feat(api): make tor and breached password lookups opt-in (#2834 )

feat(api): exempt configured ASNs from abusive IP auto-bans (#2833 )
fix(static): vendor the deepfilternet 1.3.0 assets (#2832 )
2026-10-09 12:12:25 +09:00 · 2026-09-19 01:22:17 +02:00 · 2026-09-18 23:01:58 +02:00 · 2026-09-18 18:47:42 +02:00 · 2026-09-18 17:35:58 +02:00 · 2026-09-18 15:57:32 +02:00
1079 changed files with 34693 additions and 116799 deletions
@@ -1,14 +1,14 @@
-FROM chrislusf/seaweedfs:4.31 AS seaweedfs
+FROM chrislusf/seaweedfs:4.47 AS seaweedfs

-FROM erlang:28.5.0.1
+FROM erlang:28.5.0.6

 ARG USERNAME=vscode
 ARG USER_UID=1000
 ARG USER_GID=1000
-ARG NODE_MAJOR=24
-ARG ELP_VERSION=2026-02-27
-ARG PNPM_VERSION=10.29.3
-ARG WASM_BINDGEN_VERSION=0.2.123
+ARG NODE_MAJOR=26
+ARG ELP_VERSION=2026-08-10
+ARG PNPM_VERSION=12.4.2
+ARG WASM_BINDGEN_VERSION=0.2.128

 ENV DEBIAN_FRONTEND=noninteractive

@@ -131,7 +131,8 @@ RUN apt-get update \
 RUN curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | bash - \
 	&& apt-get install -y --no-install-recommends nodejs \
 	&& rm -rf /var/lib/apt/lists/* \
-	&& corepack enable
+	&& npm install -g "pnpm@${PNPM_VERSION}" \
+	&& pnpm --version

 RUN python3 -m pip install --break-system-packages --no-cache-dir awscli

@@ -167,7 +168,7 @@ RUN ARCH="$(dpkg --print-architecture)" \
 		arm64) ELP_ARCH="aarch64" ;; \
 		*) echo "Unsupported architecture for ELP: $ARCH" >&2; exit 1 ;; \
 	esac \
-	&& curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL "https://github.com/WhatsApp/erlang-language-platform/releases/download/${ELP_VERSION}/elp-linux-${ELP_ARCH}-unknown-linux-gnu-otp-28.tar.gz" -o /tmp/elp.tgz \
+	&& curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL "https://github.com/WhatsApp/erlang-language-platform/releases/download/${ELP_VERSION}/elp-linux-${ELP_ARCH}-unknown-linux-gnu-otp-28.5.tar.gz" -o /tmp/elp.tgz \
 	&& tar -C /usr/local/bin -xzf /tmp/elp.tgz elp \
 	&& chmod +x /usr/local/bin/elp \
 	&& rm /tmp/elp.tgz
@@ -194,7 +195,4 @@ RUN curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL https://sh.rustup.rs
 	&& cargo install wasm-bindgen-cli --version "${WASM_BINDGEN_VERSION}" --locked \
 	&& rm -rf "/home/${USERNAME}/.cargo/registry" "/home/${USERNAME}/.cargo/git"

-RUN corepack prepare "pnpm@${PNPM_VERSION}" --activate \
-	&& pnpm --version
-
 WORKDIR /workspaces/fluxer
@@ -9,7 +9,7 @@ services:
    init: true
    environment:
      DOCKER_HOST: unix:///var/run/docker.sock
-      npm_config_store_dir: /home/vscode/.local/share/pnpm/store
+      pnpm_config_store_dir: /home/vscode/.local/share/pnpm/store
      FLUXER_PUBLIC_PORT: "${FLUXER_DEV_PROXY_PORT:-8088}"
      FLUXER_PUBLIC_URL: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
      FLUXER_API_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api"
@@ -292,13 +292,13 @@ services:
      start_period: 5s

  valkey:
-    image: valkey/valkey:8.1.7-alpine
+    image: valkey/valkey:9.1.2-alpine
    command: ["valkey-server", "--save", "", "--appendonly", "no"]
    ports:
      - "127.0.0.1:${FLUXER_DEV_VALKEY_PORT:-6379}:6379"

  nats:
-    image: nats:2.14.2-alpine
+    image: nats:2.14.7-alpine
    command: ["-js", "-sd", "/data", "-m", "8222"]
    volumes:
      - nats-data:/data
@@ -321,9 +321,10 @@ services:
      - "127.0.0.1:${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}:${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}/udp"

  meilisearch:
-    image: getmeili/meilisearch:v1.12
+    image: getmeili/meilisearch:v1.53
    environment:
      MEILI_NO_ANALYTICS: "true"
+      MEILI_UPGRADE_DB: "true"
      MEILI_MASTER_KEY: fluxer-dev-meilisearch
    volumes:
      - meilisearch-data:/meili_data
@@ -337,7 +338,7 @@ services:
      start_period: 5s

  mailpit:
-    image: axllent/mailpit:v1.30
+    image: axllent/mailpit:v1.31
    environment:
      MP_DATABASE: /data/mailpit.db
      MP_MAX_MESSAGES: 5000
@@ -58,13 +58,13 @@ jobs:
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: Create token
        id: create-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
@@ -101,19 +101,19 @@ jobs:
          - platform: arm64
            runner: ubuntu-24.04-arm
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: resolve source date
        id: source
        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
          context: ${{ inputs.context }}
          file: ${{ inputs.dockerfile }}
@@ -141,15 +141,15 @@ jobs:
      contents: write
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -43,13 +43,13 @@ jobs:
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: set variables
        id: vars
        run: >-
@@ -73,18 +73,18 @@ jobs:
      BUNDLE_LOCAL_ASSETS: "true"
      FLUXER_APP_PROXY_TIME_FREEZE_ENABLED: "false"
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: prepare docker config
        run: >-
          tools/ci/run.sh build-app-proxy
          --step prepare_docker_config
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
      - name: configure ghcr auth
        env:
          GHCR_USERNAME: ${{ github.actor }}
@@ -131,19 +131,19 @@ jobs:
          - platform: arm64
            runner: ubuntu-24.04-arm
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: resolve source date
        id: source
        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
          context: .
          file: fluxer_app_proxy/Dockerfile
@@ -173,15 +173,15 @@ jobs:
      contents: write
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -43,13 +43,13 @@ jobs:
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: set variables
        id: vars
        run: >-
@@ -67,18 +67,18 @@ jobs:
      contents: read
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: prepare docker config
        run: >-
          tools/ci/run.sh build-app-proxy
          --step prepare_docker_config
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
      - name: configure ghcr auth
        env:
          GHCR_USERNAME: ${{ github.actor }}
@@ -131,13 +131,13 @@ jobs:
      contents: read
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: resolve source date
        id: source
        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
@@ -145,7 +145,7 @@ jobs:
        run: >-
          tools/ci/run.sh build-app-proxy
          --step prepare_docker_config
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
      - name: configure ghcr auth
        env:
          GHCR_USERNAME: ${{ github.actor }}
@@ -178,19 +178,19 @@ jobs:
      contents: read
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: resolve source date
        id: source
        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
          context: .
          file: fluxer_app_proxy/Dockerfile
@@ -219,15 +219,15 @@ jobs:
      contents: write
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -58,14 +58,14 @@ jobs:
      source_sha: ${{ steps.meta.outputs.source_sha }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: main

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Create token
        id: create-token
@@ -98,12 +98,12 @@ jobs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Build platform matrix
        id: set-matrix
@@ -151,27 +151,27 @@ jobs:
      ELECTRON_ARCH: ${{ matrix.electron_arch }}
    steps:
      - name: Checkout CI helpers
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}
          path: _ci

      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}
          path: source

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Set up Python (Windows)
        if: runner.os == 'Windows'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
-          python-version: "3.13"
+          python-version: "3.14"

      - name: Ensure python3 command (Windows)
        if: runner.os == 'Windows'
@@ -196,14 +196,14 @@ jobs:
          --step set_workdir_unix

      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: 24
+          node-version: 26

-      - name: Set up pnpm via corepack
+      - name: Set up pnpm
        run: >-
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
-          --step setup_pnpm_corepack
+          --step setup_pnpm

      - name: Resolve pnpm store path (Windows)
        if: runner.os == 'Windows'
@@ -247,9 +247,9 @@ jobs:

      - name: Set up Rust toolchain (Unix)
        if: matrix.platform != 'windows'
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: ${{ matrix.platform == 'macos' && 'aarch64-apple-darwin,x86_64-apple-darwin' || (matrix.arch == 'arm64' && 'aarch64-unknown-linux-gnu' || 'x86_64-unknown-linux-gnu') }}

      - name: Install MSVC ARM64 build tools
@@ -260,7 +260,7 @@ jobs:

      - name: Set up MSVC env (Windows)
        if: matrix.platform == 'windows'
-        uses: TheMrMilchmann/setup-msvc-dev@79dac248aac9d0059f86eae9d8b5bfab4e95e97c
+        uses: TheMrMilchmann/setup-msvc-dev@368ef7d1ee4d1171b31d4a7f67f4d954f903f5a9
        with:
          arch: ${{ matrix.arch == 'arm64' && 'amd64_arm64' || 'amd64' }}

@@ -302,9 +302,9 @@ jobs:

      - name: Set up .NET SDK (Windows)
        if: matrix.platform == 'windows'
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
        with:
-          dotnet-version: "8.0.x"
+          dotnet-version: "10.0.x"

      - name: Install Velopack CLI
        if: matrix.platform == 'windows'
@@ -363,7 +363,7 @@ jobs:

      - name: Azure login for Artifact Signing
        if: matrix.platform == 'windows'
-        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -533,14 +533,14 @@ jobs:
      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Download S3 handoff artifacts
        run: >-
@@ -612,14 +612,14 @@ jobs:
      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Download GitHub release assets
        run: >-
@@ -19,22 +19,22 @@ jobs:
    timeout-minutes: 15
    steps:
      - name: Checkout fluxer
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -35,24 +35,24 @@ jobs:
          permission-pull-requests: write

      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          token: ${{ steps.create-token.outputs.token }}
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: "24"
+          node-version: "26"
          cache: "pnpm"

      - name: Install dependencies
@@ -40,7 +40,7 @@ jobs:
          permission-pull-requests: write

      - name: Checkout Weblate branch
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          token: ${{ steps.create-token.outputs.token }}
          ref: ${{ env.WEBLATE_BRANCH }}
@@ -48,17 +48,17 @@ jobs:
          persist-credentials: false

      - name: Set up Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: "24"
+          node-version: "26"
          cache: "pnpm"

      - name: Install dependencies
@@ -19,7 +19,7 @@ jobs:
          permission-pull-requests: write

      - name: Label pull request
-        uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13
        with:
          repo-token: ${{ steps.create-token.outputs.token }}
          configuration-path: .github/labeller.yaml
@@ -56,15 +56,15 @@ jobs:
      contents: write
      packages: read
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -28,12 +28,12 @@ jobs:
      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

      - name: Restore ci helper
@@ -42,7 +42,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -55,16 +55,16 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -83,12 +83,12 @@ jobs:
      PNPM_TEST_WORKSPACE_CONCURRENCY: '2'
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

      - name: Restore ci helper
@@ -97,7 +97,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -105,12 +105,12 @@ jobs:
        run: cargo build --locked --package fluxer-ci

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -125,7 +125,7 @@ jobs:
            fluxer_app/pkgs/libfluxcore
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
@@ -144,7 +144,7 @@ jobs:
            fluxer_app/pkgs/libfluxcore
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
@@ -156,21 +156,21 @@ jobs:
    timeout-minutes: 45
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          components: clippy, rustfmt

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Cache cargo
@@ -185,7 +185,7 @@ jobs:
            rust-${{ runner.os }}-${{ hashFiles('fluxer_media_proxy/tools/install-native-deps.sh') }}-

      - name: Install cargo-deny
-        run: cargo install cargo-deny --version 0.19.6 --locked
+        run: cargo install cargo-deny --version 0.20.2 --locked

      - name: Check Rust dependencies
        run: cargo deny --locked check -D warnings
@@ -273,12 +273,12 @@ jobs:
      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Cache cargo (gateway NIFs)
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
@@ -294,7 +294,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -305,7 +305,7 @@ jobs:
        uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124
        with:
          otp-version: '28'
-          rebar3-version: '3.24.0'
+          rebar3-version: '3.27.0'

      - name: Restore rebar3 dependencies
        id: rebar3-cache
@@ -317,10 +317,10 @@ jobs:
            !fluxer_gateway/_build/default/lib/fluxer_gateway/**
            !fluxer_gateway/_build/test/lib/fluxer_gateway/**
          key: >-
-            rebar3-${{ runner.os }}-otp28-rebar3.24.0-${{ hashFiles('fluxer_gateway/rebar.lock',
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-${{ hashFiles('fluxer_gateway/rebar.lock',
            'fluxer_gateway/rebar.config') }}
          restore-keys: |
-            rebar3-${{ runner.os }}-otp28-rebar3.24.0-
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-

      - name: Check formatting
        run: |
@@ -348,7 +348,7 @@ jobs:
            !fluxer_gateway/_build/default/lib/fluxer_gateway/**
            !fluxer_gateway/_build/test/lib/fluxer_gateway/**
          key: >-
-            rebar3-${{ runner.os }}-otp28-rebar3.24.0-${{ hashFiles('fluxer_gateway/rebar.lock',
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-${{ hashFiles('fluxer_gateway/rebar.lock',
            'fluxer_gateway/rebar.config') }}

  knip:
@@ -358,12 +358,12 @@ jobs:
      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

      - name: Restore ci helper
@@ -372,7 +372,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -380,12 +380,12 @@ jobs:
        run: cargo build --locked --package fluxer-ci

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -400,7 +400,7 @@ jobs:
            fluxer_app/pkgs/libfluxcore
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
@@ -419,7 +419,7 @@ jobs:
            fluxer_app/pkgs/libfluxcore
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
@@ -431,15 +431,15 @@ jobs:
    timeout-minutes: 15
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -456,15 +456,15 @@ jobs:
    timeout-minutes: 25
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -490,15 +490,15 @@ jobs:
    timeout-minutes: 15
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -515,12 +515,12 @@ jobs:
    timeout-minutes: 10
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
-          python-version: "3.13"
+          python-version: "3.14"

      - name: Install font tooling
        run: python3 -m pip install -r tools/fonts/requirements.txt
@@ -48,7 +48,7 @@
 	"linter": {
 		"enabled": true,
 		"rules": {
-			"recommended": true,
+			"preset": "recommended",
 			"complexity": {
 				"noForEach": "off",
 				"noImportantStyles": "off",
@@ -83,6 +83,7 @@
 					}
 				},
 				"useConst": "error",
+				"noDescendingSpecificity": "off",
 				"noNonNullAssertion": "off",
 				"noParameterAssign": "off",
 				"noRestrictedImports": {
@@ -98,7 +99,7 @@
 				}
 			},
 			"a11y": {
-				"recommended": true,
+				"preset": "recommended",
 				"useAriaPropsForRole": "error",
 				"useValidAriaRole": "error",
 				"useValidAriaValues": "error",
@@ -130,6 +130,7 @@ PUBLIC_RELEASE_CHANNEL=canary
 PUBLIC_BOOTSTRAP_API_ENDPOINT=/api
 PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT=http://localhost:8088/api
 FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64=Zmx1eGVyLWRldi11cGxvYWQtcmVsYXktc2VjcmV0LTAwMDA=
+FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64=Zmx1eGVyLWRldi1hdHRhY2htZW50LXVybC1zZWNyZXQ=
 AWS_EC2_METADATA_DISABLED=true
 AWS_ACCESS_KEY_ID=fluxer
 AWS_SECRET_ACCESS_KEY=fluxer-secret
@@ -79,34 +79,42 @@ deny = [
    { crate = "fuse-sys", reason = "libfuse2 FFI crate; Fluxer AppImages must not reintroduce libfuse2 through native Rust dependencies" },
 ]
 skip = [
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older crypto API" },
-    { crate = "[email protected].7", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected].6", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
-    { crate = "[email protected]", reason = "transitive dependency requires the older hashbrown API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older hashbrown API" },
-    { crate = "[email protected]", reason = "transitive dependency requires the older hashbrown API" },
-    { crate = "[email protected]", reason = "transitive dependency requires the prior hashbrown API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]", reason = "transitive dependency requires the older HTTP API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older HTTP body API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]", reason = "transitive dependency requires the older WASI API" },
-    { crate = "[email protected].6", reason = "transitive dependency requires the older randomness API" },
-    { crate = "[email protected].4", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected].8", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected].5", reason = "transitive dependency requires the prior randomness API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
-    { crate = "[email protected].6", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected].7", reason = "transitive dependency requires the older digest API" },
    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
-    { crate = "s[email protected]0", reason = "transitive dependency requires the older socket API" },
+    { crate = "s[email protected].0", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]+wasi-snapshot-preview1", reason = "transitive dependency requires the legacy WASI API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
    { crate = "[email protected]", reason = "transitive dependency requires the older Windows API" },
-    { crate = "[email protected]", reason = "transitive dependency requires the prior Windows API" },
-    { crate = "[email protected]", reason = "transitive dependency requires the older WASI binding API" },
 ]
 skip-tree = []

@@ -1,108 +1,64 @@
-# Every variable docker-compose.yml reads is named here, uncommented when it has
-# no default and commented with its default when it has one. A name absent from
-# this file reaches a service only through a Compose override. Compose expands
-# top to bottom, so a line using ${...} must sit below every name it reads.
+# Every variable docker-compose.yml reads, uncommented when it has no default and
+# commented with its default when it has one. Compose expands top to bottom, so a
+# line using ${...} must sit below every name it reads.

 FLUXER_DOMAIN=chat.example.com
 FLUXER_PUBLIC_SCHEME=https
 FLUXER_PUBLIC_PORT=443

-# The lines above are the address browsers use, and every advertised endpoint
-# carries FLUXER_PUBLIC_PORT. They do not move what the host publishes.
-# FLUXER_HTTP_PORT and FLUXER_HTTPS_PORT below do that, and a non-default port
-# needs the matching one set as well. Complete recipes sit beside them.
+# The address browsers use. FLUXER_HTTP_PORT and FLUXER_HTTPS_PORT below decide
+# which host ports Fluxer binds.

-# How browsers reach this instance.
-#
-# Default: Fluxer binds 80 and 443 and gets its own Let's Encrypt certificate.
-# Point DNS at this host.
-#
-# Behind your own reverse proxy (nginx, Traefik, HAProxy, Cloudflare Tunnel,
-# another Caddy): uncomment COMPOSE_FILE below. Fluxer then serves plain HTTP on
-# 127.0.0.1:8080 instead, and your proxy forwards everything to it. Keep
-# FLUXER_PUBLIC_SCHEME and FLUXER_PUBLIC_PORT describing the PUBLIC address your
-# proxy serves, not this local port.
+# By default Fluxer binds 80 and 443 and gets its own certificate. Point DNS here.
+# Behind your own reverse proxy, uncomment this instead: Fluxer then serves plain
+# HTTP on 127.0.0.1:8080. Keep the scheme and port above describing the public
+# address, not this one.
 #COMPOSE_FILE=docker-compose.yml:docker-compose.proxy.yml

-# Where the plain-HTTP port binds when the proxy overlay is in use. Leave it on
-# loopback when the proxy runs on this host. Use 0.0.0.0:8080 only when the proxy
-# is on another machine, and firewall the port to that machine.
+# Where that plain-HTTP port binds. Use 0.0.0.0:8080 only when the proxy is on
+# another machine, and firewall it to that machine.
 #FLUXER_EDGE_BIND=127.0.0.1:8080

-# Which upstream hops may set X-Forwarded-For. Fluxer rewrites the header from
-# this to the real client address, so IP bans, rate limits and abuse detection
-# see the caller rather than the proxy. The default covers proxies on private or
-# loopback addresses, which is every same-host setup. Set it to your proxy's
-# address if it reaches Fluxer from a public IP.
+# Which hops may set X-Forwarded-For. The default covers private and loopback
+# addresses. Set your proxy's address if it reaches Fluxer from a public IP.
 #FLUXER_EDGE_TRUSTED_PROXIES=private_ranges

-# The origin browsers see, without a trailing slash. Leave it unset and each
-# service builds one from the three values at the top of this file. Set it and it
-# wins: every service reads the host, the scheme and the port out of it and
-# ignores those three names. Use it when browsers reach the instance on a host
-# FLUXER_DOMAIN does not name. It has to be a bare origin, a scheme and a host
-# and an optional port and nothing after them, or the services refuse to start.
-# It does not move the edge listener or the published ports either, so set the
-# publish below to the port written here.
+# The origin browsers see, no trailing slash. Set it when browsers reach the
+# instance on a host FLUXER_DOMAIN does not name, and it wins over the three
+# values above. Scheme, host and optional port only. It does not move the
+# published ports.
 #FLUXER_PUBLIC_ORIGIN=https://chat.example.com

-# Overrides the address the edge listens on inside its container. Compose builds
-# it from FLUXER_PUBLIC_SCHEME and FLUXER_DOMAIN with no port, and the edge keeps
-# its container ports at 80 and 443 whatever the public port is. Caddy matches a
-# site by host and ignores the port in the Host header, so a request arriving on
-# a non-default published port still lands on this site. Put a port in this value
-# only if you also publish that same container port below, or nothing will be
-# listening where the publish points. Honoured in the default mode only:
-# docker-compose.proxy.yml sets the literal :8080 and tunnel.compose.yml the
-# literal :80, and Compose lets the last file win, so a value here is discarded
-# under either overlay with no warning. Set it for an unusual default-mode
-# layout, such as serving several hostnames. Write the scheme into it: a bare
-# hostname means automatic HTTPS on 443 whatever FLUXER_PUBLIC_SCHEME says.
+# The address the edge listens on inside its container. Both proxy overlays set
+# this themselves, so a value here is ignored under either. Include the scheme.
 #FLUXER_EDGE_SITE_ADDRESS=https://chat.example.com

-# The old name for the value above, read only when FLUXER_EDGE_SITE_ADDRESS is
-# unset, so an existing .env keeps the listener it already had.
+# The old name for the line above, read only when it is unset.
 #FLUXER_CADDY_SITE_ADDRESS=

-# Host side of the edge's publishes, and the only names that decide which host
-# ports Fluxer binds. The container side is fixed. Container 80 carries the
-# HTTP to HTTPS redirect and the Let's Encrypt HTTP challenge under an https
-# scheme, and the site itself under an http one. Container 443 carries the TLS
-# site. FLUXER_HTTPS_PORT moves the TCP and the UDP publish together, because
-# HTTP/3 needs both on the same port. Both take an optional bind address in front
-# of the port, and 127.0.0.1 keeps the publish off every public interface. Give
-# them different host ports: the same host port on both is two publishes of one
-# port and the edge refuses to start.
+# Host ports. Container 80 handles the redirect and the certificate challenge,
+# container 443 the TLS site. FLUXER_HTTPS_PORT moves TCP and UDP together, since
+# HTTP/3 needs both. Both accept a bind address. Give them different host ports.
 #FLUXER_HTTP_PORT=80
 #FLUXER_HTTPS_PORT=443
 #FLUXER_HTTP_PORT=127.0.0.1:80
 #FLUXER_HTTPS_PORT=127.0.0.1:443

-# HTTPS on 8443, complete. Host 80 stays published and still answers the ACME
-# challenge. Let's Encrypt only ever connects to the public 80 or 443, so the
-# certificate is issued if a router in front forwards public 80 to this host and
-# is not issued otherwise. Serve your own certificate from the Caddyfile when it
-# cannot.
+# HTTPS on 8443. Host 80 stays published for the certificate challenge, which
+# only ever arrives on public 80 or 443. Serve your own certificate if nothing
+# forwards those.
 #FLUXER_PUBLIC_PORT=8443
 #FLUXER_HTTPS_PORT=8443

-# Plain HTTP on 19080, complete. The port 80 publish moves to 19080, so nothing
-# binds host 80. Under an http scheme nothing listens on container 443, so the
-# last line parks that publish on loopback for a host that wants 443 for
-# something else. Drop it and 443 is published and idle, which is what earlier
-# releases did.
+# Plain HTTP on 19080. Nothing binds host 80, and the last line parks the idle
+# 443 publish on loopback.
 #FLUXER_PUBLIC_SCHEME=http
 #FLUXER_PUBLIC_PORT=19080
 #FLUXER_HTTP_PORT=19080
 #FLUXER_HTTPS_PORT=127.0.0.1:443

-# A tunnel or another proxy in front of the stack needs no HTTPS publish at all.
-# tunnel.compose.yml ships beside this file and replaces Caddy's published ports
-# with a single loopback HTTP publish, so nothing binds 443, and points the edge
-# at plain HTTP on that publish so it stops redirecting to https. FLUXER_HTTP_PORT
-# still moves that one publish. Set the line below and plain docker compose
-# commands pick the file up, or add it to your own -f flags if you pass any. The
-# file uses the !override tag, which needs Compose 2.24.4 or newer.
+# A tunnel needs no HTTPS publish. tunnel.compose.yml ships beside this file and
+# leaves one loopback HTTP publish. Needs Compose 2.24.4 or newer.
 #COMPOSE_FILE=docker-compose.yml:tunnel.compose.yml

 FLUXER_REGISTRY_OWNER=fluxerapp
@@ -111,11 +67,8 @@ FLUXER_IMAGE_TAG=v1

 POSTGRES_PASSWORD=CHANGE_ME
 MEILI_MASTER_KEY=CHANGE_ME
-# The stack ships its own Postgres and its own object store, and points at both
-# by service name. Set these to run either one outside the stack. Leave them
-# unset and the bundled services are used. Taking a service out of the stack
-# means an upgrade skips the backup step that reaches into it, and backing that
-# store up belongs to whoever runs it.
+# Set these to run Postgres or the object store outside the stack. Backing up a
+# store you moved out is yours to arrange, and an upgrade skips it.
 #FLUXER_POSTGRES_HOST=db.example.com
 #FLUXER_POSTGRES_PORT=5432
 #FLUXER_POSTGRES_DATABASE=fluxer
@@ -125,8 +78,7 @@ MEILI_MASTER_KEY=CHANGE_ME
 #FLUXER_S3_PUBLIC_ENDPOINT=https://cdn.example.com
 #FLUXER_S3_REGION=eu-central-1
 #FLUXER_S3_FORCE_PATH_STYLE=false
-# Bucket names. The bundled object store creates whichever names these hold, so
-# the two stay in step. An object store outside the stack needs the buckets to
+# Bucket names. The bundled store creates these. An outside store needs them to
 # exist already.
 #FLUXER_S3_BUCKET_CDN=fluxer
 #FLUXER_S3_BUCKET_UPLOADS=fluxer-uploads
@@ -134,10 +86,8 @@ MEILI_MASTER_KEY=CHANGE_ME
 #FLUXER_S3_BUCKET_REPORTS=fluxer-reports
 #FLUXER_S3_BUCKET_HARVESTS=fluxer-harvests

-# The rest of the bundled services, pointed somewhere else the same way. Leave a
-# line unset and the service in the stack is used. Taking a service out of the
-# stack goes in an override file listed in COMPOSE_FILE, because an upgrade
-# replaces docker-compose.yml.
+# The other bundled services, pointed elsewhere. Removing a service from the
+# stack belongs in an override file, since an upgrade replaces docker-compose.yml.
 #FLUXER_KV_URL=redis://cache.example.com:6379/0
 #FLUXER_NATS_URL=nats://mq.example.com:4222
 #FLUXER_NATS_JETSTREAM_URL=nats://mq.example.com:4222
@@ -145,24 +95,27 @@ MEILI_MASTER_KEY=CHANGE_ME
 #FLUXER_SEARCH_URL=https://search.example.com
 #FLUXER_LIVEKIT_INTERNAL_URL=http://livekit.example.com:7880

-# Voice off. The livekit service still runs until an override file takes it out.
+# Voice off. The livekit service still runs until an override removes it.
 #FLUXER_LIVEKIT_ENABLED=false

-# Optional systems, each off unless the instance is configured for it.
+# Optional systems, each off unless configured.
 #FLUXER_SMS_ENABLED=false
 #FLUXER_STRIPE_ENABLED=false
 #FLUXER_NCMEC_ENABLED=false
 #FLUXER_CLAMAV_ENABLED=false

-# The client address. Set the header name a proxy in front actually writes, and
-# turn the trust off when nothing sits in front, because a trusted header an
-# attacker can set is a spoofed client address.
+# Outside lookups, off unless turned on. The Tor exit list comes from
+# onionoo.torproject.org and the breached password check asks
+# api.pwnedpasswords.com.
+#FLUXER_TOR_EXIT_LIST_ENABLED=true
+#FLUXER_BREACHED_PASSWORD_CHECK_ENABLED=true
+
+# The client address. Name the header your proxy actually writes, and turn the
+# trust off when nothing sits in front.
 #FLUXER_CLIENT_IP_HEADER_NAME=cf-connecting-ip
 #FLUXER_TRUST_CLIENT_IP_HEADER=true

-# How much the services write. trace, debug, info, warn, error or fatal. Every
-# service names the object storage endpoint and its addressing at info on start,
-# so a bucket that answers 404 is visible without raising this.
+# How much the services write. trace, debug, info, warn, error or fatal.
 #LOG_LEVEL=debug

 FLUXER_S3_ACCESS_KEY=fluxer
@@ -177,32 +130,43 @@ FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64=CHANGE_ME
 FLUXER_ADMIN_SECRET_KEY_BASE=CHANGE_ME
 FLUXER_ADMIN_OAUTH_CLIENT_SECRET=CHANGE_ME

-# The token every service sends to NATS. The bundled NATS runs without
-# authentication, so this stays empty unless a Compose override points the stack
-# at an external NATS that requires a token. Compose forwards the name to every
-# container that connects.
+# The token every service sends to NATS. The bundled NATS needs none, so this
+# stays empty unless an override points at an external one.
 #FLUXER_NATS_AUTH_TOKEN=

 FLUXER_VAPID_PUBLIC_KEY=CHANGE_ME
 FLUXER_VAPID_PRIVATE_KEY=CHANGE_ME

-# The VAPID contact address defaults to admin@ followed by FLUXER_DOMAIN. Set it
-# only if that mailbox does not exist.
+# Defaults to admin@ followed by FLUXER_DOMAIN. Set it if that mailbox does not
+# exist.
 #[email protected]

-# Passkeys follow FLUXER_DOMAIN by default. Set these only if browsers reach the
-# instance on a different host, and note that changing FLUXER_PASSKEY_RP_ID
-# invalidates every passkey already registered against the old value.
+# Passkeys follow FLUXER_DOMAIN. Set these only if browsers use another host.
+# Changing the RP ID invalidates every passkey registered against the old value.
 #FLUXER_PASSKEY_RP_ID=chat.example.com
 #FLUXER_PASSKEY_RP_NAME=Fluxer
 #FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS=https://chat.example.com
 #FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS=http://chat.example.com:19080

-# Extra Content-Security-Policy sources, appended to the built-in ones. Set these
-# only when a browser must reach an origin the defaults do not cover, such as a
-# voice server hosted on a domain other than FLUXER_DOMAIN. Separate several
-# sources with spaces or commas. Every one of them is empty by default, and the
-# three carrying a value below are illustrations, not defaults.
+# Optional media policies, both off by default. See the operator docs.
+#
+# CORS limits which web origins may read media. A request with no Origin is
+# always served. Add https://web.fluxer.app if people use the hosted client.
+#
+# Signatures make an attachment read need a signed URL, so a copied link stops
+# working. Needs a secret from openssl rand -base64 32, first entry signs and
+# every entry verifies.
+#
+# Each mode is off, report or enforce. Start at report. media-proxy reads these
+# at start, so apply with docker compose up -d media-proxy.
+#FLUXER_MEDIA_PROXY_CORS_MODE=enforce
+#FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS=https://chat.example.com,https://web.fluxer.app
+#FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64=
+#FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE=enforce
+
+# Extra Content-Security-Policy sources, appended to the built-in ones. Set one
+# only when a browser must reach an origin the defaults do not cover. Separate
+# several with spaces or commas. The three values below are illustrations.
 #FLUXER_CSP_EXTRA_DEFAULT_SRC=
 #FLUXER_CSP_EXTRA_CONNECT_SRC=wss://livekit.example.com:7881
 #FLUXER_CSP_EXTRA_IMG_SRC=https://cdn.example.com
@@ -214,39 +178,29 @@ FLUXER_VAPID_PRIVATE_KEY=CHANGE_ME
 #FLUXER_CSP_EXTRA_WORKER_SRC=
 #FLUXER_CSP_EXTRA_MANIFEST_SRC=

-# One report-uri for Content-Security-Policy violation reports. Empty leaves the
-# directive off the header.
+# One report-uri for CSP violation reports. Empty leaves the directive off.
 #FLUXER_CSP_REPORT_URI=

-# Allow the SSO identity provider to resolve to a private or internal address.
-# Off by default: the API refuses to call non-public addresses so a misconfigured
-# provider URL cannot be used to reach internal services. Turn it on only when the
-# provider genuinely lives on your own network, such as split-horizon DNS or a LAN
-# identity provider, and only when you trust everyone who can configure SSO.
+# Let the SSO provider resolve to a private address. Off by default, so a
+# misconfigured provider URL cannot reach internal services. Turn it on only for
+# a provider on your own network.
 #FLUXER_SSO_ALLOW_PRIVATE_ADDRESSES=true

-# Both reach LiveKit as LIVEKIT_KEYS and the webhook signing key, and the API as
-# FLUXER_LIVEKIT_API_KEY and FLUXER_LIVEKIT_API_SECRET. Change them together.
+# These reach both LiveKit and the api. Change them together.
 LIVEKIT_API_KEY=fluxer
 LIVEKIT_API_SECRET=CHANGE_ME

-# The URL browsers use for voice signalling. Compose builds it from
-# FLUXER_PUBLIC_ORIGIN, or from FLUXER_PUBLIC_SCHEME, FLUXER_DOMAIN and
-# FLUXER_PUBLIC_PORT, as that origin followed by /livekit. The client rewrites a
-# leading http to ws itself. Set it only when LiveKit is served from another
-# host.
+# The URL browsers use for voice signalling. Built from the public origin plus
+# /livekit. Set it only when LiveKit is served from another host.
 #FLUXER_LIVEKIT_URL=

-# Media ports. LiveKit advertises these in ICE candidates, so the host must
-# forward the same numbers.
+# Media ports. LiveKit advertises these, so forward the same numbers.
 #FLUXER_LIVEKIT_TCP_PORT=7881
 #FLUXER_LIVEKIT_UDP_PORT=7882

-# LiveKit finds the address browsers dial by asking a STUN server. A host that
-# cannot reach one over UDP stops with "could not resolve external IP", and the
-# address is then set by hand: put it in FLUXER_LIVEKIT_NODE_IP and set
-# FLUXER_LIVEKIT_USE_EXTERNAL_IP to false. Point the STUN entries at another
-# server to keep the lookup and leave Google out of it.
+# LiveKit finds its public address over STUN. A host that cannot reach one stops
+# with "could not resolve external IP", so set the address by hand instead, or
+# point STUN elsewhere.
 #FLUXER_LIVEKIT_USE_EXTERNAL_IP=false
 #FLUXER_LIVEKIT_NODE_IP=203.0.113.10
 #FLUXER_LIVEKIT_STUN_PRIMARY=stun.l.google.com:19302
@@ -273,11 +227,9 @@ FLUXER_CAPTCHA_TURNSTILE_SITE_KEY=
 FLUXER_CAPTCHA_TURNSTILE_SECRET_KEY=
 FLUXER_DISCOVERY_ENABLED=true

-# Container memory. The limits sum to 18.25 GiB, which is a sum of ceilings and
-# not an allocation, so the defaults fit a host with 8 GB and are sized for 16 GB.
-# The reservations are cgroup memory.low, which biases the kernel away from
-# reclaiming from services whose death takes the instance down. They reserve
-# nothing. Lower the limits on a smaller host.
+# Container memory. These are ceilings, not allocations, and the defaults suit a
+# 16 GB host. The reservations bias the kernel away from reclaiming from services
+# whose death takes the instance down. Lower the limits on a smaller host.
 #FLUXER_CADDY_MEMORY_LIMIT=256mb
 #FLUXER_POSTGRES_MEMORY_LIMIT=5gb
 #FLUXER_POSTGRES_MEMORY_RESERVATION=3gb
@@ -308,32 +260,22 @@ FLUXER_DISCOVERY_ENABLED=true
 #FLUXER_UNFURL_SHARD_MEMORY_LIMIT=256mb
 #FLUXER_ADMIN_MEMORY_LIMIT=256mb

-# Meilisearch indexing memory. Keep it well under FLUXER_MEILISEARCH_MEMORY_LIMIT,
-# which is the container ceiling the indexer shares with the search process.
+# Meilisearch indexing memory. Keep it well under the container limit above.
 #FLUXER_MEILISEARCH_MAX_INDEXING_MEMORY=384mb

-# SeaweedFS heap ceiling. Go collects against this value instead of against the
-# container limit, which it cannot see, so without it an upload burst grows the
-# heap past FLUXER_SEAWEEDFS_MEMORY_LIMIT and the kernel OOM-kills the container
-# mid-upload (exit 137). Keep it near three quarters of that limit, and raise both
-# together: the peak is the parts of one upload in flight at once, which is 25 MB
-# times 20 for a 500 MB attachment.
+# SeaweedFS heap ceiling. Go cannot see the container limit, so without this an
+# upload burst gets the container OOM-killed. Keep it near three quarters of
+# FLUXER_SEAWEEDFS_MEMORY_LIMIT and raise both together.
 #FLUXER_SEAWEEDFS_GOMEMLIMIT=1536MiB

-# Node sizes its own heap from the container memory limit by default, at roughly
-# 55 percent of it, which always leaves room for the buffers and stacks that live
-# outside the heap. Leave these unset unless you have a reason to pin the value.
-# Any value set here must stay well below the container limit above: a heap ceiling
-# above the container limit makes the kernel OOM-kill the container (exit 137, no
-# diagnostics) instead of Node reporting a JavaScript heap out of memory error.
+# Node sizes its heap from the container limit by default. Leave these unset
+# unless you need to pin it. A heap ceiling above the container limit gets the
+# container OOM-killed instead of reporting a heap error.
 #FLUXER_API_NODE_HEAP_MB=1792
 #FLUXER_WORKER_NODE_HEAP_MB=1792

-# Bundled Postgres tuning. Keep these consistent with FLUXER_POSTGRES_MEMORY_LIMIT:
-# budget roughly shared_buffers + (server max_connections x 12 MB) +
-# (3 x autovacuum_work_mem) + 300 MB for page cache and WAL. Note this is the
-# server setting, distinct from the per-service FLUXER_POSTGRES_MAX_CONNECTIONS
-# pool sizes used by the api, worker and shards.
+# Bundled Postgres tuning. Keep it consistent with the memory limit above. This
+# is the server setting, not the per-service pool sizes.
 #FLUXER_POSTGRES_SERVER_MAX_CONNECTIONS=150
 #FLUXER_POSTGRES_SHARED_BUFFERS=512MB
 #FLUXER_POSTGRES_EFFECTIVE_CACHE_SIZE=2GB
@@ -341,48 +283,30 @@ FLUXER_DISCOVERY_ENABLED=true
 #FLUXER_POSTGRES_MAINTENANCE_WORK_MEM=256MB
 #FLUXER_POSTGRES_AUTOVACUUM_WORK_MEM=128MB

-# The bundled Valkey holds durable state as well as cache. The bulk message
-# deletion queue and the account deletion queue are sorted sets with no expiry,
-# and nothing else stores the first of the two. It therefore runs with an
-# append-only file on a named volume and with noeviction, so an over-limit write
-# fails loudly instead of silently deleting queued work. Distributed locks all
-# carry a TTL and are not what the durability is for. Only change the policy if
-# you have moved that durable state elsewhere.
+# The bundled Valkey holds durable state as well as cache, so it runs with an
+# append-only file and with noeviction, which fails an over-limit write instead
+# of dropping queued work. Change the policy only if that state lives elsewhere.
 #FLUXER_VALKEY_MAXMEMORY=192mb
 #FLUXER_VALKEY_MAXMEMORY_POLICY=noeviction

-# The gateway derives its BEAM scheduler count from the container CPU quota,
-# clamped to this range. The floor matters: a single scheduler lets one blocking
-# operation stall every websocket on the node. The ceiling stops a large host
-# from starting far more schedulers than the container can actually use.
+# The gateway derives its scheduler count from the CPU quota, clamped here. One
+# scheduler lets a single blocking operation stall every websocket on the node.
 #FLUXER_ERLANG_SCHEDULERS_MIN=2
 #FLUXER_ERLANG_SCHEDULERS_MAX=16

-# In-flight request ceiling for the services Compose forwards it to: the users
-# and messages routers and their shards. Leave it unset and each service uses its
-# built-in default. Set it and the one value replaces that default on all of
-# them, so size it for the busiest. The built-in defaults are 192 for
-# messages, 320 for snowflakes and 64 elsewhere, and they govern every service
-# Compose does not forward this to. A router holds a slot for the whole round
-# trip to its shard, so this is a ceiling on requests in flight at once and not a
-# rate: too low a value does not slow requests down, it rejects them. The api
-# turns that rejection into a 503 and logs "shard rejected the request because
-# it is at its concurrency limit".
+# In-flight request ceiling for the users and messages routers and their shards.
+# One value replaces the built-in default on all of them, so size it for the
+# busiest. Too low a value rejects requests rather than slowing them, and the api
+# turns that into a 503.
 #FLUXER_SVC_MAX_CONCURRENT_REQUESTS=192

-# The api and the Rust services name their fixed Postgres statement shapes so the
-# server can reuse their plans. Named prepared statements require a session that
-# outlives the transaction, so set this to false if you put a transaction-pooling
-# connection pooler such as PgBouncer in front of Postgres. One setting governs
-# every service. The bundled compose talks to Postgres directly, where naming is
-# a win and the default is correct.
+# Named prepared statements need a session that outlives the transaction, so set
+# this to false behind a transaction-pooling connection pooler. The bundled
+# compose talks to Postgres directly, where the default is correct.
 #FLUXER_POSTGRES_PREPARED_STATEMENTS=true

-# The api bounds how long a client may take to send a request. The header timeout
-# covers the request line and headers only, while the request timeout covers the
-# whole exchange, so a slow uploader is bounded by the second value and not by
-# the first. Raise both if you front large uploads or serve clients on high
-# latency links. The header timeout is clamped down to the request timeout, so
-# raising it alone does nothing. Both are milliseconds, between 1000 and 3600000.
+# How long a client may take to send a request. The header timeout covers the
+# request line and headers, the request timeout the whole exchange, and the first
+# is clamped down to the second. Milliseconds, 1000 to 3600000.
 #FLUXER_API_HEADERS_TIMEOUT_MS=30000
 #FLUXER_API_REQUEST_TIMEOUT_MS=120000
@@ -24,6 +24,8 @@ x-fluxer-env: &fluxer-env
  FLUXER_CLIENT_IP_HEADER_NAME: ${FLUXER_CLIENT_IP_HEADER_NAME:-x-forwarded-for}
  FLUXER_API_HEADERS_TIMEOUT_MS: ${FLUXER_API_HEADERS_TIMEOUT_MS:-30000}
  FLUXER_API_REQUEST_TIMEOUT_MS: ${FLUXER_API_REQUEST_TIMEOUT_MS:-120000}
+  FLUXER_TOR_EXIT_LIST_ENABLED: "${FLUXER_TOR_EXIT_LIST_ENABLED:-false}"
+  FLUXER_BREACHED_PASSWORD_CHECK_ENABLED: "${FLUXER_BREACHED_PASSWORD_CHECK_ENABLED:-false}"

  FLUXER_KV_URL: ${FLUXER_KV_URL:-redis://valkey:6379/0}
  FLUXER_NATS_URL: ${FLUXER_NATS_URL:-nats://nats:4222}
@@ -97,6 +99,7 @@ x-fluxer-env: &fluxer-env
  FLUXER_GATEWAY_RPC_AUTH_TOKEN: ${FLUXER_GATEWAY_RPC_AUTH_TOKEN:?set FLUXER_GATEWAY_RPC_AUTH_TOKEN in .env}
  FLUXER_MEDIA_PROXY_SECRET_KEY: ${FLUXER_MEDIA_PROXY_SECRET_KEY:?set FLUXER_MEDIA_PROXY_SECRET_KEY in .env}
  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64:?set FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64 in .env}
+  FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64: ${FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64:-}
  FLUXER_ADMIN_SECRET_KEY_BASE: ${FLUXER_ADMIN_SECRET_KEY_BASE:?set FLUXER_ADMIN_SECRET_KEY_BASE in .env}
  FLUXER_ADMIN_OAUTH_CLIENT_SECRET: ${FLUXER_ADMIN_OAUTH_CLIENT_SECRET:?set FLUXER_ADMIN_OAUTH_CLIENT_SECRET in .env}

@@ -122,7 +125,7 @@ x-fluxer-svc-healthcheck: &fluxer-svc-healthcheck

 services:
  edge:
-    image: caddy:2.10-alpine
+    image: caddy:2.11-alpine
    deploy:
      resources:
        limits:
@@ -200,7 +203,7 @@ services:
      retries: 10

  valkey:
-    image: valkey/valkey:8.1-alpine
+    image: valkey/valkey:9.1-alpine
    deploy:
      resources:
        limits:
@@ -236,7 +239,7 @@ services:
      retries: 10

  meilisearch:
-    image: getmeili/meilisearch:v1.12
+    image: getmeili/meilisearch:v1.53
    deploy:
      resources:
        limits:
@@ -246,6 +249,7 @@ services:
    environment:
      MEILI_ENV: production
      MEILI_NO_ANALYTICS: "true"
+      MEILI_UPGRADE_DB: "true"
      MEILI_MAX_INDEXING_MEMORY: ${FLUXER_MEILISEARCH_MAX_INDEXING_MEMORY:-384mb}
      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY:?set MEILI_MASTER_KEY in .env}
    volumes:
@@ -257,7 +261,7 @@ services:
      retries: 10

  seaweedfs:
-    image: chrislusf/seaweedfs:4.34
+    image: chrislusf/seaweedfs:4.47
    deploy:
      resources:
        limits:
@@ -266,7 +270,7 @@ services:
    networks: [fluxer]
    environment:
      GOMEMLIMIT: ${FLUXER_SEAWEEDFS_GOMEMLIMIT:-1536MiB}
-    command: ["server", "-s3", "-dir=/data"]
+    command: ["server", "-s3", "-dir=/data", "-master.telemetry=false"]
    volumes:
      - seaweedfs-data:/data
    healthcheck:
@@ -277,7 +281,7 @@ services:
      start_period: 60s

  seaweedfs-init:
-    image: chrislusf/seaweedfs:4.34
+    image: chrislusf/seaweedfs:4.47
    deploy:
      resources:
        limits:
@@ -472,6 +476,9 @@ services:
      FLUXER_MEDIA_PROXY_MODE: upload
      FLUXER_MEDIA_PROXY_STORAGE_BACKEND: s3
      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+      FLUXER_MEDIA_PROXY_CORS_MODE: ${FLUXER_MEDIA_PROXY_CORS_MODE:-off}
+      FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS: ${FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}:${FLUXER_PUBLIC_PORT:-443}}}
+      FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE: ${FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE:-off}
      FLUXER_S3_READ_SIGNED: "true"
    depends_on:
      seaweedfs-init: {condition: service_completed_successfully}
@@ -9,32 +9,32 @@ build = "build.rs"
 [dependencies]
 anyhow = "1.0.104"
 axum = { version = "0.8.9", features = ["macros"] }
-base64 = "0.22.1"
+base64 = "0.23.1"
 chrono = { version = "0.4", default-features = false, features = ["serde"] }
-cookie = "0.18.1"
+cookie = "0.18.2"
 fluxer_common = { path = "../fluxer_common" }
 hmac = "0.13.0"
 maud = { version = "0.27.0", features = ["axum"] }
 rand = "0.10"
-regress = "0.11"
-reqwest = { version = "0.13.4", default-features = false, features = ["json", "rustls"] }
-serde = { version = "1.0.228", features = ["derive"] }
-serde_json = "1.0.150"
+regress = "0.12"
+reqwest = { version = "0.13.5", default-features = false, features = ["json", "rustls"] }
+serde = { version = "1.0.229", features = ["derive"] }
+serde_json = "1.0.151"
 sha2 = "0.11.0"
-time = { version = "0.3.47", features = ["formatting", "parsing"] }
-tokio = { version = "1.52.3", features = ["macros", "net", "rt-multi-thread", "signal"] }
+time = { version = "0.3.55", features = ["formatting", "parsing"] }
+tokio = { version = "1.53.1", features = ["macros", "net", "rt-multi-thread", "signal"] }
 tower = { version = "0.5.3", features = ["util"] }
-tower-http = { version = "0.6.11", features = ["compression-gzip", "trace"] }
+tower-http = { version = "0.7.1", features = ["compression-gzip", "trace"] }
 tracing = "0.1.44"
 tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
 url = "2.5"
 urlencoding = "2.1.3"
-progenitor-client = { version = "0.14.0", default-features = false }
+progenitor-client = { version = "0.15.0", default-features = false }

 [build-dependencies]
 openapiv3 = "2.2.0"
-prettyplease = "0.2"
-progenitor = { version = "0.14.0", default-features = false }
+prettyplease = "0.3"
+progenitor = { version = "0.15.0", default-features = false }
 serde_json = "1"
 sha2 = "0.11.0"
-syn = "2"
+syn = "3"
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later

-FROM rust:1-bookworm AS builder
+FROM rust:1-trixie AS builder

 ARG BUILD_VERSION=""
 ARG TARGETARCH
@@ -9,7 +9,7 @@ WORKDIR /usr/src/app

 RUN apt-get update \
 	&& apt-get install -y --no-install-recommends ca-certificates nodejs npm pkg-config \
-	&& npm install -g pnpm@10.29.3 \
+	&& npm install -g pnpm@12.4.2 \
 	&& rm -rf /var/lib/apt/lists/*

 RUN npm install --no-audit --no-fund @tailwindcss/[email protected] [email protected]
@@ -57,7 +57,7 @@ RUN test "$(ls target/release/build/fluxer_admin-*/out/static/fonts/*.woff2 | wc
 	&& ls target/release/build/fluxer_admin-*/out/static/fonts/fonts.*.css \
 	&& echo "Latin-core fonts bundled successfully"

-FROM debian:bookworm-slim AS runtime
+FROM debian:trixie-slim AS runtime

 ARG BUILD_VERSION=""
 ARG SOURCE_SHA=""
@@ -54,9 +54,9 @@ fn generate_admin_api(manifest_dir: &Path, out_dir: &Path) {
        .generate_tokens(&spec)
        .expect("failed to generate admin API client");

-    let content = prettyplease::unparse(
+    let content = relax_required_nullable_fields(&prettyplease::unparse(
        &syn::parse2::<syn::File>(tokens).expect("failed to parse generated tokens"),
-    );
+    ));

    let output_path = out_dir.join("admin_api_generated.rs");
    fs::write(&output_path, content).expect("failed to write generated API code");
@@ -190,6 +190,16 @@ fn object_schema_mut<'a>(

 const MAX_SCHEMA_REFERENCE_DEPTH: usize = 32;

+fn relax_required_nullable_fields(generated: &str) -> String {
+    const PRESENCE_CHECK: &str =
+        "#[serde(deserialize_with = \"::std::option::Option::deserialize\")]";
+    generated
+        .lines()
+        .filter(|line| line.trim() != PRESENCE_CHECK)
+        .flat_map(|line| [line, "\n"])
+        .collect()
+}
+
 fn relax_progenitor_schema_strictness(spec: &mut openapiv3::OpenAPI) {
    let registry = spec.components.clone().unwrap_or_default();

@@ -10541,13 +10541,13 @@
 										"created_at": {
 											"type": "string",
 											"format": "date-time",
-											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 										},
 										"expires_at": {
 											"nullable": true,
 											"type": "string",
 											"format": "date-time",
-											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 										},
 										"max_uses": {"nullable": true, "type": "integer", "minimum": 1, "maximum": 9007199254740991},
 										"use_count": {"type": "integer", "minimum": 0, "maximum": 9007199254740991},
@@ -10555,14 +10555,14 @@
 											"nullable": true,
 											"type": "string",
 											"format": "date-time",
-											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 										},
 										"approval_required": {"type": "boolean"},
 										"last_used_at": {
 											"nullable": true,
 											"type": "string",
 											"format": "date-time",
-											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 										},
 										"last_used_by_user_id": {
 											"nullable": true,
@@ -10598,7 +10598,7 @@
 										"requested_at": {
 											"type": "string",
 											"format": "date-time",
-											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+											"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 										},
 										"registration_url_id": {"nullable": true, "type": "string", "minLength": 1, "maxLength": 128},
 										"client_ip": {"nullable": true, "type": "string"}
@@ -10855,12 +10855,14 @@
 									"min_lifetime_days": {
 										"nullable": true,
 										"type": "integer",
+										"minimum": 0,
 										"exclusiveMinimum": true,
 										"maximum": 9007199254740991
 									},
 									"max_lifetime_days": {
 										"nullable": true,
 										"type": "integer",
+										"minimum": 0,
 										"exclusiveMinimum": true,
 										"maximum": 9007199254740991
 									},
@@ -10868,12 +10870,14 @@
 									"renew_threshold_days": {
 										"nullable": true,
 										"type": "integer",
+										"minimum": 0,
 										"exclusiveMinimum": true,
 										"maximum": 9007199254740991
 									},
 									"renew_window_days": {
 										"nullable": true,
 										"type": "integer",
+										"minimum": 0,
 										"exclusiveMinimum": true,
 										"maximum": 9007199254740991
 									},
@@ -10884,15 +10888,31 @@
 											"min_size_mb": {"type": "number", "minimum": 0, "exclusiveMinimum": true},
 											"max_size_mb": {"type": "number", "minimum": 0, "exclusiveMinimum": true},
 											"max_eligible_size_mb": {"type": "number", "minimum": 0, "exclusiveMinimum": true},
-											"min_lifetime_days": {"type": "integer", "exclusiveMinimum": true, "maximum": 9007199254740991},
-											"max_lifetime_days": {"type": "integer", "exclusiveMinimum": true, "maximum": 9007199254740991},
-											"curve": {"type": "number", "minimum": 0, "maximum": 1},
-											"renew_threshold_days": {
+											"min_lifetime_days": {
 												"type": "integer",
+												"minimum": 0,
 												"exclusiveMinimum": true,
 												"maximum": 9007199254740991
 											},
-											"renew_window_days": {"type": "integer", "exclusiveMinimum": true, "maximum": 9007199254740991}
+											"max_lifetime_days": {
+												"type": "integer",
+												"minimum": 0,
+												"exclusiveMinimum": true,
+												"maximum": 9007199254740991
+											},
+											"curve": {"type": "number", "minimum": 0, "maximum": 1},
+											"renew_threshold_days": {
+												"type": "integer",
+												"minimum": 0,
+												"exclusiveMinimum": true,
+												"maximum": 9007199254740991
+											},
+											"renew_window_days": {
+												"type": "integer",
+												"minimum": 0,
+												"exclusiveMinimum": true,
+												"maximum": 9007199254740991
+											}
 										},
 										"required": [
 											"enabled",
@@ -10949,7 +10969,7 @@
 						"nullable": true,
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 					},
 					"max_uses": {"nullable": true, "type": "integer", "minimum": 1, "maximum": 1000000},
 					"approval_required": {"default": false, "type": "boolean"}
@@ -10967,13 +10987,13 @@
 							"created_at": {
 								"type": "string",
 								"format": "date-time",
-								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 							},
 							"expires_at": {
 								"nullable": true,
 								"type": "string",
 								"format": "date-time",
-								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 							},
 							"max_uses": {"nullable": true, "type": "integer", "minimum": 1, "maximum": 9007199254740991},
 							"use_count": {"type": "integer", "minimum": 0, "maximum": 9007199254740991},
@@ -10981,14 +11001,14 @@
 								"nullable": true,
 								"type": "string",
 								"format": "date-time",
-								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 							},
 							"approval_required": {"type": "boolean"},
 							"last_used_at": {
 								"nullable": true,
 								"type": "string",
 								"format": "date-time",
-								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 							},
 							"last_used_by_user_id": {
 								"nullable": true,
@@ -11222,12 +11242,14 @@
 									"min_lifetime_days": {
 										"nullable": true,
 										"type": "integer",
+										"minimum": 0,
 										"exclusiveMinimum": true,
 										"maximum": 9007199254740991
 									},
 									"max_lifetime_days": {
 										"nullable": true,
 										"type": "integer",
+										"minimum": 0,
 										"exclusiveMinimum": true,
 										"maximum": 9007199254740991
 									},
@@ -11235,12 +11257,14 @@
 									"renew_threshold_days": {
 										"nullable": true,
 										"type": "integer",
+										"minimum": 0,
 										"exclusiveMinimum": true,
 										"maximum": 9007199254740991
 									},
 									"renew_window_days": {
 										"nullable": true,
 										"type": "integer",
+										"minimum": 0,
 										"exclusiveMinimum": true,
 										"maximum": 9007199254740991
 									}
@@ -11272,7 +11296,7 @@
 								"properties": {
 									"enabled": {"type": "boolean"},
 									"window_hours": {"type": "number", "minimum": 0, "exclusiveMinimum": true, "maximum": 8760},
-									"member_threshold": {"type": "integer", "exclusiveMinimum": true, "maximum": 1000000}
+									"member_threshold": {"type": "integer", "minimum": 0, "exclusiveMinimum": true, "maximum": 1000000}
 								}
 							}
 						}
@@ -12989,14 +13013,14 @@
 						"description": "ISO 8601 timestamp when the bot token was created",
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 					},
 					"client_secret_created_at": {
 						"nullable": true,
 						"description": "ISO 8601 timestamp when the client secret was created",
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 					},
 					"version": {
 						"description": "The optimistic locking version of the application record",
@@ -13424,7 +13448,7 @@
 					"timestamp": {
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$",
 						"description": "The ISO 8601 timestamp of when the message was created"
 					},
 					"edited_timestamp": {
@@ -13432,7 +13456,7 @@
 						"nullable": true,
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 					},
 					"pinned": {"type": "boolean", "description": "Whether the message is pinned"},
 					"mention_everyone": {"type": "boolean", "description": "Whether the message mentions @everyone"},
@@ -13532,7 +13556,7 @@
 								"nullable": true,
 								"type": "string",
 								"format": "date-time",
-								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 							}
 						},
 						"required": ["participants"],
@@ -13569,7 +13593,7 @@
 							"timestamp": {
 								"type": "string",
 								"format": "date-time",
-								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
+								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$",
 								"description": "The ISO 8601 timestamp of when the message was created"
 							},
 							"edited_timestamp": {
@@ -13577,7 +13601,7 @@
 								"nullable": true,
 								"type": "string",
 								"format": "date-time",
-								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 							},
 							"pinned": {"type": "boolean", "description": "Whether the message is pinned"},
 							"mention_everyone": {"type": "boolean", "description": "Whether the message mentions @everyone"},
@@ -13677,7 +13701,7 @@
 										"nullable": true,
 										"type": "string",
 										"format": "date-time",
-										"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+										"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 									}
 								},
 								"required": ["participants"],
@@ -13841,7 +13865,7 @@
 					"timestamp": {
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$",
 						"description": "The ISO 8601 timestamp of when the original message was created"
 					},
 					"edited_timestamp": {
@@ -13849,7 +13873,7 @@
 						"nullable": true,
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 					},
 					"mentions": {
 						"description": "The user IDs mentioned in the snapshot",
@@ -14018,7 +14042,7 @@
 						"nullable": true,
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 					},
 					"description": {"description": "The description of the embed", "nullable": true, "type": "string"},
 					"author": {
@@ -14230,7 +14254,7 @@
 						"nullable": true,
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 					},
 					"description": {"description": "The description of the embed", "nullable": true, "type": "string"},
 					"author": {
@@ -15102,7 +15126,7 @@
 					"joined_at": {
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$",
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$",
 						"description": "ISO8601 timestamp of when the user joined the guild"
 					},
 					"mute": {"type": "boolean", "description": "Whether the member is muted in voice channels"},
@@ -15112,7 +15136,7 @@
 						"nullable": true,
 						"type": "string",
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
 					},
 					"profile_flags": {"nullable": true, "allOf": [{"$ref": "#/components/schemas/GuildMemberProfileFlags"}]},
 					"mention_flags": {
@@ -14,8 +14,8 @@ impl AdminApiClient {
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
        let body = generated_types::AdminBulkJobCreateRequest::UpdateUserFlags {
-            add_flags: user_flags(add_flags),
-            remove_flags: user_flags(remove_flags),
+            add_flags: user_flags(add_flags)?,
+            remove_flags: user_flags(remove_flags)?,
            user_ids: snowflakes(user_ids),
        };
        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
@@ -112,11 +112,13 @@ fn snowflakes(values: &[String]) -> Vec<generated_types::SnowflakeType> {
    values.iter().map(|value| snowflake(value)).collect()
 }

-fn user_flags(values: &[String]) -> Vec<generated_types::UserFlags> {
+fn user_flags(values: &[String]) -> ApiResult<Vec<generated_types::UserFlags>> {
    values
        .iter()
-        .cloned()
-        .map(generated_types::UserFlags::from)
+        .map(|value| {
+            generated_types::UserFlags::try_from(value.as_str())
+                .map_err(|error| ApiError::Parse(error.to_string()))
+        })
        .collect()
 }

@@ -95,8 +95,8 @@ impl AdminApiClient {
        remove_flags: &[String],
    ) -> ApiResult<AdminUser> {
        let body = generated_types::AdminUserFlagsUpdateRequest {
-            add_flags: user_flags(add_flags),
-            remove_flags: user_flags(remove_flags),
+            add_flags: user_flags(add_flags)?,
+            remove_flags: user_flags(remove_flags)?,
        };
        let response = self
            .generated()
@@ -567,11 +567,13 @@ fn bool_param(value: bool) -> &'static str {
    if value { "true" } else { "false" }
 }

-fn user_flags(values: &[String]) -> Vec<generated_types::UserFlags> {
+fn user_flags(values: &[String]) -> ApiResult<Vec<generated_types::UserFlags>> {
    values
        .iter()
-        .cloned()
-        .map(generated_types::UserFlags::from)
+        .map(|value| {
+            generated_types::UserFlags::try_from(value.as_str())
+                .map_err(|error| ApiError::Parse(error.to_string()))
+        })
        .collect()
 }

@@ -1,11 +1,11 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later
 ARG BUILD_VERSION

-FROM node:24-bookworm-slim AS base
+FROM node:26-trixie-slim AS base

 WORKDIR /usr/src/app

-RUN corepack enable && corepack prepare [email protected] --activate
+RUN npm install -g [email protected]

 FROM base AS deploy

@@ -23,9 +23,9 @@ COPY . .

 RUN pnpm install --frozen-lockfile
 RUN pnpm --filter fluxer_api run build
-RUN pnpm deploy --legacy --filter=fluxer_api --prod --config.allowUnusedPatches=true /out
+RUN pnpm deploy --legacy --filter=fluxer_api --prod --config.allow-unused-patches=true /out

-FROM node:24-bookworm-slim
+FROM node:26-trixie-slim

 ARG BUILD_VERSION
 ARG SOURCE_SHA
@@ -45,32 +45,28 @@ LABEL app.fluxer.build-version="${BUILD_VERSION}"

 WORKDIR /usr/src/app/fluxer_api

-RUN echo 'deb http://deb.debian.org/debian bookworm-backports main' > /etc/apt/sources.list.d/backports.list && \
-	apt-get update && apt-get install -y --no-install-recommends \
+RUN apt-get update && apt-get install -y --no-install-recommends \
 		ca-certificates \
 		ffmpeg \
 		libimage-exiftool-perl \
 		libwebp7 \
 		libwebpmux3 \
 		libheif1 \
-		libvips42 && \
-	apt-get install -y --no-install-recommends -t bookworm-backports \
 		libheif-plugin-libde265 \
-		libheif-plugin-dav1d && \
+		libheif-plugin-dav1d \
+		libvips42t64 && \
 	rm -rf /var/lib/apt/lists/*

-RUN corepack enable && corepack prepare [email protected] --activate
+RUN npm install -g [email protected]

 COPY --from=deploy /out ./
 COPY --from=deploy /usr/src/app/fluxer_api/dist ./dist
 COPY --from=deploy /usr/src/app/tsconfigs /usr/src/app/tsconfigs

 RUN rm -rf pkgs && \
-	mkdir -p /usr/src/app/.cache/corepack && \
 	chown -R 65532:65532 /usr/src/app

 ENV HOME=/usr/src/app
-ENV COREPACK_HOME=/usr/src/app/.cache/corepack
 ENV NODE_ENV=production
 ENV NODE_OPTIONS="--enable-source-maps"
 ENV NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
@@ -5,19 +5,19 @@
 	"scripts": {
 		"build": "node scripts/build.mjs",
 		"test": "vitest run",
-		"typecheck": "tsgo --noEmit",
+		"typecheck": "tsc --noEmit",
 		"dev": "tsx watch --clear-screen=false src/AppEntrypoint.ts",
 		"start": "tsx src/AppEntrypoint.ts",
 		"start:worker": "tsx src/WorkerEntrypoint.ts"
 	},
 	"dependencies": {
 		"@atproto/api": "catalog:",
+		"@atproto/jwk-jose": "catalog:",
+		"@atproto/oauth-client-node": "catalog:",
 		"@aws-sdk/client-s3": "catalog:",
 		"@aws-sdk/lib-storage": "catalog:",
 		"@aws-sdk/s3-request-presigner": "catalog:",
-		"@bluesky-social/jwk-jose": "catalog:",
-		"@bluesky-social/oauth-client-node": "catalog:",
-		"@bufbuild/protobuf": "^2.12.0",
+		"@bufbuild/protobuf": "^2.15.0",
 		"@elastic/elasticsearch": "catalog:",
 		"@fluxer/config": "workspace:*",
 		"@fluxer/constants": "workspace:*",
@@ -34,6 +34,8 @@
 		"@hono/node-server": "catalog:",
 		"@messageformat/core": "catalog:",
 		"@messageformat/parser": "catalog:",
+		"@nats-io/jetstream": "catalog:",
+		"@nats-io/transport-node": "catalog:",
 		"@pkgs/cache": "workspace:*",
 		"@pkgs/captcha": "workspace:*",
 		"@pkgs/cassandra": "workspace:*",
@@ -71,7 +73,6 @@
 		"lodash": "catalog:",
 		"maxmind": "catalog:",
 		"mime": "catalog:",
-		"nats": "catalog:",
 		"nodemailer": "catalog:",
 		"pg": "catalog:",
 		"pino": "catalog:",
@@ -88,10 +89,10 @@
 	"devDependencies": {
 		"@types/archiver": "catalog:",
 		"@types/lodash": "catalog:",
-		"@typescript/native-preview": "catalog:",
 		"esbuild": "catalog:",
 		"msw": "catalog:",
+		"typescript": "catalog:ts7",
 		"vitest": "catalog:"
 	},
-	"packageManager": "pnpm@10.29.3"
+	"packageManager": "pnpm@12.4.2"
 }
@@ -9,14 +9,14 @@
 	"scripts": {
 		"test": "vitest run",
 		"test:watch": "vitest",
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@pkgs/kv_client": "workspace:*"
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:",
+		"typescript": "catalog:ts7",
 		"vitest": "catalog:"
 	}
 }
@@ -7,7 +7,7 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@fluxer/logger": "workspace:*",
@@ -15,6 +15,6 @@
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -7,13 +7,13 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"cassandra-driver": "catalog:"
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -7,7 +7,7 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@elastic/elasticsearch": "catalog:",
@@ -15,6 +15,6 @@
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -9,7 +9,7 @@
 	"scripts": {
 		"test": "vitest run",
 		"test:watch": "vitest",
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@fluxer/i18n": "workspace:*",
@@ -19,8 +19,7 @@
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@types/nodemailer": "catalog:",
-		"@typescript/native-preview": "catalog:",
+		"typescript": "catalog:ts7",
 		"vitest": "catalog:"
 	}
 }
@@ -2,7 +2,7 @@

 import {createLogger} from '@fluxer/logger/src/Logger';
 import type {EmailMessage, IEmailProvider} from '@pkgs/email/src/EmailProviderTypes';
-import nodemailer from 'nodemailer';
+import nodemailer, {type Transporter} from 'nodemailer';

 const logger = createLogger('@pkgs/email/src/SmtpEmailProvider');

@@ -18,7 +18,7 @@ interface SmtpEmailConfig {
 }

 export class SmtpEmailProvider implements IEmailProvider {
-	private readonly transporter: nodemailer.Transporter;
+	private readonly transporter: Transporter;

 	constructor(config: SmtpEmailConfig) {
 		this.transporter = nodemailer.createTransport({
@@ -7,7 +7,7 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@aws-sdk/client-s3": "catalog:",
@@ -21,6 +21,6 @@
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -67,7 +67,7 @@ interface GeoipRuntimePathOptions {
 }

 export function parseGeoipSourceConfig(rawValue: string | undefined): GeoipSourceConfig {
-	if (!rawValue || !rawValue.startsWith('s3://')) {
+	if (!rawValue?.startsWith('s3://')) {
 		return createGeoipFilesystemSourceConfig(rawValue);
 	}
 	return parseGeoipS3SourceConfig(rawValue);
@@ -9,7 +9,7 @@
 	"scripts": {
 		"test": "vitest run",
 		"test:watch": "vitest",
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@fluxer/constants": "workspace:*",
@@ -17,8 +17,7 @@
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:",
-		"undici-types": "catalog:",
+		"typescript": "catalog:ts7",
 		"vitest": "catalog:"
 	}
 }
@@ -16,6 +16,7 @@ import {
 } from '@pkgs/http_client/src/HttpClientRequestInternals';
 import type {HttpClientMetrics, HttpClientTelemetry} from '@pkgs/http_client/src/HttpClientTelemetryTypes';
 import type {
+	FetchDispatcher,
 	HttpClient,
 	HttpClientFactoryOptions,
 	HttpMethod,
@@ -26,7 +27,6 @@ import type {
 	StreamResponse,
 } from '@pkgs/http_client/src/HttpClientTypes';
 import {HttpError} from '@pkgs/http_client/src/HttpError';
-import type {Dispatcher} from 'undici-types';

 const DEFAULT_SERVICE_NAME = 'unknown';

@@ -79,7 +79,7 @@ function createFetchInit(
 	headers: Headers,
 	body: string | undefined,
 	signal: AbortSignal,
-	dispatcher: Dispatcher | undefined,
+	dispatcher: FetchDispatcher | undefined,
 ): RequestInit {
 	return {
 		method,
@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

 import type {HttpClientTelemetry} from '@pkgs/http_client/src/HttpClientTelemetryTypes';
-import type {Dispatcher} from 'undici-types';

 export type ResponseStream = ReadableStream<Uint8Array> | null;
+export type FetchDispatcher = NonNullable<RequestInit['dispatcher']>;
 export type HttpMethod = 'GET' | 'POST' | 'HEAD' | 'PUT' | 'PATCH' | 'DELETE' | 'OPTIONS';
 export type RequestUrlValidationPhase = 'initial' | 'redirect';

@@ -14,7 +14,7 @@ export interface RequestUrlValidationContext {
 }

 export interface RequestUrlPolicy {
-	readonly dispatcher?: Dispatcher;
+	readonly dispatcher?: FetchDispatcher;
 	validate(url: URL, context: RequestUrlValidationContext): Promise<void>;
 }

@@ -5,10 +5,13 @@ import dns from 'node:dns';
 import type {LookupFunction} from 'node:net';
 import {BlockList, isIP} from 'node:net';
 import {formatUrlForDiagnostics} from '@pkgs/http_client/src/HttpClientDiagnostics';
-import type {RequestUrlPolicy, RequestUrlValidationContext} from '@pkgs/http_client/src/HttpClientTypes';
+import type {
+	FetchDispatcher,
+	RequestUrlPolicy,
+	RequestUrlValidationContext,
+} from '@pkgs/http_client/src/HttpClientTypes';
 import {HttpError} from '@pkgs/http_client/src/HttpError';
-import {Agent} from 'undici';
-import type {Dispatcher} from 'undici-types';
+import {Agent, Dispatcher1Wrapper} from 'undici';

 const DEFAULT_DNS_CACHE_TTL_MS = 60000;
 const DNS_CACHE_MAX_ENTRIES = 10000;
@@ -223,7 +226,7 @@ async function defaultLookupHost(hostname: string): Promise<Array<string>> {
 	return addresses.map((addressEntry) => addressEntry.address);
 }

-function createBlocklistDispatcher(allowPrivateAddresses: boolean): Dispatcher {
+function createBlocklistDispatcher(allowPrivateAddresses: boolean): FetchDispatcher {
 	const lookup: LookupFunction = (hostname, options, callback) => {
 		dns.lookup(hostname, {...options, all: true, order: options.order ?? 'verbatim'}, (error, addresses) => {
 			if (error) {
@@ -246,15 +249,18 @@ function createBlocklistDispatcher(allowPrivateAddresses: boolean): Dispatcher {
 			callback(null, primary.address, primary.family);
 		});
 	};
-	return new Agent({
-		connect: {
-			lookup,
-		},
-	}) as unknown as Dispatcher;
+	return new Dispatcher1Wrapper(
+		new Agent({
+			allowH2: false,
+			connect: {
+				lookup,
+			},
+		}),
+	) as unknown as FetchDispatcher;
 }

 interface PublicInternetRequestUrlPolicy extends RequestUrlPolicy {
-	readonly dispatcher: Dispatcher;
+	readonly dispatcher: FetchDispatcher;
 }

 export function createPublicInternetRequestUrlPolicy(
@@ -9,7 +9,7 @@
 	"scripts": {
 		"test": "vitest run",
 		"test:watch": "vitest",
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@fluxer/constants": "workspace:*",
@@ -18,7 +18,7 @@
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:",
+		"typescript": "catalog:ts7",
 		"vitest": "catalog:"
 	}
 }
@@ -295,6 +295,7 @@ export class KVClient implements IKVProvider {
 				connectTimeout: this.timeoutMs,
 				commandTimeout: this.timeoutMs,
 				maxRetriesPerRequest: 1,
+				protocol: 2,
 				retryStrategy: createRetryStrategy(),
 			});
 		}
@@ -311,6 +312,7 @@ export class KVClient implements IKVProvider {
 				connectTimeout: clusterConfig.timeoutMs,
 				commandTimeout: clusterConfig.timeoutMs,
 				maxRetriesPerRequest: 1,
+				protocol: 2,
 			},
 			scaleReads: 'master',
 			...(hasNatMap ? {natMap} : {}),
@@ -72,6 +72,7 @@ export class KVSubscription implements IKVSubscription {
 			connectTimeout: this.timeoutMs,
 			commandTimeout: this.timeoutMs,
 			maxRetriesPerRequest: 1,
+			protocol: 2,
 			retryStrategy: createRetryStrategy(),
 		};
 		const connection = this.mode === 'cluster' ? resolveKVClusterConnection(this.url, this.clusterNodes) : null;
@@ -9,14 +9,14 @@
 	"scripts": {
 		"test": "vitest run",
 		"test:watch": "vitest",
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@fluxer/constants": "workspace:*"
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:",
+		"typescript": "catalog:ts7",
 		"vitest": "catalog:"
 	}
 }
@@ -24,6 +24,10 @@
 			"import": "./src/MediaProxySigner.ts",
 			"types": "./src/MediaProxySigner.ts"
 		},
+		"./src/AttachmentUrlSignature": {
+			"import": "./src/AttachmentUrlSignature.ts",
+			"types": "./src/AttachmentUrlSignature.ts"
+		},
 		"./*": "./*"
 	},
 	"main": "./src/MediaProxyUtils.ts",
@@ -31,13 +35,13 @@
 	"scripts": {
 		"test": "vitest run",
 		"test:watch": "vitest",
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@types/node": "catalog:"
 	},
 	"devDependencies": {
-		"@typescript/native-preview": "catalog:",
+		"typescript": "catalog:ts7",
 		"vitest": "catalog:"
 	}
 }
@@ -0,0 +1,211 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import crypto from 'node:crypto';
+
+export const ATTACHMENT_URL_TTL_SECS = 86_400;
+export const ATTACHMENT_URL_BUCKET_SECS = 43_200;
+
+export const ORDINARY_USAGE = '';
+export const DATA_PACKAGE_USAGE = 'dp';
+
+export type AttachmentUrlUsage = typeof ORDINARY_USAGE | typeof DATA_PACKAGE_USAGE;
+export type SignatureParameterName = 'ex' | 'is' | 'hm' | 'uc';
+
+const SIGNATURE_DOMAIN = 'fluxer-attachment-url-v1';
+const ATTACHMENT_PATH_PREFIX = '/attachments/';
+const SIGNATURE_PARAMETER_NAMES: ReadonlyArray<SignatureParameterName> = ['ex', 'is', 'hm', 'uc'];
+const DATA_PACKAGE_EXPIRES = '0';
+const WINDOW_HEX_LENGTH = 8;
+const MAX_WINDOW_SECS = 0xff_ff_ff_ff;
+const LEADING_SLASHES_REGEX = /^\/+/u;
+const TRAILING_SLASHES_REGEX = /\/+$/u;
+
+const textEncoder = new TextEncoder();
+const strictTextDecoder = new TextDecoder('utf-8', {fatal: true, ignoreBOM: true});
+
+export interface AttachmentUrlWindow {
+	issued: number;
+	expires: number;
+}
+
+export interface SignAttachmentUrlOptions {
+	mediaEndpoint: string;
+	secret: Uint8Array;
+	nowSecs: number;
+	anchorSecs: number;
+}
+
+function hexNibble(byte: number): number {
+	if (byte >= 0x30 && byte <= 0x39) return byte - 0x30;
+	if (byte >= 0x41 && byte <= 0x46) return byte - 0x41 + 10;
+	if (byte >= 0x61 && byte <= 0x66) return byte - 0x61 + 10;
+	return -1;
+}
+
+function percentDecodeBytes(value: string, plusAsSpace: boolean): Uint8Array {
+	const bytes = textEncoder.encode(value);
+	const decoded = new Uint8Array(bytes.length);
+	let length = 0;
+	let index = 0;
+	while (index < bytes.length) {
+		const byte = bytes[index] as number;
+		if (byte === 0x25 && index + 2 < bytes.length) {
+			const high = hexNibble(bytes[index + 1] as number);
+			const low = hexNibble(bytes[index + 2] as number);
+			if (high >= 0 && low >= 0) {
+				decoded[length] = (high << 4) | low;
+				length += 1;
+				index += 3;
+				continue;
+			}
+		}
+		decoded[length] = plusAsSpace && byte === 0x2b ? 0x20 : byte;
+		length += 1;
+		index += 1;
+	}
+	return decoded.subarray(0, length);
+}
+
+export function percentDecodeStorageKey(path: string): string | null {
+	try {
+		return strictTextDecoder.decode(percentDecodeBytes(path.replace(LEADING_SLASHES_REGEX, ''), false));
+	} catch {
+		return null;
+	}
+}
+
+export function signatureParameterName(name: string): SignatureParameterName | null {
+	const decoded = percentDecodeBytes(name, true);
+	if (decoded.length !== 2) return null;
+	const candidate = String.fromCharCode(decoded[0] as number, decoded[1] as number);
+	return SIGNATURE_PARAMETER_NAMES.find((entry) => entry === candidate) ?? null;
+}
+
+export function isSignatureParameterName(name: string): boolean {
+	return signatureParameterName(name) !== null;
+}
+
+function isSafeStorageKey(key: string): boolean {
+	if (key.length === 0 || key.startsWith('/')) return false;
+	return key
+		.split('/')
+		.every((component) => component.length > 0 && component !== '.' && component !== '..' && !component.includes('\0'));
+}
+
+function firstIndexOf(value: string, characters: ReadonlyArray<string>): number {
+	let found = -1;
+	for (const character of characters) {
+		const index = value.indexOf(character);
+		if (index >= 0 && (found < 0 || index < found)) {
+			found = index;
+		}
+	}
+	return found;
+}
+
+function rawPathFromUrl(url: string): string | null {
+	const schemeIndex = url.indexOf('://');
+	if (schemeIndex < 0) return null;
+	const afterAuthority = url.slice(schemeIndex + 3);
+	const boundary = firstIndexOf(afterAuthority, ['/', '?', '#']);
+	if (boundary < 0 || afterAuthority[boundary] !== '/') return '';
+	const path = afterAuthority.slice(boundary);
+	const queryIndex = firstIndexOf(path, ['?', '#']);
+	return queryIndex < 0 ? path : path.slice(0, queryIndex);
+}
+
+function parseWebUrl(value: string): URL | null {
+	try {
+		const parsed = new URL(value);
+		return parsed.protocol === 'http:' || parsed.protocol === 'https:' ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+
+export function attachmentStorageKeyFromUrl(url: string, mediaEndpoint: string): string | null {
+	const target = parseWebUrl(url);
+	const endpoint = parseWebUrl(mediaEndpoint);
+	if (!target || !endpoint || target.origin !== endpoint.origin) return null;
+	const path = rawPathFromUrl(url);
+	if (path === null) return null;
+	const endpointPath = (rawPathFromUrl(mediaEndpoint) ?? '').replace(TRAILING_SLASHES_REGEX, '');
+	if (!path.startsWith(`${endpointPath}${ATTACHMENT_PATH_PREFIX}`)) return null;
+	const storageKey = percentDecodeStorageKey(path.slice(endpointPath.length));
+	if (storageKey === null || !isSafeStorageKey(storageKey)) return null;
+	return storageKey;
+}
+
+interface SplitUrl {
+	base: string;
+	query: string;
+	fragment: string;
+}
+
+function splitUrl(url: string): SplitUrl {
+	const fragmentIndex = url.indexOf('#');
+	const head = fragmentIndex < 0 ? url : url.slice(0, fragmentIndex);
+	const fragment = fragmentIndex < 0 ? '' : url.slice(fragmentIndex);
+	const queryIndex = head.indexOf('?');
+	if (queryIndex < 0) return {base: head, query: '', fragment};
+	return {base: head.slice(0, queryIndex), query: head.slice(queryIndex + 1), fragment};
+}
+
+function preservedFields(query: string): Array<string> {
+	if (query.length === 0) return [];
+	return query.split('&').filter((field) => {
+		if (field.length === 0 || field === '=') return false;
+		const separator = field.indexOf('=');
+		return !isSignatureParameterName(separator < 0 ? field : field.slice(0, separator));
+	});
+}
+
+export function stripAttachmentSignature(url: string): string {
+	const {base, query, fragment} = splitUrl(url);
+	const preserved = preservedFields(query);
+	if (preserved.length === 0) return `${base}${fragment}`;
+	return `${base}?${preserved.join('&')}${fragment}`;
+}
+
+export function issueWindow(anchorSecs: number, nowSecs: number): AttachmentUrlWindow {
+	const elapsed = Math.max(0, nowSecs - anchorSecs);
+	const issued = anchorSecs + Math.floor(elapsed / ATTACHMENT_URL_BUCKET_SECS) * ATTACHMENT_URL_BUCKET_SECS;
+	return {issued, expires: issued + ATTACHMENT_URL_TTL_SECS};
+}
+
+export function canonicalInput(storageKey: string, exHex: string, isHex: string, usage: AttachmentUrlUsage): string {
+	return `${SIGNATURE_DOMAIN}\n${exHex}\n${isHex}\n${usage}\n${storageKey}`;
+}
+
+function windowHex(value: number): string {
+	return value.toString(16).padStart(WINDOW_HEX_LENGTH, '0');
+}
+
+function signUsage(url: string, options: SignAttachmentUrlOptions, usage: AttachmentUrlUsage): string {
+	const storageKey = attachmentStorageKeyFromUrl(url, options.mediaEndpoint);
+	if (storageKey === null) return url;
+	const {issued, expires} = issueWindow(options.anchorSecs, options.nowSecs);
+	if (!Number.isSafeInteger(issued) || issued < 0 || expires > MAX_WINDOW_SECS) return url;
+	const isDataPackage = usage === DATA_PACKAGE_USAGE;
+	const exHex = windowHex(isDataPackage ? 0 : expires);
+	const isHex = windowHex(issued);
+	const signature = crypto
+		.createHmac('sha256', options.secret)
+		.update(canonicalInput(storageKey, exHex, isHex, usage))
+		.digest('hex');
+	const signatureFields = isDataPackage
+		? `ex=${DATA_PACKAGE_EXPIRES}&is=${isHex}&hm=${signature}&uc=${DATA_PACKAGE_USAGE}`
+		: `ex=${exHex}&is=${isHex}&hm=${signature}`;
+	const {base, query, fragment} = splitUrl(url);
+	const preserved = preservedFields(query);
+	const fields = preserved.length === 0 ? signatureFields : `${signatureFields}&${preserved.join('&')}`;
+	return `${base}?${fields}${fragment}`;
+}
+
+export function signAttachmentUrl(url: string, options: SignAttachmentUrlOptions): string {
+	return signUsage(url, options, ORDINARY_USAGE);
+}
+
+export function signDataPackageAttachmentUrl(url: string, options: SignAttachmentUrlOptions): string {
+	return signUsage(url, options, DATA_PACKAGE_USAGE);
+}
@@ -10,13 +10,13 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"mime": "catalog:"
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -7,13 +7,14 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
-		"nats": "catalog:"
+		"@nats-io/jetstream": "catalog:",
+		"@nats-io/transport-node": "catalog:"
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-import type {NatsConnection} from 'nats';
+import type {NatsConnection} from '@nats-io/transport-node';

 export interface INatsConnectionManager {
 	connect(): Promise<void>;
@@ -1,14 +1,14 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {type JetStreamClient, type JetStreamManager, jetstream, jetstreamManager} from '@nats-io/jetstream';
 import {NatsConnectionManager} from '@pkgs/nats/src/NatsConnectionManager';
-import type {JetStreamClient, JetStreamManager} from 'nats';

 export class JetStreamConnectionManager extends NatsConnectionManager {
 	getJetStreamClient(): JetStreamClient {
-		return this.getConnection().jetstream();
+		return jetstream(this.getConnection());
 	}

 	async getJetStreamManager(): Promise<JetStreamManager> {
-		return this.getConnection().jetstreamManager();
+		return jetstreamManager(this.getConnection());
 	}
 }
@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+import {connect, DrainingConnectionError, type NatsConnection} from '@nats-io/transport-node';
 import type {INatsConnectionManager} from '@pkgs/nats/src/INatsConnectionManager';
 import type {NatsConnectionOptions} from '@pkgs/nats/src/NatsConnectionOptions';
-import {connect, ErrorCode, type NatsConnection, NatsError} from 'nats';

 const DEFAULT_MAX_RECONNECT_ATTEMPTS = -1;
 const DEFAULT_RECONNECT_TIME_WAIT_MS = 500;
@@ -46,7 +46,7 @@ export class NatsConnectionManager implements INatsConnectionManager {
 		});
 		await this.connectPromise;
 		if (generation !== this.drainGeneration) {
-			throw NatsError.errorForCode(ErrorCode.ConnectionDraining);
+			throw new DrainingConnectionError();
 		}
 	}

@@ -139,7 +139,7 @@ export class NatsConnectionManager implements INatsConnectionManager {

 	private assertNotDraining(): void {
 		if (this.drainPromise !== null) {
-			throw NatsError.errorForCode(ErrorCode.ConnectionDraining);
+			throw new DrainingConnectionError();
 		}
 	}

@@ -7,7 +7,7 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"pg": "catalog:"
@@ -15,6 +15,6 @@
 	"devDependencies": {
 		"@types/node": "catalog:",
 		"@types/pg": "catalog:",
-		"@typescript/native-preview": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -7,16 +7,13 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"test": "vitest run",
-		"test:watch": "vitest",
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@pkgs/kv_client": "workspace:*"
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:",
-		"vitest": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -1,14 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-interface KVRequiredErrorOptions {
-	serviceName: string;
-	configPath: string;
-}
-
-export function throwKVRequiredError(options: KVRequiredErrorOptions): never {
-	const {serviceName, configPath} = options;
-	throw new Error(
-		`${serviceName} requires KV-backed rate limiting. ${configPath} is not set. ` +
-			`internal.kv must be configured for distributed rate limiting.`,
-	);
-}
@@ -1,63 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import {throwKVRequiredError} from '@pkgs/rate_limit/src/KVRequiredError';
-import {describe, expect, it} from 'vitest';
-
-describe('throwKVRequiredError', () => {
-	it('should throw an error with the service name', () => {
-		expect(() =>
-			throwKVRequiredError({
-				serviceName: 'fluxer_api',
-				configPath: 'internal.kv.url',
-			}),
-		).toThrow('fluxer_api requires KV-backed rate limiting');
-	});
-	it('should include the config path in the error message', () => {
-		expect(() =>
-			throwKVRequiredError({
-				serviceName: 'TestService',
-				configPath: 'config.kv.connection_string',
-			}),
-		).toThrow('config.kv.connection_string is not set');
-	});
-	it('should construct complete error message with all parts', () => {
-		let errorMessage = '';
-		try {
-			throwKVRequiredError({
-				serviceName: 'fluxer_admin',
-				configPath: 'admin.kv.endpoint',
-			});
-		} catch (error) {
-			if (error instanceof Error) {
-				errorMessage = error.message;
-			}
-		}
-		expect(errorMessage).toContain('fluxer_admin requires KV-backed rate limiting');
-		expect(errorMessage).toContain('admin.kv.endpoint is not set');
-		expect(errorMessage).toContain('internal.kv must be configured for distributed rate limiting');
-	});
-	it('should always throw (never return)', () => {
-		const fn = () =>
-			throwKVRequiredError({
-				serviceName: 'test',
-				configPath: 'test.path',
-			});
-		expect(fn).toThrow(Error);
-	});
-	it('should handle empty service name', () => {
-		expect(() =>
-			throwKVRequiredError({
-				serviceName: '',
-				configPath: 'internal.kv',
-			}),
-		).toThrow('requires KV-backed rate limiting');
-	});
-	it('should handle empty config path', () => {
-		expect(() =>
-			throwKVRequiredError({
-				serviceName: 'TestService',
-				configPath: '',
-			}),
-		).toThrow('is not set');
-	});
-});
@@ -1,18 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import {defineConfig} from 'vitest/config';
-
-export default defineConfig({
-	resolve: {tsconfigPaths: true},
-	test: {
-		globals: true,
-		environment: 'node',
-		include: ['**/*.{test,spec}.{ts,tsx}'],
-		exclude: ['node_modules', 'dist'],
-		coverage: {
-			provider: 'v8',
-			reporter: ['text', 'json', 'html'],
-			exclude: ['**/*.test.tsx', '**/*.spec.tsx', 'node_modules/'],
-		},
-	},
-});
@@ -9,7 +9,7 @@
 	"scripts": {
 		"test": "vitest run",
 		"test:watch": "vitest",
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@fluxer/constants": "workspace:*",
@@ -18,7 +18,7 @@
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:",
+		"typescript": "catalog:ts7",
 		"vitest": "catalog:"
 	}
 }
@@ -1,40 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import {SmsVerificationUnavailableError} from '@fluxer/errors/src/domains/auth/SmsVerificationUnavailableError';
-import {createMockLogger} from '@fluxer/logger/src/mock';
-import {createSmsProvider} from '@pkgs/sms/src/providers/SmsProviderFactory';
-import {describe, expect, it} from 'vitest';
-
-describe('createSmsProvider', () => {
-	it('creates a test provider that accepts the configured code', async () => {
-		const provider = createSmsProvider({
-			mode: 'test',
-			logger: createMockLogger(),
-			verificationCode: '654321',
-		});
-		await expect(provider.startVerification('+15551234567')).resolves.toBeUndefined();
-		await expect(provider.checkVerification('+15551234567', '654321')).resolves.toBe(true);
-		await expect(provider.checkVerification('+15551234567', '123456')).resolves.toBe(false);
-	});
-	it('creates an unavailable provider that throws on verification checks', async () => {
-		const provider = createSmsProvider({
-			mode: 'unavailable',
-			logger: createMockLogger(),
-		});
-		await expect(provider.startVerification('+15551234567')).resolves.toBeUndefined();
-		await expect(provider.checkVerification('+15551234567', '123456')).rejects.toThrow(SmsVerificationUnavailableError);
-	});
-	it('creates a Twilio provider in twilio mode', async () => {
-		const provider = createSmsProvider({
-			mode: 'twilio',
-			config: {
-				accountSid: 'AC123',
-				authToken: 'twilio-secret',
-				verifyServiceSid: 'VA123',
-			},
-			logger: createMockLogger(),
-			fetchFn: async () => new Response(JSON.stringify({status: 'pending'}), {status: 200}),
-		});
-		await expect(provider.startVerification('+15551234567')).resolves.toBeUndefined();
-	});
-});
@@ -1,46 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import {createMockLogger} from '@fluxer/logger/src/mock';
-import {TestSmsProvider} from '@pkgs/sms/src/providers/TestSmsProvider';
-import {describe, expect, it} from 'vitest';
-
-describe('TestSmsProvider', () => {
-	describe('startVerification', () => {
-		it('completes without error', async () => {
-			const logger = createMockLogger();
-			const provider = new TestSmsProvider({logger});
-			await expect(provider.startVerification('+15551234567')).resolves.toBeUndefined();
-		});
-		it('supports different phone number formats', async () => {
-			const logger = createMockLogger();
-			const provider = new TestSmsProvider({logger});
-			await expect(provider.startVerification('+14155552671')).resolves.toBeUndefined();
-			await expect(provider.startVerification('+447911123456')).resolves.toBeUndefined();
-			await expect(provider.startVerification('+81312345678')).resolves.toBeUndefined();
-		});
-	});
-	describe('checkVerification', () => {
-		it('returns true for the default valid code', async () => {
-			const logger = createMockLogger();
-			const provider = new TestSmsProvider({logger});
-			await provider.startVerification('+15551234567');
-			const result = await provider.checkVerification('+15551234567', '123456');
-			expect(result).toBe(true);
-		});
-		it('returns false for invalid codes', async () => {
-			const logger = createMockLogger();
-			const provider = new TestSmsProvider({logger});
-			await provider.startVerification('+15551234567');
-			expect(await provider.checkVerification('+15551234567', '000000')).toBe(false);
-			expect(await provider.checkVerification('+15551234567', '654321')).toBe(false);
-			expect(await provider.checkVerification('+15551234567', 'abcdef')).toBe(false);
-			expect(await provider.checkVerification('+15551234567', '')).toBe(false);
-		});
-		it('supports custom verification code overrides', async () => {
-			const logger = createMockLogger();
-			const provider = new TestSmsProvider({logger, verificationCode: '654321'});
-			expect(await provider.checkVerification('+15551111111', '123456')).toBe(false);
-			expect(await provider.checkVerification('+15551111111', '654321')).toBe(true);
-		});
-	});
-});
@@ -38,7 +38,7 @@ describe('TwilioSmsProvider', () => {
 		const fetchStub: typeof fetch = async (_input, init) => {
 			capturedRequest = {
 				url: String(_input),
-				authHeader: (init?.headers as Record<string, string>).Authorization,
+				authHeader: (init?.headers as Record<string, string>)?.Authorization,
 				body: init?.body as string,
 			};
 			return new Response(JSON.stringify({success: true}), {status: 200});
@@ -65,7 +65,7 @@ describe('TwilioSmsProvider', () => {
 		const fetchStub: typeof fetch = async (_input, init) => {
 			capturedRequest = {
 				url: String(_input),
-				authHeader: (init?.headers as Record<string, string>).Authorization,
+				authHeader: (init?.headers as Record<string, string>)?.Authorization,
 				body: init?.body as string,
 			};
 			return new Response(JSON.stringify({channel: 'auto'}), {status: 200});
@@ -232,7 +232,7 @@ describe('TwilioSmsProvider', () => {
 					capturedRequest = {
 						url: String(input),
 						method: init?.method,
-						authHeader: (init?.headers as Record<string, string>).Authorization,
+						authHeader: (init?.headers as Record<string, string>)?.Authorization,
 					};
 					return new Response(
 						JSON.stringify({
@@ -1,7 +1,6 @@
 {
 	"extends": "../../../tsconfigs/package.json",
 	"compilerOptions": {
-		"types": ["node"],
 		"paths": {
 			"@fluxer/*": ["../../../packages/*", "../../../packages/*/src/index.ts"],
 			"@pkgs/*": ["../*"]
@@ -7,7 +7,7 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@fluxer/logger": "workspace:*",
@@ -15,6 +15,6 @@
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -51,7 +51,7 @@
 		"./*": "./*"
 	},
 	"scripts": {
-		"typecheck": "tsgo --noEmit"
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
 		"@fluxer/constants": "workspace:*",
@@ -60,6 +60,6 @@
 	},
 	"devDependencies": {
 		"@types/node": "catalog:",
-		"@typescript/native-preview": "catalog:"
+		"typescript": "catalog:ts7"
 	}
 }
@@ -49,6 +49,7 @@ export async function createAPIApp(options: CreateAPIAppOptions): Promise<APIApp
 		trustClientIpHeader: config.proxy.trust_client_ip_header,
 		clientIpHeaderName: config.proxy.client_ip_header,
 		maxInflightRequests: config.maxInflightRequests,
+		torExitBlockingEnabled: config.torExitList.enabled,
 	});
 	routes.onError(AbuseAwareAppErrorHandler);
 	routes.notFound(AppNotFoundHandler);
@@ -166,3 +166,57 @@ describe('buildAPIConfigFromMaster stripe legacy prices', () => {
 		expect(buildAPIConfigFromMaster(withStripeLegacyPrices(master, undefined)).stripe.legacyPrices).toBeUndefined();
 	});
 });
+
+function withOptionalOutboundLookups(
+	master: MasterConfig,
+	selfHosted: boolean,
+	overrides: {torExitList?: boolean; breachedPasswordCheck?: boolean} = {},
+): MasterConfig {
+	return {
+		...master,
+		integrations: {
+			...master.integrations,
+			tor_exit_list: {enabled: overrides.torExitList},
+			breached_password_check: {enabled: overrides.breachedPasswordCheck},
+		},
+		instance: {
+			...master.instance,
+			self_hosted: selfHosted,
+		},
+	};
+}
+
+describe('buildAPIConfigFromMaster optional outbound lookups', () => {
+	let master: MasterConfig;
+	beforeAll(async () => {
+		master = await loadConfig();
+	});
+
+	it('keeps both lookups on when the instance is not self-hosted', () => {
+		const config = buildAPIConfigFromMaster(withOptionalOutboundLookups(master, false));
+		expect(config.torExitList.enabled).toBe(true);
+		expect(config.breachedPasswordCheck.enabled).toBe(true);
+	});
+
+	it('leaves both lookups off on a self-hosted instance', () => {
+		const config = buildAPIConfigFromMaster(withOptionalOutboundLookups(master, true));
+		expect(config.torExitList.enabled).toBe(false);
+		expect(config.breachedPasswordCheck.enabled).toBe(false);
+	});
+
+	it('lets a self-hosted operator switch each lookup on', () => {
+		const config = buildAPIConfigFromMaster(
+			withOptionalOutboundLookups(master, true, {torExitList: true, breachedPasswordCheck: true}),
+		);
+		expect(config.torExitList.enabled).toBe(true);
+		expect(config.breachedPasswordCheck.enabled).toBe(true);
+	});
+
+	it('lets an operator switch each lookup off when the instance is not self-hosted', () => {
+		const config = buildAPIConfigFromMaster(
+			withOptionalOutboundLookups(master, false, {torExitList: false, breachedPasswordCheck: false}),
+		);
+		expect(config.torExitList.enabled).toBe(false);
+		expect(config.breachedPasswordCheck.enabled).toBe(false);
+	});
+});
@@ -263,6 +263,9 @@ export function buildAPIConfigFromMaster(master: MasterConfig): APIConfig {
 				tokenTtlSecs: uploadRelayConfig.token_ttl_secs,
 				keepDirectCountries: uploadRelayConfig.keep_direct_countries,
 			},
+			attachmentUrls: {
+				secretsBase64: master.services.media_proxy.attachment_urls.secrets_base64,
+			},
 		},
 		geoip: geoipSourceConfig,
 		proxy: {
@@ -345,6 +348,12 @@ export function buildAPIConfigFromMaster(master: MasterConfig): APIConfig {
 		blocklistFeeds: {
 			enabled: master.integrations.blocklist_feeds.enabled ?? !master.instance.self_hosted,
 		},
+		torExitList: {
+			enabled: master.integrations.tor_exit_list.enabled ?? !master.instance.self_hosted,
+		},
+		breachedPasswordCheck: {
+			enabled: master.integrations.breached_password_check.enabled ?? !master.instance.self_hosted,
+		},
 		captcha: {
 			enabled: master.integrations.captcha.enabled,
 			provider: master.integrations.captcha.provider,
@@ -84,7 +84,7 @@ export class AdminAuditService {
 	}): Promise<AuditLogsListResponse> {
 		const auditLogSearchService = getAuditLogSearchService();
 		const targetIdBigInt = data.target_id ? BigInt(data.target_id) : undefined;
-		if (!auditLogSearchService || !auditLogSearchService.isAvailable()) {
+		if (!auditLogSearchService?.isAvailable()) {
 			return this.listAuditLogsFromDatabase({
 				adminUserId: data.admin_user_id,
 				targetType: data.target_type,
@@ -129,7 +129,7 @@ export class AdminAuditService {
 	}): Promise<AuditLogsListResponse> {
 		const auditLogSearchService = getAuditLogSearchService();
 		const targetIdBigInt = data.target_id ? BigInt(data.target_id) : undefined;
-		if (!auditLogSearchService || !auditLogSearchService.isAvailable()) {
+		if (!auditLogSearchService?.isAvailable()) {
 			return this.listAuditLogsFromDatabase({
 				adminUserId: data.admin_user_id,
 				targetType: data.target_type,
@@ -1,532 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import {
-	createAdminApiKey,
-	createAdminApiKeyWithDefaultACLs,
-	listAdminApiKeys,
-	revokeAdminApiKey,
-} from '@app/api/admin/tests/AdminTestUtils';
-import {createTestAccount, setUserACLs} from '@app/api/auth/tests/AuthTestUtils';
-import {type ApiTestHarness, createApiTestHarness} from '@app/api/test/ApiTestHarness';
-import {HTTP_STATUS} from '@app/api/test/TestConstants';
-import {createBuilder} from '@app/api/test/TestRequestBuilder';
-import {afterEach, beforeEach, describe, expect, test} from 'vitest';
-
-interface ValidationErrorResponse {
-	errors: Array<{
-		path: string;
-		code: string;
-		message: string;
-	}>;
-}
-
-function expectInvalidKeyIdFormat(json: ValidationErrorResponse): void {
-	const keyIdError = json.errors.find((error) => error.path === 'key_id');
-	expect(keyIdError).toBeDefined();
-	expect(keyIdError?.code).toBe('INVALID_SNOWFLAKE_FORMAT');
-}
-
-describe('Admin API Key Management', () => {
-	let harness: ApiTestHarness;
-	beforeEach(async () => {
-		harness = await createApiTestHarness();
-	});
-	afterEach(async () => {
-		await harness?.shutdown();
-	});
-	describe('API Key ACL Validation', () => {
-		test('user can only grant ACLs they possess', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'admin_api_key:manage', 'audit_log:view']);
-			await createBuilder(harness, `${admin.token}`)
-				.post('/admin/api-keys')
-				.body({
-					name: 'Test Key',
-					acls: ['audit_log:view'],
-				})
-				.expect(HTTP_STATUS.OK)
-				.execute();
-		});
-		test('user cannot grant ACLs they do not possess', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'admin_api_key:manage', 'audit_log:view']);
-			await createBuilder(harness, `${admin.token}`)
-				.post('/admin/api-keys')
-				.body({
-					name: 'Test Key',
-					acls: ['audit_log:view', 'user:lookup'],
-				})
-				.expect(HTTP_STATUS.FORBIDDEN)
-				.execute();
-		});
-		test('user with wildcard ACL can grant any ACL', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['*']);
-			await createBuilder(harness, `${admin.token}`)
-				.post('/admin/api-keys')
-				.body({
-					name: 'Wildcard Test Key',
-					acls: ['audit_log:view', 'user:lookup', 'guild:lookup', 'archive:trigger:user'],
-				})
-				.expect(HTTP_STATUS.OK)
-				.execute();
-		});
-		test('must have admin_api_key:manage ACL to create keys', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'audit_log:view']);
-			await createBuilder(harness, `${admin.token}`)
-				.post('/admin/api-keys')
-				.body({
-					name: 'Test Key',
-					acls: ['audit_log:view'],
-				})
-				.expect(HTTP_STATUS.FORBIDDEN)
-				.execute();
-		});
-		test('ACLs are stored and retrievable correctly', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, [
-				'admin:authenticate',
-				'admin_api_key:manage',
-				'audit_log:view',
-				'user:lookup',
-				'guild:lookup',
-			]);
-			const requestedACLs = ['audit_log:view', 'user:lookup', 'guild:lookup'];
-			await createAdminApiKey(harness, admin, 'ACL Storage Test', requestedACLs, null);
-			const keys = await listAdminApiKeys(harness, admin.token);
-			expect(keys).toHaveLength(1);
-			const keyACLs = keys[0]!.acls as Array<string>;
-			expect(keyACLs).toHaveLength(requestedACLs.length);
-			expect(keyACLs).toEqual(expect.arrayContaining(requestedACLs));
-		});
-		test('empty ACL list is valid', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'admin_api_key:manage', 'audit_log:view']);
-			await createBuilder(harness, `${admin.token}`)
-				.post('/admin/api-keys')
-				.body({
-					name: 'Test Key',
-					acls: [],
-				})
-				.expect(HTTP_STATUS.OK)
-				.execute();
-		});
-	});
-	describe('API Key Authentication', () => {
-		test('valid API key authenticates successfully', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, [
-				'admin:authenticate',
-				'admin_api_key:manage',
-				'audit_log:view',
-				'user:lookup',
-				'guild:lookup',
-			]);
-			const apiKey = await createAdminApiKeyWithDefaultACLs(harness, admin, 'Auth Test Key');
-			await createBuilder(harness, apiKey.token).get(`/admin/users/${admin.userId}`).expect(HTTP_STATUS.OK).execute();
-		});
-		test('invalid API key is rejected', async () => {
-			await createTestAccount(harness);
-			await createBuilder(harness, 'Admin invalid_key_12345')
-				.get('/admin/users/123456789')
-				.expect(HTTP_STATUS.UNAUTHORIZED)
-				.execute();
-		});
-		test('API key requires Admin prefix', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, [
-				'admin:authenticate',
-				'admin_api_key:manage',
-				'audit_log:view',
-				'user:lookup',
-				'guild:lookup',
-			]);
-			const apiKey = await createAdminApiKeyWithDefaultACLs(harness, admin, 'Prefix Test Key');
-			await createBuilder(harness, `Bearer ${apiKey.key}`)
-				.get(`/admin/users/${admin.userId}`)
-				.expect(HTTP_STATUS.UNAUTHORIZED)
-				.execute();
-		});
-		test('Admin prefix is case sensitive', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, [
-				'admin:authenticate',
-				'admin_api_key:manage',
-				'audit_log:view',
-				'user:lookup',
-				'guild:lookup',
-			]);
-			const apiKey = await createAdminApiKeyWithDefaultACLs(harness, admin, 'Case Test Key');
-			await createBuilder(harness, `admin ${apiKey.key}`)
-				.get(`/admin/users/${admin.userId}`)
-				.expect(HTTP_STATUS.UNAUTHORIZED)
-				.execute();
-		});
-		test('API key cannot authenticate to user endpoints', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, [
-				'admin:authenticate',
-				'admin_api_key:manage',
-				'audit_log:view',
-				'user:lookup',
-				'guild:lookup',
-			]);
-			const apiKey = await createAdminApiKeyWithDefaultACLs(harness, admin, 'User Endpoint Test Key');
-			await createBuilder(harness, apiKey.token).get('/users/@me').expect(HTTP_STATUS.UNAUTHORIZED).execute();
-		});
-		test('updates last_used_at timestamp on use', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, [
-				'admin:authenticate',
-				'admin_api_key:manage',
-				'audit_log:view',
-				'user:lookup',
-				'guild:lookup',
-			]);
-			const apiKey = await createAdminApiKeyWithDefaultACLs(harness, admin, 'Last Used Test Key');
-			const keysBefore = await listAdminApiKeys(harness, admin.token);
-			expect(keysBefore).toHaveLength(1);
-			expect(keysBefore[0]!.last_used_at).toBeNull();
-			await createBuilder(harness, apiKey.token).get(`/admin/users/${admin.userId}`).execute();
-			const keysAfter = await listAdminApiKeys(harness, admin.token);
-			expect(keysAfter).toHaveLength(1);
-			expect(keysAfter[0]!.last_used_at).not.toBeNull();
-		});
-	});
-	describe('API Key Authorization (ACL Restrictions)', () => {
-		test('key can access endpoints with granted ACLs', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, [
-				'admin:authenticate',
-				'admin_api_key:manage',
-				'audit_log:view',
-				'user:lookup',
-			]);
-			const apiKey = await createAdminApiKey(harness, admin, 'Test Key', ['audit_log:view', 'user:lookup'], null);
-			await createBuilder(harness, apiKey.token).get(`/admin/users/${admin.userId}`).expect(HTTP_STATUS.OK).execute();
-		});
-		test('key cannot access endpoints without required ACLs', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, [
-				'admin:authenticate',
-				'admin_api_key:manage',
-				'audit_log:view',
-				'user:lookup',
-			]);
-			const apiKey = await createAdminApiKey(harness, admin, 'Limited Key', ['audit_log:view'], null);
-			await createBuilder(harness, apiKey.token)
-				.get(`/admin/users/${admin.userId}`)
-				.expect(HTTP_STATUS.FORBIDDEN)
-				.execute();
-		});
-		test('key with wildcard ACL can access all endpoints', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['*']);
-			const apiKey = await createAdminApiKey(harness, admin, 'Wildcard Key', ['*'], null);
-			await createBuilder(harness, apiKey.token).get(`/admin/users/${admin.userId}`).expect(HTTP_STATUS.OK).execute();
-		});
-		test('multiple keys with different ACLs work independently', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, [
-				'admin:authenticate',
-				'admin_api_key:manage',
-				'audit_log:view',
-				'user:lookup',
-				'guild:lookup',
-			]);
-			const auditKey = await createAdminApiKey(harness, admin, 'Audit Log Key', ['audit_log:view'], null);
-			const userKey = await createAdminApiKey(harness, admin, 'Users Key', ['user:lookup'], null);
-			await createBuilder(harness, userKey.token).get(`/admin/users/${admin.userId}`).expect(HTTP_STATUS.OK).execute();
-			await createBuilder(harness, auditKey.token)
-				.get(`/admin/users/${admin.userId}`)
-				.expect(HTTP_STATUS.FORBIDDEN)
-				.execute();
-		});
-		test('list API keys requires admin_api_key:manage ACL', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'admin_api_key:manage']);
-			const apiKeyWithACL = await createAdminApiKey(harness, admin, 'List Test', ['admin_api_key:manage'], null);
-			await createBuilder(harness, apiKeyWithACL.token).get('/admin/api-keys').expect(HTTP_STATUS.OK).execute();
-			const apiKeyWithoutACL = await createAdminApiKey(harness, admin, 'List Test No ACL', [], null);
-			await createBuilder(harness, apiKeyWithoutACL.token)
-				.get('/admin/api-keys')
-				.expect(HTTP_STATUS.FORBIDDEN)
-				.execute();
-		});
-		test('delete API key requires admin_api_key:manage ACL', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'admin_api_key:manage']);
-			const keyToDelete = await createAdminApiKey(harness, admin, 'To Delete', [], null);
-			const deleterKey = await createAdminApiKey(harness, admin, 'Deleter', ['admin_api_key:manage'], null);
-			await createBuilder(harness, deleterKey.token)
-				.delete(`/admin/api-keys/${keyToDelete.keyId}`)
-				.body(null)
-				.expect(HTTP_STATUS.OK)
-				.execute();
-		});
-		test('delete API key fails without admin_api_key:manage ACL', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'admin_api_key:manage']);
-			const keyToDelete = await createAdminApiKey(harness, admin, 'To Delete 2', [], null);
-			const deleterKey = await createAdminApiKey(harness, admin, 'Deleter No ACL', [], null);
-			await createBuilder(harness, deleterKey.token)
-				.delete(`/admin/api-keys/${keyToDelete.keyId}`)
-				.body(null)
-				.expect(HTTP_STATUS.FORBIDDEN)
-				.execute();
-		});
-	});
-	describe('API Key Revocation', () => {
-		test('basic revocation removes key from list', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, [
-				'admin:authenticate',
-				'admin_api_key:manage',
-				'audit_log:view',
-				'user:lookup',
-				'guild:lookup',
-			]);
-			const apiKey = await createAdminApiKeyWithDefaultACLs(harness, admin, 'Revoke Test');
-			let keys = await listAdminApiKeys(harness, admin.token);
-			expect(keys).toHaveLength(1);
-			expect(keys.some((k) => k.key_id === apiKey.keyId)).toBe(true);
-			await revokeAdminApiKey(harness, admin.token, apiKey.keyId);
-			keys = await listAdminApiKeys(harness, admin.token);
-			expect(keys).toHaveLength(0);
-		});
-		test('revoked key cannot be used for authentication', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, [
-				'admin:authenticate',
-				'admin_api_key:manage',
-				'audit_log:view',
-				'user:lookup',
-				'guild:lookup',
-			]);
-			const apiKey = await createAdminApiKeyWithDefaultACLs(harness, admin, 'Revoke Auth Test');
-			await createBuilder(harness, apiKey.token).get(`/admin/users/${admin.userId}`).expect(HTTP_STATUS.OK).execute();
-			await revokeAdminApiKey(harness, admin.token, apiKey.keyId);
-			await createBuilder(harness, apiKey.token)
-				.get(`/admin/users/${admin.userId}`)
-				.expect(HTTP_STATUS.UNAUTHORIZED)
-				.execute();
-		});
-		test('revocation of non-existent key returns 404', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, [
-				'admin:authenticate',
-				'admin_api_key:manage',
-				'audit_log:view',
-				'user:lookup',
-				'guild:lookup',
-			]);
-			await createBuilder(harness, `${admin.token}`)
-				.delete('/admin/api-keys/999999999999999999')
-				.body(null)
-				.expect(HTTP_STATUS.NOT_FOUND)
-				.execute();
-		});
-		test('get rejects a non-snowflake key id', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'admin_api_key:manage']);
-			const {json} = await createBuilder<ValidationErrorResponse>(harness, `${admin.token}`)
-				.get('/admin/api-keys/nonexistent-id')
-				.expect(HTTP_STATUS.BAD_REQUEST, 'INVALID_FORM_BODY')
-				.executeWithResponse();
-			expectInvalidKeyIdFormat(json);
-		});
-		test('update rejects a non-snowflake key id', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'admin_api_key:manage']);
-			const {json} = await createBuilder<ValidationErrorResponse>(harness, `${admin.token}`)
-				.patch('/admin/api-keys/nonexistent-id')
-				.body({name: 'Renamed'})
-				.expect(HTTP_STATUS.BAD_REQUEST, 'INVALID_FORM_BODY')
-				.executeWithResponse();
-			expectInvalidKeyIdFormat(json);
-		});
-		test('revocation rejects a non-snowflake key id', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'admin_api_key:manage']);
-			const {json} = await createBuilder<ValidationErrorResponse>(harness, `${admin.token}`)
-				.delete('/admin/api-keys/nonexistent-id')
-				.body(null)
-				.expect(HTTP_STATUS.BAD_REQUEST, 'INVALID_FORM_BODY')
-				.executeWithResponse();
-			expectInvalidKeyIdFormat(json);
-		});
-		test('revocation requires admin_api_key:manage ACL', async () => {
-			const admin1 = await createTestAccount(harness);
-			const admin2 = await createTestAccount(harness);
-			await setUserACLs(harness, admin1, [
-				'admin:authenticate',
-				'admin_api_key:manage',
-				'audit_log:view',
-				'user:lookup',
-				'guild:lookup',
-			]);
-			await setUserACLs(harness, admin2, ['admin:authenticate']);
-			const apiKey = await createAdminApiKeyWithDefaultACLs(harness, admin1, 'Admin1 Key');
-			await createBuilder(harness, `${admin2.token}`)
-				.delete(`/admin/api-keys/${apiKey.keyId}`)
-				.body(null)
-				.expect(HTTP_STATUS.FORBIDDEN)
-				.execute();
-			const keys = await listAdminApiKeys(harness, admin1.token);
-			expect(keys.some((k) => k.key_id === apiKey.keyId)).toBe(true);
-		});
-		test('cannot revoke other users keys', async () => {
-			const admin1 = await createTestAccount(harness);
-			const admin2 = await createTestAccount(harness);
-			await setUserACLs(harness, admin1, [
-				'admin:authenticate',
-				'admin_api_key:manage',
-				'audit_log:view',
-				'user:lookup',
-				'guild:lookup',
-			]);
-			await setUserACLs(harness, admin2, ['admin:authenticate', 'admin_api_key:manage', 'audit_log:view']);
-			const apiKey = await createAdminApiKeyWithDefaultACLs(harness, admin1, 'Admin1 Key');
-			await createBuilder(harness, `${admin2.token}`)
-				.delete(`/admin/api-keys/${apiKey.keyId}`)
-				.body(null)
-				.expect(HTTP_STATUS.NOT_FOUND)
-				.execute();
-			const keys = await listAdminApiKeys(harness, admin1.token);
-			expect(keys.some((k) => k.key_id === apiKey.keyId)).toBe(true);
-		});
-	});
-	describe('Setting User ACLs Requires Proper ACL', () => {
-		test('setting user ACLs requires acl:set:user ACL', async () => {
-			const admin = await createTestAccount(harness);
-			const targetUser = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'acl:set:user']);
-			await createBuilder(harness, `${admin.token}`)
-				.put(`/admin/users/${targetUser.userId}/acls`)
-				.body({acls: ['admin:authenticate']})
-				.expect(HTTP_STATUS.OK)
-				.execute();
-		});
-		test('setting user ACLs fails without acl:set:user ACL', async () => {
-			const admin = await createTestAccount(harness);
-			const targetUser = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'user:lookup']);
-			await createBuilder(harness, `${admin.token}`)
-				.put(`/admin/users/${targetUser.userId}/acls`)
-				.body({acls: ['admin:authenticate']})
-				.expect(HTTP_STATUS.FORBIDDEN)
-				.execute();
-		});
-		test('API key can set user ACLs with acl:set:user', async () => {
-			const admin = await createTestAccount(harness);
-			const targetUser = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'admin_api_key:manage', 'acl:set:user']);
-			const apiKey = await createAdminApiKey(
-				harness,
-				admin,
-				'ACL Setter Key',
-				['admin:authenticate', 'acl:set:user'],
-				null,
-			);
-			await createBuilder(harness, apiKey.token)
-				.put(`/admin/users/${targetUser.userId}/acls`)
-				.body({acls: ['admin:authenticate']})
-				.expect(HTTP_STATUS.OK)
-				.execute();
-		});
-		test('API key cannot set user ACLs without acl:set:user', async () => {
-			const admin = await createTestAccount(harness);
-			const targetUser = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'admin_api_key:manage', 'user:lookup']);
-			const apiKey = await createAdminApiKey(harness, admin, 'No ACL Setter Key', ['user:lookup'], null);
-			await createBuilder(harness, apiKey.token)
-				.put(`/admin/users/${targetUser.userId}/acls`)
-				.body({acls: ['admin:authenticate']})
-				.expect(HTTP_STATUS.FORBIDDEN)
-				.execute();
-		});
-		test('setting ACLs on non-existent user fails', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'acl:set:user']);
-			await createBuilder(harness, `${admin.token}`)
-				.put('/admin/users/999999999999999999/acls')
-				.body({acls: ['admin:authenticate']})
-				.expect(HTTP_STATUS.NOT_FOUND)
-				.execute();
-		});
-	});
-	describe('Deletion Schedule Minimum Validation', () => {
-		test('schedule deletion requires user:delete ACL', async () => {
-			const admin = await createTestAccount(harness);
-			const targetUser = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'user:delete']);
-			await createBuilder(harness, `${admin.token}`)
-				.put(`/admin/users/${targetUser.userId}/deletion`)
-				.body({reason_code: 1, days_until_deletion: 60})
-				.expect(HTTP_STATUS.OK)
-				.execute();
-		});
-		test('schedule deletion fails without user:delete ACL', async () => {
-			const admin = await createTestAccount(harness);
-			const targetUser = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'user:lookup']);
-			await createBuilder(harness, `${admin.token}`)
-				.put(`/admin/users/${targetUser.userId}/deletion`)
-				.body({reason_code: 1, days_until_deletion: 60})
-				.expect(HTTP_STATUS.FORBIDDEN)
-				.execute();
-		});
-		test('deletion schedule enforces minimum days for user requested deletion', async () => {
-			const admin = await createTestAccount(harness);
-			const targetUser = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'user:delete']);
-			await createBuilder(harness, `${admin.token}`)
-				.put(`/admin/users/${targetUser.userId}/deletion`)
-				.body({reason_code: 1, days_until_deletion: 1})
-				.expect(HTTP_STATUS.OK)
-				.executeWithResponse();
-		});
-		test('deletion schedule enforces minimum days for standard deletion', async () => {
-			const admin = await createTestAccount(harness);
-			const targetUser = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'user:delete']);
-			await createBuilder(harness, `${admin.token}`)
-				.put(`/admin/users/${targetUser.userId}/deletion`)
-				.body({reason_code: 2, days_until_deletion: 1})
-				.expect(HTTP_STATUS.OK)
-				.executeWithResponse();
-		});
-		test('API key can schedule deletion with user:delete ACL', async () => {
-			const admin = await createTestAccount(harness);
-			const targetUser = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'admin_api_key:manage', 'user:delete']);
-			const apiKey = await createAdminApiKey(harness, admin, 'Deletion Key', ['user:delete'], null);
-			await createBuilder(harness, apiKey.token)
-				.put(`/admin/users/${targetUser.userId}/deletion`)
-				.body({reason_code: 1, days_until_deletion: 60})
-				.expect(HTTP_STATUS.OK)
-				.execute();
-		});
-		test('API key cannot schedule deletion without user:delete ACL', async () => {
-			const admin = await createTestAccount(harness);
-			const targetUser = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'admin_api_key:manage', 'user:lookup']);
-			const apiKey = await createAdminApiKey(harness, admin, 'No Deletion Key', ['user:lookup'], null);
-			await createBuilder(harness, apiKey.token)
-				.put(`/admin/users/${targetUser.userId}/deletion`)
-				.body({reason_code: 1, days_until_deletion: 60})
-				.expect(HTTP_STATUS.FORBIDDEN)
-				.execute();
-		});
-		test('schedule deletion on non-existent user fails', async () => {
-			const admin = await createTestAccount(harness);
-			await setUserACLs(harness, admin, ['admin:authenticate', 'user:delete']);
-			await createBuilder(harness, `${admin.token}`)
-				.put('/admin/users/999999999999999999/deletion')
-				.body({reason_code: 1, days_until_deletion: 60})
-				.expect(HTTP_STATUS.NOT_FOUND)
-				.execute();
-		});
-	});
-});
@@ -137,9 +137,11 @@ export function createInitializer(config: APIConfig, logger: ILogger): () => Pro
 			await initializeRefreshCache(ipBanCache, 'IP ban cache', logger);
 			await startAbuseReplicationSubscriber(kvClient);
 			logger.info('Abusive-IP auto-banner replication started');
-			torExitListCache.setKvClient(kvClient);
-			await torExitListCache.initialize();
-			logger.info('Tor exit list cache initialized');
+			if (config.torExitList.enabled) {
+				torExitListCache.setKvClient(kvClient);
+				await torExitListCache.initialize();
+				logger.info('Tor exit list cache initialized');
+			}
 			const {urlBlocklistCache} = await import('@app/api/middleware/UrlBlocklistCache');
 			urlBlocklistCache.setRefreshSubscriber(kvClient);
 			const {getStorageService} = await import('@app/api/middleware/ServiceSingletons');
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

 import {registerAdminControllers} from '@app/api/admin/controllers/index';
+import {AttachmentController} from '@app/api/attachment/AttachmentController';
 import {AuthController} from '@app/api/auth/AuthController';
 import {BlueskyOAuthController} from '@app/api/bluesky/BlueskyOAuthController';
 import {Config} from '@app/api/Config';
@@ -45,6 +46,7 @@ export function registerControllers(routes: HonoApp, config: APIConfig): void {
 	GeolocationController(routes);
 	registerAdminControllers(routes);
 	AuthController(routes);
+	AttachmentController(routes);
 	ChannelController(routes);
 	ConnectionController(routes);
 	BlueskyOAuthController(routes);
@@ -29,10 +29,19 @@ interface MiddlewarePipelineOptions {
 	trustClientIpHeader: boolean;
 	clientIpHeaderName?: string;
 	maxInflightRequests: number;
+	torExitBlockingEnabled: boolean;
 }

 export function configureMiddleware(routes: HonoApp, options: MiddlewarePipelineOptions): void {
-	const {logger, nodeEnv, corsOrigins, trustClientIpHeader, clientIpHeaderName, maxInflightRequests} = options;
+	const {
+		logger,
+		nodeEnv,
+		corsOrigins,
+		trustClientIpHeader,
+		clientIpHeaderName,
+		maxInflightRequests,
+		torExitBlockingEnabled,
+	} = options;
 	const resolvedHeader = resolveClientIpHeaderName(clientIpHeaderName);
 	routes.use('/webhooks/:webhook_id/:token', cors({origins: '*'}));
 	routes.use('/webhooks/:webhook_id/:token/messages/:message_id', cors({origins: '*'}));
@@ -100,7 +109,9 @@ export function configureMiddleware(routes: HonoApp, options: MiddlewarePipeline
 			}),
 		);
 	}
-	routes.use(TorExitMiddleware);
+	if (torExitBlockingEnabled) {
+		routes.use(TorExitMiddleware);
+	}
 	routes.use(AuditLogMiddleware);
 	routes.use(RequireClientIpMiddleware());
 	routes.use(ServiceMiddleware);
@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {configureMiddleware} from '@app/api/app/MiddlewarePipeline';
+import {TorExitMiddleware} from '@app/api/middleware/TorExitMiddleware';
+import {NoopLogger} from '@app/api/test/mocks/NoopLogger';
+import type {HonoEnv} from '@app/api/types/HonoEnv';
+import {Hono} from 'hono';
+import {describe, expect, it} from 'vitest';
+
+function registeredHandlers(torExitBlockingEnabled: boolean): Array<unknown> {
+	const routes = new Hono<HonoEnv>({strict: true});
+	configureMiddleware(routes, {
+		logger: new NoopLogger(),
+		nodeEnv: 'test',
+		corsOrigins: ['http://localhost:3000'],
+		trustClientIpHeader: true,
+		clientIpHeaderName: 'x-forwarded-for',
+		maxInflightRequests: 100,
+		torExitBlockingEnabled,
+	});
+	return routes.routes.map((route) => route.handler);
+}
+
+describe('tor exit blocking in the middleware pipeline', () => {
+	it('registers the tor exit middleware when the switch is on', () => {
+		expect(registeredHandlers(true)).toContain(TorExitMiddleware);
+	});
+
+	it('leaves the tor exit middleware unregistered when the switch is off', () => {
+		expect(registeredHandlers(false)).not.toContain(TorExitMiddleware);
+	});
+});
@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {signAttachmentUrl} from '@app/api/attachment/AttachmentUrls';
+import {LoginRequired} from '@app/api/middleware/AuthMiddleware';
+import {RateLimitMiddleware} from '@app/api/middleware/RateLimitMiddleware';
+import {OpenAPI} from '@app/api/middleware/ResponseTypeMiddleware';
+import {RateLimitConfigs} from '@app/api/RateLimitConfig';
+import type {HonoApp} from '@app/api/types/HonoEnv';
+import {Validator} from '@app/api/Validator';
+import {
+	RefreshAttachmentUrlsRequest,
+	RefreshAttachmentUrlsResponse,
+} from '@fluxer/schema/src/domains/message/AttachmentSchemas';
+
+export function AttachmentController(app: HonoApp) {
+	app.post(
+		'/attachments/refresh-urls',
+		RateLimitMiddleware(RateLimitConfigs.ATTACHMENT_URLS_REFRESH),
+		LoginRequired,
+		Validator('json', RefreshAttachmentUrlsRequest),
+		OpenAPI({
+			operationId: 'refresh_attachment_urls',
+			summary: 'Refresh attachment URLs',
+			responseSchema: RefreshAttachmentUrlsResponse,
+			statusCode: 200,
+			security: ['botToken', 'sessionToken'],
+			tags: ['Messages'],
+			description:
+				'Reissues the expiring signature on attachment URLs. Returns one entry per requested URL, in the order they were requested, each pairing the URL exactly as it was sent with a freshly signed copy. A URL that is not an attachment URL of this instance is returned unchanged. No membership or existence check is performed.',
+		}),
+		async (ctx) => {
+			const urls = ctx.req.valid('json').attachment_urls;
+			return ctx.json({
+				refreshed_urls: urls.map((original) => ({original, refreshed: signAttachmentUrl(original)})),
+			});
+		},
+	);
+}
@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import type {AttachmentID, ChannelID} from '@app/api/BrandedTypes';
+import {Config} from '@app/api/Config';
+import {makeAttachmentCdnUrl} from '@app/api/channel/services/message/MessageHelpers';
+import {extractTimestampBigInt} from '@fluxer/snowflake/src/SnowflakeUtils';
+import {
+	attachmentStorageKeyFromUrl,
+	type SignAttachmentUrlOptions,
+	signDataPackageAttachmentUrl as signDataPackageWithSecret,
+	signAttachmentUrl as signWithSecret,
+	stripAttachmentSignature as stripSignature,
+} from '@pkgs/media_proxy_utils/src/AttachmentUrlSignature';
+
+const SNOWFLAKE_SEGMENT_REGEX = /^[0-9]{1,20}$/u;
+const STORAGE_KEY_MIN_SEGMENTS = 4;
+
+function signingSecret(): Buffer | null {
+	const configured = Config.mediaProxy.attachmentUrls.secretsBase64[0];
+	if (!configured) return null;
+	const secret = Buffer.from(configured, 'base64');
+	return secret.length === 0 ? null : secret;
+}
+
+function anchorSecsFromStorageKey(storageKey: string): number | null {
+	const segments = storageKey.split('/');
+	if (segments.length < STORAGE_KEY_MIN_SEGMENTS || segments[0] !== 'attachments') return null;
+	const attachmentId = segments[2] as string;
+	if (!SNOWFLAKE_SEGMENT_REGEX.test(segments[1] as string) || !SNOWFLAKE_SEGMENT_REGEX.test(attachmentId)) return null;
+	return Math.floor(extractTimestampBigInt(BigInt(attachmentId)) / 1000);
+}
+
+function signingOptions(url: string, nowSecs?: number): SignAttachmentUrlOptions | null {
+	const secret = signingSecret();
+	if (secret === null) return null;
+	const mediaEndpoint = Config.endpoints.media;
+	const storageKey = attachmentStorageKeyFromUrl(url, mediaEndpoint);
+	if (storageKey === null) return null;
+	const anchorSecs = anchorSecsFromStorageKey(storageKey);
+	if (anchorSecs === null) return null;
+	return {mediaEndpoint, secret, nowSecs: nowSecs ?? Math.floor(Date.now() / 1000), anchorSecs};
+}
+
+export function signAttachmentUrl(url: string, nowSecs?: number): string {
+	const options = signingOptions(url, nowSecs);
+	return options === null ? url : signWithSecret(url, options);
+}
+
+export function signDataPackageAttachmentUrl(url: string, nowSecs?: number): string {
+	const options = signingOptions(url, nowSecs);
+	return options === null ? url : signDataPackageWithSecret(url, options);
+}
+
+export function stripOwnAttachmentSignature(url: string): string {
+	return attachmentStorageKeyFromUrl(url, Config.endpoints.media) === null ? url : stripSignature(url);
+}
+
+export function makeSignedAttachmentCdnUrl(
+	channelId: ChannelID,
+	attachmentId: AttachmentID | bigint,
+	filename: string,
+): string {
+	return signAttachmentUrl(makeAttachmentCdnUrl(channelId, attachmentId, filename));
+}
+
+export function makeDataPackageAttachmentCdnUrl(
+	channelId: ChannelID,
+	attachmentId: AttachmentID | bigint,
+	filename: string,
+): string {
+	return signDataPackageAttachmentUrl(makeAttachmentCdnUrl(channelId, attachmentId, filename));
+}
@@ -121,6 +121,7 @@ export async function generateWebAuthnRegistrationOptions(ctx: ApiContext, userI
 		userName: user.username!,
 		userDisplayName: user.username!,
 		attestationType: 'none',
+		supportedAlgorithmIDs: [-8, -7, -257],
 		excludeCredentials: existingCredentials.map((cred) => ({
 			id: cred.credentialId,
 			transports: cred.transports
@@ -174,6 +175,7 @@ export async function verifyWebAuthnRegistration(
 				expectedOrigin,
 				expectedRPID: rpID,
 				requireUserVerification: false,
+				supportedAlgorithmIDs: [-8, -7, -257],
 			});
 		} catch (error) {
 			Logger.error({error, userId, expectedChallenge, rpID, expectedOrigin}, 'WebAuthn verification failed');
@@ -5,6 +5,7 @@ import type {ApiContext} from '@app/api/ApiContext';
 import * as AuthSession from '@app/api/auth/AuthSession';
 import * as AuthUtility from '@app/api/auth/AuthUtility';
 import {createMfaTicket, createPasswordResetToken} from '@app/api/BrandedTypes';
+import {Config} from '@app/api/Config';
 import {Logger} from '@app/api/Logger';
 import type {User} from '@app/api/models/User';
 import {EXTERNAL_RESPONSE_LIMITS} from '@app/api/utils/ExternalResponseLimits';
@@ -116,6 +117,9 @@ export async function verifyPassword(
 }

 export async function isPasswordPwned(_ctx: ApiContext, password: string): Promise<boolean> {
+	if (!Config.breachedPasswordCheck.enabled) {
+		return false;
+	}
 	const hashed = crypto.createHash('sha1').update(password).digest('hex').toUpperCase();
 	const hashPrefix = hashed.slice(0, 5);
 	const hashSuffix = hashed.slice(5);
@@ -135,19 +135,14 @@ describe('reject reasons reaching the caller through the real gate', () => {
 			REJECT_REASON_CODES.invalid_number,
 		);
 	});
-	it.each([
-		'landline',
-		'tollFree',
-		'premium',
-		'sharedCost',
-		'uan',
-		'voicemail',
-		'pager',
-	] as const)('line_type_hard_rejected for %s says it is not a mobile', async (lineType) => {
-		expect(await codeFromVerify(MOBILE_US, {lookupResult: lookup({lineType})})).toBe(
-			REJECT_REASON_CODES.line_type_hard_rejected,
-		);
-	});
+	it.each(['landline', 'tollFree', 'premium', 'sharedCost', 'uan', 'voicemail', 'pager'] as const)(
+		'line_type_hard_rejected for %s says it is not a mobile',
+		async (lineType) => {
+			expect(await codeFromVerify(MOBILE_US, {lookupResult: lookup({lineType})})).toBe(
+				REJECT_REASON_CODES.line_type_hard_rejected,
+			);
+		},
+	);
 	it('sms_pumping_risk_high routes to human review', async () => {
 		expect(await codeFromVerify(MOBILE_US, {lookupResult: lookup({smsPumpingRiskScore: 100})})).toBe(
 			REJECT_REASON_CODES.sms_pumping_risk_high,
@@ -1,62 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import {
-	createAuthHarness,
-	createUniqueEmail,
-	createUniqueUsername,
-	loginUser,
-	registerUser,
-} from '@app/api/auth/tests/AuthTestUtils';
-import type {ApiTestHarness} from '@app/api/test/ApiTestHarness';
-import {createBuilderWithoutAuth} from '@app/api/test/TestRequestBuilder';
-import {afterAll, beforeAll, beforeEach, describe, expect, it} from 'vitest';
-
-async function setUserSecurityFlags(harness: ApiTestHarness, userId: string, setFlags: Array<string>): Promise<void> {
-	await createBuilderWithoutAuth(harness)
-		.post(`/test/users/${userId}/security-flags`)
-		.body({
-			set_flags: setFlags,
-		})
-		.expect(200)
-		.execute();
-}
-
-describe('Auth app store reviewer IP bypass', () => {
-	let harness: ApiTestHarness;
-	beforeAll(async () => {
-		harness = await createAuthHarness();
-	});
-	beforeEach(async () => {
-		await harness.reset();
-	});
-	afterAll(async () => {
-		await harness?.shutdown();
-	});
-	it('allows login from any IP address when APP_STORE_REVIEWER flag is set', async () => {
-		const email = createUniqueEmail('app-store-reviewer');
-		const username = createUniqueUsername('reviewer');
-		const password = 'a-strong-password';
-		const reg = await registerUser(harness, {
-			email,
-			username,
-			global_name: 'App Store Reviewer',
-			password,
-			date_of_birth: '2000-01-01',
-			consent: true,
-		});
-		await setUserSecurityFlags(harness, reg.user_id, ['APP_STORE_REVIEWER']);
-		const login = await loginUser(harness, {
-			email,
-			password,
-		});
-		expect('mfa' in login).toBe(false);
-		if (!('mfa' in login)) {
-			const nonMfaLogin = login as {
-				user_id: string;
-				token: string;
-			};
-			expect(nonMfaLogin.token).toBeTruthy();
-			expect(nonMfaLogin.user_id).toBe(reg.user_id);
-		}
-	});
-});
@@ -1,62 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import {
-	createAuthHarness,
-	createUniqueEmail,
-	createUniqueUsername,
-	loginUser,
-	registerUser,
-} from '@app/api/auth/tests/AuthTestUtils';
-import type {ApiTestHarness} from '@app/api/test/ApiTestHarness';
-import {createBuilderWithoutAuth} from '@app/api/test/TestRequestBuilder';
-import {afterAll, beforeAll, beforeEach, describe, expect, it} from 'vitest';
-
-async function setUserSecurityFlags(harness: ApiTestHarness, userId: string, setFlags: Array<string>): Promise<void> {
-	await createBuilderWithoutAuth(harness)
-		.post(`/test/users/${userId}/security-flags`)
-		.body({
-			set_flags: setFlags,
-		})
-		.expect(200)
-		.execute();
-}
-
-describe('Auth app store reviewer with other flags', () => {
-	let harness: ApiTestHarness;
-	beforeAll(async () => {
-		harness = await createAuthHarness();
-	});
-	beforeEach(async () => {
-		await harness.reset();
-	});
-	afterAll(async () => {
-		await harness?.shutdown();
-	});
-	it('allows login with APP_STORE_REVIEWER flag combined with other flags', async () => {
-		const email = createUniqueEmail('reviewer-multi-flag');
-		const username = createUniqueUsername('reviewer');
-		const password = 'a-strong-password';
-		const reg = await registerUser(harness, {
-			email,
-			username,
-			global_name: 'Multi Flag Reviewer',
-			password,
-			date_of_birth: '2000-01-01',
-			consent: true,
-		});
-		await setUserSecurityFlags(harness, reg.user_id, ['APP_STORE_REVIEWER', 'STAFF']);
-		const login = await loginUser(harness, {
-			email,
-			password,
-		});
-		expect('mfa' in login).toBe(false);
-		if (!('mfa' in login)) {
-			const nonMfaLogin = login as {
-				user_id: string;
-				token: string;
-			};
-			expect(nonMfaLogin.token).toBeTruthy();
-			expect(nonMfaLogin.user_id).toBe(reg.user_id);
-		}
-	});
-});
@@ -193,9 +193,9 @@ describe('Auth sudo required operations', () => {
 		await createBuilder(harness, account.token)
 			.post('/users/@me/mfa/totp/disable')
 			.body({
-				code: backupCode,
+				code: 'invalid-code',
 			})
-			.expect(403)
+			.expect(400, 'INVALID_FORM_BODY')
 			.execute();
 		await createBuilder(harness, account.token)
 			.post('/users/@me/mfa/totp/disable')
@@ -1,118 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import {
-	createAuthHarness,
-	createUniqueEmail,
-	createUniqueTestId,
-	createUniqueUsername,
-	registerUser,
-} from '@app/api/auth/tests/AuthTestUtils';
-import type {ApiTestHarness} from '@app/api/test/ApiTestHarness';
-import {createBuilderWithoutAuth} from '@app/api/test/TestRequestBuilder';
-import {afterAll, beforeAll, beforeEach, describe, expect, it} from 'vitest';
-
-describe('Auth IP Authorization Poll', () => {
-	let harness: ApiTestHarness;
-	beforeAll(async () => {
-		harness = await createAuthHarness();
-	});
-	beforeEach(async () => {
-		await harness.reset();
-	});
-	afterAll(async () => {
-		await harness?.shutdown();
-	});
-	it('returns not completed when authorization is pending', async () => {
-		const email = createUniqueEmail('ip-poll');
-		const password = 'a-strong-password';
-		const reg = await registerUser(harness, {
-			email,
-			username: createUniqueUsername('poll'),
-			global_name: 'Poll User',
-			password,
-			date_of_birth: '2000-01-01',
-			consent: true,
-		});
-		const ticket = createUniqueTestId('poll');
-		const token = createUniqueTestId('token');
-		await createBuilderWithoutAuth(harness)
-			.post('/test/auth/ip-authorization')
-			.body({
-				ticket,
-				token,
-				user_id: reg.user_id,
-				email,
-				username: 'poll-user',
-				client_ip: '192.0.2.10',
-				user_agent: 'IntegrationTest/1.0',
-				client_location: 'Testland',
-				created_at: Date.now() - 60 * 1000,
-				ttl_seconds: 900,
-			})
-			.expect(200)
-			.execute();
-		const pollBefore = await createBuilderWithoutAuth<{
-			completed: boolean;
-		}>(harness)
-			.get(`/auth/ip-authorization/poll?ticket=${ticket}`)
-			.execute();
-		expect(pollBefore).toMatchObject({completed: false});
-	});
-	it('returns completed with credentials after authorization', async () => {
-		const email = createUniqueEmail('ip-poll-complete');
-		const password = 'a-strong-password';
-		const reg = await registerUser(harness, {
-			email,
-			username: createUniqueUsername('pollcomplete'),
-			global_name: 'Poll Complete User',
-			password,
-			date_of_birth: '2000-01-01',
-			consent: true,
-		});
-		const ticket = createUniqueTestId('poll-complete');
-		const token = createUniqueTestId('token');
-		await createBuilderWithoutAuth(harness)
-			.post('/test/auth/ip-authorization')
-			.body({
-				ticket,
-				token,
-				user_id: reg.user_id,
-				email,
-				username: 'poll-complete-user',
-				client_ip: '192.0.2.10',
-				user_agent: 'IntegrationTest/1.0',
-				client_location: 'Testland',
-				created_at: Date.now() - 60 * 1000,
-				ttl_seconds: 900,
-			})
-			.expect(200)
-			.execute();
-		await createBuilderWithoutAuth(harness)
-			.post('/test/auth/ip-authorization/publish')
-			.body({
-				ticket,
-				token,
-				user_id: reg.user_id,
-			})
-			.expect(200)
-			.execute();
-		const pollAfter = await createBuilderWithoutAuth<{
-			completed: boolean;
-			token: string;
-			user_id: string;
-		}>(harness)
-			.get(`/auth/ip-authorization/poll?ticket=${ticket}`)
-			.execute();
-		expect(pollAfter).toMatchObject({
-			completed: true,
-			token,
-			user_id: reg.user_id,
-		});
-	});
-	it('rejects poll with invalid ticket', async () => {
-		await createBuilderWithoutAuth(harness)
-			.get('/auth/ip-authorization/poll?ticket=does-not-exist')
-			.expect(400, 'INVALID_FORM_BODY')
-			.execute();
-	});
-});
@@ -449,9 +449,9 @@ describe('MFA Consistency Tests', () => {
 			await createBuilder(harness, loggedIn.token)
 				.post('/users/@me/mfa/totp/disable')
 				.body({
-					code: backupCodes.backup_codes[0]!.code,
+					code: 'invalid-code',
 				})
-				.expect(403)
+				.expect(400, 'INVALID_FORM_BODY')
 				.execute();
 			await createBuilder(harness, loggedIn.token)
 				.post('/users/@me/mfa/totp/disable')
@@ -0,0 +1,228 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {
+	type BackupCodesResponse,
+	createAuthHarness,
+	createTestAccount,
+	createTotpSecret,
+	type TestAccount,
+	totpCodeNow,
+} from '@app/api/auth/tests/AuthTestUtils';
+import {
+	createRegistrationResponse,
+	createWebAuthnDevice,
+	type WebAuthnRegistrationOptions,
+} from '@app/api/auth/tests/WebAuthnTestUtils';
+import {Config} from '@app/api/Config';
+import type {ApiTestHarness} from '@app/api/test/ApiTestHarness';
+import {HTTP_STATUS} from '@app/api/test/TestConstants';
+import {createBuilder, createBuilderWithoutAuth} from '@app/api/test/TestRequestBuilder';
+import {ValidationErrorCodes} from '@fluxer/constants/src/ValidationErrorCodes';
+import {afterAll, beforeAll, beforeEach, describe, expect, it} from 'vitest';
+
+const SUDO_MODE_HEADER = 'X-Fluxer-Sudo-Mode-JWT';
+
+interface ValidationErrorBody {
+	code: string;
+	errors: Array<{path: string; code: string}>;
+}
+
+async function withTotpReplayProtection<T>(run: () => Promise<T>): Promise<T> {
+	const previous = Config.dev.testModeEnabled;
+	Config.dev.testModeEnabled = false;
+	try {
+		return await run();
+	} finally {
+		Config.dev.testModeEnabled = previous;
+	}
+}
+
+function wrongCodeFor(code: string): string {
+	return ((Number(code) + 500_000) % 1_000_000).toString().padStart(6, '0');
+}
+
+async function enableTotp(harness: ApiTestHarness, account: TestAccount, secret: string): Promise<Array<string>> {
+	const response = await createBuilder<BackupCodesResponse>(harness, account.token)
+		.post('/users/@me/mfa/totp/enable')
+		.body({secret, code: totpCodeNow(secret), password: account.password})
+		.execute();
+	return response.backup_codes.map((backupCode) => backupCode.code);
+}
+
+async function loginRequiresMfa(harness: ApiTestHarness, account: TestAccount): Promise<boolean> {
+	const login = await createBuilderWithoutAuth<{mfa?: boolean}>(harness)
+		.post('/auth/login')
+		.body({email: account.email, password: account.password})
+		.execute();
+	return login.mfa === true;
+}
+
+describe('MFA TOTP disable', () => {
+	let harness: ApiTestHarness;
+	beforeAll(async () => {
+		harness = await createAuthHarness();
+	});
+	beforeEach(async () => {
+		await harness.reset();
+	});
+	afterAll(async () => {
+		await harness?.shutdown();
+	});
+
+	it('disables when the sudo fields repeat the authenticator code', async () => {
+		const account = await createTestAccount(harness);
+		const secret = createTotpSecret();
+		await enableTotp(harness, account, secret);
+		await withTotpReplayProtection(async () => {
+			const code = totpCodeNow(secret);
+			await createBuilder(harness, account.token)
+				.post('/users/@me/mfa/totp/disable')
+				.body({code, mfa_method: 'totp', mfa_code: code})
+				.expect(HTTP_STATUS.NO_CONTENT)
+				.execute();
+		});
+		expect(await loginRequiresMfa(harness, account)).toBe(false);
+	});
+
+	it('proves sudo mode with the sudo fields and skips code when mfa_method is set', async () => {
+		const account = await createTestAccount(harness);
+		const secret = createTotpSecret();
+		await enableTotp(harness, account, secret);
+		await withTotpReplayProtection(async () => {
+			const code = totpCodeNow(secret);
+			await createBuilder(harness, account.token)
+				.post('/users/@me/mfa/totp/disable')
+				.body({code: wrongCodeFor(code), mfa_method: 'totp', mfa_code: code})
+				.expect(HTTP_STATUS.NO_CONTENT)
+				.execute();
+		});
+		expect(await loginRequiresMfa(harness, account)).toBe(false);
+	});
+
+	it('disables with an authenticator code alone', async () => {
+		const account = await createTestAccount(harness);
+		const secret = createTotpSecret();
+		await enableTotp(harness, account, secret);
+		await withTotpReplayProtection(async () => {
+			await createBuilder(harness, account.token)
+				.post('/users/@me/mfa/totp/disable')
+				.body({code: totpCodeNow(secret)})
+				.expect(HTTP_STATUS.NO_CONTENT)
+				.execute();
+		});
+		expect(await loginRequiresMfa(harness, account)).toBe(false);
+	});
+
+	it('disables with a backup code alone', async () => {
+		const account = await createTestAccount(harness);
+		const secret = createTotpSecret();
+		const backupCodes = await enableTotp(harness, account, secret);
+		await withTotpReplayProtection(async () => {
+			await createBuilder(harness, account.token)
+				.post('/users/@me/mfa/totp/disable')
+				.body({code: backupCodes[0]!})
+				.expect(HTTP_STATUS.NO_CONTENT)
+				.execute();
+		});
+		expect(await loginRequiresMfa(harness, account)).toBe(false);
+	});
+
+	it('rejects a wrong code without a sudo token and keeps TOTP enabled', async () => {
+		const account = await createTestAccount(harness);
+		const secret = createTotpSecret();
+		await enableTotp(harness, account, secret);
+		await withTotpReplayProtection(async () => {
+			const error = await createBuilder<ValidationErrorBody>(harness, account.token)
+				.post('/users/@me/mfa/totp/disable')
+				.body({code: wrongCodeFor(totpCodeNow(secret))})
+				.expect(HTTP_STATUS.BAD_REQUEST, 'INVALID_FORM_BODY')
+				.execute();
+			expect(error.errors).toEqual([
+				{path: 'mfa_code', code: ValidationErrorCodes.INVALID_MFA_CODE, message: expect.any(String)},
+			]);
+		});
+		expect(await loginRequiresMfa(harness, account)).toBe(true);
+	});
+
+	it('rejects an authenticator code already spent on another sudo proof', async () => {
+		const account = await createTestAccount(harness);
+		const secret = createTotpSecret();
+		await enableTotp(harness, account, secret);
+		await withTotpReplayProtection(async () => {
+			const code = totpCodeNow(secret);
+			await createBuilder(harness, account.token)
+				.post('/users/@me/mfa/backup-codes')
+				.body({regenerate: false, mfa_method: 'totp', mfa_code: code})
+				.expect(HTTP_STATUS.OK)
+				.execute();
+			const error = await createBuilder<ValidationErrorBody>(harness, account.token)
+				.post('/users/@me/mfa/totp/disable')
+				.body({code})
+				.expect(HTTP_STATUS.BAD_REQUEST, 'INVALID_FORM_BODY')
+				.execute();
+			expect(error.errors[0]?.path).toBe('mfa_code');
+			expect(error.errors[0]?.code).toBe(ValidationErrorCodes.INVALID_MFA_CODE);
+		});
+		expect(await loginRequiresMfa(harness, account)).toBe(true);
+	});
+
+	it('checks code when a sudo token proves sudo mode', async () => {
+		const account = await createTestAccount(harness);
+		const secret = createTotpSecret();
+		const backupCodes = await enableTotp(harness, account, secret);
+		await withTotpReplayProtection(async () => {
+			const code = totpCodeNow(secret);
+			const {response} = await createBuilder(harness, account.token)
+				.post('/users/@me/mfa/backup-codes')
+				.body({regenerate: false, mfa_method: 'totp', mfa_code: code})
+				.expect(HTTP_STATUS.OK)
+				.executeWithResponse();
+			const sudoToken = response.headers.get(SUDO_MODE_HEADER);
+			expect(sudoToken).toBeTruthy();
+			for (const rejected of [wrongCodeFor(code), code]) {
+				const error = await createBuilder<ValidationErrorBody>(harness, account.token)
+					.post('/users/@me/mfa/totp/disable')
+					.header(SUDO_MODE_HEADER, sudoToken!)
+					.body({code: rejected})
+					.expect(HTTP_STATUS.BAD_REQUEST, 'INVALID_FORM_BODY')
+					.execute();
+				expect(error.errors[0]?.path).toBe('code');
+				expect(error.errors[0]?.code).toBe(ValidationErrorCodes.INVALID_CODE);
+			}
+			await createBuilder(harness, account.token)
+				.post('/users/@me/mfa/totp/disable')
+				.header(SUDO_MODE_HEADER, sudoToken!)
+				.body({code: backupCodes[0]!})
+				.expect(HTTP_STATUS.NO_CONTENT)
+				.execute();
+		});
+		expect(await loginRequiresMfa(harness, account)).toBe(false);
+	});
+
+	it('still requires sudo mode when the account has no TOTP secret', async () => {
+		const account = await createTestAccount(harness);
+		const device = createWebAuthnDevice();
+		const registrationOptions = await createBuilder<WebAuthnRegistrationOptions>(harness, account.token)
+			.post('/users/@me/mfa/webauthn/credentials/registration-options')
+			.body({password: account.password})
+			.execute();
+		if (registrationOptions.rp.id) {
+			device.rpId = registrationOptions.rp.id;
+		}
+		await createBuilder(harness, account.token)
+			.post('/users/@me/mfa/webauthn/credentials')
+			.body({
+				response: createRegistrationResponse(device, registrationOptions, 'Passkey'),
+				challenge: registrationOptions.challenge,
+				name: 'Passkey',
+				password: account.password,
+			})
+			.expect(HTTP_STATUS.NO_CONTENT)
+			.execute();
+		await createBuilder(harness, account.token)
+			.post('/users/@me/mfa/totp/disable')
+			.body({code: '123456'})
+			.expect(HTTP_STATUS.FORBIDDEN, 'SUDO_MODE_REQUIRED')
+			.execute();
+	});
+});
@@ -3,6 +3,7 @@
 import crypto from 'node:crypto';
 import type {ApiContext} from '@app/api/ApiContext';
 import {isPasswordPwned, resetPwnedPasswordCacheForTesting} from '@app/api/auth/AuthPassword';
+import {getConfig} from '@app/api/Config';
 import {server} from '@app/api/test/msw/server';
 import {delay, HttpResponse, http} from 'msw';
 import {beforeEach, describe, expect, test} from 'vitest';
@@ -68,6 +69,19 @@ describe('isPasswordPwned', () => {
 		await expect(isPasswordPwned(ctx, SAFE_PASSWORD_SAME_PREFIX)).resolves.toBe(false);
 		expect(requestedPrefixes).toHaveLength(1);
 	});
+	test('makes no upstream call when the check is switched off', async () => {
+		const config = getConfig();
+		const originalEnabled = config.breachedPasswordCheck.enabled;
+		const requestedPrefixes: Array<string> = [];
+		server.use(rangeHandler(requestedPrefixes, [suffixOf(PWNED_PASSWORD)]));
+		try {
+			config.breachedPasswordCheck.enabled = false;
+			await expect(isPasswordPwned(ctx, PWNED_PASSWORD)).resolves.toBe(false);
+			expect(requestedPrefixes).toHaveLength(0);
+		} finally {
+			config.breachedPasswordCheck.enabled = originalEnabled;
+		}
+	});
 	test('fails open on a non-OK response', async () => {
 		server.use(http.get('https://api.pwnedpasswords.com/range/:prefix', () => HttpResponse.text('', {status: 503})));
 		await expect(isPasswordPwned(ctx, PWNED_PASSWORD)).resolves.toBe(false);
@@ -20,7 +20,7 @@ import type {
 import type {BlueskyOAuthConfig, BlueskyOAuthKeyConfig} from '@app/api/config/APIConfig';
 import {ConnectionCredentialRepository} from '@app/api/connection/ConnectionCredentialRepository';
 import {Agent} from '@atproto/api';
-import {JoseKey} from '@bluesky-social/jwk-jose';
+import {JoseKey} from '@atproto/jwk-jose';
 import {
 	FetchError,
 	NodeOAuthClient,
@@ -28,7 +28,7 @@ import {
 	type OAuthClientMetadataInput,
 	OAuthResponseError,
 	requestLocalLock,
-} from '@bluesky-social/oauth-client-node';
+} from '@atproto/oauth-client-node';
 import type {IKVProvider} from '@pkgs/kv_client/src/IKVProvider';

 interface BlueskyClientConfiguration {
@@ -14,7 +14,7 @@ import {
 	type NodeSavedSessionStore,
 	type NodeSavedState,
 	type NodeSavedStateStore,
-} from '@bluesky-social/oauth-client-node';
+} from '@atproto/oauth-client-node';
 import {SnowflakeType} from '@fluxer/schema/src/primitives/SchemaPrimitives';
 import type {IKVProvider} from '@pkgs/kv_client/src/IKVProvider';
 import {z} from 'zod';
@@ -107,7 +107,7 @@ export class MessageInteractionRepository extends IMessageInteractionRepository

 	async removeChannelPin(channelId: ChannelID, messageId: MessageID): Promise<void> {
 		const message = await this.messageRepository.getMessage(channelId, messageId);
-		if (!message || !message.pinnedTimestamp) {
+		if (!message?.pinnedTimestamp) {
 			return;
 		}
 		await deleteOneOrMany(
@@ -617,7 +617,7 @@ export class ChannelOperationsService {
 		auditLogReason: string | null;
 	}): Promise<void> {
 		const channel = await this.channelRepository.channelData.findUnique(params.channelId);
-		if (!channel || !channel.guildId) throw new UnknownChannelError();
+		if (!channel?.guildId) throw new UnknownChannelError();
 		const canManageRoles = await this.gatewayService.checkPermission({
 			guildId: channel.guildId,
 			userId: params.userId,
@@ -690,7 +690,7 @@ export class ChannelOperationsService {
 		auditLogReason: string | null;
 	}): Promise<void> {
 		const channel = await this.channelRepository.channelData.findUnique(params.channelId);
-		if (!channel || !channel.guildId) throw new UnknownChannelError();
+		if (!channel?.guildId) throw new UnknownChannelError();
 		const canManageRoles = await this.gatewayService.checkPermission({
 			guildId: channel.guildId,
 			userId: params.userId,
@@ -65,6 +65,7 @@ interface ProcessedAttachment {
 	hasVirusDetected: boolean;
 	applyFinalObjectMetadata: boolean;
 	sourceLocalPath: string | null;
+	sniffedContentType: string | null;
 }

 export class AttachmentProcessingService {
@@ -213,7 +214,31 @@ export class AttachmentProcessingService {
 		let applyFinalObjectMetadata = false;
 		const clientDuration: number | null = attachment.duration ?? null;
 		const waveform: string | null = attachment.waveform ?? null;
-		const isMedia = isMediaFile(contentType);
+		const sniffedContentType = isMediaFile(contentType)
+			? null
+			: await this.sniffAttachmentMediaType({
+					index,
+					uploadFilename: attachment.upload_filename,
+					filename: attachment.filename,
+				});
+		if (sniffedContentType !== null) {
+			Logger.warn(
+				{
+					surface: 'message_attachment',
+					userId: params.uploadUserId.toString(),
+					guildId: params.guild?.id ?? null,
+					channelId: message.channelId.toString(),
+					messageId: message.id.toString(),
+					attachmentId: attachmentId.toString(),
+					uploadKey: attachment.upload_filename,
+					filename: attachment.filename,
+					filenameContentType: contentType,
+					sniffedContentType,
+				},
+				'content_moderation.attachment_type_mismatch',
+			);
+		}
+		const isMedia = isMediaFile(contentType) || sniffedContentType !== null;
 		let metadata: MediaProxyMetadataResponse | null = null;
 		if (isMedia) {
 			metadata = await this.getAttachmentMediaMetadata({
@@ -303,6 +328,7 @@ export class AttachmentProcessingService {
 					hasVirusDetected,
 					applyFinalObjectMetadata,
 					sourceLocalPath: null,
+					sniffedContentType,
 				};
 			}
 			const isAudio = contentType.startsWith('audio/');
@@ -341,6 +367,7 @@ export class AttachmentProcessingService {
 				hasVirusDetected,
 				applyFinalObjectMetadata,
 				sourceLocalPath: retainedLocalPath,
+				sniffedContentType,
 			};
 		} catch (error) {
 			if (sourceLocalPath) {
@@ -350,6 +377,27 @@ export class AttachmentProcessingService {
 		}
 	}

+	private async sniffAttachmentMediaType(params: {
+		index: number;
+		uploadFilename: string;
+		filename: string;
+	}): Promise<string | null> {
+		const sniff = await this.mediaService.sniffUpload(params.uploadFilename);
+		if (sniff) {
+			return sniff.content_type;
+		}
+		Logger.warn(
+			{
+				context: METADATA_PROBE_DEGRADED_CONTEXT,
+				attachmentIndex: params.index,
+				uploadFilename: params.uploadFilename,
+				filename: params.filename,
+			},
+			'Attachment content sniff unavailable, storing attachment with its filename type',
+		);
+		return null;
+	}
+
 	private async getAttachmentMediaMetadata(params: {
 		index: number;
 		uploadFilename: string;
@@ -115,7 +115,7 @@ export class MessageDeleteService {
 	}): Promise<void> {
 		const channelId = webhook.channelId!;
 		const channel = await this.deps.channelRepository.channelData.findUnique(channelId);
-		if (!channel || !channel.guildId) {
+		if (!channel?.guildId) {
 			throw new CannotExecuteOnDmError();
 		}
 		const message = await this.deps.channelRepository.messages.getMessage(channelId, messageId);
@@ -312,7 +312,7 @@ function collectEmbedReferencedAttachmentCdnKeys(message: Message, ownKeys: Read
 	const mediaPrefix = `${Config.endpoints.media}/`;
 	const keys = new Set<string>();
 	const consider = (url: string | null | undefined): void => {
-		if (!url || !url.startsWith(mediaPrefix)) {
+		if (!url?.startsWith(mediaPrefix)) {
 			return;
 		}
 		const key = url.slice(mediaPrefix.length);
@@ -94,7 +94,7 @@ export class MessageMentionService {
 			referencedMessage?.authorId &&
 			referencedMessage.authorId !== message.authorId &&
 			!isDMChannel &&
-			(!allowedMentions || allowedMentions.replied_user !== false);
+			allowedMentions?.replied_user !== false;
 		if (shouldAddReferencedUser) {
 			userMentions.add(referencedMessage!.authorId!);
 		}
@@ -569,7 +569,7 @@ export class MessagePersistenceService {
 		}
 		const updatedSnapshots = message.messageSnapshots.map((snapshot, index) => {
 			const edit = snapshotEdits[index];
-			if (!edit || !edit.attachments || edit.attachments.length === 0) {
+			if (!edit?.attachments || edit.attachments.length === 0) {
 				return snapshot.toMessageSnapshot();
 			}
 			const snapshotRow = snapshot.toMessageSnapshot();
@@ -80,7 +80,7 @@ export class MessageProcessingService {
 		requestCache: RequestCache;
 	}): Promise<void> {
 		if (channel.guildId || channel.type !== ChannelTypes.DM) return;
-		if (!channel.recipientIds || channel.recipientIds.size !== 2) return;
+		if (channel.recipientIds?.size !== 2) return;
 		const recipientIds = Array.from(channel.recipientIds);
 		const openStates = await this.batchCheckDmChannelOpen(recipientIds, channelId);
 		const closedRecipients = openStates.filter((state) => !state.isOpen);
@@ -7,8 +7,8 @@ import {
 } from '@app/api/channel/services/message/MessageResponseDataService';
 import {Message} from '@app/api/models/Message';
 import {MessageTypes} from '@fluxer/constants/src/ChannelConstants';
+import type {NatsConnection} from '@nats-io/transport-node';
 import type {INatsConnectionManager} from '@pkgs/nats/src/INatsConnectionManager';
-import type {NatsConnection} from 'nats';
 import {describe, expect, it} from 'vitest';

 const encoder = new TextEncoder();
@@ -11,7 +11,9 @@ import {isJsonRecord, parseJsonRecord, parseJsonWithGuard} from '@app/api/utils/
 import type {MessageResponse} from '@fluxer/schema/src/domains/message/MessageResponseSchemas';
 import type {INatsConnectionManager} from '@pkgs/nats/src/INatsConnectionManager';
 import {NatsConnectionManager} from '@pkgs/nats/src/NatsConnectionManager';
-import {StringCodec} from 'nats';
+
+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder();

 const MESSAGE_RESPONSE_SERVICE_SUBJECT = 'svc.messages';
 const MESSAGE_RESPONSE_SERVICE_TIMEOUT_MS = 6000;
@@ -79,8 +81,6 @@ function isMessageServiceResponse(value: unknown): value is MessageServiceRespon
 }

 export class MessageResponseDataService {
-	private readonly codec = StringCodec();
-
 	constructor(private readonly connectionManager: INatsConnectionManager) {}

 	async listMessages(params: {
@@ -107,6 +107,7 @@ export class MessageResponseDataService {
 			can_read_message_history: params.access.canReadMessageHistory,
 			media_endpoint: Config.endpoints.media,
 			media_proxy_secret_key: Config.mediaProxy.secretKey,
+			attachment_url_secret_base64: Config.mediaProxy.attachmentUrls.secretsBase64[0],
 			include_reactions: true,
 		});
 		if (typeof response === 'object' && 'FoundApiMany' in response) {
@@ -147,6 +148,7 @@ export class MessageResponseDataService {
 			can_read_message_history: params.access.canReadMessageHistory,
 			media_endpoint: Config.endpoints.media,
 			media_proxy_secret_key: Config.mediaProxy.secretKey,
+			attachment_url_secret_base64: Config.mediaProxy.attachmentUrls.secretsBase64[0],
 			include_reactions: true,
 			nonce: params.nonce,
 			tts: params.tts,
@@ -177,6 +179,7 @@ export class MessageResponseDataService {
 			can_read_message_history: params.access.canReadMessageHistory,
 			media_endpoint: Config.endpoints.media,
 			media_proxy_secret_key: Config.mediaProxy.secretKey,
+			attachment_url_secret_base64: Config.mediaProxy.attachmentUrls.secretsBase64[0],
 			include_reactions: params.includeReactions ?? true,
 			nonce: params.nonce,
 			tts: params.tts,
@@ -244,6 +247,7 @@ export class MessageResponseDataService {
 				can_read_message_history: params.access.canReadMessageHistory,
 				media_endpoint: Config.endpoints.media,
 				media_proxy_secret_key: Config.mediaProxy.secretKey,
+				attachment_url_secret_base64: Config.mediaProxy.attachmentUrls.secretsBase64[0],
 				include_reactions: params.includeReactions ?? true,
 			});
 			if (typeof response !== 'object' || !('FoundApiMany' in response)) {
@@ -307,10 +311,10 @@ export class MessageResponseDataService {
 			const connection = this.connectionManager.getConnection();
 			const response = await connection.request(
 				MESSAGE_RESPONSE_SERVICE_SUBJECT,
-				this.codec.encode(JSON.stringify(payload)),
+				textEncoder.encode(JSON.stringify(payload)),
 				{timeout: MESSAGE_RESPONSE_SERVICE_TIMEOUT_MS},
 			);
-			const decoded = this.codec.decode(response.data);
+			const decoded = textDecoder.decode(response.data);
 			const parsed = parseJsonWithGuard(decoded, isMessageServiceResponse);
 			if (!parsed) {
 				throwForSvcErrorReply('message-response-service', parseJsonRecord(decoded));
@@ -1059,7 +1059,7 @@ export class MessageSendService {
 	}): Promise<Message> {
 		const channelId = webhook.channelId!;
 		const channel = await this.deps.channelRepository.channelData.findUnique(channelId);
-		if (!channel || !channel.guildId) {
+		if (!channel?.guildId) {
 			throw new CannotExecuteOnDmError();
 		}
 		const guild = await this.deps.gatewayService.getGuildData({
@@ -1245,7 +1245,7 @@ export class MessageSendService {
 	}): Promise<Message> {
 		const channelId = webhook.channelId!;
 		const channel = await this.deps.channelRepository.channelData.findUnique(channelId);
-		if (!channel || !channel.guildId) {
+		if (!channel?.guildId) {
 			throw new CannotExecuteOnDmError();
 		}
 		const existingMessage = await this.deps.channelRepository.messages.getMessage(channelId, messageId);
@@ -1,76 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import {createTestAccount} from '@app/api/auth/tests/AuthTestUtils';
-import {
-	createChannel,
-	createGuild,
-	deleteChannel,
-	getChannel,
-	updateChannel,
-} from '@app/api/channel/tests/ChannelTestUtils';
-import {type ApiTestHarness, createApiTestHarness} from '@app/api/test/ApiTestHarness';
-import {HTTP_STATUS} from '@app/api/test/TestConstants';
-import {createBuilder} from '@app/api/test/TestRequestBuilder';
-import {beforeAll, beforeEach, describe, expect, it} from 'vitest';
-
-describe('Channel Operation Validation', () => {
-	let harness: ApiTestHarness;
-	beforeAll(async () => {
-		harness = await createApiTestHarness();
-	});
-	beforeEach(async () => {
-		await harness.reset();
-	});
-	it('should reject getting nonexistent channel', async () => {
-		const account = await createTestAccount(harness);
-		await createBuilder(harness, account.token)
-			.get('/channels/999999999999999999')
-			.expect(HTTP_STATUS.NOT_FOUND)
-			.execute();
-	});
-	it('should reject updating nonexistent channel', async () => {
-		const account = await createTestAccount(harness);
-		await createBuilder(harness, account.token)
-			.patch('/channels/999999999999999999')
-			.body({name: 'new-name'})
-			.expect(HTTP_STATUS.NOT_FOUND)
-			.execute();
-	});
-	it('should reject deleting nonexistent channel', async () => {
-		const account = await createTestAccount(harness);
-		await createBuilder(harness, account.token)
-			.delete('/channels/999999999999999999')
-			.expect(HTTP_STATUS.NOT_FOUND)
-			.execute();
-	});
-	it('should get channel successfully', async () => {
-		const account = await createTestAccount(harness);
-		const guild = await createGuild(harness, account.token, 'Channel Operation Guild');
-		const channel = await getChannel(harness, account.token, guild.system_channel_id!);
-		expect(channel.id).toBe(guild.system_channel_id);
-	});
-	it('should update channel name successfully', async () => {
-		const account = await createTestAccount(harness);
-		const guild = await createGuild(harness, account.token, 'Channel Operation Guild');
-		const channelId = guild.system_channel_id!;
-		const updated = await updateChannel(harness, account.token, channelId, {name: 'updated-name'});
-		expect(updated.name).toBe('updated-name');
-	});
-	it('should update channel topic successfully', async () => {
-		const account = await createTestAccount(harness);
-		const guild = await createGuild(harness, account.token, 'Channel Operation Guild');
-		const channelId = guild.system_channel_id!;
-		const updated = await updateChannel(harness, account.token, channelId, {topic: 'New topic'});
-		expect(updated.topic).toBe('New topic');
-	});
-	it('should delete channel successfully', async () => {
-		const account = await createTestAccount(harness);
-		const guild = await createGuild(harness, account.token, 'Channel Operation Guild');
-		const newChannel = await createChannel(harness, account.token, guild.id, 'to-delete');
-		await deleteChannel(harness, account.token, newChannel.id);
-		await createBuilder(harness, account.token)
-			.get(`/channels/${newChannel.id}`)
-			.expect(HTTP_STATUS.NOT_FOUND)
-			.execute();
-	});
-});
@@ -1,43 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import {createTestAccount} from '@app/api/auth/tests/AuthTestUtils';
-import {createDmChannel, createFriendship, deleteChannel} from '@app/api/channel/tests/ChannelTestUtils';
-import {type ApiTestHarness, createApiTestHarness} from '@app/api/test/ApiTestHarness';
-import {HTTP_STATUS} from '@app/api/test/TestConstants';
-import {createBuilder} from '@app/api/test/TestRequestBuilder';
-import {afterAll, beforeAll, beforeEach, describe, expect, it} from 'vitest';
-
-describe('DM channel management', () => {
-	let harness: ApiTestHarness;
-	beforeAll(async () => {
-		harness = await createApiTestHarness();
-	});
-	beforeEach(async () => {
-		await harness.reset();
-	});
-	afterAll(async () => {
-		await harness?.shutdown();
-	});
-	it('can create DM channel', async () => {
-		const user1 = await createTestAccount(harness);
-		const user2 = await createTestAccount(harness);
-		await createFriendship(harness, user1, user2);
-		const dm = await createDmChannel(harness, user1.token, user2.userId);
-		expect(dm.id).toBeTruthy();
-		expect(dm.id.length).toBeGreaterThan(0);
-	});
-	it('can get DM channel', async () => {
-		const user1 = await createTestAccount(harness);
-		const user2 = await createTestAccount(harness);
-		await createFriendship(harness, user1, user2);
-		const dm = await createDmChannel(harness, user1.token, user2.userId);
-		await createBuilder(harness, user1.token).get(`/channels/${dm.id}`).expect(HTTP_STATUS.OK).execute();
-	});
-	it('can close DM channel', async () => {
-		const user1 = await createTestAccount(harness);
-		const user2 = await createTestAccount(harness);
-		await createFriendship(harness, user1, user2);
-		const dm = await createDmChannel(harness, user1.token, user2.userId);
-		await deleteChannel(harness, user1.token, dm.id);
-	});
-});
@@ -1,27 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import {createTestAccount} from '@app/api/auth/tests/AuthTestUtils';
-import {createDmChannel, createFriendship} from '@app/api/channel/tests/ChannelTestUtils';
-import {type ApiTestHarness, createApiTestHarness} from '@app/api/test/ApiTestHarness';
-import {afterAll, beforeAll, beforeEach, describe, expect, it} from 'vitest';
-
-describe('DM creation allowed with friendship', () => {
-	let harness: ApiTestHarness;
-	beforeAll(async () => {
-		harness = await createApiTestHarness();
-	});
-	beforeEach(async () => {
-		await harness.reset();
-	});
-	afterAll(async () => {
-		await harness?.shutdown();
-	});
-	it('allows friends to create DMs with each other', async () => {
-		const user1 = await createTestAccount(harness);
-		const user2 = await createTestAccount(harness);
-		await createFriendship(harness, user1, user2);
-		const dm = await createDmChannel(harness, user1.token, user2.userId);
-		expect(dm.id).toBeTruthy();
-		expect(dm.id.length).toBeGreaterThan(0);
-	});
-});
@@ -1,43 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import {createTestAccount} from '@app/api/auth/tests/AuthTestUtils';
-import {
-	createFriendship,
-	createGroupDmChannel,
-	type GroupDmChannelResponse,
-} from '@app/api/channel/tests/ChannelTestUtils';
-import {ensureSessionStarted} from '@app/api/message/tests/MessageTestUtils';
-import {type ApiTestHarness, createApiTestHarness} from '@app/api/test/ApiTestHarness';
-import {HTTP_STATUS} from '@app/api/test/TestConstants';
-import {createBuilder} from '@app/api/test/TestRequestBuilder';
-import {afterAll, beforeAll, beforeEach, describe, expect, it} from 'vitest';
-
-describe('Group DM name update', () => {
-	let harness: ApiTestHarness;
-	beforeAll(async () => {
-		harness = await createApiTestHarness();
-	});
-	beforeEach(async () => {
-		await harness.reset();
-	});
-	afterAll(async () => {
-		await harness?.shutdown();
-	});
-	it('updates group DM name correctly', async () => {
-		const user1 = await createTestAccount(harness);
-		const user2 = await createTestAccount(harness);
-		const user3 = await createTestAccount(harness);
-		await ensureSessionStarted(harness, user1.token);
-		await ensureSessionStarted(harness, user2.token);
-		await ensureSessionStarted(harness, user3.token);
-		await createFriendship(harness, user1, user2);
-		await createFriendship(harness, user1, user3);
-		const groupDm = await createGroupDmChannel(harness, user1.token, [user2.userId, user3.userId]);
-		const updated = await createBuilder<GroupDmChannelResponse>(harness, user1.token)
-			.patch(`/channels/${groupDm.id}`)
-			.body({name: 'Cool Group Chat'})
-			.expect(HTTP_STATUS.OK)
-			.execute();
-		expect(updated.name).toBe('Cool Group Chat');
-	});
-});
@@ -1,45 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-import {createTestAccount} from '@app/api/auth/tests/AuthTestUtils';
-import {createFriendship, seedPrivateChannels} from '@app/api/channel/tests/ChannelTestUtils';
-import {type ApiTestHarness, createApiTestHarness} from '@app/api/test/ApiTestHarness';
-import {HTTP_STATUS} from '@app/api/test/TestConstants';
-import {createBuilder} from '@app/api/test/TestRequestBuilder';
-import {afterAll, beforeAll, beforeEach, describe, expect, it} from 'vitest';
-
-const MAX_GROUP_DM_LIMIT = 150;
-const MAX_GROUP_DM_ERROR_CODE = 'MAX_GROUP_DMS';
-
-describe('Group DM Recipient Limit', () => {
-	let harness: ApiTestHarness;
-	beforeAll(async () => {
-		harness = await createApiTestHarness();
-	});
-	beforeEach(async () => {
-		await harness.reset();
-	});
-	afterAll(async () => {
-		await harness?.shutdown();
-	});
-	it('rejects creating group DM when user has reached limit', async () => {
-		const creator = await createTestAccount(harness);
-		const target = await createTestAccount(harness);
-		const recipient = await createTestAccount(harness);
-		const helper = await createTestAccount(harness);
-		await createFriendship(harness, creator, target);
-		await createFriendship(harness, creator, recipient);
-		const seedResult = await seedPrivateChannels(harness, target.token, target.userId, {
-			group_dm_count: MAX_GROUP_DM_LIMIT,
-			recipients: [helper.userId, recipient.userId],
-			clear_existing: true,
-		});
-		expect(seedResult.group_dms).toHaveLength(MAX_GROUP_DM_LIMIT);
-		await createBuilder(harness, creator.token)
-			.post('/users/@me/channels')
-			.body({
-				recipients: [helper.userId, target.userId],
-			})
-			.expect(HTTP_STATUS.BAD_REQUEST, MAX_GROUP_DM_ERROR_CODE)
-			.execute();
-	});
-});
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
HampusandGitHub	f32356801d	feat(api): make tor and breached password lookups opt-in (#2834 )	2026-09-19 01:22:17 +02:00
HampusandGitHub	efd677f32b	feat(api): exempt configured ASNs from abusive IP auto-bans (#2833 )	2026-09-18 23:01:58 +02:00
HampusandGitHub	3cec27ba57	fix(static): vendor the deepfilternet 1.3.0 assets (#2832 )	2026-09-18 18:47:42 +02:00
HampusandGitHub	1f810ba04d	fix(api): drop the upload segment signal and dead exports (#2831 )	2026-09-18 17:35:58 +02:00
HampusandGitHub	522cf08e61	feat(media-proxy): sign attachment URLs and gate origins (#2830 )	2026-09-18 15:57:32 +02:00
HampusandGitHub	025c01ab13	fix(api): chunk guild permission batch RPC over 100 guilds (#2829 )	2026-09-18 12:54:03 +02:00
HampusandGitHub	dc41b53d60	fix(desktop): drop redundant casts flagged by clippy 1.98 (#2826 )	2026-09-17 21:28:48 +02:00
HampusandGitHub	3b552e00ef	chore(deps): upgrade all dependencies, toolchains and images (#2825 )	2026-09-17 21:08:56 +02:00
HampusandGitHub	56e04e7b53	test(backend): remove duplicate and useless tests (#2820 )	2026-09-17 15:32:25 +02:00
HampusandGitHub	deac653a9e	test(app): remove useless frontend tests (#2819 )	2026-09-17 15:05:36 +02:00
HampusandGitHub	ed9528834d	fix(gateway): stop dead sessions leaving voice states behind (#2818 )	2026-09-17 14:55:18 +02:00
HampusandGitHub	4cecbf1f43	fix(auth): disable TOTP with one code instead of two (#2816 )	2026-09-17 04:21:50 +02:00
HampusandGitHub	b019f4a91f	fix(gateway): act on voice states in the voice server (#2815 )	2026-09-17 03:59:36 +02:00