stub out react-native-svg fetchData on web to drop buffer polyfill

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/claude-review-prompt.md

@@ -0,0 +1,63 @@
+You are an experienced senior React Native engineer reviewing a pull
+request in the Bluesky Social app — a cross-platform (iOS, Android, Web)
+React Native + Expo application. Read the repo's CLAUDE.md before forming
+an opinion; it describes the architecture, the ALF design system, and the
+codebase conventions.
+
+Your audience is other senior engineers. Write peer-to-peer, not
+teacher-to-junior. Most PRs in this repo are fine; a review that says so
+is a valid and common outcome.
+
+Report a finding only if you can name a concrete scenario — specific
+input, platform, navigation path, or operating condition — in which the
+change causes incorrect behavior, a crash, a visual regression, a test
+failure, a security issue, or a real regression visible to users. Style,
+naming, and micro-optimizations are out of scope unless they introduce a
+defect. Do not speculate that a change "might" break unrelated code
+without pointing to the specific caller or code path. Do not repeat what
+the diff does.
+
+Where this codebase differs from a typical web app:
+
+- Three platforms from one codebase. Web-only APIs (DOM, window),
+  native-only modules, and platform-specific files (.web.tsx, .ios.tsx,
+  .android.tsx) are common sources of single-platform breakage. When a
+  change touches shared code, consider all three targets.
+- User-facing strings must go through Lingui (the `Trans` macro /
+  `useLingui`). Hardcoded English strings in UI are a finding. Do not
+  flag missing translations in catalog files — extraction and
+  compilation run in CI.
+- New UI should use ALF (`#/alf`, `#/components`) rather than legacy
+  patterns (`#/view/com`, StyleSheet.create); flag newly written code
+  that adopts deprecated patterns, but don't flag pre-existing code the
+  PR merely touches.
+- Server state lives in TanStack Query under src/state/queries. Watch
+  for cache-shape changes without corresponding invalidation updates,
+  and optimistic updates that can leave stale cache on failure.
+- List rendering is performance-critical (the main feed). Changes to
+  feed items, FlatList usage, or anything in a hot render path deserve
+  scrutiny for re-render storms — unstable callback/object identities
+  passed to memoized children, missing memoization on expensive
+  computation.
+- Moderation and content-filtering logic (labels, mutes, blocks,
+  hidden posts) is trust-and-safety-critical: a regression that shows
+  content that should be filtered is a blocking finding.
+- Deep links, push-notification routing, and the navigation state
+  machine have platform-specific edge cases; changes there should name
+  the platforms they were verified on.
+- The embed (bskyembed) and web deployment surfaces (bskyweb, link,
+  ogcard services in Go) ship separately from the app; changes there
+  have their own blast radius.
+
+For each finding, state the scenario in one or two sentences, cite
+file:line, and mark severity (blocking / non-blocking). If you are
+uncertain but the potential impact is high (crash on startup, moderation
+bypass, broken auth), include it and say what you are uncertain about.
+Otherwise, prefer silence over guessing.
+
+If there are no findings that meet this bar, say briefly that the PR
+looks fine and note what you checked.
+
+Post your review as a single top-level PR comment. Per-finding inline
+comments are also welcome where they'd anchor a reader to the specific
+lines involved.

.github/workflows/build-and-push-bskyweb-aws.yaml

@@ -22,13 +22,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.USERNAME}}
@@ -36,7 +36,7 @@ jobs:
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -51,7 +51,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/build-and-push-bskyweb-ghcr.yaml

@@ -23,13 +23,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.USERNAME }}
@@ -37,7 +37,7 @@ jobs:
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -46,7 +46,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/build-and-push-embedr-aws.yaml

@@ -22,13 +22,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.USERNAME}}
@@ -36,7 +36,7 @@ jobs:
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -45,7 +45,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/build-and-push-link-aws.yaml

@@ -22,13 +22,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.USERNAME}}
@@ -36,7 +36,7 @@ jobs:
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -45,7 +45,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           push: true

.github/workflows/build-and-push-ogcard-aws.yaml

@@ -22,13 +22,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.USERNAME}}
@@ -36,7 +36,7 @@ jobs:
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -45,7 +45,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           push: true

.github/workflows/build-submit-android.yml

@@ -10,6 +10,48 @@ on:
         options:
           - testflight-android
           - production
+  workflow_call:
+    inputs:
+      profile:
+        type: string
+        description: Build profile to use
+        required: true
+    outputs:
+      package-version:
+        description: Version from package.json
+        value: ${{ jobs.build.outputs.package-version }}
+      version-code:
+        description: Android version code
+        value: ${{ jobs.build.outputs.version-code }}
+    secrets:
+      EXPO_TOKEN:
+        required: true
+      ENV_TOKEN:
+        required: true
+      SENTRY_DSN:
+        required: true
+      BITDRIFT_API_KEY:
+        required: true
+      EXPO_PUBLIC_GCP_PROJECT_ID:
+        required: true
+      GOOGLE_SERVICES_TOKEN:
+        required: true
+      SENTRY_AUTH_TOKEN:
+        required: true
+      SLACK_CLIENT_ALERT_WEBHOOK:
+        required: true
+      ANDROID_KEYSTORE_BASE64:
+        required: true
+      ANDROID_KEYSTORE_PASSWORD:
+        required: true
+      ANDROID_KEY_ALIAS:
+        required: true
+      ANDROID_KEY_PASSWORD:
+        required: true
+
+# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
+permissions:
+  contents: read
 
 jobs:
   build:
@@ -19,6 +61,10 @@ jobs:
     concurrency:
       group: android-build
       cancel-in-progress: false
+    outputs:
+      package-version: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
+      version-code: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}
+      apk-artifact-name: build-${{ steps.timestamp.outputs.time }}.apk
     steps:
       - name: Check for EXPO_TOKEN
         run: >
@@ -28,32 +74,32 @@ jobs:
           fi
 
       - name: ⬇️ Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 5
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: package.json
           cache: pnpm
 
       - name: 🪛 Setup jq
-        uses: dcarbone/install-jq-action@v2
+        uses: dcarbone/install-jq-action@4fcb5062d7ce9bc4382d1a352d19ba3ba2c317c1 # v4.0.1
 
       - name: ⚙️ Install dependencies
         run: pnpm install --frozen-lockfile
 
       - name: 🔨 Setup Expo CLI
-        uses: expo/expo-github-action@v9
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
         with:
           eas-version: '19.0.5'
           packager: 'pnpm --allow-build=dtrace-provider'
           token: ${{ secrets.EXPO_TOKEN }}
 
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
         with:
           distribution: "temurin"
           java-version: "17"
@@ -62,7 +108,8 @@ jobs:
         run: pnpm intl:build 2>&1 | tee i18n.log
 
       - name: Check for i18n compilation errors
-        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
+        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation
+          errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
 
       # EXPO_PUBLIC_ENV is handled in eas.json
       - name: Env
@@ -92,99 +139,76 @@ jobs:
           --profile $PROFILE
           --local --output build.aab --non-interactive
 
-      - name: ✍️ Rename Testflight bundle
-        if: ${{ inputs.profile != 'production' }}
-        run: mv build.aab build.apk
-
-      - name: ⏰ Get a timestamp
-        id: timestamp
-        uses: nanzm/get-time-action@master
-        with:
-          format: "MM-DD-HH-mm-ss"
-
-      - name: 🚀 Upload Production Artifact
-        id: upload-artifact-production
-        if: ${{ inputs.profile == 'production' }}
-        uses: actions/upload-artifact@v7
-        with:
-          retention-days: 30
-          compression-level: 6
-          name: build-${{ steps.timestamp.outputs.time }}.aab
-          path: build.aab
-
-      - name: 🚀 Upload Testflight Artifact
-        id: upload-artifact-testflight
-        if: ${{ inputs.profile != 'production' }}
-        uses: actions/upload-artifact@v7
-        with:
-          retention-days: 30
-          compression-level: 6
-          name: build-${{ steps.timestamp.outputs.time }}.apk
-          path: build.apk
-
       - name: 📚 Get version from package.json
         id: get-build-info
         run: bash scripts/setGitHubOutput.sh
 
-      - name: 🔔 Notify Slack of Production Build
+      - name: 🚀 Submit to Google Play
+        env:
+          PROFILE: ${{ inputs.profile || 'testflight-android' }}
+        run: pnpm eas submit -p android --profile $PROFILE --non-interactive --path build.aab
+
+      - name: 🔔 Notify Slack of Play Store Submission
         if: ${{ inputs.profile == 'production' }}
-        uses: slackapi/slack-github-action@v3.0.3
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
         with:
           webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
           webhook-type: incoming-webhook
           payload-templated: true
           payload: |
-            {"text": "Android production build for Google Play Store submission is ready!\n```Artifact: ${{ steps.upload-artifact-production.outputs.artifact-url }}\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}```"}
+            {"text": "Android ${{ inputs.profile || 'testflight-android' }} build submitted to Google Play!\n```Version Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}```"}
 
-      - name: 🔔 Notify Slack of Testflight Build
-        if: ${{ inputs.profile != 'production' }}
-        uses: slackapi/slack-github-action@v3.0.3
+      - name: 🔧 Setup bundletool
+        uses: amyu/setup-bundletool@cc2e1857284660bd625e43f2c8a45626f034302f # v1.1
         with:
-          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-          webhook-type: incoming-webhook
-          payload-templated: true
-          payload: |
-            {"text": "Android build is ready for testing. Download the artifact here: ${{ steps.upload-artifact-testflight.outputs.artifact-url }}"}
+          version: "1.18.3"
 
-      - name: 🧹 Clear Metro cache
-        if: ${{ inputs.profile == 'production' }}
-        # https://github.com/expo/eas-cli/issues/2959#issuecomment-2749791326
-        run: rm -rf ${TMPDIR:-/tmp}/metro-cache
+      - name: 🔑 Decode keystore
+        run: echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 --decode >
+          keystore.jks
 
-      - name: 🏗️ Build Production APK
-        if: ${{ inputs.profile == 'production' }}
-        run: >
-          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
-          pnpm use-build-number-with-bump
-          pnpm eas build -p android
-          --profile production-apk
-          --local --output build.apk --non-interactive
+      - name: 📦 Build signed universal APK
+        run: |
+          bundletool build-apks \
+            --bundle=build.aab \
+            --output=universal.apks \
+            --mode=universal \
+            --ks=keystore.jks \
+            --ks-pass=pass:${{ secrets.ANDROID_KEYSTORE_PASSWORD }} \
+            --ks-key-alias=${{ secrets.ANDROID_KEY_ALIAS }} \
+            --key-pass=pass:${{ secrets.ANDROID_KEY_PASSWORD }}
 
-      - name: 🚀 Upload Production APK Artifact
-        id: upload-artifact-production-apk
-        if: ${{ inputs.profile == 'production' }}
-        uses: actions/upload-artifact@v7
+      - name: 📋 Rename to .zip for extraction
+        run: mv universal.apks universal.zip
+
+      - name: 📦 Extract universal APK
+        run: unzip -p universal.zip universal.apk > build.apk
+
+      - name: ⏰ Get a timestamp
+        id: timestamp
+        run: echo "time=$(date -u +'%m-%d-%H-%M-%S')" >> "$GITHUB_OUTPUT"
+
+      - name: 🚀 Upload APK Artifact
+        id: upload-artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           retention-days: 30
           compression-level: 6
           name: build-${{ steps.timestamp.outputs.time }}.apk
           path: build.apk
 
-      - name: 🔔 Notify Slack of Production APK Build
-        if: ${{ inputs.profile == 'production' }}
-        uses: slackapi/slack-github-action@v3.0.3
+      - name: 🔔 Notify Slack of APK Artifact
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
         with:
           webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
           webhook-type: incoming-webhook
           payload-templated: true
           payload: |
-            {"text": "Android production build for GitHub/Obtanium is ready!\n```Artifact: ${{ steps.upload-artifact-production-apk.outputs.artifact-url }}\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}```"}
+            {"text": "Android ${{ inputs.profile || 'testflight-android' }} APK is ready for testing!\n```Artifact: ${{ steps.upload-artifact.outputs.artifact-url }}\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}```"}
 
       - name: ⬇️ Restore Cache
         id: get-base-commit
-        uses: actions/cache@v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ inputs.profile == 'testflight-android' }}
         with:
           path: most-recent-testflight-commit.txt
@@ -195,3 +219,65 @@ jobs:
         env:
           GITHUB_SHA: ${{ github.sha }}
         run: echo $GITHUB_SHA > most-recent-testflight-commit.txt
+
+  # Releases are cut from tags named after the version (e.g. "1.124.0"), so when a production
+  # build is dispatched against such a tag we attach the APK to the matching release. This runs
+  # as a separate job so that `contents: write` is isolated here and the build job stays read-only.
+  attachToRelease:
+    name: Attach APK to GitHub Release
+    runs-on: ubuntu-latest
+    needs: [build]
+    if: ${{ inputs.profile == 'production' && github.ref_type == 'tag' && github.repository == 'bluesky-social/social-app' }}
+    permissions:
+      contents: write
+    steps:
+      # We only attach to a release that already exists — never create one.
+      - name: 🔎 Check for matching GitHub Release
+        id: release-check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          status=$(curl -sS -o /dev/null -w '%{http_code}' \
+            -H "Authorization: Bearer $GH_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}")
+          if [ "$status" = "200" ]; then
+            echo "Found GitHub Release for tag $TAG"
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "No GitHub Release found for tag $TAG (HTTP $status); skipping APK attachment."
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: ⬇️ Download APK artifact
+        if: ${{ steps.release-check.outputs.exists == 'true' }}
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ${{ needs.build.outputs.apk-artifact-name }}
+
+      - name: 🏷️ Rename APK for release
+        if: ${{ steps.release-check.outputs.exists == 'true' }}
+        run: cp build.apk "Bluesky-${{ needs.build.outputs.package-version }}.apk"
+
+      - name: 📎 Attach APK to GitHub Release
+        id: attach
+        if: ${{ steps.release-check.outputs.exists == 'true' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+          APK: Bluesky-${{ needs.build.outputs.package-version }}.apk
+        run: |
+          gh release upload "$TAG" "$APK" --clobber
+          url=$(gh release view "$TAG" --json url --jq .url)
+          echo "url=$url" >> "$GITHUB_OUTPUT"
+
+      - name: 🔔 Notify Slack of Release Attachment
+        if: ${{ steps.release-check.outputs.exists == 'true' }}
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
+        with:
+          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload-templated: true
+          payload: |
+            {"text": "Android APK attached to GitHub Release ${{ github.ref_name }}!\n```Asset: Bluesky-${{ needs.build.outputs.package-version }}.apk\nRelease: ${{ steps.attach.outputs.url }}```"}

.github/workflows/build-submit-ios.yml

@@ -10,6 +10,58 @@ on:
         options:
           - testflight
           - production
+      testFlightGroup:
+        type: choice
+        description: TestFlight group to assign the build to after submitting
+        options:
+          - none
+          - QA Team
+          - Software Mansion
+        default: none
+  workflow_call:
+    inputs:
+      profile:
+        type: string
+        description: Build profile to use
+        required: true
+      testFlightGroup:
+        type: string
+        description: TestFlight group to assign the build to after submitting ("none" to skip)
+        default: none
+    outputs:
+      package-version:
+        description: Version from package.json
+        value: ${{ jobs.build.outputs.package-version }}
+      build-number:
+        description: iOS build number
+        value: ${{ jobs.build.outputs.build-number }}
+    secrets:
+      EXPO_TOKEN:
+        required: true
+      ENV_TOKEN:
+        required: true
+      SENTRY_DSN:
+        required: true
+      BITDRIFT_API_KEY:
+        required: true
+      EXPO_PUBLIC_GCP_PROJECT_ID:
+        required: true
+      GOOGLE_SERVICES_TOKEN:
+        required: true
+      SENTRY_AUTH_TOKEN:
+        required: true
+      ASC_KEY_ID:
+        required: true
+      ASC_ISSUER_ID:
+        required: true
+      ASC_KEY_P8_BASE64:
+        required: true
+      SLACK_CLIENT_ALERT_WEBHOOK:
+        required: true
+
+# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
+permissions:
+  contents: read
 
 jobs:
   build:
@@ -19,6 +71,9 @@ jobs:
     concurrency:
       group: ios-build
       cancel-in-progress: false
+    outputs:
+      package-version: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
+      build-number: ${{ steps.ipa-build-number.outputs.build-number }}
     steps:
       - name: Check for EXPO_TOKEN
         run: >
@@ -28,42 +83,48 @@ jobs:
           fi
 
       - name: ⬇️ Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 5
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: package.json
           cache: pnpm
 
       - name: 🪛 Setup jq
-        uses: dcarbone/install-jq-action@v2
+        uses: dcarbone/install-jq-action@4fcb5062d7ce9bc4382d1a352d19ba3ba2c317c1 # v4.0.1
 
       - name: ⚙️ Install dependencies
         run: pnpm install --frozen-lockfile
 
       - name: 🔨 Setup Expo CLI
-        uses: expo/expo-github-action@v9
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
         with:
           eas-version: '19.0.5'
           packager: 'pnpm --allow-build=dtrace-provider'
           token: ${{ secrets.EXPO_TOKEN }}
 
-      - uses: maxim-lobanov/setup-xcode@v1
+      - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
         with:
           xcode-version: "26.4"
 
-      - name: ☕️ Setup Cocoapods
-        uses: maxim-lobanov/setup-cocoapods@v1
-        with:
-          version: 1.16.2
+      - name: ☕️ Assert Cocoapods version
+        run: |
+          EXPECTED=1.16.2
+          ACTUAL=$(pod --version)
+          if [ "$ACTUAL" != "$EXPECTED" ]; then
+            echo "Expected Cocoapods $EXPECTED but runner has $ACTUAL."
+            echo "The version ships preinstalled with the macOS runner image: https://github.com/actions/runner-images/blob/main/images/macos/macos-26-Readme.md"
+            echo "If the runner image changed, update EXPECTED here or reinstall the pinned version."
+            exit 1
+          fi
 
       - name: 💾 Cache Pods
-        uses: actions/cache@v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: pods-cache
         with:
           path: ./ios/Pods
@@ -75,7 +136,8 @@ jobs:
         run: pnpm intl:build 2>&1 | tee i18n.log
 
       - name: Check for i18n compilation errors
-        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
+        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation
+          errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
 
       # EXPO_PUBLIC_ENV is handled in eas.json
       - name: ✏️ Write environment variables
@@ -153,19 +215,76 @@ jobs:
         id: get-build-info
         run: bash scripts/setGitHubOutput.sh
 
+      # Read the build number straight from the IPA's CFBundleVersion. This is the value
+      # baked in at build time by use-build-number-with-bump (remote counter + 1) and the
+      # number that actually lands in App Store Connect. `eas build:version:get` reads the
+      # remote counter, which a --local build does not advance, so it can be off by one —
+      # using it here would make distribute_only poll for a nonexistent build.
+      - name: 🔢 Read build number from IPA
+        id: ipa-build-number
+        run: |
+          plist_dir="$(mktemp -d)"
+          unzip -o -q "$BUILD_DIR/Bluesky.ipa" 'Payload/*.app/Info.plist' -d "$plist_dir"
+          plist="$(find "$plist_dir" -name Info.plist -print -quit)"
+          build_number="$(/usr/libexec/PlistBuddy -c 'Print CFBundleVersion' "$plist")"
+          rm -rf "$plist_dir"
+          if [ -z "$build_number" ]; then
+            echo "ERROR: could not read CFBundleVersion from IPA"
+            exit 1
+          fi
+          echo "IPA build number: $build_number"
+          echo "build-number=$build_number" >> "$GITHUB_OUTPUT"
+
+      # eas submit only uploads to App Store Connect; it can't assign a build to a
+      # TestFlight group. fastlane's distribute_only mode skips the upload and assigns the
+      # already-submitted build to the group, polling until Apple finishes processing it.
+      - name: 🧪 Assign build to TestFlight group
+        if: ${{ inputs.testFlightGroup != 'none' }}
+        env:
+          TESTFLIGHT_GROUP: ${{ inputs.testFlightGroup }}
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+          ASC_KEY_P8_BASE64: ${{ secrets.ASC_KEY_P8_BASE64 }}
+          APP_VERSION: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
+          BUILD_NUMBER: ${{ steps.ipa-build-number.outputs.build-number }}
+        run: |
+          # Ensure the API key material is removed even if fastlane exits non-zero
+          # (the step runs under `bash -e`, which would otherwise abort before cleanup).
+          trap 'rm -f asc_api_key.json' EXIT
+          # fastlane's Token.from_json_file expects the .p8 contents inline under "key"
+          # (PEM with embedded newlines), not a path. jq handles the newline escaping.
+          key_content="$(echo "$ASC_KEY_P8_BASE64" | base64 --decode)"
+          jq -n \
+            --arg key_id "$ASC_KEY_ID" \
+            --arg issuer_id "$ASC_ISSUER_ID" \
+            --arg key "$key_content" \
+            '{key_id: $key_id, issuer_id: $issuer_id, key: $key, in_house: false}' \
+            > asc_api_key.json
+          # app_platform is required in non-interactive mode: distribute_only otherwise
+          # calls fetch_app_platform, which prompts for input and crashes without a TTY.
+          fastlane run upload_to_testflight \
+            api_key_path:"$PWD/asc_api_key.json" \
+            distribute_only:true \
+            app_platform:"ios" \
+            app_identifier:"xyz.blueskyweb.app" \
+            app_version:"$APP_VERSION" \
+            build_number:"$BUILD_NUMBER" \
+            groups:"$TESTFLIGHT_GROUP" \
+            notify_external_testers:true
+
       - name: 🔔 Notify Slack of Production Build
         if: ${{ inputs.profile == 'production' }}
-        uses: slackapi/slack-github-action@v3.0.3
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
         with:
           webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
           webhook-type: incoming-webhook
           payload-templated: true
           payload: |
-            {"text": "iOS production build for App Store submission is ready!\n```Artifact: Check TestFlight to know when it is available\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_IOS_BUILD_NUMBER }}```"}
+            {"text": "iOS production build for App Store submission is ready!\n```Artifact: Check TestFlight to know when it is available\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.ipa-build-number.outputs.build-number }}```"}
 
       - name: ⬇️ Restore Cache
         id: get-base-commit
-        uses: actions/cache@v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ inputs.profile == 'testflight' }}
         with:
           path: most-recent-testflight-commit.txt

.github/workflows/bundle-deploy-eas-update.yml

@@ -18,6 +18,10 @@ on:
         description: Runtime version (in x.x.x format) that this update is for
         required: true
 
+# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
+permissions:
+  contents: read
+
 jobs:
   bundleDeploy:
     if: github.repository == 'bluesky-social/social-app'
@@ -27,7 +31,9 @@ jobs:
       group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}-deploy
       cancel-in-progress: true
     outputs:
-      changes-detected: ${{ steps.fingerprint.outputs.includes-changes }}
+      # A version bump forces a native build even if the fingerprint is unchanged
+      changes-detected: ${{ steps.fingerprint.outputs.includes-changes ||
+        steps.version.outputs.version-changed }}
 
     steps:
       - name: Check for EXPO_TOKEN
@@ -48,7 +54,7 @@ jobs:
           fi
 
       - name: ⬇️ Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
@@ -56,17 +62,38 @@ jobs:
         if: ${{ github.ref != 'refs/heads/main' }}
         run: git fetch origin main:main --depth 100
 
-      - uses: pnpm/action-setup@v6
+      # A change to the version in package.json means a new native release, so
+      # an OTA update must not be deployed and full native builds are required
+      # regardless of what the fingerprint says
+      - name: 🔢 Check for version change
+        id: version
+        if: ${{ github.event_name == 'push' }}
+        env:
+          EVENT_BEFORE: ${{ github.event.before }}
+        run: |
+          CURRENT_VERSION=$(jq -r '.version' package.json)
+          if [ -n "$EVENT_BEFORE" ] && [[ ! "$EVENT_BEFORE" =~ ^0+$ ]] && git cat-file -e "$EVENT_BEFORE:package.json" 2>/dev/null; then
+            PREVIOUS_VERSION=$(git show "$EVENT_BEFORE:package.json" | jq -r '.version')
+          else
+            PREVIOUS_VERSION=$(git show HEAD~1:package.json | jq -r '.version')
+          fi
+          echo "Previous version: $PREVIOUS_VERSION, current version: $CURRENT_VERSION"
+          if [ "$CURRENT_VERSION" != "$PREVIOUS_VERSION" ]; then
+            echo "Version changed, full native builds are required"
+            echo "version-changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: package.json
           cache: pnpm
 
       - name: 📷 Check fingerprint and install dependencies
         id: fingerprint
-        uses: bluesky-social/github-actions/fingerprint-native@main
+        uses: bluesky-social/github-actions/fingerprint-native@b5556913e4aef3964cfd5936d0add3fc0d809bdb # v0.2.0
         with:
           profile: ${{ inputs.channel || 'testflight' }}
           previous-commit-tag: ${{ inputs.runtimeVersion }}
@@ -75,7 +102,8 @@ jobs:
         run: pnpm intl:build 2>&1 | tee i18n.log
 
       - name: Check for i18n compilation errors
-        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
+        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation
+          errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
 
       - name: Lint check
         run: pnpm lint
@@ -87,16 +115,18 @@ jobs:
         run: pnpm typecheck
 
       - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@v9
-        if: ${{ !steps.fingerprint.outputs.includes-changes }}
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
+        if: ${{ !steps.fingerprint.outputs.includes-changes &&
+          !steps.version.outputs.version-changed }}
         with:
           eas-version: '19.0.5'
           packager: 'pnpm --allow-build=dtrace-provider'
           token: ${{ secrets.EXPO_TOKEN }}
 
       - name: 🪛 Setup jq
-        if: ${{ !steps.fingerprint.outputs.includes-changes }}
-        uses: dcarbone/install-jq-action@v2
+        if: ${{ !steps.fingerprint.outputs.includes-changes &&
+          !steps.version.outputs.version-changed }}
+        uses: dcarbone/install-jq-action@4fcb5062d7ce9bc4382d1a352d19ba3ba2c317c1 # v4.0.1
 
       # eas.json not used here, set EXPO_PUBLIC_ENV
       - name: Env
@@ -104,7 +134,8 @@ jobs:
           CHANNEL: ${{ inputs.channel || 'testflight' }}
           GITHUB_SHA: ${{ github.sha }}
         id: env
-        if: ${{ !steps.fingerprint.outputs.includes-changes }}
+        if: ${{ !steps.fingerprint.outputs.includes-changes &&
+          !steps.version.outputs.version-changed }}
         run: |
           export json='${{ secrets.GOOGLE_SERVICES_TOKEN }}'
           echo "${{ secrets.ENV_TOKEN }}" > .env
@@ -120,7 +151,8 @@ jobs:
           echo "$json" > google-services.json
 
       - name: 🏗️ Create Bundle
-        if: ${{ !steps.fingerprint.outputs.includes-changes }}
+        if: ${{ !steps.fingerprint.outputs.includes-changes &&
+          !steps.version.outputs.version-changed }}
         run: >
           SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
           SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
@@ -128,7 +160,8 @@ jobs:
           pnpm export
 
       - name: 📦 Package Bundle and 🚀 Deploy
-        if: ${{ !steps.fingerprint.outputs.includes-changes }}
+        if: ${{ !steps.fingerprint.outputs.includes-changes &&
+          !steps.version.outputs.version-changed }}
         run: pnpm use-build-number bash scripts/bundleUpdate.sh
         env:
           DENIS_API_KEY: ${{ secrets.DENIS_API_KEY }}
@@ -137,14 +170,16 @@ jobs:
 
       - name: ⬇️ Restore Cache
         id: get-base-commit
-        uses: actions/cache@v5
-        if: ${{ !steps.fingerprint.outputs.includes-changes }}
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        if: ${{ !steps.fingerprint.outputs.includes-changes &&
+          !steps.version.outputs.version-changed }}
         with:
           path: most-recent-testflight-commit.txt
           key: most-recent-testflight-commit
 
       - name: ✏️ Write commit hash to cache
-        if: ${{ !steps.fingerprint.outputs.includes-changes }}
+        if: ${{ !steps.fingerprint.outputs.includes-changes &&
+          !steps.version.outputs.version-changed }}
         run: echo $GITHUB_SHA > most-recent-testflight-commit.txt
 
   # GitHub actions are horrible so let's just copy paste this in
@@ -157,7 +192,9 @@ jobs:
     needs: [bundleDeploy]
     # Gotta check if its NOT '[]' because any md5 hash in the outputs is detected as a possible secret and won't be
     # available here
-    if: ${{ inputs.channel != 'production' && needs.bundleDeploy.outputs.changes-detected && github.repository == 'bluesky-social/social-app' }}
+    if: ${{ inputs.channel != 'production' &&
+      needs.bundleDeploy.outputs.changes-detected && github.repository ==
+      'bluesky-social/social-app' }}
     steps:
       - name: Check for EXPO_TOKEN
         run: >
@@ -167,20 +204,20 @@ jobs:
           fi
 
       - name: ⬇️ Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 5
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: package.json
           cache: pnpm
 
       - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@v9
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
         with:
           eas-version: '19.0.5'
           packager: 'pnpm --allow-build=dtrace-provider'
@@ -189,17 +226,23 @@ jobs:
       - name: ⚙️ Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - uses: maxim-lobanov/setup-xcode@v1
+      - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
         with:
           xcode-version: "26.4"
 
-      - name: ☕️ Setup Cocoapods
-        uses: maxim-lobanov/setup-cocoapods@v1
-        with:
-          version: 1.16.2
+      - name: ☕️ Assert Cocoapods version
+        run: |
+          EXPECTED=1.16.2
+          ACTUAL=$(pod --version)
+          if [ "$ACTUAL" != "$EXPECTED" ]; then
+            echo "Expected Cocoapods $EXPECTED but runner has $ACTUAL."
+            echo "The version ships preinstalled with the macOS runner image: https://github.com/actions/runner-images/blob/main/images/macos/macos-26-Readme.md"
+            echo "If the runner image changed, update EXPECTED here or reinstall the pinned version."
+            exit 1
+          fi
 
       - name: 💾 Cache Pods
-        uses: actions/cache@v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: pods-cache
         with:
           path: ./ios/Pods
@@ -282,7 +325,7 @@ jobs:
 
       - name: ⬇️ Restore Cache
         id: get-base-commit
-        uses: actions/cache@v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ inputs.channel == 'testflight' }}
         with:
           path: most-recent-testflight-commit.txt
@@ -303,7 +346,9 @@ jobs:
     needs: [bundleDeploy]
     # Gotta check if its NOT '[]' because any md5 hash in the outputs is detected as a possible secret and won't be
     # available here
-    if: ${{ inputs.channel != 'production' && needs.bundleDeploy.outputs.changes-detected && github.repository == 'bluesky-social/social-app'}}
+    if: ${{ inputs.channel != 'production' &&
+      needs.bundleDeploy.outputs.changes-detected && github.repository ==
+      'bluesky-social/social-app'}}
 
     steps:
       - name: Check for EXPO_TOKEN
@@ -314,26 +359,26 @@ jobs:
           fi
 
       - name: ⬇️ Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 5
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: package.json
           cache: pnpm
 
       - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@v9
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
         with:
           eas-version: '19.0.5'
           packager: 'pnpm --allow-build=dtrace-provider'
           token: ${{ secrets.EXPO_TOKEN }}
 
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
         with:
           distribution: "temurin"
           java-version: "17"
@@ -368,17 +413,49 @@ jobs:
           pnpm use-build-number-with-bump
           pnpm eas build -p android
           --profile testflight-android
-          --local --output build.apk --non-interactive
+          --local --output build.aab --non-interactive
+
+      - name: 📚 Get version from package.json
+        id: get-build-info
+        run: bash scripts/setGitHubOutput.sh
+
+      - name: 🚀 Submit to Google Play
+        run: pnpm eas submit -p android --profile testflight-android --non-interactive --path
+          build.aab
+
+      - name: 🔧 Setup bundletool
+        uses: amyu/setup-bundletool@cc2e1857284660bd625e43f2c8a45626f034302f # v1.1
+        with:
+          version: "1.18.3"
+
+      - name: 🔑 Decode keystore
+        run: echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 --decode >
+          keystore.jks
+
+      - name: 📦 Build signed universal APK
+        run: |
+          bundletool build-apks \
+            --bundle=build.aab \
+            --output=universal.apks \
+            --mode=universal \
+            --ks=keystore.jks \
+            --ks-pass=pass:${{ secrets.ANDROID_KEYSTORE_PASSWORD }} \
+            --ks-key-alias=${{ secrets.ANDROID_KEY_ALIAS }} \
+            --key-pass=pass:${{ secrets.ANDROID_KEY_PASSWORD }}
+
+      - name: 📋 Rename to .zip for extraction
+        run: mv universal.apks universal.zip
+
+      - name: 📦 Extract universal APK
+        run: unzip -p universal.zip universal.apk > build.apk
 
       - name: ⏰ Get a timestamp
         id: timestamp
-        uses: nanzm/get-time-action@master
-        with:
-          format: "MM-DD-HH-mm-ss"
+        run: echo "time=$(date -u +'%m-%d-%H-%M-%S')" >> "$GITHUB_OUTPUT"
 
       - name: 🚀 Upload Artifact
         id: upload-artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           retention-days: 30
           compression-level: 0
@@ -386,7 +463,7 @@ jobs:
           path: build.apk
 
       - name: 🔔 Notify Slack
-        uses: slackapi/slack-github-action@v3.0.3
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
         with:
           webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
           webhook-type: incoming-webhook
@@ -396,7 +473,7 @@ jobs:
 
       - name: ⬇️ Restore Cache
         id: get-base-commit
-        uses: actions/cache@v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ inputs.channel != 'testflight' && inputs.channel != 'production' }}
         with:
           path: most-recent-testflight-commit.txt

.github/workflows/claude-mention.yml

@@ -0,0 +1,76 @@
+name: claude-mention
+
+# @claude mention handler on PR conversation comments, inline review
+# comments, and review bodies. See the header comment in
+# claude-review.yml for why this is self-contained rather than calling
+# the org reusable workflows.
+#
+# Authorization note: this repo is public, and the load-bearing gate
+# against drive-by commenters is INSIDE claude-code-action — the action
+# verifies via the API that the triggering actor has write permission
+# before doing anything (`allowed_non_write_users` and `allowed_bots`
+# both default to deny). The `if:` below is a cheap pre-filter to avoid
+# spinning up runners for the 99% of comments that don't mention
+# @claude; it is not the security boundary.
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  pull_request_review:
+    types: [submitted]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+  actions: read
+  id-token: write
+
+jobs:
+  mention:
+    # Skip comments/reviews that don't mention @claude, non-PR issue
+    # comments, and events from claude[bot] itself (its review prose
+    # often quotes "@claude" and must not retrigger the workflow).
+    if: >
+      (
+        (github.event_name == 'issue_comment' &&
+          github.event.issue.pull_request != null &&
+          contains(github.event.comment.body, '@claude')) ||
+        (github.event_name == 'pull_request_review_comment' &&
+          contains(github.event.comment.body, '@claude')) ||
+        (github.event_name == 'pull_request_review' &&
+          contains(github.event.review.body, '@claude'))
+      ) &&
+      github.actor != 'claude[bot]'
+
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    concurrency:
+      group: claude-mention-${{ github.repository }}-${{ github.event.issue.number || github.event.pull_request.number }}
+      cancel-in-progress: false
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 1
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
+        with:
+          role-to-assume: ${{ secrets.AWS_BEDROCK_REVIEW_ROLE_ARN }}
+          aws-region: us-east-2
+
+      - name: Claude
+        uses: anthropics/claude-code-action@f87768c6d25f92ae6efa7175e223ef77d4cbf97f # v1.0.166
+        with:
+          use_bedrock: 'true'
+          additional_permissions: |
+            actions: read
+          track_progress: true
+          claude_args: |
+            --model global.anthropic.claude-opus-4-8
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__download_job_log,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"

.github/workflows/claude-review.yml

@@ -0,0 +1,68 @@
+name: claude-review
+
+# Automatic Claude review on PR creation/update, via Bedrock (OIDC, no
+# long-lived tokens). Self-contained: this intentionally uses upstream
+# claude-code-action defaults rather than the org reusable workflows in
+# bluesky-social/.github (which a public repo cannot call, and whose
+# customizations added no value over upstream).
+#
+# Review guidance lives in .github/claude-review-prompt.md.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: write
+  actions: read
+  id-token: write
+
+jobs:
+  review:
+    # Internal PRs only. This repo is public: fork PRs are the bulk of
+    # community traffic and MUST NOT trigger reviews (no Bedrock spend on
+    # unvetted code, and fork PRs can't mint the OIDC token anyway —
+    # belt-and-braces with this explicit guard). Branch PRs can only be
+    # created by people with write access, i.e. org members.
+    # Bot-authored PRs (dependabot, changesets) are also skipped.
+    if: >
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.type != 'Bot'
+
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    concurrency:
+      group: claude-review-${{ github.repository }}-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 1
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
+        with:
+          role-to-assume: ${{ secrets.AWS_BEDROCK_REVIEW_ROLE_ARN }}
+          aws-region: us-east-2
+
+      - name: Claude review
+        uses: anthropics/claude-code-action@f87768c6d25f92ae6efa7175e223ef77d4cbf97f # v1.0.166
+        with:
+          use_bedrock: 'true'
+          additional_permissions: |
+            actions: read
+          track_progress: true
+          claude_args: |
+            --model global.anthropic.claude-opus-4-8
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__download_job_log,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
+          prompt: |
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number }}
+
+            Read .github/claude-review-prompt.md in the checked-out repo
+            and review this pull request following its guidance.

.github/workflows/claude.yml

@@ -1,54 +0,0 @@
-name: Claude Code
-
-on:
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-  issues:
-    types: [opened, assigned]
-  pull_request_review:
-    types: [submitted]
-
-jobs:
-  claude:
-    if: |
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
-      issues: read
-      id-token: write
-      actions: read # Required for Claude to read CI results on PRs
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 1
-
-      - name: Run Claude Code
-        id: claude
-        uses: anthropics/claude-code-action@v1
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-
-          # This is an optional setting that allows Claude to read CI results on PRs
-          additional_permissions: |
-            actions: read
-
-          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
-          # prompt: 'Update the pull request description to include a summary of changes.'
-
-          # Optional: Add claude_args to customize behavior and configuration
-          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
-          # or https://code.claude.com/docs/en/cli-reference for available options
-          # claude_args: '--allowed-tools Bash(gh pr:*)'
-
-          # NOTE(sfn): we can add a custom system prompt here
-
-          claude_args: |
-            --model claude-opus-4-7

.github/workflows/golang-test-lint.yml

@@ -10,14 +10,17 @@ concurrency:
   group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build-and-test:
     runs-on: ubuntu-latest
     steps:
       - name: Git Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up Go tooling
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: bskyweb/go.mod
           cache-dependency-path: bskyweb/go.sum
@@ -33,9 +36,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Git Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up Go tooling
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: bskyweb/go.mod
           cache-dependency-path: bskyweb/go.sum

.github/workflows/lint.yml

@@ -24,7 +24,7 @@ jobs:
         job: [lint, prettier, typecheck]
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Verify Node version pins match package.json
         run: |
           set -euo pipefail
@@ -50,9 +50,9 @@ jobs:
           v=$(grep -oE '"node":[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+"' eas.json | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | sort -u)
           check "eas.json" "$v"
           exit $rc
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - name: Install node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: package.json
           cache: pnpm
@@ -87,10 +87,10 @@ jobs:
         shard: [1, 2, 3, 4]
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v5
-      - uses: pnpm/action-setup@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - name: Install node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: package.json
           cache: pnpm

.github/workflows/nightly-build.yml

@@ -0,0 +1,200 @@
+---
+name: Nightly Build
+
+on:
+  schedule:
+    - cron: "10 2 * * *" # run at 2:10 AM UTC, after the nightly i18n job
+  workflow_dispatch:
+
+# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
+permissions:
+  contents: read
+
+jobs:
+  # Generate the changelog once, shared by both platforms. The range covers commits since
+  # the previous nightly, whose commit SHA is stored as a "nightly-build-commit" artifact
+  # (advanced by the record job below, only after both builds succeed).
+  prepare:
+    name: Prepare release notes
+    if: github.repository == 'bluesky-social/social-app'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    outputs:
+      notes: ${{ steps.notes.outputs.notes }}
+    steps:
+      - name: ⬇️ Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - name: 📝 Generate release notes
+        id: notes
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Find the most recent non-expired nightly-build-commit artifact and read its SHA
+          # The artifacts API returns results newest-first, so the most recent marker is on
+          # page 1 — no --paginate needed (which would run the jq aggregation per page and
+          # could emit multiple URLs). Take the first non-expired match.
+          prev=""
+          url=$(gh api \
+            "repos/${GITHUB_REPOSITORY}/actions/artifacts?name=nightly-build-commit&per_page=100" \
+            --jq 'first(.artifacts[] | select(.expired == false)) | .archive_download_url' \
+            2>/dev/null || true)
+          if [ -n "$url" ] && [ "$url" != "null" ]; then
+            if curl -sSL -H "Authorization: Bearer $GH_TOKEN" -o marker.zip "$url" \
+              && unzip -o -q marker.zip; then
+              prev=$(cat nightly-build-commit.txt 2>/dev/null | tr -d '[:space:]')
+            fi
+            rm -f marker.zip nightly-build-commit.txt
+          fi
+
+          if [ -n "$prev" ] && git cat-file -e "${prev}^{commit}" 2>/dev/null; then
+            echo "Generating notes since previous nightly: $prev"
+            range="${prev}..HEAD"
+          else
+            echo "No reachable previous nightly commit; falling back to last 30 commits."
+            range="HEAD~30..HEAD"
+          fi
+          notes=$(git log --no-merges --pretty=format:'- %s' "$range" 2>/dev/null | head -n 50)
+          if [ -z "$notes" ]; then
+            notes="Nightly build — no new commits since the last nightly."
+          fi
+          # Cap the whole changelog to keep the Slack message a reasonable size.
+          # head -c caps the combined stream; cut -c would only cap each line independently.
+          notes=$(printf '%s' "$notes" | head -c 3900)
+          {
+            echo "notes<<NOTES_EOF"
+            echo "$notes"
+            echo "NOTES_EOF"
+          } >> "$GITHUB_OUTPUT"
+
+  ios:
+    name: Nightly iOS Build
+    needs: [prepare]
+    uses: ./.github/workflows/build-submit-ios.yml
+    with:
+      profile: testflight
+      testFlightGroup: "QA Team"
+    # Pass only the secrets the reusable workflow declares, rather than `secrets: inherit`,
+    # so the nightly build never hands the reusable workflow the entire repo secret store.
+    secrets:
+      EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+      ENV_TOKEN: ${{ secrets.ENV_TOKEN }}
+      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+      BITDRIFT_API_KEY: ${{ secrets.BITDRIFT_API_KEY }}
+      EXPO_PUBLIC_GCP_PROJECT_ID: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
+      GOOGLE_SERVICES_TOKEN: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
+      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+      ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+      ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+      ASC_KEY_P8_BASE64: ${{ secrets.ASC_KEY_P8_BASE64 }}
+      SLACK_CLIENT_ALERT_WEBHOOK: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+
+  android:
+    name: Nightly Android Build
+    needs: [prepare]
+    # build-submit-android.yml contains an attachToRelease job that requests contents: write.
+    # That job is skipped for nightly (it needs a production tag build), but GitHub statically
+    # validates the reusable-workflow permission ceiling, so the caller must grant it here.
+    permissions:
+      contents: write
+    uses: ./.github/workflows/build-submit-android.yml
+    with:
+      profile: testflight-android
+    # Pass only the secrets the reusable workflow declares, rather than `secrets: inherit`,
+    # so the nightly build never hands the reusable workflow the entire repo secret store.
+    secrets:
+      EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+      ENV_TOKEN: ${{ secrets.ENV_TOKEN }}
+      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+      BITDRIFT_API_KEY: ${{ secrets.BITDRIFT_API_KEY }}
+      EXPO_PUBLIC_GCP_PROJECT_ID: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
+      GOOGLE_SERVICES_TOKEN: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
+      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+      SLACK_CLIENT_ALERT_WEBHOOK: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+      ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+      ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+      ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+      ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+
+  notify-ios:
+    name: Notify Slack of iOS nightly
+    needs: [prepare, ios]
+    runs-on: ubuntu-latest
+    steps:
+      - name: 📝 Build Slack payload
+        id: payload
+        env:
+          NOTES: ${{ needs.prepare.outputs.notes }}
+          VERSION: ${{ needs.ios.outputs.package-version }}
+          BUILD_NUMBER: ${{ needs.ios.outputs.build-number }}
+        run: |
+          text="*Nightly iOS build available in TestFlight (QA Team)*
+          Version ${VERSION} (${BUILD_NUMBER})
+
+          ${NOTES}"
+          payload=$(jq -n --arg text "$text" '{text: $text}')
+          {
+            echo "payload<<PAYLOAD_EOF"
+            echo "$payload"
+            echo "PAYLOAD_EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: 🔔 Notify Slack
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
+        with:
+          webhook: ${{ secrets.NIGHTLY_BUILDS_SLACK_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload: ${{ steps.payload.outputs.payload }}
+
+  notify-android:
+    name: Notify Slack of Android nightly
+    needs: [prepare, android]
+    runs-on: ubuntu-latest
+    steps:
+      - name: 📝 Build Slack payload
+        id: payload
+        env:
+          NOTES: ${{ needs.prepare.outputs.notes }}
+          VERSION: ${{ needs.android.outputs.package-version }}
+          VERSION_CODE: ${{ needs.android.outputs.version-code }}
+        run: |
+          text="*Nightly Android build available (Internal track)*
+          Version ${VERSION} (${VERSION_CODE})
+
+          ${NOTES}"
+          payload=$(jq -n --arg text "$text" '{text: $text}')
+          {
+            echo "payload<<PAYLOAD_EOF"
+            echo "$payload"
+            echo "PAYLOAD_EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: 🔔 Notify Slack
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
+        with:
+          webhook: ${{ secrets.NIGHTLY_BUILDS_SLACK_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload: ${{ steps.payload.outputs.payload }}
+
+  # Advance the nightly marker only after both builds succeed, so a failed night's commits
+  # roll into the next successful nightly's notes rather than being silently dropped.
+  record:
+    name: Record nightly commit
+    needs: [ios, android]
+    runs-on: ubuntu-latest
+    steps:
+      - name: ✏️ Write nightly commit marker
+        env:
+          GITHUB_SHA: ${{ github.sha }}
+        run: echo "$GITHUB_SHA" > nightly-build-commit.txt
+
+      - name: 🚀 Upload nightly commit marker
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: nightly-build-commit
+          path: nightly-build-commit.txt
+          retention-days: 90

.github/workflows/nightly-update-source-languages.yaml

@@ -16,12 +16,12 @@ jobs:
 
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ssh-key: ${{secrets.GH_ACTION_DEPLOY_KEY}}
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - name: Install node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: package.json
           cache: pnpm
@@ -30,12 +30,12 @@ jobs:
       - name: Extract language strings
         run: pnpm intl:extract
       - name: Create commit
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
         with:
           commit_message: Nightly source-language update
           file_pattern: ./src/locale/locales/en/messages.po
       - name: Push source lang to Crowdin
-        uses: crowdin/github-action@v2
+        uses: crowdin/github-action@52aa776766211d83d975df51f3b9c53c2f8ba35f # v2.16.3
         with:
           upload_sources: true
           upload_sources_args: "-b main"

.github/workflows/pull-request-comment.yml

@@ -5,16 +5,15 @@ on:
   issue_comment:
     types: [created]
 
-# Permissiosn to make comments in the pull request
-permissions:
-  pull-requests: write
-  actions: write
-  contents: read
+# Permissions are granted per-job below; anything unlisted defaults to none
+permissions: {}
 
 jobs:
   handle-comment:
     if: github.event.issue.pull_request
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       should-deploy: ${{ steps.check-org.outputs.result }}
 
@@ -45,10 +44,10 @@ jobs:
             echo "mentioned=false" >> $GITHUB_OUTPUT
           fi
 
-      - name: Check organization membership
+      - name: Check commenter has write access
         if: steps.check-mention.outputs.mentioned == 'true'
         id: check-org
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             try {
@@ -72,13 +71,16 @@ jobs:
     runs-on: ubuntu-latest
     needs: [handle-comment]
     if: needs.handle-comment.outputs.should-deploy == 'true'
+    permissions:
+      contents: read
+      pull-requests: write
 
     steps:
       - name: Get PR HEAD SHA
         env:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
         id: pr-info
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const pr = await github.rest.pulls.get({
@@ -87,6 +89,16 @@ jobs:
               pull_number: process.env.ISSUE_NUMBER,
             });
 
+            // This workflow runs with repo secrets in scope, so never build
+            // code from a fork: the commenter authorizes the deploy, but a
+            // fork controls what code would run during it
+            const expected = `${context.repo.owner}/${context.repo.repo}`;
+            const head = pr.data.head.repo?.full_name;
+            if (head !== expected) {
+              core.setFailed(`OTA deploys are only allowed for branches in ${expected}, not forks (got ${head})`);
+              return;
+            }
+
             console.log(`PR HEAD SHA: ${pr.data.head.sha}`);
             console.log(`PR HEAD REF: ${pr.data.head.ref}`);
 
@@ -94,7 +106,7 @@ jobs:
             core.setOutput('head-ref', pr.data.head.ref);
 
       - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@v3
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         with:
           header: pull-request-eas-build-${{ steps.pr-info.outputs.head-sha }}
           number: ${{ github.event.issue.number }}
@@ -113,14 +125,14 @@ jobs:
           fi
 
       - name: ⬇️ Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ steps.pr-info.outputs.head-sha }}
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: package.json
           cache: pnpm
@@ -141,14 +153,14 @@ jobs:
         run: pnpm typecheck
 
       - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@v9
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
         with:
           eas-version: '19.0.5'
           packager: 'pnpm --allow-build=dtrace-provider'
           token: ${{ secrets.EXPO_TOKEN }}
 
       - name: 🪛 Setup jq
-        uses: dcarbone/install-jq-action@v2
+        uses: dcarbone/install-jq-action@4fcb5062d7ce9bc4382d1a352d19ba3ba2c317c1 # v4.0.1
 
       - name: Env
         id: env
@@ -181,7 +193,7 @@ jobs:
           RUNTIME_VERSION:
 
       - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@v3
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         env:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
         with:
@@ -198,7 +210,7 @@ jobs:
             *Generated by [PR labeler](https://github.com/expo/expo/actions/workflows/pr-labeler.yml) 🤖*
 
       - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@v3
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         if: failure()
         with:
           header: pull-request-eas-build-${{ steps.pr-info.outputs.head-sha }}

.github/workflows/pull-request-commit.yml

@@ -13,25 +13,28 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  pull-requests: write
-  actions: write
-  contents: read
+# Permissions are granted per-job below; anything unlisted defaults to none.
+# pull-requests: write is needed by sticky-pull-request-comment to post the
+# bundle-size and fingerprint diffs
+permissions: {}
 
 jobs:
   webpack-analyzer:
     runs-on: ubuntu-22.04
     if: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event_name == 'pull_request'}}
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: ⬇️ Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: package.json
           cache: pnpm
@@ -68,7 +71,7 @@ jobs:
 
       - name: ⬇️ Get base stats from cache
         id: get-base-stats
-        uses: actions/cache@v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: stats-base.json
           key: stats-base-${{ steps.base-commit.outputs.base-commit }}
@@ -89,14 +92,14 @@ jobs:
 
       - name: ％ Get diff
         id: get-diff
-        uses: NejcZdovc/bundle-size-diff@v1
+        uses: NejcZdovc/bundle-size-diff@5321de41d2d62a7b0f4d6e60f59d1280a0034160 # v1.1.0
         with:
           base_path: "stats-base.json"
           pr_path: "../stats-new.json"
           excluded_assets: "(.+).chunk.js|(.+).js.map|(.+).json|(.+).png|(.+).svg|(.+).webp|(.+).jpg|(.+).ico"
 
       - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@v3
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         with:
           header: bundle-diff
           message: |
@@ -108,9 +111,12 @@ jobs:
   fingerprint-native:
     runs-on: ubuntu-22.04
     if: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event_name == 'pull_request'}}
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: ⬇️ Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 100
 
@@ -118,22 +124,23 @@ jobs:
         run: git fetch origin main:main --depth 100
         if: github.event_name == 'pull_request'
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: package.json
           cache: pnpm
 
       - name: 📷 Check fingerprint and install dependencies
         id: fingerprint
-        uses: bluesky-social/github-actions/fingerprint-native@main
+        timeout-minutes: 5
+        uses: bluesky-social/github-actions/fingerprint-native@b5556913e4aef3964cfd5936d0add3fc0d809bdb # v0.2.0
         with:
           profile: pull-request
 
       - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@v3
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         if: ${{ steps.fingerprint.outputs.includes-changes }}
         with:
           header: fingerprint-diff
@@ -151,8 +158,24 @@ jobs:
             *Generated by [PR labeler](https://github.com/expo/expo/actions/workflows/pr-labeler.yml) 🤖*
 
       - name: 💬 Delete comment
-        uses: marocchino/sticky-pull-request-comment@v3
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         if: ${{ !steps.fingerprint.outputs.includes-changes }}
         with:
           header: fingerprint-diff
           delete: true
+
+      - name: 🏷️ Label as fingerprint changed
+        if: ${{ steps.fingerprint.outputs.includes-changes }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          gh pr edit "$PR_NUMBER" --add-label "bot: fingerprint changed" || true
+
+      - name: 🏷️ Remove fingerprint changed label
+        if: ${{ !steps.fingerprint.outputs.includes-changes }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          gh pr edit "$PR_NUMBER" --remove-label "bot: fingerprint changed" || true

.github/workflows/sync-internal.yaml

@@ -4,28 +4,40 @@ on:
   push:
     branches: [main]
 
+# The push to the internal repo uses the app token below, not the GITHUB_TOKEN
+permissions:
+  contents: read
+
 jobs:
   sync:
     runs-on: ubuntu-latest
     if: github.repository == 'bluesky-social/social-app'
     steps:
       - name: Checkout public repo
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
+          # Don't persist the checkout auth header; the push below authenticates
+          # with the app token embedded in the remote URL instead
+          persist-credentials: false
       - name: Generate GitHub App Token
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ vars.SYNC_INTERNAL_APP_ID }}
           private-key: ${{ secrets.SYNC_INTERNAL_PK }}
           repositories: social-app-internal
+          # Scope the token down from the app's full installation permissions;
+          # pushing is the only thing this token is used for. The workflows
+          # permission is required because the sync includes files under
+          # .github/workflows/, which GitHub refuses to push without it.
+          permission-contents: write
+          permission-workflows: write
       - name: Push to internal repo
         env:
           TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           git config user.name "github-actions"
           git config user.email "test@users.noreply.github.com"
-          git config --unset-all http.https://github.com/.extraheader
           git remote add internal https://x-access-token:${TOKEN}@github.com/bluesky-social/social-app-internal.git
           git push internal main --force

.github/workflows/verify-pnpm-lock.yml

@@ -6,13 +6,16 @@ concurrency:
   group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   verify-pnpm-lock:
     name: No manual pnpm-lock.yaml edits
     runs-on: ubuntu-latest
     steps:
       - name: Check out PR HEAD
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
@@ -21,10 +24,10 @@ jobs:
           BASE_REF: ${{ github.base_ref }}
         run: git fetch origin $BASE_REF --depth=1
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
 
       - name: Install node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: package.json
 

.github/workflows/zizmor.yml

@@ -0,0 +1,37 @@
+name: Workflow security
+
+on:
+  push:
+    branches: [main]
+    paths: [".github/**"]
+  pull_request:
+    paths: [".github/**"]
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
+  cancel-in-progress: true
+
+# The github.token is only used by zizmor's online audits (read-only API calls)
+permissions:
+  contents: read
+
+jobs:
+  zizmor:
+    name: Audit workflows with zizmor
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        with:
+          # Annotate the PR directly instead of uploading SARIF to the
+          # security tab, and fail the check on any finding
+          advanced-security: false
+          annotations: true
+          # Low-confidence findings (e.g. artipacked on workflows that never
+          # push) are too noisy to gate CI on
+          min-confidence: medium

.gitignore

@@ -108,8 +108,8 @@ google-services.json
 # Performance results (Flashlight)
 .perf/
 
-# ESLint
-.eslintcache
+# Oxlint
+.oxlintcache
 
 # i18n
 src/locale/locales/_build/

.jscodeshift/repo/bsky-agent.js

@@ -0,0 +1,62 @@
+/**
+ * Codemod to replace BskyAgent with AtpAgent
+ *
+ * Before:
+ *   import {BskyAgent} from '@atproto/api`
+ *   BskyAgent.appLabelers.includes(labeler)
+ *
+ * After:
+ *   import {AtpAgent} from '@atproto/api`
+ *   AtpAgent.appLabelers.includes(labeler)
+ *
+ * Handles import specifiers, type annotations, static member access
+ * (BskyAgent.configure), `extends BskyAgent`, and `new BskyAgent()`. Whole
+ * identifiers only, so names like `OpaqueBskyAgent` are left untouched.
+ *
+ * Usage: jscodeshift -t .jscodeshift/repo/bsky-agent.js <file-path>
+ * Example: jscodeshift -t .jscodeshift/repo/bsky-agent.js src/lib/moderation.ts
+ */
+
+/* eslint-disable */
+
+export const parser = 'tsx'
+
+export default function transformer(file, api) {
+  const j = api.jscodeshift
+  const root = j(file.source)
+
+  // Replace every standalone `BskyAgent` identifier with `AtpAgent`. This
+  // covers imports, type references, member expressions, `extends`, and `new`.
+  root
+    .find(j.Identifier, {name: 'BskyAgent'})
+    .replaceWith(() => j.identifier('AtpAgent'))
+
+  // Renaming can leave a duplicate `AtpAgent` specifier on the @atproto/api
+  // import if the file already imported it. Dedupe by imported name, keeping
+  // the type-only modifier only if every duplicate was type-only.
+  root
+    .find(j.ImportDeclaration, {source: {value: '@atproto/api'}})
+    .forEach(path => {
+      const seen = new Map()
+      for (const spec of path.value.specifiers) {
+        if (spec.type !== 'ImportSpecifier') {
+          seen.set(Symbol(), spec)
+          continue
+        }
+        const name = spec.imported.name
+        const existing = seen.get(name)
+        if (!existing) {
+          seen.set(name, spec)
+        } else if (
+          existing.importKind === 'type' &&
+          spec.importKind !== 'type'
+        ) {
+          // Prefer the value (non-type) import if either usage needs it.
+          seen.set(name, spec)
+        }
+      }
+      path.value.specifiers = Array.from(seen.values())
+    })
+
+  return root.toSource()
+}

.nvmrc

@@ -1 +1 @@
-24.15.0
+24.18.0

.oxlintrc.json

@@ -0,0 +1,407 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": [
+    "typescript",
+    "react",
+    "import"
+  ],
+  "categories": {
+    "correctness": "off"
+  },
+  "options": {
+    "typeAware": true
+  },
+  "env": {
+    "builtin": true
+  },
+  "settings": {
+    "import-x/extensions": [
+      ".ts",
+      ".tsx",
+      ".cts",
+      ".mts",
+      ".js",
+      ".jsx",
+      ".cjs",
+      ".mjs"
+    ],
+    "import-x/external-module-folders": [
+      "node_modules",
+      "node_modules/@types"
+    ],
+    "import-x/parsers": {
+      "@typescript-eslint/parser": [
+        ".ts",
+        ".tsx",
+        ".cts",
+        ".mts"
+      ]
+    },
+    "import-x/resolver": {
+      "node": {
+        "extensions": [
+          ".js",
+          ".web.js",
+          ".ios.js",
+          ".android.js"
+        ]
+      }
+    }
+  },
+  "ignorePatterns": [
+    "**/__mocks__/*.ts",
+    "ios/**",
+    "android/**",
+    "coverage/**",
+    "*.lock",
+    ".husky/**",
+    "patches/**",
+    "*.html",
+    "bskyweb/**",
+    "bskyembed/**",
+    "bskyogcard/**",
+    "src/locale/locales/_build/**",
+    "src/locale/locales/**/*.js",
+    "*.e2e.ts",
+    "*.e2e.tsx",
+    "eslint.config.mjs",
+    ".jscodeshift/**"
+  ],
+  "rules": {
+    "constructor-super": "error",
+    "for-direction": "error",
+    "getter-return": "error",
+    "no-async-promise-executor": "error",
+    "no-case-declarations": "error",
+    "no-class-assign": "error",
+    "no-compare-neg-zero": "error",
+    "no-cond-assign": "error",
+    "no-const-assign": "error",
+    "no-constant-binary-expression": "error",
+    "no-constant-condition": "error",
+    "no-control-regex": "error",
+    "no-debugger": "error",
+    "no-delete-var": "error",
+    "no-dupe-class-members": "error",
+    "no-dupe-else-if": "error",
+    "no-dupe-keys": "error",
+    "no-duplicate-case": "error",
+    "no-empty": "error",
+    "no-empty-character-class": "error",
+    "no-empty-pattern": "error",
+    "no-empty-static-block": "error",
+    "no-ex-assign": "error",
+    "no-extra-boolean-cast": "error",
+    "no-fallthrough": "error",
+    "no-func-assign": "error",
+    "no-global-assign": "error",
+    "no-import-assign": "error",
+    "no-invalid-regexp": "error",
+    "no-irregular-whitespace": "error",
+    "no-loss-of-precision": "error",
+    "no-misleading-character-class": "error",
+    "no-new-native-nonconstructor": "error",
+    "no-nonoctal-decimal-escape": "error",
+    "no-obj-calls": "error",
+    "no-prototype-builtins": "error",
+    "no-redeclare": "error",
+    "no-regex-spaces": "error",
+    "no-self-assign": "error",
+    "no-setter-return": "error",
+    "no-shadow-restricted-names": "error",
+    "no-sparse-arrays": "error",
+    "no-this-before-super": "error",
+    "no-unexpected-multiline": "error",
+    "no-unreachable": "error",
+    "no-unsafe-finally": "error",
+    "no-unsafe-negation": "error",
+    "no-unsafe-optional-chaining": "error",
+    "no-unused-labels": "error",
+    "no-unused-private-class-members": "error",
+    "no-unused-vars": "error",
+    "no-useless-backreference": "error",
+    "no-useless-catch": "error",
+    "no-useless-escape": "error",
+    "no-with": "error",
+    "require-yield": "error",
+    "use-isnan": "error",
+    "valid-typeof": "error",
+    "no-array-constructor": "error",
+    "no-unused-expressions": "error",
+    "import/namespace": "off",
+    "import/default": "error",
+    "import/no-named-as-default": "warn",
+    "import/no-named-as-default-member": "warn",
+    "import/no-duplicates": "warn",
+    "react/rules-of-hooks": "error",
+    "react/exhaustive-deps": "warn",
+    "typescript/await-thenable": "error",
+    "typescript/ban-ts-comment": "error",
+    "typescript/no-array-delete": "error",
+    "typescript/no-base-to-string": "error",
+    "typescript/no-duplicate-enum-values": "error",
+    "typescript/no-duplicate-type-constituents": "error",
+    "typescript/no-empty-object-type": "error",
+    "typescript/no-explicit-any": "error",
+    "typescript/no-extra-non-null-assertion": "error",
+    "typescript/no-floating-promises": "error",
+    "typescript/no-for-in-array": "error",
+    "typescript/no-implied-eval": "error",
+    "typescript/no-misused-new": "error",
+    "typescript/no-misused-promises": "error",
+    "typescript/no-namespace": "error",
+    "typescript/no-non-null-asserted-optional-chain": "error",
+    "typescript/no-redundant-type-constituents": "error",
+    "typescript/no-require-imports": "error",
+    "typescript/no-this-alias": "error",
+    "typescript/no-unnecessary-type-assertion": "error",
+    "typescript/no-unnecessary-type-constraint": "error",
+    "typescript/no-unsafe-argument": "error",
+    "typescript/no-unsafe-assignment": "error",
+    "typescript/no-unsafe-call": "error",
+    "typescript/no-unsafe-declaration-merging": "error",
+    "typescript/no-unsafe-enum-comparison": "error",
+    "typescript/no-unsafe-function-type": "error",
+    "typescript/no-unsafe-member-access": "error",
+    "typescript/no-unsafe-return": "error",
+    "typescript/no-unsafe-unary-minus": "error",
+    "typescript/no-wrapper-object-types": "error",
+    "typescript/only-throw-error": "error",
+    "typescript/prefer-as-const": "error",
+    "typescript/prefer-namespace-keyword": "error",
+    "typescript/prefer-promise-reject-errors": "error",
+    "typescript/require-await": "error",
+    "typescript/restrict-plus-operands": "error",
+    "typescript/restrict-template-expressions": "error",
+    "typescript/triple-slash-reference": "error",
+    "typescript/unbound-method": "error"
+  },
+  "overrides": [
+    {
+      "files": [
+        "**/*.ts",
+        "**/*.tsx",
+        "**/*.mts",
+        "**/*.cts"
+      ],
+      "rules": {
+        "constructor-super": "off",
+        "getter-return": "off",
+        "no-class-assign": "off",
+        "no-const-assign": "off",
+        "no-dupe-class-members": "off",
+        "no-dupe-keys": "off",
+        "no-func-assign": "off",
+        "no-import-assign": "off",
+        "no-new-native-nonconstructor": "off",
+        "no-obj-calls": "off",
+        "no-redeclare": "off",
+        "no-setter-return": "off",
+        "no-this-before-super": "off",
+        "no-unreachable": "off",
+        "no-unsafe-negation": "off",
+        "no-var": "error",
+        "no-with": "off",
+        "prefer-const": "error",
+        "prefer-rest-params": "error",
+        "prefer-spread": "error"
+      }
+    },
+    {
+      "files": [
+        "**/*.{js,jsx,ts,tsx}"
+      ],
+      "rules": {
+        "bsky-internal/avoid-unwrapped-text": [
+          "error",
+          {
+            "impliedTextComponents": [
+              "H1",
+              "H2",
+              "H3",
+              "H4",
+              "H5",
+              "H6",
+              "P",
+              "Admonition",
+              "Admonition.Admonition",
+              "Toast.Action",
+              "AgeAssuranceAdmonition",
+              "Span",
+              "StackedButton"
+            ],
+            "impliedTextProps": [],
+            "suggestedTextWrappers": {
+              "Button": "ButtonText",
+              "ToggleButton.Button": "ToggleButton.ButtonText",
+              "SegmentedControl.Item": "SegmentedControl.ItemText"
+            }
+          }
+        ],
+        "bsky-internal/use-exact-imports": "error",
+        "bsky-internal/use-prefixed-imports": "error",
+        "bsky-internal/lingui-msg-rule": "error",
+        "react/display-name": "error",
+        "react/jsx-key": "error",
+        "react/jsx-no-comment-textnodes": "error",
+        "react/jsx-no-duplicate-props": "error",
+        "react/jsx-no-target-blank": "error",
+        "react/jsx-no-undef": "error",
+        "react/no-children-prop": "error",
+        "react/no-danger-with-children": "error",
+        "react/no-direct-mutation-state": "error",
+        "react/no-find-dom-node": "error",
+        "react/no-is-mounted": "error",
+        "react/no-render-return-value": "error",
+        "react/no-string-refs": "error",
+        "react/no-unescaped-entities": "off",
+        "react/no-unknown-property": "error",
+        "react/no-unsafe": "off",
+        "react/react-in-jsx-scope": "off",
+        "react/hook-use-state": "warn",
+        "react-native/no-inline-styles": "off",
+        "react-native-a11y/has-accessibility-hint": "error",
+        "react-native-a11y/has-accessibility-props": "error",
+        "react-native-a11y/has-valid-accessibility-actions": "error",
+        "react-native-a11y/has-valid-accessibility-component-type": "error",
+        "react-native-a11y/has-valid-accessibility-descriptors": "error",
+        "react-native-a11y/has-valid-accessibility-role": "error",
+        "react-native-a11y/has-valid-accessibility-state": "error",
+        "react-native-a11y/has-valid-accessibility-states": "error",
+        "react-native-a11y/has-valid-accessibility-traits": "error",
+        "react-native-a11y/has-valid-accessibility-value": "error",
+        "react-native-a11y/no-nested-touchables": "error",
+        "react-native-a11y/has-valid-accessibility-ignores-invert-colors": "error",
+        "react-native-a11y/has-valid-accessibility-live-region": "error",
+        "react-native-a11y/has-valid-important-for-accessibility": "error",
+        "react-compiler/react-compiler": "warn",
+        "simple-import-sort/imports": [
+          "error",
+          {
+            "groups": [
+              [
+                "^\\u0000"
+              ],
+              [
+                "^node:"
+              ],
+              [
+                "^(react\\/(.*)$)|^(react$)|^(react-native(.*)$)",
+                "^(expo(.*)$)|^(expo$)",
+                "^(?!(?:alf|components|lib|locale|logger|platform|screens|state|view)(?:$|\\/))@?\\w"
+              ],
+              [
+                "^(?:#\\/)?(?:lib|state|logger|platform|locale)(?:$|\\/)",
+                "^(?:#\\/)?view(?:$|\\/)",
+                "^(?:#\\/)?screens(?:$|\\/)",
+                "^(?:#\\/)?alf(?:$|\\/)",
+                "^(?:#\\/)?components(?:$|\\/)",
+                "^#\\/",
+                "^\\."
+              ],
+              [
+                "^"
+              ]
+            ]
+          }
+        ],
+        "simple-import-sort/exports": "error",
+        "no-unused-vars": [
+          "error",
+          {
+            "argsIgnorePattern": "^_",
+            "varsIgnorePattern": "^_.+",
+            "caughtErrors": "none",
+            "ignoreRestSiblings": true
+          }
+        ],
+        "no-restricted-imports": [
+          "error",
+          {
+            "paths": [
+              {
+                "name": "react",
+                "importNames": [
+                  "React",
+                  "default"
+                ],
+                "message": "React is already in the global type namespace. Use named imports for runtime modules."
+              }
+            ]
+          }
+        ],
+        "no-empty-pattern": "off",
+        "no-async-promise-executor": "off",
+        "no-constant-binary-expression": "warn",
+        "prefer-const": "off",
+        "no-empty": "off",
+        "no-unsafe-optional-chaining": "off",
+        "no-prototype-builtins": "off",
+        "no-var": "off",
+        "prefer-rest-params": "off",
+        "no-case-declarations": "off",
+        "no-irregular-whitespace": "off",
+        "no-useless-escape": "off",
+        "no-sparse-arrays": "off",
+        "no-fallthrough": "off",
+        "no-control-regex": "off",
+        "no-unused-expressions": [
+          "error",
+          {
+            "allowTernary": true
+          }
+        ],
+        "import/consistent-type-specifier-style": [
+          "warn",
+          "prefer-inline"
+        ],
+        "import/no-nodejs-modules": "error",
+        "typescript/consistent-type-imports": [
+          "warn",
+          {
+            "prefer": "type-imports",
+            "fixStyle": "inline-type-imports"
+          }
+        ],
+        "typescript/no-require-imports": "off",
+        "typescript/ban-ts-comment": "off",
+        "typescript/no-empty-object-type": "off",
+        "typescript/no-unsafe-function-type": "off",
+        "typescript/no-unsafe-assignment": "off",
+        "typescript/unbound-method": "off",
+        "typescript/no-unsafe-argument": "off",
+        "typescript/no-unsafe-return": "off"
+      },
+      "jsPlugins": [
+        "eslint-plugin-bsky-internal",
+        "eslint-plugin-react-native",
+        "eslint-plugin-react-native-a11y",
+        "eslint-plugin-react-compiler",
+        "eslint-plugin-simple-import-sort"
+      ],
+      "env": {
+        "es2026": true,
+        "browser": true,
+        "node": true
+      }
+    },
+    {
+      "files": [
+        "bskyogcard/**/*.{js,jsx,ts,tsx}",
+        "dev-env/**/*.{js,jsx,ts,tsx}"
+      ],
+      "rules": {
+        "import/no-nodejs-modules": "off"
+      }
+    },
+    {
+      "files": [
+        "**/__tests__/**/*.{js,jsx,ts,tsx}",
+        "**/*.test.{js,jsx,ts,tsx}"
+      ],
+      "env": {
+        "jest": true
+      }
+    }
+  ]
+}

CLAUDE.md

@@ -10,7 +10,7 @@ Bluesky Social is a cross-platform social media application built with React Nat
 
 - React 19.1
 - React Native 0.81 with Expo 54
-- TypeScript 6
+- TypeScript 7
 - React Navigation 7 for routing
 - TanStack Query (React Query) for data fetching
 - Lingui 5 for internationalization
@@ -30,8 +30,9 @@ pnpm ios                # Run on iOS
 # Testing & Quality
 # IMPORTANT: Always use these pnpm scripts, never call the underlying tools directly
 pnpm test               # Run Jest tests
-pnpm lint               # Run ESLint
+pnpm lint               # Run Oxlint
 pnpm typecheck          # Run TypeScript type checking
+pnpm prettier           # Run Prettier for code formatting
 
 # Internationalization
 # DO NOT run these commands - extraction and compilation are handled by CI
@@ -81,7 +82,7 @@ should go in `/screens` (not `/view/screens`) to encourage better organization
 and separation from legacy code.
 
 For complex screens that have specific components or data needs that _are not
-shared by other screens_, we encourage subdirectoreis within `/screens/<name>`
+shared by other screens_, we encourage subdirectories within `/screens/<name>`
 e.g. `/screens/ProfileScreen/ProfileScreen.tsx` and
 `/screens/ProfileScreen/components/`.
 
@@ -125,133 +126,88 @@ eventually.
 Typically JS style for variables, functions, etc. We use ProudCamelCase for
 components, and camelCase directories and files.
 
-When organizing new code, consider if it fits into a single file, or if it
-should be broken down into multiple files. For "macro" component cases, or
-things that live in `/features` or `/screens`, we often follow a pattern of
-having an `index.tsx` for the main component, and then co-locating related
-components, hooks, and utilities in the same directory. For example:
+For "macro" cases in `/features`, `/screens`, or `/components`, co-locate related
+code in a directory with an `index.tsx` main component plus sibling
+components/hooks/utils (e.g. `screens/ProfileScreen/index.tsx` +
+`screens/ProfileScreen/components/`). Keep related code together so it lives where
+someone would look for it. Don't overdo it: a component that fits in one file
+should just be `Component.tsx`, not `Component/index.tsx`.
 
-```
-src
-├── screens/
-│   ├── ProfileScreen/
-│   │   ├── index.tsx          # Main screen component
-│   │   ├── components/       # Sub-components used only by this screen
-```
+Platform-specific files are covered under "Platform-Specific Code" below.
 
-Similar patterns can be found in `/features` and `/components`. The idea here is
-to keep related code together and make it easier to navigate.
-
-You should ask yourself: if someone new was looking for the code related to this
-feature or screen, where would they expect to find it? Organizing code in a way
-that matches developer expectations can make the codebase much more
-approachable. Being able to say "Live Now stuff lives in `/features/liveNow`" is
-easier to understand than having it scattered across multiple directories.
-
-No need to go overboard with this. If a component or feature fits into a single
-file, there's no reason to have a `/Component/index.tsx` file when it could just
-be `/Component.tsx`. Use your judgment based on the complexity and amount of
-related code.
-
-#### Platform Specific Files
-
-We have conflicting patterns in the app for this. The preferred approach is to
-group platform-specific files into a directory as much as possible. For example,
-rather than having `Component.tsx`, `Component.web.tsx`, and
-`Component.native.tsx` in the same directory, we prefer to have a `Component/`
-directory with `index.tsx`, `index.web.tsx`, and `index.native.tsx`. This keeps
-related code together and gives us a better visual cue that there are probably
-other files contained within this "macro" feature, whereas `Component.tsx` on
-its own looks more like a single component file.
-
-### Documentation and Tests Within Features
+### Comments
 
 Comment code when necessary to explain the “why” behind something; avoid
 comments that simply describe the code. Avoid Unicode characters in comments,
 e.g., use `-` not `—`.
 
-For larger features or components, it's helpful to include a README.md file
-within the directory that explains the purpose of the feature, how it works, and
-any important implementation details. The `/Component/index.tsx` pattern lends
-itself well to this, since the `index.tsx` can be the main component file, and
-the `README.md` can provide documentation for the whole feature. This is
-optional, but can be a nice way to keep documentation close to the code it
-describes.
+Always use docblock (`/** */`) syntax for comments that document a type, type
+member, method, function, or variable. These are the comments a reader expects
+to find attached to a named declaration, and the docblock form makes that intent
+clear and surfaces nicely in editor tooltips.
 
-Similarly, if there are tests that are specific to a component or feature, it
-can be helpful to include them in the same directory, either as
-`Component.test.tsx` or in a `__tests__/` subdirectory. This keeps everything
-related to the component or feature in one place and makes it easier to find and
-maintain tests.
+```tsx
+type DateFieldProps = {
+  /**
+   * An empty string renders the placeholder and opens the picker at today (or
+   * maximumDate, if earlier).
+   */
+  value: string | Date
+}
+
+/**
+ * Date-only input. Accepts a string in the format YYYY-MM-DD, or a Date object.
+ */
+export function DateField() {}
+```
+
+More generally, any multiline comment should use the `/* */` block syntax rather
+than stacked `//` lines. Reserve `//` for short, single-line comments.
+
+```tsx
+/*
+ * The picker requires a valid date, so when value is empty we fall back to
+ * maximumDate (if set) or today.
+ */
+const fallbackDate = maximumDate ? toSimpleDateString(maximumDate) : today
+```
+
+### Documentation and Tests Within Features
+
+For larger features or components, co-locate documentation and tests with the
+code. A `README.md` in the directory (the `/Component/index.tsx` pattern lends
+itself well to this) can document the whole feature, and feature-specific tests
+belong alongside it as `Component.test.tsx` or in a `__tests__/` subdirectory.
+Both are optional.
 
 ## Styling System (ALF)
 
-ALF is the custom design system. It uses Tailwind-inspired naming with underscores instead of hyphens.
+ALF is the custom design system. Tailwind-inspired naming with underscores
+instead of hyphens. Static atoms (`atoms as a`) are theme-independent; theme
+atoms/palette come from `useTheme()` (`t.atoms.bg`, `t.palette.primary_500`).
+Style props take an array of atoms + theme atoms + raw styles.
 
-### Basic Usage
-
-Generally, order atoms by:
-
-- Flexbox configuration, e.g., `a.flex_row`
-- Spacing, e.g., `a.px_md`
-- Text styles, e.g., `a.font_bold`
-- Themes, e.g., `t.atoms.text`,
-- Raw styles, e.g., `{backgroundColor: t.palette.primary_500}`
+Order atoms by: flexbox (`a.flex_row`), spacing (`a.px_md`), text (`a.font_bold`),
+themes (`t.atoms.text`), then raw styles (`{backgroundColor: t.palette.primary_500}`).
 
 ```tsx
 import {atoms as a, useTheme} from '#/alf'
 
-function MyComponent() {
-  const t = useTheme()
-
-  return (
-    <View style={[a.flex_row, a.gap_md, a.p_lg, t.atoms.bg]}>
-      <Text style={[a.text_md, a.font_bold, t.atoms.text_contrast_high]}>Hello</Text>
-    </View>
-  )
-}
+const t = useTheme()
+<View style={[a.flex_row, a.gap_md, a.p_lg, t.atoms.bg]} />
 ```
 
 ### Key Concepts
 
-**Static Atoms** – Theme-independent styles imported from `atoms`:
+Static atoms live in `a.*` (e.g. `a.flex_row`, `a.p_md`, `a.rounded_md`,
+`a.text_lg`). Theme atoms/palette come from `useTheme()` (`t.atoms.bg`,
+`t.atoms.text`, `t.atoms.border_contrast_low`, `t.palette.primary_500`).
 
-```tsx
-import {atoms as a} from '#/alf'
-// a.flex_row, a.p_md, a.gap_sm, a.rounded_md, a.text_lg, etc.
-```
+**Platform utilities** (`import {web, native, ios, android, platform} from '#/alf'`)
+return conditional styles inline in a style array: `web({cursor: 'pointer'})`,
+`native({paddingBottom: 20})`, `platform({ios: {...}, android: {...}, web: {...}})`.
 
-**Theme Atoms** – Theme-dependent colors from `useTheme()`:
-
-```tsx
-const t = useTheme()
-// t.atoms.bg, t.atoms.text, t.atoms.border_contrast_low, etc.
-// t.palette.primary_500, t.palette.negative_400, etc.
-```
-
-**Platform Utilities** – For platform-specific styles:
-
-```tsx
-import {web, native, ios, android, platform} from '#/alf'
-
-const styles = [
-  a.p_md,
-  web({cursor: 'pointer'}),
-  native({paddingBottom: 20}),
-  platform({ios: {...}, android: {...}, web: {...}}),
-]
-```
-
-**Breakpoints** – Responsive design:
-
-```tsx
-import {useBreakpoints} from '#/alf'
-
-const {gtPhone, gtMobile, gtTablet} = useBreakpoints()
-if (gtMobile) {
-  // Tablet or desktop layout
-}
-```
+**Breakpoints:** `const {gtPhone, gtMobile, gtTablet} = useBreakpoints()` from `#/alf`.
 
 ### Naming Conventions
 
@@ -272,176 +228,67 @@ if (gtMobile) {
 ```tsx
 import {Fragment} from 'react'
 import {View} from 'react-native'
-import {Trans, useLingui} from '@lingui/react/macro'
+import {Trans} from '@lingui/react/macro'
 
 import {Text} from '#/components/Typography'
 
-function MyComponent({foo = []}: {foo?: string[]}) {
-  const {t: l} = useLingui()
-
+function MyComponent({items = []}: {items?: string[]}) {
   return (
     <>
-      <View><Text><Trans>Example</Trans><Text></View>
       <View>
-        {foo.map((foo, index) => (
-          <Fragment key={foo}>
+        <Text>
+          <Trans>Example</Trans>
+        </Text>
+      </View>
+      <View>
+        {items.map((item, index) => (
+          <Fragment key={item}>
             <Text>{index}</Text>
-            <Text>{foo}</Text>
+            <Text>{item}</Text>
           </Fragment>
         ))}
       </View>
     </>
-  );
+  )
 }
 ```
 
 ### Dialog Component
 
-Dialogs use a bottom sheet on native and a modal on web. Use `useDialogControl()` hook to manage state.
-
-```tsx
-import * as Dialog from '#/components/Dialog'
-
-function MyFeature() {
-  const control = Dialog.useDialogControl()
-
-  return (
-    <>
-      <Button label="Open" onPress={control.open}>
-        <ButtonText>Open Dialog</ButtonText>
-      </Button>
-
-      <Dialog.Outer control={control}>
-        {/* Typically the inner part is in its own component */}
-        <DialogInner />
-      </Dialog.Outer>
-    </>
-  )
-}
-
-function DialogInner() {
-  return (
-    <>
-      <Dialog.Handle /> {/* Native-only drag handle */}
-      <Dialog.ScrollableInner label={l`My Dialog`}>
-        <Dialog.Header>
-          <Dialog.HeaderText>Title</Dialog.HeaderText>
-        </Dialog.Header>
-        <Text>Dialog content here</Text>
-        <Button label="Done" onPress={() => control.close()}>
-          <ButtonText>Done</ButtonText>
-        </Button>
-        <Dialog.Close /> {/* Web-only X button in top left */}
-      </Dialog.ScrollableInner>
-    </>
-  )
-}
-```
+Lives in `#/components/Dialog`. Bottom sheet on native, modal on web. Manage
+state with `useDialogControl()`. `Dialog.Handle` renders native-only, `Dialog.Close`
+web-only. CRITICAL: run any post-close action inside the `control.close(() => ...)`
+callback (see Footguns). Compound-component usage; canonical example in any dialog
+under `#/components`.
 
 ### Menu Component
 
-Menus render as a dropdown on web and a bottom sheet dialog on native.
-
-```tsx
-import * as Menu from '#/components/Menu'
-
-function MyMenu() {
-  return (
-    <Menu.Root>
-      <Menu.Trigger label="Open menu">
-        {({props}) => (
-          <Button {...props} label="Menu">
-            <ButtonIcon icon={DotsHorizontal} />
-          </Button>
-        )}
-      </Menu.Trigger>
-
-      <Menu.Outer>
-        <Menu.Group>
-          <Menu.Item label="Edit" onPress={handleEdit}>
-            <Menu.ItemIcon icon={Pencil} />
-            <Menu.ItemText>Edit</Menu.ItemText>
-          </Menu.Item>
-          <Menu.Item label="Delete" onPress={handleDelete}>
-            <Menu.ItemIcon icon={Trash} />
-            <Menu.ItemText>Delete</Menu.ItemText>
-          </Menu.Item>
-        </Menu.Group>
-      </Menu.Outer>
-    </Menu.Root>
-  )
-}
-```
+Lives in `#/components/Menu`. Dropdown on web, bottom sheet dialog on native.
+`Menu.Divider` is web-only, `Menu.ContainerItem` native-only. Compound API
+(`Menu.Root` / `Menu.Trigger` / `Menu.Outer` / `Menu.Group` / `Menu.Item`); grep
+existing usages across the app for a canonical example.
 
 ### Button Component
 
-```tsx
-import {Button, ButtonText, ButtonIcon} from '#/components/Button'
-
-// Solid primary button (most common)
-<Button label="Save" onPress={handleSave} color="primary" size="large">
-  <ButtonText>Save</ButtonText>
-</Button>
-
-// With icon
-<Button label="Share" onPress={handleShare} color="secondary" size="small">
-  <ButtonIcon icon={Share} />
-  <ButtonText>Share</ButtonText>
-</Button>
-
-// Icon-only button
-<Button label="Close" onPress={handleClose} color="secondary" size="small" shape="round">
-  <ButtonIcon icon={XIcon} />
-</Button>
-
-// Ghost variant (deprecated - use color prop)
-<Button label="Cancel" variant="ghost" color="secondary" size="small">
-  <ButtonText>Cancel</ButtonText>
-</Button>
-```
-
-**Button Props:**
+`import {Button, ButtonText, ButtonIcon} from '#/components/Button'`. Props:
 
 - `color`: `'primary'` | `'secondary'` | `'negative'` | `'primary_subtle'` | `'negative_subtle'` | `'secondary_inverted'`
 - `size`: `'tiny'` | `'small'` | `'large'`
 - `shape`: `'default'` (pill) | `'round'` | `'square'` | `'rectangular'`
-- `variant`: `'solid'` | `'outline'` | `'ghost'` (deprecated, use `color`)
-
-### Typography
-
-```tsx
-import {Text, H1, H2, P} from '#/components/Typography'
-
-<H1 style={[a.text_xl, a.font_bold]}>Heading</H1>
-<P>Paragraph text with default styling.</P>
-<Text style={[a.text_md, t.atoms.text_contrast_medium]}>Custom text</Text>
-
-// For text with emoji, add the emoji prop. User-generated text (e.g. display names)
-// will almost certainly contain emoji, so only omit it when the text is static and
-// does not contain an emoji
-<Text emoji>Hello! 👋</Text>
-```
-
-The `Text` component's default style is `[a.text_sm, a.leading_snug, t.atoms.text]`.
+- `variant`: `'solid'` | `'outline'` | `'ghost'` (deprecated, prefer `color`)
 
 ### TextField
 
-```tsx
-import * as TextField from '#/components/forms/TextField'
+Compound component at `#/components/forms/TextField` (`TextField.LabelText`,
+`TextField.Root`, `TextField.Icon`, `TextField.Input`). Prefer `defaultValue` over
+`value` (see Footguns).
 
-<TextField.LabelText>Email</TextField.LabelText>
-<TextField.Root>
-  <TextField.Icon icon={AtSign} />
-  <TextField.Input
-    label="Email address"
-    placeholder="you@example.com"
-    defaultValue={email}
-    onChangeText={setEmail}
-    keyboardType="email-address"
-    autoCapitalize="none"
-  />
-</TextField.Root>
-```
+### Typography
+
+`import {Text, H1, H2, P} from '#/components/Typography'`. The `Text` default style
+is `[a.text_sm, a.leading_snug, t.atoms.text]`. Pass the `emoji` prop to any `Text`
+that may contain emoji - user-generated text (display names etc.) almost always
+does, so only omit it for static, emoji-free strings: `<Text emoji>Hello!</Text>`.
 
 ## Internationalization (i18n)
 
@@ -515,201 +362,49 @@ pnpm intl:compile    # Compile translations for runtime
 
 ### TanStack Query (Data Fetching)
 
-```tsx
-// src/state/queries/profile.ts
-import {useQuery, useMutation, useQueryClient} from '@tanstack/react-query'
+Follow the established pattern in `src/state/queries/`; `src/state/queries/feed.ts`
+is a good canonical reference (it uses `createQueryKey`, matching key roots,
+`useInfiniteQuery`, and `persistedVersion`).
 
-import {createQueryKey} from '#/state/queries/util'
-
-/*
- * Query key name should match the query hook name for consistency
- */
-const profileQueryKeyRoot = 'profile'
-
-/*
- * Use object params and createQueryKey helper for better readability and to
- * avoid bugs with parameter order or types.
- */
-export const createProfileQueryKey = (args: {did: string}) =>
-  createQueryKey(profileQueryKeyRoot, args)
-
-/*
- * Query hook should be named use[Name]Query, where [Name] describes the data
- * being fetched. This is not a strict requirement, but it's a helpful
- * convention for discoverability
- */
-export function useProfileQuery({did}: {did: string}) {
-  const agent = useAgent()
-
-  return useQuery({
-    queryKey: createProfileQueryKey({did}),
-    queryFn: async () => {
-      const res = await agent.getProfile({actor: did})
-      return res.data
-    },
-    staleTime: STALE.MINUTES.FIVE,
-    enabled: !!did,
-  })
-}
-
-/*
- * Mutation hook should match the name of the query hook, but with "Mutation"
- * suffix. This is not a strict requirement, but it's a helpful convention for
- * discoverability and consistency.
- */
-export function useProfileMutation() {
-  const queryClient = useQueryClient()
-
-  return useMutation({
-    mutationFn: async data => {
-      // Update logic
-    },
-    onSuccess: (_, variables) => {
-      queryClient.invalidateQueries({
-        queryKey: createProfileQueryKey({did: variables.did}),
-      })
-    },
-    onError: error => {
-      if (isNetworkError(error)) {
-        // don't log, but inform user
-      } else if (error instanceof AppBskyExampleProcedure.ExampleError) {
-        // XRPC APIs often have typed errors, allows nicer handling
-      } else {
-        // Log unexpected errors to Sentry
-        logger.error('Error updating profile', {safeMessage: error})
-      }
-    },
-  })
-}
-
-/*
- * If cache mutation is needed, include specific interfaces for the specific
- * mutations you require adjacent to the source queries. Naming should be
- * descriptive of the mutation's purpose, e.g. use[Name]CacheMutation. This is
- * not a strict requirement, but it's a helpful convention for discoverability
- * and consistency.
- */
-export function useProfileCacheMutation() {
-  const queryClient = useQueryClient()
-
-  return (data: Partial<Profile>) => {
-    queryClient.setQueryData(
-      createProfileQueryKey({did: data.did}),
-      oldData => {
-        if (!oldData) return oldData
-        return {...oldData, ...data}
-      },
-    )
-  }
-}
-```
-
-**Stale Time Constants** (from `src/state/queries/index.ts`):
-
-```tsx
-STALE.SECONDS.FIFTEEN // 15 seconds
-STALE.MINUTES.ONE // 1 minute
-STALE.MINUTES.FIVE // 5 minutes
-STALE.HOURS.ONE // 1 hour
-STALE.INFINITY // Never stale
-```
-
-**Paginated APIs:** Many atproto APIs return paginated results with a `cursor`. Use `useInfiniteQuery` for these:
-
-```tsx
-export function useDraftsQuery() {
-  const agent = useAgent()
-
-  return useInfiniteQuery({
-    queryKey: createQueryKey('drafts'),
-    queryFn: async ({pageParam}) => {
-      const res = await agent.app.bsky.draft.getDrafts({cursor: pageParam})
-      return res.data
-    },
-    initialPageParam: undefined as string | undefined,
-    getNextPageParam: page => page.cursor,
-  })
-}
-```
-
-To get all items from pages: `data?.pages.flatMap(page => page.items) ?? []`
-
-**Persisted Queries**
-
-To persist query data across app restarts, `createQueryKey` supports a third
-parameter called `options`, which has a `persistedVersion` property. When this
-property is set to a number, the query will be persisted.
-
-When this property is updated (e.g. incremented), the persisted data will be cleared and replaced with the new data from the query function. This is useful for cases where the shape of the data has changed and old persisted data would no longer be valid.
-
-```tsx
-export const createProfileQueryKey = (args: {did: string}) =>
-  createQueryKey(profileQueryKeyRoot, args, {persistedVersion: 1})
-```
+- Build query keys with `createQueryKey(root, args)` (from `#/state/queries/util`)
+  using an object for `args`. The key root variable should match the hook name.
+- Naming conventions: `use[Name]Query` for queries, `use[Name]Mutation` for
+  mutations, `use[Name]CacheMutation` for helpers that mutate cached data directly.
+- Stale times come from `STALE` in `src/state/queries/index.ts`: `STALE.SECONDS.FIFTEEN`,
+  `STALE.MINUTES.ONE`, `STALE.MINUTES.FIVE`, `STALE.HOURS.ONE`, `STALE.INFINITY`.
+- Paginated atproto APIs (those returning a `cursor`) use `useInfiniteQuery` with
+  `getNextPageParam: page => page.cursor`; flatten results with
+  `data?.pages.flatMap(page => page.items) ?? []`.
+- Persist a query across restarts by passing options:
+  `createQueryKey(root, args, {persistedVersion: n})`. Bumping `n` clears the old
+  persisted data and refetches - do this whenever the data shape changes.
+- Error handling in mutations: don't log network errors (just inform the user),
+  handle typed XRPC errors specifically (e.g. `err instanceof SomeNsid.SomeError`),
+  and send unexpected errors to `logger.error('...', {safeMessage: error})`.
 
 ### Preferences (React Context)
 
-```tsx
-// Simple boolean preference pattern
-import {useAutoplayDisabled, useSetAutoplayDisabled} from '#/state/preferences'
-
-function SettingsScreen() {
-  const autoplayDisabled = useAutoplayDisabled()
-  const setAutoplayDisabled = useSetAutoplayDisabled()
-
-  return <Toggle value={autoplayDisabled} onValueChange={setAutoplayDisabled} />
-}
-```
+Boolean/simple UI preferences are exposed as paired hooks from `#/state/preferences`,
+e.g. `useAutoplayDisabled()` / `useSetAutoplayDisabled()`.
 
 ### Session State
 
-```tsx
-import {useSession, useAgent} from '#/state/session'
-
-function MyComponent() {
-  const {hasSession, currentAccount} = useSession()
-  const agent = useAgent()
-
-  if (!hasSession) {
-    return <LoginPrompt />
-  }
-
-  // Use agent for API calls
-  const response = await agent.getProfile({actor: currentAccount.did})
-}
-```
+`import {useSession, useAgent} from '#/state/session'`. `useSession()` gives
+`hasSession` and `currentAccount`; `useAgent()` gives the atproto agent for API calls.
 
 ## Navigation
 
-Navigation uses React Navigation with type-safe route parameters.
-
-```tsx
-// Screen component
-import {type NativeStackScreenProps} from '@react-navigation/native-stack'
-import {type CommonNavigatorParams} from '#/lib/routes/types'
-
-type Props = NativeStackScreenProps<CommonNavigatorParams, 'Profile'>
-
-export function ProfileScreen({route, navigation}: Props) {
-  const {name} = route.params // Type-safe params
-
-  return <Layout.Screen>{/* Screen content */}</Layout.Screen>
-}
-
-// Programmatic navigation
-import {useNavigation} from '@react-navigation/native'
-
-const navigation = useNavigation()
-navigation.navigate('Profile', {name: 'alice.bsky.social'})
-
-// Or use the navigate helper
-import {navigate} from '#/Navigation'
-navigate('Profile', {name: 'alice.bsky.social'})
-```
+React Navigation with type-safe route params. Type a screen with
+`NativeStackScreenProps<CommonNavigatorParams, 'X'>` (`route`/`navigation` come
+from props; params via `route.params`). Navigate programmatically with
+`useNavigation()`, or the `navigate` helper from `#/Navigation`. Config lives in
+`src/Navigation.tsx`, routes in `src/routes.ts`, types in `src/lib/routes/types.ts`.
 
 ## Platform-Specific Code
 
-Use file extensions for platform-specific implementations:
+Use file extensions for platform-specific implementations. The bundler resolves
+them automatically - just import the base path normally, never a conditional
+`require()`.
 
 ```
 Component.tsx          # Shared/default
@@ -719,12 +414,11 @@ Component.ios.tsx      # iOS-only
 Component.android.tsx  # Android-only
 ```
 
-Example from Dialog:
-
-- `src/components/Dialog/index.tsx` – Native (uses BottomSheet)
-- `src/components/Dialog/index.web.tsx` – Web (uses modal with Radix primitives)
-
-**Important:** The bundler automatically resolves platform-specific files. Just import normally:
+Prefer grouping variants into a `Component/` directory (`index.tsx`,
+`index.web.tsx`, `index.native.tsx`) rather than sibling `Component.web.tsx` files,
+so the shared surface reads as one "macro" module (e.g. `src/components/Dialog/index.tsx`
+native vs `index.web.tsx` web). The app has both patterns; the directory form is
+preferred for new code.
 
 ```tsx
 // CORRECT - bundler picks storage.ts or storage.web.ts automatically
@@ -736,15 +430,7 @@ const storage = IS_NATIVE
   : require('#/state/drafts/storage.web')
 ```
 
-Platform detection (for runtime logic, not imports):
-
-```tsx
-import {IS_WEB, IS_NATIVE, IS_IOS, IS_ANDROID} from '#/env'
-
-if (IS_NATIVE) {
-  // Native-specific logic
-}
-```
+Runtime platform detection (not for imports): `import {IS_WEB, IS_NATIVE, IS_IOS, IS_ANDROID} from '#/env'`.
 
 ## Import Aliases
 

Dockerfile.bskylink

@@ -1,4 +1,4 @@
-FROM node:24.15.0-alpine3.22 AS build
+FROM node:24.18.0-alpine3.23 AS build
 
 # Move files into the image and install
 WORKDIR /app
@@ -14,7 +14,7 @@ RUN yarn build
 RUN yarn install --production --ignore-scripts --prefer-offline
 
 # Uses assets from build stage to reduce build size
-FROM node:24.15.0-alpine3.22
+FROM node:24.18.0-alpine3.23
 
 RUN apk add --update dumb-init
 

Dockerfile.bskyogcard

@@ -1,4 +1,4 @@
-FROM node:24.15.0-alpine3.22 AS build
+FROM node:24.18.0-alpine3.23 AS build
 
 # Tells pnpm to run non-interactively (needed for install/script steps)
 ENV CI=true
@@ -9,7 +9,7 @@ WORKDIR /app
 COPY ./bskyogcard/package.json ./
 COPY ./bskyogcard/pnpm-lock.yaml ./
 COPY ./bskyogcard/pnpm-workspace.yaml ./
-RUN npm install --global pnpm@11.1.3
+RUN npm install --global pnpm@11.10.0
 RUN pnpm install --frozen-lockfile
 
 COPY ./bskyogcard ./
@@ -19,7 +19,7 @@ RUN pnpm install-fonts && pnpm build
 RUN pnpm install --prod --ignore-scripts --prefer-offline
 
 # Uses assets from build stage to reduce build size
-FROM node:24.15.0-alpine3.22
+FROM node:24.18.0-alpine3.23
 
 RUN apk add --update dumb-init
 

Dockerfile.embedr

@@ -5,7 +5,7 @@ WORKDIR /usr/src/social-app
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Node
-ENV NODE_VERSION=24.15.0
+ENV NODE_VERSION=24.18.0
 ENV NVM_DIR=/usr/share/nvm
 
 # Go
@@ -33,7 +33,7 @@ RUN mkdir --parents $NVM_DIR && \
 RUN \. "$NVM_DIR/nvm.sh" && \
   nvm install $NODE_VERSION && \
   nvm use $NODE_VERSION && \
-  npm install --global pnpm@11.5.0 && \
+  npm install --global pnpm@11.10.0 && \
   pnpm install --frozen-lockfile && \
   cd bskyembed && pnpm install --frozen-lockfile && cd .. && \
   pnpm intl:build && \

__e2e__/flows/curate-lists.yml

@@ -135,7 +135,8 @@ appId: xyz.blueskyweb.app
 
 - tapOn:
     id: "bottomBarSearchBtn"
-- tapOn: "Search for posts, users[,]? or feeds"
+- tapOn:
+    id: "searchScreenInput"
 - inputText: "bob"
 - tapOn:
     id: "searchAutoCompleteResult-bob.test"
@@ -145,21 +146,21 @@ appId: xyz.blueskyweb.app
     id: "profileHeaderDropdownBtn"
 - tapOn: "Add to Lists"
 - assertVisible:
-    id: "userAddRemoveListsModal"
+    id: "userAddRemoveListsDialog"
 - tapOn:
     id: "user-bob.test-addBtn"
 - tapOn:
     id: "doneBtn"
 - assertNotVisible:
-    id: "userAddRemoveListsModal"
+    id: "userAddRemoveListsDialog"
 - tapOn:
     id: "profileHeaderDropdownBtn"
 - tapOn: "Add to Lists"
 - assertVisible:
-    id: "userAddRemoveListsModal"
+    id: "userAddRemoveListsDialog"
 - tapOn:
     id: "user-bob.test-addBtn"
 - tapOn:
     id: "doneBtn"
 - assertNotVisible:
-    id: "userAddRemoveListsModal"
+    id: "userAddRemoveListsDialog"

__e2e__/flows/login.yml

@@ -11,7 +11,8 @@ appId: xyz.blueskyweb.app
 - tapOn: "Sign in"
 - tapOn:
     id: "selectServiceButton"
-- tapOn: "Custom"
+- tapOn:
+    id: "manualSelectBtn"
 - tapOn:
     id: "customServerTextInput"
 - inputText: "http://localhost:3000"
@@ -20,7 +21,8 @@ appId: xyz.blueskyweb.app
       platform: Android
     commands:
       - hideKeyboard
-- tapOn: "Done"
+- tapOn:
+    id: "doneBtn"
 - tapOn:
     id: "loginUsernameInput"
 - inputText: "Alice"

__e2e__/flows/profile-screen.yml

@@ -15,7 +15,8 @@ appId: xyz.blueskyweb.app
       id: "bottomBarSearchBtn"
 - tapOn:
     id: "bottomBarSearchBtn"
-- tapOn: "Search for posts, users[,]? or feeds"
+- tapOn:
+    id: "searchScreenInput"
 - inputText: "b"
 - tapOn:
     id: "searchAutoCompleteResult-bob.test"

__e2e__/flows/search-screen.yml

@@ -15,8 +15,10 @@ appId: xyz.blueskyweb.app
       id: "bottomBarSearchBtn"
 - tapOn:
     id: "bottomBarSearchBtn"
-- assertVisible: "Search for posts, users[,]? or feeds"
-- tapOn: "Search for posts, users[,]? or feeds"
+- assertVisible:
+    id: "searchScreenInput"
+- tapOn:
+    id: "searchScreenInput"
 - inputText: "b"
 - tapOn:
     id: "searchAutoCompleteResult-bob.test"

__tests__/lib/routes-helpers.test.ts

@@ -0,0 +1,107 @@
+import {
+  buildStateObject,
+  getCurrentRoute,
+  isStateAtTabRoot,
+} from '#/lib/routes/helpers'
+import {type State} from '#/lib/routes/types'
+
+describe('getCurrentRoute', () => {
+  it('returns Home when there is no state', () => {
+    expect(getCurrentRoute(undefined).name).toBe('Home')
+  })
+
+  it('descends into nested state using the index', () => {
+    const state = {
+      index: 0,
+      routes: [
+        {
+          name: 'HomeTab',
+          state: {
+            index: 1,
+            routes: [{name: 'Home'}, {name: 'PostThread'}],
+          },
+        },
+      ],
+    } as unknown as State
+
+    expect(getCurrentRoute(state).name).toBe('PostThread')
+  })
+
+  /*
+   * Right after a cold start from a deep link, nested navigator states are
+   * still partial and have no `index`. React Navigation focuses the last
+   * route when rehydrating such a state, so getCurrentRoute must do the
+   * same (previously it stopped at the tab route, which re-enabled the
+   * drawer swipe gesture on top of the deep-linked screen).
+   */
+  it('descends into partial nested state without an index', () => {
+    const state = {
+      routes: [
+        {
+          name: 'HomeTab',
+          state: {
+            routes: [{name: 'Home'}, {name: 'PostThread'}],
+          },
+        },
+      ],
+    } as unknown as State
+
+    expect(getCurrentRoute(state).name).toBe('PostThread')
+  })
+})
+
+describe('isStateAtTabRoot', () => {
+  it('returns true for the initial deep link state of a tab root', () => {
+    const state = buildStateObject('HomeTab', 'Home', {}) as unknown as State
+    expect(isStateAtTabRoot(state)).toBe(true)
+  })
+
+  it('returns false for the initial deep link state of a nested screen', () => {
+    const state = buildStateObject(
+      'HomeTab',
+      'PostThread',
+      {name: 'alice.test', rkey: '123'},
+      [{name: 'Home', params: {}}],
+    ) as unknown as State
+    expect(isStateAtTabRoot(state)).toBe(false)
+  })
+})
+
+describe('buildStateObject', () => {
+  it('focuses the deep-linked route in the nested state', () => {
+    const state = buildStateObject(
+      'HomeTab',
+      'PostThread',
+      {name: 'alice.test', rkey: '123'},
+      [{name: 'Home', params: {}}],
+    )
+
+    expect(state).toEqual({
+      index: 0,
+      routes: [
+        {
+          name: 'HomeTab',
+          state: {
+            index: 1,
+            routes: [
+              {name: 'Home', params: {}},
+              {name: 'PostThread', params: {name: 'alice.test', rkey: '123'}},
+            ],
+          },
+        },
+      ],
+    })
+  })
+
+  it('builds a single-route state for the Flat navigator', () => {
+    const state = buildStateObject('Flat', 'PostThread', {
+      name: 'alice.test',
+      rkey: '123',
+    })
+
+    expect(state).toEqual({
+      index: 0,
+      routes: [{name: 'PostThread', params: {name: 'alice.test', rkey: '123'}}],
+    })
+  })
+})

__tests__/lib/strings/url-helpers.test.ts

@@ -184,39 +184,39 @@ describe('getChatInviteCodeFromUrl', () => {
   type Case = [string, string | undefined]
 
   const cases: Case[] = [
-    ['https://bsky.app/c/abcdefg', 'abcdefg'],
-    ['https://bsky.app/c/abcdefghij', 'abcdefghij'],
+    ['https://bsky.app/chat/abcdefg', 'abcdefg'],
+    ['https://bsky.app/chat/abcdefghij', 'abcdefghij'],
     // http is not recognized as a bsky.app url
-    ['http://bsky.app/c/abcdefg', undefined],
-    ['https://bsky.app/c/abcdefg?utm=foo', 'abcdefg'],
-    ['https://bsky.app/c/abcdefg#section', 'abcdefg'],
-    ['/c/abcdefg', 'abcdefg'],
-    ['/c/abcdefg?utm=foo', 'abcdefg'],
-    ['/c/abcdefg#section', 'abcdefg'],
+    ['http://bsky.app/chat/abcdefg', undefined],
+    ['https://bsky.app/chat/abcdefg?utm=foo', 'abcdefg'],
+    ['https://bsky.app/chat/abcdefg#section', 'abcdefg'],
+    ['/chat/abcdefg', 'abcdefg'],
+    ['/chat/abcdefg?utm=foo', 'abcdefg'],
+    ['/chat/abcdefg#section', 'abcdefg'],
 
     // too short
-    ['https://bsky.app/c/abcdef', undefined],
-    ['/c/abcdef', undefined],
+    ['https://bsky.app/chat/abcdef', undefined],
+    ['/chat/abcdef', undefined],
     // too long
-    ['https://bsky.app/c/abcdefghijk', undefined],
-    ['/c/abcdefghijk', undefined],
+    ['https://bsky.app/chat/abcdefghijk', undefined],
+    ['/chat/abcdefghijk', undefined],
     // invalid characters
-    ['https://bsky.app/c/abc-def', undefined],
-    ['/c/abc def', undefined],
+    ['https://bsky.app/chat/abc-def', undefined],
+    ['/chat/abc def', undefined],
     // trailing path
-    ['https://bsky.app/c/abcdefg/extra', undefined],
-    ['/c/abcdefg/extra', undefined],
+    ['https://bsky.app/chat/abcdefg/extra', undefined],
+    ['/chat/abcdefg/extra', undefined],
     // wrong path
     ['https://bsky.app/profile/abcdefg', undefined],
-    ['https://bsky.app/c', undefined],
+    ['https://bsky.app/chat', undefined],
     // wrong host
-    ['https://example.com/c/abcdefg', undefined],
+    ['https://example.com/chat/abcdefg', undefined],
     // not a url, not a path
-    ['c/abcdefg', undefined],
+    ['chat/abcdefg', undefined],
     ['abcdefg', undefined],
     ['', undefined],
     // malformed url
-    ['https://[invalid/c/abcdefg', undefined],
+    ['https://[invalid/chat/abcdefg', undefined],
   ]
 
   it.each(cases)('given input %p, returns %p', (input, expected) => {

app.config.js

@@ -59,6 +59,7 @@ module.exports = function (_config) {
       ios: {
         supportsTablet: false,
         bundleIdentifier: 'xyz.blueskyweb.app',
+        appleTeamId: process.env.EXPO_APPLE_TEAM_ID,
         config: {
           usesNonExemptEncryption: false,
         },
@@ -81,6 +82,7 @@ module.exports = function (_config) {
             'an',
             'ast',
             'ca',
+            'cs',
             'cy',
             'da',
             'de',
@@ -126,6 +128,7 @@ module.exports = function (_config) {
           'com.apple.security.application-groups': 'group.app.bsky',
           'com.apple.developer.usernotifications.communication': true,
           // 'com.apple.developer.device-information.user-assigned-device-name': true,
+          'com.apple.developer.declared-age-range': true,
         },
         privacyManifests: {
           NSPrivacyCollectedDataTypes: [

assets/icons/arrowCornerDownRight_stroke2_corner3_rounded.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><path fill="#000" d="M5 5a1 1 0 0 0-2 0v4a7 7 0 0 0 7 7h8.086l-2.293 2.293a1 1 0 0 0 1.414 1.414l2.94-2.94a2.5 2.5 0 0 0 0-3.535l-2.94-2.94a1 1 0 1 0-1.414 1.415L18.086 14H10a5 5 0 0 1-5-5V5Z"/></svg>

babel.config.js

@@ -18,19 +18,7 @@ module.exports = function (api) {
     plugins: [
       '@lingui/babel-plugin-lingui-macro',
       ['babel-plugin-react-compiler', {target: '19'}],
-      [
-        'module:react-native-dotenv',
-        {
-          envName: 'APP_ENV',
-          moduleName: '@env',
-          path: '.env',
-          blocklist: null,
-          allowlist: null,
-          safe: false,
-          allowUndefined: true,
-          verbose: false,
-        },
-      ],
+      'module:react-native-dotenv', // used by web build! can remove when we drop webpack
       [
         'module-resolver',
         {

bskyembed/package.json

@@ -13,7 +13,7 @@
     "format": "prettier -w src"
   },
   "dependencies": {
-    "@atproto/api": "^0.15.25",
+    "@atproto/api": "0.20.11",
     "preact": "^10.4.8"
   },
   "devDependencies": {
@@ -32,7 +32,7 @@
     "terser": "^5.43.1",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.20.0",
-    "vite": "^8.0.12",
+    "vite": "^8.0.16",
     "vite-bundle-analyzer": "^1.3.8"
   },
   "resolutions": {

bskyembed/src/components/embed.tsx

@@ -1,5 +1,6 @@
 import {
   AppBskyEmbedExternal,
+  AppBskyEmbedGallery,
   AppBskyEmbedImages,
   AppBskyEmbedRecord,
   AppBskyEmbedRecordWithMedia,
@@ -43,6 +44,11 @@ export function Embed({
       return <ImageEmbed content={content} labelInfo={labelInfo} />
     }
 
+    // Case 1b: Gallery (Photos v2)
+    if (AppBskyEmbedGallery.isView(content)) {
+      return <GalleryEmbed content={content} labelInfo={labelInfo} />
+    }
+
     // Case 2: External link
     if (AppBskyEmbedExternal.isView(content)) {
       return <ExternalEmbed content={content} labelInfo={labelInfo} />
@@ -230,6 +236,8 @@ function Info({children}: {children: ComponentChildren}) {
   )
 }
 
+type GridImage = {thumb: string; alt: string}
+
 function ImageEmbed({
   content,
   labelInfo,
@@ -240,20 +248,45 @@ function ImageEmbed({
   if (labelInfo) {
     return <Info>{labelInfo}</Info>
   }
+  return (
+    <ImageGrid
+      images={content.images.map(i => ({thumb: i.thumb, alt: i.alt}))}
+    />
+  )
+}
 
-  switch (content.images.length) {
+function GalleryEmbed({
+  content,
+  labelInfo,
+}: {
+  content: AppBskyEmbedGallery.View
+  labelInfo?: string
+}) {
+  if (labelInfo) {
+    return <Info>{labelInfo}</Info>
+  }
+  const images = content.items
+    .filter(AppBskyEmbedGallery.isViewImage)
+    .map(i => ({thumb: i.thumbnail, alt: i.alt}))
+  return <ImageGrid images={images} />
+}
+
+function ImageGrid({images}: {images: GridImage[]}) {
+  switch (images.length) {
+    case 0:
+      return null
     case 1:
       return (
         <img
-          src={content.images[0].thumb}
-          alt={content.images[0].alt}
+          src={images[0].thumb}
+          alt={images[0].alt}
           className="w-full rounded-xl overflow-hidden object-cover h-auto max-h-[1000px]"
         />
       )
     case 2:
       return (
         <div className="flex gap-1 rounded-xl overflow-hidden w-full aspect-[2/1]">
-          {content.images.map((image, i) => (
+          {images.map((image, i) => (
             <img
               key={i}
               src={image.thumb}
@@ -268,13 +301,13 @@ function ImageEmbed({
         <div className="flex gap-1 rounded-xl overflow-hidden w-full aspect-[2/1]">
           <div className="flex-1 aspect-square">
             <img
-              src={content.images[0].thumb}
-              alt={content.images[0].alt}
+              src={images[0].thumb}
+              alt={images[0].alt}
               className="w-full h-full object-cover rounded-sm"
             />
           </div>
           <div className="flex flex-col gap-1 flex-1">
-            {content.images.slice(1).map((image, i) => (
+            {images.slice(1).map((image, i) => (
               <img
                 key={i}
                 src={image.thumb}
@@ -285,21 +318,36 @@ function ImageEmbed({
           </div>
         </div>
       )
-    case 4:
+    default: {
+      const remaining = images.length - 4
       return (
         <div className="grid grid-cols-2 gap-1 rounded-xl overflow-hidden">
-          {content.images.map((image, i) => (
-            <img
-              key={i}
-              src={image.thumb}
-              alt={image.alt}
-              className="aspect-[3/2] w-full object-cover rounded-sm"
-            />
-          ))}
+          {images.slice(0, 4).map((image, i) => {
+            const isOverflowCell = i === 3 && remaining > 0
+            return (
+              <div
+                key={i}
+                className="relative aspect-[3/2] rounded-sm overflow-hidden">
+                <img
+                  src={image.thumb}
+                  alt={image.alt}
+                  className="absolute inset-0 w-full h-full object-cover"
+                />
+                {isOverflowCell && (
+                  <div
+                    aria-label={`+${remaining} more image${remaining === 1 ? '' : 's'}, view post to see all`}
+                    className="absolute inset-0 flex items-center justify-center bg-black/50">
+                    <span className="text-white text-2xl font-semibold">
+                      +{remaining}
+                    </span>
+                  </div>
+                )}
+              </div>
+            )
+          })}
         </div>
       )
-    default:
-      return null
+    }
   }
 }
 

bskyembed/src/components/post.tsx

@@ -154,7 +154,9 @@ export function Post({thread}: Props) {
 }
 
 function PostContent({record}: {record: AppBskyFeedPost.Record | null}) {
-  if (!record) return null
+  // text-only check - posts with no text (e.g. gallery posts) would otherwise
+  // render an empty <p> that adds an extra flex gap above the embed
+  if (!record?.text) return null
 
   const rt = new RichText({
     text: record.text,

bskyogcard/package.json

@@ -6,7 +6,7 @@
   "devEngines": {
     "packageManager": {
       "name": "pnpm",
-      "version": "11.1.3",
+      "version": "11.10.0",
       "onFail": "warn"
     }
   },
@@ -18,7 +18,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@atproto/api": "0.20.6",
+    "@atproto/api": "0.20.13",
     "@atproto/common": "^0.6.1",
     "@resvg/resvg-js": "^2.6.2",
     "express": "^4.19.2",

bskyogcard/pnpm-lock.yaml

@@ -7,52 +7,52 @@ importers:
     configDependencies: {}
     packageManagerDependencies:
       '@pnpm/exe':
-        specifier: 11.1.3
-        version: 11.1.3
+        specifier: 11.5.2
+        version: 11.5.2
       pnpm:
-        specifier: 11.1.3
-        version: 11.1.3
+        specifier: 11.5.2
+        version: 11.5.2
 
 packages:
 
-  '@pnpm/exe@11.1.3':
-    resolution: {integrity: sha512-J6bSMpZlHVUKuMKtPT/+lrFPpvBiOIgk6HnNC3vmoM/fsMgFhao6ITFwdsUMzdCl2qHf9cnVYA4ZBdsGmVUnpg==}
+  '@pnpm/exe@11.5.2':
+    resolution: {integrity: sha512-4UFnP2rhNu1xjAQ+I1GdIUUEtCJuTYJlbpiWSFA4POAID3Lpt+2vrjImWO7eOJ7iCY3vpc4TFe2IW3sAolW4Kg==}
     hasBin: true
 
-  '@pnpm/linux-arm64@11.1.3':
-    resolution: {integrity: sha512-sz3fc0hSqguk2eGe/InelpBD3LP82MzF+8pLzDpYNGuhasGY+VWkuxEo02HczQYRVXTsbpZVepk+Qs2CONc04Q==}
+  '@pnpm/linux-arm64@11.5.2':
+    resolution: {integrity: sha512-MbJySnu2y9cCBqlODLjUlZ87JnRC3Inq40rvGHWJSrSQ0PnuHeSw2NDMnLI8Hf9hCY+ooussRc5iiR4IAkjUvg==}
     cpu: [arm64]
     os: [linux]
 
-  '@pnpm/linux-x64@11.1.3':
-    resolution: {integrity: sha512-UadJh5fJZWa47OtdZTWLKWDj4z5WpZFB5pS2wOh/kfKypUmQyjmbOMClP7/yJGS2ZtrSjRgYjIEWAjndkWsMaA==}
+  '@pnpm/linux-x64@11.5.2':
+    resolution: {integrity: sha512-g6g2BGpQA47wUACy6B1MdeSHPtnl6x4AeCg0IOWQ7xXorEtC+VRiSHhLpA5kByFGeSwyYh/nLc7mLul5DAaELw==}
     cpu: [x64]
     os: [linux]
 
-  '@pnpm/linuxstatic-arm64@11.1.3':
-    resolution: {integrity: sha512-lWmGr96w+VrIRVsEfTXROB3GeQNxrX2Hy32j3USHr6WlqmpH1i7YjavJGpoXeVZbb77fCFjNFAtsJzGXSgy/Og==}
+  '@pnpm/linuxstatic-arm64@11.5.2':
+    resolution: {integrity: sha512-xTxs9BLxYW39BPNGnmvYCUBnMPWm4mzmzujmdYbpRxDnBXrx55qPR5K/3LSohX7VrmsdDrYxuH6AmG1AaOlIfA==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@pnpm/linuxstatic-x64@11.1.3':
-    resolution: {integrity: sha512-I74GDBOPbr5TXgob3ct4hv6BQtLGdsjGJrII2qNl/e2xYHXekjIWE4Eh7RGN4C7xu+BZYKtvnOOr149yR7KxUw==}
+  '@pnpm/linuxstatic-x64@11.5.2':
+    resolution: {integrity: sha512-RGmmc/SoGLD90gmOHcU85UEKNoNRstLvizli4wzDASmETz/VeqJOqU5nD1YBgjzcP72sUMS352dh4bmzTfKyvQ==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@pnpm/macos-arm64@11.1.3':
-    resolution: {integrity: sha512-nWn155BVa54iNyg4iolVhjMtqumXHPh8ul5CFjQFJXdwgr9MRUgc5EUBML1+7mS8C/7Wcex5HUgn/w3fliHCsQ==}
+  '@pnpm/macos-arm64@11.5.2':
+    resolution: {integrity: sha512-gW3A2jRlC3SJRw8qX2SAzjMIu9o98daTSqCKzeeYcjF/uEbtbz3dn4HqYrYffBnenKbc4hsgZQmNOHAvUKIlSg==}
     cpu: [arm64]
     os: [darwin]
 
-  '@pnpm/win-arm64@11.1.3':
-    resolution: {integrity: sha512-4u6PQL7/WgwdweC2ZJcdCzhM1koRFG5ofcUSrIVsdyo9ePfGq2D9p1rkZbiLEfIGvl3GKOsfMB5DRTgs8es4AQ==}
+  '@pnpm/win-arm64@11.5.2':
+    resolution: {integrity: sha512-+VJCDoH/pRzLXBikwjvxgAnGfQufT8EALBX8cfSmrwD40JABUZvgPtjBjde7OwEoK/XwtlH8w+ZceFV0K3/YHQ==}
     cpu: [arm64]
     os: [win32]
 
-  '@pnpm/win-x64@11.1.3':
-    resolution: {integrity: sha512-JmhH7ljJ3MWjvWFz/YHbu/27ISCNLZsQb1JG+ib3uHlfUwIJuF6BudXYsbS5Uu0o7xUvC9sPPm+Uho4Or6R3vA==}
+  '@pnpm/win-x64@11.5.2':
+    resolution: {integrity: sha512-zgglREh75RbFgV/E0tNRS03ElX+hJOV43KRSSeaboxtj3ei1rrguxOgOCXUs/GsizoHVsuD+qXGABE4Kc4GMCg==}
     cpu: [x64]
     os: [win32]
 
@@ -116,45 +116,45 @@ packages:
     resolution: {integrity: sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==}
     engines: {node: '>=8'}
 
-  pnpm@11.1.3:
-    resolution: {integrity: sha512-yFNX/hfKEt0j3XBxgiZm39fjy3b+IU4zcLXqL7NPKiMRhVCbY+cX880KyzjdP42CvNXoFyQArmeLcOpPvtCJbQ==}
+  pnpm@11.5.2:
+    resolution: {integrity: sha512-ccYx44IGbvwlYl1c8CkHXeB7YbN/bic1D72Esb2lhkyMGWetwoB3a0XDCnFcA1mjvgj+9C1bsJ4rmQKZeWkpFg==}
     engines: {node: '>=22.13'}
     hasBin: true
 
 snapshots:
 
-  '@pnpm/exe@11.1.3':
+  '@pnpm/exe@11.5.2':
     dependencies:
       '@reflink/reflink': 0.1.19
       detect-libc: 2.1.2
     optionalDependencies:
-      '@pnpm/linux-arm64': 11.1.3
-      '@pnpm/linux-x64': 11.1.3
-      '@pnpm/linuxstatic-arm64': 11.1.3
-      '@pnpm/linuxstatic-x64': 11.1.3
-      '@pnpm/macos-arm64': 11.1.3
-      '@pnpm/win-arm64': 11.1.3
-      '@pnpm/win-x64': 11.1.3
+      '@pnpm/linux-arm64': 11.5.2
+      '@pnpm/linux-x64': 11.5.2
+      '@pnpm/linuxstatic-arm64': 11.5.2
+      '@pnpm/linuxstatic-x64': 11.5.2
+      '@pnpm/macos-arm64': 11.5.2
+      '@pnpm/win-arm64': 11.5.2
+      '@pnpm/win-x64': 11.5.2
 
-  '@pnpm/linux-arm64@11.1.3':
+  '@pnpm/linux-arm64@11.5.2':
     optional: true
 
-  '@pnpm/linux-x64@11.1.3':
+  '@pnpm/linux-x64@11.5.2':
     optional: true
 
-  '@pnpm/linuxstatic-arm64@11.1.3':
+  '@pnpm/linuxstatic-arm64@11.5.2':
     optional: true
 
-  '@pnpm/linuxstatic-x64@11.1.3':
+  '@pnpm/linuxstatic-x64@11.5.2':
     optional: true
 
-  '@pnpm/macos-arm64@11.1.3':
+  '@pnpm/macos-arm64@11.5.2':
     optional: true
 
-  '@pnpm/win-arm64@11.1.3':
+  '@pnpm/win-arm64@11.5.2':
     optional: true
 
-  '@pnpm/win-x64@11.1.3':
+  '@pnpm/win-x64@11.5.2':
     optional: true
 
   '@reflink/reflink-darwin-arm64@0.1.19':
@@ -194,7 +194,7 @@ snapshots:
 
   detect-libc@2.1.2: {}
 
-  pnpm@11.1.3: {}
+  pnpm@11.5.2: {}
 
 ---
 lockfileVersion: '9.0'
@@ -208,8 +208,8 @@ importers:
   .:
     dependencies:
       '@atproto/api':
-        specifier: 0.20.6
-        version: 0.20.6
+        specifier: 0.20.13
+        version: 0.20.13
       '@atproto/common':
         specifier: ^0.6.1
         version: 0.6.1
@@ -259,8 +259,8 @@ importers:
 
 packages:
 
-  '@atproto/api@0.20.6':
-    resolution: {integrity: sha512-WnFPcUl+qZdXmt27+Tg93BDIvBt/WpXfLIiBzBTp3ms9aszM5hAsfc7G8KEsnsmnRvcm0xRfiKEjIt5FxTKdYg==}
+  '@atproto/api@0.20.13':
+    resolution: {integrity: sha512-AN7NTUsygHXnXs5Cnc6v7/BAjQydwAhE0P8hL21RpIAB4fmTksRKTU3TV//wPg4fk9ESsfNwGIAlwoybbyoZKg==}
     engines: {node: '>=22'}
 
   '@atproto/common-web@0.5.0':
@@ -1154,7 +1154,7 @@ packages:
 
 snapshots:
 
-  '@atproto/api@0.20.6':
+  '@atproto/api@0.20.13':
     dependencies:
       '@atproto/common-web': 0.5.0
       '@atproto/lexicon': 0.7.1

bskyogcard/src/routes/chat-invite.tsx

@@ -1,6 +1,6 @@
 import assert from 'node:assert'
 
-import {type ChatBskyGroupDefs} from '@atproto/api'
+import {ChatBskyGroupDefs} from '@atproto/api'
 import resvg from '@resvg/resvg-js'
 import {type Express} from 'express'
 import satori from 'satori'
@@ -32,7 +32,7 @@ export default function (ctx: AppContext, app: Express) {
           codes: [code],
         })
         const found = result.data.joinLinkPreviews[0]
-        if (!found) {
+        if (!ChatBskyGroupDefs.isJoinLinkPreviewView(found)) {
           return res.status(404).end('not found')
         }
         preview = found

bskyweb/cmd/bskyweb/embedmeta.go

@@ -4,10 +4,9 @@ import (
 	appbsky "github.com/bluesky-social/indigo/api/bsky"
 )
 
-// Helpers for extracting Open Graph metadata from post embeds. These feed
-// og:* / twitter:* meta tags only; the schema.org JSON-LD output lives in
-// jsonld.go. og:video has its own path because JSON-LD does not yet emit
-// VideoObject (deferred — needs `duration` from the appview).
+// Helpers for extracting Open Graph metadata from post embeds. og:video
+// shares findVideoEmbed with the JSON-LD VideoObject path in jsonld.go so
+// the two outputs cannot drift.
 
 // videoMeta holds og:video meta tag data.
 type videoMeta struct {
@@ -21,17 +20,7 @@ type videoMeta struct {
 // extractVideoMeta returns og:video metadata, or the zero value if there's
 // no video embed. Respects embedHidden so og:video and og:image stay in sync.
 func extractVideoMeta(pv *appbsky.FeedDefs_PostView, embedHidden bool) videoMeta {
-	if pv == nil || pv.Embed == nil || embedHidden {
-		return videoMeta{}
-	}
-	var v *appbsky.EmbedVideo_View
-	if pv.Embed.EmbedVideo_View != nil {
-		v = pv.Embed.EmbedVideo_View
-	} else if pv.Embed.EmbedRecordWithMedia_View != nil &&
-		pv.Embed.EmbedRecordWithMedia_View.Media != nil &&
-		pv.Embed.EmbedRecordWithMedia_View.Media.EmbedVideo_View != nil {
-		v = pv.Embed.EmbedRecordWithMedia_View.Media.EmbedVideo_View
-	}
+	v := findVideoEmbed(pv, embedHidden)
 	if v == nil || v.Playlist == "" {
 		return videoMeta{}
 	}

bskyweb/cmd/bskyweb/jsonld.go

@@ -59,14 +59,30 @@ type discussionForumPosting struct {
 	Text            string            `json:"text,omitempty"`
 	Image           []string          `json:"image,omitempty"`
 	ThumbnailURL    string            `json:"thumbnailUrl,omitempty"`
+	Video           *videoObject      `json:"video,omitempty"`
 	DatePublished   string            `json:"datePublished,omitempty"`
 	InteractionStat []interactionStat `json:"interactionStatistic,omitempty"`
 	CommentCount    *int64            `json:"commentCount,omitempty"`
 	Comment         []comment         `json:"comment,omitempty"`
 	IsBasedOn       string            `json:"isBasedOn,omitempty"`
+	IsPartOf        string            `json:"isPartOf,omitempty"`
 	SharedContent   *sharedContent    `json:"sharedContent,omitempty"`
 }
 
+// videoObject is the schema.org VideoObject shape for video embeds.
+// duration is omitted because the appview does not expose it.
+type videoObject struct {
+	Type         string `json:"@type"`
+	Name         string `json:"name,omitempty"`
+	Description  string `json:"description,omitempty"`
+	ThumbnailURL string `json:"thumbnailUrl,omitempty"`
+	UploadDate   string `json:"uploadDate,omitempty"`
+	ContentURL   string `json:"contentUrl,omitempty"`
+	EmbedURL     string `json:"embedUrl,omitempty"`
+	Width        int64  `json:"width,omitempty"`
+	Height       int64  `json:"height,omitempty"`
+}
+
 // comment is the schema.org Comment shape used in
 // DiscussionForumPosting.comment[]. The comment property does not accept
 // DiscussionForumPosting, so replies map to Comment.
@@ -78,6 +94,7 @@ type comment struct {
 	Text          string       `json:"text,omitempty"`
 	Image         []string     `json:"image,omitempty"`
 	ThumbnailURL  string       `json:"thumbnailUrl,omitempty"`
+	Video         *videoObject `json:"video,omitempty"`
 	DatePublished string       `json:"datePublished,omitempty"`
 }
 
@@ -127,6 +144,31 @@ func bskyPostURLFromATURI(handle, atURI string) string {
 	return bskyPostURL(handle, parsed.RecordKey().String())
 }
 
+// bskyPostURLFromATURIWithDIDFallback returns the handle-form post URL
+// when the handle is usable, otherwise falls back to the DID-form URL
+// derived from the AT-URI's authority. Returns "" only when the AT-URI is
+// unparseable or has no record key. Used for nested fields (e.g.
+// VideoObject.embedUrl) where omitting on handle.invalid would weaken the
+// emitted structured data.
+func bskyPostURLFromATURIWithDIDFallback(handle, atURI string) string {
+	parsed, err := syntax.ParseATURI(atURI)
+	if err != nil {
+		return ""
+	}
+	rkey := parsed.RecordKey().String()
+	if rkey == "" {
+		return ""
+	}
+	if url := bskyPostURL(handle, rkey); url != "" {
+		return url
+	}
+	did := parsed.Authority().String()
+	if did == "" {
+		return ""
+	}
+	return fmt.Sprintf("https://bsky.app/profile/%s/post/%s", did, rkey)
+}
+
 // bskyProfileURL returns the canonical handle-form profile URL, or "" if
 // the handle is unusable.
 func bskyProfileURL(handle string) string {
@@ -136,9 +178,9 @@ func bskyProfileURL(handle string) string {
 	return fmt.Sprintf("https://bsky.app/profile/%s", handle)
 }
 
-// extractPostMedia returns thumbnail URLs for the post's image or video
-// embed, byte-identical to what we put in og:image. Callers derive
-// thumbnailUrl from urls[0].
+// extractPostMedia returns thumbnail URLs for the post's image, gallery,
+// or video embed, byte-identical to what we put in og:image. Callers
+// derive thumbnailUrl from urls[0].
 func extractPostMedia(pv *appbsky.FeedDefs_PostView, embedHidden bool) []string {
 	if pv == nil || pv.Embed == nil || embedHidden {
 		return nil
@@ -147,6 +189,9 @@ func extractPostMedia(pv *appbsky.FeedDefs_PostView, embedHidden bool) []string
 	if pv.Embed.EmbedImages_View != nil {
 		return imageThumbs(pv.Embed.EmbedImages_View.Images)
 	}
+	if pv.Embed.EmbedGallery_View != nil {
+		return galleryThumbs(pv.Embed.EmbedGallery_View.Items)
+	}
 	if pv.Embed.EmbedVideo_View != nil && pv.Embed.EmbedVideo_View.Thumbnail != nil {
 		return []string{*pv.Embed.EmbedVideo_View.Thumbnail}
 	}
@@ -155,6 +200,9 @@ func extractPostMedia(pv *appbsky.FeedDefs_PostView, embedHidden bool) []string
 		if media.EmbedImages_View != nil {
 			return imageThumbs(media.EmbedImages_View.Images)
 		}
+		if media.EmbedGallery_View != nil {
+			return galleryThumbs(media.EmbedGallery_View.Items)
+		}
 		if media.EmbedVideo_View != nil && media.EmbedVideo_View.Thumbnail != nil {
 			return []string{*media.EmbedVideo_View.Thumbnail}
 		}
@@ -174,6 +222,89 @@ func imageThumbs(images []*appbsky.EmbedImages_ViewImage) []string {
 	return urls
 }
 
+// galleryThumbs returns the thumbnail URLs of image items in a gallery
+// embed, or nil if empty. Items_Elem is a union; non-image variants and
+// nil entries are skipped so future gallery item types don't break SEO
+// extraction. Empty Thumbnail strings are also skipped to avoid emitting
+// <meta property="og:image" content=""> if the appview ever returns one.
+func galleryThumbs(items []*appbsky.EmbedGallery_View_Items_Elem) []string {
+	if len(items) == 0 {
+		return nil
+	}
+	urls := make([]string, 0, len(items))
+	for _, item := range items {
+		if item == nil || item.EmbedGallery_ViewImage == nil {
+			continue
+		}
+		if item.EmbedGallery_ViewImage.Thumbnail == "" {
+			continue
+		}
+		urls = append(urls, item.EmbedGallery_ViewImage.Thumbnail)
+	}
+	if len(urls) == 0 {
+		return nil
+	}
+	return urls
+}
+
+// findVideoEmbed returns the post's video embed view, or nil if there is
+// none or embeds are hidden. Shared with extractVideoMeta so og:video and
+// JSON-LD VideoObject stay in sync.
+func findVideoEmbed(pv *appbsky.FeedDefs_PostView, embedHidden bool) *appbsky.EmbedVideo_View {
+	if pv == nil || pv.Embed == nil || embedHidden {
+		return nil
+	}
+	if pv.Embed.EmbedVideo_View != nil {
+		return pv.Embed.EmbedVideo_View
+	}
+	if pv.Embed.EmbedRecordWithMedia_View != nil &&
+		pv.Embed.EmbedRecordWithMedia_View.Media != nil &&
+		pv.Embed.EmbedRecordWithMedia_View.Media.EmbedVideo_View != nil {
+		return pv.Embed.EmbedRecordWithMedia_View.Media.EmbedVideo_View
+	}
+	return nil
+}
+
+// buildVideoObject returns a VideoObject for the post's video embed, or
+// nil if there's no usable video. Falls back to "Video by @<handle>" when
+// alt text is empty so name is always populated (Google requires it).
+// description falls back to name for the same reason.
+func buildVideoObject(pv *appbsky.FeedDefs_PostView, embedURL, postText string, embedHidden bool) *videoObject {
+	v := findVideoEmbed(pv, embedHidden)
+	if v == nil || v.Playlist == "" {
+		return nil
+	}
+	vo := &videoObject{
+		Type:       "VideoObject",
+		ContentURL: v.Playlist,
+		EmbedURL:   embedURL,
+		// uploadDate uses IndexedAt (not record CreatedAt) for consistency
+		// with DiscussionForumPosting.datePublished on the parent post.
+		UploadDate: pv.IndexedAt,
+	}
+	if v.Thumbnail != nil {
+		vo.ThumbnailURL = *v.Thumbnail
+	}
+	switch {
+	case v.Alt != nil && *v.Alt != "":
+		vo.Name = *v.Alt
+	case pv.Author != nil && pv.Author.Handle != "" && pv.Author.Handle != "handle.invalid":
+		vo.Name = "Video by @" + pv.Author.Handle
+	default:
+		vo.Name = "Video on Bluesky"
+	}
+	if postText != "" {
+		vo.Description = postText
+	} else {
+		vo.Description = vo.Name
+	}
+	if v.AspectRatio != nil {
+		vo.Width = v.AspectRatio.Width
+		vo.Height = v.AspectRatio.Height
+	}
+	return vo
+}
+
 // extractQuotedPostURL returns the canonical URL of a quoted post, or ""
 // if the embed is blocked / not-found / detached / a non-post record.
 func extractQuotedPostURL(pv *appbsky.FeedDefs_PostView) string {
@@ -214,6 +345,43 @@ func extractSharedContentURL(pv *appbsky.FeedDefs_PostView) string {
 	return ""
 }
 
+// threadRootURI returns the AT-URI of the root post of the thread a reply
+// belongs to, or "" if the post is not a reply or the record is malformed.
+func threadRootURI(pv *appbsky.FeedDefs_PostView) string {
+	if pv == nil || pv.Record == nil {
+		return ""
+	}
+	rec, ok := pv.Record.Val.(*appbsky.FeedPost)
+	if !ok || rec.Reply == nil || rec.Reply.Root == nil {
+		return ""
+	}
+	return rec.Reply.Root.Uri
+}
+
+// findRootPostInParents walks tv's parent chain upward and returns the
+// PostView whose URI matches rootURI, or nil if the root is not present.
+// The root is absent when the chain is truncated by parentHeight (reply
+// deeper than the fetched height) or broken by a blocked/not-found parent.
+// Avoids a separate FeedGetPosts call when the thread response already
+// contains the root.
+func findRootPostInParents(tv *appbsky.FeedDefs_ThreadViewPost, rootURI string) *appbsky.FeedDefs_PostView {
+	if rootURI == "" {
+		return nil
+	}
+	for node := tv; node != nil; {
+		if node.Post != nil && node.Post.Uri == rootURI {
+			return node.Post
+		}
+		if node.Parent == nil {
+			return nil
+		}
+		// Only threadViewPost parents continue the chain; a blocked or
+		// not-found parent breaks it before reaching the root.
+		node = node.Parent.FeedDefs_ThreadViewPost
+	}
+	return nil
+}
+
 // buildAuthor constructs a Person. Organization classification for
 // custom-domain accounts is a future enhancement.
 func buildAuthor(author *appbsky.ActorDefs_ProfileViewBasic) *personOrOrg {
@@ -363,14 +531,18 @@ func buildPostNode(pv *appbsky.FeedDefs_PostView, replies []*appbsky.FeedDefs_Th
 		thumb = images[0]
 	}
 
+	postURL := bskyPostURLFromATURIWithDIDFallback(pv.Author.Handle, pv.Uri)
+	postText := postRecordText(pv)
+
 	node := discussionForumPosting{
 		Type:            "DiscussionForumPosting",
-		URL:             bskyPostURLFromATURI(pv.Author.Handle, pv.Uri),
+		URL:             postURL,
 		Identifier:      pv.Uri,
 		Author:          buildAuthor(pv.Author),
-		Text:            postRecordText(pv),
+		Text:            postText,
 		Image:           images,
 		ThumbnailURL:    thumb,
+		Video:           buildVideoObject(pv, postURL, postText, embedHidden),
 		DatePublished:   pv.IndexedAt,
 		InteractionStat: buildPostStats(pv),
 	}
@@ -433,27 +605,38 @@ func buildReplyNode(pv *appbsky.FeedDefs_PostView, hideLabels map[string]bool) c
 	if len(images) > 0 {
 		thumb = images[0]
 	}
+	postURL := bskyPostURLFromATURIWithDIDFallback(pv.Author.Handle, pv.Uri)
+	postText := postRecordText(pv)
 	return comment{
 		Type:          "Comment",
-		URL:           bskyPostURLFromATURI(pv.Author.Handle, pv.Uri),
+		URL:           postURL,
 		Identifier:    pv.Uri,
 		Author:        buildAuthor(pv.Author),
-		Text:          postRecordText(pv),
+		Text:          postText,
 		Image:         images,
 		ThumbnailURL:  thumb,
+		Video:         buildVideoObject(pv, postURL, postText, embedHidden),
 		DatePublished: pv.IndexedAt,
 	}
 }
 
 // buildPostJSONLD marshals the WebPage envelope wrapping a
 // DiscussionForumPosting. canonicalURL is used for both envelope.url and
-// (as a fallback) mainEntity.url so they always agree.
-func buildPostJSONLD(pv *appbsky.FeedDefs_PostView, replies []*appbsky.FeedDefs_ThreadViewPost_Replies_Elem, canonicalURL string, hideLabels, hideReplyLabels map[string]bool) (string, error) {
+// (as a fallback) mainEntity.url so they always agree. isPartOfURL, when
+// non-empty, is the handle-form canonical URL of the thread root the handler
+// resolved for a reply; pass "" to omit isPartOf (non-reply, or the root could
+// not be resolved). We never emit a DID-form isPartOf because it would not
+// match the root page's handle-form canonical.
+func buildPostJSONLD(pv *appbsky.FeedDefs_PostView, replies []*appbsky.FeedDefs_ThreadViewPost_Replies_Elem, canonicalURL string, isPartOfURL string, hideLabels, hideReplyLabels map[string]bool) (string, error) {
 	if pv == nil || pv.Author == nil {
 		return "", fmt.Errorf("nil post view or author")
 	}
 	node := buildPostNode(pv, replies, hideLabels, hideReplyLabels)
 
+	if isPartOfURL != "" {
+		node.IsPartOf = isPartOfURL
+	}
+
 	// mainEntity.url is empty when the author handle is unusable; fall back
 	// to canonicalURL so it agrees with envelope.url.
 	if node.URL == "" {

bskyweb/cmd/bskyweb/jsonld_test.go

@@ -72,6 +72,60 @@ func withImages(thumbs ...string) func(*appbsky.FeedDefs_PostView) {
 	}
 }
 
+// withGallery adds an app.bsky.embed.gallery view with image items.
+func withGallery(thumbs ...string) func(*appbsky.FeedDefs_PostView) {
+	return func(pv *appbsky.FeedDefs_PostView) {
+		var items []*appbsky.EmbedGallery_View_Items_Elem
+		for _, t := range thumbs {
+			items = append(items, &appbsky.EmbedGallery_View_Items_Elem{
+				EmbedGallery_ViewImage: &appbsky.EmbedGallery_ViewImage{
+					Thumbnail: t,
+					Fullsize:  t + "_full",
+				},
+			})
+		}
+		pv.Embed = &appbsky.FeedDefs_PostView_Embed{
+			EmbedGallery_View: &appbsky.EmbedGallery_View{Items: items},
+		}
+	}
+}
+
+// withRecordWithMediaGallery adds a record-with-media embed whose media slot
+// is an app.bsky.embed.gallery view.
+func withRecordWithMediaGallery(qHandle, qDid, qRkey string, thumbs ...string) func(*appbsky.FeedDefs_PostView) {
+	return func(pv *appbsky.FeedDefs_PostView) {
+		var items []*appbsky.EmbedGallery_View_Items_Elem
+		for _, t := range thumbs {
+			items = append(items, &appbsky.EmbedGallery_View_Items_Elem{
+				EmbedGallery_ViewImage: &appbsky.EmbedGallery_ViewImage{
+					Thumbnail: t,
+					Fullsize:  t + "_full",
+				},
+			})
+		}
+		pv.Embed = &appbsky.FeedDefs_PostView_Embed{
+			EmbedRecordWithMedia_View: &appbsky.EmbedRecordWithMedia_View{
+				Record: &appbsky.EmbedRecord_View{
+					Record: &appbsky.EmbedRecord_View_Record{
+						EmbedRecord_ViewRecord: &appbsky.EmbedRecord_ViewRecord{
+							Uri: "at://" + qDid + "/app.bsky.feed.post/" + qRkey,
+							Cid: "bafy-quoted",
+							Author: &appbsky.ActorDefs_ProfileViewBasic{
+								Did:    qDid,
+								Handle: qHandle,
+							},
+							IndexedAt: "2024-01-01T00:00:00Z",
+						},
+					},
+				},
+				Media: &appbsky.EmbedRecordWithMedia_View_Media{
+					EmbedGallery_View: &appbsky.EmbedGallery_View{Items: items},
+				},
+			},
+		}
+	}
+}
+
 // withVideo adds a video embed with a thumbnail.
 func withVideo(thumb string) func(*appbsky.FeedDefs_PostView) {
 	return func(pv *appbsky.FeedDefs_PostView) {
@@ -129,6 +183,19 @@ func withQuotePostBlocked() func(*appbsky.FeedDefs_PostView) {
 	}
 }
 
+// withReplyRoot marks the post as a reply by setting its record's Reply.Root
+// strong-ref to the given thread-root post.
+func withReplyRoot(rootDid, rootRkey string) func(*appbsky.FeedDefs_PostView) {
+	return func(pv *appbsky.FeedDefs_PostView) {
+		rec, _ := pv.Record.Val.(*appbsky.FeedPost)
+		uri := "at://" + rootDid + "/app.bsky.feed.post/" + rootRkey
+		rec.Reply = &appbsky.FeedPost_ReplyRef{
+			Root:   &comatprototypes.RepoStrongRef{Uri: uri, Cid: "bafy-root"},
+			Parent: &comatprototypes.RepoStrongRef{Uri: uri, Cid: "bafy-root"},
+		}
+	}
+}
+
 // withSelfLabel adds a self-label that should hide embeds.
 func withSelfLabel(val string) func(*appbsky.FeedDefs_PostView) {
 	return func(pv *appbsky.FeedDefs_PostView) {
@@ -209,7 +276,7 @@ func unmarshalLD(t *testing.T, s string) map[string]any {
 func TestBuildPostJSONLD_Bare(t *testing.T) {
 	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "hello")
 	canonical := "https://bsky.app/profile/alice.bsky.social/post/abc123"
-	out, err := buildPostJSONLD(pv, nil, canonical, hideEmbedLabels, hideReplyLabels)
+	out, err := buildPostJSONLD(pv, nil, canonical, "", hideEmbedLabels, hideReplyLabels)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -279,7 +346,7 @@ func TestBuildPostJSONLD_WithImages(t *testing.T) {
 	thumb1 := "https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:alice/abc@jpeg"
 	thumb2 := "https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:alice/def@jpeg"
 	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "look", withImages(thumb1, thumb2))
-	out, err := buildPostJSONLD(pv, nil, "https://bsky.app/profile/alice.bsky.social/post/abc123", hideEmbedLabels, hideReplyLabels)
+	out, err := buildPostJSONLD(pv, nil, "https://bsky.app/profile/alice.bsky.social/post/abc123", "", hideEmbedLabels, hideReplyLabels)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -299,10 +366,92 @@ func TestBuildPostJSONLD_WithImages(t *testing.T) {
 	}
 }
 
+func TestBuildPostJSONLD_WithGallery(t *testing.T) {
+	thumb1 := "https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:alice/g1@jpeg"
+	thumb2 := "https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:alice/g2@jpeg"
+	thumb3 := "https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:alice/g3@jpeg"
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "gallery", withGallery(thumb1, thumb2, thumb3))
+	out, err := buildPostJSONLD(pv, nil, "https://bsky.app/profile/alice.bsky.social/post/abc123", "", hideEmbedLabels, hideReplyLabels)
+	if err != nil {
+		t.Fatal(err)
+	}
+	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
+	imgs, ok := main["image"].([]any)
+	if !ok {
+		t.Fatalf("image should be array, got %T", main["image"])
+	}
+	if len(imgs) != 3 {
+		t.Errorf("expected 3 gallery images, got %d", len(imgs))
+	}
+	if imgs[0] != thumb1 || imgs[1] != thumb2 || imgs[2] != thumb3 {
+		t.Errorf("gallery image[] order wrong: %v", imgs)
+	}
+	if main["thumbnailUrl"] != thumb1 {
+		t.Errorf("thumbnailUrl should equal image[0] (Google byte-equality requirement), got %v", main["thumbnailUrl"])
+	}
+}
+
+// Gallery in the media slot of a record-with-media embed should still
+// produce og:image / JSON-LD image[]. Quote-post URL still emits
+// alongside via isBasedOn.
+func TestBuildPostJSONLD_GalleryInRecordWithMedia(t *testing.T) {
+	thumb := "https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:alice/g@jpeg"
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "quote+gallery",
+		withRecordWithMediaGallery("bob.example.com", "did:plc:bob", "xyz", thumb))
+	out, err := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
+	if err != nil {
+		t.Fatal(err)
+	}
+	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
+	imgs, ok := main["image"].([]any)
+	if !ok || len(imgs) != 1 || imgs[0] != thumb {
+		t.Errorf("expected single gallery thumb in image[], got %v", main["image"])
+	}
+	if main["thumbnailUrl"] != thumb {
+		t.Errorf("thumbnailUrl wrong: %v", main["thumbnailUrl"])
+	}
+	if main["isBasedOn"] != "https://bsky.app/profile/bob.example.com/post/xyz" {
+		t.Errorf("isBasedOn should still emit for record-with-media gallery, got %v", main["isBasedOn"])
+	}
+}
+
+// Forward-compat: nil items, unknown-variant union elements, and empty
+// Thumbnail strings must be skipped, not panic or leak as <meta
+// property="og:image" content="">. Unknown variants are dropped silently
+// so older deploys keep working when new gallery item types ship.
+func TestExtractPostMedia_GallerySkipsUnknownItems(t *testing.T) {
+	thumb := "https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:alice/g@jpeg"
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "gallery")
+	pv.Embed = &appbsky.FeedDefs_PostView_Embed{
+		EmbedGallery_View: &appbsky.EmbedGallery_View{
+			Items: []*appbsky.EmbedGallery_View_Items_Elem{
+				nil,
+				{}, // empty union, no variant set
+				{EmbedGallery_ViewImage: &appbsky.EmbedGallery_ViewImage{Thumbnail: ""}}, // empty Thumbnail
+				{EmbedGallery_ViewImage: &appbsky.EmbedGallery_ViewImage{Thumbnail: thumb}},
+			},
+		},
+	}
+	got := extractPostMedia(pv, false)
+	if len(got) != 1 || got[0] != thumb {
+		t.Errorf("expected single thumb, got %v", got)
+	}
+
+	// All-nil / all-unknown gallery should produce no thumbs (not [""]).
+	pv.Embed = &appbsky.FeedDefs_PostView_Embed{
+		EmbedGallery_View: &appbsky.EmbedGallery_View{
+			Items: []*appbsky.EmbedGallery_View_Items_Elem{nil, {}},
+		},
+	}
+	if got := extractPostMedia(pv, false); got != nil {
+		t.Errorf("expected nil for empty/unknown-only gallery, got %v", got)
+	}
+}
+
 func TestBuildPostJSONLD_WithVideo(t *testing.T) {
 	thumb := "https://cdn.bsky.app/img/video_thumbnail/plain/did:plc:alice/v@jpeg"
 	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "watch", withVideo(thumb))
-	out, _ := buildPostJSONLD(pv, nil, "u", hideEmbedLabels, hideReplyLabels)
+	out, _ := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
 	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
 	if main["thumbnailUrl"] != thumb {
 		t.Errorf("video thumbnailUrl wrong: %v", main["thumbnailUrl"])
@@ -315,7 +464,7 @@ func TestBuildPostJSONLD_WithVideo(t *testing.T) {
 
 func TestBuildPostJSONLD_QuotePost(t *testing.T) {
 	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "quoting!", withQuotePost("bob.example.com", "did:plc:bob", "xyz"))
-	out, _ := buildPostJSONLD(pv, nil, "u", hideEmbedLabels, hideReplyLabels)
+	out, _ := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
 	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
 	if main["isBasedOn"] != "https://bsky.app/profile/bob.example.com/post/xyz" {
 		t.Errorf("isBasedOn wrong: %v", main["isBasedOn"])
@@ -324,16 +473,122 @@ func TestBuildPostJSONLD_QuotePost(t *testing.T) {
 
 func TestBuildPostJSONLD_QuoteBlocked(t *testing.T) {
 	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "quoting blocked", withQuotePostBlocked())
-	out, _ := buildPostJSONLD(pv, nil, "u", hideEmbedLabels, hideReplyLabels)
+	out, _ := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
 	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
 	if _, present := main["isBasedOn"]; present {
 		t.Errorf("blocked quote should not produce isBasedOn")
 	}
 }
 
+func TestBuildPostJSONLD_IsPartOf(t *testing.T) {
+	// isPartOf is sourced solely from the handler-resolved URL. When supplied,
+	// it is emitted on the main post; when empty, no isPartOf is present.
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "a reply")
+	isPartOf := "https://bsky.app/profile/root.bsky.social/post/rootrkey"
+	out, _ := buildPostJSONLD(pv, nil, "u", isPartOf, hideEmbedLabels, hideReplyLabels)
+	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
+	if main["isPartOf"] != isPartOf {
+		t.Errorf("isPartOf = %v, want %v", main["isPartOf"], isPartOf)
+	}
+
+	out, _ = buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
+	main = unmarshalLD(t, out)["mainEntity"].(map[string]any)
+	if _, present := main["isPartOf"]; present {
+		t.Errorf("empty isPartOfURL should omit isPartOf, got %v", main["isPartOf"])
+	}
+}
+
+func TestThreadRootURI(t *testing.T) {
+	// A reply returns its root AT-URI; a non-reply returns "".
+	reply := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "a reply",
+		withReplyRoot("did:plc:root", "rootrkey"))
+	want := "at://did:plc:root/app.bsky.feed.post/rootrkey"
+	if got := threadRootURI(reply); got != want {
+		t.Errorf("threadRootURI = %q, want %q", got, want)
+	}
+
+	post := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "not a reply")
+	if got := threadRootURI(post); got != "" {
+		t.Errorf("threadRootURI on non-reply = %q, want empty", got)
+	}
+}
+
+func TestFindRootPostInParents(t *testing.T) {
+	rootPost := makePostView("root.bsky.social", "did:plc:root", "rootrkey", "root")
+	rootURI := rootPost.Uri
+
+	// tvp wraps a PostView, optionally chaining to a parent thread node.
+	tvp := func(pv *appbsky.FeedDefs_PostView, parent *appbsky.FeedDefs_ThreadViewPost) *appbsky.FeedDefs_ThreadViewPost {
+		node := &appbsky.FeedDefs_ThreadViewPost{Post: pv}
+		if parent != nil {
+			node.Parent = &appbsky.FeedDefs_ThreadViewPost_Parent{FeedDefs_ThreadViewPost: parent}
+		}
+		return node
+	}
+
+	t.Run("direct reply, parent is root", func(t *testing.T) {
+		leaf := tvp(makePostView("alice.bsky.social", "did:plc:alice", "leaf", "reply"), tvp(rootPost, nil))
+		if got := findRootPostInParents(leaf, rootURI); got != rootPost {
+			t.Errorf("expected root post, got %v", got)
+		}
+	})
+
+	t.Run("multi-level chain", func(t *testing.T) {
+		mid := tvp(makePostView("bob.bsky.social", "did:plc:bob", "mid", "mid"), tvp(rootPost, nil))
+		leaf := tvp(makePostView("alice.bsky.social", "did:plc:alice", "leaf", "reply"), mid)
+		if got := findRootPostInParents(leaf, rootURI); got != rootPost {
+			t.Errorf("expected root post in chain, got %v", got)
+		}
+	})
+
+	t.Run("root absent, chain truncated", func(t *testing.T) {
+		// Topmost parent is not the root (e.g. parentHeight cut off the chain).
+		topmost := makePostView("bob.bsky.social", "did:plc:bob", "mid", "mid")
+		leaf := tvp(makePostView("alice.bsky.social", "did:plc:alice", "leaf", "reply"), tvp(topmost, nil))
+		if got := findRootPostInParents(leaf, rootURI); got != nil {
+			t.Errorf("expected nil when root absent, got %v", got)
+		}
+	})
+
+	t.Run("chain broken by blocked parent", func(t *testing.T) {
+		// A blocked/not-found parent yields a nil FeedDefs_ThreadViewPost,
+		// breaking the walk before the root.
+		leaf := &appbsky.FeedDefs_ThreadViewPost{
+			Post: makePostView("alice.bsky.social", "did:plc:alice", "leaf", "reply"),
+			Parent: &appbsky.FeedDefs_ThreadViewPost_Parent{
+				FeedDefs_BlockedPost: &appbsky.FeedDefs_BlockedPost{Uri: rootURI},
+			},
+		}
+		if got := findRootPostInParents(leaf, rootURI); got != nil {
+			t.Errorf("expected nil when chain broken by blocked parent, got %v", got)
+		}
+	})
+
+	t.Run("empty rootURI", func(t *testing.T) {
+		leaf := tvp(makePostView("alice.bsky.social", "did:plc:alice", "leaf", "reply"), tvp(rootPost, nil))
+		if got := findRootPostInParents(leaf, ""); got != nil {
+			t.Errorf("expected nil for empty rootURI, got %v", got)
+		}
+	})
+}
+
+func TestBuildPostJSONLD_ReplyCommentsNoIsPartOf(t *testing.T) {
+	// Replies surfaced under the main post as comment[] are Comment nodes and
+	// never carry isPartOf, even when the main post has one.
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "main")
+	reply := makePostView("bob.bsky.social", "did:plc:bob", "rep1", "a reply")
+	isPartOf := "https://bsky.app/profile/root.bsky.social/post/rootrkey"
+	out, _ := buildPostJSONLD(pv, buildReplies(reply), "u", isPartOf, hideEmbedLabels, hideReplyLabels)
+	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
+	c := main["comment"].([]any)[0].(map[string]any)
+	if _, present := c["isPartOf"]; present {
+		t.Errorf("comment entries should not carry isPartOf, got %v", c["isPartOf"])
+	}
+}
+
 func TestBuildPostJSONLD_ExternalEmbed(t *testing.T) {
 	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "check this out", withExternalEmbed("https://www.spiegel.de/article", "Title"))
-	out, _ := buildPostJSONLD(pv, nil, "u", hideEmbedLabels, hideReplyLabels)
+	out, _ := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
 	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
 	sc, ok := main["sharedContent"].(map[string]any)
 	if !ok {
@@ -351,7 +606,7 @@ func TestBuildPostJSONLD_HiddenEmbed(t *testing.T) {
 	thumb := "https://cdn.bsky.app/img/x@jpeg"
 	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "nsfw",
 		withImages(thumb), withSelfLabel("porn"))
-	out, _ := buildPostJSONLD(pv, nil, "u", hideEmbedLabels, hideReplyLabels)
+	out, _ := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
 	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
 	if _, present := main["image"]; present {
 		t.Errorf("hidden-embed post should not emit image")
@@ -361,11 +616,30 @@ func TestBuildPostJSONLD_HiddenEmbed(t *testing.T) {
 	}
 }
 
+// Symmetric guard for the gallery extraction path. Functionally redundant
+// with the early-return at the top of extractPostMedia, but exists so the
+// hide-embed contract is asserted directly against the gallery branch -
+// catches anyone who later moves the embedHidden check inside an
+// embed-shape branch.
+func TestBuildPostJSONLD_HiddenEmbed_Gallery(t *testing.T) {
+	thumb := "https://cdn.bsky.app/img/g@jpeg"
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "nsfw",
+		withGallery(thumb), withSelfLabel("porn"))
+	out, _ := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
+	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
+	if _, present := main["image"]; present {
+		t.Errorf("hidden-embed gallery post should not emit image")
+	}
+	if _, present := main["thumbnailUrl"]; present {
+		t.Errorf("hidden-embed gallery post should not emit thumbnailUrl")
+	}
+}
+
 func TestBuildPostJSONLD_TextEscaping(t *testing.T) {
 	// Includes ", \, newline, </script>, and a unicode char.
 	tricky := "hello \"world\" \\ <\\>\n</script> 🎉"
 	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", tricky)
-	out, err := buildPostJSONLD(pv, nil, "u", hideEmbedLabels, hideReplyLabels)
+	out, err := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -401,7 +675,7 @@ func TestBuildPostJSONLD_Comments(t *testing.T) {
 		FeedDefs_BlockedPost: &appbsky.FeedDefs_BlockedPost{Uri: "at://x/y/z"},
 	})
 
-	out, _ := buildPostJSONLD(pv, replies, "u", hideEmbedLabels, hideReplyLabels)
+	out, _ := buildPostJSONLD(pv, replies, "u", "", hideEmbedLabels, hideReplyLabels)
 	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
 
 	if cc := main["commentCount"].(float64); int64(cc) != 14 {
@@ -443,7 +717,7 @@ func TestBuildPostJSONLD_Comments(t *testing.T) {
 func TestBuildPostJSONLD_HandleInvalidAuthor(t *testing.T) {
 	pv := makePostView("handle.invalid", "did:plc:alice", "abc123", "hello")
 	fallback := "https://bsky.app/profile/did:plc:alice/post/abc123"
-	out, _ := buildPostJSONLD(pv, nil, fallback, hideEmbedLabels, hideReplyLabels)
+	out, _ := buildPostJSONLD(pv, nil, fallback, "", hideEmbedLabels, hideReplyLabels)
 	envelope := unmarshalLD(t, out)
 	main := envelope["mainEntity"].(map[string]any)
 	// mainEntity.url falls back to the caller's canonical URL so envelope
@@ -492,7 +766,7 @@ func TestBuildPostJSONLD_EnvelopeURLMatchesMainEntity(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			pv := makePostView(tc.handle, tc.did, tc.rkey, "hi")
-			out, _ := buildPostJSONLD(pv, nil, tc.canonical, hideEmbedLabels, hideReplyLabels)
+			out, _ := buildPostJSONLD(pv, nil, tc.canonical, "", hideEmbedLabels, hideReplyLabels)
 			env := unmarshalLD(t, out)
 			main := env["mainEntity"].(map[string]any)
 			if env["url"] != tc.canonical {
@@ -509,7 +783,7 @@ func TestBuildPostJSONLD_NilAuthor(t *testing.T) {
 	// Defensive: don't panic if Author is nil.
 	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "hi")
 	pv.Author = nil
-	if _, err := buildPostJSONLD(pv, nil, "u", hideEmbedLabels, hideReplyLabels); err == nil {
+	if _, err := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels); err == nil {
 		t.Errorf("expected error for nil-author post, got nil")
 	}
 }
@@ -527,7 +801,7 @@ func TestBuildPostJSONLD_NilAuthorReply(t *testing.T) {
 		{FeedDefs_ThreadViewPost: &appbsky.FeedDefs_ThreadViewPost{Post: goodReply}},
 		{FeedDefs_ThreadViewPost: &appbsky.FeedDefs_ThreadViewPost{Post: badReply}},
 	}
-	out, err := buildPostJSONLD(pv, replies, "u", hideEmbedLabels, hideReplyLabels)
+	out, err := buildPostJSONLD(pv, replies, "u", "", hideEmbedLabels, hideReplyLabels)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -548,7 +822,7 @@ func TestBuildPostJSONLD_CommentMedia(t *testing.T) {
 	replies := []*appbsky.FeedDefs_ThreadViewPost_Replies_Elem{
 		{FeedDefs_ThreadViewPost: &appbsky.FeedDefs_ThreadViewPost{Post: reply}},
 	}
-	out, _ := buildPostJSONLD(pv, replies, "u", hideEmbedLabels, hideReplyLabels)
+	out, _ := buildPostJSONLD(pv, replies, "u", "", hideEmbedLabels, hideReplyLabels)
 	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
 	c := main["comment"].([]any)[0].(map[string]any)
 	imgs, ok := c["image"].([]any)
@@ -755,7 +1029,7 @@ func TestBuildPostJSONLD_HiddenReplyDropped_PostViewLabel(t *testing.T) {
 	good := makePostView("bob.bsky.social", "did:plc:bob", "rep1", "good reply")
 	bad := makePostView("eve.bsky.social", "did:plc:eve", "rep2", "spam reply",
 		withPostLabel("!hide", false))
-	out, _ := buildPostJSONLD(pv, buildReplies(good, bad), "u", hideEmbedLabels, hideReplyLabels)
+	out, _ := buildPostJSONLD(pv, buildReplies(good, bad), "u", "", hideEmbedLabels, hideReplyLabels)
 	ids := commentIdentifiers(t, out)
 	if len(ids) != 1 || ids[0] != good.Uri {
 		t.Errorf("expected only the unlabeled reply to remain, got %v", ids)
@@ -768,7 +1042,7 @@ func TestBuildPostJSONLD_HiddenReplyDropped_SelfLabel(t *testing.T) {
 	good := makePostView("bob.bsky.social", "did:plc:bob", "rep1", "good reply")
 	bad := makePostView("eve.bsky.social", "did:plc:eve", "rep2", "spam reply",
 		withSelfLabel("spam"))
-	out, _ := buildPostJSONLD(pv, buildReplies(good, bad), "u", hideEmbedLabels, hideReplyLabels)
+	out, _ := buildPostJSONLD(pv, buildReplies(good, bad), "u", "", hideEmbedLabels, hideReplyLabels)
 	ids := commentIdentifiers(t, out)
 	if len(ids) != 1 || ids[0] != good.Uri {
 		t.Errorf("expected self-labeled reply dropped, got %v", ids)
@@ -784,7 +1058,7 @@ func TestBuildPostJSONLD_HiddenReplyDropped_EmbedLabel(t *testing.T) {
 	// union behavior.
 	bad := makePostView("eve.bsky.social", "did:plc:eve", "rep2", "concerning reply",
 		withPostLabel("self-harm", false))
-	out, _ := buildPostJSONLD(pv, buildReplies(good, bad), "u", hideEmbedLabels, hideReplyLabels)
+	out, _ := buildPostJSONLD(pv, buildReplies(good, bad), "u", "", hideEmbedLabels, hideReplyLabels)
 	ids := commentIdentifiers(t, out)
 	if len(ids) != 1 || ids[0] != good.Uri {
 		t.Errorf("expected embed-labeled reply dropped, got %v", ids)
@@ -796,7 +1070,7 @@ func TestBuildPostJSONLD_NegatedHideLabelKept(t *testing.T) {
 	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "main")
 	reply := makePostView("bob.bsky.social", "did:plc:bob", "rep1", "fine reply",
 		withPostLabel("!hide", true))
-	out, _ := buildPostJSONLD(pv, buildReplies(reply), "u", hideEmbedLabels, hideReplyLabels)
+	out, _ := buildPostJSONLD(pv, buildReplies(reply), "u", "", hideEmbedLabels, hideReplyLabels)
 	ids := commentIdentifiers(t, out)
 	if len(ids) != 1 || ids[0] != reply.Uri {
 		t.Errorf("expected negated-label reply to be kept, got %v", ids)
@@ -807,7 +1081,7 @@ func TestBuildPostJSONLD_ReplyAuthorHasIdentifier(t *testing.T) {
 	// Reply author should also carry a DID identifier.
 	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "main")
 	reply := makePostView("bob.bsky.social", "did:plc:bob", "rep1", "hi")
-	out, _ := buildPostJSONLD(pv, buildReplies(reply), "u", hideEmbedLabels, hideReplyLabels)
+	out, _ := buildPostJSONLD(pv, buildReplies(reply), "u", "", hideEmbedLabels, hideReplyLabels)
 	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
 	c := main["comment"].([]any)[0].(map[string]any)
 	auth, ok := c["author"].(map[string]any)
@@ -948,7 +1222,7 @@ func TestBuildPostJSONLD_AuthorReviewedBy(t *testing.T) {
 	})
 	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "hi",
 		withVerifications(state))
-	out, err := buildPostJSONLD(pv, nil, "u", hideEmbedLabels, hideReplyLabels)
+	out, err := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -988,7 +1262,7 @@ func TestBuildPostJSONLD_ReplyAuthorNoReviewedBy(t *testing.T) {
 	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "main")
 	reply := makePostView("bob.bsky.social", "did:plc:bob", "rep1", "hi",
 		withVerifications(state))
-	out, _ := buildPostJSONLD(pv, buildReplies(reply), "u", hideEmbedLabels, hideReplyLabels)
+	out, _ := buildPostJSONLD(pv, buildReplies(reply), "u", "", hideEmbedLabels, hideReplyLabels)
 	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
 	c := main["comment"].([]any)[0].(map[string]any)
 	auth := c["author"].(map[string]any)
@@ -1049,3 +1323,339 @@ func TestBuildProfileJSONLD_HasPartAuthorReviewedBy(t *testing.T) {
 		t.Errorf("verifier identifier wrong: %v", rb[0])
 	}
 }
+
+// videoEmbedOpts configures withVideoFull. Zero values mean "not set".
+type videoEmbedOpts struct {
+	thumbnail   string
+	playlist    string
+	alt         string
+	width       int64
+	height      int64
+	hasAspect   bool
+	recordMedia bool // nest under EmbedRecordWithMedia_View.Media
+}
+
+// withVideoFull installs a fully-specified video embed for VideoObject tests.
+func withVideoFull(o videoEmbedOpts) func(*appbsky.FeedDefs_PostView) {
+	return func(pv *appbsky.FeedDefs_PostView) {
+		v := &appbsky.EmbedVideo_View{Playlist: o.playlist}
+		if o.thumbnail != "" {
+			v.Thumbnail = strPtr(o.thumbnail)
+		}
+		if o.alt != "" {
+			v.Alt = strPtr(o.alt)
+		}
+		if o.hasAspect {
+			v.AspectRatio = &appbsky.EmbedDefs_AspectRatio{Width: o.width, Height: o.height}
+		}
+		if o.recordMedia {
+			pv.Embed = &appbsky.FeedDefs_PostView_Embed{
+				EmbedRecordWithMedia_View: &appbsky.EmbedRecordWithMedia_View{
+					Record: &appbsky.EmbedRecord_View{
+						Record: &appbsky.EmbedRecord_View_Record{
+							EmbedRecord_ViewRecord: &appbsky.EmbedRecord_ViewRecord{
+								Uri: "at://did:plc:quoted/app.bsky.feed.post/q",
+								Cid: "bafy-quoted",
+								Author: &appbsky.ActorDefs_ProfileViewBasic{
+									Did:    "did:plc:quoted",
+									Handle: "quoted.bsky.social",
+								},
+								IndexedAt: "2024-01-01T00:00:00Z",
+							},
+						},
+					},
+					Media: &appbsky.EmbedRecordWithMedia_View_Media{
+						EmbedVideo_View: v,
+					},
+				},
+			}
+		} else {
+			pv.Embed = &appbsky.FeedDefs_PostView_Embed{
+				EmbedVideo_View: v,
+			}
+		}
+	}
+}
+
+func TestBuildPostJSONLD_WithVideoObject(t *testing.T) {
+	thumb := "https://cdn.bsky.app/img/video_thumbnail/plain/did:plc:alice/v@jpeg"
+	playlist := "https://video.bsky.app/v/did:plc:alice/v/playlist.m3u8"
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "watch this",
+		withVideoFull(videoEmbedOpts{
+			thumbnail: thumb, playlist: playlist, alt: "A trip to the park",
+			hasAspect: true, width: 16, height: 9,
+		}))
+	canonical := "https://bsky.app/profile/alice.bsky.social/post/abc123"
+	out, err := buildPostJSONLD(pv, nil, canonical, "", hideEmbedLabels, hideReplyLabels)
+	if err != nil {
+		t.Fatal(err)
+	}
+	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
+	video, ok := main["video"].(map[string]any)
+	if !ok {
+		t.Fatalf("video missing from mainEntity")
+	}
+	if video["@type"] != "VideoObject" {
+		t.Errorf("@type = %v, want VideoObject", video["@type"])
+	}
+	if video["name"] != "A trip to the park" {
+		t.Errorf("name = %v, want alt text", video["name"])
+	}
+	if video["description"] != "watch this" {
+		t.Errorf("description = %v, want post text", video["description"])
+	}
+	if video["thumbnailUrl"] != thumb {
+		t.Errorf("thumbnailUrl = %v, want %v", video["thumbnailUrl"], thumb)
+	}
+	if video["uploadDate"] != pv.IndexedAt {
+		t.Errorf("uploadDate = %v, want %v", video["uploadDate"], pv.IndexedAt)
+	}
+	if video["contentUrl"] != playlist {
+		t.Errorf("contentUrl = %v, want %v", video["contentUrl"], playlist)
+	}
+	if video["embedUrl"] != canonical {
+		t.Errorf("embedUrl = %v, want %v", video["embedUrl"], canonical)
+	}
+	if w, _ := video["width"].(float64); int64(w) != 16 {
+		t.Errorf("width = %v, want 16", video["width"])
+	}
+	if h, _ := video["height"].(float64); int64(h) != 9 {
+		t.Errorf("height = %v, want 9", video["height"])
+	}
+	// post thumbnailUrl should equal the video thumb (byte-equal og:image).
+	if main["thumbnailUrl"] != thumb {
+		t.Errorf("post thumbnailUrl = %v, want %v", main["thumbnailUrl"], thumb)
+	}
+}
+
+func TestBuildPostJSONLD_VideoNameFallback(t *testing.T) {
+	// No alt text -> "Video by @<handle>".
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "no alt here",
+		withVideoFull(videoEmbedOpts{
+			playlist: "https://video.bsky.app/p.m3u8",
+		}))
+	out, _ := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
+	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
+	video, ok := main["video"].(map[string]any)
+	if !ok {
+		t.Fatalf("video missing")
+	}
+	if video["name"] != "Video by @alice.bsky.social" {
+		t.Errorf("name fallback = %v", video["name"])
+	}
+}
+
+func TestBuildPostJSONLD_VideoNameFallbackHandleInvalid(t *testing.T) {
+	// handle.invalid + no alt -> generic fallback.
+	pv := makePostView("handle.invalid", "did:plc:alice", "abc123", "x",
+		withVideoFull(videoEmbedOpts{
+			playlist: "https://video.bsky.app/p.m3u8",
+		}))
+	out, _ := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
+	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
+	video := main["video"].(map[string]any)
+	if video["name"] != "Video on Bluesky" {
+		t.Errorf("name fallback = %v, want generic", video["name"])
+	}
+}
+
+func TestBuildPostJSONLD_VideoDescriptionFallback(t *testing.T) {
+	// Empty post text -> description falls back to name so Google's video
+	// rich-result requirement (description present) is satisfied.
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "",
+		withVideoFull(videoEmbedOpts{
+			playlist: "https://video.bsky.app/p.m3u8", alt: "scenic clip",
+		}))
+	out, _ := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
+	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
+	video := main["video"].(map[string]any)
+	if video["description"] != "scenic clip" {
+		t.Errorf("description fallback = %v, want name", video["description"])
+	}
+}
+
+func TestBuildPostJSONLD_VideoNoAspectRatio(t *testing.T) {
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "x",
+		withVideoFull(videoEmbedOpts{
+			playlist: "https://video.bsky.app/p.m3u8", alt: "alt",
+		}))
+	out, _ := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
+	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
+	video := main["video"].(map[string]any)
+	if _, present := video["width"]; present {
+		t.Errorf("width should be omitted when AspectRatio missing")
+	}
+	if _, present := video["height"]; present {
+		t.Errorf("height should be omitted when AspectRatio missing")
+	}
+}
+
+func TestBuildPostJSONLD_VideoMissingPlaylist(t *testing.T) {
+	// No playlist -> VideoObject suppressed; image[]/thumbnailUrl still set
+	// from the video thumb (existing behavior).
+	thumb := "https://cdn.bsky.app/img/video_thumbnail/plain/did:plc:alice/v@jpeg"
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "x",
+		withVideo(thumb))
+	out, _ := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
+	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
+	if _, present := main["video"]; present {
+		t.Errorf("video without playlist should not produce VideoObject")
+	}
+	if main["thumbnailUrl"] != thumb {
+		t.Errorf("thumbnailUrl should still be set from video thumb, got %v", main["thumbnailUrl"])
+	}
+}
+
+func TestBuildPostJSONLD_VideoHiddenEmbed(t *testing.T) {
+	// Self-labeled hide drops the video, parallel to the image-hide test.
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "nsfw",
+		withVideoFull(videoEmbedOpts{
+			thumbnail: "https://cdn.bsky.app/img/x@jpeg",
+			playlist:  "https://video.bsky.app/p.m3u8",
+			alt:       "should be dropped",
+		}),
+		withSelfLabel("porn"))
+	out, _ := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
+	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
+	if _, present := main["video"]; present {
+		t.Errorf("hidden-embed post should not emit video")
+	}
+}
+
+func TestBuildPostJSONLD_VideoInRecordWithMedia(t *testing.T) {
+	thumb := "https://cdn.bsky.app/img/video_thumbnail/plain/did:plc:alice/v@jpeg"
+	playlist := "https://video.bsky.app/p.m3u8"
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "quote+video",
+		withVideoFull(videoEmbedOpts{
+			thumbnail: thumb, playlist: playlist, alt: "alt", recordMedia: true,
+			hasAspect: true, width: 4, height: 3,
+		}))
+	out, _ := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
+	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
+	video, ok := main["video"].(map[string]any)
+	if !ok {
+		t.Fatalf("video missing on record-with-media post")
+	}
+	if video["contentUrl"] != playlist {
+		t.Errorf("contentUrl = %v, want %v", video["contentUrl"], playlist)
+	}
+	if video["thumbnailUrl"] != thumb {
+		t.Errorf("thumbnailUrl = %v, want %v", video["thumbnailUrl"], thumb)
+	}
+	// quote-post still surfaces via isBasedOn alongside the video.
+	if main["isBasedOn"] != "https://bsky.app/profile/quoted.bsky.social/post/q" {
+		t.Errorf("isBasedOn = %v", main["isBasedOn"])
+	}
+}
+
+func TestBuildPostJSONLD_VideoOnReply(t *testing.T) {
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "main")
+	*pv.ReplyCount = 1
+	thumb := "https://cdn.bsky.app/img/video_thumbnail/plain/did:plc:bob/v@jpeg"
+	playlist := "https://video.bsky.app/bob.m3u8"
+	reply := makePostView("bob.bsky.social", "did:plc:bob", "rep1", "watch",
+		withVideoFull(videoEmbedOpts{
+			thumbnail: thumb, playlist: playlist, alt: "bob's clip",
+		}))
+	out, _ := buildPostJSONLD(pv, buildReplies(reply), "u", "", hideEmbedLabels, hideReplyLabels)
+	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
+	c := main["comment"].([]any)[0].(map[string]any)
+	video, ok := c["video"].(map[string]any)
+	if !ok {
+		t.Fatalf("reply video missing")
+	}
+	if video["@type"] != "VideoObject" {
+		t.Errorf("reply video @type = %v", video["@type"])
+	}
+	if video["name"] != "bob's clip" {
+		t.Errorf("reply video name = %v", video["name"])
+	}
+	if video["contentUrl"] != playlist {
+		t.Errorf("reply video contentUrl = %v", video["contentUrl"])
+	}
+	if video["embedUrl"] != "https://bsky.app/profile/bob.bsky.social/post/rep1" {
+		t.Errorf("reply video embedUrl = %v", video["embedUrl"])
+	}
+}
+
+func TestBuildPostJSONLD_NoVideoNoField(t *testing.T) {
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "no embed")
+	out, _ := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
+	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
+	if _, present := main["video"]; present {
+		t.Errorf("post without video should not include video field")
+	}
+}
+
+func TestBuildProfileJSONLD_HasPartVideo(t *testing.T) {
+	pv := newProfileViewDetailed()
+	playlist := "https://video.bsky.app/p.m3u8"
+	post := makePostView("alice.bsky.social", "did:plc:alice", "rp1", "see",
+		withVideoFull(videoEmbedOpts{
+			playlist: playlist, alt: "alt",
+		}))
+	out, _ := buildProfileJSONLD(pv, []*appbsky.FeedDefs_PostView{post}, hideEmbedLabels, hideReplyLabels)
+	page := unmarshalLD(t, out)
+	hp := page["hasPart"].([]any)
+	if len(hp) != 1 {
+		t.Fatalf("expected 1 hasPart entry, got %d", len(hp))
+	}
+	video, ok := hp[0].(map[string]any)["video"].(map[string]any)
+	if !ok {
+		t.Fatalf("hasPart entry should carry video, got %v", hp[0])
+	}
+	if video["contentUrl"] != playlist {
+		t.Errorf("hasPart video contentUrl = %v", video["contentUrl"])
+	}
+	if video["embedUrl"] != "https://bsky.app/profile/alice.bsky.social/post/rp1" {
+		t.Errorf("hasPart video embedUrl = %v", video["embedUrl"])
+	}
+}
+
+// handle.invalid authors must still produce a non-empty embedUrl on the
+// VideoObject. The handle-form URL is unusable, so we fall back to the
+// DID-form URL derived from the AT-URI authority. Without this fallback,
+// omitempty drops embedUrl and Google's video indexer loses the canonical
+// page reference.
+func TestBuildPostJSONLD_VideoHandleInvalidEmbedURL(t *testing.T) {
+	playlist := "https://video.bsky.app/p.m3u8"
+	pv := makePostView("handle.invalid", "did:plc:alice", "abc123", "watch",
+		withVideoFull(videoEmbedOpts{
+			playlist: playlist, alt: "scenic clip",
+		}))
+	canonical := "https://bsky.app/profile/did:plc:alice/post/abc123"
+	out, _ := buildPostJSONLD(pv, nil, canonical, "", hideEmbedLabels, hideReplyLabels)
+	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
+	video, ok := main["video"].(map[string]any)
+	if !ok {
+		t.Fatalf("video missing on handle.invalid post")
+	}
+	if video["embedUrl"] != canonical {
+		t.Errorf("embedUrl = %v, want %v", video["embedUrl"], canonical)
+	}
+	if video["contentUrl"] != playlist {
+		t.Errorf("contentUrl = %v, want %v", video["contentUrl"], playlist)
+	}
+}
+
+// Same fallback applies to videos on replies whose author is handle.invalid.
+func TestBuildPostJSONLD_VideoHandleInvalidEmbedURL_Reply(t *testing.T) {
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "main")
+	*pv.ReplyCount = 1
+	playlist := "https://video.bsky.app/bob.m3u8"
+	reply := makePostView("handle.invalid", "did:plc:bob", "rep1", "watch",
+		withVideoFull(videoEmbedOpts{
+			playlist: playlist, alt: "bob's clip",
+		}))
+	out, _ := buildPostJSONLD(pv, buildReplies(reply), "u", "", hideEmbedLabels, hideReplyLabels)
+	main := unmarshalLD(t, out)["mainEntity"].(map[string]any)
+	c := main["comment"].([]any)[0].(map[string]any)
+	video, ok := c["video"].(map[string]any)
+	if !ok {
+		t.Fatalf("reply video missing")
+	}
+	want := "https://bsky.app/profile/did:plc:bob/post/rep1"
+	if video["embedUrl"] != want {
+		t.Errorf("reply video embedUrl = %v, want %v", video["embedUrl"], want)
+	}
+}

bskyweb/cmd/bskyweb/labels.go

@@ -20,3 +20,20 @@ func profileRequiresAuth(pv *appbsky.ActorDefs_ProfileViewDetailed) bool {
 	}
 	return false
 }
+
+// postAuthorRequiresAuth reports whether the post author self-applied the
+// !no-unauthenticated label, read from the author view embedded in a
+// getPostThread response. The appview surfaces the account's profile-record
+// self-labels on the post author (src == author DID), so this mirrors
+// profileRequiresAuth without a separate ActorGetProfile call.
+func postAuthorRequiresAuth(pv *appbsky.FeedDefs_PostView) bool {
+	if pv == nil || pv.Author == nil {
+		return false
+	}
+	for _, label := range pv.Author.Labels {
+		if label.Src == pv.Author.Did && label.Val == "!no-unauthenticated" {
+			return true
+		}
+	}
+	return false
+}

bskyweb/cmd/bskyweb/labels_test.go

@@ -77,3 +77,76 @@ func TestProfileRequiresAuth(t *testing.T) {
 		})
 	}
 }
+
+func TestPostAuthorRequiresAuth(t *testing.T) {
+	negTrue := true
+
+	authorPV := func(labels []*comatprototypes.LabelDefs_Label) *appbsky.FeedDefs_PostView {
+		return &appbsky.FeedDefs_PostView{
+			Author: &appbsky.ActorDefs_ProfileViewBasic{
+				Did:    "did:plc:alice",
+				Handle: "alice.bsky.social",
+				Labels: labels,
+			},
+		}
+	}
+
+	tests := []struct {
+		name string
+		pv   *appbsky.FeedDefs_PostView
+		want bool
+	}{
+		{
+			name: "nil post view",
+			pv:   nil,
+			want: false,
+		},
+		{
+			name: "nil author",
+			pv:   &appbsky.FeedDefs_PostView{},
+			want: false,
+		},
+		{
+			name: "no labels",
+			pv:   authorPV(nil),
+			want: false,
+		},
+		{
+			name: "self-applied !no-unauthenticated",
+			pv: authorPV([]*comatprototypes.LabelDefs_Label{
+				{Src: "did:plc:alice", Val: "!no-unauthenticated"},
+			}),
+			want: true,
+		},
+		{
+			name: "label from a different src does not gate",
+			pv: authorPV([]*comatprototypes.LabelDefs_Label{
+				{Src: "did:plc:labeler", Val: "!no-unauthenticated"},
+			}),
+			want: false,
+		},
+		{
+			name: "different label value does not gate",
+			pv: authorPV([]*comatprototypes.LabelDefs_Label{
+				{Src: "did:plc:alice", Val: "spam"},
+			}),
+			want: false,
+		},
+		{
+			// Negation isn't honored - matches profileRequiresAuth behavior.
+			name: "negated label still triggers (matches profile behavior)",
+			pv: authorPV([]*comatprototypes.LabelDefs_Label{
+				{Src: "did:plc:alice", Val: "!no-unauthenticated", Neg: &negTrue},
+			}),
+			want: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := postAuthorRequiresAuth(tt.pv); got != tt.want {
+				t.Errorf("got %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

bskyweb/cmd/bskyweb/main.go

@@ -59,6 +59,13 @@ func run(args []string) {
 					Value:    ":8100",
 					EnvVars:  []string{"HTTP_ADDRESS"},
 				},
+				&cli.StringFlag{
+					Name:     "metrics-address",
+					Usage:    "Specify the local IP/port to bind the metrics server to",
+					Required: false,
+					Value:    ":9090",
+					EnvVars:  []string{"METRICS_HTTP_ADDRESS"},
+				},
 				&cli.StringFlag{
 					Name:     "link-host",
 					Usage:    "scheme, hostname, and port of link service",

bskyweb/cmd/bskyweb/render_test.go

@@ -43,9 +43,16 @@ func extractJSONLD(t *testing.T, html string) string {
 	return strings.TrimSpace(m[1])
 }
 
+func TestRenderBase_NoindexMeta(t *testing.T) {
+    html := renderTemplate(t, "base.html", pongo2.Context{"noindex": true, "nofollow": true})
+    if !strings.Contains(html, `<meta name="robots" content="noindex, nofollow">`) {
+        t.Errorf("expected combined noindex,nofollow meta; got:\n%s", html)
+    }
+}
+
 func TestRenderPost_EmitsJSONLD(t *testing.T) {
 	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "hello")
-	ld, err := buildPostJSONLD(pv, nil, "https://bsky.app/profile/alice.bsky.social/post/abc123", hideEmbedLabels, hideReplyLabels)
+	ld, err := buildPostJSONLD(pv, nil, "https://bsky.app/profile/alice.bsky.social/post/abc123", "", hideEmbedLabels, hideReplyLabels)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -74,7 +81,7 @@ func TestRenderPost_OGImageMatchesJSONLD(t *testing.T) {
 	thumb1 := "https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:alice/abc@jpeg"
 	thumb2 := "https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:alice/def@jpeg"
 	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "look", withImages(thumb1, thumb2))
-	ld, _ := buildPostJSONLD(pv, nil, "https://bsky.app/profile/alice.bsky.social/post/abc123", hideEmbedLabels, hideReplyLabels)
+	ld, _ := buildPostJSONLD(pv, nil, "https://bsky.app/profile/alice.bsky.social/post/abc123", "", hideEmbedLabels, hideReplyLabels)
 	html := renderTemplate(t, "post.html", pongo2.Context{
 		"postView":     pv,
 		"requestURI":   "https://bsky.app/profile/alice.bsky.social/post/abc123",
@@ -98,10 +105,44 @@ func TestRenderPost_OGImageMatchesJSONLD(t *testing.T) {
 	}
 }
 
+// Gallery posts must hit the same og:image / JSON-LD image[] byte-equality
+// contract that legacy images posts do. Regression guard for the
+// app.bsky.embed.gallery extraction path.
+func TestRenderPost_OGImageMatchesJSONLD_Gallery(t *testing.T) {
+	thumb1 := "https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:alice/g1@jpeg"
+	thumb2 := "https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:alice/g2@jpeg"
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "gallery", withGallery(thumb1, thumb2))
+	thumbs := extractPostMedia(pv, false)
+	ld, _ := buildPostJSONLD(pv, nil, "https://bsky.app/profile/alice.bsky.social/post/abc123", "", hideEmbedLabels, hideReplyLabels)
+	html := renderTemplate(t, "post.html", pongo2.Context{
+		"postView":     pv,
+		"requestURI":   "https://bsky.app/profile/alice.bsky.social/post/abc123",
+		"canonicalURL": "https://bsky.app/profile/alice.bsky.social/post/abc123",
+		"postJSONLD":   ld,
+		"imgThumbUrls": thumbs,
+	})
+
+	if !strings.Contains(html, `<meta property="og:image" content="`+thumb1+`">`) {
+		t.Errorf("og:image[0] not found in rendered HTML for gallery post")
+	}
+	if !strings.Contains(html, `<meta property="og:image" content="`+thumb2+`">`) {
+		t.Errorf("og:image[1] not found in rendered HTML for gallery post")
+	}
+	body := extractJSONLD(t, html)
+	var parsed map[string]any
+	_ = json.Unmarshal([]byte(body), &parsed)
+	main := parsed["mainEntity"].(map[string]any)
+	imgs := main["image"].([]any)
+	if len(imgs) != 2 || imgs[0] != thumb1 || main["thumbnailUrl"] != thumb1 {
+		t.Errorf("JSON-LD image strings drifted from og:image for gallery; image=%v thumbnailUrl=%v",
+			imgs, main["thumbnailUrl"])
+	}
+}
+
 func TestRenderPost_FallsBackToCanonicalizeFilter(t *testing.T) {
 	// Without canonicalURL, the template falls back to requestURI|canonicalize_url.
 	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "hi")
-	ld, _ := buildPostJSONLD(pv, nil, "u", hideEmbedLabels, hideReplyLabels)
+	ld, _ := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
 	html := renderTemplate(t, "post.html", pongo2.Context{
 		"postView":   pv,
 		"requestURI": "https://bsky.app/profile/alice.bsky.social/post/abc123?utm=foo",
@@ -167,7 +208,7 @@ func TestRenderProfile_AuthRequiredEmitsJSONLD(t *testing.T) {
 // og:url and <link rel="canonical"> must emit the same URL.
 func TestRenderPost_OGUrlMatchesCanonical(t *testing.T) {
 	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "hi")
-	ld, _ := buildPostJSONLD(pv, nil, "u", hideEmbedLabels, hideReplyLabels)
+	ld, _ := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
 	canonical := "https://bsky.app/profile/alice.bsky.social/post/abc123"
 	html := renderTemplate(t, "post.html", pongo2.Context{
 		"postView":     pv,
@@ -192,7 +233,7 @@ func TestRenderPost_OGUrlMatchesCanonical(t *testing.T) {
 // video without a thumbnail dropped og:video entirely.
 func TestRenderPost_VideoWithoutThumbnailEmitsOGVideo(t *testing.T) {
 	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "watch")
-	ld, _ := buildPostJSONLD(pv, nil, "u", hideEmbedLabels, hideReplyLabels)
+	ld, _ := buildPostJSONLD(pv, nil, "u", "", hideEmbedLabels, hideReplyLabels)
 	videoURL := "https://video.bsky.app/v.m3u8"
 	html := renderTemplate(t, "post.html", pongo2.Context{
 		"postView":     pv,
@@ -209,3 +250,50 @@ func TestRenderPost_VideoWithoutThumbnailEmitsOGVideo(t *testing.T) {
 		t.Errorf("og:video:type should emit even without imgThumbUrls; got:\n%s", html)
 	}
 }
+
+// Auth-required posts must emit noindex,nofollow so the stub page (no body
+// text, no comments) is not indexed.
+func TestRenderPost_AuthRequiredNoindex(t *testing.T) {
+	html := renderTemplate(t, "post.html", pongo2.Context{
+		"requiresAuth":  true,
+		"profileHandle": "alice.bsky.social",
+		"requestURI":    "https://bsky.app/profile/alice.bsky.social/post/abc123",
+		"canonicalURL":  "https://bsky.app/profile/alice.bsky.social/post/abc123",
+		"noindex":       true,
+		"nofollow":      true,
+	})
+	if !strings.Contains(html, `<meta name="robots" content="noindex, nofollow">`) {
+		t.Errorf("auth-required post should emit noindex,nofollow; got:\n%s", html)
+	}
+}
+
+// Auth-required profiles must emit noindex,nofollow.
+func TestRenderProfile_AuthRequiredNoindex(t *testing.T) {
+	pv := newProfileViewDetailed()
+	html := renderTemplate(t, "profile.html", pongo2.Context{
+		"profileView":  pv,
+		"requestURI":   "https://bsky.app/profile/alice.bsky.social",
+		"requiresAuth": true,
+		"noindex":      true,
+		"nofollow":     true,
+	})
+	if !strings.Contains(html, `<meta name="robots" content="noindex, nofollow">`) {
+		t.Errorf("auth-required profile should emit noindex,nofollow; got:\n%s", html)
+	}
+}
+
+// Public posts must NOT emit a robots meta tag. Guards against an accidental
+// flip of the noindex flag for indexable pages.
+func TestRenderPost_PublicNoNoindex(t *testing.T) {
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "hello")
+	ld, _ := buildPostJSONLD(pv, nil, "https://bsky.app/profile/alice.bsky.social/post/abc123", "", hideEmbedLabels, hideReplyLabels)
+	html := renderTemplate(t, "post.html", pongo2.Context{
+		"postView":     pv,
+		"requestURI":   "https://bsky.app/profile/alice.bsky.social/post/abc123",
+		"canonicalURL": "https://bsky.app/profile/alice.bsky.social/post/abc123",
+		"postJSONLD":   ld,
+	})
+	if strings.Contains(html, `<meta name="robots"`) {
+		t.Errorf("public post should not emit robots meta; got:\n%s", html)
+	}
+}

bskyweb/cmd/bskyweb/server.go

@@ -12,6 +12,7 @@ import (
 	"io"
 	"io/fs"
 	"log/slog"
+	"net"
 	"net/http"
 	"net/netip"
 	"net/url"
@@ -35,15 +36,17 @@ import (
 	"github.com/labstack/echo-contrib/echoprometheus"
 	"github.com/labstack/echo/v4"
 	"github.com/labstack/echo/v4/middleware"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"github.com/urfave/cli/v2"
 )
 
 type Server struct {
-	echo      *echo.Echo
-	httpd     *http.Server
-	xrpcc     *xrpc.Client
-	chatXrpcc *xrpc.Client
-	cfg       *Config
+	echo         *echo.Echo
+	httpd        *http.Server
+	metricsHttpd *http.Server
+	xrpcc        *xrpc.Client
+	chatXrpcc    *xrpc.Client
+	cfg          *Config
 
 	ipccClient http.Client
 
@@ -67,6 +70,7 @@ type Config struct {
 func serve(cctx *cli.Context) error {
 	debug := cctx.Bool("debug")
 	httpAddress := cctx.String("http-address")
+	metricsAddress := cctx.String("metrics-address")
 	appviewHost := cctx.String("appview-host")
 	chatHost := cctx.String("chat-host")
 	ogcardHost := cctx.String("ogcard-host")
@@ -88,7 +92,7 @@ func serve(cctx *cli.Context) error {
 		Host:   appviewHost,
 	}
 
-	// optional client for the chat appview, used by /c/<code> for OG previews.
+	// optional client for the chat appview, used by /chat/<code> for OG previews.
 	var chatXrpcc *xrpc.Client
 	if chatHost != "" {
 		chatXrpcc = &xrpc.Client{
@@ -296,50 +300,50 @@ func serve(cctx *cli.Context) error {
 	// generic routes
 	e.GET("/hashtag/:tag", server.WebGeneric)
 	e.GET("/topic/:topic", server.WebGeneric)
-	e.GET("/search", server.WebGeneric)
-	e.GET("/feeds", server.WebGeneric)
-	e.GET("/notifications", server.WebGeneric)
-	e.GET("/notifications/settings", server.WebGeneric)
-	e.GET("/notifications/activity", server.WebGeneric)
-	e.GET("/lists", server.WebGeneric)
-	e.GET("/moderation", server.WebGeneric)
-	e.GET("/moderation/modlists", server.WebGeneric)
-	e.GET("/moderation/muted-accounts", server.WebGeneric)
-	e.GET("/moderation/blocked-accounts", server.WebGeneric)
-	e.GET("/moderation/verification-settings", server.WebGeneric)
-	e.GET("/settings", server.WebGeneric)
-	e.GET("/settings/language", server.WebGeneric)
-	e.GET("/settings/app-passwords", server.WebGeneric)
-	e.GET("/settings/following-feed", server.WebGeneric)
-	e.GET("/settings/saved-feeds", server.WebGeneric)
-	e.GET("/settings/threads", server.WebGeneric)
-	e.GET("/settings/external-embeds", server.WebGeneric)
-	e.GET("/settings/accessibility", server.WebGeneric)
-	e.GET("/settings/appearance", server.WebGeneric)
-	e.GET("/settings/account", server.WebGeneric)
-	e.GET("/settings/automation-label", server.WebGeneric)
-	e.GET("/settings/privacy-and-security", server.WebGeneric)
-	e.GET("/settings/privacy-and-security/activity", server.WebGeneric)
-	e.GET("/settings/content-and-media", server.WebGeneric)
-	e.GET("/settings/interests", server.WebGeneric)
-	e.GET("/settings/about", server.WebGeneric)
-	e.GET("/settings/notifications", server.WebGeneric)
-	e.GET("/sys/debug", server.WebGeneric)
-	e.GET("/sys/debug-mod", server.WebGeneric)
-	e.GET("/sys/log", server.WebGeneric)
+	e.GET("/search", server.WebGenericNoindex)
+	e.GET("/feeds", server.WebGenericNoindex)
+	e.GET("/notifications", server.WebGenericNoindex)
+	e.GET("/notifications/settings", server.WebGenericNoindex)
+	e.GET("/notifications/activity", server.WebGenericNoindex)
+	e.GET("/lists", server.WebGenericNoindex)
+	e.GET("/moderation", server.WebGenericNoindex)
+	e.GET("/moderation/modlists", server.WebGenericNoindex)
+	e.GET("/moderation/muted-accounts", server.WebGenericNoindex)
+	e.GET("/moderation/blocked-accounts", server.WebGenericNoindex)
+	e.GET("/moderation/verification-settings", server.WebGenericNoindex)
+	e.GET("/settings", server.WebGenericNoindex)
+	e.GET("/settings/language", server.WebGenericNoindex)
+	e.GET("/settings/app-passwords", server.WebGenericNoindex)
+	e.GET("/settings/following-feed", server.WebGenericNoindex)
+	e.GET("/settings/saved-feeds", server.WebGenericNoindex)
+	e.GET("/settings/threads", server.WebGenericNoindex)
+	e.GET("/settings/external-embeds", server.WebGenericNoindex)
+	e.GET("/settings/accessibility", server.WebGenericNoindex)
+	e.GET("/settings/appearance", server.WebGenericNoindex)
+	e.GET("/settings/account", server.WebGenericNoindex)
+	e.GET("/settings/automation-label", server.WebGenericNoindex)
+	e.GET("/settings/privacy-and-security", server.WebGenericNoindex)
+	e.GET("/settings/privacy-and-security/activity", server.WebGenericNoindex)
+	e.GET("/settings/content-and-media", server.WebGenericNoindex)
+	e.GET("/settings/interests", server.WebGenericNoindex)
+	e.GET("/settings/about", server.WebGenericNoindex)
+	e.GET("/settings/notifications", server.WebGenericNoindex)
+	e.GET("/sys/debug", server.WebGenericNoindex)
+	e.GET("/sys/debug-mod", server.WebGenericNoindex)
+	e.GET("/sys/log", server.WebGenericNoindex)
 	e.GET("/support", server.WebGeneric)
 	e.GET("/support/privacy", server.WebGeneric)
 	e.GET("/support/tos", server.WebGeneric)
 	e.GET("/support/community-guidelines", server.WebGeneric)
 	e.GET("/support/copyright", server.WebGeneric)
-	e.GET("/intent/compose", server.WebGeneric)
-	e.GET("/intent/verify-email", server.WebGeneric)
-	e.GET("/intent/age-assurance", server.WebGeneric)
-	e.GET("/messages", server.WebGeneric)
-	e.GET("/messages/inbox", server.WebGeneric)
-	e.GET("/messages/:conversation", server.WebGeneric)
-	e.GET("/messages/:conversation/settings", server.WebGeneric)
-	e.GET("/messages/:conversation/requests", server.WebGeneric)
+	e.GET("/intent/compose", server.WebGenericNoindexNofollow)
+	e.GET("/intent/verify-email", server.WebGenericNoindexNofollow)
+	e.GET("/intent/age-assurance", server.WebGenericNoindexNofollow)
+	e.GET("/messages", server.WebGenericNoindex)
+	e.GET("/messages/inbox", server.WebGenericNoindex)
+	e.GET("/messages/:conversation", server.WebGenericNoindex)
+	e.GET("/messages/:conversation/settings", server.WebGenericNoindex)
+	e.GET("/messages/:conversation/requests", server.WebGenericNoindex)
 
 	// profile endpoints; only first populates info
 	e.GET("/profile/:handleOrDID", server.WebProfile)
@@ -363,14 +367,14 @@ func serve(cctx *cli.Context) error {
 
 	// starter packs
 	e.GET("/starter-pack/:handleOrDID/:rkey", server.WebStarterPack)
-	e.GET("/starter-pack-short/:code", server.WebGeneric)
+	e.GET("/starter-pack-short/:code", server.WebGenericNoindex)
 	e.GET("/start/:handleOrDID/:rkey", server.WebStarterPack)
 
 	// chat invites
-	e.GET("/c/:code", server.WebChatInvite)
+	e.GET("/chat/:code", server.WebChatInvite)
 
 	// bookmarks
-	e.GET("/saved", server.WebGeneric)
+	e.GET("/saved", server.WebGenericNoindex)
 
 	// ipcc
 	e.GET("/ipcc", server.WebIpCC)
@@ -387,6 +391,19 @@ func serve(cctx *cli.Context) error {
 		e.Group("/:linkId", server.LinkProxyMiddleware(linkUrl))
 	}
 
+	metricsHttpd, metricsListener, err := newMetricsHTTPServer(metricsAddress)
+	if err != nil {
+		return err
+	}
+	server.metricsHttpd = metricsHttpd
+
+	log.Infof("starting metrics server address=%s", metricsAddress)
+	go func() {
+		if err := metricsHttpd.Serve(metricsListener); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			log.Errorf("metrics HTTP server shutting down unexpectedly: %s", err)
+		}
+	}()
+
 	// Start the server.
 	log.Infof("starting server address=%s", httpAddress)
 	go func() {
@@ -419,6 +436,24 @@ func serve(cctx *cli.Context) error {
 	return nil
 }
 
+func newMetricsHTTPServer(address string) (*http.Server, net.Listener, error) {
+	metricsMux := http.NewServeMux()
+	metricsMux.Handle("/metrics", promhttp.Handler())
+
+	metricsHttpd := &http.Server{
+		Addr:              address,
+		Handler:           metricsMux,
+		ReadHeaderTimeout: 5 * time.Second,
+	}
+
+	metricsListener, err := net.Listen("tcp", address)
+	if err != nil {
+		return nil, nil, fmt.Errorf("listen metrics address %s: %w", address, err)
+	}
+
+	return metricsHttpd, metricsListener, nil
+}
+
 func (srv *Server) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 	srv.echo.ServeHTTP(rw, req)
 }
@@ -429,7 +464,18 @@ func (srv *Server) Shutdown() error {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
-	return srv.httpd.Shutdown(ctx)
+	var shutdownErr error
+	if srv.metricsHttpd != nil {
+		if err := srv.metricsHttpd.Shutdown(ctx); err != nil {
+			shutdownErr = fmt.Errorf("metrics HTTP server shutdown error: %w", err)
+		}
+	}
+
+	if err := srv.httpd.Shutdown(ctx); err != nil {
+		return errors.Join(shutdownErr, err)
+	}
+
+	return shutdownErr
 }
 
 // NewTemplateContext returns a new pongo2 context with some default values.
@@ -437,6 +483,8 @@ func (srv *Server) NewTemplateContext() pongo2.Context {
 	return pongo2.Context{
 		"staticCDNHost": srv.cfg.staticCDNHost,
 		"favicon":       fmt.Sprintf("%s/static/favicon.png", srv.cfg.staticCDNHost),
+		"noindex":       false,
+		"nofollow":      false,
 	}
 }
 
@@ -489,10 +537,38 @@ func (srv *Server) LinkProxyMiddleware(url *url.URL) echo.MiddlewareFunc {
 	)
 }
 
+// renderOptions controls per-request rendering flags for the generic web handler.
+type renderOptions struct {
+	noindex  bool
+	nofollow bool
+}
+
+// webGeneric returns a handler that renders the base SPA shell with the given
+// render options applied to the template context.
+func (srv *Server) webGeneric(c echo.Context, o renderOptions) error {
+	data := srv.NewTemplateContext()
+	data["noindex"] = o.noindex
+	data["nofollow"] = o.nofollow
+	return c.Render(http.StatusOK, "base.html", data)
+}
+
 // handler for endpoint that have no specific server-side handling
 func (srv *Server) WebGeneric(c echo.Context) error {
-	data := srv.NewTemplateContext()
-	return c.Render(http.StatusOK, "base.html", data)
+	return srv.webGeneric(c, renderOptions{})
+}
+
+// handler for routes that should not be indexed by search engines
+// (e.g. auth-only user-state surfaces, internal/debug pages, action/intent dispatch URLs, search results)
+func (srv *Server) WebGenericNoindex(c echo.Context) error {
+	return srv.webGeneric(c, renderOptions{noindex: true})
+}
+
+// handler for action/intent dispatch URLs (e.g. /intent/compose). These accept
+// arbitrary query parameters from arbitrary third-party referrers, so we treat
+// them as link-graph dead-ends in addition to noindex. Anything legitimately
+// reachable from a hydrated intent page is also reachable via its canonical URL.
+func (srv *Server) WebGenericNoindexNofollow(c echo.Context) error {
+	return srv.webGeneric(c, renderOptions{noindex: true, nofollow: true})
 }
 
 func (srv *Server) WebHome(c echo.Context) error {
@@ -544,49 +620,54 @@ func (srv *Server) WebPost(c echo.Context) error {
 
 	identifier := handleOrDID.Normalize().String()
 
-	// requires two fetches: first fetch profile (!)
-	pv, err := appbsky.ActorGetProfile(ctx, srv.xrpcc, identifier)
-	if err != nil {
-		log.Warnf("failed to fetch profile for: %s\t%v", identifier, err)
-		return c.Render(http.StatusOK, "post.html", data)
-	}
-	unauthedViewingOkay := !profileRequiresAuth(pv)
-
 	req := c.Request()
 	requestURI := fmt.Sprintf("https://%s%s", req.Host, req.URL.Path)
 
-	// Always prefer the handle-form URL so JSON-LD `url` and
-	// <link rel="canonical"> match. Falls back to requestURI when the
-	// handle is unusable (template strips query/fragment).
-	canonicalURL := bskyPostURL(pv.Handle, rkey.String())
-
-	if !unauthedViewingOkay {
-		// Provide minimal OpenGraph data for auth-required posts
-		data["requestURI"] = requestURI
-		if canonicalURL != "" {
-			data["canonicalURL"] = canonicalURL
-		}
-		data["requiresAuth"] = true
-		data["profileHandle"] = pv.Handle
-		if pv.DisplayName != nil {
-			data["profileDisplayName"] = *pv.DisplayName
-		}
-		return c.Render(http.StatusOK, "post.html", data)
-	}
-
-	// then fetch the post thread (with extra context)
-	uri := fmt.Sprintf("at://%s/app.bsky.feed.post/%s", pv.Did, rkey)
-	tpv, err := appbsky.FeedGetPostThread(ctx, srv.xrpcc, 1, 0, uri)
+	// Fetch the post thread directly. The AT-URI authority accepts either a
+	// handle or a DID (the appview resolves it), so we skip the separate
+	// ActorGetProfile call and source identity, the canonical URL, and the
+	// auth gate from the thread response's author view instead.
+	// parentHeight=80 (the lexicon default) pulls the reply's ancestor chain
+	// up to the root in nearly all threads, letting isPartOf resolve from this
+	// response without a separate FeedGetPosts call.
+	uri := fmt.Sprintf("at://%s/app.bsky.feed.post/%s", identifier, rkey)
+	tpv, err := appbsky.FeedGetPostThread(ctx, srv.xrpcc, 1, 80, uri)
 	if err != nil {
 		log.Warnf("failed to fetch post: %s\t%v", uri, err)
 		return c.Render(http.StatusOK, "post.html", data)
 	}
 
 	threadView := tpv.Thread.FeedDefs_ThreadViewPost
-	if threadView == nil || threadView.Post == nil {
+	if threadView == nil || threadView.Post == nil || threadView.Post.Author == nil {
 		return c.Render(http.StatusOK, "post.html", data)
 	}
 	postView := threadView.Post
+
+	// Always prefer the handle-form URL so JSON-LD `url` and
+	// <link rel="canonical"> match. Falls back to requestURI when the
+	// handle is unusable (template strips query/fragment).
+	canonicalURL := bskyPostURL(postView.Author.Handle, rkey.String())
+
+	// Gate before populating any post content into the template so that
+	// !no-unauthenticated posts never leak text/media. The appview returns the
+	// post (with the author self-label) to unauthed callers, so we detect the
+	// label here rather than via a profile fetch.
+	if postAuthorRequiresAuth(postView) {
+		// Provide minimal OpenGraph data for auth-required posts
+		data["requestURI"] = requestURI
+		if canonicalURL != "" {
+			data["canonicalURL"] = canonicalURL
+		}
+		data["requiresAuth"] = true
+		data["noindex"] = true
+		data["nofollow"] = true
+		data["profileHandle"] = postView.Author.Handle
+		if postView.Author.DisplayName != nil {
+			data["profileDisplayName"] = *postView.Author.DisplayName
+		}
+		return c.Render(http.StatusOK, "post.html", data)
+	}
+
 	data["postView"] = postView
 	data["requestURI"] = requestURI
 	if canonicalURL != "" {
@@ -616,7 +697,32 @@ func (srv *Server) WebPost(c echo.Context) error {
 	if jsonldURL == "" {
 		jsonldURL = requestURI
 	}
-	if jsonld, err := buildPostJSONLD(postView, threadView.Replies, jsonldURL, hideEmbedLabels, hideReplyLabels); err == nil {
+
+	// Best-effort: resolve a reply's thread root to its handle-form canonical
+	// URL for isPartOf. Prefer the root already present in the thread response
+	// (parentHeight=80); fall back to a bounded FeedGetPosts only when the
+	// chain is truncated (very deep thread) or broken by a blocked/not-found
+	// ancestor. On timeout, error, or an unresolvable root we omit isPartOf
+	// rather than point at a non-indexable page.
+	isPartOfURL := ""
+	if rootURI := threadRootURI(postView); rootURI != "" {
+		if rootPost := findRootPostInParents(threadView, rootURI); rootPost != nil && rootPost.Author != nil {
+			isPartOfURL = bskyPostURLFromATURI(rootPost.Author.Handle, rootURI)
+		} else {
+			pctx, cancel := context.WithTimeout(ctx, 1*time.Second)
+			if posts, perr := appbsky.FeedGetPosts(pctx, srv.xrpcc, []string{rootURI}); perr != nil {
+				log.Warnf("failed to resolve thread root post for isPartOf: %s\t%v", rootURI, perr)
+			} else if len(posts.Posts) > 0 && posts.Posts[0].Author != nil {
+				// Handle-form only (no DID fallback): isPartOf must match the
+				// root page's handle-form canonical, so an unusable handle omits
+				// isPartOf rather than point at a non-canonical DID-form URL.
+				isPartOfURL = bskyPostURLFromATURI(posts.Posts[0].Author.Handle, rootURI)
+			}
+			cancel()
+		}
+	}
+
+	if jsonld, err := buildPostJSONLD(postView, threadView.Replies, jsonldURL, isPartOfURL, hideEmbedLabels, hideReplyLabels); err == nil {
 		data["postJSONLD"] = jsonld
 	} else {
 		log.Warnf("failed to build post JSON-LD for %s: %v", uri, err)
@@ -673,6 +779,7 @@ func (srv *Server) WebChatInvite(c echo.Context) error {
 	req := c.Request()
 	ctx := req.Context()
 	data := srv.NewTemplateContext()
+	data["noindex"] = true
 	data["requestURI"] = fmt.Sprintf("https://%s%s", req.Host, req.URL.Path)
 
 	code := c.Param("code")
@@ -695,7 +802,7 @@ func (srv *Server) WebChatInvite(c echo.Context) error {
 
 	data["title"] = preview.Name
 	if srv.cfg.ogcardHost != "" {
-		// bskyogcard registers this route as /chat-invite/:code, not /c/:code.
+		// bskyogcard registers this route as /chat-invite/:code, not /chat/:code.
 		data["imgThumbUrl"] = fmt.Sprintf("%s/chat-invite/%s", srv.cfg.ogcardHost, code)
 	}
 	return c.Render(http.StatusOK, "chatinvite.html", data)
@@ -760,6 +867,8 @@ func (srv *Server) WebProfile(c echo.Context) error {
 		}
 	} else {
 		data["requiresAuth"] = true
+		data["noindex"] = true
+		data["nofollow"] = true
 	}
 
 	if jsonld, err := buildProfileJSONLD(pv, recentPosts, hideEmbedLabels, hideReplyLabels); err == nil {

bskyweb/go.mod

@@ -3,7 +3,7 @@ module github.com/bluesky-social/social-app/bskyweb
 go 1.26
 
 require (
-	github.com/bluesky-social/indigo v0.0.0-20260529183052-5368f55344e0
+	github.com/bluesky-social/indigo v0.0.0-20260605210604-af2fec94f34c
 	github.com/flosch/pongo2/v6 v6.0.0
 	github.com/ipfs/go-log v1.0.5
 	github.com/joho/godotenv v1.5.1
@@ -44,9 +44,9 @@ require (
 	github.com/ipfs/go-log/v2 v2.5.1 // indirect
 	github.com/ipfs/go-metrics-interface v0.0.1 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
-	github.com/jackc/pgx/v5 v5.5.0 // indirect
-	github.com/jackc/puddle/v2 v2.2.1 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/pgx/v5 v5.9.2 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jbenet/goprocess v0.1.4 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
@@ -90,11 +90,11 @@ require (
 	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.26.0 // indirect
-	golang.org/x/crypto v0.45.0 // indirect
-	golang.org/x/net v0.47.0 // indirect
-	golang.org/x/sync v0.18.0 // indirect
-	golang.org/x/sys v0.38.0 // indirect
-	golang.org/x/text v0.31.0 // indirect
+	golang.org/x/crypto v0.52.0 // indirect
+	golang.org/x/net v0.55.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	golang.org/x/time v0.12.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
 	google.golang.org/protobuf v1.36.6 // indirect

bskyweb/go.sum

@@ -2,8 +2,8 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bluesky-social/indigo v0.0.0-20260529183052-5368f55344e0 h1:eijBaF59A5c+kPqufH7YO1GOqDMkyUhtM9P9aAWtfJY=
-github.com/bluesky-social/indigo v0.0.0-20260529183052-5368f55344e0/go.mod h1:JqQkz8lrOI6YZivP38GHmtVOTtzsNToITKj1gMpU5Jo=
+github.com/bluesky-social/indigo v0.0.0-20260605210604-af2fec94f34c h1:Jr82+1HUmwwZzDpt/eeU4sieya27iXjuPMdXZkOXoBc=
+github.com/bluesky-social/indigo v0.0.0-20260605210604-af2fec94f34c/go.mod h1:JqQkz8lrOI6YZivP38GHmtVOTtzsNToITKj1gMpU5Jo=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
@@ -77,12 +77,12 @@ github.com/ipfs/go-metrics-interface v0.0.1 h1:j+cpbjYvu4R8zbleSs36gvB7jR+wsL2fG
 github.com/ipfs/go-metrics-interface v0.0.1/go.mod h1:6s6euYU4zowdslK0GKHmqaIZ3j/b/tL7HTWtJ4VPgWY=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
-github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
-github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.5.0 h1:NxstgwndsTRy7eq9/kqYc/BZh5w2hHJV86wjvO+1xPw=
-github.com/jackc/pgx/v5 v5.5.0/go.mod h1:Ig06C2Vu0t5qXC60W8sqIthScaEnFvojjj9dSljmHRA=
-github.com/jackc/puddle/v2 v2.2.1 h1:RhxXJtFG022u4ibrCSMSiu5aOq1i77R3OHKNJj77OAk=
-github.com/jackc/puddle/v2 v2.2.1/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw=
+github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jbenet/go-cienv v0.1.0/go.mod h1:TqNnHUmJgXau0nCzC7kXWeotg3J9W34CUv5Djy1+FlA=
 github.com/jbenet/goprocess v0.1.4 h1:DRGOFReOMqqDNXwW70QkacFW0YN9QnwLV0Vqk+3oU0o=
 github.com/jbenet/goprocess v0.1.4/go.mod h1:5yspPrukOVuOLORacaBi858NqyClJPQxYZlqdZVfqY4=
@@ -194,8 +194,8 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/urfave/cli v1.22.10/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/urfave/cli/v2 v2.25.7 h1:VAzn5oq403l5pHjc4OhD54+XGO9cdKVL/7lDjF+iKUs=
 github.com/urfave/cli/v2 v2.25.7/go.mod h1:8qnjx1vcq5s2/wpsqoZFndg2CE5tNFyrTvS6SinrnYQ=
@@ -247,8 +247,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
-golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
-golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -266,16 +266,16 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
-golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -291,8 +291,8 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
-golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
@@ -304,8 +304,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
-golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
 golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

bskyweb/templates/base.html

@@ -139,6 +139,7 @@
   <meta name="theme-color">
   <meta name="application-name" content="Bluesky">
   <meta name="generator" content="bskyweb">
+  {% if noindex %}<meta name="robots" content="noindex{% if nofollow %}, nofollow{% endif %}">{% endif %}
   <meta property="og:site_name" content="Bluesky Social">
   <meta property="og:logo" content="{{ favicon }}">
   <meta name="twitter:site" content="@bluesky" />

dev-env/package.json

@@ -6,8 +6,8 @@
     "start": "NODE_ENV=development ./dev-infra/with-test-redis-and-db.sh node ./mock-server.ts"
   },
   "dependencies": {
-    "@atproto/api": "^0.20.0",
-    "@atproto/dev-env": "^0.5.0",
+    "@atproto/api": "^0.20.22",
+    "@atproto/dev-env": "^0.5.3",
     "typescript": "^6.0.3"
   },
   "devDependencies": {

dev-env/pnpm-lock.yaml

@@ -208,10 +208,10 @@ importers:
   .:
     dependencies:
       '@atproto/api':
-        specifier: ^0.20.0
-        version: 0.20.5
+        specifier: ^0.20.22
+        version: 0.20.22
       '@atproto/dev-env':
-        specifier: ^0.5.0
+        specifier: ^0.5.3
         version: 0.5.3
       typescript:
         specifier: ^6.0.3
@@ -257,8 +257,8 @@ packages:
     resolution: {integrity: sha512-nmjM83KucbRnz/CDSXQX6FLH/GP93XjcI1u5WFlomPscmeOAP1+9AOVsMQlKmh27I3hgaSOdCr03GJjAIpuPZQ==}
     engines: {node: '>=22'}
 
-  '@atproto/api@0.20.5':
-    resolution: {integrity: sha512-VqkRYKR9vRRk36NhtytJz5TPhNtR1hczCcfM+bWoOK6MBvWUT8HwelufrycFAIbFIH7n4ws+5UbnLYpTIBQZ6Q==}
+  '@atproto/api@0.20.22':
+    resolution: {integrity: sha512-TdT9ktYc0FMmMZ8HjkMz13QcSCcYiesCGN81mFZd5owQASHVM9GBtAAmzpkrPyZhUkiIjgh/nUHk8xWVu+4dVA==}
     engines: {node: '>=22'}
 
   '@atproto/aws@0.3.0':
@@ -277,6 +277,10 @@ packages:
     resolution: {integrity: sha512-ReWnkuZdDU/74/I47gaI26uxQjHmpq4edp41NnZZQ5vIIKGb7Ei6pZHzDTUD9JURo109SKrPx9RMP2IQm0fOKA==}
     engines: {node: '>=22'}
 
+  '@atproto/common-web@0.5.2':
+    resolution: {integrity: sha512-oO0JEvM7MM7iXMngq6V51IJlzBZFhFJoDjnGnQT75EO94/8Q5hnM/LP+a8KyWjcBcpcSZwQ0bukNv9phZONdGA==}
+    engines: {node: '>=22'}
+
   '@atproto/common@0.1.0':
     resolution: {integrity: sha512-OB5tWE2R19jwiMIs2IjQieH5KTUuMb98XGCn9h3xuu6NanwjlmbCYMv08fMYwIp3UQ6jcq//84cDT3Bu6fJD+A==}
 
@@ -331,6 +335,10 @@ packages:
     resolution: {integrity: sha512-/xza8nU/YhtzhETnHL3QKKofaJ28/0NCzhT7LaYoUkm8EgypWp5ykEtmW52yLhQM2JF6fVa25g1soQmNTGqtSg==}
     engines: {node: '>=22'}
 
+  '@atproto/lex-data@0.1.3':
+    resolution: {integrity: sha512-ysqMYW6cIKce52/+EIbTa+I4pLqZQSBP9aGImN88vAQtd1oZBKPmut6dQk00xSQ8PW9REJRuIHNSFAF4HD+fsw==}
+    engines: {node: '>=22'}
+
   '@atproto/lex-document@0.1.0':
     resolution: {integrity: sha512-I2q2iwK8RnSHkBeAj5xdJNYdHiUQqlkbbleBSJKJXlYOYy5y86dWRo9IfE0l9E3qZ3/zvy1ydlEZmZupEt0FGg==}
     engines: {node: '>=22'}
@@ -343,6 +351,10 @@ packages:
     resolution: {integrity: sha512-oWUrRMwFyWpmi/5k1Se3xBTbP06XdxBS5iFuUz9LmqItaPXwrWRD87a9ldPvINQ/A2/mn7J6/qug8sDVlhD+vQ==}
     engines: {node: '>=22'}
 
+  '@atproto/lex-json@0.1.2':
+    resolution: {integrity: sha512-58nIjoWX0c8T5fcoPPmIaShxKZgfPMhNmrprtR7GuN4PzyMwm59A3CLlKAzzR+vjI3IidEMU+enpLuwUT8L+Nw==}
+    engines: {node: '>=22'}
+
   '@atproto/lex-resolver@0.1.0':
     resolution: {integrity: sha512-zliMiRW4ttSNFreKxyvSpaYQjeWrKpV/lutnXI9BNE8Ysgnw8Rltm0bR7kG/y0OlyClxhhU/vAG+OR8NpjhU1Q==}
     engines: {node: '>=22'}
@@ -360,6 +372,10 @@ packages:
     resolution: {integrity: sha512-voNfNED5KUxn3vpo7N5DMRblBDfWf7kSfdKhJFC1RrLCxg38YbBzzURNVQJ32bp13Oot8kYfyXBWxTgtKLvw8w==}
     engines: {node: '>=22'}
 
+  '@atproto/lexicon@0.7.3':
+    resolution: {integrity: sha512-WP6ct2rjNCKSJN/VFc+8x6JQ7PvRMlfHUlmQM5hzvE3a6nOjm6kwSicjSIV/QldurdRGJ4FCQZ3uZu9Wqt4SxQ==}
+    engines: {node: '>=22'}
+
   '@atproto/oauth-provider-api@0.6.0':
     resolution: {integrity: sha512-wFioPBgI71v4PuEwYmIYPp4GNOyaRw1UX8FJq0AiNuUGMbqCjdd7ImSsG4b43hsHr5wOsMirsWyccjUEdhb+yQ==}
     engines: {node: '>=22'}
@@ -400,6 +416,10 @@ packages:
     resolution: {integrity: sha512-kA4dQDoMPpWCH8N0Q4KoSq024u5MkVfDVa8DdhyLjGA72z/khbOf1jXKPv7NIL2oEc9aj7geKELdvqyf4ogopA==}
     engines: {node: '>=22'}
 
+  '@atproto/syntax@0.6.3':
+    resolution: {integrity: sha512-io7Ck4o+40iFXhetHYoEtok2gZ8cWcJ1yRftEHe5AmAF0dSGcYmclbx5GatVew59taw+eSG7Ty5D3llop/0BhA==}
+    engines: {node: '>=22'}
+
   '@atproto/ws-client@0.1.0':
     resolution: {integrity: sha512-8qG+A+htxEHpDJRgtYNUExUOejDwU4nE2SEJCFLiTc1G+s0GbFaeg7Fk5drQA9tLMHQWoU9uqIr1YQpJyvJs8w==}
     engines: {node: '>=22'}
@@ -412,6 +432,10 @@ packages:
     resolution: {integrity: sha512-NJy02bIKrWlE2NQkRV1kT0Cj0ixbuxlF/MejBdo4cPWAa9v3oZexvAcjjb0zaOYeABkaU14iyIhvn2G4e/oLpw==}
     engines: {node: '>=22'}
 
+  '@atproto/xrpc@0.8.2':
+    resolution: {integrity: sha512-geLqJwazZuCGnae68KZppciS8DujhGvYtpc/aAj16XpHkUCf5Ds64H1IPrV0uv7SFvd/IAuMZAXZS4GIpfp1iw==}
+    engines: {node: '>=22'}
+
   '@aws-crypto/crc32@5.2.0':
     resolution: {integrity: sha512-nLbCWqQNgUiwwtFsen1AdzAtvuLRsQS8rYgMuxCrdKf9kOssamGLuPwyTY9wyYblNr9+1XM8v6zoDTPPSIeANg==}
     engines: {node: '>=16.0.0'}
@@ -2110,12 +2134,12 @@ snapshots:
       - supports-color
       - utf-8-validate
 
-  '@atproto/api@0.20.5':
+  '@atproto/api@0.20.22':
     dependencies:
-      '@atproto/common-web': 0.5.0
-      '@atproto/lexicon': 0.7.1
-      '@atproto/syntax': 0.6.1
-      '@atproto/xrpc': 0.8.0
+      '@atproto/common-web': 0.5.2
+      '@atproto/lexicon': 0.7.3
+      '@atproto/syntax': 0.6.3
+      '@atproto/xrpc': 0.8.2
       await-lock: 3.0.0
       multiformats: 13.4.2
       tlds: 1.261.0
@@ -2140,7 +2164,7 @@ snapshots:
     dependencies:
       '@atproto-labs/fetch-node': 0.3.0
       '@atproto-labs/xrpc-utils': 0.1.0
-      '@atproto/api': 0.20.5
+      '@atproto/api': 0.20.22
       '@atproto/common': 0.6.1
       '@atproto/crypto': 0.5.0
       '@atproto/did': 0.4.0
@@ -2210,6 +2234,13 @@ snapshots:
       '@atproto/syntax': 0.6.1
       zod: 3.25.76
 
+  '@atproto/common-web@0.5.2':
+    dependencies:
+      '@atproto/lex-data': 0.1.3
+      '@atproto/lex-json': 0.1.2
+      '@atproto/syntax': 0.6.3
+      zod: 3.25.76
+
   '@atproto/common@0.1.0':
     dependencies:
       '@ipld/dag-cbor': 7.0.3
@@ -2248,7 +2279,7 @@ snapshots:
 
   '@atproto/dev-env@0.5.3':
     dependencies:
-      '@atproto/api': 0.20.5
+      '@atproto/api': 0.20.22
       '@atproto/bsky': 0.0.234
       '@atproto/bsync': 0.0.27
       '@atproto/common-web': 0.5.0
@@ -2323,6 +2354,13 @@ snapshots:
       uint8arrays: 5.1.1
       unicode-segmenter: 0.14.5
 
+  '@atproto/lex-data@0.1.3':
+    dependencies:
+      multiformats: 13.4.2
+      tslib: 2.8.1
+      uint8arrays: 5.1.1
+      unicode-segmenter: 0.14.5
+
   '@atproto/lex-document@0.1.0':
     dependencies:
       '@atproto/lex-schema': 0.1.1
@@ -2345,6 +2383,11 @@ snapshots:
       '@atproto/lex-data': 0.1.1
       tslib: 2.8.1
 
+  '@atproto/lex-json@0.1.2':
+    dependencies:
+      '@atproto/lex-data': 0.1.3
+      tslib: 2.8.1
+
   '@atproto/lex-resolver@0.1.0':
     dependencies:
       '@atproto-labs/did-resolver': 0.3.0
@@ -2382,6 +2425,13 @@ snapshots:
       multiformats: 13.4.2
       zod: 3.25.76
 
+  '@atproto/lexicon@0.7.3':
+    dependencies:
+      '@atproto/common-web': 0.5.2
+      '@atproto/syntax': 0.6.3
+      multiformats: 13.4.2
+      zod: 3.25.76
+
   '@atproto/oauth-provider-api@0.6.0':
     dependencies:
       '@atproto/jwk': 0.7.0
@@ -2436,7 +2486,7 @@ snapshots:
 
   '@atproto/ozone@0.1.176':
     dependencies:
-      '@atproto/api': 0.20.5
+      '@atproto/api': 0.20.22
       '@atproto/common': 0.6.1
       '@atproto/crypto': 0.5.0
       '@atproto/identity': 0.5.0
@@ -2551,6 +2601,11 @@ snapshots:
       iso-datestring-validator: 2.2.2
       tslib: 2.8.1
 
+  '@atproto/syntax@0.6.3':
+    dependencies:
+      iso-datestring-validator: 2.2.2
+      tslib: 2.8.1
+
   '@atproto/ws-client@0.1.0':
     dependencies:
       '@atproto/common': 0.6.1
@@ -2586,6 +2641,11 @@ snapshots:
       '@atproto/lexicon': 0.7.1
       zod: 3.25.76
 
+  '@atproto/xrpc@0.8.2':
+    dependencies:
+      '@atproto/lexicon': 0.7.3
+      zod: 3.25.76
+
   '@aws-crypto/crc32@5.2.0':
     dependencies:
       '@aws-crypto/util': 5.2.0

docs/deploy-ota.md

@@ -57,6 +57,9 @@ release or OTA.
 Log in to the EAS CLI with `eas login` and manually set the build numbers to the
 values you found in **Step 1**.
 
+> [!NOTE]
+> If you don’t already have the EAS CLI, you can install it with `pnpm add -g eas-cli`.
+
 ```sh
 > npx eas build:version:set -p ios
 >
@@ -114,7 +117,7 @@ To confirm this, as mentioned above, you must completely clear the TestFlight
 build from your device and re-install from the App Store. Then, you'll need to:
 - Launch the app (or quit and reopen) and wait ~15s for the download to complete
 - Quit and reopen the app
-- Check the `Settings > About` page and confirm the has matches the most recent has on your OTA branch
+- Check the `Settings > About` page and confirm the hash matches the most recent hash on your OTA branch
 
 ### 9. Reset build numbers
 

docs/testing.md

@@ -6,7 +6,7 @@ values.
 Install dependencies in `/dev-env`
 
 ```
-cd dev-env && yarn
+cd dev-env && pnpm i
 ```
 
 ## Using Maestro
@@ -27,7 +27,7 @@ adb reverse tcp:3000 tcp:3000
 
 - In one tab, run `pnpm e2e:mock-server`
 - In a second tab, run `pnpm e2e:build`
-- In a third tab, run `pnpm e2e:run`
+- In a third tab, run `pnpm e2e:run __e2e__`
 
 ## Using Flashlight for Performance Testing
 1. Make sure Maestro is installed (optional: only for automated testing) by following the instructions above

eas.json

@@ -6,7 +6,7 @@
   },
   "build": {
     "base": {
-      "node": "24.15.0"
+      "node": "24.18.0"
     },
     "development": {
       "extends": "base",
@@ -47,21 +47,6 @@
         "EXPO_PUBLIC_ENV": "production"
       }
     },
-    "production-apk": {
-      "extends": "base",
-      "distribution": "internal",
-      "ios": {
-        "autoIncrement": false,
-        "buildArtifactPaths": ["ios/build/*"]
-      },
-      "android": {
-        "autoIncrement": false
-      },
-      "channel": "production",
-      "env": {
-        "EXPO_PUBLIC_ENV": "production"
-      }
-    },
     "testflight": {
       "extends": "base",
       "ios": {
@@ -78,7 +63,6 @@
     },
     "testflight-android": {
       "extends": "base",
-      "distribution": "internal",
       "ios": {
         "autoIncrement": true,
         "buildArtifactPaths": ["ios/build/*"]
@@ -96,6 +80,14 @@
     "production": {
       "ios": {
         "ascAppId": "6444370199"
+      },
+      "android": {
+        "track": "production"
+      }
+    },
+    "testflight-android": {
+      "android": {
+        "track": "internal"
       }
     }
   }

eslint.config.mjs

@@ -1,317 +0,0 @@
-// @ts-check
-import js from '@eslint/js'
-import tseslint from 'typescript-eslint'
-import {defineConfig} from 'eslint/config'
-import react from 'eslint-plugin-react'
-import reactHooks from 'eslint-plugin-react-hooks'
-// @ts-expect-error no types
-import reactNative from 'eslint-plugin-react-native'
-// @ts-expect-error no types
-import reactNativeA11y from 'eslint-plugin-react-native-a11y'
-import simpleImportSort from 'eslint-plugin-simple-import-sort'
-import importX from 'eslint-plugin-import-x'
-import lingui from 'eslint-plugin-lingui'
-import reactCompiler from 'eslint-plugin-react-compiler'
-import bskyInternal from 'eslint-plugin-bsky-internal'
-import globals from 'globals'
-import tsParser from '@typescript-eslint/parser'
-
-export default defineConfig(
-  /**
-   * Global ignores
-   */
-  {
-    ignores: [
-      '**/__mocks__/*.ts',
-      'ios/**',
-      'android/**',
-      'coverage/**',
-      '*.lock',
-      '.husky/**',
-      'patches/**',
-      '*.html',
-      'bskyweb/**',
-      'bskyembed/**',
-      'bskyogcard/**',
-      'src/locale/locales/_build/**',
-      'src/locale/locales/**/*.js',
-      '*.e2e.ts',
-      '*.e2e.tsx',
-      'eslint.config.mjs',
-      '.jscodeshift/**',
-    ],
-  },
-
-  /**
-   * Base configurations
-   */
-  js.configs.recommended,
-  tseslint.configs.recommendedTypeChecked,
-  reactHooks.configs.flat.recommended,
-  importX.flatConfigs.recommended,
-  importX.flatConfigs.typescript,
-  importX.flatConfigs['react-native'],
-
-  /**
-   * Main configuration for all JS/TS/JSX/TSX files
-   */
-  {
-    files: ['**/*.{js,jsx,ts,tsx}'],
-    plugins: {
-      react,
-      'react-native': reactNative,
-      'react-native-a11y': reactNativeA11y,
-      'simple-import-sort': simpleImportSort,
-      // @ts-expect-error - not sure why
-      lingui,
-      'react-compiler': reactCompiler,
-      'bsky-internal': bskyInternal,
-    },
-    languageOptions: {
-      ecmaVersion: 'latest',
-      sourceType: 'module',
-      globals: {
-        ...globals.browser,
-        ...globals.node,
-      },
-      parserOptions: {
-        parser: tsParser,
-        projectService: true,
-        tsconfigRootDir: import.meta.dirname,
-        ecmaFeatures: {
-          jsx: true,
-        },
-      },
-    },
-    settings: {
-      react: {
-        version: 'detect',
-      },
-      componentWrapperFunctions: ['observer'],
-    },
-    rules: {
-      /**
-       * Custom rules
-       */
-      'bsky-internal/avoid-unwrapped-text': [
-        'error',
-        {
-          impliedTextComponents: [
-            'H1',
-            'H2',
-            'H3',
-            'H4',
-            'H5',
-            'H6',
-            'P',
-            'Admonition',
-            'Admonition.Admonition',
-            'Toast.Action',
-            'AgeAssuranceAdmonition',
-            'Span',
-            'StackedButton',
-          ],
-          impliedTextProps: [],
-          suggestedTextWrappers: {
-            Button: 'ButtonText',
-            'ToggleButton.Button': 'ToggleButton.ButtonText',
-            'SegmentedControl.Item': 'SegmentedControl.ItemText',
-          },
-        },
-      ],
-      'bsky-internal/use-exact-imports': 'error',
-      'bsky-internal/use-prefixed-imports': 'error',
-      'bsky-internal/lingui-msg-rule': 'error',
-
-      /**
-       * React & React Native
-       */
-      ...react.configs.recommended.rules,
-      ...react.configs['jsx-runtime'].rules,
-      'react/hook-use-state': 'warn',
-      'react/no-unescaped-entities': 'off',
-      'react/prop-types': 'off',
-      'react-native/no-inline-styles': 'off',
-      ...reactNativeA11y.configs.all.rules,
-      'react-compiler/react-compiler': 'warn',
-      'react-hooks/set-state-in-effect': 'error',
-      'react-hooks/purity': 'error',
-      'react-hooks/refs': 'error',
-      'react-hooks/immutability': 'error',
-
-      /**
-       * Import sorting
-       */
-      'simple-import-sort/imports': [
-        'error',
-        {
-          groups: [
-            // Side effect imports.
-            ['^\\u0000'],
-            // Node.js builtins prefixed with `node:`.
-            ['^node:'],
-            // Packages.
-            // Things that start with a letter (or digit or underscore), or `@` followed by a letter.
-            // React/React Native prioritized, followed by expo
-            // Followed by all packages excluding unprefixed relative ones
-            [
-              '^(react\\/(.*)$)|^(react$)|^(react-native(.*)$)',
-              '^(expo(.*)$)|^(expo$)',
-              '^(?!(?:alf|components|lib|locale|logger|platform|screens|state|view)(?:$|\\/))@?\\w',
-            ],
-            // Relative imports.
-            // Ideally, anything that starts with a dot or #
-            // due to unprefixed relative imports being used, we whitelist the relative paths we use
-            // (?:$|\\/) matches end of string or /
-            [
-              '^(?:#\\/)?(?:lib|state|logger|platform|locale)(?:$|\\/)',
-              '^(?:#\\/)?view(?:$|\\/)',
-              '^(?:#\\/)?screens(?:$|\\/)',
-              '^(?:#\\/)?alf(?:$|\\/)',
-              '^(?:#\\/)?components(?:$|\\/)',
-              '^#\\/',
-              '^\\.',
-            ],
-            // anything else - hopefully we don't have any of these
-            ['^'],
-          ],
-        },
-      ],
-      'simple-import-sort/exports': 'error',
-
-      /**
-       * Import linting
-       */
-      'import-x/consistent-type-specifier-style': ['warn', 'prefer-inline'],
-      'import-x/no-unresolved': [
-        'error',
-        {
-          /*
-           * The `postinstall` hook runs `compile-if-needed` locally, but not in
-           * CI. For CI-sake, ignore this.
-           */
-          ignore: ['^#\/locale\/locales\/.+\/messages'],
-        },
-      ],
-      'import-x/no-extraneous-dependencies': [
-        'error',
-        {
-          whitelist: [
-            // test files only
-            '@jest/globals',
-            // we only use a really simple util from this, and we know it will be present
-            'expo-modules-core',
-            // this is a dep for @atproto/api, but we absolutely need them in sync, so just
-            // rely on the transient version
-            '@atproto/common-web',
-          ],
-        },
-      ],
-      'import-x/no-nodejs-modules': 'error',
-
-      /**
-       * TypeScript-specific rules
-       */
-      'no-unused-vars': 'off', // off, we use TS-specific rule below
-      '@typescript-eslint/no-unused-vars': [
-        'error',
-        {
-          argsIgnorePattern: '^_',
-          varsIgnorePattern: '^_.+',
-          caughtErrors: 'none',
-          ignoreRestSiblings: true,
-        },
-      ],
-      '@typescript-eslint/consistent-type-imports': [
-        'warn',
-        {prefer: 'type-imports', fixStyle: 'inline-type-imports'},
-      ],
-      '@typescript-eslint/no-require-imports': 'off',
-      '@typescript-eslint/no-unused-expressions': [
-        'error',
-        {
-          allowTernary: true,
-        },
-      ],
-      /**
-       * Maintain previous behavior via eslint-suppressions.json - these are
-       * stricter in typescript-eslint v8. `off` ones are a bit too nit-picky.
-       */
-      '@typescript-eslint/no-explicit-any': 'error',
-      '@typescript-eslint/ban-ts-comment': 'off',
-      '@typescript-eslint/no-empty-object-type': 'off',
-      '@typescript-eslint/no-unsafe-function-type': 'off',
-      '@typescript-eslint/no-unsafe-assignment': 'off',
-      '@typescript-eslint/unbound-method': 'off',
-      '@typescript-eslint/no-unsafe-argument': 'off',
-      '@typescript-eslint/no-unsafe-return': 'off',
-      '@typescript-eslint/no-unsafe-member-access': 'error',
-      '@typescript-eslint/no-unsafe-call': 'error',
-      '@typescript-eslint/no-floating-promises': 'error',
-      '@typescript-eslint/no-misused-promises': 'error',
-      '@typescript-eslint/require-await': 'error',
-      '@typescript-eslint/no-unsafe-enum-comparison': 'error',
-      '@typescript-eslint/no-unnecessary-type-assertion': 'error',
-      '@typescript-eslint/no-redundant-type-constituents': 'error',
-      '@typescript-eslint/no-duplicate-type-constituents': 'error',
-      '@typescript-eslint/no-base-to-string': 'error',
-      '@typescript-eslint/prefer-promise-reject-errors': 'error',
-      '@typescript-eslint/await-thenable': 'error',
-
-      'no-restricted-imports': [
-        'error',
-        {
-          paths: [
-            {
-              name: 'react',
-              importNames: ['React', 'default'],
-              message:
-                'React is already in the global type namespace. Use named imports for runtime modules.',
-            },
-          ],
-        },
-      ],
-
-      /**
-       * Turn off rules that we haven't enforced thus far
-       */
-      'no-empty-pattern': 'off',
-      'no-async-promise-executor': 'off',
-      'no-constant-binary-expression': 'warn',
-      'prefer-const': 'off',
-      'no-empty': 'off',
-      'no-unsafe-optional-chaining': 'off',
-      'no-prototype-builtins': 'off',
-      'no-var': 'off',
-      'prefer-rest-params': 'off',
-      'no-case-declarations': 'off',
-      'no-irregular-whitespace': 'off',
-      'no-useless-escape': 'off',
-      'no-sparse-arrays': 'off',
-      'no-fallthrough': 'off',
-      'no-control-regex': 'off',
-    },
-  },
-
-  /**
-   * bskyogcard, dev-env - server-side, Node.js imports are fine
-   */
-  {
-    files: ['bskyogcard/**/*.{js,jsx,ts,tsx}', 'dev-env/**/*.{js,jsx,ts,tsx}'],
-    rules: {
-      'import-x/no-nodejs-modules': 'off',
-    },
-  },
-
-  /**
-   * Test files configuration
-   */
-  {
-    files: ['**/__tests__/**/*.{js,jsx,ts,tsx}', '**/*.test.{js,jsx,ts,tsx}'],
-    languageOptions: {
-      globals: {
-        ...globals.jest,
-      },
-    },
-  },
-)

eslint/__disabled_tests__/avoid-unwrapped-text.disabled-test.js

@@ -1,16 +1,11 @@
-const {RuleTester} = require('eslint')
-const tseslint = require('typescript-eslint')
+const {RuleTester} = require('oxlint/plugins-dev')
 const avoidUnwrappedText = require('../avoid-unwrapped-text')
 
 const ruleTester = new RuleTester({
+  eslintCompat: true,
   languageOptions: {
-    parser: tseslint.parser,
     parserOptions: {
-      ecmaFeatures: {
-        jsx: true,
-      },
-      ecmaVersion: 'latest',
-      sourceType: 'module',
+      lang: 'tsx',
     },
   },
 })

eslint/__disabled_tests__/lingui-msg-rule.disabled-test.js

@@ -1,16 +1,11 @@
-const {RuleTester} = require('eslint')
-const tseslint = require('typescript-eslint')
+const {RuleTester} = require('oxlint/plugins-dev')
 const linguiMsgRule = require('../lingui-msg-rule')
 
 const ruleTester = new RuleTester({
+  eslintCompat: true,
   languageOptions: {
-    parser: tseslint.parser,
     parserOptions: {
-      ecmaFeatures: {
-        jsx: true,
-      },
-      ecmaVersion: 'latest',
-      sourceType: 'module',
+      lang: 'tsx',
     },
   },
 })

eslint/__disabled_tests__/note.md

@@ -0,0 +1,3 @@
+## Eslint plugin tests
+
+These are disabled as Oxlint’s RuleTester doesn’t work well with Hermes.

lingui.config.ts

@@ -7,6 +7,7 @@ export default defineConfig({
     'an',
     'ast',
     'ca',
+    'cs',
     'cy',
     'da',
     'de',

metro.config.js

@@ -1,40 +0,0 @@
-// Learn more https://docs.expo.io/guides/customizing-metro
-const {getSentryExpoConfig} = require('@sentry/react-native/metro')
-const cfg = getSentryExpoConfig(__dirname)
-
-// inject `.e2e.ts` and `.e2e.tsx` into the sourceExts when running tests
-cfg.resolver.sourceExts = process.env.RN_SRC_EXT
-  ? process.env.RN_SRC_EXT.split(',').concat(cfg.resolver.sourceExts)
-  : cfg.resolver.sourceExts
-
-if (cfg.resolver.resolveRequest) {
-  throw Error('Update this override because it is conflicting now.')
-}
-
-if (process.env.BSKY_PROFILE) {
-  cfg.cacheVersion += ':PROFILE'
-}
-
-cfg.resolver.assetExts = [...cfg.resolver.assetExts, 'woff2']
-
-cfg.resolver.resolveRequest = (context, moduleName, platform) => {
-  if (process.env.BSKY_PROFILE) {
-    if (moduleName.endsWith('ReactNativeRenderer-prod')) {
-      return context.resolveRequest(
-        context,
-        moduleName.replace('-prod', '-profiling'),
-        platform,
-      )
-    }
-  }
-  return context.resolveRequest(context, moduleName, platform)
-}
-
-cfg.transformer.getTransformOptions = async () => ({
-  transform: {
-    experimentalImportSupport: true,
-    inlineRequires: true,
-  },
-})
-
-module.exports = cfg

metro.config.ts

@@ -0,0 +1,57 @@
+// Learn more https://docs.expo.io/guides/customizing-metro
+import {type CustomResolver} from '@expo/metro/metro-resolver'
+import {getDefaultConfig} from '@expo/metro-config'
+import {getSentryExpoConfig} from '@sentry/react-native/metro.js'
+
+const config = getSentryExpoConfig(import.meta.dirname, {
+  // TODO: confirm this doesn't break anything when we switch to metro web
+  includeWebReplay: false,
+  annotateReactComponents: {
+    textComponentNames: ['Text', 'ButtonText'],
+  },
+  getDefaultConfig: (projectRoot, options) => {
+    const config = getDefaultConfig(projectRoot, options)
+
+    if (typeof process.env.RN_SRC_EXT === 'string') {
+      // inject `.e2e.ts` and `.e2e.tsx` into the sourceExts when running tests)
+      config.resolver.sourceExts.unshift(...process.env.RN_SRC_EXT.split(','))
+    }
+
+    config.resolver.assetExts = [...config.resolver.assetExts, 'woff2']
+
+    if (config.resolver.resolveRequest) {
+      throw Error('Update this override because it is conflicting now.')
+    }
+
+    if (process.env.BSKY_PROFILE) {
+      // @ts-expect-error readonly property
+      config.cacheVersion += ':PROFILE'
+
+      const resolver: CustomResolver = (context, moduleName, platform) => {
+        if (moduleName.endsWith('ReactNativeRenderer-prod')) {
+          return context.resolveRequest(
+            context,
+            moduleName.replace('-prod', '-profiling'),
+            platform,
+          )
+        }
+        return context.resolveRequest(context, moduleName, platform)
+      }
+
+      // @ts-expect-error readonly property
+      config.resolver.resolveRequest = resolver
+    }
+
+    config.transformer.getTransformOptions = () =>
+      Promise.resolve({
+        transform: {
+          experimentalImportSupport: true,
+          inlineRequires: true as false, // ??? typescript why?
+        },
+      })
+
+    return config as unknown as Record<string, unknown>
+  },
+})
+
+export default config

modules/Share-with-Bluesky/ShareViewController.swift

@@ -121,7 +121,6 @@ class ShareViewController: UIViewController {
     let firstItem = items.first
 
     if let dataUrl = try? await firstItem?.loadItem(forTypeIdentifier: "public.movie") as? URL {
-      let ext = String(dataUrl.lastPathComponent.split(separator: ".").last ?? "mp4")
       if let videoUriInfo = saveVideoWithInfo(dataUrl),
          let url = URL(string: "\(self.appScheme)://intent/compose?videoUri=\(videoUriInfo)") {
         _ = self.openURL(url)

modules/bottom-sheet/ios/SheetView.swift

@@ -32,9 +32,12 @@ class SheetView: ExpoView, UISheetPresentationControllerDelegate {
   var cornerRadius: CGFloat?
   var sourceViewTag: Int?
   var minHeight = 0.0
-  var maxHeight: CGFloat! {
+  // getScreenHeight() is nil when no window scene is connected yet (e.g. during
+  // prewarming or a background launch). A nil here previously trapped in
+  // clampHeight, so fall back to the full screen bounds instead.
+  var maxHeight: CGFloat = UIScreen.main.bounds.height {
     didSet {
-      let screenHeight = Util.getScreenHeight() ?? 0
+      let screenHeight = Util.getScreenHeight() ?? UIScreen.main.bounds.height
       if maxHeight > screenHeight {
         maxHeight = screenHeight
       }
@@ -77,7 +80,7 @@ class SheetView: ExpoView, UISheetPresentationControllerDelegate {
 
   required init (appContext: AppContext? = nil) {
     super.init(appContext: appContext)
-    self.maxHeight = Util.getScreenHeight()
+    self.maxHeight = Util.getScreenHeight() ?? UIScreen.main.bounds.height
     self.touchHandler = RCTTouchHandler(bridge: appContext?.reactBridge)
     SheetManager.shared.add(self)
   }

modules/bottom-sheet/src/BottomSheet.web.tsx

@@ -1,4 +1,4 @@
-import {BottomSheetViewProps} from './BottomSheet.types'
+import {type BottomSheetViewProps} from './BottomSheet.types'
 
 export function BottomSheet(_: BottomSheetViewProps) {
   throw new Error('BottomSheet is not available on web')

modules/bottom-sheet/src/BottomSheetPortal.tsx

@@ -1,20 +1,20 @@
-import React from 'react'
+import {createContext, useContext, useMemo} from 'react'
 
 import {createPortalGroup_INTERNAL} from './lib/Portal'
 
 type PortalContext = React.ElementType<{children: React.ReactNode}>
 
-export const Context = React.createContext({} as PortalContext)
+export const Context = createContext({} as PortalContext)
 Context.displayName = 'BottomSheetPortalContext'
 
-export const useBottomSheetPortal_INTERNAL = () => React.useContext(Context)
+export const useBottomSheetPortal_INTERNAL = () => useContext(Context)
 
 export function BottomSheetPortalProvider({
   children,
 }: {
   children: React.ReactNode
 }) {
-  const portal = React.useMemo(() => {
+  const portal = useMemo(() => {
     return createPortalGroup_INTERNAL()
   }, [])
 

modules/bottom-sheet/src/lib/Portal.tsx

@@ -1,4 +1,14 @@
-import React from 'react'
+import {
+  createContext,
+  Fragment,
+  useCallback,
+  useContext,
+  useEffect,
+  useId,
+  useMemo,
+  useRef,
+  useState,
+} from 'react'
 
 type Component = React.ReactElement
 
@@ -13,7 +23,7 @@ type ComponentMap = {
 }
 
 export function createPortalGroup_INTERNAL() {
-  const Context = React.createContext<ContextType>({
+  const Context = createContext<ContextType>({
     outlet: null,
     append: () => {},
     remove: () => {},
@@ -21,21 +31,21 @@ export function createPortalGroup_INTERNAL() {
   Context.displayName = 'BottomSheetPortalContext'
 
   function Provider(props: React.PropsWithChildren<{}>) {
-    const map = React.useRef<ComponentMap>({})
-    const [outlet, setOutlet] = React.useState<ContextType['outlet']>(null)
+    const map = useRef<ComponentMap>({})
+    const [outlet, setOutlet] = useState<ContextType['outlet']>(null)
 
-    const append = React.useCallback<ContextType['append']>((id, component) => {
+    const append = useCallback<ContextType['append']>((id, component) => {
       if (map.current[id]) return
-      map.current[id] = <React.Fragment key={id}>{component}</React.Fragment>
+      map.current[id] = <Fragment key={id}>{component}</Fragment>
       setOutlet(<>{Object.values(map.current)}</>)
     }, [])
 
-    const remove = React.useCallback<ContextType['remove']>(id => {
+    const remove = useCallback<ContextType['remove']>(id => {
       delete map.current[id]
       setOutlet(<>{Object.values(map.current)}</>)
     }, [])
 
-    const contextValue = React.useMemo(
+    const contextValue = useMemo(
       () => ({
         outlet,
         append,
@@ -50,14 +60,14 @@ export function createPortalGroup_INTERNAL() {
   }
 
   function Outlet() {
-    const ctx = React.useContext(Context)
+    const ctx = useContext(Context)
     return ctx.outlet
   }
 
   function Portal({children}: React.PropsWithChildren<{}>) {
-    const {append, remove} = React.useContext(Context)
-    const id = React.useId()
-    React.useEffect(() => {
+    const {append, remove} = useContext(Context)
+    const id = useId()
+    useEffect(() => {
       append(id, children as Component)
       return () => remove(id)
     }, [id, children, append, remove])

modules/expo-background-notification-handler/src/BackgroundNotificationHandlerProvider.tsx

@@ -1,6 +1,6 @@
-import React from 'react'
+import {createContext, useContext, useEffect, useMemo, useState} from 'react'
 
-import {BackgroundNotificationHandlerPreferences} from './ExpoBackgroundNotificationHandler.types'
+import {type BackgroundNotificationHandlerPreferences} from './ExpoBackgroundNotificationHandler.types'
 import {BackgroundNotificationHandler} from './ExpoBackgroundNotificationHandlerModule'
 
 interface BackgroundNotificationPreferencesContext {
@@ -11,11 +11,10 @@ interface BackgroundNotificationPreferencesContext {
   ) => void
 }
 
-const Context = React.createContext<BackgroundNotificationPreferencesContext>(
+const Context = createContext<BackgroundNotificationPreferencesContext>(
   {} as BackgroundNotificationPreferencesContext,
 )
-export const useBackgroundNotificationPreferences = () =>
-  React.useContext(Context)
+export const useBackgroundNotificationPreferences = () => useContext(Context)
 
 export function BackgroundNotificationPreferencesProvider({
   children,
@@ -23,18 +22,18 @@ export function BackgroundNotificationPreferencesProvider({
   children: React.ReactNode
 }) {
   const [preferences, setPreferences] =
-    React.useState<BackgroundNotificationHandlerPreferences>({
+    useState<BackgroundNotificationHandlerPreferences>({
       playSoundChat: true,
     })
 
-  React.useEffect(() => {
+  useEffect(() => {
     ;(async () => {
       const prefs = await BackgroundNotificationHandler.getAllPrefsAsync()
       setPreferences(prefs)
     })()
   }, [])
 
-  const value = React.useMemo(
+  const value = useMemo(
     () => ({
       preferences,
       setPref: async <

modules/expo-background-notification-handler/src/ExpoBackgroundNotificationHandlerModule.ts

@@ -1,6 +1,6 @@
 import {requireNativeModule} from 'expo-modules-core'
 
-import {ExpoBackgroundNotificationHandlerModule} from './ExpoBackgroundNotificationHandler.types'
+import {type ExpoBackgroundNotificationHandlerModule} from './ExpoBackgroundNotificationHandler.types'
 
 export const BackgroundNotificationHandler =
   requireNativeModule<ExpoBackgroundNotificationHandlerModule>(

modules/expo-background-notification-handler/src/ExpoBackgroundNotificationHandlerModule.web.ts

@@ -1,6 +1,6 @@
 import {
-  BackgroundNotificationHandlerPreferences,
-  ExpoBackgroundNotificationHandlerModule,
+  type BackgroundNotificationHandlerPreferences,
+  type ExpoBackgroundNotificationHandlerModule,
 } from './ExpoBackgroundNotificationHandler.types'
 
 // Stub for web

modules/expo-bluesky-gif-view/src/GifView.tsx

@@ -1,17 +1,24 @@
-import React from 'react'
+import {createRef, PureComponent} from 'react'
 import {requireNativeModule} from 'expo'
 import {requireNativeViewManager} from 'expo-modules-core'
 
-import {GifViewProps} from './GifView.types'
+import {type GifViewProps} from './GifView.types'
 
-const NativeModule = requireNativeModule('ExpoBlueskyGifView')
+interface GifViewNativeRef {
+  playAsync: () => Promise<void>
+  pauseAsync: () => Promise<void>
+  toggleAsync: () => Promise<void>
+}
+
+const NativeModule: {
+  prefetchAsync: (sources: string[]) => Promise<void>
+} = requireNativeModule('ExpoBlueskyGifView')
 const NativeView: React.ComponentType<
-  GifViewProps & {ref: React.RefObject<any>}
+  GifViewProps & {ref: React.RefObject<GifViewNativeRef | null>}
 > = requireNativeViewManager('ExpoBlueskyGifView')
 
-export class GifView extends React.PureComponent<GifViewProps> {
-  // TODO native types, should all be the same as those in this class
-  private nativeRef: React.RefObject<any> = React.createRef()
+export class GifView extends PureComponent<GifViewProps> {
+  private nativeRef: React.RefObject<GifViewNativeRef | null> = createRef()
 
   constructor(props: GifViewProps | Readonly<GifViewProps>) {
     super(props)
@@ -22,15 +29,15 @@ export class GifView extends React.PureComponent<GifViewProps> {
   }
 
   async playAsync(): Promise<void> {
-    await this.nativeRef.current.playAsync()
+    await this.nativeRef.current?.playAsync()
   }
 
   async pauseAsync(): Promise<void> {
-    await this.nativeRef.current.pauseAsync()
+    await this.nativeRef.current?.pauseAsync()
   }
 
   async toggleAsync(): Promise<void> {
-    await this.nativeRef.current.toggleAsync()
+    await this.nativeRef.current?.toggleAsync()
   }
 
   render() {

modules/expo-bluesky-gif-view/src/GifView.web.tsx

@@ -1,10 +1,11 @@
-import {createRef, PureComponent, type RefObject} from 'react'
+import {createRef, PureComponent} from 'react'
 import {StyleSheet} from 'react-native'
 
 import {type GifViewProps} from './GifView.types'
 
 export class GifView extends PureComponent<GifViewProps> {
-  private readonly videoPlayerRef: RefObject<HTMLMediaElement> = createRef()
+  private readonly videoPlayerRef: React.RefObject<HTMLVideoElement | null> =
+    createRef()
   private isLoaded = false
 
   constructor(props: GifViewProps | Readonly<GifViewProps>) {
@@ -18,9 +19,9 @@ export class GifView extends PureComponent<GifViewProps> {
   componentDidUpdate(prevProps: Readonly<GifViewProps>) {
     if (prevProps.autoplay !== this.props.autoplay) {
       if (this.props.autoplay) {
-        this.playAsync()
+        void this.playAsync()
       } else {
-        this.pauseAsync()
+        void this.pauseAsync()
       }
     }
   }
@@ -29,6 +30,7 @@ export class GifView extends PureComponent<GifViewProps> {
     document.removeEventListener('visibilitychange', this.onVisibilityChange)
   }
 
+  // eslint-disable-next-line @typescript-eslint/require-await
   static async prefetchAsync(_: string[]): Promise<void> {
     console.warn('prefetchAsync is not supported on web')
   }
@@ -67,9 +69,21 @@ export class GifView extends PureComponent<GifViewProps> {
   }
 
   async playAsync(): Promise<void> {
-    this.videoPlayerRef.current?.play()
+    try {
+      await this.videoPlayerRef.current?.play()
+    } catch (err) {
+      // `play()` rejects with a NotAllowedError when the browser blocks
+      // playback (e.g. Safari low-power mode or autoplay policy). This is
+      // expected and benign - the GIF simply stays paused - so swallow it
+      // rather than letting it surface as an unhandled rejection.
+      if (err instanceof DOMException && err.name === 'NotAllowedError') {
+        return
+      }
+      throw err
+    }
   }
 
+  // eslint-disable-next-line @typescript-eslint/require-await
   async pauseAsync(): Promise<void> {
     this.videoPlayerRef.current?.pause()
   }
@@ -91,12 +105,12 @@ export class GifView extends PureComponent<GifViewProps> {
         // When `<source>` children are present, omit `src` so the browser
         // walks the source list and picks via canPlayType.
         src={useSources ? undefined : source}
-        autoPlay={autoplay ? 'autoplay' : undefined}
+        autoPlay={autoplay ? true : undefined}
         preload={autoplay ? 'auto' : undefined}
         playsInline={true}
-        loop="loop"
-        muted="muted"
-        style={StyleSheet.flatten(style)}
+        loop={true}
+        muted={true}
+        style={StyleSheet.flatten(style) as React.CSSProperties}
         onCanPlay={this.onLoad}
         onPlay={this.firePlayerStateChangeEvent}
         onPause={this.firePlayerStateChangeEvent}

modules/expo-bluesky-swiss-army/README.md

@@ -10,6 +10,7 @@ This module consolidates several native features into a single Expo module:
 - **Referrer**: Tracking how users arrive at the app (web referrers, app referrers, Google Play install referrer)
 - **SharedPrefs**: Shared preferences storage using native platform APIs (UserDefaults on iOS, SharedPreferences on Android)
 - **VisibilityView**: A native view component that tracks which view is currently visible on screen
+- **NotificationSettings**: iOS handler that routes the system "notification settings" intent into the app
 
 ## Modules
 
@@ -123,9 +124,24 @@ This is useful for features like video autoplay, where you want to know which vi
 - Android: Full support using View position tracking
 - Web: Passthrough component (renders children without tracking)
 
-## Architecture
+### NotificationSettings
 
-### TypeScript Layer
+iOS only. Has no JavaScript surface - it is a pure native side effect registered
+at app launch.
+
+When push permissions are requested with `provideAppNotificationSettings: true`,
+iOS adds an in-app notification settings button to the system Settings screen for
+Bluesky. Tapping it launches the app and triggers
+`userNotificationCenter(_:openSettingsFor:)`. expo-notifications owns the
+`UNUserNotificationCenter` delegate and fans this callback out to registered
+`NotificationDelegate`s. This module registers one and converts the callback into
+a `bluesky://settings/notifications` deep link, which the app's existing linking
+config routes to the notification settings screen.
+
+**Platform Support:**
+- iOS: Full support
+- Android: Not applicable (Android opens the system notification settings directly)
+- Web: Not applicable
 
 The module uses platform-specific file extensions to provide appropriate implementations:
 
@@ -170,7 +186,9 @@ The module uses platform-specific file extensions to provide appropriate impleme
 
 ### Expo Module Config
 
-The module is registered in `expo-module.config.json` with all four sub-modules for both iOS and Android.
+The module is registered in `expo-module.config.json`. The PlatformInfo,
+Referrer, SharedPrefs, and VisibilityView sub-modules are registered for both iOS
+and Android; NotificationSettings is iOS only.
 
 ### iOS
 

modules/expo-bluesky-swiss-army/expo-module.config.json

@@ -5,7 +5,8 @@
       "ExpoBlueskySharedPrefsModule",
       "ExpoBlueskyReferrerModule",
       "ExpoBlueskyVisibilityViewModule",
-      "ExpoPlatformInfoModule"
+      "ExpoPlatformInfoModule",
+      "ExpoBlueskyNotificationSettingsModule"
     ]
   },
   "android": {

modules/expo-bluesky-swiss-army/ios/ExpoBlueskySwissArmy.podspec

@@ -10,6 +10,7 @@ Pod::Spec.new do |s|
   s.static_framework = true
 
   s.dependency 'ExpoModulesCore'
+  s.dependency 'EXNotifications'
 
   # Swift/Objective-C compatibility
   s.pod_target_xcconfig = {

modules/expo-bluesky-swiss-army/ios/NotificationSettings/ExpoBlueskyNotificationSettingsModule.swift

@@ -0,0 +1,40 @@
+import EXNotifications
+import ExpoModulesCore
+import UIKit
+import UserNotifications
+
+/*
+ * When we request push notification permissions with
+ * `provideAppNotificationSettings: true`, iOS adds an in-app notification
+ * settings button to the system Settings screen for Bluesky (and may surface
+ * it elsewhere, e.g. from a delivered notification). Tapping it launches the
+ * app and calls `userNotificationCenter(_:openSettingsFor:)`.
+ *
+ * expo-notifications owns the `UNUserNotificationCenter` delegate via its
+ * `NotificationCenterManager`, which fans that callback out to any registered
+ * `NotificationDelegate` through `openSettings(_:)`. We register here and turn
+ * the callback into a `bluesky://settings/notifications` deep link so the app's
+ * existing linking config routes the user to the notification settings screen.
+ */
+public class ExpoBlueskyNotificationSettingsModule: Module, NotificationDelegate {
+  public func definition() -> ModuleDefinition {
+    Name("ExpoBlueskyNotificationSettings")
+
+    OnCreate {
+      NotificationCenterManager.shared.addDelegate(self)
+    }
+
+    OnDestroy {
+      NotificationCenterManager.shared.removeDelegate(self)
+    }
+  }
+
+  public func openSettings(_ notification: UNNotification?) {
+    guard let url = URL(string: "bluesky://settings/notifications") else {
+      return
+    }
+    DispatchQueue.main.async {
+      UIApplication.shared.open(url, options: [:], completionHandler: nil)
+    }
+  }
+}

modules/expo-bluesky-swiss-army/src/PlatformInfo/index.native.ts

@@ -1,7 +1,7 @@
 import {Platform} from 'react-native'
 import {requireNativeModule} from 'expo-modules-core'
 
-import {AudioCategory} from './types'
+import {type AudioCategory} from './types'
 
 const NativeModule = requireNativeModule('ExpoPlatformInfo')
 

modules/expo-bluesky-swiss-army/src/PlatformInfo/index.ts

@@ -1,5 +1,5 @@
 import {NotImplementedError} from '../NotImplemented'
-import {AudioCategory} from './types'
+import {type AudioCategory} from './types'
 
 export function getIsReducedMotionEnabled(): boolean {
   throw new NotImplementedError()

modules/expo-bluesky-swiss-army/src/PlatformInfo/index.web.ts

@@ -1,5 +1,5 @@
 import {NotImplementedError} from '../NotImplemented'
-import {AudioCategory} from './types'
+import {type AudioCategory} from './types'
 
 export function getIsReducedMotionEnabled(): boolean {
   if (typeof window === 'undefined') {

modules/expo-bluesky-swiss-army/src/Referrer/index.android.ts

@@ -1,6 +1,6 @@
 import {requireNativeModule} from 'expo'
 
-import {GooglePlayReferrerInfo, ReferrerInfo} from './types'
+import {type GooglePlayReferrerInfo, type ReferrerInfo} from './types'
 
 export const NativeModule = requireNativeModule('ExpoBlueskyReferrer')