Bump app version to 1.127.0

Co-authored-by: Eric Bailey <git@esb.lol>

.claude/.pre-pr-sweep-state

@@ -0,0 +1 @@
+alt-blur@3076a2b5a593b0d7b37198b5aebfe3a222afd52d

.claude/settings.json

@@ -0,0 +1,9 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(pnpm typecheck *)",
+      "Bash(pnpm lint *)",
+      "Bash(pnpm test *)"
+    ]
+  }
+}

.env.example

@@ -1,8 +1,51 @@
-# Copy this to `.env` and `.env.test` files
+# The env the app is running in e.g. development, testflight, production
+EXPO_PUBLIC_ENV=development
 
-BITDRIFT_API_KEY=
-SENTRY_AUTH_TOKEN=
-EXPO_PUBLIC_LOG_LEVEL=debug
-EXPO_PUBLIC_LOG_DEBUG=
+# This is the semver release version of the app, pulled from package.json
+EXPO_PUBLIC_RELEASE_VERSION=
+
+# This is the commit hash that the current bundle was made from.
 EXPO_PUBLIC_BUNDLE_IDENTIFIER=
+
+# Should be formatted YYMMDDHH so that it increases for each build.
 EXPO_PUBLIC_BUNDLE_DATE=0
+
+# The log level for the app's logger transports
+EXPO_PUBLIC_LOG_LEVEL=debug
+
+# Enable debug logs for specific logger instances
+EXPO_PUBLIC_LOG_DEBUG=session
+
+# Bluesky appview DID
+EXPO_PUBLIC_BLUESKY_PROXY_DID=
+
+# Chat service DID
+EXPO_PUBLIC_CHAT_PROXY_DID=
+
+#
+#
+# Bluesky specific values
+#
+#
+
+# Bluesky's metrics API
+EXPO_PUBLIC_METRICS_API_HOST=
+
+# Growthbook config
+EXPO_PUBLIC_GROWTHBOOK_API_HOST=
+EXPO_PUBLIC_GROWTHBOOK_CLIENT_KEY=
+
+# Sentry DSN for telemetry
+EXPO_PUBLIC_SENTRY_DSN=
+
+# Bitdrift API key. If undefined, Bitdrift will be disabled.
+EXPO_PUBLIC_BITDRIFT_API_KEY=
+
+# geolocation web worker URL
+GEOLOCATION_DEV_URL=
+
+# live-events web worker URL
+LIVE_EVENTS_DEV_URL=
+
+# app-config web worker URL
+APP_CONFIG_DEV_URL=

.eslintrc.js

@@ -1,120 +0,0 @@
-module.exports = {
-  root: true,
-  extends: [
-    '@react-native',
-    'plugin:react/recommended',
-    'plugin:react/jsx-runtime',
-    'plugin:react-native-a11y/ios',
-    'prettier',
-  ],
-  parser: '@typescript-eslint/parser',
-  plugins: [
-    '@typescript-eslint',
-    'react',
-    'lingui',
-    'simple-import-sort',
-    'bsky-internal',
-    'eslint-plugin-react-compiler',
-    'import',
-  ],
-  rules: {
-    'react/no-unescaped-entities': 0,
-    'react/prop-types': 0,
-    'react-native/no-inline-styles': 0,
-    'bsky-internal/avoid-unwrapped-text': [
-      'error',
-      {
-        impliedTextComponents: [
-          'H1',
-          'H2',
-          'H3',
-          'H4',
-          'H5',
-          'H6',
-          'P',
-          'Admonition',
-          'Admonition.Admonition',
-          'Span',
-        ],
-        impliedTextProps: [],
-        suggestedTextWrappers: {
-          Button: 'ButtonText',
-          'ToggleButton.Button': 'ToggleButton.ButtonText',
-        },
-      },
-    ],
-    'bsky-internal/use-exact-imports': 'error',
-    'bsky-internal/use-typed-gates': 'error',
-    'bsky-internal/use-prefixed-imports': 'error',
-    'simple-import-sort/imports': [
-      'error',
-      {
-        groups: [
-          // Side effect imports.
-          ['^\\u0000'],
-          // Node.js builtins prefixed with `node:`.
-          ['^node:'],
-          // Packages.
-          // Things that start with a letter (or digit or underscore), or `@` followed by a letter.
-          // React/React Native priortized, followed by expo
-          // Followed by all packages excluding unprefixed relative ones
-          [
-            '^(react\\/(.*)$)|^(react$)|^(react-native(.*)$)',
-            '^(expo(.*)$)|^(expo$)',
-            '^(?!(?:alf|components|lib|locale|logger|platform|screens|state|view)(?:$|\\/))@?\\w',
-          ],
-          // Relative imports.
-          // Ideally, anything that starts with a dot or #
-          // due to unprefixed relative imports being used, we whitelist the relative paths we use
-          // (?:$|\\/) matches end of string or /
-          [
-            '^(?:#\\/)?(?:lib|state|logger|platform|locale)(?:$|\\/)',
-            '^(?:#\\/)?view(?:$|\\/)',
-            '^(?:#\\/)?screens(?:$|\\/)',
-            '^(?:#\\/)?alf(?:$|\\/)',
-            '^(?:#\\/)?components(?:$|\\/)',
-            '^#\\/',
-            '^\\.',
-          ],
-          // anything else - hopefully we don't have any of these
-          ['^'],
-        ],
-      },
-    ],
-    'simple-import-sort/exports': 'error',
-    'react-compiler/react-compiler': 'warn',
-    'no-unused-vars': 'off',
-    '@typescript-eslint/no-unused-vars': [
-      'error',
-      {argsIgnorePattern: '^_', varsIgnorePattern: '^_'},
-    ],
-    '@typescript-eslint/consistent-type-imports': [
-      'warn',
-      {prefer: 'type-imports', fixStyle: 'inline-type-imports'},
-    ],
-    'import/consistent-type-specifier-style': ['warn', 'prefer-inline'],
-  },
-  ignorePatterns: [
-    '**/__mocks__/*.ts',
-    'src/platform/polyfills.ts',
-    'src/third-party',
-    'ios',
-    'android',
-    'coverage',
-    '*.lock',
-    '.husky',
-    'patches',
-    '*.html',
-    'bskyweb',
-    'bskyembed',
-    'src/locale/locales/_build/',
-    'src/locale/locales/**/*.js',
-  ],
-  settings: {
-    componentWrapperFunctions: ['observer'],
-  },
-  parserOptions: {
-    sourceType: 'module',
-    ecmaVersion: 'latest',
-  },
-}

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,5 +1,5 @@
 name: "Bug Report"
-description: "Create a report for an issue you have experience in the app."
+description: "Create a report for an issue you have experienced in the app."
 labels: ["bug"]
 body:
   - type: markdown
@@ -19,13 +19,14 @@ body:
         4. See error
     validations:
       required: true
-  - type: textarea
+  - type: upload
     attributes:
       label: Attachments
       description: |
         If possible, please provide any images or videos that may help us understand the issue you are experiencing.
     validations:
       required: false
+      accept: ".png,.jpg,.jpeg,.gif,.webp,.mp4,.mov,.webm"
   - type: dropdown
     attributes:
       label: What platform(s) does this occur on?

.github/ISSUE_TEMPLATE/bug_report_fabric.yml

@@ -26,13 +26,14 @@ body:
         4. See error
     validations:
       required: true
-  - type: textarea
+  - type: upload
     attributes:
       label: Attachments
       description: |
         If possible, please provide any images or videos that may help us understand the issue you are experiencing.
     validations:
       required: false
+      accept: ".png,.jpg,.jpeg,.gif,.webp,.mp4,.mov,.webm"
   - type: dropdown
     attributes:
       label: What platform(s) does this occur on?

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -15,7 +15,7 @@ body:
         implement it in a timely manner.
     validations:
       required: true
-  - type: textarea
+  - type: upload
     attributes:
       label: Attachments
       description: |
@@ -24,6 +24,7 @@ body:
         in or is missing from.
     validations:
       required: false
+      accept: ".png,.jpg,.jpeg,.gif,.webp,.mp4,.mov,.webm"
   - type: textarea
     attributes:
       label: Describe Alternatives

.github/claude-review-prompt.md

@@ -0,0 +1,63 @@
+You are an experienced senior React Native engineer reviewing a pull
+request in the Bluesky Social app — a cross-platform (iOS, Android, Web)
+React Native + Expo application. Read the repo's CLAUDE.md before forming
+an opinion; it describes the architecture, the ALF design system, and the
+codebase conventions.
+
+Your audience is other senior engineers. Write peer-to-peer, not
+teacher-to-junior. Most PRs in this repo are fine; a review that says so
+is a valid and common outcome.
+
+Report a finding only if you can name a concrete scenario — specific
+input, platform, navigation path, or operating condition — in which the
+change causes incorrect behavior, a crash, a visual regression, a test
+failure, a security issue, or a real regression visible to users. Style,
+naming, and micro-optimizations are out of scope unless they introduce a
+defect. Do not speculate that a change "might" break unrelated code
+without pointing to the specific caller or code path. Do not repeat what
+the diff does.
+
+Where this codebase differs from a typical web app:
+
+- Three platforms from one codebase. Web-only APIs (DOM, window),
+  native-only modules, and platform-specific files (.web.tsx, .ios.tsx,
+  .android.tsx) are common sources of single-platform breakage. When a
+  change touches shared code, consider all three targets.
+- User-facing strings must go through Lingui (the `Trans` macro /
+  `useLingui`). Hardcoded English strings in UI are a finding. Do not
+  flag missing translations in catalog files — extraction and
+  compilation run in CI.
+- New UI should use ALF (`#/alf`, `#/components`) rather than legacy
+  patterns (`#/view/com`, StyleSheet.create); flag newly written code
+  that adopts deprecated patterns, but don't flag pre-existing code the
+  PR merely touches.
+- Server state lives in TanStack Query under src/state/queries. Watch
+  for cache-shape changes without corresponding invalidation updates,
+  and optimistic updates that can leave stale cache on failure.
+- List rendering is performance-critical (the main feed). Changes to
+  feed items, FlatList usage, or anything in a hot render path deserve
+  scrutiny for re-render storms — unstable callback/object identities
+  passed to memoized children, missing memoization on expensive
+  computation.
+- Moderation and content-filtering logic (labels, mutes, blocks,
+  hidden posts) is trust-and-safety-critical: a regression that shows
+  content that should be filtered is a blocking finding.
+- Deep links, push-notification routing, and the navigation state
+  machine have platform-specific edge cases; changes there should name
+  the platforms they were verified on.
+- The embed (bskyembed) and web deployment surfaces (bskyweb, link,
+  ogcard services in Go) ship separately from the app; changes there
+  have their own blast radius.
+
+For each finding, state the scenario in one or two sentences, cite
+file:line, and mark severity (blocking / non-blocking). If you are
+uncertain but the potential impact is high (crash on startup, moderation
+bypass, broken auth), include it and say what you are uncertain about.
+Otherwise, prefer silence over guessing.
+
+If there are no findings that meet this bar, say briefly that the PR
+looks fine and note what you checked.
+
+Post your review as a single top-level PR comment. Per-finding inline
+comments are also welcome where they'd anchor a reader to the specific
+lines involved.

.github/dependabot.yml

@@ -0,0 +1,44 @@
+version: 2
+# Dependabot auto-update config.
+#
+# Cooldown (7 days) is the point of this config: it delays version-update
+# PRs until a newly-published version has aged. Supply-chain attacks like
+# the tanstack Shai-Hulud compromise (2026-05-11) live minutes-to-hours
+# before the registry yanks them; a 7-day cooldown keeps poisoned
+# versions out of our lockfiles.
+#
+# Security updates bypass cooldown and continue to flow immediately. See:
+# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown
+#
+# Auto-merge is deliberately NOT enabled. Every dependabot PR gets human
+# review.
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    groups:
+      production:
+        dependency-type: production
+        update-types: [minor, patch]
+      development:
+        dependency-type: development
+        update-types: [minor, patch]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 3
+    groups:
+      actions:
+        patterns: ["*"]
+        update-types: [minor, patch]

.github/workflows/build-and-push-bskyweb-aws.yaml

@@ -22,13 +22,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.USERNAME}}
@@ -36,23 +36,22 @@ jobs:
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         with:
           images: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             type=sha,enable=true,priority=100,prefix=,suffix=,format=long
 
-      - name: Set outputs
-        id: vars
+      - name: Env
+        id: env
         run: |
-          echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
-          echo "SENTRY_DIST=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-          echo "SENTRY_RELEASE=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
+          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
+          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
@@ -62,8 +61,8 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           build-args: |
-            EXPO_PUBLIC_BUNDLE_IDENTIFIER=${{ steps.vars.outputs.sha_short }}
-            SENTRY_DIST=${{ steps.vars.outputs.SENTRY_DIST }}
-            SENTRY_RELEASE=${{ steps.vars.outputs.SENTRY_RELEASE }}
+            EXPO_PUBLIC_ENV=production
+            EXPO_PUBLIC_RELEASE_VERSION=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+            EXPO_PUBLIC_BUNDLE_IDENTIFIER=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
+            EXPO_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}
             SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-            SENTRY_DSN=${{ secrets.SENTRY_DSN }}

.github/workflows/build-and-push-bskyweb-ghcr.yaml

@@ -23,13 +23,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.USERNAME }}
@@ -37,7 +37,7 @@ jobs:
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         with:
           images: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -46,7 +46,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/build-and-push-embedr-aws.yaml

@@ -3,6 +3,7 @@ on:
   push:
     branches:
       - main
+      - echoprom_fix
 
 env:
   REGISTRY: ${{ secrets.AWS_ECR_REGISTRY_USEAST2_PACKAGES_REGISTRY }}
@@ -21,13 +22,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.USERNAME}}
@@ -35,7 +36,7 @@ jobs:
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         with:
           images: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -44,7 +45,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/build-and-push-link-aws.yaml

@@ -1,6 +1,9 @@
 name: build-and-push-link-aws
 on:
   workflow_dispatch:
+  push:
+    branches:
+      - main
 
 env:
   REGISTRY: ${{ secrets.AWS_ECR_REGISTRY_USEAST2_PACKAGES_REGISTRY }}
@@ -19,13 +22,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.USERNAME}}
@@ -33,7 +36,7 @@ jobs:
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         with:
           images: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -42,10 +45,10 @@ jobs:
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
-          push: ${{ github.event_name != 'pull_request' }}
+          push: true
           file: ./Dockerfile.bskylink
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

.github/workflows/build-and-push-ogcard-aws.yaml

@@ -1,6 +1,9 @@
 name: build-and-push-ogcard-aws
 on:
   workflow_dispatch:
+  push:
+    branches:
+      - main
 
 env:
   REGISTRY: ${{ secrets.AWS_ECR_REGISTRY_USEAST2_PACKAGES_REGISTRY }}
@@ -19,13 +22,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.USERNAME}}
@@ -33,7 +36,7 @@ jobs:
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         with:
           images: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -42,10 +45,10 @@ jobs:
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
-          push: ${{ github.event_name != 'pull_request' }}
+          push: true
           file: ./Dockerfile.bskyogcard
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

.github/workflows/build-submit-android.yml

@@ -10,11 +10,36 @@ on:
         options:
           - testflight-android
           - production
+  workflow_call:
+    inputs:
+      profile:
+        type: string
+        description: Build profile to use
+        required: true
+    outputs:
+      package-version:
+        description: Version from package.json
+        value: ${{ jobs.build.outputs.package-version }}
+      version-code:
+        description: Android version code
+        value: ${{ jobs.build.outputs.version-code }}
+
+# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
+permissions:
+  contents: read
 
 jobs:
   build:
+    if: github.repository == 'bluesky-social/social-app'
     name: Build and Submit Android
-    runs-on: ubuntu-latest
+    runs-on: Linux-x64-32core
+    concurrency:
+      group: android-build
+      cancel-in-progress: false
+    outputs:
+      package-version: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
+      version-code: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}
+      apk-artifact-name: build-${{ steps.timestamp.outputs.time }}.apk
     steps:
       - name: Check for EXPO_TOKEN
         run: >
@@ -24,157 +49,207 @@ jobs:
           fi
 
       - name: ⬇️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 5
 
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
       - name: 🔧 Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: .nvmrc
-          cache: yarn
+          node-version-file: package.json
+          cache: pnpm
 
       - name: 🪛 Setup jq
-        uses: dcarbone/install-jq-action@v2
-
-      - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@v8
-        with:
-          expo-version: latest
-          eas-version: latest
-          token: ${{ secrets.EXPO_TOKEN }}
-
-      - name: ⛏️ Setup EAS local builds
-        run: yarn global add eas-cli-local-build-plugin
-
-      - uses: actions/setup-java@v4
-        with:
-          distribution: 'temurin'
-          java-version: '17'
-
-      - name: "Use upgraded MMKV for Fabric"
-        run: |
-          sed -i 's/"react-native-mmkv": "\^2\.12\.2"/"react-native-mmkv": "^3.3.0"/' filename.txt
+        uses: dcarbone/install-jq-action@b7ef57d46ece78760b4019dbc4080a1ba2a40b45 # v3.2.0
 
       - name: ⚙️ Install dependencies
-        run: yarn install
+        run: pnpm install --frozen-lockfile
+
+      - name: 🔨 Setup Expo CLI
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
+        with:
+          eas-version: '19.0.5'
+          packager: 'pnpm --allow-build=dtrace-provider'
+          token: ${{ secrets.EXPO_TOKEN }}
+
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
+        with:
+          distribution: "temurin"
+          java-version: "17"
 
       - name: 🔤 Compile translations
-        run: yarn intl:build 2>&1 | tee i18n.log
+        run: pnpm intl:build 2>&1 | tee i18n.log
 
       - name: Check for i18n compilation errors
-        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
+        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation
+          errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
 
-      - name: ✏️ Write environment variables
+      # EXPO_PUBLIC_ENV is handled in eas.json
+      - name: Env
+        id: env
         run: |
           export json='${{ secrets.GOOGLE_SERVICES_TOKEN }}'
           echo "${{ secrets.ENV_TOKEN }}" > .env
-          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse --short HEAD)" >> .env
+          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> .env
+          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
+          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> .env
+          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
           echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
-          echo "BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
+          echo "EXPO_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}" >> .env
+          echo "EXPO_PUBLIC_BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
+          echo "EXPO_PUBLIC_GCP_PROJECT_ID=${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}" >> .env
           echo "$json" > google-services.json
 
-      - name: Setup Sentry vars for build-time injection
-        id: sentry
-        run: |
-          echo "SENTRY_DIST=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-          echo "SENTRY_RELEASE=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
-
       - name: 🏗️ EAS Build
-        run: SENTRY_DIST=${{ steps.sentry.outputs.SENTRY_DIST }} SENTRY_RELEASE=${{ steps.sentry.outputs.SENTRY_RELEASE }} SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }} SENTRY_DSN=${{ secrets.SENTRY_DSN }} yarn use-build-number-with-bump eas build -p android --profile ${{ inputs.profile || 'testflight-android' }} --local --output build.aab --non-interactive
-
-      - name: ✍️ Rename Testflight bundle
-        if: ${{ inputs.profile != 'production' }}
-        run: mv build.aab build.apk
-
-      - name: ⏰ Get a timestamp
-        id: timestamp
-        uses: nanzm/get-time-action@master
-        with:
-          format: 'MM-DD-HH-mm-ss'
-
-      - name: 🚀 Upload Production Artifact
-        id: upload-artifact-production
-        if: ${{ inputs.profile == 'production' }}
-        uses: actions/upload-artifact@v4
-        with:
-          retention-days: 30
-          compression-level: 6
-          name: build-${{ steps.timestamp.outputs.time }}.aab
-          path: build.aab
-
-      - name: 🚀 Upload Testflight Artifact
-        id: upload-artifact-testflight
-        if: ${{ inputs.profile != 'production' }}
-        uses: actions/upload-artifact@v4
-        with:
-          retention-days: 30
-          compression-level: 6
-          name: build-${{ steps.timestamp.outputs.time }}.apk
-          path: build.apk
+        env:
+          PROFILE: ${{ inputs.profile || 'testflight-android' }}
+        run: >
+          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
+          pnpm use-build-number-with-bump
+          pnpm eas build -p android
+          --profile $PROFILE
+          --local --output build.aab --non-interactive
 
       - name: 📚 Get version from package.json
         id: get-build-info
         run: bash scripts/setGitHubOutput.sh
 
-      - name: 🔔 Notify Slack of Production Build
-        if: ${{ inputs.profile == 'production' }}
-        uses: slackapi/slack-github-action@v1.25.0
-        with:
-          payload: |
-            {
-              "text": "Android production build for Google Play Store submission is ready!\n```Artifact: ${{ steps.upload-artifact-production.outputs.artifact-url }}\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}```"
-            }
+      - name: 🚀 Submit to Google Play
         env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+          PROFILE: ${{ inputs.profile || 'testflight-android' }}
+        run: pnpm eas submit -p android --profile $PROFILE --non-interactive --path build.aab
 
-      - name: 🔔 Notify Slack of Testflight Build
-        if: ${{ inputs.profile != 'production' }}
-        uses: slackapi/slack-github-action@v1.25.0
+      - name: 🔔 Notify Slack of Play Store Submission
+        if: ${{ inputs.profile == 'production' }}
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
         with:
+          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload-templated: true
           payload: |
-            {
-              "text": "Android build is ready for testing. Download the artifact here: ${{ steps.upload-artifact-testflight.outputs.artifact-url }}"
-            }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+            {"text": "Android ${{ inputs.profile || 'testflight-android' }} build submitted to Google Play!\n```Version Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}```"}
 
-      - name: 🏗️ Build Production APK
-        if: ${{ inputs.profile == 'production' }}
-        run: SENTRY_DIST=${{ steps.sentry.outputs.SENTRY_DIST }} SENTRY_RELEASE=${{ steps.sentry.outputs.SENTRY_RELEASE }} SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }} SENTRY_DSN=${{ secrets.SENTRY_DSN }} yarn use-build-number-with-bump eas build -p android --profile production-apk --local --output build.apk --non-interactive
+      - name: 🔧 Setup bundletool
+        uses: amyu/setup-bundletool@cc2e1857284660bd625e43f2c8a45626f034302f # v1.1
+        with:
+          version: "1.18.3"
 
-      - name: 🚀 Upload Production APK Artifact
-        id: upload-artifact-production-apk
-        if: ${{ inputs.profile == 'production' }}
-        uses: actions/upload-artifact@v4
+      - name: 🔑 Decode keystore
+        run: echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 --decode >
+          keystore.jks
+
+      - name: 📦 Build signed universal APK
+        run: |
+          bundletool build-apks \
+            --bundle=build.aab \
+            --output=universal.apks \
+            --mode=universal \
+            --ks=keystore.jks \
+            --ks-pass=pass:${{ secrets.ANDROID_KEYSTORE_PASSWORD }} \
+            --ks-key-alias=${{ secrets.ANDROID_KEY_ALIAS }} \
+            --key-pass=pass:${{ secrets.ANDROID_KEY_PASSWORD }}
+
+      - name: 📋 Rename to .zip for extraction
+        run: mv universal.apks universal.zip
+
+      - name: 📦 Extract universal APK
+        run: unzip -p universal.zip universal.apk > build.apk
+
+      - name: ⏰ Get a timestamp
+        id: timestamp
+        run: echo "time=$(date -u +'%m-%d-%H-%M-%S')" >> "$GITHUB_OUTPUT"
+
+      - name: 🚀 Upload APK Artifact
+        id: upload-artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           retention-days: 30
           compression-level: 6
           name: build-${{ steps.timestamp.outputs.time }}.apk
           path: build.apk
 
-      - name: 🔔 Notify Slack of Production APK Build
-        if: ${{ inputs.profile == 'production' }}
-        uses: slackapi/slack-github-action@v1.25.0
+      - name: 🔔 Notify Slack of APK Artifact
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
         with:
+          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload-templated: true
           payload: |
-            {
-              "text": "Android production build for GitHub/Obtanium is ready!\n```Artifact: ${{ steps.upload-artifact-production-apk.outputs.artifact-url }}\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}```"
-            }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+            {"text": "Android ${{ inputs.profile || 'testflight-android' }} APK is ready for testing!\n```Artifact: ${{ steps.upload-artifact.outputs.artifact-url }}\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}```"}
 
       - name: ⬇️ Restore Cache
         id: get-base-commit
-        uses: actions/cache@v4
-        if: ${{ inputs.profile == 'testflight' }}
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        if: ${{ inputs.profile == 'testflight-android' }}
         with:
           path: most-recent-testflight-commit.txt
           key: most-recent-testflight-commit
 
       - name: ✏️ Write commit hash to cache
-        if: ${{ inputs.profile == 'testflight' }}
-        run: echo ${{ github.sha }} > most-recent-testflight-commit.txt
+        if: ${{ inputs.profile == 'testflight-android' }}
+        env:
+          GITHUB_SHA: ${{ github.sha }}
+        run: echo $GITHUB_SHA > most-recent-testflight-commit.txt
+
+  # Releases are cut from tags named after the version (e.g. "1.124.0"), so when a production
+  # build is dispatched against such a tag we attach the APK to the matching release. This runs
+  # as a separate job so that `contents: write` is isolated here and the build job stays read-only.
+  attachToRelease:
+    name: Attach APK to GitHub Release
+    runs-on: ubuntu-latest
+    needs: [build]
+    if: ${{ inputs.profile == 'production' && github.ref_type == 'tag' && github.repository == 'bluesky-social/social-app' }}
+    permissions:
+      contents: write
+    steps:
+      # We only attach to a release that already exists — never create one.
+      - name: 🔎 Check for matching GitHub Release
+        id: release-check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          status=$(curl -sS -o /dev/null -w '%{http_code}' \
+            -H "Authorization: Bearer $GH_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}")
+          if [ "$status" = "200" ]; then
+            echo "Found GitHub Release for tag $TAG"
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "No GitHub Release found for tag $TAG (HTTP $status); skipping APK attachment."
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: ⬇️ Download APK artifact
+        if: ${{ steps.release-check.outputs.exists == 'true' }}
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ${{ needs.build.outputs.apk-artifact-name }}
+
+      - name: 🏷️ Rename APK for release
+        if: ${{ steps.release-check.outputs.exists == 'true' }}
+        run: cp build.apk "Bluesky-${{ needs.build.outputs.package-version }}.apk"
+
+      - name: 📎 Attach APK to GitHub Release
+        id: attach
+        if: ${{ steps.release-check.outputs.exists == 'true' }}
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        with:
+          tag_name: ${{ github.ref_name }}
+          files: Bluesky-${{ needs.build.outputs.package-version }}.apk
+          fail_on_unmatched_files: true
+
+      - name: 🔔 Notify Slack of Release Attachment
+        if: ${{ steps.release-check.outputs.exists == 'true' }}
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
+        with:
+          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload-templated: true
+          payload: |
+            {"text": "Android APK attached to GitHub Release ${{ github.ref_name }}!\n```Asset: Bluesky-${{ needs.build.outputs.package-version }}.apk\nRelease: ${{ steps.attach.outputs.url }}```"}

.github/workflows/build-submit-ios.yml

@@ -10,11 +10,47 @@ on:
         options:
           - testflight
           - production
+      testFlightGroup:
+        type: choice
+        description: TestFlight group to assign the build to after submitting
+        options:
+          - none
+          - QA Team
+          - Software Mansion
+        default: none
+  workflow_call:
+    inputs:
+      profile:
+        type: string
+        description: Build profile to use
+        required: true
+      testFlightGroup:
+        type: string
+        description: TestFlight group to assign the build to after submitting ("none" to skip)
+        default: none
+    outputs:
+      package-version:
+        description: Version from package.json
+        value: ${{ jobs.build.outputs.package-version }}
+      build-number:
+        description: iOS build number
+        value: ${{ jobs.build.outputs.build-number }}
+
+# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
+permissions:
+  contents: read
 
 jobs:
   build:
+    if: github.repository == 'bluesky-social/social-app'
     name: Build and Submit iOS
-    runs-on: macos-15
+    runs-on: macos-26-xlarge
+    concurrency:
+      group: ios-build
+      cancel-in-progress: false
+    outputs:
+      package-version: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
+      build-number: ${{ steps.ipa-build-number.outputs.build-number }}
     steps:
       - name: Check for EXPO_TOKEN
         run: >
@@ -24,100 +60,215 @@ jobs:
           fi
 
       - name: ⬇️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 5
 
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
       - name: 🔧 Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: .nvmrc
-          cache: yarn
+          node-version-file: package.json
+          cache: pnpm
 
       - name: 🪛 Setup jq
-        uses: dcarbone/install-jq-action@v2
-
-      - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@v8
-        with:
-          expo-version: latest
-          eas-version: latest
-          token: ${{ secrets.EXPO_TOKEN }}
-
-      - name: ⛏️ Setup EAS local builds
-        run: yarn global add eas-cli-local-build-plugin
+        uses: dcarbone/install-jq-action@b7ef57d46ece78760b4019dbc4080a1ba2a40b45 # v3.2.0
 
       - name: ⚙️ Install dependencies
-        run: yarn install
+        run: pnpm install --frozen-lockfile
 
-      - uses: maxim-lobanov/setup-xcode@v1
+      - name: 🔨 Setup Expo CLI
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
         with:
-          xcode-version: '16.2'
+          eas-version: '19.0.5'
+          packager: 'pnpm --allow-build=dtrace-provider'
+          token: ${{ secrets.EXPO_TOKEN }}
 
-      - name: ☕️ Setup Cocoapods
-        uses: maxim-lobanov/setup-cocoapods@v1
+      - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
         with:
-          version: 1.14.3
+          xcode-version: "26.4"
+
+      - name: ☕️ Assert Cocoapods version
+        run: |
+          EXPECTED=1.16.2
+          ACTUAL=$(pod --version)
+          if [ "$ACTUAL" != "$EXPECTED" ]; then
+            echo "Expected Cocoapods $EXPECTED but runner has $ACTUAL."
+            echo "The version ships preinstalled with the macOS runner image: https://github.com/actions/runner-images/blob/main/images/macos/macos-26-Readme.md"
+            echo "If the runner image changed, update EXPECTED here or reinstall the pinned version."
+            exit 1
+          fi
 
       - name: 💾 Cache Pods
-        uses: actions/cache@v3
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         id: pods-cache
         with:
           path: ./ios/Pods
-          # We'll use the yarn.lock for our hash since we don't yet have a Podfile.lock. Pod versions will not
-          # change unless the yarn version changes as well.
-          key: ${{ runner.os }}-pods-${{ hashFiles('yarn.lock') }}
+          # We'll use the pnpm-lock.yaml for our hash since we don't yet have a Podfile.lock. Pod versions will not
+          # change unless the pnpm version changes as well.
+          key: ${{ runner.os }}-pods-${{ hashFiles('pnpm-lock.yaml') }}
 
       - name: 🔤 Compile translations
-        run: yarn intl:build 2>&1 | tee i18n.log
+        run: pnpm intl:build 2>&1 | tee i18n.log
 
       - name: Check for i18n compilation errors
-        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
+        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation
+          errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
 
+      # EXPO_PUBLIC_ENV is handled in eas.json
       - name: ✏️ Write environment variables
+        id: env
         run: |
           echo "${{ secrets.ENV_TOKEN }}" > .env
-          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse --short HEAD)" >> .env
+          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> .env
+          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
+          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> .env
+          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
           echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
-          echo "BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
+          echo "EXPO_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}" >> .env
+          echo "EXPO_PUBLIC_BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
+          echo "EXPO_PUBLIC_GCP_PROJECT_ID=${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}" >> .env
           echo "${{ secrets.GOOGLE_SERVICES_TOKEN }}" > google-services.json
 
-      - name: Setup Sentry vars for build-time injection
-        id: sentry
-        run: |
-          echo "SENTRY_DIST=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-          echo "SENTRY_RELEASE=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
-
       - name: 🏗️ EAS Build
-        run: SENTRY_DIST=${{ steps.sentry.outputs.SENTRY_DIST }} SENTRY_RELEASE=${{ steps.sentry.outputs.SENTRY_RELEASE }} SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }} SENTRY_DSN=${{ secrets.SENTRY_DSN }} yarn use-build-number-with-bump eas build -p ios --profile ${{ inputs.profile || 'testflight' }} --local --output build.ipa --non-interactive
+        env:
+          PROFILE: ${{ inputs.profile || 'testflight' }}
+        run: >
+          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
+          pnpm use-build-number-with-bump
+          pnpm eas build -p ios
+          --profile $PROFILE
+          --local --output build.tar.gz --non-interactive
+
+      - name: 📂 Extract build artifact
+        run: |
+          if [ -f "build.tar.gz" ]; then
+            echo "Extracting build.tar.gz..."
+            rm -rf ios-build
+            mkdir -p ios-build
+            tar -xzf build.tar.gz -C ios-build
+            echo "Extraction completed successfully"
+
+            echo ""
+            echo "Top-level extracted files:"
+            find ios-build -maxdepth 3 -print
+
+            echo ""
+            echo "Searching for IPA..."
+            IPA_PATH="$(find ios-build -type f -name '*.ipa' -print -quit)"
+            if [ -z "$IPA_PATH" ]; then
+              echo "ERROR: No .ipa found anywhere under ios-build."
+              echo "Archive contents:"
+              tar -tzf build.tar.gz | sed -n '1,200p'
+              exit 1
+            fi
+
+            BUILD_DIR="$(dirname "$IPA_PATH")"
+            echo "Found IPA at: $IPA_PATH"
+            echo "Build dir: $BUILD_DIR"
+            echo ""
+            echo "Build dir contents:"
+            ls -la "$BUILD_DIR"
+            echo "BUILD_DIR=$BUILD_DIR" >> $GITHUB_ENV
+          else
+            echo "Archive file not found!"
+            exit 1
+          fi
 
       - name: 🚀 Deploy
-        run: eas submit -p ios --non-interactive --path build.ipa
+        run: pnpm eas submit -p ios --non-interactive --path "$BUILD_DIR/Bluesky.ipa"
+
+      - name: 🪲 Upload dSYM to Sentry
+        run: >
+          SENTRY_ORG=blueskyweb
+          SENTRY_PROJECT=app
+          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
+          pnpm sentry-cli debug-files upload "$BUILD_DIR/Bluesky.app.dSYM.zip" --include-sources
 
       - name: 📚 Get version from package.json
         id: get-build-info
         run: bash scripts/setGitHubOutput.sh
 
+      # Read the build number straight from the IPA's CFBundleVersion. This is the value
+      # baked in at build time by use-build-number-with-bump (remote counter + 1) and the
+      # number that actually lands in App Store Connect. `eas build:version:get` reads the
+      # remote counter, which a --local build does not advance, so it can be off by one —
+      # using it here would make distribute_only poll for a nonexistent build.
+      - name: 🔢 Read build number from IPA
+        id: ipa-build-number
+        run: |
+          plist_dir="$(mktemp -d)"
+          unzip -o -q "$BUILD_DIR/Bluesky.ipa" 'Payload/*.app/Info.plist' -d "$plist_dir"
+          plist="$(find "$plist_dir" -name Info.plist -print -quit)"
+          build_number="$(/usr/libexec/PlistBuddy -c 'Print CFBundleVersion' "$plist")"
+          rm -rf "$plist_dir"
+          if [ -z "$build_number" ]; then
+            echo "ERROR: could not read CFBundleVersion from IPA"
+            exit 1
+          fi
+          echo "IPA build number: $build_number"
+          echo "build-number=$build_number" >> "$GITHUB_OUTPUT"
+
+      # eas submit only uploads to App Store Connect; it can't assign a build to a
+      # TestFlight group. fastlane's distribute_only mode skips the upload and assigns the
+      # already-submitted build to the group, polling until Apple finishes processing it.
+      - name: 🧪 Assign build to TestFlight group
+        if: ${{ inputs.testFlightGroup != 'none' }}
+        env:
+          TESTFLIGHT_GROUP: ${{ inputs.testFlightGroup }}
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+          ASC_KEY_P8_BASE64: ${{ secrets.ASC_KEY_P8_BASE64 }}
+          APP_VERSION: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
+          BUILD_NUMBER: ${{ steps.ipa-build-number.outputs.build-number }}
+        run: |
+          # Ensure the API key material is removed even if fastlane exits non-zero
+          # (the step runs under `bash -e`, which would otherwise abort before cleanup).
+          trap 'rm -f asc_api_key.json' EXIT
+          # fastlane's Token.from_json_file expects the .p8 contents inline under "key"
+          # (PEM with embedded newlines), not a path. jq handles the newline escaping.
+          key_content="$(echo "$ASC_KEY_P8_BASE64" | base64 --decode)"
+          jq -n \
+            --arg key_id "$ASC_KEY_ID" \
+            --arg issuer_id "$ASC_ISSUER_ID" \
+            --arg key "$key_content" \
+            '{key_id: $key_id, issuer_id: $issuer_id, key: $key, in_house: false}' \
+            > asc_api_key.json
+          # app_platform is required in non-interactive mode: distribute_only otherwise
+          # calls fetch_app_platform, which prompts for input and crashes without a TTY.
+          fastlane run upload_to_testflight \
+            api_key_path:"$PWD/asc_api_key.json" \
+            distribute_only:true \
+            app_platform:"ios" \
+            app_identifier:"xyz.blueskyweb.app" \
+            app_version:"$APP_VERSION" \
+            build_number:"$BUILD_NUMBER" \
+            groups:"$TESTFLIGHT_GROUP" \
+            notify_external_testers:true
+
       - name: 🔔 Notify Slack of Production Build
         if: ${{ inputs.profile == 'production' }}
-        uses: slackapi/slack-github-action@v1.25.0
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
         with:
+          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload-templated: true
           payload: |
-            {
-              "text": "iOS production build for App Store submission is ready!\n```Artifact: Check TestFlight to know when it is available\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_IOS_BUILD_NUMBER }}```"
-            }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+            {"text": "iOS production build for App Store submission is ready!\n```Artifact: Check TestFlight to know when it is available\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.ipa-build-number.outputs.build-number }}```"}
 
       - name: ⬇️ Restore Cache
         id: get-base-commit
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         if: ${{ inputs.profile == 'testflight' }}
         with:
           path: most-recent-testflight-commit.txt
           key: most-recent-testflight-commit
 
       - name: ✏️ Write commit hash to cache
+        env:
+          GITHUB_SHA: ${{ github.sha }}
         if: ${{ inputs.profile == 'testflight' }}
-        run: echo ${{ github.sha }} > most-recent-testflight-commit.txt
+        run: echo $GITHUB_SHA > most-recent-testflight-commit.txt

.github/workflows/bundle-deploy-eas-update.yml

@@ -18,8 +18,13 @@ on:
         description: Runtime version (in x.x.x format) that this update is for
         required: true
 
+# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
+permissions:
+  contents: read
+
 jobs:
   bundleDeploy:
+    if: github.repository == 'bluesky-social/social-app'
     name: Bundle and Deploy EAS Update
     runs-on: ubuntu-latest
     concurrency:
@@ -38,14 +43,16 @@ jobs:
 
       # Validate the version if one is supplied. This should generally happen if the update is for a production client
       - name: 🧐 Validate version
+        env:
+          RUNTIME_VERSION: ${{ inputs.runtimeVersion }}
         if: ${{ inputs.runtimeVersion }}
         run: |
-          if [ -z "${{ inputs.runtimeVersion }}" ]; then
-            [[ "${{ inputs.runtimeVersion }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] && echo "Version is valid" || exit 1
+          if [ -z "$RUNTIME_VERSION" ]; then
+            [[ "$RUNTIME_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] && echo "Version is valid" || exit 1
           fi
 
       - name: ⬇️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
@@ -53,76 +60,81 @@ jobs:
         if: ${{ github.ref != 'refs/heads/main' }}
         run: git fetch origin main:main --depth 100
 
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
       - name: 🔧 Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: .nvmrc
-          cache: yarn
+          node-version-file: package.json
+          cache: pnpm
 
       - name: 📷 Check fingerprint and install dependencies
         id: fingerprint
-        uses: bluesky-social/github-actions/fingerprint-native@main
+        uses: bluesky-social/github-actions/fingerprint-native@b5556913e4aef3964cfd5936d0add3fc0d809bdb # v0.1.0
         with:
           profile: ${{ inputs.channel || 'testflight' }}
           previous-commit-tag: ${{ inputs.runtimeVersion }}
 
-      - name: Lint check
-        run: yarn lint
-
-      - name: Lint lockfile
-        run: yarn lockfile-lint
-
-      - name: Prettier check
-        run: yarn prettier --check .
-
       - name: 🔤 Compile translations
-        run: yarn intl:build 2>&1 | tee i18n.log
+        run: pnpm intl:build 2>&1 | tee i18n.log
 
       - name: Check for i18n compilation errors
-        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
+        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation
+          errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
+
+      - name: Lint check
+        run: pnpm lint
+
+      - name: Prettier check
+        run: pnpm prettier --check .
 
       - name: Type check
-        run: yarn typecheck
+        run: pnpm typecheck
 
       - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@v8
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
         if: ${{ !steps.fingerprint.outputs.includes-changes }}
         with:
-          expo-version: latest
-          eas-version: latest
+          eas-version: '19.0.5'
+          packager: 'pnpm --allow-build=dtrace-provider'
           token: ${{ secrets.EXPO_TOKEN }}
 
-      - name: ⛏️ Setup Expo
-        if: ${{ !steps.fingerprint.outputs.includes-changes }}
-        run: yarn global add eas-cli-local-build-plugin
-
       - name: 🪛 Setup jq
         if: ${{ !steps.fingerprint.outputs.includes-changes }}
-        uses: dcarbone/install-jq-action@v2
+        uses: dcarbone/install-jq-action@b7ef57d46ece78760b4019dbc4080a1ba2a40b45 # v3.2.0
 
-      - name: ✏️ Write environment variables
+      # eas.json not used here, set EXPO_PUBLIC_ENV
+      - name: Env
+        env:
+          CHANNEL: ${{ inputs.channel || 'testflight' }}
+          GITHUB_SHA: ${{ github.sha }}
+        id: env
         if: ${{ !steps.fingerprint.outputs.includes-changes }}
         run: |
           export json='${{ secrets.GOOGLE_SERVICES_TOKEN }}'
           echo "${{ secrets.ENV_TOKEN }}" > .env
-          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse --short HEAD)" >> .env
+          echo "EXPO_PUBLIC_ENV=$CHANNEL" >> .env
+          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> .env
+          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
+          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> .env
+          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
           echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
-          echo "BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
+          echo "EXPO_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}" >> .env
+          echo "EXPO_PUBLIC_BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
+          echo "EXPO_PUBLIC_GCP_PROJECT_ID=${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}" >> .env
           echo "$json" > google-services.json
 
-      - name: Setup Sentry vars for build-time injection
-        id: sentry
-        run: |
-          echo "SENTRY_DIST=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-          echo "SENTRY_RELEASE=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
-
       - name: 🏗️ Create Bundle
         if: ${{ !steps.fingerprint.outputs.includes-changes }}
-        run: SENTRY_DIST=${{ steps.sentry.outputs.SENTRY_DIST }} SENTRY_RELEASE=${{ steps.sentry.outputs.SENTRY_RELEASE }} SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }} SENTRY_DSN=${{ secrets.SENTRY_DSN }} EXPO_PUBLIC_ENV="${{ inputs.channel || 'testflight' }}" yarn export
+        run: >
+          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
+          pnpm export
 
       - name: 📦 Package Bundle and 🚀 Deploy
         if: ${{ !steps.fingerprint.outputs.includes-changes }}
-        run: yarn use-build-number bash scripts/bundleUpdate.sh
+        run: pnpm use-build-number bash scripts/bundleUpdate.sh
         env:
           DENIS_API_KEY: ${{ secrets.DENIS_API_KEY }}
           RUNTIME_VERSION: ${{ inputs.runtimeVersion }}
@@ -130,7 +142,7 @@ jobs:
 
       - name: ⬇️ Restore Cache
         id: get-base-commit
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         if: ${{ !steps.fingerprint.outputs.includes-changes }}
         with:
           path: most-recent-testflight-commit.txt
@@ -138,19 +150,21 @@ jobs:
 
       - name: ✏️ Write commit hash to cache
         if: ${{ !steps.fingerprint.outputs.includes-changes }}
-        run: echo ${{ github.sha }} > most-recent-testflight-commit.txt
+        run: echo $GITHUB_SHA > most-recent-testflight-commit.txt
 
   # GitHub actions are horrible so let's just copy paste this in
   buildIfNecessaryIOS:
     name: Build and Submit iOS
-    runs-on: macos-15
+    runs-on: macos-26
     concurrency:
-      group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}-build-ios
-      cancel-in-progress: true
+      group: ios-build
+      cancel-in-progress: false
     needs: [bundleDeploy]
     # Gotta check if its NOT '[]' because any md5 hash in the outputs is detected as a possible secret and won't be
     # available here
-    if: ${{ inputs.channel != 'production' && needs.bundleDeploy.outputs.changes-detected }}
+    if: ${{ inputs.channel != 'production' &&
+      needs.bundleDeploy.outputs.changes-detected && github.repository ==
+      'bluesky-social/social-app' }}
     steps:
       - name: Check for EXPO_TOKEN
         run: >
@@ -160,67 +174,128 @@ jobs:
           fi
 
       - name: ⬇️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 5
 
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
       - name: 🔧 Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: .nvmrc
-          cache: yarn
+          node-version-file: package.json
+          cache: pnpm
 
       - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@v8
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
         with:
-          expo-version: latest
-          eas-version: latest
+          eas-version: '19.0.5'
+          packager: 'pnpm --allow-build=dtrace-provider'
           token: ${{ secrets.EXPO_TOKEN }}
 
-      - name: ⛏️ Setup EAS local builds
-        run: yarn global add eas-cli-local-build-plugin
-
       - name: ⚙️ Install dependencies
-        run: yarn install
+        run: pnpm install --frozen-lockfile
 
-      - uses: maxim-lobanov/setup-xcode@v1
+      - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
         with:
-          xcode-version: '16.2'
+          xcode-version: "26.4"
 
-      - name: ☕️ Setup Cocoapods
-        uses: maxim-lobanov/setup-cocoapods@v1
-        with:
-          version: 1.14.3
+      - name: ☕️ Assert Cocoapods version
+        run: |
+          EXPECTED=1.16.2
+          ACTUAL=$(pod --version)
+          if [ "$ACTUAL" != "$EXPECTED" ]; then
+            echo "Expected Cocoapods $EXPECTED but runner has $ACTUAL."
+            echo "The version ships preinstalled with the macOS runner image: https://github.com/actions/runner-images/blob/main/images/macos/macos-26-Readme.md"
+            echo "If the runner image changed, update EXPECTED here or reinstall the pinned version."
+            exit 1
+          fi
 
       - name: 💾 Cache Pods
-        uses: actions/cache@v3
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         id: pods-cache
         with:
           path: ./ios/Pods
-          # We'll use the yarn.lock for our hash since we don't yet have a Podfile.lock. Pod versions will not
-          # change unless the yarn version changes as well.
-          key: ${{ runner.os }}-pods-${{ hashFiles('yarn.lock') }}
+          # We'll use the pnpm-lock.yaml for our hash since we don't yet have a Podfile.lock. Pod versions will not
+          # change unless the pnpm version changes as well.
+          key: ${{ runner.os }}-pods-${{ hashFiles('pnpm-lock.yaml') }}
 
       - name: 🔤 Compile translations
-        run: yarn intl:build
+        run: pnpm intl:build
 
-      - name: ✏️ Write environment variables
+      # EXPO_PUBLIC_ENV is handled in eas.json
+      - name: Env
+        id: env
         run: |
           echo "${{ secrets.ENV_TOKEN }}" > .env
-          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse --short HEAD)" >> .env
+          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> .env
+          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
+          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> .env
+          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
           echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
-          echo "BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
+          echo "EXPO_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}" >> .env
+          echo "EXPO_PUBLIC_BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
+          echo "EXPO_PUBLIC_GCP_PROJECT_ID=${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}" >> .env
           echo "${{ secrets.GOOGLE_SERVICES_TOKEN }}" > google-services.json
 
       - name: 🏗️ EAS Build
-        run: yarn use-build-number-with-bump eas build -p ios --profile testflight --local --output build.ipa --non-interactive
+        run: >
+          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
+          pnpm use-build-number-with-bump
+          pnpm eas build -p ios
+          --profile testflight
+          --local --output build.tar.gz --non-interactive
+
+      - name: 📂 Extract build artifact
+        run: |
+          if [ -f "build.tar.gz" ]; then
+            echo "Extracting build.tar.gz..."
+            rm -rf ios-build
+            mkdir -p ios-build
+            tar -xzf build.tar.gz -C ios-build
+            echo "Extraction completed successfully"
+
+            echo ""
+            echo "Top-level extracted files:"
+            find ios-build -maxdepth 3 -print
+
+            echo ""
+            echo "Searching for IPA..."
+            IPA_PATH="$(find ios-build -type f -name '*.ipa' -print -quit)"
+            if [ -z "$IPA_PATH" ]; then
+              echo "ERROR: No .ipa found anywhere under ios-build."
+              echo "Archive contents:"
+              tar -tzf build.tar.gz | sed -n '1,200p'
+              exit 1
+            fi
+
+            BUILD_DIR="$(dirname "$IPA_PATH")"
+            echo "Found IPA at: $IPA_PATH"
+            echo "Build dir: $BUILD_DIR"
+            echo ""
+            echo "Build dir contents:"
+            ls -la "$BUILD_DIR"
+            echo "BUILD_DIR=$BUILD_DIR" >> $GITHUB_ENV
+          else
+            echo "Archive file not found!"
+            exit 1
+          fi
 
       - name: 🚀 Deploy
-        run: eas submit -p ios --non-interactive --path build.ipa
+        run: pnpm eas submit -p ios --non-interactive --path "$BUILD_DIR/Bluesky.ipa"
+
+      - name: 🪲 Upload dSYM to Sentry
+        run: >
+          SENTRY_ORG=blueskyweb
+          SENTRY_PROJECT=app
+          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
+          pnpm sentry-cli debug-files upload "$BUILD_DIR/Bluesky.app.dSYM.zip" --include-sources
 
       - name: ⬇️ Restore Cache
         id: get-base-commit
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         if: ${{ inputs.channel == 'testflight' }}
         with:
           path: most-recent-testflight-commit.txt
@@ -228,18 +303,22 @@ jobs:
 
       - name: ✏️ Write commit hash to cache
         if: ${{ inputs.channel == 'testflight' }}
-        run: echo ${{ github.sha }} > most-recent-testflight-commit.txt
+        env:
+          GITHUB_SHA: ${{ github.sha }}
+        run: echo $GITHUB_SHA > most-recent-testflight-commit.txt
 
   buildIfNecessaryAndroid:
     name: Build and Submit Android
     runs-on: ubuntu-latest
     concurrency:
-      group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}-build-android
+      group: android-build
       cancel-in-progress: false
     needs: [bundleDeploy]
     # Gotta check if its NOT '[]' because any md5 hash in the outputs is detected as a possible secret and won't be
     # available here
-    if: ${{ inputs.channel != 'production' && needs.bundleDeploy.outputs.changes-detected }}
+    if: ${{ inputs.channel != 'production' &&
+      needs.bundleDeploy.outputs.changes-detected && github.repository ==
+      'bluesky-social/social-app'}}
 
     steps:
       - name: Check for EXPO_TOKEN
@@ -250,62 +329,103 @@ jobs:
           fi
 
       - name: ⬇️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 5
 
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
       - name: 🔧 Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: .nvmrc
-          cache: yarn
+          node-version-file: package.json
+          cache: pnpm
 
       - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@v8
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
         with:
-          expo-version: latest
-          eas-version: latest
+          eas-version: '19.0.5'
+          packager: 'pnpm --allow-build=dtrace-provider'
           token: ${{ secrets.EXPO_TOKEN }}
 
-      - name: ⛏️ Setup EAS local builds
-        run: yarn global add eas-cli-local-build-plugin
-
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
-          distribution: 'temurin'
-          java-version: '17'
-
-      - name: "Use upgraded MMKV for Fabric"
-        run: |
-          sed -i 's/"react-native-mmkv": "\^2\.12\.2"/"react-native-mmkv": "^3.3.0"/' filename.txt
+          distribution: "temurin"
+          java-version: "17"
 
       - name: ⚙️ Install dependencies
-        run: yarn install
+        run: pnpm install --frozen-lockfile
 
       - name: 🔤 Compile translations
-        run: yarn intl:build
+        run: pnpm intl:build
 
-      - name: ✏️ Write environment variables
+      # EXPO_PUBLIC_ENV is handled in eas.json
+      - name: Env
+        id: env
         run: |
           export json='${{ secrets.GOOGLE_SERVICES_TOKEN }}'
           echo "${{ secrets.ENV_TOKEN }}" > .env
-          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse --short HEAD)" >> .env
+          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> .env
+          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
+          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> .env
+          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
           echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
-          echo "BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
+          echo "EXPO_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}" >> .env
+          echo "EXPO_PUBLIC_BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
+          echo "EXPO_PUBLIC_GCP_PROJECT_ID=${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}" >> .env
           echo "$json" > google-services.json
 
       - name: 🏗️ EAS Build
-        run: yarn use-build-number-with-bump eas build -p android --profile testflight-android --local --output build.apk --non-interactive
+        run: >
+          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
+          pnpm use-build-number-with-bump
+          pnpm eas build -p android
+          --profile testflight-android
+          --local --output build.aab --non-interactive
+
+      - name: 📚 Get version from package.json
+        id: get-build-info
+        run: bash scripts/setGitHubOutput.sh
+
+      - name: 🚀 Submit to Google Play
+        run: pnpm eas submit -p android --profile testflight-android --non-interactive --path
+          build.aab
+
+      - name: 🔧 Setup bundletool
+        uses: amyu/setup-bundletool@cc2e1857284660bd625e43f2c8a45626f034302f # v1.1
+        with:
+          version: "1.18.3"
+
+      - name: 🔑 Decode keystore
+        run: echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 --decode >
+          keystore.jks
+
+      - name: 📦 Build signed universal APK
+        run: |
+          bundletool build-apks \
+            --bundle=build.aab \
+            --output=universal.apks \
+            --mode=universal \
+            --ks=keystore.jks \
+            --ks-pass=pass:${{ secrets.ANDROID_KEYSTORE_PASSWORD }} \
+            --ks-key-alias=${{ secrets.ANDROID_KEY_ALIAS }} \
+            --key-pass=pass:${{ secrets.ANDROID_KEY_PASSWORD }}
+
+      - name: 📋 Rename to .zip for extraction
+        run: mv universal.apks universal.zip
+
+      - name: 📦 Extract universal APK
+        run: unzip -p universal.zip universal.apk > build.apk
 
       - name: ⏰ Get a timestamp
         id: timestamp
-        uses: nanzm/get-time-action@master
-        with:
-          format: 'MM-DD-HH-mm-ss'
+        run: echo "time=$(date -u +'%m-%d-%H-%M-%S')" >> "$GITHUB_OUTPUT"
 
       - name: 🚀 Upload Artifact
         id: upload-artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           retention-days: 30
           compression-level: 0
@@ -313,24 +433,24 @@ jobs:
           path: build.apk
 
       - name: 🔔 Notify Slack
-        uses: slackapi/slack-github-action@v1.25.0
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
         with:
+          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload-templated: true
           payload: |
-            {
-              "text": "Android build is ready for testing. Download the artifact here: ${{ steps.upload-artifact.outputs.artifact-url }}"
-            }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+            {"text": "Android build is ready for testing. Download the artifact here: ${{ steps.upload-artifact.outputs.artifact-url }}"}
 
       - name: ⬇️ Restore Cache
         id: get-base-commit
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         if: ${{ inputs.channel != 'testflight' && inputs.channel != 'production' }}
         with:
           path: most-recent-testflight-commit.txt
           key: most-recent-testflight-commit
 
       - name: ✏️ Write commit hash to cache
+        env:
+          GITHUB_SHA: ${{ github.sha }}
         if: ${{ inputs.channel != 'testflight' && inputs.channel != 'production' }}
-        run: echo ${{ github.sha }} > most-recent-testflight-commit.txt
+        run: echo $GITHUB_SHA > most-recent-testflight-commit.txt

.github/workflows/claude-mention.yml

@@ -0,0 +1,76 @@
+name: claude-mention
+
+# @claude mention handler on PR conversation comments, inline review
+# comments, and review bodies. See the header comment in
+# claude-review.yml for why this is self-contained rather than calling
+# the org reusable workflows.
+#
+# Authorization note: this repo is public, and the load-bearing gate
+# against drive-by commenters is INSIDE claude-code-action — the action
+# verifies via the API that the triggering actor has write permission
+# before doing anything (`allowed_non_write_users` and `allowed_bots`
+# both default to deny). The `if:` below is a cheap pre-filter to avoid
+# spinning up runners for the 99% of comments that don't mention
+# @claude; it is not the security boundary.
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  pull_request_review:
+    types: [submitted]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+  actions: read
+  id-token: write
+
+jobs:
+  mention:
+    # Skip comments/reviews that don't mention @claude, non-PR issue
+    # comments, and events from claude[bot] itself (its review prose
+    # often quotes "@claude" and must not retrigger the workflow).
+    if: >
+      (
+        (github.event_name == 'issue_comment' &&
+          github.event.issue.pull_request != null &&
+          contains(github.event.comment.body, '@claude')) ||
+        (github.event_name == 'pull_request_review_comment' &&
+          contains(github.event.comment.body, '@claude')) ||
+        (github.event_name == 'pull_request_review' &&
+          contains(github.event.review.body, '@claude'))
+      ) &&
+      github.actor != 'claude[bot]'
+
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    concurrency:
+      group: claude-mention-${{ github.repository }}-${{ github.event.issue.number || github.event.pull_request.number }}
+      cancel-in-progress: false
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 1
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        with:
+          role-to-assume: ${{ secrets.AWS_BEDROCK_REVIEW_ROLE_ARN }}
+          aws-region: us-east-2
+
+      - name: Claude
+        uses: anthropics/claude-code-action@30544b674398ee15c84819bd87caf8a87e8c7b55 # v1.0.154
+        with:
+          use_bedrock: 'true'
+          additional_permissions: |
+            actions: read
+          track_progress: true
+          claude_args: |
+            --model global.anthropic.claude-opus-4-8
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__download_job_log,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"

.github/workflows/claude-review.yml

@@ -0,0 +1,68 @@
+name: claude-review
+
+# Automatic Claude review on PR creation/update, via Bedrock (OIDC, no
+# long-lived tokens). Self-contained: this intentionally uses upstream
+# claude-code-action defaults rather than the org reusable workflows in
+# bluesky-social/.github (which a public repo cannot call, and whose
+# customizations added no value over upstream).
+#
+# Review guidance lives in .github/claude-review-prompt.md.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: write
+  actions: read
+  id-token: write
+
+jobs:
+  review:
+    # Internal PRs only. This repo is public: fork PRs are the bulk of
+    # community traffic and MUST NOT trigger reviews (no Bedrock spend on
+    # unvetted code, and fork PRs can't mint the OIDC token anyway —
+    # belt-and-braces with this explicit guard). Branch PRs can only be
+    # created by people with write access, i.e. org members.
+    # Bot-authored PRs (dependabot, changesets) are also skipped.
+    if: >
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.type != 'Bot'
+
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    concurrency:
+      group: claude-review-${{ github.repository }}-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 1
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        with:
+          role-to-assume: ${{ secrets.AWS_BEDROCK_REVIEW_ROLE_ARN }}
+          aws-region: us-east-2
+
+      - name: Claude review
+        uses: anthropics/claude-code-action@30544b674398ee15c84819bd87caf8a87e8c7b55 # v1.0.154
+        with:
+          use_bedrock: 'true'
+          additional_permissions: |
+            actions: read
+          track_progress: true
+          claude_args: |
+            --model global.anthropic.claude-opus-4-8
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__download_job_log,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
+          prompt: |
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number }}
+
+            Read .github/claude-review-prompt.md in the checked-out repo
+            and review this pull request following its guidance.

.github/workflows/golang-test-lint.yml

@@ -7,19 +7,23 @@ on:
       - main
 
 concurrency:
-  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
+  group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build-and-test:
     runs-on: ubuntu-latest
     steps:
       - name: Git Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up Go tooling
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: '1.23'
+          go-version-file: bskyweb/go.mod
+          cache-dependency-path: bskyweb/go.sum
       - name: Dummy Static Files
         run: touch bskyweb/static/js/blah.js && touch bskyweb/static/css/blah.txt && touch bskyweb/static/media/blah.txt
       - name: Check
@@ -32,11 +36,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Git Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up Go tooling
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: '1.23'
+          go-version-file: bskyweb/go.mod
+          cache-dependency-path: bskyweb/go.sum
       - name: Dummy Static Files
         run: touch bskyweb/static/js/blah.js && touch bskyweb/static/css/blah.txt && touch bskyweb/static/media/blah.txt
       - name: Lint

.github/workflows/lint.yml

@@ -9,51 +9,111 @@ concurrency:
   group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
   cancel-in-progress: true
 
+# These jobs only check out the repo and run checks, so read access to the
+# repo contents is all the GITHUB_TOKEN needs.
+permissions:
+  contents: read
+
 jobs:
   linting:
     name: Run linters
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        job: [lint, prettier, typecheck]
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Verify Node version pins match package.json
+        run: |
+          set -euo pipefail
+          expected=$(node -p "require('./package.json').engines.node.replace(/[^0-9.]/g, '')")
+          rc=0
+          check() {
+            if [ "$2" != "$expected" ]; then
+              echo "::error file=$1::Node version mismatch: $1 pins '$2' but package.json is '$expected'"
+              rc=1
+            fi
+          }
+          # FROM node:X.Y.Z - service runtime images
+          for f in Dockerfile.bskylink Dockerfile.bskyogcard; do
+            v=$(grep -oE 'FROM node:[0-9]+\.[0-9]+\.[0-9]+' "$f" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | sort -u)
+            check "$f" "$v"
+          done
+          # ENV NODE_VERSION=X.Y.Z - Go images that nvm-install Node for the JS build stage
+          for f in Dockerfile.embedr; do
+            v=$(grep -oE 'NODE_VERSION=[0-9]+\.[0-9]+\.[0-9]+' "$f" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | sort -u)
+            check "$f" "$v"
+          done
+          # eas.json "node": "X.Y.Z"
+          v=$(grep -oE '"node":[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+"' eas.json | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | sort -u)
+          check "eas.json" "$v"
+          exit $rc
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - name: Install node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: .nvmrc
-      - name: Yarn install
-        uses: Wandalen/wretry.action@master
-        with:
-          command: yarn --frozen-lockfile
-          attempt_limit: 3
-          attempt_delay: 2000
-      - name: Lint check
-        run: yarn lint
-      - name: Lint lockfile
-        run: yarn lockfile-lint
-      - name: Prettier check
-        run: yarn prettier --check .
+          node-version-file: package.json
+          cache: pnpm
+      - name: pnpm install
+        run: pnpm install --frozen-lockfile
       - name: Check & compile i18n
-        run: yarn intl:build
-      - name: Type check
-        run: yarn typecheck
+        run: pnpm intl:build
+      - name: Lint checks
+        run: pnpm ${{ matrix.job }}
+  # Aggregates the matrix results into a single stable check name so branch
+  # protection can require "Run linters" regardless of how many matrix jobs run.
+  # The result is asserted in `run` (not `if`) so a malformed expression can
+  # never silently skip the check and report a false pass.
+  linting-summary:
+    name: Run linters
+    if: always()
+    needs: [linting]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require linting to have succeeded
+        env:
+          RESULT: ${{ needs.linting.result }}
+        run: |
+          echo "linting result: $RESULT"
+          test "$RESULT" = "success"
   testing:
     name: Run tests
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - name: Install node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: .nvmrc
-      - name: Yarn install
-        uses: Wandalen/wretry.action@master
-        with:
-          command: yarn --frozen-lockfile
-          attempt_limit: 3
-          attempt_delay: 2000
+          node-version-file: package.json
+          cache: pnpm
+      - name: pnpm install
+        run: pnpm install --frozen-lockfile
       - name: Check & compile i18n
-        run: yarn intl:build
+        run: pnpm intl:build
       - name: Run tests
         run: |
-          NODE_ENV=test yarn test --forceExit
+          NODE_ENV=test pnpm test --forceExit --shard=${{ matrix.shard }}/${{ strategy.job-total }}
+  # Aggregates the sharded test results into a single stable check name so branch
+  # protection can require "Run tests" regardless of how many shards run.
+  # The result is asserted in `run` (not `if`) so a malformed expression can
+  # never silently skip the check and report a false pass.
+  testing-summary:
+    name: Run tests
+    if: always()
+    needs: [testing]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require testing to have succeeded
+        env:
+          RESULT: ${{ needs.testing.result }}
+        run: |
+          echo "testing result: $RESULT"
+          test "$RESULT" = "success"

.github/workflows/nightly-build.yml

@@ -0,0 +1,173 @@
+---
+name: Nightly Build
+
+on:
+  schedule:
+    - cron: "10 2 * * *" # run at 2:10 AM UTC, after the nightly i18n job
+  workflow_dispatch:
+
+# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
+permissions:
+  contents: read
+
+jobs:
+  # Generate the changelog once, shared by both platforms. The range covers commits since
+  # the previous nightly, whose commit SHA is stored as a "nightly-build-commit" artifact
+  # (advanced by the record job below, only after both builds succeed).
+  prepare:
+    name: Prepare release notes
+    if: github.repository == 'bluesky-social/social-app'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    outputs:
+      notes: ${{ steps.notes.outputs.notes }}
+    steps:
+      - name: ⬇️ Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - name: 📝 Generate release notes
+        id: notes
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Find the most recent non-expired nightly-build-commit artifact and read its SHA
+          # The artifacts API returns results newest-first, so the most recent marker is on
+          # page 1 — no --paginate needed (which would run the jq aggregation per page and
+          # could emit multiple URLs). Take the first non-expired match.
+          prev=""
+          url=$(gh api \
+            "repos/${GITHUB_REPOSITORY}/actions/artifacts?name=nightly-build-commit&per_page=100" \
+            --jq 'first(.artifacts[] | select(.expired == false)) | .archive_download_url' \
+            2>/dev/null || true)
+          if [ -n "$url" ] && [ "$url" != "null" ]; then
+            if curl -sSL -H "Authorization: Bearer $GH_TOKEN" -o marker.zip "$url" \
+              && unzip -o -q marker.zip; then
+              prev=$(cat nightly-build-commit.txt 2>/dev/null | tr -d '[:space:]')
+            fi
+            rm -f marker.zip nightly-build-commit.txt
+          fi
+
+          if [ -n "$prev" ] && git cat-file -e "${prev}^{commit}" 2>/dev/null; then
+            echo "Generating notes since previous nightly: $prev"
+            range="${prev}..HEAD"
+          else
+            echo "No reachable previous nightly commit; falling back to last 30 commits."
+            range="HEAD~30..HEAD"
+          fi
+          notes=$(git log --no-merges --pretty=format:'- %s' "$range" 2>/dev/null | head -n 50)
+          if [ -z "$notes" ]; then
+            notes="Nightly build — no new commits since the last nightly."
+          fi
+          # Cap the whole changelog to keep the Slack message a reasonable size.
+          # head -c caps the combined stream; cut -c would only cap each line independently.
+          notes=$(printf '%s' "$notes" | head -c 3900)
+          {
+            echo "notes<<NOTES_EOF"
+            echo "$notes"
+            echo "NOTES_EOF"
+          } >> "$GITHUB_OUTPUT"
+
+  ios:
+    name: Nightly iOS Build
+    needs: [prepare]
+    uses: ./.github/workflows/build-submit-ios.yml
+    with:
+      profile: testflight
+      testFlightGroup: "QA Team"
+    secrets: inherit
+
+  android:
+    name: Nightly Android Build
+    needs: [prepare]
+    # build-submit-android.yml contains an attachToRelease job that requests contents: write.
+    # That job is skipped for nightly (it needs a production tag build), but GitHub statically
+    # validates the reusable-workflow permission ceiling, so the caller must grant it here.
+    permissions:
+      contents: write
+    uses: ./.github/workflows/build-submit-android.yml
+    with:
+      profile: testflight-android
+    secrets: inherit
+
+  notify-ios:
+    name: Notify Slack of iOS nightly
+    needs: [prepare, ios]
+    runs-on: ubuntu-latest
+    steps:
+      - name: 📝 Build Slack payload
+        id: payload
+        env:
+          NOTES: ${{ needs.prepare.outputs.notes }}
+          VERSION: ${{ needs.ios.outputs.package-version }}
+          BUILD_NUMBER: ${{ needs.ios.outputs.build-number }}
+        run: |
+          text="*Nightly iOS build available in TestFlight (QA Team)*
+          Version ${VERSION} (${BUILD_NUMBER})
+
+          ${NOTES}"
+          payload=$(jq -n --arg text "$text" '{text: $text}')
+          {
+            echo "payload<<PAYLOAD_EOF"
+            echo "$payload"
+            echo "PAYLOAD_EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: 🔔 Notify Slack
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
+        with:
+          webhook: ${{ secrets.NIGHTLY_BUILDS_SLACK_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload: ${{ steps.payload.outputs.payload }}
+
+  notify-android:
+    name: Notify Slack of Android nightly
+    needs: [prepare, android]
+    runs-on: ubuntu-latest
+    steps:
+      - name: 📝 Build Slack payload
+        id: payload
+        env:
+          NOTES: ${{ needs.prepare.outputs.notes }}
+          VERSION: ${{ needs.android.outputs.package-version }}
+          VERSION_CODE: ${{ needs.android.outputs.version-code }}
+        run: |
+          text="*Nightly Android build available (Internal track)*
+          Version ${VERSION} (${VERSION_CODE})
+
+          ${NOTES}"
+          payload=$(jq -n --arg text "$text" '{text: $text}')
+          {
+            echo "payload<<PAYLOAD_EOF"
+            echo "$payload"
+            echo "PAYLOAD_EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: 🔔 Notify Slack
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
+        with:
+          webhook: ${{ secrets.NIGHTLY_BUILDS_SLACK_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload: ${{ steps.payload.outputs.payload }}
+
+  # Advance the nightly marker only after both builds succeed, so a failed night's commits
+  # roll into the next successful nightly's notes rather than being silently dropped.
+  record:
+    name: Record nightly commit
+    needs: [ios, android]
+    runs-on: ubuntu-latest
+    steps:
+      - name: ✏️ Write nightly commit marker
+        env:
+          GITHUB_SHA: ${{ github.sha }}
+        run: echo "$GITHUB_SHA" > nightly-build-commit.txt
+
+      - name: 🚀 Upload nightly commit marker
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: nightly-build-commit
+          path: nightly-build-commit.txt
+          retention-days: 90

.github/workflows/nightly-update-source-languages.yaml

@@ -1,7 +1,7 @@
 name: Nightly Update Source Languages
 on:
   schedule:
-    - cron: '0 2 * * *' # run at 2 AM UTC
+    - cron: "0 2 * * *" # run at 2 AM UTC
   workflow_dispatch:
 
 jobs:
@@ -16,28 +16,26 @@ jobs:
 
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ssh-key: ${{secrets.GH_ACTION_DEPLOY_KEY}}
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - name: Install node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: .nvmrc
-      - name: Yarn install
-        uses: Wandalen/wretry.action@master
-        with:
-          command: yarn --frozen-lockfile
-          attempt_limit: 3
-          attempt_delay: 2000
+          node-version-file: package.json
+          cache: pnpm
+      - name: pnpm install
+        run: pnpm install --frozen-lockfile
       - name: Extract language strings
-        run: yarn intl:extract
+        run: pnpm intl:extract
       - name: Create commit
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
         with:
           commit_message: Nightly source-language update
           file_pattern: ./src/locale/locales/en/messages.po
       - name: Push source lang to Crowdin
-        uses: crowdin/github-action@v2
+        uses: crowdin/github-action@52aa776766211d83d975df51f3b9c53c2f8ba35f # v2.16.3
         with:
           upload_sources: true
           upload_sources_args: "-b main"
@@ -46,4 +44,4 @@ jobs:
           push_sources: false
           create_pull_request: false
         env:
-          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}

.github/workflows/pull-request-comment.yml

@@ -0,0 +1,221 @@
+---
+name: PR Comment Trigger
+
+on:
+  issue_comment:
+    types: [created]
+
+# Permissions are granted per-job below; anything unlisted defaults to none
+permissions: {}
+
+jobs:
+  handle-comment:
+    if: github.event.issue.pull_request
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      should-deploy: ${{ steps.check-org.outputs.result }}
+
+    steps:
+      - name: Check if bot is mentioned
+        id: check-mention
+        env:
+          COMMENT: ${{ github.event.comment.body }}
+        run: |
+          if [[ "$COMMENT" == *"@github-actions"* ]] || \
+             [[ "$COMMENT" == *"github-actions[bot]"* ]]; then
+            bot_mentioned=true
+          else
+            bot_mentioned=false
+          fi
+
+
+          if [[ "$COMMENT" == *"ota"* ]]; then
+            has_ota=true
+          else
+            has_ota=false
+          fi
+
+
+          if [[ "$bot_mentioned" == "true" ]] && [[ "$has_ota" == "true" ]]; then
+            echo "mentioned=true" >> $GITHUB_OUTPUT
+          else
+            echo "mentioned=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Check commenter has write access
+        if: steps.check-mention.outputs.mentioned == 'true'
+        id: check-org
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            try {
+              const { data: perm } = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                username: context.payload.comment.user.login
+              });
+
+              const hasAccess = ['admin', 'write'].includes(perm.permission);
+              console.log(`User has ${perm.permission} access`);
+
+              return hasAccess;
+            } catch(error) {
+              console.log('User has no repository access');
+              return false;
+            }
+
+  bundle-deploy:
+    name: Bundle and Deploy EAS Update
+    runs-on: ubuntu-latest
+    needs: [handle-comment]
+    if: needs.handle-comment.outputs.should-deploy == 'true'
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Get PR HEAD SHA
+        env:
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+        id: pr-info
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const pr = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: process.env.ISSUE_NUMBER,
+            });
+
+            // This workflow runs with repo secrets in scope, so never build
+            // code from a fork: the commenter authorizes the deploy, but a
+            // fork controls what code would run during it
+            const expected = `${context.repo.owner}/${context.repo.repo}`;
+            const head = pr.data.head.repo?.full_name;
+            if (head !== expected) {
+              core.setFailed(`OTA deploys are only allowed for branches in ${expected}, not forks (got ${head})`);
+              return;
+            }
+
+            console.log(`PR HEAD SHA: ${pr.data.head.sha}`);
+            console.log(`PR HEAD REF: ${pr.data.head.ref}`);
+
+            core.setOutput('head-sha', pr.data.head.sha);
+            core.setOutput('head-ref', pr.data.head.ref);
+
+      - name: 💬 Drop a comment
+        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
+        with:
+          header: pull-request-eas-build-${{ steps.pr-info.outputs.head-sha }}
+          number: ${{ github.event.issue.number }}
+          message: |
+            An OTA deployment has been requested and is now running for `${{ steps.pr-info.outputs.head-sha }}`.
+
+            [Here is some music to listen to while you wait...](https://www.youtube.com/watch?v=VBlFHuCzPgY)
+            ---
+            *Generated by [PR labeler](https://github.com/expo/expo/actions/workflows/pr-labeler.yml) 🤖*
+
+      - name: Check for EXPO_TOKEN
+        run: >
+          if [ -z "${{ secrets.EXPO_TOKEN }}" ]; then
+            echo "You must provide an EXPO_TOKEN secret linked to this project's Expo account in this repo's secrets. Learn more: https://docs.expo.dev/eas-update/github-actions"
+            exit 1
+          fi
+
+      - name: ⬇️ Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ steps.pr-info.outputs.head-sha }}
+
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
+      - name: 🔧 Setup Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: package.json
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: 🔤 Compile translations
+        run: pnpm intl:build 2>&1 | tee i18n.log
+
+      - name: Check for i18n compilation errors
+        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
+
+      - name: Lint check
+        run: pnpm lint
+
+      - name: Type check
+        run: pnpm typecheck
+
+      - name: 🔨 Setup EAS
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
+        with:
+          eas-version: '19.0.5'
+          packager: 'pnpm --allow-build=dtrace-provider'
+          token: ${{ secrets.EXPO_TOKEN }}
+
+      - name: 🪛 Setup jq
+        uses: dcarbone/install-jq-action@b7ef57d46ece78760b4019dbc4080a1ba2a40b45 # v3.2.0
+
+      - name: Env
+        id: env
+        run: |
+          export json='${{ secrets.GOOGLE_SERVICES_TOKEN }}'
+          echo "${{ secrets.ENV_TOKEN }}" > .env
+          echo "EXPO_PUBLIC_ENV=testflight" >> .env
+          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> .env
+          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
+          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> .env
+          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+          echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
+          echo "EXPO_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}" >> .env
+          echo "EXPO_PUBLIC_BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
+          echo "EXPO_PUBLIC_GCP_PROJECT_ID=${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}" >> .env
+          echo "$json" > google-services.json
+
+      - name: 🏗️ Create Bundle
+        run: >
+          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
+          pnpm export
+
+      - name: 📦 Package Bundle and 🚀 Deploy
+        run: pnpm use-build-number bash scripts/bundleUpdate.sh
+        env:
+          DENIS_API_KEY: ${{ secrets.DENIS_API_KEY }}
+          CHANNEL_NAME: pull-request-${{ github.event.issue.number }}
+          RUNTIME_VERSION:
+
+      - name: 💬 Drop a comment
+        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
+        env:
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+        with:
+          header: pull-request-eas-build-${{ steps.pr-info.outputs.head-sha }}
+          number: ${{ github.event.issue.number }}
+          message: |
+            Your requested OTA deployment was successful! You may now apply it by either scanning the QR code or opening the deep link below in your browser:
+
+            <img src="https://bsky-qr.vercel.app?channel=pull-request-$ISSUE_NUMBER" width=300 height=300>
+
+            `bluesky://intent/apply-ota?channel=pull-request-${{ github.event.issue.number }}`
+            ---
+
+            *Generated by [PR labeler](https://github.com/expo/expo/actions/workflows/pr-labeler.yml) 🤖*
+
+      - name: 💬 Drop a comment
+        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
+        if: failure()
+        with:
+          header: pull-request-eas-build-${{ steps.pr-info.outputs.head-sha }}
+          number: ${{ github.event.issue.number }}
+          message: |
+            Your requested OTA deployment was unsuccessful. See action logs for more details.
+            ---
+            *Generated by [PR labeler](https://github.com/expo/expo/actions/workflows/pr-labeler.yml) 🤖*

.github/workflows/pull-request-commit.yml

@@ -13,52 +13,65 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  pull-requests: write
-  actions: write
-  contents: read
+# Permissions are granted per-job below; anything unlisted defaults to none.
+# pull-requests: write is needed by sticky-pull-request-comment to post the
+# bundle-size and fingerprint diffs
+permissions: {}
 
 jobs:
   webpack-analyzer:
     runs-on: ubuntu-22.04
     if: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event_name == 'pull_request'}}
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: ⬇️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
       - name: 🔧 Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: .nvmrc
-          cache: yarn
+          node-version-file: package.json
+          cache: pnpm
 
       - name: Ensure tracking relevant branches and checkout base
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+          BASE_REF: ${{ github.base_ref }}
         run: |
-          git checkout ${{ github.head_ref }}
-          git checkout ${{ github.base_ref }}
+          git checkout $HEAD_REF
+          git checkout $BASE_REF
 
       - name: Get the base commit
         id: base-commit
-        run: echo base-commit=$(git log -n 1 ${{ github.base_ref }} --pretty=format:'%H') >> "$GITHUB_OUTPUT"
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: echo base-commit=$(git log -n 1 $BASE_REF --pretty=format:'%H') >> "$GITHUB_OUTPUT"
 
       - name: Merge PR commit
+        env:
+          HEAD_REF: ${{ github.head_ref }}
         run: |
           # Have to set a git config for the merge to work
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
           git config --global user.name "github-actions[bot]"
-          git merge --no-edit ${{ github.head_ref }}
-          yarn install
+          git merge --no-edit $HEAD_REF
+          pnpm install
+          pnpm intl:build
 
       - name: 🔦 Generate stats file for PR
         run: |
-          yarn generate-webpack-stats-file
+          pnpm generate-webpack-stats-file
           mv stats.json ../stats-new.json
 
       - name: ⬇️ Get base stats from cache
         id: get-base-stats
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: stats-base.json
           key: stats-base-${{ steps.base-commit.outputs.base-commit }}
@@ -72,20 +85,21 @@ jobs:
       - name: 🔦 Generate stats file from base commit
         if: ${{ !steps.get-base-stats.outputs.cache-hit }}
         run: |
-          yarn install
-          yarn generate-webpack-stats-file
+          pnpm install
+          pnpm intl:build
+          pnpm generate-webpack-stats-file
           mv stats.json stats-base.json
 
       - name: ％ Get diff
         id: get-diff
-        uses: NejcZdovc/bundle-size-diff@v1
+        uses: NejcZdovc/bundle-size-diff@5321de41d2d62a7b0f4d6e60f59d1280a0034160 # v1.1.0
         with:
-          base_path: 'stats-base.json'
-          pr_path: '../stats-new.json'
-          excluded_assets: '(.+).chunk.js|(.+).js.map|(.+).json|(.+).png'
+          base_path: "stats-base.json"
+          pr_path: "../stats-new.json"
+          excluded_assets: "(.+).chunk.js|(.+).js.map|(.+).json|(.+).png|(.+).svg|(.+).webp|(.+).jpg|(.+).ico"
 
       - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
         with:
           header: bundle-diff
           message: |
@@ -97,9 +111,12 @@ jobs:
   fingerprint-native:
     runs-on: ubuntu-22.04
     if: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event_name == 'pull_request'}}
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: ⬇️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 100
 
@@ -107,20 +124,23 @@ jobs:
         run: git fetch origin main:main --depth 100
         if: github.event_name == 'pull_request'
 
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
       - name: 🔧 Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version-file: .nvmrc
-          cache: yarn
+          node-version-file: package.json
+          cache: pnpm
 
       - name: 📷 Check fingerprint and install dependencies
         id: fingerprint
-        uses: bluesky-social/github-actions/fingerprint-native@main
+        timeout-minutes: 5
+        uses: bluesky-social/github-actions/fingerprint-native@b5556913e4aef3964cfd5936d0add3fc0d809bdb # v0.1.0
         with:
           profile: pull-request
 
       - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
         if: ${{ steps.fingerprint.outputs.includes-changes }}
         with:
           header: fingerprint-diff
@@ -138,9 +158,24 @@ jobs:
             *Generated by [PR labeler](https://github.com/expo/expo/actions/workflows/pr-labeler.yml) 🤖*
 
       - name: 💬 Delete comment
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
         if: ${{ !steps.fingerprint.outputs.includes-changes }}
         with:
           header: fingerprint-diff
           delete: true
 
+      - name: 🏷️ Label as fingerprint changed
+        if: ${{ steps.fingerprint.outputs.includes-changes }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          gh pr edit "$PR_NUMBER" --add-label "bot: fingerprint changed" || true
+
+      - name: 🏷️ Remove fingerprint changed label
+        if: ${{ !steps.fingerprint.outputs.includes-changes }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          gh pr edit "$PR_NUMBER" --remove-label "bot: fingerprint changed" || true

.github/workflows/sync-internal.yaml

@@ -0,0 +1,43 @@
+name: Sync to internal repo
+
+on:
+  push:
+    branches: [main]
+
+# The push to the internal repo uses the app token below, not the GITHUB_TOKEN
+permissions:
+  contents: read
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    if: github.repository == 'bluesky-social/social-app'
+    steps:
+      - name: Checkout public repo
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          # Don't persist the checkout auth header; the push below authenticates
+          # with the app token embedded in the remote URL instead
+          persist-credentials: false
+      - name: Generate GitHub App Token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.SYNC_INTERNAL_APP_ID }}
+          private-key: ${{ secrets.SYNC_INTERNAL_PK }}
+          repositories: social-app-internal
+          # Scope the token down from the app's full installation permissions;
+          # pushing is the only thing this token is used for. The workflows
+          # permission is required because the sync includes files under
+          # .github/workflows/, which GitHub refuses to push without it.
+          permission-contents: write
+          permission-workflows: write
+      - name: Push to internal repo
+        env:
+          TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          git config user.name "github-actions"
+          git config user.email "test@users.noreply.github.com"
+          git remote add internal https://x-access-token:${TOKEN}@github.com/bluesky-social/social-app-internal.git
+          git push internal main --force

.github/workflows/verify-pnpm-lock.yml

@@ -0,0 +1,51 @@
+name: Lockfile
+
+on:
+  pull_request:
+concurrency:
+  group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  verify-pnpm-lock:
+    name: No manual pnpm-lock.yaml edits
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out PR HEAD
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Fetch base branch
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: git fetch origin $BASE_REF --depth=1
+
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
+      - name: Install node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: package.json
+
+      - name: Reset pnpm-lock.yaml to base
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: git show "origin/$BASE_REF:pnpm-lock.yaml" > pnpm-lock.yaml
+
+      - name: pnpm install
+        # Fine to skip scripts since we don't run any code
+        run: pnpm clean && pnpm install --ignore-scripts --no-frozen-lockfile
+
+      - name: Verify pnpm-lock.yaml
+        run: |
+          git diff --quiet --exit-code || {
+            echo '::error::`pnpm-lock.yaml` does not match what pnpm would generate given the base `pnpm-lock.yaml` and the head `package.json`.'
+            echo '::error:: - If this is intentional, you can ignore this check.'
+            echo '::error:: - If this is unintentional, apply the following diff:'
+            git --no-pager diff
+            exit 1
+          }

.github/workflows/verify-yarn-lock.yml

@@ -1,46 +0,0 @@
-name: Lockfile
-
-on:
-  pull_request:
-concurrency:
-  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
-  cancel-in-progress: true
-
-jobs:
-  verify-yarn-lock:
-    name: No manual yarn.lock edits
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out PR HEAD
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-
-      - name: Fetch base branch
-        run: git fetch origin ${{ github.base_ref }} --depth=1
-
-      - name: Install node
-        uses: actions/setup-node@v4
-        with:
-          node-version-file: .nvmrc
-
-      - name: Reset yarn.lock to base
-        run: git show "origin/${{ github.base_ref }}:yarn.lock" > yarn.lock
-
-      - name: Yarn install
-        uses: Wandalen/wretry.action@master
-        with:
-          # Fine to skip scripts since we don't run any code
-          command: yarn install --ignore-scripts
-          attempt_limit: 3
-          attempt_delay: 2000
-
-      - name: Verify yarn.lock
-        run: |
-          git diff --quiet --exit-code || {
-            echo '::error::`yarn.lock` does not match what Yarn would generate given the base `yarn.lock` and the head `package.json`.'
-            echo '::error:: - If this is intentional, you can ignore this check.'
-            echo '::error:: - If this is unintentional, apply the following diff:'
-            git --no-pager diff
-            exit 1
-          }

.github/workflows/zizmor.yml

@@ -0,0 +1,37 @@
+name: Workflow security
+
+on:
+  push:
+    branches: [main]
+    paths: [".github/**"]
+  pull_request:
+    paths: [".github/**"]
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
+  cancel-in-progress: true
+
+# The github.token is only used by zizmor's online audits (read-only API calls)
+permissions:
+  contents: read
+
+jobs:
+  zizmor:
+    name: Audit workflows with zizmor
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        with:
+          # Annotate the PR directly instead of uploading SARIF to the
+          # security tab, and fail the check on any finding
+          advanced-security: false
+          annotations: true
+          # Low-confidence findings (e.g. artipacked on workflows that never
+          # push) are too noisy to gate CI on
+          min-confidence: medium

.gitignore

@@ -58,6 +58,7 @@ buck-out/
 # Ruby / CocoaPods
 /ios/Pods/
 /vendor/bundle/
+Gemfile.lock
 
 # Testing
 coverage/
@@ -85,6 +86,9 @@ stats.json
 # VSCode
 .vscode
 
+# Zed
+.zed
+
 # gitignore and github actions
 !.gitignore
 !.github
@@ -109,7 +113,9 @@ google-services.json
 
 # i18n
 src/locale/locales/_build/
-src/locale/locales/**/*.js
+src/locale/locales/**/messages.js
+src/locale/locales/**/messages.mjs
+src/locale/locales/**/messages.ts
 
 # local builds
 *.apk
@@ -118,3 +124,13 @@ src/locale/locales/**/*.js
 
 # ogcard assets
 bskyogcard/src/assets/fonts/noto-*
+
+# bskyweb build output
+bskyweb/static/media/*.webp
+bskyweb/static/media/*.jpg
+bskyweb/static/media/*.png
+bskyweb/static/media/*.svg
+
+# superpowers plugin plans/specs — local-only workspace
+docs/superpowers/
+.claude/worktrees

.husky/pre-commit

@@ -1,4 +1 @@
-#!/usr/bin/env sh
-. "$(dirname -- "$0")/_/husky.sh"
-
-npx lint-staged --concurrent false
+pnpm exec lint-staged --concurrent false

.jscodeshift/file/lingui-v5.js

@@ -0,0 +1,236 @@
+/**
+ * Codemod to update Lingui's useLingui() hook to use v5.
+ *
+ * Before:
+ *   import {msg} from '@lingui/core/macro'
+ *   import {useLingui} from '@lingui/react'
+ *   const {_} = useLingui()
+ *   _(msg`Lorem ipsum`)
+ *
+ * After:
+ *   import {useLingui} from '@lingui/react/macro'
+ *   const {t: l} = useLingui()
+ *   l`Lorem ipsum`
+ *
+ * Usage: jscodeshift -t .jscodeshift/file/lingui-v5.js <file-path>
+ * Example: jscodeshift -t .jscodeshift/file/lingui-v5.js modules/bottom-sheet/src/lib/Portal.tsx
+ */
+
+/* eslint-disable */
+
+export const parser = 'tsx'
+
+export default function transformer(file, api) {
+  const j = api.jscodeshift
+
+  const root = j(file.source)
+
+  // Remove msg imports, including aliased imports
+  root
+    .find(j.ImportDeclaration)
+    .filter(path => path.node.source.value === '@lingui/core/macro')
+    .forEach(path => {
+      const newSpecifiers = path.node.specifiers.filter(specifier => {
+        if (j.ImportSpecifier.check(specifier)) {
+          const importedName = specifier.imported
+            ? specifier.imported.name
+            : specifier.local.name
+          const localName = specifier.local
+            ? specifier.local.name
+            : importedName
+
+          return !(
+            importedName === 'msg' &&
+            (localName === 'msg' || localName === 'msgLingui')
+          )
+        }
+        return true
+      })
+
+      if (newSpecifiers.length > 0) {
+        path.node.specifiers = newSpecifiers
+      } else {
+        j(path).remove()
+      }
+    })
+
+  // Update React imports
+  root
+    .find(j.ImportDeclaration)
+    .filter(path => path.node.source.value === '@lingui/react')
+    .forEach(path => {
+      path.node.source = j.stringLiteral('@lingui/react/macro')
+    })
+
+  // Replace {_} with {t: l}
+  root
+    .find(j.VariableDeclarator, {
+      init: {
+        type: 'CallExpression',
+        callee: {name: 'useLingui'},
+      },
+    })
+    .replaceWith(nodePath => {
+      const {node} = nodePath
+      for (let i = 0; i < node.id.properties.length; i++) {
+        if (node.id.properties[i].key.name === '_') {
+          node.id.properties[i].key = j.identifier('t')
+          node.id.properties[i].shorthand = false
+          node.id.properties[i].value = j.identifier('l')
+        }
+      }
+      return node
+    })
+
+  // Replace {_: _l} with {t: l}
+  root
+    .find(j.VariableDeclarator, {
+      init: {callee: {name: 'useLingui'}},
+      id: {
+        properties: properties =>
+          properties.some(p => p.key.name === '_' && p.value.name === '_l'),
+      },
+    })
+    .forEach(path => {
+      const prop = path.node.id.properties.find(
+        p => p.key.name === '_' && p.value.name === '_l',
+      )
+      if (prop) {
+        prop.key.name = 't'
+        prop.value.name = 'l'
+      }
+    })
+
+  // Replace _(msg``) with l``
+  root
+    .find(j.CallExpression, {
+      callee: {name: '_'},
+      arguments: [
+        {
+          type: 'TaggedTemplateExpression',
+          tag: {name: 'msg'},
+        },
+      ],
+    })
+    .replaceWith(path => {
+      const quasis = path.node.arguments[0].quasi
+
+      return j.taggedTemplateExpression(j.identifier('l'), quasis)
+    })
+
+  // Replace _l(msgLingui``) with l``
+  root
+    .find(j.CallExpression, {
+      callee: {name: '_l'},
+      arguments: [
+        {
+          type: 'TaggedTemplateExpression',
+          tag: {name: 'msgLingui'},
+        },
+      ],
+    })
+    .replaceWith(path => {
+      const quasis = path.node.arguments[0].quasi
+
+      return j.taggedTemplateExpression(j.identifier('l'), quasis)
+    })
+
+  // Replace _(msg()) with l()
+  root
+    .find(j.CallExpression, {
+      callee: {name: '_'},
+      arguments: [
+        {
+          type: 'CallExpression',
+          callee: {name: 'msg'},
+        },
+      ],
+    })
+    .replaceWith(path => {
+      return j.callExpression(j.identifier('l'), [
+        path.node.arguments[0].arguments[0],
+      ])
+    })
+
+  // Replace _l(msgLingui()) with l()
+  root
+    .find(j.CallExpression, {
+      callee: {name: '_l'},
+      arguments: [
+        {
+          type: 'CallExpression',
+          callee: {name: 'msgLingui'},
+        },
+      ],
+    })
+    .replaceWith(path => {
+      return j.callExpression(j.identifier('l'), [
+        path.node.arguments[0].arguments[0],
+      ])
+    })
+
+  // Replace _(plural()) with plural()
+  root
+    .find(j.CallExpression, {
+      callee: {
+        type: 'Identifier',
+        name: '_',
+      },
+    })
+    .forEach(path => {
+      const callExpression = path.node
+      if (
+        callExpression.arguments.length === 1 &&
+        callExpression.arguments[0].type === 'CallExpression'
+      ) {
+        const innerCall = callExpression.arguments[0]
+
+        if (
+          innerCall.callee.type === 'Identifier' &&
+          innerCall.callee.name === 'plural'
+        ) {
+          j(path).replaceWith(innerCall)
+        }
+      }
+    })
+
+  // Update hook dependency arrays
+  root
+    .find(j.CallExpression, {
+      callee: callee => {
+        if (
+          callee.type === 'Identifier' ||
+          callee.type === 'MemberExpression'
+        ) {
+          return true
+        }
+        if (
+          ['useCallback', 'useEffect', 'useMemo'].includes(callee.name) &&
+          callee.type === 'MemberExpression' &&
+          callee.object.type === 'Identifier' &&
+          callee.object.name === 'React' &&
+          callee.property.type === 'Identifier' &&
+          callee.property.name === 'useCallback'
+        ) {
+          return true
+        }
+        return false
+      },
+    })
+    .forEach(path => {
+      const dependencyArray = path.node.arguments[1]
+      if (dependencyArray && dependencyArray.type === 'ArrayExpression') {
+        dependencyArray.elements = dependencyArray.elements.map(element => {
+          if (
+            element.type === 'Identifier' &&
+            (element.name === '_' || element.name === '_l')
+          ) {
+            return j.identifier('l')
+          }
+          return element
+        })
+      }
+    })
+
+  return root.toSource()
+}

.jscodeshift/repo/bsky-agent.js

@@ -0,0 +1,62 @@
+/**
+ * Codemod to replace BskyAgent with AtpAgent
+ *
+ * Before:
+ *   import {BskyAgent} from '@atproto/api`
+ *   BskyAgent.appLabelers.includes(labeler)
+ *
+ * After:
+ *   import {AtpAgent} from '@atproto/api`
+ *   AtpAgent.appLabelers.includes(labeler)
+ *
+ * Handles import specifiers, type annotations, static member access
+ * (BskyAgent.configure), `extends BskyAgent`, and `new BskyAgent()`. Whole
+ * identifiers only, so names like `OpaqueBskyAgent` are left untouched.
+ *
+ * Usage: jscodeshift -t .jscodeshift/repo/bsky-agent.js <file-path>
+ * Example: jscodeshift -t .jscodeshift/repo/bsky-agent.js src/lib/moderation.ts
+ */
+
+/* eslint-disable */
+
+export const parser = 'tsx'
+
+export default function transformer(file, api) {
+  const j = api.jscodeshift
+  const root = j(file.source)
+
+  // Replace every standalone `BskyAgent` identifier with `AtpAgent`. This
+  // covers imports, type references, member expressions, `extends`, and `new`.
+  root
+    .find(j.Identifier, {name: 'BskyAgent'})
+    .replaceWith(() => j.identifier('AtpAgent'))
+
+  // Renaming can leave a duplicate `AtpAgent` specifier on the @atproto/api
+  // import if the file already imported it. Dedupe by imported name, keeping
+  // the type-only modifier only if every duplicate was type-only.
+  root
+    .find(j.ImportDeclaration, {source: {value: '@atproto/api'}})
+    .forEach(path => {
+      const seen = new Map()
+      for (const spec of path.value.specifiers) {
+        if (spec.type !== 'ImportSpecifier') {
+          seen.set(Symbol(), spec)
+          continue
+        }
+        const name = spec.imported.name
+        const existing = seen.get(name)
+        if (!existing) {
+          seen.set(name, spec)
+        } else if (
+          existing.importKind === 'type' &&
+          spec.importKind !== 'type'
+        ) {
+          // Prefer the value (non-type) import if either usage needs it.
+          seen.set(name, spec)
+        }
+      }
+      path.value.specifiers = Array.from(seen.values())
+    })
+
+  return root.toSource()
+}

.jscodeshift/repo/react-import.js

@@ -0,0 +1,135 @@
+/**
+ * Codemod to replace namespaced React calls with named imports
+ *
+ * Before:
+ *   import React from 'react'
+ *   React.useEffect(() => {}, [])
+ *
+ * After:
+ *   import { useEffect } from 'react'
+ *   useEffect(() => {}, [])
+ *
+ * Usage: jscodeshift -t .jscodeshift/repo/react-import.js <file-path>
+ * Example: jscodeshift -t .jscodeshift/repo/react-import.js src/App.native.tsx
+ */
+
+/* eslint-disable */
+
+export const parser = 'tsx'
+
+export default function transformer(file, api) {
+  const j = api.jscodeshift
+  const root = j(file.source)
+
+  // Find the React import
+  let reactImportPath = null
+  const reactMembers = new Set()
+
+  root.find(j.ImportDeclaration).forEach(path => {
+    const node = path.value
+    if (node.source.value === 'react') {
+      node.specifiers.forEach(spec => {
+        // Check if this is a default import of React
+        if (
+          spec.type === 'ImportDefaultSpecifier' &&
+          spec.local.name === 'React'
+        ) {
+          reactImportPath = path
+        }
+      })
+    }
+  })
+
+  if (!reactImportPath) {
+    // No React import found, nothing to do
+    return file.source
+  }
+
+  // Find all React.* member expressions
+  root
+    .find(j.MemberExpression)
+    .filter(path => {
+      const node = path.value
+      return (
+        node.object.type === 'Identifier' &&
+        node.object.name === 'React' &&
+        node.property.type === 'Identifier'
+      )
+    })
+    .forEach(path => {
+      const propertyName = path.value.property.name
+      reactMembers.add(propertyName)
+    })
+
+  // Find all React.* JSX member expressions (e.g., <React.Fragment>)
+  root
+    .find(j.JSXMemberExpression)
+    .filter(path => {
+      const node = path.value
+      return node.object.name === 'React' && node.property.name
+    })
+    .forEach(path => {
+      const propertyName = path.value.property.name
+      reactMembers.add(propertyName)
+    })
+
+  // If no React members are used, remove the import
+  if (reactMembers.size === 0) {
+    reactImportPath.prune()
+    return root.toSource()
+  }
+
+  // Sort the members for consistent output
+  const sortedMembers = Array.from(reactMembers).sort()
+
+  // Create new import specifiers
+  const newSpecifiers = sortedMembers.map(name =>
+    j.importSpecifier(j.identifier(name), j.identifier(name)),
+  )
+
+  // Get the existing import specifiers
+  const sortedImports = Array.from(reactImportPath.value.specifiers).sort()
+  const existingSpecifiers = sortedImports.filter(
+    specifier => specifier.type !== 'ImportDefaultSpecifier',
+  )
+
+  const allSpecifiers = [
+    ...new Map(
+      [...existingSpecifiers, ...newSpecifiers].map(item => [
+        item.imported.name,
+        item,
+      ]),
+    ).values(),
+  ]
+
+  // Update the import declaration
+  reactImportPath.value.specifiers = allSpecifiers
+
+  // Replace all React.* member expressions with just the identifier
+  root
+    .find(j.MemberExpression)
+    .filter(path => {
+      const node = path.value
+      return (
+        node.object.type === 'Identifier' &&
+        node.object.name === 'React' &&
+        node.property.type === 'Identifier'
+      )
+    })
+    .replaceWith(path => {
+      return j.identifier(path.value.property.name)
+    })
+
+  // Replace all React.* JSX member expressions with just the identifier
+  root
+    .find(j.JSXMemberExpression)
+    .filter(path => {
+      const node = path.value
+      return node.object.name === 'React' && node.property.name
+    })
+    .replaceWith(path => {
+      return j.jsxIdentifier(path.value.property.name)
+    })
+
+  return root.toSource()
+}

.jscodeshift/repo/toast-v2.js

@@ -0,0 +1,106 @@
+/**
+ * Codemod to replace namespaced React calls with named imports
+ *
+ * Before:
+ *   import * as Toast from '#/view/com/util/Toast'
+ *   Toast.show(message, 'xmark')
+ *
+ * After:
+ *   import * as Toast from '#/components/Toast'
+ *   Toast.show(message, {type: 'error'})
+ *
+ * Usage: jscodeshift -t .jscodeshift/repo/toast-v2.js <file-path>
+ * Example: jscodeshift -t .jscodeshift/repo/toast-v2.js src/App.native.tsx
+ */
+
+/* eslint-disable */
+
+export const parser = 'tsx'
+
+const OLD_IMPORT = '#/view/com/util/Toast'
+const NEW_IMPORT = '#/components/Toast'
+
+const convertLegacyToastType = type => {
+  switch (type) {
+    // these ones are fine
+    case 'default':
+    case 'success':
+    case 'error':
+    case 'warning':
+    case 'info':
+      return type
+    // legacy ones need conversion
+    case 'xmark':
+      return 'error'
+    case 'exclamation-circle':
+      return 'warning'
+    case 'check':
+      return 'success'
+    case 'clipboard-check':
+      return 'success'
+    case 'circle-exclamation':
+    case 'exclamation-circle':
+      return 'warning'
+    default:
+      return 'default'
+  }
+}
+
+export default function transformer(file, api) {
+  const j = api.jscodeshift
+  const root = j(file.source)
+
+  // Find Toast import declarations using the old path
+  const toastImports = root
+    .find(j.ImportDeclaration)
+    .filter(path => path.value.source.value === OLD_IMPORT)
+
+  if (toastImports.length === 0) {
+    return file.source
+  }
+
+  // Update import path
+  toastImports.forEach(path => {
+    path.value.source.value = NEW_IMPORT
+  })
+
+  // Collect all local names the Toast namespace is bound to
+  const toastLocalNames = new Set()
+  toastImports.forEach(path => {
+    path.value.specifiers.forEach(spec => {
+      if (spec.type === 'ImportNamespaceSpecifier') {
+        toastLocalNames.add(spec.local.name)
+      }
+    })
+  })
+
+  // Transform Toast.show(message, type) calls
+  root.find(j.CallExpression).forEach(path => {
+    const {callee, arguments: args} = path.value
+
+    // Match <ToastName>.show(...)
+    if (
+      callee.type !== 'MemberExpression' ||
+      callee.object.type !== 'Identifier' ||
+      !toastLocalNames.has(callee.object.name) ||
+      callee.property.name !== 'show'
+    ) {
+      return
+    }
+
+    // Only transform 2-arg calls where the second arg is a string literal
+    if (args.length !== 2) return
+    const typeArg = args[1]
+    if (typeArg.type !== 'StringLiteral' && typeArg.type !== 'Literal') return
+
+    const legacyType = typeArg.value
+    const newType = convertLegacyToastType(legacyType)
+
+    // Replace the second argument with an options object: {type: 'newType'}
+    args[1] = j.objectExpression([
+      j.property('init', j.identifier('type'), j.stringLiteral(newType)),
+    ])
+  })
+
+  return root.toSource()
+}

.nvmrc

@@ -1 +1 @@
-20
+24.15.0

.prettierignore

@@ -5,10 +5,14 @@
 !**/*.jsx
 !**/*.ts
 !**/*.tsx
+!**/*.mjs
+!**/*.cjs
 !*/
 
 !**/*.css
 
+!**/pnpm-workspace.yaml
+
 # More specific ignores go below.
 .expo
 android

CLAUDE.md

@@ -0,0 +1,928 @@
+# CLAUDE.md – Bluesky Social App Development Guide
+
+This document provides guidance for working effectively in the Bluesky Social app codebase.
+
+## Project Overview
+
+Bluesky Social is a cross-platform social media application built with React Native and Expo. It runs on iOS, Android, and Web, connecting to the AT Protocol (atproto) decentralized social network.
+
+**Tech Stack:**
+
+- React 19.1
+- React Native 0.81 with Expo 54
+- TypeScript 7
+- React Navigation 7 for routing
+- TanStack Query (React Query) for data fetching
+- Lingui 5 for internationalization
+- Custom design system called ALF (Application Layout Framework)
+
+Prefer using the latest features available for each of these libraries (exact versions are found in `package.json`). For example, prefer `@lingui/react/macro` over `@lingui/react`. Suggest refactoring legacy or deprecated uses.
+
+## Essential Commands
+
+```bash
+# Development
+pnpm start              # Start Expo dev server
+pnpm web                # Start web version
+pnpm android            # Run on Android
+pnpm ios                # Run on iOS
+
+# Testing & Quality
+# IMPORTANT: Always use these pnpm scripts, never call the underlying tools directly
+pnpm test               # Run Jest tests
+pnpm lint               # Run ESLint
+pnpm typecheck          # Run TypeScript type checking
+pnpm prettier           # Run Prettier for code formatting
+
+# Internationalization
+# DO NOT run these commands - extraction and compilation are handled by CI
+pnpm intl:extract       # Extract translation strings (nightly CI job)
+pnpm intl:compile       # Compile translations for runtime (nightly CI job)
+
+# Build
+pnpm build-web          # Build web version
+pnpm prebuild           # Generate native projects
+```
+
+## Project Structure
+
+```
+src/
+├── alf/                    # Design system (ALF) - themes, atoms, tokens
+├── components/             # Shared UI components (Button, Dialog, Menu, etc.)
+├── screens/                # Full-page screen components (newer pattern)
+├── features/               # Macro-features that bridge components/screens
+├── view/
+│   ├── screens/            # Full-page screens (legacy location)
+│   ├── com/                # Reusable view components
+│   └── shell/              # App shell (navigation bars, tabs)
+├── state/
+│   ├── queries/            # TanStack Query hooks
+│   ├── preferences/        # User preferences (React Context)
+│   ├── session/            # Authentication state
+│   └── persisted/          # Persistent storage layer
+├── lib/                    # Utilities, constants, helpers
+├── locale/                 # i18n configuration and language files
+└── Navigation.tsx          # Main navigation configuration
+```
+
+### Project Structure in Depth
+
+When building new things, follow these guidelines for where to put code.
+
+#### Components vs Screens vs Features
+
+**Components** are reusable UI elements that are not full screens. Should be
+platform-agnostic when possible. Examples: Button, Dialog, Menu, TextField. Put
+these in `/components` if they are shared across screens.
+
+**Screens** are full-page components that represent a route in the app. They
+often contain multiple components and handle layout for a page. New screens
+should go in `/screens` (not `/view/screens`) to encourage better organization
+and separation from legacy code.
+
+For complex screens that have specific components or data needs that _are not
+shared by other screens_, we encourage subdirectoreis within `/screens/<name>`
+e.g. `/screens/ProfileScreen/ProfileScreen.tsx` and
+`/screens/ProfileScreen/components/`.
+
+**Features** are higher-level modules that may include context, data fetching,
+components, and utilities related to a specific feature e.g.
+`/features/liveNow`. They don't neatly fit into components or screens and often
+span multiple screens. This is an optional pattern for organizing complex
+features.
+
+#### Legacy Directories
+
+For the most part, avoid writing new files into the `/view` directory and
+subdirectories. This is the older pattern for organizing screens and components,
+and it has become a bit disorganized over time. New development should go into
+`/screens`, `/components`, and `/features`.
+
+#### State
+
+The `/state` directory is where we've historically put all our data fetching and
+state management logic. This is perfectly fine, but for new features, consider
+organizing state logic closer to the components that use it, either within a
+feature directory or co-located with a screen. The key is to keep related code
+together and avoid having "god files" with too much unrelated logic.
+
+#### Lib
+
+The `/lib` directory is for utilities and helpers that don't fit into other
+categories. This can include things like API clients, formatting functions,
+constants, and other shared logic.
+
+#### Top Level Directories
+
+Avoid writing new top-level subdirectories within `/src`. We've done this for a
+few things in the past that, but we have stronger patterns now. Examples:
+`/logger` should probably have been written into `/lib`. And `ageAssurance` is
+better classified within `/features`. We will probably migrate these things
+eventually.
+
+### File and Directory Naming Conventions
+
+Typically JS style for variables, functions, etc. We use ProudCamelCase for
+components, and camelCase directories and files.
+
+When organizing new code, consider if it fits into a single file, or if it
+should be broken down into multiple files. For "macro" component cases, or
+things that live in `/features` or `/screens`, we often follow a pattern of
+having an `index.tsx` for the main component, and then co-locating related
+components, hooks, and utilities in the same directory. For example:
+
+```
+src
+├── screens/
+│   ├── ProfileScreen/
+│   │   ├── index.tsx          # Main screen component
+│   │   ├── components/       # Sub-components used only by this screen
+```
+
+Similar patterns can be found in `/features` and `/components`. The idea here is
+to keep related code together and make it easier to navigate.
+
+You should ask yourself: if someone new was looking for the code related to this
+feature or screen, where would they expect to find it? Organizing code in a way
+that matches developer expectations can make the codebase much more
+approachable. Being able to say "Live Now stuff lives in `/features/liveNow`" is
+easier to understand than having it scattered across multiple directories.
+
+No need to go overboard with this. If a component or feature fits into a single
+file, there's no reason to have a `/Component/index.tsx` file when it could just
+be `/Component.tsx`. Use your judgment based on the complexity and amount of
+related code.
+
+#### Platform Specific Files
+
+We have conflicting patterns in the app for this. The preferred approach is to
+group platform-specific files into a directory as much as possible. For example,
+rather than having `Component.tsx`, `Component.web.tsx`, and
+`Component.native.tsx` in the same directory, we prefer to have a `Component/`
+directory with `index.tsx`, `index.web.tsx`, and `index.native.tsx`. This keeps
+related code together and gives us a better visual cue that there are probably
+other files contained within this "macro" feature, whereas `Component.tsx` on
+its own looks more like a single component file.
+
+### Comments
+
+Comment code when necessary to explain the “why” behind something; avoid
+comments that simply describe the code. Avoid Unicode characters in comments,
+e.g., use `-` not `—`.
+
+Always use docblock (`/** */`) syntax for comments that document a type, type
+member, method, function, or variable. These are the comments a reader expects
+to find attached to a named declaration, and the docblock form makes that intent
+clear and surfaces nicely in editor tooltips.
+
+```tsx
+type DateFieldProps = {
+  /**
+   * An empty string renders the placeholder and opens the picker at today (or
+   * maximumDate, if earlier).
+   */
+  value: string | Date
+}
+
+/**
+ * Date-only input. Accepts a string in the format YYYY-MM-DD, or a Date object.
+ */
+export function DateField() {}
+```
+
+More generally, any multiline comment should use the `/* */` block syntax rather
+than stacked `//` lines. Reserve `//` for short, single-line comments.
+
+```tsx
+/*
+ * The picker requires a valid date, so when value is empty we fall back to
+ * maximumDate (if set) or today.
+ */
+const fallbackDate = maximumDate ? toSimpleDateString(maximumDate) : today
+```
+
+### Documentation and Tests Within Features
+
+For larger features or components, it's helpful to include a README.md file
+within the directory that explains the purpose of the feature, how it works, and
+any important implementation details. The `/Component/index.tsx` pattern lends
+itself well to this, since the `index.tsx` can be the main component file, and
+the `README.md` can provide documentation for the whole feature. This is
+optional, but can be a nice way to keep documentation close to the code it
+describes.
+
+Similarly, if there are tests that are specific to a component or feature, it
+can be helpful to include them in the same directory, either as
+`Component.test.tsx` or in a `__tests__/` subdirectory. This keeps everything
+related to the component or feature in one place and makes it easier to find and
+maintain tests.
+
+## Styling System (ALF)
+
+ALF is the custom design system. It uses Tailwind-inspired naming with underscores instead of hyphens.
+
+### Basic Usage
+
+Generally, order atoms by:
+
+- Flexbox configuration, e.g., `a.flex_row`
+- Spacing, e.g., `a.px_md`
+- Text styles, e.g., `a.font_bold`
+- Themes, e.g., `t.atoms.text`,
+- Raw styles, e.g., `{backgroundColor: t.palette.primary_500}`
+
+```tsx
+import {atoms as a, useTheme} from '#/alf'
+
+function MyComponent() {
+  const t = useTheme()
+
+  return (
+    <View style={[a.flex_row, a.gap_md, a.p_lg, t.atoms.bg]}>
+      <Text style={[a.text_md, a.font_bold, t.atoms.text_contrast_high]}>Hello</Text>
+    </View>
+  )
+}
+```
+
+### Key Concepts
+
+**Static Atoms** – Theme-independent styles imported from `atoms`:
+
+```tsx
+import {atoms as a} from '#/alf'
+// a.flex_row, a.p_md, a.gap_sm, a.rounded_md, a.text_lg, etc.
+```
+
+**Theme Atoms** – Theme-dependent colors from `useTheme()`:
+
+```tsx
+const t = useTheme()
+// t.atoms.bg, t.atoms.text, t.atoms.border_contrast_low, etc.
+// t.palette.primary_500, t.palette.negative_400, etc.
+```
+
+**Platform Utilities** – For platform-specific styles:
+
+```tsx
+import {web, native, ios, android, platform} from '#/alf'
+
+const styles = [
+  a.p_md,
+  web({cursor: 'pointer'}),
+  native({paddingBottom: 20}),
+  platform({ios: {...}, android: {...}, web: {...}}),
+]
+```
+
+**Breakpoints** – Responsive design:
+
+```tsx
+import {useBreakpoints} from '#/alf'
+
+const {gtPhone, gtMobile, gtTablet} = useBreakpoints()
+if (gtMobile) {
+  // Tablet or desktop layout
+}
+```
+
+### Naming Conventions
+
+- Spacing: `2xs`, `xs`, `sm`, `md`, `lg`, `xl`, `2xl` (t-shirt sizes)
+- Text: `text_xs`, `text_sm`, `text_md`, `text_lg`, `text_xl`
+- Gaps/Padding: `gap_sm`, `p_md`, `px_lg`, `py_xl`
+- Flex: `flex_row`, `flex_1`, `align_center`, `justify_between`
+- Borders: `border`, `border_t`, `rounded_md`, `rounded_full`
+
+## Component Patterns
+
+- Prefer fragment shorthand over `Fragment` unless a `key` is needed.
+- Prefer functions over arrow functions for component declarations.
+- Prefer prop destructuring via parameters over a const within the component.
+- Prefer inline types over `Props` types or interfaces.
+- Set reasonable defaults for optional props.
+
+```tsx
+import {Fragment} from 'react'
+import {View} from 'react-native'
+import {Trans, useLingui} from '@lingui/react/macro'
+
+import {Text} from '#/components/Typography'
+
+function MyComponent({foo = []}: {foo?: string[]}) {
+  const {t: l} = useLingui()
+
+  return (
+    <>
+      <View><Text><Trans>Example</Trans><Text></View>
+      <View>
+        {foo.map((foo, index) => (
+          <Fragment key={foo}>
+            <Text>{index}</Text>
+            <Text>{foo}</Text>
+          </Fragment>
+        ))}
+      </View>
+    </>
+  );
+}
+```
+
+### Dialog Component
+
+Dialogs use a bottom sheet on native and a modal on web. Use `useDialogControl()` hook to manage state.
+
+```tsx
+import * as Dialog from '#/components/Dialog'
+
+function MyFeature() {
+  const control = Dialog.useDialogControl()
+
+  return (
+    <>
+      <Button label="Open" onPress={control.open}>
+        <ButtonText>Open Dialog</ButtonText>
+      </Button>
+
+      <Dialog.Outer control={control}>
+        {/* Typically the inner part is in its own component */}
+        <DialogInner />
+      </Dialog.Outer>
+    </>
+  )
+}
+
+function DialogInner() {
+  return (
+    <>
+      <Dialog.Handle /> {/* Native-only drag handle */}
+      <Dialog.ScrollableInner label={l`My Dialog`}>
+        <Dialog.Header>
+          <Dialog.HeaderText>Title</Dialog.HeaderText>
+        </Dialog.Header>
+        <Text>Dialog content here</Text>
+        <Button label="Done" onPress={() => control.close()}>
+          <ButtonText>Done</ButtonText>
+        </Button>
+        <Dialog.Close /> {/* Web-only X button in top left */}
+      </Dialog.ScrollableInner>
+    </>
+  )
+}
+```
+
+### Menu Component
+
+Menus render as a dropdown on web and a bottom sheet dialog on native.
+
+```tsx
+import * as Menu from '#/components/Menu'
+
+function MyMenu() {
+  return (
+    <Menu.Root>
+      <Menu.Trigger label="Open menu">
+        {({props}) => (
+          <Button {...props} label="Menu">
+            <ButtonIcon icon={DotsHorizontal} />
+          </Button>
+        )}
+      </Menu.Trigger>
+
+      <Menu.Outer>
+        <Menu.Group>
+          <Menu.Item label="Edit" onPress={handleEdit}>
+            <Menu.ItemIcon icon={Pencil} />
+            <Menu.ItemText>Edit</Menu.ItemText>
+          </Menu.Item>
+          <Menu.Item label="Delete" onPress={handleDelete}>
+            <Menu.ItemIcon icon={Trash} />
+            <Menu.ItemText>Delete</Menu.ItemText>
+          </Menu.Item>
+        </Menu.Group>
+      </Menu.Outer>
+    </Menu.Root>
+  )
+}
+```
+
+### Button Component
+
+```tsx
+import {Button, ButtonText, ButtonIcon} from '#/components/Button'
+
+// Solid primary button (most common)
+<Button label="Save" onPress={handleSave} color="primary" size="large">
+  <ButtonText>Save</ButtonText>
+</Button>
+
+// With icon
+<Button label="Share" onPress={handleShare} color="secondary" size="small">
+  <ButtonIcon icon={Share} />
+  <ButtonText>Share</ButtonText>
+</Button>
+
+// Icon-only button
+<Button label="Close" onPress={handleClose} color="secondary" size="small" shape="round">
+  <ButtonIcon icon={XIcon} />
+</Button>
+
+// Ghost variant (deprecated - use color prop)
+<Button label="Cancel" variant="ghost" color="secondary" size="small">
+  <ButtonText>Cancel</ButtonText>
+</Button>
+```
+
+**Button Props:**
+
+- `color`: `'primary'` | `'secondary'` | `'negative'` | `'primary_subtle'` | `'negative_subtle'` | `'secondary_inverted'`
+- `size`: `'tiny'` | `'small'` | `'large'`
+- `shape`: `'default'` (pill) | `'round'` | `'square'` | `'rectangular'`
+- `variant`: `'solid'` | `'outline'` | `'ghost'` (deprecated, use `color`)
+
+### Typography
+
+```tsx
+import {Text, H1, H2, P} from '#/components/Typography'
+
+<H1 style={[a.text_xl, a.font_bold]}>Heading</H1>
+<P>Paragraph text with default styling.</P>
+<Text style={[a.text_md, t.atoms.text_contrast_medium]}>Custom text</Text>
+
+// For text with emoji, add the emoji prop. User-generated text (e.g. display names)
+// will almost certainly contain emoji, so only omit it when the text is static and
+// does not contain an emoji
+<Text emoji>Hello! 👋</Text>
+```
+
+The `Text` component's default style is `[a.text_sm, a.leading_snug, t.atoms.text]`.
+
+### TextField
+
+```tsx
+import * as TextField from '#/components/forms/TextField'
+
+<TextField.LabelText>Email</TextField.LabelText>
+<TextField.Root>
+  <TextField.Icon icon={AtSign} />
+  <TextField.Input
+    label="Email address"
+    placeholder="you@example.com"
+    defaultValue={email}
+    onChangeText={setEmail}
+    keyboardType="email-address"
+    autoCapitalize="none"
+  />
+</TextField.Root>
+```
+
+## Internationalization (i18n)
+
+All user-facing strings must be wrapped for translation using Lingui. Include `comment` and/or `context` props when necessary to avoid ambiguity, e.g., “Post” as a noun vs a verb.
+
+Prefer using `t` via `import {useLingui} '@lingui/react/macro'` vs `_` via `import {useLingui} from '@lingui/react'`. Alias `t` to `l` to avoid collisions with `const t = useTheme()`. Refactor existing uses of ``_(msg`foo`)`` to use `` l`foo` ``.
+
+Prefer Unicode punctuation over keyboard punctuation, e.g., `“quote”` over `"quote"`. Prefer en dashes preceded by a non-breaking space over em dashes, e.g., `one – two` over `one—two`.
+
+```tsx
+import {plural} from '@lingui/core/macro'
+import {Trans, useLingui} from '@lingui/react/macro'
+
+function MyComponent() {
+  const {t: l} = useLingui()
+
+  // Simple strings - use the l macro
+  const title = l`Settings`
+  const errorMessage = l({
+    message: 'Something went wrong',
+    comment: 'Generic error message for unknown/unhandled errors.',
+    context: 'Toast',
+  })
+
+  // Strings with variables
+  const greeting = l`Hello, ${name}!`
+
+  // Pluralization
+  const countLabel = plural(count, {
+    one: '# item',
+    other: '# items',
+  })
+
+  // JSX content - use Trans component
+  return (
+    <Text>
+      <Trans>
+        Welcome to <Text style={a.font_bold}>Bluesky</Text>, {name}!
+      </Trans>
+    </Text>
+  )
+}
+```
+
+Prefer `i18n.date` for date and time formatting. This ensures formatting is re-applied when the language changes at runtime. Refactor existing uses of `Intl.DateTimeFormat` to use `i18n.date`.
+
+```tsx
+import {useLingui} from '@lingui/react/macro'
+
+function MyComponent() {
+  const {i18n} = useLingui()
+
+  const createdAt = new Date()
+
+  return i18n.date(createdAt, {
+    dateStyle: 'medium',
+    timeStyle: 'medium',
+  })
+}
+```
+
+**Commands:**
+
+```bash
+# DO NOT run these commands - extraction and compilation are handled by a nightly CI job
+pnpm intl:extract    # Extract new strings to locale files
+pnpm intl:compile    # Compile translations for runtime
+```
+
+## State Management
+
+### TanStack Query (Data Fetching)
+
+```tsx
+// src/state/queries/profile.ts
+import {useQuery, useMutation, useQueryClient} from '@tanstack/react-query'
+
+import {createQueryKey} from '#/state/queries/util'
+
+/*
+ * Query key name should match the query hook name for consistency
+ */
+const profileQueryKeyRoot = 'profile'
+
+/*
+ * Use object params and createQueryKey helper for better readability and to
+ * avoid bugs with parameter order or types.
+ */
+export const createProfileQueryKey = (args: {did: string}) =>
+  createQueryKey(profileQueryKeyRoot, args)
+
+/*
+ * Query hook should be named use[Name]Query, where [Name] describes the data
+ * being fetched. This is not a strict requirement, but it's a helpful
+ * convention for discoverability
+ */
+export function useProfileQuery({did}: {did: string}) {
+  const agent = useAgent()
+
+  return useQuery({
+    queryKey: createProfileQueryKey({did}),
+    queryFn: async () => {
+      const res = await agent.getProfile({actor: did})
+      return res.data
+    },
+    staleTime: STALE.MINUTES.FIVE,
+    enabled: !!did,
+  })
+}
+
+/*
+ * Mutation hook should match the name of the query hook, but with "Mutation"
+ * suffix. This is not a strict requirement, but it's a helpful convention for
+ * discoverability and consistency.
+ */
+export function useProfileMutation() {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationFn: async data => {
+      // Update logic
+    },
+    onSuccess: (_, variables) => {
+      queryClient.invalidateQueries({
+        queryKey: createProfileQueryKey({did: variables.did}),
+      })
+    },
+    onError: error => {
+      if (isNetworkError(error)) {
+        // don't log, but inform user
+      } else if (error instanceof AppBskyExampleProcedure.ExampleError) {
+        // XRPC APIs often have typed errors, allows nicer handling
+      } else {
+        // Log unexpected errors to Sentry
+        logger.error('Error updating profile', {safeMessage: error})
+      }
+    },
+  })
+}
+
+/*
+ * If cache mutation is needed, include specific interfaces for the specific
+ * mutations you require adjacent to the source queries. Naming should be
+ * descriptive of the mutation's purpose, e.g. use[Name]CacheMutation. This is
+ * not a strict requirement, but it's a helpful convention for discoverability
+ * and consistency.
+ */
+export function useProfileCacheMutation() {
+  const queryClient = useQueryClient()
+
+  return (data: Partial<Profile>) => {
+    queryClient.setQueryData(
+      createProfileQueryKey({did: data.did}),
+      oldData => {
+        if (!oldData) return oldData
+        return {...oldData, ...data}
+      },
+    )
+  }
+}
+```
+
+**Stale Time Constants** (from `src/state/queries/index.ts`):
+
+```tsx
+STALE.SECONDS.FIFTEEN // 15 seconds
+STALE.MINUTES.ONE // 1 minute
+STALE.MINUTES.FIVE // 5 minutes
+STALE.HOURS.ONE // 1 hour
+STALE.INFINITY // Never stale
+```
+
+**Paginated APIs:** Many atproto APIs return paginated results with a `cursor`. Use `useInfiniteQuery` for these:
+
+```tsx
+export function useDraftsQuery() {
+  const agent = useAgent()
+
+  return useInfiniteQuery({
+    queryKey: createQueryKey('drafts'),
+    queryFn: async ({pageParam}) => {
+      const res = await agent.app.bsky.draft.getDrafts({cursor: pageParam})
+      return res.data
+    },
+    initialPageParam: undefined as string | undefined,
+    getNextPageParam: page => page.cursor,
+  })
+}
+```
+
+To get all items from pages: `data?.pages.flatMap(page => page.items) ?? []`
+
+**Persisted Queries**
+
+To persist query data across app restarts, `createQueryKey` supports a third
+parameter called `options`, which has a `persistedVersion` property. When this
+property is set to a number, the query will be persisted.
+
+When this property is updated (e.g. incremented), the persisted data will be cleared and replaced with the new data from the query function. This is useful for cases where the shape of the data has changed and old persisted data would no longer be valid.
+
+```tsx
+export const createProfileQueryKey = (args: {did: string}) =>
+  createQueryKey(profileQueryKeyRoot, args, {persistedVersion: 1})
+```
+
+### Preferences (React Context)
+
+```tsx
+// Simple boolean preference pattern
+import {useAutoplayDisabled, useSetAutoplayDisabled} from '#/state/preferences'
+
+function SettingsScreen() {
+  const autoplayDisabled = useAutoplayDisabled()
+  const setAutoplayDisabled = useSetAutoplayDisabled()
+
+  return <Toggle value={autoplayDisabled} onValueChange={setAutoplayDisabled} />
+}
+```
+
+### Session State
+
+```tsx
+import {useSession, useAgent} from '#/state/session'
+
+function MyComponent() {
+  const {hasSession, currentAccount} = useSession()
+  const agent = useAgent()
+
+  if (!hasSession) {
+    return <LoginPrompt />
+  }
+
+  // Use agent for API calls
+  const response = await agent.getProfile({actor: currentAccount.did})
+}
+```
+
+## Navigation
+
+Navigation uses React Navigation with type-safe route parameters.
+
+```tsx
+// Screen component
+import {type NativeStackScreenProps} from '@react-navigation/native-stack'
+import {type CommonNavigatorParams} from '#/lib/routes/types'
+
+type Props = NativeStackScreenProps<CommonNavigatorParams, 'Profile'>
+
+export function ProfileScreen({route, navigation}: Props) {
+  const {name} = route.params // Type-safe params
+
+  return <Layout.Screen>{/* Screen content */}</Layout.Screen>
+}
+
+// Programmatic navigation
+import {useNavigation} from '@react-navigation/native'
+
+const navigation = useNavigation()
+navigation.navigate('Profile', {name: 'alice.bsky.social'})
+
+// Or use the navigate helper
+import {navigate} from '#/Navigation'
+navigate('Profile', {name: 'alice.bsky.social'})
+```
+
+## Platform-Specific Code
+
+Use file extensions for platform-specific implementations:
+
+```
+Component.tsx          # Shared/default
+Component.web.tsx      # Web-only
+Component.native.tsx   # iOS + Android
+Component.ios.tsx      # iOS-only
+Component.android.tsx  # Android-only
+```
+
+Example from Dialog:
+
+- `src/components/Dialog/index.tsx` – Native (uses BottomSheet)
+- `src/components/Dialog/index.web.tsx` – Web (uses modal with Radix primitives)
+
+**Important:** The bundler automatically resolves platform-specific files. Just import normally:
+
+```tsx
+// CORRECT - bundler picks storage.ts or storage.web.ts automatically
+import * as storage from '#/state/drafts/storage'
+
+// WRONG - don't use require() or conditional imports for platform files
+const storage = IS_NATIVE
+  ? require('#/state/drafts/storage')
+  : require('#/state/drafts/storage.web')
+```
+
+Platform detection (for runtime logic, not imports):
+
+```tsx
+import {IS_WEB, IS_NATIVE, IS_IOS, IS_ANDROID} from '#/env'
+
+if (IS_NATIVE) {
+  // Native-specific logic
+}
+```
+
+## Import Aliases
+
+Always use the `#/` alias for absolute imports:
+
+```tsx
+// Good
+import {useSession} from '#/state/session'
+import {atoms as a, useTheme} from '#/alf'
+import {Button} from '#/components/Button'
+
+// Avoid
+import {useSession} from '../../../state/session'
+```
+
+## Footguns
+
+Common pitfalls to avoid in this codebase:
+
+### Dialog Close Callback (Critical)
+
+**Always use `control.close(() => ...)` when performing actions after closing a dialog.** The callback ensures the action runs after the dialog's close animation completes. Failing to do this causes race conditions with React state updates.
+
+```tsx
+// WRONG - causes bugs with state updates, navigation, opening other dialogs
+const onConfirm = () => {
+  control.close()
+  navigation.navigate('Home') // May race with dialog animation
+}
+
+// WRONG - same problem
+const onConfirm = () => {
+  control.close()
+  otherDialogControl.open() // Will likely fail or cause visual glitches
+}
+
+// CORRECT - action runs after dialog fully closes
+const onConfirm = () => {
+  control.close(() => {
+    navigation.navigate('Home')
+  })
+}
+
+// CORRECT - opening another dialog after close
+const onConfirm = () => {
+  control.close(() => {
+    otherDialogControl.open()
+  })
+}
+
+// CORRECT - state updates after close
+const onConfirm = () => {
+  control.close(() => {
+    setSomeState(newValue)
+    onCallback?.()
+  })
+}
+```
+
+This applies to:
+
+- Navigation (`navigation.navigate()`, `navigation.push()`)
+- Opening other dialogs or menus
+- State updates that affect UI (`setState`, `queryClient.invalidateQueries`)
+- Callbacks passed from parent components
+
+The Menu component on iOS specifically uses this pattern – see `src/components/Menu/index.tsx:151`.
+
+### Controlled vs Uncontrolled Inputs
+
+Prefer `defaultValue` over `value` for TextInput on the old architecture:
+
+```tsx
+// Preferred - uncontrolled
+<TextField.Input
+  defaultValue={initialEmail}
+  onChangeText={setEmail}
+/>
+
+// Avoid when possible - controlled (can cause performance issues)
+<TextField.Input
+  value={email}
+  onChangeText={setEmail}
+/>
+```
+
+### Platform-Specific Behavior
+
+Some components behave differently across platforms:
+
+- `Dialog.Handle` – Only renders on native (drag handle for bottom sheet)
+- `Dialog.Close` – Only renders on web (X button)
+- `Menu.Divider` – Only renders on web
+- `Menu.ContainerItem` – Only works on native
+
+Always test on multiple platforms when using these components.
+
+### React Compiler is Enabled
+
+This codebase uses React Compiler, so **don't proactively add `useMemo` or `useCallback`**. The compiler handles memoization automatically.
+
+```tsx
+// UNNECESSARY - React Compiler handles this
+const handlePress = useCallback(() => {
+  doSomething()
+}, [doSomething])
+
+// JUST WRITE THIS
+const handlePress = () => {
+  doSomething()
+}
+```
+
+Only use `useMemo`/`useCallback` when you have a specific reason, such as:
+
+- The value is immediately used in an effect's dependency array
+- You're passing a callback to a non-React library that needs referential stability
+
+## Best Practices
+
+1. **Accessibility**: Always provide `label` prop for interactive elements, use `accessibilityHint` where helpful
+
+2. **Translations**: Wrap ALL user-facing strings with ` `l` `` or `<Trans>`
+
+3. **Styling**: Combine static atoms with theme atoms, use platform utilities for platform-specific styles
+
+4. **State**: Use TanStack Query for server state, React Context for UI preferences
+
+5. **Components**: Check if a component exists in `#/components/` before creating new ones
+
+6. **Types**: Define explicit types for props, use `NativeStackScreenProps` for screens
+
+7. **Testing**: Components should have `testID` props for E2E testing
+
+## Key Files Reference
+
+| Purpose           | Location                                     |
+| ----------------- | -------------------------------------------- |
+| Theme definitions | `src/alf/themes.ts`                          |
+| Design tokens     | `src/alf/tokens.ts`                          |
+| Static atoms      | `src/alf/atoms.ts` (extends `@bsky.app/alf`) |
+| Navigation config | `src/Navigation.tsx`                         |
+| Route definitions | `src/routes.ts`                              |
+| Route types       | `src/lib/routes/types.ts`                    |
+| Query hooks       | `src/state/queries/*.ts`                     |
+| Session state     | `src/state/session/index.tsx`                |
+| i18n setup        | `src/locale/i18n.ts`                         |

Dockerfile

@@ -1,79 +1,87 @@
-FROM golang:1.23-bullseye AS build-env
+#
+# Stage 1: build the web bundle with pnpm.
+#
+# Uses the official pnpm image. Node is auto-downloaded by pnpm using the
+# `devEngines.runtime` field in package.json (onFail: "download").
+#
+FROM ghcr.io/pnpm/pnpm:11 AS web-build
 
-WORKDIR /usr/src/social-app
+WORKDIR /app
 
 ENV DEBIAN_FRONTEND=noninteractive
 
 #
-# Node
+# pnpm config
 #
-ENV NODE_VERSION=20
-ENV NVM_DIR=/usr/share/nvm
+ENV CI=1
+# use the pnpm version specified in package.json
+ENV pnpm_config_pm_on_fail=download
 
-#
-# Go
-#
-ENV GODEBUG="netdns=go"
-ENV GOOS="linux"
-ENV GOARCH="amd64"
-ENV CGO_ENABLED=1
-ENV GOEXPERIMENT="loopvar"
+# The latest git hash of the preview branch on render.com
+# https://render.com/docs/docker-secrets#environment-variables-in-docker-builds
+ARG RENDER_GIT_COMMIT
 
 #
 # Expo
 #
+ARG EXPO_PUBLIC_ENV
+ENV EXPO_PUBLIC_ENV=${EXPO_PUBLIC_ENV:-development}
+ARG EXPO_PUBLIC_RELEASE_VERSION
+ENV EXPO_PUBLIC_RELEASE_VERSION=$EXPO_PUBLIC_RELEASE_VERSION
 ARG EXPO_PUBLIC_BUNDLE_IDENTIFIER
-ENV EXPO_PUBLIC_BUNDLE_IDENTIFIER=${EXPO_PUBLIC_BUNDLE_IDENTIFIER:-dev}
-
-# The latest git hash of the preview branch on render.com
-ARG RENDER_GIT_COMMIT
+# If not set by GitHub workflows, we're probably in Render
+ENV EXPO_PUBLIC_BUNDLE_IDENTIFIER=${EXPO_PUBLIC_BUNDLE_IDENTIFIER:-$RENDER_GIT_COMMIT}
 
 #
 # Sentry
 #
 ARG SENTRY_AUTH_TOKEN
 ENV SENTRY_AUTH_TOKEN=${SENTRY_AUTH_TOKEN:-unknown}
-# Will fall back to package.json#version, but this is handled elsewhere
-ARG SENTRY_RELEASE
-ENV SENTRY_RELEASE=$SENTRY_RELEASE
-ARG SENTRY_DIST
-# Default to RENDER_GIT_COMMIT if not set by GitHub workflows
-ENV SENTRY_DIST=${SENTRY_DIST:-$RENDER_GIT_COMMIT}
-ARG SENTRY_DSN
-ENV SENTRY_DSN=$SENTRY_DSN
+ARG EXPO_PUBLIC_SENTRY_DSN
+ENV EXPO_PUBLIC_SENTRY_DSN=$EXPO_PUBLIC_SENTRY_DSN
 
-#
-# Copy everything into the container
-#
 COPY . .
 
-#
-# Generate the JavaScript webpack.
-#
-RUN mkdir --parents $NVM_DIR && \
-  wget \
-    --output-document=/tmp/nvm-install.sh \
-    https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh && \
-  bash /tmp/nvm-install.sh
-
-RUN \. "$NVM_DIR/nvm.sh" && \
-  nvm install $NODE_VERSION && \
-  nvm use $NODE_VERSION && \
-  echo "Using bundle identifier: $EXPO_PUBLIC_BUNDLE_IDENTIFIER" && \
+RUN echo "Using bundle identifier: $EXPO_PUBLIC_BUNDLE_IDENTIFIER" && \
+  echo "EXPO_PUBLIC_ENV=$EXPO_PUBLIC_ENV" >> .env && \
+  echo "EXPO_PUBLIC_RELEASE_VERSION=$EXPO_PUBLIC_RELEASE_VERSION" >> .env && \
   echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$EXPO_PUBLIC_BUNDLE_IDENTIFIER" >> .env && \
   echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env && \
-  npm install --global yarn && \
-  yarn && \
-  yarn intl:build 2>&1 | tee i18n.log && \
-  if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compile errors!\n\n"; fi && \
-  EXPO_PUBLIC_BUNDLE_IDENTIFIER=$EXPO_PUBLIC_BUNDLE_IDENTIFIER EXPO_PUBLIC_BUNDLE_DATE=$() SENTRY_AUTH_TOKEN=$SENTRY_AUTH_TOKEN SENTRY_RELEASE=$SENTRY_RELEASE SENTRY_DIST=$SENTRY_DIST SENTRY_DSN=$SENTRY_DSN yarn build-web
+  echo "EXPO_PUBLIC_SENTRY_DSN=$EXPO_PUBLIC_SENTRY_DSN" >> .env
+
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm install --frozen-lockfile
+
+RUN pnpm intl:build 2>&1 | tee i18n.log && \
+  if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compile errors!\n\n"; fi
+
+RUN SENTRY_AUTH_TOKEN=$SENTRY_AUTH_TOKEN \
+    SENTRY_RELEASE=$EXPO_PUBLIC_RELEASE_VERSION \
+    SENTRY_DIST=$EXPO_PUBLIC_BUNDLE_IDENTIFIER \
+    pnpm build-web
+
+#
+# Stage 2: build the bskyweb Go binary, embedding the assets from stage 1.
+#
+# post-web-build.js (run by `pnpm build-web`) writes the bundled JS/CSS/media
+# into bskyweb/static/* and regenerates bskyweb/templates/scripts.html, so
+# copying the bskyweb/ tree from stage 1 is enough for go:embed to find
+# everything.
+#
+FROM golang:1.26-bookworm AS go-build
+
+WORKDIR /usr/src/social-app
+
+ENV GODEBUG="netdns=go"
+ENV GOOS="linux"
+ENV GOARCH="amd64"
+ENV CGO_ENABLED=1
+ENV GOEXPERIMENT="loopvar"
+
+COPY --from=web-build /app/bskyweb ./bskyweb
 
 # DEBUG
-RUN find ./bskyweb/static && find ./web-build/static
+RUN find ./bskyweb/static
 
-#
-# Generate the bskyweb Go binary.
-#
 RUN cd bskyweb/ && \
   go mod download && \
   go mod verify
@@ -86,7 +94,10 @@ RUN cd bskyweb/ && \
     -o /bskyweb \
     ./cmd/bskyweb
 
-FROM debian:bullseye-slim
+#
+# Stage 3: runtime image.
+#
+FROM debian:bookworm-slim
 
 ENV GODEBUG=netdns=go
 ENV TZ=Etc/UTC
@@ -99,7 +110,7 @@ RUN apt-get update && apt-get install --yes \
 ENTRYPOINT ["dumb-init", "--"]
 
 WORKDIR /bskyweb
-COPY --from=build-env /bskyweb /usr/bin/bskyweb
+COPY --from=go-build /bskyweb /usr/bin/bskyweb
 
 CMD ["/usr/bin/bskyweb"]
 

Dockerfile.bskylink

@@ -1,4 +1,4 @@
-FROM node:20.11-alpine3.18 as build
+FROM node:24.15.0-alpine3.22 AS build
 
 # Move files into the image and install
 WORKDIR /app
@@ -14,7 +14,7 @@ RUN yarn build
 RUN yarn install --production --ignore-scripts --prefer-offline
 
 # Uses assets from build stage to reduce build size
-FROM node:20.11-alpine3.18
+FROM node:24.15.0-alpine3.22
 
 RUN apk add --update dumb-init
 
@@ -29,8 +29,6 @@ VOLUME /app/data
 EXPOSE 3000
 ENV LINK_PORT=3000
 ENV NODE_ENV=production
-# potential perf issues w/ io_uring on this version of node
-ENV UV_USE_IO_URING=0
 
 # https://github.com/nodejs/docker-node/blob/master/docs/BestPractices.md#non-root-user
 USER node

Dockerfile.bskyogcard

@@ -1,20 +1,25 @@
-FROM node:20.11-alpine3.18 as build
+FROM node:24.15.0-alpine3.22 AS build
+
+# Tells pnpm to run non-interactively (needed for install/script steps)
+ENV CI=true
 
 # Move files into the image and install
 WORKDIR /app
 
 COPY ./bskyogcard/package.json ./
-COPY ./bskyogcard/yarn.lock ./
-RUN yarn install --frozen-lockfile
+COPY ./bskyogcard/pnpm-lock.yaml ./
+COPY ./bskyogcard/pnpm-workspace.yaml ./
+RUN npm install --global pnpm@11.5.2
+RUN pnpm install --frozen-lockfile
 
 COPY ./bskyogcard ./
 
 # build then prune dev deps
-RUN yarn install-fonts && yarn build
-RUN yarn install --production --ignore-scripts --prefer-offline
+RUN pnpm install-fonts && pnpm build
+RUN pnpm install --prod --ignore-scripts --prefer-offline
 
 # Uses assets from build stage to reduce build size
-FROM node:20.11-alpine3.18
+FROM node:24.15.0-alpine3.22
 
 RUN apk add --update dumb-init
 
@@ -26,11 +31,10 @@ COPY --from=build /app /app
 RUN mkdir /app/data && chown node /app/data
 
 VOLUME /app/data
-EXPOSE 3000
+EXPOSE 3000 3001
 ENV CARD_PORT=3000
+ENV CARD_METRICS_PORT=3001
 ENV NODE_ENV=production
-# potential perf issues w/ io_uring on this version of node
-ENV UV_USE_IO_URING=0
 
 # https://github.com/nodejs/docker-node/blob/master/docs/BestPractices.md#non-root-user
 USER node

Dockerfile.embedr

@@ -1,20 +1,24 @@
-FROM golang:1.23-bullseye AS build-env
+FROM golang:1.26-bookworm AS build-env
 
 WORKDIR /usr/src/social-app
 
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Node
-ENV NODE_VERSION=20
+ENV NODE_VERSION=24.15.0
 ENV NVM_DIR=/usr/share/nvm
 
 # Go
 ENV GODEBUG="netdns=go"
 ENV GOOS="linux"
-ENV GOARCH="amd64"
+ARG TARGETARCH
+ENV GOARCH=${TARGETARCH:-amd64}
 ENV CGO_ENABLED=1
 ENV GOEXPERIMENT="loopvar"
 
+# CI environment for pnpm
+ENV CI=true
+
 COPY . .
 
 #
@@ -29,11 +33,11 @@ RUN mkdir --parents $NVM_DIR && \
 RUN \. "$NVM_DIR/nvm.sh" && \
   nvm install $NODE_VERSION && \
   nvm use $NODE_VERSION && \
-  npm install --global yarn && \
-  yarn && \
-  cd bskyembed && yarn install --frozen-lockfile && cd .. && \
-  yarn intl:build && \
-  yarn build-embed
+  npm install --global pnpm@11.9.0 && \
+  pnpm install --frozen-lockfile && \
+  cd bskyembed && pnpm install --frozen-lockfile && cd .. && \
+  pnpm intl:build && \
+  pnpm build-embed
 
 # DEBUG
 RUN find ./bskyweb/embedr-static && find ./bskyweb/embedr-templates && find ./bskyembed/dist
@@ -58,7 +62,7 @@ RUN cd bskyweb/ && \
     -o /embedr \
     ./cmd/embedr
 
-FROM debian:bullseye-slim
+FROM debian:bookworm-slim
 
 ENV GODEBUG=netdns=go
 ENV TZ=Etc/UTC

LICENSE

@@ -1,4 +1,4 @@
-Copyright 2023–2025 Bluesky Social PBC
+Copyright 2023–2026 Bluesky Social PBC
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 

Makefile

@@ -10,33 +10,33 @@ help: ## Print info about all commands
 
 .PHONY: build-web
 build-web: ## Compile web bundle, copy to bskyweb directory
-	yarn intl:build
-	yarn build-web
+	pnpm intl:build
+	pnpm build-web
 
 .PHONY: build-web-embed
 build-web-embed: ## Compile web embed bundle, copy to bskyweb/embedr* directories
-	yarn intl:build
-	yarn build-embed
+	pnpm intl:build
+	pnpm build-embed
 
 .PHONY: test
 test: ## Run all tests
-	NODE_ENV=test yarn test
+	NODE_ENV=test pnpm test
 
 .PHONY: lint
 lint: ## Run style checks and verify syntax
-	yarn run lint
+	pnpm run lint
 
 #.PHONY: fmt
 #fmt: ## Run syntax re-formatting
-#	yarn prettier
+#	pnpm prettier
 
 .PHONY: deps
-deps: ## Installs dependent libs using 'yarn install'
-	yarn install --frozen-lockfile
+deps: ## Installs dependent libs using 'pnpm install'
+	pnpm install --frozen-lockfile
 	cd bskyembed && yarn install --frozen-lockfile
 
 .PHONY: nvm-setup
-nvm-setup: ## Use NVM to install and activate node+yarn
+nvm-setup: ## Use NVM to install and activate node+pnpm
 	nvm install 20
 	nvm use 20
-	npm install --global yarn
+	npm install --global pnpm

README.md

@@ -10,7 +10,7 @@ Get the app itself:
 
 ## Development Resources
 
-This is a [React Native](https://reactnative.dev/) application, written in the TypeScript programming language. It builds on the `atproto` TypeScript packages (like [`@atproto/api`](https://www.npmjs.com/package/@atproto/api)), code for which is also open source, but in [a different git repository](https://github.com/bluesky-social/atproto).
+This is a [React Native](https://reactnative.dev/) application, written in the TypeScript programming language. It builds on the `atproto` TypeScript packages (like [`@atproto/api`](https://www.npmjs.com/package/@atproto/api)), which are also open source, but in [a different git repository](https://github.com/bluesky-social/atproto).
 
 There is a small amount of Go language source code (in `./bskyweb/`), for a web service that returns the React Native Web application.
 
@@ -19,7 +19,7 @@ The [Build Instructions](./docs/build.md) are a good place to get started with t
 The Authenticated Transfer Protocol ("AT Protocol" or "atproto") is a decentralized social media protocol. You don't *need* to understand AT Protocol to work with this application, but it can help. Learn more at:
 
 - [Overview and Guides](https://atproto.com/guides/overview)
-- [Github Discussions](https://github.com/bluesky-social/atproto/discussions) 👈 Great place to ask questions
+- [GitHub Discussions](https://github.com/bluesky-social/atproto/discussions) 👈 Great place to ask questions
 - [Protocol Specifications](https://atproto.com/specs/atp)
 - [Blogpost on self-authenticating data structures](https://bsky.social/about/blog/3-6-2022-a-self-authenticating-social-protocol)
 
@@ -27,6 +27,7 @@ The Bluesky Social application encompasses a set of schemas and APIs built in th
 
 ## Contributions
 
+> [!NOTE]
 > While we do accept contributions, we prioritize high quality issues and pull requests. Adhering to the below guidelines will ensure a more timely review.
 
 **Rules:**
@@ -59,7 +60,7 @@ Please be sure to:
 
 ## Security disclosures
 
-If you discover any security issues, please send an email to security@bsky.app. The email is automatically CCed to the entire team and we'll respond promptly.
+If you discover any security issues, please send an email to security@bsky.app. The email is automatically CC'd to the entire team and we'll respond promptly.
 
 ## Are you a developer interested in building on atproto?
 
@@ -69,6 +70,8 @@ Bluesky is an open social network built on the AT Protocol, a flexible technolog
 
 See [./LICENSE](./LICENSE) for the full license.
 
+Bluesky Social PBC has committed to a software patent non-aggression pledge. For details see [the original announcement](https://bsky.social/about/blog/10-01-2025-patent-pledge).
+
 ## P.S.
 
 We ❤️ you and all of the ways you support us. Thank you for making Bluesky a great place!

__e2e__/flows/composer-self-label.yml

@@ -3,20 +3,26 @@ appId: xyz.blueskyweb.app
 - runScript:
     file: ../setupServer.js
     env:
-        SERVER_PATH: ?users
+      SERVER_PATH: ?users
 - runFlow:
     file: ../setupApp.yml
 - tapOn:
     id: "e2eSignInAlice"
+- extendedWaitUntil:
+    visible:
+      id: "viewHeaderHomeFeedPrefsBtn"
 
 # Post an image with the porn label
 - assertVisible:
-      id: "composeFAB"
+    id: "composeFAB"
 - tapOn:
     id: "composeFAB"
 - inputText: "Post with an image"
 - tapOn:
-    id: "openGalleryBtn"
+    id: "openMediaBtn"
+- extendedWaitUntil:
+    visible:
+      id: "selectedPhotosView"
 - tapOn: "Content warnings"
 - tapOn: "Porn"
 - tapOn:

__e2e__/flows/composer.yml

@@ -3,13 +3,17 @@ appId: xyz.blueskyweb.app
 - runScript:
     file: ../setupServer.js
     env:
-        SERVER_PATH: ?users
+      SERVER_PATH: ?users
 - runFlow:
     file: ../setupApp.yml
 - tapOn:
     id: "e2eSignInAlice"
+- extendedWaitUntil:
+    visible:
+      id: "viewHeaderHomeFeedPrefsBtn"
+
 - assertVisible:
-      id: "composeFAB"
+    id: "composeFAB"
 - tapOn:
     id: "composeFAB"
 - inputText: "Post text only"
@@ -21,7 +25,10 @@ appId: xyz.blueskyweb.app
     id: "composeFAB"
 - inputText: "Post with an image"
 - tapOn:
-    id: "openGalleryBtn"
+    id: "openMediaBtn"
+- extendedWaitUntil:
+    visible:
+      id: "selectedPhotosView"
 - tapOn:
     id: "composerPublishBtn"
 - assertVisible:
@@ -46,7 +53,10 @@ appId: xyz.blueskyweb.app
     id: "replyBtn"
 - inputText: "Reply with an image"
 - tapOn:
-    id: "openGalleryBtn"
+    id: "openMediaBtn"
+- extendedWaitUntil:
+    visible:
+      id: "selectedPhotosView"
 - tapOn:
     id: "composerPublishBtn"
 - assertVisible:
@@ -73,7 +83,10 @@ appId: xyz.blueskyweb.app
     id: "quoteBtn"
 - inputText: "QP with an image"
 - tapOn:
-    id: "openGalleryBtn"
+    id: "openMediaBtn"
+- extendedWaitUntil:
+    visible:
+      id: "selectedPhotosView"
 - tapOn:
     id: "composerPublishBtn"
 - assertVisible:

__e2e__/flows/create-account.yml

@@ -3,7 +3,7 @@ appId: xyz.blueskyweb.app
 - runScript:
     file: ../setupServer.js
     env:
-        SERVER_PATH: ""
+      SERVER_PATH: ""
 - runFlow:
     file: ../setupApp.yml
 - tapOn:
@@ -25,11 +25,25 @@ appId: xyz.blueskyweb.app
 - tapOn:
     id: "passwordInput"
 - inputText: "hunter22"
-- hideKeyboard
+- tapOn:
+    # hideKeyboard on ios is borked
+    # https://docs.maestro.dev/troubleshooting/known-issues#hidekeyboard-command-is-flaky
+    text: "Your account"
 - tapOn:
     id: "nextBtn"
-- tapOn: "Not now"
+- waitForAnimationToEnd
+- tapOn:
+    # save password thing no longer seems to be in hierarchy
+    # tap on something else instead
+    point: 20%,20%
+    repeat: 2
+    delay: 1000
+- tapOn:
+    id: "handleInput"
 - inputText: "e2e-test"
+- extendedWaitUntil:
+    visible:
+      id: "handleAvailableCheck"
 - tapOn:
     id: "nextBtn"
-
+- assertVisible: "Give your profile a face"

__e2e__/flows/curate-lists.yml

@@ -3,95 +3,82 @@ appId: xyz.blueskyweb.app
 - runScript:
     file: ../setupServer.js
     env:
-        SERVER_PATH: "?users&follows&posts"
+      SERVER_PATH: "?users&follows&posts"
 - runFlow:
     file: ../setupApp.yml
 - tapOn:
     id: "e2eSignInAlice"
+- extendedWaitUntil:
+    visible:
+      id: "viewHeaderHomeFeedPrefsBtn"
 
 - tapOn:
     label: "Create a curate list"
     id: "e2eGotoLists"
 - tapOn:
     id: "newUserListBtn"
-- assertVisible:
-    id: "createOrEditListModal"
+- waitForAnimationToEnd
+- assertVisible: "Create user list"
 - tapOn:
-    id: "editNameInput"
+    id: "editListNameInput"
 - inputText: "Good Ppl"
 - tapOn:
-    id: "editDescriptionInput"
+    id: "editListDescriptionInput"
 - inputText: "They good"
 - tapOn: "Save"
-- tapOn: "Save"
-- assertNotVisible:
-    id: "createOrEditListModal"
+- assertNotVisible: "Create user list"
 - tapOn: "People"
 - assertVisible: "Good Ppl"
 - assertVisible: "They good"
 
 - tapOn:
-    label: "Edit display name and description via the edit curatelist modal"
-    point: "90%,9%"
+    id: "moreOptionsBtn"
 - tapOn: "Edit list details"
-- assertVisible:
-    id: "createOrEditListModal"
+- assertVisible: "Edit user list"
 - tapOn:
-    id: "editNameInput"
+    id: "editListNameInput"
 - eraseText
 - inputText: "Bad Ppl"
-- hideKeyboard
 - tapOn:
-    id: "editDescriptionInput"
+    id: "editListDescriptionInput"
 - eraseText
 - inputText: "They bad"
 - tapOn: "Save"
-- tapOn: "Save"
-- assertNotVisible:
-    id: "createOrEditListModal"
+- assertNotVisible: "Edit user list"
 - assertVisible: Bad Ppl
 - assertVisible: They bad
 
 - tapOn:
-    label: "Remove description via the edit curatelist modal"
-    point: "90%,9%"
+    id: "moreOptionsBtn"
 - tapOn: "Edit list details"
-- assertVisible:
-    id: "createOrEditListModal"
+- assertVisible: "Edit user list"
 - tapOn:
-    id: "editDescriptionInput"
+    id: "editListDescriptionInput"
 - eraseText
 - tapOn: "Save"
-- tapOn: "Save"
-- assertNotVisible:
-    id: "createOrEditListModal"
+- assertNotVisible: "Edit user list"
 - assertNotVisible:
     id: "listDescription"
 
 - tapOn:
-    label: "Delete the curatelist"
-    point: "90%,9%"
+    id: "moreOptionsBtn"
 - tapOn: "Delete List"
 - tapOn:
     id: "confirmBtn"
 
-- tapOn:
-    label: "Create a new curatelist"
-    id: "e2eGotoLists"
+- assertVisible:
+    id: "newUserListBtn"
 - tapOn:
     id: "newUserListBtn"
-- assertVisible:
-    id: "createOrEditListModal"
+- assertVisible: "Create user list"
 - tapOn:
-    id: "editNameInput"
+    id: "editListNameInput"
 - inputText: "Good Ppl"
 - tapOn:
-    id: "editDescriptionInput"
+    id: "editListDescriptionInput"
 - inputText: "They good"
 - tapOn: "Save"
-- tapOn: "Save"
-- assertNotVisible:
-    id: "createOrEditListModal"
+- assertNotVisible: "Create user list"
 - tapOn: "People"
 - assertVisible: "Good Ppl"
 - assertVisible: "They good"
@@ -104,7 +91,8 @@ appId: xyz.blueskyweb.app
 - tapOn: "Add user to list"
 - swipe:
     direction: DOWN
-- assertVisible: "View Bob's profile"
+- assertVisible:
+    id: "profileCard-bob.test-link"
 
 - tapOn: "Posts"
 - assertVisible:
@@ -135,8 +123,9 @@ appId: xyz.blueskyweb.app
     id: "e2eGotoLists"
 - tapOn: "Good Ppl"
 
-# - tapOn: "People"
-- assertVisible: "View Bob's profile"
+- tapOn: "People"
+- assertVisible:
+    id: "profileCard-bob.test-link"
 - tapOn:
     point: "90%,43%"
 - tapOn:
@@ -146,7 +135,8 @@ appId: xyz.blueskyweb.app
 
 - tapOn:
     id: "bottomBarSearchBtn"
-- tapOn: "Search for posts, users, or feeds"
+- tapOn:
+    id: "searchScreenInput"
 - inputText: "bob"
 - tapOn:
     id: "searchAutoCompleteResult-bob.test"
@@ -156,21 +146,21 @@ appId: xyz.blueskyweb.app
     id: "profileHeaderDropdownBtn"
 - tapOn: "Add to Lists"
 - assertVisible:
-    id: "userAddRemoveListsModal"
+    id: "userAddRemoveListsDialog"
 - tapOn:
     id: "user-bob.test-addBtn"
 - tapOn:
     id: "doneBtn"
 - assertNotVisible:
-    id: "userAddRemoveListsModal"
+    id: "userAddRemoveListsDialog"
 - tapOn:
     id: "profileHeaderDropdownBtn"
 - tapOn: "Add to Lists"
 - assertVisible:
-    id: "userAddRemoveListsModal"
+    id: "userAddRemoveListsDialog"
 - tapOn:
     id: "user-bob.test-addBtn"
 - tapOn:
     id: "doneBtn"
 - assertNotVisible:
-    id: "userAddRemoveListsModal"
+    id: "userAddRemoveListsDialog"

__e2e__/flows/feed-reorder.yml

@@ -35,9 +35,12 @@ appId: xyz.blueskyweb.app
     id: "menuItemButton-Feeds"
 - tapOn:
     id: "editFeedsBtn"
-- tapOn:
-    label: "Tap on down arrow"
-    id: "feed-timeline-moveDown"
+- swipe:
+    label: "Drag feed down"
+    from:
+      id: "feed-drag-handle"
+    direction: "DOWN"
+    duration: 1000
 - tapOn:
       label: "Save button"
       id: "saveChangesBtn"
@@ -55,9 +58,12 @@ appId: xyz.blueskyweb.app
     id: "menuItemButton-Feeds"
 - tapOn:
     id: "editFeedsBtn"
-- tapOn:
-    label: "Tap on down arrow"
-    id: "feed-feed-moveDown"
+- swipe:
+    label: "Drag feed down"
+    from:
+      id: "feed-drag-handle"
+    direction: "DOWN"
+    duration: 1000
 - tapOn:
     label: "Save button"
     id: "saveChangesBtn"

__e2e__/flows/home-screen.yml

@@ -3,7 +3,7 @@ appId: xyz.blueskyweb.app
 - runScript:
     file: ../setupServer.js
     env:
-        SERVER_PATH: ?users&follows&posts&feeds
+      SERVER_PATH: ?users&follows&posts&feeds
 - runFlow:
     file: ../setupApp.yml
 - tapOn:
@@ -11,7 +11,7 @@ appId: xyz.blueskyweb.app
 
 - extendedWaitUntil:
     visible:
-        text: "Feeds ✨"
+      text: "Feeds ✨"
 - tapOn:
     label: "Can go to feeds page using feeds button in tab bar"
     text: "Feeds ✨"
@@ -50,6 +50,6 @@ appId: xyz.blueskyweb.app
     label: "Can delete posts"
     id: "postDropdownBtn"
     childOf:
-        id: "feedItem-by-alice.test"
+      id: "feedItem-by-alice.test"
 - tapOn: "Delete post"
 - tapOn: "Delete"

__e2e__/flows/login.yml

@@ -15,6 +15,11 @@ appId: xyz.blueskyweb.app
 - tapOn:
     id: "customServerTextInput"
 - inputText: "http://localhost:3000"
+- runFlow:
+    when:
+      platform: Android
+    commands:
+      - hideKeyboard
 - tapOn: "Done"
 - tapOn:
     id: "loginUsernameInput"
@@ -23,5 +28,7 @@ appId: xyz.blueskyweb.app
     id: "loginPasswordInput"
 - inputText: "hunter2"
 - pressKey: Enter
-- tapOn: "Not now"
+- tapOn:
+    text: "Not Now"
+    optional: true
 - assertVisible: "Following"

__e2e__/flows/mod-lists.yml

@@ -3,11 +3,14 @@ appId: xyz.blueskyweb.app
 - runScript:
     file: ../setupServer.js
     env:
-        SERVER_PATH: "?users&follows&labels"
+      SERVER_PATH: "?users&follows&labels"
 - runFlow:
     file: ../setupApp.yml
 - tapOn:
     id: "e2eSignInAlice"
+- extendedWaitUntil:
+    visible:
+      id: "viewHeaderHomeFeedPrefsBtn"
 
 # create a modlist
 - tapOn:
@@ -16,32 +19,25 @@ appId: xyz.blueskyweb.app
     id: "moderationlistsBtn"
 - tapOn: "New list"
 - tapOn:
-    id: "editNameInput"
+    id: "editListNameInput"
 - inputText: "Muted Users"
 - tapOn:
-    id: "editDescriptionInput"
+    id: "editListDescriptionInput"
 - inputText: "Shhh"
 - tapOn: "Save"
-- tapOn: "Save"
 
 # view modlist
 - assertVisible: "Muted Users"
 - assertVisible: "Shhh"
 
-- tapOn:
-    label: "Dropdown"
-    point: "71%,9%"
-
+- tapOn: "Subscribe to this list"
 - tapOn: "Mute accounts"
 - tapOn: "Mute list"
 - tapOn: "Unmute"
 
-- tapOn:
-      label: "Dropdown"
-      point: "71%,9%"
-
+- tapOn: "Subscribe to this list"
 - tapOn: "Block accounts"
 - tapOn: "Block list"
 - tapOn: "Unblock"
 
- # the rest of the behaviors are tested in curate-lists.yml
+  # the rest of the behaviors are tested in curate-lists.yml

__e2e__/flows/onboarding-avatar-creator.yml

@@ -3,11 +3,15 @@ appId: xyz.blueskyweb.app
 - runScript:
     file: ../setupServer.js
     env:
-        SERVER_PATH: "?users"
+      SERVER_PATH: "?users"
 - runFlow:
     file: ../setupApp.yml
 - tapOn:
     id: "e2eSignInAlice"
+- extendedWaitUntil:
+    visible:
+      id: "viewHeaderHomeFeedPrefsBtn"
+
 - tapOn:
     id: "e2eStartOnboarding"
 - tapOn: "Open avatar creator"
@@ -21,12 +25,24 @@ appId: xyz.blueskyweb.app
 - tapOn: "Select the atom emoji as your avatar"
 - tapOn: "Done"
 - waitForAnimationToEnd
-- tapOn: "Continue to next step"
+- tapOn:
+    id: "onboardingContinue"
 - assertVisible: "What are your interests?"
 - tapOn:
-    label: "Tap on continue"
-    point: "50%,92%"
-- assertVisible: "You're ready to go!"
+    id: "onboardingContinue"
+- assertVisible: "Suggested for you"
+# mock server doesn't have suggestions api
+- tapOn: "Skip to next step"
+- swipe:
+    direction: "LEFT"
+- swipe:
+    direction: "LEFT"
+- assertVisible: "Complete onboarding and start using your account"
 - tapOn:
-    label: "Tap on Lets go"
-    point: "50%,92%"
+    id: "onboardingFinish"
+- tapOn:
+    label: "NUX, if applicable"
+    text: "Close"
+    optional: true
+- waitForAnimationToEnd
+- assertVisible: "Following"

__e2e__/flows/onboarding.yml

@@ -3,27 +3,44 @@ appId: xyz.blueskyweb.app
 - runScript:
     file: ../setupServer.js
     env:
-        SERVER_PATH: "?users"
+      SERVER_PATH: "?users"
 - runFlow:
     file: ../setupApp.yml
 - tapOn:
     id: "e2eSignInAlice"
+- extendedWaitUntil:
+    visible:
+      id: "viewHeaderHomeFeedPrefsBtn"
+
 - tapOn:
     id: "e2eStartOnboarding"
 - tapOn: "Select an avatar"
 - waitForAnimationToEnd
-- assertVisible: "Search your library…"
+- assertVisible: "Photos"
+- assertVisible: "Collections"
 - tapOn:
     point: "50%,22%"
 - waitForAnimationToEnd
 - tapOn: "Done"
 - waitForAnimationToEnd
-- tapOn: "Continue to next step"
+- tapOn:
+    id: "onboardingContinue"
 - assertVisible: "What are your interests?"
 - tapOn:
-    label: "Tap on continue"
-    point: "50%,92%"
-- assertVisible: "You're ready to go!"
+    id: "onboardingContinue"
+- assertVisible: "Suggested for you"
+# mock server doesn't have suggestions api
+- tapOn: "Skip to next step"
+- swipe:
+    direction: "LEFT"
+- swipe:
+    direction: "LEFT"
+- assertVisible: "Complete onboarding and start using your account"
 - tapOn:
-    label: "Tap on Lets go"
-    point: "50%,92%"
+    id: "onboardingFinish"
+- tapOn:
+    label: "NUX, if applicable"
+    text: "Close"
+    optional: true
+- waitForAnimationToEnd
+- assertVisible: "Following"

__e2e__/flows/post-report-flow.yml

@@ -3,18 +3,22 @@ appId: xyz.blueskyweb.app
 - runScript:
     file: ../setupServer.js
     env:
-        SERVER_PATH: "?users&follows&posts"
+      SERVER_PATH: "?users&follows&posts"
 - runFlow:
     file: ../setupApp.yml
 - tapOn:
     id: "e2eSignInAlice"
+- extendedWaitUntil:
+    visible:
+      id: "viewHeaderHomeFeedPrefsBtn"
 
 - tapOn:
     id: "postDropdownBtn"
     index: 0
 - tapOn:
     id: "postDropdownReportBtn"
-- tapOn: "Create report for Misleading Post"
+- tapOn: "Create report for Misleading"
+- tapOn: "Create report for Spam"
 - tapOn: "Send report to Dev-env Moderation"
 - tapOn:
     point: "50%,90%"

__e2e__/flows/profile-screen.yml

@@ -3,7 +3,7 @@ appId: xyz.blueskyweb.app
 - runScript:
     file: ../setupServer.js
     env:
-        SERVER_PATH: "?users&posts&feeds"
+      SERVER_PATH: "?users&posts&feeds"
 - runFlow:
     file: ../setupApp.yml
 - tapOn:
@@ -12,10 +12,11 @@ appId: xyz.blueskyweb.app
 # Navigate to another user profile
 - extendedWaitUntil:
     visible:
-        id: "bottomBarSearchBtn"
+      id: "bottomBarSearchBtn"
 - tapOn:
     id: "bottomBarSearchBtn"
-- tapOn: "Search for posts, users, or feeds"
+- tapOn:
+    id: "searchScreenInput"
 - inputText: "b"
 - tapOn:
     id: "searchAutoCompleteResult-bob.test"
@@ -25,6 +26,8 @@ appId: xyz.blueskyweb.app
 # Can follow/unfollow another user
 - tapOn:
     id: "followBtn"
+- tapOn:
+    point: 65%,35% # dismiss the subscribe prompt
 - tapOn:
     id: "unfollowBtn"
 
@@ -36,4 +39,4 @@ appId: xyz.blueskyweb.app
 - tapOn:
     id: "profileHeaderDropdownBtn"
 - tapOn: "Unmute Account"
-- assertNotVisible: "Account Muted"
+- assertNotVisible: "Account Muted"

__e2e__/flows/report-dialog/account.default.yml

@@ -3,7 +3,7 @@ appId: xyz.blueskyweb.app
 - runScript:
     file: ../../setupServer.js
     env:
-        SERVER_PATH: ?users&follows&posts&feeds
+      SERVER_PATH: ?users&follows&posts&feeds
 - runFlow:
     file: ../../setupApp.yml
 - tapOn:
@@ -15,9 +15,11 @@ appId: xyz.blueskyweb.app
 - tapOn:
     id: "profileHeaderDropdownReportBtn"
 - tapOn:
-    id: "report:option:com.atproto.moderation.defs#reasonSpam"
+    id: "report:category:Misleading"
+- tapOn:
+    id: "report:option:Spam"
 - assertVisible:
-    id: "report:labeler:mod-authority.test"
+    text: "Send report to Dev-env Moderation"
 - tapOn:
     id: "report:submit"
 - assertNotVisible:

__e2e__/flows/report-dialog/post.default.yml

@@ -3,7 +3,7 @@ appId: xyz.blueskyweb.app
 - runScript:
     file: ../../setupServer.js
     env:
-        SERVER_PATH: ?users&follows&posts&feeds
+      SERVER_PATH: ?users&follows&posts&feeds
 - runFlow:
     file: ../../setupApp.yml
 - tapOn:
@@ -15,9 +15,11 @@ appId: xyz.blueskyweb.app
 - tapOn:
     id: "postDropdownReportBtn"
 - tapOn:
-    id: "report:option:com.atproto.moderation.defs#reasonSpam"
+    id: "report:category:Misleading"
+- tapOn:
+    id: "report:option:Spam"
 - assertVisible:
-    id: "report:labeler:mod-authority.test"
+    text: "Send report to Dev-env Moderation"
 - tapOn:
     id: "report:submit"
 - assertNotVisible:

__e2e__/flows/report-dialog/post.edit-reason.yml

@@ -3,7 +3,7 @@ appId: xyz.blueskyweb.app
 - runScript:
     file: ../../setupServer.js
     env:
-        SERVER_PATH: ?users&follows&posts&feeds
+      SERVER_PATH: ?users&follows&posts&feeds
 - runFlow:
     file: ../../setupApp.yml
 - tapOn:
@@ -15,20 +15,28 @@ appId: xyz.blueskyweb.app
 - tapOn:
     id: "postDropdownReportBtn"
 - tapOn:
-    id: "report:option:com.atproto.moderation.defs#reasonOther"
+    id: "report:category:Misleading"
+- tapOn:
+    id: "report:option:Other misleading content"
 - assertVisible:
-    id: "report:labeler:mod-authority.test"
+    text: Your report will be sent to Dev-env Moderation.*
 # reason "other" defaults with details open
 - assertVisible:
     id: "report:details"
 - tapOn:
-    id: "report:clearOption"
+    id: "report:clearReportOption"
 - assertNotVisible:
     id: "report:details"
 - tapOn:
-    id: "report:option:com.atproto.moderation.defs#reasonSpam"
+    id: "report:clearCategory"
+- assertNotVisible:
+    id: "report:option:Other misleading content"
+- tapOn:
+    id: "report:category:Misleading"
+- tapOn:
+    id: "report:option:Spam"
 - assertVisible:
-    id: "report:labeler:mod-authority.test"
+    text: Your report will be sent to Dev-env Moderation.*
 - tapOn:
     id: "report:submit"
 - assertNotVisible:

__e2e__/flows/report-dialog/post.reason-other.yml

@@ -3,7 +3,7 @@ appId: xyz.blueskyweb.app
 - runScript:
     file: ../../setupServer.js
     env:
-        SERVER_PATH: ?users&follows&posts&feeds
+      SERVER_PATH: ?users&follows&posts&feeds
 - runFlow:
     file: ../../setupApp.yml
 - tapOn:
@@ -15,15 +15,18 @@ appId: xyz.blueskyweb.app
 - tapOn:
     id: "postDropdownReportBtn"
 - tapOn:
-    id: "report:option:com.atproto.moderation.defs#reasonOther"
+    id: "report:category:Misleading"
+- tapOn:
+    id: "report:option:Other misleading content"
 - assertVisible:
-    id: "report:labeler:mod-authority.test"
+    text: "Send report to Dev-env Moderation"
 # reason "other" defaults with details open
 - assertVisible:
     id: "report:details"
 - tapOn:
     id: "report:details"
 - inputText: "This is a test report"
+- hideKeyboard
 - tapOn:
     id: "report:submit"
 - assertNotVisible:

__e2e__/flows/search-screen.yml

@@ -3,20 +3,24 @@ appId: xyz.blueskyweb.app
 - runScript:
     file: ../setupServer.js
     env:
-        SERVER_PATH: "?users"
+      SERVER_PATH: "?users"
 - runFlow:
     file: ../setupApp.yml
 - tapOn:
     id: "e2eSignInAlice"
 
 # Navigate to another user profile via autocomplete
+- extendedWaitUntil:
+    visible:
+      id: "bottomBarSearchBtn"
 - tapOn:
     id: "bottomBarSearchBtn"
-- assertVisible: "Search for posts, users, or feeds"
-- tapOn: "Search for posts, users, or feeds"
+- assertVisible:
+    id: "searchScreenInput"
+- tapOn:
+    id: "searchScreenInput"
 - inputText: "b"
 - tapOn:
     id: "searchAutoCompleteResult-bob.test"
 - assertVisible:
     id: "profileView"
-

__e2e__/flows/shared-prefs.yml

@@ -8,8 +8,12 @@ appId: xyz.blueskyweb.app
     file: ../setupApp.yml
 - tapOn:
     id: "e2eSignInAlice"
+- extendedWaitUntil:
+    visible:
+      id: "viewHeaderHomeFeedPrefsBtn"
+
 - assertVisible:
-      id: "storybookBtn"
+    id: "storybookBtn"
 - tapOn:
     id: "storybookBtn"
 - tapOn:

__e2e__/flows/thread-muting.yml

@@ -3,13 +3,16 @@ appId: xyz.blueskyweb.app
 - runScript:
     file: ../setupServer.js
     env:
-        SERVER_PATH: "?users&follows"
+      SERVER_PATH: "?users&follows"
 - runFlow:
     file: ../setupApp.yml
 
 # Login, create a thread, and log out
 - tapOn:
     id: "e2eSignInAlice"
+- extendedWaitUntil:
+    visible:
+      id: "viewHeaderHomeFeedPrefsBtn"
 - assertVisible:
     id: "composeFAB"
 - tapOn:
@@ -19,8 +22,13 @@ appId: xyz.blueskyweb.app
     id: "composerPublishBtn"
 
 # Login, reply to the thread, and log out
+- tapOn:
+    id: "e2eSignOut"
 - tapOn:
     id: "e2eSignInBob"
+- extendedWaitUntil:
+    visible:
+      id: "viewHeaderHomeFeedPrefsBtn"
 - tapOn:
     id: "replyBtn"
 - inputText: "Reply 1"
@@ -28,8 +36,13 @@ appId: xyz.blueskyweb.app
     id: "composerPublishBtn"
 
 # Login, confirm notification exists, mute thread, and log out
+- tapOn:
+    id: "e2eSignOut"
 - tapOn:
     id: "e2eSignInAlice"
+- extendedWaitUntil:
+    visible:
+      id: "viewHeaderHomeFeedPrefsBtn"
 - tapOn:
     id: "bottomBarNotificationsBtn"
 - assertVisible:
@@ -39,12 +52,17 @@ appId: xyz.blueskyweb.app
 - tapOn:
     id: "postDropdownBtn"
     childOf:
-        id: "postThreadItem-by-bob.test"
+      id: "postThreadItem-by-bob.test"
 - tapOn: "Mute thread"
 
 # Login, reply to the thread twice, and log out
+- tapOn:
+    id: "e2eSignOut"
 - tapOn:
     id: "e2eSignInBob"
+- extendedWaitUntil:
+    visible:
+      id: "viewHeaderHomeFeedPrefsBtn"
 - tapOn:
     id: "bottomBarProfileBtn"
 - tapOn:
@@ -60,24 +78,35 @@ appId: xyz.blueskyweb.app
 - tapOn:
     id: "composerPublishBtn"
 
-
-# Login, confirm notifications dont exist, unmute the thread, confirm notifications exist
+# Login, confirm notifications dont exist, unmute the thread, ~~confirm notifications exist~~
+# Mute thread behaviour no longer change old notifications after muting/unmuting a thread -sfn
+- tapOn:
+    id: "e2eSignOut"
 - tapOn:
     id: "e2eSignInAlice"
+- extendedWaitUntil:
+    visible:
+      id: "viewHeaderHomeFeedPrefsBtn"
 - tapOn:
     id: "bottomBarNotificationsBtn"
-- assertNotVisible:
+- assertVisible: ".*Reply 1.*"
+- assertNotVisible: ".*Reply 2.*"
+- assertNotVisible: ".*Reply 3.*"
+- assertVisible:
     id: "feedItem-by-bob.test"
 - tapOn:
-    id: "bottomBarHomeBtn"
+    id: "feedItem-by-bob.test"
 - tapOn:
     id: "postDropdownBtn"
+    childOf:
+      id: "postThreadItem-by-bob.test"
 - tapOn: "Unmute thread"
 - tapOn:
     id: "bottomBarNotificationsBtn"
 - swipe:
     from:
-        id: "notifsFeed"
+      id: "notifsFeed"
     direction: DOWN
-- assertVisible:
-    id: "feedItem-by-bob.test"
+- assertVisible: ".*Reply 1.*"
+- assertNotVisible: ".*Reply 2.*"
+- assertNotVisible: ".*Reply 3.*"

__e2e__/mock-server.ts

@@ -1,520 +0,0 @@
-import {createServer as createHTTPServer} from 'node:http'
-import {parse} from 'node:url'
-
-import {createServer, TestPDS} from '../jest/test-pds'
-
-async function main() {
-  let server: TestPDS
-  createHTTPServer(async (req, res) => {
-    const url = parse(req.url || '/', true)
-    if (req.method !== 'POST') {
-      return res.writeHead(200).end()
-    }
-    try {
-      console.log('Closing old server')
-      await server?.close()
-      console.log('Starting new server')
-      const inviteRequired = url?.query && 'invite' in url.query
-      server = await createServer({inviteRequired})
-      console.log('Listening at', server.pdsUrl)
-      if (url?.query) {
-        if ('users' in url.query) {
-          console.log('Generating mock users')
-          await server.mocker.createUser('alice')
-          await server.mocker.createUser('bob')
-          await server.mocker.createUser('carla')
-          await server.mocker.users.alice.agent.upsertProfile(() => ({
-            displayName: 'Alice',
-            description: 'Test user 1',
-          }))
-          await server.mocker.users.bob.agent.upsertProfile(() => ({
-            displayName: 'Bob',
-            description: 'Test user 2',
-          }))
-          await server.mocker.users.carla.agent.upsertProfile(() => ({
-            displayName: 'Carla',
-            description: 'Test user 3',
-          }))
-          if (inviteRequired) {
-            await server.mocker.createInvite(server.mocker.users.alice.did)
-          }
-        }
-        if ('follows' in url.query) {
-          console.log('Generating mock follows')
-          await server.mocker.follow('alice', 'bob')
-          await server.mocker.follow('alice', 'carla')
-          await server.mocker.follow('bob', 'alice')
-          await server.mocker.follow('bob', 'carla')
-          await server.mocker.follow('carla', 'alice')
-          await server.mocker.follow('carla', 'bob')
-        }
-        if ('posts' in url.query) {
-          console.log('Generating mock posts')
-          for (let user in server.mocker.users) {
-            await server.mocker.users[user].agent.post({text: 'Post'})
-          }
-        }
-        if ('feeds' in url.query) {
-          console.log('Generating mock feed')
-          await server.mocker.createFeed('alice', 'alice-favs', [])
-        }
-        if ('thread' in url.query) {
-          console.log('Generating mock posts')
-          const res = await server.mocker.users.bob.agent.post({
-            text: 'Thread root',
-          })
-          await server.mocker.users.carla.agent.post({
-            text: 'Thread reply',
-            reply: {
-              parent: {cid: res.cid, uri: res.uri},
-              root: {cid: res.cid, uri: res.uri},
-            },
-          })
-        }
-        if ('mergefeed' in url.query) {
-          console.log('Generating mock users')
-          await server.mocker.createUser('alice')
-          await server.mocker.createUser('bob')
-          await server.mocker.createUser('carla')
-          await server.mocker.createUser('dan')
-          await server.mocker.users.alice.agent.upsertProfile(() => ({
-            displayName: 'Alice',
-            description: 'Test user 1',
-          }))
-          await server.mocker.users.bob.agent.upsertProfile(() => ({
-            displayName: 'Bob',
-            description: 'Test user 2',
-          }))
-          await server.mocker.users.carla.agent.upsertProfile(() => ({
-            displayName: 'Carla',
-            description: 'Test user 3',
-          }))
-          await server.mocker.users.dan.agent.upsertProfile(() => ({
-            displayName: 'Dan',
-            description: 'Test user 4',
-          }))
-          console.log('Generating mock follows')
-          await server.mocker.follow('alice', 'bob')
-          await server.mocker.follow('alice', 'carla')
-          console.log('Generating mock posts')
-          let posts: Record<string, any[]> = {
-            alice: [],
-            bob: [],
-            carla: [],
-            dan: [],
-          }
-          for (let i = 0; i < 10; i++) {
-            for (let user in server.mocker.users) {
-              if (user === 'alice') continue
-              posts[user].push(
-                await server.mocker.createPost(user, `Post ${i}`),
-              )
-            }
-          }
-          for (let i = 0; i < 10; i++) {
-            for (let user in server.mocker.users) {
-              if (user === 'alice') continue
-              if (i % 5 === 0) {
-                await server.mocker.createReply(user, 'Self reply', {
-                  cid: posts[user][i].cid,
-                  uri: posts[user][i].uri,
-                })
-              }
-              if (i % 5 === 1) {
-                await server.mocker.createReply(user, 'Reply to bob', {
-                  cid: posts.bob[i].cid,
-                  uri: posts.bob[i].uri,
-                })
-              }
-              if (i % 5 === 2) {
-                await server.mocker.createReply(user, 'Reply to dan', {
-                  cid: posts.dan[i].cid,
-                  uri: posts.dan[i].uri,
-                })
-              }
-              await server.mocker.users[user].agent.post({text: `Post ${i}`})
-            }
-          }
-          console.log('Generating mock feeds')
-          await server.mocker.createFeed(
-            'alice',
-            'alice-favs',
-            posts.dan.map(p => p.uri),
-          )
-          await server.mocker.createFeed(
-            'alice',
-            'alice-favs2',
-            posts.dan.map(p => p.uri),
-          )
-        }
-        if ('labels' in url.query) {
-          console.log('Generating naughty users with labels')
-
-          const anchorPost = await server.mocker.createPost(
-            'alice',
-            'Anchor post',
-          )
-
-          for (const user of [
-            'dmca-account',
-            'dmca-profile',
-            'dmca-posts',
-            'porn-account',
-            'porn-profile',
-            'porn-posts',
-            'nudity-account',
-            'nudity-profile',
-            'nudity-posts',
-            'scam-account',
-            'scam-profile',
-            'scam-posts',
-            'unknown-account',
-            'unknown-profile',
-            'unknown-posts',
-            'hide-account',
-            'hide-profile',
-            'hide-posts',
-            'no-promote-account',
-            'no-promote-profile',
-            'no-promote-posts',
-            'warn-account',
-            'warn-profile',
-            'warn-posts',
-            'muted-account',
-            'muted-by-list-account',
-            'blocking-account',
-            'blockedby-account',
-            'mutual-block-account',
-          ]) {
-            await server.mocker.createUser(user)
-            await server.mocker.follow('alice', user)
-            await server.mocker.follow(user, 'alice')
-            await server.mocker.createPost(user, `Unlabeled post from ${user}`)
-            await server.mocker.createReply(
-              user,
-              `Unlabeled reply from ${user}`,
-              anchorPost,
-            )
-            await server.mocker.like(user, anchorPost)
-          }
-
-          await server.mocker.labelAccount('dmca-violation', 'dmca-account')
-          await server.mocker.labelProfile('dmca-violation', 'dmca-profile')
-          await server.mocker.labelPost(
-            'dmca-violation',
-            await server.mocker.createPost('dmca-posts', 'dmca post'),
-          )
-          await server.mocker.labelPost(
-            'dmca-violation',
-            await server.mocker.createQuotePost(
-              'dmca-posts',
-              'dmca quote post',
-              anchorPost,
-            ),
-          )
-          await server.mocker.labelPost(
-            'dmca-violation',
-            await server.mocker.createReply(
-              'dmca-posts',
-              'dmca reply',
-              anchorPost,
-            ),
-          )
-
-          await server.mocker.labelAccount('porn', 'porn-account')
-          await server.mocker.labelProfile('porn', 'porn-profile')
-          await server.mocker.labelPost(
-            'porn',
-            await server.mocker.createImagePost('porn-posts', 'porn post'),
-          )
-          await server.mocker.labelPost(
-            'porn',
-            await server.mocker.createQuotePost(
-              'porn-posts',
-              'porn quote post',
-              anchorPost,
-            ),
-          )
-          await server.mocker.labelPost(
-            'porn',
-            await server.mocker.createReply(
-              'porn-posts',
-              'porn reply',
-              anchorPost,
-            ),
-          )
-
-          await server.mocker.labelAccount('nudity', 'nudity-account')
-          await server.mocker.labelProfile('nudity', 'nudity-profile')
-          await server.mocker.labelPost(
-            'nudity',
-            await server.mocker.createImagePost('nudity-posts', 'nudity post'),
-          )
-          await server.mocker.labelPost(
-            'nudity',
-            await server.mocker.createQuotePost(
-              'nudity-posts',
-              'nudity quote post',
-              anchorPost,
-            ),
-          )
-          await server.mocker.labelPost(
-            'nudity',
-            await server.mocker.createReply(
-              'nudity-posts',
-              'nudity reply',
-              anchorPost,
-            ),
-          )
-
-          await server.mocker.labelAccount('scam', 'scam-account')
-          await server.mocker.labelProfile('scam', 'scam-profile')
-          await server.mocker.labelPost(
-            'scam',
-            await server.mocker.createPost('scam-posts', 'scam post'),
-          )
-          await server.mocker.labelPost(
-            'scam',
-            await server.mocker.createQuotePost(
-              'scam-posts',
-              'scam quote post',
-              anchorPost,
-            ),
-          )
-          await server.mocker.labelPost(
-            'scam',
-            await server.mocker.createReply(
-              'scam-posts',
-              'scam reply',
-              anchorPost,
-            ),
-          )
-
-          await server.mocker.labelAccount(
-            'not-a-real-label',
-            'unknown-account',
-          )
-          await server.mocker.labelProfile(
-            'not-a-real-label',
-            'unknown-profile',
-          )
-          await server.mocker.labelPost(
-            'not-a-real-label',
-            await server.mocker.createPost('unknown-posts', 'unknown post'),
-          )
-          await server.mocker.labelPost(
-            'not-a-real-label',
-            await server.mocker.createQuotePost(
-              'unknown-posts',
-              'unknown quote post',
-              anchorPost,
-            ),
-          )
-          await server.mocker.labelPost(
-            'not-a-real-label',
-            await server.mocker.createReply(
-              'unknown-posts',
-              'unknown reply',
-              anchorPost,
-            ),
-          )
-
-          await server.mocker.labelAccount('!hide', 'hide-account')
-          await server.mocker.labelProfile('!hide', 'hide-profile')
-          await server.mocker.labelPost(
-            '!hide',
-            await server.mocker.createPost('hide-posts', 'hide post'),
-          )
-          await server.mocker.labelPost(
-            '!hide',
-            await server.mocker.createQuotePost(
-              'hide-posts',
-              'hide quote post',
-              anchorPost,
-            ),
-          )
-          await server.mocker.labelPost(
-            '!hide',
-            await server.mocker.createReply(
-              'hide-posts',
-              'hide reply',
-              anchorPost,
-            ),
-          )
-
-          await server.mocker.labelAccount('!no-promote', 'no-promote-account')
-          await server.mocker.labelProfile('!no-promote', 'no-promote-profile')
-          await server.mocker.labelPost(
-            '!no-promote',
-            await server.mocker.createPost(
-              'no-promote-posts',
-              'no-promote post',
-            ),
-          )
-          await server.mocker.labelPost(
-            '!no-promote',
-            await server.mocker.createQuotePost(
-              'no-promote-posts',
-              'no-promote quote post',
-              anchorPost,
-            ),
-          )
-          await server.mocker.labelPost(
-            '!no-promote',
-            await server.mocker.createReply(
-              'no-promote-posts',
-              'no-promote reply',
-              anchorPost,
-            ),
-          )
-
-          await server.mocker.labelAccount('!warn', 'warn-account')
-          await server.mocker.labelProfile('!warn', 'warn-profile')
-          await server.mocker.labelPost(
-            '!warn',
-            await server.mocker.createPost('warn-posts', 'warn post'),
-          )
-          await server.mocker.labelPost(
-            '!warn',
-            await server.mocker.createQuotePost(
-              'warn-posts',
-              'warn quote post',
-              anchorPost,
-            ),
-          )
-          await server.mocker.labelPost(
-            '!warn',
-            await server.mocker.createReply(
-              'warn-posts',
-              'warn reply',
-              anchorPost,
-            ),
-          )
-
-          await server.mocker.users.alice.agent.mute('muted-account.test')
-          await server.mocker.createPost('muted-account', 'muted post')
-          await server.mocker.createQuotePost(
-            'muted-account',
-            'muted quote post',
-            anchorPost,
-          )
-          await server.mocker.createReply(
-            'muted-account',
-            'muted reply',
-            anchorPost,
-          )
-
-          const list = await server.mocker.createMuteList(
-            'alice',
-            'Muted Users',
-          )
-          await server.mocker.addToMuteList(
-            'alice',
-            list,
-            server.mocker.users['muted-by-list-account'].did,
-          )
-          await server.mocker.createPost('muted-by-list-account', 'muted post')
-          await server.mocker.createQuotePost(
-            'muted-by-list-account',
-            'account quote post',
-            anchorPost,
-          )
-          await server.mocker.createReply(
-            'muted-by-list-account',
-            'account reply',
-            anchorPost,
-          )
-
-          await server.mocker.createPost('blocking-account', 'blocking post')
-          await server.mocker.createQuotePost(
-            'blocking-account',
-            'blocking quote post',
-            anchorPost,
-          )
-          await server.mocker.createReply(
-            'blocking-account',
-            'blocking reply',
-            anchorPost,
-          )
-          await server.mocker.users.alice.agent.app.bsky.graph.block.create(
-            {
-              repo: server.mocker.users.alice.did,
-            },
-            {
-              subject: server.mocker.users['blocking-account'].did,
-              createdAt: new Date().toISOString(),
-            },
-          )
-
-          await server.mocker.createPost('blockedby-account', 'blockedby post')
-          await server.mocker.createQuotePost(
-            'blockedby-account',
-            'blockedby quote post',
-            anchorPost,
-          )
-          await server.mocker.createReply(
-            'blockedby-account',
-            'blockedby reply',
-            anchorPost,
-          )
-          await server.mocker.users[
-            'blockedby-account'
-          ].agent.app.bsky.graph.block.create(
-            {
-              repo: server.mocker.users['blockedby-account'].did,
-            },
-            {
-              subject: server.mocker.users.alice.did,
-              createdAt: new Date().toISOString(),
-            },
-          )
-
-          await server.mocker.createPost(
-            'mutual-block-account',
-            'mutual-block post',
-          )
-          await server.mocker.createQuotePost(
-            'mutual-block-account',
-            'mutual-block quote post',
-            anchorPost,
-          )
-          await server.mocker.createReply(
-            'mutual-block-account',
-            'mutual-block reply',
-            anchorPost,
-          )
-          await server.mocker.users.alice.agent.app.bsky.graph.block.create(
-            {
-              repo: server.mocker.users.alice.did,
-            },
-            {
-              subject: server.mocker.users['mutual-block-account'].did,
-              createdAt: new Date().toISOString(),
-            },
-          )
-          await server.mocker.users[
-            'mutual-block-account'
-          ].agent.app.bsky.graph.block.create(
-            {
-              repo: server.mocker.users['mutual-block-account'].did,
-            },
-            {
-              subject: server.mocker.users.alice.did,
-              createdAt: new Date().toISOString(),
-            },
-          )
-
-          // flush caches
-          await server.mocker.testNet.processAll()
-        }
-      }
-      console.log('Ready')
-      return res.writeHead(200).end(server.pdsUrl)
-    } catch (e) {
-      console.error('Error!', e)
-      return res.writeHead(500).end()
-    }
-  }).listen(1986)
-  console.log('Mock server manager listening on 1986')
-}
-main()

__e2e__/perf-test.yml

@@ -1,4 +1,3 @@
-
 # flow.yaml
 
 appId: xyz.blueskyweb.app
@@ -33,7 +32,7 @@ appId: xyz.blueskyweb.app
     direction: "LEFT"
 - swipe:
     direction: "LEFT"
-- swipe: 
+- swipe:
     direction: "LEFT"
 - swipe:
     direction: "RIGHT"

__e2e__/setupApp.yml

@@ -1,13 +1,32 @@
 appId: xyz.blueskyweb.app
 ---
 - launchApp:
-   appId: "xyz.blueskyweb.app"
-   clearState: true
-- waitForAnimationToEnd
-- tapOn: "http://localhost:8081"
-- waitForAnimationToEnd
-- extendedWaitUntil:
-    visible: "Continue"
-- swipe:
-   from: "Bluesky"
-   direction: DOWN
+    appId: "xyz.blueskyweb.app"
+    clearState: true
+    arguments:
+      "-EXDevMenuIsOnboardingFinished": true
+- runFlow:
+    when:
+      platform: iOS
+    commands:
+      - openLink: "exp+bluesky://expo-development-client/?url=http%3A%2F%2Flocalhost%3A8081"
+      - runFlow:
+          when:
+            visible: 'Open in "Bluesky"'
+          commands:
+            - tapOn: Open
+- runFlow:
+    when:
+      platform: Android
+    commands:
+      - tapOn: 'http://localhost:8081'
+      - runFlow:
+          label: "Dismiss Expo dev menu"
+          when:
+            visible: "Continue"
+          commands:
+            - back
+- tapOn:
+    id: e2eProxyHeaderInput
+- inputText: ${output.result}
+- pressKey: Enter

__e2e__/setupServer.js

@@ -1,5 +1,8 @@
-// eslint-disable-next-line
-http.post('http://localhost:1986/' + SERVER_PATH, {
+// eslint-disable-next-line no-undef
+var res = http.post('http://localhost:1986/' + SERVER_PATH, {
   headers: {'Content-Type': 'text/plain'},
   body: '',
 })
+
+// eslint-disable-next-line no-undef
+output.result = json(res.body).appviewDid

__mocks__/@gorhom/bottom-sheet.tsx

@@ -1,7 +1,8 @@
-import React, {ReactNode} from 'react'
-import {View, ScrollView, Modal, FlatList, TextInput} from 'react-native'
+import React, {type ReactNode} from 'react'
+import {FlatList, Modal, ScrollView, TextInput, View} from 'react-native'
 
 const BottomSheetModalContext = React.createContext(null)
+BottomSheetModalContext.displayName = 'BottomSheetModalContext'
 
 const BottomSheetModalProvider = (props: any) => {
   return <BottomSheetModalContext.Provider {...props} value={{}} />
@@ -47,13 +48,13 @@ export {useBottomSheetInternal}
 export {useBottomSheetDynamicSnapPoints}
 
 export {
-  BottomSheetModalProvider,
   BottomSheetBackdrop,
+  BottomSheetFlatList,
+  BottomSheetFooter,
   BottomSheetHandle,
   BottomSheetModal,
-  BottomSheetFooter,
+  BottomSheetModalProvider,
   BottomSheetScrollView,
-  BottomSheetFlatList,
   BottomSheetTextInput,
 }
 

__mocks__/@notifee/react-native.ts

@@ -1,6 +0,0 @@
-export default {
-  requestPermission: jest.fn(),
-  onForegroundEvent: jest.fn(),
-  setBadgeCount: jest.fn(),
-  displayNotification: jest.fn(),
-}

__mocks__/@react-native-camera-roll/camera-roll.js

@@ -1,9 +0,0 @@
-export const CameraRoll = {
-  getPhotos: jest.fn().mockResolvedValue({
-    edges: [
-      {node: {image: {uri: 'path/to/image1.jpg'}}},
-      {node: {image: {uri: 'path/to/image2.jpg'}}},
-      {node: {image: {uri: 'path/to/image3.jpg'}}},
-    ],
-  }),
-}

__mocks__/react-native-background-fetch.ts

@@ -1,4 +0,0 @@
-export default {
-  configure: jest.fn().mockResolvedValue(0),
-  finish: jest.fn(),
-}

__mocks__/react-native-fs.js

@@ -1 +0,0 @@
-export default {}

__mocks__/rn-fetch-blob.js

@@ -1,10 +0,0 @@
-jest.mock('rn-fetch-blob', () => {
-  return {
-    __esModule: true,
-    default: {
-      fs: {
-        unlink: jest.fn(),
-      },
-    },
-  }
-})

__mocks__/zeego/dropdown-menu.js

@@ -1,2 +0,0 @@
-export const DropdownMenu = jest.fn().mockImplementation(() => {})
-export const create = jest.fn().mockImplementation(() => {})

__tests__/lib/images.test.ts

@@ -1,11 +1,12 @@
-import {createDownloadResumable, deleteAsync} from 'expo-file-system'
+import {createDownloadResumable, deleteAsync} from 'expo-file-system/legacy'
 import {manipulateAsync, SaveFormat} from 'expo-image-manipulator'
 
+import {IMAGE_SIZE_CONFIG_2K_1MB} from '../../src/lib/constants'
 import {
   downloadAndResize,
   type DownloadAndResizeOpts,
-  getResizedDimensions,
 } from '../../src/lib/media/manip'
+import {getResizedDimensions} from '../../src/lib/media/util'
 
 const mockResizedImage = {
   path: 'file://resized-image.jpg',
@@ -41,10 +42,8 @@ describe('downloadAndResize', () => {
 
     const opts: DownloadAndResizeOpts = {
       uri: 'https://example.com/image.jpg',
-      width: 100,
-      height: 100,
+      maxDimension: 2000,
       maxSize: 500000,
-      mode: 'cover',
       timeout: 10000,
     }
 
@@ -60,9 +59,11 @@ describe('downloadAndResize', () => {
 
     // First time it gets called is to get dimensions
     expect(manipulateAsync).toHaveBeenCalledWith(expect.any(String), [], {})
+    // The mocked source image is 100x100, below maxDimension, so it is not
+    // downsized.
     expect(manipulateAsync).toHaveBeenCalledWith(
       expect.any(String),
-      [{resize: {height: opts.height, width: opts.width}}],
+      [{resize: {height: 100, width: 100}}],
       {format: SaveFormat.JPEG, compress: 1.0},
     )
     expect(deleteAsync).toHaveBeenCalledWith(expect.any(String), {
@@ -73,10 +74,8 @@ describe('downloadAndResize', () => {
   it('should return undefined for invalid URI', async () => {
     const opts: DownloadAndResizeOpts = {
       uri: 'invalid-uri',
-      width: 100,
-      height: 100,
+      maxDimension: 2000,
       maxSize: 500000,
-      mode: 'cover',
       timeout: 10000,
     }
 
@@ -90,13 +89,19 @@ describe('downloadAndResize', () => {
       width: 1200,
       height: 1000,
     }
-    const resizedDimensionsOne = getResizedDimensions(initialDimensionsOne)
+    const resizedDimensionsOne = getResizedDimensions(
+      initialDimensionsOne,
+      IMAGE_SIZE_CONFIG_2K_1MB.maxDimension,
+    )
 
     const initialDimensionsTwo = {
       width: 1000,
       height: 1200,
     }
-    const resizedDimensionsTwo = getResizedDimensions(initialDimensionsTwo)
+    const resizedDimensionsTwo = getResizedDimensions(
+      initialDimensionsTwo,
+      IMAGE_SIZE_CONFIG_2K_1MB.maxDimension,
+    )
 
     expect(resizedDimensionsOne).toEqual(initialDimensionsOne)
     expect(resizedDimensionsTwo).toEqual(initialDimensionsTwo)
@@ -107,13 +112,19 @@ describe('downloadAndResize', () => {
       width: 3000,
       height: 1500,
     }
-    const resizedDimensionsOne = getResizedDimensions(initialDimensionsOne)
+    const resizedDimensionsOne = getResizedDimensions(
+      initialDimensionsOne,
+      IMAGE_SIZE_CONFIG_2K_1MB.maxDimension,
+    )
 
     const initialDimensionsTwo = {
       width: 2000,
       height: 4000,
     }
-    const resizedDimensionsTwo = getResizedDimensions(initialDimensionsTwo)
+    const resizedDimensionsTwo = getResizedDimensions(
+      initialDimensionsTwo,
+      IMAGE_SIZE_CONFIG_2K_1MB.maxDimension,
+    )
 
     expect(resizedDimensionsOne).toEqual({
       width: 2000,

__tests__/lib/link-meta.test.ts

@@ -1,4 +1,4 @@
-import {LikelyType, getLikelyType} from '../../src/lib/link-meta/link-meta'
+import {getLikelyType, LikelyType} from '../../src/lib/link-meta/link-meta'
 
 describe('getLikelyType', () => {
   it('correctly handles non-parsed url', async () => {

__tests__/lib/string.test.ts

@@ -1,4 +1,5 @@
 import {RichText} from '@atproto/api'
+import {i18n} from '@lingui/core'
 
 import {parseEmbedPlayerFromUrl} from '#/lib/strings/embed-player'
 import {
@@ -6,6 +7,8 @@ import {
   createStarterPackLinkFromAndroidReferrer,
   parseStarterPackUri,
 } from '#/lib/strings/starter-pack'
+import {messages} from '#/locale/locales/en/messages'
+import {klipyUrlToBskyGifUrl} from '#/features/gifPicker/utils'
 import {cleanError} from '../../src/lib/strings/errors'
 import {createFullHandle, makeValidHandle} from '../../src/lib/strings/handles'
 import {enforceLen} from '../../src/lib/strings/helpers'
@@ -201,6 +204,9 @@ describe('enforceLen', () => {
 })
 
 describe('cleanError', () => {
+  // cleanError uses lingui
+  i18n.loadAndActivate({locale: 'en', messages})
+
   const inputs = [
     'TypeError: Network request failed',
     'Error: Aborted',
@@ -326,6 +332,7 @@ describe('shortenLinks', () => {
       expect(outputRT.text).toEqual(outputs[i][0])
       expect(outputRT.facets?.length).toEqual(outputs[i][1].length)
       for (let j = 0; j < outputs[i][1].length; j++) {
+        // @ts-expect-error whatever
         expect(outputRT.facets![j].features[0].uri).toEqual(outputs[i][1][j])
       }
     }
@@ -377,6 +384,7 @@ describe('parseEmbedPlayerFromUrl', () => {
     'https://music.apple.com/us/playlist/playlistName/playlistId',
     'https://music.apple.com/us/album/albumName/albumId',
     'https://music.apple.com/us/album/albumName/albumId?i=songId',
+    'https://music.apple.com/us/song/songName/songId',
 
     'https://vimeo.com/videoId',
     'https://vimeo.com/videoId?autoplay=0',
@@ -435,6 +443,20 @@ describe('parseEmbedPlayerFromUrl', () => {
 
     'https://www.flickr.com/groups/898944@N23/',
     'https://www.flickr.com/groups',
+
+    'https://maxblansjaar.bandcamp.com/album/false-comforts',
+    'https://grmnygrmny.bandcamp.com/track/fluid',
+    'https://sufjanstevens.bandcamp.com/',
+    'https://sufjanstevens.bandcamp.com',
+    'https://bandcamp.com/',
+    'https://bandcamp.com',
+
+    'https://static.klipy.com/ii/abc123/73/ac/someFile.gif?hh=200&ww=300',
+    'https://static.klipy.com/ii/abc123/73/ac/someFile.gif?hh=200&ww=300&mp4=videoSlugMp4&webm=videoSlugWebm',
+    'https://static.klipy.com/ii/abc123/73/ac/someFile.gif?hh=200',
+    'https://static.klipy.com/ii/abc123/73/ac/someFile.gif',
+    'https://static.klipy.com/other/path.gif?hh=200&ww=300',
+    'https://static.klipy.com',
   ]
 
   const outputs = [
@@ -603,6 +625,11 @@ describe('parseEmbedPlayerFromUrl', () => {
       playerUri:
         'https://embed.music.apple.com/us/album/albumName/albumId?i=songId',
     },
+    {
+      type: 'apple_music_song',
+      source: 'appleMusic',
+      playerUri: 'https://embed.music.apple.com/us/song/songName/songId',
+    },
 
     {
       type: 'vimeo_video',
@@ -808,6 +835,52 @@ describe('parseEmbedPlayerFromUrl', () => {
 
     undefined,
     undefined,
+
+    {
+      type: 'bandcamp_album',
+      source: 'bandcamp',
+      playerUri:
+        'https://bandcamp.com/EmbeddedPlayer/url=https%3A%2F%2Fmaxblansjaar.bandcamp.com%2Falbum%2Ffalse-comforts/size=large/bgcol=ffffff/linkcol=0687f5/minimal=true/transparent=true/',
+    },
+    {
+      type: 'bandcamp_track',
+      source: 'bandcamp',
+      playerUri:
+        'https://bandcamp.com/EmbeddedPlayer/url=https%3A%2F%2Fgrmnygrmny.bandcamp.com%2Ftrack%2Ffluid/size=large/bgcol=ffffff/linkcol=0687f5/minimal=true/transparent=true/',
+    },
+    undefined,
+    undefined,
+    undefined,
+    undefined,
+
+    {
+      type: 'klipy_gif',
+      source: 'klipy',
+      isGif: true,
+      hideDetails: true,
+      playerUri: 'https://k.gifs.bsky.app/ii/abc123/73/ac/someFile.gif',
+      dimensions: {
+        width: 300,
+        height: 200,
+      },
+    },
+    // With video slug params — on native (test env), keeps gif filename,
+    // strips mp4/webm params. On web, would swap to video filename.
+    {
+      type: 'klipy_gif',
+      source: 'klipy',
+      isGif: true,
+      hideDetails: true,
+      playerUri: 'https://k.gifs.bsky.app/ii/abc123/73/ac/someFile.gif',
+      dimensions: {
+        width: 300,
+        height: 200,
+      },
+    },
+    undefined,
+    undefined,
+    undefined,
+    undefined,
   ]
 
   it('correctly grabs the correct id from uri', () => {
@@ -950,20 +1023,20 @@ describe('parseStarterPackHttpUri', () => {
   })
 
   it('returns the at uri when the input is a valid starterpack at uri', () => {
-    const validAtUri = 'at://did:123/app.bsky.graph.starterpack/rkey'
+    const validAtUri = 'at://did:plc:123/app.bsky.graph.starterpack/rkey'
     expect(parseStarterPackUri(validAtUri)).toEqual({
-      name: 'did:123',
+      name: 'did:plc:123',
       rkey: 'rkey',
     })
   })
 
   it('returns null when the at uri has no rkey', () => {
-    const validAtUri = 'at://did:123/app.bsky.graph.starterpack'
+    const validAtUri = 'at://did:plc:123/app.bsky.graph.starterpack'
     expect(parseStarterPackUri(validAtUri)).toEqual(null)
   })
 
   it('returns null when the collection is not app.bsky.graph.starterpack', () => {
-    const validAtUri = 'at://did:123/app.bsky.graph.list/rkey'
+    const validAtUri = 'at://did:plc:123/app.bsky.graph.list/rkey'
     expect(parseStarterPackUri(validAtUri)).toEqual(null)
   })
 
@@ -997,3 +1070,31 @@ describe('createStarterPackGooglePlayUri', () => {
     expect(createStarterPackGooglePlayUri(undefined, 'rkey')).toEqual(null)
   })
 })
+
+describe('klipyUrlToBskyGifUrl', () => {
+  const inputs = [
+    'https://static.klipy.com/ii/abc123/73/ac/someFile.gif',
+    'https://static.klipy.com/ii/abc123/73/ac/someFile.gif?hh=200&ww=300',
+  ]
+
+  it.each(inputs)(
+    'returns url with k.gifs.bsky.app as hostname for input url',
+    input => {
+      const out = klipyUrlToBskyGifUrl(input)
+      expect(out.startsWith('https://k.gifs.bsky.app/')).toEqual(true)
+    },
+  )
+
+  it('preserves the path and query params when rewriting', () => {
+    const out = klipyUrlToBskyGifUrl(
+      'https://static.klipy.com/ii/abc123/73/ac/someFile.gif?hh=200&ww=300',
+    )
+    expect(out).toEqual(
+      'https://k.gifs.bsky.app/ii/abc123/73/ac/someFile.gif?hh=200&ww=300',
+    )
+  })
+
+  it('returns empty string for invalid URLs', () => {
+    expect(klipyUrlToBskyGifUrl('not-a-url')).toEqual('')
+  })
+})

__tests__/lib/strings/handles.test.ts

@@ -1,4 +1,4 @@
-import {IsValidHandle, validateServiceHandle} from '#/lib/strings/handles'
+import {type IsValidHandle, validateServiceHandle} from '#/lib/strings/handles'
 
 describe('handle validation', () => {
   const valid = [
@@ -18,17 +18,17 @@ describe('handle validation', () => {
   })
 
   const invalid = [
-    ['al', 'bsky.social', 'frontLength'],
+    ['al', 'bsky.social', 'frontLengthNotTooShort'],
     ['-alice', 'bsky.social', 'hyphenStartOrEnd'],
     ['alice-', 'bsky.social', 'hyphenStartOrEnd'],
     ['%%%', 'bsky.social', 'handleChars'],
-    ['1234567890123456789', 'bsky.social', 'frontLength'],
+    ['1234567890123456789', 'bsky.social', 'frontLengthNotTooLong'],
     [
       '1234567890123456789',
       'my-custom-pds-with-long-name.social',
-      'frontLength',
+      'frontLengthNotTooLong',
     ],
-    ['al', 'my-custom-pds-with-long-name.social', 'frontLength'],
+    ['al', 'my-custom-pds-with-long-name.social', 'frontLengthNotTooShort'],
     ['a'.repeat(300), 'toolong.com', 'totalLength'],
   ] satisfies [string, string, keyof IsValidHandle][]
   it.each(invalid)(

__tests__/lib/strings/mention-manip.test.ts

@@ -32,6 +32,7 @@ describe('getMentionAt', () => {
     ['@alice hello', 7, undefined],
     ['alice@alice', 0, undefined],
     ['alice@alice', 6, undefined],
+    ['hello @alice-com goodbye', 8, 'alice-com'],
   ]
 
   it.each(cases)(
@@ -72,6 +73,7 @@ describe('insertMentionAt', () => {
     ['@alice hello', 7, '@alice hello'],
     ['alice@alice', 0, 'alice@alice'],
     ['alice@alice', 6, 'alice@alice'],
+    ['hello @alice-com goodbye', 10, 'hello @alice.com  goodbye'],
   ]
 
   it.each(cases)(

__tests__/lib/strings/url-helpers.test.ts

@@ -1,6 +1,7 @@
 import {describe, expect, it} from '@jest/globals'
 
 import {
+  getChatInviteCodeFromUrl,
   isPossiblyAUrl,
   isTrustedUrl,
   linkRequiresWarning,
@@ -178,3 +179,47 @@ describe('isTrustedUrl', () => {
     expect(output).toEqual(expected)
   })
 })
+
+describe('getChatInviteCodeFromUrl', () => {
+  type Case = [string, string | undefined]
+
+  const cases: Case[] = [
+    ['https://bsky.app/chat/abcdefg', 'abcdefg'],
+    ['https://bsky.app/chat/abcdefghij', 'abcdefghij'],
+    // http is not recognized as a bsky.app url
+    ['http://bsky.app/chat/abcdefg', undefined],
+    ['https://bsky.app/chat/abcdefg?utm=foo', 'abcdefg'],
+    ['https://bsky.app/chat/abcdefg#section', 'abcdefg'],
+    ['/chat/abcdefg', 'abcdefg'],
+    ['/chat/abcdefg?utm=foo', 'abcdefg'],
+    ['/chat/abcdefg#section', 'abcdefg'],
+
+    // too short
+    ['https://bsky.app/chat/abcdef', undefined],
+    ['/chat/abcdef', undefined],
+    // too long
+    ['https://bsky.app/chat/abcdefghijk', undefined],
+    ['/chat/abcdefghijk', undefined],
+    // invalid characters
+    ['https://bsky.app/chat/abc-def', undefined],
+    ['/chat/abc def', undefined],
+    // trailing path
+    ['https://bsky.app/chat/abcdefg/extra', undefined],
+    ['/chat/abcdefg/extra', undefined],
+    // wrong path
+    ['https://bsky.app/profile/abcdefg', undefined],
+    ['https://bsky.app/chat', undefined],
+    // wrong host
+    ['https://example.com/chat/abcdefg', undefined],
+    // not a url, not a path
+    ['chat/abcdefg', undefined],
+    ['abcdefg', undefined],
+    ['', undefined],
+    // malformed url
+    ['https://[invalid/chat/abcdefg', undefined],
+  ]
+
+  it.each(cases)('given input %p, returns %p', (input, expected) => {
+    expect(getChatInviteCodeFromUrl(input)).toEqual(expected)
+  })
+})

app.config.js

@@ -1,5 +1,10 @@
+// @ts-check
 const pkg = require('./package.json')
 
+/**
+ * @param {import('@expo/config-types').ExpoConfig} _config
+ * @returns {{ expo: import('@expo/config-types').ExpoConfig }}
+ */
 module.exports = function (_config) {
   /**
    * App version number. Should be incremented as part of a release cycle.
@@ -11,11 +16,11 @@ module.exports = function (_config) {
    *
    * @see https://docs.expo.dev/build-reference/variables/#built-in-environment-variables
    */
-  const PLATFORM = process.env.EAS_BUILD_PLATFORM
+  const PLATFORM = process.env.EAS_BUILD_PLATFORM ?? 'web'
 
   const IS_TESTFLIGHT = process.env.EXPO_PUBLIC_ENV === 'testflight'
   const IS_PRODUCTION = process.env.EXPO_PUBLIC_ENV === 'production'
-  const IS_DEV = !IS_TESTFLIGHT || !IS_PRODUCTION
+  const IS_DEV = !IS_TESTFLIGHT && !IS_PRODUCTION
 
   const ASSOCIATED_DOMAINS = [
     'applinks:bsky.app',
@@ -26,15 +31,17 @@ module.exports = function (_config) {
     ...(IS_DEV || IS_TESTFLIGHT ? [] : []),
   ]
 
-  const UPDATES_CHANNEL = IS_TESTFLIGHT
-    ? 'testflight'
-    : IS_PRODUCTION
-    ? 'production'
-    : undefined
-  const UPDATES_ENABLED = !!UPDATES_CHANNEL
+  const UPDATES_ENABLED = IS_TESTFLIGHT || IS_PRODUCTION
 
   const USE_SENTRY = Boolean(process.env.SENTRY_AUTH_TOKEN)
 
+  const IOS_ICON_FILE =
+    PLATFORM === 'web' // web build doesn't like .icon files
+      ? './assets/app-icons/ios_icon_default_next.png'
+      : IS_TESTFLIGHT
+        ? './assets/app-icons/ios_icon_testflight.icon'
+        : './assets/app-icons/ios_icon_default.icon'
+
   return {
     expo: {
       version: VERSION,
@@ -45,17 +52,22 @@ module.exports = function (_config) {
       runtimeVersion: {
         policy: 'appVersion',
       },
-      icon: './assets/app-icons/ios_icon_default_light.png',
+      icon: './assets/app-icons/ios_icon_default_next.png',
       userInterfaceStyle: 'automatic',
-      primaryColor: '#1083fe',
+      primaryColor: '#006AFF',
+      newArchEnabled: false,
       ios: {
         supportsTablet: false,
         bundleIdentifier: 'xyz.blueskyweb.app',
+        appleTeamId: process.env.EXPO_APPLE_TEAM_ID,
         config: {
           usesNonExemptEncryption: false,
         },
+        icon: IOS_ICON_FILE,
         infoPlist: {
+          CADisableMinimumFrameDurationOnPhone: true,
           UIBackgroundModes: ['remote-notification'],
+          NSUserActivityTypes: ['INSendMessageIntent'],
           NSCameraUsageDescription:
             'Used for profile pictures, posts, and other kinds of content.',
           NSMicrophoneUsageDescription:
@@ -70,6 +82,7 @@ module.exports = function (_config) {
             'an',
             'ast',
             'ca',
+            'cs',
             'cy',
             'da',
             'de',
@@ -113,8 +126,38 @@ module.exports = function (_config) {
           'com.apple.developer.kernel.increased-memory-limit': true,
           'com.apple.developer.kernel.extended-virtual-addressing': true,
           'com.apple.security.application-groups': 'group.app.bsky',
+          'com.apple.developer.usernotifications.communication': true,
+          // 'com.apple.developer.device-information.user-assigned-device-name': true,
         },
         privacyManifests: {
+          NSPrivacyCollectedDataTypes: [
+            {
+              NSPrivacyCollectedDataType: 'NSPrivacyCollectedDataTypeCrashData',
+              NSPrivacyCollectedDataTypeLinked: false,
+              NSPrivacyCollectedDataTypeTracking: false,
+              NSPrivacyCollectedDataTypePurposes: [
+                'NSPrivacyCollectedDataTypePurposeAppFunctionality',
+              ],
+            },
+            {
+              NSPrivacyCollectedDataType:
+                'NSPrivacyCollectedDataTypePerformanceData',
+              NSPrivacyCollectedDataTypeLinked: false,
+              NSPrivacyCollectedDataTypeTracking: false,
+              NSPrivacyCollectedDataTypePurposes: [
+                'NSPrivacyCollectedDataTypePurposeAppFunctionality',
+              ],
+            },
+            {
+              NSPrivacyCollectedDataType:
+                'NSPrivacyCollectedDataTypeOtherDiagnosticData',
+              NSPrivacyCollectedDataTypeLinked: false,
+              NSPrivacyCollectedDataTypeTracking: false,
+              NSPrivacyCollectedDataTypePurposes: [
+                'NSPrivacyCollectedDataTypePurposeAppFunctionality',
+              ],
+            },
+          ],
           NSPrivacyAccessedAPITypes: [
             {
               NSPrivacyAccessedAPIType:
@@ -146,12 +189,11 @@ module.exports = function (_config) {
         barStyle: 'light-content',
       },
       android: {
-        icon: './assets/app-icons/android_icon_default_light.png',
+        icon: './assets/app-icons/android_icon_default_next.png',
         adaptiveIcon: {
           foregroundImage: './assets/icon-android-foreground.png',
-          monochromeImage: './assets/icon-android-foreground.png',
-          backgroundImage: './assets/icon-android-background.png',
-          backgroundColor: '#1185FE',
+          monochromeImage: './assets/icon-android-monochrome.png',
+          backgroundColor: '#006AFF',
         },
         googleServicesFile: './google-services.json',
         package: 'xyz.blueskyweb.app',
@@ -164,10 +206,14 @@ module.exports = function (_config) {
                 scheme: 'https',
                 host: 'bsky.app',
               },
-              IS_DEV && {
-                scheme: 'http',
-                host: 'localhost:19006',
-              },
+              ...(IS_DEV
+                ? [
+                    {
+                      scheme: 'http',
+                      host: 'localhost:19006',
+                    },
+                  ]
+                : []),
             ],
             category: ['BROWSABLE', 'DEFAULT'],
           },
@@ -190,7 +236,6 @@ module.exports = function (_config) {
             }
           : undefined,
         checkAutomatically: 'NEVER',
-        channel: UPDATES_CHANNEL,
       },
       plugins: [
         'expo-video',
@@ -200,26 +245,39 @@ module.exports = function (_config) {
           'react-native-edge-to-edge',
           {android: {enforceNavigationBarContrast: false}},
         ],
-        USE_SENTRY && [
-          '@sentry/react-native/expo',
-          {
-            organization: 'blueskyweb',
-            project: 'app',
-            url: 'https://sentry.io',
-          },
-        ],
+        ...(USE_SENTRY
+          ? [
+              /** @type {[string, any]} */ ([
+                '@sentry/react-native/expo',
+                {
+                  organization: 'blueskyweb',
+                  project: 'app',
+                  url: 'https://sentry.io',
+                },
+              ]),
+            ]
+          : []),
         [
           'expo-build-properties',
           {
             ios: {
               deploymentTarget: '15.1',
-              newArchEnabled: false,
+              buildReactNativeFromSource: true,
+              ccacheEnabled: IS_DEV,
+              cxxLanguageStandard: 'c++23',
+              extraPods: [
+                {
+                  name: 'MCEmojiPicker',
+                  git: 'https://github.com/bluesky-social/MCEmojiPicker.git',
+                  branch: 'main',
+                },
+              ],
             },
             android: {
-              compileSdkVersion: 35,
+              compileSdkVersion: 36,
               targetSdkVersion: 35,
               buildToolsVersion: '35.0.0',
-              newArchEnabled: true,
+              buildReactNativeFromSource: IS_PRODUCTION,
             },
           },
         ],
@@ -240,10 +298,10 @@ module.exports = function (_config) {
         ],
         './plugins/starterPackAppClipExtension/withStarterPackAppClip.js',
         './plugins/withGradleJVMHeapSizeIncrease.js',
-        './plugins/withAndroidManifestPlugin.js',
+        './plugins/withAndroidManifestLargeHeapPlugin.js',
         './plugins/withAndroidManifestFCMIconPlugin.js',
+        './plugins/withAndroidManifestIntentQueriesPlugin.js',
         './plugins/withAndroidStylesAccentColorPlugin.js',
-        './plugins/withAndroidDayNightThemePlugin.js',
         './plugins/withAndroidNoJitpackPlugin.js',
         './plugins/shareExtension/withShareExtensions.js',
         './plugins/notificationsExtension/withNotificationsExtension.js',
@@ -256,10 +314,12 @@ module.exports = function (_config) {
               // Android only
               './assets/fonts/inter/Inter-Regular.otf',
               './assets/fonts/inter/Inter-Italic.otf',
+              './assets/fonts/inter/Inter-Medium.otf',
+              './assets/fonts/inter/Inter-MediumItalic.otf',
               './assets/fonts/inter/Inter-SemiBold.otf',
               './assets/fonts/inter/Inter-SemiBoldItalic.otf',
-              './assets/fonts/inter/Inter-ExtraBold.otf',
-              './assets/fonts/inter/Inter-ExtraBoldItalic.otf',
+              './assets/fonts/inter/Inter-Bold.otf',
+              './assets/fonts/inter/Inter-BoldItalic.otf',
             ],
           },
         ],
@@ -267,43 +327,43 @@ module.exports = function (_config) {
           'expo-splash-screen',
           {
             ios: {
-              enableFullScreenImage_legacy: true,
-              backgroundColor: '#ffffff',
-              image: './assets/splash.png',
+              enableFullScreenImage_legacy: true, // iOS only
+              backgroundColor: '#006AFF', // primary_500
+              image: './assets/splash/splash.png',
               resizeMode: 'cover',
               dark: {
-                enableFullScreenImage_legacy: true,
-                backgroundColor: '#001429',
-                image: './assets/splash-dark.png',
+                enableFullScreenImage_legacy: true, // iOS only
+                backgroundColor: '#002861', // primary_900
+                image: './assets/splash/splash-dark.png',
                 resizeMode: 'cover',
               },
             },
             android: {
-              backgroundColor: '#0c7cff',
-              image: './assets/splash-android-icon.png',
-              imageWidth: 150,
+              backgroundColor: '#006AFF', // primary_500
+              image: './assets/splash/android-splash-logo-white.png',
+              imageWidth: 102, // even division of 306px
               dark: {
-                backgroundColor: '#0c2a49',
-                image: './assets/splash-android-icon-dark.png',
-                imageWidth: 150,
+                backgroundColor: '#002861', // primary_900
+                image: './assets/splash/android-splash-logo-white.png',
+                imageWidth: 102,
               },
             },
           },
         ],
         [
-          '@mozzius/expo-dynamic-app-icon',
+          '@bsky.app/expo-dynamic-app-icon',
           {
             /**
              * Default set
              */
             default_light: {
-              ios: './assets/app-icons/ios_icon_default_light.png',
-              android: './assets/app-icons/android_icon_default_light.png',
+              ios: './assets/app-icons/ios_icon_legacy_light.png',
+              android: './assets/app-icons/android_icon_legacy_light.png',
               prerendered: true,
             },
             default_dark: {
-              ios: './assets/app-icons/ios_icon_default_dark.png',
-              android: './assets/app-icons/android_icon_default_dark.png',
+              ios: './assets/app-icons/ios_icon_legacy_dark.png',
+              android: './assets/app-icons/android_icon_legacy_dark.png',
               prerendered: true,
             },
 
@@ -358,7 +418,15 @@ module.exports = function (_config) {
           },
         ],
         ['expo-screen-orientation', {initialOrientation: 'PORTRAIT_UP'}],
-      ].filter(Boolean),
+        ['expo-location'],
+        [
+          'expo-contacts',
+          {
+            contactsPermission:
+              'I agree to allow Bluesky to use my contacts for friend discovery until I opt out.',
+          },
+        ],
+      ],
       extra: {
         eas: {
           build: {

assets/app-icons/ios_icon_default.icon/icon.json

@@ -0,0 +1,31 @@
+{
+  "fill" : {
+    "automatic-gradient" : "srgb:0.00000,0.41569,1.00000,1.00000"
+  },
+  "groups" : [
+    {
+      "layers" : [
+        {
+          "fill" : "none",
+          "glass" : false,
+          "image-name" : "iOS transparent.png",
+          "name" : "iOS transparent"
+        }
+      ],
+      "shadow" : {
+        "kind" : "neutral",
+        "opacity" : 0.5
+      },
+      "translucency" : {
+        "enabled" : true,
+        "value" : 0.5
+      }
+    }
+  ],
+  "supported-platforms" : {
+    "circles" : [
+      "watchOS"
+    ],
+    "squares" : "shared"
+  }
+}

assets/app-icons/ios_icon_testflight.icon/icon.json

@@ -0,0 +1,113 @@
+{
+  "fill" : {
+    "automatic-gradient" : "srgb:1.00000,1.00000,1.00000,1.00000"
+  },
+  "groups" : [
+    {
+      "blend-mode-specializations" : [
+        {
+          "value" : "overlay"
+        },
+        {
+          "appearance" : "dark",
+          "value" : "screen"
+        },
+        {
+          "appearance" : "tinted",
+          "value" : "screen"
+        }
+      ],
+      "blur-material-specializations" : [
+        {
+          "value" : 0.5
+        },
+        {
+          "appearance" : "dark",
+          "value" : 0.5
+        },
+        {
+          "appearance" : "tinted",
+          "value" : null
+        }
+      ],
+      "hidden" : false,
+      "layers" : [
+        {
+          "image-name" : "TestFlight notice.png",
+          "name" : "TestFlight notice"
+        }
+      ],
+      "lighting" : "individual",
+      "position" : {
+        "scale" : 0.4,
+        "translation-in-points" : [
+          0,
+          350
+        ]
+      },
+      "shadow" : {
+        "kind" : "neutral",
+        "opacity" : 0.5
+      },
+      "specular-specializations" : [
+        {
+          "value" : false
+        },
+        {
+          "appearance" : "dark",
+          "value" : false
+        },
+        {
+          "appearance" : "tinted",
+          "value" : false
+        }
+      ],
+      "translucency-specializations" : [
+        {
+          "value" : {
+            "enabled" : true,
+            "value" : 0.5
+          }
+        },
+        {
+          "appearance" : "dark",
+          "value" : {
+            "enabled" : true,
+            "value" : 0.5
+          }
+        },
+        {
+          "appearance" : "tinted",
+          "value" : {
+            "enabled" : true,
+            "value" : 0.5
+          }
+        }
+      ]
+    },
+    {
+      "layers" : [
+        {
+          "fill" : "none",
+          "glass" : false,
+          "image-name" : "iOS transparent.png",
+          "name" : "iOS transparent"
+        }
+      ],
+      "shadow" : {
+        "kind" : "neutral",
+        "opacity" : 0.5
+      },
+      "translucency" : {
+        "enabled" : true,
+        "value" : 0.5
+      }
+    }
+  ],
+  "supported-platforms" : {
+    "circles" : [
+      "watchOS"
+    ],
+    "squares" : "shared"
+  }
+}

assets/icons/arrowBoxRight_stroke2_corner3_rounded.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><path fill="#000" d="M17 3a4 4 0 0 1 4 4v10a4 4 0 0 1-4 4h-2a1 1 0 1 1 0-2h2a2 2 0 0 0 2-2V7a2 2 0 0 0-2-2h-2a1 1 0 1 1 0-2h2Zm-6.707 4.793a1 1 0 0 1 1.414 0l3.5 3.5a1 1 0 0 1 0 1.414l-3.5 3.5a1 1 0 1 1-1.414-1.414L12.086 13H4a1 1 0 1 1 0-2h8.086l-1.793-1.793a1 1 0 0 1 0-1.414Z"/></svg>

assets/icons/arrowCornerDownRight_stroke2_corner2_rounded.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><path fill="#000" d="M15.793 10.293a1 1 0 0 1 1.338-.068l.076.068 3.293 3.293a2 2 0 0 1 .138 2.677l-.138.151-3.293 3.293a1 1 0 1 1-1.414-1.414L18.086 16H8a5 5 0 0 1-5-5V5a1 1 0 0 1 2 0v6a3 3 0 0 0 3 3h10.086l-2.293-2.293-.068-.076a1 1 0 0 1 .068-1.338Z"/></svg>

assets/icons/arrowCornerDownRight_stroke2_corner3_rounded.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><path fill="#000" d="M5 5a1 1 0 0 0-2 0v4a7 7 0 0 0 7 7h8.086l-2.293 2.293a1 1 0 0 0 1.414 1.414l2.94-2.94a2.5 2.5 0 0 0 0-3.535l-2.94-2.94a1 1 0 1 0-1.414 1.415L18.086 14H10a5 5 0 0 1-5-5V5Z"/></svg>

assets/icons/arrowRotateClockwise_stroke2_corner0_rounded.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><path fill="#000" d="M2.972 12a9 9 0 0 1 9-9c1.726 0 3.165.423 4.448 1.21A10 10 0 0 1 18 5.428V4a1 1 0 1 1 2 0v4a1 1 0 0 1-1 1h-4a1 1 0 1 1 0-2h1.756a8.3 8.3 0 0 0-1.382-1.085C14.417 5.327 13.341 5 11.972 5a7 7 0 1 0 6.601 9.333A1 1 0 0 1 20.46 15a9 9 0 0 1-17.487-3Z"/></svg>