diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
new file mode 100644
index 000000000..450e57347
--- /dev/null
+++ b/.github/workflows/freebsd.yml
@@ -0,0 +1,56 @@
+# Builds and tests the workspace on FreeBSD, inside a FreeBSD VM on a Linux runner
+# (GitHub has no FreeBSD runners). GPU tests skip themselves when the VM has no adapter.
+name: FreeBSD
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    paths:
+      - Cargo.toml
+      - Cargo.lock
+      - "**/Cargo.toml"
+      - "crates/fonts/**"
+      - .github/workflows/freebsd.yml
+  workflow_dispatch:
+
+concurrency:
+  group: freebsd-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  freebsd:
+    name: FreeBSD 14 (build + test)
+    runs-on: ubuntu-latest
+    timeout-minutes: 300
+    steps:
+      - uses: actions/checkout@v4
+      # The Japanese font tests run against craft-fonts (an optional build input; they skip without it).
+      - name: Check out craft-fonts
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          repository: storytold/craft-fonts
+          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+          path: craft-fonts
+      - name: Build and test in a FreeBSD VM
+        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1
+        with:
+          release: "14.3"
+          usesh: true
+          cpu: 4
+          mem: 12288
+          # Nothing to bring back; copying the target dir out of the VM fails on large builds.
+          copyback: false
+          prepare: |
+            pkg install -y git curl pkgconf cmake python3 libxkbcommon wayland libX11 libXcursor libXrandr libXi libxcb mesa-libs vulkan-loader gtk3 fontconfig freetype2 alsa-lib
+            curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal
+          run: |
+            . "$HOME/.cargo/env"
+            # The checkout is synced in under another owner; let tests that call git read it.
+            git config --global --add safe.directory "*"
+            rustc --version
+            CARGO_PROFILE_DEV_DEBUG=0 cargo build --workspace --all-targets --locked
+            CRAFT_FONTS_DIR="$PWD/craft-fonts" CARGO_PROFILE_DEV_DEBUG=0 cargo test --workspace --locked
diff --git a/.github/workflows/packaging-lint.yml b/.github/workflows/packaging-lint.yml
new file mode 100644
index 000000000..17518ed76
--- /dev/null
+++ b/.github/workflows/packaging-lint.yml
@@ -0,0 +1,57 @@
+# Quick static checks for the release pipeline (seconds, no Rust build): workflow syntax,
+# packaging shell/PowerShell scripts, and the Linux desktop/AppStream/Flatpak metadata.
+name: Packaging lint
+
+on:
+  push:
+    branches: [main, release]
+    paths: [".github/workflows/**", "packaging/**", "assets/app-icon/**"]
+  pull_request:
+    paths: [".github/workflows/**", "packaging/**", "assets/app-icon/**"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: packaging-lint-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    env:
+      ACTIONLINT_VERSION: 1.7.12
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends shellcheck desktop-file-utils appstream libxml2-utils python3-yaml
+          curl -fsSL "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" \
+            | tar -xz -C "$RUNNER_TEMP" actionlint
+      - name: actionlint
+        run: |
+          "$RUNNER_TEMP/actionlint" -color
+      - name: shellcheck
+        run: shellcheck packaging/*.sh packaging/*/*.sh
+      - name: PowerShell
+        shell: pwsh
+        run: |
+          foreach ($f in Get-ChildItem packaging/windows/*.ps1) {
+            $errors = $null
+            [System.Management.Automation.Language.Parser]::ParseFile($f.FullName, [ref]$null, [ref]$errors) | Out-Null
+            if ($errors) { $errors | ForEach-Object { Write-Output "::error file=$($f.Name)::$_" }; exit 1 }
+            Write-Output "ok $($f.Name)"
+          }
+      - name: XML, desktop entry, AppStream, Flatpak manifest
+        run: |
+          xmllint --noout packaging/windows/wordcraft.wxs packaging/macos/*.plist* packaging/linux/*.xml*
+          # Windows Installer needs Icon ids ending in .ico or .exe, or shortcuts show a blank icon.
+          if grep -oE '<Icon Id="[^"]*"' packaging/windows/wordcraft.wxs | grep -vE '\.(ico|exe)"$'; then
+            echo "::error::Icon Id must end in .ico or .exe"; exit 1
+          fi
+          desktop-file-validate packaging/linux/ai.storyteller.wordcraft.desktop
+          sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' packaging/linux/ai.storyteller.wordcraft.metainfo.xml.in >"$RUNNER_TEMP/ai.storyteller.wordcraft.metainfo.xml"
+          appstreamcli validate --no-net --explain "$RUNNER_TEMP/ai.storyteller.wordcraft.metainfo.xml"
+          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/ai.storyteller.wordcraft.yml')); assert m['id'] == 'ai.storyteller.wordcraft' and m['command'] == 'wordcraft'"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 000000000..775f860f9
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,326 @@
+# Release pipeline: every push to `release` builds signed installers for every platform and
+# creates or updates the draft GitHub Release "WordCraft v<version>". See docs/releasing.md.
+#
+# All jobs run in the `release` environment (restricted to the `release` branch), which holds
+# the signing secrets. Every secret is optional: missing ones produce unsigned artifacts and a
+# warning, never a failed build.
+name: Release
+
+on:
+  push:
+    branches: [release]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version override for a test run, e.g. 0.2.0-rc.1 (empty: Cargo.toml)"
+        type: string
+        default: ""
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  # Never cancel a run mid-notarization or mid-upload; a newer push waits its turn.
+  cancel-in-progress: false
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: 0
+  RUST_BACKTRACE: 1
+  WORDCRAFT_BUILD_SHA: ${{ github.sha }}
+  INPUT_VERSION: ${{ inputs.version }}
+
+jobs:
+  version:
+    name: version
+    runs-on: ubuntu-latest
+    environment: release
+    outputs:
+      version: ${{ steps.v.outputs.version }}
+      date: ${{ steps.v.outputs.date }}
+      prerelease: ${{ steps.v.outputs.prerelease }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: v
+        name: Resolve version
+        run: |
+          . packaging/env.sh
+          v="${INPUT_VERSION#v}"
+          v="${v:-$VERSION}"
+          if ! printf '%s' "$v" | grep -Eq '^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$'; then
+            echo "::error::'$v' is not a version like 1.2.3 or 1.2.3-rc.1"
+            exit 1
+          fi
+          case "$v" in *-*) pre=true ;; *) pre=false ;; esac
+          {
+            echo "version=$v"
+            echo "date=$(date -u +%Y-%m-%d)"
+            echo "prerelease=$pre"
+          } >>"$GITHUB_OUTPUT"
+          echo "### WordCraft v$v (\`${GITHUB_SHA::9}\`)" >>"$GITHUB_STEP_SUMMARY"
+
+  macos:
+    name: macOS universal
+    needs: version
+    runs-on: macos-15
+    environment: release
+    env:
+      WORDCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      WORDCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+    steps:
+      - uses: actions/checkout@v4
+      # Optional font input (docs: storytold/craft-fonts docs/integration.md); releases always embed it.
+      - name: Check out craft-fonts
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          repository: storytold/craft-fonts
+          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+          path: craft-fonts
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-apple-darwin, x86_64-apple-darwin
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: release-macos-universal
+      - name: Apply version override
+        if: inputs.version != ''
+        run: cargo xtask version set "$WORDCRAFT_VERSION"
+      - name: Import signing certificate
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        run: packaging/macos/import-cert.sh
+      - name: Build, sign, notarize
+        env:
+          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
+          CRAFT_FONTS_REQUIRED: "1"
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: packaging/macos/package.sh --arch universal
+      - uses: actions/upload-artifact@v4
+        with:
+          name: release-macos
+          path: dist/release/*
+          if-no-files-found: error
+      - name: Remove temporary keychain
+        if: always()
+        run: |
+          if [ -n "${MACOS_KEYCHAIN:-}" ]; then security delete-keychain "$MACOS_KEYCHAIN" || true; fi
+
+  windows:
+    name: Windows ${{ matrix.arch }}
+    needs: version
+    runs-on: windows-latest
+    environment: release
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { arch: x64, target: x86_64-pc-windows-msvc }
+          - { arch: x86, target: i686-pc-windows-msvc }
+          # Windows on ARM: cross-compiled on the x64 runner, so signing and WiX run as above.
+          # .github/workflows/windows-arm64.yml installs and runs it on ARM64 hardware.
+          - { arch: arm64, target: aarch64-pc-windows-msvc }
+    env:
+      WORDCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      WORDCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+    steps:
+      - uses: actions/checkout@v4
+      # Optional font input (docs: storytold/craft-fonts docs/integration.md); releases always embed it.
+      - name: Check out craft-fonts
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          repository: storytold/craft-fonts
+          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+          path: craft-fonts
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: release-windows-${{ matrix.arch }}
+      - name: Apply version override
+        if: inputs.version != ''
+        shell: bash
+        run: cargo xtask version set "$WORDCRAFT_VERSION"
+      - name: Install WiX
+        shell: pwsh
+        run: dotnet tool install --global wix --version 5.0.2
+      - name: Build, sign, package
+        shell: pwsh
+        env:
+          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
+          CRAFT_FONTS_REQUIRED: "1"
+          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
+          AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
+          AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
+          AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }}
+        run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }}
+      - uses: actions/upload-artifact@v4
+        with:
+          name: release-windows-${{ matrix.arch }}
+          path: dist/release/*
+          if-no-files-found: error
+
+  linux:
+    name: Linux ${{ matrix.arch }}
+    needs: version
+    # The oldest GitHub-hosted image, so the binaries only need glibc >= 2.35 (Ubuntu 22.04+,
+    # Debian 12+, Fedora 36+, RHEL 10). See docs/releasing.md.
+    runs-on: ${{ matrix.runner }}
+    environment: release
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { arch: x86_64, runner: ubuntu-22.04, deb: amd64 }
+          - { arch: aarch64, runner: ubuntu-22.04-arm, deb: arm64 }
+    env:
+      WORDCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      WORDCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+      NFPM_VERSION: 2.47.0
+    steps:
+      - uses: actions/checkout@v4
+      # Optional font input (docs: storytold/craft-fonts docs/integration.md); releases always embed it.
+      - name: Check out craft-fonts
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          repository: storytold/craft-fonts
+          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+          path: craft-fonts
+      - name: Install build and packaging tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev libgl1-mesa-dev \
+            desktop-file-utils appstream python3-yaml
+          curl -fsSL -o "$RUNNER_TEMP/nfpm.deb" \
+            "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_${{ matrix.deb }}.deb"
+          sudo dpkg -i "$RUNNER_TEMP/nfpm.deb"
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: release-linux-${{ matrix.arch }}
+      - name: Apply version override
+        if: inputs.version != ''
+        run: cargo xtask version set "$WORDCRAFT_VERSION"
+      - name: Build and package (AppImage, deb, rpm, tar.gz)
+        env:
+          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
+          CRAFT_FONTS_REQUIRED: "1"
+        run: packaging/linux/package.sh
+      - name: Check the packages
+        run: |
+          dpkg-deb --info dist/release/*.deb
+          dpkg-deb --contents dist/release/*.deb | grep -E 'usr/bin/wordcraft$|metainfo|applications'
+          ldd target/release/wordcraft
+          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/ai.storyteller.wordcraft.yml')); assert m['id'] == 'ai.storyteller.wordcraft'"
+          for appimage in dist/release/*.AppImage; do
+            chmod +x "$appimage"
+            APPIMAGE_EXTRACT_AND_RUN=1 "$appimage" --version
+          done
+      - uses: actions/upload-artifact@v4
+        with:
+          name: release-linux-${{ matrix.arch }}
+          path: dist/release/*
+          if-no-files-found: error
+
+  web:
+    name: Web (wasm)
+    needs: version
+    runs-on: ubuntu-latest
+    environment: release
+    env:
+      WORDCRAFT_VERSION: ${{ needs.version.outputs.version }}
+      WORDCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
+      TRUNK_VERSION: 0.21.14
+    steps:
+      - uses: actions/checkout@v4
+      # Optional font input (docs: storytold/craft-fonts docs/integration.md); releases always embed it.
+      - name: Check out craft-fonts
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          repository: storytold/craft-fonts
+          ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+          path: craft-fonts
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: release-web
+      - name: Install trunk
+        run: |
+          curl -fsSL "https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" \
+            | tar -xz -C "$HOME/.cargo/bin" trunk
+          trunk --version
+      - name: Apply version override
+        if: inputs.version != ''
+        run: cargo xtask version set "$WORDCRAFT_VERSION"
+      - name: Build and zip
+        env:
+          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
+          CRAFT_FONTS_REQUIRED: "1"
+        run: packaging/web/package.sh
+      - uses: actions/upload-artifact@v4
+        with:
+          name: release-web
+          path: dist/release/*
+          if-no-files-found: error
+
+  release:
+    name: Draft GitHub Release
+    needs: [version, macos, windows, linux, web]
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: write
+    env:
+      VERSION: ${{ needs.version.outputs.version }}
+      PRERELEASE: ${{ needs.version.outputs.prerelease }}
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_REPO: ${{ github.repository }}
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: release-*
+          path: artifacts
+          merge-multiple: true
+      - name: Checksums
+        working-directory: artifacts
+        run: |
+          sha256sum -- * | tee SHA256SUMS.txt
+      - name: Create or update the draft release
+        working-directory: artifacts
+        run: |
+          tag="v$VERSION"
+          title="WordCraft v$VERSION"
+          pre=()
+          if [ "$PRERELEASE" = true ]; then pre=(--prerelease); fi
+          if draft="$(gh release view "$tag" --json isDraft --jq .isDraft 2>/dev/null)"; then
+            if [ "$draft" != "true" ]; then
+              echo "::error::Release $tag is already published. Bump the version (cargo xtask version set) before pushing to release."
+              exit 1
+            fi
+            echo "Updating draft $tag: replacing its assets"
+            gh release view "$tag" --json assets --jq '.assets[].name' | while read -r asset; do
+              gh release delete-asset "$tag" "$asset" --yes
+            done
+            gh release edit "$tag" --draft --title "$title" --target "$GITHUB_SHA" --prerelease="$PRERELEASE"
+            gh release upload "$tag" --clobber -- *
+          else
+            echo "Creating draft $tag"
+            gh release create "$tag" --draft --title "$title" --target "$GITHUB_SHA" --generate-notes "${pre[@]}" -- *
+          fi
+          {
+            echo "Draft release **$title** at \`${GITHUB_SHA::9}\`:"
+            echo
+            sed 's/^/    /' SHA256SUMS.txt
+          } >>"$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/windows-arm64.yml b/.github/workflows/windows-arm64.yml
new file mode 100644
index 000000000..46f7764a9
--- /dev/null
+++ b/.github/workflows/windows-arm64.yml
@@ -0,0 +1,95 @@
+# Windows on ARM: package the ARM64 release the way release.yml does (cross-compiled on an x64
+# runner, unsigned here), then install that MSI on a Windows 11 ARM64 runner, check the installed
+# binaries are ARM64, run the CLI natively, and uninstall. (A native ARM64 `cargo test` job is left
+# out for now: PrintCraft saw an intermittent access violation in egui UI tests there.)
+name: Windows ARM64
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    paths:
+      - Cargo.toml
+      - Cargo.lock
+      - "**/Cargo.toml"
+      - "**/build.rs"
+      - .github/workflows/windows-arm64.yml
+      - packaging/windows/**
+  schedule:
+    - cron: "41 4 * * 1" # weekly, so drift in the runner images shows up
+  workflow_dispatch:
+
+concurrency:
+  group: windows-arm64-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: 0
+
+jobs:
+  package:
+    name: package (cross-compiled on x64)
+    runs-on: windows-latest
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable
+        with:
+          targets: aarch64-pc-windows-msvc
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+        with:
+          key: windows-arm64-package
+      - name: Install WiX
+        shell: pwsh
+        run: dotnet tool install --global wix --version 5.0.2
+      - name: Build and package (unsigned)
+        shell: pwsh
+        env:
+          DIST: ${{ github.workspace }}\dist\arm64
+        run: ./packaging/windows/package.ps1 -Arch arm64
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wordcraft-windows-arm64
+          path: dist/arm64/*
+          if-no-files-found: error
+          retention-days: 7
+
+  install:
+    name: install and run on ARM64
+    needs: package
+    runs-on: windows-11-arm
+    timeout-minutes: 30
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: wordcraft-windows-arm64
+          path: dist
+      - name: Install the MSI, check it, run it, uninstall it
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $msi = (Get-ChildItem dist/*.msi | Select-Object -First 1).FullName
+          $p = Start-Process msiexec.exe -ArgumentList '/i', "`"$msi`"", '/qn', '/l*v', 'install.log' -Wait -PassThru
+          if ($p.ExitCode -ne 0) { Get-Content install.log -Tail 60; throw "msiexec /i exited $($p.ExitCode)" }
+          $dir = Join-Path $env:ProgramFiles 'WordCraft'
+          foreach ($exe in 'wordcraft.exe', 'wordcraft-cli.exe') {
+            $path = Join-Path $dir $exe
+            if (-not (Test-Path $path)) { throw "$exe not installed in $dir" }
+            $bytes = [System.IO.File]::ReadAllBytes($path)
+            $machine = [BitConverter]::ToUInt16($bytes, [BitConverter]::ToInt32($bytes, 0x3C) + 4)
+            if ($machine -ne 0xAA64) { throw "$exe is for machine 0x$('{0:X}' -f $machine), not ARM64" }
+            Write-Output "ok $path (ARM64)"
+          }
+          # The installed CLI runs natively on ARM64.
+          $cli = Join-Path $dir 'wordcraft-cli.exe'
+          $out = & $cli --version 2>&1 | Out-String
+          if ($LASTEXITCODE -ne 0) { Write-Output $out; throw "wordcraft-cli --version exited $LASTEXITCODE" }
+          Write-Output "ok wordcraft-cli --version: $($out.Trim())"
+          $p = Start-Process msiexec.exe -ArgumentList '/x', "`"$msi`"", '/qn' -Wait -PassThru
+          if ($p.ExitCode -ne 0) { throw "msiexec /x exited $($p.ExitCode)" }
+          if (Test-Path (Join-Path $dir 'wordcraft.exe')) { throw 'uninstall left wordcraft.exe behind' }
+          Write-Output 'ok uninstalled'
diff --git a/Cargo.lock b/Cargo.lock
index cffb7c494..3400a6ed7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3759,10 +3759,12 @@ version = "1.1.6+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "920602543f0911ab71da12c50d59701da54c196d1a2bf5cb4b75667f137a406a"
 dependencies = [
+ "indexmap",
  "serde_core",
  "serde_spanned",
  "toml_datetime",
  "toml_parser",
+ "toml_writer",
  "winnow",
 ]
 
@@ -3796,6 +3798,12 @@ dependencies = [
  "winnow",
 ]
 
+[[package]]
+name = "toml_writer"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2"
+
 [[package]]
 name = "tracing"
 version = "0.1.44"
@@ -4806,6 +4814,16 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "winresource"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0986a8b1d586b7d3e4fe3d9ea39fb451ae22869dcea4aa109d287a374d866087"
+dependencies = [
+ "toml",
+ "version_check",
+]
+
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"
@@ -4821,6 +4839,7 @@ dependencies = [
  "log",
  "rfd",
  "serde_json",
+ "winresource",
  "wordcraft-doc",
  "wordcraft-engine",
  "wordcraft-ui-egui",
diff --git a/apps/wordcraft/Cargo.toml b/apps/wordcraft/Cargo.toml
index 83cdbc2dc..2323e9ffd 100644
--- a/apps/wordcraft/Cargo.toml
+++ b/apps/wordcraft/Cargo.toml
@@ -19,5 +19,9 @@ egui = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
 
+[build-dependencies]
+# Icon + VERSIONINFO for wordcraft.exe; build.rs only uses it when the target is Windows.
+winresource = "0.1"
+
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 rfd = { workspace = true }
diff --git a/apps/wordcraft/build.rs b/apps/wordcraft/build.rs
new file mode 100644
index 000000000..d025b2f89
--- /dev/null
+++ b/apps/wordcraft/build.rs
@@ -0,0 +1,30 @@
+//! Windows only: embed the app icon and version info (VERSIONINFO) into `wordcraft.exe`, so it
+//! shows in Explorer, the taskbar, the Start menu and Alt-Tab.
+//!
+//! On every other target this does nothing. A missing resource compiler is a warning, so a
+//! cross-compile from macOS or Linux still links, unless `WORDCRAFT_REQUIRE_WINRES=1` turns it
+//! into an error (for release builds).
+
+fn main() {
+    println!("cargo:rerun-if-changed=build.rs");
+    println!("cargo:rerun-if-changed=../../assets/app-icon/wordcraft.ico");
+    println!("cargo:rerun-if-env-changed=WORDCRAFT_REQUIRE_WINRES");
+    if std::env::var("CARGO_CFG_TARGET_OS").as_deref() != Ok("windows") {
+        return;
+    }
+    let mut res = winresource::WindowsResource::new();
+    res.set_icon("../../assets/app-icon/wordcraft.ico")
+        .set("ProductName", "WordCraft")
+        .set("FileDescription", "WordCraft word processor")
+        .set("CompanyName", "Learning Machines LLC")
+        .set("LegalCopyright", "Copyright (c) the WordCraft authors. MIT OR Apache-2.0.")
+        .set("OriginalFilename", "wordcraft.exe")
+        .set("InternalName", "wordcraft");
+    if let Err(e) = res.compile() {
+        if std::env::var_os("WORDCRAFT_REQUIRE_WINRES").is_some() {
+            eprintln!("embedding Windows resources failed: {e}");
+            std::process::exit(1);
+        }
+        println!("cargo:warning=wordcraft.exe built without icon/version resources: {e}");
+    }
+}
diff --git a/apps/wordcraft/src/main.rs b/apps/wordcraft/src/main.rs
index 637ab798f..a3685d431 100644
--- a/apps/wordcraft/src/main.rs
+++ b/apps/wordcraft/src/main.rs
@@ -111,7 +111,7 @@ fn main() -> eframe::Result {
             "--control" => control_port = args.next().and_then(|p| p.parse().ok()),
             "--sample" => sample = true,
             "--version" => {
-                println!("wordcraft {}", env!("CARGO_PKG_VERSION"));
+                println!("wordcraft {} ({})", env!("CARGO_PKG_VERSION"), option_env!("WORDCRAFT_BUILD_SHA").map(|s| s.get(..8).unwrap_or(s)).unwrap_or("dev"));
                 return Ok(());
             }
             _ => files.push(a),
diff --git a/crates/render/src/lib.rs b/crates/render/src/lib.rs
index 262e1a4b4..a85d60e9c 100644
--- a/crates/render/src/lib.rs
+++ b/crates/render/src/lib.rs
@@ -14,6 +14,18 @@ use wordcraft_fonts::FontDb;
 use wordcraft_layout::Page;
 use wordcraft_layout::display::{DisplayOptions, Draw, Stroke, page_display};
 
+/// Worker threads for rasterising (0 on the web, where there are no threads).
+pub fn default_threads() -> u16 {
+    #[cfg(target_arch = "wasm32")]
+    {
+        0
+    }
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        std::thread::available_parallelism().map(|n| (n.get().saturating_sub(1)).clamp(1, 8) as u16).unwrap_or(2)
+    }
+}
+
 /// Largest raster side vello_cpu handles comfortably.
 pub const MAX_SIDE: u32 = 16_000;
 
@@ -161,7 +173,7 @@ pub fn render_page(doc: &Document, page: &Page, scale: f32, opts: &RenderOptions
 /// Render a page into a `w`×`h` raster with `view` (page points → pixels).
 pub fn render_region(doc: &Document, page: &Page, w: u32, h: u32, view: Affine, opts: &RenderOptions) -> Rendered {
     let (w16, h16) = (w.clamp(1, MAX_SIDE) as u16, h.clamp(1, MAX_SIDE) as u16);
-    let mut ctx = RenderContext::new(w16, h16);
+    let mut ctx = RenderContext::new_with(w16, h16, vello_cpu::RenderSettings { num_threads: default_threads(), ..Default::default() });
     ctx.set_transform(Affine::IDENTITY);
     ctx.set_paint(color(doc.settings.page_color.unwrap_or(opts.paper), 1.0));
     ctx.fill_rect(&kurbo::Rect::new(0.0, 0.0, w16 as f64, h16 as f64));
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index 9e67986ed..b4b6835e0 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -697,7 +697,7 @@ fn body(app: &mut WordApp, ui: &mut Ui, d: &mut Dialog) -> bool {
         }
         Dialog::About => {
             ui.label(egui::RichText::new("WordCraft").font(semibold(22.0)));
-            ui.label(format!("Version {}", env!("CARGO_PKG_VERSION")));
+            ui.label(format!("Version {} ({})", env!("CARGO_PKG_VERSION"), option_env!("WORDCRAFT_BUILD_SHA").map(|s| s.get(..8).unwrap_or(s)).unwrap_or("development build")));
             ui.label("A free, open-source word processor written from scratch in Rust.\nPart of the Crafting Apps from the ArtCraft team.");
             ui.add_space(6.0);
             ui.hyperlink_to("getartcraft.com/apps/wordcraft", "https://getartcraft.com/apps/wordcraft");
diff --git a/packaging/env.sh b/packaging/env.sh
new file mode 100644
index 000000000..2614fc06c
--- /dev/null
+++ b/packaging/env.sh
@@ -0,0 +1,69 @@
+# shellcheck shell=bash
+# Shared setup for the packaging scripts. Source it: `. "$(dirname "$0")/../env.sh"`.
+#
+# Exports:
+#   ROOT                    workspace root
+#   VERSION                 [workspace.package] version from Cargo.toml (override: WORDCRAFT_VERSION)
+#   DIST                    output directory for release artifacts (default: $ROOT/dist/release)
+#   WORDCRAFT_BUILD_SHA    git commit baked into the binaries (see crates/engine/src/build_info.rs)
+#   WORDCRAFT_BUILD_DATE   UTC build date, YYYY-MM-DD
+#   CARGO_TARGET_DIR        cargo's target dir (default: $ROOT/target)
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+export ROOT
+
+# The version lives in exactly one place: `[workspace.package] version` in the root Cargo.toml.
+# (`cargo xtask version` prints the same thing; awk avoids compiling xtask here.)
+workspace_version() {
+  awk '
+    /^\[/ { in_pkg = ($0 == "[workspace.package]") ; next }
+    in_pkg && $1 == "version" { gsub(/[" ]/, "", $3); print $3; exit }
+  ' "$ROOT/Cargo.toml"
+}
+
+VERSION="${WORDCRAFT_VERSION:-$(workspace_version)}"
+if [ -z "$VERSION" ]; then
+  echo "error: could not read [workspace.package] version from $ROOT/Cargo.toml" >&2
+  exit 1
+fi
+export VERSION
+
+DIST="${DIST:-$ROOT/dist/release}"
+mkdir -p "$DIST"
+export DIST
+
+if [ -z "${WORDCRAFT_BUILD_SHA:-}" ]; then
+  WORDCRAFT_BUILD_SHA="$(git -C "$ROOT" rev-parse HEAD 2>/dev/null || true)"
+fi
+export WORDCRAFT_BUILD_SHA
+export WORDCRAFT_BUILD_DATE="${WORDCRAFT_BUILD_DATE:-$(date -u +%Y-%m-%d)}"
+export CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-$ROOT/target}"
+
+# Emit a GitHub Actions warning (plain stderr outside Actions).
+warn() {
+  if [ -n "${GITHUB_ACTIONS:-}" ]; then echo "::warning::$*"; else echo "warning: $*" >&2; fi
+}
+
+# Copy licence and readme files that exist into a package directory.
+copy_docs() {
+  local dest="$1" f
+  for f in README.md LICENSE LICENSE-MIT LICENSE-APACHE COPYRIGHT; do
+    if [ -f "$ROOT/$f" ]; then cp "$ROOT/$f" "$dest/"; fi
+  done
+  copy_font_licences "$dest"
+}
+
+# Builds made with craft-fonts (CRAFT_FONTS_DIR, set by the release workflow) embed its fonts, so
+# the package carries their licences as OFL-<family-dir>.txt. Nothing without CRAFT_FONTS_DIR.
+copy_font_licences() {
+  local dest="$1" f
+  [ -n "${CRAFT_FONTS_DIR:-}" ] || return 0
+  for f in "$CRAFT_FONTS_DIR"/fonts/*/OFL.txt; do
+    if [ -f "$f" ]; then cp "$f" "$dest/OFL-$(basename "$(dirname "$f")").txt"; fi
+  done
+}
+
+# Portable SHA-256 of a file (prints just the hash).
+sha256() {
+  if command -v sha256sum >/dev/null; then sha256sum "$1" | cut -d' ' -f1; else shasum -a 256 "$1" | cut -d' ' -f1; fi
+}
diff --git a/packaging/linux/ai.storyteller.wordcraft.desktop b/packaging/linux/ai.storyteller.wordcraft.desktop
new file mode 100644
index 000000000..ea9a113cc
--- /dev/null
+++ b/packaging/linux/ai.storyteller.wordcraft.desktop
@@ -0,0 +1,14 @@
+[Desktop Entry]
+Type=Application
+Name=WordCraft
+GenericName=Word Processor
+Comment=Write and design documents; open and save Word files
+Exec=wordcraft %F
+TryExec=wordcraft
+Icon=ai.storyteller.wordcraft
+Terminal=false
+StartupNotify=true
+StartupWMClass=ai.storyteller.wordcraft
+Categories=Office;WordProcessor;
+Keywords=word;processor;document;docx;writer;text;letter;report;
+MimeType=application/vnd.openxmlformats-officedocument.wordprocessingml.document;application/vnd.oasis.opendocument.text;application/rtf;text/markdown;text/html;text/plain;
diff --git a/packaging/linux/ai.storyteller.wordcraft.metainfo.xml.in b/packaging/linux/ai.storyteller.wordcraft.metainfo.xml.in
new file mode 100644
index 000000000..b28437e53
--- /dev/null
+++ b/packaging/linux/ai.storyteller.wordcraft.metainfo.xml.in
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- AppStream metadata (software centres, Flathub). Template: package.sh and the Flatpak
+     manifest substitute @VERSION@ and @DATE@ from Cargo.toml and the build date. -->
+<component type="desktop-application">
+  <id>ai.storyteller.wordcraft</id>
+  <metadata_license>CC0-1.0</metadata_license>
+  <project_license>MIT OR Apache-2.0</project_license>
+  <name>WordCraft</name>
+  <summary>Write and design documents; open and save Word files</summary>
+  <developer id="ai.storyteller">
+    <name>Learning Machines LLC</name>
+  </developer>
+  <description>
+    <p>
+      WordCraft is a fast, open-source word processor with a familiar ribbon: styles, tables, track changes, references, mail merge, and .docx, PDF, ODT, RTF, HTML and Markdown files. It can be driven by AI agents over MCP.
+    </p>
+  </description>
+  <launchable type="desktop-id">ai.storyteller.wordcraft.desktop</launchable>
+  <icon type="stock">ai.storyteller.wordcraft</icon>
+  <!-- Only url types known to appstream 0.15 (Ubuntu 22.04, where CI validates): no vcs-browser. -->
+  <url type="homepage">https://getartcraft.com/apps/wordcraft</url>
+  <url type="bugtracker">https://github.com/storytold/wordcraft/issues</url>
+  <url type="help">https://github.com/storytold/wordcraft</url>
+  <url type="contact">https://discord.gg/artcraft</url>
+  <categories>
+    <category>Office</category>
+    <category>WordProcessor</category>
+  </categories>
+  <keywords>
+    <keyword>word processor</keyword>
+    <keyword>docx</keyword>
+    <keyword>document</keyword>
+    <keyword>writer</keyword>
+  </keywords>
+  <screenshots>
+    <screenshot type="default">
+      <caption>The Open Studio Handbook sample with the Navigation pane</caption>
+      <image>https://raw.githubusercontent.com/storytold/wordcraft/main/docs/images/hero.png</image>
+    </screenshot>
+  </screenshots>
+  <branding>
+    <color type="primary" scheme_preference="light">#b9c7f5</color>
+    <color type="primary" scheme_preference="dark">#2b47b5</color>
+  </branding>
+  <requires>
+    <display_length compare="ge">760</display_length>
+  </requires>
+  <supports>
+    <control>keyboard</control>
+    <control>pointing</control>
+    <control>tablet</control>
+  </supports>
+  <provides>
+    <binary>wordcraft</binary>
+  </provides>
+  <content_rating type="oars-1.1"/>
+  <releases>
+    <release version="@VERSION@" date="@DATE@"/>
+  </releases>
+</component>
diff --git a/packaging/linux/ai.storyteller.wordcraft.mime.xml b/packaging/linux/ai.storyteller.wordcraft.mime.xml
new file mode 100644
index 000000000..be4dcc220
--- /dev/null
+++ b/packaging/linux/ai.storyteller.wordcraft.mime.xml
@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<mime-info xmlns="http://www.freedesktop.org/standards/shared-mime-info">
+</mime-info>
diff --git a/packaging/linux/flatpak/ai.storyteller.wordcraft.yml b/packaging/linux/flatpak/ai.storyteller.wordcraft.yml
new file mode 100644
index 000000000..805f5863c
--- /dev/null
+++ b/packaging/linux/flatpak/ai.storyteller.wordcraft.yml
@@ -0,0 +1,56 @@
+# Flatpak manifest for WordCraft, ready for a Flathub submission.
+#
+# Flatpak builds run offline, so the crate sources must be vendored first. From the repo root:
+#
+#   curl -fsSLO https://raw.githubusercontent.com/flatpak/flatpak-builder-tools/master/cargo/flatpak-cargo-generator.py
+#   python3 flatpak-cargo-generator.py Cargo.lock -o packaging/linux/flatpak/cargo-sources.json
+#   flatpak-builder --user --install --force-clean build-flatpak packaging/linux/flatpak/ai.storyteller.wordcraft.yml
+#   flatpak run ai.storyteller.wordcraft
+#
+# For Flathub, replace the `dir` source with a `git` source pinned to a release tag and commit.
+id: ai.storyteller.wordcraft
+runtime: org.freedesktop.Platform
+runtime-version: '25.08'
+sdk: org.freedesktop.Sdk
+sdk-extensions:
+  - org.freedesktop.Sdk.Extension.rust-stable
+command: wordcraft
+finish-args:
+  - --share=ipc
+  - --socket=wayland
+  - --socket=fallback-x11
+  - --device=dri
+  # Open/Save dialogs use the file-chooser portal (rfd), and drag-and-drop uses the document
+  # portal, so broad filesystem access isn't needed. Pictures is granted for opening files by
+  # path from the command line.
+  - --filesystem=xdg-pictures
+build-options:
+  append-path: /usr/lib/sdk/rust-stable/bin
+modules:
+  - name: wordcraft
+    buildsystem: simple
+    build-options:
+      env:
+        CARGO_HOME: /run/build/wordcraft/cargo
+        CARGO_NET_OFFLINE: 'true'
+    build-commands:
+      - cargo --offline build --release --locked -p wordcraft
+      - install -Dm755 target/release/wordcraft /app/bin/wordcraft
+      - install -Dm644 packaging/linux/ai.storyteller.wordcraft.desktop /app/share/applications/ai.storyteller.wordcraft.desktop
+      - install -Dm644 packaging/linux/ai.storyteller.wordcraft.mime.xml /app/share/mime/packages/ai.storyteller.wordcraft.xml
+      - mkdir -p /app/share/icons && cp -R assets/app-icon/hicolor /app/share/icons/
+      - >-
+        version=$(awk '/^\[/{p=($0=="[workspace.package]");next} p&&$1=="version"{gsub(/[" ]/,"",$3);print $3;exit}' Cargo.toml);
+        install -d /app/share/metainfo;
+        sed -e "s/@VERSION@/$version/" -e "s/@DATE@/$(date -u +%Y-%m-%d)/"
+        packaging/linux/ai.storyteller.wordcraft.metainfo.xml.in > /app/share/metainfo/ai.storyteller.wordcraft.metainfo.xml
+    sources:
+      - type: dir
+        path: ../../..
+        skip:
+          - target
+          - dist
+          - corpus
+          - build-flatpak
+          - .flatpak-builder
+      - cargo-sources.json
diff --git a/packaging/linux/nfpm.yaml b/packaging/linux/nfpm.yaml
new file mode 100644
index 000000000..a91f34263
--- /dev/null
+++ b/packaging/linux/nfpm.yaml
@@ -0,0 +1,70 @@
+# .deb and .rpm packages (nfpm: https://nfpm.goreleaser.com). Run by package.sh, which stages
+# the file tree, substitutes its path for ${STAGE} (nfpm doesn't expand env vars in `src`) and
+# exports VERSION and NFPM_ARCH.
+#
+#   nfpm package -f packaging/linux/nfpm.yaml -p deb -t dist/release/
+name: wordcraft
+arch: ${NFPM_ARCH}
+platform: linux
+version: ${VERSION}
+# semver: 0.2.0-rc.1 becomes 0.2.0~rc.1 in deb/rpm, so pre-releases sort before the release.
+version_schema: semver
+release: 1
+section: graphics
+priority: optional
+maintainer: ${WORDCRAFT_MAINTAINER}
+vendor: Learning Machines LLC
+homepage: https://getartcraft.com/apps/wordcraft
+license: MIT OR Apache-2.0
+description: |-
+  Open-source, native image editor that works the way Photoshop users expect.
+  Layers, masks, adjustment layers, layer styles, type and brushes; opens and
+  saves layered PSD/PSB files; 8/16/32-bit documents; GPU compositing (wgpu).
+  Includes wordcraft-cli, a headless converter and command runner.
+
+# The binaries link only glibc and libgcc_s directly. Windowing (X11/Wayland, xkbcommon) and the
+# GPU (Vulkan, EGL/GL) are loaded at runtime, so they are dependencies/recommendations here
+# rather than ELF NEEDED entries.
+overrides:
+  deb:
+    depends:
+      - libc6 (>= 2.35)
+      - libgcc-s1
+      - libxkbcommon0
+      - libvulkan1 | libegl1
+    recommends:
+      - libwayland-client0
+      - libx11-6
+      - libx11-xcb1
+      - libxcursor1
+      - libxi6
+      - libxrandr2
+      - mesa-vulkan-drivers
+      - xdg-desktop-portal
+  rpm:
+    depends:
+      - libxkbcommon
+      - (vulkan-loader or libglvnd-egl)
+    recommends:
+      - libwayland-client
+      - libX11
+      - libXcursor
+      - libXi
+      - libXrandr
+      - mesa-vulkan-drivers
+      - xdg-desktop-portal
+
+contents:
+  - src: ${STAGE}/usr/bin/wordcraft
+    dst: /usr/bin/wordcraft
+    file_info: { mode: 0755 }
+  - src: ${STAGE}/usr/bin/wordcraft-cli
+    dst: /usr/bin/wordcraft-cli
+    file_info: { mode: 0755 }
+  - src: ${STAGE}/usr/share/
+    dst: /usr/share/
+    type: tree
+
+scripts:
+  postinstall: packaging/linux/postinst.sh
+  postremove: packaging/linux/postinst.sh
diff --git a/packaging/linux/package.sh b/packaging/linux/package.sh
new file mode 100755
index 000000000..36d9c609c
--- /dev/null
+++ b/packaging/linux/package.sh
@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# Build and package WordCraft for Linux (<arch> is x86_64 or aarch64):
+#
+#   $DIST/wordcraft-<version>-linux-<arch>.AppImage  any distro with glibc >= the build host's
+#   $DIST/wordcraft-<version>-linux-<arch>.deb       Debian, Ubuntu, Mint, Pop!_OS, ...
+#   $DIST/wordcraft-<version>-linux-<arch>.rpm       Fedora, openSUSE, RHEL, ...
+#   $DIST/wordcraft-<version>-linux-<arch>.tar.gz    plain FHS-style tree (bin/, share/)
+#
+# Usage: packaging/linux/package.sh [--skip-build] [--formats "appimage deb rpm tar"]
+#
+# Needs: cargo; nfpm for deb/rpm (https://nfpm.goreleaser.com); appimagetool for the AppImage
+# (downloaded into $CARGO_TARGET_DIR if missing). Build on an old distro (CI: Ubuntu 22.04,
+# glibc 2.35) so the binaries run on newer ones. Optional: desktop-file-validate, appstreamcli.
+set -euo pipefail
+# shellcheck source=../env.sh
+. "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
+HERE="$ROOT/packaging/linux"
+APP_ID=ai.storyteller.wordcraft
+
+SKIP_BUILD=0
+FORMATS="appimage deb rpm tar"
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --skip-build) SKIP_BUILD=1; shift ;;
+    --formats) FORMATS="$2"; shift 2 ;;
+    -h | --help) sed -n '2,15p' "$0"; exit 0 ;;
+    *) echo "unknown argument: $1" >&2; exit 2 ;;
+  esac
+done
+
+ARCH="$(uname -m)"
+case "$ARCH" in
+  x86_64) DEB_ARCH=amd64 ;;
+  aarch64 | arm64) ARCH=aarch64; DEB_ARCH=arm64 ;;
+  *) echo "unsupported architecture $ARCH" >&2; exit 2 ;;
+esac
+export WORDCRAFT_MAINTAINER="${WORDCRAFT_MAINTAINER:-WordCraft maintainers <wordcraft@storyteller.ai>}"
+BASENAME="wordcraft-$VERSION-linux-$ARCH"
+
+echo "==> WordCraft $VERSION for Linux $ARCH ($FORMATS)"
+
+if [ "$SKIP_BUILD" = 0 ]; then
+  (cd "$ROOT" && cargo build --release --locked -p wordcraft -p wordcraft-cli)
+fi
+BIN="$CARGO_TARGET_DIR/release"
+WORK="$CARGO_TARGET_DIR/linux-package"
+STAGE="$WORK/root"
+rm -rf "$WORK"
+
+# ---- stage an FHS tree (shared by every format) -------------------------------------------------
+install -Dm755 "$BIN/wordcraft" "$STAGE/usr/bin/wordcraft"
+install -Dm755 "$BIN/wordcraft-cli" "$STAGE/usr/bin/wordcraft-cli"
+strip "$STAGE/usr/bin/wordcraft" "$STAGE/usr/bin/wordcraft-cli" 2>/dev/null || true
+install -Dm644 "$HERE/$APP_ID.desktop" "$STAGE/usr/share/applications/$APP_ID.desktop"
+install -Dm644 "$HERE/$APP_ID.mime.xml" "$STAGE/usr/share/mime/packages/$APP_ID.xml"
+mkdir -p "$STAGE/usr/share/metainfo"
+sed -e "s/@VERSION@/$VERSION/g" -e "s/@DATE@/$WORDCRAFT_BUILD_DATE/g" \
+  "$HERE/$APP_ID.metainfo.xml.in" >"$STAGE/usr/share/metainfo/$APP_ID.metainfo.xml"
+mkdir -p "$STAGE/usr/share/icons"
+cp -R "$ROOT/assets/app-icon/hicolor" "$STAGE/usr/share/icons/"
+mkdir -p "$STAGE/usr/share/doc/wordcraft"
+copy_docs "$STAGE/usr/share/doc/wordcraft"
+
+if command -v desktop-file-validate >/dev/null; then
+  desktop-file-validate "$STAGE/usr/share/applications/$APP_ID.desktop"
+fi
+if command -v appstreamcli >/dev/null; then
+  appstreamcli validate --no-net --explain "$STAGE/usr/share/metainfo/$APP_ID.metainfo.xml"
+fi
+
+has() { case " $FORMATS " in *" $1 "*) return 0 ;; *) return 1 ;; esac; }
+
+# ---- .tar.gz ------------------------------------------------------------------------------------
+if has tar; then
+  mkdir -p "$WORK/tar"
+  cp -R "$STAGE/usr" "$WORK/tar/$BASENAME"
+  tar -C "$WORK/tar" -czf "$DIST/$BASENAME.tar.gz" "$BASENAME"
+  echo "wrote $DIST/$BASENAME.tar.gz"
+fi
+
+# ---- .deb / .rpm --------------------------------------------------------------------------------
+if has deb || has rpm; then
+  command -v nfpm >/dev/null || { echo "error: nfpm not found (https://nfpm.goreleaser.com/install/)" >&2; exit 1; }
+  export VERSION
+  export NFPM_ARCH="$DEB_ARCH"
+  # nfpm expands env vars in fields like `version` and `arch`, but not in `contents[].src`.
+  sed "s|\${STAGE}|$STAGE|g" "$HERE/nfpm.yaml" >"$WORK/nfpm.yaml"
+  for fmt in deb rpm; do
+    if has "$fmt"; then (cd "$ROOT" && nfpm package -f "$WORK/nfpm.yaml" -p "$fmt" -t "$DIST/$BASENAME.$fmt"); fi
+  done
+fi
+
+# ---- AppImage -----------------------------------------------------------------------------------
+if has appimage; then
+  APPDIR="$WORK/WordCraft.AppDir"
+  cp -R "$STAGE" "$APPDIR"
+  mv "$APPDIR/usr/share/doc" "$WORK/doc-unused"
+  ln -s usr/bin/wordcraft "$APPDIR/AppRun"
+  cp "$HERE/$APP_ID.desktop" "$APPDIR/$APP_ID.desktop"
+  cp "$ROOT/assets/app-icon/hicolor/256x256/apps/$APP_ID.png" "$APPDIR/$APP_ID.png"
+  ln -s "$APP_ID.png" "$APPDIR/.DirIcon"
+
+  TOOL="${APPIMAGETOOL:-$(command -v appimagetool || true)}"
+  if [ -z "$TOOL" ]; then
+    TOOL="$CARGO_TARGET_DIR/appimagetool-$ARCH.AppImage"
+    if [ ! -x "$TOOL" ]; then
+      curl -fsSL -o "$TOOL" "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-$ARCH.AppImage"
+      chmod +x "$TOOL"
+    fi
+  fi
+  OUT="$DIST/$BASENAME.AppImage"
+  # Extract-and-run: works without FUSE (containers, CI). The output embeds the static runtime,
+  # so users don't need libfuse2 either.
+  ARCH="$ARCH" APPIMAGE_EXTRACT_AND_RUN=1 "$TOOL" --no-appstream "$APPDIR" "$OUT"
+  echo "wrote $OUT"
+fi
+
+"$STAGE/usr/bin/wordcraft-cli" --version
+echo "==> done"
+ls -lh "$DIST"
diff --git a/packaging/linux/postinst.sh b/packaging/linux/postinst.sh
new file mode 100755
index 000000000..775e4df91
--- /dev/null
+++ b/packaging/linux/postinst.sh
@@ -0,0 +1,13 @@
+#!/bin/sh
+# deb/rpm post-install and post-remove: refresh the desktop, MIME and icon caches.
+# Every tool is optional; missing ones are skipped.
+if command -v update-desktop-database >/dev/null 2>&1; then
+  update-desktop-database -q /usr/share/applications || true
+fi
+if command -v update-mime-database >/dev/null 2>&1; then
+  update-mime-database /usr/share/mime || true
+fi
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+  gtk-update-icon-cache -q -t -f /usr/share/icons/hicolor || true
+fi
+exit 0
diff --git a/packaging/macos/Info.plist.in b/packaging/macos/Info.plist.in
new file mode 100644
index 000000000..13024e5d8
--- /dev/null
+++ b/packaging/macos/Info.plist.in
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!-- Template: packaging/macos/package.sh substitutes @VERSION@ (full, e.g. 0.2.0-rc.1),
+     @SHORT_VERSION@ (numeric X.Y.Z) and @BUILD_SHA@. -->
+<plist version="1.0">
+<dict>
+  <key>CFBundleDevelopmentRegion</key>
+  <string>en</string>
+  <key>CFBundleDisplayName</key>
+  <string>WordCraft</string>
+  <key>CFBundleName</key>
+  <string>WordCraft</string>
+  <key>CFBundleExecutable</key>
+  <string>WordCraft</string>
+  <key>CFBundleIdentifier</key>
+  <string>ai.storyteller.wordcraft</string>
+  <key>CFBundleInfoDictionaryVersion</key>
+  <string>6.0</string>
+  <key>CFBundlePackageType</key>
+  <string>APPL</string>
+  <key>CFBundleSignature</key>
+  <string>????</string>
+  <key>CFBundleShortVersionString</key>
+  <string>@SHORT_VERSION@</string>
+  <key>CFBundleVersion</key>
+  <string>@SHORT_VERSION@</string>
+  <key>WordCraftVersion</key>
+  <string>@VERSION@</string>
+  <key>WordCraftBuildCommit</key>
+  <string>@BUILD_SHA@</string>
+  <key>CFBundleIconFile</key>
+  <string>WordCraft</string>
+  <key>LSApplicationCategoryType</key>
+  <string>public.app-category.productivity</string>
+  <!-- Must match MACOSX_DEPLOYMENT_TARGET in package.sh. Big Sur is the first release on
+       Apple silicon and has the Metal feature set wgpu targets. -->
+  <key>LSMinimumSystemVersion</key>
+  <string>11.0</string>
+  <key>NSHighResolutionCapable</key>
+  <true/>
+  <key>NSSupportsAutomaticGraphicsSwitching</key>
+  <true/>
+  <key>NSRequiresAquaSystemAppearance</key>
+  <false/>
+  <key>NSHumanReadableCopyright</key>
+  <string>Copyright © the WordCraft authors. MIT OR Apache-2.0.</string>
+
+  <!-- Documents WordCraft opens (system type declarations). -->
+  <key>CFBundleDocumentTypes</key>
+  <array>
+    <dict>
+      <key>CFBundleTypeName</key>
+      <string>Word Document</string>
+      <key>CFBundleTypeRole</key>
+      <string>Editor</string>
+      <key>LSHandlerRank</key>
+      <string>Alternate</string>
+      <key>LSItemContentTypes</key>
+      <array>
+        <string>org.openxmlformats.wordprocessingml.document</string>
+        <string>org.openxmlformats.wordprocessingml.template</string>
+        <string>org.oasis-open.opendocument.text</string>
+        <string>public.rtf</string>
+        <string>net.daringfireball.markdown</string>
+        <string>public.html</string>
+        <string>public.plain-text</string>
+      </array>
+    </dict>
+  </array>
+</dict>
+</plist>
diff --git a/packaging/macos/entitlements.plist b/packaging/macos/entitlements.plist
new file mode 100644
index 000000000..43836738e
--- /dev/null
+++ b/packaging/macos/entitlements.plist
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!-- Hardened-runtime entitlements for Wordcraft. Deliberately empty: the app is pure Rust,
+     loads no unsigned code, needs no JIT, and is not sandboxed (it opens files by path, from the
+     command line and drag-and-drop). Add exceptions here only with a reason in a comment. -->
+<plist version="1.0">
+<dict>
+</dict>
+</plist>
diff --git a/packaging/macos/import-cert.sh b/packaging/macos/import-cert.sh
new file mode 100755
index 000000000..63e47d348
--- /dev/null
+++ b/packaging/macos/import-cert.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# CI only: import the Developer ID certificate into a temporary keychain so codesign can use it.
+#
+# Inputs (env): APPLE_CERTIFICATE (base64 .p12), APPLE_CERTIFICATE_PASSWORD, KEYCHAIN_PASSWORD
+# (optional; random if unset), RUNNER_TEMP (or TMPDIR).
+# Outputs: MACOS_SIGN_IDENTITY (SHA-1 of the identity) and MACOS_KEYCHAIN, appended to
+# $GITHUB_ENV when running in Actions, otherwise printed.
+#
+# Missing certificate: prints a warning and exits 0, so package.sh falls back to ad-hoc signing.
+set -euo pipefail
+umask 077
+# shellcheck source=../env.sh
+. "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
+
+if [ -z "${APPLE_CERTIFICATE:-}" ]; then
+  warn "APPLE_CERTIFICATE is not set: macOS builds will be ad-hoc signed and not notarized"
+  exit 0
+fi
+
+TMP="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
+KEYCHAIN="$TMP/wordcraft-signing.keychain-db"
+CERT="$TMP/wordcraft-signing.p12"
+KC_PASS="${KEYCHAIN_PASSWORD:-$(openssl rand -hex 24)}"
+
+trap 'rm -f "$CERT"' EXIT
+printf '%s' "$APPLE_CERTIFICATE" | base64 --decode >"$CERT"
+security create-keychain -p "$KC_PASS" "$KEYCHAIN"
+security set-keychain-settings -lut 21600 "$KEYCHAIN"
+security unlock-keychain -p "$KC_PASS" "$KEYCHAIN"
+security import "$CERT" -P "${APPLE_CERTIFICATE_PASSWORD:-}" -T /usr/bin/codesign -T /usr/bin/security -t cert -f pkcs12 -k "$KEYCHAIN"
+rm -f "$CERT"
+# Let codesign use the key without a UI prompt.
+security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KC_PASS" "$KEYCHAIN" >/dev/null
+# Put it on the search list (keeping the login keychain) so codesign and notarytool find it.
+# shellcheck disable=SC2046
+security list-keychains -d user -s "$KEYCHAIN" $(security list-keychains -d user | tr -d '"')
+
+IDENTITY="$(security find-identity -v -p codesigning "$KEYCHAIN" | awk '/Developer ID Application/ { print $2; exit }')"
+if [ -z "$IDENTITY" ]; then
+  security find-identity -v -p codesigning "$KEYCHAIN" >&2
+  echo "error: no 'Developer ID Application' identity in APPLE_CERTIFICATE" >&2
+  exit 1
+fi
+echo "Imported signing identity $IDENTITY"
+if [ -n "${GITHUB_ENV:-}" ]; then
+  { echo "MACOS_SIGN_IDENTITY=$IDENTITY"; echo "MACOS_KEYCHAIN=$KEYCHAIN"; } >>"$GITHUB_ENV"
+else
+  echo "MACOS_SIGN_IDENTITY=$IDENTITY"
+  echo "MACOS_KEYCHAIN=$KEYCHAIN"
+fi
diff --git a/packaging/macos/package.sh b/packaging/macos/package.sh
new file mode 100755
index 000000000..21fb6adb9
--- /dev/null
+++ b/packaging/macos/package.sh
@@ -0,0 +1,164 @@
+#!/usr/bin/env bash
+# Build, sign and (optionally) notarize the macOS release artifacts:
+#
+#   $DIST/wordcraft-<version>-macos-<arch>.dmg          WordCraft.app on a drag-to-Applications DMG
+#   $DIST/wordcraft-cli-<version>-macos-<arch>.zip      the headless CLI
+#
+# Usage: packaging/macos/package.sh [--arch universal|aarch64|x86_64] [--skip-build]
+#
+# Signing (env):
+#   MACOS_SIGN_IDENTITY   codesign identity (name or SHA-1). Default "-" = ad-hoc (local testing;
+#                         Gatekeeper will reject the result on other Macs). In CI, import-cert.sh sets it.
+#   MACOS_KEYCHAIN        keychain holding the identity (optional)
+# Notarization (env; all three needed, and a real identity):
+#   APPLE_ID, APPLE_PASSWORD (app-specific password), APPLE_TEAM_ID
+set -euo pipefail
+# shellcheck source=../env.sh
+. "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
+HERE="$ROOT/packaging/macos"
+
+ARCH=universal
+SKIP_BUILD=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --arch) ARCH="$2"; shift 2 ;;
+    --skip-build) SKIP_BUILD=1; shift ;;
+    -h | --help) sed -n '2,16p' "$0"; exit 0 ;;
+    *) echo "unknown argument: $1" >&2; exit 2 ;;
+  esac
+done
+case "$ARCH" in
+  universal) TARGETS=(aarch64-apple-darwin x86_64-apple-darwin) ;;
+  aarch64) TARGETS=(aarch64-apple-darwin) ;;
+  x86_64) TARGETS=(x86_64-apple-darwin) ;;
+  *) echo "unknown --arch $ARCH" >&2; exit 2 ;;
+esac
+
+# Keep in sync with LSMinimumSystemVersion in Info.plist.in.
+export MACOSX_DEPLOYMENT_TARGET=11.0
+IDENTITY="${MACOS_SIGN_IDENTITY:--}"
+SHORT_VERSION="${VERSION%%-*}"
+WORK="$CARGO_TARGET_DIR/macos-package"
+APP="$WORK/WordCraft.app"
+DMG="$DIST/wordcraft-$VERSION-macos-$ARCH.dmg"
+CLI_ZIP="$DIST/wordcraft-cli-$VERSION-macos-$ARCH.zip"
+
+NOTARIZE=0
+if [ "$IDENTITY" = "-" ]; then
+  warn "macOS: ad-hoc signing (no MACOS_SIGN_IDENTITY); artifacts are not notarized"
+elif [ -n "${APPLE_ID:-}" ] && [ -n "${APPLE_PASSWORD:-}" ] && [ -n "${APPLE_TEAM_ID:-}" ]; then
+  NOTARIZE=1
+else
+  warn "macOS: APPLE_ID / APPLE_PASSWORD / APPLE_TEAM_ID incomplete; signed but not notarized"
+fi
+
+echo "==> WordCraft $VERSION for macOS ($ARCH), identity: $IDENTITY, notarize: $NOTARIZE"
+
+# ---- build -------------------------------------------------------------------------------------
+if [ "$SKIP_BUILD" = 0 ]; then
+  args=()
+  for t in "${TARGETS[@]}"; do args+=(--target "$t"); done
+  (cd "$ROOT" && cargo build --release --locked -p wordcraft -p wordcraft-cli "${args[@]}")
+fi
+
+rm -rf "$WORK"
+mkdir -p "$WORK/bin"
+for bin in wordcraft wordcraft-cli; do
+  inputs=()
+  for t in "${TARGETS[@]}"; do inputs+=("$CARGO_TARGET_DIR/$t/release/$bin"); done
+  lipo -create -output "$WORK/bin/$bin" "${inputs[@]}"
+  lipo -info "$WORK/bin/$bin"
+done
+
+# ---- signing helpers ---------------------------------------------------------------------------
+sign() {
+  # Hardened runtime + secure timestamp for a real identity; ad-hoc can't be timestamped.
+  local ts=(--timestamp)
+  [ "$IDENTITY" = "-" ] && ts=(--timestamp=none)
+  local kc=()
+  [ -n "${MACOS_KEYCHAIN:-}" ] && kc=(--keychain "$MACOS_KEYCHAIN")
+  codesign --force --sign "$IDENTITY" ${kc[@]+"${kc[@]}"} "${ts[@]}" "$@"
+}
+
+notarize() {
+  local file="$1" out id status
+  echo "==> notarizing $(basename "$file") (this can take a few minutes)"
+  out="$(xcrun notarytool submit "$file" --apple-id "$APPLE_ID" --password "$APPLE_PASSWORD" \
+    --team-id "$APPLE_TEAM_ID" --wait --timeout 1h --output-format json)" || true
+  echo "$out"
+  id="$(printf '%s' "$out" | plutil -extract id raw -o - - 2>/dev/null || true)"
+  status="$(printf '%s' "$out" | plutil -extract status raw -o - - 2>/dev/null || true)"
+  if [ "$status" != "Accepted" ]; then
+    if [ -n "$id" ]; then
+      xcrun notarytool log "$id" --apple-id "$APPLE_ID" --password "$APPLE_PASSWORD" --team-id "$APPLE_TEAM_ID" || true
+    fi
+    echo "error: notarization of $(basename "$file") failed (status: ${status:-unknown})" >&2
+    exit 1
+  fi
+}
+
+# ---- WordCraft.app ----------------------------------------------------------------------------
+echo "==> assembling $APP"
+mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
+# Executable and icon carry the display name (CFBundleExecutable / CFBundleIconFile).
+cp "$WORK/bin/wordcraft" "$APP/Contents/MacOS/WordCraft"
+cp "$ROOT/assets/app-icon/wordcraft.icns" "$APP/Contents/Resources/WordCraft.icns"
+# Licences of the embedded craft-fonts fonts (only when built with CRAFT_FONTS_DIR).
+copy_font_licences "$APP/Contents/Resources"
+sed -e "s/@VERSION@/$VERSION/g" -e "s/@SHORT_VERSION@/$SHORT_VERSION/g" \
+  -e "s/@BUILD_SHA@/${WORDCRAFT_BUILD_SHA:-unknown}/g" \
+  "$HERE/Info.plist.in" >"$APP/Contents/Info.plist"
+plutil -lint "$APP/Contents/Info.plist"
+printf 'APPL????' >"$APP/Contents/PkgInfo"
+
+# Sign inside-out: nested code first, then the bundle itself (no --deep on the final signature).
+# Today the only nested code is the main executable; frameworks/helpers would be signed here too.
+sign --options runtime --entitlements "$HERE/entitlements.plist" "$APP/Contents/MacOS/WordCraft"
+sign --options runtime --entitlements "$HERE/entitlements.plist" "$APP"
+codesign --verify --strict --deep --verbose=2 "$APP"
+
+if [ "$NOTARIZE" = 1 ]; then
+  ditto -c -k --keepParent "$APP" "$WORK/WordCraft-notarize.zip"
+  notarize "$WORK/WordCraft-notarize.zip"
+  xcrun stapler staple "$APP"
+  xcrun stapler validate "$APP"
+  spctl --assess --type execute -vvv "$APP"
+fi
+
+# ---- DMG ---------------------------------------------------------------------------------------
+echo "==> building $DMG"
+STAGE="$WORK/dmg"
+mkdir -p "$STAGE"
+ditto "$APP" "$STAGE/WordCraft.app"
+ln -s /Applications "$STAGE/Applications"
+rm -f "$DMG" "$WORK/raw.dmg"
+# makehybrid + convert builds the image without attaching a device, unlike `create -srcfolder`,
+# which is flaky on CI runners ("Resource busy") and hangs in sandboxed sessions.
+hdiutil makehybrid -hfs -hfs-volume-name "WordCraft $VERSION" -hfs-openfolder "$STAGE" -o "$WORK/raw.dmg" "$STAGE"
+hdiutil convert "$WORK/raw.dmg" -format UDZO -imagekey zlib-level=9 -o "$DMG"
+rm -f "$WORK/raw.dmg"
+sign "$DMG"
+codesign --verify --strict --verbose=2 "$DMG"
+if [ "$NOTARIZE" = 1 ]; then
+  notarize "$DMG"
+  xcrun stapler staple "$DMG"
+  xcrun stapler validate "$DMG"
+  spctl --assess --type open --context context:primary-signature -vvv "$DMG"
+fi
+
+# ---- CLI ---------------------------------------------------------------------------------------
+echo "==> building $CLI_ZIP"
+CLI_DIR="$WORK/wordcraft-cli-$VERSION-macos-$ARCH"
+mkdir -p "$CLI_DIR"
+cp "$WORK/bin/wordcraft-cli" "$CLI_DIR/"
+copy_docs "$CLI_DIR"
+sign --options runtime "$CLI_DIR/wordcraft-cli"
+codesign --verify --strict --verbose=2 "$CLI_DIR/wordcraft-cli"
+rm -f "$CLI_ZIP"
+ditto -c -k --keepParent "$CLI_DIR" "$CLI_ZIP"
+# A bare Mach-O can't carry a stapled ticket; Gatekeeper looks the notarization up online.
+if [ "$NOTARIZE" = 1 ]; then notarize "$CLI_ZIP"; fi
+
+"$WORK/bin/wordcraft-cli" --version
+echo "==> done"
+ls -lh "$DMG" "$CLI_ZIP"
diff --git a/packaging/web/.htaccess b/packaging/web/.htaccess
new file mode 100644
index 000000000..7b7e6e185
--- /dev/null
+++ b/packaging/web/.htaccess
@@ -0,0 +1,16 @@
+# Apache (see HOSTING.md). Needs mod_mime; mod_deflate and mod_headers are optional.
+AddType application/wasm .wasm
+AddType text/javascript .js
+
+<IfModule mod_deflate.c>
+  AddOutputFilterByType DEFLATE application/wasm text/javascript text/html
+</IfModule>
+
+<IfModule mod_headers.c>
+  <FilesMatch "\.(wasm|js)$">
+    Header set Cache-Control "public, max-age=31536000, immutable"
+  </FilesMatch>
+  <FilesMatch "^index\.html$">
+    Header set Cache-Control "no-cache"
+  </FilesMatch>
+</IfModule>
diff --git a/packaging/web/README.md b/packaging/web/README.md
new file mode 100644
index 000000000..dd885dc5a
--- /dev/null
+++ b/packaging/web/README.md
@@ -0,0 +1,89 @@
+# Hosting WordCraft for the web
+
+`wordcraft-web-<version>.zip` (from the GitHub release, or `packaging/web/package.sh`) holds a
+static site in `wordcraft-web-<version>/`:
+
+| File | What it is |
+|---|---|
+| `index.html` | The page. It loads everything through relative URLs. |
+| `wordcraft-web-<hash>.js` | wasm-bindgen glue (generated, ES module) |
+| `wordcraft-web-<hash>_bg.wasm` | The app, about 13 MB, or 5 MB with compression |
+| `_headers`, `.htaccess` | Sample header rules for Netlify/Cloudflare Pages and Apache |
+
+There is no server-side code. Upload the folder's contents anywhere that serves static files.
+
+## Any path works
+
+All URLs in `index.html` are relative (`public_url = "./"` in `apps/wordcraft-web/Trunk.toml`),
+so the site works at a domain root (`https://example.com/`), under a prefix
+(`https://example.com/tools/wordcraft/`) and from a CDN bucket. The asset names carry a content
+hash, so they can be cached forever. Only `index.html` needs revalidation.
+
+## Required server settings
+
+- **MIME type:** serve `.wasm` as `application/wasm`. Browsers refuse to stream-compile it under
+  any other type, and the app then loads slowly or not at all. Serve `.js` as `text/javascript`.
+  Most hosts already do both. For nginx, check that `mime.types` has `application/wasm wasm;`.
+- **Compression:** turn on gzip or Brotli for `.wasm`, `.js` and `.html`. That takes the
+  download from about 13 MB to about 5 MB. You can also precompress (`brotli -k *.wasm`) and let
+  the server send `Content-Encoding: br`.
+- **Caching:** `Cache-Control: public, max-age=31536000, immutable` on the hashed `.wasm` and
+  `.js` files, and `no-cache` on `index.html`.
+- **HTTPS:** WebGPU (and the clipboard) only work in a secure context, which means `https://`
+  or `http://localhost`. Over plain HTTP elsewhere, the app falls back to WebGL2.
+- **No special isolation headers:** WordCraft doesn't use `SharedArrayBuffer`, so it doesn't
+  need `Cross-Origin-Opener-Policy` or `Cross-Origin-Embedder-Policy`. If your site already sends
+  COEP `require-corp`, also send `Cross-Origin-Resource-Policy: same-origin` (or `cross-origin`
+  when the files live on a CDN) on the app's files.
+
+nginx example:
+
+```nginx
+location /wordcraft/ {
+    types { application/wasm wasm; text/javascript js; text/html html; }
+    gzip on;
+    gzip_types application/wasm text/javascript text/html;
+    location ~* \.(wasm|js)$ { add_header Cache-Control "public, max-age=31536000, immutable"; }
+    location ~* index\.html$ { add_header Cache-Control "no-cache"; }
+}
+```
+
+Local test: `python3 -m http.server 8765` inside the folder, then open http://localhost:8765/.
+
+## Embedding in a page (iframe)
+
+```html
+<iframe
+  src="https://example.com/wordcraft/"
+  title="WordCraft image editor"
+  style="width: 100%; height: 720px; border: 0;"
+  allow="fullscreen; clipboard-read; clipboard-write"
+  allowfullscreen>
+</iframe>
+```
+
+- The app fills the iframe and follows its size, so size the iframe and not the app.
+- Keyboard shortcuts go to the iframe after the user clicks into it, as with any embedded app.
+- **Cross-origin embeds** work. Preferences are kept in the iframe's `localStorage`. Browsers
+  that partition or block third-party storage may forget them between visits, and the app
+  then starts with defaults.
+- **Sandboxed iframes** need at least
+  `sandbox="allow-scripts allow-same-origin allow-downloads allow-popups"`. Without
+  `allow-same-origin` there's no storage. Without `allow-downloads`, Save and Export (browser
+  downloads) are blocked.
+- Don't send `X-Frame-Options: DENY` or a `frame-ancestors` CSP that excludes the embedding page.
+
+## Renderer selection and fallback flags
+
+WordCraft renders with wgpu. It uses **WebGPU** when the browser has it and falls back to
+**WebGL2** on its own. URL query flags override this, and they work on the iframe `src` too:
+
+| Flag | Effect |
+|---|---|
+| *(none)* | WebGPU if available, otherwise WebGL2 |
+| `?webgl` | Force the WebGL2 backend (useful when a WebGPU driver misbehaves) |
+| `?cpu` | Force the CPU canvas path (slowest, most compatible) |
+
+For example: `<iframe src="https://example.com/wordcraft/?webgl" ...>`.
+
+A browser with neither WebGPU nor WebGL2 gets a message in place of the app.
diff --git a/packaging/web/_headers b/packaging/web/_headers
new file mode 100644
index 000000000..fac0fbe1f
--- /dev/null
+++ b/packaging/web/_headers
@@ -0,0 +1,13 @@
+# Netlify / Cloudflare Pages header rules (see HOSTING.md). Other hosts: set the same headers.
+/*
+  X-Content-Type-Options: nosniff
+
+/*.wasm
+  Content-Type: application/wasm
+  Cache-Control: public, max-age=31536000, immutable
+
+/*.js
+  Cache-Control: public, max-age=31536000, immutable
+
+/index.html
+  Cache-Control: no-cache
diff --git a/packaging/web/package.sh b/packaging/web/package.sh
new file mode 100755
index 000000000..730c075e2
--- /dev/null
+++ b/packaging/web/package.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Build the browser version and zip it:  $DIST/wordcraft-web-<version>.zip
+#
+# Usage: packaging/web/package.sh [--skip-build]
+#
+# Needs: trunk (brew install trunk / cargo install trunk --locked) and the wasm32-unknown-unknown
+# target. The zip holds a self-contained static site in wordcraft-web-<version>/ that works
+# from any URL path and inside an <iframe>. Hosting notes: packaging/web/README.md.
+set -euo pipefail
+# shellcheck source=../env.sh
+. "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
+HERE="$ROOT/packaging/web"
+
+if [ "${1:-}" != "--skip-build" ]; then
+  command -v trunk >/dev/null || { echo "error: trunk not found (cargo install trunk --locked)" >&2; exit 1; }
+  (cd "$ROOT/apps/wordcraft-web" && trunk build --release)
+fi
+
+SITE="$ROOT/dist/web"
+[ -f "$SITE/index.html" ] || { echo "error: $SITE/index.html missing; run without --skip-build" >&2; exit 1; }
+# Paths must be relative so the site works under any prefix (public_url = "./" in Trunk.toml).
+if grep -Eq '(src|href)="/[^/]' "$SITE/index.html"; then
+  echo "error: $SITE/index.html has root-absolute URLs; it would break when served from a sub-path" >&2
+  exit 1
+fi
+
+NAME="wordcraft-web-$VERSION"
+WORK="$CARGO_TARGET_DIR/web-package"
+rm -rf "$WORK"
+mkdir -p "$WORK/$NAME"
+cp -R "$SITE/." "$WORK/$NAME/"
+# Sample server configs (MIME type, caching, compression); harmless where unused.
+cp "$HERE/_headers" "$HERE/.htaccess" "$WORK/$NAME/"
+cp "$HERE/README.md" "$WORK/$NAME/HOSTING.md"
+copy_docs "$WORK/$NAME"
+rm -f "$DIST/$NAME.zip"
+(cd "$WORK" && zip -qr9 "$DIST/$NAME.zip" "$NAME")
+echo "wrote $DIST/$NAME.zip"
+ls -lh "$DIST/$NAME.zip"
diff --git a/packaging/windows/package.ps1 b/packaging/windows/package.ps1
new file mode 100644
index 000000000..938f8e5c7
--- /dev/null
+++ b/packaging/windows/package.ps1
@@ -0,0 +1,131 @@
+<#
+.SYNOPSIS
+  Build, sign and package WordCraft for Windows.
+
+.DESCRIPTION
+  Produces, in $env:DIST (default: dist/release):
+    wordcraft-<version>-windows-<arch>.msi            per-machine installer (WiX v5)
+    wordcraft-<version>-windows-<arch>-portable.zip   wordcraft.exe + wordcraft-cli.exe
+
+  The binaries link the C runtime statically (+crt-static), so neither the MSI nor the portable
+  zip needs the Visual C++ redistributable. Signing is delegated to sign.ps1 (skipped with a
+  warning when no signing secrets are set).
+
+  Needs: Rust (MSVC toolchain + the target), the Windows SDK (rc.exe, signtool.exe),
+  and WiX v5: dotnet tool install --global wix --version 5.0.2
+
+.EXAMPLE
+  pwsh packaging/windows/package.ps1 -Arch x64
+  pwsh packaging/windows/package.ps1 -Arch x86 -SkipBuild
+  pwsh packaging/windows/package.ps1 -Arch arm64     # cross-compiled; needs the MSVC ARM64 build tools
+#>
+param(
+  [ValidateSet('x64', 'x86', 'arm64')] [string] $Arch = 'x64',
+  [switch] $SkipBuild
+)
+$ErrorActionPreference = 'Stop'
+$Root = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
+
+function Invoke-Native([string] $What, [scriptblock] $Block) {
+  Write-Output "==> $What"
+  & $Block
+  if ($LASTEXITCODE -ne 0) { throw "$What failed with exit code $LASTEXITCODE" }
+}
+
+# The version lives in one place: [workspace.package] version in the root Cargo.toml.
+$Version = $env:WORDCRAFT_VERSION
+if (-not $Version) {
+  $inPkg = $false
+  foreach ($line in Get-Content (Join-Path $Root 'Cargo.toml')) {
+    if ($line -match '^\s*\[') { $inPkg = ($line.Trim() -eq '[workspace.package]'); continue }
+    if ($inPkg -and $line -match '^\s*version\s*=\s*"([^"]+)"') { $Version = $Matches[1]; break }
+  }
+}
+if (-not $Version) { throw 'could not read [workspace.package] version from Cargo.toml' }
+# MSI ProductVersion is numeric (major.minor.build); pre-release tags are dropped there.
+$MsiVersion = ($Version -split '-')[0]
+
+$Target = switch ($Arch) { 'x64' { 'x86_64-pc-windows-msvc' } 'x86' { 'i686-pc-windows-msvc' } 'arm64' { 'aarch64-pc-windows-msvc' } }
+$Dist = if ($env:DIST) { $env:DIST } else { Join-Path $Root 'dist\release' }
+$TargetDir = if ($env:CARGO_TARGET_DIR) { $env:CARGO_TARGET_DIR } else { Join-Path $Root 'target' }
+New-Item -ItemType Directory -Force -Path $Dist | Out-Null
+
+if (-not $env:WORDCRAFT_BUILD_SHA) { $env:WORDCRAFT_BUILD_SHA = (git -C $Root rev-parse HEAD 2>$null) }
+if (-not $env:WORDCRAFT_BUILD_DATE) { $env:WORDCRAFT_BUILD_DATE = (Get-Date).ToUniversalTime().ToString('yyyy-MM-dd') }
+
+Write-Output "WordCraft $Version for Windows $Arch ($Target)"
+
+if (-not $SkipBuild) {
+  # Static CRT: no VC++ redistributable needed. Scoped to the target so host build scripts and
+  # proc-macros are unaffected.
+  $flagVar = 'CARGO_TARGET_' + ($Target.ToUpper() -replace '-', '_') + '_RUSTFLAGS'
+  [Environment]::SetEnvironmentVariable($flagVar, '-C target-feature=+crt-static')
+  # Fail the build (rather than warn) if the icon/VERSIONINFO can't be embedded.
+  $env:WORDCRAFT_REQUIRE_WINRES = '1'
+  Invoke-Native "cargo build ($Target)" { cargo build --release --locked -p wordcraft -p wordcraft-cli --target $Target }
+}
+
+$Bin = Join-Path $TargetDir "$Target\release"
+
+# Check both binaries' PE headers before packaging. Machine (COFF header) must match -Arch, so an
+# x64 build can never ship labelled arm64. Subsystem (optional header): 2 = Windows GUI, 3 = console.
+# The app must be GUI (no console window opens with it); the CLI must stay console so its output
+# reaches the terminal.
+function Get-PeHeader([string] $Path) {
+  $bytes = [System.IO.File]::ReadAllBytes($Path)
+  $pe = [BitConverter]::ToInt32($bytes, 0x3C)
+  return @{ Machine = [BitConverter]::ToUInt16($bytes, $pe + 4); Subsystem = [BitConverter]::ToUInt16($bytes, $pe + 0x5C) }
+}
+$Machine = switch ($Arch) { 'x64' { 0x8664 } 'x86' { 0x14C } 'arm64' { 0xAA64 } }
+foreach ($check in @(@('wordcraft.exe', 2), @('wordcraft-cli.exe', 3))) {
+  $h = Get-PeHeader (Join-Path $Bin $check[0])
+  if ($h.Machine -ne $Machine) { throw "$($check[0]) is for machine 0x$('{0:X}' -f $h.Machine), expected 0x$('{0:X}' -f $Machine) ($Arch)" }
+  if ($h.Subsystem -ne $check[1]) { throw "$($check[0]) has PE subsystem $($h.Subsystem), expected $($check[1])" }
+  Write-Output "ok $($check[0]): $Arch, PE subsystem $($h.Subsystem)"
+}
+$Stage = Join-Path $TargetDir "windows-package\$Arch"
+Remove-Item -Recurse -Force $Stage -ErrorAction SilentlyContinue
+New-Item -ItemType Directory -Force -Path $Stage | Out-Null
+Copy-Item (Join-Path $Bin 'wordcraft.exe'), (Join-Path $Bin 'wordcraft-cli.exe') $Stage
+
+& (Join-Path $PSScriptRoot 'sign.ps1') (Join-Path $Stage 'wordcraft.exe') (Join-Path $Stage 'wordcraft-cli.exe')
+
+# ---- MSI ---------------------------------------------------------------------------------------
+$Msi = Join-Path $Dist "wordcraft-$Version-windows-$Arch.msi"
+Invoke-Native 'wix build' {
+  wix build (Join-Path $PSScriptRoot 'wordcraft.wxs') -arch $Arch `
+    -d "Version=$MsiVersion" -d "BinDir=$Stage" -d "IconPath=$(Join-Path $Root 'assets\app-icon\wordcraft.ico')" `
+    -o $Msi
+}
+# wix writes its debug symbols (.wixpdb) next to the MSI; keep them out of the release assets.
+Remove-Item -Force -ErrorAction SilentlyContinue ([IO.Path]::ChangeExtension($Msi, '.wixpdb'))
+& (Join-Path $PSScriptRoot 'sign.ps1') $Msi
+
+# ---- portable zip ------------------------------------------------------------------------------
+$Portable = Join-Path $TargetDir "windows-package\wordcraft-$Version-windows-$Arch-portable"
+Remove-Item -Recurse -Force $Portable -ErrorAction SilentlyContinue
+New-Item -ItemType Directory -Force -Path $Portable | Out-Null
+Copy-Item (Join-Path $Stage '*.exe') $Portable
+foreach ($f in 'README.md', 'LICENSE', 'LICENSE-MIT', 'LICENSE-APACHE') {
+  $p = Join-Path $Root $f
+  if (Test-Path $p) { Copy-Item $p $Portable }
+}
+# Builds made with craft-fonts (CRAFT_FONTS_DIR) embed its fonts: ship their licences.
+if ($env:CRAFT_FONTS_DIR) {
+  foreach ($ofl in Get-ChildItem -Path (Join-Path $env:CRAFT_FONTS_DIR 'fonts\*\OFL.txt') -ErrorAction SilentlyContinue) {
+    Copy-Item $ofl.FullName (Join-Path $Portable "OFL-$($ofl.Directory.Name).txt")
+  }
+}
+$Zip = Join-Path $Dist "wordcraft-$Version-windows-$Arch-portable.zip"
+Remove-Item -Force $Zip -ErrorAction SilentlyContinue
+Compress-Archive -Path $Portable -DestinationPath $Zip
+
+# Smoke-test the CLI when this machine can run it. An ARM64 build made on an x64 runner can't run
+# here; .github/workflows/windows-arm64.yml installs and runs it on ARM64 instead.
+$HostArch = [System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture.ToString().ToLowerInvariant()
+if ($Arch -ne 'arm64' -or $HostArch -eq 'arm64') {
+  Invoke-Native 'wordcraft-cli --version' { & (Join-Path $Stage 'wordcraft-cli.exe') --version }
+} else {
+  Write-Output "skipping wordcraft-cli --version: an $Arch build doesn't run on this $HostArch machine"
+}
+Get-Item $Msi, $Zip | Format-Table Name, Length
diff --git a/packaging/windows/sign.ps1 b/packaging/windows/sign.ps1
new file mode 100644
index 000000000..697c59c68
--- /dev/null
+++ b/packaging/windows/sign.ps1
@@ -0,0 +1,95 @@
+<#
+.SYNOPSIS
+  Authenticode-sign files with signtool, using whichever signing material is configured.
+
+.DESCRIPTION
+  Tries, in order:
+    1. A code-signing certificate file:   WINDOWS_CERTIFICATE (base64 .pfx), WINDOWS_CERTIFICATE_PASSWORD
+    2. Azure Trusted Signing:             AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET,
+                                          AZURE_SIGNING_ENDPOINT (e.g. https://eus.codesigning.azure.net),
+                                          AZURE_SIGNING_ACCOUNT, AZURE_CERT_PROFILE
+  With neither, it prints a warning and leaves the files unsigned (exit code 0), so test builds
+  still produce installers.
+
+  This is the one place to adapt when the signing setup changes (an HSM/cloud key, a different
+  timestamp server, ...). Optional overrides: WINDOWS_TIMESTAMP_URL, SIGNTOOL (path to signtool.exe).
+
+.EXAMPLE
+  pwsh packaging/windows/sign.ps1 dist/wordcraft.exe dist/Wordcraft.msi
+#>
+param(
+  [Parameter(Mandatory = $true, ValueFromRemainingArguments = $true)]
+  [string[]] $Files
+)
+$ErrorActionPreference = 'Stop'
+
+function Write-Warn([string] $Message) {
+  if ($env:GITHUB_ACTIONS) { Write-Output "::warning::$Message" } else { Write-Warning $Message }
+}
+
+function Find-SignTool {
+  if ($env:SIGNTOOL) { return $env:SIGNTOOL }
+  $onPath = Get-Command signtool.exe -ErrorAction SilentlyContinue
+  if ($onPath) { return $onPath.Source }
+  $kits = Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\bin'
+  $found = Get-ChildItem -Path $kits -Recurse -Filter signtool.exe -ErrorAction SilentlyContinue |
+    Where-Object { $_.FullName -match '\\x64\\signtool\.exe$' } |
+    Sort-Object FullName -Descending | Select-Object -First 1
+  if (-not $found) { throw 'signtool.exe not found (install the Windows SDK)' }
+  return $found.FullName
+}
+
+function Invoke-SignTool([string[]] $Arguments) {
+  & $script:SignTool @Arguments
+  if ($LASTEXITCODE -ne 0) { throw "signtool $($Arguments[0]) failed with exit code $LASTEXITCODE" }
+}
+
+$Files = $Files | ForEach-Object { (Resolve-Path $_).Path }
+$haveCert = [bool]$env:WINDOWS_CERTIFICATE
+$azureVars = 'AZURE_TENANT_ID', 'AZURE_CLIENT_ID', 'AZURE_CLIENT_SECRET', 'AZURE_SIGNING_ENDPOINT', 'AZURE_SIGNING_ACCOUNT', 'AZURE_CERT_PROFILE'
+$haveAzure = -not ($azureVars | Where-Object { -not [Environment]::GetEnvironmentVariable($_) })
+
+if (-not $haveCert -and -not $haveAzure) {
+  Write-Warn "Windows signing secrets not set (WINDOWS_CERTIFICATE or AZURE_*): leaving unsigned: $($Files -join ', ')"
+  exit 0
+}
+
+$script:SignTool = Find-SignTool
+$common = @('sign', '/v', '/fd', 'SHA256', '/td', 'SHA256', '/d', 'WordCraft', '/du', 'https://github.com/storytold/wordcraft')
+$tmp = Join-Path ([IO.Path]::GetTempPath()) "wordcraft-sign-$PID"
+New-Item -ItemType Directory -Force -Path $tmp | Out-Null
+
+try {
+  if ($haveCert) {
+    Write-Output "Signing with WINDOWS_CERTIFICATE: $($Files -join ', ')"
+    $pfx = Join-Path $tmp 'cert.pfx'
+    [IO.File]::WriteAllBytes($pfx, [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE))
+    $ts = if ($env:WINDOWS_TIMESTAMP_URL) { $env:WINDOWS_TIMESTAMP_URL } else { 'http://timestamp.digicert.com' }
+    $signArgs = $common + @('/tr', $ts, '/f', $pfx)
+    if ($env:WINDOWS_CERTIFICATE_PASSWORD) { $signArgs += @('/p', $env:WINDOWS_CERTIFICATE_PASSWORD) }
+    Invoke-SignTool ($signArgs + $Files)
+  }
+  else {
+    Write-Output "Signing with Azure Trusted Signing ($env:AZURE_SIGNING_ACCOUNT / $env:AZURE_CERT_PROFILE): $($Files -join ', ')"
+    # The dlib authenticates with DefaultAzureCredential, which reads AZURE_TENANT_ID,
+    # AZURE_CLIENT_ID and AZURE_CLIENT_SECRET from the environment.
+    $pkg = Join-Path $tmp 'trusted-signing.zip'
+    Invoke-WebRequest -Uri 'https://www.nuget.org/api/v2/package/Microsoft.Trusted.Signing.Client' -OutFile $pkg
+    Expand-Archive -Path $pkg -DestinationPath (Join-Path $tmp 'client') -Force
+    $dlib = Get-ChildItem -Path (Join-Path $tmp 'client') -Recurse -Filter Azure.CodeSigning.Dlib.dll |
+      Where-Object { $_.FullName -match '\\x64\\' } | Select-Object -First 1
+    if (-not $dlib) { throw 'Azure.CodeSigning.Dlib.dll not found in Microsoft.Trusted.Signing.Client' }
+    $metadata = Join-Path $tmp 'metadata.json'
+    @{
+      Endpoint               = $env:AZURE_SIGNING_ENDPOINT
+      CodeSigningAccountName = $env:AZURE_SIGNING_ACCOUNT
+      CertificateProfileName = $env:AZURE_CERT_PROFILE
+    } | ConvertTo-Json | Set-Content -Path $metadata -Encoding utf8
+    $ts = if ($env:WINDOWS_TIMESTAMP_URL) { $env:WINDOWS_TIMESTAMP_URL } else { 'http://timestamp.acs.microsoft.com' }
+    Invoke-SignTool ($common + @('/tr', $ts, '/dlib', $dlib.FullName, '/dmdf', $metadata) + $Files)
+  }
+  Invoke-SignTool (@('verify', '/pa', '/v') + $Files)
+}
+finally {
+  Remove-Item -Recurse -Force $tmp -ErrorAction SilentlyContinue
+}
diff --git a/packaging/windows/wordcraft.wxs b/packaging/windows/wordcraft.wxs
new file mode 100644
index 000000000..31b1a6f52
--- /dev/null
+++ b/packaging/windows/wordcraft.wxs
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  WordCraft MSI (WiX Toolset v5: `dotnet tool install -g wix`). Built by package.ps1:
+
+    wix build wordcraft.wxs -arch x64 -d Version=1.2.3 -d BinDir=... -d IconPath=... -o out.msi
+
+  Per-machine install into Program Files, a Start Menu shortcut, `.pcraft` owned by WordCraft,
+  and WordCraft offered under "Open with" for PSD/PSB and the image formats it reads (without
+  taking over the user's default app for them).
+-->
+<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
+  <Package
+      Name="WordCraft"
+      Manufacturer="Learning Machines LLC"
+      Version="$(var.Version)"
+      UpgradeCode="49E87D30-BB68-4896-AA1D-F45C833CFC3C"
+      Scope="perMachine"
+      Compressed="yes"
+      Language="1033">
+    <SummaryInformation Description="WordCraft word processor" Manufacturer="Learning Machines LLC" />
+    <!-- Same-version upgrades let successive pre-releases of one X.Y.Z replace each other
+         (MSI versions are numeric, so 1.2.3-rc.1 and 1.2.3-rc.2 are both 1.2.3). -->
+    <MajorUpgrade AllowSameVersionUpgrades="yes"
+        DowngradeErrorMessage="A newer version of WordCraft is already installed." />
+    <MediaTemplate EmbedCab="yes" CompressionLevel="high" />
+
+    <Icon Id="WordcraftIcon.ico" SourceFile="$(var.IconPath)" />
+    <Property Id="ARPPRODUCTICON" Value="WordcraftIcon.ico" />
+    <Property Id="ARPURLINFOABOUT" Value="https://getartcraft.com/apps/wordcraft" />
+    <Property Id="ARPURLUPDATEINFO" Value="https://getartcraft.com/apps/wordcraft" />
+    <Property Id="ARPHELPLINK" Value="https://discord.gg/artcraft" />
+
+    <StandardDirectory Id="ProgramFiles6432Folder">
+      <Directory Id="INSTALLFOLDER" Name="WordCraft" />
+    </StandardDirectory>
+    <StandardDirectory Id="ProgramMenuFolder" />
+
+    <Feature Id="Main" Title="WordCraft" Level="1">
+      <ComponentGroupRef Id="WordcraftFiles" />
+    </Feature>
+  </Package>
+
+  <Fragment>
+    <ComponentGroup Id="WordcraftFiles" Directory="INSTALLFOLDER">
+      <Component Id="WordcraftApp" Guid="DE018EF3-EE87-4E36-9F76-0B7B060A195E">
+        <File Id="WordcraftExe" Source="$(var.BinDir)\wordcraft.exe" KeyPath="yes">
+          <Shortcut Id="StartMenuShortcut" Directory="ProgramMenuFolder" Name="WordCraft"
+              Description="WordCraft word processor" WorkingDirectory="INSTALLFOLDER" Advertise="yes"
+              Icon="WordcraftIcon.ico" IconIndex="0" />
+        </File>
+
+        <RegistryValue Root="HKLM" Key="Software\Microsoft\Windows\CurrentVersion\App Paths\wordcraft.exe" Value="[#WordcraftExe]" Type="string" />
+      </Component>
+
+      <Component Id="WordcraftCli">
+        <File Id="WordcraftCliExe" Source="$(var.BinDir)\wordcraft-cli.exe" KeyPath="yes" />
+      </Component>
+    </ComponentGroup>
+  </Fragment>
+</Wix>