totp: let legacy sessions disable totp

Lewis: May this revision serve well! <lu5a@proton.me>

.config/nextest.toml

@@ -25,6 +25,28 @@ fail-fast = false
 test-threads = "num-cpus"
 slow-timeout = { period = "300s", terminate-after = 2 }
 
+[profile.gauntlet-pr]
+retries = 0
+fail-fast = true
+test-threads = "num-cpus"
+slow-timeout = { period = "60s", terminate-after = 5 }
+
+[[profile.gauntlet-pr.overrides]]
+filter = "binary(gauntlet_smoke)"
+slow-timeout = { period = "300s", terminate-after = 2 }
+
+[profile.gauntlet-nightly]
+retries = 0
+fail-fast = false
+test-threads = "num-cpus"
+slow-timeout = { period = "600s", terminate-after = 1 }
+
+[profile.gauntlet-soak]
+retries = 0
+fail-fast = false
+test-threads = 1
+slow-timeout = { period = "5m", terminate-after = 1000 }
+
 [test-groups]
 serial-env-tests = { max-threads = 1 }
 heavy-load-tests = { max-threads = 4 }
@@ -46,6 +68,10 @@ test-group = "serial-env-tests"
 filter = "package(tranquil-signal)"
 test-group = "serial-env-tests"
 
+[[profile.default.overrides]]
+filter = "package(tranquil-config)"
+test-group = "serial-env-tests"
+
 [[profile.default.overrides]]
 filter = "binary(whole_story)"
 test-group = "heavy-load-tests"
@@ -72,10 +98,24 @@ test-group = "io-heavy-sim"
 filter = "test(/test_scale_/) | test(/full_backup_and_restore/)"
 slow-timeout = { period = "120s", terminate-after = 4 }
 
+[[profile.default.overrides]]
+filter = "binary(gauntlet_smoke)"
+slow-timeout = { period = "300s", terminate-after = 8 }
+
 [[profile.default.overrides]]
 filter = "binary(compaction_restart) | binary(mst_refcount_integrity) | binary(gc_compaction_restart)"
 slow-timeout = { period = "120s", terminate-after = 4 }
 
+[[profile.default.overrides]]
+filter = "test(/retention_time_travel_survives_many_seeds/)"
+slow-timeout = { period = "300s", terminate-after = 24 }
+test-group = "io-heavy-sim"
+
+[[profile.default.overrides]]
+filter = "binary(fd_lifecycle)"
+slow-timeout = { period = "300s", terminate-after = 4 }
+test-group = "io-heavy-sim"
+
 [[profile.ci.overrides]]
 filter = "test(/import_with_verification/) | test(/plc_migration/)"
 test-group = "serial-env-tests"
@@ -92,6 +132,10 @@ test-group = "serial-env-tests"
 filter = "package(tranquil-signal)"
 test-group = "serial-env-tests"
 
+[[profile.ci.overrides]]
+filter = "package(tranquil-config)"
+test-group = "serial-env-tests"
+
 [[profile.ci.overrides]]
 filter = "binary(whole_story)"
 test-group = "heavy-load-tests"
@@ -103,3 +147,13 @@ test-group = "heavy-load-tests"
 [[profile.ci.overrides]]
 filter = "binary(repo_lifecycle)"
 test-group = "heavy-load-tests"
+
+[[profile.ci.overrides]]
+filter = "test(/retention_time_travel_survives_many_seeds/)"
+slow-timeout = { period = "300s", terminate-after = 24 }
+test-group = "io-heavy-sim"
+
+[[profile.ci.overrides]]
+filter = "binary(fd_lifecycle)"
+slow-timeout = { period = "300s", terminate-after = 4 }
+test-group = "io-heavy-sim"

.containerignore

@@ -0,0 +1,12 @@
+target/
+.git/
+.jj/
+**/node_modules/
+frontend/dist/
+frontend/coverage/
+frontend/.pnpm-store/
+.direnv/
+result
+.env
+*.output
+reference-pds-bsky/

.gitignore

@@ -1,6 +1,9 @@
-/target
+target/
 .env
 .direnv
 result
 frontend/node_modules/
 frontend/dist/
+frontend/coverage/
+frontend/.pnpm-store
+frontend/.npmrc

.sqlx/query-09142b5a6b91fe4fd795fb6c85af5461e2621f6c3545b6d26e4618d813904b75.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT nextval('firehose_seq') as \"seq!\"",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "seq!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "09142b5a6b91fe4fd795fb6c85af5461e2621f6c3545b6d26e4618d813904b75"
+}

.sqlx/query-0b895d105363a60040323c5c47bc897905af3da980d0dc1b3b60bbdcdd90ea7a.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE repo_seq r\n           SET seq = $1::bigint + (o.ord - 1)\n           FROM unnest($2::bigint[]) WITH ORDINALITY AS o(id, ord)\n           WHERE r.id = o.id",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8Array"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "0b895d105363a60040323c5c47bc897905af3da980d0dc1b3b60bbdcdd90ea7a"
+}

.sqlx/query-0bb2cb6af37bff735b6b380697fc8e1fa2034ca0600e8c16e1e362b722192327.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "UPDATE invite_codes SET available_uses = available_uses - 1 WHERE code = $1",
+  "query": "UPDATE invite_codes SET available_uses = available_uses - 1 WHERE code = $1 AND available_uses > 0 AND COALESCE(disabled, false) = false",
   "describe": {
     "columns": [],
     "parameters": {
@@ -10,5 +10,5 @@
     },
     "nullable": []
   },
-  "hash": "1ee6eda3e44660e7f14fcfe56adc2d41c72901b9c701fc7b992314e5370b32dc"
+  "hash": "0bb2cb6af37bff735b6b380697fc8e1fa2034ca0600e8c16e1e362b722192327"
 }

.sqlx/query-122d79e006c0e11214e3cf11cfb98bdff6fbf156893b482572532ebcd8979e61.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            DELETE FROM repo_seq\n            WHERE did = $1\n              AND id <> (SELECT id FROM repo_seq WHERE did = $1 ORDER BY id DESC LIMIT 1)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "122d79e006c0e11214e3cf11cfb98bdff6fbf156893b482572532ebcd8979e61"
+}

.sqlx/query-18bbda5582db1b32d02ab8a3eee970c9508b9bd67239c2f936639a9f863b30ff.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT id, did, handle, email, created_at, deactivated_at, takedown_ref, is_admin\n               FROM users WHERE did = $1",
+  "query": "SELECT id, did, handle, email, created_at, deactivated_at, takedown_ref, is_admin, inbound_migration\n               FROM users WHERE handle = $1",
   "describe": {
     "columns": [
       {
@@ -42,6 +42,11 @@
         "ordinal": 7,
         "name": "is_admin",
         "type_info": "Bool"
+      },
+      {
+        "ordinal": 8,
+        "name": "inbound_migration",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -57,8 +62,9 @@
       false,
       true,
       true,
+      false,
       false
     ]
   },
-  "hash": "6b51995c40519a63f85c70f29ca8bd6ec1963c8562d78215d980785dc46a6384"
+  "hash": "18bbda5582db1b32d02ab8a3eee970c9508b9bd67239c2f936639a9f863b30ff"
 }

.sqlx/query-23201d4e26bc650939e30f69fb0bca00d351d057098afebc1017f70a84b4bd22.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE users SET deactivated_at = NULL WHERE did = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "23201d4e26bc650939e30f69fb0bca00d351d057098afebc1017f70a84b4bd22"
-}

.sqlx/query-2c3c0740793f29b9bd9e0f81c2372d427dee091e20da8f71ae1e5f2769aa985d.json

@@ -1,11 +1,11 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO repo_seq (did, event_type, active, status)\n            VALUES ($1, 'account', false, 'deleted')\n            RETURNING seq\n            ",
+  "query": "\n            INSERT INTO repo_seq (did, event_type, active, status)\n            VALUES ($1, 'account', false, 'deleted')\n            RETURNING id\n            ",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "seq",
+        "name": "id",
         "type_info": "Int8"
       }
     ],
@@ -18,5 +18,5 @@
       false
     ]
   },
-  "hash": "a0ea3630adb9e411d94d88084df6b05d7fc3ba8c306146fc932b736fe342eceb"
+  "hash": "2c3c0740793f29b9bd9e0f81c2372d427dee091e20da8f71ae1e5f2769aa985d"
 }

.sqlx/query-3cc7247d2cd7e85a6f21d783dd956f8fecc6f63c994014bb4e91504d498b5fd5.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT pg_try_advisory_xact_lock($1) as \"locked!\"",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "locked!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "3cc7247d2cd7e85a6f21d783dd956f8fecc6f63c994014bb4e91504d498b5fd5"
+}

.sqlx/query-4dcee809896ead3de8ca0433856ed424211d79df201d08bbea0e4c576931a234.json

@@ -1,18 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE session_tokens SET access_jti = $1, refresh_jti = $2, access_expires_at = $3, refresh_expires_at = $4, updated_at = NOW() WHERE id = $5",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Timestamptz",
-        "Timestamptz",
-        "Int4"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "4dcee809896ead3de8ca0433856ed424211d79df201d08bbea0e4c576931a234"
-}

.sqlx/query-4f3ef746cb5fc0916d3df5f92494c538497d3b9c1cfcc6e44c9b80f2193094f6.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            INSERT INTO repo_seq (did, event_type, handle)\n            VALUES ($1, 'identity', $2)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "4f3ef746cb5fc0916d3df5f92494c538497d3b9c1cfcc6e44c9b80f2193094f6"
+}

.sqlx/query-50b2178cd174af1dc132a22048e52a6af492f4d8025ec512dd9c0c9ba62eb202.json

@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO repo_seq (did, event_type, handle)\n            VALUES ($1, 'identity', $2)\n            RETURNING seq\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "seq",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "50b2178cd174af1dc132a22048e52a6af492f4d8025ec512dd9c0c9ba62eb202"
-}

.sqlx/query-51e029e572777e6a103fd7fd5550494de9d4cac7e3ff84e27ddec1a6aaefc047.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE users SET deactivated_at = NULL, inbound_migration = FALSE WHERE did = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "51e029e572777e6a103fd7fd5550494de9d4cac7e3ff84e27ddec1a6aaefc047"
+}

.sqlx/query-5bee4ed5296667e4ca7e1a97aec28d30a470b8aee7b378ec9ca4e34de4faf349.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE comms_queue\n               SET status = 'failed'::comms_status,\n                   attempts = max_attempts,\n                   last_error = $2,\n                   updated_at = NOW()\n               WHERE id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "5bee4ed5296667e4ca7e1a97aec28d30a470b8aee7b378ec9ca4e34de4faf349"
+}

.sqlx/query-714a1c9a73e2fed8182d4ab2fe4a2c33bc10a52e27ed95d3a6641477ae42395e.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT id as \"id!\" FROM repo_seq WHERE seq IS NULL ORDER BY id LIMIT $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "714a1c9a73e2fed8182d4ab2fe4a2c33bc10a52e27ed95d3a6641477ae42395e"
+}

.sqlx/query-7cdf3b8136782a5b2e4aff91907a680566b4610e6cbf9d9396d31f9bbd99c3b8.json

@@ -1,11 +1,11 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT seq, did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                      ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n               FROM repo_seq\n               WHERE seq = $1",
+  "query": "SELECT seq as \"seq!\", did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                      ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n               FROM repo_seq\n               WHERE seq = $1",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "seq",
+        "name": "seq!",
         "type_info": "Int8"
       },
       {
@@ -90,7 +90,7 @@
       ]
     },
     "nullable": [
-      false,
+      true,
       false,
       false,
       false,
@@ -108,5 +108,5 @@
       true
     ]
   },
-  "hash": "4702a94384ce938d3f5384bc2106a48500f8749134e6bfd1c619a9151f5d3772"
+  "hash": "7cdf3b8136782a5b2e4aff91907a680566b4610e6cbf9d9396d31f9bbd99c3b8"
 }

.sqlx/query-8003624cedbac8b094c83933578517abfb2eaf8e59d1d52c7ea59bf5d11cfcfe.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM session_tokens WHERE id = $1 AND did = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int4",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "8003624cedbac8b094c83933578517abfb2eaf8e59d1d52c7ea59bf5d11cfcfe"
+}

.sqlx/query-800b93a38eef70bafdf0a1b221994f3c19ab562f84d18265376296a592b4c767.json

@@ -1,14 +1,8 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO repo_seq (did, event_type, commit_cid, prev_cid, ops, blobs, block_cids, block_data, rev)\n            VALUES ($1, 'commit', $2, $3::TEXT, $4, $5, $6, $7, $8)\n            RETURNING seq\n            ",
+  "query": "\n            INSERT INTO repo_seq (did, event_type, commit_cid, prev_cid, ops, blobs, block_cids, block_data, rev)\n            VALUES ($1, 'commit', $2, $3::TEXT, $4, $5, $6, $7, $8)\n            ",
   "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "seq",
-        "type_info": "Int8"
-      }
-    ],
+    "columns": [],
     "parameters": {
       "Left": [
         "Text",
@@ -21,9 +15,7 @@
         "Text"
       ]
     },
-    "nullable": [
-      false
-    ]
+    "nullable": []
   },
-  "hash": "a325862f897484bb1a8863fd7a1bc3fd17ab20b6e30498f9900daf80609c413d"
+  "hash": "800b93a38eef70bafdf0a1b221994f3c19ab562f84d18265376296a592b4c767"
 }

.sqlx/query-82276a34f473ff8b9790b78915ae3f72873d4b748cdb47bd2b81edc2f7a6e5a8.json

@@ -1,14 +1,8 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO repo_seq (did, event_type, commit_cid, prev_cid, ops, blobs, block_cids, block_data, prev_data_cid, rev)\n            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)\n            RETURNING seq\n            ",
+  "query": "\n            INSERT INTO repo_seq (did, event_type, commit_cid, prev_cid, ops, blobs, block_cids, block_data, prev_data_cid, rev)\n            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)\n            ",
   "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "seq",
-        "type_info": "Int8"
-      }
-    ],
+    "columns": [],
     "parameters": {
       "Left": [
         "Text",
@@ -23,9 +17,7 @@
         "Text"
       ]
     },
-    "nullable": [
-      false
-    ]
+    "nullable": []
   },
-  "hash": "97dd3cfe72b74b4dac686c030a07f6eb56dabb2df72815f3248760b4e3f7950e"
+  "hash": "82276a34f473ff8b9790b78915ae3f72873d4b748cdb47bd2b81edc2f7a6e5a8"
 }

.sqlx/query-847ce3c34985d0957526c87e0a20c6b4e5daae08a338f7635def682ac0689cf6.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM session_tokens WHERE access_jti = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "847ce3c34985d0957526c87e0a20c6b4e5daae08a338f7635def682ac0689cf6"
-}

.sqlx/query-856e458c1c78f030545dc147f76d1b91fa4cc6e178eb51133c52358855ba3f02.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "DELETE FROM repo_seq WHERE did = $1 AND seq != $2",
+  "query": "DELETE FROM repo_seq WHERE did = $1 AND id <> $2",
   "describe": {
     "columns": [],
     "parameters": {
@@ -11,5 +11,5 @@
     },
     "nullable": []
   },
-  "hash": "b6d6548acb89d6384cd226f6ed0d66de27fde3af24b4a7a3fce7e098812e38a5"
+  "hash": "856e458c1c78f030545dc147f76d1b91fa4cc6e178eb51133c52358855ba3f02"
 }

.sqlx/query-890aa92acdcb0fe2a3bf04d87e1f16a801d271da7cedc32fc42c2ef5b100faae.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "UPDATE comms_queue\n               SET status = 'processing', updated_at = NOW()\n               WHERE id IN (\n                   SELECT id FROM comms_queue\n                   WHERE status = 'pending'\n                     AND scheduled_for <= $1\n                     AND attempts < max_attempts\n                   ORDER BY scheduled_for ASC\n                   LIMIT $2\n                   FOR UPDATE SKIP LOCKED\n               )\n               RETURNING\n                   id, user_id,\n                   channel as \"channel: CommsChannel\",\n                   comms_type as \"comms_type: CommsType\",\n                   status as \"status: CommsStatus\",\n                   recipient, subject, body, metadata,\n                   attempts, max_attempts, last_error,\n                   created_at, updated_at, scheduled_for, processed_at",
+  "query": "UPDATE comms_queue\n               SET status = 'processing', updated_at = NOW()\n               WHERE id IN (\n                   SELECT id FROM comms_queue\n                   WHERE attempts < max_attempts\n                     AND scheduled_for <= $1\n                     AND (\n                         status = 'pending'\n                         OR (status = 'processing'\n                             AND updated_at < $1 - INTERVAL '10 minutes')\n                     )\n                   ORDER BY scheduled_for ASC\n                   LIMIT $2\n                   FOR UPDATE SKIP LOCKED\n               )\n               RETURNING\n                   id, user_id,\n                   channel as \"channel: CommsChannel\",\n                   comms_type as \"comms_type: CommsType\",\n                   status as \"status: CommsStatus\",\n                   recipient, subject, body, metadata,\n                   attempts, max_attempts, last_error,\n                   created_at, updated_at, scheduled_for, processed_at",
   "describe": {
     "columns": [
       {
@@ -154,5 +154,5 @@
       true
     ]
   },
-  "hash": "8047fda41bd94f819213decb8b3e0aba49a8dbdb10217eefd77e3567f8c9694a"
+  "hash": "890aa92acdcb0fe2a3bf04d87e1f16a801d271da7cedc32fc42c2ef5b100faae"
 }

.sqlx/query-8ccd42b5b1b75f45e094889ee26af8517de28ca687efa81fd9c4fce598338fe9.json

@@ -1,14 +1,8 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO repo_seq (did, event_type, active, status)\n            VALUES ($1, 'account', $2, $3)\n            RETURNING seq\n            ",
+  "query": "\n            INSERT INTO repo_seq (did, event_type, active, status)\n            VALUES ($1, 'account', $2, $3)\n            ",
   "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "seq",
-        "type_info": "Int8"
-      }
-    ],
+    "columns": [],
     "parameters": {
       "Left": [
         "Text",
@@ -16,9 +10,7 @@
         "Text"
       ]
     },
-    "nullable": [
-      false
-    ]
+    "nullable": []
   },
-  "hash": "623042c0b901e17ff37c5bcc1a4eefe56fc8b996ca8326e75796897d13c9e9ed"
+  "hash": "8ccd42b5b1b75f45e094889ee26af8517de28ca687efa81fd9c4fce598338fe9"
 }

.sqlx/query-8f4357f7a18ddcf6b686a4555f244d37c35917364b8f917ca6ee2d4030ace742.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n            DELETE FROM oauth_token\n            WHERE id IN (\n                SELECT id FROM oauth_token\n                WHERE did = $1\n                ORDER BY updated_at ASC\n                OFFSET $2\n            )\n            ",
+  "query": "\n            DELETE FROM oauth_token\n            WHERE id IN (\n                SELECT id FROM oauth_token\n                WHERE did = $1\n                ORDER BY created_at DESC\n                OFFSET $2\n            )\n            ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -11,5 +11,5 @@
     },
     "nullable": []
   },
-  "hash": "56cd24903171eddc2ededd9079ffe10937c34e99b0305f25c980ca754da44625"
+  "hash": "8f4357f7a18ddcf6b686a4555f244d37c35917364b8f917ca6ee2d4030ace742"
 }

.sqlx/query-957bc81c63510ab502d2f8cea75dafcbdf2c8ebb448c86990d5e404ee5280438.json

@@ -1,11 +1,11 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT seq, did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                              ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n                       FROM repo_seq\n                       WHERE seq > $1\n                       ORDER BY seq ASC",
+  "query": "SELECT seq as \"seq!\", did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                              ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n                       FROM repo_seq\n                       WHERE seq > $1\n                       ORDER BY seq ASC",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "seq",
+        "name": "seq!",
         "type_info": "Int8"
       },
       {
@@ -90,7 +90,7 @@
       ]
     },
     "nullable": [
-      false,
+      true,
       false,
       false,
       false,
@@ -108,5 +108,5 @@
       true
     ]
   },
-  "hash": "c47746c256fd8c9d386551f3bd270e9a96fecdb713642d07d60fb4aeb02c8426"
+  "hash": "957bc81c63510ab502d2f8cea75dafcbdf2c8ebb448c86990d5e404ee5280438"
 }

.sqlx/query-9ba7869f29286cfd6b811ffa1e26bda1d637b98b44be66cdc265b1af4cec2d4f.json

@@ -1,14 +1,8 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO repo_seq (did, event_type, commit_cid, rev, block_cids, block_data)\n            VALUES ($1, 'sync', $2, $3, $4, $5)\n            RETURNING seq\n            ",
+  "query": "\n            INSERT INTO repo_seq (did, event_type, commit_cid, rev, block_cids, block_data)\n            VALUES ($1, 'sync', $2, $3, $4, $5)\n            ",
   "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "seq",
-        "type_info": "Int8"
-      }
-    ],
+    "columns": [],
     "parameters": {
       "Left": [
         "Text",
@@ -18,9 +12,7 @@
         "ByteaArray"
       ]
     },
-    "nullable": [
-      false
-    ]
+    "nullable": []
   },
-  "hash": "5996774d097a484f81353d49e4a99b07c30a003377c924add576bfb48ddde29b"
+  "hash": "9ba7869f29286cfd6b811ffa1e26bda1d637b98b44be66cdc265b1af4cec2d4f"
 }

.sqlx/query-a06e1d9f6f95e4c4c2b98310ebddcc9d963cc033582bf2e945e8bf3a301b4247.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT pg_advisory_xact_lock($1)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "pg_advisory_xact_lock",
+        "type_info": "Void"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "a06e1d9f6f95e4c4c2b98310ebddcc9d963cc033582bf2e945e8bf3a301b4247"
+}

.sqlx/query-a27e93bc594babbada10afe5c3e33a65909ec69c579329916833e4b0fe2332d3.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM session_tokens WHERE access_jti = $1 AND did = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "a27e93bc594babbada10afe5c3e33a65909ec69c579329916833e4b0fe2332d3"
+}

.sqlx/query-b2e1736dbe2ab9114e373353bcc299176417f3c9220025f9521591ba62928bd7.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT session_id FROM used_refresh_tokens WHERE refresh_jti = $1 FOR UPDATE",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "session_id",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "b2e1736dbe2ab9114e373353bcc299176417f3c9220025f9521591ba62928bd7"
-}

.sqlx/query-bd0407818c8bdae1f1024777951b08cb9c386fe751722e1caf6ad243e271697a.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT setval('firehose_seq', $1)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "setval",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "bd0407818c8bdae1f1024777951b08cb9c386fe751722e1caf6ad243e271697a"
+}

.sqlx/query-c08e3760be75071ac5e281cb3b05b3a02dccbf35b96c3d50c652878a38c9f9e6.json

@@ -0,0 +1,82 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            SELECT u.used_at, st.id AS session_id, st.did, st.scope, st.controller_did,\n                   st.access_jti, st.refresh_jti, st.access_expires_at, st.refresh_expires_at,\n                   k.key_bytes, k.encryption_version\n            FROM used_refresh_tokens u\n            JOIN session_tokens st ON st.id = u.session_id\n            JOIN users us ON st.did = us.did\n            JOIN user_keys k ON us.id = k.user_id\n            WHERE u.refresh_jti = $1\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "used_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 1,
+        "name": "session_id",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 2,
+        "name": "did",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "scope",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "controller_did",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 5,
+        "name": "access_jti",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 6,
+        "name": "refresh_jti",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 7,
+        "name": "access_expires_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 8,
+        "name": "refresh_expires_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 9,
+        "name": "key_bytes",
+        "type_info": "Bytea"
+      },
+      {
+        "ordinal": 10,
+        "name": "encryption_version",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true,
+      true,
+      false,
+      false,
+      false,
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "c08e3760be75071ac5e281cb3b05b3a02dccbf35b96c3d50c652878a38c9f9e6"
+}

.sqlx/query-c0a7b73070e6c5b9baa9caddca3c5d24427b48ed02b5cac913a0c0af1e5c9379.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO used_refresh_tokens (refresh_jti, session_id)\n            VALUES ($1, $2)\n            ON CONFLICT (refresh_jti) DO NOTHING\n            ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Int4"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "c0a7b73070e6c5b9baa9caddca3c5d24427b48ed02b5cac913a0c0af1e5c9379"
-}

.sqlx/query-cf874abcb72017e775fe699a0b77ae9341355f30e4af84968ffeb9135dba745f.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM session_tokens WHERE id = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Int4"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "cf874abcb72017e775fe699a0b77ae9341355f30e4af84968ffeb9135dba745f"
-}

.sqlx/query-d4eacb9bca838dd18dcfd8ca39b83ef50968bfaaabc213536c049cc222ffe9c8.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "NOTIFY repo_updates",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "d4eacb9bca838dd18dcfd8ca39b83ef50968bfaaabc213536c049cc222ffe9c8"
+}

.sqlx/query-da2770e44c0ec21756ce4b6b0c57abff4f38cd8c680c5ced7d3b35f3c1f58da7.json

@@ -1,11 +1,11 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT seq, did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                              ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n                       FROM repo_seq\n                       WHERE seq > $1\n                       ORDER BY seq ASC\n                       LIMIT $2",
+  "query": "SELECT seq as \"seq!\", did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                              ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n                       FROM repo_seq\n                       WHERE seq > $1\n                       ORDER BY seq ASC\n                       LIMIT $2",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "seq",
+        "name": "seq!",
         "type_info": "Int8"
       },
       {
@@ -91,7 +91,7 @@
       ]
     },
     "nullable": [
-      false,
+      true,
       false,
       false,
       false,
@@ -109,5 +109,5 @@
       true
     ]
   },
-  "hash": "89c8ce80d8c52b4668c34f63e48b51cacc7e8ff300958a192378f1d72de04f9a"
+  "hash": "da2770e44c0ec21756ce4b6b0c57abff4f38cd8c680c5ced7d3b35f3c1f58da7"
 }

.sqlx/query-dfe011b2d2bafbbbbea508a4977fc34bb1be4cf2612296df23763e6e5841c33e.json

@@ -1,11 +1,11 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT seq, did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                      ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n               FROM repo_seq\n               WHERE seq > $1\n               ORDER BY seq ASC\n               LIMIT $2",
+  "query": "SELECT seq as \"seq!\", did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                      ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n               FROM repo_seq\n               WHERE seq > $1 AND seq < $2\n               ORDER BY seq ASC",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "seq",
+        "name": "seq!",
         "type_info": "Int8"
       },
       {
@@ -91,7 +91,7 @@
       ]
     },
     "nullable": [
-      false,
+      true,
       false,
       false,
       false,
@@ -109,5 +109,5 @@
       true
     ]
   },
-  "hash": "0349b2af4d21105029ecc2bf81ad7be9987ec17ac088730596849d7a45558e57"
+  "hash": "dfe011b2d2bafbbbbea508a4977fc34bb1be4cf2612296df23763e6e5841c33e"
 }

.sqlx/query-f16d41b41a5388997e6ed408da55056173340ed12b60b1a956de87f73f9d0824.json

@@ -1,11 +1,11 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT seq, did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                      ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n               FROM repo_seq\n               WHERE seq > $1 AND seq < $2\n               ORDER BY seq ASC",
+  "query": "SELECT seq as \"seq!\", did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                      ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n               FROM repo_seq\n               WHERE seq > $1\n               ORDER BY seq ASC\n               LIMIT $2",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "seq",
+        "name": "seq!",
         "type_info": "Int8"
       },
       {
@@ -91,7 +91,7 @@
       ]
     },
     "nullable": [
-      false,
+      true,
       false,
       false,
       false,
@@ -109,5 +109,5 @@
       true
     ]
   },
-  "hash": "ad784aff9bb5c1f19f90a3b1c3b3694a3e1aa889b0fe3e55cfebb7af8c620256"
+  "hash": "f16d41b41a5388997e6ed408da55056173340ed12b60b1a956de87f73f9d0824"
 }

.sqlx/query-f1c4ec28b02d09ffce35aa8249c1747a70c12a3ecfc1ff6ca1847840f770db2f.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT id, did, handle, email, created_at, deactivated_at, takedown_ref, is_admin\n               FROM users WHERE handle = $1",
+  "query": "SELECT id, did, handle, email, created_at, deactivated_at, takedown_ref, is_admin, inbound_migration\n               FROM users WHERE did = $1",
   "describe": {
     "columns": [
       {
@@ -42,6 +42,11 @@
         "ordinal": 7,
         "name": "is_admin",
         "type_info": "Bool"
+      },
+      {
+        "ordinal": 8,
+        "name": "inbound_migration",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -57,8 +62,9 @@
       false,
       true,
       true,
+      false,
       false
     ]
   },
-  "hash": "584bceda60d8b6a02e7dc44d833e3fba13151f36ba9f75c64e33d6cb534cc939"
+  "hash": "f1c4ec28b02d09ffce35aa8249c1747a70c12a3ecfc1ff6ca1847840f770db2f"
 }

.sqlx/query-fcd868a192d27fd4eccae92a884e881b8d6f09bf7ae08a9b431a44acbf2f91f3.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT session_id FROM used_refresh_tokens WHERE refresh_jti = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "session_id",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "fcd868a192d27fd4eccae92a884e881b8d6f09bf7ae08a9b431a44acbf2f91f3"
-}

.tangled/workflows/publish-cachix-aarch64.yml

@@ -0,0 +1,21 @@
+when:
+  - event: ["push", "manual"]
+    branch: ["main"]
+
+engine: nixery
+
+dependencies:
+  nixpkgs:
+    - nix
+    - cachix
+    - gnugrep
+
+steps:
+  - name: Authenticate
+    command: |
+      cachix authtoken "$CACHIX_AUTH_TOKEN"
+
+  - name: Build and push aarch64
+    command: |
+      SUBS="--option extra-substituters https://tranquil.cachix.org --option extra-trusted-public-keys tranquil.cachix.org-1:PoO+mGL6a6LcJiPakMDHN4E218/ei/7v2sxeDtNkSRg="
+      nix-store -qR --include-outputs $(nix-store -qd $(nix build .#packages.x86_64-linux.tranquil-pds-aarch64 $SUBS --print-out-paths --no-link)) | grep -v '\.drv$' | cachix push tranquil

.tangled/workflows/publish-cachix-x86_64.yml

@@ -0,0 +1,28 @@
+when:
+  - event: ["push", "manual"]
+    branch: ["main"]
+
+engine: nixery
+
+dependencies:
+  nixpkgs:
+    - nix
+    - cachix
+    - gnugrep
+
+steps:
+  - name: Authenticate
+    command: |
+      cachix authtoken "$CACHIX_AUTH_TOKEN"
+
+  - name: Build and push x86_64
+    command: |
+      SUBS="--option extra-substituters https://tranquil.cachix.org --option extra-trusted-public-keys tranquil.cachix.org-1:PoO+mGL6a6LcJiPakMDHN4E218/ei/7v2sxeDtNkSRg="
+      nix-store -qR --include-outputs $(nix-store -qd $(nix build .#packages.x86_64-linux.tranquil-pds $SUBS --print-out-paths --no-link)) | grep -v '\.drv$' | cachix push tranquil
+      nix-store -qR --include-outputs $(nix-store -qd $(nix build .#packages.x86_64-linux.tranquil-frontend $SUBS --print-out-paths --no-link)) | grep -v '\.drv$' | cachix push tranquil
+
+  - name: Build and push devShell
+    command: |
+      SUBS="--option extra-substituters https://tranquil.cachix.org --option extra-trusted-public-keys tranquil.cachix.org-1:PoO+mGL6a6LcJiPakMDHN4E218/ei/7v2sxeDtNkSRg="
+      nix develop $SUBS --profile dev-profile -c true
+      cachix push tranquil dev-profile

.tangled/workflows/publish-image.yml

@@ -1,24 +1,36 @@
 when:
-  - event: []
-    branch: []
+  - event: [ "manual" ]
+  - event: [ "push" ]
+    branch: [ "main" ]
 
 engine: nixery
 
 dependencies:
   nixpkgs:
-    - podman
+    - kaniko
+
+environment:
+  DOCKER_CONFIG: "/kaniko/.docker"
 
 steps:
-  - name: Create podman config
+  - name: Configure Kaniko
     command: |
-      mkdir -p ~/.config/containers
-      echo "unqualified-search-registries = [\"docker.io\"]" >> ~/.config/containers/registries.conf
+      mkdir -p /kaniko/.docker/
+      echo "{
+        \"auths\": {
+          \"https://atcr.io/v1\":{
+            \"auth\": \"$ATCR_CREDENTIALS\"
+          }
+        }
+      }" > /kaniko/.docker/config.json
 
   - name: Build image
     command: |
-      podman build . -t tranquil-pds:latest -t "tranquil-pds:$TANGLED_COMMIT_SHA"
-
-  - name: Publish image
-    command: |
-      podman push --creds "$ATCR_USERNAME:$ATCR_PASSWORD" tranquil-pds:latest "atcr.io/tranquil.farm/tranquil-pds:latest"
-      podman push --creds "$ATCR_USERNAME:$ATCR_PASSWORD" "tranquil-pds:$TANGLED_COMMIT_SHA" "atcr.io/tranquil.farm/tranquil-pds:$TANGLED_COMMIT_SHA"
+      executor \
+        --context=$(pwd) \
+        --ignore-path=$(pwd) \
+        --dockerfile=$(pwd)/Dockerfile \
+        --destination="atcr.io/tranquil.farm/tranquil-pds:latest" \
+        --destination="atcr.io/tranquil.farm/tranquil-pds:$TANGLED_COMMIT_SHA" \
+        --push-retry=3 \
+        --skip-push-permission-check

CONTRIBUTING.md

@@ -0,0 +1,135 @@
+# Contributing to Tranquil PDS
+
+## When PRing
+
+In order of importance:
+
+- **You must run your change! Every contribution that says "here's xyz. untested." does not help the project.**
+- Relevant tests to your PR must pass. The whole suite doesn't have to be proven to have run, because there are a *ton* of tests and they're quite heavy, but hopefully there are existing tests for whatever you're PRing, and if there aren't, please add those too.
+- Run cargo fmt :P
+
+> 🦪 Lewis
+>
+> Good CI fixes some of these. We should really get around to that.
+
+Things that would also be nice but aren't like, a pain in our side:
+
+- Big changes should be stacked PRs that are broken up into digestible pieces. Those stacked PRs should hopefully be able to be merged individually if necessary.
+
+## Local Development
+
+### Prerequisites
+
+- [Docker](https://docs.docker.com/get-docker/) and Docker Compose
+- Add `pds.test` to your hosts file (one-time setup):
+
+  ```
+  127.0.0.1 pds.test
+  ```
+
+  - **macOS / Linux:** `/etc/hosts`
+  - **Windows:** `C:\Windows\System32\drivers\etc\hosts`
+
+### Starting the dev environment
+
+```bash
+just run-dev
+```
+
+This starts the following services via `docker-compose`:
+
+- **Traefik** — HTTPS reverse proxy at `https://pds.test`
+- **Backend** — Rust server with `cargo-watch` (auto-rebuilds on file changes)
+- **Frontend** — Vite dev server with hot module replacement
+- **Postgres** — Database on port 5432
+- **PLC Directory** — Local [did-method-plc](https://github.com/did-method-plc/did-method-plc) server for DID registration
+- **Mailpit** — Local email server with web UI at [http://localhost:8025](http://localhost:8025)
+
+Once all services are running, open **https://pds.test** in your browser.
+
+### Trusting the self-signed certificate
+
+Traefik generates a self-signed TLS certificate. Your browser will show a security warning on first visit. You can either click through it, or add the certificate to your system trust store for a seamless experience:
+
+**macOS:**
+
+```bash
+# Extract the cert from traefik and add it to the system keychain
+echo | openssl s_client -connect localhost:443 -servername pds.test 2>/dev/null | openssl x509 > /tmp/pds-test.pem
+sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/pds-test.pem
+```
+
+**Linux (Debian/Ubuntu):**
+
+```bash
+echo | openssl s_client -connect localhost:443 -servername pds.test 2>/dev/null | openssl x509 | sudo tee /usr/local/share/ca-certificates/pds-test.crt
+sudo update-ca-certificates
+```
+
+**Linux (Fedora/RHEL):**
+
+```bash
+echo | openssl s_client -connect localhost:443 -servername pds.test 2>/dev/null | openssl x509 | sudo tee /etc/pki/ca-trust/source/anchors/pds-test.pem
+sudo update-ca-trust
+```
+
+**Windows (PowerShell as Administrator):**
+
+```powershell
+$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
+$cert.Import([System.Text.Encoding]::UTF8.GetBytes((echo | openssl s_client -connect localhost:443 -servername pds.test 2>$null | openssl x509)))
+$store = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", "LocalMachine")
+$store.Open("ReadWrite")
+$store.Add($cert)
+$store.Close()
+```
+
+Restart your browser after adding the certificate.
+
+### Stopping the dev environment
+
+```bash
+# Stop containers (preserves database + build cache)
+docker compose --profile dev down
+
+# Stop and wipe all data (fresh start)
+docker compose --profile dev down -v
+```
+
+### Direct database access
+
+Postgres is exposed on port 5432:
+
+```bash
+psql postgres://postgres:postgres@localhost:5432/pds
+```
+
+### How it works
+
+- **Source code** is bind-mounted into the containers so that changes made on the host will be immediately reflected in the application
+- **Backend** uses `cargo-watch` to recompile and restart when Rust files change
+- **Frontend** uses Vite's HMR for instant browser updates when frontend files change
+- **Build cache** (`target/` directory and cargo registry) are stored in Docker volumes, so incremental compilation persists across container restarts
+- **Traefik** routes `/`, `/xrpc`, `/oauth`, `/.well-known`, `/u`, and `/health` to the backend; everything else goes to the Vite dev server
+- **Mailpit** captures all outgoing email — open [http://localhost:8025](http://localhost:8025) to view verification emails during registration
+- **PLC Directory** runs locally so DID registration doesn't hit the real `plc.directory`
+
+### Running the backend natively
+
+If you prefer running the Rust backend outside Docker (faster incremental builds on host), you need:
+
+- Rust toolchain (see `rust-toolchain.toml`)
+- `protoc` (`brew install protobuf` on macOS)
+- PostgreSQL (start with `docker compose up db`)
+
+Then run:
+
+```bash
+cargo run -p tranquil-server -- --config config.toml
+```
+
+And start the frontend separately:
+
+```bash
+cd frontend && pnpm install && pnpm dev
+```

Cargo.lock

@@ -9,7 +9,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "087113bd50d9adce24850eed5d0476c7d199d532fce8fab5173650331e09033a"
 dependencies = [
  "abnf-core",
- "nom",
+ "nom 7.1.3",
 ]
 
 [[package]]
@@ -18,7 +18,7 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c44e09c43ae1c368fb91a03a566472d0087c26cf7e1b9e8e289c14ede681dd7d"
 dependencies = [
- "nom",
+ "nom 7.1.3",
 ]
 
 [[package]]
@@ -210,16 +210,32 @@ version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5493c3bedbacf7fd7382c6346bbd66687d12bbaad3a89a2d2c303ee6cf20b048"
 dependencies = [
- "asn1-rs-derive",
+ "asn1-rs-derive 0.5.1",
  "asn1-rs-impl",
  "displaydoc",
- "nom",
+ "nom 7.1.3",
  "num-traits",
  "rusticata-macros",
  "thiserror 1.0.69",
  "time",
 ]
 
+[[package]]
+name = "asn1-rs"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f43a50ac4fdca5df8e885c21b835997f0a1cdee65494a6847694a98652d9d8"
+dependencies = [
+ "asn1-rs-derive 0.6.0",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom 7.1.3",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror 2.0.18",
+ "time",
+]
+
 [[package]]
 name = "asn1-rs-derive"
 version = "0.5.1"
@@ -232,6 +248,18 @@ dependencies = [
  "synstructure",
 ]
 
+[[package]]
+name = "asn1-rs-derive"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+ "synstructure",
+]
+
 [[package]]
 name = "asn1-rs-impl"
 version = "0.2.0"
@@ -1046,7 +1074,7 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
 dependencies = [
- "bit-vec",
+ "bit-vec 0.8.0",
 ]
 
 [[package]]
@@ -1055,6 +1083,15 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
 
+[[package]]
+name = "bit-vec"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "bitflags"
 version = "2.11.0"
@@ -1558,7 +1595,7 @@ checksum = "06b4f5ec222421e22bb0a8cbaa36b1d2b50fd45cdd30c915ded34108da78b29f"
 dependencies = [
  "confique-macro",
  "serde",
- "toml",
+ "toml 0.9.12+spec-1.1.0",
 ]
 
 [[package]]
@@ -1970,9 +2007,23 @@ version = "9.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5cd0a5c643689626bec213c4d8bd4d96acc8ffdb4ad4bb6bc16abf27d5f4b553"
 dependencies = [
- "asn1-rs",
+ "asn1-rs 0.6.2",
  "displaydoc",
- "nom",
+ "nom 7.1.3",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
+[[package]]
+name = "der-parser"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6"
+dependencies = [
+ "asn1-rs 0.7.2",
+ "displaydoc",
+ "nom 7.1.3",
  "num-bigint",
  "num-traits",
  "rusticata-macros",
@@ -2216,6 +2267,22 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "email-encoding"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9298e6504d9b9e780ed3f7dfd43a61be8cd0e09eb07f7706a945b0072b6670b6"
+dependencies = [
+ "base64 0.22.1",
+ "memchr",
+]
+
+[[package]]
+name = "email_address"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e079f19b08ca6239f47f8ba8509c11cf3ea30095831f7fed61441475edd8c449"
+
 [[package]]
 name = "embedded-io"
 version = "0.4.0"
@@ -2818,6 +2885,34 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "h3"
+version = "0.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10872b55cfb02a821b69dc7cf8dc6a71d6af25eb9a79662bec4a9d016056b3be"
+dependencies = [
+ "bytes",
+ "fastrand",
+ "futures-util",
+ "http 1.4.0",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "h3-quinn"
+version = "0.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2e732c8d91a74731663ac8479ab505042fbf547b9a207213ab7fbcbfc4f8b4"
+dependencies = [
+ "bytes",
+ "futures",
+ "h3",
+ "quinn",
+ "tokio",
+ "tokio-util",
+]
+
 [[package]]
 name = "half"
 version = "2.7.1"
@@ -3780,6 +3875,37 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
+[[package]]
+name = "lettre"
+version = "0.11.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dabda5859ee7c06b995b9d1165aa52c39110e079ef609db97178d86aeb051fa7"
+dependencies = [
+ "async-trait",
+ "base64 0.22.1",
+ "ed25519-dalek",
+ "email-encoding",
+ "email_address",
+ "fastrand",
+ "futures-io",
+ "futures-util",
+ "httpdate",
+ "idna",
+ "mime",
+ "nom 8.0.0",
+ "percent-encoding",
+ "quoted_printable",
+ "rsa",
+ "rustls 0.23.37",
+ "sha2",
+ "socket2 0.6.3",
+ "tokio",
+ "tokio-rustls 0.26.4",
+ "tracing",
+ "url",
+ "webpki-roots 1.0.6",
+]
+
 [[package]]
 name = "libc"
 version = "0.2.183"
@@ -4409,6 +4535,15 @@ dependencies = [
  "minimal-lexical",
 ]
 
+[[package]]
+name = "nom"
+version = "8.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "nonzero_ext"
 version = "0.3.0"
@@ -4558,7 +4693,16 @@ version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a8d8034d9489cdaf79228eb9f6a3b8d7bb32ba00d6645ebd48eef4077ceb5bd9"
 dependencies = [
- "asn1-rs",
+ "asn1-rs 0.6.2",
+]
+
+[[package]]
+name = "oid-registry"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f40cff3dde1b6087cc5d5f5d4d65712f34016a03ed60e9c08dcc392736b5b7"
+dependencies = [
+ "asn1-rs 0.7.2",
 ]
 
 [[package]]
@@ -4839,7 +4983,7 @@ checksum = "9114f9c1683dd09c5f4fa024c89fdad783eaae21d3d52dd23ddaaffa29ffb168"
 dependencies = [
  "either",
  "fnv",
- "nom",
+ "nom 7.1.3",
  "once_cell",
  "postcard",
  "quick-xml",
@@ -5050,7 +5194,7 @@ version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
 dependencies = [
- "toml_edit",
+ "toml_edit 0.25.5+spec-1.1.0",
 ]
 
 [[package]]
@@ -5128,7 +5272,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37566cb3fdacef14c0737f9546df7cfeadbfbc9fef10991038bf5015d0c80532"
 dependencies = [
  "bit-set",
- "bit-vec",
+ "bit-vec 0.8.0",
  "bitflags",
  "num-traits",
  "rand 0.9.2",
@@ -5371,6 +5515,7 @@ checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
 dependencies = [
  "bytes",
  "cfg_aliases",
+ "futures-io",
  "pin-project-lite",
  "quinn-proto",
  "quinn-udp",
@@ -5427,6 +5572,12 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "quoted_printable"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "478e0585659a122aa407eb7e3c0e1fa51b1d8a870038bd29f0cf4a8551eea972"
+
 [[package]]
 name = "r-efi"
 version = "5.3.0"
@@ -5568,6 +5719,20 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "rcgen"
+version = "0.14.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57f6d249aad744e274e682777a50283a225a32705394ee6d5fcc01efa25e4055"
+dependencies = [
+ "pem",
+ "ring",
+ "rustls-pki-types",
+ "time",
+ "x509-parser 0.18.1",
+ "yasna",
+]
+
 [[package]]
 name = "redis"
 version = "1.1.0"
@@ -5833,7 +5998,7 @@ version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
 dependencies = [
- "nom",
+ "nom 7.1.3",
 ]
 
 [[package]]
@@ -6050,6 +6215,16 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "secrecy"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e891af845473308773346dc847b2c23ee78fe442e0472ac50e22a18a93d3ae5a"
+dependencies = [
+ "serde",
+ "zeroize",
+]
+
 [[package]]
 name = "security-framework"
 version = "3.7.0"
@@ -6201,6 +6376,15 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "serde_spanned"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "serde_spanned"
 version = "1.0.4"
@@ -7144,6 +7328,18 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "toml"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
+dependencies = [
+ "serde",
+ "serde_spanned 0.6.9",
+ "toml_datetime 0.6.11",
+ "toml_edit 0.22.27",
+]
+
 [[package]]
 name = "toml"
 version = "0.9.12+spec-1.1.0"
@@ -7152,13 +7348,22 @@ checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
 dependencies = [
  "indexmap 2.13.0",
  "serde_core",
- "serde_spanned",
+ "serde_spanned 1.0.4",
  "toml_datetime 0.7.5+spec-1.1.0",
  "toml_parser",
  "toml_writer",
  "winnow 0.7.15",
 ]
 
+[[package]]
+name = "toml_datetime"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "toml_datetime"
 version = "0.7.5+spec-1.1.0"
@@ -7177,6 +7382,20 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "toml_edit"
+version = "0.22.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
+dependencies = [
+ "indexmap 2.13.0",
+ "serde",
+ "serde_spanned 0.6.9",
+ "toml_datetime 0.6.11",
+ "toml_write",
+ "winnow 0.7.15",
+]
+
 [[package]]
 name = "toml_edit"
 version = "0.25.5+spec-1.1.0"
@@ -7198,6 +7417,12 @@ dependencies = [
  "winnow 1.0.0",
 ]
 
+[[package]]
+name = "toml_write"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
+
 [[package]]
 name = "toml_writer"
 version = "1.0.7+spec-1.1.0"
@@ -7405,7 +7630,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-api"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "anyhow",
  "axum",
@@ -7456,7 +7681,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-auth"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "anyhow",
  "base32",
@@ -7479,11 +7704,12 @@ dependencies = [
 
 [[package]]
 name = "tranquil-cache"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
  "redis",
+ "thiserror 2.0.18",
  "tokio-util",
  "tracing",
  "tranquil-config",
@@ -7493,11 +7719,19 @@ dependencies = [
 
 [[package]]
 name = "tranquil-comms"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
+ "chrono",
+ "ed25519-dalek",
+ "futures",
+ "hickory-resolver",
+ "lettre",
+ "rand 0.8.5",
  "reqwest",
+ "rsa",
+ "secrecy",
  "serde_json",
  "sqlx",
  "thiserror 2.0.18",
@@ -7511,7 +7745,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-config"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "confique",
  "serde",
@@ -7519,7 +7753,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-crypto"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "aes-gcm",
  "base64 0.22.1",
@@ -7535,7 +7769,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-db"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "async-trait",
  "chrono",
@@ -7552,7 +7786,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-db-traits"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
@@ -7568,7 +7802,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-infra"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "async-trait",
  "bytes",
@@ -7579,9 +7813,10 @@ dependencies = [
 
 [[package]]
 name = "tranquil-lexicon"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "chrono",
+ "futures",
  "hickory-resolver",
  "parking_lot",
  "reqwest",
@@ -7597,7 +7832,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-oauth"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "anyhow",
  "axum",
@@ -7620,7 +7855,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-oauth-server"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "axum",
  "base64 0.22.1",
@@ -7653,7 +7888,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-pds"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "aes-gcm",
  "anyhow",
@@ -7693,6 +7928,7 @@ dependencies = [
  "multibase",
  "multihash",
  "p256 0.13.2",
+ "parking_lot",
  "rand 0.8.5",
  "redis",
  "regex",
@@ -7705,6 +7941,7 @@ dependencies = [
  "sha2",
  "sqlx",
  "subtle",
+ "tempfile",
  "testcontainers",
  "testcontainers-modules",
  "thiserror 2.0.18",
@@ -7745,7 +7982,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-repo"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "bytes",
  "cid",
@@ -7757,19 +7994,22 @@ dependencies = [
 
 [[package]]
 name = "tranquil-ripple"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "async-trait",
  "backon",
  "bincode 2.0.1",
- "bytes",
  "foca",
  "futures",
+ "hkdf",
  "metrics",
  "parking_lot",
+ "quinn",
  "rand 0.9.2",
+ "rcgen",
+ "rustls 0.23.37",
  "serde",
- "socket2 0.6.3",
+ "sha2",
  "thiserror 2.0.18",
  "tokio",
  "tokio-util",
@@ -7778,11 +8018,12 @@ dependencies = [
  "tranquil-config",
  "tranquil-infra",
  "uuid",
+ "x509-parser 0.18.1",
 ]
 
 [[package]]
 name = "tranquil-scopes"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "axum",
  "futures",
@@ -7798,15 +8039,31 @@ dependencies = [
 
 [[package]]
 name = "tranquil-server"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
+ "arc-swap",
  "axum",
+ "bytes",
  "clap",
  "dotenvy",
  "ed25519-dalek",
+ "futures-util",
+ "h3",
+ "h3-quinn",
  "hex",
+ "http 1.4.0",
+ "hyper 1.8.1",
+ "hyper-util",
+ "quinn",
+ "rcgen",
+ "reqwest",
+ "rustls 0.23.37",
+ "rustls-pemfile",
+ "thiserror 2.0.18",
  "tokio",
+ "tokio-rustls 0.26.4",
  "tokio-util",
+ "tower",
  "tracing",
  "tracing-subscriber",
  "tranquil-api",
@@ -7819,7 +8076,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-signal"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "async-trait",
  "chrono",
@@ -7842,7 +8099,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-storage"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "async-trait",
  "aws-config",
@@ -7859,12 +8116,13 @@ dependencies = [
 
 [[package]]
 name = "tranquil-store"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "async-trait",
  "bytes",
  "chrono",
  "cid",
+ "clap",
  "dashmap",
  "fjall",
  "flume 0.11.1",
@@ -7892,6 +8150,7 @@ dependencies = [
  "thiserror 2.0.18",
  "tikv-jemallocator",
  "tokio",
+ "toml 0.8.23",
  "tracing",
  "tracing-subscriber",
  "tranquil-db",
@@ -7906,7 +8165,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-sync"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "anyhow",
  "axum",
@@ -7928,7 +8187,7 @@ dependencies = [
 
 [[package]]
 name = "tranquil-types"
-version = "0.5.4"
+version = "0.6.5"
 dependencies = [
  "chrono",
  "cid",
@@ -8441,9 +8700,9 @@ checksum = "15784340a24c170ce60567282fb956a0938742dbfbf9eff5df793a686a009b8b"
 dependencies = [
  "base64 0.21.7",
  "base64urlsafedata",
- "der-parser",
+ "der-parser 9.0.0",
  "hex",
- "nom",
+ "nom 7.1.3",
  "openssl",
  "openssl-sys",
  "rand 0.9.2",
@@ -8457,7 +8716,7 @@ dependencies = [
  "uuid",
  "webauthn-attestation-ca",
  "webauthn-rs-proto",
- "x509-parser",
+ "x509-parser 0.16.0",
 ]
 
 [[package]]
@@ -8853,6 +9112,9 @@ name = "winnow"
 version = "0.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+dependencies = [
+ "memchr",
+]
 
 [[package]]
 name = "winnow"
@@ -9008,17 +9270,35 @@ version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fcbc162f30700d6f3f82a24bf7cc62ffe7caea42c0b2cba8bf7f3ae50cf51f69"
 dependencies = [
- "asn1-rs",
+ "asn1-rs 0.6.2",
  "data-encoding",
- "der-parser",
+ "der-parser 9.0.0",
  "lazy_static",
- "nom",
- "oid-registry",
+ "nom 7.1.3",
+ "oid-registry 0.7.1",
  "rusticata-macros",
  "thiserror 1.0.69",
  "time",
 ]
 
+[[package]]
+name = "x509-parser"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d43b0f71ce057da06bc0851b23ee24f3f86190b07203dd8f567d0b706a185202"
+dependencies = [
+ "asn1-rs 0.7.2",
+ "data-encoding",
+ "der-parser 10.0.0",
+ "lazy_static",
+ "nom 7.1.3",
+ "oid-registry 0.8.1",
+ "ring",
+ "rusticata-macros",
+ "thiserror 2.0.18",
+ "time",
+]
+
 [[package]]
 name = "xattr"
 version = "1.6.1"
@@ -9047,6 +9327,16 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
 
+[[package]]
+name = "yasna"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5f6765e852b9b4dc8e2a76843e4d64d1cea8e79bcde0b6901aea8e7c7f08282"
+dependencies = [
+ "bit-vec 0.9.1",
+ "time",
+]
+
 [[package]]
 name = "yoke"
 version = "0.8.1"

Cargo.toml

@@ -26,7 +26,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.5.4"
+version = "0.6.5"
 edition = "2024"
 license = "AGPL-3.0-or-later"
 
@@ -59,6 +59,7 @@ presage = { git = "https://github.com/whisperfish/presage", rev = "fe3ed54c4844a
 unicode-segmentation = "1"
 
 aes-gcm = "0.10"
+arc-swap = "1"
 backon = "1"
 bincode = { version = "2", features = ["serde"] }
 anyhow = "1.0"
@@ -81,11 +82,15 @@ foca = { version = "1", features = ["bincode-codec", "tracing"] }
 futures = "0.3"
 futures-util = "0.3"
 governor = "0.10"
+h3 = "0.0.8"
+h3-quinn = "0.0.10"
 hex = "0.4"
 hickory-resolver = { version = "0.24", features = ["tokio-runtime"] }
 hkdf = "0.12"
 hmac = "0.12"
 http = "1.4"
+hyper = { version = "1", features = ["server", "http1", "http2"] }
+hyper-util = { version = "0.1", features = ["server", "server-auto", "server-graceful", "service", "tokio"] }
 image = { version = "0.25", default-features = false, features = ["jpeg", "png", "gif", "webp"] }
 qrcodegen = "1.8"
 infer = "0.19"
@@ -93,6 +98,7 @@ ipld-core = "0.4"
 iroh-car = "0.5"
 jacquard-common = { version = "0.9", features = ["crypto-k256"] }
 jacquard-repo = "0.9"
+lettre = { version = "0.11", default-features = false, features = ["builder", "smtp-transport", "tokio1", "tokio1-rustls-tls", "pool", "dkim", "tracing"] }
 jsonwebtoken = { version = "10.2", features = ["rust_crypto"] }
 k256 = { version = "0.13", features = ["ecdsa", "pem", "pkcs8"] }
 metrics = "0.24"
@@ -102,9 +108,15 @@ parking_lot = "0.12"
 multihash = "0.19"
 p256 = { version = "0.13", features = ["ecdsa"] }
 p384 = { version = "0.13", features = ["ecdsa"] }
+quinn = { version = "0.11", default-features = false, features = ["runtime-tokio", "rustls-ring", "log"] }
 rand = "0.8"
+rcgen = { version = "0.14", default-features = false, features = ["ring", "pem"] }
 redis = { version = "1.0", features = ["tokio-comp", "connection-manager"] }
 regex = "1"
+rsa = "0.9"
+rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12", "logging"] }
+rustls-pemfile = "2"
+secrecy = { version = "0.10", features = ["serde"] }
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-webpki-roots", "http2", "charset", "macos-system-configuration"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_bytes = "0.11"
@@ -116,8 +128,9 @@ sqlx = { version = "0.8", features = ["runtime-tokio-rustls", "postgres", "uuid"
 subtle = "2.5"
 thiserror = "2.0"
 tokio = { version = "1.48", features = ["macros", "rt-multi-thread", "time", "signal", "process", "io-util", "fs"] }
-tokio-util = "0.7.18"
+tokio-util = { version = "0.7.18", features = ["rt"] }
 tokio-tungstenite = { version = "0.28", features = ["rustls-tls-webpki-roots"] }
+tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12", "logging"] }
 totp-rs = { version = "5", features = ["qr"] }
 tower = "0.5"
 tower-http = { version = "0.6", features = ["fs", "cors"] }
@@ -128,6 +141,7 @@ urlencoding = "2.1"
 uuid = { version = "1.19", features = ["v4", "v5", "v7", "fast-rng", "serde"] }
 webauthn-rs = { version = "0.5", features = ["danger-allow-state-serialisation", "danger-user-presence-only-security-keys", "conditional-ui"] }
 webauthn-rs-proto = "0.5"
+x509-parser = "0.18"
 zip = { version = "7.0", default-features = false, features = ["deflate"] }
 
 ciborium = "0.2"
@@ -140,11 +154,20 @@ wiremock = "0.6"
 curve25519-dalek = { git = "https://github.com/signalapp/curve25519-dalek", tag = "signal-curve25519-4.1.3" }
 
 [profile.release]
-lto = "fat"
+opt-level = "s"
 strip = true
-codegen-units = 1
 panic = "abort"
+codegen-units = 256
+
+[profile.lewis]
+inherits = "release"
+opt-level = 3
+lto = "fat"
+codegen-units = 1
 
 [profile.bench]
+opt-level = 3
+lto = "fat"
+codegen-units = 1
 debug = 1
 strip = false

Dockerfile

@@ -1,13 +1,35 @@
-FROM node:24-alpine AS frontend
+ARG DISTROLESS_IMAGE=gcr.io/distroless/cc-debian13:latest@sha256:1e3c6d9c255be500eb680cdea0ad07554f52ae92dfcbdf07043a2a435b4c1fe3
+
+FROM node:24-trixie-slim AS frontend
 RUN corepack enable && corepack prepare pnpm@latest --activate
 WORKDIR /app
-COPY frontend/package.json frontend/pnpm-lock.yaml ./
+COPY frontend/package.json frontend/pnpm-lock.yaml frontend/pnpm-workspace.yaml ./
 RUN pnpm install --frozen-lockfile
 COPY frontend/ ./
 RUN pnpm build
 
-FROM rust:1.92-alpine AS builder
-RUN apk add --no-cache ca-certificates musl-dev pkgconfig openssl-dev openssl-libs-static mold clang protoc
+FROM rust:1.96-slim-trixie AS builder
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates pkg-config libssl-dev mold clang protobuf-compiler curl xz-utils \
+    && rm -rf /var/lib/apt/lists/*
+ARG COMPRESS="true"
+RUN set -eux; \
+    if [ "$COMPRESS" = "true" ]; then \
+      arch="$(uname -m)"; \
+      case "$arch" in \
+        x86_64)  upx_arch=amd64; upx_sha=ddc2654063fe4dc80d95b420788494e4db078ebb01a650692d623b5a9906e61e ;; \
+        aarch64) upx_arch=arm64; upx_sha=100310f74eb6f67694d1d0377f1c729b6a49238ce8c4de21ea2e7d3406186f8b ;; \
+        *) echo "upx: no prebuilt binary for $arch, skipping compression"; upx_arch="" ;; \
+      esac; \
+      if [ -n "$upx_arch" ]; then \
+        curl -fsSL -o /tmp/upx.tar.xz "https://github.com/upx/upx/releases/download/v5.0.2/upx-5.0.2-${upx_arch}_linux.tar.xz"; \
+        echo "${upx_sha}  /tmp/upx.tar.xz" | sha256sum -c -; \
+        tar -xJf /tmp/upx.tar.xz -C /tmp; \
+        install -m0755 "/tmp/upx-5.0.2-${upx_arch}_linux/upx" /usr/local/bin/upx; \
+        rm -rf /tmp/upx.tar.xz "/tmp/upx-5.0.2-${upx_arch}_linux"; \
+      fi; \
+    fi
+RUN mkdir -p /stage/var/lib/tranquil-pds/blobs /stage/var/lib/tranquil-pds/store
 ENV RUSTFLAGS="-C linker=clang -C link-arg=-fuse-ld=mold"
 WORKDIR /app
 ARG SLIM="false"
@@ -35,24 +57,24 @@ COPY crates/tranquil-oauth-server ./crates/tranquil-oauth-server
 COPY crates/tranquil-store ./crates/tranquil-store
 COPY crates/tranquil-signal ./crates/tranquil-signal
 COPY crates/tranquil-server ./crates/tranquil-server
-COPY migrations ./crates/tranquil-pds/migrations
-RUN --mount=type=cache,target=/usr/local/cargo/registry \
-    --mount=type=cache,target=/app/target \
+COPY migrations ./migrations
+RUN --mount=type=cache,id=cargo-registry,target=/usr/local/cargo/registry \
+    --mount=type=cache,id=cargo-git,target=/usr/local/cargo/git \
+    --mount=type=cache,id=tranquil-target,target=/app/target,sharing=locked \
     if [ "$SLIM" = "true" ]; then \
       SQLX_OFFLINE=true cargo build --release -p tranquil-server --no-default-features; \
     else \
       SQLX_OFFLINE=true cargo build --release -p tranquil-server; \
     fi && \
-    cp target/release/tranquil-server /tmp/tranquil-pds
+    cp target/release/tranquil-server /tmp/tranquil-pds && \
+    if [ "$COMPRESS" = "true" ] && command -v upx >/dev/null 2>&1; then upx --best --lzma /tmp/tranquil-pds; fi
 
-FROM alpine:3.23
-RUN apk add --no-cache msmtp ca-certificates \
-    && ln -sf /usr/bin/msmtp /usr/sbin/sendmail
+FROM ${DISTROLESS_IMAGE}
 COPY --from=builder /tmp/tranquil-pds /usr/local/bin/tranquil-pds
-COPY --from=frontend /app/dist /var/lib/tranquil-pds/frontend
-COPY migrations /app/migrations
-WORKDIR /app
-ENV SERVER_HOST=0.0.0.0
+COPY --from=builder --chown=65532:65532 /stage/var/lib/tranquil-pds /var/lib/tranquil-pds
+COPY --from=frontend --chown=65532:65532 /app/dist /var/lib/tranquil-pds/frontend
+WORKDIR /var/lib/tranquil-pds
+ENV SERVER_HOST=[::]
 ENV SERVER_PORT=3000
 EXPOSE 3000
-CMD ["tranquil-pds"]
+ENTRYPOINT ["/usr/local/bin/tranquil-pds"]

Dockerfile.dev

@@ -0,0 +1,19 @@
+FROM rust:1.96-slim-trixie
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    pkg-config \
+    libssl-dev \
+    mold \
+    clang \
+    protobuf-compiler \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN cargo install cargo-watch
+
+ENV RUSTFLAGS="-C linker=clang -C link-arg=-fuse-ld=mold"
+ENV SQLX_OFFLINE=true
+
+WORKDIR /app
+
+CMD ["cargo", "watch", "-x", "run -p tranquil-server -- --config /app/config.dev.toml"]

README.md

@@ -6,7 +6,7 @@ A Personal Data Server for the AT Protocol.
 
 We came together to make this PDS to enable and empower our users to better host their data on this shared protocol. All of our decisions as a project are guided by their usefulness to the community: PDS hosters and end-users both. 
 
-Comparatively: Bluesky the company created a "reference PDS" that we can self-host quite easily, and that's great, but Bluesky has an incentive to make software for themselvess first & foremost, then secondly their software can be useful for us self-hosters. In contrast, Tranquil is not from a company, and will never be.
+Comparatively: Bluesky the company created a "reference PDS" that we can self-host quite easily, and that's great, but Bluesky has an incentive to make software for themselves first & foremost, then secondly their software can be useful for us self-hosters. In contrast, Tranquil is not from a company, and will never be.
 
 ## What's different about Tranquil PDS
 
@@ -20,7 +20,7 @@ It is a superset of the reference PDS, including:
 - account delegation: letting others manage an account with configurable permission levels
 - a built-in web UI for account management, repo browsing, and admin
 
-Unlike the ref PDS, Tranquil itself is compiled to a single binary with no nodeJS runtime. However, at time of writing, Tranquil requires postgres running separately.
+Unlike the ref PDS, Tranquil is a single binary with no nodejs runtime. That said, at time of writing, Tranquil does require postgres running separately.
 
 ## Quick Start
 
@@ -46,22 +46,28 @@ just test
 just lint
 ```
 
+Nix users can enter a devshell with `nix develop`, or `direnv allow` to auto-enter via the bundled `.envrc`. Pre-built artifacts including the devshell are available from our [binary cache](docs/2_INSTALL_NIX.md#binary-cache).
+
 ## Production Deployment
 
 ### Quick Deploy (Docker/Podman Compose)
 
-Edit `config.toml` with your values. Generate secrets with `openssl rand -base64 48`.
+`docker-compose.prod.yaml` pulls the prebuilt image `atcr.io/tranquil.farm/tranquil-pds:latest`. Sign in to the registry first with `podman login atcr.io`. The Containers guide covers building from source.
 
 ```bash
 cp example.toml config.toml
+```
+
+Edit `config.toml` with your values and generate secrets with `openssl rand -base64 48`. Set the postgres password to match `docker-compose.prod.yaml`. nginx needs a TLS certificate before it starts, so follow the wildcard cert steps in the [Containers guide](docs/2_INSTALL_CONTAINERS.md).
+
+```bash
 podman-compose -f docker-compose.prod.yaml up -d
 ```
 
 ### Installation Guides
 
-- [Debian](docs/install-debian.md)
-- [Containers](docs/install-containers.md)
-- [Kubernetes](docs/install-kubernetes.md)
+- [Nix](docs/2_INSTALL_NIX.md)
+- [Containers](docs/2_INSTALL_CONTAINERS.md)
 
 ## Community
 
@@ -74,7 +80,7 @@ We currently don't have a shared space to chat and organize Tranquil things, but
 - [@oyster.cafe](https://tangled.org/did:plc:3fwecdnvtcscjnrx2p4n7alz)
 - [@nel.pet](https://tangled.org/did:plc:h5wsnqetncv6lu2weom35lg2)
 
-### Amazing contributers
+### Amazing contributors
 
 - [@isabelroses.com](https://tangled.org/did:plc:qxichs7jsycphrsmbujwqbfb)
 - [@quilling.dev](https://tangled.org/did:plc:jrtgsidnmxaen4offglr5lsh)
@@ -85,6 +91,8 @@ We currently don't have a shared space to chat and organize Tranquil things, but
 - [@a.starrysky.fyi](https://tangled.org/did:plc:uuyqs6y3pwtbteet4swt5i5y)
 - [@sans-self.org](https://tangled.org/did:plc:wydyrngmxbcsqdvhmd7whmye)
 - [@tachyonism.tngl.sh](https://tangled.org/did:plc:w6qiwij62bmdugsd3gemhpy2)
+- [@trezy.codes](https://tangled.org/did:plc:4jrld6fwpnwqehtce56qshzv)
+- [@ave.zone](https://tangled.org/did:plc:mchrltkrhuzpxleiwpmmvpar)
 - Could be your name here too!
 
 ### Tranquil PDS instances in the wild!
@@ -99,4 +107,3 @@ This project is very grateful to [@nonbinary.computer](https://tangled.org/did:p
 ## License
 
 AGPL-3.0-or-later. Documentation is CC BY-SA 4.0. See [LICENSE](LICENSE) for details.
-

config.dev.toml

@@ -0,0 +1,30 @@
+[server]
+hostname = "pds.test"
+allow_http_proxy = true
+invite_code_required = false
+disable_rate_limiting = true
+
+[frontend]
+enabled = true
+dir = "/app/frontend/public"
+
+[database]
+url = "postgres://postgres:postgres@db:5432/pds"
+
+[storage]
+path = "/var/lib/tranquil-pds/blobs"
+
+[plc]
+directory_url = "http://plc:2582"
+
+[email]
+from_address = "noreply@pds.test"
+from_name = "Tranquil PDS (Dev)"
+
+[email.smarthost]
+host = "mailpit"
+port = 1025
+tls = "none"
+
+[secrets]
+allow_insecure = true

crates/tranquil-api/src/actor/preferences.rs

@@ -12,7 +12,6 @@ use tranquil_pds::auth::{Auth, NotTakendown, Permissive};
 use tranquil_pds::state::AppState;
 
 const APP_BSKY_NAMESPACE: &str = "app.bsky";
-const MAX_PREFERENCES_COUNT: usize = 100;
 const MAX_PREFERENCE_SIZE: usize = 10_000;
 const PERSONAL_DETAILS_PREF: &str = "app.bsky.actor.defs#personalDetailsPref";
 const DECLARED_AGE_PREF: &str = "app.bsky.actor.defs#declaredAgePref";
@@ -92,6 +91,8 @@ pub async fn put_preferences(
     auth: Auth<NotTakendown>,
     Json(input): Json<PutPreferencesInput>,
 ) -> Response {
+    let max_preferences_count: usize = tranquil_config::get().server.max_preferences_count;
+
     let has_full_access = auth.permissions().has_full_access();
     let user_id: uuid::Uuid = match state.repos.user.get_id_by_did(&auth.did).await {
         Ok(Some(id)) => id,
@@ -99,11 +100,11 @@ pub async fn put_preferences(
             return ApiError::InternalError(Some("User not found".into())).into_response();
         }
     };
-    if input.preferences.len() > MAX_PREFERENCES_COUNT {
+    if input.preferences.len() > max_preferences_count {
         return ApiError::InvalidRequest(format!(
             "Too many preferences: {} exceeds limit of {}",
             input.preferences.len(),
-            MAX_PREFERENCES_COUNT
+            max_preferences_count
         ))
         .into_response();
     }

crates/tranquil-api/src/admin/signal.rs

@@ -9,7 +9,6 @@ use tranquil_pds::state::AppState;
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SignalStatusOutput {
-    pub enabled: bool,
     pub linked: bool,
 }
 
@@ -23,13 +22,12 @@ pub async fn get_signal_status(
     State(state): State<AppState>,
     _auth: Auth<Admin>,
 ) -> Result<Json<SignalStatusOutput>, ApiError> {
-    let enabled = tranquil_config::get().signal.enabled;
     let linked = match &state.signal_sender {
         Some(slot) => slot.is_linked().await,
         None => false,
     };
 
-    Ok(Json(SignalStatusOutput { enabled, linked }))
+    Ok(Json(SignalStatusOutput { linked }))
 }
 
 pub async fn link_signal_device(
@@ -76,7 +74,7 @@ pub async fn link_signal_device(
         let result = tokio::select! {
             biased;
             _ = shutdown.cancelled() => {
-                tracing::info!("Signal linking aborted due to server shutdown");
+                tracing::info!("server shutting down, aborting signal linking");
                 return;
             }
             r = link_result.completion => r,
@@ -84,10 +82,10 @@ pub async fn link_signal_device(
         match result {
             Ok(Ok(client)) => {
                 if slot_for_task.complete_link(generation, client).await {
-                    tracing::info!("Signal device linked successfully");
+                    tracing::info!("signal device linked");
                 } else {
                     tracing::warn!(
-                        "Signal link completed but generation mismatch or already linked; discarding"
+                        "discarding completed signal link, generation mismatch or already linked"
                     );
                 }
             }

crates/tranquil-api/src/delegation.rs

@@ -174,9 +174,7 @@ pub async fn remove_controller(
                 .session
                 .delete_app_passwords_by_controller(&auth.did, &input.controller_did)
                 .await
-                .unwrap_or(0)
-                .try_into()
-                .unwrap_or(0usize);
+                .unwrap_or(0);
 
             let revoked_oauth_tokens = state
                 .repos
@@ -232,6 +230,20 @@ pub async fn update_controller_scopes(
         .await
     {
         Ok(true) => {
+            let revoked_app_passwords = state
+                .repos
+                .session
+                .delete_app_passwords_by_controller(&auth.did, &input.controller_did)
+                .await
+                .unwrap_or(0);
+
+            let revoked_oauth_tokens = state
+                .repos
+                .oauth
+                .revoke_tokens_for_controller(&auth.did, &input.controller_did)
+                .await
+                .unwrap_or(0);
+
             let _ = state
                 .repos
                 .delegation
@@ -241,7 +253,9 @@ pub async fn update_controller_scopes(
                     Some(&input.controller_did),
                     DelegationActionType::ScopesModified,
                     Some(json!({
-                        "new_scopes": input.granted_scopes.as_str()
+                        "new_scopes": input.granted_scopes.as_str(),
+                        "revoked_app_passwords": revoked_app_passwords,
+                        "revoked_oauth_tokens": revoked_oauth_tokens
                     })),
                     None,
                     None,
@@ -330,7 +344,6 @@ pub struct CreateDelegatedAccountInput {
     pub handle: String,
     pub email: Option<String>,
     pub controller_scopes: ValidatedDelegationScope,
-    pub invite_code: Option<String>,
 }
 
 #[derive(Debug, Serialize)]
@@ -362,19 +375,6 @@ pub async fn create_delegated_account(
         return Err(ApiError::InvalidEmail);
     }
 
-    let validated_invite_code = if let Some(ref code) = input.invite_code {
-        match state.repos.infra.validate_invite_code(code).await {
-            Ok(validated) => Some(validated),
-            Err(_) => return Err(ApiError::InvalidInviteCode),
-        }
-    } else {
-        let invite_required = tranquil_config::get().server.invite_code_required;
-        if invite_required {
-            return Err(ApiError::InviteCodeRequired);
-        }
-        None
-    };
-
     let plc = create_plc_did(&state, &handle).await.map_err(|e| {
         tracing::error!("PLC DID creation failed: {:?}", e);
         e
@@ -397,16 +397,15 @@ pub async fn create_delegated_account(
         commit_cid: repo.commit_cid.to_string(),
         repo_rev: repo.repo_rev.clone(),
         genesis_block_cids: repo.genesis_block_cids,
-        invite_code: input.invite_code.clone(),
     };
 
-    let user_id = match state
+    match state
         .repos
         .user
         .create_delegated_account(&create_input)
         .await
     {
-        Ok(id) => id,
+        Ok(_) => {}
         Err(tranquil_db_traits::CreateAccountError::HandleTaken) => {
             return Err(ApiError::HandleNotAvailable(None));
         }
@@ -417,16 +416,6 @@ pub async fn create_delegated_account(
             error!("Error creating delegated account: {:?}", e);
             return Err(ApiError::InternalError(None));
         }
-    };
-
-    if let Some(validated) = validated_invite_code
-        && let Err(e) = state
-            .repos
-            .infra
-            .record_invite_code_use(&validated, user_id)
-            .await
-    {
-        warn!("Failed to record invite code use for {}: {:?}", did, e);
     }
 
     crate::identity::provision::sequence_new_account(

crates/tranquil-api/src/identity/account.rs

@@ -10,6 +10,7 @@ use serde::{Deserialize, Serialize};
 use serde_json::json;
 use tracing::{debug, error, info};
 use tranquil_pds::api::error::ApiError;
+use tranquil_pds::api::invite::check_registration_invite;
 use tranquil_pds::auth::{ServiceTokenVerifier, extract_auth_token_from_header, is_service_token};
 use tranquil_pds::rate_limit::{AccountCreationLimit, RateLimited};
 use tranquil_pds::state::AppState;
@@ -415,40 +416,11 @@ pub async fn create_account(
         return ApiError::HandleTaken.into_response();
     }
 
-    let is_bootstrap = state.bootstrap_invite_code.is_some()
-        && state.repos.user.count_users().await.unwrap_or(1) == 0;
-
-    if is_bootstrap {
-        match input.invite_code.as_deref() {
-            Some(code) if Some(code) == state.bootstrap_invite_code.as_deref() => {}
-            _ => return ApiError::InvalidInviteCode.into_response(),
-        }
-    } else {
-        let invite_code_required = tranquil_config::get().server.invite_code_required;
-        if invite_code_required
-            && input
-                .invite_code
-                .as_ref()
-                .map(|c| c.trim().is_empty())
-                .unwrap_or(true)
-        {
-            return ApiError::InviteCodeRequired.into_response();
-        }
-        if let Some(code) = &input.invite_code
-            && !code.trim().is_empty()
-        {
-            let valid = match state.repos.user.check_and_consume_invite_code(code).await {
-                Ok(v) => v,
-                Err(e) => {
-                    error!("Error checking invite code: {:?}", e);
-                    return ApiError::InternalError(None).into_response();
-                }
-            };
-            if !valid {
-                return ApiError::InvalidInviteCode.into_response();
-            }
-        }
-    }
+    let invite_registration =
+        match check_registration_invite(&state, input.invite_code.as_deref()).await {
+            Ok(outcome) => outcome,
+            Err(e) => return e.into_response(),
+        };
 
     if let Err(e) = validate_password(&input.password) {
         return ApiError::InvalidRequest(e.to_string()).into_response();
@@ -510,17 +482,14 @@ pub async fn create_account(
         telegram_username: comms.telegram,
         signal_username: comms.signal,
         deactivated_at,
+        inbound_migration: is_migration || is_did_web_byod,
         encrypted_key_bytes: repo.encrypted_key_bytes,
         encryption_version: tranquil_pds::config::ENCRYPTION_VERSION,
         reserved_key_id,
         commit_cid: commit_cid_str.clone(),
         repo_rev: rev_str.clone(),
         genesis_block_cids: repo.genesis_block_cids,
-        invite_code: if is_bootstrap {
-            None
-        } else {
-            input.invite_code.clone()
-        },
+        invite_code: invite_registration.into_invite_code(),
         birthdate_pref,
     };
 
@@ -540,6 +509,9 @@ pub async fn create_account(
         Err(tranquil_db_traits::CreateAccountError::DidExists) => {
             return ApiError::AccountAlreadyExists.into_response();
         }
+        Err(tranquil_db_traits::CreateAccountError::InviteCodeUnavailable) => {
+            return ApiError::InvalidInviteCode.into_response();
+        }
         Err(e) => {
             error!("Error creating password account: {:?}", e);
             return ApiError::InternalError(None).into_response();

crates/tranquil-api/src/identity/did.rs

@@ -491,16 +491,10 @@ pub async fn get_recommended_did_credentials(
     let rotation_keys = if auth.did.starts_with("did:web:") {
         vec![]
     } else {
-        let server_rotation_key = match &tranquil_config::get().secrets.plc_rotation_key {
-            Some(key) => key.clone(),
-            None => {
-                warn!(
-                    "PLC_ROTATION_KEY not set, falling back to user's signing key for rotation key recommendation"
-                );
-                did_key.clone()
-            }
-        };
-        vec![server_rotation_key]
+        tranquil_pds::plc::rotation_keys_for(
+            tranquil_config::get().secrets.plc_rotation_key.as_deref(),
+            &signing_key,
+        )
     };
     Ok(Json(GetRecommendedDidCredentialsOutput {
         rotation_keys,

crates/tranquil-api/src/identity/plc/mod.rs

@@ -3,5 +3,5 @@ mod sign;
 mod submit;
 
 pub use request::request_plc_operation_signature;
-pub use sign::{ServiceInput, SignPlcOperationInput, SignPlcOperationOutput, sign_plc_operation};
+pub use sign::{SignPlcOperationInput, SignPlcOperationOutput, sign_plc_operation};
 pub use submit::{SubmitPlcOperationInput, submit_plc_operation};

crates/tranquil-api/src/identity/plc/request.rs

@@ -6,10 +6,6 @@ use tranquil_pds::api::error::{ApiError, DbResultExt};
 use tranquil_pds::auth::{Auth, Permissive};
 use tranquil_pds::state::AppState;
 
-fn generate_plc_token() -> String {
-    tranquil_pds::util::generate_token_code()
-}
-
 pub async fn request_plc_operation_signature(
     State(state): State<AppState>,
     auth: Auth<Permissive>,
@@ -28,12 +24,13 @@ pub async fn request_plc_operation_signature(
         .ok_or(ApiError::AccountNotFound)?;
 
     let _ = state.repos.infra.delete_plc_tokens_for_user(user_id).await;
-    let plc_token = generate_plc_token();
+    let display_token = tranquil_pds::util::generate_token_code();
+    let stored_token = tranquil_pds::util::normalize_token_code(&display_token);
     let expires_at = Utc::now() + Duration::minutes(10);
     state
         .repos
         .infra
-        .insert_plc_token(user_id, &plc_token, expires_at)
+        .insert_plc_token(user_id, &stored_token, expires_at)
         .await
         .log_db_err("creating PLC token")?;
 
@@ -42,7 +39,7 @@ pub async fn request_plc_operation_signature(
         state.repos.user.as_ref(),
         state.repos.infra.as_ref(),
         user_id,
-        &plc_token,
+        &display_token,
         hostname,
     )
     .await

crates/tranquil-api/src/identity/plc/sign.rs

@@ -9,7 +9,10 @@ use tranquil_pds::api::ApiError;
 use tranquil_pds::api::error::DbResultExt;
 use tranquil_pds::auth::{Auth, Permissive};
 use tranquil_pds::circuit_breaker::with_circuit_breaker;
-use tranquil_pds::plc::{PlcError, PlcService, ServiceType, create_update_op, sign_operation};
+use tranquil_pds::plc::{
+    PlcError, PlcService, create_update_op, missing_required_rotation_key, sign_operation,
+    signing_key_to_did_key,
+};
 use tranquil_pds::state::AppState;
 
 #[derive(Debug, Deserialize)]
@@ -19,14 +22,7 @@ pub struct SignPlcOperationInput {
     pub rotation_keys: Option<Vec<String>>,
     pub also_known_as: Option<Vec<String>>,
     pub verification_methods: Option<HashMap<String, String>>,
-    pub services: Option<HashMap<String, ServiceInput>>,
-}
-
-#[derive(Debug, Deserialize, Clone)]
-pub struct ServiceInput {
-    #[serde(rename = "type")]
-    pub service_type: ServiceType,
-    pub endpoint: String,
+    pub services: Option<HashMap<String, PlcService>>,
 }
 
 #[derive(Debug, Serialize)]
@@ -50,9 +46,10 @@ pub async fn sign_plc_operation(
             "PLC operations are only valid for did:plc identities".into(),
         ));
     }
-    let token = input.token.as_ref().ok_or_else(|| {
+    let raw_token = input.token.as_ref().ok_or_else(|| {
         ApiError::InvalidRequest("Email confirmation token required to sign PLC operations".into())
     })?;
+    let token = &tranquil_pds::util::normalize_token_code(raw_token);
 
     let user_id = state
         .repos
@@ -106,25 +103,12 @@ pub async fn sign_plc_operation(
     if last_op.is_tombstone() {
         return Err(ApiError::from(PlcError::Tombstoned));
     }
-    let services = input.services.map(|s| {
-        s.into_iter()
-            .map(|(k, v)| {
-                (
-                    k,
-                    PlcService {
-                        service_type: v.service_type,
-                        endpoint: v.endpoint,
-                    },
-                )
-            })
-            .collect()
-    });
     let unsigned_op = create_update_op(
         &last_op,
         input.rotation_keys,
         input.verification_methods,
         input.also_known_as,
-        services,
+        input.services,
     )
     .map_err(|e| match e {
         PlcError::Tombstoned => ApiError::InvalidRequest("Cannot update tombstoned DID".into()),
@@ -134,6 +118,18 @@ pub async fn sign_plc_operation(
         }
     })?;
 
+    let signing_did_key = signing_key_to_did_key(&signing_key);
+    if let Some(rotation_keys) = unsigned_op.get("rotationKeys").and_then(Value::as_array) {
+        let rotation_key_strs: Vec<&str> = rotation_keys.iter().filter_map(Value::as_str).collect();
+        if let Some(missing) = missing_required_rotation_key(
+            &rotation_key_strs,
+            &signing_did_key,
+            tranquil_config::get().secrets.plc_rotation_key.as_deref(),
+        ) {
+            return Err(ApiError::InvalidRequest(missing.message().into()));
+        }
+    }
+
     let signed_op = sign_operation(&unsigned_op, &signing_key).map_err(|e| {
         error!("Failed to sign PLC operation: {:?}", e);
         ApiError::InternalError(None)

crates/tranquil-api/src/identity/plc/submit.rs

@@ -67,19 +67,14 @@ pub async fn submit_plc_operation(
     })?;
 
     let user_did_key = signing_key_to_did_key(&signing_key);
-    let server_rotation_key = tranquil_config::get()
-        .secrets
-        .plc_rotation_key
-        .clone()
-        .unwrap_or_else(|| user_did_key.clone());
     if let Some(rotation_keys) = op.get("rotationKeys").and_then(Value::as_array) {
-        let has_server_key = rotation_keys
-            .iter()
-            .any(|k| k.as_str() == Some(&server_rotation_key));
-        if !has_server_key {
-            return Err(ApiError::InvalidRequest(
-                "Rotation keys do not include server's rotation key".into(),
-            ));
+        let rotation_key_strs: Vec<&str> = rotation_keys.iter().filter_map(Value::as_str).collect();
+        if let Some(missing) = tranquil_pds::plc::missing_required_rotation_key(
+            &rotation_key_strs,
+            &user_did_key,
+            tranquil_config::get().secrets.plc_rotation_key.as_deref(),
+        ) {
+            return Err(ApiError::InvalidRequest(missing.message().into()));
         }
     }
     if let Some(services) = op.get("services").and_then(Value::as_object)
@@ -129,20 +124,13 @@ pub async fn submit_plc_operation(
     .await
     .map_err(ApiError::from)?;
 
-    match state
+    if let Err(e) = state
         .repos
         .repo
         .insert_identity_event(did, Some(&user.handle))
         .await
     {
-        Ok(seq) => {
-            if let Err(e) = state.repos.repo.notify_update(seq).await {
-                warn!("Failed to notify identity event: {:?}", e);
-            }
-        }
-        Err(e) => {
-            warn!("Failed to sequence identity event: {:?}", e);
-        }
+        warn!("Failed to sequence identity event: {:?}", e);
     }
     let _ = state
         .cache

crates/tranquil-api/src/identity/provision.rs

@@ -45,15 +45,9 @@ pub async fn submit_plc_genesis(
     let hostname = &tranquil_config::get().server.hostname;
     let pds_endpoint = format!("https://{}", hostname);
 
-    let rotation_key = tranquil_config::get()
-        .secrets
-        .plc_rotation_key
-        .clone()
-        .unwrap_or_else(|| tranquil_pds::plc::signing_key_to_did_key(signing_key));
-
     let genesis_result = tranquil_pds::plc::create_genesis_operation(
         signing_key,
-        &rotation_key,
+        tranquil_config::get().secrets.plc_rotation_key.as_deref(),
         handle,
         &pds_endpoint,
     )

crates/tranquil-api/src/lib.rs

@@ -15,8 +15,12 @@ pub mod temp;
 use tranquil_pds::state::AppState;
 
 pub fn api_routes() -> axum::Router<AppState> {
+    use axum::extract::DefaultBodyLimit;
     use axum::routing::{get, post};
 
+    let blob_body_limit =
+        DefaultBodyLimit::max(tranquil_config::get().server.max_blob_size as usize);
+
     axum::Router::new()
         .route("/_health", get(server::health))
         .route(
@@ -68,7 +72,10 @@ pub fn api_routes() -> axum::Router<AppState> {
         .route("/com.atproto.repo.deleteRecord", post(repo::delete_record))
         .route("/com.atproto.repo.listRecords", get(repo::list_records))
         .route("/com.atproto.repo.describeRepo", get(repo::describe_repo))
-        .route("/com.atproto.repo.uploadBlob", post(repo::upload_blob))
+        .route(
+            "/com.atproto.repo.uploadBlob",
+            post(repo::upload_blob).layer(blob_body_limit),
+        )
         .route("/com.atproto.repo.applyWrites", post(repo::apply_writes))
         .route(
             "/com.atproto.server.checkAccountStatus",
@@ -247,7 +254,10 @@ pub fn api_routes() -> axum::Router<AppState> {
             "/_identity.verifyHandleOwnership",
             post(identity::verify_handle_ownership),
         )
-        .route("/com.atproto.repo.importRepo", post(repo::import_repo))
+        .route(
+            "/com.atproto.repo.importRepo",
+            post(repo::import_repo).layer(blob_body_limit),
+        )
         .route(
             "/com.atproto.admin.deleteAccount",
             post(admin::delete_account),

crates/tranquil-api/src/notification_prefs.rs

@@ -282,7 +282,7 @@ async fn process_messaging_channel_update(
                 "Invalid Telegram username. Must be 5-32 characters, alphanumeric or underscore".into(),
             ),
             CommsChannel::Signal => ApiError::InvalidRequest(
-                "Invalid Signal username. Must be 3-32 characters followed by .XX (e.g. username.01)".into(),
+                "Invalid Signal username. Must be a 3-32 character nickname, a dot, then a 2-20 digit discriminator".into(),
             ),
             CommsChannel::Email => ApiError::InvalidEmail,
         });

crates/tranquil-api/src/repo/import.rs

@@ -14,6 +14,35 @@ use tranquil_pds::sync::verify::CarVerifier;
 use tranquil_pds::types::Did;
 use tranquil_types::{AtUri, CidLink};
 
+fn map_car_verify_error(e: tranquil_pds::sync::verify::VerifyError) -> ApiError {
+    use tranquil_pds::sync::verify::VerifyError;
+    match e {
+        VerifyError::DidMismatch {
+            commit_did,
+            expected_did,
+        } => ApiError::InvalidRepo(format!(
+            "CAR file is for DID {} but you are authenticated as {}",
+            commit_did, expected_did
+        )),
+        VerifyError::InvalidSignature => ApiError::InvalidRequest(
+            "Repo commit signature does not match the DID document signing key".into(),
+        ),
+        VerifyError::NoSigningKey => {
+            ApiError::InvalidRequest("DID document has no atproto signing key".into())
+        }
+        VerifyError::DidResolutionFailed(msg) => {
+            ApiError::InvalidRequest(format!("Could not resolve DID document: {}", msg))
+        }
+        VerifyError::MstValidationFailed(msg) => {
+            ApiError::InvalidRequest(format!("MST validation failed: {}", msg))
+        }
+        other => {
+            error!("CAR verification failed: {:?}", other);
+            ApiError::InvalidRequest(format!("CAR verification failed: {}", other))
+        }
+    }
+}
+
 pub async fn import_repo(
     State(state): State<AppState>,
     auth: Auth<NotTakendown>,
@@ -77,27 +106,6 @@ pub async fn import_repo(
         blocks.len(),
         root
     );
-    let Some(root_block) = blocks.get(&root) else {
-        return Err(ApiError::InvalidRequest(
-            "Root block not found in CAR file".into(),
-        ));
-    };
-    let commit_did: Did = match jacquard_repo::commit::Commit::from_cbor(root_block) {
-        Ok(commit) => commit
-            .did()
-            .as_str()
-            .parse()
-            .map_err(|_| ApiError::InvalidRequest("Commit contains invalid DID".into()))?,
-        Err(e) => {
-            return Err(ApiError::InvalidRequest(format!("Invalid commit: {}", e)));
-        }
-    };
-    if commit_did != *did {
-        return Err(ApiError::InvalidRepo(format!(
-            "CAR file is for DID {} but you are authenticated as {}",
-            commit_did, did
-        )));
-    }
     let skip_verification = std::env::var("SKIP_IMPORT_VERIFICATION")
         .ok()
         .map(|v| v == "true" || v == "1")
@@ -106,92 +114,26 @@ pub async fn import_repo(
                 .map(|c| c.import.skip_verification)
                 .unwrap_or(false)
         });
-    let is_migration = user.deactivated_at.is_some();
+    let is_migration = user.inbound_migration && user.deactivated_at.is_some();
     if skip_verification {
-        warn!("Skipping all CAR verification for import (SKIP_IMPORT_VERIFICATION=true)");
+        warn!("Skipping all CAR verification for repo import (SKIP_IMPORT_VERIFICATION=true)");
     } else if is_migration {
-        debug!("Verifying CAR file structure for migration (skipping signature verification)");
-        let verifier = CarVerifier::new();
-        match verifier.verify_car_structure_only(did, &root, &blocks) {
-            Ok(verified) => {
-                debug!(
-                    "CAR structure verification successful: rev={}, data_cid={}",
-                    verified.rev, verified.data_cid
-                );
-            }
-            Err(tranquil_pds::sync::verify::VerifyError::DidMismatch {
-                commit_did,
-                expected_did,
-            }) => {
-                return Err(ApiError::InvalidRepo(format!(
-                    "CAR file is for DID {} but you are authenticated as {}",
-                    commit_did, expected_did
-                )));
-            }
-            Err(tranquil_pds::sync::verify::VerifyError::MstValidationFailed(msg)) => {
-                return Err(ApiError::InvalidRequest(format!(
-                    "MST validation failed: {}",
-                    msg
-                )));
-            }
-            Err(e) => {
-                error!("CAR structure verification error: {:?}", e);
-                return Err(ApiError::InvalidRequest(format!(
-                    "CAR verification failed: {}",
-                    e
-                )));
-            }
-        }
+        let verified = CarVerifier::new()
+            .verify_car_structure_only(&root, &blocks)
+            .map_err(map_car_verify_error)?;
+        debug!(
+            "CAR structure verified for migration import: rev={}, data_cid={}",
+            verified.rev, verified.data_cid
+        );
     } else {
-        debug!("Verifying CAR file signature and structure for DID {}", did);
-        let verifier = CarVerifier::new();
-        match verifier.verify_car(did, &root, &blocks).await {
-            Ok(verified) => {
-                debug!(
-                    "CAR verification successful: rev={}, data_cid={}",
-                    verified.rev, verified.data_cid
-                );
-            }
-            Err(tranquil_pds::sync::verify::VerifyError::DidMismatch {
-                commit_did,
-                expected_did,
-            }) => {
-                return Err(ApiError::InvalidRepo(format!(
-                    "CAR file is for DID {} but you are authenticated as {}",
-                    commit_did, expected_did
-                )));
-            }
-            Err(tranquil_pds::sync::verify::VerifyError::InvalidSignature) => {
-                return Err(ApiError::InvalidRequest(
-                    "CAR file commit signature verification failed".into(),
-                ));
-            }
-            Err(tranquil_pds::sync::verify::VerifyError::DidResolutionFailed(msg)) => {
-                warn!("DID resolution failed during import verification: {}", msg);
-                return Err(ApiError::InvalidRequest(format!(
-                    "Failed to verify DID: {}",
-                    msg
-                )));
-            }
-            Err(tranquil_pds::sync::verify::VerifyError::NoSigningKey) => {
-                return Err(ApiError::InvalidRequest(
-                    "DID document does not contain a signing key".into(),
-                ));
-            }
-            Err(tranquil_pds::sync::verify::VerifyError::MstValidationFailed(msg)) => {
-                return Err(ApiError::InvalidRequest(format!(
-                    "MST validation failed: {}",
-                    msg
-                )));
-            }
-            Err(e) => {
-                error!("CAR verification error: {:?}", e);
-                return Err(ApiError::InvalidRequest(format!(
-                    "CAR verification failed: {}",
-                    e
-                )));
-            }
-        }
+        let verified = CarVerifier::new()
+            .verify_car(did, &root, &blocks)
+            .await
+            .map_err(map_car_verify_error)?;
+        debug!(
+            "CAR signature and structure verified: rev={}, data_cid={}",
+            verified.rev, verified.data_cid
+        );
     }
     let max_blocks = tranquil_config::get().import.max_blocks as usize;
     let _write_lock = state.repo_write_locks.lock(user_id).await;
@@ -417,7 +359,6 @@ async fn sequence_import_event(
         rev: None,
     };
 
-    let seq = state.repos.repo.insert_commit_event(&data).await?;
-    state.repos.repo.notify_update(seq).await?;
+    state.repos.repo.insert_commit_event(&data).await?;
     Ok(())
 }

crates/tranquil-api/src/repo/record/batch.rs

@@ -1,6 +1,6 @@
 use super::validation::validate_record_with_status;
 use super::validation_mode::{ValidationMode, deserialize_validation_mode};
-use crate::repo::record::write::CommitInfo;
+use crate::repo::record::write::{CommitInfo, ensure_record_type};
 use axum::{Json, extract::State};
 use jacquard_repo::{mst::Mst, storage::BlockStore};
 use serde::{Deserialize, Serialize};
@@ -14,8 +14,8 @@ use tranquil_pds::auth::{
 };
 use tranquil_pds::repo::TrackingBlockStore;
 use tranquil_pds::repo_ops::{
-    FinalizeParams, RecordOp, begin_repo_write, extract_backlinks, extract_blob_cids,
-    finalize_repo_write,
+    CommitResult, FinalizeParams, RecordOp, begin_repo_write, extract_backlinks, extract_blob_cids,
+    finalize_repo_write, with_repair_retry,
 };
 use tranquil_pds::state::AppState;
 use tranquil_pds::types::{AtIdentifier, AtUri, Did, Nsid, Rkey};
@@ -27,7 +27,6 @@ struct WriteAccumulator {
     mst: Mst<TrackingBlockStore>,
     results: Vec<WriteResult>,
     ops: Vec<RecordOp>,
-    modified_keys: Vec<String>,
     all_blob_cids: Vec<String>,
     backlinks_to_add: Vec<Backlink>,
     backlinks_to_remove: Vec<AtUri>,
@@ -44,7 +43,6 @@ async fn process_single_write(
         mst,
         mut results,
         mut ops,
-        mut modified_keys,
         mut all_blob_cids,
         mut backlinks_to_add,
         mut backlinks_to_remove,
@@ -56,6 +54,8 @@ async fn process_single_write(
             rkey,
             value,
         } => {
+            let value = ensure_record_type(value, collection);
+            let value = &*value;
             let validation_status = if validate.should_skip() {
                 None
             } else {
@@ -69,8 +69,19 @@ async fn process_single_write(
                     .await?,
                 )
             };
-            all_blob_cids.extend(extract_blob_cids(value));
             let rkey = rkey.clone().unwrap_or_else(Rkey::generate);
+            let key = format!("{}/{}", collection, rkey);
+            if mst
+                .get(&key)
+                .await
+                .map_err(|e| ApiError::from_mst_error("read MST for applyWrites create", &e))?
+                .is_some()
+            {
+                return Err(ApiError::InvalidRequest(format!(
+                    "Record already exists at {key}"
+                )));
+            }
+            all_blob_cids.extend(extract_blob_cids(value));
             let record_ipld = tranquil_pds::util::json_to_ipld(value);
             let record_bytes = serde_ipld_dagcbor::to_vec(&record_ipld)
                 .map_err(|_| ApiError::InvalidRecord("Failed to serialize record".into()))?;
@@ -78,12 +89,10 @@ async fn process_single_write(
                 .put(&record_bytes)
                 .await
                 .map_err(|_| ApiError::InternalError(Some("Failed to store record".into())))?;
-            let key = format!("{}/{}", collection, rkey);
-            modified_keys.push(key.clone());
             let new_mst = mst
                 .add(&key, record_cid)
                 .await
-                .map_err(|_| ApiError::InternalError(Some("Failed to add to MST".into())))?;
+                .map_err(|e| ApiError::from_mst_error("add record to MST", &e))?;
             let uri = AtUri::from_parts(did, collection, &rkey);
             backlinks_to_add.extend(extract_backlinks(&uri, value));
             results.push(WriteResult::CreateResult {
@@ -100,7 +109,6 @@ async fn process_single_write(
                 mst: new_mst,
                 results,
                 ops,
-                modified_keys,
                 all_blob_cids,
                 backlinks_to_add,
                 backlinks_to_remove,
@@ -111,6 +119,8 @@ async fn process_single_write(
             rkey,
             value,
         } => {
+            let value = ensure_record_type(value, collection);
+            let value = &*value;
             let validation_status = if validate.should_skip() {
                 None
             } else {
@@ -124,6 +134,14 @@ async fn process_single_write(
                     .await?,
                 )
             };
+            let key = format!("{}/{}", collection, rkey);
+            let prev_record_cid = mst
+                .get(&key)
+                .await
+                .map_err(|e| ApiError::from_mst_error("read update target from MST", &e))?
+                .ok_or_else(|| {
+                    ApiError::InvalidRequest("Update target record does not exist".into())
+                })?;
             all_blob_cids.extend(extract_blob_cids(value));
             let record_ipld = tranquil_pds::util::json_to_ipld(value);
             let record_bytes = serde_ipld_dagcbor::to_vec(&record_ipld)
@@ -132,21 +150,10 @@ async fn process_single_write(
                 .put(&record_bytes)
                 .await
                 .map_err(|_| ApiError::InternalError(Some("Failed to store record".into())))?;
-            let key = format!("{}/{}", collection, rkey);
-            modified_keys.push(key.clone());
-            let prev_record_cid = mst
-                .get(&key)
-                .await
-                .map_err(|e| {
-                    ApiError::InternalError(Some(format!("Failed to read prev record: {}", e)))
-                })?
-                .ok_or_else(|| {
-                    ApiError::InvalidRequest("Update target record does not exist".into())
-                })?;
             let new_mst = mst
                 .update(&key, record_cid)
                 .await
-                .map_err(|_| ApiError::InternalError(Some("Failed to update MST".into())))?;
+                .map_err(|e| ApiError::from_mst_error("update record in MST", &e))?;
             let uri = AtUri::from_parts(did, collection, rkey);
             backlinks_to_remove.push(uri.clone());
             backlinks_to_add.extend(extract_backlinks(&uri, value));
@@ -165,7 +172,6 @@ async fn process_single_write(
                 mst: new_mst,
                 results,
                 ops,
-                modified_keys,
                 all_blob_cids,
                 backlinks_to_add,
                 backlinks_to_remove,
@@ -173,20 +179,17 @@ async fn process_single_write(
         }
         WriteOp::Delete { collection, rkey } => {
             let key = format!("{}/{}", collection, rkey);
-            modified_keys.push(key.clone());
             let prev_record_cid = mst
                 .get(&key)
                 .await
-                .map_err(|e| {
-                    ApiError::InternalError(Some(format!("Failed to read prev record: {}", e)))
-                })?
+                .map_err(|e| ApiError::from_mst_error("read delete target from MST", &e))?
                 .ok_or_else(|| {
                     ApiError::InvalidRequest("Delete target record does not exist".into())
                 })?;
             let new_mst = mst
                 .delete(&key)
                 .await
-                .map_err(|_| ApiError::InternalError(Some("Failed to delete from MST".into())))?;
+                .map_err(|e| ApiError::from_mst_error("delete record from MST", &e))?;
             backlinks_to_remove.push(AtUri::from_parts(did, collection, rkey));
             results.push(WriteResult::DeleteResult {});
             ops.push(RecordOp::Delete {
@@ -198,7 +201,6 @@ async fn process_single_write(
                 mst: new_mst,
                 results,
                 ops,
-                modified_keys,
                 all_blob_cids,
                 backlinks_to_add,
                 backlinks_to_remove,
@@ -219,7 +221,6 @@ async fn process_writes(
         mst: initial_mst,
         results: Vec::new(),
         ops: Vec::new(),
-        modified_keys: Vec::new(),
         all_blob_cids: Vec::new(),
         backlinks_to_add: Vec::new(),
         backlinks_to_remove: Vec::new(),
@@ -231,6 +232,45 @@ async fn process_writes(
         .await
 }
 
+async fn execute_apply_writes(
+    state: &AppState,
+    user_id: uuid::Uuid,
+    did: &Did,
+    input: &ApplyWritesInput,
+    controller_did: Option<&Did>,
+    write_summary: Option<serde_json::Value>,
+) -> Result<(CommitResult, Vec<WriteResult>), ApiError> {
+    let (ctx, mst) = begin_repo_write(state, user_id, input.swap_commit.as_deref()).await?;
+
+    let WriteAccumulator {
+        mst: final_mst,
+        results,
+        ops,
+        all_blob_cids,
+        backlinks_to_add,
+        backlinks_to_remove,
+    } = process_writes(&input.writes, mst, did, input.validate, &ctx.tracking_store).await?;
+
+    let commit_result = finalize_repo_write(
+        state,
+        ctx,
+        final_mst,
+        FinalizeParams {
+            did,
+            user_id,
+            controller_did,
+            delegation_detail: write_summary,
+            ops,
+            blob_cids: &all_blob_cids,
+            backlinks_to_add,
+            backlinks_to_remove,
+        },
+    )
+    .await?;
+
+    Ok((commit_result, results))
+}
+
 #[derive(Deserialize)]
 #[serde(tag = "$type")]
 pub enum WriteOp {
@@ -345,25 +385,6 @@ pub async fn apply_writes(
         .log_db_err("fetching user for batch write")?
         .ok_or(ApiError::InternalError(Some("User not found".into())))?;
 
-    let (ctx, mst) = begin_repo_write(&state, user_id, input.swap_commit.as_deref()).await?;
-
-    let WriteAccumulator {
-        mst: final_mst,
-        results,
-        ops,
-        modified_keys,
-        all_blob_cids,
-        backlinks_to_add,
-        backlinks_to_remove,
-    } = process_writes(
-        &input.writes,
-        mst,
-        &did,
-        input.validate,
-        &ctx.tracking_store,
-    )
-    .await?;
-
     let write_summary: Option<serde_json::Value> = controller_did.as_ref().map(|_| {
         let writes: Vec<serde_json::Value> = input
             .writes
@@ -397,22 +418,16 @@ pub async fn apply_writes(
         })
     });
 
-    let commit_result = finalize_repo_write(
-        &state,
-        ctx,
-        final_mst,
-        FinalizeParams {
-            did: &did,
+    let (commit_result, results) = with_repair_retry(&state, user_id, || {
+        execute_apply_writes(
+            &state,
             user_id,
-            controller_did: controller_did.as_ref(),
-            delegation_detail: write_summary,
-            ops,
-            modified_keys: &modified_keys,
-            blob_cids: &all_blob_cids,
-            backlinks_to_add,
-            backlinks_to_remove,
-        },
-    )
+            &did,
+            &input,
+            controller_did.as_ref(),
+            write_summary.clone(),
+        )
+    })
     .await?;
 
     Ok(Json(ApplyWritesOutput {

crates/tranquil-api/src/repo/record/delete.rs

@@ -4,13 +4,15 @@ use cid::Cid;
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use std::str::FromStr;
-use tracing::error;
 use tranquil_pds::api::error::ApiError;
 use tranquil_pds::auth::{Active, Auth, VerifyScope};
 use tranquil_pds::cid_types::RecordCid;
-use tranquil_pds::repo_ops::{FinalizeParams, RecordOp, begin_repo_write, finalize_repo_write};
+use tranquil_pds::repo_ops::{
+    FinalizeParams, RecordOp, begin_repo_write, finalize_repo_write, with_repair_retry,
+};
 use tranquil_pds::state::AppState;
-use tranquil_pds::types::{AtIdentifier, AtUri, Nsid, Rkey};
+use tranquil_pds::types::{AtIdentifier, AtUri, Did, Nsid, Rkey};
+use uuid::Uuid;
 
 #[derive(Deserialize)]
 pub struct DeleteRecordInput {
@@ -41,13 +43,30 @@ pub async fn delete_record(
     let user_id = repo_auth.user_id;
     let controller_did = repo_auth.controller_did;
 
-    let (ctx, mst) = begin_repo_write(&state, user_id, input.swap_commit.as_deref()).await?;
+    let out = with_repair_retry(&state, user_id, || {
+        delete_record_inner(&state, &did, user_id, controller_did.as_ref(), &input)
+    })
+    .await?;
+    Ok(Json(out))
+}
+
+async fn delete_record_inner(
+    state: &AppState,
+    did: &Did,
+    user_id: Uuid,
+    controller_did: Option<&Did>,
+    input: &DeleteRecordInput,
+) -> Result<DeleteRecordOutput, ApiError> {
+    let (ctx, mst) = begin_repo_write(state, user_id, input.swap_commit.as_deref()).await?;
 
     let key = format!("{}/{}", input.collection, input.rkey);
 
     if let Some(swap_record_str) = &input.swap_record {
         let expected_cid = Cid::from_str(swap_record_str).ok();
-        let actual_cid = mst.get(&key).await.ok().flatten();
+        let actual_cid = mst
+            .get(&key)
+            .await
+            .map_err(|e| ApiError::from_mst_error("read swap target from MST", &e))?;
         if expected_cid != actual_cid {
             return Err(ApiError::InvalidSwap(Some(
                 "Record has been modified or does not exist".into(),
@@ -55,18 +74,18 @@ pub async fn delete_record(
         }
     }
 
-    let prev_record_cid = mst.get(&key).await.map_err(|e| {
-        error!("Failed to read prev record from MST: {}", e);
-        ApiError::InternalError(Some("Failed to read MST".into()))
-    })?;
+    let prev_record_cid = mst
+        .get(&key)
+        .await
+        .map_err(|e| ApiError::from_mst_error("read prev record from MST", &e))?;
     let Some(prev_record_cid) = prev_record_cid else {
-        return Ok(Json(DeleteRecordOutput { commit: None }));
+        return Ok(DeleteRecordOutput { commit: None });
     };
 
-    let new_mst = mst.delete(&key).await.map_err(|e| {
-        error!("Failed to delete from MST: {}", e);
-        ApiError::InternalError(Some("Failed to delete from MST".into()))
-    })?;
+    let new_mst = mst
+        .delete(&key)
+        .await
+        .map_err(|e| ApiError::from_mst_error("delete record from MST", &e))?;
 
     let op = RecordOp::Delete {
         collection: input.collection.clone(),
@@ -74,18 +93,17 @@ pub async fn delete_record(
         prev: RecordCid::from(prev_record_cid),
     };
 
-    let modified_keys = [key];
-    let deleted_uri = AtUri::from_parts(&did, &input.collection, &input.rkey);
+    let deleted_uri = AtUri::from_parts(did, &input.collection, &input.rkey);
 
     let commit_result = finalize_repo_write(
-        &state,
+        state,
         ctx,
         new_mst,
         FinalizeParams {
-            did: &did,
+            did,
             user_id,
-            controller_did: controller_did.as_ref(),
-            delegation_detail: controller_did.as_ref().map(|_| {
+            controller_did,
+            delegation_detail: controller_did.map(|_| {
                 json!({
                     "action": "delete",
                     "collection": input.collection,
@@ -93,7 +111,6 @@ pub async fn delete_record(
                 })
             }),
             ops: vec![op],
-            modified_keys: &modified_keys,
             blob_cids: &[],
             backlinks_to_add: vec![],
             backlinks_to_remove: vec![deleted_uri],
@@ -101,10 +118,10 @@ pub async fn delete_record(
     )
     .await?;
 
-    Ok(Json(DeleteRecordOutput {
+    Ok(DeleteRecordOutput {
         commit: Some(CommitInfo {
             cid: commit_result.commit_cid.to_string(),
             rev: commit_result.rev,
         }),
-    }))
+    })
 }

crates/tranquil-api/src/repo/record/write.rs

@@ -5,8 +5,8 @@ use cid::Cid;
 use jacquard_repo::storage::BlockStore;
 use serde::{Deserialize, Serialize};
 use serde_json::json;
+use std::borrow::Cow;
 use std::str::FromStr;
-use tracing::error;
 use tranquil_pds::api::error::{ApiError, DbResultExt};
 use tranquil_pds::auth::{
     Active, Auth, AuthSource, RepoScopeAction, ScopeVerified, VerifyScope, require_not_migrated,
@@ -14,7 +14,7 @@ use tranquil_pds::auth::{
 };
 use tranquil_pds::repo_ops::{
     FinalizeParams, RecordOp, begin_repo_write, extract_backlinks, extract_blob_cids,
-    finalize_repo_write,
+    finalize_repo_write, with_repair_retry,
 };
 use tranquil_pds::state::AppState;
 use tranquil_pds::types::{AtIdentifier, AtUri, Did, Nsid, Rkey};
@@ -62,6 +62,29 @@ pub async fn prepare_repo_write<A: RepoScopeAction>(
     })
 }
 
+pub(crate) fn ensure_record_type<'a>(
+    record: &'a serde_json::Value,
+    collection: &Nsid,
+) -> Cow<'a, serde_json::Value> {
+    let serde_json::Value::Object(map) = record else {
+        return Cow::Borrowed(record);
+    };
+    let needs_fill = match map.get("$type") {
+        None | Some(serde_json::Value::Null) => true,
+        Some(serde_json::Value::String(existing)) => existing.is_empty(),
+        Some(_) => false,
+    };
+    if !needs_fill {
+        return Cow::Borrowed(record);
+    }
+    let mut map = map.clone();
+    map.insert(
+        "$type".to_string(),
+        serde_json::Value::String(collection.to_string()),
+    );
+    Cow::Owned(serde_json::Value::Object(map))
+}
+
 #[derive(Deserialize)]
 #[allow(dead_code)]
 pub struct CreateRecordInput {
@@ -95,15 +118,32 @@ pub struct CreateRecordOutput {
 pub async fn create_record(
     State(state): State<AppState>,
     auth: Auth<Active>,
-    Json(input): Json<CreateRecordInput>,
+    Json(mut input): Json<CreateRecordInput>,
 ) -> Result<Json<CreateRecordOutput>, ApiError> {
+    if let Cow::Owned(record) = ensure_record_type(&input.record, &input.collection) {
+        input.record = record;
+    }
     let scope_proof = auth.verify_repo_create(&input.collection)?;
     let repo_auth = prepare_repo_write(&state, &scope_proof, &input.repo).await?;
     let did = repo_auth.did;
     let user_id = repo_auth.user_id;
     let controller_did = repo_auth.controller_did;
 
-    let (ctx, mut mst) = begin_repo_write(&state, user_id, input.swap_commit.as_deref()).await?;
+    let out = with_repair_retry(&state, user_id, || {
+        create_record_inner(&state, &did, user_id, controller_did.as_ref(), &input)
+    })
+    .await?;
+    Ok(Json(out))
+}
+
+async fn create_record_inner(
+    state: &AppState,
+    did: &Did,
+    user_id: Uuid,
+    controller_did: Option<&Did>,
+    input: &CreateRecordInput,
+) -> Result<CreateRecordOutput, ApiError> {
+    let (ctx, mut mst) = begin_repo_write(state, user_id, input.swap_commit.as_deref()).await?;
 
     let validation_status = if input.validate.should_skip() {
         None
@@ -119,12 +159,12 @@ pub async fn create_record(
         )
     };
 
-    let rkey = input.rkey.unwrap_or_else(Rkey::generate);
+    let rkey = input.rkey.clone().unwrap_or_else(Rkey::generate);
     let mut ops: Vec<RecordOp> = Vec::new();
     let mut conflict_uris_to_cleanup: Vec<AtUri> = Vec::new();
 
     if !input.validate.should_skip() {
-        let record_uri = AtUri::from_parts(&did, &input.collection, &rkey);
+        let record_uri = AtUri::from_parts(did, &input.collection, &rkey);
         let backlinks = extract_backlinks(&record_uri, &input.record);
 
         if !backlinks.is_empty() {
@@ -149,24 +189,18 @@ pub async fn create_record(
                     Ok(Some(cid)) => cid,
                     Ok(None) => continue,
                     Err(e) => {
-                        error!(
-                            "Failed to read conflict record from MST {}: {:?}",
-                            conflict_uri, e
-                        );
-                        return Err(ApiError::InternalError(Some(
-                            "Failed to read conflicting record from MST".into(),
-                        )));
+                        return Err(ApiError::from_mst_error(
+                            &format!("read conflict record from MST {conflict_uri}"),
+                            &e,
+                        ));
                     }
                 };
 
                 mst = mst.delete(&conflict_key).await.map_err(|e| {
-                    error!(
-                        "Failed to delete conflict from MST {}: {:?}",
-                        conflict_uri, e
-                    );
-                    ApiError::InternalError(Some(
-                        "Failed to delete conflicting record from MST".into(),
-                    ))
+                    ApiError::from_mst_error(
+                        &format!("delete conflict from MST {conflict_uri}"),
+                        &e,
+                    )
                 })?;
 
                 ops.push(RecordOp::Delete {
@@ -179,6 +213,18 @@ pub async fn create_record(
         }
     }
 
+    let key = format!("{}/{}", input.collection, rkey);
+    if mst
+        .get(&key)
+        .await
+        .map_err(|e| ApiError::from_mst_error("read MST for create existence check", &e))?
+        .is_some()
+    {
+        return Err(ApiError::InvalidRequest(format!(
+            "Record already exists at {key}"
+        )));
+    }
+
     let record_ipld = tranquil_pds::util::json_to_ipld(&input.record);
     let record_bytes = serde_ipld_dagcbor::to_vec(&record_ipld)
         .map_err(|_| ApiError::InvalidRecord("Failed to serialize record".into()))?;
@@ -187,12 +233,10 @@ pub async fn create_record(
         .put(&record_bytes)
         .await
         .map_err(|_| ApiError::InternalError(Some("Failed to save record block".into())))?;
-
-    let key = format!("{}/{}", input.collection, rkey);
     mst = mst
         .add(&key, record_cid)
         .await
-        .map_err(|_| ApiError::InternalError(Some("Failed to add to MST".into())))?;
+        .map_err(|e| ApiError::from_mst_error("add record to MST", &e))?;
 
     ops.push(RecordOp::Create {
         collection: input.collection.clone(),
@@ -200,34 +244,20 @@ pub async fn create_record(
         cid: tranquil_pds::cid_types::RecordCid::from(record_cid),
     });
 
-    let modified_keys: Vec<String> = ops
-        .iter()
-        .map(|op| match op {
-            RecordOp::Create {
-                collection, rkey, ..
-            }
-            | RecordOp::Update {
-                collection, rkey, ..
-            }
-            | RecordOp::Delete {
-                collection, rkey, ..
-            } => format!("{}/{}", collection, rkey),
-        })
-        .collect();
     let blob_cids = extract_blob_cids(&input.record);
 
-    let created_uri = AtUri::from_parts(&did, &input.collection, &rkey);
+    let created_uri = AtUri::from_parts(did, &input.collection, &rkey);
     let backlinks_to_add = extract_backlinks(&created_uri, &input.record);
 
     let commit_result = finalize_repo_write(
-        &state,
+        state,
         ctx,
         mst,
         FinalizeParams {
-            did: &did,
+            did,
             user_id,
-            controller_did: controller_did.as_ref(),
-            delegation_detail: controller_did.as_ref().map(|_| {
+            controller_did,
+            delegation_detail: controller_did.map(|_| {
                 json!({
                     "action": "create",
                     "collection": input.collection,
@@ -235,7 +265,6 @@ pub async fn create_record(
                 })
             }),
             ops,
-            modified_keys: &modified_keys,
             blob_cids: &blob_cids,
             backlinks_to_add,
             backlinks_to_remove: conflict_uris_to_cleanup,
@@ -243,7 +272,7 @@ pub async fn create_record(
     )
     .await?;
 
-    Ok(Json(CreateRecordOutput {
+    Ok(CreateRecordOutput {
         uri: created_uri,
         cid: record_cid.to_string(),
         commit: CommitInfo {
@@ -251,7 +280,7 @@ pub async fn create_record(
             rev: commit_result.rev,
         },
         validation_status,
-    }))
+    })
 }
 
 #[derive(Deserialize)]
@@ -283,15 +312,32 @@ pub struct PutRecordOutput {
 pub async fn put_record(
     State(state): State<AppState>,
     auth: Auth<Active>,
-    Json(input): Json<PutRecordInput>,
+    Json(mut input): Json<PutRecordInput>,
 ) -> Result<Json<PutRecordOutput>, ApiError> {
+    if let Cow::Owned(record) = ensure_record_type(&input.record, &input.collection) {
+        input.record = record;
+    }
     let upsert_proof = auth.verify_repo_upsert(&input.collection)?;
     let repo_auth = prepare_repo_write(&state, &upsert_proof, &input.repo).await?;
     let did = repo_auth.did;
     let user_id = repo_auth.user_id;
     let controller_did = repo_auth.controller_did;
 
-    let (ctx, mst) = begin_repo_write(&state, user_id, input.swap_commit.as_deref()).await?;
+    let out = with_repair_retry(&state, user_id, || {
+        put_record_inner(&state, &did, user_id, controller_did.as_ref(), &input)
+    })
+    .await?;
+    Ok(Json(out))
+}
+
+async fn put_record_inner(
+    state: &AppState,
+    did: &Did,
+    user_id: Uuid,
+    controller_did: Option<&Did>,
+    input: &PutRecordInput,
+) -> Result<PutRecordOutput, ApiError> {
+    let (ctx, mst) = begin_repo_write(state, user_id, input.swap_commit.as_deref()).await?;
 
     let validation_status = if input.validate.should_skip() {
         None
@@ -309,9 +355,13 @@ pub async fn put_record(
 
     let key = format!("{}/{}", input.collection, input.rkey);
 
+    let read_cid = |r: Result<Option<Cid>, jacquard_repo::error::RepoError>| {
+        r.map_err(|e| ApiError::from_mst_error("read MST for put", &e))
+    };
+
     if let Some(swap_record_str) = &input.swap_record {
         let expected_cid = Cid::from_str(swap_record_str).ok();
-        let actual_cid = mst.get(&key).await.ok().flatten();
+        let actual_cid = read_cid(mst.get(&key).await)?;
         if expected_cid != actual_cid {
             return Err(ApiError::InvalidSwap(Some(
                 "Record has been modified or does not exist".into(),
@@ -319,7 +369,7 @@ pub async fn put_record(
         }
     }
 
-    let existing_cid = mst.get(&key).await.ok().flatten();
+    let existing_cid = read_cid(mst.get(&key).await)?;
     let record_ipld = tranquil_pds::util::json_to_ipld(&input.record);
     let record_bytes = serde_ipld_dagcbor::to_vec(&record_ipld)
         .map_err(|_| ApiError::InvalidRecord("Failed to serialize record".into()))?;
@@ -330,21 +380,21 @@ pub async fn put_record(
         .map_err(|_| ApiError::InternalError(Some("Failed to save record block".into())))?;
 
     if existing_cid == Some(record_cid) {
-        return Ok(Json(PutRecordOutput {
-            uri: AtUri::from_parts(&did, &input.collection, &input.rkey),
+        return Ok(PutRecordOutput {
+            uri: AtUri::from_parts(did, &input.collection, &input.rkey),
             cid: record_cid.to_string(),
             commit: None,
             validation_status,
-        }));
+        });
     }
 
-    let record_uri = AtUri::from_parts(&did, &input.collection, &input.rkey);
+    let record_uri = AtUri::from_parts(did, &input.collection, &input.rkey);
     let (new_mst, op, is_update, backlinks_to_remove) = match existing_cid {
         Some(prev_cid) => {
             let new_mst = mst
                 .update(&key, record_cid)
                 .await
-                .map_err(|_| ApiError::InternalError(Some("Failed to update MST".into())))?;
+                .map_err(|e| ApiError::from_mst_error("update record in MST", &e))?;
             let op = RecordOp::Update {
                 collection: input.collection.clone(),
                 rkey: input.rkey.clone(),
@@ -357,7 +407,7 @@ pub async fn put_record(
             let new_mst = mst
                 .add(&key, record_cid)
                 .await
-                .map_err(|_| ApiError::InternalError(Some("Failed to add to MST".into())))?;
+                .map_err(|e| ApiError::from_mst_error("add record to MST", &e))?;
             let op = RecordOp::Create {
                 collection: input.collection.clone(),
                 rkey: input.rkey.clone(),
@@ -367,19 +417,18 @@ pub async fn put_record(
         }
     };
 
-    let modified_keys = [key];
     let blob_cids = extract_blob_cids(&input.record);
     let backlinks_to_add = extract_backlinks(&record_uri, &input.record);
 
     let commit_result = finalize_repo_write(
-        &state,
+        state,
         ctx,
         new_mst,
         FinalizeParams {
-            did: &did,
+            did,
             user_id,
-            controller_did: controller_did.as_ref(),
-            delegation_detail: controller_did.as_ref().map(|_| {
+            controller_did,
+            delegation_detail: controller_did.map(|_| {
                 json!({
                     "action": if is_update { "update" } else { "create" },
                     "collection": input.collection,
@@ -387,7 +436,6 @@ pub async fn put_record(
                 })
             }),
             ops: vec![op],
-            modified_keys: &modified_keys,
             blob_cids: &blob_cids,
             backlinks_to_add,
             backlinks_to_remove,
@@ -395,7 +443,7 @@ pub async fn put_record(
     )
     .await?;
 
-    Ok(Json(PutRecordOutput {
+    Ok(PutRecordOutput {
         uri: record_uri,
         cid: record_cid.to_string(),
         commit: Some(CommitInfo {
@@ -403,5 +451,5 @@ pub async fn put_record(
             rev: commit_result.rev,
         }),
         validation_status,
-    }))
+    })
 }

crates/tranquil-api/src/server/account_status.rs

@@ -197,18 +197,19 @@ async fn assert_valid_did_document_for_service(
         .await
         .map_err(ApiError::InvalidRequest)?;
 
+        let doc_rotation_keys = doc_data
+            .get("rotationKeys")
+            .and_then(Value::as_array)
+            .map(|arr| arr.iter().filter_map(Value::as_str).collect::<Vec<_>>())
+            .unwrap_or_default();
+
         let server_rotation_key = tranquil_config::get().secrets.plc_rotation_key.clone();
-        if let Some(ref expected_rotation_key) = server_rotation_key {
-            let rotation_keys = doc_data
-                .get("rotationKeys")
-                .and_then(Value::as_array)
-                .map(|arr| arr.iter().filter_map(Value::as_str).collect::<Vec<_>>())
-                .unwrap_or_default();
-            if !rotation_keys.contains(&expected_rotation_key.as_str()) {
-                return Err(ApiError::InvalidRequest(
-                    "Server rotation key not included in PLC DID data".into(),
-                ));
-            }
+        if let Some(ref expected_rotation_key) = server_rotation_key
+            && !doc_rotation_keys.contains(&expected_rotation_key.as_str())
+        {
+            return Err(ApiError::InvalidRequest(
+                "Server rotation key not included in PLC DID data".into(),
+            ));
         }
 
         let doc_signing_key = doc_data
@@ -243,6 +244,16 @@ async fn assert_valid_did_document_for_service(
                     "DID document verification method does not match expected signing key".into(),
                 ));
             }
+
+            if !doc_rotation_keys.contains(&expected_did_key.as_str()) {
+                warn!(
+                    "DID {} rotation keys {:?} omit the PDS-managed signing key {}",
+                    did, doc_rotation_keys, expected_did_key
+                );
+                return Err(ApiError::InvalidRequest(
+                    "PLC rotation keys omit the PDS-managed signing key required to sign operations for this identity".into(),
+                ));
+            }
         }
     } else if let Some(host_and_path) = did.as_str().strip_prefix("did:web:") {
         let client = tranquil_pds::api::proxy_client::did_resolution_client();
@@ -665,27 +676,22 @@ pub async fn delete_account(
             error!("DB error deleting account: {:?}", e);
             ApiError::InternalError(None)
         })?;
-    let account_seq = tranquil_pds::repo_ops::sequence_account_event(
+    if let Err(e) = tranquil_pds::repo_ops::sequence_account_event(
         &state,
         did,
         tranquil_db_traits::AccountStatus::Deleted,
     )
-    .await;
-    match account_seq {
-        Ok(seq) => {
-            if let Err(e) = state.repos.repo.delete_sequences_except(did, seq).await {
-                warn!(
-                    "Failed to cleanup sequences for deleted account {}: {}",
-                    did, e
-                );
-            }
-        }
-        Err(e) => {
-            warn!(
-                "Failed to sequence account deletion event for {}: {}",
-                did, e
-            );
-        }
+    .await
+    {
+        warn!(
+            "Failed to sequence account deletion event for {}: {}",
+            did, e
+        );
+    } else if let Err(e) = state.repos.repo.purge_did_events_keeping_latest(did).await {
+        warn!(
+            "Failed to cleanup sequences for deleted account {}: {}",
+            did, e
+        );
     }
     let _ = state
         .cache

crates/tranquil-api/src/server/app_password.rs

@@ -116,7 +116,10 @@ pub async fn create_app_password(
             .await
             .ok()
             .flatten();
-        let granted_scopes = grant.map(|g| g.granted_scopes).unwrap_or_default();
+        let granted_scopes = match grant {
+            Some(g) => g.granted_scopes,
+            None => return Err(ApiError::InsufficientScope(None)),
+        };
 
         let requested = input.scopes.as_deref().unwrap_or("atproto");
         let intersected = intersect_scopes(requested, granted_scopes.as_str());

crates/tranquil-api/src/server/meta.rs

@@ -5,7 +5,7 @@ use tranquil_pds::BUILD_VERSION;
 use tranquil_pds::state::AppState;
 use tranquil_pds::util::{discord_app_id, discord_bot_username, telegram_bot_username};
 
-fn get_available_comms_channels() -> Vec<CommsChannel> {
+async fn get_available_comms_channels(state: &AppState) -> Vec<CommsChannel> {
     let cfg = tranquil_config::get();
     let mut channels = vec![CommsChannel::Email];
     if cfg.discord.bot_token.is_some() {
@@ -14,7 +14,9 @@ fn get_available_comms_channels() -> Vec<CommsChannel> {
     if cfg.telegram.bot_token.is_some() {
         channels.push(CommsChannel::Telegram);
     }
-    if cfg.signal.enabled {
+    if let Some(slot) = &state.signal_sender
+        && slot.is_linked().await
+    {
         channels.push(CommsChannel::Signal);
     }
     channels
@@ -66,7 +68,7 @@ pub struct DescribeServerOutput {
     pub telegram_bot_username: Option<String>,
 }
 
-pub async fn describe_server() -> Json<DescribeServerOutput> {
+pub async fn describe_server(State(state): State<AppState>) -> Json<DescribeServerOutput> {
     let cfg = tranquil_config::get();
     let pds_hostname = &cfg.server.hostname;
 
@@ -82,7 +84,7 @@ pub async fn describe_server() -> Json<DescribeServerOutput> {
             email: cfg.server.contact_email.clone(),
         },
         version: BUILD_VERSION,
-        available_comms_channels: get_available_comms_channels(),
+        available_comms_channels: get_available_comms_channels(&state).await,
         self_hosted_did_web_enabled: is_self_hosted_did_web_enabled(),
         discord_bot_username: discord_bot_username().map(String::from),
         discord_app_id: discord_app_id().map(String::from),

crates/tranquil-api/src/server/mod.rs

@@ -51,6 +51,7 @@ pub use session::{
     auto_resend_verification, confirm_signup, create_session, delete_session,
     get_legacy_login_preference, get_session, list_sessions, refresh_session, resend_verification,
     revoke_all_sessions, revoke_session, update_legacy_login_preference, update_locale,
+    verification_blocks_login,
 };
 pub use signing_key::reserve_signing_key;
 pub use totp::{

crates/tranquil-api/src/server/passkey_account.rs

@@ -7,6 +7,7 @@ use serde_json::json;
 use tracing::{debug, error, info, warn};
 use tranquil_db_traits::WebauthnChallengeType;
 use tranquil_pds::api::error::ApiError;
+use tranquil_pds::api::invite::check_registration_invite;
 use tranquil_pds::api::{OptionsResponse, SuccessResponse};
 use tranquil_pds::auth::NormalizedLoginIdentifier;
 
@@ -119,26 +120,8 @@ pub async fn create_passkey_account(
         return Err(ApiError::InvalidEmail);
     }
 
-    let is_bootstrap = state.bootstrap_invite_code.is_some()
-        && state.repos.user.count_users().await.unwrap_or(1) == 0;
-
-    let _validated_invite_code = if is_bootstrap {
-        match input.invite_code.as_deref() {
-            Some(code) if Some(code) == state.bootstrap_invite_code.as_deref() => None,
-            _ => return Err(ApiError::InvalidInviteCode),
-        }
-    } else if let Some(ref code) = input.invite_code {
-        match state.repos.infra.validate_invite_code(code).await {
-            Ok(validated) => Some(validated),
-            Err(_) => return Err(ApiError::InvalidInviteCode),
-        }
-    } else {
-        let invite_required = tranquil_config::get().server.invite_code_required;
-        if invite_required {
-            return Err(ApiError::InviteCodeRequired);
-        }
-        None
-    };
+    let invite_registration =
+        check_registration_invite(&state, input.invite_code.as_deref()).await?;
 
     let verification_channel = input
         .verification_channel
@@ -241,15 +224,9 @@ pub async fn create_passkey_account(
                     ));
                 }
             } else {
-                let rotation_key = tranquil_config::get()
-                    .secrets
-                    .plc_rotation_key
-                    .clone()
-                    .unwrap_or_else(|| tranquil_pds::plc::signing_key_to_did_key(&secret_key));
-
                 let genesis_result = match tranquil_pds::plc::create_genesis_operation(
                     &secret_key,
-                    &rotation_key,
+                    tranquil_config::get().secrets.plc_rotation_key.as_deref(),
                     &handle,
                     &pds_endpoint,
                 ) {
@@ -343,11 +320,7 @@ pub async fn create_passkey_account(
         commit_cid: repo.commit_cid.to_string(),
         repo_rev: repo.repo_rev.clone(),
         genesis_block_cids: repo.genesis_block_cids,
-        invite_code: if is_bootstrap {
-            None
-        } else {
-            input.invite_code.clone()
-        },
+        invite_code: invite_registration.into_invite_code(),
         birthdate_pref,
     };
 
@@ -359,6 +332,9 @@ pub async fn create_passkey_account(
         Err(tranquil_db_traits::CreateAccountError::EmailTaken) => {
             return Err(ApiError::EmailTaken);
         }
+        Err(tranquil_db_traits::CreateAccountError::InviteCodeUnavailable) => {
+            return Err(ApiError::InvalidInviteCode);
+        }
         Err(e) => {
             error!("Error creating passkey account: {:?}", e);
             return Err(ApiError::InternalError(None));

crates/tranquil-api/src/server/password.rs

@@ -13,10 +13,6 @@ use tranquil_pds::state::AppState;
 use tranquil_pds::types::PlainPassword;
 use tranquil_pds::validation::validate_password;
 
-fn generate_reset_code() -> String {
-    tranquil_pds::util::generate_token_code()
-}
-
 #[derive(Deserialize)]
 pub struct RequestPasswordResetInput {
     #[serde(alias = "identifier")]
@@ -70,12 +66,13 @@ pub async fn request_password_reset(
             return Err(ApiError::InternalError(None));
         }
     };
-    let code = generate_reset_code();
+    let display_code = tranquil_pds::util::generate_token_code();
+    let stored_code = tranquil_pds::util::normalize_token_code(&display_code);
     let expires_at = Utc::now() + Duration::minutes(10);
     if let Err(e) = state
         .repos
         .user
-        .set_password_reset_code(user_id, &code, expires_at)
+        .set_password_reset_code(user_id, &stored_code, expires_at)
         .await
     {
         error!("DB error setting reset code: {:?}", e);
@@ -86,7 +83,7 @@ pub async fn request_password_reset(
         state.repos.user.as_ref(),
         state.repos.infra.as_ref(),
         user_id,
-        &code,
+        &display_code,
         hostname,
     )
     .await
@@ -133,7 +130,13 @@ pub async fn reset_password(
     if let Err(e) = validate_password(password) {
         return Err(ApiError::InvalidRequest(e.to_string()));
     }
-    let user = match state.repos.user.get_user_by_reset_code(token).await {
+    let normalized_token = tranquil_pds::util::normalize_token_code(token);
+    let user = match state
+        .repos
+        .user
+        .get_user_by_reset_code(&normalized_token)
+        .await
+    {
         Ok(Some(u)) => u,
         Ok(None) => {
             return Err(ApiError::InvalidToken(None));

crates/tranquil-api/src/server/session.rs

@@ -8,18 +8,28 @@ use bcrypt::verify;
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use tracing::{error, info, warn};
-use tranquil_db_traits::{SessionId, TokenFamilyId};
+use tranquil_db_traits::{ChannelVerificationStatus, SessionId, TokenFamilyId};
 use tranquil_pds::api::error::{ApiError, DbResultExt};
 use tranquil_pds::api::{EmptyResponse, PreferredLocaleOutput, SuccessResponse};
 use tranquil_pds::auth::{
     Active, Auth, NormalizedLoginIdentifier, Permissive, require_legacy_session_mfa,
     require_reauth_window,
 };
-use tranquil_pds::rate_limit::{LoginLimit, RateLimited, RefreshSessionLimit};
+use tranquil_pds::rate_limit::{
+    LoginLimit, RateLimited, RefreshSessionLimit, TotpVerifyLimit,
+    check_user_rate_limit_with_message,
+};
 use tranquil_pds::state::AppState;
 use tranquil_pds::types::{AccountState, Did, Handle, PlainPassword};
 use tranquil_types::TokenId;
 
+pub fn verification_blocks_login(channel_verification: &ChannelVerificationStatus) -> bool {
+    !tranquil_config::get()
+        .server
+        .disable_account_verification_gate
+        && !channel_verification.has_any_verified()
+}
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct CreateSessionInput {
@@ -129,14 +139,13 @@ pub async fn create_session(
         warn!("Login attempt for takendown account: {}", row.did);
         return Err(ApiError::AccountTakedown);
     }
-    let is_verified = row.channel_verification.has_any_verified();
     let is_delegated = state
         .repos
         .delegation
         .is_delegated_account(&row.did)
         .await
         .unwrap_or(false);
-    if !is_verified && !is_delegated {
+    if verification_blocks_login(&row.channel_verification) && !is_delegated {
         warn!("Login attempt for unverified account: {}", row.did);
         let resend_info = auto_resend_verification(&state, &row.did).await;
         let handle = resend_info
@@ -162,16 +171,35 @@ pub async fn create_session(
     let has_totp = row.totp_enabled;
     let email_2fa_enabled = row.email_2fa_enabled;
     let is_legacy_login = has_totp || email_2fa_enabled;
+    let used_totp_factor = tranquil_pds::auth::legacy_2fa::used_totp_factor(
+        has_totp,
+        input.auth_factor_token.as_deref(),
+    );
     let twofa_ctx = tranquil_pds::auth::legacy_2fa::Legacy2faContext {
+        is_app_password: app_password_name.is_some(),
         email_2fa_enabled,
         has_totp,
         allow_legacy_login: row.allow_legacy_login,
     };
+    if let Some(token) = input.auth_factor_token.as_deref()
+        && has_totp
+        && tranquil_pds::auth::legacy_2fa::looks_like_totp_token(token)
+    {
+        check_user_rate_limit_with_message::<TotpVerifyLimit>(
+            &state,
+            row.did.as_str(),
+            "Too many verification attempts. Please try again in a few minutes.",
+        )
+        .await?;
+    }
     match tranquil_pds::auth::legacy_2fa::process_legacy_2fa(
         state.cache.as_ref(),
         &row.did,
         &twofa_ctx,
         input.auth_factor_token.as_deref(),
+        async |t: &str| {
+            crate::server::totp::verify_totp_or_backup_for_user(&state, &row.did, t).await
+        },
     )
     .await
     {
@@ -278,7 +306,7 @@ pub async fn create_session(
         error!("Failed to insert session: {:?}", e);
         return Err(ApiError::InternalError(None));
     }
-    if is_legacy_login {
+    if is_legacy_login && !used_totp_factor {
         warn!(
             did = %row.did,
             ip = %client_ip,
@@ -424,7 +452,12 @@ pub async fn delete_session(
 ) -> Result<Json<EmptyResponse>, ApiError> {
     let jti = tranquil_pds::auth::extract_jti_from_headers(&headers)
         .ok_or(ApiError::AuthenticationRequired)?;
-    match state.repos.session.delete_session_by_access_jti(&jti).await {
+    match state
+        .repos
+        .session
+        .delete_session_by_access_jti(&jti, &auth.did)
+        .await
+    {
         Ok(rows) if rows > 0 => {
             let session_cache_key = tranquil_pds::cache_keys::session_key(&auth.did, &jti);
             let _ = state.cache.delete(&session_cache_key).await;
@@ -477,16 +510,15 @@ pub async fn refresh_session(
             )));
         }
     };
-    if let Ok(Some(_)) = state
-        .repos
-        .session
-        .check_refresh_token_used(&refresh_jti)
-        .await
+    if let Some(result) = dispatch_refresh_grace(
+        &state,
+        &refresh_token,
+        &refresh_jti,
+        state.repos.session.lookup_refresh_grace(&refresh_jti).await,
+    )
+    .await
     {
-        warn!("Refresh token reuse detected for jti: {}", refresh_jti);
-        return Err(ApiError::AuthenticationFailed(Some(
-            "Refresh token has been revoked due to suspected compromise".into(),
-        )));
+        return result;
     }
     let session_row = match state
         .repos
@@ -496,9 +528,18 @@ pub async fn refresh_session(
     {
         Ok(Some(row)) => row,
         Ok(None) => {
-            return Err(ApiError::AuthenticationFailed(Some(
-                "Invalid refresh token".into(),
-            )));
+            return dispatch_refresh_grace(
+                &state,
+                &refresh_token,
+                &refresh_jti,
+                state.repos.session.lookup_refresh_grace(&refresh_jti).await,
+            )
+            .await
+            .unwrap_or_else(|| {
+                Err(ApiError::AuthenticationFailed(Some(
+                    "Invalid refresh token".into(),
+                )))
+            });
         }
         Err(e) => {
             error!("Database error fetching session: {:?}", e);
@@ -544,6 +585,7 @@ pub async fn refresh_session(
         }
     };
     let refresh_data = tranquil_db_traits::SessionRefreshData {
+        did: session_row.did.clone(),
         old_refresh_jti: refresh_jti.clone(),
         session_id: session_row.id,
         new_access_jti: new_access_meta.jti.clone(),
@@ -551,22 +593,27 @@ pub async fn refresh_session(
         new_access_expires_at: new_access_meta.expires_at,
         new_refresh_expires_at: new_refresh_meta.expires_at,
     };
-    match state
+    let (access_jwt, refresh_jwt) = match state
         .repos
         .session
         .refresh_session_atomic(&refresh_data)
         .await
     {
-        Ok(tranquil_db_traits::RefreshSessionResult::Success) => {}
-        Ok(tranquil_db_traits::RefreshSessionResult::TokenAlreadyUsed) => {
-            warn!("Refresh token reuse detected during atomic operation");
-            return Err(ApiError::AuthenticationFailed(Some(
-                "Refresh token has been revoked due to suspected compromise".into(),
-            )));
+        Ok(tranquil_db_traits::RefreshSessionResult::Success) => {
+            (new_access_meta.token, new_refresh_meta.token)
         }
-        Ok(tranquil_db_traits::RefreshSessionResult::ConcurrentRefresh) => {
+        Ok(tranquil_db_traits::RefreshSessionResult::GraceReplay(replay)) => {
+            // Lost a benign concurrent rotation; re-mint the winner's tokens
+            // using this session's signing key (same user, unchanged by rotation).
+            info!(
+                "Concurrent refresh within grace window for session_id: {}; replaying tokens",
+                session_row.id
+            );
+            remint_grace_tokens(&replay, &key_bytes)?
+        }
+        Ok(tranquil_db_traits::RefreshSessionResult::Compromise) => {
             warn!(
-                "Concurrent refresh detected for session_id: {}",
+                "Refresh token reuse outside grace window or unreplayable rotation conflict for session_id: {}",
                 session_row.id
             );
             return Err(ApiError::AuthenticationFailed(Some(
@@ -577,12 +624,151 @@ pub async fn refresh_session(
             error!("Database error during session refresh: {:?}", e);
             return Err(ApiError::InternalError(None));
         }
+    };
+    build_refresh_session_output(&state, session_row.did, access_jwt, refresh_jwt).await
+}
+
+async fn dispatch_refresh_grace(
+    state: &AppState,
+    refresh_token: &str,
+    presented_jti: &str,
+    lookup: Result<tranquil_db_traits::RefreshGraceLookup, tranquil_db_traits::DbError>,
+) -> Option<Result<Json<RefreshSessionOutput>, ApiError>> {
+    match lookup {
+        Ok(tranquil_db_traits::RefreshGraceLookup::NotUsed) => None,
+        Ok(tranquil_db_traits::RefreshGraceLookup::Replay(replay)) => {
+            Some(serve_refresh_grace_replay(state, refresh_token, presented_jti, replay).await)
+        }
+        Ok(tranquil_db_traits::RefreshGraceLookup::Compromised {
+            did,
+            session_id,
+            key_bytes,
+            encryption_version,
+        }) => Some(Err(revoke_compromised_session(
+            state,
+            refresh_token,
+            presented_jti,
+            did,
+            session_id,
+            key_bytes,
+            encryption_version,
+        )
+        .await)),
+        Err(e) => {
+            error!("Database error checking refresh token grace: {:?}", e);
+            Some(Err(ApiError::InternalError(None)))
+        }
     }
-    let did_for_doc = session_row.did.clone();
+}
+
+async fn serve_refresh_grace_replay(
+    state: &AppState,
+    refresh_token: &str,
+    presented_jti: &str,
+    replay: tranquil_db_traits::RefreshGraceReplay,
+) -> Result<Json<RefreshSessionOutput>, ApiError> {
+    let key =
+        match tranquil_pds::config::decrypt_key(&replay.key_bytes, Some(replay.encryption_version))
+        {
+            Ok(k) => k,
+            Err(e) => {
+                error!("Failed to decrypt user key for grace replay: {:?}", e);
+                return Err(ApiError::InternalError(None));
+            }
+        };
+    if tranquil_pds::auth::verify_refresh_token(refresh_token, &key).is_err() {
+        return Err(ApiError::AuthenticationFailed(Some(
+            "Invalid refresh token".into(),
+        )));
+    }
+    info!("Refresh token reuse within grace window for jti: {presented_jti}; replaying tokens");
+    let (access_jwt, refresh_jwt) = remint_grace_tokens(&replay, &key)?;
+    build_refresh_session_output(state, replay.did, access_jwt, refresh_jwt).await
+}
+
+async fn revoke_compromised_session(
+    state: &AppState,
+    refresh_token: &str,
+    presented_jti: &str,
+    did: Did,
+    session_id: SessionId,
+    key_bytes: Vec<u8>,
+    encryption_version: i32,
+) -> ApiError {
+    let key = match tranquil_pds::config::decrypt_key(&key_bytes, Some(encryption_version)) {
+        Ok(k) => k,
+        Err(e) => {
+            error!("Failed to decrypt user key for grace check: {:?}", e);
+            return ApiError::InternalError(None);
+        }
+    };
+    if tranquil_pds::auth::verify_refresh_token(refresh_token, &key).is_err() {
+        return ApiError::AuthenticationFailed(Some("Invalid refresh token".into()));
+    }
+    warn!("Refresh token reuse outside grace window for jti: {presented_jti}; revoking session");
+    if let Err(e) = state
+        .repos
+        .session
+        .delete_session_by_id(session_id, &did)
+        .await
+    {
+        error!(
+            "Failed to revoke session {} for refresh token reuse: {:?}",
+            session_id.as_i32(),
+            e
+        );
+        return ApiError::InternalError(None);
+    }
+    ApiError::AuthenticationFailed(Some(
+        "Refresh token has been revoked due to suspected compromise".into(),
+    ))
+}
+
+/// Re-mint the access/refresh JWTs for a grace-window replay from the session's
+/// current jtis and signing key. We never persist the signed JWTs; they are
+/// reconstructed on demand so a benignly-racing client converges on the same
+/// credentials the winning rotation produced. `key_bytes` is the owning user's
+/// already-decrypted signing key.
+fn remint_grace_tokens(
+    replay: &tranquil_db_traits::RefreshGraceReplay,
+    key_bytes: &[u8],
+) -> Result<(String, String), ApiError> {
+    let access_jwt = tranquil_pds::auth::create_access_token_with_jti(
+        &replay.did,
+        key_bytes,
+        replay.scope.as_deref(),
+        replay.controller_did.as_deref(),
+        None,
+        &replay.access_jti,
+        replay.access_expires_at,
+    )
+    .map_err(|e| {
+        error!("Failed to re-mint access token for grace replay: {:?}", e);
+        ApiError::InternalError(None)
+    })?;
+    let refresh_jwt = tranquil_pds::auth::create_refresh_token_with_jti(
+        &replay.did,
+        key_bytes,
+        &replay.refresh_jti,
+        replay.refresh_expires_at,
+    )
+    .map_err(|e| {
+        error!("Failed to re-mint refresh token for grace replay: {:?}", e);
+        ApiError::InternalError(None)
+    })?;
+    Ok((access_jwt, refresh_jwt))
+}
+
+async fn build_refresh_session_output(
+    state: &AppState,
+    did: Did,
+    access_jwt: String,
+    refresh_jwt: String,
+) -> Result<Json<RefreshSessionOutput>, ApiError> {
     let did_resolver = state.did_resolver.clone();
     let (db_result, did_doc) = tokio::join!(
-        state.repos.user.get_session_info_by_did(&session_row.did),
-        did_resolver.fetch_did_document(&did_for_doc)
+        state.repos.user.get_session_info_by_did(&did),
+        did_resolver.fetch_did_document(&did)
     );
     match db_result {
         Ok(Some(u)) => {
@@ -593,10 +779,10 @@ pub async fn refresh_session(
             let account_state =
                 AccountState::from_db_fields(u.deactivated_at, u.takedown_ref.clone(), None, None);
             Ok(Json(RefreshSessionOutput {
-                access_jwt: new_access_meta.token,
-                refresh_jwt: new_refresh_meta.token,
+                access_jwt,
+                refresh_jwt,
                 handle,
-                did: session_row.did,
+                did,
                 email: u.email,
                 email_confirmed: u.channel_verification.email,
                 preferred_channel: u.preferred_comms_channel.as_str().to_string(),
@@ -609,7 +795,7 @@ pub async fn refresh_session(
             }))
         }
         Ok(None) => {
-            error!("User not found for existing session: {}", session_row.did);
+            error!("User not found for existing session: {}", did);
             Err(ApiError::InternalError(None))
         }
         Err(e) => {
@@ -980,7 +1166,7 @@ pub async fn revoke_session(
         state
             .repos
             .session
-            .delete_session_by_id(session_id)
+            .delete_session_by_id(session_id, &auth.did)
             .await
             .log_db_err("deleting session")?;
         let cache_key = tranquil_pds::cache_keys::session_key(&auth.did, &access_jti);

crates/tranquil-api/src/server/totp.rs

@@ -6,8 +6,8 @@ use tranquil_pds::api::error::{ApiError, DbResultExt};
 use tranquil_pds::auth::{
     Active, Auth, decrypt_totp_secret, encrypt_totp_secret, generate_backup_codes,
     generate_qr_png_base64, generate_totp_secret, generate_totp_uri, hash_backup_code,
-    is_backup_code_format, require_legacy_session_mfa, verify_backup_code, verify_password_mfa,
-    verify_totp_code, verify_totp_mfa,
+    is_backup_code_format, verify_backup_code, verify_password_mfa, verify_totp_code,
+    verify_totp_mfa,
 };
 use tranquil_pds::rate_limit::{TotpVerifyLimit, check_user_rate_limit_with_message};
 use tranquil_pds::state::AppState;
@@ -163,11 +163,9 @@ pub async fn disable_totp(
     auth: Auth<Active>,
     Json(input): Json<DisableTotpInput>,
 ) -> Result<Json<EmptyResponse>, ApiError> {
-    let session_mfa = require_legacy_session_mfa(&state, &auth).await?;
-
     let _rate_limit = check_user_rate_limit_with_message::<TotpVerifyLimit>(
         &state,
-        session_mfa.did(),
+        &auth.did,
         "Too many verification attempts. Please try again in a few minutes.",
     )
     .await?;
@@ -184,7 +182,7 @@ pub async fn disable_totp(
 
     tranquil_pds::auth::legacy_2fa::clear_challenge(state.cache.as_ref(), &auth.did).await;
 
-    info!(did = %session_mfa.did(), "TOTP disabled (verified via {} and {})", password_mfa.method(), totp_mfa.method());
+    info!(did = %password_mfa.did(), "TOTP disabled (verified via {} and {})", password_mfa.method(), totp_mfa.method());
 
     Ok(Json(EmptyResponse {}))
 }

crates/tranquil-auth/src/lib.rs

@@ -5,10 +5,11 @@ mod verify;
 
 pub use token::{
     create_access_token, create_access_token_hs256, create_access_token_hs256_with_metadata,
-    create_access_token_with_delegation, create_access_token_with_metadata,
-    create_access_token_with_scope_metadata, create_refresh_token, create_refresh_token_hs256,
-    create_refresh_token_hs256_with_metadata, create_refresh_token_with_metadata,
-    create_service_token, create_service_token_hs256,
+    create_access_token_with_delegation, create_access_token_with_jti,
+    create_access_token_with_metadata, create_access_token_with_scope_metadata,
+    create_refresh_token, create_refresh_token_hs256, create_refresh_token_hs256_with_metadata,
+    create_refresh_token_with_jti, create_refresh_token_with_metadata, create_service_token,
+    create_service_token_hs256,
 };
 
 pub use totp::{

crates/tranquil-auth/src/token.rs

@@ -4,7 +4,7 @@ use super::types::{
 use anyhow::Result;
 use base64::Engine as _;
 use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-use chrono::{Duration, Utc};
+use chrono::{DateTime, Duration, Utc};
 use hmac::{Hmac, Mac};
 use k256::ecdsa::{Signature, SigningKey, signature::Signer};
 use sha2::Sha256;
@@ -35,7 +35,7 @@ pub fn create_access_token_with_scope_metadata(
         scope,
         TokenType::Access,
         key_bytes,
-        Duration::minutes(15),
+        Duration::minutes(120),
         hostname,
     )
 }
@@ -54,7 +54,7 @@ pub fn create_access_token_with_delegation(
         scope,
         TokenType::Access,
         key_bytes,
-        Duration::minutes(15),
+        Duration::minutes(120),
         act,
         hostname,
     )
@@ -69,11 +69,59 @@ pub fn create_refresh_token_with_metadata(
         TokenScope::Refresh.as_str(),
         TokenType::Refresh,
         key_bytes,
-        Duration::days(14),
+        Duration::days(90),
         None,
     )
 }
 
+/// Re-mint an access token carrying a specific `jti` and expiry. Used by the
+/// refresh grace window to reproduce a session's current access token without
+/// persisting the signed JWT itself.
+pub fn create_access_token_with_jti(
+    did: &str,
+    key_bytes: &[u8],
+    scopes: Option<&str>,
+    controller_did: Option<&str>,
+    hostname: Option<&str>,
+    jti: &str,
+    expires_at: DateTime<Utc>,
+) -> Result<String> {
+    let scope = scopes.unwrap_or(TokenScope::Access.as_str());
+    let act = controller_did.map(|c| ActClaim { sub: c.to_string() });
+    Ok(create_signed_token_pinned(
+        did,
+        scope,
+        TokenType::Access,
+        key_bytes,
+        expires_at,
+        jti.to_string(),
+        act,
+        hostname,
+    )?
+    .token)
+}
+
+/// Re-mint a refresh token carrying a specific `jti` and expiry. Counterpart to
+/// [`create_access_token_with_jti`] for the refresh grace window.
+pub fn create_refresh_token_with_jti(
+    did: &str,
+    key_bytes: &[u8],
+    jti: &str,
+    expires_at: DateTime<Utc>,
+) -> Result<String> {
+    Ok(create_signed_token_pinned(
+        did,
+        TokenScope::Refresh.as_str(),
+        TokenType::Refresh,
+        key_bytes,
+        expires_at,
+        jti.to_string(),
+        None,
+        None,
+    )?
+    .token)
+}
+
 pub fn create_service_token(
     did: &str,
     aud: &str,
@@ -122,14 +170,27 @@ fn create_signed_token_with_act(
     act: Option<ActClaim>,
     hostname: Option<&str>,
 ) -> Result<TokenWithMetadata> {
-    let signing_key = SigningKey::from_slice(key_bytes)?;
-
     let expires_at = Utc::now()
         .checked_add_signed(duration)
         .expect("valid timestamp");
+    let jti = uuid::Uuid::new_v4().to_string();
+    create_signed_token_pinned(did, scope, typ, key_bytes, expires_at, jti, act, hostname)
+}
+
+#[allow(clippy::too_many_arguments)]
+fn create_signed_token_pinned(
+    did: &str,
+    scope: &str,
+    typ: TokenType,
+    key_bytes: &[u8],
+    expires_at: DateTime<Utc>,
+    jti: String,
+    act: Option<ActClaim>,
+    hostname: Option<&str>,
+) -> Result<TokenWithMetadata> {
+    let signing_key = SigningKey::from_slice(key_bytes)?;
 
     let expiration = expires_at.timestamp();
-    let jti = uuid::Uuid::new_v4().to_string();
 
     let aud_hostname = hostname.map(|h| h.to_string()).unwrap_or_else(|| {
         tranquil_config::try_get()
@@ -198,7 +259,7 @@ pub fn create_access_token_hs256_with_metadata(
         TokenScope::Access.as_str(),
         TokenType::Access,
         secret,
-        Duration::minutes(15),
+        Duration::minutes(120),
     )
 }
 
@@ -211,7 +272,7 @@ pub fn create_refresh_token_hs256_with_metadata(
         TokenScope::Refresh.as_str(),
         TokenType::Refresh,
         secret,
-        Duration::days(14),
+        Duration::days(90),
     )
 }
 

crates/tranquil-auth/src/types.rs

@@ -15,7 +15,9 @@ impl TokenType {
         match self {
             Self::Access => "at+jwt",
             Self::Refresh => "refresh+jwt",
-            Self::Service => "jwt",
+            // RFC 7519 §5.1 recommends the uppercase "JWT".
+            // and for atproto inter-service auth its a requirement.
+            Self::Service => "JWT",
         }
     }
 }
@@ -290,6 +292,17 @@ mod tests {
         assert!(TokenType::from_str("bearer").is_err());
     }
 
+    #[test]
+    fn service_token_header_serializes_typ_as_uppercase_jwt() {
+        // RFC 7519 §5.1 recommends the JWT `typ` header value be uppercase "JWT".
+        let header = Header {
+            alg: SigningAlgorithm::ES256K,
+            typ: TokenType::Service,
+        };
+        let json = serde_json::to_string(&header).expect("serialize header");
+        assert!(json.contains(r#""typ":"JWT""#), "got {json}");
+    }
+
     #[test]
     fn signing_algorithm_case_insensitive() {
         assert_eq!(

crates/tranquil-cache/Cargo.toml

@@ -16,5 +16,6 @@ tranquil-ripple = { workspace = true }
 async-trait = { workspace = true }
 base64 = { workspace = true }
 redis = { workspace = true, optional = true }
+thiserror = { workspace = true }
 tokio-util = { workspace = true }
 tracing = { workspace = true }

crates/tranquil-cache/src/lib.rs

@@ -160,18 +160,17 @@ impl Cache for NoOpCache {
     }
 }
 
-pub struct NoOpRateLimiter;
-
-#[async_trait]
-impl DistributedRateLimiter for NoOpRateLimiter {
-    async fn check_rate_limit(&self, _key: &str, _limit: u32, _window_ms: u64) -> bool {
-        true
-    }
+#[derive(Debug, thiserror::Error)]
+pub enum CacheInitError {
+    #[error("ripple config: {0}")]
+    Config(#[from] tranquil_ripple::RippleConfigError),
+    #[error("ripple start: {0}")]
+    Start(#[from] tranquil_ripple::RippleStartError),
 }
 
 pub async fn create_cache(
     shutdown: tokio_util::sync::CancellationToken,
-) -> (Arc<dyn Cache>, Arc<dyn DistributedRateLimiter>) {
+) -> Result<(Arc<dyn Cache>, Arc<dyn DistributedRateLimiter>), CacheInitError> {
     let cache_cfg = tranquil_config::try_get().map(|c| &c.cache);
     let backend = cache_cfg.map(|c| c.backend.as_str()).unwrap_or("ripple");
     let valkey_url = cache_cfg.and_then(|c| c.valkey_url.as_deref());
@@ -183,7 +182,7 @@ pub async fn create_cache(
                 Ok(cache) => {
                     tracing::info!("using valkey cache at {url}");
                     let rate_limiter = Arc::new(RedisRateLimiter::new(cache.connection()));
-                    return (Arc::new(cache), rate_limiter);
+                    return Ok((Arc::new(cache), rate_limiter));
                 }
                 Err(e) => {
                     tracing::warn!("failed to connect to valkey: {e}. falling back to ripple.");
@@ -201,26 +200,13 @@ pub async fn create_cache(
         );
     }
 
-    match tranquil_ripple::RippleConfig::from_config() {
-        Ok(config) => {
-            let peer_count = config.seed_peers.len();
-            match tranquil_ripple::RippleEngine::start(config, shutdown).await {
-                Ok((cache, rate_limiter, _bound_addr)) => {
-                    match peer_count {
-                        0 => tracing::info!("ripple cache started (single-node)"),
-                        n => tracing::info!("ripple cache started ({n} seed peers)"),
-                    }
-                    (cache, rate_limiter)
-                }
-                Err(e) => {
-                    tracing::error!("ripple engine failed to start: {e:#}. running without cache.");
-                    (Arc::new(NoOpCache), Arc::new(NoOpRateLimiter))
-                }
-            }
-        }
-        Err(e) => {
-            tracing::error!("ripple config error: {e:#}. running without cache.");
-            (Arc::new(NoOpCache), Arc::new(NoOpRateLimiter))
-        }
+    let config = tranquil_ripple::RippleConfig::from_config()?;
+    let peer_count = config.seed_peers.len();
+    let (cache, rate_limiter, _bound_addr) =
+        tranquil_ripple::RippleEngine::start(config, shutdown).await?;
+    match peer_count {
+        0 => tracing::info!("ripple cache started as a single node"),
+        n => tracing::info!("ripple cache started with {n} seed peers"),
     }
+    Ok((cache, rate_limiter))
 }

crates/tranquil-comms/Cargo.toml

@@ -10,7 +10,14 @@ tranquil-signal = { workspace = true }
 
 async-trait = { workspace = true }
 base64 = { workspace = true }
+ed25519-dalek = { workspace = true }
+futures = { workspace = true }
+hickory-resolver = { workspace = true }
+lettre = { workspace = true }
+rand = { workspace = true }
 reqwest = { workspace = true }
+rsa = { workspace = true }
+secrecy = { workspace = true }
 serde_json = { workspace = true }
 sqlx = { workspace = true }
 thiserror = { workspace = true }
@@ -18,3 +25,7 @@ tokio = { workspace = true }
 tracing = { workspace = true }
 tranquil-db-traits = { workspace = true }
 uuid = { workspace = true }
+
+[dev-dependencies]
+chrono = { workspace = true }
+tokio = { workspace = true, features = ["macros", "rt-multi-thread", "time", "io-util", "net"] }

crates/tranquil-comms/src/email/dkim.rs

@@ -0,0 +1,227 @@
+use std::fs;
+
+use base64::Engine;
+use base64::engine::general_purpose::STANDARD as BASE64_STANDARD;
+use ed25519_dalek::pkcs8::DecodePrivateKey as _;
+use lettre::Message;
+use lettre::message::dkim::{
+    DkimCanonicalization, DkimCanonicalizationType, DkimConfig as LettreDkimConfig,
+    DkimSigningAlgorithm, DkimSigningKey,
+};
+use lettre::message::header::HeaderName;
+use rsa::pkcs1::EncodeRsaPrivateKey;
+use rsa::pkcs8::LineEnding;
+
+use super::types::{DkimKeyPath, DkimSelector, EmailDomain};
+use crate::sender::SendError;
+
+const SIGNED_HEADERS: &[&str] = &[
+    "From",
+    "Sender",
+    "Reply-To",
+    "To",
+    "Cc",
+    "Subject",
+    "Date",
+    "In-Reply-To",
+    "References",
+    "MIME-Version",
+    "Content-Type",
+    "Content-Transfer-Encoding",
+];
+
+pub struct DkimSigner {
+    config: LettreDkimConfig,
+}
+
+impl DkimSigner {
+    pub fn load(
+        selector: DkimSelector,
+        domain: EmailDomain,
+        path: DkimKeyPath,
+    ) -> Result<Self, SendError> {
+        let pem = fs::read_to_string(path.as_path()).map_err(|e| {
+            SendError::DkimSign(format!("read DKIM key {}: {e}", path.as_path().display()))
+        })?;
+        Self::from_pem(selector, domain, &pem)
+    }
+
+    pub fn from_pem(
+        selector: DkimSelector,
+        domain: EmailDomain,
+        pem: &str,
+    ) -> Result<Self, SendError> {
+        let key = parse_key(pem)?;
+        let canonicalization = DkimCanonicalization {
+            header: DkimCanonicalizationType::Relaxed,
+            body: DkimCanonicalizationType::Relaxed,
+        };
+        let headers = SIGNED_HEADERS
+            .iter()
+            .copied()
+            .map(HeaderName::new_from_ascii_str)
+            .collect();
+        let config = LettreDkimConfig::new(
+            selector.into_inner(),
+            domain.into_inner(),
+            key,
+            headers,
+            canonicalization,
+        );
+        Ok(Self { config })
+    }
+
+    pub fn sign(&self, message: &mut Message) {
+        message.sign(&self.config);
+    }
+}
+
+impl std::fmt::Debug for DkimSigner {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str("DkimSigner")
+    }
+}
+
+fn parse_key(input: &str) -> Result<DkimSigningKey, SendError> {
+    let trimmed = input.trim_start();
+    match trimmed {
+        s if s.starts_with("-----BEGIN RSA PRIVATE KEY-----") => {
+            DkimSigningKey::new(input, DkimSigningAlgorithm::Rsa)
+                .map_err(|e| SendError::DkimSign(format!("RSA PKCS#1 PEM rejected: {e}")))
+        }
+        s if s.starts_with("-----BEGIN PRIVATE KEY-----") => parse_pkcs8(input),
+        s if s.starts_with("-----BEGIN") => Err(SendError::DkimSign(
+            "unrecognized PEM type; expected an RSA or Ed25519 private key".to_string(),
+        )),
+        _ => DkimSigningKey::new(input.trim(), DkimSigningAlgorithm::Ed25519).map_err(|e| {
+            SendError::DkimSign(format!(
+                "expected base64-encoded 32-byte Ed25519 seed or a PEM-wrapped key: {e}"
+            ))
+        }),
+    }
+}
+
+fn parse_pkcs8(pem: &str) -> Result<DkimSigningKey, SendError> {
+    let ed25519_err = match ed25519_dalek::SigningKey::from_pkcs8_pem(pem) {
+        Ok(key) => {
+            let seed = BASE64_STANDARD.encode(key.to_bytes());
+            return DkimSigningKey::new(&seed, DkimSigningAlgorithm::Ed25519)
+                .map_err(|e| SendError::DkimSign(format!("re-import Ed25519 seed: {e}")));
+        }
+        Err(e) => e,
+    };
+
+    let rsa_err = match rsa::RsaPrivateKey::from_pkcs8_pem(pem) {
+        Ok(key) => {
+            let pkcs1 = key
+                .to_pkcs1_pem(LineEnding::LF)
+                .map_err(|e| SendError::DkimSign(format!("re-encode RSA PKCS#8 as PKCS#1: {e}")))?;
+            return DkimSigningKey::new(pkcs1.as_str(), DkimSigningAlgorithm::Rsa)
+                .map_err(|e| SendError::DkimSign(format!("re-import RSA PKCS#1: {e}")));
+        }
+        Err(e) => e,
+    };
+
+    Err(SendError::DkimSign(format!(
+        "PKCS#8 PEM rejected by both parsers; ed25519: {ed25519_err}; rsa: {rsa_err}"
+    )))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use ed25519_dalek::pkcs8::EncodePrivateKey as _;
+    use lettre::message::Mailbox;
+    use lettre::message::header::ContentType;
+    use rsa::pkcs1::DecodeRsaPrivateKey as _;
+
+    const ED25519_RAW_SEED_B64: &str = "QkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkI=";
+
+    const RSA_PKCS1_PEM: &str = include_str!("test_fixtures/rsa2048-priv-pkcs1.pem");
+
+    fn ed25519_pkcs8_pem() -> String {
+        let key = ed25519_dalek::SigningKey::from_bytes(&[7u8; 32]);
+        key.to_pkcs8_pem(LineEnding::LF).unwrap().to_string()
+    }
+
+    fn rsa_pkcs8_pem() -> String {
+        let key = rsa::RsaPrivateKey::from_pkcs1_pem(RSA_PKCS1_PEM).unwrap();
+        key.to_pkcs8_pem(LineEnding::LF).unwrap().to_string()
+    }
+
+    fn signer(pem: &str) -> DkimSigner {
+        DkimSigner::from_pem(
+            DkimSelector::parse("default").unwrap(),
+            EmailDomain::parse("nel.pet").unwrap(),
+            pem,
+        )
+        .expect("key should load")
+    }
+
+    fn signed_headers(signer: &DkimSigner) -> String {
+        let from: Mailbox = "sender@nel.pet".parse().unwrap();
+        let to: Mailbox = "recipient@nel.pet".parse().unwrap();
+        let mut message = Message::builder()
+            .from(from)
+            .to(to)
+            .subject("Roundtrip")
+            .header(ContentType::TEXT_PLAIN)
+            .body("Body".to_string())
+            .unwrap();
+        signer.sign(&mut message);
+        String::from_utf8(message.formatted()).unwrap()
+    }
+
+    #[test]
+    fn rejects_garbage() {
+        assert!(matches!(
+            parse_key("not a key"),
+            Err(SendError::DkimSign(_))
+        ));
+    }
+
+    #[test]
+    fn rejects_unknown_pem_type() {
+        let pem = "-----BEGIN OPENSSH PRIVATE KEY-----\nx\n-----END OPENSSH PRIVATE KEY-----\n";
+        match parse_key(pem) {
+            Err(SendError::DkimSign(msg)) => assert!(msg.contains("unrecognized"), "msg: {msg}"),
+            other => panic!("expected unrecognized PEM error, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn ed25519_raw_seed_signs() {
+        let raw = signed_headers(&signer(ED25519_RAW_SEED_B64));
+        assert_signed_with(&raw, "a=ed25519-sha256");
+    }
+
+    #[test]
+    fn ed25519_pkcs8_pem_signs() {
+        let raw = signed_headers(&signer(&ed25519_pkcs8_pem()));
+        assert_signed_with(&raw, "a=ed25519-sha256");
+    }
+
+    #[test]
+    fn rsa_pkcs1_pem_signs() {
+        let raw = signed_headers(&signer(RSA_PKCS1_PEM));
+        assert_signed_with(&raw, "a=rsa-sha256");
+    }
+
+    #[test]
+    fn rsa_pkcs8_pem_signs() {
+        let raw = signed_headers(&signer(&rsa_pkcs8_pem()));
+        assert_signed_with(&raw, "a=rsa-sha256");
+    }
+
+    fn assert_signed_with(raw: &str, algorithm: &str) {
+        assert!(
+            raw.contains("DKIM-Signature:"),
+            "no signature header: {raw}"
+        );
+        assert!(raw.contains(algorithm), "missing {algorithm}: {raw}");
+        assert!(
+            raw.contains("c=relaxed/relaxed"),
+            "expected relaxed/relaxed canonicalization: {raw}"
+        );
+    }
+}

crates/tranquil-comms/src/email/message.rs

@@ -0,0 +1,151 @@
+use lettre::Message;
+use lettre::message::Mailbox;
+use lettre::message::header::ContentType;
+use uuid::Uuid;
+
+use super::types::EmailDomain;
+use crate::sender::SendError;
+use crate::types::QueuedComms;
+
+pub(super) fn build(from: &Mailbox, qc: &QueuedComms) -> Result<Message, SendError> {
+    let to: Mailbox = qc
+        .recipient
+        .parse()
+        .map_err(|e: lettre::address::AddressError| SendError::InvalidRecipient(e.to_string()))?;
+    let subject = qc.subject.as_deref().unwrap_or("Notification");
+    let message_id = format!("<{}@{}>", Uuid::new_v4(), from.email.domain());
+    Message::builder()
+        .from(from.clone())
+        .to(to)
+        .subject(subject)
+        .message_id(Some(message_id))
+        .header(ContentType::TEXT_PLAIN)
+        .body(qc.body.clone())
+        .map_err(|e| SendError::MessageBuild(e.to_string()))
+}
+
+pub(super) fn recipient_domain(message: &Message) -> Result<EmailDomain, SendError> {
+    let envelope = message.envelope();
+    let first = envelope
+        .to()
+        .first()
+        .ok_or_else(|| SendError::MessageBuild("envelope has no recipients".to_string()))?;
+    EmailDomain::parse(first.domain())
+        .map_err(|e| SendError::InvalidRecipient(format!("invalid recipient domain: {e}")))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::types::{CommsChannel, CommsStatus, CommsType};
+    use chrono::Utc;
+    use uuid::Uuid;
+
+    fn from_mailbox() -> Mailbox {
+        "Test Sender <noreply@nel.pet>".parse().unwrap()
+    }
+
+    fn fixture(recipient: &str, subject: Option<&str>, body: &str) -> QueuedComms {
+        QueuedComms {
+            id: Uuid::new_v4(),
+            user_id: None,
+            channel: CommsChannel::Email,
+            comms_type: CommsType::Welcome,
+            status: CommsStatus::Pending,
+            recipient: recipient.to_string(),
+            subject: subject.map(String::from),
+            body: body.to_string(),
+            metadata: None,
+            attempts: 0,
+            max_attempts: 3,
+            last_error: None,
+            created_at: Utc::now(),
+            updated_at: Utc::now(),
+            scheduled_for: Utc::now(),
+            processed_at: None,
+        }
+    }
+
+    #[test]
+    fn build_basic_message() {
+        let msg = build(
+            &from_mailbox(),
+            &fixture("user@nel.pet", Some("Welcome"), "Hello world."),
+        )
+        .unwrap();
+        let raw = String::from_utf8(msg.formatted()).unwrap();
+        let lower = raw.to_lowercase();
+        assert!(raw.contains("From: \"Test Sender\" <noreply@nel.pet>"));
+        assert!(raw.contains("To: user@nel.pet"));
+        assert!(raw.contains("Subject: Welcome"));
+        assert!(lower.contains("content-type: text/plain"));
+        assert!(raw.contains("Hello world."));
+    }
+
+    #[test]
+    fn utf8_subject_is_encoded() {
+        let msg = build(
+            &from_mailbox(),
+            &fixture("user@nel.pet", Some("héllo wörld"), "Body"),
+        )
+        .unwrap();
+        let raw = String::from_utf8(msg.formatted()).unwrap();
+        assert!(raw.contains("=?utf-8?"));
+        assert!(!raw.contains("héllo"));
+    }
+
+    #[test]
+    fn header_injection_rejected() {
+        let result = build(
+            &from_mailbox(),
+            &fixture("x@nel.pet\r\nBcc: evil@x", Some("s"), "b"),
+        );
+        assert!(matches!(result, Err(SendError::InvalidRecipient(_))));
+    }
+
+    #[test]
+    fn subject_crlf_does_not_inject_headers() {
+        let msg = build(
+            &from_mailbox(),
+            &fixture("user@nel.pet", Some("hi\r\nBcc: evil@nel.pet"), "body"),
+        )
+        .expect("subject CRLF should be encoded, not rejected");
+        let raw = String::from_utf8(msg.formatted()).unwrap();
+        assert!(
+            !raw.contains("Bcc:"),
+            "CRLF in subject must not produce a Bcc header: {raw}"
+        );
+        assert!(
+            raw.contains("Subject: ="),
+            "subject with non-printable chars should be RFC 2047 encoded: {raw}"
+        );
+    }
+
+    #[test]
+    fn message_id_uses_from_domain() {
+        let msg = build(&from_mailbox(), &fixture("user@nel.pet", Some("s"), "b")).unwrap();
+        let raw = String::from_utf8(msg.formatted()).unwrap();
+        let line = raw
+            .lines()
+            .find(|l| l.starts_with("Message-ID:") || l.starts_with("Message-Id:"))
+            .expect("message-id header present");
+        assert!(
+            line.contains("@nel.pet>"),
+            "message-id should use From domain: {line}"
+        );
+    }
+
+    #[test]
+    fn missing_subject_uses_default() {
+        let msg = build(&from_mailbox(), &fixture("user@nel.pet", None, "Body")).unwrap();
+        let raw = String::from_utf8(msg.formatted()).unwrap();
+        assert!(raw.contains("Subject: Notification"));
+    }
+
+    #[test]
+    fn recipient_domain_extracted() {
+        let msg = build(&from_mailbox(), &fixture("user@Nel.PET", Some("s"), "b")).unwrap();
+        let d = recipient_domain(&msg).unwrap();
+        assert_eq!(d.as_str(), "nel.pet");
+    }
+}

crates/tranquil-comms/src/email/mod.rs

@@ -0,0 +1,196 @@
+pub mod dkim;
+pub mod message;
+mod mx;
+pub mod transport;
+pub mod types;
+
+use std::sync::Arc;
+use std::time::Duration;
+
+use async_trait::async_trait;
+use hickory_resolver::TokioAsyncResolver;
+use hickory_resolver::config::{ResolverConfig, ResolverOpts};
+use lettre::message::Mailbox;
+use lettre::transport::smtp::AsyncSmtpTransport;
+use lettre::transport::smtp::PoolConfig;
+use lettre::transport::smtp::authentication::Credentials;
+use lettre::transport::smtp::extension::ClientId;
+use tokio::sync::Semaphore;
+use tracing::{info, warn};
+
+pub use self::dkim::DkimSigner;
+pub use self::transport::SendMode;
+use self::types::{
+    DkimKeyPath, DkimSelector, EmailDomain, HeloName, SmtpHost, SmtpPassword, SmtpPort,
+    SmtpUsername, TlsMode,
+};
+use crate::sender::{CommsSender, SendError};
+use crate::types::{CommsChannel, QueuedComms};
+
+pub struct EmailSender {
+    from: Mailbox,
+    mode: SendMode,
+    dkim: Option<DkimSigner>,
+}
+
+impl EmailSender {
+    pub fn new(from: Mailbox, mode: SendMode, dkim: Option<DkimSigner>) -> Self {
+        Self { from, mode, dkim }
+    }
+
+    pub fn from_config(cfg: &tranquil_config::TranquilConfig) -> Result<Option<Self>, SendError> {
+        let Some(from_address) = cfg.email.from_address.as_deref().filter(|s| !s.is_empty()) else {
+            info!("Email sender disabled: MAIL_FROM_ADDRESS unset");
+            return Ok(None);
+        };
+        let from = build_from(&cfg.email.from_name, from_address)?;
+        let dkim = build_dkim(&cfg.email.dkim)?;
+        let mode = match cfg
+            .email
+            .smarthost
+            .host
+            .as_deref()
+            .filter(|h| !h.is_empty())
+        {
+            Some(host) => build_smarthost(cfg, host)?,
+            None => build_direct_mx(cfg)?,
+        };
+        info!(?mode, dkim = dkim.is_some(), "Email sender initialized");
+        Ok(Some(Self { from, mode, dkim }))
+    }
+}
+
+fn config_invalid(field: &str, error: impl std::fmt::Display) -> SendError {
+    SendError::ConfigInvalid(format!("{field}: {error}"))
+}
+
+fn build_from(from_name: &str, from_address: &str) -> Result<Mailbox, SendError> {
+    let raw = match from_name.is_empty() {
+        true => from_address.to_string(),
+        false => format!("\"{}\" <{}>", from_name.replace('"', "'"), from_address),
+    };
+    raw.parse::<Mailbox>()
+        .map_err(|e| config_invalid("MAIL_FROM_ADDRESS / MAIL_FROM_NAME", e))
+}
+
+fn build_smarthost(
+    cfg: &tranquil_config::TranquilConfig,
+    host_raw: &str,
+) -> Result<SendMode, SendError> {
+    let host = SmtpHost::parse(host_raw).map_err(|e| config_invalid("MAIL_SMARTHOST_HOST", e))?;
+    let port = SmtpPort::parse(cfg.email.smarthost.port)
+        .map_err(|e| config_invalid("MAIL_SMARTHOST_PORT", e))?;
+    let tls = TlsMode::parse(&cfg.email.smarthost.tls)
+        .map_err(|e| config_invalid("MAIL_SMARTHOST_TLS", e))?;
+    let helo = resolve_helo(cfg)?;
+    let pool = PoolConfig::new()
+        .max_size(cfg.email.smarthost.pool_size)
+        .idle_timeout(Duration::from_secs(60));
+    let command_timeout = Duration::from_secs(cfg.email.smarthost.command_timeout_secs);
+    let total_timeout = Duration::from_secs(cfg.email.smarthost.total_timeout_secs);
+
+    let builder = match tls {
+        TlsMode::Implicit => AsyncSmtpTransport::<lettre::Tokio1Executor>::relay(host.as_str())
+            .map_err(|e| config_invalid("smarthost TLS setup", e))?,
+        TlsMode::Starttls => {
+            AsyncSmtpTransport::<lettre::Tokio1Executor>::starttls_relay(host.as_str())
+                .map_err(|e| config_invalid("smarthost TLS setup", e))?
+        }
+        TlsMode::None => {
+            AsyncSmtpTransport::<lettre::Tokio1Executor>::builder_dangerous(host.as_str())
+        }
+    };
+    let builder = builder
+        .port(port.as_u16())
+        .hello_name(ClientId::Domain(helo.into_inner()))
+        .timeout(Some(command_timeout))
+        .pool_config(pool);
+    let builder = match (
+        cfg.email.smarthost.username.as_deref(),
+        cfg.email.smarthost.password.as_deref(),
+    ) {
+        (Some(u), Some(p)) => {
+            let username =
+                SmtpUsername::parse(u).map_err(|e| config_invalid("MAIL_SMARTHOST_USERNAME", e))?;
+            let password =
+                SmtpPassword::parse(p).map_err(|e| config_invalid("MAIL_SMARTHOST_PASSWORD", e))?;
+            builder.credentials(Credentials::new(
+                username.into_inner(),
+                password.expose().to_string(),
+            ))
+        }
+        _ => builder,
+    };
+    Ok(SendMode::Smarthost {
+        transport: Box::new(builder.build()),
+        total_timeout,
+    })
+}
+
+fn build_direct_mx(cfg: &tranquil_config::TranquilConfig) -> Result<SendMode, SendError> {
+    let helo = resolve_helo(cfg)?;
+    let resolver = Arc::new(TokioAsyncResolver::tokio_from_system_conf().unwrap_or_else(|e| {
+        tracing::warn!("falling back to default DNS resolvers: {}", e);
+        TokioAsyncResolver::tokio(ResolverConfig::default(), ResolverOpts::default())
+    }));
+    let max_concurrent = cfg.email.direct_mx.max_concurrent_sends.max(1);
+    Ok(SendMode::DirectMx {
+        resolver,
+        helo,
+        command_timeout: Duration::from_secs(cfg.email.direct_mx.command_timeout_secs),
+        total_timeout: Duration::from_secs(cfg.email.direct_mx.total_timeout_secs),
+        require_tls: cfg.email.direct_mx.require_tls,
+        inflight: Arc::new(Semaphore::new(max_concurrent)),
+    })
+}
+
+fn resolve_helo(cfg: &tranquil_config::TranquilConfig) -> Result<HeloName, SendError> {
+    let raw = cfg
+        .email
+        .helo_name
+        .clone()
+        .unwrap_or_else(|| cfg.server.hostname_without_port().to_string());
+    HeloName::parse(&raw).map_err(|e| config_invalid(&format!("HELO name {raw:?}"), e))
+}
+
+fn build_dkim(cfg: &tranquil_config::DkimConfig) -> Result<Option<DkimSigner>, SendError> {
+    let selector = match cfg.selector.as_deref() {
+        Some(s) => s,
+        None => return Ok(None),
+    };
+    let domain = cfg
+        .domain
+        .as_deref()
+        .ok_or_else(|| SendError::DkimSign("MAIL_DKIM_DOMAIN required when selector set".into()))?;
+    let key_path = cfg.private_key_path.as_deref().ok_or_else(|| {
+        SendError::DkimSign("MAIL_DKIM_KEY_PATH required when selector set".into())
+    })?;
+    let selector = DkimSelector::parse(selector)
+        .map_err(|e| SendError::DkimSign(format!("invalid DKIM selector: {e}")))?;
+    let domain = EmailDomain::parse(domain)
+        .map_err(|e| SendError::DkimSign(format!("invalid DKIM domain: {e}")))?;
+    let path = DkimKeyPath::parse(key_path)
+        .map_err(|e| SendError::DkimSign(format!("DKIM key path invalid: {e}")))?;
+    DkimSigner::load(selector, domain, path).map(Some)
+}
+
+#[async_trait]
+impl CommsSender for EmailSender {
+    fn channel(&self) -> CommsChannel {
+        CommsChannel::Email
+    }
+
+    async fn send(&self, notification: &QueuedComms) -> Result<(), SendError> {
+        let mut message = message::build(&self.from, notification)?;
+        if let Some(signer) = &self.dkim {
+            signer.sign(&mut message);
+        }
+        match transport::dispatch(&self.mode, message).await {
+            Ok(()) => Ok(()),
+            Err(e) => {
+                warn!(comms_id = %notification.id, error = %e, "SMTP send failed");
+                Err(e)
+            }
+        }
+    }
+}

crates/tranquil-comms/src/email/mx.rs

@@ -0,0 +1,250 @@
+use hickory_resolver::TokioAsyncResolver;
+use hickory_resolver::error::{ResolveError, ResolveErrorKind};
+use hickory_resolver::proto::op::ResponseCode;
+use rand::seq::SliceRandom;
+
+use super::types::{EmailDomain, MxHost, MxPriority, MxRecord};
+use crate::sender::SendError;
+
+pub async fn resolve(
+    resolver: &TokioAsyncResolver,
+    domain: &EmailDomain,
+) -> Result<Vec<MxRecord>, SendError> {
+    match resolver.mx_lookup(domain.as_str()).await {
+        Ok(lookup) => interpret_lookup(
+            lookup
+                .iter()
+                .map(|mx| (mx.preference(), mx.exchange().clone())),
+            domain,
+        ),
+        Err(e) => classify_lookup_error(e, domain),
+    }
+}
+
+fn interpret_lookup(
+    items: impl IntoIterator<Item = (u16, hickory_resolver::Name)>,
+    domain: &EmailDomain,
+) -> Result<Vec<MxRecord>, SendError> {
+    let entries: Vec<_> = items.into_iter().collect();
+    match entries.iter().any(|(_, name)| name.is_root()) {
+        true => Err(SendError::DnsPermanent(format!(
+            "null MX record at {}: domain refuses mail",
+            domain.as_str()
+        ))),
+        false => {
+            let records: Vec<MxRecord> = entries
+                .into_iter()
+                .filter_map(|(prio, name)| {
+                    MxHost::parse(&name.to_utf8()).ok().map(|host| MxRecord {
+                        priority: MxPriority::new(prio),
+                        host,
+                    })
+                })
+                .collect();
+            match records.is_empty() {
+                true => implicit_mx(domain),
+                false => Ok(prioritize(records)),
+            }
+        }
+    }
+}
+
+fn prioritize(mut records: Vec<MxRecord>) -> Vec<MxRecord> {
+    records.shuffle(&mut rand::thread_rng());
+    records.sort_by_key(|r| r.priority);
+    records
+}
+
+fn classify_lookup_error(
+    e: ResolveError,
+    domain: &EmailDomain,
+) -> Result<Vec<MxRecord>, SendError> {
+    match e.kind() {
+        ResolveErrorKind::NoRecordsFound { response_code, .. } => match *response_code {
+            ResponseCode::NoError => implicit_mx(domain),
+            ResponseCode::NXDomain => Err(SendError::DnsPermanent(format!(
+                "domain {} does not exist",
+                domain.as_str()
+            ))),
+            other => Err(SendError::DnsTransient(format!(
+                "MX lookup for {} failed with {other}",
+                domain.as_str()
+            ))),
+        },
+        _ => Err(SendError::DnsTransient(e.to_string())),
+    }
+}
+
+fn implicit_mx(domain: &EmailDomain) -> Result<Vec<MxRecord>, SendError> {
+    MxHost::parse(domain.as_str())
+        .map(|host| {
+            vec![MxRecord {
+                priority: MxPriority::new(0),
+                host,
+            }]
+        })
+        .map_err(|e| SendError::DnsPermanent(format!("invalid recipient domain: {e}")))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn record(prio: u16, host: &str) -> MxRecord {
+        MxRecord {
+            priority: MxPriority::new(prio),
+            host: MxHost::parse(host).unwrap(),
+        }
+    }
+
+    #[test]
+    fn prioritize_sorts_by_priority_ascending() {
+        let result = prioritize(vec![
+            record(20, "mx2.nel.pet"),
+            record(10, "mx1.nel.pet"),
+            record(10, "mx1b.nel.pet"),
+        ]);
+        assert_eq!(result[0].priority.as_u16(), 10);
+        assert_eq!(result[1].priority.as_u16(), 10);
+        assert_eq!(result[2].priority.as_u16(), 20);
+    }
+
+    #[test]
+    fn prioritize_randomizes_equal_priority_order() {
+        let attempts: Vec<Vec<String>> = (0..200)
+            .map(|_| {
+                prioritize(vec![
+                    record(10, "a.nel.pet"),
+                    record(10, "b.nel.pet"),
+                    record(10, "c.nel.pet"),
+                    record(10, "d.nel.pet"),
+                ])
+                .into_iter()
+                .map(|r| r.host.as_str().to_string())
+                .collect()
+            })
+            .collect();
+        let distinct: std::collections::HashSet<_> = attempts.iter().cloned().collect();
+        assert!(
+            distinct.len() > 1,
+            "equal-priority MX order should vary across calls; got only {}",
+            distinct.len()
+        );
+    }
+
+    #[test]
+    fn implicit_mx_uses_domain_as_host() {
+        let d = EmailDomain::parse("nel.pet").unwrap();
+        let result = implicit_mx(&d).unwrap();
+        assert_eq!(result.len(), 1);
+        assert_eq!(result[0].priority.as_u16(), 0);
+        assert_eq!(result[0].host.as_str(), "nel.pet");
+    }
+
+    #[test]
+    fn no_error_response_yields_implicit_mx() {
+        let d = EmailDomain::parse("nel.pet").unwrap();
+        let err = ResolveError::from(ResolveErrorKind::NoRecordsFound {
+            query: Box::new(hickory_resolver::proto::op::Query::default()),
+            soa: None,
+            negative_ttl: None,
+            response_code: ResponseCode::NoError,
+            trusted: false,
+        });
+        let result = classify_lookup_error(err, &d).unwrap();
+        assert_eq!(result.len(), 1);
+        assert_eq!(result[0].host.as_str(), "nel.pet");
+    }
+
+    #[test]
+    fn nxdomain_response_is_permanent() {
+        let d = EmailDomain::parse("does-not-exist.invalid").unwrap();
+        let err = ResolveError::from(ResolveErrorKind::NoRecordsFound {
+            query: Box::new(hickory_resolver::proto::op::Query::default()),
+            soa: None,
+            negative_ttl: None,
+            response_code: ResponseCode::NXDomain,
+            trusted: true,
+        });
+        match classify_lookup_error(err, &d) {
+            Err(SendError::DnsPermanent(_)) => {}
+            other => panic!("expected DnsPermanent, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn servfail_response_is_transient() {
+        let d = EmailDomain::parse("nel.pet").unwrap();
+        let err = ResolveError::from(ResolveErrorKind::NoRecordsFound {
+            query: Box::new(hickory_resolver::proto::op::Query::default()),
+            soa: None,
+            negative_ttl: None,
+            response_code: ResponseCode::ServFail,
+            trusted: false,
+        });
+        match classify_lookup_error(err, &d) {
+            Err(SendError::DnsTransient(_)) => {}
+            other => panic!("expected DnsTransient, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn timeout_is_transient() {
+        let d = EmailDomain::parse("nel.pet").unwrap();
+        let err = ResolveError::from(ResolveErrorKind::Timeout);
+        match classify_lookup_error(err, &d) {
+            Err(SendError::DnsTransient(_)) => {}
+            other => panic!("expected DnsTransient, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn message_variant_is_transient() {
+        let d = EmailDomain::parse("nel.pet").unwrap();
+        let err = ResolveError::from(ResolveErrorKind::Message("transient resolver glitch"));
+        match classify_lookup_error(err, &d) {
+            Err(SendError::DnsTransient(_)) => {}
+            other => panic!("expected DnsTransient default, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn null_mx_is_permanent() {
+        let d = EmailDomain::parse("nomail.nel.pet").unwrap();
+        let result = interpret_lookup(vec![(0, hickory_resolver::Name::root())], &d);
+        match result {
+            Err(SendError::DnsPermanent(msg)) => {
+                assert!(msg.contains("null MX"), "msg: {msg}")
+            }
+            other => panic!("expected DnsPermanent, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn null_mx_alongside_real_records_still_permanent() {
+        let d = EmailDomain::parse("mixed.nel.pet").unwrap();
+        let real = hickory_resolver::Name::from_ascii("mx1.nel.pet.").unwrap();
+        let result = interpret_lookup(vec![(10, real), (0, hickory_resolver::Name::root())], &d);
+        assert!(matches!(result, Err(SendError::DnsPermanent(_))));
+    }
+
+    #[test]
+    fn empty_lookup_uses_implicit_mx() {
+        let d = EmailDomain::parse("nel.pet").unwrap();
+        let result = interpret_lookup(Vec::<(u16, hickory_resolver::Name)>::new(), &d).unwrap();
+        assert_eq!(result.len(), 1);
+        assert_eq!(result[0].host.as_str(), "nel.pet");
+    }
+
+    #[test]
+    fn valid_records_pass_through_with_priority_sort() {
+        let d = EmailDomain::parse("nel.pet").unwrap();
+        let mx1 = hickory_resolver::Name::from_ascii("mx1.nel.pet.").unwrap();
+        let mx2 = hickory_resolver::Name::from_ascii("mx2.nel.pet.").unwrap();
+        let result = interpret_lookup(vec![(20, mx2), (10, mx1)], &d).unwrap();
+        assert_eq!(result.len(), 2);
+        assert_eq!(result[0].priority.as_u16(), 10);
+        assert_eq!(result[0].host.as_str(), "mx1.nel.pet");
+        assert_eq!(result[1].priority.as_u16(), 20);
+    }
+}

crates/tranquil-comms/src/email/test_fixtures/rsa2048-priv-pkcs1.pem

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAtsQsUV8QpqrygsY+2+JCQ6Fw8/omM71IM2N/R8pPbzbgOl0p
+78MZGsgPOQ2HSznjD0FPzsH8oO2B5Uftws04LHb2HJAYlz25+lN5cqfHAfa3fgmC
+38FfwBkn7l582UtPWZ/wcBOnyCgb3yLcvJrXyrt8QxHJgvWO23ITrUVYszImbXQ6
+7YGS0YhMrbixRzmo2tpm3JcIBtnHrEUMsT0NfFdfsZhTT8YbxBvA8FdODgEwx7u/
+vf3J9qbi4+Kv8cvqyJuleIRSjVXPsIMnoejIn04APPKIjpMyQdnWlby7rNyQtE4+
+CV+jcFjqJbE/Xilcvqxt6DirjFCvYeKYl1uHLwIDAQABAoIBAH7Mg2LA7bB0EWQh
+XiL3SrnZG6BpAHAM9jaQ5RFNjua9z7suP5YUaSpnegg/FopeUuWWjmQHudl8bg5A
+ZPgtoLdYoU8XubfUH19I4o1lUXBPVuaeeqn6Yw/HZCjAbSXkVdz8VbesK092ZD/e
+0/4V/3irsn5lrMSq0L322yfvYKaRDFxKCF7UMnWrGcHZl6Msbv/OffLRk19uYB7t
+4WGhK1zCfKIfgdLJnD0eoI6Q4wU6sJvvpyTe8NDDo8HpdAwNn3YSahSewKp9gHgg
+VIQlTZUdsHxM+R+2RUwJZYj9WSTbq+s1nKICUmjQBPnWbrPW963BE5utQPFt3mOe
+EWRzdsECgYEA3MBhJC1Okq+u5yrFE8plufdwNvm9fg5uYUYafvdlQiXsFTx+XDGm
+FXpuWhP/bheOh1jByzPZ1rvjF57xiZjkIuzcvtePTs/b5fT82K7CydDchkc8qb0W
+2dI40h+13e++sUPKYdC9aqjZHzOgl3kOlkDbyRCF3F8mNDujE49rLWcCgYEA0/MU
+dX5A6VSDb5K+JCNq8vDaBKNGU8GAr2fpYAhtk/3mXLI+/Z0JN0di9ZgeNhhJr2jN
+11OU/2pOButpsgnkIo2y36cOQPf5dQpSgXZke3iNDld3osuLIuPNJn/3C087AtOq
++w4YxZClZLAxiLCqX8SBVrB2IiFCQ70SJ++n8vkCgYEAzmi3rBsNEA1jblVIh1PF
+wJhD/bOQ4nBd92iUV8m9jZdl4wl4YX4u/IBI9MMkIG24YIe2VOl7s9Rk5+4/jNg/
+4QQ2998Y6aljxOZJEdZ+3jQELy4m49OhrTRq2ta5t/Z3CMsJTmLe6f9NXWZpr5iK
+8iVdHOjtMXxqfYaR2jVNEtsCgYAl9uWUQiAoa037v0I1wO5YQ9IZgJGJUSDWynsg
+C4JtPs5zji4ASY+sCipsqWnH8MPKGrC8QClxMr51ONe+30yw78a5jvfbpU9Wqpmq
+vOU0xJwnlH1GeMUcY8eMfOFocjG0yOtYeubvBIDLr0/AFzz9WHp+Z69RX7m53nUR
+GDlyKQKBgDGZVAbUBiB8rerqNbONBAxfipoa4IJ+ntBrFT2DtoIZNbSzaoK+nVbH
+kbWMJycaV5PVOh1lfAiZeWCxQz5RcZh/RS8USnxyMG1j4dP/wLcbdasI8uRaSC6Y
+hFHL5HjhLrIo0HRWySS2b2ztBI2FP1M+MaaGFPHDzm2OyZg85yr3
+-----END RSA PRIVATE KEY-----

crates/tranquil-comms/src/email/transport.rs

@@ -0,0 +1,164 @@
+use std::sync::Arc;
+use std::time::Duration;
+
+use futures::StreamExt;
+use hickory_resolver::TokioAsyncResolver;
+use lettre::transport::smtp::AsyncSmtpTransport;
+use lettre::transport::smtp::Error as SmtpError;
+use lettre::transport::smtp::client::{Tls, TlsParameters};
+use lettre::transport::smtp::extension::ClientId;
+use lettre::{AsyncTransport, Message, Tokio1Executor};
+use tokio::sync::Semaphore;
+
+use super::message::recipient_domain;
+use super::mx;
+use super::types::{HeloName, MxRecord};
+use crate::sender::SendError;
+
+pub enum SendMode {
+    Smarthost {
+        transport: Box<AsyncSmtpTransport<Tokio1Executor>>,
+        total_timeout: Duration,
+    },
+    DirectMx {
+        resolver: Arc<TokioAsyncResolver>,
+        helo: HeloName,
+        command_timeout: Duration,
+        total_timeout: Duration,
+        require_tls: bool,
+        inflight: Arc<Semaphore>,
+    },
+}
+
+impl std::fmt::Debug for SendMode {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Smarthost { total_timeout, .. } => {
+                write!(f, "SendMode::Smarthost(total_timeout={total_timeout:?})")
+            }
+            Self::DirectMx {
+                helo, require_tls, ..
+            } => write!(
+                f,
+                "SendMode::DirectMx({}, require_tls={require_tls})",
+                helo.as_str()
+            ),
+        }
+    }
+}
+
+pub async fn dispatch(mode: &SendMode, message: Message) -> Result<(), SendError> {
+    match mode {
+        SendMode::Smarthost {
+            transport,
+            total_timeout,
+        } => with_total_timeout(*total_timeout, run_send(transport, message)).await,
+        SendMode::DirectMx {
+            resolver,
+            helo,
+            command_timeout,
+            total_timeout,
+            require_tls,
+            inflight,
+        } => {
+            with_total_timeout(*total_timeout, async {
+                let _permit =
+                    inflight.clone().acquire_owned().await.map_err(|_| {
+                        SendError::SmtpTransient("send semaphore closed".to_string())
+                    })?;
+                send_direct(
+                    resolver.as_ref(),
+                    helo,
+                    *command_timeout,
+                    *require_tls,
+                    message,
+                )
+                .await
+            })
+            .await
+        }
+    }
+}
+
+async fn with_total_timeout<F: std::future::Future<Output = Result<(), SendError>>>(
+    total: Duration,
+    fut: F,
+) -> Result<(), SendError> {
+    tokio::time::timeout(total, fut)
+        .await
+        .unwrap_or(Err(SendError::Timeout))
+}
+
+async fn run_send(
+    transport: &AsyncSmtpTransport<Tokio1Executor>,
+    message: Message,
+) -> Result<(), SendError> {
+    transport
+        .send(message)
+        .await
+        .map(|_| ())
+        .map_err(classify_smtp_error)
+}
+
+async fn send_direct(
+    resolver: &TokioAsyncResolver,
+    helo: &HeloName,
+    command_timeout: Duration,
+    require_tls: bool,
+    message: Message,
+) -> Result<(), SendError> {
+    let domain = recipient_domain(&message)?;
+    let mxs = mx::resolve(resolver, &domain).await?;
+    let outcome = futures::stream::iter(mxs)
+        .fold(None::<Result<(), SendError>>, |acc, mx_record| {
+            let message = message.clone();
+            async move {
+                match &acc {
+                    Some(Ok(())) | Some(Err(SendError::SmtpPermanent(_))) => acc,
+                    _ => Some(
+                        attempt_one_host(mx_record, helo, command_timeout, require_tls, message)
+                            .await,
+                    ),
+                }
+            }
+        })
+        .await;
+    outcome.unwrap_or_else(|| {
+        Err(SendError::SmtpTransient(format!(
+            "no MX records returned for {}",
+            domain.as_str()
+        )))
+    })
+}
+
+async fn attempt_one_host(
+    mx_record: MxRecord,
+    helo: &HeloName,
+    command_timeout: Duration,
+    require_tls: bool,
+    message: Message,
+) -> Result<(), SendError> {
+    let host = mx_record.host.as_str().to_string();
+    let tls_params = TlsParameters::new(host.clone())
+        .map_err(|e| SendError::SmtpTransient(format!("TLS params for {host}: {e}")))?;
+    let tls = match require_tls {
+        true => Tls::Required(tls_params),
+        false => Tls::Opportunistic(tls_params),
+    };
+    let transport: AsyncSmtpTransport<Tokio1Executor> =
+        AsyncSmtpTransport::<Tokio1Executor>::builder_dangerous(&host)
+            .port(25)
+            .tls(tls)
+            .hello_name(ClientId::Domain(helo.as_str().to_string()))
+            .timeout(Some(command_timeout))
+            .build();
+    run_send(&transport, message).await
+}
+
+fn classify_smtp_error(e: SmtpError) -> SendError {
+    match () {
+        _ if e.is_permanent() => SendError::SmtpPermanent(e.to_string()),
+        _ if e.is_timeout() => SendError::Timeout,
+        _ => SendError::SmtpTransient(e.to_string()),
+    }
+}

crates/tranquil-comms/src/email/types.rs

@@ -0,0 +1,291 @@
+use std::path::PathBuf;
+
+#[derive(Debug, thiserror::Error)]
+pub enum ParseError {
+    #[error("empty value")]
+    Empty,
+    #[error("invalid character {0:?}")]
+    InvalidChar(char),
+    #[error("zero {0}")]
+    Zero(&'static str),
+    #[error("invalid TLS mode {0:?}")]
+    InvalidTlsMode(String),
+}
+
+fn parse_token(raw: &str, lowercase: bool, strip_trailing_dot: bool) -> Result<String, ParseError> {
+    let mut s = raw.trim();
+    if strip_trailing_dot {
+        s = s.trim_end_matches('.');
+    }
+    match s {
+        "" => Err(ParseError::Empty),
+        _ if s.chars().any(char::is_whitespace) => Err(ParseError::InvalidChar(' ')),
+        _ => Ok(match lowercase {
+            true => s.to_lowercase(),
+            false => s.to_string(),
+        }),
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct SmtpHost(String);
+
+impl SmtpHost {
+    pub fn parse(raw: &str) -> Result<Self, ParseError> {
+        parse_token(raw, true, false).map(Self)
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub struct SmtpPort(u16);
+
+impl SmtpPort {
+    pub fn parse(raw: u16) -> Result<Self, ParseError> {
+        match raw {
+            0 => Err(ParseError::Zero("smtp port")),
+            n => Ok(Self(n)),
+        }
+    }
+
+    pub fn as_u16(self) -> u16 {
+        self.0
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct HeloName(String);
+
+impl HeloName {
+    pub fn parse(raw: &str) -> Result<Self, ParseError> {
+        parse_token(raw, false, false).map(Self)
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    pub fn into_inner(self) -> String {
+        self.0
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct EmailDomain(String);
+
+impl EmailDomain {
+    pub fn parse(raw: &str) -> Result<Self, ParseError> {
+        parse_token(raw, true, true).map(Self)
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+
+    pub fn into_inner(self) -> String {
+        self.0
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct MxHost(String);
+
+impl MxHost {
+    pub fn parse(raw: &str) -> Result<Self, ParseError> {
+        parse_token(raw, true, true).map(Self)
+    }
+
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct MxPriority(u16);
+
+impl MxPriority {
+    pub fn new(value: u16) -> Self {
+        Self(value)
+    }
+
+    pub fn as_u16(self) -> u16 {
+        self.0
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct MxRecord {
+    pub priority: MxPriority,
+    pub host: MxHost,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct DkimSelector(String);
+
+impl DkimSelector {
+    pub fn parse(raw: &str) -> Result<Self, ParseError> {
+        let trimmed = raw.trim();
+        let valid = !trimmed.is_empty() && trimmed.split('.').all(valid_subdomain);
+        match valid {
+            true => Ok(Self(trimmed.to_string())),
+            false => Err(ParseError::InvalidChar('?')),
+        }
+    }
+
+    pub fn into_inner(self) -> String {
+        self.0
+    }
+}
+
+fn valid_subdomain(seg: &str) -> bool {
+    let starts_alnum = seg
+        .chars()
+        .next()
+        .is_some_and(|c| c.is_ascii_alphanumeric());
+    let ends_alnum = seg
+        .chars()
+        .next_back()
+        .is_some_and(|c| c.is_ascii_alphanumeric());
+    let body_ok = seg.chars().all(|c| c.is_ascii_alphanumeric() || c == '-');
+    starts_alnum && ends_alnum && body_ok
+}
+
+#[derive(Debug, Clone)]
+pub struct DkimKeyPath(PathBuf);
+
+impl DkimKeyPath {
+    pub fn parse(raw: &str) -> Result<Self, ParseError> {
+        let trimmed = raw.trim();
+        match trimmed.is_empty() {
+            true => Err(ParseError::Empty),
+            false => Ok(Self(PathBuf::from(trimmed))),
+        }
+    }
+
+    pub fn as_path(&self) -> &std::path::Path {
+        &self.0
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SmtpUsername(String);
+
+impl SmtpUsername {
+    pub fn parse(raw: &str) -> Result<Self, ParseError> {
+        match raw.is_empty() {
+            true => Err(ParseError::Empty),
+            false => Ok(Self(raw.to_string())),
+        }
+    }
+
+    pub fn into_inner(self) -> String {
+        self.0
+    }
+}
+
+#[derive(Clone)]
+pub struct SmtpPassword(secrecy::SecretString);
+
+impl SmtpPassword {
+    pub fn parse(raw: &str) -> Result<Self, ParseError> {
+        match raw.is_empty() {
+            true => Err(ParseError::Empty),
+            false => Ok(Self(secrecy::SecretString::from(raw.to_string()))),
+        }
+    }
+
+    pub fn expose(&self) -> &str {
+        use secrecy::ExposeSecret;
+        self.0.expose_secret()
+    }
+}
+
+impl std::fmt::Debug for SmtpPassword {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str("SmtpPassword(***)")
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum TlsMode {
+    Implicit,
+    Starttls,
+    None,
+}
+
+impl TlsMode {
+    pub fn parse(raw: &str) -> Result<Self, ParseError> {
+        match raw.to_ascii_lowercase().as_str() {
+            "implicit" => Ok(Self::Implicit),
+            "starttls" => Ok(Self::Starttls),
+            "none" => Ok(Self::None),
+            other => Err(ParseError::InvalidTlsMode(other.to_string())),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn smtp_host_lowercases_and_trims() {
+        let h = SmtpHost::parse("  SMTP.NEL.PET  ").unwrap();
+        assert_eq!(h.as_str(), "smtp.nel.pet");
+    }
+
+    #[test]
+    fn smtp_host_rejects_whitespace() {
+        assert!(SmtpHost::parse("a b").is_err());
+    }
+
+    #[test]
+    fn smtp_host_rejects_empty() {
+        assert!(SmtpHost::parse("").is_err());
+        assert!(SmtpHost::parse("   ").is_err());
+    }
+
+    #[test]
+    fn smtp_port_rejects_zero() {
+        assert!(SmtpPort::parse(0).is_err());
+        assert_eq!(SmtpPort::parse(587).unwrap().as_u16(), 587);
+    }
+
+    #[test]
+    fn email_domain_strips_trailing_dot() {
+        assert_eq!(EmailDomain::parse("Nel.pet.").unwrap().as_str(), "nel.pet");
+    }
+
+    #[test]
+    fn dkim_selector_validates() {
+        assert!(DkimSelector::parse("default").is_ok());
+        assert!(DkimSelector::parse("s1.nel.pet").is_ok());
+        assert!(DkimSelector::parse("s2024-q1").is_ok());
+        assert!(DkimSelector::parse("mailo-2024.nel.pet").is_ok());
+        assert!(DkimSelector::parse("a-b").is_ok());
+        assert!(DkimSelector::parse("").is_err());
+        assert!(DkimSelector::parse("a..b").is_err());
+        assert!(DkimSelector::parse("-leading").is_err());
+        assert!(DkimSelector::parse("trailing-").is_err());
+        assert!(DkimSelector::parse("s_under").is_err());
+    }
+
+    #[test]
+    fn tls_mode_parses_known_modes() {
+        assert_eq!(TlsMode::parse("STARTTLS").unwrap(), TlsMode::Starttls);
+        assert_eq!(TlsMode::parse("implicit").unwrap(), TlsMode::Implicit);
+        assert_eq!(TlsMode::parse("none").unwrap(), TlsMode::None);
+        assert!(TlsMode::parse("garbage").is_err());
+    }
+
+    #[test]
+    fn smtp_password_redacts_in_debug() {
+        let p = SmtpPassword::parse("hunter2").unwrap();
+        let dbg = format!("{:?}", p);
+        assert_eq!(dbg, "SmtpPassword(***)");
+        assert!(!dbg.contains("hunter2"));
+    }
+}

crates/tranquil-comms/src/lib.rs

@@ -1,13 +1,15 @@
+pub mod email;
 mod locale;
 mod sender;
 mod types;
 
+pub use email::EmailSender;
 pub use locale::{
     DEFAULT_LOCALE, NotificationStrings, VALID_LOCALES, format_message, get_strings,
     validate_locale,
 };
 pub use sender::{
-    CommsSender, DiscordSender, EmailSender, SendError, SignalSender, TelegramSender,
-    is_valid_phone_number, is_valid_signal_username, mime_encode_header, sanitize_header_value,
+    CommsSender, DiscordSender, SendError, SignalSender, TelegramSender, is_valid_phone_number,
+    is_valid_signal_username,
 };
 pub use types::{CommsChannel, CommsStatus, CommsType, NewComms, QueuedComms};

crates/tranquil-comms/src/locale.rs

@@ -1,5 +1,5 @@
 pub const DEFAULT_LOCALE: &str = "en";
-pub const VALID_LOCALES: &[&str] = &["en", "zh", "ja", "ko", "sv", "fi"];
+pub const VALID_LOCALES: &[&str] = &["en", "zh", "ja", "ko", "sv", "fi", "fr"];
 
 pub fn validate_locale(locale: &str) -> &str {
     if VALID_LOCALES.contains(&locale) {
@@ -44,6 +44,7 @@ pub fn get_strings(locale: &str) -> &'static NotificationStrings {
         "ko" => &STRINGS_KO,
         "sv" => &STRINGS_SV,
         "fi" => &STRINGS_FI,
+        "fr" => &STRINGS_FR,
         _ => &STRINGS_EN,
     }
 }
@@ -216,6 +217,34 @@ static STRINGS_FI: NotificationStrings = NotificationStrings {
     channel_verification_body: "Vahvistuskoodisi on:\n{code}\n\nTai vahvista suoraan:\n{verify_link}",
 };
 
+static STRINGS_FR: NotificationStrings = NotificationStrings {
+    welcome_subject: "Bienvenue sur {hostname}",
+    welcome_body: "Bienvenue sur {hostname} !\n\nVotre identifiant est : @{handle}\n\nMerci de nous avoir rejoint.",
+    password_reset_subject: "Réinitialisation du mot de passe - {hostname}",
+    password_reset_body: "Bonjour @{handle},\n\nVotre code de réinitialisation du mot de passe est : {code}\n\nCe code expirera dans 10 minutes.\n\nSi vous n'avez pas demandé cela, veuillez ignorer ce message.",
+    email_update_subject: "Confirmer votre nouvelle adresse e-mail - {hostname}",
+    email_update_body: "Bonjour @{handle},\n\nVotre code de vérification est :\n{code}\n\nCopiez le code ci-dessus et saisissez-le ici :\n{verify_page}\n\nCe code expirera dans 10 minutes.\n\nOu si vous aimez vivre dangereusement :\n{verify_link}\n\nSi vous n'avez pas demandé cela, veuillez ignorer cet e-mail.",
+    short_token_body: "Bonjour @{handle},\n\nVotre code de vérification est :\n{code}\n\nCe code expirera dans 15 minutes.\n\nSi vous n'avez pas demandé cela, veuillez ignorer cet e-mail.",
+    account_deletion_subject: "Demande de suppression de compte - {hostname}",
+    account_deletion_body: "Bonjour @{handle},\n\nVotre code de confirmation de suppression de compte est : {code}\n\nCe code expirera dans 10 minutes.\n\nSi vous n'avez pas demandé cela, sécurisez votre compte immédiatement.",
+    plc_operation_subject: "{hostname} - Jeton d'opération PLC",
+    plc_operation_body: "Bonjour @{handle},\n\nVous avez demandé à signer une opération PLC pour votre compte.\n\nVotre jeton de vérification est : {token}\n\nCe jeton expirera dans 10 minutes.\n\nSi vous n'avez pas demandé cela, vous pouvez ignorer ce message en toute sécurité.",
+    two_factor_code_subject: "Vérification de connexion - {hostname}",
+    two_factor_code_body: "Bonjour @{handle},\n\nVotre code de vérification de connexion est : {code}\n\nCe code expirera dans 10 minutes.\n\nSi vous n'avez pas demandé cela, sécurisez votre compte immédiatement.",
+    passkey_recovery_subject: "Récupération de compte - {hostname}",
+    passkey_recovery_body: "Bonjour @{handle},\n\nVous avez demandé la récupération de votre compte à clé d'accès uniquement.\n\nCliquez sur le lien ci-dessous pour définir un mot de passe temporaire et retrouver l'accès :\n{url}\n\nCe lien expirera dans 1 heure.\n\nSi vous n'avez pas demandé cela, veuillez ignorer ce message. Votre compte reste sécurisé.",
+    signup_verification_subject: "Vérifier votre compte - {hostname}",
+    signup_verification_body: "Bienvenue ! Votre code de vérification est :\n{code}\n\nCopiez le code ci-dessus et saisissez-le ici :\n{verify_page}\n\nCe code expirera dans 30 minutes.\n\nOu si vous aimez vivre dangereusement :\n{verify_link}\n\nSi vous n'avez pas créé de compte sur {hostname}, veuillez ignorer ce message.",
+    legacy_login_subject: "Alerte de sécurité : Connexion classique détectée - {hostname}",
+    legacy_login_body: "Bonjour @{handle},\n\nUne connexion à votre compte a été détectée via une application classique (comme Bluesky) qui ne prend pas en charge la vérification TOTP.\n\nDétails :\n- Date : {timestamp}\n- Adresse IP : {ip}\n\nVotre protection TOTP a été contournée pour cette connexion. La session dispose de permissions limitées pour les opérations sensibles.\n\nSi ce n'était pas vous :\n1. Changez votre mot de passe immédiatement\n2. Vérifiez vos sessions actives\n3. Envisagez de désactiver les connexions d'applications classiques dans vos paramètres de sécurité\n\nRestez vigilant,\n{hostname}",
+    migration_verification_subject: "Vérifier votre adresse e-mail - {hostname}",
+    migration_verification_body: "Bienvenue sur {hostname} !\n\nVotre compte a été migré avec succès. Pour finaliser la configuration, veuillez vérifier votre adresse e-mail.\n\nVotre code de vérification est :\n{code}\n\nCopiez le code ci-dessus et saisissez-le ici :\n{verify_page}\n\nCe code expirera dans 48 heures.\n\nOu si vous aimez vivre dangereusement :\n{verify_link}\n\nSi vous n'avez pas migré votre compte, veuillez ignorer cet e-mail.",
+    channel_verified_subject: "Canal de notification vérifié - {hostname}",
+    channel_verified_body: "Bonjour {handle},\n\n{channel} a été vérifié comme canal de notification pour votre compte sur {hostname}.",
+    channel_verification_subject: "Vérifier votre canal - {hostname}",
+    channel_verification_body: "Votre code de vérification est :\n{code}\n\nOu vérifiez directement :\n{verify_link}",
+};
+
 pub fn format_message(template: &str, vars: &[(&str, &str)]) -> String {
     vars.iter()
         .fold(template.to_string(), |result, (key, value)| {
@@ -233,6 +262,9 @@ mod tests {
         assert_eq!(validate_locale("zh"), "zh");
         assert_eq!(validate_locale("ja"), "ja");
         assert_eq!(validate_locale("ko"), "ko");
+        assert_eq!(validate_locale("sv"), "sv");
+        assert_eq!(validate_locale("fi"), "fi");
+        assert_eq!(validate_locale("fr"), "fr");
         assert_eq!(validate_locale("invalid"), DEFAULT_LOCALE);
         assert_eq!(validate_locale(""), DEFAULT_LOCALE);
     }
@@ -252,5 +284,9 @@ mod tests {
         let zh = get_strings("zh");
         assert!(zh.welcome_subject.contains("{hostname}"));
         assert!(zh.welcome_body.contains("欢迎"));
+
+        let fr = get_strings("fr");
+        assert!(fr.welcome_subject.contains("{hostname}"));
+        assert!(fr.welcome_body.contains("Bienvenue"));
     }
 }

crates/tranquil-comms/src/sender.rs

@@ -1,11 +1,7 @@
 use async_trait::async_trait;
-use base64::{Engine, engine::general_purpose::STANDARD as BASE64};
 use reqwest::Client;
 use serde_json::json;
-use std::process::Stdio;
 use std::time::Duration;
-use tokio::io::AsyncWriteExt;
-use tokio::process::Command;
 
 use super::types::{CommsChannel, QueuedComms};
 
@@ -21,25 +17,51 @@ pub trait CommsSender: Send + Sync {
 
 #[derive(Debug, thiserror::Error)]
 pub enum SendError {
-    #[error("Failed to spawn {command}: {source}")]
-    ProcessSpawn {
-        command: String,
-        source: std::io::Error,
-    },
-    #[error("{command} exited with non-zero status: {detail}")]
-    ProcessFailed { command: String, detail: String },
     #[error("Channel not configured: {0:?}")]
     NotConfigured(CommsChannel),
-    #[error("External service error: {0}")]
-    ExternalService(String),
+    #[error("Email configuration invalid: {0}")]
+    ConfigInvalid(String),
     #[error("Invalid recipient format: {0}")]
     InvalidRecipient(String),
+    #[error("Message construction failed: {0}")]
+    MessageBuild(String),
+    #[error("transient DNS lookup failure: {0}")]
+    DnsTransient(String),
+    #[error("permanent DNS lookup failure: {0}")]
+    DnsPermanent(String),
+    #[error("SMTP transient error: {0}")]
+    SmtpTransient(String),
+    #[error("SMTP permanent error: {0}")]
+    SmtpPermanent(String),
+    #[error("DKIM signing failed: {0}")]
+    DkimSign(String),
+    #[error("External service error: {0}")]
+    ExternalService(String),
     #[error("Request timeout")]
     Timeout,
     #[error("Max retries exceeded: {0}")]
     MaxRetriesExceeded(String),
 }
 
+impl SendError {
+    pub fn is_permanent(&self) -> bool {
+        match self {
+            Self::SmtpPermanent(_)
+            | Self::DnsPermanent(_)
+            | Self::InvalidRecipient(_)
+            | Self::MessageBuild(_)
+            | Self::DkimSign(_)
+            | Self::ConfigInvalid(_) => true,
+            Self::SmtpTransient(_)
+            | Self::DnsTransient(_)
+            | Self::Timeout
+            | Self::ExternalService(_)
+            | Self::MaxRetriesExceeded(_)
+            | Self::NotConfigured(_) => false,
+        }
+    }
+}
+
 fn create_http_client() -> Client {
     Client::builder()
         .timeout(Duration::from_secs(HTTP_TIMEOUT_SECS))
@@ -100,19 +122,6 @@ where
     ))
 }
 
-pub fn sanitize_header_value(value: &str) -> String {
-    value.replace(['\r', '\n'], " ").trim().to_string()
-}
-
-pub fn mime_encode_header(value: &str) -> String {
-    if value.is_ascii() {
-        sanitize_header_value(value)
-    } else {
-        let sanitized = sanitize_header_value(value);
-        format!("=?UTF-8?B?{}?=", BASE64.encode(sanitized.as_bytes()))
-    }
-}
-
 pub fn escape_html(text: &str) -> String {
     text.replace('&', "&")
         .replace('<', "&lt;")
@@ -135,93 +144,6 @@ pub fn is_valid_signal_username(username: &str) -> bool {
     tranquil_signal::SignalUsername::parse(username).is_ok()
 }
 
-pub struct EmailSender {
-    from_address: String,
-    from_name: String,
-    sendmail_path: String,
-}
-
-impl EmailSender {
-    pub fn new(from_address: String, from_name: String, sendmail_path: String) -> Self {
-        Self {
-            from_address,
-            from_name,
-            sendmail_path,
-        }
-    }
-
-    pub fn from_config(cfg: &tranquil_config::TranquilConfig) -> Option<Self> {
-        let from_address = cfg.email.from_address.clone()?;
-        let from_name = cfg.email.from_name.clone();
-        let sendmail_path = cfg.email.sendmail_path.clone();
-        Some(Self::new(from_address, from_name, sendmail_path))
-    }
-
-    pub fn format_email(&self, notification: &QueuedComms) -> String {
-        let subject = mime_encode_header(notification.subject.as_deref().unwrap_or("Notification"));
-        let recipient = sanitize_header_value(&notification.recipient);
-        let from_header = if self.from_name.is_empty() {
-            self.from_address.clone()
-        } else {
-            format!(
-                "{} <{}>",
-                sanitize_header_value(&self.from_name),
-                self.from_address
-            )
-        };
-        format!(
-            "From: {}\r\nTo: {}\r\nSubject: {}\r\nContent-Type: text/plain; charset=utf-8\r\nMIME-Version: 1.0\r\n\r\n{}",
-            from_header, recipient, subject, notification.body
-        )
-    }
-}
-
-#[async_trait]
-impl CommsSender for EmailSender {
-    fn channel(&self) -> CommsChannel {
-        CommsChannel::Email
-    }
-
-    async fn send(&self, notification: &QueuedComms) -> Result<(), SendError> {
-        let email_content = self.format_email(notification);
-        let mut child = Command::new(&self.sendmail_path)
-            .arg("-t")
-            .arg("-oi")
-            .stdin(Stdio::piped())
-            .stdout(Stdio::piped())
-            .stderr(Stdio::piped())
-            .spawn()
-            .map_err(|e| SendError::ProcessSpawn {
-                command: self.sendmail_path.clone(),
-                source: e,
-            })?;
-        if let Some(mut stdin) = child.stdin.take() {
-            stdin
-                .write_all(email_content.as_bytes())
-                .await
-                .map_err(|e| SendError::ProcessSpawn {
-                    command: self.sendmail_path.clone(),
-                    source: e,
-                })?;
-        }
-        let output = child
-            .wait_with_output()
-            .await
-            .map_err(|e| SendError::ProcessSpawn {
-                command: self.sendmail_path.clone(),
-                source: e,
-            })?;
-        if !output.status.success() {
-            let stderr = String::from_utf8_lossy(&output.stderr);
-            return Err(SendError::ProcessFailed {
-                command: self.sendmail_path.clone(),
-                detail: stderr.to_string(),
-            });
-        }
-        Ok(())
-    }
-}
-
 const DISCORD_API_BASE: &str = "https://discord.com/api/v10";
 
 #[derive(Clone)]
@@ -299,7 +221,7 @@ impl DiscordSender {
             "type": 1,
             "options": [{
                 "name": "handle",
-                "description": "Your PDS handle (e.g. alice.example.com)",
+                "description": "Your PDS handle",
                 "type": 3,
                 "required": false
             }]
@@ -610,3 +532,28 @@ impl CommsSender for SignalSender {
         ))
     }
 }
+
+#[cfg(test)]
+mod is_permanent_matrix {
+    use super::{CommsChannel, SendError};
+
+    #[test]
+    fn permanent_variants_are_permanent() {
+        assert!(SendError::SmtpPermanent("x".into()).is_permanent());
+        assert!(SendError::DnsPermanent("x".into()).is_permanent());
+        assert!(SendError::InvalidRecipient("x".into()).is_permanent());
+        assert!(SendError::MessageBuild("x".into()).is_permanent());
+        assert!(SendError::DkimSign("x".into()).is_permanent());
+        assert!(SendError::ConfigInvalid("x".into()).is_permanent());
+    }
+
+    #[test]
+    fn transient_variants_are_not_permanent() {
+        assert!(!SendError::SmtpTransient("x".into()).is_permanent());
+        assert!(!SendError::DnsTransient("x".into()).is_permanent());
+        assert!(!SendError::Timeout.is_permanent());
+        assert!(!SendError::ExternalService("x".into()).is_permanent());
+        assert!(!SendError::MaxRetriesExceeded("x".into()).is_permanent());
+        assert!(!SendError::NotConfigured(CommsChannel::Email).is_permanent());
+    }
+}

crates/tranquil-comms/tests/email_smtp.rs

@@ -0,0 +1,158 @@
+use std::time::Duration;
+
+use chrono::Utc;
+use lettre::message::Mailbox;
+use lettre::transport::smtp::AsyncSmtpTransport;
+use lettre::transport::smtp::extension::ClientId;
+use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
+use tokio::net::{TcpListener, TcpStream};
+use tranquil_comms::email::transport::SendMode;
+use tranquil_comms::email::{EmailSender, types::HeloName};
+use tranquil_comms::{CommsChannel, CommsSender, CommsStatus, CommsType, QueuedComms, SendError};
+use uuid::Uuid;
+
+fn fixture(recipient: &str, subject: &str, body: &str) -> QueuedComms {
+    QueuedComms {
+        id: Uuid::new_v4(),
+        user_id: None,
+        channel: CommsChannel::Email,
+        comms_type: CommsType::Welcome,
+        status: CommsStatus::Pending,
+        recipient: recipient.to_string(),
+        subject: Some(subject.to_string()),
+        body: body.to_string(),
+        metadata: None,
+        attempts: 0,
+        max_attempts: 3,
+        last_error: None,
+        created_at: Utc::now(),
+        updated_at: Utc::now(),
+        scheduled_for: Utc::now(),
+        processed_at: None,
+    }
+}
+
+fn build_smarthost_sender(host: &str, port: u16) -> EmailSender {
+    build_smarthost_sender_with_total_timeout(host, port, Duration::from_secs(10))
+}
+
+fn build_smarthost_sender_with_total_timeout(
+    host: &str,
+    port: u16,
+    total_timeout: Duration,
+) -> EmailSender {
+    let from: Mailbox = "Tranquil Test <noreply@nel.pet>".parse().unwrap();
+    let helo = HeloName::parse("mta.nel.pet").unwrap();
+    let transport = AsyncSmtpTransport::<lettre::Tokio1Executor>::builder_dangerous(host)
+        .port(port)
+        .hello_name(ClientId::Domain(helo.into_inner()))
+        .timeout(Some(Duration::from_secs(5)))
+        .build();
+    EmailSender::new(
+        from,
+        SendMode::Smarthost {
+            transport: Box::new(transport),
+            total_timeout,
+        },
+        None,
+    )
+}
+
+async fn drive_stub(stream: TcpStream, rcpt_response: &'static [u8]) -> std::io::Result<()> {
+    let (read, mut write) = stream.into_split();
+    let mut reader = BufReader::new(read);
+    write.write_all(b"220 stub ESMTP\r\n").await?;
+    let mut line = String::new();
+    loop {
+        line.clear();
+        let n = reader.read_line(&mut line).await?;
+        if n == 0 {
+            return Ok(());
+        }
+        let upper = line.to_ascii_uppercase();
+        let response: &[u8] = match upper.split_whitespace().next() {
+            Some("EHLO") | Some("HELO") => b"250-stub\r\n250 SIZE 10240000\r\n",
+            Some("MAIL") => b"250 OK\r\n",
+            Some("RCPT") => rcpt_response,
+            Some("DATA") => b"354 end with .\r\n",
+            Some("RSET") => b"250 OK\r\n",
+            Some("QUIT") => b"221 bye\r\n",
+            _ => b"500 unknown\r\n",
+        };
+        write.write_all(response).await?;
+        if upper.starts_with("QUIT") {
+            return Ok(());
+        }
+    }
+}
+
+async fn spawn_stub(rcpt_response: &'static [u8]) -> u16 {
+    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let port = listener.local_addr().unwrap().port();
+    tokio::spawn(async move {
+        let (stream, _) = listener.accept().await.unwrap();
+        let _ = drive_stub(stream, rcpt_response).await;
+    });
+    port
+}
+
+#[tokio::test]
+async fn rcpt_550_classifies_as_smtp_permanent() {
+    let port = spawn_stub(b"550 5.1.1 user unknown\r\n").await;
+    let sender = build_smarthost_sender("127.0.0.1", port);
+    let result = sender.send(&fixture("nel@nel.pet", "x", "x")).await;
+    match result {
+        Err(SendError::SmtpPermanent(_)) => {}
+        other => panic!("expected SmtpPermanent, got {other:?}"),
+    }
+}
+
+#[tokio::test]
+async fn rcpt_421_classifies_as_smtp_transient() {
+    let port = spawn_stub(b"421 4.7.0 try again later\r\n").await;
+    let sender = build_smarthost_sender("127.0.0.1", port);
+    let result = sender.send(&fixture("nel@nel.pet", "x", "x")).await;
+    match result {
+        Err(SendError::SmtpTransient(_)) => {}
+        other => panic!("expected SmtpTransient, got {other:?}"),
+    }
+}
+
+#[tokio::test]
+async fn invalid_recipient_classifies_as_invalid_recipient() {
+    let port = spawn_stub(b"250 OK\r\n").await;
+    let sender = build_smarthost_sender("127.0.0.1", port);
+    let result = sender.send(&fixture("not-an-address", "x", "x")).await;
+    match result {
+        Err(SendError::InvalidRecipient(_)) => {}
+        other => panic!("expected InvalidRecipient, got {other:?}"),
+    }
+}
+
+async fn spawn_silent_stub() -> u16 {
+    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let port = listener.local_addr().unwrap().port();
+    tokio::spawn(async move {
+        let (_stream, _) = listener.accept().await.unwrap();
+        std::future::pending::<()>().await;
+    });
+    port
+}
+
+#[tokio::test]
+async fn smarthost_silent_relay_hits_total_timeout() {
+    let port = spawn_silent_stub().await;
+    let sender =
+        build_smarthost_sender_with_total_timeout("127.0.0.1", port, Duration::from_millis(500));
+    let start = std::time::Instant::now();
+    let result = sender.send(&fixture("nel@nel.pet", "x", "x")).await;
+    let elapsed = start.elapsed();
+    match result {
+        Err(SendError::Timeout) => {}
+        other => panic!("expected Timeout, got {other:?}"),
+    }
+    assert!(
+        elapsed < Duration::from_secs(2),
+        "send returned in {elapsed:?}, expected close to 500ms total_timeout"
+    );
+}

crates/tranquil-db-traits/src/backlink.rs

@@ -7,7 +7,7 @@ use uuid::Uuid;
 
 use crate::DbError;
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub enum BacklinkPath {
     Subject,
     SubjectUri,

crates/tranquil-db-traits/src/infra.rs

@@ -244,6 +244,8 @@ pub trait InfraRepository: Send + Sync {
 
     async fn mark_comms_failed(&self, id: Uuid, error: &str) -> Result<(), DbError>;
 
+    async fn mark_comms_failed_permanent(&self, id: Uuid, error: &str) -> Result<(), DbError>;
+
     async fn create_invite_code(
         &self,
         code: &str,
@@ -266,17 +268,6 @@ pub trait InfraRepository: Send + Sync {
         code: &'a str,
     ) -> Result<ValidatedInviteCode<'a>, InviteCodeError>;
 
-    async fn decrement_invite_code_uses(
-        &self,
-        code: &ValidatedInviteCode<'_>,
-    ) -> Result<(), DbError>;
-
-    async fn record_invite_code_use(
-        &self,
-        code: &ValidatedInviteCode<'_>,
-        used_by_user: Uuid,
-    ) -> Result<(), DbError>;
-
     async fn get_invite_codes_for_account(
         &self,
         for_account: &Did,

crates/tranquil-db-traits/src/lib.rs

@@ -43,7 +43,8 @@ pub use repo::{
 pub use scope::{DbScope, InvalidScopeError};
 pub use sequence::{SequenceNumber, deserialize_optional_sequence};
 pub use session::{
-    AppPasswordCreate, AppPasswordPrivilege, AppPasswordRecord, LoginType, RefreshSessionResult,
+    AppPasswordCreate, AppPasswordPrivilege, AppPasswordRecord, LoginType,
+    REFRESH_GRACE_PERIOD_SECS, RefreshGraceLookup, RefreshGraceReplay, RefreshSessionResult,
     SessionForRefresh, SessionId, SessionListItem, SessionMfaStatus, SessionRefreshData,
     SessionRepository, SessionToken, SessionTokenCreate,
 };

crates/tranquil-db-traits/src/repo.rs

@@ -319,7 +319,6 @@ pub struct ApplyCommitInput {
 
 #[derive(Debug, Clone)]
 pub struct ApplyCommitResult {
-    pub seq: i64,
     pub is_account_active: bool,
 }
 
@@ -445,19 +444,15 @@ pub trait RepoRepository: Send + Sync {
 
     async fn count_user_blocks(&self, user_id: Uuid) -> Result<i64, DbError>;
 
-    async fn insert_commit_event(&self, data: &CommitEventData) -> Result<SequenceNumber, DbError>;
+    async fn insert_commit_event(&self, data: &CommitEventData) -> Result<(), DbError>;
 
     async fn insert_identity_event(
         &self,
         did: &Did,
         handle: Option<&Handle>,
-    ) -> Result<SequenceNumber, DbError>;
+    ) -> Result<(), DbError>;
 
-    async fn insert_account_event(
-        &self,
-        did: &Did,
-        status: AccountStatus,
-    ) -> Result<SequenceNumber, DbError>;
+    async fn insert_account_event(&self, did: &Did, status: AccountStatus) -> Result<(), DbError>;
 
     async fn insert_sync_event(
         &self,
@@ -465,7 +460,7 @@ pub trait RepoRepository: Send + Sync {
         commit_cid: &CidLink,
         rev: Option<&str>,
         commit_bytes: &[u8],
-    ) -> Result<SequenceNumber, DbError>;
+    ) -> Result<(), DbError>;
 
     async fn insert_genesis_commit_event(
         &self,
@@ -475,14 +470,18 @@ pub trait RepoRepository: Send + Sync {
         rev: &str,
         commit_bytes: &[u8],
         mst_root_bytes: &[u8],
-    ) -> Result<SequenceNumber, DbError>;
-
-    async fn delete_sequences_except(
-        &self,
-        did: &Did,
-        keep_seq: SequenceNumber,
     ) -> Result<(), DbError>;
 
+    async fn purge_did_events_keeping_latest(&self, did: &Did) -> Result<(), DbError>;
+
+    async fn assign_pending_sequences(&self) -> Result<u64, DbError> {
+        Ok(0)
+    }
+
+    async fn flush_pending_sequences(&self) -> Result<(), DbError> {
+        Ok(())
+    }
+
     async fn prune_events_older_than(&self, cutoff: DateTime<Utc>) -> Result<PruneCount, DbError>;
 
     async fn get_max_seq(&self) -> Result<SequenceNumber, DbError>;
@@ -526,8 +525,6 @@ pub trait RepoRepository: Send + Sync {
     async fn get_repo_root_cid_by_user_id(&self, user_id: Uuid)
     -> Result<Option<CidLink>, DbError>;
 
-    async fn notify_update(&self, seq: SequenceNumber) -> Result<(), DbError>;
-
     async fn import_repo_data(
         &self,
         user_id: Uuid,
@@ -563,5 +560,5 @@ pub trait RepoEventNotifier: Send + Sync {
 
 #[async_trait]
 pub trait RepoEventReceiver: Send {
-    async fn recv(&mut self) -> Option<i64>;
+    async fn recv(&mut self) -> Option<()>;
 }

crates/tranquil-db-traits/src/session.rs

@@ -158,15 +158,53 @@ pub struct SessionMfaStatus {
     pub last_reauth_at: Option<DateTime<Utc>>,
 }
 
+/// Window during which a just-rotated refresh token may still be presented by a
+/// benignly-racing or retrying client without being treated as a compromise.
+/// The window is measured per rotated token from its own rotation time
+/// (`used_refresh_tokens.used_at` / the metastore marker's `rotated_at_ms`),
+/// matching the reference atproto PDS `REFRESH_GRACE_MS`
+/// (`account-manager.ts::rotateRefreshToken`), which shortens a rotated refresh
+/// token's lifetime to a 2-hour revocation grace period.
+pub const REFRESH_GRACE_PERIOD_SECS: i64 = 2 * 60 * 60;
+
+/// The session's current token identity (plus its signing key) needed to re-mint
+/// the access/refresh JWTs during a grace-window replay. We carry the key so the
+/// caller can verify the presented token's signature before issuing anything.
+#[derive(Debug, Clone)]
+pub struct RefreshGraceReplay {
+    pub did: Did,
+    pub scope: Option<String>,
+    pub controller_did: Option<Did>,
+    pub access_jti: String,
+    pub refresh_jti: String,
+    pub access_expires_at: DateTime<Utc>,
+    pub refresh_expires_at: DateTime<Utc>,
+    pub key_bytes: Vec<u8>,
+    pub encryption_version: i32,
+}
+
 #[derive(Debug, Clone)]
 pub enum RefreshSessionResult {
     Success,
-    TokenAlreadyUsed,
-    ConcurrentRefresh,
+    GraceReplay(RefreshGraceReplay),
+    Compromise,
+}
+
+#[derive(Debug, Clone)]
+pub enum RefreshGraceLookup {
+    NotUsed,
+    Replay(RefreshGraceReplay),
+    Compromised {
+        did: Did,
+        session_id: SessionId,
+        key_bytes: Vec<u8>,
+        encryption_version: i32,
+    },
 }
 
 #[derive(Debug, Clone)]
 pub struct SessionRefreshData {
+    pub did: Did,
     pub old_refresh_jti: String,
     pub session_id: SessionId,
     pub new_access_jti: String,
@@ -189,18 +227,17 @@ pub trait SessionRepository: Send + Sync {
         refresh_jti: &str,
     ) -> Result<Option<SessionForRefresh>, DbError>;
 
-    async fn update_session_tokens(
+    async fn delete_session_by_access_jti(
+        &self,
+        access_jti: &str,
+        did: &Did,
+    ) -> Result<u64, DbError>;
+
+    async fn delete_session_by_id(
         &self,
         session_id: SessionId,
-        new_access_jti: &str,
-        new_refresh_jti: &str,
-        new_access_expires_at: DateTime<Utc>,
-        new_refresh_expires_at: DateTime<Utc>,
-    ) -> Result<(), DbError>;
-
-    async fn delete_session_by_access_jti(&self, access_jti: &str) -> Result<u64, DbError>;
-
-    async fn delete_session_by_id(&self, session_id: SessionId) -> Result<u64, DbError>;
+        did: &Did,
+    ) -> Result<u64, DbError>;
 
     async fn delete_sessions_by_did(&self, did: &Did) -> Result<u64, DbError>;
 
@@ -230,16 +267,7 @@ pub trait SessionRepository: Send + Sync {
         app_password_name: &str,
     ) -> Result<Vec<String>, DbError>;
 
-    async fn check_refresh_token_used(
-        &self,
-        refresh_jti: &str,
-    ) -> Result<Option<SessionId>, DbError>;
-
-    async fn mark_refresh_token_used(
-        &self,
-        refresh_jti: &str,
-        session_id: SessionId,
-    ) -> Result<bool, DbError>;
+    async fn lookup_refresh_grace(&self, refresh_jti: &str) -> Result<RefreshGraceLookup, DbError>;
 
     async fn list_app_passwords(&self, user_id: Uuid) -> Result<Vec<AppPasswordRecord>, DbError>;
 

crates/tranquil-db-traits/src/user.rs

@@ -44,6 +44,7 @@ pub struct UserRow {
     pub deactivated_at: Option<DateTime<Utc>>,
     pub takedown_ref: Option<String>,
     pub is_admin: bool,
+    pub inbound_migration: bool,
 }
 
 #[derive(Debug, Clone)]
@@ -550,7 +551,7 @@ pub trait UserRepository: Send + Sync {
         limit: i64,
     ) -> Result<Vec<ScheduledDeletionAccount>, DbError>;
 
-    async fn delete_account_with_firehose(&self, user_id: Uuid, did: &Did) -> Result<i64, DbError>;
+    async fn delete_account_with_firehose(&self, user_id: Uuid, did: &Did) -> Result<(), DbError>;
 
     async fn create_password_account(
         &self,
@@ -588,8 +589,6 @@ pub trait UserRepository: Send + Sync {
 
     async fn cleanup_expired_handle_reservations(&self) -> Result<u64, DbError>;
 
-    async fn check_and_consume_invite_code(&self, code: &str) -> Result<bool, DbError>;
-
     async fn complete_passkey_setup(
         &self,
         input: &CompletePasskeySetupInput,
@@ -995,6 +994,7 @@ pub struct CreatePasswordAccountInput {
     pub telegram_username: Option<String>,
     pub signal_username: Option<String>,
     pub deactivated_at: Option<DateTime<Utc>>,
+    pub inbound_migration: bool,
     pub encrypted_key_bytes: Vec<u8>,
     pub encryption_version: i32,
     pub reserved_key_id: Option<Uuid>,
@@ -1017,6 +1017,7 @@ pub enum CreateAccountError {
     EmailTaken,
     DidExists,
     InvalidToken,
+    InviteCodeUnavailable,
     Database(String),
 }
 
@@ -1032,7 +1033,6 @@ pub struct CreateDelegatedAccountInput {
     pub commit_cid: String,
     pub repo_rev: String,
     pub genesis_block_cids: Vec<Vec<u8>>,
-    pub invite_code: Option<String>,
 }
 
 #[derive(Debug, Clone)]

crates/tranquil-db/src/postgres/event_notifier.rs

@@ -35,9 +35,9 @@ pub struct PostgresRepoEventReceiver {
 
 #[async_trait]
 impl RepoEventReceiver for PostgresRepoEventReceiver {
-    async fn recv(&mut self) -> Option<i64> {
+    async fn recv(&mut self) -> Option<()> {
         match self.listener.recv().await {
-            Ok(notification) => notification.payload().parse().ok(),
+            Ok(_) => Some(()),
             Err(_) => None,
         }
     }