diff --git a/.github/workflows/analyze.yml b/.github/workflows/analyze.yml
index c399b85..a5a6ace 100644
--- a/.github/workflows/analyze.yml
+++ b/.github/workflows/analyze.yml
@@ -14,7 +14,7 @@ jobs:
 
       - uses: subosito/flutter-action@v2
         with:
-          flutter-version: '3.24.0'
+          flutter-version: '3.29.0'
           channel: 'stable'
 
       - name: Bootstrap dependencies
@@ -24,7 +24,7 @@ jobs:
         run: flutter pub get
 
       - name: Flutter analyze
-        run: flutter analyze
+        run: flutter analyze lib tool --no-fatal-warnings --no-fatal-infos
 
       - name: Complexity guard
         run: dart run tool/check_complexity.dart
diff --git a/.github/workflows/build-packages.yml b/.github/workflows/build-packages.yml
new file mode 100644
index 0000000..20ee4a3
--- /dev/null
+++ b/.github/workflows/build-packages.yml
@@ -0,0 +1,395 @@
+name: Build Packages
+
+on:
+  push:
+    branches:
+      - main
+      - master
+    tags:
+      - "v*"
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      publish_release:
+        description: "Publish downloaded build artifacts to GitHub Releases"
+        required: false
+        default: false
+        type: boolean
+      release_tag:
+        description: "Release tag to publish when manually triggering"
+        required: false
+        default: ""
+        type: string
+      prerelease:
+        description: "Mark the GitHub Release as a prerelease"
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  BUILD_MODE: release
+  FLUTTER_VERSION: 3.29.0
+
+jobs:
+  linux:
+    name: Linux
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Set up Flutter
+        uses: subosito/flutter-action@v2
+        with:
+          flutter-version: ${{ env.FLUTTER_VERSION }}
+          cache: true
+
+      - name: Install Linux dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            build-essential \
+            cmake \
+            libgtk-3-dev \
+            libsodium-dev \
+            libgstreamer1.0-dev \
+            libgstreamer-plugins-base1.0-dev \
+            libsecret-1-dev \
+            libayatana-appindicator3-dev \
+            gstreamer1.0-plugins-base \
+            gstreamer1.0-plugins-good \
+            ninja-build \
+            patchelf \
+            pkg-config
+
+      - name: Enable Linux desktop
+        run: flutter config --enable-linux-desktop
+
+      - name: Bootstrap dependencies
+        run: dart run tool/bootstrap_deps.dart
+
+      - name: Install Flutter packages
+        run: flutter pub get
+
+      - name: Fix desktop_drop_for_t Linux plugin naming
+        run: |
+          # desktop_drop_for_t is a fork of desktop_drop but its Linux plugin
+          # files still use the old names. Fix the CMake target name and create
+          # a symlink so the generated #include <desktop_drop_for_t/...> resolves.
+          PLUGIN_DIR="linux/flutter/ephemeral/.plugin_symlinks/desktop_drop_for_t/linux"
+          if [ -f "$PLUGIN_DIR/CMakeLists.txt" ]; then
+            sed -i 's/set(PLUGIN_NAME "desktop_drop_plugin")/set(PLUGIN_NAME "desktop_drop_for_t_plugin")/' "$PLUGIN_DIR/CMakeLists.txt"
+            sed -i 's/set(desktop_drop_bundled_libraries/set(desktop_drop_for_t_bundled_libraries/' "$PLUGIN_DIR/CMakeLists.txt"
+            # Header lives under include/desktop_drop/ but registrant expects desktop_drop_for_t/
+            if [ -d "$PLUGIN_DIR/include/desktop_drop" ] && [ ! -d "$PLUGIN_DIR/include/desktop_drop_for_t" ]; then
+              ln -s desktop_drop "$PLUGIN_DIR/include/desktop_drop_for_t"
+            fi
+          fi
+
+      - name: Build Tim2Tox native library
+        run: bash tool/ci/build_tim2tox.sh --target linux --mode "$BUILD_MODE"
+
+      - name: Build Linux bundle
+        run: flutter build linux --release --dart-define=FLUTTER_BUILD_MODE="$BUILD_MODE"
+
+      - name: Package Linux artifacts
+        run: bash tool/ci/package_artifacts.sh --target linux --mode "$BUILD_MODE"
+
+      - name: Upload Linux artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: toxee-linux-release
+          path: dist/linux
+          if-no-files-found: error
+
+  windows:
+    name: Windows
+    runs-on: windows-2022
+    continue-on-error: true  # tim2tox C++ source requires POSIX porting for Windows
+
+    steps:
+      - name: Configure Git line endings
+        run: |
+          git config --global core.autocrlf false
+          git config --global core.eol lf
+
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Set up Flutter
+        uses: subosito/flutter-action@v2
+        with:
+          flutter-version: ${{ env.FLUTTER_VERSION }}
+          cache: true
+
+      - name: Install vcpkg and native dependencies
+        shell: pwsh
+        run: |
+          $vcpkgRoot = Join-Path $env:RUNNER_TEMP "vcpkg"
+          git clone --depth 1 https://github.com/microsoft/vcpkg $vcpkgRoot
+          & "$vcpkgRoot\bootstrap-vcpkg.bat" -disableMetrics
+          & "$vcpkgRoot\vcpkg.exe" install libsodium:x64-windows pthreads:x64-windows
+          "VCPKG_ROOT=$vcpkgRoot" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+      - name: Enable Windows desktop
+        run: flutter config --enable-windows-desktop
+
+      - name: Bootstrap dependencies
+        run: dart run tool/bootstrap_deps.dart
+
+      - name: Install Flutter packages
+        run: flutter pub get
+
+      - name: Build Tim2Tox native library
+        run: bash tool/ci/build_tim2tox.sh --target windows --mode "$BUILD_MODE"
+
+      - name: Build Windows runner
+        run: flutter build windows --release --dart-define=FLUTTER_BUILD_MODE="$BUILD_MODE"
+
+      - name: Package Windows artifacts
+        run: bash tool/ci/package_artifacts.sh --target windows --mode "$BUILD_MODE"
+
+      - name: Upload Windows artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: toxee-windows-release
+          path: dist/windows
+          if-no-files-found: error
+
+  macos:
+    name: macOS
+    runs-on: macos-14
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Set up Flutter
+        uses: subosito/flutter-action@v2
+        with:
+          flutter-version: ${{ env.FLUTTER_VERSION }}
+          cache: true
+
+      - name: Install macOS dependencies
+        run: brew install libsodium
+
+      - name: Enable macOS desktop
+        run: flutter config --enable-macos-desktop
+
+      - name: Bootstrap dependencies
+        run: dart run tool/bootstrap_deps.dart
+
+      - name: Install Flutter packages
+        run: flutter pub get
+
+      - name: Build Tim2Tox native library
+        run: bash tool/ci/build_tim2tox.sh --target macos --mode "$BUILD_MODE"
+
+      - name: Build macOS app
+        run: flutter build macos --release --dart-define=FLUTTER_BUILD_MODE="$BUILD_MODE"
+
+      - name: Package macOS artifacts
+        run: bash tool/ci/package_artifacts.sh --target macos --mode "$BUILD_MODE"
+
+      - name: Upload macOS artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: toxee-macos-release
+          path: dist/macos
+          if-no-files-found: error
+
+  android:
+    name: Android
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Set up Java
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: "17"
+          cache: gradle
+
+      - name: Set up Flutter
+        uses: subosito/flutter-action@v2
+        with:
+          flutter-version: ${{ env.FLUTTER_VERSION }}
+          cache: true
+
+      - name: Enable Android support
+        run: flutter config --enable-android
+
+      - name: Bootstrap dependencies
+        run: dart run tool/bootstrap_deps.dart
+
+      - name: Install Flutter packages
+        run: flutter pub get
+
+      - name: Prepare Android signing
+        env:
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+        run: |
+          if [[ -n "$ANDROID_KEYSTORE_BASE64" && -n "$ANDROID_KEYSTORE_PASSWORD" && -n "$ANDROID_KEY_ALIAS" && -n "$ANDROID_KEY_PASSWORD" ]]; then
+            echo "$ANDROID_KEYSTORE_BASE64" | base64 --decode > "$RUNNER_TEMP/toxee-release.keystore"
+            printf 'storeFile=%s\nstorePassword=%s\nkeyAlias=%s\nkeyPassword=%s\n' \
+              "$RUNNER_TEMP/toxee-release.keystore" \
+              "$ANDROID_KEYSTORE_PASSWORD" \
+              "$ANDROID_KEY_ALIAS" \
+              "$ANDROID_KEY_PASSWORD" \
+              > android/key.properties
+          fi
+
+      - name: Stage optional Android Tim2Tox JNI libs
+        run: bash tool/ci/build_tim2tox.sh --target android --mode "$BUILD_MODE"
+
+      - name: Build Android APK
+        run: flutter build apk --release --dart-define=FLUTTER_BUILD_MODE="$BUILD_MODE"
+
+      - name: Build Android App Bundle
+        run: flutter build appbundle --release --dart-define=FLUTTER_BUILD_MODE="$BUILD_MODE"
+
+      - name: Package Android artifacts
+        run: bash tool/ci/package_artifacts.sh --target android --mode "$BUILD_MODE"
+
+      - name: Upload Android artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: toxee-android-release
+          path: dist/android
+          if-no-files-found: error
+
+  ios:
+    name: iOS
+    runs-on: macos-14
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Set up Flutter
+        uses: subosito/flutter-action@v2
+        with:
+          flutter-version: ${{ env.FLUTTER_VERSION }}
+          cache: true
+
+      - name: Install macOS dependencies
+        run: brew install libsodium
+
+      - name: Enable iOS support
+        run: flutter config --enable-ios
+
+      - name: Bootstrap dependencies
+        run: dart run tool/bootstrap_deps.dart
+
+      - name: Install Flutter packages
+        run: flutter pub get
+
+      - name: Install CocoaPods
+        run: |
+          cd ios
+          pod install
+
+      - name: Prepare iOS signing
+        env:
+          IOS_CERTIFICATE_P12_BASE64: ${{ secrets.IOS_CERTIFICATE_P12_BASE64 }}
+          IOS_CERTIFICATE_PASSWORD: ${{ secrets.IOS_CERTIFICATE_PASSWORD }}
+          IOS_PROVISIONING_PROFILE_BASE64: ${{ secrets.IOS_PROVISIONING_PROFILE_BASE64 }}
+          IOS_KEYCHAIN_PASSWORD: ${{ secrets.IOS_KEYCHAIN_PASSWORD }}
+          IOS_SIGNING_IDENTITY: ${{ secrets.IOS_SIGNING_IDENTITY }}
+        run: |
+          if [[ -n "$IOS_CERTIFICATE_P12_BASE64" && -n "$IOS_CERTIFICATE_PASSWORD" && -n "$IOS_PROVISIONING_PROFILE_BASE64" ]]; then
+            bash tool/ci/prepare_ios_signing.sh
+          fi
+
+      - name: Stage optional iOS Tim2Tox artifacts
+        run: bash tool/ci/build_tim2tox.sh --target ios --mode "$BUILD_MODE"
+
+      - name: Build iOS app
+        run: |
+          if [[ "${IOS_SIGNING_READY:-false}" == "true" ]]; then
+            flutter build ios --release --dart-define=FLUTTER_BUILD_MODE="$BUILD_MODE"
+          else
+            flutter build ios --release --no-codesign --dart-define=FLUTTER_BUILD_MODE="$BUILD_MODE"
+          fi
+
+      - name: Package iOS artifacts
+        run: bash tool/ci/package_artifacts.sh --target ios --mode "$BUILD_MODE"
+
+      - name: Upload iOS artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: toxee-ios-release
+          path: dist/ios
+          if-no-files-found: error
+
+  publish:
+    name: Publish GitHub Release
+    runs-on: ubuntu-24.04
+    needs:
+      - linux
+      - windows
+      - macos
+      - android
+      - ios
+    if: ${{ startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && github.event.inputs.publish_release == 'true') }}
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Resolve release metadata
+        id: release_meta
+        run: |
+          release_tag="${GITHUB_REF_NAME:-}"
+          if [[ "${GITHUB_REF_TYPE:-}" != "tag" ]]; then
+            release_tag="${{ github.event.inputs.release_tag }}"
+          fi
+
+          if [[ -z "$release_tag" ]]; then
+            echo "release_tag input is required for manual publish." >&2
+            exit 1
+          fi
+
+          echo "release_tag=$release_tag" >> "$GITHUB_OUTPUT"
+          echo "prerelease=${{ github.event.inputs.prerelease || 'false' }}" >> "$GITHUB_OUTPUT"
+
+      - name: Download packaged artifacts
+        uses: actions/download-artifact@v5
+        with:
+          pattern: toxee-*-release
+          path: release-artifacts
+          merge-multiple: false
+
+      - name: Publish GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ steps.release_meta.outputs.release_tag }}
+          PRERELEASE: ${{ steps.release_meta.outputs.prerelease }}
+          RELEASE_ARTIFACTS_DIR: ${{ github.workspace }}/release-artifacts
+        run: bash tool/ci/publish_release.sh
diff --git a/.gitignore b/.gitignore
index 1c51318..d7ab1f8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -43,6 +43,7 @@ app.*.map.json
 /android/app/debug
 /android/app/profile
 /android/app/release
+/android/key.properties
 /android/build/
 /toxee/
 
diff --git a/.gitmodules b/.gitmodules
index df8427a..06c5a28 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,7 +1,7 @@
 [submodule "third_party/tim2tox"]
 	path = third_party/tim2tox
-	url = git@github.com:anonymoussoft/tim2tox.git
+	url = https://github.com/anonymoussoft/tim2tox.git
 [submodule "third_party/chat-uikit-flutter"]
 	path = third_party/chat-uikit-flutter
-	url = git@github.com:anonymoussoft/chat-uikit-flutter.git
+	url = https://github.com/anonymoussoft/chat-uikit-flutter.git
 	branch = v2
diff --git a/README.md b/README.md
index 0bb6618..965e311 100644
--- a/README.md
+++ b/README.md
@@ -147,6 +147,32 @@ If you hit a `package_config.json` parse error, run `dart tool/bootstrap_deps.da
 - **Run only**: `./run_toxee.sh` (other platform helpers include `run_toxee_ios.sh`, `run_toxee_android.sh`, and related scripts)
 - For detailed platform steps, dependency layout, and deployment notes, see [doc/operations/BUILD_AND_DEPLOY.en.md](doc/operations/BUILD_AND_DEPLOY.en.md), [doc/operations/DEPENDENCY_BOOTSTRAP.en.md](doc/operations/DEPENDENCY_BOOTSTRAP.en.md), and [doc/operations/DEPENDENCY_LAYOUT.en.md](doc/operations/DEPENDENCY_LAYOUT.en.md). For debugging issues, see [doc/TROUBLESHOOTING.en.md](doc/TROUBLESHOOTING.en.md).
 
+## GitHub Actions packages
+
+The repository now includes [`.github/workflows/build-packages.yml`](.github/workflows/build-packages.yml), which runs on push, pull request, tag push, and manual dispatch. It builds and uploads artifacts for:
+
+- **Windows**
+- **Linux**
+- **macOS**
+- **Android**
+- **iOS**
+
+Each job uploads the contents of `dist/<platform>/` as a GitHub Actions artifact. Desktop jobs build the host Tim2Tox FFI library and bundle it into the packaged app output. Android builds both `app-release.apk` and `app-release.aab`; if the secrets `ANDROID_KEYSTORE_BASE64`, `ANDROID_KEYSTORE_PASSWORD`, `ANDROID_KEY_ALIAS`, and `ANDROID_KEY_PASSWORD` are present, the workflow uses them for release signing, otherwise it falls back to the project's existing debug-key release signing.
+
+iOS now has two modes:
+
+- With `IOS_CERTIFICATE_P12_BASE64`, `IOS_CERTIFICATE_PASSWORD`, and `IOS_PROVISIONING_PROFILE_BASE64` configured, the workflow performs a signed `flutter build ios --release` and packages a real `.ipa`.
+- Without those secrets, the iOS job still runs as an unsigned validation build, but it does **not** publish an installable package. Instead, `dist/ios/NOTES.txt` explains that signing was not configured.
+
+Mobile jobs also write `dist/<platform>/NOTES.txt` when Tim2Tox mobile native artifacts were not available in the workspace, so CI keeps that remaining native-injection gap explicit instead of silently pretending the package is complete.
+
+Publishing to **GitHub Releases** is built into the same workflow:
+
+- Push a tag like `v1.2.3` to build all platforms and publish a GitHub Release automatically.
+- Or run `workflow_dispatch`, set `publish_release=true`, and provide `release_tag` (optionally `prerelease=true`).
+- The publish job downloads the artifacts from the current run, uploads the packaged installables to the Release, and adds a generated `SHA256SUMS.txt`.
+- Release notes use GitHub's `--generate-notes` flow, while platform-specific packaging caveats are merged into the uploaded build-note assets.
+
 ---
 
 ## Documentation hub
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 661c45e..61e0a06 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -147,6 +147,32 @@ flutter pub get
 - **仅运行**：`./run_toxee.sh`（其他平台辅助脚本包括 `run_toxee_ios.sh`、`run_toxee_android.sh` 等）
 - 详细平台步骤、依赖布局和部署说明见 [doc/operations/BUILD_AND_DEPLOY.md](doc/operations/BUILD_AND_DEPLOY.md)、[doc/operations/DEPENDENCY_BOOTSTRAP.md](doc/operations/DEPENDENCY_BOOTSTRAP.md)、[doc/operations/DEPENDENCY_LAYOUT.md](doc/operations/DEPENDENCY_LAYOUT.md)。调试问题见 [doc/TROUBLESHOOTING.md](doc/TROUBLESHOOTING.md)。
 
+## GitHub Actions 打包
+
+仓库现已包含 [`.github/workflows/build-packages.yml`](.github/workflows/build-packages.yml)。它会在 `push`、`pull_request`、tag push 和手动触发时执行，并为以下平台生成构建产物：
+
+- **Windows**
+- **Linux**
+- **macOS**
+- **Android**
+- **iOS**
+
+每个平台 job 都会把 `dist/<platform>/` 目录作为 GitHub Actions artifact 上传。桌面端 job 会先构建宿主平台的 Tim2Tox FFI 动态库，再把它一起打进应用产物。Android 会同时产出 `app-release.apk` 和 `app-release.aab`；如果配置了 `ANDROID_KEYSTORE_BASE64`、`ANDROID_KEYSTORE_PASSWORD`、`ANDROID_KEY_ALIAS`、`ANDROID_KEY_PASSWORD` 这 4 个 secrets，workflow 会自动使用 release keystore 签名，否则继续沿用项目当前的 debug-key release 签名。
+
+iOS 现在分两种模式：
+
+- 如果配置了 `IOS_CERTIFICATE_P12_BASE64`、`IOS_CERTIFICATE_PASSWORD`、`IOS_PROVISIONING_PROFILE_BASE64`，workflow 会执行带签名的 `flutter build ios --release`，并产出真实可安装的 `.ipa`。
+- 如果没有这些 secrets，iOS job 仍会执行未签名校验构建，但**不会**把它当作可安装包发布；此时只会在 `dist/ios/NOTES.txt` 中说明未配置签名。
+
+对于 Android/iOS，如果工作区里还没有可注入的 Tim2Tox 移动端原生库，CI 也会继续把这个限制写进 `dist/<platform>/NOTES.txt`，避免把“能编译”误认为“已经完成原生注入”。
+
+同一个 workflow 也支持发布到 **GitHub Releases**：
+
+- 推送 `v1.2.3` 这样的 tag，会自动构建所有平台并发布 GitHub Release。
+- 或者手动执行 `workflow_dispatch`，把 `publish_release` 设为 `true`，并填写 `release_tag`；如果是预发布版本，还可以把 `prerelease` 设为 `true`。
+- 发布 job 会下载当前 run 的构建产物，把真正可安装的打包文件上传到 Release，并额外生成 `SHA256SUMS.txt`。
+- Release 文案使用 GitHub 的 `--generate-notes` 自动生成；各平台额外的打包说明会作为附带构建说明文件一起上传。
+
 ---
 
 ## 文档入口
diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 9b941db..85db1c8 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -1,3 +1,5 @@
+import java.util.Properties
+
 plugins {
     id("com.android.application")
     id("kotlin-android")
@@ -5,6 +7,13 @@ plugins {
     id("dev.flutter.flutter-gradle-plugin")
 }
 
+val keystoreProperties = Properties()
+val keystorePropertiesFile = rootProject.file("key.properties")
+
+if (keystorePropertiesFile.exists()) {
+    keystorePropertiesFile.inputStream().use { keystoreProperties.load(it) }
+}
+
 android {
     namespace = "com.example.toxee"
     compileSdk = flutter.compileSdkVersion
@@ -30,11 +39,26 @@ android {
         versionName = flutter.versionName
     }
 
+    signingConfigs {
+        if (keystorePropertiesFile.exists()) {
+            create("release") {
+                keyAlias = keystoreProperties.getProperty("keyAlias")
+                keyPassword = keystoreProperties.getProperty("keyPassword")
+                storeFile = file(keystoreProperties.getProperty("storeFile"))
+                storePassword = keystoreProperties.getProperty("storePassword")
+            }
+        }
+    }
+
     buildTypes {
         release {
-            // TODO: Add your own signing config for the release build.
-            // Signing with the debug keys for now, so `flutter run --release` works.
-            signingConfig = signingConfigs.getByName("debug")
+            // Prefer a user-supplied release keystore when available, but keep
+            // debug-key signing as the default so CI can still build artifacts.
+            signingConfig = if (keystorePropertiesFile.exists()) {
+                signingConfigs.getByName("release")
+            } else {
+                signingConfigs.getByName("debug")
+            }
         }
     }
 }
diff --git a/android/build.gradle.kts b/android/build.gradle.kts
index 89176ef..9603df3 100644
--- a/android/build.gradle.kts
+++ b/android/build.gradle.kts
@@ -1,3 +1,31 @@
+fun inferAndroidNamespace(manifestFile: File): String? {
+    if (!manifestFile.exists()) {
+        return null
+    }
+
+    val match = Regex("""package\s*=\s*"([^"]+)"""").find(manifestFile.readText())
+    return match?.groupValues?.getOrNull(1)
+}
+
+fun configureMissingNamespace(project: Project) {
+    val androidExtension = project.extensions.findByName("android") ?: return
+    val namespaceGetter = androidExtension.javaClass.methods.find {
+        it.name == "getNamespace" && it.parameterCount == 0
+    } ?: return
+
+    val currentNamespace = namespaceGetter.invoke(androidExtension) as? String
+    if (!currentNamespace.isNullOrBlank()) {
+        return
+    }
+
+    val inferredNamespace = inferAndroidNamespace(project.file("src/main/AndroidManifest.xml")) ?: return
+    val namespaceSetter = androidExtension.javaClass.methods.find {
+        it.name == "setNamespace" && it.parameterCount == 1
+    } ?: return
+
+    namespaceSetter.invoke(androidExtension, inferredNamespace)
+}
+
 allprojects {
     repositories {
         google()
@@ -12,7 +40,11 @@ subprojects {
     val newSubprojectBuildDir: Directory = newBuildDir.dir(project.name)
     project.layout.buildDirectory.value(newSubprojectBuildDir)
 }
+
 subprojects {
+    pluginManager.withPlugin("com.android.library") {
+        configureMissingNamespace(project)
+    }
     project.evaluationDependsOn(":app")
 }
 
diff --git a/ios/Runner.xcodeproj/project.pbxproj b/ios/Runner.xcodeproj/project.pbxproj
index 1ef27cb..40e0203 100644
--- a/ios/Runner.xcodeproj/project.pbxproj
+++ b/ios/Runner.xcodeproj/project.pbxproj
@@ -8,6 +8,7 @@
 
 /* Begin PBXBuildFile section */
 		1498D2341E8E89220040F4C2 /* GeneratedPluginRegistrant.m in Sources */ = {isa = PBXBuildFile; fileRef = 1498D2331E8E89220040F4C2 /* GeneratedPluginRegistrant.m */; };
+		21B6E55B57F646BCB738C1A1 /* CallAudioChannel.swift in Sources */ = {isa = PBXBuildFile; fileRef = 7C799A0D75B64C3A99666B0D /* CallAudioChannel.swift */; };
 		331C808B294A63AB00263BE5 /* RunnerTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 331C807B294A618700263BE5 /* RunnerTests.swift */; };
 		3B3967161E833CAA004F5970 /* AppFrameworkInfo.plist in Resources */ = {isa = PBXBuildFile; fileRef = 3B3967151E833CAA004F5970 /* AppFrameworkInfo.plist */; };
 		74858FAF1ED2DC5600515810 /* AppDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = 74858FAE1ED2DC5600515810 /* AppDelegate.swift */; };
@@ -53,6 +54,7 @@
 		6B3FE00B114681163210827C /* Pods-RunnerTests.profile.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-RunnerTests.profile.xcconfig"; path = "Target Support Files/Pods-RunnerTests/Pods-RunnerTests.profile.xcconfig"; sourceTree = "<group>"; };
 		74858FAD1ED2DC5600515810 /* Runner-Bridging-Header.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = "Runner-Bridging-Header.h"; sourceTree = "<group>"; };
 		74858FAE1ED2DC5600515810 /* AppDelegate.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = AppDelegate.swift; sourceTree = "<group>"; };
+		7C799A0D75B64C3A99666B0D /* CallAudioChannel.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = CallAudioChannel.swift; sourceTree = "<group>"; };
 		7AFA3C8E1D35360C0083082E /* Release.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; name = Release.xcconfig; path = Flutter/Release.xcconfig; sourceTree = "<group>"; };
 		7F0012E7B0FEAC22975C895F /* Pods-Runner.profile.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Runner.profile.xcconfig"; path = "Target Support Files/Pods-Runner/Pods-Runner.profile.xcconfig"; sourceTree = "<group>"; };
 		9740EEB21CF90195004384FC /* Debug.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; name = Debug.xcconfig; path = Flutter/Debug.xcconfig; sourceTree = "<group>"; };
@@ -151,6 +153,7 @@
 				1498D2321E8E86230040F4C2 /* GeneratedPluginRegistrant.h */,
 				1498D2331E8E89220040F4C2 /* GeneratedPluginRegistrant.m */,
 				74858FAE1ED2DC5600515810 /* AppDelegate.swift */,
+				7C799A0D75B64C3A99666B0D /* CallAudioChannel.swift */,
 				74858FAD1ED2DC5600515810 /* Runner-Bridging-Header.h */,
 			);
 			path = Runner;
@@ -396,6 +399,7 @@
 			buildActionMask = 2147483647;
 			files = (
 				74858FAF1ED2DC5600515810 /* AppDelegate.swift in Sources */,
+				21B6E55B57F646BCB738C1A1 /* CallAudioChannel.swift in Sources */,
 				1498D2341E8E89220040F4C2 /* GeneratedPluginRegistrant.m in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
diff --git a/third_party/tim2tox b/third_party/tim2tox
index 8687376..6fbc047 160000
--- a/third_party/tim2tox
+++ b/third_party/tim2tox
@@ -1 +1 @@
-Subproject commit 8687376c36c78aba3666e56e43bd0acc1167da7f
+Subproject commit 6fbc047d5b50d8d458d36e6ed3e42eced6310907
diff --git a/tool/bootstrap_deps.dart b/tool/bootstrap_deps.dart
index b1747a6..b105ebb 100644
--- a/tool/bootstrap_deps.dart
+++ b/tool/bootstrap_deps.dart
@@ -17,8 +17,8 @@ void main(List<String> args) async {
   //    Do this first so third_party/tim2tox exists and contains the lock file.
   const submodulePaths = ['third_party/tim2tox', 'third_party/chat-uikit-flutter'];
   const submoduleUrls = {
-    'third_party/tim2tox': 'git@github.com:anonymoussoft/tim2tox.git',
-    'third_party/chat-uikit-flutter': 'git@github.com:anonymoussoft/chat-uikit-flutter.git',
+    'third_party/tim2tox': 'https://github.com/anonymoussoft/tim2tox.git',
+    'third_party/chat-uikit-flutter': 'https://github.com/anonymoussoft/chat-uikit-flutter.git',
   };
   int code = await _run(repoRoot, 'git', ['submodule', 'sync', '--recursive']);
   if (code != 0) {
@@ -57,13 +57,10 @@ void main(List<String> args) async {
   // Pin chat-uikit-flutter to v2 branch (see .gitmodules branch = v2)
   final uikitDir = Directory('$repoRoot/third_party/chat-uikit-flutter');
   if (uikitDir.existsSync()) {
-    final branch = 'v2';
+    const branch = 'v2';
     int c = await _run(repoRoot, 'git', ['-C', 'third_party/chat-uikit-flutter', 'fetch', 'origin', branch]);
     if (c == 0) {
-      c = await _run(repoRoot, 'git', ['-C', 'third_party/chat-uikit-flutter', 'checkout', branch]);
-      if (c != 0) {
-        c = await _run(repoRoot, 'git', ['-C', 'third_party/chat-uikit-flutter', 'checkout', '-b', branch, 'origin/$branch']);
-      }
+      c = await _run(repoRoot, 'git', ['-C', 'third_party/chat-uikit-flutter', 'checkout', '-B', branch, 'FETCH_HEAD']);
       if (c == 0) {
         stdout.writeln('third_party/chat-uikit-flutter switched to branch $branch');
       }
@@ -141,6 +138,9 @@ void main(List<String> args) async {
           }
         }
       }
+      if (Platform.isWindows) {
+        _normalizeSdkLineEndings(sdkDir);
+      }
       stateFile.writeAsStringSync(jsonEncode({
         'version': version,
         'sha256': actualSha256,
@@ -152,7 +152,7 @@ void main(List<String> args) async {
 
   // 3) Apply SDK patch series via tim2tox tool (patches live in tim2tox repo: patches/tencent_cloud_chat_sdk/<version>/)
   final stateMap = stateFile.existsSync() ? (jsonDecode(stateFile.readAsStringSync()) as Map<String, dynamic>) : <String, dynamic>{};
-  final appliedKey = 'patches_applied';
+  const appliedKey = 'patches_applied';
   final seriesFile = File('${tim2toxDir.path}/patches/tencent_cloud_chat_sdk/$version/series');
   final bool shouldApplySdkPatches = stateMap[appliedKey] != true &&
       tim2toxDir.existsSync() &&
@@ -269,9 +269,38 @@ Future<void> _download(String url, String destPath) async {
 }
 
 Future<String> _sha256File(String path) async {
+  if (Platform.isWindows) {
+    final r = await Process.run(
+      'certutil',
+      ['-hashfile', path, 'SHA256'],
+      runInShell: false,
+    );
+    if (r.exitCode != 0) {
+      throw Exception('certutil failed: ${r.stderr}');
+    }
+    final lines = (r.stdout as String)
+        .split(RegExp(r'\r?\n'))
+        .map((line) => line.trim())
+        .where((line) => RegExp(r'^[A-Fa-f0-9 ]+$').hasMatch(line) && line.isNotEmpty)
+        .toList();
+    if (lines.isEmpty) {
+      throw Exception('certutil output did not contain a SHA-256 hash');
+    }
+    return lines.first.replaceAll(' ', '').toLowerCase();
+  }
+
+  try {
+    final r = await Process.run('sha256sum', [path], runInShell: false);
+    if (r.exitCode == 0) {
+      return (r.stdout as String).split(' ').first.trim();
+    }
+  } on ProcessException {
+    // Fall through to shasum on platforms like macOS where sha256sum is absent.
+  }
+
   final r = await Process.run('shasum', ['-a', '256', path], runInShell: false);
   if (r.exitCode != 0) {
-    throw Exception('shasum failed: ${r.stderr}');
+    throw Exception('sha256 tool failed: ${r.stderr}');
   }
   return (r.stdout as String).split(' ').first.trim();
 }
@@ -294,3 +323,39 @@ void _copyDir(Directory src, Directory dest) {
     }
   }
 }
+
+void _normalizeSdkLineEndings(Directory sdkDir) {
+  const textExtensions = {
+    '.dart',
+    '.yaml',
+    '.yml',
+    '.json',
+    '.xml',
+    '.gradle',
+    '.kts',
+    '.java',
+    '.kt',
+    '.m',
+    '.mm',
+    '.swift',
+    '.h',
+    '.hpp',
+    '.c',
+    '.cc',
+    '.cpp',
+    '.txt',
+    '.md',
+  };
+
+  for (final entity in sdkDir.listSync(recursive: true)) {
+    if (entity is! File) continue;
+    final lowerPath = entity.path.toLowerCase();
+    if (!textExtensions.any(lowerPath.endsWith)) continue;
+
+    final contents = entity.readAsStringSync();
+    final normalized = contents.replaceAll('\r\n', '\n');
+    if (contents != normalized) {
+      entity.writeAsStringSync(normalized);
+    }
+  }
+}
diff --git a/tool/ci/build_tim2tox.sh b/tool/ci/build_tim2tox.sh
new file mode 100644
index 0000000..170fbbc
--- /dev/null
+++ b/tool/ci/build_tim2tox.sh
@@ -0,0 +1,235 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=tool/ci/common.sh
+source "$SCRIPT_DIR/common.sh"
+
+TARGET=""
+MODE="release"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --target)
+      TARGET="${2:-}"
+      shift 2
+      ;;
+    --mode)
+      MODE="${2:-}"
+      shift 2
+      ;;
+    --help|-h)
+      cat <<'EOF'
+Usage: build_tim2tox.sh --target <linux|windows|macos|android|ios> [--mode <debug|profile|release>]
+EOF
+      exit 0
+      ;;
+    *)
+      ci_die "Unknown option: $1"
+      ;;
+  esac
+done
+
+[[ -n "$TARGET" ]] || ci_die "--target is required"
+
+REPO_ROOT="$(ci_repo_root)"
+TIM2TOX_DIR="$REPO_ROOT/third_party/tim2tox"
+OUTPUT_DIR="$REPO_ROOT/build/native-artifacts/$TARGET"
+
+[[ -d "$TIM2TOX_DIR" ]] || ci_die "tim2tox submodule not found: $TIM2TOX_DIR"
+
+ci_reset_dir "$OUTPUT_DIR"
+
+bootstrap_tim2tox_submodules() {
+  if [[ -f "$TIM2TOX_DIR/.gitmodules" ]] && { [[ -d "$TIM2TOX_DIR/.git" ]] || [[ -f "$TIM2TOX_DIR/.git" ]]; }; then
+    ci_log "Ensuring tim2tox nested submodules are initialized"
+    (cd "$TIM2TOX_DIR" && git submodule update --init --recursive)
+  fi
+}
+
+capture_linux_shared_library() {
+  local library_path="$1"
+  [[ -n "$library_path" && -e "$library_path" ]] || return 0
+
+  local resolved_path
+  resolved_path="$(readlink -f "$library_path" 2>/dev/null || printf '%s\n' "$library_path")"
+
+  cp -P "$library_path" "$OUTPUT_DIR/"
+  if [[ "$resolved_path" != "$library_path" && -f "$resolved_path" ]]; then
+    cp "$resolved_path" "$OUTPUT_DIR/"
+  fi
+}
+
+configure_args=(
+  -DBUILD_FFI=ON
+  -DBUILD_TOXAV=OFF
+  -DMUST_BUILD_TOXAV=OFF
+  -DDHT_BOOTSTRAP=OFF
+  -DBOOTSTRAP_DAEMON=OFF
+  -DENABLE_SHARED=OFF
+  -DENABLE_STATIC=ON
+  -DUNITTEST=OFF
+  -DAUTOTEST=OFF
+  -DBUILD_MISC_TESTS=OFF
+  -DBUILD_FUN_UTILS=OFF
+  -DBUILD_FUZZ_TESTS=OFF
+  -DUSE_IPV6=ON
+  -DEXPERIMENTAL_API=OFF
+  -DERROR=ON
+  -DWARNING=ON
+  -DINFO=ON
+  -DTRACE=OFF
+  -DDEBUG=OFF
+  -DCMAKE_POLICY_VERSION_MINIMUM=3.5
+)
+
+build_desktop_target() {
+  local target="$1"
+  local build_dir="$TIM2TOX_DIR/build/ci-$target"
+  local lib_pattern=""
+  local built_lib=""
+
+  bootstrap_tim2tox_submodules
+  mkdir -p "$build_dir"
+
+  case "$target" in
+    linux)
+      lib_pattern="libtim2tox_ffi.so"
+      ci_log "Configuring tim2tox for Linux"
+      cmake -S "$TIM2TOX_DIR" -B "$build_dir" \
+        -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_CXX_FLAGS="-Wno-error=deprecated-copy -Wno-error=format -include arpa/inet.h" \
+        -DCMAKE_C_FLAGS="-Wno-error=format" \
+        "${configure_args[@]}"
+      ;;
+    macos)
+      lib_pattern="libtim2tox_ffi.dylib"
+      ci_log "Configuring tim2tox for macOS"
+      cmake -S "$TIM2TOX_DIR" -B "$build_dir" \
+        -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_CXX_FLAGS="-Wno-error=deprecated-copy -Wno-error=format" \
+        -DCMAKE_C_FLAGS="-Wno-error=format" \
+        "${configure_args[@]}"
+      ;;
+    windows)
+      lib_pattern="tim2tox_ffi.dll"
+      ci_log "Configuring tim2tox for Windows"
+      local source_dir_win build_dir_win
+      source_dir_win="$(ci_windows_path "$TIM2TOX_DIR")"
+      build_dir_win="$(ci_windows_path "$build_dir")"
+      if [[ -n "${VCPKG_ROOT:-}" ]]; then
+        local vcpkg_root_win toolchain_file
+        vcpkg_root_win="$(ci_windows_path "$VCPKG_ROOT")"
+        toolchain_file="${vcpkg_root_win}/scripts/buildsystems/vcpkg.cmake"
+        VCPKG_ROOT="$vcpkg_root_win" cmake -S "$source_dir_win" -B "$build_dir_win" \
+          -G "Visual Studio 17 2022" -A x64 \
+          -DCMAKE_TOOLCHAIN_FILE="$toolchain_file" \
+          "${configure_args[@]}"
+      else
+        cmake -S "$source_dir_win" -B "$build_dir_win" -G "Visual Studio 17 2022" -A x64 "${configure_args[@]}"
+      fi
+      ;;
+    *)
+      ci_die "Unsupported desktop target: $target"
+      ;;
+  esac
+
+  ci_log "Building tim2tox_ffi for $target"
+  cmake --build "$build_dir" --config Release --target tim2tox_ffi --parallel "$(ci_cpu_count)"
+
+  built_lib="$(find "$build_dir" -type f -name "$lib_pattern" | head -n 1 || true)"
+  [[ -n "$built_lib" ]] || ci_die "Failed to locate $lib_pattern under $build_dir"
+  cp "$built_lib" "$OUTPUT_DIR/"
+  ci_log "Captured native library: $built_lib"
+
+  if [[ "$target" == "windows" && -n "${VCPKG_ROOT:-}" ]]; then
+    ci_copy_matching_file "$VCPKG_ROOT/installed/x64-windows" "libsodium.dll" "$OUTPUT_DIR" >/dev/null || \
+      ci_warn "libsodium.dll not found under $VCPKG_ROOT/installed/x64-windows"
+  fi
+
+  if [[ "$target" == "linux" ]]; then
+    local sodium_dep
+    sodium_dep="$(ldd "$built_lib" | awk '/libsodium/ {print $3; exit}' || true)"
+    if [[ -n "$sodium_dep" && -e "$sodium_dep" ]]; then
+      capture_linux_shared_library "$sodium_dep"
+      ci_log "Captured Linux dependency: $sodium_dep"
+    else
+      ci_warn "Could not resolve libsodium dependency from $built_lib"
+    fi
+  fi
+
+  if [[ "$target" == "macos" ]]; then
+    local sodium_dep
+    sodium_dep="$(otool -L "$built_lib" | awk '/libsodium.*dylib/ {print $1; exit}' || true)"
+    if [[ -n "$sodium_dep" && -f "$sodium_dep" ]]; then
+      cp "$sodium_dep" "$OUTPUT_DIR/"
+      ci_log "Captured macOS dependency: $sodium_dep"
+    fi
+  fi
+}
+
+sync_android_ffi_libs() {
+  local source_dir="${TIM2TOX_ANDROID_LIB_DIR:-}"
+  local repo_jni_libs="$REPO_ROOT/android/app/src/main/jniLibs"
+  if [[ -z "$source_dir" ]]; then
+    if [[ -d "$repo_jni_libs" ]] && find "$repo_jni_libs" -type f -name "libtim2tox_ffi.so" | grep -q .; then
+      source_dir="$repo_jni_libs"
+    fi
+  fi
+
+  if [[ -z "$source_dir" ]]; then
+    ci_warn "No Android Tim2Tox JNI libraries found; Android artifacts will be built without bundled libtim2tox_ffi.so"
+    return
+  fi
+
+  [[ -d "$source_dir" ]] || ci_die "TIM2TOX_ANDROID_LIB_DIR is not a directory: $source_dir"
+  mkdir -p "$OUTPUT_DIR/jniLibs"
+  cp -R "$source_dir"/. "$OUTPUT_DIR/jniLibs/"
+  if [[ "$source_dir" != "$repo_jni_libs" ]]; then
+    rm -rf "$repo_jni_libs"
+    mkdir -p "$repo_jni_libs"
+    cp -R "$source_dir"/. "$repo_jni_libs/"
+    ci_log "Staged Android JNI libraries into $repo_jni_libs"
+  fi
+  ci_log "Synced Android JNI libraries from $source_dir"
+}
+
+sync_ios_ffi_artifacts() {
+  local copied="false"
+
+  if [[ -n "${TIM2TOX_IOS_FRAMEWORK_PATH:-}" ]]; then
+    [[ -d "${TIM2TOX_IOS_FRAMEWORK_PATH}" ]] || ci_die "TIM2TOX_IOS_FRAMEWORK_PATH does not exist: ${TIM2TOX_IOS_FRAMEWORK_PATH}"
+    cp -R "${TIM2TOX_IOS_FRAMEWORK_PATH}" "$OUTPUT_DIR/"
+    copied="true"
+    ci_log "Captured iOS framework from ${TIM2TOX_IOS_FRAMEWORK_PATH}"
+  fi
+
+  if [[ -n "${TIM2TOX_IOS_DYLIB_PATH:-}" ]]; then
+    [[ -f "${TIM2TOX_IOS_DYLIB_PATH}" ]] || ci_die "TIM2TOX_IOS_DYLIB_PATH does not exist: ${TIM2TOX_IOS_DYLIB_PATH}"
+    cp "${TIM2TOX_IOS_DYLIB_PATH}" "$OUTPUT_DIR/"
+    copied="true"
+    ci_log "Captured iOS dylib from ${TIM2TOX_IOS_DYLIB_PATH}"
+  fi
+
+  if [[ "$copied" != "true" ]]; then
+    ci_warn "No iOS Tim2Tox framework/dylib provided; iOS package will be produced unsigned and without injected Tim2Tox native binary"
+  fi
+}
+
+case "$TARGET" in
+  linux|windows|macos)
+    build_desktop_target "$TARGET"
+    ;;
+  android)
+    sync_android_ffi_libs
+    ;;
+  ios)
+    sync_ios_ffi_artifacts
+    ;;
+  *)
+    ci_die "Unsupported target: $TARGET"
+    ;;
+esac
+
+ci_log "Done preparing Tim2Tox artifacts for $TARGET ($MODE)"
diff --git a/tool/ci/common.sh b/tool/ci/common.sh
new file mode 100644
index 0000000..d49e9ed
--- /dev/null
+++ b/tool/ci/common.sh
@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ci_log() {
+  printf '[ci] %s\n' "$*"
+}
+
+ci_warn() {
+  printf '[ci][warn] %s\n' "$*" >&2
+}
+
+ci_die() {
+  printf '[ci][error] %s\n' "$*" >&2
+  exit 1
+}
+
+ci_require_cmd() {
+  local cmd="$1"
+  command -v "$cmd" >/dev/null 2>&1 || ci_die "Missing required command: $cmd"
+}
+
+ci_repo_root() {
+  local dir
+  dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+  printf '%s\n' "$dir"
+}
+
+ci_host_os() {
+  if [[ -n "${RUNNER_OS:-}" ]]; then
+    printf '%s\n' "${RUNNER_OS,,}"
+    return
+  fi
+
+  case "$(uname -s)" in
+    Darwin) printf '%s\n' "macos" ;;
+    Linux) printf '%s\n' "linux" ;;
+    MINGW*|MSYS*|CYGWIN*) printf '%s\n' "windows" ;;
+    *) printf '%s\n' "unknown" ;;
+  esac
+}
+
+ci_cpu_count() {
+  if command -v nproc >/dev/null 2>&1; then
+    nproc
+    return
+  fi
+
+  if command -v sysctl >/dev/null 2>&1; then
+    sysctl -n hw.ncpu
+    return
+  fi
+
+  if command -v getconf >/dev/null 2>&1; then
+    getconf _NPROCESSORS_ONLN
+    return
+  fi
+
+  printf '%s\n' "4"
+}
+
+ci_mode_dirname() {
+  case "$1" in
+    debug) printf '%s\n' "Debug" ;;
+    profile) printf '%s\n' "Profile" ;;
+    release) printf '%s\n' "Release" ;;
+    *) ci_die "Unknown build mode: $1" ;;
+  esac
+}
+
+ci_windows_path() {
+  local path="$1"
+  if command -v cygpath >/dev/null 2>&1; then
+    cygpath -m "$path"
+  else
+    printf '%s\n' "$path"
+  fi
+}
+
+ci_reset_dir() {
+  local dir="$1"
+  rm -rf "$dir"
+  mkdir -p "$dir"
+}
+
+ci_copy_matching_file() {
+  local search_root="$1"
+  local pattern="$2"
+  local destination_dir="$3"
+  local match
+
+  match="$(find "$search_root" -type f -name "$pattern" | head -n 1 || true)"
+  if [[ -n "$match" ]]; then
+    mkdir -p "$destination_dir"
+    cp "$match" "$destination_dir/"
+    printf '%s\n' "$match"
+    return 0
+  fi
+
+  return 1
+}
+
+ci_sha256_file() {
+  local file="$1"
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$file" | awk '{print $1}'
+    return
+  fi
+
+  if command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 "$file" | awk '{print $1}'
+    return
+  fi
+
+  ci_die "Missing sha256 tool"
+}
diff --git a/tool/ci/package_artifacts.sh b/tool/ci/package_artifacts.sh
new file mode 100644
index 0000000..b7ac815
--- /dev/null
+++ b/tool/ci/package_artifacts.sh
@@ -0,0 +1,235 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=tool/ci/common.sh
+source "$SCRIPT_DIR/common.sh"
+
+TARGET=""
+MODE="release"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --target)
+      TARGET="${2:-}"
+      shift 2
+      ;;
+    --mode)
+      MODE="${2:-}"
+      shift 2
+      ;;
+    --help|-h)
+      cat <<'EOF'
+Usage: package_artifacts.sh --target <linux|windows|macos|android|ios> [--mode <debug|profile|release>]
+EOF
+      exit 0
+      ;;
+    *)
+      ci_die "Unknown option: $1"
+      ;;
+  esac
+done
+
+[[ -n "$TARGET" ]] || ci_die "--target is required"
+
+REPO_ROOT="$(ci_repo_root)"
+DIST_DIR="$REPO_ROOT/dist/$TARGET"
+NATIVE_DIR="$REPO_ROOT/build/native-artifacts/$TARGET"
+MODE_DIR="$(ci_mode_dirname "$MODE")"
+
+ci_reset_dir "$DIST_DIR"
+
+write_note() {
+  local note_file="$DIST_DIR/NOTES.txt"
+  printf '%s\n' "$1" >> "$note_file"
+}
+
+package_linux() {
+  local bundle_dir="$REPO_ROOT/build/linux/x64/$MODE/bundle"
+  local staged_dir="$DIST_DIR/toxee-linux-x64"
+  local archive_path="$DIST_DIR/toxee-linux-x64-$MODE.tar.gz"
+  local bundled_sodium="false"
+
+  [[ -d "$bundle_dir" ]] || ci_die "Linux bundle not found: $bundle_dir"
+
+  mkdir -p "$bundle_dir/lib"
+  if [[ -f "$NATIVE_DIR/libtim2tox_ffi.so" ]]; then
+    cp "$NATIVE_DIR/libtim2tox_ffi.so" "$bundle_dir/lib/"
+    write_note "Bundled libtim2tox_ffi.so into Linux bundle."
+  else
+    write_note "libtim2tox_ffi.so was not found. The Linux bundle was packaged without the Tim2Tox native library."
+  fi
+
+  while IFS= read -r sodium_file; do
+    [[ -n "$sodium_file" ]] || continue
+    cp -a "$sodium_file" "$bundle_dir/lib/"
+    bundled_sodium="true"
+  done < <(find "$NATIVE_DIR" -maxdepth 1 \( -type f -o -type l \) -name 'libsodium*.so*' | sort)
+
+  if [[ "$bundled_sodium" == "true" ]]; then
+    write_note "Bundled Linux libsodium runtime dependency."
+  else
+    write_note "Linux libsodium runtime dependency was not captured; target host may need libsodium preinstalled."
+  fi
+
+  if command -v patchelf >/dev/null 2>&1 && command -v file >/dev/null 2>&1; then
+    if file "$bundle_dir/lib/libtim2tox_ffi.so" | grep -qi 'ELF'; then
+      patchelf --set-rpath '$ORIGIN' "$bundle_dir/lib/libtim2tox_ffi.so"
+      write_note "Normalized Linux FFI rpath to \$ORIGIN."
+    fi
+  fi
+
+  rm -rf "$staged_dir"
+  mkdir -p "$staged_dir"
+  cp -R "$bundle_dir"/. "$staged_dir/"
+  tar -czf "$archive_path" -C "$DIST_DIR" "$(basename "$staged_dir")"
+  rm -rf "$staged_dir"
+  ci_log "Created Linux archive: $archive_path"
+}
+
+package_windows() {
+  local runner_dir="$REPO_ROOT/build/windows/x64/runner/$MODE_DIR"
+  local staged_dir="$DIST_DIR/toxee-windows-x64"
+  local archive_path="$DIST_DIR/toxee-windows-x64-$MODE.zip"
+
+  [[ -d "$runner_dir" ]] || ci_die "Windows runner output not found: $runner_dir"
+
+  rm -rf "$staged_dir"
+  mkdir -p "$staged_dir"
+  cp -R "$runner_dir"/. "$staged_dir/"
+
+  if [[ -f "$NATIVE_DIR/tim2tox_ffi.dll" ]]; then
+    cp "$NATIVE_DIR/tim2tox_ffi.dll" "$staged_dir/"
+    write_note "Bundled tim2tox_ffi.dll into Windows package."
+  else
+    write_note "tim2tox_ffi.dll was not found. The Windows package was created without the Tim2Tox native library."
+  fi
+
+  if [[ -f "$NATIVE_DIR/libsodium.dll" ]]; then
+    cp "$NATIVE_DIR/libsodium.dll" "$staged_dir/"
+    write_note "Bundled libsodium.dll into Windows package."
+  fi
+
+  powershell.exe -NoLogo -NoProfile -Command \
+    "Compress-Archive -Path '$(ci_windows_path "$staged_dir")' -DestinationPath '$(ci_windows_path "$archive_path")' -Force" \
+    >/dev/null
+  rm -rf "$staged_dir"
+  ci_log "Created Windows archive: $archive_path"
+}
+
+package_macos() {
+  local app_bundle="$REPO_ROOT/build/macos/Build/Products/$MODE_DIR/Toxee.app"
+  local archive_path="$DIST_DIR/toxee-macos-$MODE.zip"
+  local macos_dir="$app_bundle/Contents/MacOS"
+  local ffi_lib="$NATIVE_DIR/libtim2tox_ffi.dylib"
+  local sodium_lib
+
+  if [[ ! -d "$app_bundle" ]]; then
+    app_bundle="$(find "$REPO_ROOT/build/macos/Build/Products/$MODE_DIR" -maxdepth 1 -type d -name '*.app' | head -n 1 || true)"
+  fi
+  [[ -n "$app_bundle" && -d "$app_bundle" ]] || ci_die "macOS app bundle not found under build/macos/Build/Products/$MODE_DIR"
+
+  mkdir -p "$macos_dir"
+
+  if [[ -f "$ffi_lib" ]]; then
+    cp "$ffi_lib" "$macos_dir/"
+    write_note "Bundled libtim2tox_ffi.dylib into macOS app."
+
+    sodium_lib="$(find "$NATIVE_DIR" -maxdepth 1 -type f -name 'libsodium*.dylib' | head -n 1 || true)"
+    if [[ -n "$sodium_lib" ]]; then
+      cp "$sodium_lib" "$macos_dir/"
+      local old_path new_name
+      old_path="$(otool -L "$ffi_lib" | awk '/libsodium.*dylib/ {print $1; exit}' || true)"
+      new_name="$(basename "$sodium_lib")"
+      if [[ -n "$old_path" ]]; then
+        install_name_tool -change "$old_path" "@loader_path/$new_name" "$macos_dir/$(basename "$ffi_lib")"
+      fi
+      write_note "Bundled $(basename "$sodium_lib") into macOS app."
+    fi
+  else
+    write_note "libtim2tox_ffi.dylib was not found. The macOS app was packaged without the Tim2Tox native library."
+  fi
+
+  ditto -c -k --sequesterRsrc --keepParent "$app_bundle" "$archive_path"
+  ci_log "Created macOS archive: $archive_path"
+}
+
+package_android() {
+  local apk_path="$REPO_ROOT/build/app/outputs/flutter-apk/app-$MODE.apk"
+  local aab_path="$REPO_ROOT/build/app/outputs/bundle/$MODE/app-$MODE.aab"
+
+  [[ -f "$apk_path" ]] || ci_die "Android APK not found: $apk_path"
+  cp "$apk_path" "$DIST_DIR/"
+  ci_log "Captured Android APK: $apk_path"
+
+  if [[ -f "$aab_path" ]]; then
+    cp "$aab_path" "$DIST_DIR/"
+    ci_log "Captured Android App Bundle: $aab_path"
+  else
+    write_note "Android App Bundle was not produced."
+  fi
+
+  if [[ -d "$NATIVE_DIR/jniLibs" ]] && find "$NATIVE_DIR/jniLibs" -type f -name "libtim2tox_ffi.so" | grep -q .; then
+    write_note "Android build used repository-provided Tim2Tox JNI libraries."
+  else
+    write_note "No Android Tim2Tox JNI libraries were staged. APK/AAB were built, but runtime native loading still needs libtim2tox_ffi.so packaging."
+  fi
+}
+
+package_ios() {
+  local app_bundle="$REPO_ROOT/build/ios/iphoneos/Runner.app"
+  local archive_path="$DIST_DIR/toxee-ios-$MODE.ipa"
+  local frameworks_dir="$app_bundle/Frameworks"
+  local framework_src="$NATIVE_DIR/tim2tox_ffi.framework"
+  local dylib_src="$NATIVE_DIR/libtim2tox_ffi.dylib"
+  local payload_dir="$DIST_DIR/Payload"
+  local signed_marker="$app_bundle/embedded.mobileprovision"
+  local injected="false"
+
+  [[ -d "$app_bundle" ]] || ci_die "iOS app bundle not found: $app_bundle"
+
+  mkdir -p "$frameworks_dir"
+  if [[ -d "$framework_src" ]]; then
+    rm -rf "$frameworks_dir/tim2tox_ffi.framework"
+    cp -R "$framework_src" "$frameworks_dir/"
+    injected="true"
+  elif [[ -f "$dylib_src" ]]; then
+    cp "$dylib_src" "$frameworks_dir/"
+    injected="true"
+  fi
+
+  if [[ -f "$signed_marker" ]]; then
+    mkdir -p "$payload_dir"
+    cp -R "$app_bundle" "$payload_dir/"
+    (cd "$DIST_DIR" && zip -qry "$(basename "$archive_path")" Payload)
+    rm -rf "$payload_dir"
+    ci_log "Created iOS IPA: $archive_path"
+    write_note "Packaged signed iOS app as IPA."
+    if [[ "$injected" == "true" ]]; then
+      write_note "Injected Tim2Tox FFI artifact into signed iOS app before IPA packaging."
+    else
+      write_note "Signed iOS IPA was packaged without an injected Tim2Tox FFI artifact."
+    fi
+    return
+  fi
+
+  if [[ "${IOS_SIGNING_READY:-false}" == "true" ]]; then
+    ci_die "iOS signing was configured, but the built app bundle is not signed (missing embedded.mobileprovision)."
+  fi
+
+  if [[ "$injected" == "true" ]]; then
+    write_note "Unsigned iOS build detected; FFI artifacts were not packaged as an installable IPA."
+  else
+    write_note "Unsigned iOS build detected; skipping installable package creation."
+  fi
+}
+
+case "$TARGET" in
+  linux) package_linux ;;
+  windows) package_windows ;;
+  macos) package_macos ;;
+  android) package_android ;;
+  ios) package_ios ;;
+  *) ci_die "Unsupported target: $TARGET" ;;
+esac
diff --git a/tool/ci/prepare_ios_signing.sh b/tool/ci/prepare_ios_signing.sh
new file mode 100644
index 0000000..ccfe717
--- /dev/null
+++ b/tool/ci/prepare_ios_signing.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=tool/ci/common.sh
+source "$SCRIPT_DIR/common.sh"
+
+ci_require_cmd security
+ci_require_cmd base64
+ci_require_cmd plutil
+
+[[ -n "${IOS_CERTIFICATE_P12_BASE64:-}" ]] || ci_die "IOS_CERTIFICATE_P12_BASE64 is required"
+[[ -n "${IOS_CERTIFICATE_PASSWORD:-}" ]] || ci_die "IOS_CERTIFICATE_PASSWORD is required"
+[[ -n "${IOS_PROVISIONING_PROFILE_BASE64:-}" ]] || ci_die "IOS_PROVISIONING_PROFILE_BASE64 is required"
+
+RUNNER_TEMP_DIR="${RUNNER_TEMP:-$(mktemp -d)}"
+KEYCHAIN_PASSWORD="${IOS_KEYCHAIN_PASSWORD:-toxee-ci-keychain}"
+KEYCHAIN_PATH="$RUNNER_TEMP_DIR/toxee-ci-signing.keychain-db"
+P12_PATH="$RUNNER_TEMP_DIR/toxee-signing-cert.p12"
+PROFILE_PATH="$RUNNER_TEMP_DIR/toxee.mobileprovision"
+PROFILE_INSTALL_DIR="$HOME/Library/MobileDevice/Provisioning Profiles"
+
+echo "$IOS_CERTIFICATE_P12_BASE64" | base64 --decode > "$P12_PATH"
+echo "$IOS_PROVISIONING_PROFILE_BASE64" | base64 --decode > "$PROFILE_PATH"
+
+security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
+security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+security import "$P12_PATH" -P "$IOS_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
+security list-keychains -d user -s "$KEYCHAIN_PATH" login.keychain-db
+security default-keychain -d user -s "$KEYCHAIN_PATH"
+security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+
+mkdir -p "$PROFILE_INSTALL_DIR"
+PROFILE_UUID="$(security cms -D -i "$PROFILE_PATH" | plutil -extract UUID raw -o - -)"
+cp "$PROFILE_PATH" "$PROFILE_INSTALL_DIR/$PROFILE_UUID.mobileprovision"
+
+SIGNING_IDENTITY="${IOS_SIGNING_IDENTITY:-}"
+if [[ -z "$SIGNING_IDENTITY" ]]; then
+  SIGNING_IDENTITY="$(security find-identity -v -p codesigning "$KEYCHAIN_PATH" | sed -n 's/.*"\(.*\)"/\1/p' | head -n 1)"
+fi
+
+if [[ -n "${GITHUB_ENV:-}" ]]; then
+  {
+    printf 'IOS_SIGNING_READY=true\n'
+    printf 'IOS_SIGNING_IDENTITY=%s\n' "$SIGNING_IDENTITY"
+    printf 'IOS_SIGNING_KEYCHAIN=%s\n' "$KEYCHAIN_PATH"
+    printf 'IOS_PROVISIONING_PROFILE_UUID=%s\n' "$PROFILE_UUID"
+  } >> "$GITHUB_ENV"
+fi
+
+ci_log "Prepared iOS signing keychain and provisioning profile ($PROFILE_UUID)"
diff --git a/tool/ci/publish_release.sh b/tool/ci/publish_release.sh
new file mode 100644
index 0000000..7770942
--- /dev/null
+++ b/tool/ci/publish_release.sh
@@ -0,0 +1,135 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=tool/ci/common.sh
+source "$SCRIPT_DIR/common.sh"
+
+RELEASE_TAG="${RELEASE_TAG:-}"
+PRERELEASE="${PRERELEASE:-false}"
+ARTIFACTS_DIR="${RELEASE_ARTIFACTS_DIR:-}"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --tag)
+      RELEASE_TAG="${2:-}"
+      shift 2
+      ;;
+    --artifacts-dir)
+      ARTIFACTS_DIR="${2:-}"
+      shift 2
+      ;;
+    --prerelease)
+      PRERELEASE="true"
+      shift
+      ;;
+    --help|-h)
+      cat <<'EOF'
+Usage: publish_release.sh --tag <tag> --artifacts-dir <dir> [--prerelease]
+EOF
+      exit 0
+      ;;
+    *)
+      ci_die "Unknown option: $1"
+      ;;
+  esac
+done
+
+[[ -n "$RELEASE_TAG" ]] || ci_die "Release tag is required"
+[[ -n "$ARTIFACTS_DIR" ]] || ci_die "Artifacts directory is required"
+[[ -d "$ARTIFACTS_DIR" ]] || ci_die "Artifacts directory does not exist: $ARTIFACTS_DIR"
+
+ci_require_cmd gh
+
+REPO_ROOT="$(ci_repo_root)"
+STAGE_DIR="$REPO_ROOT/dist/github-release"
+BUILD_NOTES_FILE="$STAGE_DIR/BUILD-NOTES.txt"
+CHECKSUM_FILE="$STAGE_DIR/SHA256SUMS.txt"
+
+ci_reset_dir "$STAGE_DIR"
+: > "$BUILD_NOTES_FILE"
+: > "$CHECKSUM_FILE"
+
+copy_release_asset() {
+  local source_file="$1"
+  local relative_path="$2"
+  local basename
+  local destination_name
+
+  basename="$(basename "$source_file")"
+  destination_name="$basename"
+
+  if [[ -f "$STAGE_DIR/$destination_name" ]]; then
+    destination_name="${relative_path//\//-}"
+  fi
+
+  cp "$source_file" "$STAGE_DIR/$destination_name"
+  printf '%s  %s\n' "$(ci_sha256_file "$STAGE_DIR/$destination_name")" "$destination_name" >> "$CHECKSUM_FILE"
+}
+
+collect_assets() {
+  local file relative_path
+  while IFS= read -r -d '' file; do
+    relative_path="${file#$ARTIFACTS_DIR/}"
+    if [[ "$(basename "$file")" == "NOTES.txt" ]]; then
+      {
+        printf '=== %s ===\n' "$(dirname "$relative_path")"
+        cat "$file"
+        printf '\n'
+      } >> "$BUILD_NOTES_FILE"
+      continue
+    fi
+
+    case "$file" in
+      *.zip|*.tar.gz|*.apk|*.aab|*.dmg|*.pkg|*.msi|*.msix|*.exe|*.ipa) ;;
+      *) continue ;;
+    esac
+
+    copy_release_asset "$file" "$relative_path"
+  done < <(find "$ARTIFACTS_DIR" -type f -print0 | sort -z)
+}
+
+create_or_update_release() {
+  local extra_create_flags=()
+
+  if [[ "$PRERELEASE" == "true" ]]; then
+    extra_create_flags+=(--prerelease)
+  fi
+
+  if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+    ci_log "Release $RELEASE_TAG already exists; uploading assets with --clobber"
+    gh release upload "$RELEASE_TAG" "$STAGE_DIR"/* --clobber
+    return
+  fi
+
+  if [[ "${GITHUB_REF_TYPE:-}" == "tag" && "${GITHUB_REF_NAME:-}" == "$RELEASE_TAG" ]]; then
+    ci_log "Creating release from existing tag $RELEASE_TAG"
+    gh release create "$RELEASE_TAG" "$STAGE_DIR"/* \
+      --title "$RELEASE_TAG" \
+      --generate-notes \
+      --verify-tag \
+      "${extra_create_flags[@]}"
+    return
+  fi
+
+  ci_log "Creating release $RELEASE_TAG targeting ${GITHUB_SHA:-current HEAD}"
+  gh release create "$RELEASE_TAG" "$STAGE_DIR"/* \
+    --title "$RELEASE_TAG" \
+    --generate-notes \
+    --target "${GITHUB_SHA:-HEAD}" \
+    "${extra_create_flags[@]}"
+}
+
+collect_assets
+
+if [[ ! -s "$CHECKSUM_FILE" ]]; then
+  ci_die "No release assets were collected from $ARTIFACTS_DIR"
+fi
+
+if [[ ! -s "$BUILD_NOTES_FILE" ]]; then
+  rm -f "$BUILD_NOTES_FILE"
+fi
+
+create_or_update_release
+ci_log "Published GitHub Release: $RELEASE_TAG"
diff --git a/tool/test_ci_packaging.sh b/tool/test_ci_packaging.sh
new file mode 100644
index 0000000..9231c5e
--- /dev/null
+++ b/tool/test_ci_packaging.sh
@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+TMP_ROOT="$(mktemp -d)"
+ANDROID_JNI_DIR="$ROOT/android/app/src/main/jniLibs"
+
+cleanup() {
+  rm -rf "$TMP_ROOT"
+  rm -rf "$ROOT/build/native-artifacts"
+  rm -rf "$ROOT/dist/linux" "$ROOT/dist/ios"
+  rm -rf "$ANDROID_JNI_DIR"
+}
+trap cleanup EXIT
+
+fail() {
+  echo "[FAIL] $*" >&2
+  exit 1
+}
+
+assert_file_exists() {
+  local path="$1"
+  [[ -e "$path" ]] || fail "Expected file to exist: $path"
+}
+
+assert_file_missing() {
+  local path="$1"
+  [[ ! -e "$path" ]] || fail "Expected file to be absent: $path"
+}
+
+test_android_syncs_jni_libs_into_app_tree() {
+  echo "[test] android syncs JNI libs into app tree"
+  local src_dir="$TMP_ROOT/android-libs"
+  mkdir -p "$src_dir/arm64-v8a"
+  printf 'fake-so' > "$src_dir/arm64-v8a/libtim2tox_ffi.so"
+
+  TIM2TOX_ANDROID_LIB_DIR="$src_dir" \
+    bash "$ROOT/tool/ci/build_tim2tox.sh" --target android --mode release
+
+  assert_file_exists "$ROOT/build/native-artifacts/android/jniLibs/arm64-v8a/libtim2tox_ffi.so"
+  assert_file_exists "$ANDROID_JNI_DIR/arm64-v8a/libtim2tox_ffi.so"
+}
+
+test_linux_package_includes_libsodium() {
+  echo "[test] linux package includes libsodium payload"
+  mkdir -p "$ROOT/build/linux/x64/release/bundle/lib"
+  printf 'fake-exe' > "$ROOT/build/linux/x64/release/bundle/toxee"
+  printf 'fake-ffi' > "$ROOT/build/linux/x64/release/bundle/lib/libtim2tox_ffi.so"
+  mkdir -p "$ROOT/build/native-artifacts/linux"
+  printf 'fake-ffi' > "$ROOT/build/native-artifacts/linux/libtim2tox_ffi.so"
+  printf 'fake-sodium' > "$ROOT/build/native-artifacts/linux/libsodium.so.23"
+
+  bash "$ROOT/tool/ci/package_artifacts.sh" --target linux --mode release
+
+  tar -tzf "$ROOT/dist/linux/toxee-linux-x64-release.tar.gz" | grep -q 'libsodium.so.23' || \
+    fail "Expected Linux archive to contain libsodium.so.23"
+}
+
+test_ios_unsigned_build_is_not_packaged_as_installable_zip() {
+  echo "[test] unsigned iOS build is not packaged as installable zip"
+  rm -rf "$ROOT/dist/ios" "$ROOT/build/ios/iphoneos"
+  mkdir -p "$ROOT/build/ios/iphoneos/Runner.app/Frameworks"
+
+  bash "$ROOT/tool/ci/package_artifacts.sh" --target ios --mode release
+
+  assert_file_missing "$ROOT/dist/ios/toxee-ios-release.zip"
+  assert_file_missing "$ROOT/dist/ios/toxee-ios-release.ipa"
+  assert_file_exists "$ROOT/dist/ios/NOTES.txt"
+}
+
+test_ios_signed_build_is_packaged_as_ipa() {
+  echo "[test] signed iOS build is packaged as ipa"
+  rm -rf "$ROOT/dist/ios" "$ROOT/build/ios/iphoneos"
+  mkdir -p "$ROOT/build/ios/iphoneos/Runner.app/Frameworks"
+  printf 'signed' > "$ROOT/build/ios/iphoneos/Runner.app/embedded.mobileprovision"
+  mkdir -p "$ROOT/build/native-artifacts/ios/tim2tox_ffi.framework"
+  printf 'ffi-framework' > "$ROOT/build/native-artifacts/ios/tim2tox_ffi.framework/tim2tox_ffi"
+
+  bash "$ROOT/tool/ci/package_artifacts.sh" --target ios --mode release
+
+  assert_file_exists "$ROOT/dist/ios/toxee-ios-release.ipa"
+  local zip_listing
+  zip_listing="$(unzip -l "$ROOT/dist/ios/toxee-ios-release.ipa")"
+  grep -q 'Payload/Runner.app/Frameworks/tim2tox_ffi.framework/tim2tox_ffi' <<<"$zip_listing" || \
+    fail "Expected signed IPA to contain injected tim2tox_ffi framework"
+}
+
+test_workflow_does_not_use_secrets_in_if_conditions() {
+  echo "[test] workflow avoids secrets in if conditions"
+  if rg -n '^[[:space:]]*if:.*secrets\\.' "$ROOT/.github/workflows/build-packages.yml" >/dev/null; then
+    fail "Workflow still uses secrets directly in if conditions"
+  fi
+}
+
+test_analyze_workflow_tolerates_existing_warnings() {
+  echo "[test] analyze workflow is non-fatal for existing warnings"
+  rg -n 'flutter analyze lib tool --no-fatal-warnings --no-fatal-infos' "$ROOT/.github/workflows/analyze.yml" >/dev/null || \
+    fail "Analyze workflow still treats warnings as fatal"
+}
+
+test_android_syncs_jni_libs_into_app_tree
+test_linux_package_includes_libsodium
+test_ios_unsigned_build_is_not_packaged_as_installable_zip
+test_ios_signed_build_is_packaged_as_ipa
+test_workflow_does_not_use_secrets_in_if_conditions
+test_analyze_workflow_tolerates_existing_warnings
+
+echo "[PASS] all packaging regression tests passed"