = [
  "bitflags",
  "errno",
  "libc",
- "linux-raw-sys 0.9.4",
+ "linux-raw-sys",
  "windows-sys 0.59.0",
 ]
 
-[[package]]
-name = "rustls"
-version = "0.21.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
-dependencies = [
- "log",
- "ring",
- "rustls-webpki 0.101.7",
- "sct",
-]
-
 [[package]]
 name = "rustls"
 version = "0.23.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df51b5869f3a441595eac5e8ff14d486ff285f7b8c0df8770e49c3b56351f0f0"
 dependencies = [
- "aws-lc-rs",
  "once_cell",
+ "ring",
  "rustls-pki-types",
- "rustls-webpki 0.103.1",
+ "rustls-webpki",
  "subtle",
  "zeroize",
 ]
 
-[[package]]
-name = "rustls-native-certs"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
-dependencies = [
- "openssl-probe",
- "rustls-pemfile 1.0.4",
- "schannel",
- "security-framework 2.11.1",
-]
-
 [[package]]
 name = "rustls-native-certs"
 version = "0.8.1"
@@ -2465,15 +2134,6 @@ dependencies = [
  "security-framework 3.2.0",
 ]
 
-[[package]]
-name = "rustls-pemfile"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
-dependencies = [
- "base64 0.21.7",
-]
-
 [[package]]
 name = "rustls-pemfile"
 version = "2.2.0"
@@ -2488,15 +2148,8 @@ name = "rustls-pki-types"
 version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "917ce264624a4b4db1c364dcc35bfca9ded014d0a958cd47ad3e960e988ea51c"
-
-[[package]]
-name = "rustls-webpki"
-version = "0.101.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
 dependencies = [
- "ring",
- "untrusted",
+ "web-time",
 ]
 
 [[package]]
@@ -2505,7 +2158,6 @@ version = "0.103.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fef8b8769aaccf73098557a87cd1816b4f9c7c16811c9c77142aa695c16f2c03"
 dependencies = [
- "aws-lc-rs",
  "ring",
  "rustls-pki-types",
  "untrusted",
@@ -2523,6 +2175,15 @@ version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
 [[package]]
 name = "schannel"
 version = "0.1.27"
@@ -2539,28 +2200,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
-name = "sct"
-version = "0.7.1"
+name = "scratch"
+version = "1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
-dependencies = [
- "ring",
- "untrusted",
-]
-
-[[package]]
-name = "sec1"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3be24c1842290c45df0a7bf069e0c268a747ad05a192f2fd7dcfdbc1cba40928"
-dependencies = [
- "base16ct",
- "der 0.6.1",
- "generic-array",
- "pkcs8 0.9.0",
- "subtle",
- "zeroize",
-]
+checksum = "9f6280af86e5f559536da57a45ebc84948833b3bee313a7dd25232e09c878a52"
 
 [[package]]
 name = "security-framework"
@@ -2648,17 +2291,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "sha1"
-version = "0.10.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
 [[package]]
 name = "sha2"
 version = "0.10.8"
@@ -2694,23 +2326,13 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "signature"
-version = "1.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74233d3b3b2f6d4b006dc19dee745e73e2a6bfb6f93607cd3b02bd5b00797d7c"
-dependencies = [
- "digest",
- "rand_core",
-]
-
 [[package]]
 name = "signature"
 version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
- "rand_core",
+ "rand_core 0.6.4",
 ]
 
 [[package]]
@@ -2738,16 +2360,6 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "spki"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67cf02bbac7a337dc36e4f5a693db6c21e7863f45070f7064577eb4367a3212b"
-dependencies = [
- "base64ct",
- "der 0.6.1",
-]
-
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -2755,7 +2367,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
  "base64ct",
- "der 0.7.9",
+ "der",
 ]
 
 [[package]]
@@ -2837,10 +2449,19 @@ dependencies = [
  "fastrand",
  "getrandom 0.3.2",
  "once_cell",
- "rustix 1.0.5",
+ "rustix",
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "termcolor"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
+dependencies = [
+ "winapi-util",
+]
+
 [[package]]
 name = "thiserror"
 version = "2.0.12"
@@ -2871,36 +2492,6 @@ dependencies = [
  "once_cell",
 ]
 
-[[package]]
-name = "time"
-version = "0.3.41"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7619e19bc266e0f9c5e6686659d394bc57973859340060a69221e57dbc0c40"
-dependencies = [
- "deranged",
- "num-conv",
- "powerfmt",
- "serde",
- "time-core",
- "time-macros",
-]
-
-[[package]]
-name = "time-core"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9e9a38711f559d9e3ce1cdb06dd7c5b8ea546bc90052da6d06bb76da74bb07c"
-
-[[package]]
-name = "time-macros"
-version = "0.2.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3526739392ec93fd8b359c8e98514cb3e8e021beb4e5f597b00a0221f8ed8a49"
-dependencies = [
- "num-conv",
- "time-core",
-]
-
 [[package]]
 name = "tinystr"
 version = "0.7.6"
@@ -2911,6 +2502,21 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "tinyvec"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09b3661f17e86524eccd4371ab0429194e0d7c008abb45f7a7495b1719463c71"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
 [[package]]
 name = "tokio"
 version = "1.44.2"
@@ -2926,6 +2532,7 @@ dependencies = [
  "signal-hook-registry",
  "socket2",
  "tokio-macros",
+ "tracing",
  "windows-sys 0.52.0",
 ]
 
@@ -2950,31 +2557,32 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "tokio-rustls"
-version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
-dependencies = [
- "rustls 0.21.12",
- "tokio",
-]
-
 [[package]]
 name = "tokio-rustls"
 version = "0.26.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e727b36a1a0e8b74c376ac2211e40c2c8af09fb4013c60d910495810f008e9b"
 dependencies = [
- "rustls 0.23.26",
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eca58d7bba4a75707817a2c44174253f9236b2d5fbd055602e9d5c07c139a047"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
  "tokio",
 ]
 
 [[package]]
 name = "tokio-util"
-version = "0.7.14"
+version = "0.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b9590b93e6fcc1739458317cccd391ad3955e2bde8913edf6f95f9e65a8f034"
+checksum = "66a539a9ad6d5d281510d5bd368c973d636c02dbf8a67300bfb6b950696ad7df"
 dependencies = [
  "bytes",
  "futures-core",
@@ -2995,11 +2603,61 @@ version = "0.22.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "17b4795ff5edd201c7cd6dca065ae59972ce77d1b80fa0a84d94950ece7d1474"
 dependencies = [
- "indexmap",
+ "indexmap 2.9.0",
  "toml_datetime",
  "winnow",
 ]
 
+[[package]]
+name = "tonic"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877c5b330756d856ffcc4553ab34a5684481ade925ecc54bcd1bf02b1d0d4d52"
+dependencies = [
+ "async-stream",
+ "async-trait",
+ "axum",
+ "base64 0.22.1",
+ "bytes",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-timeout",
+ "hyper-util",
+ "percent-encoding",
+ "pin-project",
+ "prost",
+ "socket2",
+ "tokio",
+ "tokio-stream",
+ "tower 0.4.13",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "indexmap 1.9.3",
+ "pin-project",
+ "pin-project-lite",
+ "rand 0.8.5",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
 [[package]]
 name = "tower"
 version = "0.5.2"
@@ -3100,12 +2758,28 @@ version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
 
+[[package]]
+name = "ulid"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "470dbf6591da1b39d43c14523b2b469c86879a53e8b758c8e090a470fe7b1fbe"
+dependencies = [
+ "rand 0.9.1",
+ "web-time",
+]
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
 
+[[package]]
+name = "unicode-width"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fc81956842c57dac11422a97c3b8195a1ff727f06e85c84ed2e8aa277c9a0fd"
+
 [[package]]
 name = "untrusted"
 version = "0.9.0"
@@ -3124,12 +2798,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "urlencoding"
-version = "2.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
-
 [[package]]
 name = "utf16_iter"
 version = "1.0.5"
@@ -3148,12 +2816,6 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
-[[package]]
-name = "uuid"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "458f7a779bf54acc9f347480ac654f68407d3aab21269a6e3c9f922acd9e2da9"
-
 [[package]]
 name = "valuable"
 version = "0.1.1"
@@ -3173,10 +2835,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
 [[package]]
-name = "vsimd"
-version = "0.8.0"
+name = "walkdir"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
 
 [[package]]
 name = "want"
@@ -3273,6 +2939,19 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "wasm-streams"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
 [[package]]
 name = "web-sys"
 version = "0.3.77"
@@ -3284,15 +2963,13 @@ dependencies = [
 ]
 
 [[package]]
-name = "which"
-version = "4.4.2"
+name = "web-time"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
 dependencies = [
- "either",
- "home",
- "once_cell",
- "rustix 0.38.44",
+ "js-sys",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -3311,12 +2988,56 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
+[[package]]
+name = "winapi-util"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
+dependencies = [
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "winapi-x86_64-pc-windows-gnu"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
+[[package]]
+name = "windows-core"
+version = "0.61.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4763c1de310c86d75a878046489e2e5ba02c649d185f21c67d4cf8a56d098980"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings 0.4.0",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a47fddd13af08290e67f4acabf4b459f647552718f683a7b415d290ac744a836"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd9211b69f8dcdfa817bfd14bf1c97c9188afa36f4750130fcdf3f400eca9fa8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "windows-link"
 version = "0.1.1"
@@ -3330,7 +3051,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4286ad90ddb45071efd1a66dfa43eb02dd0dfbae1545ad6cc3c51cf34d7e8ba3"
 dependencies = [
  "windows-result",
- "windows-strings",
+ "windows-strings 0.3.1",
  "windows-targets 0.53.0",
 ]
 
@@ -3352,6 +3073,15 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-strings"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a2ba9642430ee452d5a7aa78d72907ebe8cfda358e8cb7918a2050581322f97"
+dependencies = [
+ "windows-link",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
@@ -3528,12 +3258,6 @@ version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e9df38ee2d2c3c5948ea468a8406ff0db0b29ae1ffde1bcf20ef305bcc95c51"
 
-[[package]]
-name = "xmlparser"
-version = "0.13.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66fee0b777b0f5ac1c69bb06d361268faafa61cd4682ae064a171c16c433e9e4"
-
 [[package]]
 name = "yoke"
 version = "0.7.5"
@@ -3558,6 +3282,26 @@ dependencies = [
  "synstructure",
 ]
 
+[[package]]
+name = "zerocopy"
+version = "0.8.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2586fea28e186957ef732a5f8b3be2da217d65c5969d4b1e17f973ebbe876879"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a996a8f63c5c4448cd959ac1bab0aaa3306ccfd060472f85943ee0750f0169be"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "zerofrom"
 version = "0.1.6"
diff --git a/Cargo.toml b/Cargo.toml
index f7bc3f0..c1de8ac 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,21 +3,37 @@ name = "nixcp"
 version = "0.1.0"
 edition = "2024"
 
+[profile.release]
+lto = true
+codegen-units = 1
+
 [dependencies]
 anyhow = "1.0.97"
 async-compression = { version = "0.4.22", features = ["tokio", "zstd"] }
-aws-config = { version = "1.6.1", features = ["behavior-version-latest"] }
-aws-sdk-s3 = "1.82.0"
 clap = { version = "4.5.34", features = ["derive"] }
 ed25519-dalek = "2.1.1"
 futures = "0.3.31"
 nix-compat = { git = "https://github.com/tvlfyi/tvix.git", version = "0.1.0" }
 regex = "1.11.1"
 reqwest = "0.12.15"
-serde = { version = "1.0.219", features = [ "derive" ]}
+serde = { version = "1.0.219", features = ["derive"] }
 serde_json = "1.0.140"
 sha2 = "0.10.8"
-tokio = { version = "1.44.1", features = [ "full" ]}
+tokio = { version = "1.44.1", features = ["full", "tracing", "parking_lot"] }
 tracing = "0.1.41"
-tracing-subscriber = { version = "0.3.19", features = ["env-filter"]}
-url = { version = "2.5.4", features = [ "serde" ]}
+url = { version = "2.5.4", features = ["serde"] }
+cxx = "1.0"
+console-subscriber = "0.4.1"
+tokio-util = { version = "0.7.15", features = ["io"] }
+bytes = "1.10.1"
+object_store = { version = "0.12.0", features = ["aws"] }
+ulid = "1.2.1"
+tracing-subscriber = "0.3.19"
+humansize = "2.1.3"
+
+[build-dependencies]
+cxx-build = "1.0"
+pkg-config = "0.3.32"
+
+[dev-dependencies]
+tempfile = "3.19.1"
diff --git a/README.md b/README.md
index ff71137..55fdaef 100644
--- a/README.md
+++ b/README.md
@@ -11,14 +11,13 @@ The signing key is generated with:
 nix-store --generate-binary-cache-key nixcache.cy7.sh cache-priv-key.pem cache-pub-key.pem
 ```
 
-`AWS_ACCESS_KEY_ID` and `AWS_ENDPOINT_URL` environment variables should be set with your s3 credentials.
+`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables should be set with your s3 credentials.
 
 ```
-Usage: nixcp [OPTIONS] --bucket <bucket name> --signing-key <SIGNING_KEY> <COMMAND>
+Usage: nixcp push [OPTIONS] --bucket <bucket name> --signing-key <SIGNING_KEY> [PATH]...
 
-Commands:
-  push  
-  help  Print this message or the help of the given subcommand(s)
+Arguments:
+  [PATH]...  Path to upload e.g. ./result or /nix/store/y4qpcibkj767szhjb58i2sidmz8m24hb-hello-2.12.1
 
 Options:
       --bucket <bucket name>
@@ -28,15 +27,13 @@ Options:
       --signing-key <SIGNING_KEY>
           Path to the file containing signing key e.g. ~/cache-priv-key.pem
       --region <REGION>
-          If unspecified, will get it form AWS_DEFAULT_REGION envar or the AWS default
+          If unspecified, will get it form AWS_DEFAULT_REGION envar or default to us-east-1
       --endpoint <ENDPOINT>
-          If unspecifed, will get it from AWS_ENDPOINT_URL envar or the AWS default e.g. https://s3.example.com
-      --profile <PROFILE>
-          AWS profile to use
+          If unspecifed, will get it from AWS_ENDPOINT envar e.g. https://s3.example.com
+      --skip-signature-check
+          
   -h, --help
           Print help
-  -V, --version
-          Print version
 ```
 
 ## Install with nix
diff --git a/build.rs b/build.rs
new file mode 100644
index 0000000..2bbe451
--- /dev/null
+++ b/build.rs
@@ -0,0 +1,21 @@
+fn main() {
+    cxx_build::bridge("src/bindings/mod.rs")
+        .file("src/bindings/nix.cpp")
+        .flag("-std=c++2a")
+        .flag("-O2")
+        .flag("-include")
+        .flag("nix/config.h")
+        .flag("-I")
+        .flag(concat!(env!("NIX_INCLUDE_PATH"), "/nix"))
+        .compile("nixbinding");
+    println!("cargo:rerun-if-changed=src/bindings");
+
+    pkg_config::Config::new()
+        .atleast_version("2.4")
+        .probe("nix-store")
+        .unwrap();
+    pkg_config::Config::new()
+        .atleast_version("2.4")
+        .probe("nix-main")
+        .unwrap();
+}
diff --git a/flake.nix b/flake.nix
index c263f49..2d1191f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -22,28 +22,56 @@
         };
         toolchain = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
         craneLib = (crane.mkLib pkgs).overrideToolchain(_: toolchain);
-      in
-      {
-        devShells.default = pkgs.mkShell {
-          nativeBuildInputs = with pkgs; [
-            pkg-config
-          ];
-          buildInputs = with pkgs; [
-            openssl
-            toolchain
-          ];
+        lib = pkgs.lib;
+
+        # don't clean cpp files
+        cppFilter = path: _type: builtins.match ".*(cpp|hpp)$" path != null;
+        cppOrCargo = path: type:
+          (cppFilter path type) || (craneLib.filterCargoSources path type);
+        src = lib.cleanSourceWith {
+          src = ./.;
+          filter = cppOrCargo;
+          name = "source";
         };
 
-        packages.default = craneLib.buildPackage {
-          src = craneLib.cleanCargoSource ./.;
+        commonArgs = {
+          inherit src;
           strictDeps = true;
           nativeBuildInputs = with pkgs; [
             pkg-config
           ];
           buildInputs = with pkgs; [
+            toolchain
             openssl
+            nix
+            boost
+          ];
+          # for cpp bindings to work
+          NIX_INCLUDE_PATH = "${lib.getDev pkgs.nix}/include";
+					# skip integration tests (they need a connection to the nix store)
+					cargoTestExtraArgs = "--bins";
+        };
+
+        cargoArtifacts = craneLib.buildDepsOnly commonArgs;
+        nixcp = craneLib.buildPackage (commonArgs // {
+          inherit cargoArtifacts;
+        });
+      in
+      {
+        devShells.default = craneLib.devShell {
+          inputsFrom = [ nixcp ];
+
+          RUST_BACKGRACE = 1;
+          # for cpp bindings to work
+          NIX_INCLUDE_PATH = "${lib.getDev pkgs.nix}/include";
+
+          packages = with pkgs; [
+            tokio-console
+            cargo-udeps
           ];
         };
+
+        packages.default = nixcp;
       }
     );
 }
diff --git a/src/bindings/mod.rs b/src/bindings/mod.rs
new file mode 100644
index 0000000..46b86dd
--- /dev/null
+++ b/src/bindings/mod.rs
@@ -0,0 +1,237 @@
+/*
+Copyright 2022 Zhaofeng Li and the Attic contributors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+//! `libnixstore` Bindings
+#![allow(dead_code)]
+
+use std::cell::UnsafeCell;
+use std::io;
+use std::pin::Pin;
+use std::task::{Context, Poll};
+
+use anyhow::Result;
+use bytes::Bytes;
+use futures::stream::{Stream, StreamExt};
+use tokio::io::{AsyncWrite, AsyncWriteExt};
+
+// The C++ implementation takes care of concurrency
+#[repr(transparent)]
+pub struct FfiNixStore(UnsafeCell<cxx::UniquePtr<ffi::CNixStore>>);
+
+unsafe impl Send for FfiNixStore {}
+unsafe impl Sync for FfiNixStore {}
+
+impl FfiNixStore {
+    pub fn store(&self) -> Pin<&mut ffi::CNixStore> {
+        unsafe {
+            let ptr = self.0.get().as_mut().unwrap();
+            ptr.pin_mut()
+        }
+    }
+}
+
+/// Obtain a handle to the Nix store.
+pub unsafe fn open_nix_store() -> Result<FfiNixStore> {
+    match ffi::open_nix_store() {
+        Ok(ptr) => {
+            let cell = UnsafeCell::new(ptr);
+            Ok(FfiNixStore(cell))
+        }
+        Err(e) => Err(e.into()),
+    }
+}
+
+// TODO: Benchmark different implementations
+// (tokio, crossbeam, flume)
+mod mpsc {
+    // Tokio
+    pub use tokio::sync::mpsc::{
+        UnboundedReceiver, UnboundedSender, error::SendError, unbounded_channel,
+    };
+}
+
+/// Async write request.
+#[derive(Debug)]
+enum AsyncWriteMessage {
+    Data(Vec<u8>),
+    Error(String),
+    Eof,
+}
+
+/// Async write request sender.
+#[derive(Clone)]
+pub struct AsyncWriteSender {
+    sender: mpsc::UnboundedSender<AsyncWriteMessage>,
+}
+
+impl AsyncWriteSender {
+    fn send(&mut self, data: &[u8]) -> Result<(), mpsc::SendError<AsyncWriteMessage>> {
+        let message = AsyncWriteMessage::Data(Vec::from(data));
+        self.sender.send(message)
+    }
+
+    fn eof(&mut self) -> Result<(), mpsc::SendError<AsyncWriteMessage>> {
+        let message = AsyncWriteMessage::Eof;
+        self.sender.send(message)
+    }
+
+    pub(crate) fn rust_error(
+        &mut self,
+        error: impl std::error::Error,
+    ) -> Result<(), impl std::error::Error> {
+        let message = AsyncWriteMessage::Error(error.to_string());
+        self.sender.send(message)
+    }
+}
+
+/// A wrapper of the `AsyncWrite` trait for the synchronous Nix C++ land.
+pub struct AsyncWriteAdapter {
+    receiver: mpsc::UnboundedReceiver<AsyncWriteMessage>,
+    eof: bool,
+}
+
+impl AsyncWriteAdapter {
+    pub fn new() -> (Self, Box<AsyncWriteSender>) {
+        let (sender, receiver) = mpsc::unbounded_channel();
+
+        let r = Self {
+            receiver,
+            eof: false,
+        };
+        let sender = Box::new(AsyncWriteSender { sender });
+
+        (r, sender)
+    }
+
+    /// Write everything the sender sends to us.
+    pub async fn write_all(mut self, mut writer: Box<dyn AsyncWrite + Unpin>) -> Result<()> {
+        let writer = writer.as_mut();
+
+        while let Some(data) = self.next().await {
+            match data {
+                Ok(v) => {
+                    writer.write_all(&v).await?;
+                }
+                Err(e) => {
+                    return Err(e.into());
+                }
+            }
+        }
+
+        if !self.eof {
+            Err(io::Error::from(io::ErrorKind::BrokenPipe).into())
+        } else {
+            Ok(())
+        }
+    }
+}
+
+impl Stream for AsyncWriteAdapter {
+    type Item = std::io::Result<Bytes>;
+
+    fn poll_next(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Option<Self::Item>> {
+        match self.receiver.poll_recv(cx) {
+            Poll::Pending => Poll::Pending,
+            Poll::Ready(Some(message)) => {
+                use AsyncWriteMessage::*;
+                match message {
+                    Data(v) => Poll::Ready(Some(Ok(v.into()))),
+                    Error(exception) => {
+                        let error = std::io::Error::other(format!("cxx error: {exception}"));
+                        Poll::Ready(Some(Err(error)))
+                    }
+                    Eof => {
+                        self.eof = true;
+                        Poll::Ready(None)
+                    }
+                }
+            }
+            Poll::Ready(None) => {
+                if !self.eof {
+                    Poll::Ready(Some(Err(io::Error::from(io::ErrorKind::BrokenPipe))))
+                } else {
+                    Poll::Ready(None)
+                }
+            }
+        }
+    }
+}
+
+#[cxx::bridge]
+/// Generated by `cxx.rs`.
+///
+/// Mid-level wrapper of `libnixstore` implemented in C++.
+mod ffi {
+    extern "Rust" {
+        type AsyncWriteSender;
+        fn send(self: &mut AsyncWriteSender, data: &[u8]) -> Result<()>;
+        fn eof(self: &mut AsyncWriteSender) -> Result<()>;
+    }
+
+    unsafe extern "C++" {
+        include!("nixcp/src/bindings/nix.hpp");
+
+        // =========
+        // CNixStore
+        // =========
+
+        /// Mid-level wrapper for the Unix Domain Socket Nix Store.
+        type CNixStore;
+
+        /// Queries information about a valid path.
+        fn query_path_info(
+            self: Pin<&mut CNixStore>,
+            store_path: &[u8],
+        ) -> Result<UniquePtr<CPathInfo>>;
+
+        /// Computes the closure of a valid path.
+        ///
+        /// If `flip_directions` is true, the set of paths that can reach `store_path` is
+        /// returned.
+        fn compute_fs_closure(
+            self: Pin<&mut CNixStore>,
+            store_path: &[u8],
+            flip_direction: bool,
+            include_outputs: bool,
+            include_derivers: bool,
+        ) -> Result<UniquePtr<CxxVector<CxxString>>>;
+
+        /// Creates a NAR dump from a path.
+        fn nar_from_path(
+            self: Pin<&mut CNixStore>,
+            base_name: Vec<u8>,
+            sender: Box<AsyncWriteSender>,
+        ) -> Result<()>;
+
+        /// Obtains a handle to the Nix store.
+        fn open_nix_store() -> Result<UniquePtr<CNixStore>>;
+
+        // =========
+        // CPathInfo
+        // =========
+
+        /// Mid-level wrapper for the `nix::ValidPathInfo` struct.
+        type CPathInfo;
+        /// Returns the size of the NAR.
+        fn nar_size(self: Pin<&mut CPathInfo>) -> u64;
+
+        /// Returns the references of the store path.
+        fn references(self: Pin<&mut CPathInfo>) -> UniquePtr<CxxVector<CxxString>>;
+
+        /// Returns the possibly invalid signatures attached to the store path.
+        fn sigs(self: Pin<&mut CPathInfo>) -> UniquePtr<CxxVector<CxxString>>;
+    }
+}
diff --git a/src/bindings/nix.cpp b/src/bindings/nix.cpp
new file mode 100644
index 0000000..8bf2cb3
--- /dev/null
+++ b/src/bindings/nix.cpp
@@ -0,0 +1,128 @@
+/*
+Copyright 2022 Zhaofeng Li and the Attic contributors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// C++ side of the libnixstore glue.
+//
+// We implement a mid-level wrapper of the Nix Store interface,
+// which is then wrapped again in the Rust side to enable full
+// async-await operation.
+//
+// Here we stick with the naming conventions of Rust and handle
+// Rust types directly where possible, so that the interfaces are
+// satisfying to use from the Rust side via cxx.rs.
+
+#include "nixcp/src/bindings/nix.hpp"
+
+static std::mutex g_init_nix_mutex;
+static bool g_init_nix_done = false;
+
+static nix::StorePath store_path_from_rust(RBasePathSlice base_name) {
+	std::string_view sv((const char *)base_name.data(), base_name.size());
+	return nix::StorePath(sv);
+}
+
+// ========
+// RustSink
+// ========
+
+RustSink::RustSink(RBox<AsyncWriteSender> sender) : sender(std::move(sender)) {}
+
+void RustSink::operator () (std::string_view data) {
+	RBasePathSlice s((const unsigned char *)data.data(), data.size());
+
+	this->sender->send(s);
+}
+
+void RustSink::eof() {
+	this->sender->eof();
+}
+
+
+// =========
+// CPathInfo
+// =========
+
+CPathInfo::CPathInfo(nix::ref<const nix::ValidPathInfo> pi) : pi(pi) {}
+
+uint64_t CPathInfo::nar_size() {
+	return this->pi->narSize;
+}
+
+std::unique_ptr<std::vector<std::string>> CPathInfo::sigs() {
+	std::vector<std::string> result;
+	for (auto&& elem : this->pi->sigs) {
+		result.push_back(std::string(elem));
+	}
+	return std::make_unique<std::vector<std::string>>(result);
+}
+
+std::unique_ptr<std::vector<std::string>> CPathInfo::references() {
+	std::vector<std::string> result;
+	for (auto&& elem : this->pi->references) {
+		result.push_back(std::string(elem.to_string()));
+	}
+	return std::make_unique<std::vector<std::string>>(result);
+}
+
+// =========
+// CNixStore
+// =========
+
+CNixStore::CNixStore() {
+	std::map<std::string, std::string> params;
+	std::lock_guard<std::mutex> lock(g_init_nix_mutex);
+
+	if (!g_init_nix_done) {
+		nix::initNix();
+		g_init_nix_done = true;
+	}
+
+	this->store = nix::openStore(nix::settings.storeUri.get(), params);
+}
+
+std::unique_ptr<CPathInfo> CNixStore::query_path_info(RBasePathSlice base_name) {
+	auto store_path = store_path_from_rust(base_name);
+
+	auto r = this->store->queryPathInfo(store_path);
+	return std::make_unique<CPathInfo>(r);
+}
+
+std::unique_ptr<std::vector<std::string>> CNixStore::compute_fs_closure(RBasePathSlice base_name, bool flip_direction, bool include_outputs, bool include_derivers) {
+	std::set<nix::StorePath> out;
+
+	this->store->computeFSClosure(store_path_from_rust(base_name), out, flip_direction, include_outputs, include_derivers);
+
+	std::vector<std::string> result;
+	for (auto&& elem : out) {
+		result.push_back(std::string(elem.to_string()));
+	}
+	return std::make_unique<std::vector<std::string>>(result);
+}
+
+void CNixStore::nar_from_path(RVec<unsigned char> base_name, RBox<AsyncWriteSender> sender) {
+	RustSink sink(std::move(sender));
+
+	std::string_view sv((const char *)base_name.data(), base_name.size());
+	nix::StorePath store_path(sv);
+
+	// exceptions will be thrown into Rust
+	this->store->narFromPath(store_path, sink);
+	sink.eof();
+}
+
+std::unique_ptr<CNixStore> open_nix_store() {
+	return std::make_unique<CNixStore>();
+}
diff --git a/src/bindings/nix.hpp b/src/bindings/nix.hpp
new file mode 100644
index 0000000..87b3ebf
--- /dev/null
+++ b/src/bindings/nix.hpp
@@ -0,0 +1,89 @@
+/*
+Copyright 2022 Zhaofeng Li and the Attic contributors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// C++ side of the libnixstore glue.
+//
+// We implement a mid-level wrapper of the Nix Store interface,
+// which is then wrapped again in the Rust side to enable full
+// async-await operation.
+//
+// Here we stick with the naming conventions of Rust and handle
+// Rust types directly where possible, so that the interfaces are
+// satisfying to use from the Rust side via cxx.rs.
+
+#pragma once
+#include <iostream>
+#include <memory>
+#include <mutex>
+#include <set>
+#include <nix/store-api.hh>
+#include <nix/local-store.hh>
+#include <nix/remote-store.hh>
+#include <nix/uds-remote-store.hh>
+#include <nix/hash.hh>
+#include <nix/path.hh>
+#include <nix/serialise.hh>
+#include <nix/shared.hh>
+#include <rust/cxx.h>
+
+template<class T> using RVec = rust::Vec<T>;
+template<class T> using RBox = rust::Box<T>;
+template<class T> using RSlice = rust::Slice<T>;
+using RString = rust::String;
+using RStr = rust::Str;
+using RBasePathSlice = RSlice<const unsigned char>;
+using RHashSlice = RSlice<const unsigned char>;
+
+struct AsyncWriteSender;
+
+struct RustSink : nix::Sink
+{
+	RBox<AsyncWriteSender> sender;
+public:
+	RustSink(RBox<AsyncWriteSender> sender);
+	void operator () (std::string_view data) override;
+	void eof();
+};
+
+// Opaque wrapper for nix::ValidPathInfo
+class CPathInfo {
+	nix::ref<const nix::ValidPathInfo> pi;
+public:
+	CPathInfo(nix::ref<const nix::ValidPathInfo> pi);
+	std::unique_ptr<std::vector<std::string>> sigs();
+	std::unique_ptr<std::vector<std::string>> references();
+	uint64_t nar_size();
+};
+
+class CNixStore {
+	std::shared_ptr<nix::Store> store;
+public:
+	CNixStore();
+
+	RString store_dir();
+	std::unique_ptr<CPathInfo> query_path_info(RBasePathSlice base_name);
+	std::unique_ptr<std::vector<std::string>> compute_fs_closure(
+		RBasePathSlice base_name,
+		bool flip_direction,
+		bool include_outputs,
+		bool include_derivers);
+	void nar_from_path(RVec<unsigned char> base_name, RBox<AsyncWriteSender> sender);
+};
+
+std::unique_ptr<CNixStore> open_nix_store();
+
+// Relies on our definitions
+#include "nixcp/src/bindings/mod.rs.h"
diff --git a/src/lib.rs b/src/lib.rs
new file mode 100644
index 0000000..dfbab4f
--- /dev/null
+++ b/src/lib.rs
@@ -0,0 +1,65 @@
+use std::path::PathBuf;
+
+use clap::{Args, Parser, Subcommand};
+
+mod bindings;
+mod cli;
+pub mod make_nar;
+pub mod path_info;
+pub mod push;
+pub mod store;
+mod uploader;
+
+#[derive(Parser, Debug)]
+#[command(version)]
+#[command(name = "nixcp")]
+#[command(about = "Upload store paths to a s3 binary cache")]
+#[command(long_about = None)]
+pub struct Cli {
+    #[command(subcommand)]
+    pub command: Commands,
+
+    /// Whether to enable tokio-console
+    #[arg(long)]
+    pub tokio_console: bool,
+}
+
+#[derive(Debug, Subcommand)]
+pub enum Commands {
+    #[command(arg_required_else_help = true)]
+    Push(PushArgs),
+}
+
+#[derive(Debug, Args)]
+pub struct PushArgs {
+    /// The s3 bucket to upload to
+    #[arg(long, value_name = "bucket name")]
+    bucket: String,
+
+    /// Upstream cache to check against. Can be specified multiple times.
+    /// cache.nixos.org is always included.
+    #[arg(long = "upstream", short, value_name = "nixcache.example.com")]
+    upstreams: Vec<String>,
+
+    /// Path to the file containing signing key
+    /// e.g. ~/cache-priv-key.pem
+    #[arg(long)]
+    signing_key: String,
+
+    /// If unspecified, will get it form AWS_DEFAULT_REGION envar or default to us-east-1
+    #[arg(long)]
+    region: Option<String>,
+
+    /// If unspecifed, will get it from AWS_ENDPOINT envar
+    /// e.g. https://s3.example.com
+    #[arg(long)]
+    endpoint: Option<String>,
+
+    #[arg(long)]
+    skip_signature_check: bool,
+
+    /// Path to upload
+    /// e.g. ./result or /nix/store/y4qpcibkj767szhjb58i2sidmz8m24hb-hello-2.12.1
+    #[arg(value_name = "PATH")]
+    pub paths: Vec<PathBuf>,
+}
diff --git a/src/main.rs b/src/main.rs
index 57d3340..1afe4b6 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1,88 +1,46 @@
-#![feature(let_chains)]
-#![feature(extend_one)]
-
 use anyhow::{Context, Result};
-use clap::{Args, Parser, Subcommand};
-use tracing_subscriber::{EnvFilter, FmtSubscriber};
+use clap::Parser;
+use tracing_subscriber::{EnvFilter, prelude::*};
 
-use push::Push;
-
-mod cli;
-mod path_info;
-mod push;
-mod uploader;
-
-#[derive(Parser, Debug)]
-#[command(version)]
-#[command(name = "nixcp")]
-#[command(about = "Upload store paths to a s3 binary cache")]
-#[command(long_about = None)]
-struct Cli {
-    #[command(subcommand)]
-    command: Commands,
-}
-
-#[derive(Debug, Subcommand)]
-enum Commands {
-    #[command(arg_required_else_help = true)]
-    Push(PushArgs),
-}
-
-#[derive(Debug, Args)]
-pub struct PushArgs {
-    /// The s3 bucket to upload to
-    #[arg(long, value_name = "bucket name")]
-    bucket: String,
-
-    /// Upstream cache to check against. Can be specified multiple times.
-    /// cache.nixos.org is always included.
-    #[arg(long = "upstream", short, value_name = "nixcache.example.com")]
-    upstreams: Vec<String>,
-
-    /// Path to the file containing signing key
-    /// e.g. ~/cache-priv-key.pem
-    #[arg(long)]
-    signing_key: String,
-
-    /// If unspecified, will get it form AWS_DEFAULT_REGION envar
-    #[arg(long)]
-    region: Option<String>,
-
-    /// If unspecifed, will get it from AWS_ENDPOINT_URL envar
-    /// e.g. https://s3.example.com
-    #[arg(long)]
-    endpoint: Option<String>,
-
-    /// AWS profile to use
-    #[arg(long)]
-    profile: Option<String>,
-
-    #[arg(long)]
-    skip_signature_check: bool,
-
-    /// Package or store path to upload
-    /// e.g. nixpkgs#hello or /nix/store/y4qpcibkj767szhjb58i2sidmz8m24hb-hello-2.12.1
-    #[arg(value_name = "package or store path")]
-    package: String,
-}
+use nixcp::push::Push;
+use nixcp::store::Store;
+use nixcp::{Cli, Commands};
 
 #[tokio::main]
 async fn main() -> Result<()> {
-    let filter = EnvFilter::from_default_env();
-    let subscriber = FmtSubscriber::builder().with_env_filter(filter).finish();
-    tracing::subscriber::set_global_default(subscriber)?;
-
     let cli = Cli::parse();
+    init_logging(cli.tokio_console);
 
     match &cli.command {
         Commands::Push(cli) => {
-            let push = Box::leak(Box::new(Push::new(cli).await?));
-            push.paths_from_package(&cli.package)
+            let store = Store::connect()?;
+            let push = Box::leak(Box::new(Push::new(cli, store).await?));
+            push.add_paths(cli.paths.clone())
                 .await
-                .context("nixcp get paths from package")?;
+                .context("add paths to push")?;
             push.run().await.context("nixcp run")?;
         }
     }
 
     Ok(())
 }
+
+fn init_logging(tokio_console: bool) {
+    let env_filter = EnvFilter::from_default_env();
+    let fmt_layer = tracing_subscriber::fmt::layer().with_filter(env_filter);
+
+    let console_layer = if tokio_console {
+        Some(console_subscriber::spawn())
+    } else {
+        None
+    };
+
+    tracing_subscriber::registry()
+        .with(fmt_layer)
+        .with(console_layer)
+        .init();
+
+    if tokio_console {
+        println!("tokio-console is enabled");
+    }
+}
diff --git a/src/make_nar.rs b/src/make_nar.rs
new file mode 100644
index 0000000..97d6b1f
--- /dev/null
+++ b/src/make_nar.rs
@@ -0,0 +1,81 @@
+use anyhow::Result;
+use async_compression::{Level, tokio::bufread::ZstdEncoder};
+use nix_compat::{
+    narinfo::{self, NarInfo},
+    store_path::StorePath,
+};
+use sha2::{Digest, Sha256};
+use std::{mem::take, sync::Arc};
+use tokio::io::{AsyncRead, BufReader};
+use tokio_util::io::InspectReader;
+
+use crate::path_info::PathInfo;
+use crate::store::Store;
+
+pub struct MakeNar<'a> {
+    path_info: &'a PathInfo,
+    store: Arc<Store>,
+    pub nar_hasher: Sha256,
+    /// hash of compressed nar file
+    file_hasher: Sha256,
+    pub nar_size: u64,
+    file_size: u64,
+}
+
+impl<'a> MakeNar<'a> {
+    pub fn new(path_info: &'a PathInfo, store: Arc<Store>) -> Result<Self> {
+        Ok(Self {
+            path_info,
+            store,
+            nar_hasher: Sha256::new(),
+            file_hasher: Sha256::new(),
+            nar_size: 0,
+            file_size: 0,
+        })
+    }
+
+    /// Returns a compressed nar reader which can be uploaded. File hash will be available when
+    /// everything is read
+    pub fn compress_and_hash(&mut self) -> Result<impl AsyncRead> {
+        let nar_reader = self.store.nar_from_path(self.path_info.path.clone());
+        // reader that hashes as nar is read
+        let nar_reader = InspectReader::new(nar_reader, |x| {
+            self.nar_size += x.len() as u64;
+            self.nar_hasher.update(x);
+        });
+
+        let encoder = ZstdEncoder::with_quality(BufReader::new(nar_reader), Level::Default);
+        // reader that updates file_hash as the compressed nar is read
+        Ok(InspectReader::new(encoder, |x| {
+            self.file_size += x.len() as u64;
+            self.file_hasher.update(x);
+        }))
+    }
+
+    /// Returns *unsigned* narinfo. `url` must be updated before uploading
+    pub fn get_narinfo(&mut self) -> Result<NarInfo> {
+        let file_hash = take(&mut self.file_hasher).finalize().into();
+        let nar_hash = take(&mut self.nar_hasher).finalize().into();
+
+        Ok(NarInfo {
+            flags: narinfo::Flags::empty(),
+            store_path: self.path_info.path.as_ref(),
+            nar_hash,
+            nar_size: self.nar_size,
+            references: self
+                .path_info
+                .references
+                .iter()
+                .map(StorePath::as_ref)
+                .collect(),
+            signatures: Vec::new(),
+            ca: None,
+            system: None,
+            deriver: None,
+            compression: Some("zstd"),
+            file_hash: Some(file_hash),
+            file_size: Some(self.file_size),
+            url: "",
+        })
+    }
+}
diff --git a/src/path_info.rs b/src/path_info.rs
index 6dcbb53..213fd1a 100644
--- a/src/path_info.rs
+++ b/src/path_info.rs
@@ -1,85 +1,80 @@
 use std::collections::HashSet;
 
-use anyhow::{Context, Error, Result};
-use aws_sdk_s3 as s3;
+use anyhow::{Context, Result, anyhow};
+use futures::future::join_all;
 use nix_compat::nixbase32;
 use nix_compat::store_path::StorePath;
+use object_store::{ObjectStore, aws::AmazonS3, path::Path as ObjectPath};
 use regex::Regex;
-use serde::Deserialize;
+use std::path::Path;
 use tokio::process::Command;
-use tracing::{debug, error, trace};
+use tracing::{debug, trace};
 use url::Url;
 
-// nix path-info --derivation --json
-#[derive(Debug, Clone, Deserialize)]
+use crate::store::Store;
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub struct PathInfo {
-    pub deriver: Option<StorePath<String>>,
     pub path: StorePath<String>,
-    signatures: Option<Vec<String>>,
+    pub signatures: Vec<String>,
     pub references: Vec<StorePath<String>>,
+    pub nar_size: u64,
 }
 
 impl PathInfo {
-    // get PathInfo for a package or a store path
-    // we deserialize this as an array of `PathInfo` below
-    pub async fn from_path(path: &str) -> Result<Self> {
-        debug!("query nix path-info for {path}");
-        // use lix cause nix would return a json map instead of an array
-        // json output is not stable and could break in future
-        // TODO figure out a better way
-        let nix_cmd = Command::new("nix")
-            .arg("run")
-            .arg("--experimental-features")
-            .arg("nix-command flakes")
-            .arg("github:nixos/nixpkgs/nixos-unstable#lix")
-            .arg("--")
-            .arg("path-info")
-            .arg("--json")
-            .arg(path)
-            .output()
-            .await
-            .context("`nix path-info` failed for {package}")?;
+    pub async fn from_derivation(drv: &Path, store: &Store) -> Result<Self> {
+        debug!("query path info for {:?}", drv);
 
-        trace!(
-            "nix path-info output: {}",
-            String::from_utf8_lossy(&nix_cmd.stdout)
-        );
-
-        // nix path-info returns an array with one element
-        match serde_json::from_slice::<Vec<_>>(&nix_cmd.stdout)
-            .context("parse path info from stdout")
-        {
-            Ok(path_info) => path_info
-                .into_iter()
-                .next()
-                .ok_or_else(|| Error::msg("nix path-info returned empty")),
-            Err(e) => {
-                error!(
-                    "Failed to parse data from `nix path-info`. The path may not exist on your system."
-                );
-                Err(e)
+        let derivation = match drv.extension() {
+            Some(ext) if ext == "drv" => drv.as_os_str().as_encoded_bytes(),
+            _ => {
+                let drv = {
+                    // resolve symlink
+                    if drv.is_symlink() {
+                        &drv.canonicalize()?
+                    } else {
+                        drv
+                    }
+                };
+                &Command::new("nix")
+                    .arg("path-info")
+                    .arg("--derivation")
+                    .arg(drv)
+                    .output()
+                    .await
+                    .context(format!("run command: nix path-info --derivaiton {drv:?}"))?
+                    .stdout
             }
+        };
+        let derivation = String::from_utf8_lossy(derivation);
+        debug!("derivation: {derivation}");
+
+        if derivation.is_empty() {
+            return Err(anyhow!(
+                "nix path-info did not return a derivation for {drv:#?}"
+            ));
         }
+
+        Self::from_path(derivation.trim(), store).await
     }
 
-    pub async fn get_closure(&self) -> Result<Vec<Self>> {
-        debug!("query nix-store for {}", self.absolute_path());
-        let nix_store_cmd = Command::new("nix-store")
-            .arg("--query")
-            .arg("--requisites")
-            .arg("--include-outputs")
-            .arg(self.absolute_path())
-            .output()
+    pub async fn from_path(path: &str, store: &Store) -> Result<Self> {
+        let store_path =
+            StorePath::from_absolute_path(path.as_bytes()).context("storepath from path")?;
+        store
+            .query_path_info(store_path)
             .await
-            .expect("nix-store cmd failed");
+            .context("query pathinfo for path")
+    }
 
-        let nix_store_paths = String::from_utf8(nix_store_cmd.stdout)?;
-        let nix_store_paths: Vec<&str> = nix_store_paths.lines().collect();
-        let mut closure = Vec::with_capacity(nix_store_paths.len());
-        for path in nix_store_paths {
-            closure.push(Self::from_path(path).await?);
-        }
-        Ok(closure)
+    // TODO: skip call to query_path_info and return Vec<Path>?
+    pub async fn get_closure(&self, store: &Store) -> Result<Vec<Self>> {
+        let futs = store
+            .compute_fs_closure(self.path.clone())
+            .await?
+            .into_iter()
+            .map(|x| store.query_path_info(x));
+        join_all(futs).await.into_iter().collect()
     }
 
     /// checks if the path is signed by any upstream. if it is, we assume a cache hit.
@@ -101,23 +96,21 @@ impl PathInfo {
     }
 
     fn signees(&self) -> Vec<&str> {
-        if let Some(signatures) = self.signatures.as_ref() {
-            let signees: Vec<_> = signatures
-                .iter()
-                .filter_map(|signature| Some(signature.split_once(":")?.0))
-                .collect();
-            trace!("signees for {}: {:?}", self.path, signees);
-            return signees;
-        }
-        Vec::new()
+        let signers: Vec<_> = self
+            .signatures
+            .iter()
+            .filter_map(|signature| Some(signature.split_once(":")?.0))
+            .collect();
+        trace!("signers for {}: {:?}", self.path, signers);
+        signers
     }
 
     pub async fn check_upstream_hit(&self, upstreams: &[Url]) -> bool {
         for upstream in upstreams {
             let upstream = upstream
-                .join(format!("{}.narinfo", self.digest()).as_str())
+                .join(self.narinfo_path().as_ref())
                 .expect("adding <hash>.narinfo should make a valid url");
-            debug!("querying {}", upstream);
+            trace!("querying {}", upstream);
             let res_status = reqwest::Client::new()
                 .head(upstream.as_str())
                 .send()
@@ -135,83 +128,12 @@ impl PathInfo {
         self.path.to_absolute_path()
     }
 
-    pub fn digest(&self) -> String {
-        nixbase32::encode(self.path.digest())
+    pub fn narinfo_path(&self) -> ObjectPath {
+        ObjectPath::parse(format!("{}.narinfo", nixbase32::encode(self.path.digest())))
+            .expect("must parse to a valid object_store path")
     }
 
-    pub async fn check_if_already_exists(&self, s3_client: &s3::Client, bucket: String) -> bool {
-        s3_client
-            .head_object()
-            .bucket(bucket)
-            .key(format!("{}.narinfo", self.digest()))
-            .send()
-            .await
-            .is_ok()
+    pub async fn check_if_already_exists(&self, s3: &AmazonS3) -> bool {
+        s3.head(&self.narinfo_path()).await.is_ok()
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn get_signees_from_path_info() {
-        let path_info_json = r#"{"deriver":"/nix/store/idy9slp6835nm6x2i41vzm4g1kai1m2p-nixcp-0.1.0.drv.drv","narHash":"sha256-BG5iQEKKOM7d4199942ReE+bZxQDGDuOZqQ5jkTp45o=","narSize":27851376,"path":"/nix/store/giv6gcnv0ymqgi60dx0fsk2l1pxdd1n0-nixcp-0.1.0","references":["/nix/store/954l60hahqvr0hbs7ww6lmgkxvk8akdf-openssl-3.4.1","/nix/store/ik84lbv5jvjm1xxvdl8mhg52ry3xycvm-gcc-14-20241116-lib","/nix/store/rmy663w9p7xb202rcln4jjzmvivznmz8-glibc-2.40-66"],"registrationTime":1744643248,"signatures":["nixcache.cy7.sh:n1lnCoT16xHcuV+tc+/TbZ2m+UKuI15ok+3cg2i5yFHO8+QVUn0x+tOSy6bZ+KxWl4PvmIjUQN1Kus0efn46Cw=="],"valid":true}"#;
-        let mut path_info: PathInfo = serde_json::from_str(path_info_json).expect("must serialize");
-
-        path_info.signatures = Some(vec![
-            "cache.nixos.org-1:sRAGxSFkQ6PGzPGs9caX6y81tqfevIemSSWZjeD7/v1X0J9kEeafaFgz+zBD/0k8imHSWi/leCoIXSCG6/MrCw==".to_string(),
-            "nixcache.cy7.sh:hV1VQvztp8UY7hq/G22uzC3vQp4syBtnpJh21I1CRJykqweohb4mdS3enyi+9xXqAUZMfNrZuRFSySqa5WK1Dg==".to_string(),
-        ]);
-        let signees = path_info.signees();
-        assert_eq!(signees, vec!["cache.nixos.org-1", "nixcache.cy7.sh"]);
-    }
-
-    #[test]
-    fn match_upstream_cache_from_signature() {
-        let path_info_json = r#"{"deriver":"/nix/store/idy9slp6835nm6x2i41vzm4g1kai1m2p-nixcp-0.1.0.drv.drv","narHash":"sha256-BG5iQEKKOM7d4199942ReE+bZxQDGDuOZqQ5jkTp45o=","narSize":27851376,"path":"/nix/store/giv6gcnv0ymqgi60dx0fsk2l1pxdd1n0-nixcp-0.1.0","references":["/nix/store/954l60hahqvr0hbs7ww6lmgkxvk8akdf-openssl-3.4.1","/nix/store/ik84lbv5jvjm1xxvdl8mhg52ry3xycvm-gcc-14-20241116-lib","/nix/store/rmy663w9p7xb202rcln4jjzmvivznmz8-glibc-2.40-66"],"registrationTime":1744643248,"signatures":["nixcache.cy7.sh:n1lnCoT16xHcuV+tc+/TbZ2m+UKuI15ok+3cg2i5yFHO8+QVUn0x+tOSy6bZ+KxWl4PvmIjUQN1Kus0efn46Cw=="],"valid":true}"#;
-        let mut path_info: PathInfo = serde_json::from_str(path_info_json).expect("must serialize");
-
-        path_info.signatures = Some(vec![
-            "cache.nixos.org-1:sRAGxSFkQ6PGzPGs9caX6y81tqfevIemSSWZjeD7/v1X0J9kEeafaFgz+zBD/0k8imHSWi/leCoIXSCG6/MrCw==".to_string(),
-            "nixcache.cy7.sh:hV1VQvztp8UY7hq/G22uzC3vQp4syBtnpJh21I1CRJykqweohb4mdS3enyi+9xXqAUZMfNrZuRFSySqa5WK1Dg==".to_string(),
-            "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=".to_string(),
-        ]);
-        assert!(
-            path_info.check_upstream_signature(&[Url::parse("https://cache.nixos.org").unwrap()])
-        );
-        assert!(
-            path_info.check_upstream_signature(&[Url::parse("https://nixcache.cy7.sh").unwrap()])
-        );
-        assert!(
-            path_info.check_upstream_signature(&[
-                Url::parse("https://nix-community.cachix.org").unwrap()
-            ])
-        );
-        assert!(
-            !path_info
-                .check_upstream_signature(&[Url::parse("https://fake-cache.cachix.org").unwrap()]),
-        );
-    }
-
-    #[test]
-    fn path_info_without_signature() {
-        let path_info_json = r#"{"ca":"fixed:r:sha256:1q10p04pgx9sk6xbvrkn4nvh0ys2lzplgcni5368f4z3cr8ikbmz","narHash":"sha256-v64ZUWbjE4fMKNGyR++nQnsAtyV25r26mTr1dwm4IOA=","narSize":5520,"path":"/nix/store/gj6hz9mj23v01yvq1nn5f655jrcky1qq-nixos-option.nix","references":[],"registrationTime":1744740942,"valid":true}"#;
-        let path_info: PathInfo = serde_json::from_str(path_info_json).expect("must serialize");
-
-        assert!(
-            !path_info.check_upstream_signature(&[Url::parse("https://cache.nixos.org").unwrap()])
-        );
-    }
-
-    /*
-    #[test]
-    fn path_info_deserialize_nix_map() {
-        let path_info_json = r#"{"/nix/store/8vm1jxsc0jphd65vb7r6g5ysgqw0yh9f-home-manager-generation":{"ca":null,"deriver":"/nix/store/h8z25s6arcrns5nmrq1yhgbamywjivpn-home-manager-generation.drv","narHash":"sha256-o4qwqyJ5UVm9cyC/nBNcNYVnIM14Pewgw7fou+wUVSY=","narSize":13608,"references":["/nix/store/40yifhx34v4g4llrdn3v2ag8w02j10fv-gnugrep-3.11","/nix/store/4d0ix5djms3n2jnjdc58l916cwack1rp-empty-directory","/nix/store/56zmgla8443qfrkrh2ch0vz0mh8ywrw1-home-manager-files","/nix/store/58br4vk3q5akf4g8lx0pqzfhn47k3j8d-bash-5.2p37","/nix/store/80l1sb3vcmrkcdd7ihlizkcnv19rq9fj-ncurses-6.5","/nix/store/8vm1jxsc0jphd65vb7r6g5ysgqw0yh9f-home-manager-generation","/nix/store/92as847i10kl6s19fi910ddyk9l83835-check-link-targets.sh","/nix/store/9c90iz95yynyh3vsc67zndch6j01vgz3-home-manager-path","/nix/store/b2cfj7yk3wfg1jdwjzim7306hvsc5gnl-systemd-257.3","/nix/store/bm5fi6wj0w4r2wjll2448k307bzfcjwx-cleanup","/nix/store/c244fsb3a7i5837lzn94m4bmav9i5p9b-link","/nix/store/cvlbhhrvzfkjl2hrrzhq3vr5gzan1r60-bash-interactive-5.2p37","/nix/store/gpxsdrrd4x93fs75395vr2dfys1ki9mq-jq-1.7.1-bin","/nix/store/jlf743lqxbvad6dbgndsgqfg20m2np5i-sd-switch-0.5.3","/nix/store/mhmgm739aagj4x7hr6ag2wjmxhmpy8mf-gettext-0.22.5","/nix/store/w9db12j05yv5hl31s6jndd9cfm1g1gw4-hm-modules-messages","/nix/store/wj1c3gsiajabnq50ifxqnlv60i5rhqj7-diffutils-3.10","/nix/store/xhql0ilzbiqwnmz4z8y0phk611wynxf2-gnused-4.9","/nix/store/xq5f95pp297afc2xjgrmhmf9w631qp7m-findutils-4.10.0","/nix/store/yh6qg1nsi5h2xblcr67030pz58fsaxx3-coreutils-9.6","/nix/store/zhrjg6wxrxmdlpn6iapzpp2z2vylpvw5-home-manager.sh"],"registrationTime":1744742989,"signatures":["nixcache.cy7.sh:Vq4X95kSzum7BwrBhjmmM2yVipfBI3AE3jgZ3b3RoYrP4/ghotbDdlwCvwK3qx4BQdEOLSgrC1tDwiMNb6oRBw=="],"ultimate":false}}"#;
-        serde_json::from_str::<HashMap<String, PathInfo>>(path_info_json).expect("must serialize");
-
-        let path_info_json = r#"{"/nix/store/3a2ahdaprw6df0lml1pj9jhbi038dsjh-nixos-system-chunk-25.05.20250412.2631b0b":{"ca":null,"deriver":"/nix/store/12ssi931481jlkizgfk1c1jnawvwjbhh-nixos-system-chunk-25.05.20250412.2631b0b.drv","narHash":"sha256-CHhBIzMD4v/FKqKgGroq0UC1k3GrK5lcNwQPMpv2xLc=","narSize":20704,"references":["/nix/store/0yjiyixxsr137iw93hnaacdsssy1li9h-switch-to-configuration-0.1.0","/nix/store/14rby7cpwrzjsjym44cl5h6nj6qpn1gs-etc","/nix/store/3a2ahdaprw6df0lml1pj9jhbi038dsjh-nixos-system-chunk-25.05.20250412.2631b0b","/nix/store/3wjljpj30fvv2cdb60apr4126pa5bm87-shadow-4.17.2","/nix/store/40yifhx34v4g4llrdn3v2ag8w02j10fv-gnugrep-3.11","/nix/store/58br4vk3q5akf4g8lx0pqzfhn47k3j8d-bash-5.2p37","/nix/store/5dyh8l59kfvf89zjkbmjfnx7fix93n4f-net-tools-2.10","/nix/store/aq9wdsz12bg9252790l9awiry2bml4ls-sops-install-secrets-0.0.1","/nix/store/b00kq6fjhgisdrykg621vml8505nnmb3-users-groups.json","/nix/store/b2cfj7yk3wfg1jdwjzim7306hvsc5gnl-systemd-257.3","/nix/store/bfr68wi6k8icb3j9fy3fzchva56djfhd-mounts.sh","/nix/store/cjnihsds5hhnji9r85hglph07q9y9hgc-system-path","/nix/store/cvlbhhrvzfkjl2hrrzhq3vr5gzan1r60-bash-interactive-5.2p37","/nix/store/f9jll96j74f5ykvs062718b98lfjbn9g-util-linux-2.40.4-bin","/nix/store/h7zih134d3n5yk8pnhv1fa38n6qkyrn2-pre-switch-checks","/nix/store/idn5n51246piyxcr3v6gxnj5a5l9mzpn-linux-6.14.2","/nix/store/ipn5793y61x2904xqnkgbjnp91svjjzx-perl-5.40.0-env","/nix/store/j1rikvl25pz0b5ham1ijq0nbg1q2fqfy-initrd-linux-6.14.2","/nix/store/jgawnqyh6piwcl79gxpmq5czx9rfr9xh-glibc-locales-2.40-66","/nix/store/jqgmcv8j4gj59218hcbiyn8z951rycdj-install-grub.sh","/nix/store/kpmybhxy3gz6k1znbdirwsp3c6wvsgg9-manifest.json","/nix/store/lgainx4gl6q7mhiwmls81d3n51p5jz7z-linux-6.14.2-modules","/nix/store/mhxn5kwnri3z9hdzi3x0980id65p0icn-lib.sh","/nix/store/n8n0faszqlnf3mdg0fj6abnknrhjsw5j-perl-5.40.0-env","/nix/store/nq61v7a601gjndijq5nndprkzpwz4q9g-glibc-2.40-66-bin","/nix/store/nx27idxpvi3fk3p7admvhipny73nr25n-kmod-31","/nix/store/pggww1d2pg24fcg5v36xn63n53vanyyi-gnupg-2.4.7","/nix/store/rg5rf512szdxmnj9qal3wfdnpfsx38qi-setup-etc.pl","/nix/store/vvlfaafnz3pdhw7lx5kc5gb9pl4zhz5l-local-cmds","/nix/store/w142vx7ij1fz6qwhp5dprkf59cizvv1v-update-users-groups.pl","/nix/store/xq5f95pp297afc2xjgrmhmf9w631qp7m-findutils-4.10.0","/nix/store/yh6qg1nsi5h2xblcr67030pz58fsaxx3-coreutils-9.6","/nix/store/zlsmh0ccgvncg30qb4y0mp5pahnk1wnw-append-initrd-secrets","/nix/store/zs07icpv5ykf8m36xcv717hh26bp09fa-firmware","/nix/store/zy2n4id5gcxcbx2x8jbblkmcpdlpsypk-getent-glibc-2.40-66"],"registrationTime":1744743136,"signatures":["nixcache.cy7.sh:dZ1XiKQNe0fRX48gBj03PIABYJGV6BPwb72YpMqEBONZMF+JrkVKhRCF0ur/4Bf5prHxg6Qfg1ytP/4csRC9DQ=="],"ultimate":false}}"#;
-        serde_json::from_str::<HashMap<String, PathInfo>>(path_info_json).expect("must serialize");
-    }
-    */
-}
diff --git a/src/push.rs b/src/push.rs
index 719d3a8..bf25ea1 100644
--- a/src/push.rs
+++ b/src/push.rs
@@ -1,6 +1,8 @@
 use std::{
+    collections::HashSet,
     fs,
     iter::once,
+    path::PathBuf,
     sync::{
         Arc,
         atomic::{AtomicUsize, Ordering},
@@ -8,22 +10,22 @@ use std::{
 };
 
 use anyhow::{Context, Result};
-use aws_config::Region;
-use aws_sdk_s3 as s3;
 use futures::future::join_all;
+use humansize::{DECIMAL, format_size};
 use nix_compat::narinfo::{self, SigningKey};
-use tokio::sync::{RwLock, mpsc};
-use tracing::{debug, info, trace};
+use object_store::aws::{AmazonS3, AmazonS3Builder};
+use tokio::sync::{RwLock, Semaphore, mpsc};
+use tracing::debug;
 use url::Url;
 
-use crate::{PushArgs, path_info::PathInfo, uploader::Uploader};
+use crate::{PushArgs, path_info::PathInfo, store::Store, uploader::Uploader};
 
 pub struct Push {
     upstream_caches: Vec<Url>,
-    store_paths: Arc<RwLock<Vec<PathInfo>>>,
-    s3_client: s3::Client,
+    store_paths: Arc<RwLock<HashSet<PathInfo>>>,
     signing_key: SigningKey<ed25519_dalek::SigningKey>,
-    bucket: String,
+    store: Arc<Store>,
+    s3: Arc<AmazonS3>,
     // paths that we skipped cause of a signature match
     signature_hit_count: AtomicUsize,
     // paths that we skipped cause we found it on an upstream
@@ -35,7 +37,7 @@ pub struct Push {
 }
 
 impl Push {
-    pub async fn new(cli: &PushArgs) -> Result<Self> {
+    pub async fn new(cli: &PushArgs, store: Store) -> Result<Self> {
         let mut upstreams = Vec::with_capacity(cli.upstreams.len() + 1);
         for upstream in cli
             .upstreams
@@ -49,24 +51,21 @@ impl Push {
         let key = fs::read_to_string(&cli.signing_key)?;
         let signing_key = narinfo::parse_keypair(key.as_str())?.0;
 
-        let mut s3_config = aws_config::from_env();
+        let mut s3_builder = AmazonS3Builder::from_env().with_bucket_name(&cli.bucket);
+
         if let Some(region) = &cli.region {
-            s3_config = s3_config.region(Region::new(region.clone()));
+            s3_builder = s3_builder.with_region(region);
         }
         if let Some(endpoint) = &cli.endpoint {
-            s3_config = s3_config.endpoint_url(endpoint);
-        }
-        if let Some(profile) = &cli.profile {
-            s3_config = s3_config.profile_name(profile);
+            s3_builder = s3_builder.with_endpoint(endpoint);
         }
 
-        let s3_client = s3::Client::new(&s3_config.load().await);
         Ok(Self {
             upstream_caches: upstreams,
-            store_paths: Arc::new(RwLock::new(Vec::new())),
-            s3_client,
+            store_paths: Arc::new(RwLock::new(HashSet::new())),
             signing_key,
-            bucket: cli.bucket.clone(),
+            store: Arc::new(store),
+            s3: Arc::new(s3_builder.build()?),
             signature_hit_count: AtomicUsize::new(0),
             upstream_hit_count: AtomicUsize::new(0),
             already_exists_count: AtomicUsize::new(0),
@@ -74,26 +73,42 @@ impl Push {
         })
     }
 
-    pub async fn paths_from_package(&mut self, package: &str) -> Result<()> {
-        let path_info = PathInfo::from_path(package)
+    pub async fn add_paths(&'static self, paths: Vec<PathBuf>) -> Result<()> {
+        let mut futs = Vec::with_capacity(paths.len());
+        for path in paths {
+            let store_paths = self.store_paths.clone();
+            let store = self.store.clone();
+
+            futs.push(tokio::spawn(async move {
+                let path_info = PathInfo::from_derivation(path.as_path(), &store)
+                    .await
+                    .context("get path info for path")?;
+                debug!("path-info for {path:?}: {path_info:?}");
+
+                store_paths.write().await.extend(
+                    path_info
+                        .get_closure(&store)
+                        .await
+                        .context("closure from path info")?,
+                );
+                Ok(())
+            }));
+        }
+        join_all(futs)
             .await
-            .context("get path info for package")?;
-        debug!("path-info for {package}: {:?}", path_info);
-        self.store_paths.write().await.extend(
-            path_info
-                .get_closure()
-                .await
-                .context("closure from path info")?,
-        );
-        info!("found {} store paths", self.store_paths.read().await.len());
+            .into_iter()
+            .flatten()
+            .collect::<Result<Vec<_>>>()?;
+        println!("found {} store paths", self.store_paths.read().await.len());
 
         Ok(())
     }
 
     pub async fn run(&'static self) -> Result<()> {
-        let (tx, rx) = mpsc::channel(10);
+        let (tx, rx) = mpsc::channel(1);
         let filter = tokio::spawn(self.filter_from_upstream(tx));
         let upload = tokio::spawn(self.upload(rx));
+
         filter.await?;
         upload.await??;
         Ok(())
@@ -101,33 +116,34 @@ impl Push {
 
     /// filter paths that are on upstream and send to `tx`
     async fn filter_from_upstream(&'static self, tx: mpsc::Sender<PathInfo>) {
-        let mut handles = Vec::with_capacity(10);
+        let mut handles = Vec::new();
         let store_paths = self.store_paths.read().await.clone();
+        // limit number of inflight requests
+        let inflight_permits = Arc::new(Semaphore::new(32));
 
         for path in store_paths.into_iter() {
             if path.check_upstream_signature(&self.upstream_caches) {
-                trace!("skip {} (signature match)", path.absolute_path());
-                self.signature_hit_count.fetch_add(1, Ordering::Release);
+                debug!("skip {} (signature match)", path.absolute_path());
+                self.signature_hit_count.fetch_add(1, Ordering::Relaxed);
                 continue;
             }
             handles.push({
                 let tx = tx.clone();
+                let inflight_permits = inflight_permits.clone();
                 tokio::spawn(async move {
+                    let _permit = inflight_permits.acquire().await.unwrap();
                     if !path
                         .check_upstream_hit(self.upstream_caches.as_slice())
                         .await
                     {
-                        if path
-                            .check_if_already_exists(&self.s3_client, self.bucket.clone())
-                            .await
-                        {
-                            trace!("skip {} (already exists)", path.absolute_path());
+                        if path.check_if_already_exists(&self.s3).await {
+                            debug!("skip {} (already exists)", path.absolute_path());
                             self.already_exists_count.fetch_add(1, Ordering::Relaxed);
                         } else {
                             tx.send(path).await.unwrap();
                         }
                     } else {
-                        trace!("skip {} (upstream hit)", path.absolute_path());
+                        debug!("skip {} (upstream hit)", path.absolute_path());
                         self.upstream_hit_count.fetch_add(1, Ordering::Relaxed);
                     }
                 })
@@ -142,24 +158,35 @@ impl Push {
     }
 
     async fn upload(&'static self, mut rx: mpsc::Receiver<PathInfo>) -> Result<()> {
-        let mut uploads = Vec::with_capacity(10);
+        let mut uploads = Vec::new();
+        let permits = Arc::new(Semaphore::new(10));
 
         loop {
+            let permits = permits.clone();
+
             if let Some(path_to_upload) = rx.recv().await {
-                let absolute_path = path_to_upload.absolute_path();
-
-                println!("uploading: {}", absolute_path);
-                let uploader = Uploader::new(
-                    &self.signing_key,
-                    path_to_upload,
-                    &self.s3_client,
-                    self.bucket.clone(),
-                )?;
-
-                uploads.push(tokio::spawn(async move {
-                    let res = uploader.upload().await;
-                    self.upload_count.fetch_add(1, Ordering::Relaxed);
-                    res
+                uploads.push(tokio::spawn({
+                    // large uploads will be concurrently uploaded with multipart anyway so don't spawn
+                    // too much of them
+                    let permit = if path_to_upload.nar_size > 15 * 1024 * 1024 {
+                        Some(permits.acquire_owned().await.unwrap())
+                    } else {
+                        None
+                    };
+                    println!(
+                        "uploading: {} (size: {})",
+                        path_to_upload.absolute_path(),
+                        format_size(path_to_upload.nar_size, DECIMAL)
+                    );
+                    let uploader = Uploader::new(&self.signing_key, path_to_upload)?;
+                    let s3 = self.s3.clone();
+                    let store = self.store.clone();
+                    async move {
+                        let res = uploader.upload(s3, store).await;
+                        drop(permit);
+                        self.upload_count.fetch_add(1, Ordering::Relaxed);
+                        res
+                    }
                 }));
             } else {
                 join_all(uploads)
diff --git a/src/store.rs b/src/store.rs
new file mode 100644
index 0000000..9b925b2
--- /dev/null
+++ b/src/store.rs
@@ -0,0 +1,100 @@
+use std::{ffi::OsStr, os::unix::ffi::OsStrExt, sync::Arc};
+
+use anyhow::{Context, Result};
+use nix_compat::store_path::StorePath;
+use tokio::{io::AsyncRead, task};
+use tokio_util::io::StreamReader;
+
+use crate::{
+    bindings::{self, AsyncWriteAdapter},
+    path_info::PathInfo,
+};
+
+pub struct Store {
+    inner: Arc<bindings::FfiNixStore>,
+}
+
+impl Store {
+    pub fn connect() -> Result<Self> {
+        let inner = unsafe { bindings::open_nix_store()? };
+        Ok(Self {
+            inner: Arc::new(inner),
+        })
+    }
+
+    pub async fn compute_fs_closure(
+        &self,
+        path: StorePath<String>,
+    ) -> Result<Vec<StorePath<String>>> {
+        let inner = self.inner.clone();
+        task::spawn_blocking(move || {
+            let cxx_vector =
+                inner
+                    .store()
+                    .compute_fs_closure(path.to_string().as_bytes(), false, true, true)?;
+            cxx_vector
+                .iter()
+                .map(|x| {
+                    StorePath::from_bytes(x.as_bytes())
+                        .context("make StorePath from vector returned by compute_fs_closure")
+                })
+                .collect::<Result<_, _>>()
+        })
+        .await
+        .unwrap()
+    }
+
+    pub async fn query_path_info(&self, path: StorePath<String>) -> Result<PathInfo> {
+        let inner = self.inner.clone();
+
+        task::spawn_blocking(move || {
+            let mut c_path_info = inner
+                .store()
+                .query_path_info(path.to_string().as_bytes())
+                .context("query cpp for path info")?;
+
+            let signatures = c_path_info
+                .pin_mut()
+                .sigs()
+                .into_iter()
+                .map(|x| {
+                    let osstr = OsStr::from_bytes(x.as_bytes());
+                    osstr.to_str().unwrap().to_string()
+                })
+                .collect();
+            let references = c_path_info
+                .pin_mut()
+                .references()
+                .into_iter()
+                .map(|x| StorePath::from_bytes(x.as_bytes()))
+                .collect::<Result<_, _>>()
+                .context("get references from pathinfo")?;
+            let nar_size = c_path_info.pin_mut().nar_size();
+
+            Ok(PathInfo {
+                path,
+                signatures,
+                references,
+                nar_size,
+            })
+        })
+        .await
+        .unwrap()
+    }
+
+    pub fn nar_from_path(&self, store_path: StorePath<String>) -> impl AsyncRead {
+        let inner = self.inner.clone();
+        let (adapter, mut sender) = AsyncWriteAdapter::new();
+        let base_name = store_path.to_string().as_bytes().to_vec();
+
+        tokio::task::spawn_blocking(move || {
+            // Send all exceptions through the channel, and ignore errors
+            // during sending (the channel may have been closed).
+            if let Err(e) = inner.store().nar_from_path(base_name, sender.clone()) {
+                let _ = sender.rust_error(e);
+            }
+        });
+
+        StreamReader::new(adapter)
+    }
+}
diff --git a/src/uploader.rs b/src/uploader.rs
index b0520ac..c829a79 100644
--- a/src/uploader.rs
+++ b/src/uploader.rs
@@ -1,187 +1,80 @@
 use anyhow::Result;
-use async_compression::{Level, tokio::bufread::ZstdEncoder};
-use aws_sdk_s3::{
-    self as s3,
-    types::{CompletedMultipartUpload, CompletedPart},
-};
-use futures::future::join_all;
-use nix_compat::{
-    narinfo::{self, NarInfo, SigningKey},
-    nixbase32,
-    store_path::StorePath,
-};
-use sha2::{Digest, Sha256};
-use tokio::{io::AsyncReadExt, process::Command};
-use tracing::debug;
+use bytes::BytesMut;
+use nix_compat::{narinfo::SigningKey, nixbase32};
+use object_store::{ObjectStore, aws::AmazonS3, buffered::BufWriter, path::Path};
+use std::sync::Arc;
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tracing::{debug, trace};
+use ulid::Ulid;
 
-use crate::path_info::PathInfo;
+use crate::{make_nar::MakeNar, path_info::PathInfo, store::Store};
 
-const MULTIPART_CUTOFF: usize = 1024 * 1024 * 5;
+const CHUNK_SIZE: usize = 1024 * 1024 * 5;
 
 pub struct Uploader<'a> {
     signing_key: &'a SigningKey<ed25519_dalek::SigningKey>,
     path: PathInfo,
-    s3_client: &'a s3::Client,
-    bucket: String,
 }
 
 impl<'a> Uploader<'a> {
     pub fn new(
         signing_key: &'a SigningKey<ed25519_dalek::SigningKey>,
         path: PathInfo,
-        s3_client: &'a s3::Client,
-        bucket: String,
     ) -> Result<Self> {
-        Ok(Self {
-            signing_key,
-            path,
-            s3_client,
-            bucket,
-        })
+        Ok(Self { signing_key, path })
     }
 
-    pub async fn upload(&self) -> Result<()> {
-        let nar = self.make_nar().await?;
-        let mut nar_info = self.narinfo_from_nar(&nar)?;
-        let nar = self.compress_nar(&nar).await;
+    pub async fn upload(&self, s3: Arc<AmazonS3>, store: Arc<Store>) -> Result<()> {
+        let mut nar = MakeNar::new(&self.path, store)?;
 
-        // update fields that we know after compression
-        let mut hasher = Sha256::new();
-        hasher.update(&nar);
-        let hash: [u8; 32] = hasher.finalize().into();
-        let nar_url = self.nar_url(&hash);
-        nar_info.file_hash = Some(hash);
-        nar_info.file_size = Some(nar.len() as u64);
-        nar_info.url = nar_url.as_str();
-        debug!("uploading nar with key: {nar_url}");
+        // we don't know what the hash of the compressed file will be so upload to a
+        // temp location for now
+        let temp_path = Path::parse(Ulid::new().to_string())?;
+        let mut s3_writer = BufWriter::new(s3.clone(), temp_path.clone());
+        debug!("uploading to temp path: {}", temp_path);
 
-        if nar.len() < MULTIPART_CUTOFF {
-            let put_object = self
-                .s3_client
-                .put_object()
-                .bucket(&self.bucket)
-                .key(&nar_url)
-                .body(nar.into())
-                .send()
-                .await?;
-            debug!("put object: {:#?}", put_object);
-        } else {
-            let multipart = self
-                .s3_client
-                .create_multipart_upload()
-                .bucket(&self.bucket)
-                .key(&nar_url)
-                .send()
-                .await?;
-            let upload_id = multipart.upload_id().unwrap();
-
-            let mut parts = Vec::with_capacity(nar.len() / MULTIPART_CUTOFF);
-            let chunks = nar.chunks(MULTIPART_CUTOFF);
-            for (i, chunk) in chunks.enumerate() {
-                parts.push(tokio::task::spawn(
-                    self.s3_client
-                        .upload_part()
-                        .bucket(&self.bucket)
-                        .key(&nar_url)
-                        .upload_id(upload_id)
-                        .part_number(i as i32 + 1)
-                        .body(chunk.to_vec().into())
-                        .send(),
-                ));
+        // compress and upload nar
+        let mut file_reader = nar.compress_and_hash()?;
+        loop {
+            let mut buf = BytesMut::with_capacity(CHUNK_SIZE);
+            let n = file_reader.read_buf(&mut buf).await?;
+            s3_writer.put(buf.freeze()).await?;
+            if n == 0 {
+                break;
             }
-
-            let completed_parts = join_all(parts)
-                .await
-                .into_iter()
-                .flatten()
-                .collect::<Result<Vec<_>, _>>()?
-                .into_iter()
-                .enumerate()
-                .map(|(i, part)| {
-                    CompletedPart::builder()
-                        .set_e_tag(part.e_tag().map(ToString::to_string))
-                        .set_part_number(Some(i as i32 + 1))
-                        .set_checksum_sha256(part.checksum_sha256().map(ToString::to_string))
-                        .build()
-                })
-                .collect::<Vec<_>>();
-
-            let completed_mp_upload = CompletedMultipartUpload::builder()
-                .set_parts(Some(completed_parts))
-                .build();
-
-            let complete_mp_upload = self
-                .s3_client
-                .complete_multipart_upload()
-                .bucket(&self.bucket)
-                .key(&nar_url)
-                .upload_id(upload_id)
-                .multipart_upload(completed_mp_upload)
-                .send()
-                .await?;
-
-            debug!("complete multipart upload: {:#?}", complete_mp_upload);
         }
+        drop(file_reader);
 
-        let narinfo_url = format!("{}.narinfo", self.path.digest());
-        debug!("uploading narinfo with key {narinfo_url}");
-        self.s3_client
-            .put_object()
-            .bucket(&self.bucket)
-            .key(narinfo_url)
-            .body(nar_info.to_string().as_bytes().to_vec().into())
-            .send()
-            .await?;
+        let mut nar_info = nar.get_narinfo()?;
+        nar_info.add_signature(self.signing_key);
+
+        // now that we can calculate the file_hash move the nar to where it should be
+        let real_path = nar_url(
+            &nar_info
+                .file_hash
+                .expect("file hash must be known at this point"),
+        );
+        debug!("moving {} to {}", temp_path, real_path);
+        // the temp object must be done uploading
+        s3_writer.shutdown().await?;
+        // this is implemented as a copy-and-delete
+        s3.rename(&temp_path, &real_path).await?;
+        // set nar url in narinfo
+        nar_info.url = real_path.as_ref();
+
+        // upload narinfo
+        let narinfo_path = self.path.narinfo_path();
+        debug!("uploading narinfo: {}", narinfo_path);
+        trace!("narinfo: {:#}", nar_info);
+        s3.put(&narinfo_path, nar_info.to_string().into()).await?;
 
         Ok(())
     }
-
-    async fn make_nar(&self) -> Result<Vec<u8>> {
-        Ok(Command::new("nix")
-            .arg("nar")
-            .arg("dump-path")
-            .arg(self.path.absolute_path())
-            .output()
-            .await?
-            .stdout)
-    }
-
-    fn narinfo_from_nar(&self, nar: &[u8]) -> Result<NarInfo> {
-        let mut hasher = Sha256::new();
-        hasher.update(nar);
-        let nar_hash: [u8; 32] = hasher.finalize().into();
-        let mut nar_info = NarInfo {
-            flags: narinfo::Flags::empty(),
-            store_path: self.path.path.as_ref(),
-            nar_hash,
-            nar_size: nar.len() as u64,
-            references: self.path.references.iter().map(StorePath::as_ref).collect(),
-            signatures: Vec::new(),
-            ca: None,
-            system: None,
-            deriver: self.path.deriver.as_ref().map(|x| x.as_ref()),
-            compression: Some("zstd"),
-            file_hash: None,
-            file_size: None,
-            url: "",
-        };
-        // signature consists of: store_path, nar_hash, nar_size, and references
-        nar_info.add_signature(self.signing_key);
-        Ok(nar_info)
-    }
-
-    fn nar_url(&self, compressed_nar_hash: &[u8]) -> String {
-        let compressed_nar_hash = nixbase32::encode(compressed_nar_hash);
-        format!("nar/{compressed_nar_hash}.nar.zst")
-    }
-
-    async fn compress_nar(&self, nar: &[u8]) -> Vec<u8> {
-        let mut encoder = ZstdEncoder::with_quality(nar, Level::Default);
-        let mut compressed = Vec::with_capacity(nar.len());
-        encoder
-            .read_to_end(&mut compressed)
-            .await
-            .expect("should compress just fine");
-        compressed
-    }
+}
+
+/// calculate url where the compressed nar should be uploaded
+fn nar_url(file_hash: &[u8]) -> Path {
+    let compressed_nar_hash = nixbase32::encode(file_hash);
+    Path::parse(format!("nar/{compressed_nar_hash}.nar.zst"))
+        .expect("should parse to a valid object_store::path::Path")
 }
diff --git a/tests/common/mod.rs b/tests/common/mod.rs
new file mode 100644
index 0000000..3870a1d
--- /dev/null
+++ b/tests/common/mod.rs
@@ -0,0 +1,32 @@
+#![allow(dead_code)]
+
+use std::process::Command;
+use std::sync::Arc;
+
+use nixcp::store::Store;
+
+pub const HELLO: &str = "github:nixos/nixpkgs?ref=f771eb401a46846c1aebd20552521b233dd7e18b#hello";
+pub const HELLO_DRV: &str = "iqbwkm8mjjjlmw6x6ry9rhzin2cp9372-hello-2.12.1.drv";
+pub const HELLO_PATH: &str = "/nix/store/9bwryidal9q3g91cjm6xschfn4ikd82q-hello-2.12.1";
+
+pub struct Context {
+    pub store: Arc<Store>,
+}
+
+impl Context {
+    fn new() -> Self {
+        // hello must be in the store
+        Command::new("nix")
+            .arg("build")
+            .arg("--no-link")
+            .arg(HELLO)
+            .status()
+            .unwrap();
+        let store = Arc::new(Store::connect().expect("connect to nix store"));
+        Self { store }
+    }
+}
+
+pub fn context() -> Context {
+    Context::new()
+}
diff --git a/tests/nar.rs b/tests/nar.rs
new file mode 100644
index 0000000..5ebadc5
--- /dev/null
+++ b/tests/nar.rs
@@ -0,0 +1,26 @@
+use crate::common::HELLO_PATH;
+use nix_compat::nixbase32;
+use nixcp::make_nar::MakeNar;
+use nixcp::path_info::PathInfo;
+use sha2::Digest;
+use tokio::io::AsyncReadExt;
+
+mod common;
+
+#[tokio::test]
+async fn nar_size_and_hash() {
+    let ctx = common::context();
+    let path_info = PathInfo::from_path(HELLO_PATH, &ctx.store).await.unwrap();
+
+    let mut nar = MakeNar::new(&path_info, ctx.store).unwrap();
+    let mut reader = nar.compress_and_hash().unwrap();
+    let mut buf = Vec::new();
+    reader.read_to_end(&mut buf).await.unwrap();
+    drop(reader);
+
+    assert_eq!(nar.nar_size, 234680);
+
+    let nar_hash = nar.nar_hasher.finalize();
+    let real_nar_hash = "08za7nnjda8kpdsd73v3mhykjvp0rsmskwsr37winhmzgm6iw79w";
+    assert_eq!(nixbase32::encode(nar_hash.as_slice()), real_nar_hash);
+}
diff --git a/tests/path_info.rs b/tests/path_info.rs
new file mode 100644
index 0000000..0f9543b
--- /dev/null
+++ b/tests/path_info.rs
@@ -0,0 +1,56 @@
+use nixcp::path_info::PathInfo;
+use std::path::PathBuf;
+
+use tempfile::TempDir;
+
+use crate::common::{HELLO, HELLO_DRV, HELLO_PATH};
+
+mod common;
+
+#[tokio::test]
+async fn path_info_from_package() {
+    let ctx = common::context();
+    let path = PathBuf::from(HELLO);
+    let path_info = PathInfo::from_derivation(&path, &ctx.store)
+        .await
+        .expect("get pathinfo from package");
+    assert_eq!(path_info.path.to_string(), HELLO_DRV);
+}
+
+#[tokio::test]
+async fn path_info_from_path() {
+    let ctx = common::context();
+    let path = PathBuf::from(HELLO_PATH);
+    let path_info = PathInfo::from_derivation(&path, &ctx.store)
+        .await
+        .expect("get pathinfo from package");
+    assert_eq!(path_info.path.to_string(), HELLO_DRV);
+}
+
+#[tokio::test]
+async fn path_info_symlink() {
+    let ctx = common::context();
+
+    let temp_path = TempDir::new().unwrap();
+    let link_path = temp_path.path().join("result");
+
+    // symlink at ./result (like `nix build`)
+    std::os::unix::fs::symlink(HELLO_PATH, &link_path).unwrap();
+
+    // should resolve symlink
+    let path_info = PathInfo::from_derivation(&link_path, &ctx.store)
+        .await
+        .expect("get pathinfo from package");
+    assert_eq!(path_info.path.to_string(), HELLO_DRV);
+}
+
+#[tokio::test]
+async fn closure() {
+    let ctx = common::context();
+    let path = PathBuf::from(HELLO);
+    let path_info = PathInfo::from_derivation(&path, &ctx.store)
+        .await
+        .expect("get pathinfo from package");
+    let closure = path_info.get_closure(&ctx.store).await.unwrap();
+    assert_eq!(closure.len(), 472);
+}