refactor(api): extract common helpers module, extend API error types with auth methods

json_to_ipld handled $link (→ Ipld::Link) but treated $bytes objects
as regular maps, producing a CBOR map (major type 5) instead of a byte
string (major type 2). This caused downstream consumers expecting
spec-compliant CBOR — notably Jetstream's atdata.UnmarshalCBOR — to
fail with "decoding $byte value: illegal base64 data".

Decode $bytes from standard base64 (RFC 4648 §4, padding optional)
into Ipld::Bytes, matching the existing $link handling pattern.

.cargo/config.toml

@@ -1,2 +0,0 @@
-[target.x86_64-unknown-linux-gnu]
-rustflags = ["-C", "link-arg=-fuse-ld=mold"]

.config/nextest.toml

@@ -21,6 +21,10 @@ heavy-load-tests = { max-threads = 4 }
 filter = "test(/import_with_verification/) | test(/plc_migration/)"
 test-group = "serial-env-tests"
 
+[[profile.default.overrides]]
+filter = "binary(handle_domains)"
+test-group = "serial-env-tests"
+
 [[profile.default.overrides]]
 filter = "binary(ripple_cluster)"
 test-group = "serial-env-tests"
@@ -29,10 +33,22 @@ test-group = "serial-env-tests"
 filter = "binary(whole_story)"
 test-group = "heavy-load-tests"
 
+[[profile.default.overrides]]
+filter = "test(/two_node_stress_concurrent_load/)"
+test-group = "heavy-load-tests"
+
+[[profile.default.overrides]]
+filter = "binary(repo_lifecycle)"
+test-group = "heavy-load-tests"
+
 [[profile.ci.overrides]]
 filter = "test(/import_with_verification/) | test(/plc_migration/)"
 test-group = "serial-env-tests"
 
+[[profile.ci.overrides]]
+filter = "binary(handle_domains)"
+test-group = "serial-env-tests"
+
 [[profile.ci.overrides]]
 filter = "binary(ripple_cluster)"
 test-group = "serial-env-tests"
@@ -40,3 +56,11 @@ test-group = "serial-env-tests"
 [[profile.ci.overrides]]
 filter = "binary(whole_story)"
 test-group = "heavy-load-tests"
+
+[[profile.ci.overrides]]
+filter = "test(/two_node_stress_concurrent_load/)"
+test-group = "heavy-load-tests"
+
+[[profile.ci.overrides]]
+filter = "binary(repo_lifecycle)"
+test-group = "heavy-load-tests"

.env.example

@@ -1,227 +0,0 @@
-# =============================================================================
-# Server
-# =============================================================================
-SERVER_HOST=127.0.0.1
-SERVER_PORT=3000
-# The public-facing hostname of the PDS (used in DID documents, JWTs, etc.)
-PDS_HOSTNAME=localhost:3000
-# =============================================================================
-# Database
-# =============================================================================
-DATABASE_URL=postgres://postgres:postgres@localhost:5432/pds
-# Connection pool settings (defaults are good for most deployments)
-# DATABASE_MAX_CONNECTIONS=100
-# DATABASE_MIN_CONNECTIONS=10
-# DATABASE_ACQUIRE_TIMEOUT_SECS=30
-# =============================================================================
-# Blob Storage
-# =============================================================================
-# Backend: "filesystem" (default) or "s3"
-# BLOB_STORAGE_BACKEND=filesystem
-# For filesystem backend:
-BLOB_STORAGE_PATH=/var/lib/tranquil/blobs
-# For S3 backend:
-# S3_ENDPOINT=http://localhost:9000
-# AWS_REGION=us-east-1
-# S3_BUCKET=pds-blobs
-# AWS_ACCESS_KEY_ID=minioadmin
-# AWS_SECRET_ACCESS_KEY=minioadmin
-# =============================================================================
-# Backups
-# =============================================================================
-# Enable/disable automatic repo backups
-# BACKUP_ENABLED=true
-# Backend: "filesystem" (default) or "s3"
-# BACKUP_STORAGE_BACKEND=filesystem
-# For filesystem backend:
-BACKUP_STORAGE_PATH=/var/lib/tranquil/backups
-# For S3 backend:
-# BACKUP_S3_BUCKET=pds-backups
-# Backup schedule and retention
-# BACKUP_RETENTION_COUNT=7
-# BACKUP_INTERVAL_SECS=86400
-# =============================================================================
-# Cache & Rate Limiting
-# =============================================================================
-# Ripple (in-process CRDT cache) is the default. No config needed for single-node.
-# Set VALKEY_URL to use valkey instead (disables ripple).
-# VALKEY_URL=redis://localhost:6379
-#
-# Ripple multi-node settings (only needed when clustering):
-# RIPPLE_BIND=0.0.0.0:7890
-# RIPPLE_PEERS=10.0.0.2:7890,10.0.0.3:7890
-# RIPPLE_MACHINE_ID=1
-# RIPPLE_GOSSIP_INTERVAL_MS=200
-# RIPPLE_CACHE_MAX_MB=256
-# =============================================================================
-# Security Secrets
-# =============================================================================
-# These MUST be set in production (minimum 32 characters each)
-# In development, set TRANQUIL_PDS_ALLOW_INSECURE_SECRETS=1 to use defaults
-# Server-wide secret for OAuth token signing (HS256)
-# JWT_SECRET=your-secure-random-string-at-least-32-chars
-# Secret for DPoP proof validation
-# DPOP_SECRET=your-secure-random-string-at-least-32-chars
-# Key for encrypting user signing keys at rest (AES-256-GCM)
-# MASTER_KEY=your-secure-random-string-at-least-32-chars
-# Set this ONLY in development to allow default/weak secrets
-# TRANQUIL_PDS_ALLOW_INSECURE_SECRETS=1
-# =============================================================================
-# PLC Directory
-# =============================================================================
-# PLC_DIRECTORY_URL=https://plc.directory
-# PLC_TIMEOUT_SECS=10
-# PLC_CONNECT_TIMEOUT_SECS=5
-# Optional: rotation key for PLC operations (defaults to user's key)
-# PLC_ROTATION_KEY=did:key:...
-# =============================================================================
-# DID Resolution
-# =============================================================================
-# Cache TTL for resolved DID documents (default: 300 seconds)
-# DID_CACHE_TTL_SECS=300
-# =============================================================================
-# Relays
-# =============================================================================
-# Comma-separated list of relay URLs to notify via requestCrawl
-# CRAWLERS=https://bsky.network,https://relay.upcloud.world
-# =============================================================================
-# Firehose (subscribeRepos WebSocket)
-# =============================================================================
-# Buffer size for firehose broadcast channel
-# FIREHOSE_BUFFER_SIZE=10000
-# Disconnect slow consumers after this many events of lag
-# FIREHOSE_MAX_LAG=5000
-# =============================================================================
-# Notification Service
-# =============================================================================
-# Queue processing settings
-# NOTIFICATION_BATCH_SIZE=100
-# NOTIFICATION_POLL_INTERVAL_MS=1000
-# Email notifications (via sendmail/msmtp)
-# MAIL_FROM_ADDRESS=noreply@example.com
-# MAIL_FROM_NAME=My PDS
-# SENDMAIL_PATH=/usr/sbin/sendmail
-# Discord notifications (via bot DM)
-# DISCORD_BOT_TOKEN=bot-token
-# Telegram notifications (via bot)
-# TELEGRAM_BOT_TOKEN=bot-token
-# TELEGRAM_WEBHOOK_SECRET=random-secret
-# Signal notifications (via signal-cli)
-# SIGNAL_CLI_PATH=/usr/local/bin/signal-cli
-# SIGNAL_SENDER_NUMBER=+1234567890
-# =============================================================================
-# Upload Limits
-# =============================================================================
-# Maximum blob/body size in bytes (default: 10GB)
-# This controls both the Axum body limit and blob upload limits.
-# Make sure your nginx client_max_body_size matches or exceeds this value.
-# MAX_BLOB_SIZE=10737418240
-# =============================================================================
-# Repository Import
-# =============================================================================
-# Set to "true" to accept repository imports
-# ACCEPTING_REPO_IMPORTS=false
-# Maximum import size in bytes (default: 100MB)
-# MAX_IMPORT_SIZE=104857600
-# Maximum blocks per import (default: 100000)
-# MAX_IMPORT_BLOCKS=100000
-# Skip verification during import (testing only)
-# SKIP_IMPORT_VERIFICATION=false
-# =============================================================================
-# Account Registration
-# =============================================================================
-# Require invite codes for registration
-# INVITE_CODE_REQUIRED=false
-# Comma-separated list of available user domains
-# AVAILABLE_USER_DOMAINS=example.com
-# Enable self-hosted did:web identities (default: true)
-# Hosting did:web requires a long-term commitment to serve DID documents.
-# Set to false if you don't want to offer this option.
-# ENABLE_SELF_HOSTED_DID_WEB=true
-# =============================================================================
-# Server Metadata (returned by describeServer)
-# =============================================================================
-# Privacy policy URL (optional)
-# PRIVACY_POLICY_URL=https://example.com/privacy
-# Terms of service URL (optional)
-# TERMS_OF_SERVICE_URL=https://example.com/terms
-# Contact email address (optional)
-# CONTACT_EMAIL=admin@example.com
-# =============================================================================
-# Rate Limiting
-# =============================================================================
-# Disable all rate limiting (testing only, NEVER in production)
-# DISABLE_RATE_LIMITING=1
-# =============================================================================
-# Account Deletion
-# =============================================================================
-# How often to check for scheduled account deletions (default: 3600 = 1 hour)
-# SCHEDULED_DELETE_CHECK_INTERVAL_SECS=3600
-# =============================================================================
-# Moderation / Report Service
-# =============================================================================
-# If configured, moderation reports will be proxied to this service
-# instead of being stored locally. The service should implement the
-# com.atproto.moderation.createReport endpoint (eg., Bluesky's Ozone).
-# Both URL and DID must be set for proxying to be enabled.
-# REPORT_SERVICE_URL=https://mod.bsky.app
-# REPORT_SERVICE_DID=did:plc:ar7c4by46qjdydhdevvrndac
-# =============================================================================
-# Age Assurance Override
-# =============================================================================
-# Enable this if you have separately assured the ages of your users
-# (eg., through your own age verification process). When enabled, the PDS
-# will return "assured" status for age assurance checks instead of proxying
-# to the appview. This helps migrated users avoid the age assurance
-# catch-22 on bsky.app.
-# PDS_AGE_ASSURANCE_OVERRIDE=1
-# =============================================================================
-# Miscellaneous
-# =============================================================================
-# Allow HTTP for proxy requests (development only)
-# ALLOW_HTTP_PROXY=1
-# =============================================================================
-# SSO / Social Login
-# =============================================================================
-# Each provider requires ENABLED=true plus CLIENT_ID and CLIENT_SECRET.
-# Register your PDS as an OAuth application with each provider to get credentials.
-
-# GitHub
-# SSO_GITHUB_ENABLED=true
-# SSO_GITHUB_CLIENT_ID=
-# SSO_GITHUB_CLIENT_SECRET=
-
-# Discord
-# SSO_DISCORD_ENABLED=true
-# SSO_DISCORD_CLIENT_ID=
-# SSO_DISCORD_CLIENT_SECRET=
-
-# Google
-# SSO_GOOGLE_ENABLED=true
-# SSO_GOOGLE_CLIENT_ID=
-# SSO_GOOGLE_CLIENT_SECRET=
-
-# GitLab (set ISSUER for self-hosted instances)
-# SSO_GITLAB_ENABLED=false
-# SSO_GITLAB_CLIENT_ID=
-# SSO_GITLAB_CLIENT_SECRET=
-# SSO_GITLAB_ISSUER=https://gitlab.com
-
-# Generic OIDC
-# SSO_OIDC_ENABLED=false
-# SSO_OIDC_CLIENT_ID=
-# SSO_OIDC_CLIENT_SECRET=
-# SSO_OIDC_ISSUER=https://your-identity-provider.com
-# SSO_OIDC_NAME=Custom Provider
-
-# Apple Sign-in
-# SSO_APPLE_ENABLED=true
-# SSO_APPLE_CLIENT_ID=com.example.signin    # Services ID from Apple Developer Portal
-# SSO_APPLE_TEAM_ID=XXXXXXXXXX              # 10-character Team ID
-# SSO_APPLE_KEY_ID=XXXXXXXXXX               # Key ID from portal
-# SSO_APPLE_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
-CARGO_MOMMYS_LITTLE=mister
-CARGO_MOMMYS_PRONOUNS=his
-CARGO_MOMMYS_ROLES=daddy
-CARGO_MOMMYS_EMOTES="🚛/🧱/🚜/🔩/🦺"
-CARGO_MOMMYS_MOODS=ominous

.sqlx/query-017b04caf42b30f2c8f9468acf61a83244b7c2fa5cacfaee41a946a6af5ef68e.json

@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT id, backup_enabled FROM users WHERE did = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "backup_enabled",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "017b04caf42b30f2c8f9468acf61a83244b7c2fa5cacfaee41a946a6af5ef68e"
-}

.sqlx/query-05fd99170e31e68fa5028c862417cdf535cd70e09fde0a8a28249df0070eb2fc.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT t.token FROM plc_operation_tokens t JOIN users u ON t.user_id = u.id WHERE u.did = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "token",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "05fd99170e31e68fa5028c862417cdf535cd70e09fde0a8a28249df0070eb2fc"
-}

.sqlx/query-0710b57fb9aa933525f617b15e6e2e5feaa9c59c38ec9175568abdacda167107.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE users SET deactivated_at = $1 WHERE did = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Timestamptz",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "0710b57fb9aa933525f617b15e6e2e5feaa9c59c38ec9175568abdacda167107"
-}

.sqlx/query-07c54d6bcfdc08d821e788c31dc46cc240dc8507c7dd5bdd2ceeb36d2084e8ce.json

@@ -1,53 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT u.id, u.did, u.backup_enabled, u.deactivated_at, r.repo_root_cid, r.repo_rev\n            FROM users u\n            JOIN repos r ON r.user_id = u.id\n            WHERE u.backup_enabled = true\n              AND u.deactivated_at IS NULL\n              AND (\n                NOT EXISTS (\n                  SELECT 1 FROM account_backups ab WHERE ab.user_id = u.id\n                )\n                OR (\n                  SELECT MAX(ab.created_at) FROM account_backups ab WHERE ab.user_id = u.id\n                ) < NOW() - make_interval(secs => $1)\n              )\n            LIMIT $2\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "did",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "backup_enabled",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 3,
-        "name": "deactivated_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 4,
-        "name": "repo_root_cid",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 5,
-        "name": "repo_rev",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Float8",
-        "Int8"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      true,
-      false,
-      true
-    ]
-  },
-  "hash": "07c54d6bcfdc08d821e788c31dc46cc240dc8507c7dd5bdd2ceeb36d2084e8ce"
-}

.sqlx/query-0ce61cd393867522de318c1f86c787851ec7bbc31b147b9c2fb2bac9b2676ba6.json

@@ -1,87 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT\n                id,\n                delegated_did,\n                actor_did,\n                controller_did,\n                action_type as \"action_type: PgDelegationActionType\",\n                action_details,\n                ip_address,\n                user_agent,\n                created_at\n            FROM delegation_audit_log\n            WHERE controller_did = $1\n            ORDER BY created_at DESC\n            LIMIT $2 OFFSET $3\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "delegated_did",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "actor_did",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 3,
-        "name": "controller_did",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 4,
-        "name": "action_type: PgDelegationActionType",
-        "type_info": {
-          "Custom": {
-            "name": "delegation_action_type",
-            "kind": {
-              "Enum": [
-                "grant_created",
-                "grant_revoked",
-                "scopes_modified",
-                "token_issued",
-                "repo_write",
-                "blob_upload",
-                "account_action"
-              ]
-            }
-          }
-        }
-      },
-      {
-        "ordinal": 5,
-        "name": "action_details",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 6,
-        "name": "ip_address",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 7,
-        "name": "user_agent",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 8,
-        "name": "created_at",
-        "type_info": "Timestamptz"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Int8",
-        "Int8"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      true,
-      false,
-      true,
-      true,
-      true,
-      false
-    ]
-  },
-  "hash": "0ce61cd393867522de318c1f86c787851ec7bbc31b147b9c2fb2bac9b2676ba6"
-}

.sqlx/query-0d70da6b077d6fbab5056c38490acbe772626a3447182b76b0cbcee15c5a46dc.json

@@ -1,29 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT ab.storage_key, ab.repo_rev\n            FROM account_backups ab\n            JOIN users u ON u.id = ab.user_id\n            WHERE ab.id = $1 AND u.did = $2\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "storage_key",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "repo_rev",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "0d70da6b077d6fbab5056c38490acbe772626a3447182b76b0cbcee15c5a46dc"
-}

.sqlx/query-0ec60bb854a4991d0d7249a68f7445b65c8cc8c723baca221d85f5e4f2478b99.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT body FROM comms_queue WHERE user_id = (SELECT id FROM users WHERE did = $1) AND comms_type = 'email_update' ORDER BY created_at DESC LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "body",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "0ec60bb854a4991d0d7249a68f7445b65c8cc8c723baca221d85f5e4f2478b99"
-}

.sqlx/query-0fae1be7a75bdc58c69a9af97cad4aec23c32a9378764b8d6d7eb2cc89c562b1.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT token FROM sso_pending_registration WHERE token = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "token",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "0fae1be7a75bdc58c69a9af97cad4aec23c32a9378764b8d6d7eb2cc89c562b1"
-}

.sqlx/query-120c30d563b3cc40a2bb670f0c38c4ad63360b4a4f8e20c21afbe60c6fb7087a.json

@@ -1,29 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT id, storage_key\n            FROM account_backups\n            WHERE user_id = $1\n            ORDER BY created_at DESC\n            OFFSET $2\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "storage_key",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Int8"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "120c30d563b3cc40a2bb670f0c38c4ad63360b4a4f8e20c21afbe60c6fb7087a"
-}

.sqlx/query-1c84643fd6bc57c76517849a64d2d877df337e823d4c2c2b077f695bbfc9e9ac.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        DELETE FROM sso_pending_registration\n        WHERE token = $1 AND expires_at > NOW()\n        RETURNING token\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "token",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "1c84643fd6bc57c76517849a64d2d877df337e823d4c2c2b077f695bbfc9e9ac"
-}

.sqlx/query-24b823043ab60f36c29029137fef30dfe33922bb06067f2fdbfc1fbb4b0a2a81.json

@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        DELETE FROM sso_pending_registration\n        WHERE token = $1 AND expires_at > NOW()\n        RETURNING token, request_uri\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "token",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "request_uri",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "24b823043ab60f36c29029137fef30dfe33922bb06067f2fdbfc1fbb4b0a2a81"
-}

.sqlx/query-2841093a67480e75e1e9e4046bf3eb74afae2d04f5ea0ec17a4d433983e6d71c.json

@@ -1,38 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO external_identities (did, provider, provider_user_id)\n        VALUES ($1, $2, $3)\n        RETURNING id\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        {
-          "Custom": {
-            "name": "sso_provider_type",
-            "kind": {
-              "Enum": [
-                "github",
-                "discord",
-                "google",
-                "gitlab",
-                "oidc",
-                "apple"
-              ]
-            }
-          }
-        },
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "2841093a67480e75e1e9e4046bf3eb74afae2d04f5ea0ec17a4d433983e6d71c"
-}

.sqlx/query-29ef76852bb89af1ab9e679ceaa4abcf8bc8268a348d3be0da9840d1708d20b5.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE users SET password_reset_code_expires_at = NOW() - INTERVAL '1 hour' WHERE email = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "29ef76852bb89af1ab9e679ceaa4abcf8bc8268a348d3be0da9840d1708d20b5"
-}

.sqlx/query-3043db19db2d0f51d1db6965a3ba0af4a1a4a76cc4ab1cad8395ba6babecc37d.json

@@ -1,52 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT u.id, u.did, u.backup_enabled, u.deactivated_at, r.repo_root_cid, r.repo_rev\n            FROM users u\n            JOIN repos r ON r.user_id = u.id\n            WHERE u.did = $1\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "did",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "backup_enabled",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 3,
-        "name": "deactivated_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 4,
-        "name": "repo_root_cid",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 5,
-        "name": "repo_rev",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      true,
-      false,
-      true
-    ]
-  },
-  "hash": "3043db19db2d0f51d1db6965a3ba0af4a1a4a76cc4ab1cad8395ba6babecc37d"
-}

.sqlx/query-376b72306b50f747bc9161985ff4f50c35c53025a55ccf5e9933dc3795d29313.json

@@ -1,32 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO sso_pending_registration (token, request_uri, provider, provider_user_id, provider_email_verified)\n        VALUES ($1, $2, $3, $4, $5)\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        {
-          "Custom": {
-            "name": "sso_provider_type",
-            "kind": {
-              "Enum": [
-                "github",
-                "discord",
-                "google",
-                "gitlab",
-                "oidc",
-                "apple"
-              ]
-            }
-          }
-        },
-        "Text",
-        "Bool"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "376b72306b50f747bc9161985ff4f50c35c53025a55ccf5e9933dc3795d29313"
-}

.sqlx/query-3933ea5b147ab6294936de147b98e116cfae848ecd76ea5d367585eb5117f2ad.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT id FROM external_identities WHERE id = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "3933ea5b147ab6294936de147b98e116cfae848ecd76ea5d367585eb5117f2ad"
-}

.sqlx/query-3bed8d4843545f4a9676207513806603c50eb2af92957994abaf1c89c0294c12.json

@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO users (did, handle, email, password_hash) VALUES ($1, $2, $3, 'hash')",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "3bed8d4843545f4a9676207513806603c50eb2af92957994abaf1c89c0294c12"
-}

.sqlx/query-4445cc86cdf04894b340e67661b79a3c411917144a011f50849b737130b24dbe.json

@@ -1,55 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT subject, body, comms_type as \"comms_type: String\" FROM comms_queue WHERE user_id = $1 AND comms_type = 'admin_email' ORDER BY created_at DESC LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "subject",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "body",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "comms_type: String",
-        "type_info": {
-          "Custom": {
-            "name": "comms_type",
-            "kind": {
-              "Enum": [
-                "welcome",
-                "email_verification",
-                "password_reset",
-                "email_update",
-                "account_deletion",
-                "admin_email",
-                "plc_operation",
-                "two_factor_code",
-                "channel_verification",
-                "passkey_recovery",
-                "legacy_login_alert",
-                "migration_verification",
-                "channel_verified"
-              ]
-            }
-          }
-        }
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      true,
-      false,
-      false
-    ]
-  },
-  "hash": "4445cc86cdf04894b340e67661b79a3c411917144a011f50849b737130b24dbe"
-}

.sqlx/query-4560c237741ce9d4166aecd669770b3360a3ac71e649b293efb88d92c3254068.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT id FROM users WHERE email = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "4560c237741ce9d4166aecd669770b3360a3ac71e649b293efb88d92c3254068"
-}

.sqlx/query-47fe4a54857344d8f789f37092a294cd58f64b4fb431b54b5deda13d64525e88.json

@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT token, expires_at FROM account_deletion_requests WHERE did = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "token",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "expires_at",
-        "type_info": "Timestamptz"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "47fe4a54857344d8f789f37092a294cd58f64b4fb431b54b5deda13d64525e88"
-}

.sqlx/query-49cbc923cc4a0dcf7dea4ead5ab9580ff03b717586c4ca2d5343709e2dac86b6.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT email_verified FROM users WHERE did = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "email_verified",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "49cbc923cc4a0dcf7dea4ead5ab9580ff03b717586c4ca2d5343709e2dac86b6"
-}

.sqlx/query-4fef326fa2d03d04869af3fec702c901d1ecf392545a3a032438b2c1859d46cc.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT token FROM sso_pending_registration\n        WHERE token = $1 AND expires_at > NOW()\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "token",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "4fef326fa2d03d04869af3fec702c901d1ecf392545a3a032438b2c1859d46cc"
-}

.sqlx/query-575c1e5529874f8f523e6fe22ccf4ee3296806581b1765dfb91a84ffab347f15.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO oauth_authorization_request (id, client_id, parameters, expires_at)\n        VALUES ($1, 'https://test.example.com', $2, NOW() + INTERVAL '1 hour')\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Jsonb"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "575c1e5529874f8f523e6fe22ccf4ee3296806581b1765dfb91a84ffab347f15"
-}

.sqlx/query-596c3400a60c77c7645fd46fcea61fa7898b6832e58c0f647f382b23b81d350e.json

@@ -1,33 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO sso_pending_registration (token, request_uri, provider, provider_user_id, provider_username, provider_email)\n        VALUES ($1, $2, $3, $4, $5, $6)\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        {
-          "Custom": {
-            "name": "sso_provider_type",
-            "kind": {
-              "Enum": [
-                "github",
-                "discord",
-                "google",
-                "gitlab",
-                "oidc",
-                "apple"
-              ]
-            }
-          }
-        },
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "596c3400a60c77c7645fd46fcea61fa7898b6832e58c0f647f382b23b81d350e"
-}

.sqlx/query-59e63c5cf92985714e9586d1ce012efef733d4afaa4ea09974daf8303805e5d2.json

@@ -1,81 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT id, did, provider as \"provider: SsoProviderType\", provider_user_id, provider_username, provider_email\n        FROM external_identities\n        WHERE provider = $1 AND provider_user_id = $2\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "did",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "provider: SsoProviderType",
-        "type_info": {
-          "Custom": {
-            "name": "sso_provider_type",
-            "kind": {
-              "Enum": [
-                "github",
-                "discord",
-                "google",
-                "gitlab",
-                "oidc",
-                "apple"
-              ]
-            }
-          }
-        }
-      },
-      {
-        "ordinal": 3,
-        "name": "provider_user_id",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 4,
-        "name": "provider_username",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 5,
-        "name": "provider_email",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        {
-          "Custom": {
-            "name": "sso_provider_type",
-            "kind": {
-              "Enum": [
-                "github",
-                "discord",
-                "google",
-                "gitlab",
-                "oidc",
-                "apple"
-              ]
-            }
-          }
-        },
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      true,
-      true
-    ]
-  },
-  "hash": "59e63c5cf92985714e9586d1ce012efef733d4afaa4ea09974daf8303805e5d2"
-}

.sqlx/query-5a016f289caf75177731711e56e92881ba343c73a9a6e513e205c801c5943ec0.json

@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT k.key_bytes, k.encryption_version\n        FROM user_keys k\n        JOIN users u ON k.user_id = u.id\n        WHERE u.did = $1\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "key_bytes",
-        "type_info": "Bytea"
-      },
-      {
-        "ordinal": 1,
-        "name": "encryption_version",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      true
-    ]
-  },
-  "hash": "5a016f289caf75177731711e56e92881ba343c73a9a6e513e205c801c5943ec0"
-}

.sqlx/query-5af4a386c1632903ad7102551a5bd148bcf541baab6a84c8649666a695f9c4d1.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        DELETE FROM sso_auth_state\n        WHERE state = $1 AND expires_at > NOW()\n        RETURNING state\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "state",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "5af4a386c1632903ad7102551a5bd148bcf541baab6a84c8649666a695f9c4d1"
-}

.sqlx/query-5e4c0dd92ac3c4b5e2eae5d129f2649cf3a8f068105f44a8dca9625427affc06.json

@@ -1,43 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT provider_user_id, provider_email_verified\n        FROM external_identities\n        WHERE did = $1 AND provider = $2\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "provider_user_id",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "provider_email_verified",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        {
-          "Custom": {
-            "name": "sso_provider_type",
-            "kind": {
-              "Enum": [
-                "github",
-                "discord",
-                "google",
-                "gitlab",
-                "oidc",
-                "apple"
-              ]
-            }
-          }
-        }
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "5e4c0dd92ac3c4b5e2eae5d129f2649cf3a8f068105f44a8dca9625427affc06"
-}

.sqlx/query-5e9c6ec72c2c0ea1c8dff551d01baddd1dd953c828a5656db2ee39dea996f890.json

@@ -1,33 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO sso_auth_state (state, request_uri, provider, action, nonce, code_verifier)\n        VALUES ($1, $2, $3, $4, $5, $6)\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        {
-          "Custom": {
-            "name": "sso_provider_type",
-            "kind": {
-              "Enum": [
-                "github",
-                "discord",
-                "google",
-                "gitlab",
-                "oidc",
-                "apple"
-              ]
-            }
-          }
-        },
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "5e9c6ec72c2c0ea1c8dff551d01baddd1dd953c828a5656db2ee39dea996f890"
-}

.sqlx/query-63f6f2a89650794fe90e10ce7fc785a6b9f7d37c12b31a6ff13f7c5214eef19e.json

@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT did, email_verified FROM users WHERE did = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "did",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "email_verified",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "63f6f2a89650794fe90e10ce7fc785a6b9f7d37c12b31a6ff13f7c5214eef19e"
-}

.sqlx/query-6c7ace2a64848adc757af6c93b9162e1d95788b372370a7ad0d7540338bb73ee.json

@@ -1,66 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT state, request_uri, provider as \"provider: SsoProviderType\", action, nonce, code_verifier\n        FROM sso_auth_state\n        WHERE state = $1\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "state",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "request_uri",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "provider: SsoProviderType",
-        "type_info": {
-          "Custom": {
-            "name": "sso_provider_type",
-            "kind": {
-              "Enum": [
-                "github",
-                "discord",
-                "google",
-                "gitlab",
-                "oidc",
-                "apple"
-              ]
-            }
-          }
-        }
-      },
-      {
-        "ordinal": 3,
-        "name": "action",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 4,
-        "name": "nonce",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 5,
-        "name": "code_verifier",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      true,
-      true
-    ]
-  },
-  "hash": "6c7ace2a64848adc757af6c93b9162e1d95788b372370a7ad0d7540338bb73ee"
-}

.sqlx/query-6c7d5b62546ed7581edbfdb6946492a6cc41b94b04009b5602f1ef72e0138edc.json

@@ -1,27 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO account_backups (user_id, storage_key, repo_root_cid, repo_rev, block_count, size_bytes)\n            VALUES ($1, $2, $3, $4, $5, $6)\n            ON CONFLICT (storage_key) DO UPDATE SET created_at = NOW()\n            RETURNING id\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Text",
-        "Text",
-        "Text",
-        "Int4",
-        "Int8"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "6c7d5b62546ed7581edbfdb6946492a6cc41b94b04009b5602f1ef72e0138edc"
-}

.sqlx/query-6fbcff0206599484bfb6cef165b6f729d27e7a342f7718ee4ac07f0ca94412ba.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT state FROM sso_auth_state WHERE state = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "state",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "6fbcff0206599484bfb6cef165b6f729d27e7a342f7718ee4ac07f0ca94412ba"
-}

.sqlx/query-712459c27fc037f45389e2766cf1057e86e93ef756a784ed12beb453b03c5da1.json

@@ -1,33 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO sso_pending_registration (token, request_uri, provider, provider_user_id, provider_username, provider_email_verified)\n        VALUES ($1, $2, $3, $4, $5, $6)\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        {
-          "Custom": {
-            "name": "sso_provider_type",
-            "kind": {
-              "Enum": [
-                "github",
-                "discord",
-                "google",
-                "gitlab",
-                "oidc",
-                "apple"
-              ]
-            }
-          }
-        },
-        "Text",
-        "Text",
-        "Bool"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "712459c27fc037f45389e2766cf1057e86e93ef756a784ed12beb453b03c5da1"
-}

.sqlx/query-785a864944c5939331704c71b0cd3ed26ffdd64f3fd0f26ecc28b6a0557bbe8f.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT subject FROM comms_queue WHERE user_id = $1 AND comms_type = 'admin_email' AND body = 'Email without subject' LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "subject",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      true
-    ]
-  },
-  "hash": "785a864944c5939331704c71b0cd3ed26ffdd64f3fd0f26ecc28b6a0557bbe8f"
-}

.sqlx/query-78be3d837cfb54d5e915ff0c5b1aaedc104776a22ad28b637de574e58d052036.json

@@ -1,35 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT ab.id, ab.storage_key, u.deactivated_at\n            FROM account_backups ab\n            JOIN users u ON u.id = ab.user_id\n            WHERE ab.id = $1 AND u.did = $2\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "storage_key",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "deactivated_at",
-        "type_info": "Timestamptz"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      true
-    ]
-  },
-  "hash": "78be3d837cfb54d5e915ff0c5b1aaedc104776a22ad28b637de574e58d052036"
-}

.sqlx/query-7caa8f9083b15ec1209dda35c4c6f6fba9fe338e4a6a10636b5389d426df1631.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT t.token\n        FROM plc_operation_tokens t\n        JOIN users u ON t.user_id = u.id\n        WHERE u.did = $1\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "token",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "7caa8f9083b15ec1209dda35c4c6f6fba9fe338e4a6a10636b5389d426df1631"
-}

.sqlx/query-7d24e744a4e63570b1410e50b45b745ce8915ab3715b3eff7efc2d84f27735d0.json

@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT provider_username, last_login_at FROM external_identities WHERE id = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "provider_username",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "last_login_at",
-        "type_info": "Timestamptz"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      true,
-      true
-    ]
-  },
-  "hash": "7d24e744a4e63570b1410e50b45b745ce8915ab3715b3eff7efc2d84f27735d0"
-}

.sqlx/query-7d43e7e917104d7bce29459149a345145361c6940e9b8e2ccc561a0a032f63c0.json

@@ -1,46 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT\n                u.did,\n                u.handle,\n                d.granted_scopes,\n                d.granted_at,\n                (u.deactivated_at IS NULL AND u.takedown_ref IS NULL) as \"is_active!\"\n            FROM account_delegations d\n            JOIN users u ON u.did = d.controller_did\n            WHERE d.delegated_did = $1 AND d.revoked_at IS NULL\n            ORDER BY d.granted_at DESC\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "did",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "handle",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "granted_scopes",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 3,
-        "name": "granted_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 4,
-        "name": "is_active!",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      null
-    ]
-  },
-  "hash": "7d43e7e917104d7bce29459149a345145361c6940e9b8e2ccc561a0a032f63c0"
-}

.sqlx/query-7ec9500e28b450ab569ec50f968f5f66b7e8e80b160db9734cb78f91fc9f2cc6.json

@@ -1,52 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT id, repo_rev, repo_root_cid, block_count, size_bytes, created_at\n            FROM account_backups\n            WHERE user_id = $1\n            ORDER BY created_at DESC\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "repo_rev",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "repo_root_cid",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 3,
-        "name": "block_count",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 4,
-        "name": "size_bytes",
-        "type_info": "Int8"
-      },
-      {
-        "ordinal": 5,
-        "name": "created_at",
-        "type_info": "Timestamptz"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      false,
-      false
-    ]
-  },
-  "hash": "7ec9500e28b450ab569ec50f968f5f66b7e8e80b160db9734cb78f91fc9f2cc6"
-}

.sqlx/query-82717b6f61cd79347e1ca7e92c4413743ba168d1e0d8b85566711e54d4048f81.json

@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT t.token, t.expires_at FROM plc_operation_tokens t JOIN users u ON t.user_id = u.id WHERE u.did = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "token",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "expires_at",
-        "type_info": "Timestamptz"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "82717b6f61cd79347e1ca7e92c4413743ba168d1e0d8b85566711e54d4048f81"
-}

.sqlx/query-85882f1c27888b695582395b798b8e4994ed1d761a598f938f2271e5ba320eea.json

@@ -0,0 +1,58 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT id, did, preferred_comms_channel as \"preferred_comms_channel: CommsChannel\", recovery_token, recovery_token_expires_at FROM users WHERE did = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "did",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "preferred_comms_channel: CommsChannel",
+        "type_info": {
+          "Custom": {
+            "name": "comms_channel",
+            "kind": {
+              "Enum": [
+                "email",
+                "discord",
+                "telegram",
+                "signal"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 3,
+        "name": "recovery_token",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "recovery_token_expires_at",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "85882f1c27888b695582395b798b8e4994ed1d761a598f938f2271e5ba320eea"
+}

.sqlx/query-85ffc37a77af832d7795f5f37efe304fced4bf56b4f2287fe9aeb3fc97e1b191.json

@@ -1,34 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO sso_pending_registration (token, request_uri, provider, provider_user_id, provider_username, provider_email, provider_email_verified)\n        VALUES ($1, $2, $3, $4, $5, $6, $7)\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        {
-          "Custom": {
-            "name": "sso_provider_type",
-            "kind": {
-              "Enum": [
-                "github",
-                "discord",
-                "google",
-                "gitlab",
-                "oidc",
-                "apple"
-              ]
-            }
-          }
-        },
-        "Text",
-        "Text",
-        "Text",
-        "Bool"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "85ffc37a77af832d7795f5f37efe304fced4bf56b4f2287fe9aeb3fc97e1b191"
-}

.sqlx/query-9ad422bf3c43e3cfd86fc88c73594246ead214ca794760d3fe77bb5cf4f27be5.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT body FROM comms_queue WHERE user_id = (SELECT id FROM users WHERE did = $1) AND comms_type = 'email_verification' ORDER BY created_at DESC LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "body",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "9ad422bf3c43e3cfd86fc88c73594246ead214ca794760d3fe77bb5cf4f27be5"
-}

.sqlx/query-9b035b051769e6b9d45910a8bb42ac0f84c73de8c244ba4560f004ee3f4b7002.json

@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT did, public_key_did_key FROM reserved_signing_keys WHERE public_key_did_key = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "did",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "public_key_did_key",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      true,
-      false
-    ]
-  },
-  "hash": "9b035b051769e6b9d45910a8bb42ac0f84c73de8c244ba4560f004ee3f4b7002"
-}

.sqlx/query-9dba64081d4f95b5490c9a9bf30a7175db3429f39df4f25e212f38f33882fc65.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT id FROM external_identities WHERE did = $1\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "9dba64081d4f95b5490c9a9bf30a7175db3429f39df4f25e212f38f33882fc65"
-}

.sqlx/query-9fd56986c1c843d386d1e5884acef8573eb55a3e9f5cb0122fcf8b93d6d667a5.json

@@ -1,66 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT token, request_uri, provider as \"provider: SsoProviderType\", provider_user_id,\n               provider_username, provider_email\n        FROM sso_pending_registration\n        WHERE token = $1 AND expires_at > NOW()\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "token",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "request_uri",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "provider: SsoProviderType",
-        "type_info": {
-          "Custom": {
-            "name": "sso_provider_type",
-            "kind": {
-              "Enum": [
-                "github",
-                "discord",
-                "google",
-                "gitlab",
-                "oidc",
-                "apple"
-              ]
-            }
-          }
-        }
-      },
-      {
-        "ordinal": 3,
-        "name": "provider_user_id",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 4,
-        "name": "provider_username",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 5,
-        "name": "provider_email",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      true,
-      true
-    ]
-  },
-  "hash": "9fd56986c1c843d386d1e5884acef8573eb55a3e9f5cb0122fcf8b93d6d667a5"
-}

.sqlx/query-a10a29aee170a54af2ddbd59cf989a2910508b9f7e6f60465dd4cb5c7a79d848.json

@@ -1,40 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT id, did, recovery_token, recovery_token_expires_at FROM users WHERE did = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "did",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "recovery_token",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 3,
-        "name": "recovery_token_expires_at",
-        "type_info": "Timestamptz"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      true,
-      true
-    ]
-  },
-  "hash": "a10a29aee170a54af2ddbd59cf989a2910508b9f7e6f60465dd4cb5c7a79d848"
-}

.sqlx/query-a23a390659616779d7dbceaa3b5d5171e70fa25e3b8393e142cebcbff752f0f5.json

@@ -1,34 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT private_key_bytes, expires_at, used_at FROM reserved_signing_keys WHERE public_key_did_key = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "private_key_bytes",
-        "type_info": "Bytea"
-      },
-      {
-        "ordinal": 1,
-        "name": "expires_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 2,
-        "name": "used_at",
-        "type_info": "Timestamptz"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      true
-    ]
-  },
-  "hash": "a23a390659616779d7dbceaa3b5d5171e70fa25e3b8393e142cebcbff752f0f5"
-}

.sqlx/query-a3d549a32e76c24e265c73a98dd739067623f275de0740bd576ee288f4444496.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        UPDATE external_identities\n        SET provider_username = $2, last_login_at = NOW()\n        WHERE id = $1\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "a3d549a32e76c24e265c73a98dd739067623f275de0740bd576ee288f4444496"
-}

.sqlx/query-a802d7d860f263eace39ce82bb27b633cec7287c1cc177f0e1d47ec6571564d5.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT token FROM account_deletion_requests WHERE did = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "token",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "a802d7d860f263eace39ce82bb27b633cec7287c1cc177f0e1d47ec6571564d5"
-}

.sqlx/query-aee3e8e1d8924d41bec7d866e274f8bb2ddef833eb03326103c2d0a17ee56154.json

@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        DELETE FROM sso_auth_state\n        WHERE state = $1 AND expires_at > NOW()\n        RETURNING state, request_uri\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "state",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "request_uri",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "aee3e8e1d8924d41bec7d866e274f8bb2ddef833eb03326103c2d0a17ee56154"
-}

.sqlx/query-b22003e74a58303beb993547a8e2bf2415152a5546d6a10c9aebc223420b0088.json

@@ -1,34 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT DISTINCT b.cid, b.storage_key, b.mime_type\n            FROM blobs b\n            JOIN record_blobs rb ON rb.blob_cid = b.cid\n            WHERE rb.repo_id = $1\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "cid",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "storage_key",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "mime_type",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false
-    ]
-  },
-  "hash": "b22003e74a58303beb993547a8e2bf2415152a5546d6a10c9aebc223420b0088"
-}

.sqlx/query-ba9684872fad5201b8504c2606c29364a2df9631fe98817e7bfacd3f3f51f6cb.json

@@ -1,31 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO sso_pending_registration (token, request_uri, provider, provider_user_id, expires_at)\n        VALUES ($1, $2, $3, $4, NOW() - INTERVAL '1 hour')\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        {
-          "Custom": {
-            "name": "sso_provider_type",
-            "kind": {
-              "Enum": [
-                "github",
-                "discord",
-                "google",
-                "gitlab",
-                "oidc",
-                "apple"
-              ]
-            }
-          }
-        },
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "ba9684872fad5201b8504c2606c29364a2df9631fe98817e7bfacd3f3f51f6cb"
-}

.sqlx/query-bb4460f75d30f48b79d71b97f2c7d54190260deba2d2ade177dbdaa507ab275b.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM sso_auth_state WHERE expires_at < NOW()",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "bb4460f75d30f48b79d71b97f2c7d54190260deba2d2ade177dbdaa507ab275b"
-}

.sqlx/query-bb83d46014c20edc99ef7e81808087097e719771c6c8163e4e8e11a98bb97dde.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM account_backups WHERE user_id = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "bb83d46014c20edc99ef7e81808087097e719771c6c8163e4e8e11a98bb97dde"
-}

.sqlx/query-bd5861c7ed2021d025e78d63ef6a35b2bb07d2c11f88f3945fbcf099b9c7c1cf.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            UPDATE oauth_authorization_request\n            SET expires_at = $2\n            WHERE id = $1 AND did IS NOT NULL AND code IS NULL\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Timestamptz"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "bd5861c7ed2021d025e78d63ef6a35b2bb07d2c11f88f3945fbcf099b9c7c1cf"
+}

.sqlx/query-bf2b237ee5cfe66d038dce3f564c05a683d391aebda7871d65d302e04b5d733f.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT deactivated_at FROM users WHERE did = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "deactivated_at",
-        "type_info": "Timestamptz"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      true
-    ]
-  },
-  "hash": "bf2b237ee5cfe66d038dce3f564c05a683d391aebda7871d65d302e04b5d733f"
-}

.sqlx/query-c69577bc8e88e2f2cc516d6bec3d201419b589b6088ceb933cb182265b14e363.json

@@ -1,46 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT\n                u.did,\n                u.handle,\n                d.granted_scopes,\n                d.granted_at,\n                true as \"is_active!\"\n            FROM account_delegations d\n            JOIN users u ON u.did = d.controller_did\n            WHERE d.delegated_did = $1\n              AND d.revoked_at IS NULL\n              AND u.deactivated_at IS NULL\n              AND u.takedown_ref IS NULL\n            ORDER BY d.granted_at DESC\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "did",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "handle",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "granted_scopes",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 3,
-        "name": "granted_at",
-        "type_info": "Timestamptz"
-      },
-      {
-        "ordinal": 4,
-        "name": "is_active!",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      null
-    ]
-  },
-  "hash": "c69577bc8e88e2f2cc516d6bec3d201419b589b6088ceb933cb182265b14e363"
-}

.sqlx/query-cd3b8098ad4c1056c1d23acd8a6b29f7abfe18ee6f559bd94ab16274b1cfdfee.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT password_reset_code FROM users WHERE email = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "password_reset_code",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      true
-    ]
-  },
-  "hash": "cd3b8098ad4c1056c1d23acd8a6b29f7abfe18ee6f559bd94ab16274b1cfdfee"
-}

.sqlx/query-cda68f9b6c60295a196fc853b70ec5fd51a8ffaa2bac5942c115c99d1cbcafa3.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT COUNT(*) as \"count!\" FROM plc_operation_tokens t JOIN users u ON t.user_id = u.id WHERE u.did = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "count!",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "cda68f9b6c60295a196fc853b70ec5fd51a8ffaa2bac5942c115c99d1cbcafa3"
-}

.sqlx/query-d0d4fb4b44cda3442b20037b4d5efaa032e1d004c775e2b6077c5050d7d62041.json

@@ -1,31 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO sso_auth_state (state, request_uri, provider, action, expires_at)\n        VALUES ($1, $2, $3, $4, NOW() - INTERVAL '1 hour')\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        {
-          "Custom": {
-            "name": "sso_provider_type",
-            "kind": {
-              "Enum": [
-                "github",
-                "discord",
-                "google",
-                "gitlab",
-                "oidc",
-                "apple"
-              ]
-            }
-          }
-        },
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "d0d4fb4b44cda3442b20037b4d5efaa032e1d004c775e2b6077c5050d7d62041"
-}

.sqlx/query-d529d6dc9858c1da360f0417e94a3b40041b043bae57e95002d4bf5df46a4ab4.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE account_deletion_requests SET expires_at = NOW() - INTERVAL '1 hour' WHERE token = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "d529d6dc9858c1da360f0417e94a3b40041b043bae57e95002d4bf5df46a4ab4"
-}

.sqlx/query-d92bfa1e67c60c4fb333b6390e49224381c1dd23c3ef09aff3a6d59eadd13c64.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT COUNT(*) as \"count!\"\n            FROM account_delegations d\n            JOIN users u ON u.did = d.controller_did\n            WHERE d.delegated_did = $1\n              AND d.revoked_at IS NULL\n              AND u.deactivated_at IS NULL\n              AND u.takedown_ref IS NULL\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "count!",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "d92bfa1e67c60c4fb333b6390e49224381c1dd23c3ef09aff3a6d59eadd13c64"
-}

.sqlx/query-dd6021dd12823e042b011b2c1507736a46c0dcf0eb94cb41de58f8ca0b3a2f08.json

@@ -0,0 +1,52 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            SELECT\n                d.controller_did,\n                u.handle as \"handle?\",\n                d.granted_scopes,\n                d.granted_at,\n                CASE WHEN u.did IS NOT NULL\n                     THEN u.deactivated_at IS NULL AND u.takedown_ref IS NULL\n                     ELSE true\n                END as \"is_active!\",\n                u.did IS NOT NULL as \"is_local!\"\n            FROM account_delegations d\n            LEFT JOIN users u ON u.did = d.controller_did\n            WHERE d.delegated_did = $1 AND d.revoked_at IS NULL\n            ORDER BY d.granted_at DESC\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "controller_did",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 1,
+        "name": "handle?",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "granted_scopes",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "granted_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 4,
+        "name": "is_active!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 5,
+        "name": "is_local!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      null,
+      null
+    ]
+  },
+  "hash": "dd6021dd12823e042b011b2c1507736a46c0dcf0eb94cb41de58f8ca0b3a2f08"
+}

.sqlx/query-dd7d80d4d118a5fc95b574e2ca9ffaccf974e52fb6ac368f716409c55f9d3ab0.json

@@ -1,40 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO external_identities (did, provider, provider_user_id, provider_username, provider_email)\n        VALUES ($1, $2, $3, $4, $5)\n        RETURNING id\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        {
-          "Custom": {
-            "name": "sso_provider_type",
-            "kind": {
-              "Enum": [
-                "github",
-                "discord",
-                "google",
-                "gitlab",
-                "oidc",
-                "apple"
-              ]
-            }
-          }
-        },
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "dd7d80d4d118a5fc95b574e2ca9ffaccf974e52fb6ac368f716409c55f9d3ab0"
-}

.sqlx/query-e20cbe2a939d790aaea718b084a80d8ede655ba1cc0fd4346d7e91d6de7d6cf3.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT COUNT(*) FROM comms_queue WHERE user_id = $1 AND comms_type = 'password_reset'",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "count",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "e20cbe2a939d790aaea718b084a80d8ede655ba1cc0fd4346d7e91d6de7d6cf3"
-}

.sqlx/query-e3e4b6131b7692edf87fcf3b67b59127d3a218afb7a34a4bcb3c56765f8cd4c6.json

@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT id, password_reset_code_expires_at FROM users WHERE password_reset_code = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "password_reset_code_expires_at",
-        "type_info": "Timestamptz"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      true
-    ]
-  },
-  "hash": "e3e4b6131b7692edf87fcf3b67b59127d3a218afb7a34a4bcb3c56765f8cd4c6"
-}

.sqlx/query-e64cd36284d10ab7f3d9f6959975a1a627809f444b0faff7e611d985f31b90e9.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT used_at FROM reserved_signing_keys WHERE public_key_did_key = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "used_at",
-        "type_info": "Timestamptz"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      true
-    ]
-  },
-  "hash": "e64cd36284d10ab7f3d9f6959975a1a627809f444b0faff7e611d985f31b90e9"
-}

.sqlx/query-eb3029b84fb58576a94987da1984cbe152f5ee7aa55b2b3f678603fe1e1c906b.json

@@ -1,11 +1,21 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT preferred_comms_channel as \"preferred_comms_channel: String\", discord_username FROM users WHERE did = $1",
+  "query": "SELECT id, did, preferred_comms_channel as \"preferred_comms_channel: CommsChannel\", password_reset_code_expires_at FROM users WHERE password_reset_code = $1",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "preferred_comms_channel: String",
+        "name": "id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "did",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "preferred_comms_channel: CommsChannel",
         "type_info": {
           "Custom": {
             "name": "comms_channel",
@@ -21,9 +31,9 @@
         }
       },
       {
-        "ordinal": 1,
-        "name": "discord_username",
-        "type_info": "Text"
+        "ordinal": 3,
+        "name": "password_reset_code_expires_at",
+        "type_info": "Timestamptz"
       }
     ],
     "parameters": {
@@ -32,9 +42,11 @@
       ]
     },
     "nullable": [
+      false,
+      false,
       false,
       true
     ]
   },
-  "hash": "a844774d8dd3c50c5faf3de5d43f534b80234759c8437434e467ca33ea10fd1f"
+  "hash": "eb3029b84fb58576a94987da1984cbe152f5ee7aa55b2b3f678603fe1e1c906b"
 }

.sqlx/query-eb54d2ce02cab7c2e7f9926bd469b19e5f0513f47173b2738fc01a57082d7abb.json

@@ -1,30 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO external_identities (did, provider, provider_user_id)\n        VALUES ($1, $2, $3)\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        {
-          "Custom": {
-            "name": "sso_provider_type",
-            "kind": {
-              "Enum": [
-                "github",
-                "discord",
-                "google",
-                "gitlab",
-                "oidc",
-                "apple"
-              ]
-            }
-          }
-        },
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "eb54d2ce02cab7c2e7f9926bd469b19e5f0513f47173b2738fc01a57082d7abb"
-}

.sqlx/query-ec22a8cc89e480c403a239eac44288e144d83364129491de6156760616666d3d.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM external_identities WHERE id = $1 AND did = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "ec22a8cc89e480c403a239eac44288e144d83364129491de6156760616666d3d"
-}

.sqlx/query-f26c13023b47b908ec96da2e6b8bf8b34ca6a2246c20fc96f76f0e95530762a7.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT email FROM users WHERE did = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "email",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      true
-    ]
-  },
-  "hash": "f26c13023b47b908ec96da2e6b8bf8b34ca6a2246c20fc96f76f0e95530762a7"
-}

.sqlx/query-f29da3bdfbbc547b339b4cdb059fac26435b0feec65cf1c56f851d1c4d6b1814.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE users SET is_admin = TRUE WHERE did = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "f29da3bdfbbc547b339b4cdb059fac26435b0feec65cf1c56f851d1c4d6b1814"
-}

.sqlx/query-f71428b1ce982504cd531937131d49196ec092b4d13e9ae7dcdaedfe98de5a70.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE users SET backup_enabled = $1 WHERE did = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Bool",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "f71428b1ce982504cd531937131d49196ec092b4d13e9ae7dcdaedfe98de5a70"
-}

.sqlx/query-f7af28963099aec12cf1d4f8a9a03699bb3a90f39bc9c4c0f738a37827e8f382.json

@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT password_reset_code, password_reset_code_expires_at FROM users WHERE email = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "password_reset_code",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "password_reset_code_expires_at",
-        "type_info": "Timestamptz"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      true,
-      true
-    ]
-  },
-  "hash": "f7af28963099aec12cf1d4f8a9a03699bb3a90f39bc9c4c0f738a37827e8f382"
-}

.sqlx/query-f85f8d49bbd2d5e048bd8c29081aef5b8097e2384793e85df72eeeb858b7c532.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM account_backups WHERE id = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "f85f8d49bbd2d5e048bd8c29081aef5b8097e2384793e85df72eeeb858b7c532"
-}

.sqlx/query-ff2ffeb1ea1c1375ff0edc4c9ce2f3cdeb92e2b0a72405ea0441b0340b177b96.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            SELECT COUNT(*) as \"count!\"\n            FROM account_delegations d\n            LEFT JOIN users u ON u.did = d.controller_did\n            WHERE d.delegated_did = $1\n              AND d.revoked_at IS NULL\n              AND (u.did IS NULL OR (u.deactivated_at IS NULL AND u.takedown_ref IS NULL))\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "ff2ffeb1ea1c1375ff0edc4c9ce2f3cdeb92e2b0a72405ea0441b0340b177b96"
+}

Cargo.lock

@@ -104,6 +104,56 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "anstream"
+version = "0.6.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43d5b281e737544384e969a5ccad3f1cdd24b48086a0fc1b2a5262a26b8f4f4a"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "anyhow"
 version = "1.0.100"
@@ -1216,6 +1266,46 @@ dependencies = [
  "inout",
 ]
 
+[[package]]
+name = "clap"
+version = "4.5.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63be97961acde393029492ce0be7a1af7e323e6bae9511ebfac33751be5e6806"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.5.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f13174bda5dfd69d7e947827e5af4b0f2f94a4a3ee92912fba07a66150f21e2"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.5.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a92793da1a46a5f2a02a6f4c46c6496b28c43638adea8306fcb0caa1634f24e5"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a822ea5bc7590f9d40f1ba12c0dc3c2760f3482c6984db1573ad11031420831"
+
 [[package]]
 name = "cmake"
 version = "0.1.57"
@@ -1240,6 +1330,12 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
 
+[[package]]
+name = "colorchoice"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+
 [[package]]
 name = "combine"
 version = "4.6.7"
@@ -1280,6 +1376,29 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "confique"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06b4f5ec222421e22bb0a8cbaa36b1d2b50fd45cdd30c915ded34108da78b29f"
+dependencies = [
+ "confique-macro",
+ "serde",
+ "toml",
+]
+
+[[package]]
+name = "confique-macro"
+version = "0.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4d1754680cd218e7bcb4c960cc9bae3444b5197d64563dccccfdf83cab9e1a7"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+]
+
 [[package]]
 name = "const-oid"
 version = "0.9.6"
@@ -2624,6 +2743,12 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "http-range-header"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9171a2ea8a68358193d15dd5d70c1c10a2afc3e7e4c5bc92bc9f025cebd7359c"
+
 [[package]]
 name = "httparse"
 version = "1.10.1"
@@ -2744,22 +2869,6 @@ dependencies = [
  "tower-service",
 ]
 
-[[package]]
-name = "hyper-tls"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
-dependencies = [
- "bytes",
- "http-body-util",
- "hyper 1.8.1",
- "hyper-util",
- "native-tls",
- "tokio",
- "tokio-native-tls",
- "tower-service",
-]
-
 [[package]]
 name = "hyper-util"
 version = "0.1.19"
@@ -2778,7 +2887,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.6.1",
+ "socket2 0.6.2",
  "system-configuration",
  "tokio",
  "tower-service",
@@ -3075,6 +3184,12 @@ dependencies = [
  "unsigned-varint 0.7.2",
 ]
 
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
 [[package]]
 name = "itertools"
 version = "0.14.0"
@@ -3504,6 +3619,16 @@ version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
+[[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
 [[package]]
 name = "minimal-lexical"
 version = "0.2.1"
@@ -3585,23 +3710,6 @@ dependencies = [
  "web-time",
 ]
 
-[[package]]
-name = "native-tls"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87de3442987e9dbec73158d5c715e7ad9072fda936bb03d19d7fa10e00520f0e"
-dependencies = [
- "libc",
- "log",
- "openssl",
- "openssl-probe",
- "openssl-sys",
- "schannel",
- "security-framework 2.11.1",
- "security-framework-sys",
- "tempfile",
-]
-
 [[package]]
 name = "nom"
 version = "7.1.3"
@@ -3748,6 +3856,12 @@ version = "1.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
 
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
 [[package]]
 name = "opaque-debug"
 version = "0.3.1"
@@ -4242,7 +4356,7 @@ dependencies = [
  "quinn-udp",
  "rustc-hash",
  "rustls 0.23.35",
- "socket2 0.6.1",
+ "socket2 0.6.2",
  "thiserror 2.0.17",
  "tokio",
  "tracing",
@@ -4279,7 +4393,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.6.1",
+ "socket2 0.6.2",
  "tracing",
  "windows-sys 0.60.2",
 ]
@@ -4402,7 +4516,7 @@ dependencies = [
  "pin-project-lite",
  "ryu",
  "sha1_smol",
- "socket2 0.6.1",
+ "socket2 0.6.2",
  "tokio",
  "tokio-util",
  "url",
@@ -4498,12 +4612,10 @@ dependencies = [
  "http-body-util",
  "hyper 1.8.1",
  "hyper-rustls 0.27.7",
- "hyper-tls",
  "hyper-util",
  "js-sys",
  "log",
  "mime",
- "native-tls",
  "percent-encoding",
  "pin-project-lite",
  "quinn",
@@ -4514,7 +4626,6 @@ dependencies = [
  "serde_urlencoded",
  "sync_wrapper",
  "tokio",
- "tokio-native-tls",
  "tokio-rustls 0.26.4",
  "tower",
  "tower-http",
@@ -4661,7 +4772,7 @@ dependencies = [
  "openssl-probe",
  "rustls-pki-types",
  "schannel",
- "security-framework 3.5.1",
+ "security-framework",
 ]
 
 [[package]]
@@ -4800,19 +4911,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "security-framework"
-version = "2.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
-dependencies = [
- "bitflags",
- "core-foundation 0.9.4",
- "core-foundation-sys",
- "libc",
- "security-framework-sys",
-]
-
 [[package]]
 name = "security-framework"
 version = "3.5.1"
@@ -4958,6 +5056,15 @@ dependencies = [
  "syn 2.0.111",
 ]
 
+[[package]]
+name = "serde_spanned"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8bbf91e5a4d6315eee45e704372590b30e260ee83af6639d64557f51b067776"
+dependencies = [
+ "serde_core",
+]
+
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -5134,9 +5241,9 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.6.1"
+version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17129e116933cf371d018bb80ae557e889637989d8638274fb25622827b03881"
+checksum = "86f4aa3ad99f2088c990dfa82d367e19cb29268ed67c574d10d0a4bfe71f07e0"
 dependencies = [
  "libc",
  "windows-sys 0.60.2",
@@ -5525,19 +5632,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "tempfile"
-version = "3.23.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
-dependencies = [
- "fastrand",
- "getrandom 0.3.4",
- "once_cell",
- "rustix",
- "windows-sys 0.61.2",
-]
-
 [[package]]
 name = "testcontainers"
 version = "0.26.2"
@@ -5693,7 +5787,7 @@ dependencies = [
  "mio",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.6.1",
+ "socket2 0.6.2",
  "tokio-macros",
  "windows-sys 0.61.2",
 ]
@@ -5709,16 +5803,6 @@ dependencies = [
  "syn 2.0.111",
 ]
 
-[[package]]
-name = "tokio-native-tls"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
-dependencies = [
- "native-tls",
- "tokio",
-]
-
 [[package]]
 name = "tokio-rustls"
 version = "0.24.1"
@@ -5758,10 +5842,12 @@ checksum = "d25a406cddcc431a75d3d9afc6a7c0f7428d4891dd973e4d54c56b46127bf857"
 dependencies = [
  "futures-util",
  "log",
- "native-tls",
+ "rustls 0.23.35",
+ "rustls-pki-types",
  "tokio",
- "tokio-native-tls",
+ "tokio-rustls 0.26.4",
  "tungstenite",
+ "webpki-roots 0.26.11",
 ]
 
 [[package]]
@@ -5778,6 +5864,45 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "toml"
+version = "0.9.12+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
+dependencies = [
+ "indexmap 2.12.1",
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_parser",
+ "toml_writer",
+ "winnow",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.7.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.0.7+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "247eaa3197818b831697600aadf81514e577e0cba5eab10f7e064e78ae154df1"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "toml_writer"
+version = "1.0.6+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab16f14aed21ee8bfd8ec22513f7287cd4a91aa92e44edfe2c17ddd004e92607"
+
 [[package]]
 name = "tonic"
 version = "0.14.2"
@@ -5797,7 +5922,7 @@ dependencies = [
  "hyper-util",
  "percent-encoding",
  "pin-project",
- "socket2 0.6.1",
+ "socket2 0.6.2",
  "sync_wrapper",
  "tokio",
  "tokio-stream",
@@ -5867,13 +5992,19 @@ dependencies = [
  "http 1.4.0",
  "http-body 1.0.1",
  "http-body-util",
+ "http-range-header",
+ "httpdate",
  "iri-string",
+ "mime",
+ "mime_guess",
+ "percent-encoding",
  "pin-project-lite",
  "tokio",
  "tokio-util",
  "tower",
  "tower-layer",
  "tower-service",
+ "tracing",
 ]
 
 [[package]]
@@ -5961,9 +6092,57 @@ dependencies = [
  "syn 2.0.111",
 ]
 
+[[package]]
+name = "tranquil-api"
+version = "0.4.6"
+dependencies = [
+ "anyhow",
+ "axum",
+ "backon",
+ "base32",
+ "base64 0.22.1",
+ "bcrypt",
+ "bs58",
+ "bytes",
+ "chrono",
+ "cid",
+ "ed25519-dalek",
+ "futures",
+ "hex",
+ "http 1.4.0",
+ "infer",
+ "ipld-core",
+ "jacquard-common",
+ "jacquard-repo",
+ "k256",
+ "multibase",
+ "multihash",
+ "rand 0.8.5",
+ "reqwest",
+ "serde",
+ "serde_ipld_dagcbor",
+ "serde_json",
+ "sha2",
+ "subtle",
+ "thiserror 2.0.17",
+ "tokio",
+ "tracing",
+ "tranquil-config",
+ "tranquil-db",
+ "tranquil-db-traits",
+ "tranquil-lexicon",
+ "tranquil-pds",
+ "tranquil-scopes",
+ "tranquil-types",
+ "urlencoding",
+ "uuid",
+ "webauthn-rs",
+ "zip",
+]
+
 [[package]]
 name = "tranquil-auth"
-version = "0.1.0"
+version = "0.4.6"
 dependencies = [
  "anyhow",
  "base32",
@@ -5978,6 +6157,7 @@ dependencies = [
  "sha2",
  "subtle",
  "totp-rs",
+ "tranquil-config",
  "tranquil-crypto",
  "urlencoding",
  "uuid",
@@ -5985,20 +6165,21 @@ dependencies = [
 
 [[package]]
 name = "tranquil-cache"
-version = "0.1.0"
+version = "0.4.6"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
  "redis",
  "tokio-util",
  "tracing",
+ "tranquil-config",
  "tranquil-infra",
  "tranquil-ripple",
 ]
 
 [[package]]
 name = "tranquil-comms"
-version = "0.1.0"
+version = "0.4.6"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
@@ -6006,13 +6187,22 @@ dependencies = [
  "serde_json",
  "thiserror 2.0.17",
  "tokio",
+ "tranquil-config",
  "tranquil-db-traits",
  "uuid",
 ]
 
+[[package]]
+name = "tranquil-config"
+version = "0.4.6"
+dependencies = [
+ "confique",
+ "serde",
+]
+
 [[package]]
 name = "tranquil-crypto"
-version = "0.1.0"
+version = "0.4.6"
 dependencies = [
  "aes-gcm",
  "base64 0.22.1",
@@ -6028,7 +6218,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-db"
-version = "0.1.0"
+version = "0.4.6"
 dependencies = [
  "async-trait",
  "chrono",
@@ -6045,7 +6235,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-db-traits"
-version = "0.1.0"
+version = "0.4.6"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
@@ -6061,17 +6251,36 @@ dependencies = [
 
 [[package]]
 name = "tranquil-infra"
-version = "0.1.0"
+version = "0.4.6"
 dependencies = [
  "async-trait",
  "bytes",
  "futures",
  "thiserror 2.0.17",
+ "tranquil-config",
+]
+
+[[package]]
+name = "tranquil-lexicon"
+version = "0.4.6"
+dependencies = [
+ "chrono",
+ "hickory-resolver",
+ "parking_lot",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.17",
+ "tokio",
+ "tracing",
+ "unicode-segmentation",
+ "urlencoding",
+ "wiremock",
 ]
 
 [[package]]
 name = "tranquil-oauth"
-version = "0.1.0"
+version = "0.4.6"
 dependencies = [
  "anyhow",
  "axum",
@@ -6092,9 +6301,42 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "tranquil-oauth-server"
+version = "0.4.6"
+dependencies = [
+ "axum",
+ "base64 0.22.1",
+ "bcrypt",
+ "chrono",
+ "cid",
+ "hmac",
+ "http 1.4.0",
+ "jacquard-common",
+ "jacquard-repo",
+ "k256",
+ "rand 0.8.5",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sha2",
+ "subtle",
+ "tokio",
+ "tracing",
+ "tranquil-api",
+ "tranquil-config",
+ "tranquil-crypto",
+ "tranquil-db-traits",
+ "tranquil-pds",
+ "tranquil-types",
+ "urlencoding",
+ "uuid",
+ "webauthn-rs",
+]
+
 [[package]]
 name = "tranquil-pds"
-version = "0.1.0"
+version = "0.4.6"
 dependencies = [
  "aes-gcm",
  "anyhow",
@@ -6112,7 +6354,6 @@ dependencies = [
  "ciborium",
  "cid",
  "ctor",
- "dotenvy",
  "ed25519-dalek",
  "futures",
  "futures-util",
@@ -6157,18 +6398,22 @@ dependencies = [
  "tower-http",
  "tower-layer",
  "tracing",
- "tracing-subscriber",
+ "tranquil-api",
  "tranquil-auth",
  "tranquil-cache",
  "tranquil-comms",
+ "tranquil-config",
  "tranquil-crypto",
  "tranquil-db",
  "tranquil-db-traits",
+ "tranquil-lexicon",
  "tranquil-oauth",
+ "tranquil-oauth-server",
  "tranquil-repo",
  "tranquil-ripple",
  "tranquil-scopes",
  "tranquil-storage",
+ "tranquil-sync",
  "tranquil-types",
  "urlencoding",
  "uuid",
@@ -6179,7 +6424,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-repo"
-version = "0.1.0"
+version = "0.4.6"
 dependencies = [
  "bytes",
  "cid",
@@ -6191,7 +6436,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-ripple"
-version = "0.1.0"
+version = "0.4.6"
 dependencies = [
  "async-trait",
  "backon",
@@ -6199,21 +6444,24 @@ dependencies = [
  "bytes",
  "foca",
  "futures",
+ "metrics",
  "parking_lot",
  "rand 0.9.2",
  "serde",
+ "socket2 0.6.2",
  "thiserror 2.0.17",
  "tokio",
  "tokio-util",
  "tracing",
  "tracing-subscriber",
+ "tranquil-config",
  "tranquil-infra",
  "uuid",
 ]
 
 [[package]]
 name = "tranquil-scopes"
-version = "0.1.0"
+version = "0.4.6"
 dependencies = [
  "axum",
  "futures",
@@ -6221,14 +6469,35 @@ dependencies = [
  "reqwest",
  "serde",
  "serde_json",
+ "thiserror 2.0.17",
  "tokio",
  "tracing",
  "urlencoding",
 ]
 
+[[package]]
+name = "tranquil-server"
+version = "0.4.6"
+dependencies = [
+ "axum",
+ "clap",
+ "dotenvy",
+ "ed25519-dalek",
+ "hex",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "tracing-subscriber",
+ "tranquil-api",
+ "tranquil-config",
+ "tranquil-oauth-server",
+ "tranquil-pds",
+ "tranquil-sync",
+]
+
 [[package]]
 name = "tranquil-storage"
-version = "0.1.0"
+version = "0.4.6"
 dependencies = [
  "async-trait",
  "aws-config",
@@ -6238,13 +6507,36 @@ dependencies = [
  "sha2",
  "tokio",
  "tracing",
+ "tranquil-config",
  "tranquil-infra",
  "uuid",
 ]
 
+[[package]]
+name = "tranquil-sync"
+version = "0.4.6"
+dependencies = [
+ "anyhow",
+ "axum",
+ "bytes",
+ "chrono",
+ "cid",
+ "futures",
+ "ipld-core",
+ "jacquard-repo",
+ "serde",
+ "serde_ipld_dagcbor",
+ "tokio",
+ "tracing",
+ "tranquil-config",
+ "tranquil-db-traits",
+ "tranquil-pds",
+ "tranquil-types",
+]
+
 [[package]]
 name = "tranquil-types"
-version = "0.1.0"
+version = "0.4.6"
 dependencies = [
  "chrono",
  "cid",
@@ -6272,8 +6564,9 @@ dependencies = [
  "http 1.4.0",
  "httparse",
  "log",
- "native-tls",
  "rand 0.9.2",
+ "rustls 0.23.35",
+ "rustls-pki-types",
  "sha1",
  "thiserror 2.0.17",
  "utf-8",
@@ -6285,6 +6578,12 @@ version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
 
+[[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+
 [[package]]
 name = "unicode-bidi"
 version = "0.3.18"
@@ -6422,6 +6721,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
 [[package]]
 name = "uuid"
 version = "1.19.0"
@@ -6996,6 +7301,12 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
 
+[[package]]
+name = "winnow"
+version = "0.7.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
+
 [[package]]
 name = "winreg"
 version = "0.50.0"

Cargo.toml

@@ -2,6 +2,7 @@
 resolver = "2"
 members = [
     "crates/tranquil-types",
+    "crates/tranquil-config",
     "crates/tranquil-infra",
     "crates/tranquil-crypto",
     "crates/tranquil-storage",
@@ -15,15 +16,21 @@ members = [
     "crates/tranquil-db-traits",
     "crates/tranquil-db",
     "crates/tranquil-pds",
+    "crates/tranquil-server",
+    "crates/tranquil-sync",
+    "crates/tranquil-oauth-server",
+    "crates/tranquil-api",
+    "crates/tranquil-lexicon",
 ]
 
 [workspace.package]
-version = "0.2.0"
+version = "0.4.6"
 edition = "2024"
 license = "AGPL-3.0-or-later"
 
 [workspace.dependencies]
 tranquil-types = { path = "crates/tranquil-types" }
+tranquil-config = { path = "crates/tranquil-config" }
 tranquil-infra = { path = "crates/tranquil-infra" }
 tranquil-crypto = { path = "crates/tranquil-crypto" }
 tranquil-storage = { path = "crates/tranquil-storage" }
@@ -36,6 +43,14 @@ tranquil-comms = { path = "crates/tranquil-comms" }
 tranquil-db-traits = { path = "crates/tranquil-db-traits" }
 tranquil-db = { path = "crates/tranquil-db" }
 tranquil-ripple = { path = "crates/tranquil-ripple" }
+tranquil-lexicon = { path = "crates/tranquil-lexicon" }
+tranquil-pds = { path = "crates/tranquil-pds" }
+tranquil-server = { path = "crates/tranquil-server" }
+tranquil-sync = { path = "crates/tranquil-sync" }
+tranquil-oauth-server = { path = "crates/tranquil-oauth-server" }
+tranquil-api = { path = "crates/tranquil-api" }
+
+unicode-segmentation = "1"
 
 aes-gcm = "0.10"
 backon = "1"
@@ -52,6 +67,8 @@ bs58 = "0.5"
 bytes = "1.11"
 chrono = { version = "0.4", features = ["serde"] }
 cid = "0.11"
+clap = { version = "4", features = ["derive", "env"] }
+confique = { version = "0.4", features = ["toml"] }
 dotenvy = "0.15"
 ed25519-dalek = { version = "2.1", features = ["pkcs8"] }
 foca = { version = "1", features = ["bincode-codec", "tracing"] }
@@ -81,7 +98,7 @@ p384 = { version = "0.13", features = ["ecdsa"] }
 rand = "0.8"
 redis = { version = "1.0", features = ["tokio-comp", "connection-manager"] }
 regex = "1"
-reqwest = { version = "0.12", features = ["json"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-webpki-roots", "http2", "charset", "macos-system-configuration"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_bytes = "0.11"
 serde_ipld_dagcbor = "0.6"
@@ -91,12 +108,12 @@ sha2 = "0.10"
 sqlx = { version = "0.8", features = ["runtime-tokio-rustls", "postgres", "uuid", "chrono", "json"] }
 subtle = "2.5"
 thiserror = "2.0"
-tokio = { version = "1.48", features = ["macros", "rt-multi-thread", "time", "signal", "process"] }
+tokio = { version = "1.48", features = ["macros", "rt-multi-thread", "time", "signal", "process", "io-util", "fs"] }
 tokio-util = "0.7.18"
-tokio-tungstenite = { version = "0.28", features = ["native-tls"] }
+tokio-tungstenite = { version = "0.28", features = ["rustls-tls-webpki-roots"] }
 totp-rs = { version = "5", features = ["qr"] }
 tower = "0.5"
-tower-http = { version = "0.6", features = ["cors"] }
+tower-http = { version = "0.6", features = ["fs", "cors"] }
 tower-layer = "0.3"
 tracing = "0.1"
 tracing-subscriber = "0.3"
@@ -111,3 +128,8 @@ ctor = "0.6"
 testcontainers = "0.26"
 testcontainers-modules = { version = "0.14", features = ["postgres"] }
 wiremock = "0.6"
+
+[profile.release]
+lto = "fat"
+strip = true
+codegen-units = 1

Dockerfile

@@ -1,20 +1,62 @@
-FROM rust:1.92-alpine AS builder
-RUN apk add --no-cache ca-certificates openssl openssl-dev openssl-libs-static pkgconfig musl-dev
+FROM denoland/deno:alpine AS frontend
 WORKDIR /app
+COPY frontend/ ./
+RUN deno task build
+
+FROM rust:1.92-alpine AS builder
+RUN apk add --no-cache ca-certificates musl-dev pkgconfig openssl-dev openssl-libs-static mold clang
+ENV RUSTFLAGS="-C linker=clang -C link-arg=-fuse-ld=mold"
+WORKDIR /app
+ARG SLIM="false"
 COPY Cargo.toml Cargo.lock ./
-COPY crates ./crates
 COPY .sqlx ./.sqlx
+COPY crates/tranquil-types ./crates/tranquil-types
+COPY crates/tranquil-crypto ./crates/tranquil-crypto
+COPY crates/tranquil-scopes ./crates/tranquil-scopes
+COPY crates/tranquil-config ./crates/tranquil-config
+COPY crates/tranquil-repo ./crates/tranquil-repo
+COPY crates/tranquil-lexicon ./crates/tranquil-lexicon
+COPY crates/tranquil-oauth ./crates/tranquil-oauth
+COPY crates/tranquil-db-traits ./crates/tranquil-db-traits
+COPY crates/tranquil-infra ./crates/tranquil-infra
+COPY crates/tranquil-auth ./crates/tranquil-auth
+COPY crates/tranquil-comms ./crates/tranquil-comms
+COPY crates/tranquil-db ./crates/tranquil-db
+COPY crates/tranquil-ripple ./crates/tranquil-ripple
+COPY crates/tranquil-storage ./crates/tranquil-storage
+COPY crates/tranquil-cache ./crates/tranquil-cache
+COPY crates/tranquil-pds ./crates/tranquil-pds
+COPY crates/tranquil-sync ./crates/tranquil-sync
+COPY crates/tranquil-api ./crates/tranquil-api
+COPY crates/tranquil-oauth-server ./crates/tranquil-oauth-server
+COPY crates/tranquil-server ./crates/tranquil-server
 COPY migrations ./crates/tranquil-pds/migrations
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/app/target \
-    SQLX_OFFLINE=true cargo build --release -p tranquil-pds && \
-    cp target/release/tranquil-pds /tmp/tranquil-pds
+    if [ "$SLIM" = "true" ]; then \
+      SQLX_OFFLINE=true cargo build --release -p tranquil-server --no-default-features; \
+    else \
+      SQLX_OFFLINE=true cargo build --release -p tranquil-server; \
+    fi && \
+    cp target/release/tranquil-server /tmp/tranquil-pds
 
-FROM alpine:3.23
-RUN apk add --no-cache msmtp ca-certificates && ln -sf /usr/bin/msmtp /usr/sbin/sendmail
+FROM alpine:3.23 AS signal-cli
+RUN apk add --no-cache curl tar
+ARG SIGNAL_CLI_VERSION=0.13.24
+RUN curl -fsSL "https://github.com/AsamK/signal-cli/releases/download/v${SIGNAL_CLI_VERSION}/signal-cli-${SIGNAL_CLI_VERSION}-Linux-native.tar.gz" \
+    | tar xz -C /usr/local/bin
+
+FROM debian:trixie-slim
+RUN apt-get update && apt-get install -y --no-install-recommends msmtp ca-certificates \
+    && rm -rf /var/lib/apt/lists/* \
+    && ln -sf /usr/bin/msmtp /usr/sbin/sendmail
+COPY --from=signal-cli /usr/local/bin/signal-cli /usr/local/bin/signal-cli
+VOLUME /var/lib/signal-cli
 COPY --from=builder /tmp/tranquil-pds /usr/local/bin/tranquil-pds
+COPY --from=frontend /app/dist /var/lib/tranquil-pds/frontend
 COPY migrations /app/migrations
 WORKDIR /app
+ENV SIGNAL_CLI_CONFIG=/var/lib/signal-cli
 ENV SERVER_HOST=0.0.0.0
 ENV SERVER_PORT=3000
 EXPOSE 3000

README.md

@@ -6,27 +6,28 @@ Bluesky runs on a federated protocol called AT Protocol. Your account lives on a
 
 This particular PDS thrives under harsh conditions. It is a dandelion growing through the cracks in the sidewalk concrete.
 
-It has full compatibility with Bluesky's reference PDS: same endpoints, same behavior, same client compatibility. Everything works: repo operations, blob storage, firehose, OAuth, handle resolution, account migration, the lot.
-
-Another excellent PDS is [Cocoon](https://tangled.org/hailey.at/cocoon), written in go.
+It has full compatibility with Bluesky's reference PDS.
 
 ## What's different about Tranquil PDS
 
-It is a superset of the reference PDS, including: passkeys and 2FA (WebAuthn/FIDO2, TOTP, backup codes, trusted devices), SSO login and signup, did:web support (PDS-hosted subdomains or bring-your-own), multi-channel communication (email, discord, telegram, signal) for verification and alerts, granular OAuth scopes with a consent UI showing human-readable descriptions, app passwords with granular permissions (read-only, post-only, or custom scopes), account delegation (letting others manage an account with configurable permission levels), automatic backups (configurable retention and frequency, one-click restore), and a built-in web UI for account management, OAuth consent, repo browsing, and admin.
+It is a superset of the reference PDS, including: passkeys and 2FA (WebAuthn/FIDO2, TOTP, backup codes, trusted devices), SSO login and signup, did:web support (PDS-hosted subdomains or bring-your-own), multi-channel communication (email, discord, telegram, signal) for verification and alerts, granular OAuth scopes with a consent UI showing human-readable descriptions, app passwords with granular permissions (read-only, post-only, or custom scopes), account delegation (letting others manage an account with configurable permission levels), and a built-in web UI for account management, repo browsing, and admin.
 
-The PDS itself is a single small binary with no node/npm runtime. It requires postgres. Blobs are stored on the local filesystem by default (S3 optional). Valkey is optional (supported as an alternative to the built-in cache).
+The PDS itself is a single binary with no nodeJS runtime. However, at time of writing, Tranquil requires postgres running separately. Blobs are stored on the local filesystem by default (S3 optional). Valkey is also optional (as an alternative to the built-in cache).
 
 ## Quick Start
 
 ```bash
-cp .env.example .env
-podman compose up -d
+cp example.toml config.toml
+podman compose up db -d
 just run
 ```
 
 ## Configuration
 
-See `.env.example` for all configuration options.
+See `example.toml` for all configuration options.
+
+> [!NOTE]
+> The order of configuration precedence is: environment variables, then a config file passed via `--config`, then `/etc/tranquil-pds/config.toml`, then the built-in defaults. So you can use environment variables, or a config file, or both.
 
 ## Development
 
@@ -41,20 +42,18 @@ just lint
 
 ### Quick Deploy (Docker/Podman Compose)
 
-Edit `.env.prod` with your values. Generate secrets with `openssl rand -base64 48`.
+Edit `config.toml` with your values. Generate secrets with `openssl rand -base64 48`.
 
 ```bash
-cp .env.prod.example .env.prod
+cp example.toml config.toml
 podman-compose -f docker-compose.prod.yaml up -d
 ```
 
 ### Installation Guides
 
-| Guide | Best For |
-|-------|----------|
-| [Debian](docs/install-debian.md) | Debian 13+ with systemd |
-| [Containers](docs/install-containers.md) | Podman with quadlets or OpenRC |
-| [Kubernetes](docs/install-kubernetes.md) | You know what you're doing |
+- [Debian](docs/install-debian.md)
+- [Containers](docs/install-containers.md)
+- [Kubernetes](docs/install-kubernetes.md)
 
 ## Maintainers to ping
 

TODO.md

@@ -1,160 +0,0 @@
-# Lewis' Big Boy TODO list
-
-## Active development
-
-### Storage backend abstraction
-Make storage layers swappable via traits.
-
-filesystem blob storage
-- [ ] FilesystemBlobStorage implementation
-- [ ] directory structure (content-addressed like blobs/{cid} already used in objsto)
-- [ ] atomic writes (write to temp, rename)
-- [ ] config option to choose backend (env var or config flag)
-- [ ] also traitify BackupStorage (currently hardcoded to objsto)
-
-sqlite database backend
-- [ ] abstract db layer behind trait (queries, transactions, migrations)
-- [ ] sqlite implementation matching postgres behavior
-- [ ] handle sqlite's single-writer limitation (connection pooling strategy)
-- [ ] migrations system that works for both
-- [ ] testing: run full test suite against both backends
-- [ ] config option to choose backend (postgres vs sqlite)
-- [ ] document tradeoffs (sqlite for single-user/small, postgres for multi-user/scale)
-
-### Plugin system
-WASM component model plugins. Compile to wasm32-wasip2, sandboxed via wasmtime, capability-gated. Based on zed's extensions.
-
-WIT interface
-- [ ] record hooks before/after create, update, delete
-- [ ] blob hooks before/after upload, validate
-- [ ] xrpc hooks before/after (middleware), custom endpoint handler
-- [ ] firehose hook on_commit
-- [ ] host imports http client, kv store, logging, read records
-
-wasmtime host
-- [ ] engine with epoch interruption (kill runaway plugins)
-- [ ] plugin manifest (plugin.toml): id, version, capabilities, hooks
-- [ ] capability enforcement at runtime
-- [ ] plugin loader, lifecycle (enable/disable/reload)
-- [ ] resource limits (memory, time)
-- [ ] per-plugin fs sandbox
-
-capabilities
-- [ ] http:fetch with domain allowlist
-- [ ] kv:read, kv:write
-- [ ] record:read, blob:read
-- [ ] xrpc:register
-- [ ] firehose:subscribe
-
-pds-plugin-api (rust), MVP for plugin system
-- [ ] plugin trait with default impls
-- [ ] register_plugin! macro
-- [ ] typed host import wrappers
-- [ ] publish to crates.io
-- [ ] docs + example
-
-pds-plugin-api in golang, nice to have after the fact
-- [ ] wit-bindgen-go bindings
-- [ ] go wrappers
-- [ ] tinygo build instructions
-- [ ] example
-
-@pds/plugin-api in typescript, nice to have after the fact
-- [ ] jco/componentize-js bindings
-- [ ] typeScript types
-- [ ] build tooling
-- [ ] example
-
-example plugins
-- [ ] content filter
-- [ ] webhook notifier
-- [ ] objsto backup mirror
-- [ ] custom lexicon handler
-- [ ] better audit logger
-
-### Misc
-
-cross-pds delegation
-when a client (eg. tangled.org) tries to log into a delegated account:
-- [ ] client starts oauth flow to delegated account's pds
-- [ ] delegated pds sees account is externally controlled, launches oauth to controller's pds (delegated pds acts as oauth client)
-- [ ] controller authenticates at their own pds
-- [ ] delegated pds verifies controller perms and scope from its local delegation grants
-- [ ] delegated pds issues session to client within the intersection of controller's granted scope and client's requested scope
-
-per-request "act as"
-- [ ] authed as user X, perform action as delegated user Y in single request
-- [ ] approach decision
-  - [ ] option 1: `X-Act-As` header with target did, server verifies delegation grant
-  - [ ] option 2: token exchange (RFC 8693) for short-lived delegated token
-  - [ ] option 3 (lewis fav): extend existing `act` claim to support on-demand minting
-  - [ ] something else?
-
-### Private/encrypted data
-Records only authorized parties can see and decrypt.
-
-research
-- [ ] survey atproto discourse on private data
-- [ ] document bluesky team's likely approach. wait.. are they even gonna do this? whatever
-- [ ] look at matrix/signal for federated e2ee patterns
-
-key management
-- [ ] db schema for encryption keys (user_keys, key_grants, key_rotations)
-- [ ] per-user encryption keypair generation (separate from signing keys)
-- [ ] key derivation scheme (per-collection? per-record? both?)
-- [ ] key storage (encrypted at rest, hsm option?)
-- [ ] rotation and revocation flow
-
-storage layer
-- [ ] encrypted record format (encrypted cbor blob + metadata)
-- [ ] collection-level vs per-record encryption flag
-- [ ] how encrypted records appear in mst (hash of ciphertext? separate tree?)
-- [ ] blob encryption (same keys? separate?)
-
-api surface
-- [ ] xrpc getPublicKey, grantAccess, revokeAccess, listGrants
-- [ ] xrpc getEncryptedRecord (ciphertext for client-side decrypt)
-- [ ] or transparent server-side decrypt if requester has grant?
-- [ ] lexicon for key grant records
-
-sync/federation
-- [ ] how encrypted records appear on firehose (ciphertext? omitted? placeholder?)
-- [ ] pds-to-pds key exchange protocol
-- [ ] appview behavior (can't index without grants)
-- [ ] relay behavior with encrypted commits
-
-client integration
-- [ ] client-side encryption (pds never sees plaintext) vs server-side with trust
-- [ ] key backup/recovery (lose key = lose data)
-
-plugin hooks (once core exists)
-- [ ] on_access_grant_request for custom authorization
-- [ ] on_key_rotation to notify interested parties
-
----
-
-## Completed
-
-Core ATProto: Health, describeServer, all session endpoints, full repo CRUD, applyWrites, blob upload, importRepo, firehose with cursor replay, CAR export, blob sync, crawler notifications, handle resolution, PLC operations, full admin API, moderation reports.
-
-did:web support: Self-hosted did:web (subdomain format `did:web:handle.pds.com`), external/BYOD did:web, DID document serving via `/.well-known/did.json`, clear registration warnings about did:web trade-offs vs did:plc.
-
-OAuth 2.1: Authorization server metadata, JWKS, PAR, authorize endpoint with login UI, token endpoint (auth code + refresh), revocation, introspection, DPoP, PKCE S256, client metadata validation, private_key_jwt verification.
-
-OAuth Scope Enforcement: Full granular scope system with consent UI, human-readable scope descriptions, per-client scope preferences, scope parsing (repo/blob/rpc/account/identity), endpoint-level scope checks, DPoP token support in auth extractors, token revocation on re-authorization, response_mode support (query/fragment).
-
-App endpoints: getPreferences, putPreferences, getProfile, getProfiles, getTimeline, getAuthorFeed, getActorLikes, getPostThread, getFeed, registerPush (all with local-first + proxy fallback).
-
-Infrastructure: Sequencer with cursor replay, postgres repo storage with atomic transactions, valkey DID cache, debounced crawler notifications with circuit breakers, multi-channel notifications (email/Discord/Telegram/Signal), image processing, distributed rate limiting, security hardening.
-
-Web UI: OAuth login, registration, email verification, password reset, multi-account selector, dashboard, sessions, app passwords, invites, notification preferences, repo browser, CAR export, admin panel, OAuth consent screen with scope selection.
-
-Auth: ES256K + HS256 dual support, JTI-only token storage, refresh token family tracking, encrypted signing keys (AES-256-GCM), DPoP replay protection, constant-time comparisons.
-
-Passkeys and 2FA: WebAuthn/FIDO2 passkey registration and authentication, TOTP with QR setup, backup codes (hashed, one-time use), passkey-only account creation, trusted devices (remember this browser), re-auth for sensitive actions, rate-limited 2FA attempts, settings UI for managing all auth methods.
-
-App password scopes: Granular permissions for app passwords using the same scope system as OAuth. Preset buttons for common use cases (full access, read-only, post-only), scope stored in session and preserved across token refresh, explicit RPC/repo/blob scope enforcement for restricted passwords.
-
-Account Delegation: Delegated accounts controlled by other accounts instead of passwords. OAuth delegation flow (authenticate as controller), scope-based permissions (owner/admin/editor/viewer presets), scope intersection (tokens limited to granted permissions), `act` claim for delegation tracking, creating delegated account flow, controller management UI, "act as" account switcher, comprehensive audit logging with actor/controller tracking, delegation-aware OAuth consent with permission limitation notices.
-
-Migration: OAuth-based inbound migration wizard with PLC token flow, offline restore from CAR file + rotation key for disaster recovery, scheduled automatic backups, standalone repo/blob export, did:web DID document editor for self-service identity management, handle preservation (keep existing external handle via DNS/HTTP verification or create new PDS-subdomain handle).

crates/tranquil-api/Cargo.toml

@@ -0,0 +1,50 @@
+[package]
+name = "tranquil-api"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+tranquil-pds = { workspace = true }
+tranquil-types = { workspace = true }
+tranquil-config = { workspace = true }
+tranquil-db = { workspace = true }
+tranquil-db-traits = { workspace = true }
+tranquil-lexicon = { workspace = true, features = ["resolve"] }
+tranquil-scopes = { workspace = true }
+
+anyhow = { workspace = true }
+axum = { workspace = true }
+backon = { workspace = true }
+base32 = { workspace = true }
+base64 = { workspace = true }
+bcrypt = { workspace = true }
+bs58 = { workspace = true }
+bytes = { workspace = true }
+chrono = { workspace = true }
+cid = { workspace = true }
+ed25519-dalek = { workspace = true }
+futures = { workspace = true }
+hex = { workspace = true }
+http = { workspace = true }
+infer = { workspace = true }
+ipld-core = { workspace = true }
+jacquard-common = { workspace = true }
+jacquard-repo = { workspace = true }
+k256 = { workspace = true }
+multibase = { workspace = true }
+multihash = { workspace = true }
+rand = { workspace = true }
+reqwest = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+serde_ipld_dagcbor = { workspace = true }
+sha2 = { workspace = true }
+subtle = { workspace = true }
+thiserror = { workspace = true }
+tokio = { workspace = true }
+tracing = { workspace = true }
+urlencoding = { workspace = true }
+uuid = { workspace = true }
+webauthn-rs = { workspace = true }
+zip = { workspace = true }

crates/tranquil-api/src/actor/preferences.rs

@@ -1,6 +1,3 @@
-use crate::api::error::ApiError;
-use crate::auth::{Auth, NotTakendown, Permissive};
-use crate::state::AppState;
 use axum::{
     Json,
     extract::State,
@@ -10,6 +7,9 @@ use axum::{
 use chrono::{Datelike, NaiveDate, Utc};
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
+use tranquil_pds::api::error::ApiError;
+use tranquil_pds::auth::{Auth, NotTakendown, Permissive};
+use tranquil_pds::state::AppState;
 
 const APP_BSKY_NAMESPACE: &str = "app.bsky";
 const MAX_PREFERENCES_COUNT: usize = 100;
@@ -21,7 +21,7 @@ fn get_age_from_datestring(birth_date: &str) -> Option<i32> {
     let bday = NaiveDate::parse_from_str(birth_date, "%Y-%m-%d").ok()?;
     let today = Utc::now().date_naive();
     let mut age = today.year() - bday.year();
-    let m = today.month() as i32 - bday.month() as i32;
+    let m = i32::try_from(today.month()).unwrap_or(0) - i32::try_from(bday.month()).unwrap_or(0);
     if m < 0 || (m == 0 && today.day() < bday.day()) {
         age -= 1;
     }

crates/tranquil-api/src/admin/account/delete.rs

@@ -1,8 +1,3 @@
-use crate::api::EmptyResponse;
-use crate::api::error::{ApiError, DbResultExt};
-use crate::auth::{Admin, Auth};
-use crate::state::AppState;
-use crate::types::Did;
 use axum::{
     Json,
     extract::State,
@@ -10,6 +5,11 @@ use axum::{
 };
 use serde::Deserialize;
 use tracing::warn;
+use tranquil_pds::api::EmptyResponse;
+use tranquil_pds::api::error::{ApiError, DbResultExt};
+use tranquil_pds::auth::{Admin, Auth};
+use tranquil_pds::state::AppState;
+use tranquil_pds::types::Did;
 
 #[derive(Deserialize)]
 pub struct DeleteAccountInput {
@@ -36,7 +36,7 @@ pub async fn delete_account(
         .await
         .log_db_err("deleting account")?;
 
-    if let Err(e) = crate::api::repo::record::sequence_account_event(
+    if let Err(e) = tranquil_pds::repo_ops::sequence_account_event(
         &state,
         did,
         tranquil_db_traits::AccountStatus::Deleted,
@@ -48,6 +48,9 @@ pub async fn delete_account(
             did, e
         );
     }
-    let _ = state.cache.delete(&format!("handle:{}", handle)).await;
+    let _ = state
+        .cache
+        .delete(&tranquil_pds::cache_keys::handle_key(&handle))
+        .await;
     Ok(EmptyResponse::ok().into_response())
 }

crates/tranquil-api/src/admin/account/email.rs

@@ -1,8 +1,3 @@
-use crate::api::error::{ApiError, AtpJson, DbResultExt};
-use crate::auth::{Admin, Auth};
-use crate::state::AppState;
-use crate::types::Did;
-use crate::util::pds_hostname;
 use axum::{
     Json,
     extract::State,
@@ -11,6 +6,10 @@ use axum::{
 };
 use serde::{Deserialize, Serialize};
 use tracing::warn;
+use tranquil_pds::api::error::{ApiError, DbResultExt};
+use tranquil_pds::auth::{Admin, Auth};
+use tranquil_pds::state::AppState;
+use tranquil_pds::types::Did;
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -30,7 +29,7 @@ pub struct SendEmailOutput {
 pub async fn send_email(
     State(state): State<AppState>,
     _auth: Auth<Admin>,
-    AtpJson(input): AtpJson<SendEmailInput>,
+    Json(input): Json<SendEmailInput>,
 ) -> Result<Response, ApiError> {
     let content = input.content.trim();
     if content.is_empty() {
@@ -45,7 +44,7 @@ pub async fn send_email(
 
     let email = user.email.ok_or(ApiError::NoEmail)?;
     let (user_id, handle) = (user.id, user.handle);
-    let hostname = pds_hostname();
+    let hostname = &tranquil_config::get().server.hostname;
     let subject = input
         .subject
         .clone()

crates/tranquil-api/src/admin/account/info.rs

@@ -1,7 +1,3 @@
-use crate::api::error::{ApiError, DbResultExt};
-use crate::auth::{Admin, Auth};
-use crate::state::AppState;
-use crate::types::{Did, Handle};
 use axum::{
     Json,
     extract::{Query, RawQuery, State},
@@ -10,6 +6,10 @@ use axum::{
 };
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
+use tranquil_pds::api::error::{ApiError, DbResultExt};
+use tranquil_pds::auth::{Admin, Auth};
+use tranquil_pds::state::AppState;
+use tranquil_pds::types::{Did, Handle};
 
 #[derive(Deserialize)]
 pub struct GetAccountInfoParams {
@@ -196,10 +196,11 @@ pub async fn get_account_infos(
     _auth: Auth<Admin>,
     RawQuery(raw_query): RawQuery,
 ) -> Result<Response, ApiError> {
-    let dids: Vec<String> = crate::util::parse_repeated_query_param(raw_query.as_deref(), "dids")
-        .into_iter()
-        .filter(|d| !d.is_empty())
-        .collect();
+    let dids: Vec<String> =
+        tranquil_pds::util::parse_repeated_query_param(raw_query.as_deref(), "dids")
+            .into_iter()
+            .filter(|d| !d.is_empty())
+            .collect();
 
     if dids.is_empty() {
         return Err(ApiError::InvalidRequest("dids is required".into()));

crates/tranquil-api/src/admin/account/search.rs

@@ -1,7 +1,3 @@
-use crate::api::error::{ApiError, DbResultExt};
-use crate::auth::{Admin, Auth};
-use crate::state::AppState;
-use crate::types::{Did, Handle};
 use axum::{
     Json,
     extract::{Query, State},
@@ -9,6 +5,10 @@ use axum::{
     response::{IntoResponse, Response},
 };
 use serde::{Deserialize, Serialize};
+use tranquil_pds::api::error::{ApiError, DbResultExt};
+use tranquil_pds::auth::{Admin, Auth};
+use tranquil_pds::state::AppState;
+use tranquil_pds::types::{Did, Handle};
 
 #[derive(Deserialize)]
 pub struct SearchAccountsParams {
@@ -67,10 +67,11 @@ pub async fn search_accounts(
         .await
         .log_db_err("in search_accounts")?;
 
-    let has_more = rows.len() > limit as usize;
+    let limit_usize = usize::try_from(limit).unwrap_or(0);
+    let has_more = rows.len() > limit_usize;
     let accounts: Vec<AccountView> = rows
         .into_iter()
-        .take(limit as usize)
+        .take(limit_usize)
         .map(|row| AccountView {
             did: row.did.clone(),
             handle: row.handle,

crates/tranquil-api/src/admin/account/update.rs

@@ -1,9 +1,3 @@
-use crate::api::EmptyResponse;
-use crate::api::error::ApiError;
-use crate::auth::{Admin, Auth};
-use crate::state::AppState;
-use crate::types::{Did, Handle, PlainPassword};
-use crate::util::pds_hostname_without_port;
 use axum::{
     Json,
     extract::State,
@@ -11,6 +5,11 @@ use axum::{
 };
 use serde::Deserialize;
 use tracing::{error, warn};
+use tranquil_pds::api::EmptyResponse;
+use tranquil_pds::api::error::ApiError;
+use tranquil_pds::auth::{Admin, Auth};
+use tranquil_pds::state::AppState;
+use tranquil_pds::types::{Did, Handle, PlainPassword};
 
 #[derive(Deserialize)]
 pub struct UpdateAccountEmailInput {
@@ -70,9 +69,9 @@ pub async fn update_account_handle(
     {
         return Err(ApiError::InvalidHandle(None));
     }
-    let hostname_for_handles = pds_hostname_without_port();
+    let available_domains = tranquil_config::get().server.available_user_domain_list();
     let handle = if !input_handle.contains('.') {
-        format!("{}.{}", input_handle, hostname_for_handles)
+        format!("{}.{}", input_handle, &available_domains[0])
     } else {
         input_handle.to_string()
     };
@@ -84,7 +83,7 @@ pub async fn update_account_handle(
         .ok()
         .flatten()
         .ok_or(ApiError::AccountNotFound)?;
-    let handle_for_check = unsafe { Handle::new_unchecked(&handle) };
+    let handle_for_check: Handle = handle.parse().map_err(|_| ApiError::InvalidHandle(None))?;
     if let Ok(true) = state
         .user_repo
         .check_handle_exists(&handle_for_check, user_id)
@@ -100,10 +99,16 @@ pub async fn update_account_handle(
         Ok(0) => Err(ApiError::AccountNotFound),
         Ok(_) => {
             if let Some(old) = old_handle {
-                let _ = state.cache.delete(&format!("handle:{}", old)).await;
+                let _ = state
+                    .cache
+                    .delete(&tranquil_pds::cache_keys::handle_key(&old))
+                    .await;
             }
-            let _ = state.cache.delete(&format!("handle:{}", handle)).await;
-            if let Err(e) = crate::api::repo::record::sequence_identity_event(
+            let _ = state
+                .cache
+                .delete(&tranquil_pds::cache_keys::handle_key(&handle))
+                .await;
+            if let Err(e) = tranquil_pds::repo_ops::sequence_identity_event(
                 &state,
                 did,
                 Some(&handle_for_check),
@@ -116,7 +121,7 @@ pub async fn update_account_handle(
                 );
             }
             if let Err(e) =
-                crate::api::identity::did::update_plc_handle(&state, did, &handle_for_check).await
+                crate::identity::did::update_plc_handle(&state, did, &handle_for_check).await
             {
                 warn!("Failed to update PLC handle for admin handle update: {}", e);
             }

crates/tranquil-api/src/admin/config.rs

@@ -1,9 +1,9 @@
-use crate::api::error::{ApiError, DbResultExt};
-use crate::auth::{Admin, Auth};
-use crate::state::AppState;
 use axum::{Json, extract::State};
 use serde::{Deserialize, Serialize};
-use tracing::error;
+use tracing::{error, warn};
+use tranquil_pds::api::error::{ApiError, DbResultExt};
+use tranquil_pds::auth::{Admin, Auth};
+use tranquil_pds::state::AppState;
 use tranquil_types::CidLink;
 
 #[derive(Serialize)]
@@ -187,15 +187,24 @@ pub async fn update_server_config(
         };
 
         if let Some(old_cid_str) = should_delete_old {
-            let old_cid = unsafe { CidLink::new_unchecked(old_cid_str) };
-            if let Ok(Some(storage_key)) =
-                state.infra_repo.get_blob_storage_key_by_cid(&old_cid).await
-            {
-                if let Err(e) = state.blob_store.delete(&storage_key).await {
-                    error!("Failed to delete old logo blob from storage: {:?}", e);
+            match CidLink::new(old_cid_str) {
+                Ok(old_cid) => {
+                    if let Ok(Some(storage_key)) =
+                        state.infra_repo.get_blob_storage_key_by_cid(&old_cid).await
+                    {
+                        if let Err(e) = state.blob_store.delete(&storage_key).await {
+                            error!("Failed to delete old logo blob from storage: {:?}", e);
+                        }
+                        if let Err(e) = state.infra_repo.delete_blob_by_cid(&old_cid).await {
+                            error!("Failed to delete old logo blob record: {:?}", e);
+                        }
+                    }
                 }
-                if let Err(e) = state.infra_repo.delete_blob_by_cid(&old_cid).await {
-                    error!("Failed to delete old logo blob record: {:?}", e);
+                Err(e) => {
+                    warn!(
+                        "Old logo CID in database is invalid, skipping cleanup: {:?}",
+                        e
+                    );
                 }
             }
         }

crates/tranquil-api/src/admin/invite.rs

@@ -1,7 +1,3 @@
-use crate::api::EmptyResponse;
-use crate::api::error::{ApiError, DbResultExt};
-use crate::auth::{Admin, Auth};
-use crate::state::AppState;
 use axum::{
     Json,
     extract::{Query, State},
@@ -11,6 +7,10 @@ use axum::{
 use serde::{Deserialize, Serialize};
 use tracing::error;
 use tranquil_db_traits::InviteCodeSortOrder;
+use tranquil_pds::api::EmptyResponse;
+use tranquil_pds::api::error::{ApiError, DbResultExt};
+use tranquil_pds::auth::{Admin, Auth};
+use tranquil_pds::state::AppState;
 
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -144,7 +144,7 @@ pub async fn get_invite_codes(
         })
         .collect();
 
-    let next_cursor = if codes_rows.len() == limit as usize {
+    let next_cursor = if codes_rows.len() == usize::try_from(limit).unwrap_or(0) {
         codes_rows.last().map(|r| r.code.clone())
     } else {
         None

crates/tranquil-api/src/admin/server_stats.rs

@@ -1,12 +1,12 @@
-use crate::api::error::ApiError;
-use crate::auth::{Admin, Auth};
-use crate::state::AppState;
 use axum::{
     Json,
     extract::State,
     response::{IntoResponse, Response},
 };
 use serde::Serialize;
+use tranquil_pds::api::error::ApiError;
+use tranquil_pds::auth::{Admin, Auth};
+use tranquil_pds::state::AppState;
 
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]

crates/tranquil-api/src/admin/status.rs

@@ -1,7 +1,3 @@
-use crate::api::error::ApiError;
-use crate::auth::{Admin, Auth};
-use crate::state::AppState;
-use crate::types::{CidLink, Did};
 use axum::{
     Json,
     extract::{Query, State},
@@ -11,6 +7,10 @@ use axum::{
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use tracing::{error, warn};
+use tranquil_pds::api::error::ApiError;
+use tranquil_pds::auth::{Admin, Auth};
+use tranquil_pds::state::AppState;
+use tranquil_pds::types::{CidLink, Did};
 
 #[derive(Deserialize)]
 pub struct GetSubjectStatusParams {
@@ -175,7 +175,10 @@ pub async fn update_subject_status(
         Some("com.atproto.admin.defs#repoRef") => {
             let did_str = input.subject.get("did").and_then(|d| d.as_str());
             if let Some(did_str) = did_str {
-                let did = unsafe { Did::new_unchecked(did_str) };
+                let did: Did = match did_str.parse() {
+                    Ok(d) => d,
+                    Err(_) => return Err(ApiError::InvalidDid("Invalid DID format".into())),
+                };
                 if let Some(takedown) = &input.takedown {
                     let takedown_ref = if takedown.applied {
                         takedown.r#ref.as_deref()
@@ -212,7 +215,7 @@ pub async fn update_subject_status(
                         tranquil_db_traits::AccountStatus::Active
                     };
                     if let Err(e) =
-                        crate::api::repo::record::sequence_account_event(&state, &did, status).await
+                        tranquil_pds::repo_ops::sequence_account_event(&state, &did, status).await
                     {
                         warn!("Failed to sequence account event for takedown: {}", e);
                     }
@@ -224,13 +227,16 @@ pub async fn update_subject_status(
                         tranquil_db_traits::AccountStatus::Active
                     };
                     if let Err(e) =
-                        crate::api::repo::record::sequence_account_event(&state, &did, status).await
+                        tranquil_pds::repo_ops::sequence_account_event(&state, &did, status).await
                     {
                         warn!("Failed to sequence account event for deactivation: {}", e);
                     }
                 }
                 if let Ok(Some(handle)) = state.user_repo.get_handle_by_did(&did).await {
-                    let _ = state.cache.delete(&format!("handle:{}", handle)).await;
+                    let _ = state
+                        .cache
+                        .delete(&tranquil_pds::cache_keys::handle_key(&handle))
+                        .await;
                 }
                 return Ok((
                     StatusCode::OK,