just: clippy over all targets, lint the bsky-off build

Lewis: May this revision serve well! <did:plc:3fwecdnvtcscjnrx2p4n7alz>
cache: DID, SSO, & OAuth client metadata caches onto shared cache
2026-08-24 18:26:06 +00:00 · 2026-08-16 20:14:11 +03:00 · 2026-08-16 20:05:16 +03:00 · 2026-08-16 20:05:16 +03:00 · 2026-08-16 20:05:16 +03:00 · 2026-08-16 20:05:16 +03:00
468 changed files with 38898 additions and 10686 deletions
@@ -68,6 +68,10 @@ test-group = "serial-env-tests"
 filter = "package(tranquil-signal)"
 test-group = "serial-env-tests"

+[[profile.default.overrides]]
+filter = "package(tranquil-config)"
+test-group = "serial-env-tests"
+
 [[profile.default.overrides]]
 filter = "binary(whole_story)"
 test-group = "heavy-load-tests"
@@ -102,6 +106,16 @@ slow-timeout = { period = "300s", terminate-after = 8 }
 filter = "binary(compaction_restart) | binary(mst_refcount_integrity) | binary(gc_compaction_restart)"
 slow-timeout = { period = "120s", terminate-after = 4 }

+[[profile.default.overrides]]
+filter = "test(/retention_time_travel_survives_many_seeds/)"
+slow-timeout = { period = "300s", terminate-after = 24 }
+test-group = "io-heavy-sim"
+
+[[profile.default.overrides]]
+filter = "binary(fd_lifecycle)"
+slow-timeout = { period = "300s", terminate-after = 4 }
+test-group = "io-heavy-sim"
+
 [[profile.ci.overrides]]
 filter = "test(/import_with_verification/) | test(/plc_migration/)"
 test-group = "serial-env-tests"
@@ -118,6 +132,10 @@ test-group = "serial-env-tests"
 filter = "package(tranquil-signal)"
 test-group = "serial-env-tests"

+[[profile.ci.overrides]]
+filter = "package(tranquil-config)"
+test-group = "serial-env-tests"
+
 [[profile.ci.overrides]]
 filter = "binary(whole_story)"
 test-group = "heavy-load-tests"
@@ -129,3 +147,13 @@ test-group = "heavy-load-tests"
 [[profile.ci.overrides]]
 filter = "binary(repo_lifecycle)"
 test-group = "heavy-load-tests"
+
+[[profile.ci.overrides]]
+filter = "test(/retention_time_travel_survives_many_seeds/)"
+slow-timeout = { period = "300s", terminate-after = 24 }
+test-group = "io-heavy-sim"
+
+[[profile.ci.overrides]]
+filter = "binary(fd_lifecycle)"
+slow-timeout = { period = "300s", terminate-after = 4 }
+test-group = "io-heavy-sim"
@@ -0,0 +1,12 @@
+target/
+.git/
+.jj/
+**/node_modules/
+frontend/dist/
+frontend/coverage/
+frontend/.pnpm-store/
+.direnv/
+result
+.env
+*.output
+reference-pds-bsky/
@@ -4,3 +4,6 @@ target/
 result
 frontend/node_modules/
 frontend/dist/
+frontend/coverage/
+frontend/.pnpm-store
+frontend/.npmrc
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT nextval('firehose_seq') as \"seq!\"",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "seq!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "09142b5a6b91fe4fd795fb6c85af5461e2621f6c3545b6d26e4618d813904b75"
+}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE repo_seq r\n           SET seq = $1::bigint + (o.ord - 1)\n           FROM unnest($2::bigint[]) WITH ORDINALITY AS o(id, ord)\n           WHERE r.id = o.id",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8Array"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "0b895d105363a60040323c5c47bc897905af3da980d0dc1b3b60bbdcdd90ea7a"
+}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "UPDATE invite_codes SET available_uses = available_uses - 1 WHERE code = $1",
+  "query": "UPDATE invite_codes SET available_uses = available_uses - 1 WHERE code = $1 AND available_uses > 0 AND COALESCE(disabled, false) = false",
  "describe": {
    "columns": [],
    "parameters": {
@@ -10,5 +10,5 @@
    },
    "nullable": []
  },
-  "hash": "1ee6eda3e44660e7f14fcfe56adc2d41c72901b9c701fc7b992314e5370b32dc"
+  "hash": "0bb2cb6af37bff735b6b380697fc8e1fa2034ca0600e8c16e1e362b722192327"
 }
@@ -0,0 +1,25 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            SELECT DISTINCT r.record_cid AS \"record_cid!\"\n            FROM records r\n            WHERE r.repo_id = $1\n              AND r.record_cid = ANY($2)\n              AND NOT EXISTS (\n                  SELECT 1 FROM UNNEST($3::text[], $4::text[]) AS k(collection, rkey)\n                  WHERE k.collection = r.collection AND k.rkey = r.rkey\n              )\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "record_cid!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "TextArray",
+        "TextArray",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "105807a41c7337e7aa46bace29ab613030fd4fbf6845baddab9c0b2009972c02"
+}
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            DELETE FROM repo_seq\n            WHERE did = $1\n              AND id <> (SELECT id FROM repo_seq WHERE did = $1 ORDER BY id DESC LIMIT 1)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "122d79e006c0e11214e3cf11cfb98bdff6fbf156893b482572532ebcd8979e61"
+}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT id, did, handle, email, created_at, deactivated_at, takedown_ref, is_admin\n               FROM users WHERE did = $1",
+  "query": "SELECT id, did, handle, email, created_at, deactivated_at, takedown_ref, is_admin, inbound_migration\n               FROM users WHERE handle = $1",
  "describe": {
    "columns": [
      {
@@ -42,6 +42,11 @@
        "ordinal": 7,
        "name": "is_admin",
        "type_info": "Bool"
+      },
+      {
+        "ordinal": 8,
+        "name": "inbound_migration",
+        "type_info": "Bool"
      }
    ],
    "parameters": {
@@ -57,8 +62,9 @@
      false,
      true,
      true,
+      false,
      false
    ]
  },
-  "hash": "6b51995c40519a63f85c70f29ca8bd6ec1963c8562d78215d980785dc46a6384"
+  "hash": "18bbda5582db1b32d02ab8a3eee970c9508b9bd67239c2f936639a9f863b30ff"
 }
@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE users SET deactivated_at = NULL WHERE did = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "23201d4e26bc650939e30f69fb0bca00d351d057098afebc1017f70a84b4bd22"
-}
@@ -1,11 +1,11 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO repo_seq (did, event_type, active, status)\n            VALUES ($1, 'account', false, 'deleted')\n            RETURNING seq\n            ",
+  "query": "\n            INSERT INTO repo_seq (did, event_type, active, status)\n            VALUES ($1, 'account', false, 'deleted')\n            RETURNING id\n            ",
  "describe": {
    "columns": [
      {
        "ordinal": 0,
-        "name": "seq",
+        "name": "id",
        "type_info": "Int8"
      }
    ],
@@ -18,5 +18,5 @@
      false
    ]
  },
-  "hash": "a0ea3630adb9e411d94d88084df6b05d7fc3ba8c306146fc932b736fe342eceb"
+  "hash": "2c3c0740793f29b9bd9e0f81c2372d427dee091e20da8f71ae1e5f2769aa985d"
 }
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                    SELECT block_cid AS \"block_cid!\" FROM user_blocks\n                    WHERE user_id = $1 AND repo_rev > $2\n                    ORDER BY repo_rev ASC\n                    ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "block_cid!",
+        "type_info": "Bytea"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "30570ed3866840d1258c8768a5c8a23ade40700c05ddbbf7fc4f64bfa95b1ed4"
+}
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT pg_try_advisory_xact_lock($1) as \"locked!\"",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "locked!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "3cc7247d2cd7e85a6f21d783dd956f8fecc6f63c994014bb4e91504d498b5fd5"
+}
@@ -1,18 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE session_tokens SET access_jti = $1, refresh_jti = $2, access_expires_at = $3, refresh_expires_at = $4, updated_at = NOW() WHERE id = $5",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Timestamptz",
-        "Timestamptz",
-        "Int4"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "4dcee809896ead3de8ca0433856ed424211d79df201d08bbea0e4c576931a234"
-}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            INSERT INTO repo_seq (did, event_type, handle)\n            VALUES ($1, 'identity', $2)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "4f3ef746cb5fc0916d3df5f92494c538497d3b9c1cfcc6e44c9b80f2193094f6"
+}
@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO repo_seq (did, event_type, handle)\n            VALUES ($1, 'identity', $2)\n            RETURNING seq\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "seq",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "50b2178cd174af1dc132a22048e52a6af492f4d8025ec512dd9c0c9ba62eb202"
-}
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE users SET deactivated_at = NULL, inbound_migration = FALSE WHERE did = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "51e029e572777e6a103fd7fd5550494de9d4cac7e3ff84e27ddec1a6aaefc047"
+}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT id, did, email, email_verified, handle\n               FROM users\n               WHERE LOWER(email) = $1",
+  "query": "SELECT id, did, email, email_verified\n               FROM users\n               WHERE LOWER(email) = $1",
  "describe": {
    "columns": [
      {
@@ -22,11 +22,6 @@
        "ordinal": 3,
        "name": "email_verified",
        "type_info": "Bool"
-      },
-      {
-        "ordinal": 4,
-        "name": "handle",
-        "type_info": "Text"
      }
    ],
    "parameters": {
@@ -38,9 +33,8 @@
      false,
      false,
      true,
-      false,
      false
    ]
  },
-  "hash": "b230a27fce54d4f79de4ffcc754bf6c7e5a889623e64cdd7aaec791b3553ed83"
+  "hash": "55b5e5cb13e09c4261e0452ef7e21240b504096666692c8fbd5c7dcd58607bc7"
 }
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE comms_queue\n               SET status = 'failed'::comms_status,\n                   attempts = max_attempts,\n                   last_error = $2,\n                   updated_at = NOW()\n               WHERE id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "5bee4ed5296667e4ca7e1a97aec28d30a470b8aee7b378ec9ca4e34de4faf349"
+}
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT id as \"id!\" FROM repo_seq WHERE seq IS NULL ORDER BY id LIMIT $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "714a1c9a73e2fed8182d4ab2fe4a2c33bc10a52e27ed95d3a6641477ae42395e"
+}
@@ -1,11 +1,11 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT seq, did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                      ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n               FROM repo_seq\n               WHERE seq = $1",
+  "query": "SELECT seq as \"seq!\", did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                      ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n               FROM repo_seq\n               WHERE seq = $1",
  "describe": {
    "columns": [
      {
        "ordinal": 0,
-        "name": "seq",
+        "name": "seq!",
        "type_info": "Int8"
      },
      {
@@ -90,7 +90,7 @@
      ]
    },
    "nullable": [
-      false,
+      true,
      false,
      false,
      false,
@@ -108,5 +108,5 @@
      true
    ]
  },
-  "hash": "4702a94384ce938d3f5384bc2106a48500f8749134e6bfd1c619a9151f5d3772"
+  "hash": "7cdf3b8136782a5b2e4aff91907a680566b4610e6cbf9d9396d31f9bbd99c3b8"
 }
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM session_tokens WHERE id = $1 AND did = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int4",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "8003624cedbac8b094c83933578517abfb2eaf8e59d1d52c7ea59bf5d11cfcfe"
+}
@@ -1,14 +1,8 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO repo_seq (did, event_type, commit_cid, prev_cid, ops, blobs, block_cids, block_data, rev)\n            VALUES ($1, 'commit', $2, $3::TEXT, $4, $5, $6, $7, $8)\n            RETURNING seq\n            ",
+  "query": "\n            INSERT INTO repo_seq (did, event_type, commit_cid, prev_cid, ops, blobs, block_cids, block_data, rev)\n            VALUES ($1, 'commit', $2, $3::TEXT, $4, $5, $6, $7, $8)\n            ",
  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "seq",
-        "type_info": "Int8"
-      }
-    ],
+    "columns": [],
    "parameters": {
      "Left": [
        "Text",
@@ -21,9 +15,7 @@
        "Text"
      ]
    },
-    "nullable": [
-      false
-    ]
+    "nullable": []
  },
-  "hash": "a325862f897484bb1a8863fd7a1bc3fd17ab20b6e30498f9900daf80609c413d"
+  "hash": "800b93a38eef70bafdf0a1b221994f3c19ab562f84d18265376296a592b4c767"
 }
@@ -1,14 +1,8 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO repo_seq (did, event_type, commit_cid, prev_cid, ops, blobs, block_cids, block_data, prev_data_cid, rev)\n            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)\n            RETURNING seq\n            ",
+  "query": "\n            INSERT INTO repo_seq (did, event_type, commit_cid, prev_cid, ops, blobs, block_cids, block_data, prev_data_cid, rev)\n            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)\n            ",
  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "seq",
-        "type_info": "Int8"
-      }
-    ],
+    "columns": [],
    "parameters": {
      "Left": [
        "Text",
@@ -23,9 +17,7 @@
        "Text"
      ]
    },
-    "nullable": [
-      false
-    ]
+    "nullable": []
  },
-  "hash": "97dd3cfe72b74b4dac686c030a07f6eb56dabb2df72815f3248760b4e3f7950e"
+  "hash": "82276a34f473ff8b9790b78915ae3f72873d4b748cdb47bd2b81edc2f7a6e5a8"
 }
@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM session_tokens WHERE access_jti = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "847ce3c34985d0957526c87e0a20c6b4e5daae08a338f7635def682ac0689cf6"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "DELETE FROM repo_seq WHERE did = $1 AND seq != $2",
+  "query": "DELETE FROM repo_seq WHERE did = $1 AND id <> $2",
  "describe": {
    "columns": [],
    "parameters": {
@@ -11,5 +11,5 @@
    },
    "nullable": []
  },
-  "hash": "b6d6548acb89d6384cd226f6ed0d66de27fde3af24b4a7a3fce7e098812e38a5"
+  "hash": "856e458c1c78f030545dc147f76d1b91fa4cc6e178eb51133c52358855ba3f02"
 }
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                    SELECT block_cid AS \"block_cid!\" FROM user_blocks\n                    WHERE user_id = $1\n                    ORDER BY repo_rev ASC\n                    ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "block_cid!",
+        "type_info": "Bytea"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "85cc0cd1e62a30fa67d415b7a01164f962a422513e8f0737553321fd9987a56c"
+}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "UPDATE comms_queue\n               SET status = 'processing', updated_at = NOW()\n               WHERE id IN (\n                   SELECT id FROM comms_queue\n                   WHERE status = 'pending'\n                     AND scheduled_for <= $1\n                     AND attempts < max_attempts\n                   ORDER BY scheduled_for ASC\n                   LIMIT $2\n                   FOR UPDATE SKIP LOCKED\n               )\n               RETURNING\n                   id, user_id,\n                   channel as \"channel: CommsChannel\",\n                   comms_type as \"comms_type: CommsType\",\n                   status as \"status: CommsStatus\",\n                   recipient, subject, body, metadata,\n                   attempts, max_attempts, last_error,\n                   created_at, updated_at, scheduled_for, processed_at",
+  "query": "UPDATE comms_queue\n               SET status = 'processing', updated_at = NOW()\n               WHERE id IN (\n                   SELECT id FROM comms_queue\n                   WHERE attempts < max_attempts\n                     AND scheduled_for <= $1\n                     AND (\n                         status = 'pending'\n                         OR (status = 'processing'\n                             AND updated_at < $1 - INTERVAL '10 minutes')\n                     )\n                   ORDER BY scheduled_for ASC\n                   LIMIT $2\n                   FOR UPDATE SKIP LOCKED\n               )\n               RETURNING\n                   id, user_id,\n                   channel as \"channel: CommsChannel\",\n                   comms_type as \"comms_type: CommsType\",\n                   status as \"status: CommsStatus\",\n                   recipient, subject, body, metadata,\n                   attempts, max_attempts, last_error,\n                   created_at, updated_at, scheduled_for, processed_at",
  "describe": {
    "columns": [
      {
@@ -154,5 +154,5 @@
      true
    ]
  },
-  "hash": "8047fda41bd94f819213decb8b3e0aba49a8dbdb10217eefd77e3567f8c9694a"
+  "hash": "890aa92acdcb0fe2a3bf04d87e1f16a801d271da7cedc32fc42c2ef5b100faae"
 }
@@ -1,14 +1,8 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO repo_seq (did, event_type, active, status)\n            VALUES ($1, 'account', $2, $3)\n            RETURNING seq\n            ",
+  "query": "\n            INSERT INTO repo_seq (did, event_type, active, status)\n            VALUES ($1, 'account', $2, $3)\n            ",
  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "seq",
-        "type_info": "Int8"
-      }
-    ],
+    "columns": [],
    "parameters": {
      "Left": [
        "Text",
@@ -16,9 +10,7 @@
        "Text"
      ]
    },
-    "nullable": [
-      false
-    ]
+    "nullable": []
  },
-  "hash": "623042c0b901e17ff37c5bcc1a4eefe56fc8b996ca8326e75796897d13c9e9ed"
+  "hash": "8ccd42b5b1b75f45e094889ee26af8517de28ca687efa81fd9c4fce598338fe9"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n            DELETE FROM oauth_token\n            WHERE id IN (\n                SELECT id FROM oauth_token\n                WHERE did = $1\n                ORDER BY updated_at ASC\n                OFFSET $2\n            )\n            ",
+  "query": "\n            DELETE FROM oauth_token\n            WHERE id IN (\n                SELECT id FROM oauth_token\n                WHERE did = $1\n                ORDER BY created_at DESC\n                OFFSET $2\n            )\n            ",
  "describe": {
    "columns": [],
    "parameters": {
@@ -11,5 +11,5 @@
    },
    "nullable": []
  },
-  "hash": "56cd24903171eddc2ededd9079ffe10937c34e99b0305f25c980ca754da44625"
+  "hash": "8f4357f7a18ddcf6b686a4555f244d37c35917364b8f917ca6ee2d4030ace742"
 }
@@ -1,11 +1,11 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT seq, did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                              ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n                       FROM repo_seq\n                       WHERE seq > $1\n                       ORDER BY seq ASC",
+  "query": "SELECT seq as \"seq!\", did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                              ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n                       FROM repo_seq\n                       WHERE seq > $1\n                       ORDER BY seq ASC",
  "describe": {
    "columns": [
      {
        "ordinal": 0,
-        "name": "seq",
+        "name": "seq!",
        "type_info": "Int8"
      },
      {
@@ -90,7 +90,7 @@
      ]
    },
    "nullable": [
-      false,
+      true,
      false,
      false,
      false,
@@ -108,5 +108,5 @@
      true
    ]
  },
-  "hash": "c47746c256fd8c9d386551f3bd270e9a96fecdb713642d07d60fb4aeb02c8426"
+  "hash": "957bc81c63510ab502d2f8cea75dafcbdf2c8ebb448c86990d5e404ee5280438"
 }
@@ -1,14 +1,8 @@
 {
  "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO repo_seq (did, event_type, commit_cid, rev, block_cids, block_data)\n            VALUES ($1, 'sync', $2, $3, $4, $5)\n            RETURNING seq\n            ",
+  "query": "\n            INSERT INTO repo_seq (did, event_type, commit_cid, rev, block_cids, block_data)\n            VALUES ($1, 'sync', $2, $3, $4, $5)\n            ",
  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "seq",
-        "type_info": "Int8"
-      }
-    ],
+    "columns": [],
    "parameters": {
      "Left": [
        "Text",
@@ -18,9 +12,7 @@
        "ByteaArray"
      ]
    },
-    "nullable": [
-      false
-    ]
+    "nullable": []
  },
-  "hash": "5996774d097a484f81353d49e4a99b07c30a003377c924add576bfb48ddde29b"
+  "hash": "9ba7869f29286cfd6b811ffa1e26bda1d637b98b44be66cdc265b1af4cec2d4f"
 }
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT pg_advisory_xact_lock($1)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "pg_advisory_xact_lock",
+        "type_info": "Void"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "a06e1d9f6f95e4c4c2b98310ebddcc9d963cc033582bf2e945e8bf3a301b4247"
+}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM session_tokens WHERE access_jti = $1 AND did = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "a27e93bc594babbada10afe5c3e33a65909ec69c579329916833e4b0fe2332d3"
+}
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT session_id FROM used_refresh_tokens WHERE refresh_jti = $1 FOR UPDATE",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "session_id",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "b2e1736dbe2ab9114e373353bcc299176417f3c9220025f9521591ba62928bd7"
-}
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT setval('firehose_seq', $1)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "setval",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "bd0407818c8bdae1f1024777951b08cb9c386fe751722e1caf6ad243e271697a"
+}
@@ -0,0 +1,82 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            SELECT u.used_at, st.id AS session_id, st.did, st.scope, st.controller_did,\n                   st.access_jti, st.refresh_jti, st.access_expires_at, st.refresh_expires_at,\n                   k.key_bytes, k.encryption_version\n            FROM used_refresh_tokens u\n            JOIN session_tokens st ON st.id = u.session_id\n            JOIN users us ON st.did = us.did\n            JOIN user_keys k ON us.id = k.user_id\n            WHERE u.refresh_jti = $1\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "used_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 1,
+        "name": "session_id",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 2,
+        "name": "did",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "scope",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "controller_did",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 5,
+        "name": "access_jti",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 6,
+        "name": "refresh_jti",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 7,
+        "name": "access_expires_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 8,
+        "name": "refresh_expires_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 9,
+        "name": "key_bytes",
+        "type_info": "Bytea"
+      },
+      {
+        "ordinal": 10,
+        "name": "encryption_version",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true,
+      true,
+      false,
+      false,
+      false,
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "c08e3760be75071ac5e281cb3b05b3a02dccbf35b96c3d50c652878a38c9f9e6"
+}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO used_refresh_tokens (refresh_jti, session_id)\n            VALUES ($1, $2)\n            ON CONFLICT (refresh_jti) DO NOTHING\n            ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Int4"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "c0a7b73070e6c5b9baa9caddca3c5d24427b48ed02b5cac913a0c0af1e5c9379"
-}
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "NOTIFY repo_updates",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "d4eacb9bca838dd18dcfd8ca39b83ef50968bfaaabc213536c049cc222ffe9c8"
+}
@@ -1,11 +1,11 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT seq, did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                              ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n                       FROM repo_seq\n                       WHERE seq > $1\n                       ORDER BY seq ASC\n                       LIMIT $2",
+  "query": "SELECT seq as \"seq!\", did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                              ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n                       FROM repo_seq\n                       WHERE seq > $1\n                       ORDER BY seq ASC\n                       LIMIT $2",
  "describe": {
    "columns": [
      {
        "ordinal": 0,
-        "name": "seq",
+        "name": "seq!",
        "type_info": "Int8"
      },
      {
@@ -91,7 +91,7 @@
      ]
    },
    "nullable": [
-      false,
+      true,
      false,
      false,
      false,
@@ -109,5 +109,5 @@
      true
    ]
  },
-  "hash": "89c8ce80d8c52b4668c34f63e48b51cacc7e8ff300958a192378f1d72de04f9a"
+  "hash": "da2770e44c0ec21756ce4b6b0c57abff4f38cd8c680c5ced7d3b35f3c1f58da7"
 }
@@ -1,11 +1,11 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT seq, did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                      ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n               FROM repo_seq\n               WHERE seq > $1\n               ORDER BY seq ASC\n               LIMIT $2",
+  "query": "SELECT seq as \"seq!\", did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                      ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n               FROM repo_seq\n               WHERE seq > $1 AND seq < $2\n               ORDER BY seq ASC",
  "describe": {
    "columns": [
      {
        "ordinal": 0,
-        "name": "seq",
+        "name": "seq!",
        "type_info": "Int8"
      },
      {
@@ -91,7 +91,7 @@
      ]
    },
    "nullable": [
-      false,
+      true,
      false,
      false,
      false,
@@ -109,5 +109,5 @@
      true
    ]
  },
-  "hash": "0349b2af4d21105029ecc2bf81ad7be9987ec17ac088730596849d7a45558e57"
+  "hash": "dfe011b2d2bafbbbbea508a4977fc34bb1be4cf2612296df23763e6e5841c33e"
 }
@@ -1,11 +1,11 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT seq, did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                      ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n               FROM repo_seq\n               WHERE seq > $1 AND seq < $2\n               ORDER BY seq ASC",
+  "query": "SELECT seq as \"seq!\", did, created_at, event_type as \"event_type: RepoEventType\", commit_cid, prev_cid, prev_data_cid,\n                      ops, blobs, block_cids, block_data, blocks_cids, handle, active, status, rev\n               FROM repo_seq\n               WHERE seq > $1\n               ORDER BY seq ASC\n               LIMIT $2",
  "describe": {
    "columns": [
      {
        "ordinal": 0,
-        "name": "seq",
+        "name": "seq!",
        "type_info": "Int8"
      },
      {
@@ -91,7 +91,7 @@
      ]
    },
    "nullable": [
-      false,
+      true,
      false,
      false,
      false,
@@ -109,5 +109,5 @@
      true
    ]
  },
-  "hash": "ad784aff9bb5c1f19f90a3b1c3b3694a3e1aa889b0fe3e55cfebb7af8c620256"
+  "hash": "f16d41b41a5388997e6ed408da55056173340ed12b60b1a956de87f73f9d0824"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT id, did, handle, email, created_at, deactivated_at, takedown_ref, is_admin\n               FROM users WHERE handle = $1",
+  "query": "SELECT id, did, handle, email, created_at, deactivated_at, takedown_ref, is_admin, inbound_migration\n               FROM users WHERE did = $1",
  "describe": {
    "columns": [
      {
@@ -42,6 +42,11 @@
        "ordinal": 7,
        "name": "is_admin",
        "type_info": "Bool"
+      },
+      {
+        "ordinal": 8,
+        "name": "inbound_migration",
+        "type_info": "Bool"
      }
    ],
    "parameters": {
@@ -57,8 +62,9 @@
      false,
      true,
      true,
+      false,
      false
    ]
  },
-  "hash": "584bceda60d8b6a02e7dc44d833e3fba13151f36ba9f75c64e33d6cb534cc939"
+  "hash": "f1c4ec28b02d09ffce35aa8249c1747a70c12a3ecfc1ff6ca1847840f770db2f"
 }
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT session_id FROM used_refresh_tokens WHERE refresh_jti = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "session_id",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "fcd868a192d27fd4eccae92a884e881b8d6f09bf7ae08a9b431a44acbf2f91f3"
-}
@@ -18,4 +18,4 @@ steps:
  - name: Build and push aarch64
    command: |
      SUBS="--option extra-substituters https://tranquil.cachix.org --option extra-trusted-public-keys tranquil.cachix.org-1:PoO+mGL6a6LcJiPakMDHN4E218/ei/7v2sxeDtNkSRg="
-      nix-store -qR --include-outputs $(nix-store -qd $(nix build .#packages.x86_64-linux.tranquil-pds-aarch64 $SUBS --print-out-paths --no-link)) | grep -v '\.drv$' | cachix push "$CACHIX_CACHE_NAME"
+      nix-store -qR --include-outputs $(nix-store -qd $(nix build .#packages.x86_64-linux.tranquil-pds-aarch64 $SUBS --print-out-paths --no-link)) | grep -v '\.drv$' | cachix push tranquil
@@ -18,11 +18,11 @@ steps:
  - name: Build and push x86_64
    command: |
      SUBS="--option extra-substituters https://tranquil.cachix.org --option extra-trusted-public-keys tranquil.cachix.org-1:PoO+mGL6a6LcJiPakMDHN4E218/ei/7v2sxeDtNkSRg="
-      nix-store -qR --include-outputs $(nix-store -qd $(nix build .#packages.x86_64-linux.tranquil-pds $SUBS --print-out-paths --no-link)) | grep -v '\.drv$' | cachix push "$CACHIX_CACHE_NAME"
-      nix-store -qR --include-outputs $(nix-store -qd $(nix build .#packages.x86_64-linux.tranquil-frontend $SUBS --print-out-paths --no-link)) | grep -v '\.drv$' | cachix push "$CACHIX_CACHE_NAME"
+      nix-store -qR --include-outputs $(nix-store -qd $(nix build .#packages.x86_64-linux.tranquil-pds $SUBS --print-out-paths --no-link)) | grep -v '\.drv$' | cachix push tranquil
+      nix-store -qR --include-outputs $(nix-store -qd $(nix build .#packages.x86_64-linux.tranquil-frontend $SUBS --print-out-paths --no-link)) | grep -v '\.drv$' | cachix push tranquil

  - name: Build and push devShell
    command: |
      SUBS="--option extra-substituters https://tranquil.cachix.org --option extra-trusted-public-keys tranquil.cachix.org-1:PoO+mGL6a6LcJiPakMDHN4E218/ei/7v2sxeDtNkSRg="
      nix develop $SUBS --profile dev-profile -c true
-      cachix push "$CACHIX_CACHE_NAME" dev-profile
+      cachix push tranquil dev-profile
@@ -1,24 +1,36 @@
 when:
-  - event: []
-    branch: []
+  - event: [ "manual" ]
+  - event: [ "push" ]
+    branch: [ "main" ]

 engine: nixery

 dependencies:
  nixpkgs:
-    - podman
+    - kaniko
+
+environment:
+  DOCKER_CONFIG: "/kaniko/.docker"

 steps:
-  - name: Create podman config
+  - name: Configure Kaniko
    command: |
-      mkdir -p ~/.config/containers
-      echo "unqualified-search-registries = [\"docker.io\"]" >> ~/.config/containers/registries.conf
+      mkdir -p /kaniko/.docker/
+      echo "{
+        \"auths\": {
+          \"https://atcr.io/v1\":{
+            \"auth\": \"$ATCR_CREDENTIALS\"
+          }
+        }
+      }" > /kaniko/.docker/config.json

  - name: Build image
    command: |
-      podman build . -t tranquil-pds:latest -t "tranquil-pds:$TANGLED_COMMIT_SHA"
-
-  - name: Publish image
-    command: |
-      podman push --creds "$ATCR_USERNAME:$ATCR_PASSWORD" tranquil-pds:latest "atcr.io/tranquil.farm/tranquil-pds:latest"
-      podman push --creds "$ATCR_USERNAME:$ATCR_PASSWORD" "tranquil-pds:$TANGLED_COMMIT_SHA" "atcr.io/tranquil.farm/tranquil-pds:$TANGLED_COMMIT_SHA"
+      executor \
+        --context=$(pwd) \
+        --ignore-path=$(pwd) \
+        --dockerfile=$(pwd)/Dockerfile \
+        --destination="atcr.io/tranquil.farm/tranquil-pds:latest" \
+        --destination="atcr.io/tranquil.farm/tranquil-pds:$TANGLED_COMMIT_SHA" \
+        --push-retry=3 \
+        --skip-push-permission-check
@@ -0,0 +1,190 @@
+# Contributing to Tranquil PDS
+
+## When PRing
+
+In order of importance:
+
+- If your change involves how Tranquil implements atproto make sure its correct! See more below.
+- **You must run your change! Every contribution that says "here's xyz. untested." does not help the project.**
+- Relevant tests to your PR must pass. The whole suite doesn't have to be proven to have run, because there are a *ton* of tests and they're quite heavy, but hopefully there are existing tests for whatever you're PRing, and if there aren't, please add those too.
+- Run cargo fmt :P
+
+> 🦪 Lewis
+>
+> Good CI fixes some of these. We should really get around to that.
+
+Things that would also be nice but aren't like, a pain in our side:
+
+- Big changes should be stacked PRs that are broken up into digestible pieces. Those stacked PRs should hopefully be able to be merged individually if necessary.
+
+### How we define a "correct" PDS implementation
+
+The atproto specs are notoriously imprecise, ambiguious,
+lacks specifications for large parts of the protocol and network (even including what implementing a PDS entails!)
+and is generally none specific.
+This is bad.
+We won't waste time here describing all the ways in which that is problematic,
+the important thing for Tranquil is that this means that "follows spec" is not sufficient to describe a "correct" PDS implementation.
+Thus we need to come up with a description of "correct".
+In order of importance the following rules describe what "correct" means for Tranquil:
+
+- The specs take precedence.
+  If the spec *is* specific enough then follow it.
+  Even if the reference implementation doesn't.
+- If the specs aren't sufficiently specific
+  rely on the reference implementation, potential supporting documents or discussions,
+  and/or community sentiment or common sense.
+  If the matter is still debated and/or PBCs opinion differs from community sentiment we generally side with the community.
+  - Examples here include what features and APIs to implement,
+    here we look at what the reference implementation implements
+    as well as https://github.com/bluesky-social/atproto/discussions/2350 as a supporting document.
+    Another example is whether `include` scopes are allowed to use a `*` `aud` parameter.
+    Discussion here has happened in https://github.com/bluesky-social/atproto/issues/4490.
+    PBC has voiced an opinion that this should be disallowed,
+    community sentiment seems to strongly lean to allowing it. Tranquil allows it.
+  - Please mark locations like this with a `// SPECAMB: ...` comment explaining the ambiguity
+    and what parts of the reference implementation and/or supporting documents have been used as reference.
+- If the reference implementation has behaviour that is only ever relevant for the Bluesky application.
+  Implementions of such behaviour **must** be gated behind a `bsky-support` cargo feature of the implementing crate.
+  - Examples here include bluesky feedgen specific service proxying behaviour,
+    the `app.bsky.actor.getPreferences` and `app.bsky.actor.putPreferences` APIs,
+    and special handling of the `X-BSKY-TOPICS` HTTP header during service proxying.
+  - Please add a comment next to these implementations with an explanation of the behaviour.
+  - Most of these behaviours are required for proper functioning of the official Bluesky client, though not all.
+    If the behaviour isn't required for the official client consider not implementing it.
+  - One such behaviour that we have a *hard rule* to never implement is default proxying to a configured Bluesky appview
+    for `app.bsky.*` APIs and as fallback for `com.atproto.repo.getRecord`.
+    Many third-party Bluesky clients rely on this behaviour, the official client used to do the same but does not anymore.
+    Third-party clients breaking because they don't specify an `atproto-proxy` header is thus *not* a Tranquil bug but a bug in said clients.
+  - Bluesky is the only application that will ever recieve application specific behaviour like this.
+    It does so only because such a big section of atproto usage is Bluesky
+    and because Bluesky is the only application that can practically rely on application specific behaviour.
+    Application specific behaviour for other applications may still be added to Tranquil if such behaviour is a Tranquil feature,
+    for example for Tranquils rudimentary banned content moderation feature,
+    and not something said application relies on for proper functioning.
+
+There is bound to be edge cases that these rules don't fully cover.
+Here common sense, community sentiment, furthering the goals of atproto itself, and ultimately maintainer opinion take precedence over support for any individual application.
+Even Bluesky.
+
+The rules above are meant to capture Tranquils goals of being correct while being community oriented and avoiding as much "Bluesky-defaultism" as possible.
+Tranquil is a community atproto PDS, *not* a company-led Bluesky (or other atproto app) PDS.
+See also "Tranquil & the world" in docs/1_WELCOME_TO_TRANQUIL_PDS.md.
+
+## Local Development
+
+### Prerequisites
+
+- [Docker](https://docs.docker.com/get-docker/) and Docker Compose
+- Add `pds.test` to your hosts file (one-time setup):
+
+  ```
+  127.0.0.1 pds.test
+  ```
+
+  - **macOS / Linux:** `/etc/hosts`
+  - **Windows:** `C:\Windows\System32\drivers\etc\hosts`
+
+### Starting the dev environment
+
+```bash
+just run-dev
+```
+
+This starts the following services via `docker-compose`:
+
+- **Traefik** — HTTPS reverse proxy at `https://pds.test`
+- **Backend** — Rust server with `cargo-watch` (auto-rebuilds on file changes)
+- **Frontend** — Vite dev server with hot module replacement
+- **Postgres** — Database on port 5432
+- **PLC Directory** — Local [did-method-plc](https://github.com/did-method-plc/did-method-plc) server for DID registration
+- **Mailpit** — Local email server with web UI at [http://localhost:8025](http://localhost:8025)
+
+Once all services are running, open **https://pds.test** in your browser.
+
+### Trusting the self-signed certificate
+
+Traefik generates a self-signed TLS certificate. Your browser will show a security warning on first visit. You can either click through it, or add the certificate to your system trust store for a seamless experience:
+
+**macOS:**
+
+```bash
+# Extract the cert from traefik and add it to the system keychain
+echo | openssl s_client -connect localhost:443 -servername pds.test 2>/dev/null | openssl x509 > /tmp/pds-test.pem
+sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/pds-test.pem
+```
+
+**Linux (Debian/Ubuntu):**
+
+```bash
+echo | openssl s_client -connect localhost:443 -servername pds.test 2>/dev/null | openssl x509 | sudo tee /usr/local/share/ca-certificates/pds-test.crt
+sudo update-ca-certificates
+```
+
+**Linux (Fedora/RHEL):**
+
+```bash
+echo | openssl s_client -connect localhost:443 -servername pds.test 2>/dev/null | openssl x509 | sudo tee /etc/pki/ca-trust/source/anchors/pds-test.pem
+sudo update-ca-trust
+```
+
+**Windows (PowerShell as Administrator):**
+
+```powershell
+$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
+$cert.Import([System.Text.Encoding]::UTF8.GetBytes((echo | openssl s_client -connect localhost:443 -servername pds.test 2>$null | openssl x509)))
+$store = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", "LocalMachine")
+$store.Open("ReadWrite")
+$store.Add($cert)
+$store.Close()
+```
+
+Restart your browser after adding the certificate.
+
+### Stopping the dev environment
+
+```bash
+# Stop containers (preserves database + build cache)
+docker compose --profile dev down
+
+# Stop and wipe all data (fresh start)
+docker compose --profile dev down -v
+```
+
+### Direct database access
+
+Postgres is exposed on port 5432:
+
+```bash
+psql postgres://postgres:postgres@localhost:5432/pds
+```
+
+### How it works
+
+- **Source code** is bind-mounted into the containers so that changes made on the host will be immediately reflected in the application
+- **Backend** uses `cargo-watch` to recompile and restart when Rust files change
+- **Frontend** uses Vite's HMR for instant browser updates when frontend files change
+- **Build cache** (`target/` directory and cargo registry) are stored in Docker volumes, so incremental compilation persists across container restarts
+- **Traefik** routes `/`, `/xrpc`, `/oauth`, `/.well-known`, `/u`, and `/health` to the backend; everything else goes to the Vite dev server
+- **Mailpit** captures all outgoing email — open [http://localhost:8025](http://localhost:8025) to view verification emails during registration
+- **PLC Directory** runs locally so DID registration doesn't hit the real `plc.directory`
+
+### Running the backend natively
+
+If you prefer running the Rust backend outside Docker (faster incremental builds on host), you need:
+
+- Rust toolchain (see `rust-toolchain.toml`)
+- `protoc` (`brew install protobuf` on macOS)
+- PostgreSQL (start with `docker compose up db`)
+
+Then run:
+
+```bash
+cargo run -p tranquil-server -- --config config.toml
+```
+
+And start the frontend separately:
+
+```bash
+cd frontend && pnpm install && pnpm dev
+```
@@ -9,7 +9,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "087113bd50d9adce24850eed5d0476c7d199d532fce8fab5173650331e09033a"
 dependencies = [
 "abnf-core",
- "nom",
+ "nom 7.1.3",
 ]

 [[package]]
@@ -18,7 +18,7 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c44e09c43ae1c368fb91a03a566472d0087c26cf7e1b9e8e289c14ede681dd7d"
 dependencies = [
- "nom",
+ "nom 7.1.3",
 ]

 [[package]]
@@ -105,6 +105,21 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "250f629c0161ad8107cf89319e990051fae62832fd343083bea452d93e2205fd"

+[[package]]
+name = "alloc-no-stdlib"
+version = "2.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
+
+[[package]]
+name = "alloc-stdlib"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e76a019e91224d279006ff972f1e984179a6e9feb050adba6ce8274aef23195"
+dependencies = [
+ "alloc-no-stdlib",
+]
+
 [[package]]
 name = "allocator-api2"
 version = "0.2.21"
@@ -210,16 +225,32 @@ version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5493c3bedbacf7fd7382c6346bbd66687d12bbaad3a89a2d2c303ee6cf20b048"
 dependencies = [
- "asn1-rs-derive",
+ "asn1-rs-derive 0.5.1",
 "asn1-rs-impl",
 "displaydoc",
- "nom",
+ "nom 7.1.3",
 "num-traits",
 "rusticata-macros",
 "thiserror 1.0.69",
 "time",
 ]

+[[package]]
+name = "asn1-rs"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f43a50ac4fdca5df8e885c21b835997f0a1cdee65494a6847694a98652d9d8"
+dependencies = [
+ "asn1-rs-derive 0.6.0",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom 7.1.3",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror 2.0.18",
+ "time",
+]
+
 [[package]]
 name = "asn1-rs-derive"
 version = "0.5.1"
@@ -232,6 +263,18 @@ dependencies = [
 "synstructure",
 ]

+[[package]]
+name = "asn1-rs-derive"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+ "synstructure",
+]
+
 [[package]]
 name = "asn1-rs-impl"
 version = "0.2.0"
@@ -1046,7 +1089,7 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
 dependencies = [
- "bit-vec",
+ "bit-vec 0.8.0",
 ]

 [[package]]
@@ -1055,6 +1098,15 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"

+[[package]]
+name = "bit-vec"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "bitflags"
 version = "2.11.0"
@@ -1213,6 +1265,27 @@ dependencies = [
 "cfg_aliases",
 ]

+[[package]]
+name = "brotli"
+version = "8.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cc91aac060a7a1e25823bdccbfb6af1875b88f17c6daac97894eed8207166b3"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+ "brotli-decompressor",
+]
+
+[[package]]
+name = "brotli-decompressor"
+version = "5.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a32acac15fe1967bc3986b2a6347dffc965602354ea6f450ad07e8bfd253583"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+]
+
 [[package]]
 name = "bs58"
 version = "0.5.1"
@@ -1970,9 +2043,23 @@ version = "9.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5cd0a5c643689626bec213c4d8bd4d96acc8ffdb4ad4bb6bc16abf27d5f4b553"
 dependencies = [
- "asn1-rs",
+ "asn1-rs 0.6.2",
 "displaydoc",
- "nom",
+ "nom 7.1.3",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
+[[package]]
+name = "der-parser"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6"
+dependencies = [
+ "asn1-rs 0.7.2",
+ "displaydoc",
+ "nom 7.1.3",
 "num-bigint",
 "num-traits",
 "rusticata-macros",
@@ -2216,6 +2303,22 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "email-encoding"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9298e6504d9b9e780ed3f7dfd43a61be8cd0e09eb07f7706a945b0072b6670b6"
+dependencies = [
+ "base64 0.22.1",
+ "memchr",
+]
+
+[[package]]
+name = "email_address"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e079f19b08ca6239f47f8ba8509c11cf3ea30095831f7fed61441475edd8c449"
+
 [[package]]
 name = "embedded-io"
 version = "0.4.0"
@@ -2419,7 +2522,6 @@ checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
 "crc32fast",
 "miniz_oxide",
- "zlib-rs",
 ]

 [[package]]
@@ -2818,6 +2920,34 @@ dependencies = [
 "tracing",
 ]

+[[package]]
+name = "h3"
+version = "0.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10872b55cfb02a821b69dc7cf8dc6a71d6af25eb9a79662bec4a9d016056b3be"
+dependencies = [
+ "bytes",
+ "fastrand",
+ "futures-util",
+ "http 1.4.0",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "h3-quinn"
+version = "0.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2e732c8d91a74731663ac8479ab505042fbf547b9a207213ab7fbcbfc4f8b4"
+dependencies = [
+ "bytes",
+ "futures",
+ "h3",
+ "quinn",
+ "tokio",
+ "tokio-util",
+]
+
 [[package]]
 name = "half"
 version = "2.7.1"
@@ -3780,6 +3910,37 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"

+[[package]]
+name = "lettre"
+version = "0.11.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dabda5859ee7c06b995b9d1165aa52c39110e079ef609db97178d86aeb051fa7"
+dependencies = [
+ "async-trait",
+ "base64 0.22.1",
+ "ed25519-dalek",
+ "email-encoding",
+ "email_address",
+ "fastrand",
+ "futures-io",
+ "futures-util",
+ "httpdate",
+ "idna",
+ "mime",
+ "nom 8.0.0",
+ "percent-encoding",
+ "quoted_printable",
+ "rsa",
+ "rustls 0.23.37",
+ "sha2",
+ "socket2 0.6.3",
+ "tokio",
+ "tokio-rustls 0.26.4",
+ "tracing",
+ "url",
+ "webpki-roots 1.0.6",
+]
+
 [[package]]
 name = "libc"
 version = "0.2.183"
@@ -4409,6 +4570,15 @@ dependencies = [
 "minimal-lexical",
 ]

+[[package]]
+name = "nom"
+version = "8.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "nonzero_ext"
 version = "0.3.0"
@@ -4558,7 +4728,16 @@ version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a8d8034d9489cdaf79228eb9f6a3b8d7bb32ba00d6645ebd48eef4077ceb5bd9"
 dependencies = [
- "asn1-rs",
+ "asn1-rs 0.6.2",
+]
+
+[[package]]
+name = "oid-registry"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f40cff3dde1b6087cc5d5f5d4d65712f34016a03ed60e9c08dcc392736b5b7"
+dependencies = [
+ "asn1-rs 0.7.2",
 ]

 [[package]]
@@ -4839,7 +5018,7 @@ checksum = "9114f9c1683dd09c5f4fa024c89fdad783eaae21d3d52dd23ddaaffa29ffb168"
 dependencies = [
 "either",
 "fnv",
- "nom",
+ "nom 7.1.3",
 "once_cell",
 "postcard",
 "quick-xml",
@@ -5128,7 +5307,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37566cb3fdacef14c0737f9546df7cfeadbfbc9fef10991038bf5015d0c80532"
 dependencies = [
 "bit-set",
- "bit-vec",
+ "bit-vec 0.8.0",
 "bitflags",
 "num-traits",
 "rand 0.9.2",
@@ -5371,6 +5550,7 @@ checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
 dependencies = [
 "bytes",
 "cfg_aliases",
+ "futures-io",
 "pin-project-lite",
 "quinn-proto",
 "quinn-udp",
@@ -5427,6 +5607,12 @@ dependencies = [
 "proc-macro2",
 ]

+[[package]]
+name = "quoted_printable"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "478e0585659a122aa407eb7e3c0e1fa51b1d8a870038bd29f0cf4a8551eea972"
+
 [[package]]
 name = "r-efi"
 version = "5.3.0"
@@ -5568,6 +5754,20 @@ dependencies = [
 "crossbeam-utils",
 ]

+[[package]]
+name = "rcgen"
+version = "0.14.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57f6d249aad744e274e682777a50283a225a32705394ee6d5fcc01efa25e4055"
+dependencies = [
+ "pem",
+ "ring",
+ "rustls-pki-types",
+ "time",
+ "x509-parser 0.18.1",
+ "yasna",
+]
+
 [[package]]
 name = "redis"
 version = "1.1.0"
@@ -5833,7 +6033,7 @@ version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
 dependencies = [
- "nom",
+ "nom 7.1.3",
 ]

 [[package]]
@@ -6050,6 +6250,16 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "secrecy"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e891af845473308773346dc847b2c23ee78fe442e0472ac50e22a18a93d3ae5a"
+dependencies = [
+ "serde",
+ "zeroize",
+]
+
 [[package]]
 name = "security-framework"
 version = "3.7.0"
@@ -7455,9 +7665,8 @@ dependencies = [

 [[package]]
 name = "tranquil-api"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
- "anyhow",
 "axum",
 "backon",
 "base32",
@@ -7491,27 +7700,25 @@ dependencies = [
 "tokio",
 "tracing",
 "tranquil-config",
- "tranquil-db",
 "tranquil-db-traits",
 "tranquil-lexicon",
 "tranquil-pds",
- "tranquil-scopes",
 "tranquil-signal",
 "tranquil-types",
 "urlencoding",
 "uuid",
 "webauthn-rs",
- "zip",
 ]

 [[package]]
 name = "tranquil-auth"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
 "anyhow",
 "base32",
 "base64 0.22.1",
 "bcrypt",
+ "brotli",
 "chrono",
 "hmac",
 "k256",
@@ -7523,17 +7730,19 @@ dependencies = [
 "totp-rs",
 "tranquil-config",
 "tranquil-crypto",
+ "tranquil-types",
 "urlencoding",
 "uuid",
 ]

 [[package]]
 name = "tranquil-cache"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
 "async-trait",
 "base64 0.22.1",
 "redis",
+ "thiserror 2.0.18",
 "tokio-util",
 "tracing",
 "tranquil-config",
@@ -7543,13 +7752,20 @@ dependencies = [

 [[package]]
 name = "tranquil-comms"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
 "async-trait",
 "base64 0.22.1",
+ "chrono",
+ "ed25519-dalek",
+ "futures",
+ "hickory-resolver",
+ "lettre",
+ "rand 0.8.5",
 "reqwest",
+ "rsa",
+ "secrecy",
 "serde_json",
- "sqlx",
 "thiserror 2.0.18",
 "tokio",
 "tracing",
@@ -7561,15 +7777,14 @@ dependencies = [

 [[package]]
 name = "tranquil-config"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
 "confique",
- "serde",
 ]

 [[package]]
 name = "tranquil-crypto"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
 "aes-gcm",
 "base64 0.22.1",
@@ -7585,7 +7800,7 @@ dependencies = [

 [[package]]
 name = "tranquil-db"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
 "async-trait",
 "chrono",
@@ -7602,7 +7817,7 @@ dependencies = [

 [[package]]
 name = "tranquil-db-traits"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
 "async-trait",
 "base64 0.22.1",
@@ -7618,18 +7833,20 @@ dependencies = [

 [[package]]
 name = "tranquil-infra"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
 "async-trait",
 "bytes",
 "futures",
+ "serde",
+ "serde_json",
 "thiserror 2.0.18",
- "tranquil-config",
+ "tranquil-types",
 ]

 [[package]]
 name = "tranquil-lexicon"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
 "chrono",
 "futures",
@@ -7641,14 +7858,15 @@ dependencies = [
 "thiserror 2.0.18",
 "tokio",
 "tracing",
+ "tranquil-infra",
+ "tranquil-types",
 "unicode-segmentation",
- "urlencoding",
 "wiremock",
 ]

 [[package]]
 name = "tranquil-oauth"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
 "anyhow",
 "axum",
@@ -7665,14 +7883,16 @@ dependencies = [
 "sqlx",
 "tokio",
 "tracing",
+ "tranquil-infra",
 "tranquil-types",
 "uuid",
 ]

 [[package]]
 name = "tranquil-oauth-server"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
+ "async-trait",
 "axum",
 "base64 0.22.1",
 "bcrypt",
@@ -7695,7 +7915,9 @@ dependencies = [
 "tranquil-config",
 "tranquil-crypto",
 "tranquil-db-traits",
+ "tranquil-infra",
 "tranquil-pds",
+ "tranquil-scopes",
 "tranquil-types",
 "urlencoding",
 "uuid",
@@ -7704,7 +7926,7 @@ dependencies = [

 [[package]]
 name = "tranquil-pds"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
 "aes-gcm",
 "anyhow",
@@ -7716,7 +7938,6 @@ dependencies = [
 "base32",
 "base64 0.22.1",
 "bcrypt",
- "bs58",
 "bytes",
 "chrono",
 "ciborium",
@@ -7732,7 +7953,6 @@ dependencies = [
 "hmac",
 "http 1.4.0",
 "image",
- "infer",
 "ipld-core",
 "iroh-car",
 "jacquard-common",
@@ -7744,6 +7964,7 @@ dependencies = [
 "multibase",
 "multihash",
 "p256 0.13.2",
+ "parking_lot",
 "rand 0.8.5",
 "redis",
 "regex",
@@ -7756,6 +7977,7 @@ dependencies = [
 "sha2",
 "sqlx",
 "subtle",
+ "tempfile",
 "testcontainers",
 "testcontainers-modules",
 "thiserror 2.0.18",
@@ -7772,9 +7994,9 @@ dependencies = [
 "tranquil-cache",
 "tranquil-comms",
 "tranquil-config",
- "tranquil-crypto",
 "tranquil-db",
 "tranquil-db-traits",
+ "tranquil-infra",
 "tranquil-lexicon",
 "tranquil-oauth",
 "tranquil-oauth-server",
@@ -7791,12 +8013,11 @@ dependencies = [
 "webauthn-rs",
 "webauthn-rs-proto",
 "wiremock",
- "zip",
 ]

 [[package]]
 name = "tranquil-repo"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
 "bytes",
 "cid",
@@ -7808,19 +8029,22 @@ dependencies = [

 [[package]]
 name = "tranquil-ripple"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
 "async-trait",
 "backon",
 "bincode 2.0.1",
- "bytes",
 "foca",
 "futures",
+ "hkdf",
 "metrics",
 "parking_lot",
+ "quinn",
 "rand 0.9.2",
+ "rcgen",
+ "rustls 0.23.37",
 "serde",
- "socket2 0.6.3",
+ "sha2",
 "thiserror 2.0.18",
 "tokio",
 "tokio-util",
@@ -7829,11 +8053,12 @@ dependencies = [
 "tranquil-config",
 "tranquil-infra",
 "uuid",
+ "x509-parser 0.18.1",
 ]

 [[package]]
 name = "tranquil-scopes"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
 "axum",
 "futures",
@@ -7844,20 +8069,37 @@ dependencies = [
 "thiserror 2.0.18",
 "tokio",
 "tracing",
+ "tranquil-types",
 "urlencoding",
 ]

 [[package]]
 name = "tranquil-server"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
+ "arc-swap",
 "axum",
+ "bytes",
 "clap",
 "dotenvy",
 "ed25519-dalek",
+ "futures-util",
+ "h3",
+ "h3-quinn",
 "hex",
+ "http 1.4.0",
+ "hyper 1.8.1",
+ "hyper-util",
+ "quinn",
+ "rcgen",
+ "reqwest",
+ "rustls 0.23.37",
+ "rustls-pemfile",
+ "thiserror 2.0.18",
 "tokio",
+ "tokio-rustls 0.26.4",
 "tokio-util",
+ "tower",
 "tracing",
 "tracing-subscriber",
 "tranquil-api",
@@ -7870,7 +8112,7 @@ dependencies = [

 [[package]]
 name = "tranquil-signal"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
 "async-trait",
 "chrono",
@@ -7878,7 +8120,6 @@ dependencies = [
 "futures",
 "presage",
 "rand 0.9.2",
- "serde",
 "serde_json",
 "sqlx",
 "tempfile",
@@ -7886,14 +8127,13 @@ dependencies = [
 "tokio",
 "tokio-util",
 "tracing",
- "tranquil-signal",
 "url",
 "uuid",
 ]

 [[package]]
 name = "tranquil-storage"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
 "async-trait",
 "aws-config",
@@ -7910,7 +8150,7 @@ dependencies = [

 [[package]]
 name = "tranquil-store"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
 "async-trait",
 "bytes",
@@ -7950,7 +8190,6 @@ dependencies = [
 "tranquil-db",
 "tranquil-db-traits",
 "tranquil-oauth",
- "tranquil-repo",
 "tranquil-store",
 "tranquil-types",
 "uuid",
@@ -7959,7 +8198,7 @@ dependencies = [

 [[package]]
 name = "tranquil-sync"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
 "anyhow",
 "axum",
@@ -7981,15 +8220,22 @@ dependencies = [

 [[package]]
 name = "tranquil-types"
-version = "0.5.6"
+version = "0.6.6"
 dependencies = [
+ "base64 0.22.1",
 "chrono",
 "cid",
 "jacquard-common",
+ "rand 0.8.5",
+ "reqwest",
 "serde",
 "serde_json",
 "sqlx",
 "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "url",
+ "uuid",
 ]

 [[package]]
@@ -8041,12 +8287,6 @@ version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ea3136b675547379c4bd395ca6b938e5ad3c3d20fad76e7fe85f9e0d011419c"

-[[package]]
-name = "typed-path"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
-
 [[package]]
 name = "typenum"
 version = "1.19.0"
@@ -8494,9 +8734,9 @@ checksum = "15784340a24c170ce60567282fb956a0938742dbfbf9eff5df793a686a009b8b"
 dependencies = [
 "base64 0.21.7",
 "base64urlsafedata",
- "der-parser",
+ "der-parser 9.0.0",
 "hex",
- "nom",
+ "nom 7.1.3",
 "openssl",
 "openssl-sys",
 "rand 0.9.2",
@@ -8510,7 +8750,7 @@ dependencies = [
 "uuid",
 "webauthn-attestation-ca",
 "webauthn-rs-proto",
- "x509-parser",
+ "x509-parser 0.16.0",
 ]

 [[package]]
@@ -9064,17 +9304,35 @@ version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fcbc162f30700d6f3f82a24bf7cc62ffe7caea42c0b2cba8bf7f3ae50cf51f69"
 dependencies = [
- "asn1-rs",
+ "asn1-rs 0.6.2",
 "data-encoding",
- "der-parser",
+ "der-parser 9.0.0",
 "lazy_static",
- "nom",
- "oid-registry",
+ "nom 7.1.3",
+ "oid-registry 0.7.1",
 "rusticata-macros",
 "thiserror 1.0.69",
 "time",
 ]

+[[package]]
+name = "x509-parser"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d43b0f71ce057da06bc0851b23ee24f3f86190b07203dd8f567d0b706a185202"
+dependencies = [
+ "asn1-rs 0.7.2",
+ "data-encoding",
+ "der-parser 10.0.0",
+ "lazy_static",
+ "nom 7.1.3",
+ "oid-registry 0.8.1",
+ "ring",
+ "rusticata-macros",
+ "thiserror 2.0.18",
+ "time",
+]
+
 [[package]]
 name = "xattr"
 version = "1.6.1"
@@ -9103,6 +9361,16 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"

+[[package]]
+name = "yasna"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5f6765e852b9b4dc8e2a76843e4d64d1cea8e79bcde0b6901aea8e7c7f08282"
+dependencies = [
+ "bit-vec 0.9.1",
+ "time",
+]
+
 [[package]]
 name = "yoke"
 version = "0.8.1"
@@ -9220,20 +9488,6 @@ dependencies = [
 "syn 2.0.117",
 ]

-[[package]]
-name = "zip"
-version = "7.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c42e33efc22a0650c311c2ef19115ce232583abbe80850bc8b66509ebef02de0"
-dependencies = [
- "crc32fast",
- "flate2",
- "indexmap 2.13.0",
- "memchr",
- "typed-path",
- "zopfli",
-]
-
 [[package]]
 name = "zkcredential"
 version = "0.1.0"
@@ -9282,30 +9536,12 @@ dependencies = [
 "zkcredential",
 ]

-[[package]]
-name = "zlib-rs"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3be3d40e40a133f9c916ee3f9f4fa2d9d63435b5fbe1bfc6d9dae0aa0ada1513"
-
 [[package]]
 name = "zmij"
 version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"

-[[package]]
-name = "zopfli"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249"
-dependencies = [
- "bumpalo",
- "crc32fast",
- "log",
- "simd-adler32",
-]
-
 [[package]]
 name = "zune-core"
 version = "0.5.1"
@@ -26,7 +26,7 @@ members = [
 ]

 [workspace.package]
-version = "0.5.6"
+version = "0.6.6"
 edition = "2024"
 license = "AGPL-3.0-or-later"

@@ -47,7 +47,6 @@ tranquil-db = { path = "crates/tranquil-db" }
 tranquil-ripple = { path = "crates/tranquil-ripple" }
 tranquil-lexicon = { path = "crates/tranquil-lexicon" }
 tranquil-pds = { path = "crates/tranquil-pds" }
-tranquil-server = { path = "crates/tranquil-server" }
 tranquil-sync = { path = "crates/tranquil-sync" }
 tranquil-oauth-server = { path = "crates/tranquil-oauth-server" }
 tranquil-api = { path = "crates/tranquil-api" }
@@ -59,6 +58,7 @@ presage = { git = "https://github.com/whisperfish/presage", rev = "fe3ed54c4844a
 unicode-segmentation = "1"

 aes-gcm = "0.10"
+arc-swap = "1"
 backon = "1"
 bincode = { version = "2", features = ["serde"] }
 anyhow = "1.0"
@@ -81,11 +81,15 @@ foca = { version = "1", features = ["bincode-codec", "tracing"] }
 futures = "0.3"
 futures-util = "0.3"
 governor = "0.10"
+h3 = "0.0.8"
+h3-quinn = "0.0.10"
 hex = "0.4"
 hickory-resolver = { version = "0.24", features = ["tokio-runtime"] }
 hkdf = "0.12"
 hmac = "0.12"
 http = "1.4"
+hyper = { version = "1", features = ["server", "http1", "http2"] }
+hyper-util = { version = "0.1", features = ["server", "server-auto", "server-graceful", "service", "tokio"] }
 image = { version = "0.25", default-features = false, features = ["jpeg", "png", "gif", "webp"] }
 qrcodegen = "1.8"
 infer = "0.19"
@@ -93,6 +97,7 @@ ipld-core = "0.4"
 iroh-car = "0.5"
 jacquard-common = { version = "0.9", features = ["crypto-k256"] }
 jacquard-repo = "0.9"
+lettre = { version = "0.11", default-features = false, features = ["builder", "smtp-transport", "tokio1", "tokio1-rustls-tls", "pool", "dkim", "tracing"] }
 jsonwebtoken = { version = "10.2", features = ["rust_crypto"] }
 k256 = { version = "0.13", features = ["ecdsa", "pem", "pkcs8"] }
 metrics = "0.24"
@@ -102,9 +107,15 @@ parking_lot = "0.12"
 multihash = "0.19"
 p256 = { version = "0.13", features = ["ecdsa"] }
 p384 = { version = "0.13", features = ["ecdsa"] }
+quinn = { version = "0.11", default-features = false, features = ["runtime-tokio", "rustls-ring", "log"] }
 rand = "0.8"
+rcgen = { version = "0.14", default-features = false, features = ["ring", "pem"] }
 redis = { version = "1.0", features = ["tokio-comp", "connection-manager"] }
 regex = "1"
+rsa = "0.9"
+rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12", "logging"] }
+rustls-pemfile = "2"
+secrecy = { version = "0.10", features = ["serde"] }
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-webpki-roots", "http2", "charset", "macos-system-configuration"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_bytes = "0.11"
@@ -116,8 +127,9 @@ sqlx = { version = "0.8", features = ["runtime-tokio-rustls", "postgres", "uuid"
 subtle = "2.5"
 thiserror = "2.0"
 tokio = { version = "1.48", features = ["macros", "rt-multi-thread", "time", "signal", "process", "io-util", "fs"] }
-tokio-util = "0.7.18"
+tokio-util = { version = "0.7.18", features = ["rt"] }
 tokio-tungstenite = { version = "0.28", features = ["rustls-tls-webpki-roots"] }
+tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12", "logging"] }
 totp-rs = { version = "5", features = ["qr"] }
 tower = "0.5"
 tower-http = { version = "0.6", features = ["fs", "cors"] }
@@ -125,10 +137,11 @@ tower-layer = "0.3"
 tracing = "0.1"
 tracing-subscriber = "0.3"
 urlencoding = "2.1"
+url = "2.5"
 uuid = { version = "1.19", features = ["v4", "v5", "v7", "fast-rng", "serde"] }
 webauthn-rs = { version = "0.5", features = ["danger-allow-state-serialisation", "danger-user-presence-only-security-keys", "conditional-ui"] }
 webauthn-rs-proto = "0.5"
-zip = { version = "7.0", default-features = false, features = ["deflate"] }
+x509-parser = "0.18"

 ciborium = "0.2"
 ctor = "0.6"
@@ -140,11 +153,20 @@ wiremock = "0.6"
 curve25519-dalek = { git = "https://github.com/signalapp/curve25519-dalek", tag = "signal-curve25519-4.1.3" }

 [profile.release]
-lto = "fat"
+opt-level = "s"
 strip = true
-codegen-units = 1
 panic = "abort"
+codegen-units = 256
+
+[profile.lewis]
+inherits = "release"
+opt-level = 3
+lto = "fat"
+codegen-units = 1

 [profile.bench]
+opt-level = 3
+lto = "fat"
+codegen-units = 1
 debug = 1
 strip = false
@@ -1,13 +1,35 @@
-FROM node:24-alpine AS frontend
+ARG DISTROLESS_IMAGE=gcr.io/distroless/cc-debian13:latest@sha256:1e3c6d9c255be500eb680cdea0ad07554f52ae92dfcbdf07043a2a435b4c1fe3
+
+FROM node:24-trixie-slim AS frontend
 RUN corepack enable && corepack prepare pnpm@latest --activate
 WORKDIR /app
-COPY frontend/package.json frontend/pnpm-lock.yaml ./
+COPY frontend/package.json frontend/pnpm-lock.yaml frontend/pnpm-workspace.yaml ./
 RUN pnpm install --frozen-lockfile
 COPY frontend/ ./
 RUN pnpm build

-FROM rust:1.92-alpine AS builder
-RUN apk add --no-cache ca-certificates musl-dev pkgconfig openssl-dev openssl-libs-static mold clang protoc
+FROM rust:1.96-slim-trixie AS builder
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates pkg-config libssl-dev mold clang protobuf-compiler curl xz-utils \
+    && rm -rf /var/lib/apt/lists/*
+ARG COMPRESS="true"
+RUN set -eux; \
+    if [ "$COMPRESS" = "true" ]; then \
+      arch="$(uname -m)"; \
+      case "$arch" in \
+        x86_64)  upx_arch=amd64; upx_sha=ddc2654063fe4dc80d95b420788494e4db078ebb01a650692d623b5a9906e61e ;; \
+        aarch64) upx_arch=arm64; upx_sha=100310f74eb6f67694d1d0377f1c729b6a49238ce8c4de21ea2e7d3406186f8b ;; \
+        *) echo "upx: no prebuilt binary for $arch, skipping compression"; upx_arch="" ;; \
+      esac; \
+      if [ -n "$upx_arch" ]; then \
+        curl -fsSL -o /tmp/upx.tar.xz "https://github.com/upx/upx/releases/download/v5.0.2/upx-5.0.2-${upx_arch}_linux.tar.xz"; \
+        echo "${upx_sha}  /tmp/upx.tar.xz" | sha256sum -c -; \
+        tar -xJf /tmp/upx.tar.xz -C /tmp; \
+        install -m0755 "/tmp/upx-5.0.2-${upx_arch}_linux/upx" /usr/local/bin/upx; \
+        rm -rf /tmp/upx.tar.xz "/tmp/upx-5.0.2-${upx_arch}_linux"; \
+      fi; \
+    fi
+RUN mkdir -p /stage/var/lib/tranquil-pds/blobs /stage/var/lib/tranquil-pds/store
 ENV RUSTFLAGS="-C linker=clang -C link-arg=-fuse-ld=mold"
 WORKDIR /app
 ARG SLIM="false"
@@ -35,24 +57,24 @@ COPY crates/tranquil-oauth-server ./crates/tranquil-oauth-server
 COPY crates/tranquil-store ./crates/tranquil-store
 COPY crates/tranquil-signal ./crates/tranquil-signal
 COPY crates/tranquil-server ./crates/tranquil-server
-COPY migrations ./crates/tranquil-pds/migrations
-RUN --mount=type=cache,target=/usr/local/cargo/registry \
-    --mount=type=cache,target=/app/target \
+COPY migrations ./migrations
+RUN --mount=type=cache,id=cargo-registry,target=/usr/local/cargo/registry \
+    --mount=type=cache,id=cargo-git,target=/usr/local/cargo/git \
+    --mount=type=cache,id=tranquil-target,target=/app/target,sharing=locked \
    if [ "$SLIM" = "true" ]; then \
      SQLX_OFFLINE=true cargo build --release -p tranquil-server --no-default-features; \
    else \
      SQLX_OFFLINE=true cargo build --release -p tranquil-server; \
    fi && \
-    cp target/release/tranquil-server /tmp/tranquil-pds
+    cp target/release/tranquil-server /tmp/tranquil-pds && \
+    if [ "$COMPRESS" = "true" ] && command -v upx >/dev/null 2>&1; then upx --best --lzma /tmp/tranquil-pds; fi

-FROM alpine:3.23
-RUN apk add --no-cache msmtp ca-certificates \
-    && ln -sf /usr/bin/msmtp /usr/sbin/sendmail
+FROM ${DISTROLESS_IMAGE}
 COPY --from=builder /tmp/tranquil-pds /usr/local/bin/tranquil-pds
-COPY --from=frontend /app/dist /var/lib/tranquil-pds/frontend
-COPY migrations /app/migrations
-WORKDIR /app
-ENV SERVER_HOST=0.0.0.0
+COPY --from=builder --chown=65532:65532 /stage/var/lib/tranquil-pds /var/lib/tranquil-pds
+COPY --from=frontend --chown=65532:65532 /app/dist /var/lib/tranquil-pds/frontend
+WORKDIR /var/lib/tranquil-pds
+ENV SERVER_HOST=[::]
 ENV SERVER_PORT=3000
 EXPOSE 3000
-CMD ["tranquil-pds"]
+ENTRYPOINT ["/usr/local/bin/tranquil-pds"]
@@ -0,0 +1,19 @@
+FROM rust:1.96-slim-trixie
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    pkg-config \
+    libssl-dev \
+    mold \
+    clang \
+    protobuf-compiler \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN cargo install cargo-watch
+
+ENV RUSTFLAGS="-C linker=clang -C link-arg=-fuse-ld=mold"
+ENV SQLX_OFFLINE=true
+
+WORKDIR /app
+
+CMD ["cargo", "watch", "-x", "run -p tranquil-server -- --config /app/config.dev.toml"]
@@ -6,7 +6,7 @@ A Personal Data Server for the AT Protocol.

 We came together to make this PDS to enable and empower our users to better host their data on this shared protocol. All of our decisions as a project are guided by their usefulness to the community: PDS hosters and end-users both. 

-Comparatively: Bluesky the company created a "reference PDS" that we can self-host quite easily, and that's great, but Bluesky has an incentive to make software for themselvess first & foremost, then secondly their software can be useful for us self-hosters. In contrast, Tranquil is not from a company, and will never be.
+Comparatively: Bluesky the company created a "reference PDS" that we can self-host quite easily, and that's great, but Bluesky has an incentive to make software for themselves first & foremost, then secondly their software can be useful for us self-hosters. In contrast, Tranquil is not from a company, and will never be.

 ## What's different about Tranquil PDS

@@ -20,7 +20,7 @@ It is a superset of the reference PDS, including:
 - account delegation: letting others manage an account with configurable permission levels
 - a built-in web UI for account management, repo browsing, and admin

-Unlike the ref PDS, Tranquil itself is compiled to a single binary with no nodeJS runtime. However, at time of writing, Tranquil requires postgres running separately.
+Unlike the ref PDS, Tranquil is a single binary with no nodejs runtime. That said, at time of writing, Tranquil does require postgres running separately.

 ## Quick Start

@@ -46,25 +46,28 @@ just test
 just lint
 ```

-Nix users can enter a devshell with `nix develop`, or `direnv allow` to auto-enter via the bundled `.envrc`. Pre-built artifacts (including the devshell) are available from our [binary cache](docs/install-nix.md#binary-cache).
+Nix users can enter a devshell with `nix develop`, or `direnv allow` to auto-enter via the bundled `.envrc`. Pre-built artifacts including the devshell are available from our [binary cache](docs/2_INSTALL_NIX.md#binary-cache).

 ## Production Deployment

 ### Quick Deploy (Docker/Podman Compose)

-Edit `config.toml` with your values. Generate secrets with `openssl rand -base64 48`.
+`docker-compose.prod.yaml` pulls the prebuilt image `atcr.io/tranquil.farm/tranquil-pds:latest`. Sign in to the registry first with `podman login atcr.io`. The Containers guide covers building from source.

 ```bash
 cp example.toml config.toml
+```
+
+Edit `config.toml` with your values and generate secrets with `openssl rand -base64 48`. Set the postgres password to match `docker-compose.prod.yaml`. nginx needs a TLS certificate before it starts, so follow the wildcard cert steps in the [Containers guide](docs/2_INSTALL_CONTAINERS.md).
+
+```bash
 podman-compose -f docker-compose.prod.yaml up -d
 ```

 ### Installation Guides

- [Nix](docs/install-nix.md)
- [Debian](docs/install-debian.md)
- [Containers](docs/install-containers.md)
- [Kubernetes](docs/install-kubernetes.md)
+- [Nix](docs/2_INSTALL_NIX.md)
+- [Containers](docs/2_INSTALL_CONTAINERS.md)

 ## Community

@@ -77,7 +80,7 @@ We currently don't have a shared space to chat and organize Tranquil things, but
 - [@oyster.cafe](https://tangled.org/did:plc:3fwecdnvtcscjnrx2p4n7alz)
 - [@nel.pet](https://tangled.org/did:plc:h5wsnqetncv6lu2weom35lg2)

-### Amazing contributers
+### Amazing contributors

 - [@isabelroses.com](https://tangled.org/did:plc:qxichs7jsycphrsmbujwqbfb)
 - [@quilling.dev](https://tangled.org/did:plc:jrtgsidnmxaen4offglr5lsh)
@@ -88,6 +91,8 @@ We currently don't have a shared space to chat and organize Tranquil things, but
 - [@a.starrysky.fyi](https://tangled.org/did:plc:uuyqs6y3pwtbteet4swt5i5y)
 - [@sans-self.org](https://tangled.org/did:plc:wydyrngmxbcsqdvhmd7whmye)
 - [@tachyonism.tngl.sh](https://tangled.org/did:plc:w6qiwij62bmdugsd3gemhpy2)
+- [@trezy.codes](https://tangled.org/did:plc:4jrld6fwpnwqehtce56qshzv)
+- [@ave.zone](https://tangled.org/did:plc:mchrltkrhuzpxleiwpmmvpar)
 - Could be your name here too!

 ### Tranquil PDS instances in the wild!
@@ -0,0 +1,30 @@
+[server]
+hostname = "pds.test"
+allow_http_proxy = true
+invite_code_required = false
+disable_rate_limiting = true
+
+[frontend]
+enabled = true
+dir = "/app/frontend/public"
+
+[database]
+url = "postgres://postgres:postgres@db:5432/pds"
+
+[storage]
+path = "/var/lib/tranquil-pds/blobs"
+
+[plc]
+directory_url = "http://plc:2582"
+
+[email]
+from_address = "noreply@pds.test"
+from_name = "Tranquil PDS (Dev)"
+
+[email.smarthost]
+host = "mailpit"
+port = 1025
+tls = "none"
+
+[secrets]
+allow_insecure = true
@@ -8,13 +8,10 @@ license.workspace = true
 tranquil-pds = { workspace = true }
 tranquil-types = { workspace = true }
 tranquil-config = { workspace = true }
-tranquil-db = { workspace = true }
 tranquil-db-traits = { workspace = true }
 tranquil-lexicon = { workspace = true, features = ["resolve"] }
-tranquil-scopes = { workspace = true }
 tranquil-signal = { workspace = true }

-anyhow = { workspace = true }
 axum = { workspace = true }
 backon = { workspace = true }
 base32 = { workspace = true }
@@ -50,4 +47,7 @@ tracing = { workspace = true }
 urlencoding = { workspace = true }
 uuid = { workspace = true }
 webauthn-rs = { workspace = true }
-zip = { workspace = true }
+
+[features]
+bsky = ["bsky-support"]
+bsky-support = []
@@ -1,3 +0,0 @@
-mod preferences;
-
-pub use preferences::{get_preferences, put_preferences};
@@ -8,7 +8,7 @@ use std::collections::HashMap;
 use tranquil_pds::api::error::{ApiError, DbResultExt};
 use tranquil_pds::auth::{Admin, Auth};
 use tranquil_pds::state::AppState;
-use tranquil_pds::types::{Did, Handle};
+use tranquil_pds::types::{Did, Handle, InviteCode};

 #[derive(Deserialize)]
 pub struct GetAccountInfoParams {
@@ -39,7 +39,7 @@ pub struct AccountInfo {
 #[derive(Serialize, Clone)]
 #[serde(rename_all = "camelCase")]
 pub struct InviteCodeInfo {
-    pub code: String,
+    pub code: InviteCode,
    pub available: i32,
    pub disabled: bool,
    #[serde(skip_serializing_if = "Option::is_none")]
@@ -123,12 +123,12 @@ async fn get_invites_for_user(
        return None;
    }

-    let code_strings: Vec<String> = invite_codes.iter().map(|ic| ic.code.clone()).collect();
+    let codes: Vec<InviteCode> = invite_codes.iter().map(|ic| ic.code.clone()).collect();

    let uses = state
        .repos
        .infra
-        .get_invite_code_uses_batch(&code_strings)
+        .get_invite_code_uses_batch(&codes)
        .await
        .ok()?;

@@ -157,7 +157,7 @@ async fn get_invites_for_user(
    }
 }

-async fn get_invite_code_info(state: &AppState, code: &str) -> Option<InviteCodeInfo> {
+async fn get_invite_code_info(state: &AppState, code: &InviteCode) -> Option<InviteCodeInfo> {
    let info = state.repos.infra.get_invite_code_info(code).await.ok()??;

    let uses = state
@@ -200,11 +200,11 @@ pub async fn get_account_infos(
        return Err(ApiError::InvalidRequest("dids is required".into()));
    }

-    let dids_typed: Vec<Did> = dids.iter().filter_map(|d| d.parse().ok()).collect();
+    let dids: Vec<Did> = dids.iter().filter_map(|d| d.parse().ok()).collect();
    let accounts = state
        .repos
        .infra
-        .get_admin_account_infos_by_dids(&dids_typed)
+        .get_admin_account_infos_by_dids(&dids)
        .await
        .log_db_err("fetching account infos")?;

@@ -217,7 +217,7 @@ pub async fn get_account_infos(
        .await
        .unwrap_or_default();

-    let all_codes: Vec<String> = all_invite_codes
+    let all_codes: Vec<InviteCode> = all_invite_codes
        .iter()
        .map(|(_, c)| c.code.clone())
        .collect();
@@ -233,7 +233,7 @@ pub async fn get_account_infos(
        Vec::new()
    };

-    let invited_by_map: HashMap<uuid::Uuid, String> = state
+    let invited_by_map: HashMap<uuid::Uuid, InviteCode> = state
        .repos
        .infra
        .get_invite_code_uses_by_users(&user_ids)
@@ -249,7 +249,7 @@ pub async fn get_account_infos(

    let (codes_by_user, code_info_map): (
        HashMap<uuid::Uuid, Vec<InviteCodeInfo>>,
-        HashMap<String, InviteCodeInfo>,
+        HashMap<InviteCode, InviteCodeInfo>,
    ) = all_invite_codes.into_iter().fold(
        (HashMap::new(), HashMap::new()),
        |(mut by_user, mut by_code), (user_id, ic)| {
@@ -106,7 +106,7 @@ pub async fn update_account_handle(
            }
            let _ = state
                .cache
-                .delete(&tranquil_pds::cache_keys::handle_key(&handle))
+                .delete(&tranquil_pds::cache_keys::handle_key(&handle_for_check))
                .await;
            if let Err(e) = tranquil_pds::repo_ops::sequence_identity_event(
                &state,
@@ -10,12 +10,13 @@ use tranquil_pds::api::EmptyResponse;
 use tranquil_pds::api::error::{ApiError, DbResultExt};
 use tranquil_pds::auth::{Admin, Auth};
 use tranquil_pds::state::AppState;
+use tranquil_types::{Did, InviteCode};

 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct DisableInviteCodesInput {
-    pub codes: Option<Vec<String>>,
-    pub accounts: Option<Vec<String>>,
+    pub codes: Option<Vec<InviteCode>>,
+    pub accounts: Option<Vec<Did>>,
 }

 pub async fn disable_invite_codes(
@@ -28,17 +29,14 @@ pub async fn disable_invite_codes(
    {
        error!("DB error disabling invite codes: {:?}", e);
    }
-    if let Some(accounts) = &input.accounts {
-        let accounts_typed: Vec<tranquil_types::Did> =
-            accounts.iter().filter_map(|a| a.parse().ok()).collect();
-        if let Err(e) = state
+    if let Some(accounts) = &input.accounts
+        && let Err(e) = state
            .repos
            .infra
-            .disable_invite_codes_by_account(&accounts_typed)
+            .disable_invite_codes_by_account(accounts)
            .await
-        {
-            error!("DB error disabling invite codes by account: {:?}", e);
-        }
+    {
+        error!("DB error disabling invite codes by account: {:?}", e);
    }
    Ok(Json(EmptyResponse {}))
 }
@@ -53,7 +51,7 @@ pub struct GetInviteCodesParams {
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct InviteCodeInfo {
-    pub code: String,
+    pub code: InviteCode,
    pub available: i32,
    pub disabled: bool,
    pub for_account: String,
@@ -72,7 +70,7 @@ pub struct InviteCodeUseInfo {
 #[derive(Serialize)]
 pub struct GetInviteCodesOutput {
    #[serde(skip_serializing_if = "Option::is_none")]
-    pub cursor: Option<String>,
+    pub cursor: Option<InviteCode>,
    pub codes: Vec<InviteCodeInfo>,
 }

@@ -95,9 +93,9 @@ pub async fn get_invite_codes(
        .log_db_err("fetching invite codes")?;

    let user_ids: Vec<uuid::Uuid> = codes_rows.iter().map(|r| r.created_by_user).collect();
-    let code_strings: Vec<String> = codes_rows.iter().map(|r| r.code.clone()).collect();
+    let code_values: Vec<InviteCode> = codes_rows.iter().map(|r| r.code.clone()).collect();

-    let creator_dids: std::collections::HashMap<uuid::Uuid, tranquil_types::Did> = state
+    let creator_dids: std::collections::HashMap<uuid::Uuid, Did> = state
        .repos
        .infra
        .get_user_dids_by_ids(&user_ids)
@@ -106,14 +104,14 @@ pub async fn get_invite_codes(
        .into_iter()
        .collect();

-    let uses_by_code = if code_strings.is_empty() {
+    let uses_by_code = if code_values.is_empty() {
        std::collections::HashMap::new()
    } else {
        common::group_invite_uses_by_code(
            state
                .repos
                .infra
-                .get_invite_code_uses_batch(&code_strings)
+                .get_invite_code_uses_batch(&code_values)
                .await
                .unwrap_or_default(),
            |u| InviteCodeUseInfo {
@@ -167,7 +165,7 @@ pub async fn disable_account_invites(
    if account.is_empty() {
        return Err(ApiError::InvalidRequest("account is required".into()));
    }
-    let account_did: tranquil_types::Did = account
+    let account_did: Did = account
        .parse()
        .map_err(|_| ApiError::InvalidDid("Invalid DID format".into()))?;

@@ -200,7 +198,7 @@ pub async fn enable_account_invites(
    if account.is_empty() {
        return Err(ApiError::InvalidRequest("account is required".into()));
    }
-    let account_did: tranquil_types::Did = account
+    let account_did: Did = account
        .parse()
        .map_err(|_| ApiError::InvalidDid("Invalid DID format".into()))?;

@@ -9,7 +9,6 @@ use tranquil_pds::state::AppState;
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SignalStatusOutput {
-    pub enabled: bool,
    pub linked: bool,
 }

@@ -23,13 +22,12 @@ pub async fn get_signal_status(
    State(state): State<AppState>,
    _auth: Auth<Admin>,
 ) -> Result<Json<SignalStatusOutput>, ApiError> {
-    let enabled = tranquil_config::get().signal.enabled;
    let linked = match &state.signal_sender {
        Some(slot) => slot.is_linked().await,
        None => false,
    };

-    Ok(Json(SignalStatusOutput { enabled, linked }))
+    Ok(Json(SignalStatusOutput { linked }))
 }

 pub async fn link_signal_device(
@@ -5,7 +5,7 @@ use tracing::error;
 use tranquil_db_traits::{CommsChannel, DidWebOverrides, SessionRepository, UserRepository};
 use tranquil_pds::api::error::ApiError;
 use tranquil_pds::api::error::DbResultExt;
-use tranquil_pds::types::{AtIdentifier, Did, Handle};
+use tranquil_pds::types::{AtIdentifier, Did, Handle, PasswordHash};

 pub struct ResolvedRepo {
    pub user_id: uuid::Uuid,
@@ -76,7 +76,7 @@ pub async fn resolve_repo_user_id(
 pub fn group_invite_uses_by_code<U, F>(
    uses: Vec<tranquil_db_traits::InviteCodeUse>,
    map_use: F,
-) -> HashMap<String, Vec<U>>
+) -> HashMap<tranquil_types::InviteCode, Vec<U>>
 where
    F: Fn(tranquil_db_traits::InviteCodeUse) -> U,
 {
@@ -195,12 +195,13 @@ pub fn extract_verification_recipient(
    }
 }

-pub fn create_self_hosted_did_web(handle: &str) -> Result<String, ApiError> {
+pub fn create_self_hosted_did_web(handle: &str) -> Result<Did, ApiError> {
    if !tranquil_pds::util::is_self_hosted_did_web_enabled() {
        return Err(ApiError::SelfHostedDidWebDisabled);
    }
    let encoded_handle = handle.replace(':', "%3A");
-    Ok(format!("did:web:{}", encoded_handle))
+    Did::new(format!("did:web:{}", encoded_handle))
+        .map_err(|_| ApiError::InvalidHandle(Some("Handle is not a valid did:web".into())))
 }

 pub enum CredentialMatch {
@@ -216,10 +217,10 @@ pub async fn verify_credential(
    session_repo: &dyn SessionRepository,
    user_id: uuid::Uuid,
    password: &str,
-    password_hash: Option<&str>,
+    password_hash: Option<&PasswordHash>,
 ) -> Option<CredentialMatch> {
    let main_valid = password_hash
-        .map(|h| bcrypt::verify(password, h).unwrap_or(false))
+        .map(|h| bcrypt::verify(password, h.as_str()).unwrap_or(false))
        .unwrap_or(false);
    if main_valid {
        return Some(CredentialMatch::MainPassword);
@@ -230,7 +231,7 @@ pub async fn verify_credential(
        .unwrap_or_default();
    app_passwords
        .into_iter()
-        .find(|app| bcrypt::verify(password, &app.password_hash).unwrap_or(false))
+        .find(|app| bcrypt::verify(password, app.password_hash.as_str()).unwrap_or(false))
        .map(|app| {
            let scopes = app.scopes.unwrap_or_else(|| {
                if app.privilege.is_privileged() {
@@ -247,14 +248,16 @@ pub async fn verify_credential(
        })
 }

-pub fn hash_or_internal_error(value: &str) -> Result<String, ApiError> {
-    bcrypt::hash(value, DEFAULT_COST).map_err(|e| {
-        error!("Bcrypt hash error: {:?}", e);
-        ApiError::InternalError(None)
-    })
+pub fn hash_or_internal_error(value: &str) -> Result<PasswordHash, ApiError> {
+    bcrypt::hash(value, DEFAULT_COST)
+        .map(PasswordHash::new)
+        .map_err(|e| {
+            error!("Bcrypt hash error: {:?}", e);
+            ApiError::InternalError(None)
+        })
 }

-pub async fn hash_password_async(password: &str) -> Result<String, ApiError> {
+pub async fn hash_password_async(password: &str) -> Result<PasswordHash, ApiError> {
    let password = password.to_string();
    tokio::task::spawn_blocking(move || hash(password, DEFAULT_COST))
        .await
@@ -262,6 +265,7 @@ pub async fn hash_password_async(password: &str) -> Result<String, ApiError> {
            error!("Failed to spawn blocking task: {:?}", e);
            ApiError::InternalError(None)
        })?
+        .map(PasswordHash::new)
        .map_err(|e| {
            error!("Failed to hash password: {:?}", e);
            ApiError::InternalError(None)
@@ -12,12 +12,12 @@ use tranquil_pds::api::{
 };
 use tranquil_pds::auth::{Active, Auth};
 use tranquil_pds::delegation::{
-    DelegationActionType, SCOPE_PRESETS, ValidatedDelegationScope, verify_can_add_controllers,
-    verify_can_control_accounts,
+    DelegationActionType, IdentityResolutionError, SCOPE_PRESETS, ValidatedDelegationScope,
+    verify_can_add_controllers, verify_can_control_accounts,
 };
 use tranquil_pds::rate_limit::{AccountCreationLimit, RateLimited};
 use tranquil_pds::state::AppState;
-use tranquil_pds::types::{Did, Handle};
+use tranquil_pds::types::{CidLink, Did, Handle};

 pub async fn list_controllers(
    State(state): State<AppState>,
@@ -38,11 +38,10 @@ pub async fn list_controllers(
        async move {
            if c.handle.is_none() {
                c.handle = did_resolver
-                    .fetch_did_document(c.did.as_str())
+                    .fetch_did_document(&c.did)
                    .await
                    .ok()
-                    .and_then(|doc| tranquil_types::did_doc::extract_handle(&doc))
-                    .map(Into::into);
+                    .and_then(|doc| tranquil_types::did_doc::extract_handle(&doc));
            }
            c
        }
@@ -66,19 +65,19 @@ pub async fn add_controller(
 ) -> Result<Json<SuccessResponse>, ApiError> {
    let resolved = tranquil_pds::delegation::resolve_identity(&state, &input.controller_did)
        .await
-        .map_err(|_| ApiError::ControllerNotFound)?;
+        .map_err(|e| match e {
+            IdentityResolutionError::PdsEndpoint(_) => ApiError::InvalidDelegation(
+                "Controller PDS endpoint isn't a usable https URL".into(),
+            ),
+            IdentityResolutionError::DidResolution(_) => ApiError::ControllerNotFound,
+        })?;

    if !resolved.is_local
        && let Some(ref pds_url) = resolved.pds_url
    {
-        if !pds_url.starts_with("https://") {
-            return Err(ApiError::InvalidDelegation(
-                "Controller PDS must use HTTPS".into(),
-            ));
-        }
        match state
            .cross_pds_oauth
-            .check_remote_is_delegated(pds_url, input.controller_did.as_str())
+            .check_remote_is_delegated(pds_url, &input.controller_did)
            .await
        {
            Some(true) => {
@@ -174,9 +173,7 @@ pub async fn remove_controller(
                .session
                .delete_app_passwords_by_controller(&auth.did, &input.controller_did)
                .await
-                .unwrap_or(0)
-                .try_into()
-                .unwrap_or(0usize);
+                .unwrap_or(0);

            let revoked_oauth_tokens = state
                .repos
@@ -232,6 +229,20 @@ pub async fn update_controller_scopes(
        .await
    {
        Ok(true) => {
+            let revoked_app_passwords = state
+                .repos
+                .session
+                .delete_app_passwords_by_controller(&auth.did, &input.controller_did)
+                .await
+                .unwrap_or(0);
+
+            let revoked_oauth_tokens = state
+                .repos
+                .oauth
+                .revoke_tokens_for_controller(&auth.did, &input.controller_did)
+                .await
+                .unwrap_or(0);
+
            let _ = state
                .repos
                .delegation
@@ -241,7 +252,9 @@ pub async fn update_controller_scopes(
                    Some(&input.controller_did),
                    DelegationActionType::ScopesModified,
                    Some(json!({
-                        "new_scopes": input.granted_scopes.as_str()
+                        "new_scopes": input.granted_scopes.as_str(),
+                        "revoked_app_passwords": revoked_app_passwords,
+                        "revoked_oauth_tokens": revoked_oauth_tokens
                    })),
                    None,
                    None,
@@ -330,7 +343,6 @@ pub struct CreateDelegatedAccountInput {
    pub handle: String,
    pub email: Option<String>,
    pub controller_scopes: ValidatedDelegationScope,
-    pub invite_code: Option<String>,
 }

 #[derive(Debug, Serialize)]
@@ -362,25 +374,11 @@ pub async fn create_delegated_account(
        return Err(ApiError::InvalidEmail);
    }

-    let validated_invite_code = if let Some(ref code) = input.invite_code {
-        match state.repos.infra.validate_invite_code(code).await {
-            Ok(validated) => Some(validated),
-            Err(_) => return Err(ApiError::InvalidInviteCode),
-        }
-    } else {
-        let invite_required = tranquil_config::get().server.invite_code_required;
-        if invite_required {
-            return Err(ApiError::InviteCodeRequired);
-        }
-        None
-    };
-
    let plc = create_plc_did(&state, &handle).await.map_err(|e| {
        tracing::error!("PLC DID creation failed: {:?}", e);
        e
    })?;
    let did = plc.did;
-    let handle: Handle = handle.parse().map_err(|_| ApiError::InvalidHandle(None))?;
    info!(did = %did, handle = %handle, controller = %can_control.did(), "Created DID for delegated account");

    let repo = init_genesis_repo(&state, &did, &plc.signing_key, &plc.signing_key_bytes).await?;
@@ -394,19 +392,18 @@ pub async fn create_delegated_account(
        controller_scopes: input.controller_scopes.as_str().to_string(),
        encrypted_key_bytes: repo.encrypted_key_bytes,
        encryption_version: tranquil_pds::config::ENCRYPTION_VERSION,
-        commit_cid: repo.commit_cid.to_string(),
+        commit_cid: CidLink::from(&repo.commit_cid),
        repo_rev: repo.repo_rev.clone(),
        genesis_block_cids: repo.genesis_block_cids,
-        invite_code: input.invite_code.clone(),
    };

-    let user_id = match state
+    match state
        .repos
        .user
        .create_delegated_account(&create_input)
        .await
    {
-        Ok(id) => id,
+        Ok(_) => {}
        Err(tranquil_db_traits::CreateAccountError::HandleTaken) => {
            return Err(ApiError::HandleNotAvailable(None));
        }
@@ -417,16 +414,6 @@ pub async fn create_delegated_account(
            error!("Error creating delegated account: {:?}", e);
            return Err(ApiError::InternalError(None));
        }
-    };
-
-    if let Some(validated) = validated_invite_code
-        && let Err(e) = state
-            .repos
-            .infra
-            .record_invite_code_use(&validated, user_id)
-            .await
-    {
-        warn!("Failed to record invite code use for {}: {:?}", did, e);
    }

    crate::identity::provision::sequence_new_account(
@@ -476,24 +463,26 @@ pub async fn resolve_controller(
            .parse()
            .map_err(|_| ApiError::ControllerNotFound)?
    } else {
-        let local_handle: Option<Handle> = identifier.parse().ok();
-        let local_user = match local_handle {
-            Some(ref h) => state.repos.user.get_by_handle(h).await.ok().flatten(),
-            None => None,
-        };
+        let handle: Handle = identifier
+            .parse()
+            .map_err(|_| ApiError::ControllerNotFound)?;
+        let local_user = state.repos.user.get_by_handle(&handle).await.ok().flatten();
        match local_user {
            Some(user) => user.did,
-            None => tranquil_pds::handle::resolve_handle(identifier)
+            None => tranquil_pds::handle::resolve_handle(&handle)
                .await
-                .map_err(|_| ApiError::ControllerNotFound)?
-                .parse()
                .map_err(|_| ApiError::ControllerNotFound)?,
        }
    };

    let resolved = tranquil_pds::delegation::resolve_identity(&state, &did)
        .await
-        .map_err(|_| ApiError::ControllerNotFound)?;
+        .map_err(|e| match e {
+            IdentityResolutionError::PdsEndpoint(_) => ApiError::InvalidDelegation(
+                "Controller PDS endpoint isn't a usable https URL".into(),
+            ),
+            IdentityResolutionError::DidResolution(_) => ApiError::ControllerNotFound,
+        })?;

    Ok(Json(resolved))
 }
@@ -149,17 +149,21 @@ async fn handle_command(state: AppState, interaction: Interaction) -> Response {
        }
    };

-    let handle = parse_start_handle(interaction.data.as_ref().and_then(|d| d.options.as_deref()));
-
-    if let Some(ref h) = handle
-        && Handle::new(h).is_err()
+    let handle = match parse_start_handle(
+        interaction.data.as_ref().and_then(|d| d.options.as_deref()),
+    )
+    .map(Handle::new)
+    .transpose()
    {
-        return Json(json!({
-            "type": 4,
-            "data": {"content": "Invalid handle format. Handle should look like: alice.example.com", "flags": 64}
-        }))
-        .into_response();
-    }
+        Ok(h) => h,
+        Err(_) => {
+            return Json(json!({
+                "type": 4,
+                "data": {"content": "Invalid handle format. Handle should look like: nel.oyster.cafe", "flags": 64}
+            }))
+            .into_response();
+        }
+    };

    debug!(
        discord_username = %discord_username,
@@ -171,7 +175,7 @@ async fn handle_command(state: AppState, interaction: Interaction) -> Response {
    match state
        .repos
        .user
-        .store_discord_user_id(&discord_username, &discord_user_id, handle.as_deref())
+        .store_discord_user_id(&discord_username, &discord_user_id, handle.as_ref())
        .await
    {
        Ok(Some(user_id)) => {
@@ -10,10 +10,11 @@ use serde::{Deserialize, Serialize};
 use serde_json::json;
 use tracing::{debug, error, info};
 use tranquil_pds::api::error::ApiError;
+use tranquil_pds::api::invite::check_registration_invite;
 use tranquil_pds::auth::{ServiceTokenVerifier, extract_auth_token_from_header, is_service_token};
 use tranquil_pds::rate_limit::{AccountCreationLimit, RateLimited};
 use tranquil_pds::state::AppState;
-use tranquil_pds::types::{Did, Handle, PlainPassword};
+use tranquil_pds::types::{CidLink, Did, Handle, Nsid, PlainPassword};
 use tranquil_pds::validation::validate_password;
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -24,7 +25,7 @@ pub struct CreateAccountInput {
    pub invite_code: Option<String>,
    pub did: Option<String>,
    pub did_type: Option<String>,
-    pub signing_key: Option<String>,
+    pub signing_key: Option<Did>,
    pub verification_channel: Option<tranquil_db_traits::CommsChannel>,
    pub discord_username: Option<String>,
    pub telegram_username: Option<String>,
@@ -46,23 +47,15 @@ pub struct CreateAccountOutput {

 async fn try_reactivate_migration(
    state: &AppState,
-    did: &str,
-    handle: &str,
+    did: &Did,
+    handle: &Handle,
    email: &Option<String>,
    verification_channel: tranquil_db_traits::CommsChannel,
    verification_recipient: Option<&str>,
 ) -> Option<Response> {
-    let did_typed: Did = match did.parse() {
-        Ok(d) => d,
-        Err(_) => return Some(ApiError::InternalError(Some("Invalid DID".into())).into_response()),
-    };
-    let handle_typed: Handle = match handle.parse() {
-        Ok(h) => h,
-        Err(_) => return Some(ApiError::InvalidHandle(None).into_response()),
-    };
    let reactivate_input = tranquil_db_traits::MigrationReactivationInput {
-        did: did_typed.clone(),
-        new_handle: handle_typed.clone(),
+        did: did.clone(),
+        new_handle: handle.clone(),
        new_email: email.clone(),
    };
    match state
@@ -72,7 +65,7 @@ async fn try_reactivate_migration(
        .await
    {
        Ok(reactivated) => {
-            info!(did = %did, old_handle = %reactivated.old_handle, new_handle = %handle, "Preparing existing account for inbound migration");
+            info!(did = %did, old_handle = ?reactivated.old_handle, new_handle = %handle, "Preparing existing account for inbound migration");
            let secret_key_bytes = match state
                .repos
                .user
@@ -119,7 +112,7 @@ async fn try_reactivate_migration(
                }
            };
            let session_data = tranquil_db_traits::SessionTokenCreate {
-                did: did_typed.clone(),
+                did: did.clone(),
                access_jti: access_meta.jti.clone(),
                refresh_jti: refresh_meta.jti.clone(),
                access_expires_at: access_meta.expires_at,
@@ -139,7 +132,7 @@ async fn try_reactivate_migration(
                    super::provision::enqueue_migration_verification(
                        state,
                        reactivated.user_id,
-                        &did_typed,
+                        did,
                        verification_channel,
                        recipient,
                    )
@@ -152,14 +145,9 @@ async fn try_reactivate_migration(
                (
                    StatusCode::OK,
                    Json(CreateAccountOutput {
-                        handle: handle.to_string().into(),
-                        did: did_typed.clone(),
-                        did_doc: state
-                            .did_resolver
-                            .fetch_did_document(did)
-                            .await
-                            .ok()
-                            .map(|f| (*f).clone()),
+                        handle: handle.clone(),
+                        did: did.clone(),
+                        did_doc: state.did_resolver.fetch_did_document(did).await.ok(),
                        access_jwt: access_meta.token,
                        refresh_jwt: refresh_meta.token,
                        verification_required,
@@ -209,8 +197,10 @@ pub async fn create_account(
        let token = extracted.token;
        if is_service_token(&token) {
            let verifier = ServiceTokenVerifier::new();
+            let create_account_lxm = Nsid::new("com.atproto.server.createAccount")
+                .expect("com.atproto.server.createAccount is a valid NSID");
            match verifier
-                .verify_service_token(&token, Some("com.atproto.server.createAccount"))
+                .verify_service_token(&token, Some(&create_account_lxm))
                .await
            {
                Ok(claims) => {
@@ -307,7 +297,7 @@ pub async fn create_account(
    };
    let hostname = &cfg.server.hostname;
    let key_result =
-        match super::provision::resolve_signing_key(&state, input.signing_key.as_deref()).await {
+        match super::provision::resolve_signing_key(&state, input.signing_key.as_ref()).await {
            Ok(k) => k,
            Err(e) => return e.into_response(),
        };
@@ -315,7 +305,7 @@ pub async fn create_account(
    let signing_key = key_result.signing_key;
    let reserved_key_id = key_result.reserved_key_id;
    let did_type = input.did_type.as_deref().unwrap_or("plc");
-    let did = match did_type {
+    let did: Did = match did_type {
        "web" => {
            let self_hosted_did = match common::create_self_hosted_did_web(&handle) {
                Ok(d) => d,
@@ -340,27 +330,42 @@ pub async fn create_account(
            }
            if !is_did_web_byod
                && let Err(e) =
-                    verify_did_web(d, hostname, &input.handle, input.signing_key.as_deref()).await
+                    verify_did_web(d, hostname, &input.handle, input.signing_key.as_ref()).await
            {
                return ApiError::InvalidDid(e.to_string()).into_response();
            }
            info!(did = %d, "Creating external did:web account");
-            d.clone()
+            match d.parse() {
+                Ok(d) => d,
+                Err(_) => return ApiError::InvalidDid("Invalid DID format".into()).into_response(),
+            }
        }
        _ => {
            if let Some(d) = &input.did {
                if d.starts_with("did:plc:") && is_migration {
                    info!(did = %d, "Migration with existing did:plc");
-                    d.clone()
+                    match d.parse() {
+                        Ok(d) => d,
+                        Err(_) => {
+                            return ApiError::InvalidDid("Invalid DID format".into())
+                                .into_response();
+                        }
+                    }
                } else if d.starts_with("did:web:") {
                    if !is_did_web_byod
                        && let Err(e) =
-                            verify_did_web(d, hostname, &input.handle, input.signing_key.as_deref())
+                            verify_did_web(d, hostname, &input.handle, input.signing_key.as_ref())
                                .await
                    {
                        return ApiError::InvalidDid(e.to_string()).into_response();
                    }
-                    d.clone()
+                    match d.parse() {
+                        Ok(d) => d,
+                        Err(_) => {
+                            return ApiError::InvalidDid("Invalid DID format".into())
+                                .into_response();
+                        }
+                    }
                } else if !d.trim().is_empty() {
                    return ApiError::InvalidDid(
                        "Only did:web DIDs can be provided; leave empty for did:plc. For migration with existing did:plc, provide service auth.".into()
@@ -395,14 +400,10 @@ pub async fn create_account(
        return response;
    }

-    let handle_typed: Handle = match handle.parse() {
-        Ok(h) => h,
-        Err(_) => return ApiError::InvalidHandle(None).into_response(),
-    };
    let handle_available = match state
        .repos
        .user
-        .check_handle_available_for_new_account(&handle_typed)
+        .check_handle_available_for_new_account(&handle)
        .await
    {
        Ok(available) => available,
@@ -415,40 +416,11 @@ pub async fn create_account(
        return ApiError::HandleTaken.into_response();
    }

-    let is_bootstrap = state.bootstrap_invite_code.is_some()
-        && state.repos.user.count_users().await.unwrap_or(1) == 0;
-
-    if is_bootstrap {
-        match input.invite_code.as_deref() {
-            Some(code) if Some(code) == state.bootstrap_invite_code.as_deref() => {}
-            _ => return ApiError::InvalidInviteCode.into_response(),
-        }
-    } else {
-        let invite_code_required = tranquil_config::get().server.invite_code_required;
-        if invite_code_required
-            && input
-                .invite_code
-                .as_ref()
-                .map(|c| c.trim().is_empty())
-                .unwrap_or(true)
-        {
-            return ApiError::InviteCodeRequired.into_response();
-        }
-        if let Some(code) = &input.invite_code
-            && !code.trim().is_empty()
-        {
-            let valid = match state.repos.user.check_and_consume_invite_code(code).await {
-                Ok(v) => v,
-                Err(e) => {
-                    error!("Error checking invite code: {:?}", e);
-                    return ApiError::InternalError(None).into_response();
-                }
-            };
-            if !valid {
-                return ApiError::InvalidInviteCode.into_response();
-            }
-        }
-    }
+    let invite_registration =
+        match check_registration_invite(&state, input.invite_code.as_deref()).await {
+            Ok(outcome) => outcome,
+            Err(e) => return e.into_response(),
+        };

    if let Err(e) = validate_password(&input.password) {
        return ApiError::InvalidRequest(e.to_string()).into_response();
@@ -465,23 +437,15 @@ pub async fn create_account(
        None
    };

-    let did_for_commit: Did = match did.parse() {
-        Ok(d) => d,
-        Err(_) => return ApiError::InternalError(Some("Invalid DID".into())).into_response(),
-    };
-    let repo = match super::provision::init_genesis_repo(
-        &state,
-        &did_for_commit,
-        &signing_key,
-        &secret_key_bytes,
-    )
-    .await
-    {
-        Ok(r) => r,
-        Err(e) => return e.into_response(),
-    };
-    let commit_cid_str = repo.commit_cid.to_string();
-    let rev_str = repo.repo_rev.clone();
+    let repo =
+        match super::provision::init_genesis_repo(&state, &did, &signing_key, &secret_key_bytes)
+            .await
+        {
+            Ok(r) => r,
+            Err(e) => return e.into_response(),
+        };
+    let commit_cid = CidLink::from(&repo.commit_cid);
+    let repo_rev = repo.repo_rev.clone();

    let birthdate_pref = if tranquil_config::get().server.age_assurance_override {
        Some(json!({
@@ -501,26 +465,23 @@ pub async fn create_account(
    let repo_for_seq = repo.clone();

    let create_input = tranquil_db_traits::CreatePasswordAccountInput {
-        handle: handle_typed.clone(),
+        handle: handle.clone(),
        email: email.clone(),
-        did: did_for_commit.clone(),
+        did: did.clone(),
        password_hash,
        preferred_comms_channel,
        discord_username: comms.discord,
        telegram_username: comms.telegram,
        signal_username: comms.signal,
        deactivated_at,
+        inbound_migration: is_migration || is_did_web_byod,
        encrypted_key_bytes: repo.encrypted_key_bytes,
        encryption_version: tranquil_pds::config::ENCRYPTION_VERSION,
        reserved_key_id,
-        commit_cid: commit_cid_str.clone(),
-        repo_rev: rev_str.clone(),
+        commit_cid: commit_cid.clone(),
+        repo_rev: repo_rev.clone(),
        genesis_block_cids: repo.genesis_block_cids,
-        invite_code: if is_bootstrap {
-            None
-        } else {
-            input.invite_code.clone()
-        },
+        invite_code: invite_registration.into_invite_code(),
        birthdate_pref,
    };

@@ -540,6 +501,9 @@ pub async fn create_account(
        Err(tranquil_db_traits::CreateAccountError::DidExists) => {
            return ApiError::AccountAlreadyExists.into_response();
        }
+        Err(tranquil_db_traits::CreateAccountError::InviteCodeUnavailable) => {
+            return ApiError::InvalidInviteCode.into_response();
+        }
        Err(e) => {
            error!("Error creating password account: {:?}", e);
            return ApiError::InternalError(None).into_response();
@@ -547,21 +511,15 @@ pub async fn create_account(
    };
    let user_id = create_result.user_id;
    if !is_migration && !is_did_web_byod {
-        super::provision::sequence_new_account(
-            &state,
-            &did_for_commit,
-            &handle_typed,
-            &repo_for_seq,
-            &input.handle,
-        )
-        .await;
+        super::provision::sequence_new_account(&state, &did, &handle, &repo_for_seq, &input.handle)
+            .await;
    }
    if !is_migration {
        if let Some(ref recipient) = verification_recipient {
            super::provision::enqueue_signup_verification(
                &state,
                user_id,
-                &did_for_commit,
+                &did,
                verification_channel,
                recipient,
            )
@@ -571,7 +529,7 @@ pub async fn create_account(
        super::provision::enqueue_migration_verification(
            &state,
            user_id,
-            &did_for_commit,
+            &did,
            verification_channel,
            recipient,
        )
@@ -581,7 +539,6 @@ pub async fn create_account(
    let session = match super::provision::create_and_store_session(
        &state,
        &did,
-        &did_for_commit,
        &secret_key_bytes,
        "transition:generic transition:chat.bsky",
        None,
@@ -604,9 +561,9 @@ pub async fn create_account(
    (
        StatusCode::OK,
        Json(CreateAccountOutput {
-            handle: handle.clone().into(),
-            did: did_for_commit,
-            did_doc: did_doc.map(|f| (*f).clone()),
+            handle: handle.clone(),
+            did,
+            did_doc,
            access_jwt: session.access_jwt,
            refresh_jwt: session.refresh_jwt,
            verification_required: !is_migration,
@@ -19,7 +19,7 @@ use tranquil_pds::rate_limit::{
    HandleUpdateDailyLimit, HandleUpdateLimit, check_user_rate_limit_with_message,
 };
 use tranquil_pds::state::AppState;
-use tranquil_pds::types::Handle;
+use tranquil_pds::types::{Did, Handle};
 use tranquil_pds::util::get_header_str;

 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -44,16 +44,18 @@ pub async fn resolve_handle(
    if handle_str.is_empty() {
        return ApiError::InvalidRequest("handle is required".into()).into_response();
    }
-    let cache_key = tranquil_pds::cache_keys::handle_key(handle_str);
-    if let Some(did) = state.cache.get(&cache_key).await {
-        return DidResponse::response(did).into_response();
-    }
    let handle: Handle = match handle_str.parse() {
        Ok(h) => h,
        Err(_) => {
            return ApiError::InvalidHandle(Some("Invalid handle format".into())).into_response();
        }
    };
+    let cache_key = tranquil_pds::cache_keys::handle_key(&handle);
+    if let Some(cached) = state.cache.get(&cache_key).await
+        && let Ok(did) = tranquil_pds::Did::new(cached)
+    {
+        return DidResponse::response(did).into_response();
+    }
    let user = state.repos.user.get_by_handle(&handle).await;
    match user {
        Ok(Some(row)) => {
@@ -63,7 +65,7 @@ pub async fn resolve_handle(
                .await;
            DidResponse::response(row.did).into_response()
        }
-        Ok(None) => match tranquil_pds::handle::resolve_handle(handle.as_str()).await {
+        Ok(None) => match tranquil_pds::handle::resolve_handle(&handle).await {
            Ok(did) => {
                let _ = state
                    .cache
@@ -159,15 +161,15 @@ pub async fn well_known_did(State(state): State<AppState>, headers: HeaderMap) -

 async fn serve_handle_did_doc(state: &AppState, handle: &str, hostname: &str) -> Response {
    let encoded_handle = handle.replace(':', "%3A");
-    let expected_did = format!("did:web:{}", encoded_handle);
-    let expected_did_typed: tranquil_pds::types::Did = match expected_did.parse() {
+    let expected_did: tranquil_pds::types::Did = match format!("did:web:{}", encoded_handle).parse()
+    {
        Ok(d) => d,
        Err(_) => return ApiError::InvalidRequest("Invalid DID format".into()).into_response(),
    };
    let user = match state
        .repos
        .user
-        .get_user_for_did_doc_build(&expected_did_typed)
+        .get_user_for_did_doc_build(&expected_did)
        .await
    {
        Ok(Some(u)) => u,
@@ -212,8 +214,7 @@ async fn serve_handle_did_doc(state: &AppState, handle: &str, hostname: &str) ->
 pub async fn user_did_doc(State(state): State<AppState>, Path(handle): Path<String>) -> Response {
    let hostname = &tranquil_config::get().server.hostname;
    let hostname_for_handles = tranquil_config::get().server.hostname_without_port();
-    let current_handle = format!("{}.{}", handle, hostname_for_handles);
-    let current_handle_typed: Handle = match current_handle.parse() {
+    let current_handle: Handle = match format!("{}.{}", handle, hostname_for_handles).parse() {
        Ok(h) => h,
        Err(_) => {
            return ApiError::InvalidHandle(Some("Invalid handle format".into())).into_response();
@@ -222,7 +223,7 @@ pub async fn user_did_doc(State(state): State<AppState>, Path(handle): Path<Stri
    let user = match state
        .repos
        .user
-        .get_did_web_info_by_handle(&current_handle_typed)
+        .get_did_web_info_by_handle(&current_handle)
        .await
    {
        Ok(Some(u)) => u,
@@ -347,7 +348,7 @@ pub async fn verify_did_web(
    did: &str,
    hostname: &str,
    handle: &str,
-    expected_signing_key: Option<&str>,
+    expected_signing_key: Option<&Did>,
 ) -> Result<(), DidWebVerifyError> {
    let hostname_for_handles = hostname.split(':').next().unwrap_or(hostname);
    let subdomain_host = format!("{}.{}", handle, hostname_for_handles);
@@ -426,10 +427,15 @@ pub async fn verify_did_web(
    let expected_multibase = expected_signing_key
        .strip_prefix("did:key:")
        .ok_or(DidWebVerifyError::InvalidSigningKey)?;
+    let did_prefixed_key_id = format!("{}#atproto", did);
    let has_matching_key = verification_methods.iter().any(|vm| {
-        vm["publicKeyMultibase"]
+        let is_atproto_method = vm["id"]
            .as_str()
-            .is_some_and(|pk| pk == expected_multibase)
+            .is_some_and(|id| id == "#atproto" || id == did_prefixed_key_id);
+        is_atproto_method
+            && vm["publicKeyMultibase"]
+                .as_str()
+                .is_some_and(|pk| pk == expected_multibase)
    });
    if !has_matching_key {
        return Err(DidWebVerifyError::KeyMismatch(
@@ -491,16 +497,10 @@ pub async fn get_recommended_did_credentials(
    let rotation_keys = if auth.did.starts_with("did:web:") {
        vec![]
    } else {
-        let server_rotation_key = match &tranquil_config::get().secrets.plc_rotation_key {
-            Some(key) => key.clone(),
-            None => {
-                warn!(
-                    "PLC_ROTATION_KEY not set, falling back to user's signing key for rotation key recommendation"
-                );
-                did_key.clone()
-            }
-        };
-        vec![server_rotation_key]
+        tranquil_pds::plc::rotation_keys_for(
+            tranquil_config::get().secrets.plc_rotation_key.as_deref(),
+            &signing_key,
+        )
    };
    Ok(Json(GetRecommendedDidCredentialsOutput {
        rotation_keys,
@@ -589,7 +589,7 @@ pub async fn update_handle(
        .max_by_key(|d| d.len())
        .cloned();
    let is_domain_itself = handle_domains.iter().any(|d| d == &new_handle);
-    let handle = if (!new_handle.contains('.') || matched_handle_domain.is_some())
+    let handle: Handle = if (!new_handle.contains('.') || matched_handle_domain.is_some())
        && !is_domain_itself
    {
        let (short_part, full_handle) = match &matched_handle_domain {
@@ -604,13 +604,12 @@ pub async fn update_handle(
            }
        };
        if full_handle == current_handle {
-            let handle_typed: Handle = match full_handle.parse() {
+            let handle: Handle = match full_handle.parse() {
                Ok(h) => h,
                Err(_) => return Err(ApiError::InvalidHandle(None)),
            };
            if let Err(e) =
-                tranquil_pds::repo_ops::sequence_identity_event(&state, &did, Some(&handle_typed))
-                    .await
+                tranquil_pds::repo_ops::sequence_identity_event(&state, &did, Some(&handle)).await
            {
                warn!("Failed to sequence identity event for handle update: {}", e);
            }
@@ -628,21 +627,21 @@ pub async fn update_handle(
            return Err(ApiError::InvalidHandle(Some("Handle too long".into())));
        }
        full_handle
+            .parse()
+            .map_err(|_| ApiError::InvalidHandle(Some("Invalid handle format".into())))?
    } else {
+        let handle: Handle = new_handle
+            .parse()
+            .map_err(|_| ApiError::InvalidHandle(Some("Invalid handle format".into())))?;
        if new_handle == current_handle {
-            let handle_typed: Handle = match new_handle.parse() {
-                Ok(h) => h,
-                Err(_) => return Err(ApiError::InvalidHandle(None)),
-            };
            if let Err(e) =
-                tranquil_pds::repo_ops::sequence_identity_event(&state, &did, Some(&handle_typed))
-                    .await
+                tranquil_pds::repo_ops::sequence_identity_event(&state, &did, Some(&handle)).await
            {
                warn!("Failed to sequence identity event for handle update: {}", e);
            }
            return Ok(Json(EmptyResponse {}));
        }
-        match tranquil_pds::handle::verify_handle_ownership(&new_handle, &did).await {
+        match tranquil_pds::handle::verify_handle_ownership(&handle, &did).await {
            Ok(()) => {}
            Err(tranquil_pds::handle::HandleResolutionError::NotFound) => {
                return Err(ApiError::HandleNotAvailable(None));
@@ -661,15 +660,12 @@ pub async fn update_handle(
                ))));
            }
        }
-        new_handle.clone()
+        handle
    };
-    let handle_typed: Handle = handle
-        .parse()
-        .map_err(|_| ApiError::InvalidHandle(Some("Invalid handle format".into())))?;
    let handle_exists = state
        .repos
        .user
-        .check_handle_exists(&handle_typed, user_id)
+        .check_handle_exists(&handle, user_id)
        .await
        .log_db_err("checking handle existence")?;
    if handle_exists {
@@ -678,7 +674,7 @@ pub async fn update_handle(
    state
        .repos
        .user
-        .update_handle(user_id, &handle_typed)
+        .update_handle(user_id, &handle)
        .await
        .map_err(|e| {
            error!("DB error updating handle: {:?}", e);
@@ -696,11 +692,11 @@ pub async fn update_handle(
        .delete(&tranquil_pds::cache_keys::handle_key(&handle))
        .await;
    if let Err(e) =
-        tranquil_pds::repo_ops::sequence_identity_event(&state, &did, Some(&handle_typed)).await
+        tranquil_pds::repo_ops::sequence_identity_event(&state, &did, Some(&handle)).await
    {
        warn!("Failed to sequence identity event for handle update: {}", e);
    }
-    if let Err(e) = update_plc_handle(&state, &did, &handle_typed).await {
+    if let Err(e) = update_plc_handle(&state, &did, &handle).await {
        warn!("Failed to update PLC handle: {}", e);
    }
    Ok(Json(EmptyResponse {}))
@@ -26,10 +26,9 @@ pub async fn verify_handle_ownership(
    _rate_limit: RateLimited<HandleVerificationLimit>,
    Json(input): Json<VerifyHandleOwnershipInput>,
 ) -> Response {
-    let handle_str = input.handle.as_str();
    let did_str = input.did.as_str();

-    let dns_mismatch = match tranquil_pds::handle::resolve_handle_dns(handle_str).await {
+    let dns_mismatch = match tranquil_pds::handle::resolve_handle_dns(&input.handle).await {
        Ok(did) if did == did_str => {
            return Json(VerifyHandleOwnershipOutput {
                verified: true,
@@ -45,7 +44,7 @@ pub async fn verify_handle_ownership(
        Err(_) => None,
    };

-    match tranquil_pds::handle::resolve_handle_http(handle_str).await {
+    match tranquil_pds::handle::resolve_handle_http(&input.handle).await {
        Ok(did) if did == did_str => Json(VerifyHandleOwnershipOutput {
            verified: true,
            method: Some("http".to_string()),
@@ -3,5 +3,5 @@ mod sign;
 mod submit;

 pub use request::request_plc_operation_signature;
-pub use sign::{ServiceInput, SignPlcOperationInput, SignPlcOperationOutput, sign_plc_operation};
+pub use sign::{SignPlcOperationInput, SignPlcOperationOutput, sign_plc_operation};
 pub use submit::{SubmitPlcOperationInput, submit_plc_operation};
@@ -6,10 +6,6 @@ use tranquil_pds::api::error::{ApiError, DbResultExt};
 use tranquil_pds::auth::{Auth, Permissive};
 use tranquil_pds::state::AppState;

-fn generate_plc_token() -> String {
-    tranquil_pds::util::generate_token_code()
-}
-
 pub async fn request_plc_operation_signature(
    State(state): State<AppState>,
    auth: Auth<Permissive>,
@@ -28,12 +24,13 @@ pub async fn request_plc_operation_signature(
        .ok_or(ApiError::AccountNotFound)?;

    let _ = state.repos.infra.delete_plc_tokens_for_user(user_id).await;
-    let plc_token = generate_plc_token();
+    let display_token = tranquil_pds::util::generate_token_code();
+    let stored_token = tranquil_pds::util::normalize_token_code(&display_token);
    let expires_at = Utc::now() + Duration::minutes(10);
    state
        .repos
        .infra
-        .insert_plc_token(user_id, &plc_token, expires_at)
+        .insert_plc_token(user_id, &stored_token, expires_at)
        .await
        .log_db_err("creating PLC token")?;

@@ -42,7 +39,7 @@ pub async fn request_plc_operation_signature(
        state.repos.user.as_ref(),
        state.repos.infra.as_ref(),
        user_id,
-        &plc_token,
+        &display_token,
        hostname,
    )
    .await
@@ -9,7 +9,10 @@ use tranquil_pds::api::ApiError;
 use tranquil_pds::api::error::DbResultExt;
 use tranquil_pds::auth::{Auth, Permissive};
 use tranquil_pds::circuit_breaker::with_circuit_breaker;
-use tranquil_pds::plc::{PlcError, PlcService, ServiceType, create_update_op, sign_operation};
+use tranquil_pds::plc::{
+    PlcError, PlcService, create_update_op, missing_required_rotation_key, sign_operation,
+    signing_key_to_did_key,
+};
 use tranquil_pds::state::AppState;

 #[derive(Debug, Deserialize)]
@@ -19,14 +22,7 @@ pub struct SignPlcOperationInput {
    pub rotation_keys: Option<Vec<String>>,
    pub also_known_as: Option<Vec<String>>,
    pub verification_methods: Option<HashMap<String, String>>,
-    pub services: Option<HashMap<String, ServiceInput>>,
-}
-
-#[derive(Debug, Deserialize, Clone)]
-pub struct ServiceInput {
-    #[serde(rename = "type")]
-    pub service_type: ServiceType,
-    pub endpoint: String,
+    pub services: Option<HashMap<String, PlcService>>,
 }

 #[derive(Debug, Serialize)]
@@ -50,9 +46,10 @@ pub async fn sign_plc_operation(
            "PLC operations are only valid for did:plc identities".into(),
        ));
    }
-    let token = input.token.as_ref().ok_or_else(|| {
+    let raw_token = input.token.as_ref().ok_or_else(|| {
        ApiError::InvalidRequest("Email confirmation token required to sign PLC operations".into())
    })?;
+    let token = &tranquil_pds::util::normalize_token_code(raw_token);

    let user_id = state
        .repos
@@ -106,25 +103,12 @@ pub async fn sign_plc_operation(
    if last_op.is_tombstone() {
        return Err(ApiError::from(PlcError::Tombstoned));
    }
-    let services = input.services.map(|s| {
-        s.into_iter()
-            .map(|(k, v)| {
-                (
-                    k,
-                    PlcService {
-                        service_type: v.service_type,
-                        endpoint: v.endpoint,
-                    },
-                )
-            })
-            .collect()
-    });
    let unsigned_op = create_update_op(
        &last_op,
        input.rotation_keys,
        input.verification_methods,
        input.also_known_as,
-        services,
+        input.services,
    )
    .map_err(|e| match e {
        PlcError::Tombstoned => ApiError::InvalidRequest("Cannot update tombstoned DID".into()),
@@ -134,6 +118,18 @@ pub async fn sign_plc_operation(
        }
    })?;

+    let signing_did_key = signing_key_to_did_key(&signing_key);
+    if let Some(rotation_keys) = unsigned_op.get("rotationKeys").and_then(Value::as_array) {
+        let rotation_key_strs: Vec<&str> = rotation_keys.iter().filter_map(Value::as_str).collect();
+        if let Some(missing) = missing_required_rotation_key(
+            &rotation_key_strs,
+            &signing_did_key,
+            tranquil_config::get().secrets.plc_rotation_key.as_deref(),
+        ) {
+            return Err(ApiError::InvalidRequest(missing.message().into()));
+        }
+    }
+
    let signed_op = sign_operation(&unsigned_op, &signing_key).map_err(|e| {
        error!("Failed to sign PLC operation: {:?}", e);
        ApiError::InternalError(None)
@@ -67,19 +67,14 @@ pub async fn submit_plc_operation(
    })?;

    let user_did_key = signing_key_to_did_key(&signing_key);
-    let server_rotation_key = tranquil_config::get()
-        .secrets
-        .plc_rotation_key
-        .clone()
-        .unwrap_or_else(|| user_did_key.clone());
    if let Some(rotation_keys) = op.get("rotationKeys").and_then(Value::as_array) {
-        let has_server_key = rotation_keys
-            .iter()
-            .any(|k| k.as_str() == Some(&server_rotation_key));
-        if !has_server_key {
-            return Err(ApiError::InvalidRequest(
-                "Rotation keys do not include server's rotation key".into(),
-            ));
+        let rotation_key_strs: Vec<&str> = rotation_keys.iter().filter_map(Value::as_str).collect();
+        if let Some(missing) = tranquil_pds::plc::missing_required_rotation_key(
+            &rotation_key_strs,
+            &user_did_key,
+            tranquil_config::get().secrets.plc_rotation_key.as_deref(),
+        ) {
+            return Err(ApiError::InvalidRequest(missing.message().into()));
        }
    }
    if let Some(services) = op.get("services").and_then(Value::as_object)
@@ -129,20 +124,13 @@ pub async fn submit_plc_operation(
    .await
    .map_err(ApiError::from)?;

-    match state
+    if let Err(e) = state
        .repos
        .repo
        .insert_identity_event(did, Some(&user.handle))
        .await
    {
-        Ok(seq) => {
-            if let Err(e) = state.repos.repo.notify_update(seq).await {
-                warn!("Failed to notify identity event: {:?}", e);
-            }
-        }
-        Err(e) => {
-            warn!("Failed to sequence identity event: {:?}", e);
-        }
+        warn!("Failed to sequence identity event: {:?}", e);
    }
    let _ = state
        .cache
@@ -1,4 +1,4 @@
-use jacquard_common::types::{integer::LimitedU32, string::Tid};
+use jacquard_common::types::{integer::LimitedU32, string::Tid as JacquardTid};
 use jacquard_repo::{mst::Mst, storage::BlockStore};
 use k256::ecdsa::SigningKey;
 use std::sync::Arc;
@@ -6,7 +6,7 @@ use tranquil_db_traits::CommsChannel;
 use tranquil_pds::api::error::ApiError;
 use tranquil_pds::repo_ops::create_signed_commit;
 use tranquil_pds::state::AppState;
-use tranquil_pds::types::{Did, Handle};
+use tranquil_pds::types::{CidLink, Did, Handle, Tid};

 pub struct PlcDidResult {
    pub did: Did,
@@ -14,7 +14,7 @@ pub struct PlcDidResult {
    pub signing_key: SigningKey,
 }

-pub async fn create_plc_did(state: &AppState, handle: &str) -> Result<PlcDidResult, ApiError> {
+pub async fn create_plc_did(state: &AppState, handle: &Handle) -> Result<PlcDidResult, ApiError> {
    use k256::SecretKey;
    use rand::rngs::OsRng;

@@ -25,10 +25,7 @@ pub async fn create_plc_did(state: &AppState, handle: &str) -> Result<PlcDidResu
        ApiError::InternalError(None)
    })?;

-    let did_str = submit_plc_genesis(state, &signing_key, handle).await?;
-    let did: Did = did_str
-        .parse()
-        .map_err(|_| ApiError::InternalError(Some("PLC genesis returned invalid DID".into())))?;
+    let did = submit_plc_genesis(state, &signing_key, handle).await?;

    Ok(PlcDidResult {
        did,
@@ -40,20 +37,14 @@ pub async fn create_plc_did(state: &AppState, handle: &str) -> Result<PlcDidResu
 pub async fn submit_plc_genesis(
    state: &AppState,
    signing_key: &SigningKey,
-    handle: &str,
-) -> Result<String, ApiError> {
+    handle: &Handle,
+) -> Result<Did, ApiError> {
    let hostname = &tranquil_config::get().server.hostname;
    let pds_endpoint = format!("https://{}", hostname);

-    let rotation_key = tranquil_config::get()
-        .secrets
-        .plc_rotation_key
-        .clone()
-        .unwrap_or_else(|| tranquil_pds::plc::signing_key_to_did_key(signing_key));
-
    let genesis_result = tranquil_pds::plc::create_genesis_operation(
        signing_key,
-        &rotation_key,
+        tranquil_config::get().secrets.plc_rotation_key.as_deref(),
        handle,
        &pds_endpoint,
    )
@@ -80,7 +71,7 @@ pub struct GenesisRepo {
    pub encrypted_key_bytes: Vec<u8>,
    pub commit_cid: cid::Cid,
    pub mst_root_cid: cid::Cid,
-    pub repo_rev: String,
+    pub repo_rev: Tid,
    pub genesis_block_cids: Vec<Vec<u8>>,
 }

@@ -102,8 +93,8 @@ pub async fn init_genesis_repo(
        ApiError::InternalError(None)
    })?;

-    let rev = Tid::now(LimitedU32::MIN);
-    let (commit_bytes, _sig) = create_signed_commit(did, mst_root, rev.as_ref(), None, signing_key)
+    let rev = JacquardTid::now(LimitedU32::MIN);
+    let (commit_bytes, _sig) = create_signed_commit(did, mst_root, &rev, None, signing_key)
        .map_err(|e| {
            tracing::error!("Error creating genesis commit: {:?}", e);
            ApiError::InternalError(None)
@@ -118,7 +109,7 @@ pub async fn init_genesis_repo(
        encrypted_key_bytes,
        commit_cid,
        mst_root_cid: mst_root,
-        repo_rev: rev.as_ref().to_string(),
+        repo_rev: Tid::from(rev.clone()),
        genesis_block_cids: vec![mst_root.to_bytes(), commit_cid.to_bytes()],
    })
 }
@@ -131,7 +122,7 @@ pub struct SigningKeyResult {

 pub async fn resolve_signing_key(
    state: &AppState,
-    signing_key_did: Option<&str>,
+    signing_key_did: Option<&Did>,
 ) -> Result<SigningKeyResult, ApiError> {
    match signing_key_did {
        Some(key_did) => {
@@ -173,6 +164,13 @@ pub async fn resolve_signing_key(
    }
 }

+#[cfg_attr(
+    not(feature = "bsky"),
+    expect(
+        unused_variables,
+        reason = "only the bsky block writes display_name into the default profile record"
+    )
+)]
 pub async fn sequence_new_account(
    state: &AppState,
    did: &Did,
@@ -207,27 +205,31 @@ pub async fn sequence_new_account(
    if let Err(e) = tranquil_pds::repo_ops::sequence_sync_event(
        state,
        did,
-        &repo.commit_cid.to_string(),
+        &CidLink::from(&repo.commit_cid),
        Some(&repo.repo_rev),
    )
    .await
    {
        tracing::warn!("Failed to sequence sync event for {}: {}", did, e);
    }
-    let profile_record = serde_json::json!({
-        "$type": "app.bsky.actor.profile",
-        "displayName": display_name
-    });
-    if let Err(e) = tranquil_pds::repo_ops::create_record_internal(
-        state,
-        did,
-        &tranquil_pds::types::PROFILE_COLLECTION,
-        &tranquil_pds::types::PROFILE_RKEY,
-        &profile_record,
-    )
-    .await
+    // TODO: make this configurable and also deduplicate with tranquil-oauth-server/src/sso_endpoints.rs:1210
+    #[cfg(feature = "bsky")]
    {
-        tracing::warn!("Failed to create default profile for {}: {}", did, e);
+        let profile_record = serde_json::json!({
+            "$type": "app.bsky.actor.profile",
+            "displayName": display_name
+        });
+        if let Err(e) = tranquil_pds::repo_ops::create_record_internal(
+            state,
+            did,
+            &tranquil_pds::types::PROFILE_COLLECTION,
+            &tranquil_pds::types::PROFILE_RKEY,
+            &profile_record,
+        )
+        .await
+        {
+            tracing::warn!("Failed to create default profile for {}: {}", did, e);
+        };
    }
 }

@@ -264,25 +266,23 @@ pub struct SessionResult {

 pub async fn create_and_store_session(
    state: &AppState,
-    did_str: &str,
    did: &Did,
    signing_key_bytes: &[u8],
    scope: &str,
    controller_did: Option<&Did>,
 ) -> Result<SessionResult, ApiError> {
-    let access_meta =
-        tranquil_pds::auth::create_access_token_with_metadata(did_str, signing_key_bytes).map_err(
+    let access_meta = tranquil_pds::auth::create_access_token_with_metadata(did, signing_key_bytes)
+        .map_err(|e| {
+            tracing::error!("Error creating access token: {:?}", e);
+            ApiError::InternalError(None)
+        })?;
+    let refresh_meta =
+        tranquil_pds::auth::create_refresh_token_with_metadata(did, signing_key_bytes).map_err(
            |e| {
-                tracing::error!("Error creating access token: {:?}", e);
+                tracing::error!("Error creating refresh token: {:?}", e);
                ApiError::InternalError(None)
            },
        )?;
-    let refresh_meta =
-        tranquil_pds::auth::create_refresh_token_with_metadata(did_str, signing_key_bytes)
-            .map_err(|e| {
-                tracing::error!("Error creating refresh token: {:?}", e);
-                ApiError::InternalError(None)
-            })?;
    let session_data = tranquil_db_traits::SessionTokenCreate {
        did: did.clone(),
        access_jti: access_meta.jti.clone(),
@@ -1,5 +1,12 @@
-pub mod actor;
+// BSKY: Bluesky requires PDSs to implement its private preferences API
+#[cfg(feature = "bsky-support")]
+pub mod actor {
+    mod preferences;
+
+    pub use preferences::{get_preferences, put_preferences};
+}
 pub mod admin;
+#[cfg(feature = "bsky")]
 pub mod age_assurance;
 pub mod common;
 pub mod delegation;
@@ -15,9 +22,13 @@ pub mod temp;
 use tranquil_pds::state::AppState;

 pub fn api_routes() -> axum::Router<AppState> {
+    use axum::extract::DefaultBodyLimit;
    use axum::routing::{get, post};

-    axum::Router::new()
+    let blob_body_limit =
+        DefaultBodyLimit::max(tranquil_config::get().server.max_blob_size as usize);
+
+    let router = axum::Router::new()
        .route("/_health", get(server::health))
        .route(
            "/com.atproto.server.describeServer",
@@ -68,7 +79,10 @@ pub fn api_routes() -> axum::Router<AppState> {
        .route("/com.atproto.repo.deleteRecord", post(repo::delete_record))
        .route("/com.atproto.repo.listRecords", get(repo::list_records))
        .route("/com.atproto.repo.describeRepo", get(repo::describe_repo))
-        .route("/com.atproto.repo.uploadBlob", post(repo::upload_blob))
+        .route(
+            "/com.atproto.repo.uploadBlob",
+            post(repo::upload_blob).layer(blob_body_limit),
+        )
        .route("/com.atproto.repo.applyWrites", post(repo::apply_writes))
        .route(
            "/com.atproto.server.checkAccountStatus",
@@ -247,7 +261,10 @@ pub fn api_routes() -> axum::Router<AppState> {
            "/_identity.verifyHandleOwnership",
            post(identity::verify_handle_ownership),
        )
-        .route("/com.atproto.repo.importRepo", post(repo::import_repo))
+        .route(
+            "/com.atproto.repo.importRepo",
+            post(repo::import_repo).layer(blob_body_limit),
+        )
        .route(
            "/com.atproto.admin.deleteAccount",
            post(admin::delete_account),
@@ -363,14 +380,6 @@ pub fn api_routes() -> axum::Router<AppState> {
            post(admin::update_subject_status),
        )
        .route("/com.atproto.admin.sendEmail", post(admin::send_email))
-        .route(
-            "/app.bsky.actor.getPreferences",
-            get(actor::get_preferences),
-        )
-        .route(
-            "/app.bsky.actor.putPreferences",
-            post(actor::put_preferences),
-        )
        .route(
            "/com.atproto.temp.checkSignupQueue",
            get(temp::check_signup_queue),
@@ -428,7 +437,21 @@ pub fn api_routes() -> axum::Router<AppState> {
        .route(
            "/_delegation.resolveController",
            get(delegation::resolve_controller),
+        );
+
+    #[cfg(feature = "bsky-support")]
+    let router = router
+        .route(
+            "/app.bsky.actor.getPreferences",
+            get(actor::get_preferences),
        )
+        .route(
+            "/app.bsky.actor.putPreferences",
+            post(actor::put_preferences),
+        );
+
+    #[cfg(feature = "bsky")]
+    let router = router
        .route(
            "/app.bsky.ageassurance.getState",
            get(age_assurance::get_state),
@@ -436,7 +459,9 @@ pub fn api_routes() -> axum::Router<AppState> {
        .route(
            "/app.bsky.unspecced.getAgeAssuranceState",
            get(age_assurance::get_age_assurance_state),
-        )
+        );
+
+    router
 }

 pub fn well_known_api_routes() -> axum::Router<AppState> {
@@ -464,9 +489,15 @@ pub fn webhook_routes() -> axum::Router<AppState> {
 pub fn misc_routes() -> axum::Router<AppState> {
    use axum::routing::get;

-    axum::Router::new()
+    let router = axum::Router::new()
        .route("/health", get(server::health))
        .route("/robots.txt", get(server::robots_txt))
        .route("/favicon.ico", get(server::get_logo))
-        .route("/u/{handle}/did.json", get(identity::user_did_doc))
+        .route("/u/{handle}/did.json", get(identity::user_did_doc));
+
+    if tranquil_config::get().server.rfc_moo_compliance {
+        router.route("/cow.txt", get(server::cow_txt))
+    } else {
+        router
+    }
 }
@@ -6,11 +6,16 @@ use axum::{
 };
 use serde::{Deserialize, Serialize};
 use serde_json::{Value, json};
-use tracing::{error, info};
+use std::sync::LazyLock;
+use tracing::{error, info, warn};
 use tranquil_pds::api::ApiError;
 use tranquil_pds::api::proxy_client::{is_ssrf_safe, proxy_client};
 use tranquil_pds::auth::{AnyUser, Auth};
 use tranquil_pds::state::AppState;
+use tranquil_pds::types::{Did, Nsid};
+
+static CREATE_REPORT_NSID: LazyLock<Nsid> =
+    LazyLock::new(|| "com.atproto.moderation.createReport".parse().unwrap());

 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 pub enum ReportReasonType {
@@ -65,17 +70,26 @@ pub struct CreateReportOutput {

 struct ReportServiceConfig {
    url: String,
-    did: String,
+    did: Did,
 }

 fn get_report_service_config() -> Option<ReportServiceConfig> {
    let cfg = tranquil_config::get();
    let url = cfg.moderation.report_service_url.clone()?;
-    let did = cfg.moderation.report_service_did.clone()?;
-    if url.is_empty() || did.is_empty() {
+    let did_str = cfg.moderation.report_service_did.as_deref()?;
+    if url.is_empty() || did_str.is_empty() {
        return None;
    }
-    Some(ReportServiceConfig { url, did })
+    match did_str.parse::<Did>() {
+        Ok(did) => Some(ReportServiceConfig { url, did }),
+        Err(_) => {
+            warn!(
+                report_service_did = did_str,
+                "invalid report_service_did, handling reports locally"
+            );
+            None
+        }
+    }
 }

 pub async fn create_report(
@@ -96,7 +110,7 @@ async fn proxy_to_report_service(
    state: &AppState,
    auth_user: &tranquil_pds::auth::AuthenticatedUser,
    service_url: &str,
-    service_did: &str,
+    service_did: &Did,
    input: &CreateReportInput,
 ) -> Response {
    if let Err(e) = is_ssrf_safe(service_url) {
@@ -138,7 +152,7 @@ async fn proxy_to_report_service(
    let service_token = match tranquil_pds::auth::create_service_token(
        &auth_user.did,
        service_did,
-        Some("com.atproto.moderation.createReport"),
+        Some(&CREATE_REPORT_NSID),
        &key_bytes,
    ) {
        Ok(t) => t,
@@ -6,7 +6,7 @@ use tranquil_db_traits::{CommsChannel, CommsStatus, CommsType};
 use tranquil_pds::api::error::{ApiError, DbResultExt};
 use tranquil_pds::auth::{Active, Auth};
 use tranquil_pds::state::AppState;
-use tranquil_types::Did;
+use tranquil_types::{Did, Handle};

 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
@@ -137,7 +137,7 @@ pub async fn request_channel_verification(
    did: &Did,
    channel: CommsChannel,
    identifier: &str,
-    handle: Option<&str>,
+    handle: Option<&Handle>,
 ) -> Result<String, ApiError> {
    let token = tranquil_pds::auth::verification_token::generate_channel_update_token(
        did, channel, identifier,
@@ -147,12 +147,14 @@ pub async fn request_channel_verification(
    match channel {
        CommsChannel::Email => {
            let hostname = &tranquil_config::get().server.hostname;
-            let handle_str = handle.unwrap_or("user");
+            let handle = handle.ok_or_else(|| {
+                ApiError::InternalError(Some("Email verification requires a handle".into()))
+            })?;
            tranquil_pds::comms::comms_repo::enqueue_email_update(
                state.repos.infra.as_ref(),
                user_id,
                identifier,
-                handle_str,
+                handle,
                &formatted_token,
                hostname,
            )
@@ -11,14 +11,18 @@ use multihash::Multihash;
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use std::pin::Pin;
+use std::sync::LazyLock;
 use tracing::{debug, error, info, warn};
 use tranquil_pds::api::error::{ApiError, DbResultExt};
 use tranquil_pds::auth::{Auth, AuthAny, NotTakendown, Permissive, VerifyScope};
 use tranquil_pds::delegation::DelegationActionType;
 use tranquil_pds::state::AppState;
-use tranquil_pds::types::{CidLink, Did};
+use tranquil_pds::types::{CidLink, Did, Nsid};
 use tranquil_pds::util::get_header_str;

+static UPLOAD_BLOB_NSID: LazyLock<Nsid> =
+    LazyLock::new(|| "com.atproto.repo.uploadBlob".parse().unwrap());
+
 fn detect_mime_type(data: &[u8], client_hint: &str) -> String {
    if let Some(kind) = infer::get(data) {
        let detected = kind.mime_type().to_string();
@@ -48,7 +52,7 @@ pub async fn upload_blob(
 ) -> Result<Response, ApiError> {
    let (did, controller_did): (Did, Option<Did>) = match &auth {
        AuthAny::Service(service) => {
-            service.require_lxm("com.atproto.repo.uploadBlob")?;
+            service.require_lxm(&UPLOAD_BLOB_NSID)?;
            (service.did.clone(), None)
        }
        AuthAny::User(user) => {
@@ -14,6 +14,35 @@ use tranquil_pds::sync::verify::CarVerifier;
 use tranquil_pds::types::Did;
 use tranquil_types::{AtUri, CidLink};

+fn map_car_verify_error(e: tranquil_pds::sync::verify::VerifyError) -> ApiError {
+    use tranquil_pds::sync::verify::VerifyError;
+    match e {
+        VerifyError::DidMismatch {
+            commit_did,
+            expected_did,
+        } => ApiError::InvalidRepo(format!(
+            "CAR file is for DID {} but you are authenticated as {}",
+            commit_did, expected_did
+        )),
+        VerifyError::InvalidSignature => ApiError::InvalidRequest(
+            "Repo commit signature does not match the DID document signing key".into(),
+        ),
+        VerifyError::NoSigningKey => {
+            ApiError::InvalidRequest("DID document has no atproto signing key".into())
+        }
+        VerifyError::DidResolutionFailed(msg) => {
+            ApiError::InvalidRequest(format!("Could not resolve DID document: {}", msg))
+        }
+        VerifyError::MstValidationFailed(msg) => {
+            ApiError::InvalidRequest(format!("MST validation failed: {}", msg))
+        }
+        other => {
+            error!("CAR verification failed: {:?}", other);
+            ApiError::InvalidRequest(format!("CAR verification failed: {}", other))
+        }
+    }
+}
+
 pub async fn import_repo(
    State(state): State<AppState>,
    auth: Auth<NotTakendown>,
@@ -77,27 +106,6 @@ pub async fn import_repo(
        blocks.len(),
        root
    );
-    let Some(root_block) = blocks.get(&root) else {
-        return Err(ApiError::InvalidRequest(
-            "Root block not found in CAR file".into(),
-        ));
-    };
-    let commit_did: Did = match jacquard_repo::commit::Commit::from_cbor(root_block) {
-        Ok(commit) => commit
-            .did()
-            .as_str()
-            .parse()
-            .map_err(|_| ApiError::InvalidRequest("Commit contains invalid DID".into()))?,
-        Err(e) => {
-            return Err(ApiError::InvalidRequest(format!("Invalid commit: {}", e)));
-        }
-    };
-    if commit_did != *did {
-        return Err(ApiError::InvalidRepo(format!(
-            "CAR file is for DID {} but you are authenticated as {}",
-            commit_did, did
-        )));
-    }
    let skip_verification = std::env::var("SKIP_IMPORT_VERIFICATION")
        .ok()
        .map(|v| v == "true" || v == "1")
@@ -106,92 +114,26 @@ pub async fn import_repo(
                .map(|c| c.import.skip_verification)
                .unwrap_or(false)
        });
-    let is_migration = user.deactivated_at.is_some();
+    let is_migration = user.inbound_migration && user.deactivated_at.is_some();
    if skip_verification {
-        warn!("Skipping all CAR verification for import (SKIP_IMPORT_VERIFICATION=true)");
+        warn!("Skipping all CAR verification for repo import (SKIP_IMPORT_VERIFICATION=true)");
    } else if is_migration {
-        debug!("Verifying CAR file structure for migration (skipping signature verification)");
-        let verifier = CarVerifier::new();
-        match verifier.verify_car_structure_only(did, &root, &blocks) {
-            Ok(verified) => {
-                debug!(
-                    "CAR structure verification successful: rev={}, data_cid={}",
-                    verified.rev, verified.data_cid
-                );
-            }
-            Err(tranquil_pds::sync::verify::VerifyError::DidMismatch {
-                commit_did,
-                expected_did,
-            }) => {
-                return Err(ApiError::InvalidRepo(format!(
-                    "CAR file is for DID {} but you are authenticated as {}",
-                    commit_did, expected_did
-                )));
-            }
-            Err(tranquil_pds::sync::verify::VerifyError::MstValidationFailed(msg)) => {
-                return Err(ApiError::InvalidRequest(format!(
-                    "MST validation failed: {}",
-                    msg
-                )));
-            }
-            Err(e) => {
-                error!("CAR structure verification error: {:?}", e);
-                return Err(ApiError::InvalidRequest(format!(
-                    "CAR verification failed: {}",
-                    e
-                )));
-            }
-        }
+        let verified = CarVerifier::new()
+            .verify_car_structure_only(&root, &blocks)
+            .map_err(map_car_verify_error)?;
+        debug!(
+            "CAR structure verified for migration import: rev={}, data_cid={}",
+            verified.rev, verified.data_cid
+        );
    } else {
-        debug!("Verifying CAR file signature and structure for DID {}", did);
-        let verifier = CarVerifier::new();
-        match verifier.verify_car(did, &root, &blocks).await {
-            Ok(verified) => {
-                debug!(
-                    "CAR verification successful: rev={}, data_cid={}",
-                    verified.rev, verified.data_cid
-                );
-            }
-            Err(tranquil_pds::sync::verify::VerifyError::DidMismatch {
-                commit_did,
-                expected_did,
-            }) => {
-                return Err(ApiError::InvalidRepo(format!(
-                    "CAR file is for DID {} but you are authenticated as {}",
-                    commit_did, expected_did
-                )));
-            }
-            Err(tranquil_pds::sync::verify::VerifyError::InvalidSignature) => {
-                return Err(ApiError::InvalidRequest(
-                    "CAR file commit signature verification failed".into(),
-                ));
-            }
-            Err(tranquil_pds::sync::verify::VerifyError::DidResolutionFailed(msg)) => {
-                warn!("DID resolution failed during import verification: {}", msg);
-                return Err(ApiError::InvalidRequest(format!(
-                    "Failed to verify DID: {}",
-                    msg
-                )));
-            }
-            Err(tranquil_pds::sync::verify::VerifyError::NoSigningKey) => {
-                return Err(ApiError::InvalidRequest(
-                    "DID document does not contain a signing key".into(),
-                ));
-            }
-            Err(tranquil_pds::sync::verify::VerifyError::MstValidationFailed(msg)) => {
-                return Err(ApiError::InvalidRequest(format!(
-                    "MST validation failed: {}",
-                    msg
-                )));
-            }
-            Err(e) => {
-                error!("CAR verification error: {:?}", e);
-                return Err(ApiError::InvalidRequest(format!(
-                    "CAR verification failed: {}",
-                    e
-                )));
-            }
-        }
+        let verified = CarVerifier::new()
+            .verify_car(did, &root, &blocks)
+            .await
+            .map_err(map_car_verify_error)?;
+        debug!(
+            "CAR signature and structure verified: rev={}, data_cid={}",
+            verified.rev, verified.data_cid
+        );
    }
    let max_blocks = tranquil_config::get().import.max_blocks as usize;
    let _write_lock = state.repo_write_locks.lock(user_id).await;
@@ -225,17 +167,11 @@ pub async fn import_repo(
                .records
                .iter()
                .flat_map(|record| {
-                    let record_uri =
-                        AtUri::from_parts(did.as_str(), &record.collection, &record.rkey);
-                    record.blob_refs.iter().filter_map(move |blob_ref| {
-                        match CidLink::new(&blob_ref.cid) {
-                            Ok(cid_link) => Some((record_uri.clone(), cid_link)),
-                            Err(_) => {
-                                tracing::warn!(cid = %blob_ref.cid, "skipping unparseable blob CID reference during import");
-                                None
-                            }
-                        }
-                    })
+                    let record_uri = AtUri::from_parts(did, &record.collection, &record.rkey);
+                    record
+                        .blob_refs
+                        .iter()
+                        .map(move |blob_ref| (record_uri.clone(), blob_ref.cid.clone()))
                })
                .collect();

@@ -285,43 +221,62 @@ pub async fn import_repo(
            })?;
            let new_rev = Tid::now(LimitedU32::MIN);
            let new_rev_str = new_rev.to_string();
-            let (commit_bytes, _sig) = create_signed_commit(
-                did,
-                import_result.data_cid,
-                &new_rev_str,
-                None,
-                &signing_key,
-            )
-            .map_err(|e| {
-                error!("Failed to create new commit: {}", e);
-                ApiError::InternalError(None)
-            })?;
+            let (commit_bytes, _sig) =
+                create_signed_commit(did, import_result.data_cid, &new_rev, None, &signing_key)
+                    .map_err(|e| {
+                        error!("Failed to create new commit: {}", e);
+                        ApiError::InternalError(None)
+                    })?;
            let new_root_cid: cid::Cid =
                state.block_store.put(&commit_bytes).await.map_err(|e| {
                    error!("Failed to store new commit block: {:?}", e);
                    ApiError::InternalError(None)
                })?;
            let new_root_cid_link = CidLink::from(&new_root_cid);
+            let new_rev_tid = tranquil_pds::types::Tid::from(new_rev.clone());
            state
                .repos
                .repo
-                .update_repo_root(user_id, &new_root_cid_link, &new_rev_str)
+                .update_repo_root(user_id, &new_root_cid_link, &new_rev_tid)
                .await
                .map_err(|e| {
                    error!("Failed to update repo root: {:?}", e);
                    ApiError::InternalError(None)
                })?;
-            let mut all_block_cids: Vec<Vec<u8>> = blocks.keys().map(|c| c.to_bytes()).collect();
-            all_block_cids.push(new_root_cid.to_bytes());
-            state
-                .repos
-                .repo
-                .insert_user_blocks(user_id, &all_block_cids, &new_rev_str)
-                .await
-                .map_err(|e| {
-                    error!("Failed to insert user_blocks: {:?}", e);
-                    ApiError::InternalError(None)
-                })?;
+            match tranquil_pds::scheduled::collect_current_repo_blocks(
+                &state.block_store,
+                &new_root_cid,
+            )
+            .await
+            {
+                Ok(reachable) => {
+                    if !reachable.is_complete() {
+                        error!(
+                            unreadable = reachable.unreadable,
+                            "scheduling a structural repair because the imported repo walk could \
+                             not read every block"
+                        );
+                        tranquil_pds::repo_ops::schedule_repo_repair(&state, user_id);
+                    }
+                    state
+                        .repos
+                        .repo
+                        .insert_user_blocks(user_id, &reachable.block_cids, &new_rev_tid)
+                        .await
+                        .map_err(|e| {
+                            error!("Failed to insert user_blocks: {:?}", e);
+                            ApiError::InternalError(None)
+                        })?;
+                }
+                Err(e) => {
+                    error!(
+                        "Failed to walk the imported repo: {:?}. The root is already updated and \
+                         a scheduled structural repair will rebuild user_blocks",
+                        e
+                    );
+                    tranquil_pds::repo_ops::schedule_repo_repair(&state, user_id);
+                }
+            }
            let new_root_str = new_root_cid.to_string();
            info!(
                "Created new commit for imported repo: cid={}, rev={}",
@@ -417,7 +372,6 @@ async fn sequence_import_event(
        rev: None,
    };

-    let seq = state.repos.repo.insert_commit_event(&data).await?;
-    state.repos.repo.notify_update(seq).await?;
+    state.repos.repo.insert_commit_event(&data).await?;
    Ok(())
 }
@@ -1,6 +1,6 @@
 use super::validation::validate_record_with_status;
 use super::validation_mode::{ValidationMode, deserialize_validation_mode};
-use crate::repo::record::write::CommitInfo;
+use crate::repo::record::write::{CommitInfo, ensure_record_type};
 use axum::{Json, extract::State};
 use jacquard_repo::{mst::Mst, storage::BlockStore};
 use serde::{Deserialize, Serialize};
@@ -14,11 +14,11 @@ use tranquil_pds::auth::{
 };
 use tranquil_pds::repo::TrackingBlockStore;
 use tranquil_pds::repo_ops::{
-    FinalizeParams, RecordOp, begin_repo_write, extract_backlinks, extract_blob_cids,
-    finalize_repo_write,
+    CommitResult, FinalizeParams, RecordOp, begin_repo_write, extract_backlinks, extract_blob_cids,
+    finalize_repo_write, with_repair_retry,
 };
 use tranquil_pds::state::AppState;
-use tranquil_pds::types::{AtIdentifier, AtUri, Did, Nsid, Rkey};
+use tranquil_pds::types::{AtIdentifier, AtUri, CidLink, Did, Nsid, Rkey};
 use tranquil_pds::validation::ValidationStatus;

 const MAX_BATCH_WRITES: usize = 200;
@@ -27,8 +27,7 @@ struct WriteAccumulator {
    mst: Mst<TrackingBlockStore>,
    results: Vec<WriteResult>,
    ops: Vec<RecordOp>,
-    modified_keys: Vec<String>,
-    all_blob_cids: Vec<String>,
+    all_blob_cids: Vec<CidLink>,
    backlinks_to_add: Vec<Backlink>,
    backlinks_to_remove: Vec<AtUri>,
 }
@@ -44,7 +43,6 @@ async fn process_single_write(
        mst,
        mut results,
        mut ops,
-        mut modified_keys,
        mut all_blob_cids,
        mut backlinks_to_add,
        mut backlinks_to_remove,
@@ -56,6 +54,8 @@ async fn process_single_write(
            rkey,
            value,
        } => {
+            let value = ensure_record_type(value, collection);
+            let value = &*value;
            let validation_status = if validate.should_skip() {
                None
            } else {
@@ -69,8 +69,19 @@ async fn process_single_write(
                    .await?,
                )
            };
-            all_blob_cids.extend(extract_blob_cids(value));
            let rkey = rkey.clone().unwrap_or_else(Rkey::generate);
+            let key = format!("{}/{}", collection, rkey);
+            if mst
+                .get(&key)
+                .await
+                .map_err(|e| ApiError::from_mst_error("read MST for applyWrites create", &e))?
+                .is_some()
+            {
+                return Err(ApiError::InvalidRequest(format!(
+                    "Record already exists at {key}"
+                )));
+            }
+            all_blob_cids.extend(extract_blob_cids(value));
            let record_ipld = tranquil_pds::util::json_to_ipld(value);
            let record_bytes = serde_ipld_dagcbor::to_vec(&record_ipld)
                .map_err(|_| ApiError::InvalidRecord("Failed to serialize record".into()))?;
@@ -78,12 +89,10 @@ async fn process_single_write(
                .put(&record_bytes)
                .await
                .map_err(|_| ApiError::InternalError(Some("Failed to store record".into())))?;
-            let key = format!("{}/{}", collection, rkey);
-            modified_keys.push(key.clone());
            let new_mst = mst
                .add(&key, record_cid)
                .await
-                .map_err(|_| ApiError::InternalError(Some("Failed to add to MST".into())))?;
+                .map_err(|e| ApiError::from_mst_error("add record to MST", &e))?;
            let uri = AtUri::from_parts(did, collection, &rkey);
            backlinks_to_add.extend(extract_backlinks(&uri, value));
            results.push(WriteResult::CreateResult {
@@ -100,7 +109,6 @@ async fn process_single_write(
                mst: new_mst,
                results,
                ops,
-                modified_keys,
                all_blob_cids,
                backlinks_to_add,
                backlinks_to_remove,
@@ -111,6 +119,8 @@ async fn process_single_write(
            rkey,
            value,
        } => {
+            let value = ensure_record_type(value, collection);
+            let value = &*value;
            let validation_status = if validate.should_skip() {
                None
            } else {
@@ -124,6 +134,14 @@ async fn process_single_write(
                    .await?,
                )
            };
+            let key = format!("{}/{}", collection, rkey);
+            let prev_record_cid = mst
+                .get(&key)
+                .await
+                .map_err(|e| ApiError::from_mst_error("read update target from MST", &e))?
+                .ok_or_else(|| {
+                    ApiError::InvalidRequest("Update target record does not exist".into())
+                })?;
            all_blob_cids.extend(extract_blob_cids(value));
            let record_ipld = tranquil_pds::util::json_to_ipld(value);
            let record_bytes = serde_ipld_dagcbor::to_vec(&record_ipld)
@@ -132,21 +150,10 @@ async fn process_single_write(
                .put(&record_bytes)
                .await
                .map_err(|_| ApiError::InternalError(Some("Failed to store record".into())))?;
-            let key = format!("{}/{}", collection, rkey);
-            modified_keys.push(key.clone());
-            let prev_record_cid = mst
-                .get(&key)
-                .await
-                .map_err(|e| {
-                    ApiError::InternalError(Some(format!("Failed to read prev record: {}", e)))
-                })?
-                .ok_or_else(|| {
-                    ApiError::InvalidRequest("Update target record does not exist".into())
-                })?;
            let new_mst = mst
                .update(&key, record_cid)
                .await
-                .map_err(|_| ApiError::InternalError(Some("Failed to update MST".into())))?;
+                .map_err(|e| ApiError::from_mst_error("update record in MST", &e))?;
            let uri = AtUri::from_parts(did, collection, rkey);
            backlinks_to_remove.push(uri.clone());
            backlinks_to_add.extend(extract_backlinks(&uri, value));
@@ -165,7 +172,6 @@ async fn process_single_write(
                mst: new_mst,
                results,
                ops,
-                modified_keys,
                all_blob_cids,
                backlinks_to_add,
                backlinks_to_remove,
@@ -173,20 +179,17 @@ async fn process_single_write(
        }
        WriteOp::Delete { collection, rkey } => {
            let key = format!("{}/{}", collection, rkey);
-            modified_keys.push(key.clone());
            let prev_record_cid = mst
                .get(&key)
                .await
-                .map_err(|e| {
-                    ApiError::InternalError(Some(format!("Failed to read prev record: {}", e)))
-                })?
+                .map_err(|e| ApiError::from_mst_error("read delete target from MST", &e))?
                .ok_or_else(|| {
                    ApiError::InvalidRequest("Delete target record does not exist".into())
                })?;
            let new_mst = mst
                .delete(&key)
                .await
-                .map_err(|_| ApiError::InternalError(Some("Failed to delete from MST".into())))?;
+                .map_err(|e| ApiError::from_mst_error("delete record from MST", &e))?;
            backlinks_to_remove.push(AtUri::from_parts(did, collection, rkey));
            results.push(WriteResult::DeleteResult {});
            ops.push(RecordOp::Delete {
@@ -198,7 +201,6 @@ async fn process_single_write(
                mst: new_mst,
                results,
                ops,
-                modified_keys,
                all_blob_cids,
                backlinks_to_add,
                backlinks_to_remove,
@@ -219,7 +221,6 @@ async fn process_writes(
        mst: initial_mst,
        results: Vec::new(),
        ops: Vec::new(),
-        modified_keys: Vec::new(),
        all_blob_cids: Vec::new(),
        backlinks_to_add: Vec::new(),
        backlinks_to_remove: Vec::new(),
@@ -231,6 +232,45 @@ async fn process_writes(
        .await
 }

+async fn execute_apply_writes(
+    state: &AppState,
+    user_id: uuid::Uuid,
+    did: &Did,
+    input: &ApplyWritesInput,
+    controller_did: Option<&Did>,
+    write_summary: Option<serde_json::Value>,
+) -> Result<(CommitResult, Vec<WriteResult>), ApiError> {
+    let (ctx, mst) = begin_repo_write(state, user_id, input.swap_commit.as_deref()).await?;
+
+    let WriteAccumulator {
+        mst: final_mst,
+        results,
+        ops,
+        all_blob_cids,
+        backlinks_to_add,
+        backlinks_to_remove,
+    } = process_writes(&input.writes, mst, did, input.validate, &ctx.tracking_store).await?;
+
+    let commit_result = finalize_repo_write(
+        state,
+        ctx,
+        final_mst,
+        FinalizeParams {
+            did,
+            user_id,
+            controller_did,
+            delegation_detail: write_summary,
+            ops,
+            blob_cids: &all_blob_cids,
+            backlinks_to_add,
+            backlinks_to_remove,
+        },
+    )
+    .await?;
+
+    Ok((commit_result, results))
+}
+
 #[derive(Deserialize)]
 #[serde(tag = "$type")]
 pub enum WriteOp {
@@ -313,9 +353,9 @@ pub async fn apply_writes(
        &auth,
        &input.writes,
        |w| match w {
-            WriteOp::Create { collection, .. } => collection.as_str(),
-            WriteOp::Update { collection, .. } => collection.as_str(),
-            WriteOp::Delete { collection, .. } => collection.as_str(),
+            WriteOp::Create { collection, .. } => collection,
+            WriteOp::Update { collection, .. } => collection,
+            WriteOp::Delete { collection, .. } => collection,
        },
        |w| match w {
            WriteOp::Create { .. } => WriteOpKind::Create,
@@ -345,25 +385,6 @@ pub async fn apply_writes(
        .log_db_err("fetching user for batch write")?
        .ok_or(ApiError::InternalError(Some("User not found".into())))?;

-    let (ctx, mst) = begin_repo_write(&state, user_id, input.swap_commit.as_deref()).await?;
-
-    let WriteAccumulator {
-        mst: final_mst,
-        results,
-        ops,
-        modified_keys,
-        all_blob_cids,
-        backlinks_to_add,
-        backlinks_to_remove,
-    } = process_writes(
-        &input.writes,
-        mst,
-        &did,
-        input.validate,
-        &ctx.tracking_store,
-    )
-    .await?;
-
    let write_summary: Option<serde_json::Value> = controller_did.as_ref().map(|_| {
        let writes: Vec<serde_json::Value> = input
            .writes
@@ -397,22 +418,16 @@ pub async fn apply_writes(
        })
    });

-    let commit_result = finalize_repo_write(
-        &state,
-        ctx,
-        final_mst,
-        FinalizeParams {
-            did: &did,
+    let (commit_result, results) = with_repair_retry(&state, user_id, || {
+        execute_apply_writes(
+            &state,
            user_id,
-            controller_did: controller_did.as_ref(),
-            delegation_detail: write_summary,
-            ops,
-            modified_keys: &modified_keys,
-            blob_cids: &all_blob_cids,
-            backlinks_to_add,
-            backlinks_to_remove,
-        },
-    )
+            &did,
+            &input,
+            controller_did.as_ref(),
+            write_summary.clone(),
+        )
+    })
    .await?;

    Ok(Json(ApplyWritesOutput {
@@ -4,13 +4,15 @@ use cid::Cid;
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use std::str::FromStr;
-use tracing::error;
 use tranquil_pds::api::error::ApiError;
 use tranquil_pds::auth::{Active, Auth, VerifyScope};
 use tranquil_pds::cid_types::RecordCid;
-use tranquil_pds::repo_ops::{FinalizeParams, RecordOp, begin_repo_write, finalize_repo_write};
+use tranquil_pds::repo_ops::{
+    FinalizeParams, RecordOp, begin_repo_write, finalize_repo_write, with_repair_retry,
+};
 use tranquil_pds::state::AppState;
-use tranquil_pds::types::{AtIdentifier, AtUri, Nsid, Rkey};
+use tranquil_pds::types::{AtIdentifier, AtUri, Did, Nsid, Rkey};
+use uuid::Uuid;

 #[derive(Deserialize)]
 pub struct DeleteRecordInput {
@@ -41,13 +43,30 @@ pub async fn delete_record(
    let user_id = repo_auth.user_id;
    let controller_did = repo_auth.controller_did;

-    let (ctx, mst) = begin_repo_write(&state, user_id, input.swap_commit.as_deref()).await?;
+    let out = with_repair_retry(&state, user_id, || {
+        delete_record_inner(&state, &did, user_id, controller_did.as_ref(), &input)
+    })
+    .await?;
+    Ok(Json(out))
+}
+
+async fn delete_record_inner(
+    state: &AppState,
+    did: &Did,
+    user_id: Uuid,
+    controller_did: Option<&Did>,
+    input: &DeleteRecordInput,
+) -> Result<DeleteRecordOutput, ApiError> {
+    let (ctx, mst) = begin_repo_write(state, user_id, input.swap_commit.as_deref()).await?;

    let key = format!("{}/{}", input.collection, input.rkey);

    if let Some(swap_record_str) = &input.swap_record {
        let expected_cid = Cid::from_str(swap_record_str).ok();
-        let actual_cid = mst.get(&key).await.ok().flatten();
+        let actual_cid = mst
+            .get(&key)
+            .await
+            .map_err(|e| ApiError::from_mst_error("read swap target from MST", &e))?;
        if expected_cid != actual_cid {
            return Err(ApiError::InvalidSwap(Some(
                "Record has been modified or does not exist".into(),
@@ -55,18 +74,18 @@ pub async fn delete_record(
        }
    }

-    let prev_record_cid = mst.get(&key).await.map_err(|e| {
-        error!("Failed to read prev record from MST: {}", e);
-        ApiError::InternalError(Some("Failed to read MST".into()))
-    })?;
+    let prev_record_cid = mst
+        .get(&key)
+        .await
+        .map_err(|e| ApiError::from_mst_error("read prev record from MST", &e))?;
    let Some(prev_record_cid) = prev_record_cid else {
-        return Ok(Json(DeleteRecordOutput { commit: None }));
+        return Ok(DeleteRecordOutput { commit: None });
    };

-    let new_mst = mst.delete(&key).await.map_err(|e| {
-        error!("Failed to delete from MST: {}", e);
-        ApiError::InternalError(Some("Failed to delete from MST".into()))
-    })?;
+    let new_mst = mst
+        .delete(&key)
+        .await
+        .map_err(|e| ApiError::from_mst_error("delete record from MST", &e))?;

    let op = RecordOp::Delete {
        collection: input.collection.clone(),
@@ -74,18 +93,17 @@ pub async fn delete_record(
        prev: RecordCid::from(prev_record_cid),
    };

-    let modified_keys = [key];
-    let deleted_uri = AtUri::from_parts(&did, &input.collection, &input.rkey);
+    let deleted_uri = AtUri::from_parts(did, &input.collection, &input.rkey);

    let commit_result = finalize_repo_write(
-        &state,
+        state,
        ctx,
        new_mst,
        FinalizeParams {
-            did: &did,
+            did,
            user_id,
-            controller_did: controller_did.as_ref(),
-            delegation_detail: controller_did.as_ref().map(|_| {
+            controller_did,
+            delegation_detail: controller_did.map(|_| {
                json!({
                    "action": "delete",
                    "collection": input.collection,
@@ -93,7 +111,6 @@ pub async fn delete_record(
                })
            }),
            ops: vec![op],
-            modified_keys: &modified_keys,
            blob_cids: &[],
            backlinks_to_add: vec![],
            backlinks_to_remove: vec![deleted_uri],
@@ -101,10 +118,10 @@ pub async fn delete_record(
    )
    .await?;

-    Ok(Json(DeleteRecordOutput {
+    Ok(DeleteRecordOutput {
        commit: Some(CommitInfo {
            cid: commit_result.commit_cid.to_string(),
            rev: commit_result.rev,
        }),
-    }))
+    })
 }
@@ -1 +0,0 @@
-pub use tranquil_pds::repo_ops::*;
@@ -9,13 +9,13 @@ pub async fn validate_record_with_status(
    require_lexicon: bool,
 ) -> Result<ValidationStatus, ApiError> {
    let registry = tranquil_lexicon::LexiconRegistry::global();
-    if !registry.has_schema(collection.as_str()) {
-        let _ = registry.resolve_dynamic(collection.as_str()).await;
+    if !registry.has_schema(collection) {
+        let _ = registry.resolve_dynamic(collection).await;
    }

    let validator = RecordValidator::new().require_lexicon(require_lexicon);
    validator
-        .validate_with_rkey(record, collection.as_str(), rkey.map(|v| v.as_str()))
+        .validate_with_rkey(record, collection, rkey)
        .map_err(validation_error_to_api_error)
 }

@@ -5,8 +5,9 @@ use cid::Cid;
 use jacquard_repo::storage::BlockStore;
 use serde::{Deserialize, Serialize};
 use serde_json::json;
+use std::borrow::Cow;
 use std::str::FromStr;
-use tracing::error;
+use tracing::warn;
 use tranquil_pds::api::error::{ApiError, DbResultExt};
 use tranquil_pds::auth::{
    Active, Auth, AuthSource, RepoScopeAction, ScopeVerified, VerifyScope, require_not_migrated,
@@ -14,10 +15,10 @@ use tranquil_pds::auth::{
 };
 use tranquil_pds::repo_ops::{
    FinalizeParams, RecordOp, begin_repo_write, extract_backlinks, extract_blob_cids,
-    finalize_repo_write,
+    finalize_repo_write, with_repair_retry,
 };
 use tranquil_pds::state::AppState;
-use tranquil_pds::types::{AtIdentifier, AtUri, Did, Nsid, Rkey};
+use tranquil_pds::types::{AtIdentifier, AtUri, Did, Nsid, Rkey, Tid};
 use tranquil_pds::validation::ValidationStatus;
 use uuid::Uuid;

@@ -62,6 +63,29 @@ pub async fn prepare_repo_write<A: RepoScopeAction>(
    })
 }

+pub(crate) fn ensure_record_type<'a>(
+    record: &'a serde_json::Value,
+    collection: &Nsid,
+) -> Cow<'a, serde_json::Value> {
+    let serde_json::Value::Object(map) = record else {
+        return Cow::Borrowed(record);
+    };
+    let needs_fill = match map.get("$type") {
+        None | Some(serde_json::Value::Null) => true,
+        Some(serde_json::Value::String(existing)) => existing.is_empty(),
+        Some(_) => false,
+    };
+    if !needs_fill {
+        return Cow::Borrowed(record);
+    }
+    let mut map = map.clone();
+    map.insert(
+        "$type".to_string(),
+        serde_json::Value::String(collection.to_string()),
+    );
+    Cow::Owned(serde_json::Value::Object(map))
+}
+
 #[derive(Deserialize)]
 #[allow(dead_code)]
 pub struct CreateRecordInput {
@@ -79,7 +103,7 @@ pub struct CreateRecordInput {
 #[serde(rename_all = "camelCase")]
 pub struct CommitInfo {
    pub cid: String,
-    pub rev: String,
+    pub rev: Tid,
 }

 #[derive(Serialize)]
@@ -95,15 +119,32 @@ pub struct CreateRecordOutput {
 pub async fn create_record(
    State(state): State<AppState>,
    auth: Auth<Active>,
-    Json(input): Json<CreateRecordInput>,
+    Json(mut input): Json<CreateRecordInput>,
 ) -> Result<Json<CreateRecordOutput>, ApiError> {
+    if let Cow::Owned(record) = ensure_record_type(&input.record, &input.collection) {
+        input.record = record;
+    }
    let scope_proof = auth.verify_repo_create(&input.collection)?;
    let repo_auth = prepare_repo_write(&state, &scope_proof, &input.repo).await?;
    let did = repo_auth.did;
    let user_id = repo_auth.user_id;
    let controller_did = repo_auth.controller_did;

-    let (ctx, mut mst) = begin_repo_write(&state, user_id, input.swap_commit.as_deref()).await?;
+    let out = with_repair_retry(&state, user_id, || {
+        create_record_inner(&state, &did, user_id, controller_did.as_ref(), &input)
+    })
+    .await?;
+    Ok(Json(out))
+}
+
+async fn create_record_inner(
+    state: &AppState,
+    did: &Did,
+    user_id: Uuid,
+    controller_did: Option<&Did>,
+    input: &CreateRecordInput,
+) -> Result<CreateRecordOutput, ApiError> {
+    let (ctx, mut mst) = begin_repo_write(state, user_id, input.swap_commit.as_deref()).await?;

    let validation_status = if input.validate.should_skip() {
        None
@@ -119,12 +160,12 @@ pub async fn create_record(
        )
    };

-    let rkey = input.rkey.unwrap_or_else(Rkey::generate);
+    let rkey = input.rkey.clone().unwrap_or_else(Rkey::generate);
    let mut ops: Vec<RecordOp> = Vec::new();
    let mut conflict_uris_to_cleanup: Vec<AtUri> = Vec::new();

    if !input.validate.should_skip() {
-        let record_uri = AtUri::from_parts(&did, &input.collection, &rkey);
+        let record_uri = AtUri::from_parts(did, &input.collection, &rkey);
        let backlinks = extract_backlinks(&record_uri, &input.record);

        if !backlinks.is_empty() {
@@ -141,32 +182,33 @@ pub async fn create_record(
                else {
                    continue;
                };
-                let conflict_rkey = Rkey::from(conflict_rkey_str.to_string());
-                let conflict_collection = Nsid::from(conflict_col_str.to_string());
+                let (Ok(conflict_rkey), Ok(conflict_collection)) =
+                    (Rkey::new(conflict_rkey_str), Nsid::new(conflict_col_str))
+                else {
+                    warn!(
+                        uri = %conflict_uri,
+                        "skipping a backlink conflict whose stored URI doesn't parse"
+                    );
+                    continue;
+                };
                let conflict_key = format!("{}/{}", conflict_collection, conflict_rkey);

                let prev_cid = match mst.get(&conflict_key).await {
                    Ok(Some(cid)) => cid,
                    Ok(None) => continue,
                    Err(e) => {
-                        error!(
-                            "Failed to read conflict record from MST {}: {:?}",
-                            conflict_uri, e
-                        );
-                        return Err(ApiError::InternalError(Some(
-                            "Failed to read conflicting record from MST".into(),
-                        )));
+                        return Err(ApiError::from_mst_error(
+                            &format!("read conflict record from MST {conflict_uri}"),
+                            &e,
+                        ));
                    }
                };

                mst = mst.delete(&conflict_key).await.map_err(|e| {
-                    error!(
-                        "Failed to delete conflict from MST {}: {:?}",
-                        conflict_uri, e
-                    );
-                    ApiError::InternalError(Some(
-                        "Failed to delete conflicting record from MST".into(),
-                    ))
+                    ApiError::from_mst_error(
+                        &format!("delete conflict from MST {conflict_uri}"),
+                        &e,
+                    )
                })?;

                ops.push(RecordOp::Delete {
@@ -179,6 +221,18 @@ pub async fn create_record(
        }
    }

+    let key = format!("{}/{}", input.collection, rkey);
+    if mst
+        .get(&key)
+        .await
+        .map_err(|e| ApiError::from_mst_error("read MST for create existence check", &e))?
+        .is_some()
+    {
+        return Err(ApiError::InvalidRequest(format!(
+            "Record already exists at {key}"
+        )));
+    }
+
    let record_ipld = tranquil_pds::util::json_to_ipld(&input.record);
    let record_bytes = serde_ipld_dagcbor::to_vec(&record_ipld)
        .map_err(|_| ApiError::InvalidRecord("Failed to serialize record".into()))?;
@@ -187,12 +241,10 @@ pub async fn create_record(
        .put(&record_bytes)
        .await
        .map_err(|_| ApiError::InternalError(Some("Failed to save record block".into())))?;
-
-    let key = format!("{}/{}", input.collection, rkey);
    mst = mst
        .add(&key, record_cid)
        .await
-        .map_err(|_| ApiError::InternalError(Some("Failed to add to MST".into())))?;
+        .map_err(|e| ApiError::from_mst_error("add record to MST", &e))?;

    ops.push(RecordOp::Create {
        collection: input.collection.clone(),
@@ -200,34 +252,20 @@ pub async fn create_record(
        cid: tranquil_pds::cid_types::RecordCid::from(record_cid),
    });

-    let modified_keys: Vec<String> = ops
-        .iter()
-        .map(|op| match op {
-            RecordOp::Create {
-                collection, rkey, ..
-            }
-            | RecordOp::Update {
-                collection, rkey, ..
-            }
-            | RecordOp::Delete {
-                collection, rkey, ..
-            } => format!("{}/{}", collection, rkey),
-        })
-        .collect();
    let blob_cids = extract_blob_cids(&input.record);

-    let created_uri = AtUri::from_parts(&did, &input.collection, &rkey);
+    let created_uri = AtUri::from_parts(did, &input.collection, &rkey);
    let backlinks_to_add = extract_backlinks(&created_uri, &input.record);

    let commit_result = finalize_repo_write(
-        &state,
+        state,
        ctx,
        mst,
        FinalizeParams {
-            did: &did,
+            did,
            user_id,
-            controller_did: controller_did.as_ref(),
-            delegation_detail: controller_did.as_ref().map(|_| {
+            controller_did,
+            delegation_detail: controller_did.map(|_| {
                json!({
                    "action": "create",
                    "collection": input.collection,
@@ -235,7 +273,6 @@ pub async fn create_record(
                })
            }),
            ops,
-            modified_keys: &modified_keys,
            blob_cids: &blob_cids,
            backlinks_to_add,
            backlinks_to_remove: conflict_uris_to_cleanup,
@@ -243,7 +280,7 @@ pub async fn create_record(
    )
    .await?;

-    Ok(Json(CreateRecordOutput {
+    Ok(CreateRecordOutput {
        uri: created_uri,
        cid: record_cid.to_string(),
        commit: CommitInfo {
@@ -251,7 +288,7 @@ pub async fn create_record(
            rev: commit_result.rev,
        },
        validation_status,
-    }))
+    })
 }

 #[derive(Deserialize)]
@@ -283,15 +320,32 @@ pub struct PutRecordOutput {
 pub async fn put_record(
    State(state): State<AppState>,
    auth: Auth<Active>,
-    Json(input): Json<PutRecordInput>,
+    Json(mut input): Json<PutRecordInput>,
 ) -> Result<Json<PutRecordOutput>, ApiError> {
+    if let Cow::Owned(record) = ensure_record_type(&input.record, &input.collection) {
+        input.record = record;
+    }
    let upsert_proof = auth.verify_repo_upsert(&input.collection)?;
    let repo_auth = prepare_repo_write(&state, &upsert_proof, &input.repo).await?;
    let did = repo_auth.did;
    let user_id = repo_auth.user_id;
    let controller_did = repo_auth.controller_did;

-    let (ctx, mst) = begin_repo_write(&state, user_id, input.swap_commit.as_deref()).await?;
+    let out = with_repair_retry(&state, user_id, || {
+        put_record_inner(&state, &did, user_id, controller_did.as_ref(), &input)
+    })
+    .await?;
+    Ok(Json(out))
+}
+
+async fn put_record_inner(
+    state: &AppState,
+    did: &Did,
+    user_id: Uuid,
+    controller_did: Option<&Did>,
+    input: &PutRecordInput,
+) -> Result<PutRecordOutput, ApiError> {
+    let (ctx, mst) = begin_repo_write(state, user_id, input.swap_commit.as_deref()).await?;

    let validation_status = if input.validate.should_skip() {
        None
@@ -309,9 +363,13 @@ pub async fn put_record(

    let key = format!("{}/{}", input.collection, input.rkey);

+    let read_cid = |r: Result<Option<Cid>, jacquard_repo::error::RepoError>| {
+        r.map_err(|e| ApiError::from_mst_error("read MST for put", &e))
+    };
+
    if let Some(swap_record_str) = &input.swap_record {
        let expected_cid = Cid::from_str(swap_record_str).ok();
-        let actual_cid = mst.get(&key).await.ok().flatten();
+        let actual_cid = read_cid(mst.get(&key).await)?;
        if expected_cid != actual_cid {
            return Err(ApiError::InvalidSwap(Some(
                "Record has been modified or does not exist".into(),
@@ -319,32 +377,34 @@ pub async fn put_record(
        }
    }

-    let existing_cid = mst.get(&key).await.ok().flatten();
+    let existing_cid = read_cid(mst.get(&key).await)?;
    let record_ipld = tranquil_pds::util::json_to_ipld(&input.record);
    let record_bytes = serde_ipld_dagcbor::to_vec(&record_ipld)
        .map_err(|_| ApiError::InvalidRecord("Failed to serialize record".into()))?;
-    let record_cid = ctx
-        .tracking_store
+    let record_cid = jacquard_repo::mst::util::compute_cid(&record_bytes)
+        .map_err(|_| ApiError::InvalidRecord("Failed to compute record CID".into()))?;
+
+    if existing_cid == Some(record_cid) {
+        return Ok(PutRecordOutput {
+            uri: AtUri::from_parts(did, &input.collection, &input.rkey),
+            cid: record_cid.to_string(),
+            commit: None,
+            validation_status,
+        });
+    }
+
+    ctx.tracking_store
        .put(&record_bytes)
        .await
        .map_err(|_| ApiError::InternalError(Some("Failed to save record block".into())))?;

-    if existing_cid == Some(record_cid) {
-        return Ok(Json(PutRecordOutput {
-            uri: AtUri::from_parts(&did, &input.collection, &input.rkey),
-            cid: record_cid.to_string(),
-            commit: None,
-            validation_status,
-        }));
-    }
-
-    let record_uri = AtUri::from_parts(&did, &input.collection, &input.rkey);
+    let record_uri = AtUri::from_parts(did, &input.collection, &input.rkey);
    let (new_mst, op, is_update, backlinks_to_remove) = match existing_cid {
        Some(prev_cid) => {
            let new_mst = mst
                .update(&key, record_cid)
                .await
-                .map_err(|_| ApiError::InternalError(Some("Failed to update MST".into())))?;
+                .map_err(|e| ApiError::from_mst_error("update record in MST", &e))?;
            let op = RecordOp::Update {
                collection: input.collection.clone(),
                rkey: input.rkey.clone(),
@@ -357,7 +417,7 @@ pub async fn put_record(
            let new_mst = mst
                .add(&key, record_cid)
                .await
-                .map_err(|_| ApiError::InternalError(Some("Failed to add to MST".into())))?;
+                .map_err(|e| ApiError::from_mst_error("add record to MST", &e))?;
            let op = RecordOp::Create {
                collection: input.collection.clone(),
                rkey: input.rkey.clone(),
@@ -367,19 +427,18 @@ pub async fn put_record(
        }
    };

-    let modified_keys = [key];
    let blob_cids = extract_blob_cids(&input.record);
    let backlinks_to_add = extract_backlinks(&record_uri, &input.record);

    let commit_result = finalize_repo_write(
-        &state,
+        state,
        ctx,
        new_mst,
        FinalizeParams {
-            did: &did,
+            did,
            user_id,
-            controller_did: controller_did.as_ref(),
-            delegation_detail: controller_did.as_ref().map(|_| {
+            controller_did,
+            delegation_detail: controller_did.map(|_| {
                json!({
                    "action": if is_update { "update" } else { "create" },
                    "collection": input.collection,
@@ -387,7 +446,6 @@ pub async fn put_record(
                })
            }),
            ops: vec![op],
-            modified_keys: &modified_keys,
            blob_cids: &blob_cids,
            backlinks_to_add,
            backlinks_to_remove,
@@ -395,7 +453,7 @@ pub async fn put_record(
    )
    .await?;

-    Ok(Json(PutRecordOutput {
+    Ok(PutRecordOutput {
        uri: record_uri,
        cid: record_cid.to_string(),
        commit: Some(CommitInfo {
@@ -403,5 +461,5 @@ pub async fn put_record(
            rev: commit_result.rev,
        }),
        validation_status,
-    }))
+    })
 }
@@ -10,7 +10,7 @@ use serde_json::Value;
 use std::str::FromStr;
 use std::sync::Arc;
 use std::sync::atomic::{AtomicUsize, Ordering};
-use tracing::{error, info, warn};
+use tracing::{debug, error, info, warn};
 use tranquil_pds::api::EmptyResponse;
 use tranquil_pds::api::error::{ApiError, DbResultExt};
 use tranquil_pds::auth::{Auth, NotTakendown, Permissive, require_legacy_session_mfa};
@@ -18,7 +18,7 @@ use tranquil_pds::cache::Cache;
 use tranquil_pds::oauth::scopes::{AccountAction, AccountAttr};
 use tranquil_pds::plc::PlcClient;
 use tranquil_pds::state::AppState;
-use tranquil_pds::types::PlainPassword;
+use tranquil_pds::types::{PlainPassword, Tid};
 use uuid::Uuid;

 #[derive(Serialize)]
@@ -27,7 +27,8 @@ pub struct CheckAccountStatusOutput {
    pub activated: bool,
    pub valid_did: bool,
    pub repo_commit: String,
-    pub repo_rev: String,
+    #[serde(serialize_with = "serialize_optional_rev")]
+    pub repo_rev: Option<Tid>,
    pub repo_blocks: i64,
    pub indexed_records: i64,
    pub private_state_values: i64,
@@ -35,6 +36,13 @@ pub struct CheckAccountStatusOutput {
    pub imported_blobs: i64,
 }

+fn serialize_optional_rev<S: serde::Serializer>(
+    rev: &Option<Tid>,
+    serializer: S,
+) -> Result<S::Ok, S::Error> {
+    serializer.serialize_str(rev.as_ref().map_or("", Tid::as_str))
+}
+
 pub async fn check_account_status(
    State(state): State<AppState>,
    auth: Auth<Permissive>,
@@ -65,23 +73,20 @@ pub async fn check_account_status(
        .count_user_blocks(user_id)
        .await
        .unwrap_or(0);
-    let repo_rev = if let Some(rev) = repo_rev_from_db {
-        rev
-    } else if !repo_commit.is_empty() {
-        if let Ok(cid) = Cid::from_str(&repo_commit) {
-            if let Ok(Some(block)) = state.block_store.get(&cid).await {
+    let repo_rev = match (repo_rev_from_db, Cid::from_str(&repo_commit)) {
+        (Some(rev), _) => Some(rev),
+        (None, Ok(cid)) => state
+            .block_store
+            .get(&cid)
+            .await
+            .ok()
+            .flatten()
+            .and_then(|block| {
                Commit::from_cbor(&block)
                    .ok()
-                    .map(|c| c.rev().to_string())
-                    .unwrap_or_default()
-            } else {
-                String::new()
-            }
-        } else {
-            String::new()
-        }
-    } else {
-        String::new()
+                    .map(|commit| Tid::from(commit.rev().clone()))
+            }),
+        (None, Err(_)) => None,
    };
    let record_count: i64 = state.repos.repo.count_records(user_id).await.unwrap_or(0);
    let imported_blobs: i64 = state
@@ -133,7 +138,7 @@ async fn assert_valid_did_document_for_service(
    if did.as_str().starts_with("did:plc:") {
        let max_attempts = if with_retry { 5 } else { 1 };
        let cache_for_retry = cache.clone();
-        let did_owned = did.as_str().to_string();
+        let did_owned = did.clone();
        let expected_owned = expected_endpoint.clone();
        let attempt_counter = Arc::new(AtomicUsize::new(0));

@@ -197,18 +202,20 @@ async fn assert_valid_did_document_for_service(
        .await
        .map_err(ApiError::InvalidRequest)?;

+        let doc_rotation_keys = doc_data
+            .get("rotationKeys")
+            .and_then(Value::as_array)
+            .map(|arr| arr.iter().filter_map(Value::as_str).collect::<Vec<_>>())
+            .unwrap_or_default();
+
        let server_rotation_key = tranquil_config::get().secrets.plc_rotation_key.clone();
-        if let Some(ref expected_rotation_key) = server_rotation_key {
-            let rotation_keys = doc_data
-                .get("rotationKeys")
-                .and_then(Value::as_array)
-                .map(|arr| arr.iter().filter_map(Value::as_str).collect::<Vec<_>>())
-                .unwrap_or_default();
-            if !rotation_keys.contains(&expected_rotation_key.as_str()) {
-                return Err(ApiError::InvalidRequest(
-                    "Server rotation key not included in PLC DID data".into(),
-                ));
-            }
+        if let Some(ref expected_rotation_key) = server_rotation_key
+            && !doc_rotation_keys.contains(&expected_rotation_key.as_str())
+        {
+            debug!(
+                "DID {} rotation keys {:?} omit the PDS-managed server rotation key {}",
+                did, doc_rotation_keys, expected_rotation_key
+            );
        }

        let doc_signing_key = doc_data
@@ -243,6 +250,13 @@ async fn assert_valid_did_document_for_service(
                    "DID document verification method does not match expected signing key".into(),
                ));
            }
+
+            if !doc_rotation_keys.contains(&expected_did_key.as_str()) {
+                debug!(
+                    "DID {} rotation keys {:?} omit the PDS-managed signing key {}",
+                    did, doc_rotation_keys, expected_did_key
+                );
+            }
        }
    } else if let Some(host_and_path) = did.as_str().strip_prefix("did:web:") {
        let client = tranquil_pds::api::proxy_client::did_resolution_client();
@@ -376,7 +390,7 @@ pub async fn activate_account(
                .cache
                .delete(&tranquil_pds::cache_keys::plc_data_key(&did))
                .await;
-            if state.did_resolver.refresh_did(did.as_str()).await.is_err() {
+            if state.did_resolver.refresh_did(&did).await.is_err() {
                warn!(
                    "[MIGRATION] activateAccount: Failed to refresh DID cache for {}",
                    did
@@ -412,10 +426,8 @@ pub async fn activate_account(
                "[MIGRATION] activateAccount: Sequencing identity event for did={} handle={:?}",
                did, handle
            );
-            let handle_typed = handle.clone();
            if let Err(e) =
-                tranquil_pds::repo_ops::sequence_identity_event(&state, &did, handle_typed.as_ref())
-                    .await
+                tranquil_pds::repo_ops::sequence_identity_event(&state, &did, handle.as_ref()).await
            {
                warn!(
                    "[MIGRATION] activateAccount: Failed to sequence identity event for activation: {}",
@@ -438,7 +450,9 @@ pub async fn activate_account(
                );
                let rev = if let Ok(cid) = Cid::from_str(root_cid_link.as_str()) {
                    if let Ok(Some(block)) = state.block_store.get(&cid).await {
-                        Commit::from_cbor(&block).ok().map(|c| c.rev().to_string())
+                        Commit::from_cbor(&block)
+                            .ok()
+                            .map(|c| Tid::from(c.rev().clone()))
                    } else {
                        None
                    }
@@ -448,8 +462,8 @@ pub async fn activate_account(
                if let Err(e) = tranquil_pds::repo_ops::sequence_sync_event(
                    &state,
                    &did,
-                    root_cid_link.as_str(),
-                    rev.as_deref(),
+                    &root_cid_link,
+                    rev.as_ref(),
                )
                .await
                {
@@ -626,7 +640,7 @@ pub async fn delete_account(
        state.repos.session.as_ref(),
        user_id,
        password,
-        password_hash.as_deref(),
+        password_hash.as_ref(),
    )
    .await
    .is_none()
@@ -665,27 +679,22 @@ pub async fn delete_account(
            error!("DB error deleting account: {:?}", e);
            ApiError::InternalError(None)
        })?;
-    let account_seq = tranquil_pds::repo_ops::sequence_account_event(
+    if let Err(e) = tranquil_pds::repo_ops::sequence_account_event(
        &state,
        did,
        tranquil_db_traits::AccountStatus::Deleted,
    )
-    .await;
-    match account_seq {
-        Ok(seq) => {
-            if let Err(e) = state.repos.repo.delete_sequences_except(did, seq).await {
-                warn!(
-                    "Failed to cleanup sequences for deleted account {}: {}",
-                    did, e
-                );
-            }
-        }
-        Err(e) => {
-            warn!(
-                "Failed to sequence account deletion event for {}: {}",
-                did, e
-            );
-        }
+    .await
+    {
+        warn!(
+            "Failed to sequence account deletion event for {}: {}",
+            did, e
+        );
+    } else if let Err(e) = state.repos.repo.purge_did_events_keeping_latest(did).await {
+        warn!(
+            "Failed to cleanup sequences for deleted account {}: {}",
+            did, e
+        );
    }
    let _ = state
        .cache
@@ -116,7 +116,10 @@ pub async fn create_app_password(
            .await
            .ok()
            .flatten();
-        let granted_scopes = grant.map(|g| g.granted_scopes).unwrap_or_default();
+        let granted_scopes = match grant {
+            Some(g) => g.granted_scopes,
+            None => return Err(ApiError::InsufficientScope(None)),
+        };

        let requested = input.scopes.as_deref().unwrap_or("atproto");
        let intersected = intersect_scopes(requested, granted_scopes.as_str());
@@ -188,7 +191,7 @@ pub async fn create_app_password(
    }
    Ok(Json(CreateAppPasswordOutput {
        name: name.to_string(),
-        password,
+        password: password.into_inner(),
        created_at: created_at.to_rfc3339(),
        privileged: privilege.is_privileged(),
        scopes: final_scopes,
@@ -0,0 +1,57 @@
+                                                                                                                                                                      
+                                                                                                                                                                      
+                                                                                                                                                                      
+                                                                                                                                                                      
+                                                                                                                                                                      
+                                                                                                                                                                      
+                                                                            ..........................                                                                
+                                                              ....*o|||||||8#@@@@@@@@@@@@@@@@@@@@@@@###&|o:_..                                                        
+                                                    ..*:o|||&8##@###8888888######@#@###########################|*...                                                  
+                                             .:o|||8#####8888|:::**.     *&########################@@################&o_                                              
+                                        .*o&8###@#8&o*_.                :###@##############@########################@@##&o_                                           
+                                     .*o8########&                     :##@#@##############@############################@###|_                                        
+                                 .*o|8##########8o                    .#######################################################&o_                                     
+                   *&##|_     ..*&##8&o*|88888|_                      _#######################################@##################|.                                   
+                  *#####&  *&######&o_..*o|o:_       .&##o            _###########################################################&_                                  
+                 _##8*##8 .|88|:::|#######8###8|*:_ .&#@@8            _##@@@########################################################&_                                
+                 _#@8_##8_         *8#8|*_ _:|#####&&####8            .&##############################################################|                               
+                 _#@8.|##8_                   _::o###8&##8             .|##@############################8###########################@@#|_                             
+                 *###o.|88o                 ..*&####|..##&               _|##########################8|_ .|#############################8                             
+               *|###|_                   ._&####8|*_   _*_                  _::&8888888888888888|::*_      .|##@####@@@##################|                            
+             *&###|_     _:_         .&88###8|*_       .....                                                 .|#####@@@##################8                            
+            .##@#&      _##&   .|##o _#@@#@#|       .|#######&:_                                               _|###@####################8                            
+           .:8##8o   _o:*&##|   *##8_.&@@##@#|   _::o8#8|::|#####|_                                              _|#################88###8                            
+          .&##&*_   *###o_###|  .|##8*&##|*###o _###8####8|_ _:|###|_           .*o|||o:_                          _:::&8888888888|_  _##8                            
+          .###|_.  _###o  *###|*&#######8  *##8 .##8_ _:|###|_  _|###|_       .&########o                                             _##&                            
+           _|####8|&##8:_  _|#########88o  .##8  *##&    _|###o   .|###o      .#########|                                            .o##o                            
+             o#8|*:#@@###o   _:::*__*_     _##8_ _##8_     _&##|_   *##8_      *8#####8|_  .*oo:_                                    o##|                             
+            *###o.&#####&             _oo* .8##& .8##8_     .|##&    o##&        _::::_.*o|8######|_                                .##8.                             
+           _###&o&##8_:*_            .###& .###|_&#####|     _##8   :###o        *ooo&#########@#@#&                            ....:##&                              
+           .|8||###&.                 _**_ .###88##|*&###|*._&##& *|##8_      *o&####@@####@@######&                 .*o||||||&#######8_                              
+              *&###o                        _|88##8_  _:8######|*:###|_      _##################88|_               *&#################&                               
+             *#####o  *&8o                      *##&     _:::*_.&##|_        _#@##############8_                  :##################8*                               
+            .###&##8_.|88o   *&8o               _@@&           .###|         .&####@#########|_                  .####@###@@########8*                                
+            _##&.|###|_.... .|88o               _##8*  *&###|_  *###o          _:&88######8|_               .*o|||##################o                                 
+            _##8_ _|########|_                .*o8####&#@@#@##o  *#@8                _*:*.                .&###@###################|                                  
+            .|##&   _:::::&##&             .*&##############@#8_ .###o                                    _#@####################|_                                   
+             .&##|_      .&##8_         *o&####################8_ *##&                                    .&#####@@############8*                                     
+              .|##8_.&###&####8_       _########################8**##&                                     _##################|_                                      
+               .&###&##888888##8_      .|88######@###########|*######o                                    _|8###############|_                                        
+               .&#####o      *###|_        _::::::*o##8**o##8 .|###8o                                   .&##@#############&*                                          
+               .|####o        _|###|_              _##8.*&##&   _*_                                     .#################|                                           
+                  _*_           _|###|_..          .|#####8|_                                            *&#@#########8###&                                           
+                                  *#######&|o:_... ..*:::*.                                   ......._:o&8####888&o:#####8_                                           
+                                  _###|&888#####@#####&|||o:_........................._:o||||8##@@@@####8|:*_       _:::*_                                            
+                                  .|#@###o  _:::o#@#888######@@@@@@@@@@@@@@@@@@@@@@@@#####888|::::::**_                                                               
+                                    _::*_       :##&   *&8|_:::::::::::::::::::::::::**_                                                                              
+                                               .###8||&##8o                                                                                                           
+                                                _|888888|_                                                                                                            
+                                                                                                                                                                      
+                                                                                                                                                                      
+                                                                                                                                                                      
+                                                                                                                                                                      
+                                                                                                                                                                      
+                                                                                                                                                                      
+                                                                                                                                                                      
+                                                                                                                                                                      
+                                                                                                                                                                      
@@ -19,6 +19,7 @@ use tranquil_pds::auth::{Auth, NotTakendown};
 use tranquil_pds::oauth::scopes::{AccountAction, AccountAttr};
 use tranquil_pds::rate_limit::{EmailUpdateLimit, RateLimited, VerificationCheckLimit};
 use tranquil_pds::state::AppState;
+use tranquil_pds::types::{AtIdentifier, Did};

 const EMAIL_UPDATE_TTL: Duration = Duration::from_secs(30 * 60);

@@ -37,7 +38,7 @@ struct PendingEmailUpdate {

 async fn get_pending_email_update(
    cache: &dyn tranquil_pds::cache::Cache,
-    did: &str,
+    did: &Did,
 ) -> Option<PendingEmailUpdate> {
    cache
        .get(&tranquil_pds::cache_keys::email_update_key(did))
@@ -79,7 +80,7 @@ pub async fn request_email_update(
    if token_required {
        let token = tranquil_pds::auth::email_token::create_email_token(
            state.cache.as_ref(),
-            auth.did.as_str(),
+            &auth.did,
            tranquil_pds::auth::email_token::EmailTokenPurpose::UpdateEmail,
        )
        .await
@@ -249,7 +250,7 @@ pub async fn update_email(

                tranquil_pds::auth::email_token::validate_email_token(
                    state.cache.as_ref(),
-                    did.as_str(),
+                    did,
                    tranquil_pds::auth::email_token::EmailTokenPurpose::UpdateEmail,
                    token,
                )
@@ -298,7 +299,7 @@ pub async fn update_email(

            let short_token_result = tranquil_pds::auth::email_token::validate_email_token(
                state.cache.as_ref(),
-                did.as_str(),
+                did,
                tranquil_pds::auth::email_token::EmailTokenPurpose::UpdateEmail,
                token,
            )
@@ -394,7 +395,7 @@ pub async fn update_email(

 #[derive(Deserialize)]
 pub struct CheckEmailVerifiedInput {
-    pub identifier: String,
+    pub identifier: AtIdentifier,
 }

 pub async fn check_email_verified(
@@ -7,6 +7,7 @@ use tranquil_pds::auth::{Admin, Auth, NotTakendown};
 use tranquil_pds::state::AppState;
 use tranquil_pds::types::Did;
 use tranquil_pds::util::gen_invite_code;
+use tranquil_types::InviteCode as InviteCodeValue;

 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -17,7 +18,7 @@ pub struct CreateInviteCodeInput {

 #[derive(Serialize)]
 pub struct CreateInviteCodeOutput {
-    pub code: String,
+    pub code: InviteCodeValue,
 }

 pub async fn create_invite_code(
@@ -42,7 +43,7 @@ pub async fn create_invite_code(
    match state
        .repos
        .infra
-        .create_invite_code(&code, input.use_count, Some(&for_account))
+        .create_invite_code(&code, input.use_count, &for_account)
        .await
    {
        Ok(true) => Ok(Json(CreateInviteCodeOutput { code })),
@@ -72,8 +73,8 @@ pub struct CreateInviteCodesOutput {

 #[derive(Serialize)]
 pub struct AccountCodes {
-    pub account: String,
-    pub codes: Vec<String>,
+    pub account: Did,
+    pub codes: Vec<InviteCodeValue>,
 }

 pub async fn create_invite_codes(
@@ -112,14 +113,11 @@ pub async fn create_invite_codes(
        let infra_repo = state.repos.infra.clone();
        let use_count = input.use_count;
        async move {
-            let codes: Vec<String> = (0..code_count).map(|_| gen_invite_code()).collect();
+            let codes: Vec<InviteCodeValue> = (0..code_count).map(|_| gen_invite_code()).collect();
            infra_repo
-                .create_invite_codes_batch(&codes, use_count, admin_user_id, Some(&account))
+                .create_invite_codes_batch(&codes, use_count, admin_user_id, &account)
                .await
-                .map(|_| AccountCodes {
-                    account: account.to_string(),
-                    codes,
-                })
+                .map(|_| AccountCodes { account, codes })
        }
    }))
    .await;
@@ -145,7 +143,7 @@ pub struct GetAccountInviteCodesParams {
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct InviteCode {
-    pub code: String,
+    pub code: InviteCodeValue,
    pub available: i32,
    pub disabled: bool,
    pub for_account: String,
@@ -190,27 +188,24 @@ pub async fn get_account_invite_codes(
    let codes = futures::future::join_all(filtered_codes.into_iter().map(|info| {
        let infra_repo = state.repos.infra.clone();
        async move {
-            let uses = infra_repo
+            let uses: Vec<InviteCodeUse> = infra_repo
                .get_invite_code_uses(&info.code)
                .await
-                .map(|use_rows| {
-                    use_rows
-                        .into_iter()
-                        .map(|u| InviteCodeUse {
-                            used_by: u.used_by_did.to_string(),
-                            used_by_handle: u.used_by_handle.map(|h| h.to_string()),
-                            used_at: u.used_at.to_rfc3339(),
-                        })
-                        .collect::<Vec<_>>()
+                .log_db_err("fetching invite code uses")?
+                .into_iter()
+                .map(|u| InviteCodeUse {
+                    used_by: u.used_by_did.to_string(),
+                    used_by_handle: u.used_by_handle.map(|h| h.to_string()),
+                    used_at: u.used_at.to_rfc3339(),
                })
-                .unwrap_or_default();
+                .collect();

            let use_count = i32::try_from(uses.len()).unwrap_or(i32::MAX);
            if !include_used && use_count >= info.available_uses {
-                return None;
+                return Ok(None);
            }

-            Some(InviteCode {
+            Ok(Some(InviteCode {
                code: info.code,
                available: info.available_uses,
                disabled: false,
@@ -221,11 +216,16 @@ pub async fn get_account_invite_codes(
                    .unwrap_or_else(|| "admin".to_string()),
                created_at: info.created_at.to_rfc3339(),
                uses,
-            })
+            }))
        }
    }))
    .await;

-    let codes: Vec<InviteCode> = codes.into_iter().flatten().collect();
+    let codes: Vec<InviteCode> = codes
+        .into_iter()
+        .collect::<Result<Vec<Option<InviteCode>>, ApiError>>()?
+        .into_iter()
+        .flatten()
+        .collect();
    Ok(Json(GetAccountInviteCodesOutput { codes }))
 }
@@ -5,7 +5,7 @@ use tranquil_pds::BUILD_VERSION;
 use tranquil_pds::state::AppState;
 use tranquil_pds::util::{discord_app_id, discord_bot_username, telegram_bot_username};

-fn get_available_comms_channels() -> Vec<CommsChannel> {
+async fn get_available_comms_channels(state: &AppState) -> Vec<CommsChannel> {
    let cfg = tranquil_config::get();
    let mut channels = vec![CommsChannel::Email];
    if cfg.discord.bot_token.is_some() {
@@ -14,7 +14,9 @@ fn get_available_comms_channels() -> Vec<CommsChannel> {
    if cfg.telegram.bot_token.is_some() {
        channels.push(CommsChannel::Telegram);
    }
-    if cfg.signal.enabled {
+    if let Some(slot) = &state.signal_sender
+        && slot.is_linked().await
+    {
        channels.push(CommsChannel::Signal);
    }
    channels
@@ -27,6 +29,10 @@ pub async fn robots_txt() -> impl IntoResponse {
        "# Hello!\n\n# Crawling the public API is allowed\nUser-agent: *\nAllow: /\n",
    )
 }
+
+pub async fn cow_txt() -> &'static str {
+    include_str!("cow.txt")
+}
 pub fn is_self_hosted_did_web_enabled() -> bool {
    tranquil_config::get().server.enable_pds_hosted_did_web
 }
@@ -66,7 +72,7 @@ pub struct DescribeServerOutput {
    pub telegram_bot_username: Option<String>,
 }

-pub async fn describe_server() -> Json<DescribeServerOutput> {
+pub async fn describe_server(State(state): State<AppState>) -> Json<DescribeServerOutput> {
    let cfg = tranquil_config::get();
    let pds_hostname = &cfg.server.hostname;

@@ -82,7 +88,7 @@ pub async fn describe_server() -> Json<DescribeServerOutput> {
            email: cfg.server.contact_email.clone(),
        },
        version: BUILD_VERSION,
-        available_comms_channels: get_available_comms_channels(),
+        available_comms_channels: get_available_comms_channels(&state).await,
        self_hosted_did_web_enabled: is_self_hosted_did_web_enabled(),
        discord_bot_username: discord_bot_username().map(String::from),
        discord_app_id: discord_app_id().map(String::from),
@@ -28,7 +28,7 @@ pub use email::{
 };
 pub use invite::{create_invite_code, create_invite_codes, get_account_invite_codes};
 pub use logo::get_logo;
-pub use meta::{describe_server, health, robots_txt};
+pub use meta::{cow_txt, describe_server, health, robots_txt};
 pub use migration::{get_did_document, update_did_document};
 pub use passkey_account::{
    complete_passkey_setup, create_passkey_account, recover_passkey_account,
@@ -51,6 +51,7 @@ pub use session::{
    auto_resend_verification, confirm_signup, create_session, delete_session,
    get_legacy_login_preference, get_session, list_sessions, refresh_session, resend_verification,
    revoke_all_sessions, revoke_session, update_legacy_login_preference, update_locale,
+    verification_blocks_login,
 };
 pub use signing_key::reserve_signing_key;
 pub use totp::{
@@ -7,13 +7,14 @@ use serde_json::json;
 use tracing::{debug, error, info, warn};
 use tranquil_db_traits::WebauthnChallengeType;
 use tranquil_pds::api::error::ApiError;
+use tranquil_pds::api::invite::check_registration_invite;
 use tranquil_pds::api::{OptionsResponse, SuccessResponse};
 use tranquil_pds::auth::NormalizedLoginIdentifier;

 use tranquil_pds::auth::{ServiceTokenVerifier, generate_app_password, is_service_token};
 use tranquil_pds::rate_limit::{AccountCreationLimit, PasswordResetLimit, RateLimited};
 use tranquil_pds::state::AppState;
-use tranquil_pds::types::{Did, Handle, PlainPassword};
+use tranquil_pds::types::{Did, Handle, Jti, Nsid, PlainPassword};
 use tranquil_pds::validation::validate_password;

 fn generate_setup_token() -> String {
@@ -38,7 +39,7 @@ pub struct CreatePasskeyAccountInput {
    pub invite_code: Option<String>,
    pub did: Option<String>,
    pub did_type: Option<String>,
-    pub signing_key: Option<String>,
+    pub signing_key: Option<Did>,
    pub verification_channel: Option<tranquil_db_traits::CommsChannel>,
    pub discord_username: Option<String>,
    pub telegram_username: Option<String>,
@@ -68,8 +69,10 @@ pub async fn create_passkey_account(
        let token = extracted.token;
        if is_service_token(&token) {
            let verifier = ServiceTokenVerifier::new();
+            let create_account_lxm = Nsid::new("com.atproto.server.createAccount")
+                .expect("com.atproto.server.createAccount is a valid NSID");
            match verifier
-                .verify_service_token(&token, Some("com.atproto.server.createAccount"))
+                .verify_service_token(&token, Some(&create_account_lxm))
                .await
            {
                Ok(claims) => {
@@ -119,26 +122,8 @@ pub async fn create_passkey_account(
        return Err(ApiError::InvalidEmail);
    }

-    let is_bootstrap = state.bootstrap_invite_code.is_some()
-        && state.repos.user.count_users().await.unwrap_or(1) == 0;
-
-    let _validated_invite_code = if is_bootstrap {
-        match input.invite_code.as_deref() {
-            Some(code) if Some(code) == state.bootstrap_invite_code.as_deref() => None,
-            _ => return Err(ApiError::InvalidInviteCode),
-        }
-    } else if let Some(ref code) = input.invite_code {
-        match state.repos.infra.validate_invite_code(code).await {
-            Ok(validated) => Some(validated),
-            Err(_) => return Err(ApiError::InvalidInviteCode),
-        }
-    } else {
-        let invite_required = tranquil_config::get().server.invite_code_required;
-        if invite_required {
-            return Err(ApiError::InviteCodeRequired);
-        }
-        None
-    };
+    let invite_registration =
+        check_registration_invite(&state, input.invite_code.as_deref()).await?;

    let verification_channel = input
        .verification_channel
@@ -160,7 +145,7 @@ pub async fn create_passkey_account(
    let did_type = input.did_type.as_deref().unwrap_or("plc");

    let key_result =
-        match crate::identity::provision::resolve_signing_key(&state, input.signing_key.as_deref())
+        match crate::identity::provision::resolve_signing_key(&state, input.signing_key.as_ref())
            .await
        {
            Ok(k) => k,
@@ -170,7 +155,7 @@ pub async fn create_passkey_account(
    let secret_key = key_result.signing_key;
    let reserved_key_id = key_result.reserved_key_id;

-    let did = match did_type {
+    let did: Did = match did_type {
        "web" => {
            let self_hosted_did = match common::create_self_hosted_did_web(&handle) {
                Ok(d) => d,
@@ -208,7 +193,7 @@ pub async fn create_passkey_account(
                    d,
                    hostname,
                    &input.handle,
-                    input.signing_key.as_deref(),
+                    input.signing_key.as_ref(),
                )
                .await
                {
@@ -216,7 +201,8 @@ pub async fn create_passkey_account(
                }
                info!(did = %d, "Creating external did:web passkey account (reserved key)");
            }
-            d.to_string()
+            d.parse()
+                .map_err(|_| ApiError::InvalidDid("Invalid DID format".into()))?
        }
        _ => {
            if let Some(ref auth_did) = byod_auth {
@@ -229,7 +215,9 @@ pub async fn create_passkey_account(
                            )));
                        }
                        info!(did = %provided_did, "Creating BYOD did:plc passkey account (migration)");
-                        provided_did.clone()
+                        provided_did
+                            .parse()
+                            .map_err(|_| ApiError::InvalidDid("Invalid DID format".into()))?
                    } else {
                        return Err(ApiError::InvalidRequest(
                            "BYOD migration requires a did:plc or did:web DID".into(),
@@ -241,15 +229,9 @@ pub async fn create_passkey_account(
                    ));
                }
            } else {
-                let rotation_key = tranquil_config::get()
-                    .secrets
-                    .plc_rotation_key
-                    .clone()
-                    .unwrap_or_else(|| tranquil_pds::plc::signing_key_to_did_key(&secret_key));
-
                let genesis_result = match tranquil_pds::plc::create_genesis_operation(
                    &secret_key,
-                    &rotation_key,
+                    tranquil_config::get().secrets.plc_rotation_key.as_deref(),
                    &handle,
                    &pds_endpoint,
                ) {
@@ -291,13 +273,9 @@ pub async fn create_passkey_account(
        None
    };

-    let did_typed: Did = match did.parse() {
-        Ok(d) => d,
-        Err(_) => return Err(ApiError::InternalError(Some("Invalid DID".into()))),
-    };
    let repo = match crate::identity::provision::init_genesis_repo(
        &state,
-        &did_typed,
+        &did,
        &secret_key,
        &secret_key_bytes,
    )
@@ -316,10 +294,6 @@ pub async fn create_passkey_account(
        None
    };

-    let handle_typed: Handle = match handle.parse() {
-        Ok(h) => h,
-        Err(_) => return Err(ApiError::InvalidHandle(None)),
-    };
    let repo_for_seq = repo.clone();
    let comms = crate::identity::provision::normalize_comms_usernames(
        input.discord_username.as_deref(),
@@ -327,9 +301,9 @@ pub async fn create_passkey_account(
        input.signal_username.as_deref(),
    );
    let create_input = tranquil_db_traits::CreatePasskeyAccountInput {
-        handle: handle_typed.clone(),
+        handle: handle.clone(),
        email: email.clone().unwrap_or_default(),
-        did: did_typed.clone(),
+        did: did.clone(),
        preferred_comms_channel: verification_channel,
        discord_username: comms.discord,
        telegram_username: comms.telegram,
@@ -340,14 +314,10 @@ pub async fn create_passkey_account(
        encrypted_key_bytes: repo.encrypted_key_bytes,
        encryption_version: tranquil_pds::config::ENCRYPTION_VERSION,
        reserved_key_id,
-        commit_cid: repo.commit_cid.to_string(),
+        commit_cid: tranquil_types::CidLink::from(&repo.commit_cid),
        repo_rev: repo.repo_rev.clone(),
        genesis_block_cids: repo.genesis_block_cids,
-        invite_code: if is_bootstrap {
-            None
-        } else {
-            input.invite_code.clone()
-        },
+        invite_code: invite_registration.into_invite_code(),
        birthdate_pref,
    };

@@ -359,6 +329,9 @@ pub async fn create_passkey_account(
        Err(tranquil_db_traits::CreateAccountError::EmailTaken) => {
            return Err(ApiError::EmailTaken);
        }
+        Err(tranquil_db_traits::CreateAccountError::InviteCodeUnavailable) => {
+            return Err(ApiError::InvalidInviteCode);
+        }
        Err(e) => {
            error!("Error creating passkey account: {:?}", e);
            return Err(ApiError::InternalError(None));
@@ -369,10 +342,10 @@ pub async fn create_passkey_account(
    if !is_byod_did_web {
        crate::identity::provision::sequence_new_account(
            &state,
-            &did_typed,
-            &handle_typed,
-            &repo_for_seq,
+            &did,
            &handle,
+            &repo_for_seq,
+            handle.as_str(),
        )
        .await;
    }
@@ -380,7 +353,7 @@ pub async fn create_passkey_account(
    crate::identity::provision::enqueue_signup_verification(
        &state,
        user_id,
-        &did_typed,
+        &did,
        verification_channel,
        &verification_recipient,
    )
@@ -391,10 +364,10 @@ pub async fn create_passkey_account(
    let access_jwt = if byod_auth.is_some() {
        match tranquil_pds::auth::create_access_token_with_metadata(&did, &secret_key_bytes) {
            Ok(token_meta) => {
-                let refresh_jti = uuid::Uuid::new_v4().to_string();
+                let refresh_jti = Jti::from(uuid::Uuid::new_v4().to_string());
                let refresh_expires = chrono::Utc::now() + chrono::Duration::hours(24);
                let session_data = tranquil_db_traits::SessionTokenCreate {
-                    did: did_typed.clone(),
+                    did: did.clone(),
                    access_jti: token_meta.jti.clone(),
                    refresh_jti,
                    access_expires_at: token_meta.expires_at,
@@ -421,8 +394,8 @@ pub async fn create_passkey_account(
    };

    Ok(Json(CreatePasskeyAccountOutput {
-        did: did.into(),
-        handle: handle.into(),
+        did,
+        handle,
        setup_token,
        setup_expires_at,
        access_jwt,
@@ -576,7 +549,7 @@ pub async fn complete_passkey_setup(
    Ok(Json(CompletePasskeySetupOutput {
        did: input.did.clone(),
        handle: user.handle,
-        app_password,
+        app_password: app_password.into_inner(),
        app_password_name,
    }))
 }
@@ -715,7 +688,7 @@ pub async fn request_passkey_recovery(
    if let Err(e) = state
        .repos
        .user
-        .set_recovery_token(&user.did, &recovery_token_hash, expires_at)
+        .set_recovery_token(&user.did, recovery_token_hash.as_str(), expires_at)
        .await
    {
        error!("Error updating recovery token: {:?}", e);
@@ -10,13 +10,9 @@ use tranquil_pds::auth::{
 };
 use tranquil_pds::rate_limit::{PasswordResetLimit, RateLimited, ResetPasswordLimit};
 use tranquil_pds::state::AppState;
-use tranquil_pds::types::PlainPassword;
+use tranquil_pds::types::{Handle, PlainPassword};
 use tranquil_pds::validation::validate_password;

-fn generate_reset_code() -> String {
-    tranquil_pds::util::generate_token_code()
-}
-
 #[derive(Deserialize)]
 pub struct RequestPasswordResetInput {
    #[serde(alias = "identifier")]
@@ -49,12 +45,23 @@ pub async fn request_password_reset(
        None
    };

-    let user_id = match state
-        .repos
-        .user
-        .get_id_by_email_or_handle(normalized, normalized_handle.as_str())
-        .await
-    {
+    let lookup = match Handle::new(normalized_handle.as_str()) {
+        Ok(handle) => {
+            state
+                .repos
+                .user
+                .get_id_by_email_or_handle(normalized, &handle)
+                .await
+        }
+        Err(_) => state
+            .repos
+            .user
+            .get_by_email(normalized)
+            .await
+            .map(|user| user.map(|user| user.id)),
+    };
+
+    let user_id = match lookup {
        Ok(Some(id)) => id,
        Ok(None) => {
            info!("Password reset requested for unknown identifier");
@@ -70,12 +77,13 @@ pub async fn request_password_reset(
            return Err(ApiError::InternalError(None));
        }
    };
-    let code = generate_reset_code();
+    let display_code = tranquil_pds::util::generate_token_code();
+    let stored_code = tranquil_pds::util::normalize_token_code(&display_code);
    let expires_at = Utc::now() + Duration::minutes(10);
    if let Err(e) = state
        .repos
        .user
-        .set_password_reset_code(user_id, &code, expires_at)
+        .set_password_reset_code(user_id, &stored_code, expires_at)
        .await
    {
        error!("DB error setting reset code: {:?}", e);
@@ -86,7 +94,7 @@ pub async fn request_password_reset(
        state.repos.user.as_ref(),
        state.repos.infra.as_ref(),
        user_id,
-        &code,
+        &display_code,
        hostname,
    )
    .await
@@ -133,7 +141,13 @@ pub async fn reset_password(
    if let Err(e) = validate_password(password) {
        return Err(ApiError::InvalidRequest(e.to_string()));
    }
-    let user = match state.repos.user.get_user_by_reset_code(token).await {
+    let normalized_token = tranquil_pds::util::normalize_token_code(token);
+    let user = match state
+        .repos
+        .user
+        .get_user_by_reset_code(&normalized_token)
+        .await
+    {
        Ok(Some(u)) => u,
        Ok(None) => {
            return Err(ApiError::InvalidToken(None));
@@ -74,7 +74,7 @@ pub async fn reauth_password(
        .log_db_err("fetching password hash")?
        .ok_or(ApiError::AccountNotFound)?;

-    let password_valid = bcrypt::verify(&input.password, &password_hash).unwrap_or(false);
+    let password_valid = bcrypt::verify(&input.password, password_hash.as_str()).unwrap_or(false);

    if !password_valid {
        let app_password_hashes = state
@@ -85,7 +85,7 @@ pub async fn reauth_password(
            .unwrap_or_default();

        let app_password_valid = app_password_hashes.iter().fold(false, |acc, h| {
-            acc | bcrypt::verify(&input.password, h).unwrap_or(false)
+            acc | bcrypt::verify(&input.password, h.as_str()).unwrap_or(false)
        });

        if !app_password_valid {
@@ -118,7 +118,7 @@ pub async fn get_service_auth(
            &auth.auth_source,
            auth.scope.as_deref(),
            params.aud.as_str(),
-            method.as_str(),
+            method,
        ) {
            return e.into_response();
        }
@@ -169,18 +169,14 @@ pub async fn get_service_auth(
        }
    }

-    let service_token = match tranquil_pds::auth::create_service_token(
-        &auth.did,
-        params.aud.as_str(),
-        lxm.map(|v| v.as_str()),
-        &key_bytes,
-    ) {
-        Ok(t) => t,
-        Err(e) => {
-            error!("Failed to create service token: {:?}", e);
-            return ApiError::InternalError(None).into_response();
-        }
-    };
+    let service_token =
+        match tranquil_pds::auth::create_service_token(&auth.did, &params.aud, lxm, &key_bytes) {
+            Ok(t) => t,
+            Err(e) => {
+                error!("Failed to create service token: {:?}", e);
+                return ApiError::InternalError(None).into_response();
+            }
+        };
    (
        StatusCode::OK,
        Json(GetServiceAuthOutput {
@@ -8,18 +8,28 @@ use bcrypt::verify;
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use tracing::{error, info, warn};
-use tranquil_db_traits::{SessionId, TokenFamilyId};
+use tranquil_db_traits::{ChannelVerificationStatus, SessionId, TokenFamilyId};
 use tranquil_pds::api::error::{ApiError, DbResultExt};
 use tranquil_pds::api::{EmptyResponse, PreferredLocaleOutput, SuccessResponse};
 use tranquil_pds::auth::{
    Active, Auth, NormalizedLoginIdentifier, Permissive, require_legacy_session_mfa,
    require_reauth_window,
 };
-use tranquil_pds::rate_limit::{LoginLimit, RateLimited, RefreshSessionLimit};
+use tranquil_pds::rate_limit::{
+    LoginLimit, RateLimited, RefreshSessionLimit, TotpVerifyLimit,
+    check_user_rate_limit_with_message,
+};
 use tranquil_pds::state::AppState;
-use tranquil_pds::types::{AccountState, Did, Handle, PlainPassword};
+use tranquil_pds::types::{AccountState, AtIdentifier, Did, Handle, PlainPassword};
 use tranquil_types::TokenId;

+pub fn verification_blocks_login(channel_verification: &ChannelVerificationStatus) -> bool {
+    !tranquil_config::get()
+        .server
+        .disable_account_verification_gate
+        && !channel_verification.has_any_verified()
+}
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct CreateSessionInput {
@@ -68,10 +78,20 @@ pub async fn create_session(
        "Normalized identifier: {} -> {}",
        input.identifier, normalized_identifier
    );
+    let Ok(login_identifier) = AtIdentifier::new(normalized_identifier.as_str()) else {
+        let _ = verify(
+            &input.password,
+            "$2b$12$LQv3c1yqBWVHxkd0LHAkCOYz6TtxMQJqhN8/X4.VTtYw1ZzQKZqmK",
+        );
+        warn!("Login identifier is not a valid handle or DID");
+        return Err(ApiError::AuthenticationFailed(Some(
+            "Invalid identifier or password".into(),
+        )));
+    };
    let row = match state
        .repos
        .user
-        .get_login_full_by_identifier(normalized_identifier.as_str())
+        .get_login_full_by_identifier(&login_identifier)
        .await
    {
        Ok(Some(row)) => row,
@@ -102,7 +122,7 @@ pub async fn create_session(
        state.repos.session.as_ref(),
        row.id,
        &input.password,
-        row.password_hash.as_deref(),
+        row.password_hash.as_ref(),
    )
    .await;
    let (app_password_name, app_password_scopes, app_password_controller) = match credential {
@@ -129,14 +149,13 @@ pub async fn create_session(
        warn!("Login attempt for takendown account: {}", row.did);
        return Err(ApiError::AccountTakedown);
    }
-    let is_verified = row.channel_verification.has_any_verified();
    let is_delegated = state
        .repos
        .delegation
        .is_delegated_account(&row.did)
        .await
        .unwrap_or(false);
-    if !is_verified && !is_delegated {
+    if verification_blocks_login(&row.channel_verification) && !is_delegated {
        warn!("Login attempt for unverified account: {}", row.did);
        let resend_info = auto_resend_verification(&state, &row.did).await;
        let handle = resend_info
@@ -162,17 +181,35 @@ pub async fn create_session(
    let has_totp = row.totp_enabled;
    let email_2fa_enabled = row.email_2fa_enabled;
    let is_legacy_login = has_totp || email_2fa_enabled;
+    let used_totp_factor = tranquil_pds::auth::legacy_2fa::used_totp_factor(
+        has_totp,
+        input.auth_factor_token.as_deref(),
+    );
    let twofa_ctx = tranquil_pds::auth::legacy_2fa::Legacy2faContext {
        is_app_password: app_password_name.is_some(),
        email_2fa_enabled,
        has_totp,
        allow_legacy_login: row.allow_legacy_login,
    };
+    if let Some(token) = input.auth_factor_token.as_deref()
+        && has_totp
+        && tranquil_pds::auth::legacy_2fa::looks_like_totp_token(token)
+    {
+        check_user_rate_limit_with_message::<TotpVerifyLimit>(
+            &state,
+            row.did.as_str(),
+            "Too many verification attempts. Please try again in a few minutes.",
+        )
+        .await?;
+    }
    match tranquil_pds::auth::legacy_2fa::process_legacy_2fa(
        state.cache.as_ref(),
        &row.did,
        &twofa_ctx,
        input.auth_factor_token.as_deref(),
+        async |t: &str| {
+            crate::server::totp::verify_totp_or_backup_for_user(&state, &row.did, t).await
+        },
    )
    .await
    {
@@ -240,7 +277,7 @@ pub async fn create_session(
        &row.did,
        &key_bytes,
        app_password_scopes.as_deref(),
-        app_password_controller.as_deref(),
+        app_password_controller.as_ref(),
        None,
    ) {
        Ok(m) => m,
@@ -279,7 +316,7 @@ pub async fn create_session(
        error!("Failed to insert session: {:?}", e);
        return Err(ApiError::InternalError(None));
    }
-    if is_legacy_login {
+    if is_legacy_login && !used_totp_factor {
        warn!(
            did = %row.did,
            ip = %client_ip,
@@ -314,7 +351,7 @@ pub async fn create_session(
            refresh_jwt: refresh_meta.token,
            handle,
            did: row.did,
-            did_doc: did_doc.ok().map(|f| (*f).clone()),
+            did_doc: did_doc.ok(),
            email: row.email,
            email_confirmed: Some(row.channel_verification.email),
            email_auth_factor: email_auth_factor_out,
@@ -407,7 +444,7 @@ pub async fn get_session(
                status: account_state.status_for_session().map(String::from),
                migrated_to_pds,
                migrated_at,
-                did_doc: did_doc.ok().map(|f| (*f).clone()),
+                did_doc: did_doc.ok(),
            }))
        }
        Ok(None) => Err(ApiError::AuthenticationFailed(None)),
@@ -425,7 +462,12 @@ pub async fn delete_session(
 ) -> Result<Json<EmptyResponse>, ApiError> {
    let jti = tranquil_pds::auth::extract_jti_from_headers(&headers)
        .ok_or(ApiError::AuthenticationRequired)?;
-    match state.repos.session.delete_session_by_access_jti(&jti).await {
+    match state
+        .repos
+        .session
+        .delete_session_by_access_jti(&jti, &auth.did)
+        .await
+    {
        Ok(rows) if rows > 0 => {
            let session_cache_key = tranquil_pds::cache_keys::session_key(&auth.did, &jti);
            let _ = state.cache.delete(&session_cache_key).await;
@@ -478,16 +520,15 @@ pub async fn refresh_session(
            )));
        }
    };
-    if let Ok(Some(_)) = state
-        .repos
-        .session
-        .check_refresh_token_used(&refresh_jti)
-        .await
+    if let Some(result) = dispatch_refresh_grace(
+        &state,
+        &refresh_token,
+        &refresh_jti,
+        state.repos.session.lookup_refresh_grace(&refresh_jti).await,
+    )
+    .await
    {
-        warn!("Refresh token reuse detected for jti: {}", refresh_jti);
-        return Err(ApiError::AuthenticationFailed(Some(
-            "Refresh token has been revoked due to suspected compromise".into(),
-        )));
+        return result;
    }
    let session_row = match state
        .repos
@@ -497,9 +538,18 @@ pub async fn refresh_session(
    {
        Ok(Some(row)) => row,
        Ok(None) => {
-            return Err(ApiError::AuthenticationFailed(Some(
-                "Invalid refresh token".into(),
-            )));
+            return dispatch_refresh_grace(
+                &state,
+                &refresh_token,
+                &refresh_jti,
+                state.repos.session.lookup_refresh_grace(&refresh_jti).await,
+            )
+            .await
+            .unwrap_or_else(|| {
+                Err(ApiError::AuthenticationFailed(Some(
+                    "Invalid refresh token".into(),
+                )))
+            });
        }
        Err(e) => {
            error!("Database error fetching session: {:?}", e);
@@ -525,7 +575,7 @@ pub async fn refresh_session(
        &session_row.did,
        &key_bytes,
        session_row.scope.as_deref(),
-        session_row.controller_did.as_deref(),
+        session_row.controller_did.as_ref(),
        None,
    ) {
        Ok(m) => m,
@@ -545,6 +595,7 @@ pub async fn refresh_session(
        }
    };
    let refresh_data = tranquil_db_traits::SessionRefreshData {
+        did: session_row.did.clone(),
        old_refresh_jti: refresh_jti.clone(),
        session_id: session_row.id,
        new_access_jti: new_access_meta.jti.clone(),
@@ -552,22 +603,27 @@ pub async fn refresh_session(
        new_access_expires_at: new_access_meta.expires_at,
        new_refresh_expires_at: new_refresh_meta.expires_at,
    };
-    match state
+    let (access_jwt, refresh_jwt) = match state
        .repos
        .session
        .refresh_session_atomic(&refresh_data)
        .await
    {
-        Ok(tranquil_db_traits::RefreshSessionResult::Success) => {}
-        Ok(tranquil_db_traits::RefreshSessionResult::TokenAlreadyUsed) => {
-            warn!("Refresh token reuse detected during atomic operation");
-            return Err(ApiError::AuthenticationFailed(Some(
-                "Refresh token has been revoked due to suspected compromise".into(),
-            )));
+        Ok(tranquil_db_traits::RefreshSessionResult::Success) => {
+            (new_access_meta.token, new_refresh_meta.token)
        }
-        Ok(tranquil_db_traits::RefreshSessionResult::ConcurrentRefresh) => {
+        Ok(tranquil_db_traits::RefreshSessionResult::GraceReplay(replay)) => {
+            // Lost a benign concurrent rotation; re-mint the winner's tokens
+            // using this session's signing key (same user, unchanged by rotation).
+            info!(
+                "Concurrent refresh within grace window for session_id: {}; replaying tokens",
+                session_row.id
+            );
+            remint_grace_tokens(&replay, &key_bytes)?
+        }
+        Ok(tranquil_db_traits::RefreshSessionResult::Compromise) => {
            warn!(
-                "Concurrent refresh detected for session_id: {}",
+                "Refresh token reuse outside grace window or unreplayable rotation conflict for session_id: {}",
                session_row.id
            );
            return Err(ApiError::AuthenticationFailed(Some(
@@ -578,12 +634,151 @@ pub async fn refresh_session(
            error!("Database error during session refresh: {:?}", e);
            return Err(ApiError::InternalError(None));
        }
+    };
+    build_refresh_session_output(&state, session_row.did, access_jwt, refresh_jwt).await
+}
+
+async fn dispatch_refresh_grace(
+    state: &AppState,
+    refresh_token: &str,
+    presented_jti: &str,
+    lookup: Result<tranquil_db_traits::RefreshGraceLookup, tranquil_db_traits::DbError>,
+) -> Option<Result<Json<RefreshSessionOutput>, ApiError>> {
+    match lookup {
+        Ok(tranquil_db_traits::RefreshGraceLookup::NotUsed) => None,
+        Ok(tranquil_db_traits::RefreshGraceLookup::Replay(replay)) => {
+            Some(serve_refresh_grace_replay(state, refresh_token, presented_jti, replay).await)
+        }
+        Ok(tranquil_db_traits::RefreshGraceLookup::Compromised {
+            did,
+            session_id,
+            key_bytes,
+            encryption_version,
+        }) => Some(Err(revoke_compromised_session(
+            state,
+            refresh_token,
+            presented_jti,
+            did,
+            session_id,
+            key_bytes,
+            encryption_version,
+        )
+        .await)),
+        Err(e) => {
+            error!("Database error checking refresh token grace: {:?}", e);
+            Some(Err(ApiError::InternalError(None)))
+        }
    }
-    let did_for_doc = session_row.did.clone();
+}
+
+async fn serve_refresh_grace_replay(
+    state: &AppState,
+    refresh_token: &str,
+    presented_jti: &str,
+    replay: tranquil_db_traits::RefreshGraceReplay,
+) -> Result<Json<RefreshSessionOutput>, ApiError> {
+    let key =
+        match tranquil_pds::config::decrypt_key(&replay.key_bytes, Some(replay.encryption_version))
+        {
+            Ok(k) => k,
+            Err(e) => {
+                error!("Failed to decrypt user key for grace replay: {:?}", e);
+                return Err(ApiError::InternalError(None));
+            }
+        };
+    if tranquil_pds::auth::verify_refresh_token(refresh_token, &key).is_err() {
+        return Err(ApiError::AuthenticationFailed(Some(
+            "Invalid refresh token".into(),
+        )));
+    }
+    info!("Refresh token reuse within grace window for jti: {presented_jti}; replaying tokens");
+    let (access_jwt, refresh_jwt) = remint_grace_tokens(&replay, &key)?;
+    build_refresh_session_output(state, replay.did, access_jwt, refresh_jwt).await
+}
+
+async fn revoke_compromised_session(
+    state: &AppState,
+    refresh_token: &str,
+    presented_jti: &str,
+    did: Did,
+    session_id: SessionId,
+    key_bytes: Vec<u8>,
+    encryption_version: i32,
+) -> ApiError {
+    let key = match tranquil_pds::config::decrypt_key(&key_bytes, Some(encryption_version)) {
+        Ok(k) => k,
+        Err(e) => {
+            error!("Failed to decrypt user key for grace check: {:?}", e);
+            return ApiError::InternalError(None);
+        }
+    };
+    if tranquil_pds::auth::verify_refresh_token(refresh_token, &key).is_err() {
+        return ApiError::AuthenticationFailed(Some("Invalid refresh token".into()));
+    }
+    warn!("Refresh token reuse outside grace window for jti: {presented_jti}; revoking session");
+    if let Err(e) = state
+        .repos
+        .session
+        .delete_session_by_id(session_id, &did)
+        .await
+    {
+        error!(
+            "Failed to revoke session {} for refresh token reuse: {:?}",
+            session_id.as_i32(),
+            e
+        );
+        return ApiError::InternalError(None);
+    }
+    ApiError::AuthenticationFailed(Some(
+        "Refresh token has been revoked due to suspected compromise".into(),
+    ))
+}
+
+/// Re-mint the access/refresh JWTs for a grace-window replay from the session's
+/// current jtis and signing key. We never persist the signed JWTs; they are
+/// reconstructed on demand so a benignly-racing client converges on the same
+/// credentials the winning rotation produced. `key_bytes` is the owning user's
+/// already-decrypted signing key.
+fn remint_grace_tokens(
+    replay: &tranquil_db_traits::RefreshGraceReplay,
+    key_bytes: &[u8],
+) -> Result<(String, String), ApiError> {
+    let access_jwt = tranquil_pds::auth::create_access_token_with_jti(
+        &replay.did,
+        key_bytes,
+        replay.scope.as_deref(),
+        replay.controller_did.as_ref(),
+        None,
+        &replay.access_jti,
+        replay.access_expires_at,
+    )
+    .map_err(|e| {
+        error!("Failed to re-mint access token for grace replay: {:?}", e);
+        ApiError::InternalError(None)
+    })?;
+    let refresh_jwt = tranquil_pds::auth::create_refresh_token_with_jti(
+        &replay.did,
+        key_bytes,
+        &replay.refresh_jti,
+        replay.refresh_expires_at,
+    )
+    .map_err(|e| {
+        error!("Failed to re-mint refresh token for grace replay: {:?}", e);
+        ApiError::InternalError(None)
+    })?;
+    Ok((access_jwt, refresh_jwt))
+}
+
+async fn build_refresh_session_output(
+    state: &AppState,
+    did: Did,
+    access_jwt: String,
+    refresh_jwt: String,
+) -> Result<Json<RefreshSessionOutput>, ApiError> {
    let did_resolver = state.did_resolver.clone();
    let (db_result, did_doc) = tokio::join!(
-        state.repos.user.get_session_info_by_did(&session_row.did),
-        did_resolver.fetch_did_document(&did_for_doc)
+        state.repos.user.get_session_info_by_did(&did),
+        did_resolver.fetch_did_document(&did)
    );
    match db_result {
        Ok(Some(u)) => {
@@ -594,10 +789,10 @@ pub async fn refresh_session(
            let account_state =
                AccountState::from_db_fields(u.deactivated_at, u.takedown_ref.clone(), None, None);
            Ok(Json(RefreshSessionOutput {
-                access_jwt: new_access_meta.token,
-                refresh_jwt: new_refresh_meta.token,
+                access_jwt,
+                refresh_jwt,
                handle,
-                did: session_row.did,
+                did,
                email: u.email,
                email_confirmed: u.channel_verification.email,
                preferred_channel: u.preferred_comms_channel.as_str().to_string(),
@@ -605,12 +800,12 @@ pub async fn refresh_session(
                preferred_locale: u.preferred_locale,
                is_admin: u.is_admin,
                active: account_state.is_active(),
-                did_doc: did_doc.ok().map(|f| (*f).clone()),
+                did_doc: did_doc.ok(),
                status: account_state.status_for_session().map(String::from),
            }))
        }
        Ok(None) => {
-            error!("User not found for existing session: {}", session_row.did);
+            error!("User not found for existing session: {}", did);
            Err(ApiError::InternalError(None))
        }
        Err(e) => {
@@ -720,7 +915,6 @@ pub async fn confirm_signup(
    let session = match crate::identity::provision::create_and_store_session(
        &state,
        &row.did,
-        &row.did,
        &key_bytes,
        "transition:generic transition:chat.bsky",
        None,
@@ -762,7 +956,7 @@ pub struct AutoResendResult {
 }

 pub async fn auto_resend_verification(state: &AppState, did: &Did) -> Option<AutoResendResult> {
-    let debounce_key = tranquil_pds::cache_keys::auto_verify_sent_key(did.as_str());
+    let debounce_key = tranquil_pds::cache_keys::auto_verify_sent_key(did);
    let debounced = state.cache.get(&debounce_key).await.is_some();
    let row = match state.repos.user.get_resend_verification_by_did(did).await {
        Ok(Some(row)) => row,
@@ -945,13 +1139,13 @@ pub async fn list_sessions(
    Ok(Json(ListSessionsOutput { sessions }))
 }

-fn extract_client_name(client_id: &str) -> String {
+fn extract_client_name(client_id: &tranquil_types::ClientId) -> String {
    if client_id.starts_with("http://localhost") || client_id.starts_with("http://127.0.0.1") {
        "Localhost App".to_string()
-    } else if let Ok(parsed) = reqwest::Url::parse(client_id) {
+    } else if let Ok(parsed) = reqwest::Url::parse(client_id.as_str()) {
        parsed.host_str().unwrap_or("Unknown App").to_string()
    } else {
-        client_id.to_string()
+        client_id.as_str().to_string()
    }
 }

@@ -981,7 +1175,7 @@ pub async fn revoke_session(
        state
            .repos
            .session
-            .delete_session_by_id(session_id)
+            .delete_session_by_id(session_id, &auth.did)
            .await
            .log_db_err("deleting session")?;
        let cache_key = tranquil_pds::cache_keys::session_key(&auth.did, &access_jti);
@@ -1025,11 +1219,11 @@ pub async fn revoke_all_sessions(
            .delete_sessions_by_did(&auth.did)
            .await
            .log_db_err("revoking JWT sessions")?;
-        let jti_typed = TokenId::from(jti.clone());
+        let token_id = TokenId::from(jti.clone().into_inner());
        state
            .repos
            .oauth
-            .delete_sessions_by_did_except(&auth.did, &jti_typed)
+            .delete_sessions_by_did_except(&auth.did, &token_id)
            .await
            .log_db_err("revoking OAuth sessions")?;
    } else {
@@ -10,17 +10,19 @@ use serde::{Deserialize, Serialize};
 use tracing::{error, info};
 use tranquil_pds::api::error::ApiError;
 use tranquil_pds::state::AppState;
+use tranquil_pds::types::Did;

 const SECP256K1_MULTICODEC_PREFIX: [u8; 2] = [0xe7, 0x01];

-fn public_key_to_did_key(signing_key: &SigningKey) -> String {
+fn public_key_to_did_key(signing_key: &SigningKey) -> Did {
    let verifying_key = signing_key.verifying_key();
    let compressed_pubkey = verifying_key.to_sec1_bytes();
    let mut multicodec_key = Vec::with_capacity(2 + compressed_pubkey.len());
    multicodec_key.extend_from_slice(&SECP256K1_MULTICODEC_PREFIX);
    multicodec_key.extend_from_slice(&compressed_pubkey);
    let encoded = multibase::encode(multibase::Base::Base58Btc, &multicodec_key);
-    format!("did:key:{}", encoded)
+    Did::new(format!("did:key:{}", encoded))
+        .expect("did:key with a multibase-encoded secp256k1 key is a valid DID")
 }

 #[derive(Deserialize)]
@@ -31,7 +33,7 @@ pub struct ReserveSigningKeyInput {
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ReserveSigningKeyOutput {
-    pub signing_key: String,
+    pub signing_key: Did,
 }

 pub async fn reserve_signing_key(
@@ -52,7 +52,7 @@ impl DeviceTrustState {
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct TrustedDevice {
-    pub id: String,
+    pub id: DeviceId,
    pub user_agent: Option<String>,
    pub friendly_name: Option<String>,
    pub trusted_at: Option<DateTime<Utc>>,
@@ -62,7 +62,20 @@ pub async fn handle_telegram_webhook(
            && let Some(from) = message.from
            && let Some(username) = from.username
        {
-            let handle = parse_start_handle(message.text.as_deref());
+            let handle = match parse_start_handle(message.text.as_deref())
+                .map(tranquil_types::Handle::new)
+                .transpose()
+            {
+                Ok(h) => h,
+                Err(e) => {
+                    warn!(
+                        telegram_username = %username,
+                        error = %e,
+                        "Ignoring /start with an invalid handle"
+                    );
+                    return StatusCode::OK;
+                }
+            };

            debug!(
                telegram_username = %username,
@@ -73,7 +86,7 @@ pub async fn handle_telegram_webhook(
            match state
                .repos
                .user
-                .store_telegram_chat_id(&username, from.id, handle.as_deref())
+                .store_telegram_chat_id(&username, from.id, handle.as_ref())
                .await
            {
                Ok(Some(user_id)) => {
@@ -58,7 +58,16 @@ pub async fn dereference_scope(

    for part in scope_parts {
        if let Some(cid_str) = part.strip_prefix("ref:") {
-            let cache_key = tranquil_pds::cache_keys::scope_ref_key(cid_str);
+            let cid = match Cid::from_str(cid_str) {
+                Ok(c) => c,
+                Err(_) => {
+                    tracing::warn!("Invalid CID in scope ref: {}", cid_str);
+                    continue;
+                }
+            };
+
+            let cache_key =
+                tranquil_pds::cache_keys::scope_ref_key(&tranquil_types::CidLink::from(&cid));
            if let Some(cached) = state.cache.get(&cache_key).await {
                for s in cached.split_whitespace() {
                    if !resolved_scopes.contains(&s.to_string()) {
@@ -68,14 +77,6 @@ pub async fn dereference_scope(
                continue;
            }

-            let cid = match Cid::from_str(cid_str) {
-                Ok(c) => c,
-                Err(_) => {
-                    tracing::warn!("Invalid CID in scope ref: {}", cid_str);
-                    continue;
-                }
-            };
-
            let block_bytes = match state.block_store.get(&cid).await {
                Ok(Some(b)) => b,
                Ok(None) => {
@@ -1,31 +0,0 @@
-use axum::{
-    Json,
-    extract::State,
-    response::{IntoResponse, Response},
-};
-use serde::Deserialize;
-use tranquil_pds::api::SuccessResponse;
-use tranquil_pds::state::AppState;
-
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct ConfirmChannelVerificationInput {
-    pub channel: tranquil_db_traits::CommsChannel,
-    pub identifier: String,
-    pub code: String,
-}
-
-pub async fn confirm_channel_verification(
-    State(state): State<AppState>,
-    Json(input): Json<ConfirmChannelVerificationInput>,
-) -> Response {
-    let token_input = crate::server::VerifyTokenInput {
-        token: input.code,
-        identifier: input.identifier,
-    };
-
-    match crate::server::verify_token_internal(&state, token_input).await {
-        Ok(_output) => SuccessResponse::ok().into_response(),
-        Err(e) => e.into_response(),
-    }
-}
@@ -7,6 +7,7 @@ license.workspace = true
 [dependencies]
 tranquil-config = { workspace = true }
 tranquil-crypto = { workspace = true }
+tranquil-types = { path = "../tranquil-types", default-features = false }

 anyhow = { workspace = true }
 base32 = { workspace = true }
@@ -23,3 +24,4 @@ subtle = { workspace = true }
 totp-rs = { workspace = true }
 urlencoding = { workspace = true }
 uuid = { workspace = true }
+brotli = "8.0.4"
@@ -0,0 +1,183 @@
+use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use brotli::{CompressorWriter, Decompressor};
+use std::fmt;
+use std::io::{Read, Write};
+
+const COMPRESSED_PREFIX: &str = "$br$";
+const QUALITY: u32 = 9;
+const WINDOW_BITS: u32 = 16;
+const BUFFER_SIZE: usize = 4096;
+const MAX_SCOPE_LEN: u64 = 64 * 1024;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ScopeDecodeError {
+    Base64DecodeFailed,
+    DecompressFailed,
+    TooLarge,
+}
+
+impl fmt::Display for ScopeDecodeError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Base64DecodeFailed => write!(f, "Base64 decode of compressed scope failed"),
+            Self::DecompressFailed => write!(f, "Brotli decompression of scope failed"),
+            Self::TooLarge => write!(f, "Decompressed scope exceeds maximum length"),
+        }
+    }
+}
+
+impl std::error::Error for ScopeDecodeError {}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ScopeEncodeError {
+    TooLarge,
+}
+
+impl fmt::Display for ScopeEncodeError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::TooLarge => write!(f, "Scope exceeds maximum length"),
+        }
+    }
+}
+
+impl std::error::Error for ScopeEncodeError {}
+
+fn brotli_compress(input: &str) -> Vec<u8> {
+    let mut writer = CompressorWriter::new(Vec::new(), BUFFER_SIZE, QUALITY, WINDOW_BITS);
+
+    writer
+        .write_all(input.as_bytes())
+        .expect("writing to a Vec cannot fail");
+
+    writer.into_inner()
+}
+
+fn brotli_decompress(input: &[u8]) -> Result<String, ScopeDecodeError> {
+    let mut output = String::new();
+
+    Decompressor::new(input, BUFFER_SIZE)
+        .take(MAX_SCOPE_LEN + 1)
+        .read_to_string(&mut output)
+        .map_err(|_| ScopeDecodeError::DecompressFailed)?;
+
+    if output.len() as u64 > MAX_SCOPE_LEN {
+        return Err(ScopeDecodeError::TooLarge);
+    }
+
+    Ok(output)
+}
+
+pub fn encode_scope(scope: &str) -> Result<String, ScopeEncodeError> {
+    if scope.len() as u64 > MAX_SCOPE_LEN {
+        return Err(ScopeEncodeError::TooLarge);
+    }
+
+    let tagged = format!(
+        "{COMPRESSED_PREFIX}{}",
+        URL_SAFE_NO_PAD.encode(brotli_compress(scope))
+    );
+
+    if tagged.len() < scope.len() || scope.starts_with(COMPRESSED_PREFIX) {
+        Ok(tagged)
+    } else {
+        Ok(scope.to_owned())
+    }
+}
+
+pub fn decode_scope(scope: &str) -> Result<String, ScopeDecodeError> {
+    let Some(encoded) = scope.strip_prefix(COMPRESSED_PREFIX) else {
+        return Ok(scope.to_owned());
+    };
+
+    let compressed = URL_SAFE_NO_PAD
+        .decode(encoded)
+        .map_err(|_| ScopeDecodeError::Base64DecodeFailed)?;
+
+    brotli_decompress(&compressed)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn long_scope() -> String {
+        let mut scope = String::from("transition:generic transition:chat.bsky");
+        for collection in [
+            "social.colibri.message",
+            "social.colibri.community",
+            "social.colibri.reaction",
+            "social.colibri.member",
+            "social.colibri.channel.read",
+        ] {
+            scope.push_str(&format!(" repo:{collection}?action=create&action=delete"));
+        }
+        scope
+    }
+
+    #[test]
+    fn long_scope_roundtrips_through_compression() {
+        let scope = long_scope();
+        let encoded = encode_scope(&scope).unwrap();
+
+        assert!(encoded.starts_with(COMPRESSED_PREFIX));
+        assert!(encoded.len() < scope.len());
+        assert_eq!(decode_scope(&encoded).unwrap(), scope);
+    }
+
+    #[test]
+    fn short_scope_stays_plaintext() {
+        let encoded = encode_scope("com.atproto.access").unwrap();
+
+        assert_eq!(encoded, "com.atproto.access");
+        assert_eq!(decode_scope(&encoded).unwrap(), "com.atproto.access");
+    }
+
+    #[test]
+    fn untagged_scope_passes_through() {
+        assert_eq!(
+            decode_scope("com.atproto.refresh").unwrap(),
+            "com.atproto.refresh"
+        );
+        assert_eq!(decode_scope("").unwrap(), "");
+    }
+
+    #[test]
+    fn malformed_compressed_scope_errors_instead_of_panicking() {
+        assert_eq!(
+            decode_scope("$br$not valid base64!"),
+            Err(ScopeDecodeError::Base64DecodeFailed)
+        );
+        assert_eq!(
+            decode_scope("$br$AAAAAAAAAAAAAAAA"),
+            Err(ScopeDecodeError::DecompressFailed)
+        );
+    }
+
+    #[test]
+    fn compression_bomb_is_rejected() {
+        let bomb = URL_SAFE_NO_PAD.encode(brotli_compress(&"a".repeat(MAX_SCOPE_LEN as usize * 2)));
+
+        assert_eq!(
+            decode_scope(&format!("{COMPRESSED_PREFIX}{bomb}")),
+            Err(ScopeDecodeError::TooLarge)
+        );
+    }
+
+    #[test]
+    fn plaintext_that_looks_compressed_roundtrips() {
+        let scope = "$br$repo:*";
+        let encoded = encode_scope(scope).unwrap();
+
+        assert!(encoded.starts_with(COMPRESSED_PREFIX));
+        assert_eq!(decode_scope(&encoded).unwrap(), scope);
+    }
+
+    #[test]
+    fn encode_rejects_oversized_scope() {
+        let oversized = "a".repeat(MAX_SCOPE_LEN as usize + 1);
+
+        assert_eq!(encode_scope(&oversized), Err(ScopeEncodeError::TooLarge));
+        assert!(encode_scope(&"a".repeat(MAX_SCOPE_LEN as usize)).is_ok());
+    }
+}
--- a/Show More
+++ b/Show More