migrate the logged-out feed fetch to a direct appview lex client

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.claude/.pre-pr-sweep-state

@@ -0,0 +1 @@
+alt-blur@3076a2b5a593b0d7b37198b5aebfe3a222afd52d

.claude/settings.json

@@ -0,0 +1,9 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(pnpm typecheck *)",
+      "Bash(pnpm lint *)",
+      "Bash(pnpm test *)"
+    ]
+  }
+}

.env.example

@@ -46,3 +46,6 @@ GEOLOCATION_DEV_URL=
 
 # live-events web worker URL
 LIVE_EVENTS_DEV_URL=
+
+# app-config web worker URL
+APP_CONFIG_DEV_URL=

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,5 +1,5 @@
 name: "Bug Report"
-description: "Create a report for an issue you have experience in the app."
+description: "Create a report for an issue you have experienced in the app."
 labels: ["bug"]
 body:
   - type: markdown
@@ -19,13 +19,14 @@ body:
         4. See error
     validations:
       required: true
-  - type: textarea
+  - type: upload
     attributes:
       label: Attachments
       description: |
         If possible, please provide any images or videos that may help us understand the issue you are experiencing.
     validations:
       required: false
+      accept: ".png,.jpg,.jpeg,.gif,.webp,.mp4,.mov,.webm"
   - type: dropdown
     attributes:
       label: What platform(s) does this occur on?

.github/ISSUE_TEMPLATE/bug_report_fabric.yml

@@ -26,13 +26,14 @@ body:
         4. See error
     validations:
       required: true
-  - type: textarea
+  - type: upload
     attributes:
       label: Attachments
       description: |
         If possible, please provide any images or videos that may help us understand the issue you are experiencing.
     validations:
       required: false
+      accept: ".png,.jpg,.jpeg,.gif,.webp,.mp4,.mov,.webm"
   - type: dropdown
     attributes:
       label: What platform(s) does this occur on?

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -15,7 +15,7 @@ body:
         implement it in a timely manner.
     validations:
       required: true
-  - type: textarea
+  - type: upload
     attributes:
       label: Attachments
       description: |
@@ -24,6 +24,7 @@ body:
         in or is missing from.
     validations:
       required: false
+      accept: ".png,.jpg,.jpeg,.gif,.webp,.mp4,.mov,.webm"
   - type: textarea
     attributes:
       label: Describe Alternatives

.github/actions/compile-i18n/action.yml

@@ -0,0 +1,15 @@
+---
+name: Compile translations
+description: Compile i18n translations and fail on compilation errors.
+
+runs:
+  using: composite
+  steps:
+    - name: 🔤 Compile translations
+      shell: bash
+      run: pnpm intl:build 2>&1 | tee i18n.log
+
+    - name: Check for i18n compilation errors
+      shell: bash
+      run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation
+        errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi

.github/actions/eas-local-build/action.yml

@@ -0,0 +1,72 @@
+---
+name: Local EAS Build
+description: Build an Expo app locally with a selected EAS profile.
+
+inputs:
+  platform:
+    description: EAS platform to build (ios or android)
+    required: true
+  profile:
+    description: EAS build profile
+    required: true
+  output:
+    description: Output path for the local build artifact
+    required: true
+  log-path:
+    description: Optional path to tee build output into
+    required: false
+    default: ""
+  bump-build-number:
+    description: Run the build through use-build-number-with-bump
+    required: false
+    default: "false"
+  sentry-auth-token:
+    description: Optional Sentry authentication token
+    required: false
+    default: ""
+  sentry-release:
+    description: Optional Sentry release
+    required: false
+    default: ""
+  sentry-dist:
+    description: Optional Sentry distribution
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Build locally with EAS
+      shell: bash
+      env:
+        PLATFORM: ${{ inputs.platform }}
+        PROFILE: ${{ inputs.profile }}
+        OUTPUT: ${{ inputs.output }}
+        LOG_PATH: ${{ inputs.log-path }}
+        BUMP_BUILD_NUMBER: ${{ inputs.bump-build-number }}
+        SENTRY_AUTH_TOKEN: ${{ inputs.sentry-auth-token }}
+        SENTRY_RELEASE: ${{ inputs.sentry-release }}
+        SENTRY_DIST: ${{ inputs.sentry-dist }}
+      run: |
+        set -o pipefail
+        build_command=(
+          pnpm eas build
+          --platform "$PLATFORM"
+          --profile "$PROFILE"
+          --local
+          --output "$OUTPUT"
+          --non-interactive
+        )
+
+        if [ -n "$LOG_PATH" ]; then
+          mkdir -p "$(dirname "$LOG_PATH")"
+          if [ "$BUMP_BUILD_NUMBER" = "true" ]; then
+            pnpm use-build-number-with-bump "${build_command[@]}" 2>&1 | tee "$LOG_PATH"
+          else
+            "${build_command[@]}" 2>&1 | tee "$LOG_PATH"
+          fi
+        elif [ "$BUMP_BUILD_NUMBER" = "true" ]; then
+          pnpm use-build-number-with-bump "${build_command[@]}"
+        else
+          "${build_command[@]}"
+        fi

.github/actions/setup-denis/action.yml

@@ -0,0 +1,50 @@
+---
+name: Setup denis CLI
+description: >
+  Download and verify the denis OTA publish binary from the (private)
+  bluesky-social/tango releases and put it on PATH. Uses a short-lived GitHub
+  App token scoped to contents:read on tango, since the default GITHUB_TOKEN
+  cannot read a private repo's releases.
+
+inputs:
+  release-tag:
+    description: denis release tag in bluesky-social/tango to download
+    required: true
+  app-id:
+    description: GitHub App ID for the token used to read tango releases
+    required: true
+  private-key:
+    description: GitHub App private key
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: 🔑 Mint tango read token
+      id: tango-token
+      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      with:
+        app-id: ${{ inputs.app-id }}
+        private-key: ${{ inputs.private-key }}
+        repositories: tango
+        permission-contents: read
+
+    - name: ⬇️ Download and verify denis binary
+      shell: bash
+      env:
+        GH_TOKEN: ${{ steps.tango-token.outputs.token }}
+        RELEASE_TAG: ${{ inputs.release-tag }}
+      run: |
+        BIN_DIR="$RUNNER_TEMP/denis-bin"
+        mkdir -p "$BIN_DIR"
+        cd "$BIN_DIR"
+        gh release download "$RELEASE_TAG" \
+          --repo bluesky-social/tango \
+          --pattern denis-linux-amd64 \
+          --pattern denis-linux-amd64.sha256 \
+          --clobber
+        # Verify before making it executable / putting it on PATH.
+        sha256sum -c denis-linux-amd64.sha256
+        mv denis-linux-amd64 denis
+        chmod +x denis
+        echo "$BIN_DIR" >> "$GITHUB_PATH"

.github/actions/setup-expo-project/action.yml

@@ -0,0 +1,47 @@
+---
+name: Setup Expo Project
+description: Install dependencies and set up the Expo/EAS CLI for a build. Does not check out the repo.
+
+inputs:
+  expo-token:
+    description: Expo token (EXPO_TOKEN secret)
+    required: true
+  eas-version:
+    description: EAS CLI version to install
+    required: false
+    default: '19.0.5'
+
+runs:
+  using: composite
+  steps:
+    - name: Check for EXPO_TOKEN
+      shell: bash
+      env:
+        EXPO_TOKEN: ${{ inputs.expo-token }}
+      run: >
+        if [ -z "$EXPO_TOKEN" ]; then
+          echo "You must provide an EXPO_TOKEN secret linked to this project's Expo account in this repo's secrets. Learn more: https://docs.expo.dev/eas-update/github-actions"
+          exit 1
+        fi
+
+    - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
+    - name: 🔧 Setup Node
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version-file: package.json
+        cache: pnpm
+
+    - name: 🪛 Setup jq
+      uses: dcarbone/install-jq-action@4fcb5062d7ce9bc4382d1a352d19ba3ba2c317c1 # v4.0.1
+
+    - name: ⚙️ Install dependencies
+      shell: bash
+      run: pnpm install --frozen-lockfile
+
+    - name: 🔨 Setup Expo CLI
+      uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
+      with:
+        eas-version: ${{ inputs.eas-version }}
+        packager: 'pnpm --allow-build=dtrace-provider'
+        token: ${{ inputs.expo-token }}

.github/actions/write-env/action.yml

@@ -0,0 +1,63 @@
+---
+name: Write Environment Variables
+description: Write the .env file and google-services.json used by the build.
+
+inputs:
+  env-token:
+    description: Base .env contents (ENV_TOKEN secret)
+    required: true
+  sentry-dsn:
+    description: Sentry DSN (SENTRY_DSN secret)
+    required: true
+  bitdrift-api-key:
+    description: Bitdrift API key (BITDRIFT_API_KEY secret)
+    required: true
+  gcp-project-id:
+    description: GCP project ID (EXPO_PUBLIC_GCP_PROJECT_ID secret)
+    required: true
+  google-services-token:
+    description: google-services.json contents (GOOGLE_SERVICES_TOKEN secret)
+    required: true
+  expo-public-env:
+    description: >
+      EXPO_PUBLIC_ENV value. Only set for OTA deploys where eas.json isn't used;
+      for regular builds this is normally handled in eas.json.
+    required: false
+    default: ''
+
+outputs:
+  release-version:
+    description: Version from package.json
+    value: ${{ steps.env.outputs.release-version }}
+  bundle-identifier:
+    description: git SHA of HEAD
+    value: ${{ steps.env.outputs.bundle-identifier }}
+
+runs:
+  using: composite
+  steps:
+    - name: ✏️ Write environment variables
+      id: env
+      shell: bash
+      env:
+        ENV_TOKEN: ${{ inputs.env-token }}
+        SENTRY_DSN: ${{ inputs.sentry-dsn }}
+        BITDRIFT_API_KEY: ${{ inputs.bitdrift-api-key }}
+        GCP_PROJECT_ID: ${{ inputs.gcp-project-id }}
+        GOOGLE_SERVICES_TOKEN: ${{ inputs.google-services-token }}
+        EXPO_PUBLIC_ENV: ${{ inputs.expo-public-env }}
+      run: |
+        echo "$ENV_TOKEN" > .env
+        # EXPO_PUBLIC_ENV is normally handled in eas.json; only written here for OTA deploys.
+        if [ -n "$EXPO_PUBLIC_ENV" ]; then
+          echo "EXPO_PUBLIC_ENV=$EXPO_PUBLIC_ENV" >> .env
+        fi
+        echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> .env
+        echo "release-version=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
+        echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> .env
+        echo "bundle-identifier=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+        echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
+        echo "EXPO_PUBLIC_SENTRY_DSN=$SENTRY_DSN" >> .env
+        echo "EXPO_PUBLIC_BITDRIFT_API_KEY=$BITDRIFT_API_KEY" >> .env
+        echo "EXPO_PUBLIC_GCP_PROJECT_ID=$GCP_PROJECT_ID" >> .env
+        echo "$GOOGLE_SERVICES_TOKEN" > google-services.json

.github/claude-review-prompt.md

@@ -0,0 +1,63 @@
+You are an experienced senior React Native engineer reviewing a pull
+request in the Bluesky Social app — a cross-platform (iOS, Android, Web)
+React Native + Expo application. Read the repo's CLAUDE.md before forming
+an opinion; it describes the architecture, the ALF design system, and the
+codebase conventions.
+
+Your audience is other senior engineers. Write peer-to-peer, not
+teacher-to-junior. Most PRs in this repo are fine; a review that says so
+is a valid and common outcome.
+
+Report a finding only if you can name a concrete scenario — specific
+input, platform, navigation path, or operating condition — in which the
+change causes incorrect behavior, a crash, a visual regression, a test
+failure, a security issue, or a real regression visible to users. Style,
+naming, and micro-optimizations are out of scope unless they introduce a
+defect. Do not speculate that a change "might" break unrelated code
+without pointing to the specific caller or code path. Do not repeat what
+the diff does.
+
+Where this codebase differs from a typical web app:
+
+- Three platforms from one codebase. Web-only APIs (DOM, window),
+  native-only modules, and platform-specific files (.web.tsx, .ios.tsx,
+  .android.tsx) are common sources of single-platform breakage. When a
+  change touches shared code, consider all three targets.
+- User-facing strings must go through Lingui (the `Trans` macro /
+  `useLingui`). Hardcoded English strings in UI are a finding. Do not
+  flag missing translations in catalog files — extraction and
+  compilation run in CI.
+- New UI should use ALF (`#/alf`, `#/components`) rather than legacy
+  patterns (`#/view/com`, StyleSheet.create); flag newly written code
+  that adopts deprecated patterns, but don't flag pre-existing code the
+  PR merely touches.
+- Server state lives in TanStack Query under src/state/queries. Watch
+  for cache-shape changes without corresponding invalidation updates,
+  and optimistic updates that can leave stale cache on failure.
+- List rendering is performance-critical (the main feed). Changes to
+  feed items, FlatList usage, or anything in a hot render path deserve
+  scrutiny for re-render storms — unstable callback/object identities
+  passed to memoized children, missing memoization on expensive
+  computation.
+- Moderation and content-filtering logic (labels, mutes, blocks,
+  hidden posts) is trust-and-safety-critical: a regression that shows
+  content that should be filtered is a blocking finding.
+- Deep links, push-notification routing, and the navigation state
+  machine have platform-specific edge cases; changes there should name
+  the platforms they were verified on.
+- The embed (bskyembed) and web deployment surfaces (bskyweb, link,
+  ogcard services in Go) ship separately from the app; changes there
+  have their own blast radius.
+
+For each finding, state the scenario in one or two sentences, cite
+file:line, and mark severity (blocking / non-blocking). If you are
+uncertain but the potential impact is high (crash on startup, moderation
+bypass, broken auth), include it and say what you are uncertain about.
+Otherwise, prefer silence over guessing.
+
+If there are no findings that meet this bar, say briefly that the PR
+looks fine and note what you checked.
+
+Post your review as a single top-level PR comment. Per-finding inline
+comments are also welcome where they'd anchor a reader to the specific
+lines involved.

.github/dependabot.yml

@@ -0,0 +1,44 @@
+version: 2
+# Dependabot auto-update config.
+#
+# Cooldown (7 days) is the point of this config: it delays version-update
+# PRs until a newly-published version has aged. Supply-chain attacks like
+# the tanstack Shai-Hulud compromise (2026-05-11) live minutes-to-hours
+# before the registry yanks them; a 7-day cooldown keeps poisoned
+# versions out of our lockfiles.
+#
+# Security updates bypass cooldown and continue to flow immediately. See:
+# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown
+#
+# Auto-merge is deliberately NOT enabled. Every dependabot PR gets human
+# review.
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    groups:
+      production:
+        dependency-type: production
+        update-types: [minor, patch]
+      development:
+        dependency-type: development
+        update-types: [minor, patch]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 3
+    groups:
+      actions:
+        patterns: ["*"]
+        update-types: [minor, patch]

.github/scripts/cleanup-nightly-e2e.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+
+set +e
+
+platform="${1:?usage: cleanup-nightly-e2e.sh <ios|android> <device-id>}"
+device_id="${2:-}"
+artifact_dir="${GITHUB_WORKSPACE:-$PWD}/artifacts/$platform"
+mkdir -p "$artifact_dir"
+
+if [[ -f i18n.log ]]; then
+  cp i18n.log "$artifact_dir/i18n.log"
+fi
+
+stop_process_tree() {
+  local pid="$1"
+  local child
+  while read -r child; do
+    [[ -n "$child" ]] && stop_process_tree "$child"
+  done < <(pgrep -P "$pid" 2>/dev/null || true)
+  kill -TERM "$pid" >/dev/null 2>&1 || true
+}
+
+stop_pid_file() {
+  [[ -f "$1" ]] || return 0
+  local pid
+  pid="$(cat "$1")"
+  stop_process_tree "$pid"
+}
+
+stop_pid_file "$artifact_dir/logcat.pid"
+stop_pid_file "$artifact_dir/metro.pid"
+stop_pid_file "$artifact_dir/mock-server.pid"
+stop_pid_file "$artifact_dir/emulator.pid"
+
+if [[ "$platform" == "ios" ]]; then
+  if [[ -f "$artifact_dir/redis-bin.txt" ]]; then
+    "$(cat "$artifact_dir/redis-bin.txt")/redis-cli" \
+      -h 127.0.0.1 -p 6380 shutdown nosave >/dev/null 2>&1 || true
+  fi
+  if [[ -f "$artifact_dir/postgres-bin.txt" ]]; then
+    "$(cat "$artifact_dir/postgres-bin.txt")/pg_ctl" \
+      -D "${RUNNER_TEMP:-/tmp}/nightly-e2e-postgres" -m fast stop >/dev/null 2>&1 || true
+  fi
+  [[ -n "$device_id" ]] && xcrun simctl shutdown "$device_id" >/dev/null 2>&1 || true
+else
+  docker compose -f dev-env/dev-infra/docker-compose.yaml logs --no-color \
+    >>"$artifact_dir/docker-services.log" 2>&1 || true
+  docker compose -f dev-env/dev-infra/docker-compose.yaml down --volumes --remove-orphans >/dev/null 2>&1 || true
+  [[ -n "$device_id" ]] && adb -s "$device_id" emu kill >/dev/null 2>&1 || true
+fi

.github/scripts/run-nightly-e2e.sh

@@ -0,0 +1,179 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+platform="${1:?usage: run-nightly-e2e.sh <ios|android> <device-id>}"
+device_id="${2:?usage: run-nightly-e2e.sh <ios|android> <device-id>}"
+
+if [[ "$platform" != "ios" && "$platform" != "android" ]]; then
+  echo "Unsupported platform: $platform" >&2
+  exit 2
+fi
+
+artifact_dir="${GITHUB_WORKSPACE:-$PWD}/artifacts/$platform"
+maestro_dir="$artifact_dir/maestro"
+mkdir -p "$maestro_dir"
+
+phase() {
+  printf '%s\n' "$1" >"$artifact_dir/phase.txt"
+}
+
+wait_for_port() {
+  local port="$1"
+  local label="$2"
+  local attempts="${3:-120}"
+
+  for ((i = 1; i <= attempts; i++)); do
+    if nc -z 127.0.0.1 "$port" >/dev/null 2>&1; then
+      return 0
+    fi
+    sleep 1
+  done
+
+  echo "Timed out waiting for $label on port $port" >&2
+  return 1
+}
+
+# shellcheck disable=SC2329 # Invoked through the cleanup trap call chain.
+stop_process_tree() {
+  local pid="$1"
+  local child
+  while read -r child; do
+    [[ -n "$child" ]] && stop_process_tree "$child"
+  done < <(pgrep -P "$pid" 2>/dev/null || true)
+  kill -TERM "$pid" >/dev/null 2>&1 || true
+}
+
+# shellcheck disable=SC2329 # Invoked by cleanup, which is registered as a trap.
+stop_pid_file() {
+  local pid_file="$1"
+  [[ -f "$pid_file" ]] || return 0
+
+  local pid
+  pid="$(cat "$pid_file")"
+  [[ -n "$pid" ]] || return 0
+
+  # pnpm and Expo both spawn multiple generations of children.
+  stop_process_tree "$pid"
+}
+
+# shellcheck disable=SC2329 # Invoked by the EXIT/INT/TERM trap below.
+cleanup() {
+  set +e
+  stop_pid_file "$artifact_dir/logcat.pid"
+  stop_pid_file "$artifact_dir/metro.pid"
+  stop_pid_file "$artifact_dir/mock-server.pid"
+
+  if [[ "$platform" == "ios" ]]; then
+    if [[ -f "$artifact_dir/redis.pid" ]]; then
+      redis_bin="$(cat "$artifact_dir/redis-bin.txt")"
+      "$redis_bin/redis-cli" -h 127.0.0.1 -p 6380 shutdown nosave >/dev/null 2>&1 || true
+    fi
+    if [[ -f "$artifact_dir/postgres-bin.txt" && -d "${RUNNER_TEMP:-/tmp}/nightly-e2e-postgres" ]]; then
+      postgres_bin="$(cat "$artifact_dir/postgres-bin.txt")"
+      "$postgres_bin/pg_ctl" -D "${RUNNER_TEMP:-/tmp}/nightly-e2e-postgres" -m fast stop >/dev/null 2>&1 || true
+    fi
+  else
+    docker compose -f dev-env/dev-infra/docker-compose.yaml logs --no-color \
+      >>"$artifact_dir/docker-services.log" 2>&1 || true
+    docker compose -f dev-env/dev-infra/docker-compose.yaml down --volumes --remove-orphans >/dev/null 2>&1 || true
+  fi
+}
+
+trap cleanup EXIT INT TERM
+
+if [[ "$platform" == "android" ]]; then
+  adb -s "$device_id" logcat -c
+  adb -s "$device_id" logcat -v threadtime >"$artifact_dir/logcat.log" 2>&1 &
+  printf '%s\n' "$!" >"$artifact_dir/logcat.pid"
+fi
+
+phase "Starting PostgreSQL, Redis, and mock server"
+if [[ "$platform" == "ios" ]]; then
+  brew install postgresql@14 2>&1 | tee "$artifact_dir/native-dependencies.log"
+
+  postgres_bin="$(brew --prefix postgresql@14)/bin"
+  redis_version="7.4.7"
+  redis_archive="${RUNNER_TEMP:-/tmp}/redis-${redis_version}.tar.gz"
+  redis_source="${RUNNER_TEMP:-/tmp}/redis-${redis_version}"
+  curl -fsSL -o "$redis_archive" \
+    "https://download.redis.io/releases/redis-${redis_version}.tar.gz"
+  echo "c97e57b0df330a9e091cacff012bebe763c275398cf36ff44cdba876814b595b  $redis_archive" \
+    | shasum -a 256 --check | tee -a "$artifact_dir/native-dependencies.log"
+  rm -rf "$redis_source"
+  tar -xzf "$redis_archive" -C "${RUNNER_TEMP:-/tmp}"
+  make -C "$redis_source" -j "$(sysctl -n hw.ncpu)" \
+    2>&1 | tee -a "$artifact_dir/native-dependencies.log"
+  redis_bin="$redis_source/src"
+  "$redis_bin/redis-server" --version | tee -a "$artifact_dir/native-dependencies.log"
+  printf '%s\n' "$redis_bin" >"$artifact_dir/redis-bin.txt"
+
+  postgres_data="${RUNNER_TEMP:-/tmp}/nightly-e2e-postgres"
+  rm -rf "$postgres_data"
+  "$postgres_bin/initdb" -D "$postgres_data" --auth=trust --username=pg --no-locale \
+    >"$artifact_dir/postgres-init.log" 2>&1
+  "$postgres_bin/pg_ctl" -D "$postgres_data" \
+    -o "-p 5433 -h 127.0.0.1" -l "$artifact_dir/postgres.log" start
+  printf '%s\n' "$postgres_bin" >"$artifact_dir/postgres-bin.txt"
+
+  "$redis_bin/redis-server" \
+    --bind 127.0.0.1 \
+    --port 6380 \
+    --save "" \
+    --appendonly no \
+    --daemonize yes \
+    --pidfile "$artifact_dir/redis.pid" \
+    --logfile "$artifact_dir/redis.log"
+
+  wait_for_port 5433 "PostgreSQL"
+  wait_for_port 6380 "Redis"
+  pnpm --dir dev-env start:external >"$artifact_dir/mock-server.log" 2>&1 &
+else
+  pnpm --dir dev-env start >"$artifact_dir/mock-server.log" 2>&1 &
+fi
+printf '%s\n' "$!" >"$artifact_dir/mock-server.pid"
+wait_for_port 1986 "the E2E mock-server manager"
+
+phase "Starting Metro"
+EXPO_PUBLIC_ENV=e2e \
+  NODE_ENV=development \
+  RN_SRC_EXT=e2e.ts,e2e.tsx \
+  pnpm exec expo start --dev-client --clear --port 8081 \
+  >"$artifact_dir/metro.log" 2>&1 &
+printf '%s\n' "$!" >"$artifact_dir/metro.pid"
+wait_for_port 8081 "Metro"
+
+# Pre-warm Metro bundle so the first Maestro flow doesn't hit a cold-start delay
+phase "Pre-warming Metro bundle"
+bundle_platform="$platform"
+curl -s -o /dev/null "http://localhost:8081/index.bundle?platform=${bundle_platform}&dev=true&minify=false"
+echo "Metro bundle pre-warmed for $bundle_platform"
+
+if [[ "$platform" == "android" ]]; then
+  phase "Configuring Android localhost routing"
+  adb -s "$device_id" reverse tcp:3000 tcp:3000
+  adb -s "$device_id" reverse tcp:8081 tcp:8081
+fi
+
+phase "Running Maestro flows"
+set +e
+maestro test \
+  --udid "$device_id" \
+  --format JUNIT \
+  --output "$artifact_dir/report.xml" \
+  --config __e2e__/config.yml \
+  --debug-output "$maestro_dir" \
+  --test-output-dir "$maestro_dir" \
+  --flatten-debug-output \
+  __e2e__ \
+  2>&1 | tee "$artifact_dir/maestro-cli.log"
+maestro_status=${PIPESTATUS[0]}
+set -e
+
+if [[ "$maestro_status" -eq 0 ]]; then
+  phase "Completed"
+else
+  phase "Maestro flow failure"
+fi
+
+exit "$maestro_status"

.github/scripts/summarize-maestro.mjs

@@ -0,0 +1,356 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+
+const ENTITY_REPLACEMENTS = {
+  '&': '&',
+  ''': "'",
+  '>': '>',
+  '&lt;': '<',
+  '&quot;': '"',
+}
+
+function decodeXml(value = '') {
+  return value
+    .replace(/&(amp|apos|gt|lt|quot);/g, entity => ENTITY_REPLACEMENTS[entity])
+    .replace(/&#(\d+);/g, (_, code) => String.fromCodePoint(Number(code)))
+    .replace(/&#x([\da-f]+);/gi, (_, code) =>
+      String.fromCodePoint(Number.parseInt(code, 16)),
+    )
+}
+
+function attributes(source = '') {
+  const result = {}
+  for (const match of source.matchAll(/([\w:.-]+)\s*=\s*(["'])(.*?)\2/gs)) {
+    result[match[1]] = decodeXml(match[3])
+  }
+  return result
+}
+
+function concise(value, limit = 300) {
+  const normalized = decodeXml(value)
+    .replace(/<[^>]+>/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim()
+  return normalized.length > limit
+    ? `${normalized.slice(0, limit - 1)}…`
+    : normalized
+}
+
+export function parseJUnit(xml) {
+  const failures = []
+  const testcasePattern = /<testcase\b([^>]*?)(?:\/>|>([\s\S]*?)<\/testcase>)/gi
+
+  for (const match of xml.matchAll(testcasePattern)) {
+    const testcase = attributes(match[1])
+    const body = match[2] || ''
+    const failure = body.match(/<(failure|error)\b([^>]*)>([\s\S]*?)<\/\1>/i)
+    const selfClosingFailure = body.match(/<(failure|error)\b([^>]*)\/>/i)
+    const failureMatch = failure || selfClosingFailure
+    if (!failureMatch) continue
+
+    const failureAttributes = attributes(failureMatch[2])
+    const name = testcase.name || testcase.classname || 'Unnamed Maestro flow'
+    const message = concise(
+      failureAttributes.message || (failure ? failureMatch[3] : '') || 'Failed',
+    )
+    failures.push({name, message})
+  }
+
+  if (failures.length === 0) {
+    const suite = xml.match(/<testsuite\b([^>]*)>/i)
+    const suiteAttributes = attributes(suite?.[1])
+    if (
+      Number(suiteAttributes.failures || 0) +
+        Number(suiteAttributes.errors || 0) >
+      0
+    ) {
+      failures.push({
+        name: suiteAttributes.name || 'Maestro test suite',
+        message: 'JUnit reported a failure without testcase details',
+      })
+    }
+  }
+
+  return failures
+}
+
+export function parseMaestroCli(log) {
+  const failures = []
+  const failurePattern = /^\[Failed\]\s+(.+?)\s+\([^)]*\)\s+\((.+)\)\s*$/gm
+  for (const match of log.matchAll(failurePattern)) {
+    failures.push({
+      name: concise(match[1], 120),
+      message: concise(match[2]),
+    })
+  }
+  return failures
+}
+
+function walk(root) {
+  if (!root || !fs.existsSync(root)) return []
+  const entries = fs.readdirSync(root, {withFileTypes: true})
+  return entries.flatMap(entry => {
+    const candidate = path.join(root, entry.name)
+    return entry.isDirectory() ? walk(candidate) : [candidate]
+  })
+}
+
+function readPhase(root) {
+  const phaseFile = walk(root).find(file => path.basename(file) === 'phase.txt')
+  return phaseFile ? fs.readFileSync(phaseFile, 'utf8').trim() : ''
+}
+
+function platformResult({name, status, root, artifactUrl}) {
+  const files = walk(root)
+  const reports = files.filter(file => /(?:report|junit).*\.xml$/i.test(file))
+  const junitFailures = reports.flatMap(report =>
+    parseJUnit(fs.readFileSync(report, 'utf8')),
+  )
+  const maestroLogs = files.filter(
+    file => path.basename(file) === 'maestro-cli.log',
+  )
+  const cliFailures = maestroLogs.flatMap(log =>
+    parseMaestroCli(fs.readFileSync(log, 'utf8')),
+  )
+  // A cancelled or timed-out Maestro run may never flush JUnit. Its CLI log is
+  // streamed continuously, so use those failure lines when JUnit has no detail.
+  const failures = junitFailures.length > 0 ? junitFailures : cliFailures
+  // A skipped platform (e.g. iOS while temporarily disabled) is not a failure
+  // as long as it produced no flow failures.
+  const failed =
+    (status !== 'success' && status !== 'skipped') || failures.length > 0
+  return {
+    name,
+    status,
+    failed,
+    failures,
+    phase: readPhase(root),
+    hasJUnit: reports.length > 0,
+    artifactUrl,
+  }
+}
+
+function statusEmoji(status) {
+  if (status === 'success') return ':white_check_mark:'
+  if (status === 'skipped') return ':fast_forward:'
+  return ':x:'
+}
+
+function slackEscape(value) {
+  return value
+    .replaceAll('&', '&amp;')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+}
+
+function platformBlock(platform) {
+  const lines = [
+    `${statusEmoji(platform.status)} *${platform.name}* — job status: \`${platform.status}\``,
+  ]
+  if (platform.failures.length > 0) {
+    for (const failure of platform.failures.slice(0, 8)) {
+      lines.push(
+        `• *${slackEscape(failure.name)}:* ${slackEscape(failure.message)}`,
+      )
+    }
+    if (platform.failures.length > 8) {
+      lines.push(`• …and ${platform.failures.length - 8} more failed flows`)
+    }
+  } else if (platform.failed && !platform.hasJUnit) {
+    lines.push(
+      `• *Setup phase:* ${slackEscape(platform.phase || 'No phase metadata was captured')}`,
+    )
+  } else if (platform.failed) {
+    lines.push(
+      `• Job failed after JUnit was written; latest phase: ${slackEscape(platform.phase || 'unknown')}`,
+    )
+  }
+  if (platform.artifactUrl) {
+    lines.push(
+      `• <${platform.artifactUrl}|Open ${platform.name} logs and artifacts>`,
+    )
+  }
+  return lines.join('\n').slice(0, 3000)
+}
+
+function githubSummary({notify, platforms, shortSha, runUrl, commitUrl}) {
+  const lines = [
+    `# Nightly Maestro E2E ${notify ? 'failed' : 'passed'}`,
+    '',
+    `- Commit: [\`${shortSha}\`](${commitUrl})`,
+    `- Workflow run: [open run](${runUrl})`,
+    '',
+  ]
+
+  for (const platform of platforms) {
+    const headerEmoji =
+      platform.status === 'success'
+        ? '✅'
+        : platform.status === 'skipped'
+          ? '⏭️'
+          : '❌'
+    lines.push(
+      `## ${headerEmoji} ${platform.name}`,
+      '',
+      `Job status: \`${platform.status}\``,
+      '',
+    )
+    if (platform.failures.length > 0) {
+      for (const failure of platform.failures.slice(0, 10)) {
+        lines.push(`- **${failure.name}:** ${failure.message}`)
+      }
+      if (platform.failures.length > 10) {
+        lines.push(`- …and ${platform.failures.length - 10} more failed flows`)
+      }
+      lines.push('')
+    } else if (platform.failed && !platform.hasJUnit) {
+      lines.push(
+        `- Setup phase: ${platform.phase || 'No phase metadata was captured'}`,
+        '',
+      )
+    } else if (platform.failed) {
+      lines.push(
+        `- The job failed after JUnit was written (latest phase: ${platform.phase || 'unknown'})`,
+        '',
+      )
+    }
+    if (platform.artifactUrl) {
+      lines.push(
+        `- [${platform.name} logs and artifacts](${platform.artifactUrl})`,
+        '',
+      )
+    }
+  }
+
+  return lines.join('\n').trim()
+}
+
+export function buildSummary({
+  iosStatus,
+  androidStatus,
+  iosRoot,
+  androidRoot,
+  artifactUrls = {},
+  sha,
+  runUrl,
+  commitUrl,
+}) {
+  const platforms = [
+    platformResult({
+      name: 'iOS',
+      status: iosStatus,
+      root: iosRoot,
+      artifactUrl: artifactUrls.ios,
+    }),
+    platformResult({
+      name: 'Android',
+      status: androidStatus,
+      root: androidRoot,
+      artifactUrl: artifactUrls.android,
+    }),
+  ]
+  const notify = platforms.some(platform => platform.failed)
+  const shortSha = sha.slice(0, 12)
+  const lines = [
+    ':rotating_light: *Nightly Maestro E2E failed*',
+    `*Commit:* <${commitUrl}|\`${shortSha}\`>`,
+    `*Workflow run:* <${runUrl}|open run>`,
+    '',
+  ]
+
+  for (const platform of platforms) {
+    lines.push(
+      `${statusEmoji(platform.status)} *${platform.name}* — job status: \`${platform.status}\``,
+    )
+    if (platform.failures.length > 0) {
+      for (const failure of platform.failures.slice(0, 10)) {
+        lines.push(
+          `• *${slackEscape(failure.name)}:* ${slackEscape(failure.message)}`,
+        )
+      }
+      if (platform.failures.length > 10) {
+        lines.push(`• …and ${platform.failures.length - 10} more failed flows`)
+      }
+    } else if (platform.failed && !platform.hasJUnit) {
+      lines.push(
+        `• Setup phase: ${platform.phase || 'No phase metadata was captured'}`,
+      )
+    } else if (platform.failed) {
+      lines.push(
+        `• The job failed after JUnit was written (latest phase: ${platform.phase || 'unknown'})`,
+      )
+    }
+    if (platform.artifactUrl) {
+      lines.push(
+        `• <${platform.artifactUrl}|${platform.name} logs and artifacts>`,
+      )
+    }
+    lines.push('')
+  }
+
+  const text = lines.join('\n').trim()
+  const blocks = [
+    {
+      type: 'header',
+      text: {type: 'plain_text', text: 'Nightly Maestro E2E failed'},
+    },
+    {
+      type: 'section',
+      text: {
+        type: 'mrkdwn',
+        text: `*Commit:* <${commitUrl}|\`${shortSha}\`>\n*Workflow run:* <${runUrl}|open run>`,
+      },
+    },
+    {type: 'divider'},
+    ...platforms.flatMap((platform, index) => [
+      {type: 'section', text: {type: 'mrkdwn', text: platformBlock(platform)}},
+      ...(index < platforms.length - 1 ? [{type: 'divider'}] : []),
+    ]),
+  ]
+  return {
+    notify,
+    platforms,
+    githubSummary: githubSummary({
+      notify,
+      platforms,
+      shortSha,
+      runUrl,
+      commitUrl,
+    }),
+    payload: {text, blocks},
+  }
+}
+
+function parseArgs(argv) {
+  const result = {}
+  for (let i = 0; i < argv.length; i += 2) {
+    const key = argv[i]
+    if (!key?.startsWith('--') || argv[i + 1] === undefined) {
+      throw new Error(`Invalid argument: ${key || '<missing>'}`)
+    }
+    result[key.slice(2)] = argv[i + 1]
+  }
+  return result
+}
+
+if (
+  process.argv[1] &&
+  path.resolve(process.argv[1]) === path.resolve(import.meta.filename)
+) {
+  const args = parseArgs(process.argv.slice(2))
+  const artifactUrls = args['artifact-urls']
+    ? JSON.parse(fs.readFileSync(args['artifact-urls'], 'utf8'))
+    : {}
+  const summary = buildSummary({
+    iosStatus: args['ios-status'],
+    androidStatus: args['android-status'],
+    iosRoot: args['ios-root'],
+    androidRoot: args['android-root'],
+    artifactUrls,
+    sha: args.sha,
+    runUrl: args['run-url'],
+    commitUrl: args['commit-url'],
+  })
+  process.stdout.write(`${JSON.stringify(summary)}\n`)
+}

.github/workflows/asset-notices.yml

@@ -0,0 +1,41 @@
+name: Asset notices
+
+# Verifies that every path named in ASSETS.md and NOTICE.md still exists.
+#
+# Those files tell forkers which assets our MIT license does not cover, and carry the third-party
+# attribution notices we are required to pass along. If an asset moves and the notice is not
+# updated, the notice silently stops meaning anything. This job makes that visible in review
+# rather than a year later.
+#
+# No paths filter: the notices also reference files under src/ (e.g. the inline logo components),
+# so any rename anywhere in the tree can rot a notice. The check runs in under a second.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: Check asset licensing notices
+    runs-on: ubuntu-latest
+    steps:
+      - name: ⬇️ Check out Git repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: ⚙️ Set up Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: package.json
+
+      - name: 📜 Verify asset notices
+        run: node scripts/check-asset-notices.mjs

.github/workflows/build-and-push-bskyweb-aws.yaml

@@ -21,37 +21,37 @@ jobs:
       id-token: write
 
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - name: ⬇️ Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+      - name: 🔧 Setup Docker buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
-      - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+      - name: 🔑 Log into registry ${{ env.REGISTRY }}
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.USERNAME}}
           password: ${{ env.PASSWORD }}
 
-      - name: Extract Docker metadata
+      - name: 🏷️ Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             type=sha,enable=true,priority=100,prefix=,suffix=,format=long
 
-      - name: Env
+      - name: 📝 Env
         id: env
         run: |
           echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
           echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
 
-      - name: Build and push Docker image
+      - name: 🚀 Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/build-and-push-bskyweb-ghcr.yaml

@@ -22,31 +22,31 @@ jobs:
       id-token: write
 
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - name: ⬇️ Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+      - name: 🔧 Setup Docker buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
-      - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+      - name: 🔑 Log into registry ${{ env.REGISTRY }}
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.USERNAME }}
           password: ${{ env.PASSWORD }}
 
-      - name: Extract Docker metadata
+      - name: 🏷️ Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             type=sha,enable=true,priority=100,prefix=bskyweb:,suffix=,format=long
 
-      - name: Build and push Docker image
+      - name: 🚀 Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/build-and-push-embedr-aws.yaml

@@ -21,31 +21,31 @@ jobs:
       id-token: write
 
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - name: ⬇️ Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+      - name: 🔧 Setup Docker buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
-      - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+      - name: 🔑 Log into registry ${{ env.REGISTRY }}
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.USERNAME}}
           password: ${{ env.PASSWORD }}
 
-      - name: Extract Docker metadata
+      - name: 🏷️ Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             type=sha,enable=true,priority=100,prefix=,suffix=,format=long
 
-      - name: Build and push Docker image
+      - name: 🚀 Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}

.github/workflows/build-and-push-link-aws.yaml

@@ -1,11 +1,9 @@
 name: build-and-push-link-aws
 on:
   workflow_dispatch:
-  pull_request:
-    paths:
-      - "bskylink/**"
-      - "Dockerfile.bskylink"
-      - ".github/workflows/build-and-push-link-aws.yaml"
+  push:
+    branches:
+      - main
 
 env:
   REGISTRY: ${{ secrets.AWS_ECR_REGISTRY_USEAST2_PACKAGES_REGISTRY }}
@@ -23,31 +21,31 @@ jobs:
       id-token: write
 
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - name: ⬇️ Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+      - name: 🔧 Setup Docker buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
-      - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+      - name: 🔑 Log into registry ${{ env.REGISTRY }}
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.USERNAME}}
           password: ${{ env.PASSWORD }}
 
-      - name: Extract Docker metadata
+      - name: 🏷️ Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             type=sha,enable=true,priority=100,prefix=,suffix=,format=long
 
-      - name: Build and push Docker image
+      - name: 🚀 Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           push: true

.github/workflows/build-and-push-ogcard-aws.yaml

@@ -1,11 +1,9 @@
 name: build-and-push-ogcard-aws
 on:
   workflow_dispatch:
-  pull_request:
-    paths:
-      - "bskyogcard/**"
-      - "Dockerfile.bskyogcard"
-      - ".github/workflows/build-and-push-ogcard-aws.yaml"
+  push:
+    branches:
+      - main
 
 env:
   REGISTRY: ${{ secrets.AWS_ECR_REGISTRY_USEAST2_PACKAGES_REGISTRY }}
@@ -23,31 +21,31 @@ jobs:
       id-token: write
 
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - name: ⬇️ Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+      - name: 🔧 Setup Docker buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
-      - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+      - name: 🔑 Log into registry ${{ env.REGISTRY }}
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.USERNAME}}
           password: ${{ env.PASSWORD }}
 
-      - name: Extract Docker metadata
+      - name: 🏷️ Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             type=sha,enable=true,priority=100,prefix=,suffix=,format=long
 
-      - name: Build and push Docker image
+      - name: 🚀 Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           push: true

.github/workflows/build-submit-android.yml

@@ -10,195 +10,308 @@ on:
         options:
           - testflight-android
           - production
+      submit:
+        type: boolean
+        description: Submit the build to Google Play (disable to only produce the APK artifact)
+        default: true
+  workflow_call:
+    inputs:
+      profile:
+        type: string
+        description: Build profile to use
+        required: true
+      submit:
+        type: boolean
+        description: Submit the build to Google Play (disable to only produce the APK artifact)
+        default: true
+      runner:
+        type: string
+        description: Runner for the build job (defaults to Linux-x64-32core)
+        required: false
+        default: ''
+    outputs:
+      package-version:
+        description: Version from package.json
+        value: ${{ jobs.build.outputs.package-version }}
+      version-code:
+        description: Android version code
+        value: ${{ jobs.build.outputs.version-code }}
+    secrets:
+      EXPO_TOKEN:
+        required: true
+      ENV_TOKEN:
+        required: true
+      SENTRY_DSN:
+        required: true
+      BITDRIFT_API_KEY:
+        required: true
+      EXPO_PUBLIC_GCP_PROJECT_ID:
+        required: true
+      GOOGLE_SERVICES_TOKEN:
+        required: true
+      SENTRY_AUTH_TOKEN:
+        required: true
+      SLACK_CLIENT_ALERT_WEBHOOK:
+        required: true
+      ANDROID_KEYSTORE_BASE64:
+        required: true
+      ANDROID_KEYSTORE_PASSWORD:
+        required: true
+      ANDROID_KEY_ALIAS:
+        required: true
+      ANDROID_KEY_PASSWORD:
+        required: true
+
+# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
+permissions:
+  contents: read
 
 jobs:
   build:
     if: github.repository == 'bluesky-social/social-app'
-    name: Build and Submit Android
-    runs-on: Linux-x64-32core
+    name: Build Android
+    runs-on: ${{ inputs.runner || 'Linux-x64-32core' }}
     concurrency:
       group: android-build
       cancel-in-progress: false
+    outputs:
+      package-version: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
+      version-code: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}
     steps:
-      - name: Check for EXPO_TOKEN
-        run: >
-          if [ -z "${{ secrets.EXPO_TOKEN }}" ]; then
-            echo "You must provide an EXPO_TOKEN secret linked to this project's Expo account in this repo's secrets. Learn more: https://docs.expo.dev/eas-update/github-actions"
-            exit 1
-          fi
-
       - name: ⬇️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 5
 
-      - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+      - name: 🔧 Setup Expo project
+        uses: ./.github/actions/setup-expo-project
         with:
-          node-version-file: .nvmrc
-          cache: yarn
+          expo-token: ${{ secrets.EXPO_TOKEN }}
 
-      - name: 🪛 Setup jq
-        uses: dcarbone/install-jq-action@v2
-
-      - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@main
-        with:
-          expo-version: latest
-          eas-version: latest
-          token: ${{ secrets.EXPO_TOKEN }}
-
-      - name: ⛏️ Setup EAS local builds
-        run: yarn global add eas-cli-local-build-plugin
-
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: "temurin"
           java-version: "17"
 
-      - name: ⚙️ Install dependencies
-        run: yarn install --frozen-lockfile
-
       - name: 🔤 Compile translations
-        run: yarn intl:build 2>&1 | tee i18n.log
-
-      - name: Check for i18n compilation errors
-        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
+        uses: ./.github/actions/compile-i18n
 
       # EXPO_PUBLIC_ENV is handled in eas.json
-      - name: Env
+      - name: ✏️ Write environment variables
         id: env
-        run: |
-          export json='${{ secrets.GOOGLE_SERVICES_TOKEN }}'
-          echo "${{ secrets.ENV_TOKEN }}" > .env
-          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> .env
-          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
-          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> .env
-          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-          echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
-          echo "EXPO_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}" >> .env
-          echo "EXPO_PUBLIC_BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
-          echo "EXPO_PUBLIC_GCP_PROJECT_ID=${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}" >> .env
-          echo "$json" > google-services.json
+        uses: ./.github/actions/write-env
+        with:
+          env-token: ${{ secrets.ENV_TOKEN }}
+          sentry-dsn: ${{ secrets.SENTRY_DSN }}
+          bitdrift-api-key: ${{ secrets.BITDRIFT_API_KEY }}
+          gcp-project-id: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
+          google-services-token: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
 
       - name: 🏗️ EAS Build
-        env:
-          PROFILE: ${{ inputs.profile || 'testflight-android' }}
-        run: >
-          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
-          yarn use-build-number-with-bump
-          eas build -p android
-          --profile $PROFILE
-          --local --output build.aab --non-interactive
-
-      - name: ✍️ Rename Testflight bundle
-        if: ${{ inputs.profile != 'production' }}
-        run: mv build.aab build.apk
-
-      - name: ⏰ Get a timestamp
-        id: timestamp
-        uses: nanzm/get-time-action@master
+        uses: ./.github/actions/eas-local-build
         with:
-          format: "MM-DD-HH-mm-ss"
-
-      - name: 🚀 Upload Production Artifact
-        id: upload-artifact-production
-        if: ${{ inputs.profile == 'production' }}
-        uses: actions/upload-artifact@v4
-        with:
-          retention-days: 30
-          compression-level: 6
-          name: build-${{ steps.timestamp.outputs.time }}.aab
-          path: build.aab
-
-      - name: 🚀 Upload Testflight Artifact
-        id: upload-artifact-testflight
-        if: ${{ inputs.profile != 'production' }}
-        uses: actions/upload-artifact@v4
-        with:
-          retention-days: 30
-          compression-level: 6
-          name: build-${{ steps.timestamp.outputs.time }}.apk
-          path: build.apk
+          platform: android
+          profile: ${{ inputs.profile || 'testflight-android' }}
+          output: build.aab
+          bump-build-number: "true"
+          sentry-auth-token: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          sentry-release: ${{ steps.env.outputs.release-version }}
+          sentry-dist: ${{ steps.env.outputs.bundle-identifier }}
 
       - name: 📚 Get version from package.json
         id: get-build-info
         run: bash scripts/setGitHubOutput.sh
 
-      - name: 🔔 Notify Slack of Production Build
-        if: ${{ inputs.profile == 'production' }}
-        uses: slackapi/slack-github-action@v1.25.0
+      # Hands the built bundle off to the submit / universalApk jobs. Retention is
+      # deliberately short (1 day) since it's only an intra-run handoff artifact.
+      - name: 🚀 Upload AAB artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          payload: |
-            {
-              "text": "Android production build for Google Play Store submission is ready!\n```Artifact: ${{ steps.upload-artifact-production.outputs.artifact-url }}\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}```"
-            }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+          name: android-aab-${{ github.run_id }}
+          retention-days: 1
+          if-no-files-found: error
+          path: build.aab
 
-      - name: 🔔 Notify Slack of Testflight Build
-        if: ${{ inputs.profile != 'production' }}
-        uses: slackapi/slack-github-action@v1.25.0
+      - name: 📝 Write build summary
+        env:
+          REMOTE_VERSION_CODE: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}
+        run: |
+          {
+            echo "### Android build number"
+            echo
+            echo "\`$REMOTE_VERSION_CODE\`"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  submit:
+    name: Submit to Google Play
+    runs-on: ubuntu-latest
+    needs: [build]
+    # Submit unless explicitly disabled; on events where inputs is empty this still submits.
+    if: ${{ inputs.submit != false }}
+    steps:
+      # eas submit reads app config from the repo, so we need a checkout.
+      - name: ⬇️ Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          payload: |
-            {
-              "text": "Android build is ready for testing. Download the artifact here: ${{ steps.upload-artifact-testflight.outputs.artifact-url }}"
-            }
+          fetch-depth: 5
+
+      - name: 🔧 Setup Expo project
+        uses: ./.github/actions/setup-expo-project
+        with:
+          expo-token: ${{ secrets.EXPO_TOKEN }}
+
+      - name: ⬇️ Download AAB artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: android-aab-${{ github.run_id }}
+
+      - name: 🚀 Submit to Google Play
         env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+          PROFILE: ${{ inputs.profile || 'testflight-android' }}
+        run: pnpm eas submit -p android --profile $PROFILE --non-interactive --path build.aab
 
-      - name: 🧹 Clear Metro cache
+      - name: 🔔 Notify Slack of Play Store Submission
         if: ${{ inputs.profile == 'production' }}
-        # https://github.com/expo/eas-cli/issues/2959#issuecomment-2749791326
-        run: rm -rf ${TMPDIR:-/tmp}/metro-cache
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload-templated: true
+          payload: |
+            {"text": "Android ${{ inputs.profile || 'testflight-android' }} build submitted to Google Play!\n```Version Number: ${{ needs.build.outputs.package-version }}\nBuild Number: ${{ needs.build.outputs.version-code }}```"}
 
-      - name: 🏗️ Build Production APK
-        if: ${{ inputs.profile == 'production' }}
-        run: >
-          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
-          yarn use-build-number-with-bump
-          eas build -p android
-          --profile production-apk
-          --local --output build.apk --non-interactive
+  # Runs in parallel with submit: the QA APK shouldn't be blocked by a Play submission failure.
+  universalApk:
+    name: Build universal APK
+    runs-on: ubuntu-latest
+    needs: [build]
+    outputs:
+      apk-artifact-name: build-${{ steps.timestamp.outputs.time }}.apk
+    steps:
+      - name: ⬇️ Download AAB artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: android-aab-${{ github.run_id }}
 
-      - name: 🚀 Upload Production APK Artifact
-        id: upload-artifact-production-apk
-        if: ${{ inputs.profile == 'production' }}
-        uses: actions/upload-artifact@v4
+      # bundletool needs a JRE. ubuntu-latest ships a default JDK, but pin it explicitly
+      # like the build job so the toolchain is deterministic.
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        with:
+          distribution: "temurin"
+          java-version: "17"
+
+      - name: 🔧 Setup bundletool
+        uses: amyu/setup-bundletool@cc2e1857284660bd625e43f2c8a45626f034302f # v1.1
+        with:
+          version: "1.18.3"
+
+      - name: 🔑 Decode keystore
+        env:
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+        run: echo "$ANDROID_KEYSTORE_BASE64" | base64 --decode > keystore.jks
+
+      - name: 📦 Build signed universal APK
+        env:
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+        run: |
+          bundletool build-apks \
+            --bundle=build.aab \
+            --output=universal.apks \
+            --mode=universal \
+            --ks=keystore.jks \
+            --ks-pass=pass:"$ANDROID_KEYSTORE_PASSWORD" \
+            --ks-key-alias="$ANDROID_KEY_ALIAS" \
+            --key-pass=pass:"$ANDROID_KEY_PASSWORD"
+
+      - name: 📋 Rename to .zip for extraction
+        run: mv universal.apks universal.zip
+
+      - name: 📦 Extract universal APK
+        run: unzip -p universal.zip universal.apk > build.apk
+
+      - name: ⏰ Get a timestamp
+        id: timestamp
+        run: echo "time=$(date -u +'%m-%d-%H-%M-%S')" >> "$GITHUB_OUTPUT"
+
+      - name: 🚀 Upload APK Artifact
+        id: upload-artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           retention-days: 30
           compression-level: 6
           name: build-${{ steps.timestamp.outputs.time }}.apk
           path: build.apk
 
-      - name: 🔔 Notify Slack of Production APK Build
-        if: ${{ inputs.profile == 'production' }}
-        uses: slackapi/slack-github-action@v1.25.0
+      - name: 🔔 Notify Slack of APK Artifact
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
+          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload-templated: true
           payload: |
-            {
-              "text": "Android production build for GitHub/Obtanium is ready!\n```Artifact: ${{ steps.upload-artifact-production-apk.outputs.artifact-url }}\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}```"
-            }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+            {"text": "Android ${{ inputs.profile || 'testflight-android' }} APK is ready for testing!\n```Artifact: ${{ steps.upload-artifact.outputs.artifact-url }}\nVersion Number: ${{ needs.build.outputs.package-version }}\nBuild Number: ${{ needs.build.outputs.version-code }}```"}
 
-      - name: ⬇️ Restore Cache
-        id: get-base-commit
-        uses: actions/cache@v4
-        if: ${{ inputs.profile == 'testflight-android' }}
+  # Releases are cut from tags named after the version (e.g. "1.124.0"), so when a production
+  # build is dispatched against such a tag we attach the APK to the matching release. This runs
+  # as a separate job so that `contents: write` is isolated here and the build job stays read-only.
+  attachToRelease:
+    name: Attach APK to GitHub Release
+    runs-on: ubuntu-latest
+    needs: [build, universalApk]
+    if: ${{ inputs.profile == 'production' && github.ref_type == 'tag' && github.repository == 'bluesky-social/social-app' }}
+    permissions:
+      contents: write
+    steps:
+      # We only attach to a release that already exists — never create one.
+      - name: 🔎 Check for matching GitHub Release
+        id: release-check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          status=$(curl -sS -o /dev/null -w '%{http_code}' \
+            -H "Authorization: Bearer $GH_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}")
+          if [ "$status" = "200" ]; then
+            echo "Found GitHub Release for tag $TAG"
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "No GitHub Release found for tag $TAG (HTTP $status); skipping APK attachment."
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: ⬇️ Download APK artifact
+        if: ${{ steps.release-check.outputs.exists == 'true' }}
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          path: most-recent-testflight-commit.txt
-          key: most-recent-testflight-commit
+          name: ${{ needs.universalApk.outputs.apk-artifact-name }}
 
-      - name: ✏️ Write commit hash to cache
-        if: ${{ inputs.profile == 'testflight-android' }}
+      - name: 🏷️ Rename APK for release
+        if: ${{ steps.release-check.outputs.exists == 'true' }}
+        run: cp build.apk "Bluesky-${{ needs.build.outputs.package-version }}.apk"
+
+      - name: 📎 Attach APK to GitHub Release
+        id: attach
+        if: ${{ steps.release-check.outputs.exists == 'true' }}
         env:
-          GITHUB_SHA: ${{ github.sha }}
-        run: echo $GITHUB_SHA > most-recent-testflight-commit.txt
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          TAG: ${{ github.ref_name }}
+          APK: Bluesky-${{ needs.build.outputs.package-version }}.apk
+        run: |
+          gh release upload "$TAG" "$APK" --clobber
+          url=$(gh release view "$TAG" --json url --jq .url)
+          echo "url=$url" >> "$GITHUB_OUTPUT"
+
+      - name: 🔔 Notify Slack of Release Attachment
+        if: ${{ steps.release-check.outputs.exists == 'true' }}
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload-templated: true
+          payload: |
+            {"text": "Android APK attached to GitHub Release ${{ github.ref_name }}!\n```Asset: Bluesky-${{ needs.build.outputs.package-version }}.apk\nRelease: ${{ steps.attach.outputs.url }}```"}

.github/workflows/build-submit-ios.yml

@@ -10,149 +10,315 @@ on:
         options:
           - testflight
           - production
+      testFlightGroup:
+        type: choice
+        description: TestFlight group to assign the build to after submitting
+        options:
+          - none
+          - QA Team
+          - Software Mansion
+        default: none
+      changelog:
+        type: string
+        description: TestFlight "What to Test" notes (only applied when a group is selected)
+        required: false
+        default: ''
+  workflow_call:
+    inputs:
+      profile:
+        type: string
+        description: Build profile to use
+        required: true
+      testFlightGroup:
+        type: string
+        description: TestFlight group to assign the build to after submitting ("none" to skip)
+        default: none
+      runner:
+        type: string
+        description: Runner for the build job (defaults to macos-26-xlarge)
+        required: false
+        default: ''
+    outputs:
+      package-version:
+        description: Version from package.json
+        value: ${{ jobs.build.outputs.package-version }}
+      build-number:
+        description: iOS build number
+        value: ${{ jobs.build.outputs.build-number }}
+    secrets:
+      EXPO_TOKEN:
+        required: true
+      ENV_TOKEN:
+        required: true
+      SENTRY_DSN:
+        required: true
+      BITDRIFT_API_KEY:
+        required: true
+      EXPO_PUBLIC_GCP_PROJECT_ID:
+        required: true
+      GOOGLE_SERVICES_TOKEN:
+        required: true
+      SENTRY_AUTH_TOKEN:
+        required: true
+      ASC_KEY_ID:
+        required: true
+      ASC_ISSUER_ID:
+        required: true
+      ASC_KEY_P8_BASE64:
+        required: true
+      SLACK_CLIENT_ALERT_WEBHOOK:
+        required: true
+
+# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
+permissions:
+  contents: read
 
 jobs:
   build:
     if: github.repository == 'bluesky-social/social-app'
-    name: Build and Submit iOS
-    runs-on: macos-26-xlarge
+    name: Build iOS
+    runs-on: ${{ inputs.runner || 'macos-26-xlarge' }}
     concurrency:
       group: ios-build
       cancel-in-progress: false
+    outputs:
+      package-version: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
+      build-number: ${{ steps.ipa-build-number.outputs.build-number }}
     steps:
-      - name: Check for EXPO_TOKEN
-        run: >
-          if [ -z "${{ secrets.EXPO_TOKEN }}" ]; then
-            echo "You must provide an EXPO_TOKEN secret linked to this project's Expo account in this repo's secrets. Learn more: https://docs.expo.dev/eas-update/github-actions"
-            exit 1
-          fi
-
       - name: ⬇️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 5
 
-      - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+      - name: 🔧 Setup Expo project
+        uses: ./.github/actions/setup-expo-project
         with:
-          node-version-file: .nvmrc
-          cache: yarn
+          expo-token: ${{ secrets.EXPO_TOKEN }}
 
-      - name: 🪛 Setup jq
-        uses: dcarbone/install-jq-action@v2
-
-      - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@main
+      - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
         with:
-          expo-version: latest
-          eas-version: latest
-          token: ${{ secrets.EXPO_TOKEN }}
+          xcode-version: "26.4"
 
-      - name: ⛏️ Setup EAS local builds
-        run: yarn global add eas-cli-local-build-plugin
-
-      - name: ⚙️ Install dependencies
-        run: yarn install --frozen-lockfile
-
-      - uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: "26.0"
-
-      - name: ☕️ Setup Cocoapods
-        uses: maxim-lobanov/setup-cocoapods@v1
-        with:
-          version: 1.16.2
+      - name: ☕️ Assert Cocoapods version
+        run: |
+          EXPECTED=1.17.0
+          ACTUAL=$(pod --version)
+          if [ "$ACTUAL" != "$EXPECTED" ]; then
+            echo "Expected Cocoapods $EXPECTED but runner has $ACTUAL."
+            echo "The version ships preinstalled with the macOS runner image: https://github.com/actions/runner-images/blob/main/images/macos/macos-26-Readme.md"
+            echo "If the runner image changed, update EXPECTED here or reinstall the pinned version."
+            exit 1
+          fi
 
       - name: 💾 Cache Pods
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: pods-cache
         with:
           path: ./ios/Pods
-          # We'll use the yarn.lock for our hash since we don't yet have a Podfile.lock. Pod versions will not
-          # change unless the yarn version changes as well.
-          key: ${{ runner.os }}-pods-${{ hashFiles('yarn.lock') }}
+          # We'll use the pnpm-lock.yaml for our hash since we don't yet have a Podfile.lock. Pod versions will not
+          # change unless the pnpm version changes as well.
+          key: ${{ runner.os }}-pods-${{ hashFiles('pnpm-lock.yaml') }}
 
       - name: 🔤 Compile translations
-        run: yarn intl:build 2>&1 | tee i18n.log
-
-      - name: Check for i18n compilation errors
-        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
+        uses: ./.github/actions/compile-i18n
 
       # EXPO_PUBLIC_ENV is handled in eas.json
       - name: ✏️ Write environment variables
         id: env
-        run: |
-          echo "${{ secrets.ENV_TOKEN }}" > .env
-          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> .env
-          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
-          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> .env
-          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-          echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
-          echo "EXPO_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}" >> .env
-          echo "EXPO_PUBLIC_BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
-          echo "EXPO_PUBLIC_GCP_PROJECT_ID=${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}" >> .env
-          echo "${{ secrets.GOOGLE_SERVICES_TOKEN }}" > google-services.json
+        uses: ./.github/actions/write-env
+        with:
+          env-token: ${{ secrets.ENV_TOKEN }}
+          sentry-dsn: ${{ secrets.SENTRY_DSN }}
+          bitdrift-api-key: ${{ secrets.BITDRIFT_API_KEY }}
+          gcp-project-id: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
+          google-services-token: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
 
       - name: 🏗️ EAS Build
-        env:
-          PROFILE: ${{ inputs.profile || 'testflight' }}
-        run: >
-          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
-          yarn use-build-number-with-bump
-          eas build -p ios
-          --profile $PROFILE
-          --local --output build.tar.gz --non-interactive
+        uses: ./.github/actions/eas-local-build
+        with:
+          platform: ios
+          profile: ${{ inputs.profile || 'testflight' }}
+          output: build.tar.gz
+          bump-build-number: "true"
+          sentry-auth-token: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          sentry-release: ${{ steps.env.outputs.release-version }}
+          sentry-dist: ${{ steps.env.outputs.bundle-identifier }}
 
       - name: 📂 Extract build artifact
         run: |
           if [ -f "build.tar.gz" ]; then
             echo "Extracting build.tar.gz..."
-            mkdir ios-build
+            rm -rf ios-build
+            mkdir -p ios-build
             tar -xzf build.tar.gz -C ios-build
             echo "Extraction completed successfully"
+
+            echo ""
+            echo "Top-level extracted files:"
+            find ios-build -maxdepth 3 -print
+
+            echo ""
+            echo "Searching for IPA..."
+            IPA_PATH="$(find ios-build -type f -name '*.ipa' -print -quit)"
+            if [ -z "$IPA_PATH" ]; then
+              echo "ERROR: No .ipa found anywhere under ios-build."
+              echo "Archive contents:"
+              tar -tzf build.tar.gz | sed -n '1,200p'
+              exit 1
+            fi
+
+            BUILD_DIR="$(dirname "$IPA_PATH")"
+            echo "Found IPA at: $IPA_PATH"
+            echo "Build dir: $BUILD_DIR"
+            echo ""
+            echo "Build dir contents:"
+            ls -la "$BUILD_DIR"
+            echo "BUILD_DIR=$BUILD_DIR" >> $GITHUB_ENV
           else
             echo "Archive file not found!"
             exit 1
           fi
 
-      - name: 🚀 Deploy
-        run: eas submit -p ios --non-interactive --path ios-build/ios/build/Bluesky.ipa
-
-      - name: 🪲 Upload dSYM to Sentry
-        run: >
-          SENTRY_ORG=blueskyweb
-          SENTRY_PROJECT=app
-          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          yarn sentry-cli debug-files upload ios-build/ios/build/Bluesky.app.dSYM.zip --include-sources
-
       - name: 📚 Get version from package.json
         id: get-build-info
         run: bash scripts/setGitHubOutput.sh
 
+      # Read the build number straight from the IPA's CFBundleVersion. This is the value
+      # baked in at build time by use-build-number-with-bump (remote counter + 1) and the
+      # number that actually lands in App Store Connect. `eas build:version:get` reads the
+      # remote counter, which a --local build does not advance, so it can be off by one —
+      # using it here would make distribute_only poll for a nonexistent build.
+      # PlistBuddy is macOS-only, which is why this stays in the build job.
+      - name: 🔢 Read build number from IPA
+        id: ipa-build-number
+        run: |
+          plist_dir="$(mktemp -d)"
+          unzip -o -q "$BUILD_DIR/Bluesky.ipa" 'Payload/*.app/Info.plist' -d "$plist_dir"
+          plist="$(find "$plist_dir" -name Info.plist -print -quit)"
+          build_number="$(/usr/libexec/PlistBuddy -c 'Print CFBundleVersion' "$plist")"
+          rm -rf "$plist_dir"
+          if [ -z "$build_number" ]; then
+            echo "ERROR: could not read CFBundleVersion from IPA"
+            exit 1
+          fi
+          echo "IPA build number: $build_number"
+          echo "build-number=$build_number" >> "$GITHUB_OUTPUT"
+
+      # Hand the IPA and dSYM off to the submit job. Retention is deliberately short since
+      # this artifact only exists to bridge the two jobs within a single run.
+      - name: 🚀 Upload build artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ios-build-${{ github.run_id }}
+          retention-days: 1
+          if-no-files-found: error
+          path: |
+            ${{ env.BUILD_DIR }}/Bluesky.ipa
+            ${{ env.BUILD_DIR }}/Bluesky.app.dSYM.zip
+
+      - name: 📝 Write build summary
+        env:
+          REMOTE_BUILD_NUMBER: ${{ steps.get-build-info.outputs.BSKY_IOS_BUILD_NUMBER }}
+        run: |
+          {
+            echo "### iOS build number"
+            echo
+            echo "\`$REMOTE_BUILD_NUMBER\`"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  submit:
+    name: Submit iOS
+    # Submission and dSYM upload are I/O bound and don't need the xlarge builder.
+    runs-on: macos-26
+    needs: [build]
+    steps:
+      - name: ⬇️ Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # eas submit reads the app config from the repo
+          fetch-depth: 5
+
+      - name: 🔧 Setup Expo project
+        uses: ./.github/actions/setup-expo-project
+        with:
+          expo-token: ${{ secrets.EXPO_TOKEN }}
+
+      - name: ⬇️ Download build artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ios-build-${{ github.run_id }}
+          path: ios-build
+
+      - name: 🚀 Deploy
+        run: pnpm eas submit -p ios --non-interactive --path ios-build/Bluesky.ipa
+
+      - name: 🪲 Upload dSYM to Sentry
+        env:
+          SENTRY_ORG: blueskyweb
+          SENTRY_PROJECT: app
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+        run: pnpm sentry-cli debug-files upload ios-build/Bluesky.app.dSYM.zip --include-sources
+
       - name: 🔔 Notify Slack of Production Build
         if: ${{ inputs.profile == 'production' }}
-        uses: slackapi/slack-github-action@v1.25.0
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
+          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload-templated: true
           payload: |
-            {
-              "text": "iOS production build for App Store submission is ready!\n```Artifact: Check TestFlight to know when it is available\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_IOS_BUILD_NUMBER }}```"
-            }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+            {"text": "iOS production build for App Store submission is ready!\n```Artifact: Check TestFlight to know when it is available\nVersion Number: ${{ needs.build.outputs.package-version }}\nBuild Number: ${{ needs.build.outputs.build-number }}```"}
 
-      - name: ⬇️ Restore Cache
-        id: get-base-commit
-        uses: actions/cache@v4
-        if: ${{ inputs.profile == 'testflight' }}
-        with:
-          path: most-recent-testflight-commit.txt
-          key: most-recent-testflight-commit
-
-      - name: ✏️ Write commit hash to cache
+  distribute:
+    name: Assign build to TestFlight group
+    # fastlane and jq ship preinstalled on the macOS runner image, and this step mostly idles
+    # polling Apple processing, so it runs on a normal-size runner.
+    runs-on: macos-26
+    needs: [build, submit]
+    # testFlightGroup defaults to 'none' on both workflow_call and dispatch; guard against the
+    # empty string too, since `!= 'none'` alone would be true for ''.
+    if: ${{ inputs.testFlightGroup && inputs.testFlightGroup != 'none' }}
+    steps:
+      # eas submit only uploads to App Store Connect; it can't assign a build to a
+      # TestFlight group. fastlane's distribute_only mode skips the upload and assigns the
+      # already-submitted build to the group, polling until Apple finishes processing it.
+      - name: 🧪 Assign build to TestFlight group
         env:
-          GITHUB_SHA: ${{ github.sha }}
-        if: ${{ inputs.profile == 'testflight' }}
-        run: echo $GITHUB_SHA > most-recent-testflight-commit.txt
+          TESTFLIGHT_GROUP: ${{ inputs.testFlightGroup }}
+          CHANGELOG: ${{ inputs.changelog }}
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+          ASC_KEY_P8_BASE64: ${{ secrets.ASC_KEY_P8_BASE64 }}
+          APP_VERSION: ${{ needs.build.outputs.package-version }}
+          BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
+        run: |
+          # Ensure the API key material is removed even if fastlane exits non-zero
+          # (the step runs under `bash -e`, which would otherwise abort before cleanup).
+          trap 'rm -f asc_api_key.json' EXIT
+          # fastlane's Token.from_json_file expects the .p8 contents inline under "key"
+          # (PEM with embedded newlines), not a path. jq handles the newline escaping.
+          key_content="$(echo "$ASC_KEY_P8_BASE64" | base64 --decode)"
+          jq -n \
+            --arg key_id "$ASC_KEY_ID" \
+            --arg issuer_id "$ASC_ISSUER_ID" \
+            --arg key "$key_content" \
+            '{key_id: $key_id, issuer_id: $issuer_id, key: $key, in_house: false}' \
+            > asc_api_key.json
+          # changelog is optional, and passing it empty would blank out whatever "What to
+          # Test" notes the build already has, so only include the flag when it is set.
+          changelog_arg=()
+          if [ -n "$CHANGELOG" ]; then
+            changelog_arg=(changelog:"$CHANGELOG")
+          fi
+          # app_platform is required in non-interactive mode: distribute_only otherwise
+          # calls fetch_app_platform, which prompts for input and crashes without a TTY.
+          fastlane run upload_to_testflight \
+            api_key_path:"$PWD/asc_api_key.json" \
+            distribute_only:true \
+            app_platform:"ios" \
+            app_identifier:"xyz.blueskyweb.app" \
+            app_version:"$APP_VERSION" \
+            build_number:"$BUILD_NUMBER" \
+            groups:"$TESTFLIGHT_GROUP" \
+            notify_external_testers:true \
+            "${changelog_arg[@]}"

.github/workflows/bundle-deploy-eas-update.yml

@@ -17,20 +17,46 @@ on:
         type: string
         description: Runtime version (in x.x.x format) that this update is for
         required: true
+      iosBuildNumber:
+        type: string
+        description: iOS build number of the native build this update targets
+          (required for production)
+      androidVersionCode:
+        type: string
+        description: Android version code of the native build this update
+          targets (required for production)
+
+# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
+permissions:
+  contents: read
+
+# denis release tag in bluesky-social/tango whose linux-amd64 binary this
+# workflow downloads to publish OTA bundles. Bump this one line to roll denis.
+env:
+  DENIS_RELEASE_TAG: denis-v0.1.1
 
 jobs:
   bundleDeploy:
     if: github.repository == 'bluesky-social/social-app'
     name: Bundle and Deploy EAS Update
     runs-on: ubuntu-latest
+    # id-token: write lets this job mint an OIDC token to assume the denis
+    # publish role; actions: read loads the fingerprint baseline artifact;
+    # contents: read is still needed for the checkout.
+    permissions:
+      id-token: write
+      actions: read
+      contents: read
     concurrency:
       group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}-deploy
       cancel-in-progress: true
     outputs:
-      changes-detected: ${{ steps.fingerprint.outputs.includes-changes }}
+      # A version bump forces a native build even if the fingerprint is unchanged
+      changes-detected: ${{ steps.fingerprint.outputs.includes-changes ||
+        steps.version.outputs.version-changed }}
 
     steps:
-      - name: Check for EXPO_TOKEN
+      - name: 🔑 Check for EXPO_TOKEN
         run: >
           if [ -z "${{ secrets.EXPO_TOKEN }}" ]; then
             echo "You must provide an EXPO_TOKEN secret linked to this project's Expo account in this repo's secrets. Learn more: https://docs.expo.dev/eas-update/github-actions"
@@ -43,12 +69,25 @@ jobs:
           RUNTIME_VERSION: ${{ inputs.runtimeVersion }}
         if: ${{ inputs.runtimeVersion }}
         run: |
-          if [ -z "$RUNTIME_VERSION" ]; then
-            [[ "$RUNTIME_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] && echo "Version is valid" || exit 1
-          fi
+          [[ "$RUNTIME_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] && echo "Version is valid" || exit 1
+
+      # Production OTAs are bound to the specific native build they target, so
+      # the build numbers must be entered manually rather than read from the
+      # global EAS counters, which advance with every testflight build and so
+      # point past older production releases
+      - name: 🧐 Validate build numbers
+        if: ${{ inputs.channel == 'production' }}
+        env:
+          IOS_BUILD_NUMBER: ${{ inputs.iosBuildNumber }}
+          ANDROID_VERSION_CODE: ${{ inputs.androidVersionCode }}
+        run: |
+          [[ "$IOS_BUILD_NUMBER" =~ ^[0-9]+$ ]] ||
+            (echo "A numeric iosBuildNumber is required for production updates" && exit 1)
+          [[ "$ANDROID_VERSION_CODE" =~ ^[0-9]+$ ]] ||
+            (echo "A numeric androidVersionCode is required for production updates" && exit 1)
 
       - name: ⬇️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -56,321 +95,306 @@ jobs:
         if: ${{ github.ref != 'refs/heads/main' }}
         run: git fetch origin main:main --depth 100
 
+      # A change to the version in package.json means a new native release, so
+      # an OTA update must not be deployed and full native builds are required
+      # regardless of what the fingerprint says
+      - name: 🔢 Check for version change
+        id: version
+        if: ${{ github.event_name == 'push' }}
+        env:
+          EVENT_BEFORE: ${{ github.event.before }}
+        run: |
+          CURRENT_VERSION=$(jq -r '.version' package.json)
+          if [ -n "$EVENT_BEFORE" ] && [[ ! "$EVENT_BEFORE" =~ ^0+$ ]] && git cat-file -e "$EVENT_BEFORE:package.json" 2>/dev/null; then
+            PREVIOUS_VERSION=$(git show "$EVENT_BEFORE:package.json" | jq -r '.version')
+          else
+            PREVIOUS_VERSION=$(git show HEAD~1:package.json | jq -r '.version')
+          fi
+          echo "Previous version: $PREVIOUS_VERSION, current version: $CURRENT_VERSION"
+          if [ "$CURRENT_VERSION" != "$PREVIOUS_VERSION" ]; then
+            echo "Version changed, full native builds are required"
+            echo "version-changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+
       - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version-file: .nvmrc
-          cache: yarn
+          node-version-file: package.json
+          cache: pnpm
+
+      - name: ⬇️ Load fingerprint baseline
+        id: baseline
+        if: ${{ (inputs.channel || 'testflight') == 'testflight' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY_ID: ${{ github.repository_id }}
+        run: |
+          url=$(gh api \
+            "repos/${GITHUB_REPOSITORY}/actions/artifacts?name=testflight-native-fingerprint&per_page=100" \
+            --jq "[.artifacts[] | select(
+              .expired == false and
+              .workflow_run.head_branch == \"main\" and
+              .workflow_run.head_repository_id == (\$ENV.REPOSITORY_ID | tonumber)
+            )] | max_by(.created_at) | .archive_download_url" \
+            2>/dev/null || true)
+
+          if [ -n "$url" ] && [ "$url" != "null" ]; then
+            mkdir baseline-artifact
+            if curl -sSL -H "Authorization: Bearer $GH_TOKEN" -o baseline.zip "$url" \
+              && unzip -q baseline.zip -d baseline-artifact; then
+              if jq -e '.sources | type == "array"' \
+                baseline-artifact/native-fingerprint.json >/dev/null; then
+                echo "path=baseline-artifact/native-fingerprint.json" >> "$GITHUB_OUTPUT"
+              else
+                echo "::warning::Ignoring invalid fingerprint baseline artifact."
+              fi
+            else
+              echo "::warning::Could not download fingerprint baseline artifact."
+            fi
+          fi
 
       - name: 📷 Check fingerprint and install dependencies
         id: fingerprint
-        uses: bluesky-social/github-actions/fingerprint-native@main
+        uses: bluesky-social/github-actions/fingerprint-native@abc6a46eb4badf243f55bfd7d6cec42722456300 # v0.3.0
         with:
           profile: ${{ inputs.channel || 'testflight' }}
           previous-commit-tag: ${{ inputs.runtimeVersion }}
+          # The recordBaseline job uploads this marker after a successful deploy;
+          # on the native path, that requires both builds to succeed. A missing
+          # marker forces native builds so they can seed the baseline safely.
+          baseline-fingerprint-path: ${{ steps.baseline.outputs.path }}
 
-      - name: Lint check
-        run: yarn lint
-
-      - name: Lint lockfile
-        run: yarn lockfile-lint
-
-      - name: Prettier check
-        run: yarn prettier --check .
+      # Hand the full fingerprint to recordBaseline through a short-lived
+      # artifact. It is uploaded unconditionally but promoted to the persistent
+      # baseline only after both native builds succeed.
+      - name: 🚀 Upload native fingerprint
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: native-fingerprint-${{ github.run_id }}
+          path: ${{ steps.fingerprint.outputs.current-fingerprint-path }}
+          retention-days: 1
+          if-no-files-found: error
 
       - name: 🔤 Compile translations
-        run: yarn intl:build 2>&1 | tee i18n.log
+        uses: ./.github/actions/compile-i18n
 
-      - name: Check for i18n compilation errors
-        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
+      - name: 🧹 Lint check
+        run: pnpm lint
 
-      - name: Type check
-        run: yarn typecheck
+      - name: 💅 Prettier check
+        run: pnpm prettier --check .
+
+      - name: 🔎 Type check
+        run: pnpm typecheck
 
       - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@main
-        if: ${{ !steps.fingerprint.outputs.includes-changes }}
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
+        if: ${{ !steps.fingerprint.outputs.includes-changes &&
+          !steps.version.outputs.version-changed }}
         with:
-          expo-version: latest
-          eas-version: latest
+          eas-version: '19.0.5'
+          packager: 'pnpm --allow-build=dtrace-provider'
           token: ${{ secrets.EXPO_TOKEN }}
 
-      - name: ⛏️ Setup Expo
-        if: ${{ !steps.fingerprint.outputs.includes-changes }}
-        run: yarn global add eas-cli-local-build-plugin
-
       - name: 🪛 Setup jq
-        if: ${{ !steps.fingerprint.outputs.includes-changes }}
-        uses: dcarbone/install-jq-action@v2
+        if: ${{ !steps.fingerprint.outputs.includes-changes &&
+          !steps.version.outputs.version-changed }}
+        uses: dcarbone/install-jq-action@4fcb5062d7ce9bc4382d1a352d19ba3ba2c317c1 # v4.0.1
 
-      # eas.json not used here, set EXPO_PUBLIC_ENV
-      - name: Env
-        env:
-          CHANNEL: ${{ inputs.channel || 'testflight' }}
-          GITHUB_SHA: ${{ github.sha }}
+      # eas.json not used here, so EXPO_PUBLIC_ENV must be written explicitly
+      - name: ✏️ Write environment variables
         id: env
-        if: ${{ !steps.fingerprint.outputs.includes-changes }}
-        run: |
-          export json='${{ secrets.GOOGLE_SERVICES_TOKEN }}'
-          echo "${{ secrets.ENV_TOKEN }}" > .env
-          echo "EXPO_PUBLIC_ENV=$CHANNEL" >> .env
-          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> .env
-          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
-          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> .env
-          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-          echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
-          echo "EXPO_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}" >> .env
-          echo "EXPO_PUBLIC_BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
-          echo "EXPO_PUBLIC_GCP_PROJECT_ID=${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}" >> .env
-          echo "$json" > google-services.json
+        if: ${{ !steps.fingerprint.outputs.includes-changes && !steps.version.outputs.version-changed }}
+        uses: ./.github/actions/write-env
+        with:
+          env-token: ${{ secrets.ENV_TOKEN }}
+          sentry-dsn: ${{ secrets.SENTRY_DSN }}
+          bitdrift-api-key: ${{ secrets.BITDRIFT_API_KEY }}
+          gcp-project-id: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
+          google-services-token: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
+          expo-public-env: ${{ inputs.channel || 'testflight' }}
 
       - name: 🏗️ Create Bundle
-        if: ${{ !steps.fingerprint.outputs.includes-changes }}
+        if: ${{ !steps.fingerprint.outputs.includes-changes &&
+          !steps.version.outputs.version-changed }}
         run: >
           SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
-          yarn export
+          SENTRY_RELEASE=${{ steps.env.outputs.release-version }}
+          SENTRY_DIST=${{ steps.env.outputs.bundle-identifier }}
+          pnpm export
 
-      - name: 📦 Package Bundle and 🚀 Deploy
-        if: ${{ !steps.fingerprint.outputs.includes-changes }}
-        run: yarn use-build-number bash scripts/bundleUpdate.sh
+      # Pin ONE bundle version for both publishes below. Each script used to call
+      # `date +%s` itself, so the same bytes reached denis and ota1 under versions
+      # seconds apart (observed: 1785102575 vs 1785102614). The version is part of
+      # the asset URL path, so each origin then served a manifest referencing a
+      # path only it had -- meaning a manifest fetched from one origin and assets
+      # fetched from the other 404. Both scripts fall back to `date +%s` when this
+      # is unset, so single-publisher callers are unaffected.
+      - name: 🔢 Pin bundle version
+        if: ${{ !steps.fingerprint.outputs.includes-changes &&
+          !steps.version.outputs.version-changed }}
+        run: echo "BUNDLE_VERSION=$(date +%s)" >> "$GITHUB_ENV"
+
+      # denis on EKS has been the sole origin for updates.bsky.app since
+      # 2026-07-26, so it publishes FIRST: it is the path that actually serves
+      # clients. The legacy ota1 upload runs after it, and exists only so that
+      # rolling the Bunny origin back to ota1 would find current bundles there.
+      #
+      # The ordering is load-bearing, not cosmetic. While the legacy step ran
+      # first, its failure skipped these steps and nothing reached EITHER origin
+      # -- the dual-write took down the working path with it. Both steps are
+      # still required to pass, so a stale ota1 remains a loud failure, but the
+      # publish that serves users has already landed before the legacy one can
+      # fail.
+      #
+      # Both halves are removed together when ota1 is decommissioned (Phase 5).
+      - name: ☁️ Configure AWS credentials (denis)
+        if: ${{ !steps.fingerprint.outputs.includes-changes &&
+          !steps.version.outputs.version-changed }}
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
+        with:
+          role-to-assume: arn:aws:iam::007404326489:role/denis-ci-publish
+          aws-region: us-east-2
+
+      - name: ⬇️ Setup denis CLI
+        if: ${{ !steps.fingerprint.outputs.includes-changes &&
+          !steps.version.outputs.version-changed }}
+        uses: ./.github/actions/setup-denis
+        with:
+          release-tag: ${{ env.DENIS_RELEASE_TAG }}
+          app-id: ${{ vars.SYNC_INTERNAL_APP_ID }}
+          private-key: ${{ secrets.SYNC_INTERNAL_PK }}
+
+      - name: 🚀 Publish OTA to denis (S3)
+        if: ${{ !steps.fingerprint.outputs.includes-changes &&
+          !steps.version.outputs.version-changed }}
+        run: pnpm use-build-number bash scripts/denisPublish.sh
+        env:
+          RUNTIME_VERSION: ${{ inputs.runtimeVersion }}
+          CHANNEL_NAME: ${{ inputs.channel || 'testflight' }}
+          # When set (required for production), these take precedence over the
+          # global EAS counters inside the use-build-number wrapper
+          BSKY_IOS_BUILD_NUMBER: ${{ inputs.iosBuildNumber }}
+          BSKY_ANDROID_VERSION_CODE: ${{ inputs.androidVersionCode }}
+
+      - name: 📦 Package Bundle and 🚀 Deploy (legacy ota1)
+        if: ${{ !steps.fingerprint.outputs.includes-changes &&
+          !steps.version.outputs.version-changed }}
+        run: pnpm use-build-number bash scripts/bundleUpdate.sh
         env:
           DENIS_API_KEY: ${{ secrets.DENIS_API_KEY }}
           RUNTIME_VERSION: ${{ inputs.runtimeVersion }}
           CHANNEL_NAME: ${{ inputs.channel || 'testflight' }}
+          # When set (required for production), these take precedence over the
+          # global EAS counters inside the use-build-number wrapper
+          BSKY_IOS_BUILD_NUMBER: ${{ inputs.iosBuildNumber }}
+          BSKY_ANDROID_VERSION_CODE: ${{ inputs.androidVersionCode }}
 
-      - name: ⬇️ Restore Cache
-        id: get-base-commit
-        uses: actions/cache@v4
-        if: ${{ !steps.fingerprint.outputs.includes-changes }}
-        with:
-          path: most-recent-testflight-commit.txt
-          key: most-recent-testflight-commit
-
-      - name: ✏️ Write commit hash to cache
-        if: ${{ !steps.fingerprint.outputs.includes-changes }}
-        run: echo $GITHUB_SHA > most-recent-testflight-commit.txt
-
-  # GitHub actions are horrible so let's just copy paste this in
   buildIfNecessaryIOS:
     name: Build and Submit iOS
-    runs-on: macos-26
-    concurrency:
-      group: ios-build
-      cancel-in-progress: false
     needs: [bundleDeploy]
     # Gotta check if its NOT '[]' because any md5 hash in the outputs is detected as a possible secret and won't be
     # available here
-    if: ${{ inputs.channel != 'production' && needs.bundleDeploy.outputs.changes-detected && github.repository == 'bluesky-social/social-app' }}
-    steps:
-      - name: Check for EXPO_TOKEN
-        run: >
-          if [ -z "${{ secrets.EXPO_TOKEN }}" ]; then
-            echo "You must provide an EXPO_TOKEN secret linked to this project's Expo account in this repo's secrets. Learn more: https://docs.expo.dev/eas-update/github-actions"
-            exit 1
-          fi
-
-      - name: ⬇️ Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 5
-
-      - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-          cache: yarn
-
-      - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@main
-        with:
-          expo-version: latest
-          eas-version: latest
-          token: ${{ secrets.EXPO_TOKEN }}
-
-      - name: ⛏️ Setup EAS local builds
-        run: yarn global add eas-cli-local-build-plugin
-
-      - name: ⚙️ Install dependencies
-        run: yarn install --frozen-lockfile
-
-      - uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: "26.0"
-
-      - name: ☕️ Setup Cocoapods
-        uses: maxim-lobanov/setup-cocoapods@v1
-        with:
-          version: 1.16.2
-
-      - name: 💾 Cache Pods
-        uses: actions/cache@v4
-        id: pods-cache
-        with:
-          path: ./ios/Pods
-          # We'll use the yarn.lock for our hash since we don't yet have a Podfile.lock. Pod versions will not
-          # change unless the yarn version changes as well.
-          key: ${{ runner.os }}-pods-${{ hashFiles('yarn.lock') }}
-
-      - name: 🔤 Compile translations
-        run: yarn intl:build
-
-      # EXPO_PUBLIC_ENV is handled in eas.json
-      - name: Env
-        id: env
-        run: |
-          echo "${{ secrets.ENV_TOKEN }}" > .env
-          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> .env
-          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
-          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> .env
-          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-          echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
-          echo "EXPO_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}" >> .env
-          echo "EXPO_PUBLIC_BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
-          echo "EXPO_PUBLIC_GCP_PROJECT_ID=${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}" >> .env
-          echo "${{ secrets.GOOGLE_SERVICES_TOKEN }}" > google-services.json
-
-      - name: 🏗️ EAS Build
-        run: >
-          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
-          yarn use-build-number-with-bump
-          eas build -p ios
-          --profile testflight
-          --local --output build.ipa --non-interactive
-
-      - name: 🚀 Deploy
-        run: eas submit -p ios --non-interactive --path build.ipa
-
-      - name: ⬇️ Restore Cache
-        id: get-base-commit
-        uses: actions/cache@v4
-        if: ${{ inputs.channel == 'testflight' }}
-        with:
-          path: most-recent-testflight-commit.txt
-          key: most-recent-testflight-commit
-
-      - name: ✏️ Write commit hash to cache
-        if: ${{ inputs.channel == 'testflight' }}
-        env:
-          GITHUB_SHA: ${{ github.sha }}
-        run: echo $GITHUB_SHA > most-recent-testflight-commit.txt
+    if: ${{ inputs.channel != 'production' &&
+      needs.bundleDeploy.outputs.changes-detected && github.repository ==
+      'bluesky-social/social-app' }}
+    uses: ./.github/workflows/build-submit-ios.yml
+    with:
+      profile: testflight
+      testFlightGroup: none
+      # OTA rebuilds don't need the xlarge builder used for releases
+      runner: macos-26
+    # Pass only the secrets the reusable workflow declares, rather than `secrets: inherit`,
+    # so this workflow never hands the reusable workflow the entire repo secret store.
+    secrets:
+      EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+      ENV_TOKEN: ${{ secrets.ENV_TOKEN }}
+      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+      BITDRIFT_API_KEY: ${{ secrets.BITDRIFT_API_KEY }}
+      EXPO_PUBLIC_GCP_PROJECT_ID: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
+      GOOGLE_SERVICES_TOKEN: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
+      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+      ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+      ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+      ASC_KEY_P8_BASE64: ${{ secrets.ASC_KEY_P8_BASE64 }}
+      SLACK_CLIENT_ALERT_WEBHOOK: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
 
   buildIfNecessaryAndroid:
     name: Build and Submit Android
-    runs-on: ubuntu-latest
-    concurrency:
-      group: android-build
-      cancel-in-progress: false
     needs: [bundleDeploy]
     # Gotta check if its NOT '[]' because any md5 hash in the outputs is detected as a possible secret and won't be
     # available here
-    if: ${{ inputs.channel != 'production' && needs.bundleDeploy.outputs.changes-detected && github.repository == 'bluesky-social/social-app'}}
+    if: ${{ inputs.channel != 'production' &&
+      needs.bundleDeploy.outputs.changes-detected && github.repository ==
+      'bluesky-social/social-app' }}
+    # build-submit-android.yml contains an attachToRelease job that requests contents: write.
+    # That job is skipped here (it needs a production tag build), but GitHub statically
+    # validates the reusable-workflow permission ceiling, so the caller must grant it.
+    permissions:
+      contents: write
+    uses: ./.github/workflows/build-submit-android.yml
+    with:
+      profile: testflight-android
+      runner: ubuntu-latest
+    # Pass only the secrets the reusable workflow declares, rather than `secrets: inherit`,
+    # so this workflow never hands the reusable workflow the entire repo secret store.
+    secrets:
+      EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+      ENV_TOKEN: ${{ secrets.ENV_TOKEN }}
+      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+      BITDRIFT_API_KEY: ${{ secrets.BITDRIFT_API_KEY }}
+      EXPO_PUBLIC_GCP_PROJECT_ID: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
+      GOOGLE_SERVICES_TOKEN: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
+      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+      SLACK_CLIENT_ALERT_WEBHOOK: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+      ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+      ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+      ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+      ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
 
+  # Advance the fingerprint baseline only after BOTH native builds have shipped
+  # the new native surface. This replaces the old actions/cache baseline, which
+  # only advanced on cache eviction and so silently froze - freezing meant every
+  # fingerprint looked changed and OTA updates stopped deploying entirely.
+  #
+  # On the native-build path, this runs only after both builds succeed. A
+  # successful OTA deploy also records its fingerprint, refreshing the
+  # persistent marker's retention without changing the native baseline.
+  #
+  # The persistent artifact replaces the old actions/cache marker without
+  # requiring a PAT or mutable repository variable. Each successful deploy adds
+  # an immutable marker; the next run reads the newest non-expired one using the
+  # built-in GITHUB_TOKEN.
+  recordBaseline:
+    name: Record fingerprint baseline
+    runs-on: ubuntu-latest
+    needs: [bundleDeploy, buildIfNecessaryIOS, buildIfNecessaryAndroid]
+    if: ${{ always() &&
+      (inputs.channel || 'testflight') == 'testflight' &&
+      needs.bundleDeploy.result == 'success' &&
+      (needs.bundleDeploy.outputs.changes-detected != 'true' ||
+      (needs.buildIfNecessaryIOS.result == 'success' &&
+      needs.buildIfNecessaryAndroid.result == 'success')) &&
+      github.repository == 'bluesky-social/social-app' }}
+    permissions:
+      actions: read
     steps:
-      - name: Check for EXPO_TOKEN
+      - name: ⬇️ Download native fingerprint
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: native-fingerprint-${{ github.run_id }}
+
+      - name: 🧐 Validate native fingerprint
         run: >
-          if [ -z "${{ secrets.EXPO_TOKEN }}" ]; then
-            echo "You must provide an EXPO_TOKEN secret linked to this project's Expo account in this repo's secrets. Learn more: https://docs.expo.dev/eas-update/github-actions"
-            exit 1
-          fi
+          jq -e '.sources | type == "array"' native-fingerprint.json >/dev/null ||
+          (echo "::error::native fingerprint artifact was invalid; refusing to record it as the baseline." && exit 1)
 
-      - name: ⬇️ Checkout
-        uses: actions/checkout@v4
+      - name: 🚀 Record fingerprint baseline
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          fetch-depth: 5
-
-      - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-          cache: yarn
-
-      - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@main
-        with:
-          expo-version: latest
-          eas-version: latest
-          token: ${{ secrets.EXPO_TOKEN }}
-
-      - name: ⛏️ Setup EAS local builds
-        run: yarn global add eas-cli-local-build-plugin
-
-      - uses: actions/setup-java@v4
-        with:
-          distribution: "temurin"
-          java-version: "17"
-
-      - name: ⚙️ Install dependencies
-        run: yarn install --frozen-lockfile
-
-      - name: 🔤 Compile translations
-        run: yarn intl:build
-
-      # EXPO_PUBLIC_ENV is handled in eas.json
-      - name: Env
-        id: env
-        run: |
-          export json='${{ secrets.GOOGLE_SERVICES_TOKEN }}'
-          echo "${{ secrets.ENV_TOKEN }}" > .env
-          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> .env
-          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
-          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> .env
-          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-          echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
-          echo "EXPO_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}" >> .env
-          echo "EXPO_PUBLIC_BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
-          echo "EXPO_PUBLIC_GCP_PROJECT_ID=${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}" >> .env
-          echo "$json" > google-services.json
-
-      - name: 🏗️ EAS Build
-        run: >
-          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
-          yarn use-build-number-with-bump
-          eas build -p android
-          --profile testflight-android
-          --local --output build.apk --non-interactive
-
-      - name: ⏰ Get a timestamp
-        id: timestamp
-        uses: nanzm/get-time-action@master
-        with:
-          format: "MM-DD-HH-mm-ss"
-
-      - name: 🚀 Upload Artifact
-        id: upload-artifact
-        uses: actions/upload-artifact@v4
-        with:
-          retention-days: 30
-          compression-level: 0
-          name: build-${{ steps.timestamp.outputs.time }}.apk
-          path: build.apk
-
-      - name: 🔔 Notify Slack
-        uses: slackapi/slack-github-action@v1.25.0
-        with:
-          payload: |
-            {
-              "text": "Android build is ready for testing. Download the artifact here: ${{ steps.upload-artifact.outputs.artifact-url }}"
-            }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
-
-      - name: ⬇️ Restore Cache
-        id: get-base-commit
-        uses: actions/cache@v4
-        if: ${{ inputs.channel != 'testflight' && inputs.channel != 'production' }}
-        with:
-          path: most-recent-testflight-commit.txt
-          key: most-recent-testflight-commit
-
-      - name: ✏️ Write commit hash to cache
-        env:
-          GITHUB_SHA: ${{ github.sha }}
-        if: ${{ inputs.channel != 'testflight' && inputs.channel != 'production' }}
-        run: echo $GITHUB_SHA > most-recent-testflight-commit.txt
+          name: testflight-native-fingerprint
+          path: native-fingerprint.json
+          retention-days: 90
+          if-no-files-found: error

.github/workflows/claude-mention.yml

@@ -0,0 +1,75 @@
+name: claude-mention
+
+# @claude mention handler on PR conversation comments, inline review
+# comments, and review bodies. See the header comment in
+# claude-review.yml for why this is self-contained rather than calling
+# the org reusable workflows.
+#
+# Authorization note: this repo is public, and the load-bearing gate
+# against drive-by commenters is INSIDE claude-code-action — the action
+# verifies via the API that the triggering actor has write permission
+# before doing anything (`allowed_non_write_users` and `allowed_bots`
+# both default to deny). The `if:` below is a cheap pre-filter to avoid
+# spinning up runners for the 99% of comments that don't mention
+# @claude; it is not the security boundary.
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  pull_request_review:
+    types: [submitted]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+  actions: read
+  # Required for claude-code-action's GitHub App token exchange.
+  id-token: write
+
+jobs:
+  mention:
+    # Skip comments/reviews that don't mention @claude, non-PR issue
+    # comments, and events from claude[bot] itself (its review prose
+    # often quotes "@claude" and must not retrigger the workflow).
+    if: >
+      (
+        (github.event_name == 'issue_comment' &&
+          github.event.issue.pull_request != null &&
+          contains(github.event.comment.body, '@claude')) ||
+        (github.event_name == 'pull_request_review_comment' &&
+          contains(github.event.comment.body, '@claude')) ||
+        (github.event_name == 'pull_request_review' &&
+          contains(github.event.review.body, '@claude'))
+      ) &&
+      github.actor != 'claude[bot]'
+
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    concurrency:
+      group: claude-mention-${{ github.repository }}-${{ github.event.issue.number || github.event.pull_request.number }}
+      cancel-in-progress: false
+
+    steps:
+      - name: ⬇️ Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+
+      - name: 🤖 Claude
+        uses: anthropics/claude-code-action@1623c36729ac1cd5895198cded705a287de7db79 # v1.0.187
+        env:
+          ANTHROPIC_BASE_URL: https://agentgateway.k1.prod.bsky.dev
+        with:
+          # Agent Gateway service keys use Authorization: Bearer, the wire
+          # shape emitted by the action's OAuth-token input.
+          claude_code_oauth_token: ${{ secrets.AGENT_GATEWAY_CLAUDE_GH_REVIEW_KEY }}
+          additional_permissions: |
+            actions: read
+          track_progress: true
+          claude_args: |
+            --model claude-opus-4-8:api
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__download_job_log,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"

.github/workflows/claude-review.yml

@@ -0,0 +1,66 @@
+name: claude-review
+
+# Automatic Claude review on PR creation/update, via Agent Gateway.
+# Self-contained: this intentionally uses upstream
+# claude-code-action defaults rather than the org reusable workflows in
+# bluesky-social/.github (which a public repo cannot call, and whose
+# customizations added no value over upstream).
+#
+# Review guidance lives in .github/claude-review-prompt.md.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: write
+  actions: read
+  # Required for claude-code-action's GitHub App token exchange.
+  id-token: write
+
+jobs:
+  review:
+    # Internal PRs only. This repo is public: fork PRs are the bulk of
+    # community traffic and MUST NOT trigger reviews (no gateway spend on
+    # unvetted code). Branch PRs can only be
+    # created by people with write access, i.e. org members.
+    # Bot-authored PRs (dependabot, changesets) are also skipped.
+    if: >
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.type != 'Bot'
+
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    concurrency:
+      group: claude-review-${{ github.repository }}-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
+
+    steps:
+      - name: ⬇️ Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+
+      - name: 🤖 Claude review
+        uses: anthropics/claude-code-action@1623c36729ac1cd5895198cded705a287de7db79 # v1.0.187
+        env:
+          ANTHROPIC_BASE_URL: https://agentgateway.k1.prod.bsky.dev
+        with:
+          # Agent Gateway service keys use Authorization: Bearer, the wire
+          # shape emitted by the action's OAuth-token input.
+          claude_code_oauth_token: ${{ secrets.AGENT_GATEWAY_CLAUDE_GH_REVIEW_KEY }}
+          additional_permissions: |
+            actions: read
+          track_progress: true
+          claude_args: |
+            --model claude-opus-4-8:api
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__download_job_log,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
+          prompt: |
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number }}
+
+            Read .github/claude-review-prompt.md in the checked-out repo
+            and review this pull request following its guidance.

.github/workflows/claude.yml

@@ -1,54 +0,0 @@
-name: Claude Code
-
-on:
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-  issues:
-    types: [opened, assigned]
-  pull_request_review:
-    types: [submitted]
-
-jobs:
-  claude:
-    if: |
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
-      issues: read
-      id-token: write
-      actions: read # Required for Claude to read CI results on PRs
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Run Claude Code
-        id: claude
-        uses: anthropics/claude-code-action@v1
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-
-          # This is an optional setting that allows Claude to read CI results on PRs
-          additional_permissions: |
-            actions: read
-
-          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
-          # prompt: 'Update the pull request description to include a summary of changes.'
-
-          # Optional: Add claude_args to customize behavior and configuration
-          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
-          # or https://code.claude.com/docs/en/cli-reference for available options
-          # claude_args: '--allowed-tools Bash(gh pr:*)'
-
-          # NOTE(sfn): we can add a custom system prompt here
-
-          claude_args: |
-            --model claude-opus-4-5-20251101

.github/workflows/golang-test-lint.yml

@@ -10,34 +10,39 @@ concurrency:
   group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build-and-test:
     runs-on: ubuntu-latest
     steps:
-      - name: Git Checkout
-        uses: actions/checkout@v5
-      - name: Set up Go tooling
-        uses: actions/setup-go@v6
+      - name: ⬇️ Git Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: 🔧 Set up Go tooling
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: bskyweb/go.mod
-      - name: Dummy Static Files
+          cache-dependency-path: bskyweb/go.sum
+      - name: 📄 Dummy Static Files
         run: touch bskyweb/static/js/blah.js && touch bskyweb/static/css/blah.txt && touch bskyweb/static/media/blah.txt
-      - name: Check
+      - name: 🔍 Check
         run: cd bskyweb/ && make check
-      - name: Build (binary)
+      - name: 🏗️ Build (binary)
         run: cd bskyweb/ && make build
-      - name: Test
+      - name: 🧪 Test
         run: cd bskyweb/ && make test
   lint:
     runs-on: ubuntu-latest
     steps:
-      - name: Git Checkout
-        uses: actions/checkout@v5
-      - name: Set up Go tooling
-        uses: actions/setup-go@v6
+      - name: ⬇️ Git Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: 🔧 Set up Go tooling
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: bskyweb/go.mod
-      - name: Dummy Static Files
+          cache-dependency-path: bskyweb/go.sum
+      - name: 📄 Dummy Static Files
         run: touch bskyweb/static/js/blah.js && touch bskyweb/static/css/blah.txt && touch bskyweb/static/media/blah.txt
-      - name: Lint
+      - name: 🧹 Lint
         run: cd bskyweb/ &&  make lint

.github/workflows/lint.yml

@@ -6,56 +6,122 @@ on:
     branches:
       - main
 concurrency:
-  group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
+  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
   cancel-in-progress: true
 
+# These jobs only check out the repo and run checks, so read access to the
+# repo contents is all the GITHUB_TOKEN needs.
+permissions:
+  contents: read
+
 jobs:
   linting:
     name: Run linters
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        job:
+          [
+            lint,
+            prettier,
+            'lexicons:verify',
+            'typecheck:ios',
+            'typecheck:android',
+            'typecheck:web',
+          ]
     steps:
-      - name: Check out Git repository
-        uses: actions/checkout@v4
-      - name: Install node
-        uses: actions/setup-node@v6
+      - name: ⬇️ Check out Git repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: 🔍 Verify Node version pins match package.json
+        run: |
+          set -euo pipefail
+          expected=$(node -p "require('./package.json').engines.node.replace(/[^0-9.]/g, '')")
+          rc=0
+          check() {
+            if [ "$2" != "$expected" ]; then
+              echo "::error file=$1::Node version mismatch: $1 pins '$2' but package.json is '$expected'"
+              rc=1
+            fi
+          }
+          # FROM node:X.Y.Z - service runtime images
+          for f in Dockerfile.bskylink Dockerfile.bskyogcard; do
+            v=$(grep -oE 'FROM node:[0-9]+\.[0-9]+\.[0-9]+' "$f" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | sort -u)
+            check "$f" "$v"
+          done
+          # ENV NODE_VERSION=X.Y.Z - Go images that nvm-install Node for the JS build stage
+          for f in Dockerfile.embedr; do
+            v=$(grep -oE 'NODE_VERSION=[0-9]+\.[0-9]+\.[0-9]+' "$f" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | sort -u)
+            check "$f" "$v"
+          done
+          # eas.json "node": "X.Y.Z"
+          v=$(grep -oE '"node":[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+"' eas.json | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | sort -u)
+          check "eas.json" "$v"
+          exit $rc
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+      - name: 🔧 Install node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version-file: .nvmrc
-          cache: yarn
-      - name: Yarn install
-        uses: Wandalen/wretry.action@master
-        with:
-          command: yarn --frozen-lockfile
-          attempt_limit: 3
-          attempt_delay: 2000
-      - name: Lint check
-        run: yarn lint
-      - name: Lint lockfile
-        run: yarn lockfile-lint
-      - name: Prettier check
-        run: yarn prettier --check .
-      - name: Check & compile i18n
-        run: yarn intl:build
-      - name: Type check
-        run: yarn typecheck
+          node-version-file: package.json
+          cache: pnpm
+      - name: 📦 pnpm install
+        run: pnpm install --frozen-lockfile
+      - name: 🔤 Check & compile i18n
+        run: pnpm intl:build
+      - name: 🧹 Lint checks
+        run: pnpm ${{ matrix.job }}
+  # Aggregates the matrix results into a single stable check name so branch
+  # protection can require "Run linters" regardless of how many matrix jobs run.
+  # The result is asserted in `run` (not `if`) so a malformed expression can
+  # never silently skip the check and report a false pass.
+  linting-summary:
+    name: Run linters
+    if: always()
+    needs: [linting]
+    runs-on: ubuntu-latest
+    steps:
+      - name: ✅ Require linting to have succeeded
+        env:
+          RESULT: ${{ needs.linting.result }}
+        run: |
+          echo "linting result: $RESULT"
+          test "$RESULT" = "success"
   testing:
     name: Run tests
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
     steps:
-      - name: Check out Git repository
-        uses: actions/checkout@v4
-      - name: Install node
-        uses: actions/setup-node@v6
+      - name: ⬇️ Check out Git repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+      - name: 🔧 Install node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version-file: .nvmrc
-          cache: yarn
-      - name: Yarn install
-        uses: Wandalen/wretry.action@master
-        with:
-          command: yarn --frozen-lockfile
-          attempt_limit: 3
-          attempt_delay: 2000
-      - name: Check & compile i18n
-        run: yarn intl:build
-      - name: Run tests
+          node-version-file: package.json
+          cache: pnpm
+      - name: 📦 pnpm install
+        run: pnpm install --frozen-lockfile
+      - name: 🔤 Check & compile i18n
+        run: pnpm intl:build
+      - name: 🧪 Run tests
         run: |
-          NODE_ENV=test yarn test --forceExit
+          NODE_ENV=test pnpm test --forceExit --shard=${{ matrix.shard }}/${{ strategy.job-total }}
+  # Aggregates the sharded test results into a single stable check name so branch
+  # protection can require "Run tests" regardless of how many shards run.
+  # The result is asserted in `run` (not `if`) so a malformed expression can
+  # never silently skip the check and report a false pass.
+  testing-summary:
+    name: Run tests
+    if: always()
+    needs: [testing]
+    runs-on: ubuntu-latest
+    steps:
+      - name: ✅ Require testing to have succeeded
+        env:
+          RESULT: ${{ needs.testing.result }}
+        run: |
+          echo "testing result: $RESULT"
+          test "$RESULT" = "success"

.github/workflows/nightly-build.yml

@@ -0,0 +1,200 @@
+---
+name: Nightly Build
+
+on:
+  schedule:
+    - cron: "10 2 * * *" # run at 2:10 AM UTC, after the nightly i18n job
+  workflow_dispatch:
+
+# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
+permissions:
+  contents: read
+
+jobs:
+  # Generate the changelog once, shared by both platforms. The range covers commits since
+  # the previous nightly, whose commit SHA is stored as a "nightly-build-commit" artifact
+  # (advanced by the record job below, only after both builds succeed).
+  prepare:
+    name: Prepare release notes
+    if: github.repository == 'bluesky-social/social-app'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    outputs:
+      notes: ${{ steps.notes.outputs.notes }}
+    steps:
+      - name: ⬇️ Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: 📝 Generate release notes
+        id: notes
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Find the most recent non-expired nightly-build-commit artifact and read its SHA
+          # The artifacts API returns results newest-first, so the most recent marker is on
+          # page 1 — no --paginate needed (which would run the jq aggregation per page and
+          # could emit multiple URLs). Take the first non-expired match.
+          prev=""
+          url=$(gh api \
+            "repos/${GITHUB_REPOSITORY}/actions/artifacts?name=nightly-build-commit&per_page=100" \
+            --jq 'first(.artifacts[] | select(.expired == false)) | .archive_download_url' \
+            2>/dev/null || true)
+          if [ -n "$url" ] && [ "$url" != "null" ]; then
+            if curl -sSL -H "Authorization: Bearer $GH_TOKEN" -o marker.zip "$url" \
+              && unzip -o -q marker.zip; then
+              prev=$(cat nightly-build-commit.txt 2>/dev/null | tr -d '[:space:]')
+            fi
+            rm -f marker.zip nightly-build-commit.txt
+          fi
+
+          if [ -n "$prev" ] && git cat-file -e "${prev}^{commit}" 2>/dev/null; then
+            echo "Generating notes since previous nightly: $prev"
+            range="${prev}..HEAD"
+          else
+            echo "No reachable previous nightly commit; falling back to last 30 commits."
+            range="HEAD~30..HEAD"
+          fi
+          notes=$(git log --no-merges --pretty=format:'- %s' "$range" 2>/dev/null | head -n 50)
+          if [ -z "$notes" ]; then
+            notes="Nightly build — no new commits since the last nightly."
+          fi
+          # Cap the whole changelog to keep the Slack message a reasonable size.
+          # head -c caps the combined stream; cut -c would only cap each line independently.
+          notes=$(printf '%s' "$notes" | head -c 3900)
+          {
+            echo "notes<<NOTES_EOF"
+            echo "$notes"
+            echo "NOTES_EOF"
+          } >> "$GITHUB_OUTPUT"
+
+  ios:
+    name: Nightly iOS Build
+    needs: [prepare]
+    uses: ./.github/workflows/build-submit-ios.yml
+    with:
+      profile: testflight
+      testFlightGroup: "QA Team"
+    # Pass only the secrets the reusable workflow declares, rather than `secrets: inherit`,
+    # so the nightly build never hands the reusable workflow the entire repo secret store.
+    secrets:
+      EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+      ENV_TOKEN: ${{ secrets.ENV_TOKEN }}
+      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+      BITDRIFT_API_KEY: ${{ secrets.BITDRIFT_API_KEY }}
+      EXPO_PUBLIC_GCP_PROJECT_ID: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
+      GOOGLE_SERVICES_TOKEN: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
+      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+      ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+      ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+      ASC_KEY_P8_BASE64: ${{ secrets.ASC_KEY_P8_BASE64 }}
+      SLACK_CLIENT_ALERT_WEBHOOK: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+
+  android:
+    name: Nightly Android Build
+    needs: [prepare]
+    # build-submit-android.yml contains an attachToRelease job that requests contents: write.
+    # That job is skipped for nightly (it needs a production tag build), but GitHub statically
+    # validates the reusable-workflow permission ceiling, so the caller must grant it here.
+    permissions:
+      contents: write
+    uses: ./.github/workflows/build-submit-android.yml
+    with:
+      profile: testflight-android
+    # Pass only the secrets the reusable workflow declares, rather than `secrets: inherit`,
+    # so the nightly build never hands the reusable workflow the entire repo secret store.
+    secrets:
+      EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+      ENV_TOKEN: ${{ secrets.ENV_TOKEN }}
+      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+      BITDRIFT_API_KEY: ${{ secrets.BITDRIFT_API_KEY }}
+      EXPO_PUBLIC_GCP_PROJECT_ID: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
+      GOOGLE_SERVICES_TOKEN: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
+      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+      SLACK_CLIENT_ALERT_WEBHOOK: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+      ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+      ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+      ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+      ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+
+  notify-ios:
+    name: Notify Slack of iOS nightly
+    needs: [prepare, ios]
+    runs-on: ubuntu-latest
+    steps:
+      - name: 📝 Build Slack payload
+        id: payload
+        env:
+          NOTES: ${{ needs.prepare.outputs.notes }}
+          VERSION: ${{ needs.ios.outputs.package-version }}
+          BUILD_NUMBER: ${{ needs.ios.outputs.build-number }}
+        run: |
+          text="*Nightly iOS build available in TestFlight (QA Team)*
+          Version ${VERSION} (${BUILD_NUMBER})
+
+          ${NOTES}"
+          payload=$(jq -n --arg text "$text" '{text: $text}')
+          {
+            echo "payload<<PAYLOAD_EOF"
+            echo "$payload"
+            echo "PAYLOAD_EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: 🔔 Notify Slack
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          webhook: ${{ secrets.NIGHTLY_BUILDS_SLACK_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload: ${{ steps.payload.outputs.payload }}
+
+  notify-android:
+    name: Notify Slack of Android nightly
+    needs: [prepare, android]
+    runs-on: ubuntu-latest
+    steps:
+      - name: 📝 Build Slack payload
+        id: payload
+        env:
+          NOTES: ${{ needs.prepare.outputs.notes }}
+          VERSION: ${{ needs.android.outputs.package-version }}
+          VERSION_CODE: ${{ needs.android.outputs.version-code }}
+        run: |
+          text="*Nightly Android build available (Internal track)*
+          Version ${VERSION} (${VERSION_CODE})
+
+          ${NOTES}"
+          payload=$(jq -n --arg text "$text" '{text: $text}')
+          {
+            echo "payload<<PAYLOAD_EOF"
+            echo "$payload"
+            echo "PAYLOAD_EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: 🔔 Notify Slack
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          webhook: ${{ secrets.NIGHTLY_BUILDS_SLACK_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload: ${{ steps.payload.outputs.payload }}
+
+  # Advance the nightly marker only after both builds succeed, so a failed night's commits
+  # roll into the next successful nightly's notes rather than being silently dropped.
+  record:
+    name: Record nightly commit
+    needs: [ios, android]
+    runs-on: ubuntu-latest
+    steps:
+      - name: ✏️ Write nightly commit marker
+        env:
+          GITHUB_SHA: ${{ github.sha }}
+        run: echo "$GITHUB_SHA" > nightly-build-commit.txt
+
+      - name: 🚀 Upload nightly commit marker
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: nightly-build-commit
+          path: nightly-build-commit.txt
+          retention-days: 90

.github/workflows/nightly-e2e.yml

@@ -0,0 +1,424 @@
+---
+name: Nightly Maestro E2E
+
+on:
+  schedule:
+    - cron: "0 4 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: nightly-maestro-e2e-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  CI: "1"
+  MAESTRO_VERSION: "2.6.1"
+  MAESTRO_DRIVER_STARTUP_TIMEOUT: "180000"
+  MAESTRO_CLI_NO_ANALYTICS: "1"
+  MAESTRO_CLI_ANALYSIS_NOTIFICATION_DISABLED: "true"
+  MAESTRO_DISABLE_UPDATE_CHECK: "1"
+
+jobs:
+  ios:
+    name: iOS Maestro E2E
+    if: github.repository == 'bluesky-social/social-app'
+    runs-on: macos-26-xlarge
+    timeout-minutes: 120
+    steps:
+      - name: ⬇️ Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: 🛠️ Select Xcode 26.4
+        uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
+        with:
+          xcode-version: "26.4"
+
+      - name: 🧰 Prepare E2E configuration
+        run: |
+          mkdir -p artifacts/ios
+          echo "Installing dependencies" > artifacts/ios/phase.txt
+          cp .env.example .env.development
+          cp google-services.json.example google-services.json
+
+      - name: 🔧 Set up Expo project
+        uses: ./.github/actions/setup-expo-project
+        with:
+          expo-token: ${{ secrets.EXPO_TOKEN }}
+
+      - name: ☕️ Set up Java 17
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        with:
+          distribution: temurin
+          java-version: "17"
+
+      - name: 📦 Install dev-env dependencies
+        run: pnpm --dir dev-env install --frozen-lockfile 2>&1 | tee artifacts/ios/dependencies.log
+
+      - name: 🔤 Compile translations
+        uses: ./.github/actions/compile-i18n
+
+      - name: 📥 Install Maestro 2.6.1
+        run: |
+          echo "Installing Maestro" > artifacts/ios/phase.txt
+          curl -fsSL -o "$RUNNER_TEMP/maestro.zip" \
+            "https://github.com/mobile-dev-inc/Maestro/releases/download/cli-${MAESTRO_VERSION}/maestro.zip"
+          echo "3440825f514f537c6a96bcf5de995780c2a4a7f83a43208fdc95d4f1fecfad3b  $RUNNER_TEMP/maestro.zip" \
+            | shasum -a 256 --check
+          unzip -q "$RUNNER_TEMP/maestro.zip" -d "$RUNNER_TEMP"
+          echo "$RUNNER_TEMP/maestro/bin" >> "$GITHUB_PATH"
+          "$RUNNER_TEMP/maestro/bin/maestro" --version | tee artifacts/ios/maestro-version.log
+          test "$("$RUNNER_TEMP/maestro/bin/maestro" --version)" = "$MAESTRO_VERSION"
+
+      - name: 📱 Boot one iOS simulator
+        run: |
+          echo "Booting iOS simulator" > artifacts/ios/phase.txt
+          device_name="iPhone 17"
+          runtime_name="iOS 26.5"
+
+          runtime_id=$(xcrun simctl list runtimes available --json | jq -r \
+            --arg name "$runtime_name" \
+            '[.runtimes[] | select(.name == $name and .isAvailable != false)] | first | .identifier // empty')
+          if [ -z "$runtime_id" ]; then
+            echo "The $runtime_name simulator runtime is not installed. Available iOS runtimes:" >&2
+            xcrun simctl list runtimes available --json | jq -r \
+              '.runtimes[] | select(.name | startswith("iOS")) | "- \(.name)"' >&2
+            exit 1
+          fi
+
+          device_type_id=$(xcrun simctl list devicetypes --json | jq -r \
+            --arg name "$device_name" \
+            '[.devicetypes[] | select(.name == $name)] | first | .identifier // empty')
+          if [ -z "$device_type_id" ]; then
+            echo "The $device_name simulator device type is not installed" >&2
+            exit 1
+          fi
+
+          udid=$(xcrun simctl list devices available --json | jq -r \
+            --arg runtime "$runtime_id" \
+            --arg name "$device_name" \
+            '[.devices[$runtime][]? | select(.name == $name)] | first | .udid // empty')
+          if [ -z "$udid" ]; then
+            udid=$(xcrun simctl create "$device_name" "$device_type_id" "$runtime_id")
+          fi
+
+          echo "IOS_UDID=$udid" >> "$GITHUB_ENV"
+          xcrun simctl shutdown all || true
+          xcrun simctl boot "$udid"
+          xcrun simctl bootstatus "$udid" -b
+          echo "Using $device_name on $runtime_name ($udid)"
+
+      - name: 🏷️ Mark iOS development client build phase
+        run: echo "Building the iOS development client" > artifacts/ios/phase.txt
+
+      - name: 🏗️ Build iOS development client
+        uses: ./.github/actions/eas-local-build
+        with:
+          platform: ios
+          profile: e2e
+          output: ${{ runner.temp }}/nightly-e2e-ios.tar.gz
+          log-path: artifacts/ios/build.log
+
+      - name: 📲 Install iOS development client
+        run: |
+          build_contents="$RUNNER_TEMP/nightly-e2e-ios-build"
+          mkdir -p "$build_contents"
+          tar -xzf "$RUNNER_TEMP/nightly-e2e-ios.tar.gz" -C "$build_contents"
+          app_path=$(find "$build_contents" -type d -name '*.app' -print -quit)
+          if [ -z "$app_path" ]; then
+            echo "The local EAS build did not contain an iOS simulator app" >&2
+            exit 1
+          fi
+          xcrun simctl install "$IOS_UDID" "$app_path" 2>&1 | tee -a artifacts/ios/build.log
+
+      - name: 🧪 Run iOS Maestro suite
+        run: .github/scripts/run-nightly-e2e.sh ios "$IOS_UDID"
+
+      - name: 🧹 Clean up iOS services and simulator
+        if: always()
+        run: .github/scripts/cleanup-nightly-e2e.sh ios "${IOS_UDID:-}"
+
+      - name: 🚀 Upload iOS E2E artifacts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: nightly-e2e-ios-${{ github.run_id }}
+          path: artifacts/ios
+          if-no-files-found: warn
+          retention-days: 7
+
+  android:
+    name: Android Maestro E2E
+    if: github.repository == 'bluesky-social/social-app'
+    # Linux-x64-32core is a repository-managed runner label.
+    runs-on: Linux-x64-32core
+    timeout-minutes: 120
+    steps:
+      - name: ⬇️ Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: 🧰 Prepare E2E configuration
+        run: |
+          mkdir -p artifacts/android
+          echo "Installing dependencies" > artifacts/android/phase.txt
+          cp .env.example .env.development
+          cp google-services.json.example google-services.json
+
+      - name: 🔧 Set up Expo project
+        uses: ./.github/actions/setup-expo-project
+        with:
+          expo-token: ${{ secrets.EXPO_TOKEN }}
+
+      - name: ☕️ Set up Java 17
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        with:
+          distribution: temurin
+          java-version: "17"
+
+      - name: 📦 Install dev-env dependencies
+        run: pnpm --dir dev-env install --frozen-lockfile 2>&1 | tee artifacts/android/dependencies.log
+
+      - name: 🔤 Compile translations
+        uses: ./.github/actions/compile-i18n
+
+      - name: 📥 Install Maestro 2.6.1
+        run: |
+          echo "Installing Maestro" > artifacts/android/phase.txt
+          curl -fsSL -o "$RUNNER_TEMP/maestro.zip" \
+            "https://github.com/mobile-dev-inc/Maestro/releases/download/cli-${MAESTRO_VERSION}/maestro.zip"
+          echo "3440825f514f537c6a96bcf5de995780c2a4a7f83a43208fdc95d4f1fecfad3b  $RUNNER_TEMP/maestro.zip" \
+            | shasum -a 256 --check
+          unzip -q "$RUNNER_TEMP/maestro.zip" -d "$RUNNER_TEMP"
+          echo "$RUNNER_TEMP/maestro/bin" >> "$GITHUB_PATH"
+          "$RUNNER_TEMP/maestro/bin/maestro" --version | tee artifacts/android/maestro-version.log
+          test "$("$RUNNER_TEMP/maestro/bin/maestro" --version)" = "$MAESTRO_VERSION"
+
+      - name: 📱 Install and boot one Android emulator
+        run: |
+          echo "Booting Android emulator" > artifacts/android/phase.txt
+          android_sdk="${ANDROID_SDK_ROOT:-${ANDROID_HOME:-/usr/local/lib/android/sdk}}"
+          sdkmanager_bin="$android_sdk/cmdline-tools/latest/bin/sdkmanager"
+          avdmanager_bin="$android_sdk/cmdline-tools/latest/bin/avdmanager"
+          # API 35 emulator images have known stability problems in headless CI
+          # (see flutter/flutter#153445); the qemu process died deterministically
+          # on the first native stack-screen push with the API 35 image.
+          system_image="system-images;android-34;google_apis;x86_64"
+
+          if [ ! -x "$sdkmanager_bin" ] || [ ! -x "$avdmanager_bin" ]; then
+            echo "Android command-line tools were not found under $android_sdk" >&2
+            find "$android_sdk/cmdline-tools" -maxdepth 3 -type f \( \
+              -name sdkmanager -o -name avdmanager \
+            \) -print >&2 || true
+            exit 1
+          fi
+
+          export ANDROID_HOME="$android_sdk"
+          export ANDROID_SDK_ROOT="$android_sdk"
+          export PATH="$android_sdk/platform-tools:$android_sdk/emulator:$PATH"
+          echo "ANDROID_HOME=$android_sdk" >> "$GITHUB_ENV"
+          echo "ANDROID_SDK_ROOT=$android_sdk" >> "$GITHUB_ENV"
+          echo "$android_sdk/platform-tools" >> "$GITHUB_PATH"
+          echo "$android_sdk/emulator" >> "$GITHUB_PATH"
+          echo "Using Android SDK at $android_sdk"
+
+          yes | "$sdkmanager_bin" --sdk_root="$android_sdk" --licenses >/dev/null || true
+          "$sdkmanager_bin" --sdk_root="$android_sdk" \
+            "platform-tools" "emulator" "$system_image"
+
+          export ANDROID_AVD_HOME="$RUNNER_TEMP/.android/avd"
+          mkdir -p "$ANDROID_AVD_HOME"
+          echo "ANDROID_AVD_HOME=$ANDROID_AVD_HOME" >> "$GITHUB_ENV"
+          echo no | "$avdmanager_bin" create avd \
+            --force \
+            --name nightly-e2e \
+            --package "$system_image" \
+            --device pixel_6
+
+          # Reduce resolution to lighten the SwiftShader software-rendering
+          # workload, and raise RAM/cores/heap so the debug RN app has headroom.
+          # The default 2560MB RAM led to silent qemu crashes mid-flow.
+          printf 'hw.lcd.width=720\nhw.lcd.height=1600\nhw.lcd.density=280\nhw.ramSize=6144\nhw.cpu.ncore=4\nvm.heapSize=512\n' \
+            >> "$ANDROID_AVD_HOME/nightly-e2e.avd/config.ini"
+
+          if [ -e /dev/kvm ] && [ ! -w /dev/kvm ]; then
+            sudo chmod 666 /dev/kvm
+          fi
+
+          # Disable the emulator's Vulkan feature so graphics goes through the
+          # plain GLES SwiftShader translator. gfxstream Vulkan via SwiftShader
+          # Subzero crashed qemu silently at a deterministic rendering step;
+          # GLES-only is sufficient since the guest renders with skiagl.
+          #
+          # Run the launch in a background subshell so the emulator's exit
+          # status is recorded when it dies (it is otherwise backgrounded and
+          # its death is invisible). Write the emulator's real PID - not the
+          # subshell's - to emulator.pid, since cleanup-nightly-e2e.sh kills the
+          # PID from that file directly; killing the subshell would not kill the
+          # emulator child.
+          (
+            # wait returns the emulator's non-zero status on crash; set -e would
+            # abort the subshell before the status is logged.
+            set +e
+            "$android_sdk/emulator/emulator" @nightly-e2e \
+              -port 5554 \
+              -no-window \
+              -gpu swiftshader_indirect \
+              -feature -Vulkan \
+              -no-snapshot \
+              -noaudio \
+              -no-boot-anim \
+              -camera-back none \
+              > artifacts/android/emulator.log 2>&1 &
+            emulator_pid=$!
+            echo "$emulator_pid" > artifacts/android/emulator.pid
+            wait "$emulator_pid"
+            echo "Emulator exited with status $?" >> artifacts/android/emulator.log
+          ) &
+
+          adb -s emulator-5554 wait-for-device
+          booted=false
+          for _ in $(seq 1 120); do
+            if [ "$(adb -s emulator-5554 shell getprop sys.boot_completed 2>/dev/null | tr -d '\r')" = "1" ]; then
+              booted=true
+              break
+            fi
+            sleep 5
+          done
+          if [ "$booted" != "true" ]; then
+            echo "Android emulator did not finish booting" >&2
+            exit 1
+          fi
+
+          adb -s emulator-5554 shell settings put global window_animation_scale 0
+          adb -s emulator-5554 shell settings put global transition_animation_scale 0
+          adb -s emulator-5554 shell settings put global animator_duration_scale 0
+
+      - name: 🏷️ Mark Android development client build phase
+        run: echo "Building the Android development client" > artifacts/android/phase.txt
+
+      - name: 🏗️ Build Android development client
+        uses: ./.github/actions/eas-local-build
+        with:
+          platform: android
+          profile: e2e
+          output: ${{ runner.temp }}/nightly-e2e-android.apk
+          log-path: artifacts/android/build.log
+
+      - name: 📲 Install Android development client
+        run: |
+          adb -s emulator-5554 install -r "$RUNNER_TEMP/nightly-e2e-android.apk" \
+            2>&1 | tee -a artifacts/android/build.log
+
+      - name: 🧪 Run Android Maestro suite
+        run: .github/scripts/run-nightly-e2e.sh android emulator-5554
+
+      - name: 🩺 Capture emulator crash diagnostics
+        if: always()
+        run: |
+          {
+            echo "=== Emulator process status ==="
+            pgrep -fa "emulator.*nightly-e2e" || echo "Emulator process not found"
+            echo "=== Emulator exit status ==="
+            grep "Emulator exited" artifacts/android/emulator.log || echo "No emulator exit status recorded"
+            echo "=== OOM killer check (kernel) ==="
+            oom_lines=$(sudo dmesg 2>/dev/null | grep -iE "oom|killed process|out of memory" | tail -20)
+            echo "${oom_lines:-No kernel OOM evidence found (or dmesg unavailable)}"
+            echo "=== systemd-oomd check ==="
+            oomd_lines=$(journalctl -u systemd-oomd --no-pager 2>/dev/null | tail -20)
+            echo "${oomd_lines:-No systemd-oomd journal entries (or journalctl unavailable)}"
+            echo "=== journal kernel tail ==="
+            journalctl -k --no-pager 2>/dev/null | tail -30 || echo "journalctl -k unavailable"
+            echo "=== Emulator crash database ==="
+            ls -la /tmp/android-runner/emu-crash-*.db 2>/dev/null || echo "No crash database found"
+          } > artifacts/android/emulator-diagnostics.log 2>&1
+
+      - name: 🧹 Clean up Android services and emulator
+        if: always()
+        run: .github/scripts/cleanup-nightly-e2e.sh android emulator-5554
+
+      - name: 🚀 Upload Android E2E artifacts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: nightly-e2e-android-${{ github.run_id }}
+          path: artifacts/android
+          if-no-files-found: warn
+          retention-days: 7
+
+  report:
+    name: Report E2E failures
+    needs: [ios, android]
+    if: ${{ always() && github.repository == 'bluesky-social/social-app' }}
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - name: ⬇️ Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: ⬇️ Download iOS artifacts
+        continue-on-error: true
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: nightly-e2e-ios-${{ github.run_id }}
+          path: downloaded-artifacts/ios
+
+      - name: ⬇️ Download Android artifacts
+        continue-on-error: true
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: nightly-e2e-android-${{ github.run_id }}
+          path: downloaded-artifacts/android
+
+      - name: 🔗 Resolve artifact links
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          run_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}#artifacts"
+          jq -n --arg run "$run_url" '{ios: $run, android: $run}' > artifact-links.json
+          if gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/artifacts?per_page=100" \
+            > artifact-response.json; then
+            jq --arg base "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/artifacts" \
+              --arg run "$run_url" \
+              '{
+                ios: (.artifacts | map(select(.name | startswith("nightly-e2e-ios-"))) | first | if . then ($base + "/" + (.id | tostring)) else $run end),
+                android: (.artifacts | map(select(.name | startswith("nightly-e2e-android-"))) | first | if . then ($base + "/" + (.id | tostring)) else $run end)
+              }' artifact-response.json > artifact-links.json
+          fi
+
+      - name: 📊 Summarize platform results
+        id: summary
+        env:
+          IOS_STATUS: ${{ needs.ios.result }}
+          ANDROID_STATUS: ${{ needs.android.result }}
+        run: |
+          node .github/scripts/summarize-maestro.mjs \
+            --ios-status "$IOS_STATUS" \
+            --android-status "$ANDROID_STATUS" \
+            --ios-root downloaded-artifacts/ios \
+            --android-root downloaded-artifacts/android \
+            --artifact-urls artifact-links.json \
+            --sha "$GITHUB_SHA" \
+            --run-url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
+            --commit-url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/commit/${GITHUB_SHA}" \
+            > e2e-summary.json
+          echo "notify=$(jq -r .notify e2e-summary.json)" >> "$GITHUB_OUTPUT"
+          echo "payload=$(jq -c .payload e2e-summary.json)" >> "$GITHUB_OUTPUT"
+          jq -r .githubSummary e2e-summary.json >> "$GITHUB_STEP_SUMMARY"
+
+      - name: 🔔 Notify Slack of E2E failures
+        if: steps.summary.outputs.notify == 'true'
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
+        with:
+          webhook: ${{ secrets.E2E_FAILURES_SLACK_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload: ${{ steps.summary.outputs.payload }}

.github/workflows/nightly-update-source-languages.yaml

@@ -15,30 +15,27 @@ jobs:
       contents: write
 
     steps:
-      - name: Check out Git repository
-        uses: actions/checkout@v4
+      - name: ⬇️ Check out Git repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ssh-key: ${{secrets.GH_ACTION_DEPLOY_KEY}}
-      - name: Install node
-        uses: actions/setup-node@v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+      - name: 🔧 Install node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version-file: .nvmrc
-          cache: yarn
-      - name: Yarn install
-        uses: Wandalen/wretry.action@master
-        with:
-          command: yarn --frozen-lockfile
-          attempt_limit: 3
-          attempt_delay: 2000
-      - name: Extract language strings
-        run: yarn intl:extract
-      - name: Create commit
-        uses: stefanzweifel/git-auto-commit-action@v5
+          node-version-file: package.json
+          cache: pnpm
+      - name: 📦 pnpm install
+        run: pnpm install --frozen-lockfile
+      - name: 🔤 Extract language strings
+        run: pnpm intl:extract
+      - name: 📝 Create commit
+        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
         with:
           commit_message: Nightly source-language update
           file_pattern: ./src/locale/locales/en/messages.po
-      - name: Push source lang to Crowdin
-        uses: crowdin/github-action@v2
+      - name: 🚀 Push source lang to Crowdin
+        uses: crowdin/github-action@c7af9bc98b01694653031fef2a0dc6c7888ce9bc # v2.17.0
         with:
           upload_sources: true
           upload_sources_args: "-b main"

.github/workflows/pull-request-comment.yml

@@ -1,213 +0,0 @@
----
-name: PR Comment Trigger
-
-on:
-  issue_comment:
-    types: [created]
-
-# Permissiosn to make comments in the pull request
-permissions:
-  pull-requests: write
-  actions: write
-  contents: read
-
-jobs:
-  handle-comment:
-    if: github.event.issue.pull_request
-    runs-on: ubuntu-latest
-    outputs:
-      should-deploy: ${{ steps.check-org.outputs.result }}
-
-    steps:
-      - name: Check if bot is mentioned
-        id: check-mention
-        env:
-          COMMENT: ${{ github.event.comment.body }}
-        run: |
-          if [[ "$COMMENT" == *"@github-actions"* ]] || \
-             [[ "$COMMENT" == *"github-actions[bot]"* ]]; then
-            bot_mentioned=true
-          else
-            bot_mentioned=false
-          fi
-
-
-          if [[ "$COMMENT" == *"ota"* ]]; then
-            has_ota=true
-          else
-            has_ota=false
-          fi
-
-
-          if [[ "$bot_mentioned" == "true" ]] && [[ "$has_ota" == "true" ]]; then
-            echo "mentioned=true" >> $GITHUB_OUTPUT
-          else
-            echo "mentioned=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Check organization membership
-        if: steps.check-mention.outputs.mentioned == 'true'
-        id: check-org
-        uses: actions/github-script@v7
-        with:
-          script: |
-            try {
-              const { data: perm } = await github.rest.repos.getCollaboratorPermissionLevel({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                username: context.payload.comment.user.login
-              });
-
-              const hasAccess = ['admin', 'write'].includes(perm.permission);
-              console.log(`User has ${perm.permission} access`);
-
-              return hasAccess;
-            } catch(error) {
-              console.log('User has no repository access');
-              return false;
-            }
-
-  bundle-deploy:
-    name: Bundle and Deploy EAS Update
-    runs-on: ubuntu-latest
-    needs: [handle-comment]
-    if: needs.handle-comment.outputs.should-deploy == 'true'
-
-    steps:
-      - name: Get PR HEAD SHA
-        env:
-          ISSUE_NUMBER: ${{ github.event.issue.number }}
-        id: pr-info
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const pr = await github.rest.pulls.get({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: process.env.ISSUE_NUMBER,
-            });
-
-            console.log(`PR HEAD SHA: ${pr.data.head.sha}`);
-            console.log(`PR HEAD REF: ${pr.data.head.ref}`);
-
-            core.setOutput('head-sha', pr.data.head.sha);
-            core.setOutput('head-ref', pr.data.head.ref);
-
-      - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@v2
-        with:
-          header: pull-request-eas-build-${{ steps.pr-info.outputs.head-sha }}
-          number: ${{ github.event.issue.number }}
-          message: |
-            An OTA deployment has been requested and is now running for `${{ steps.pr-info.outputs.head-sha }}`.
-
-            [Here is some music to listen to while you wait...](https://www.youtube.com/watch?v=VBlFHuCzPgY)
-            ---
-            *Generated by [PR labeler](https://github.com/expo/expo/actions/workflows/pr-labeler.yml) 🤖*
-
-      - name: Check for EXPO_TOKEN
-        run: >
-          if [ -z "${{ secrets.EXPO_TOKEN }}" ]; then
-            echo "You must provide an EXPO_TOKEN secret linked to this project's Expo account in this repo's secrets. Learn more: https://docs.expo.dev/eas-update/github-actions"
-            exit 1
-          fi
-
-      - name: ⬇️ Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ steps.pr-info.outputs.head-sha }}
-
-      - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-          cache: yarn
-
-      - name: Install dependencies
-        run: yarn install --frozen-lockfile
-
-      - name: Lint check
-        run: yarn lint
-
-      - name: Lint lockfile
-        run: yarn lockfile-lint
-
-      - name: 🔤 Compile translations
-        run: yarn intl:build 2>&1 | tee i18n.log
-
-      - name: Check for i18n compilation errors
-        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
-
-      - name: Type check
-        run: yarn typecheck
-
-      - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@main
-        with:
-          expo-version: latest
-          eas-version: latest
-          token: ${{ secrets.EXPO_TOKEN }}
-
-      - name: ⛏️ Setup Expo
-        run: yarn global add eas-cli-local-build-plugin
-
-      - name: 🪛 Setup jq
-        uses: dcarbone/install-jq-action@v2
-
-      - name: Env
-        id: env
-        run: |
-          export json='${{ secrets.GOOGLE_SERVICES_TOKEN }}'
-          echo "${{ secrets.ENV_TOKEN }}" > .env
-          echo "EXPO_PUBLIC_ENV=testflight" >> .env
-          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> .env
-          echo "EXPO_PUBLIC_RELEASE_VERSION=$(jq -r '.version' package.json)" >> $GITHUB_OUTPUT
-          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> .env
-          echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-          echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env
-          echo "EXPO_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}" >> .env
-          echo "EXPO_PUBLIC_BITDRIFT_API_KEY=${{ secrets.BITDRIFT_API_KEY }}" >> .env
-          echo "EXPO_PUBLIC_GCP_PROJECT_ID=${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}" >> .env
-          echo "$json" > google-services.json
-
-      - name: 🏗️ Create Bundle
-        run: >
-          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
-          yarn export
-
-      - name: 📦 Package Bundle and 🚀 Deploy
-        run: yarn use-build-number bash scripts/bundleUpdate.sh
-        env:
-          DENIS_API_KEY: ${{ secrets.DENIS_API_KEY }}
-          CHANNEL_NAME: pull-request-${{ github.event.issue.number }}
-          RUNTIME_VERSION:
-
-      - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@v2
-        env:
-          ISSUE_NUMBER: ${{ github.event.issue.number }}
-        with:
-          header: pull-request-eas-build-${{ steps.pr-info.outputs.head-sha }}
-          number: ${{ github.event.issue.number }}
-          message: |
-            Your requested OTA deployment was successful! You may now apply it by either scanning the QR code or opening the deep link below in your browser:
-
-            <img src="https://bsky-qr.vercel.app?channel=pull-request-$ISSUE_NUMBER" width=300 height=300>
-
-            `bluesky://intent/apply-ota?channel=pull-request-${{ github.event.issue.number }}`
-            ---
-
-            *Generated by [PR labeler](https://github.com/expo/expo/actions/workflows/pr-labeler.yml) 🤖*
-
-      - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@v2
-        if: failure()
-        with:
-          header: pull-request-eas-build-${{ steps.pr-info.outputs.head-sha }}
-          number: ${{ github.event.issue.number }}
-          message: |
-            Your requested OTA deployment was unsuccessful. See action logs for more details.
-            ---
-            *Generated by [PR labeler](https://github.com/expo/expo/actions/workflows/pr-labeler.yml) 🤖*

.github/workflows/pull-request-commit.yml

@@ -13,28 +13,78 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  pull-requests: write
-  actions: write
-  contents: read
+# Permissions are granted per-job below; anything unlisted defaults to none.
+# pull-requests: write is needed by sticky-pull-request-comment to post the
+# bundle-size and fingerprint diffs and the PR OTA install link
+permissions: {}
+
+# denis release tag in bluesky-social/tango whose linux-amd64 binary the PR OTA
+# job downloads. Bump this one line to roll denis.
+env:
+  DENIS_RELEASE_TAG: denis-v0.1.1
+  NODE_OPTIONS: --max-old-space-size=4096
 
 jobs:
-  webpack-analyzer:
-    runs-on: ubuntu-22.04
-    if: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event_name == 'pull_request'}}
+  # Populate this from main so every PR can restore the same trusted baseline.
+  webpack-analyzer-base:
+    runs-on: ubuntu-24.04
+    if: ${{ github.event_name == 'push' }}
+    permissions:
+      contents: read
     steps:
       - name: ⬇️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+
+      - name: 🔧 Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: package.json
+          cache: pnpm
+
+      - name: ⬇️ Get base stats from cache
+        id: get-base-stats
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: stats.json
+          key: stats-base-main-${{ github.sha }}
+
+      - name: 🔦 Generate stats file for base commit
+        if: ${{ !steps.get-base-stats.outputs.cache-hit }}
+        run: |
+          pnpm install
+          pnpm intl:build
+          pnpm generate-webpack-stats-file
+
+      - name: ⬆️ Save base stats to cache
+        if: ${{ !steps.get-base-stats.outputs.cache-hit }}
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: stats.json
+          key: stats-base-main-${{ github.sha }}
+
+  webpack-analyzer:
+    runs-on: ubuntu-24.04
+    if: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event_name == 'pull_request'}}
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: ⬇️ Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
-      - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-          cache: yarn
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
-      - name: Ensure tracking relevant branches and checkout base
+      - name: 🔧 Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: package.json
+          cache: pnpm
+
+      - name: 🌿 Ensure tracking relevant branches and checkout base
         env:
           HEAD_REF: ${{ github.head_ref }}
           BASE_REF: ${{ github.base_ref }}
@@ -42,13 +92,13 @@ jobs:
           git checkout $HEAD_REF
           git checkout $BASE_REF
 
-      - name: Get the base commit
+      - name: 🔍 Get the base commit
         id: base-commit
         env:
           BASE_REF: ${{ github.base_ref }}
         run: echo base-commit=$(git log -n 1 $BASE_REF --pretty=format:'%H') >> "$GITHUB_OUTPUT"
 
-      - name: Merge PR commit
+      - name: 🔀 Merge PR commit
         env:
           HEAD_REF: ${{ github.head_ref }}
         run: |
@@ -56,45 +106,47 @@ jobs:
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
           git config --global user.name "github-actions[bot]"
           git merge --no-edit $HEAD_REF
-          yarn install
-          yarn intl:build
+          pnpm install
+          pnpm intl:build
 
       - name: 🔦 Generate stats file for PR
         run: |
-          yarn generate-webpack-stats-file
+          pnpm generate-webpack-stats-file
           mv stats.json ../stats-new.json
 
       - name: ⬇️ Get base stats from cache
         id: get-base-stats
-        uses: actions/cache@v4
+        # Restore-only prevents PR-scoped fallback builds from creating caches.
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
-          path: stats-base.json
-          key: stats-base-${{ steps.base-commit.outputs.base-commit }}
+          path: stats.json
+          key: stats-base-main-${{ steps.base-commit.outputs.base-commit }}
 
-      - name: Restore to base commit
+      - name: ⏪ Restore to base commit
         if: ${{ !steps.get-base-stats.outputs.cache-hit }}
+        env:
+          BASE_COMMIT: ${{ steps.base-commit.outputs.base-commit }}
         run: |
-          git reset HEAD~
+          git reset "$BASE_COMMIT"
           git restore .
 
       - name: 🔦 Generate stats file from base commit
         if: ${{ !steps.get-base-stats.outputs.cache-hit }}
         run: |
-          yarn install
-          yarn intl:build
-          yarn generate-webpack-stats-file
-          mv stats.json stats-base.json
+          pnpm install
+          pnpm intl:build
+          pnpm generate-webpack-stats-file
 
       - name: ％ Get diff
         id: get-diff
-        uses: NejcZdovc/bundle-size-diff@v1
+        uses: NejcZdovc/bundle-size-diff@5321de41d2d62a7b0f4d6e60f59d1280a0034160 # v1.1.0
         with:
-          base_path: "stats-base.json"
+          base_path: "stats.json"
           pr_path: "../stats-new.json"
           excluded_assets: "(.+).chunk.js|(.+).js.map|(.+).json|(.+).png|(.+).svg|(.+).webp|(.+).jpg|(.+).ico"
 
       - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         with:
           header: bundle-diff
           message: |
@@ -106,9 +158,16 @@ jobs:
   fingerprint-native:
     runs-on: ubuntu-22.04
     if: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event_name == 'pull_request'}}
+    permissions:
+      contents: read
+      pull-requests: write
+    outputs:
+      # Empty when the native surface is unchanged, 'true' when it changed.
+      # publish-pr-ota gates on this.
+      includes-changes: ${{ steps.fingerprint.outputs.includes-changes }}
     steps:
       - name: ⬇️ Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 100
 
@@ -116,20 +175,23 @@ jobs:
         run: git fetch origin main:main --depth 100
         if: github.event_name == 'pull_request'
 
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+
       - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version-file: .nvmrc
-          cache: yarn
+          node-version-file: package.json
+          cache: pnpm
 
       - name: 📷 Check fingerprint and install dependencies
         id: fingerprint
-        uses: bluesky-social/github-actions/fingerprint-native@main
+        timeout-minutes: 5
+        uses: bluesky-social/github-actions/fingerprint-native@abc6a46eb4badf243f55bfd7d6cec42722456300 # v0.3.0
         with:
           profile: pull-request
 
       - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         if: ${{ steps.fingerprint.outputs.includes-changes }}
         with:
           header: fingerprint-diff
@@ -147,8 +209,171 @@ jobs:
             *Generated by [PR labeler](https://github.com/expo/expo/actions/workflows/pr-labeler.yml) 🤖*
 
       - name: 💬 Delete comment
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
         if: ${{ !steps.fingerprint.outputs.includes-changes }}
         with:
           header: fingerprint-diff
           delete: true
+
+      # publish-pr-ota is skipped once the fingerprint changes, so any install
+      # link left over from an earlier fingerprint-clean commit on this PR now
+      # points at a bundle that no longer matches the PR. Drop it.
+      - name: 💬 Delete stale OTA install comment
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
+        if: ${{ steps.fingerprint.outputs.includes-changes }}
+        with:
+          header: pull-request-ota
+          delete: true
+
+      - name: 🏷️ Label as fingerprint changed
+        if: ${{ steps.fingerprint.outputs.includes-changes }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          gh pr edit "$PR_NUMBER" --add-label "bot: fingerprint changed" || true
+
+      - name: 🏷️ Remove fingerprint changed label
+        if: ${{ !steps.fingerprint.outputs.includes-changes }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          gh pr edit "$PR_NUMBER" --remove-label "bot: fingerprint changed" || true
+
+  # Automatic per-PR OTA preview, published to the pull-request-<N> channel on
+  # denis. Replaces the old `@github-actions ota` comment trigger. Gated to
+  # same-repo PRs (fork guard): a branch can only exist in this repo if someone
+  # with write access pushed it, so an outside contributor (who can only open a
+  # PR from a fork) never runs this job with the denis publish role in scope.
+  # This matches the fork-guard gate the other jobs in this workflow use;
+  # author_association is deliberately NOT checked (it can't identify a private
+  # org member and would skip their PRs).
+  #
+  # Bot authors are excluded: Dependabot pushes in-repo branches, so it passes
+  # the fork guard, but GitHub withholds repo secrets from Dependabot-triggered
+  # runs. EXPO_TOKEN is then empty and the job fails at setup — a red check on
+  # every dependabot PR. There is no OTA preview worth publishing for a
+  # dependency bump anyway.
+  #
+  # Gated on a clean fingerprint-native run: an OTA can only carry JS, so once
+  # the native surface changes the published bundle no longer represents the PR
+  # and installing it on a store/TestFlight client is misleading at best. Those
+  # PRs need a native build instead. A skipped or failed fingerprint job also
+  # skips this one - without a verdict we can't say the OTA is representative.
+  publish-pr-ota:
+    name: Publish PR OTA to denis
+    needs: fingerprint-native
+    runs-on: ubuntu-latest
+    if: >-
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.type != 'Bot' &&
+      needs.fingerprint-native.outputs.includes-changes != 'true'
+    concurrency:
+      group: pr-ota-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
+    permissions:
+      id-token: write
+      contents: read
+    outputs:
+      release-version: ${{ steps.env.outputs.release-version }}
+      ios-build-number: ${{ steps.build-info.outputs.BSKY_IOS_BUILD_NUMBER }}
+      android-build-number: ${{ steps.build-info.outputs.BSKY_ANDROID_VERSION_CODE }}
+    steps:
+      - name: ⬇️ Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: 🛠️ Setup Expo project
+        uses: ./.github/actions/setup-expo-project
+        with:
+          expo-token: ${{ secrets.EXPO_TOKEN }}
+
+      - name: 🔤 Compile translations
+        uses: ./.github/actions/compile-i18n
+
+      - name: ✏️ Write environment variables
+        id: env
+        uses: ./.github/actions/write-env
+        with:
+          env-token: ${{ secrets.ENV_TOKEN }}
+          sentry-dsn: ${{ secrets.SENTRY_DSN }}
+          bitdrift-api-key: ${{ secrets.BITDRIFT_API_KEY }}
+          gcp-project-id: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
+          google-services-token: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
+          expo-public-env: testflight
+
+      - name: 🏗️ Create Bundle
+        run: >
+          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_RELEASE=${{ steps.env.outputs.release-version }}
+          SENTRY_DIST=${{ steps.env.outputs.bundle-identifier }}
+          pnpm export
+
+      - name: ☁️ Configure AWS credentials (denis, PR-scoped)
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
+        with:
+          role-to-assume: arn:aws:iam::007404326489:role/denis-ci-publish-pr
+          aws-region: us-east-2
+          # Defense-in-depth: the base role is already scoped to pr/*, but narrow
+          # this session further to just THIS PR's prefix so a bug can't write to
+          # another PR's objects or the prod tree.
+          inline-session-policy: |-
+            {
+              "Version": "2012-10-17",
+              "Statement": [
+                {
+                  "Effect": "Allow",
+                  "Action": ["s3:PutObject", "s3:DeleteObject"],
+                  "Resource": "arn:aws:s3:::bsky-denis-ota-prod/pr/${{ github.event.pull_request.number }}/*"
+                },
+                {
+                  "Effect": "Allow",
+                  "Action": "s3:ListBucket",
+                  "Resource": "arn:aws:s3:::bsky-denis-ota-prod",
+                  "Condition": {
+                    "StringLike": { "s3:prefix": "pr/${{ github.event.pull_request.number }}/*" }
+                  }
+                }
+              ]
+            }
+
+      - name: ⬇️ Setup denis CLI
+        uses: ./.github/actions/setup-denis
+        with:
+          release-tag: ${{ env.DENIS_RELEASE_TAG }}
+          app-id: ${{ vars.SYNC_INTERNAL_APP_ID }}
+          private-key: ${{ secrets.SYNC_INTERNAL_PK }}
+
+      - name: 🔢 Get native build numbers
+        id: build-info
+        run: bash scripts/setGitHubOutput.sh
+
+      - name: 🚀 Publish OTA to denis (S3)
+        run: pnpm use-build-number bash scripts/denisPublish.sh
+        env:
+          RUNTIME_VERSION: ''
+          CHANNEL_NAME: pull-request-${{ github.event.pull_request.number }}
+          # Pin the publish to the same values exposed in the install link.
+          BSKY_IOS_BUILD_NUMBER: ${{ steps.build-info.outputs.BSKY_IOS_BUILD_NUMBER }}
+          BSKY_ANDROID_VERSION_CODE: ${{ steps.build-info.outputs.BSKY_ANDROID_VERSION_CODE }}
+
+  comment-pr-ota:
+    name: Comment PR OTA install link
+    needs: publish-pr-ota
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - name: 💬 Drop OTA install comment
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
+        with:
+          header: pull-request-ota
+          message: |
+            The OTA deployment for this PR was successful! You may now apply it by either scanning the QR code or opening the deep link below in your browser:
+
+            <img src="https://bsky-qr.vercel.app?channel=pull-request-${{ github.event.pull_request.number }}&releaseVersion=${{ needs.publish-pr-ota.outputs.release-version }}&iosBuildNumber=${{ needs.publish-pr-ota.outputs.ios-build-number }}&androidBuildNumber=${{ needs.publish-pr-ota.outputs.android-build-number }}" width="300" height="300" alt="QR code for the PR OTA deployment">
+
+            `bluesky://intent/apply-ota?channel=pull-request-${{ github.event.pull_request.number }}&releaseVersion=${{ needs.publish-pr-ota.outputs.release-version }}&iosBuildNumber=${{ needs.publish-pr-ota.outputs.ios-build-number }}&androidBuildNumber=${{ needs.publish-pr-ota.outputs.android-build-number }}`

.github/workflows/sync-internal.yaml

@@ -4,28 +4,40 @@ on:
   push:
     branches: [main]
 
+# The push to the internal repo uses the app token below, not the GITHUB_TOKEN
+permissions:
+  contents: read
+
 jobs:
   sync:
     runs-on: ubuntu-latest
     if: github.repository == 'bluesky-social/social-app'
     steps:
-      - name: Checkout public repo
-        uses: actions/checkout@v4
+      - name: ⬇️ Checkout public repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - name: Generate GitHub App Token
+          # Don't persist the checkout auth header; the push below authenticates
+          # with the app token embedded in the remote URL instead
+          persist-credentials: false
+      - name: 🔑 Generate GitHub App Token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ vars.SYNC_INTERNAL_APP_ID }}
           private-key: ${{ secrets.SYNC_INTERNAL_PK }}
           repositories: social-app-internal
-      - name: Push to internal repo
+          # Scope the token down from the app's full installation permissions;
+          # pushing is the only thing this token is used for. The workflows
+          # permission is required because the sync includes files under
+          # .github/workflows/, which GitHub refuses to push without it.
+          permission-contents: write
+          permission-workflows: write
+      - name: 🚀 Push to internal repo
         env:
           TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           git config user.name "github-actions"
           git config user.email "test@users.noreply.github.com"
-          git config --unset-all http.https://github.com/.extraheader
           git remote add internal https://x-access-token:${TOKEN}@github.com/bluesky-social/social-app-internal.git
           git push internal main --force

.github/workflows/verify-pnpm-lock.yml

@@ -0,0 +1,51 @@
+name: Lockfile
+
+on:
+  pull_request:
+concurrency:
+  group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  verify-pnpm-lock:
+    name: No manual pnpm-lock.yaml edits
+    runs-on: ubuntu-latest
+    steps:
+      - name: ⬇️ Check out PR HEAD
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: ⬇️ Fetch base branch
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: git fetch origin $BASE_REF --depth=1
+
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+
+      - name: 🔧 Install node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: package.json
+
+      - name: ⏪ Reset pnpm-lock.yaml to base
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: git show "origin/$BASE_REF:pnpm-lock.yaml" > pnpm-lock.yaml
+
+      - name: 📦 pnpm install
+        # Fine to skip scripts since we don't run any code
+        run: pnpm clean && pnpm install --ignore-scripts --no-frozen-lockfile
+
+      - name: 🔍 Verify pnpm-lock.yaml
+        run: |
+          git diff --quiet --exit-code || {
+            echo '::error::`pnpm-lock.yaml` does not match what pnpm would generate given the base `pnpm-lock.yaml` and the head `package.json`.'
+            echo '::error:: - If this is intentional, you can ignore this check.'
+            echo '::error:: - If this is unintentional, apply the following diff:'
+            git --no-pager diff
+            exit 1
+          }

.github/workflows/verify-yarn-lock.yml

@@ -1,50 +0,0 @@
-name: Lockfile
-
-on:
-  pull_request:
-concurrency:
-  group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
-  cancel-in-progress: true
-
-jobs:
-  verify-yarn-lock:
-    name: No manual yarn.lock edits
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out PR HEAD
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Fetch base branch
-        env:
-          BASE_REF: ${{ github.base_ref }}
-        run: git fetch origin $BASE_REF --depth=1
-
-      - name: Install node
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: .nvmrc
-
-      - name: Reset yarn.lock to base
-        env:
-          BASE_REF: ${{ github.base_ref }}
-        run: git show "origin/$BASE_REF:yarn.lock" > yarn.lock
-
-      - name: Yarn install
-        uses: Wandalen/wretry.action@master
-        with:
-          # Fine to skip scripts since we don't run any code
-          command: yarn install --ignore-scripts
-          attempt_limit: 3
-          attempt_delay: 2000
-
-      - name: Verify yarn.lock
-        run: |
-          git diff --quiet --exit-code || {
-            echo '::error::`yarn.lock` does not match what Yarn would generate given the base `yarn.lock` and the head `package.json`.'
-            echo '::error:: - If this is intentional, you can ignore this check.'
-            echo '::error:: - If this is unintentional, apply the following diff:'
-            git --no-pager diff
-            exit 1
-          }

.github/workflows/zizmor.yml

@@ -0,0 +1,37 @@
+name: Workflow security
+
+on:
+  push:
+    branches: [main]
+    paths: [".github/**"]
+  pull_request:
+    paths: [".github/**"]
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
+  cancel-in-progress: true
+
+# The github.token is only used by zizmor's online audits (read-only API calls)
+permissions:
+  contents: read
+
+jobs:
+  zizmor:
+    name: Audit workflows with zizmor
+    runs-on: ubuntu-latest
+    steps:
+      - name: ⬇️ Check out Git repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: 🛡️ Run zizmor
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        with:
+          # Annotate the PR directly instead of uploading SARIF to the
+          # security tab, and fail the check on any finding
+          advanced-security: false
+          annotations: true
+          # Low-confidence findings (e.g. artipacked on workflows that never
+          # push) are too noisy to gate CI on
+          min-confidence: medium

.gitignore

@@ -86,6 +86,9 @@ stats.json
 # VSCode
 .vscode
 
+# Zed
+.zed
+
 # gitignore and github actions
 !.gitignore
 !.github
@@ -105,12 +108,17 @@ google-services.json
 # Performance results (Flashlight)
 .perf/
 
-# ESLint
-.eslintcache
+# Oxlint
+.oxlintcache
 
 # i18n
 src/locale/locales/_build/
-src/locale/locales/**/*.js
+src/locale/locales/**/messages.js
+src/locale/locales/**/messages.mjs
+src/locale/locales/**/messages.ts
+
+# generated lexicon schemas (pnpm lexicons:generate)
+src/lexicons/
 
 # local builds
 *.apk
@@ -125,3 +133,10 @@ bskyweb/static/media/*.webp
 bskyweb/static/media/*.jpg
 bskyweb/static/media/*.png
 bskyweb/static/media/*.svg
+
+# superpowers plugin plans/specs — local-only workspace
+docs/superpowers/
+.claude/worktrees
+
+# pnpm
+.pnpm-store/

.husky/pre-commit

@@ -1,4 +1 @@
-#!/usr/bin/env sh
-. "$(dirname -- "$0")/_/husky.sh"
-
-npx lint-staged --concurrent false
+pnpm exec lint-staged --concurrent false

.jscodeshift/file/lingui-v5.js

@@ -0,0 +1,236 @@
+/**
+ * Codemod to update Lingui's useLingui() hook to use v5.
+ *
+ * Before:
+ *   import {msg} from '@lingui/core/macro'
+ *   import {useLingui} from '@lingui/react'
+ *   const {_} = useLingui()
+ *   _(msg`Lorem ipsum`)
+ *
+ * After:
+ *   import {useLingui} from '@lingui/react/macro'
+ *   const {t: l} = useLingui()
+ *   l`Lorem ipsum`
+ *
+ * Usage: jscodeshift -t .jscodeshift/file/lingui-v5.js <file-path>
+ * Example: jscodeshift -t .jscodeshift/file/lingui-v5.js modules/bottom-sheet/src/lib/Portal.tsx
+ */
+
+/* eslint-disable */
+
+export const parser = 'tsx'
+
+export default function transformer(file, api) {
+  const j = api.jscodeshift
+
+  const root = j(file.source)
+
+  // Remove msg imports, including aliased imports
+  root
+    .find(j.ImportDeclaration)
+    .filter(path => path.node.source.value === '@lingui/core/macro')
+    .forEach(path => {
+      const newSpecifiers = path.node.specifiers.filter(specifier => {
+        if (j.ImportSpecifier.check(specifier)) {
+          const importedName = specifier.imported
+            ? specifier.imported.name
+            : specifier.local.name
+          const localName = specifier.local
+            ? specifier.local.name
+            : importedName
+
+          return !(
+            importedName === 'msg' &&
+            (localName === 'msg' || localName === 'msgLingui')
+          )
+        }
+        return true
+      })
+
+      if (newSpecifiers.length > 0) {
+        path.node.specifiers = newSpecifiers
+      } else {
+        j(path).remove()
+      }
+    })
+
+  // Update React imports
+  root
+    .find(j.ImportDeclaration)
+    .filter(path => path.node.source.value === '@lingui/react')
+    .forEach(path => {
+      path.node.source = j.stringLiteral('@lingui/react/macro')
+    })
+
+  // Replace {_} with {t: l}
+  root
+    .find(j.VariableDeclarator, {
+      init: {
+        type: 'CallExpression',
+        callee: {name: 'useLingui'},
+      },
+    })
+    .replaceWith(nodePath => {
+      const {node} = nodePath
+      for (let i = 0; i < node.id.properties.length; i++) {
+        if (node.id.properties[i].key.name === '_') {
+          node.id.properties[i].key = j.identifier('t')
+          node.id.properties[i].shorthand = false
+          node.id.properties[i].value = j.identifier('l')
+        }
+      }
+      return node
+    })
+
+  // Replace {_: _l} with {t: l}
+  root
+    .find(j.VariableDeclarator, {
+      init: {callee: {name: 'useLingui'}},
+      id: {
+        properties: properties =>
+          properties.some(p => p.key.name === '_' && p.value.name === '_l'),
+      },
+    })
+    .forEach(path => {
+      const prop = path.node.id.properties.find(
+        p => p.key.name === '_' && p.value.name === '_l',
+      )
+      if (prop) {
+        prop.key.name = 't'
+        prop.value.name = 'l'
+      }
+    })
+
+  // Replace _(msg``) with l``
+  root
+    .find(j.CallExpression, {
+      callee: {name: '_'},
+      arguments: [
+        {
+          type: 'TaggedTemplateExpression',
+          tag: {name: 'msg'},
+        },
+      ],
+    })
+    .replaceWith(path => {
+      const quasis = path.node.arguments[0].quasi
+
+      return j.taggedTemplateExpression(j.identifier('l'), quasis)
+    })
+
+  // Replace _l(msgLingui``) with l``
+  root
+    .find(j.CallExpression, {
+      callee: {name: '_l'},
+      arguments: [
+        {
+          type: 'TaggedTemplateExpression',
+          tag: {name: 'msgLingui'},
+        },
+      ],
+    })
+    .replaceWith(path => {
+      const quasis = path.node.arguments[0].quasi
+
+      return j.taggedTemplateExpression(j.identifier('l'), quasis)
+    })
+
+  // Replace _(msg()) with l()
+  root
+    .find(j.CallExpression, {
+      callee: {name: '_'},
+      arguments: [
+        {
+          type: 'CallExpression',
+          callee: {name: 'msg'},
+        },
+      ],
+    })
+    .replaceWith(path => {
+      return j.callExpression(j.identifier('l'), [
+        path.node.arguments[0].arguments[0],
+      ])
+    })
+
+  // Replace _l(msgLingui()) with l()
+  root
+    .find(j.CallExpression, {
+      callee: {name: '_l'},
+      arguments: [
+        {
+          type: 'CallExpression',
+          callee: {name: 'msgLingui'},
+        },
+      ],
+    })
+    .replaceWith(path => {
+      return j.callExpression(j.identifier('l'), [
+        path.node.arguments[0].arguments[0],
+      ])
+    })
+
+  // Replace _(plural()) with plural()
+  root
+    .find(j.CallExpression, {
+      callee: {
+        type: 'Identifier',
+        name: '_',
+      },
+    })
+    .forEach(path => {
+      const callExpression = path.node
+      if (
+        callExpression.arguments.length === 1 &&
+        callExpression.arguments[0].type === 'CallExpression'
+      ) {
+        const innerCall = callExpression.arguments[0]
+
+        if (
+          innerCall.callee.type === 'Identifier' &&
+          innerCall.callee.name === 'plural'
+        ) {
+          j(path).replaceWith(innerCall)
+        }
+      }
+    })
+
+  // Update hook dependency arrays
+  root
+    .find(j.CallExpression, {
+      callee: callee => {
+        if (
+          callee.type === 'Identifier' ||
+          callee.type === 'MemberExpression'
+        ) {
+          return true
+        }
+        if (
+          ['useCallback', 'useEffect', 'useMemo'].includes(callee.name) &&
+          callee.type === 'MemberExpression' &&
+          callee.object.type === 'Identifier' &&
+          callee.object.name === 'React' &&
+          callee.property.type === 'Identifier' &&
+          callee.property.name === 'useCallback'
+        ) {
+          return true
+        }
+        return false
+      },
+    })
+    .forEach(path => {
+      const dependencyArray = path.node.arguments[1]
+      if (dependencyArray && dependencyArray.type === 'ArrayExpression') {
+        dependencyArray.elements = dependencyArray.elements.map(element => {
+          if (
+            element.type === 'Identifier' &&
+            (element.name === '_' || element.name === '_l')
+          ) {
+            return j.identifier('l')
+          }
+          return element
+        })
+      }
+    })
+
+  return root.toSource()
+}

.jscodeshift/repo/react-import.js

@@ -0,0 +1,135 @@
+/**
+ * Codemod to replace namespaced React calls with named imports
+ *
+ * Before:
+ *   import React from 'react'
+ *   React.useEffect(() => {}, [])
+ *
+ * After:
+ *   import { useEffect } from 'react'
+ *   useEffect(() => {}, [])
+ *
+ * Usage: jscodeshift -t .jscodeshift/repo/react-import.js <file-path>
+ * Example: jscodeshift -t .jscodeshift/repo/react-import.js src/App.native.tsx
+ */
+
+/* eslint-disable */
+
+export const parser = 'tsx'
+
+export default function transformer(file, api) {
+  const j = api.jscodeshift
+  const root = j(file.source)
+
+  // Find the React import
+  let reactImportPath = null
+  const reactMembers = new Set()
+
+  root.find(j.ImportDeclaration).forEach(path => {
+    const node = path.value
+    if (node.source.value === 'react') {
+      node.specifiers.forEach(spec => {
+        // Check if this is a default import of React
+        if (
+          spec.type === 'ImportDefaultSpecifier' &&
+          spec.local.name === 'React'
+        ) {
+          reactImportPath = path
+        }
+      })
+    }
+  })
+
+  if (!reactImportPath) {
+    // No React import found, nothing to do
+    return file.source
+  }
+
+  // Find all React.* member expressions
+  root
+    .find(j.MemberExpression)
+    .filter(path => {
+      const node = path.value
+      return (
+        node.object.type === 'Identifier' &&
+        node.object.name === 'React' &&
+        node.property.type === 'Identifier'
+      )
+    })
+    .forEach(path => {
+      const propertyName = path.value.property.name
+      reactMembers.add(propertyName)
+    })
+
+  // Find all React.* JSX member expressions (e.g., <React.Fragment>)
+  root
+    .find(j.JSXMemberExpression)
+    .filter(path => {
+      const node = path.value
+      return node.object.name === 'React' && node.property.name
+    })
+    .forEach(path => {
+      const propertyName = path.value.property.name
+      reactMembers.add(propertyName)
+    })
+
+  // If no React members are used, remove the import
+  if (reactMembers.size === 0) {
+    reactImportPath.prune()
+    return root.toSource()
+  }
+
+  // Sort the members for consistent output
+  const sortedMembers = Array.from(reactMembers).sort()
+
+  // Create new import specifiers
+  const newSpecifiers = sortedMembers.map(name =>
+    j.importSpecifier(j.identifier(name), j.identifier(name)),
+  )
+
+  // Get the existing import specifiers
+  const sortedImports = Array.from(reactImportPath.value.specifiers).sort()
+  const existingSpecifiers = sortedImports.filter(
+    specifier => specifier.type !== 'ImportDefaultSpecifier',
+  )
+
+  const allSpecifiers = [
+    ...new Map(
+      [...existingSpecifiers, ...newSpecifiers].map(item => [
+        item.imported.name,
+        item,
+      ]),
+    ).values(),
+  ]
+
+  // Update the import declaration
+  reactImportPath.value.specifiers = allSpecifiers
+
+  // Replace all React.* member expressions with just the identifier
+  root
+    .find(j.MemberExpression)
+    .filter(path => {
+      const node = path.value
+      return (
+        node.object.type === 'Identifier' &&
+        node.object.name === 'React' &&
+        node.property.type === 'Identifier'
+      )
+    })
+    .replaceWith(path => {
+      return j.identifier(path.value.property.name)
+    })
+
+  // Replace all React.* JSX member expressions with just the identifier
+  root
+    .find(j.JSXMemberExpression)
+    .filter(path => {
+      const node = path.value
+      return node.object.name === 'React' && node.property.name
+    })
+    .replaceWith(path => {
+      return j.jsxIdentifier(path.value.property.name)
+    })
+
+  return root.toSource()
+}

.jscodeshift/repo/toast-v2.js

@@ -0,0 +1,106 @@
+/**
+ * Codemod to replace namespaced React calls with named imports
+ *
+ * Before:
+ *   import * as Toast from '#/view/com/util/Toast'
+ *   Toast.show(message, 'xmark')
+ *
+ * After:
+ *   import * as Toast from '#/components/Toast'
+ *   Toast.show(message, {type: 'error'})
+ *
+ * Usage: jscodeshift -t .jscodeshift/repo/toast-v2.js <file-path>
+ * Example: jscodeshift -t .jscodeshift/repo/toast-v2.js src/App.native.tsx
+ */
+
+/* eslint-disable */
+
+export const parser = 'tsx'
+
+const OLD_IMPORT = '#/view/com/util/Toast'
+const NEW_IMPORT = '#/components/Toast'
+
+const convertLegacyToastType = type => {
+  switch (type) {
+    // these ones are fine
+    case 'default':
+    case 'success':
+    case 'error':
+    case 'warning':
+    case 'info':
+      return type
+    // legacy ones need conversion
+    case 'xmark':
+      return 'error'
+    case 'exclamation-circle':
+      return 'warning'
+    case 'check':
+      return 'success'
+    case 'clipboard-check':
+      return 'success'
+    case 'circle-exclamation':
+    case 'exclamation-circle':
+      return 'warning'
+    default:
+      return 'default'
+  }
+}
+
+export default function transformer(file, api) {
+  const j = api.jscodeshift
+  const root = j(file.source)
+
+  // Find Toast import declarations using the old path
+  const toastImports = root
+    .find(j.ImportDeclaration)
+    .filter(path => path.value.source.value === OLD_IMPORT)
+
+  if (toastImports.length === 0) {
+    return file.source
+  }
+
+  // Update import path
+  toastImports.forEach(path => {
+    path.value.source.value = NEW_IMPORT
+  })
+
+  // Collect all local names the Toast namespace is bound to
+  const toastLocalNames = new Set()
+  toastImports.forEach(path => {
+    path.value.specifiers.forEach(spec => {
+      if (spec.type === 'ImportNamespaceSpecifier') {
+        toastLocalNames.add(spec.local.name)
+      }
+    })
+  })
+
+  // Transform Toast.show(message, type) calls
+  root.find(j.CallExpression).forEach(path => {
+    const {callee, arguments: args} = path.value
+
+    // Match <ToastName>.show(...)
+    if (
+      callee.type !== 'MemberExpression' ||
+      callee.object.type !== 'Identifier' ||
+      !toastLocalNames.has(callee.object.name) ||
+      callee.property.name !== 'show'
+    ) {
+      return
+    }
+
+    // Only transform 2-arg calls where the second arg is a string literal
+    if (args.length !== 2) return
+    const typeArg = args[1]
+    if (typeArg.type !== 'StringLiteral' && typeArg.type !== 'Literal') return
+
+    const legacyType = typeArg.value
+    const newType = convertLegacyToastType(legacyType)
+
+    // Replace the second argument with an options object: {type: 'newType'}
+    args[1] = j.objectExpression([
+      j.property('init', j.identifier('type'), j.stringLiteral(newType)),
+    ])
+  })
+
+  return root.toSource()
+}

.nvmrc

@@ -1 +1 @@
-20
+24.18.0

.oxlintrc.json

@@ -0,0 +1,408 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": [
+    "typescript",
+    "react",
+    "import"
+  ],
+  "categories": {
+    "correctness": "off"
+  },
+  "options": {
+    "typeAware": true
+  },
+  "env": {
+    "builtin": true
+  },
+  "settings": {
+    "import-x/extensions": [
+      ".ts",
+      ".tsx",
+      ".cts",
+      ".mts",
+      ".js",
+      ".jsx",
+      ".cjs",
+      ".mjs"
+    ],
+    "import-x/external-module-folders": [
+      "node_modules",
+      "node_modules/@types"
+    ],
+    "import-x/parsers": {
+      "@typescript-eslint/parser": [
+        ".ts",
+        ".tsx",
+        ".cts",
+        ".mts"
+      ]
+    },
+    "import-x/resolver": {
+      "node": {
+        "extensions": [
+          ".js",
+          ".web.js",
+          ".ios.js",
+          ".android.js"
+        ]
+      }
+    }
+  },
+  "ignorePatterns": [
+    "**/__mocks__/*.ts",
+    "ios/**",
+    "android/**",
+    "coverage/**",
+    "*.lock",
+    ".husky/**",
+    "patches/**",
+    "*.html",
+    "bskyweb/**",
+    "bskyembed/**",
+    "bskyogcard/**",
+    "src/locale/locales/_build/**",
+    "src/locale/locales/**/*.js",
+    "src/lexicons/**",
+    "*.e2e.ts",
+    "*.e2e.tsx",
+    "eslint.config.mjs",
+    ".jscodeshift/**"
+  ],
+  "rules": {
+    "constructor-super": "error",
+    "for-direction": "error",
+    "getter-return": "error",
+    "no-async-promise-executor": "error",
+    "no-case-declarations": "error",
+    "no-class-assign": "error",
+    "no-compare-neg-zero": "error",
+    "no-cond-assign": "error",
+    "no-const-assign": "error",
+    "no-constant-binary-expression": "error",
+    "no-constant-condition": "error",
+    "no-control-regex": "error",
+    "no-debugger": "error",
+    "no-delete-var": "error",
+    "no-dupe-class-members": "error",
+    "no-dupe-else-if": "error",
+    "no-dupe-keys": "error",
+    "no-duplicate-case": "error",
+    "no-empty": "error",
+    "no-empty-character-class": "error",
+    "no-empty-pattern": "error",
+    "no-empty-static-block": "error",
+    "no-ex-assign": "error",
+    "no-extra-boolean-cast": "error",
+    "no-fallthrough": "error",
+    "no-func-assign": "error",
+    "no-global-assign": "error",
+    "no-import-assign": "error",
+    "no-invalid-regexp": "error",
+    "no-irregular-whitespace": "error",
+    "no-loss-of-precision": "error",
+    "no-misleading-character-class": "error",
+    "no-new-native-nonconstructor": "error",
+    "no-nonoctal-decimal-escape": "error",
+    "no-obj-calls": "error",
+    "no-prototype-builtins": "error",
+    "no-redeclare": "error",
+    "no-regex-spaces": "error",
+    "no-self-assign": "error",
+    "no-setter-return": "error",
+    "no-shadow-restricted-names": "error",
+    "no-sparse-arrays": "error",
+    "no-this-before-super": "error",
+    "no-unexpected-multiline": "error",
+    "no-unreachable": "error",
+    "no-unsafe-finally": "error",
+    "no-unsafe-negation": "error",
+    "no-unsafe-optional-chaining": "error",
+    "no-unused-labels": "error",
+    "no-unused-private-class-members": "error",
+    "no-unused-vars": "error",
+    "no-useless-backreference": "error",
+    "no-useless-catch": "error",
+    "no-useless-escape": "error",
+    "no-with": "error",
+    "require-yield": "error",
+    "use-isnan": "error",
+    "valid-typeof": "error",
+    "no-array-constructor": "error",
+    "no-unused-expressions": "error",
+    "import/namespace": "off",
+    "import/default": "error",
+    "import/no-named-as-default": "warn",
+    "import/no-named-as-default-member": "warn",
+    "import/no-duplicates": "warn",
+    "react/rules-of-hooks": "error",
+    "react/exhaustive-deps": "warn",
+    "typescript/await-thenable": "error",
+    "typescript/ban-ts-comment": "error",
+    "typescript/no-array-delete": "error",
+    "typescript/no-base-to-string": "error",
+    "typescript/no-duplicate-enum-values": "error",
+    "typescript/no-duplicate-type-constituents": "error",
+    "typescript/no-empty-object-type": "error",
+    "typescript/no-explicit-any": "error",
+    "typescript/no-extra-non-null-assertion": "error",
+    "typescript/no-floating-promises": "error",
+    "typescript/no-for-in-array": "error",
+    "typescript/no-implied-eval": "error",
+    "typescript/no-misused-new": "error",
+    "typescript/no-misused-promises": "error",
+    "typescript/no-namespace": "error",
+    "typescript/no-non-null-asserted-optional-chain": "error",
+    "typescript/no-redundant-type-constituents": "error",
+    "typescript/no-require-imports": "error",
+    "typescript/no-this-alias": "error",
+    "typescript/no-unnecessary-type-assertion": "error",
+    "typescript/no-unnecessary-type-constraint": "error",
+    "typescript/no-unsafe-argument": "error",
+    "typescript/no-unsafe-assignment": "error",
+    "typescript/no-unsafe-call": "error",
+    "typescript/no-unsafe-declaration-merging": "error",
+    "typescript/no-unsafe-enum-comparison": "error",
+    "typescript/no-unsafe-function-type": "error",
+    "typescript/no-unsafe-member-access": "error",
+    "typescript/no-unsafe-return": "error",
+    "typescript/no-unsafe-unary-minus": "error",
+    "typescript/no-wrapper-object-types": "error",
+    "typescript/only-throw-error": "error",
+    "typescript/prefer-as-const": "error",
+    "typescript/prefer-namespace-keyword": "error",
+    "typescript/prefer-promise-reject-errors": "error",
+    "typescript/require-await": "error",
+    "typescript/restrict-plus-operands": "error",
+    "typescript/restrict-template-expressions": "error",
+    "typescript/triple-slash-reference": "error",
+    "typescript/unbound-method": "error"
+  },
+  "overrides": [
+    {
+      "files": [
+        "**/*.ts",
+        "**/*.tsx",
+        "**/*.mts",
+        "**/*.cts"
+      ],
+      "rules": {
+        "constructor-super": "off",
+        "getter-return": "off",
+        "no-class-assign": "off",
+        "no-const-assign": "off",
+        "no-dupe-class-members": "off",
+        "no-dupe-keys": "off",
+        "no-func-assign": "off",
+        "no-import-assign": "off",
+        "no-new-native-nonconstructor": "off",
+        "no-obj-calls": "off",
+        "no-redeclare": "off",
+        "no-setter-return": "off",
+        "no-this-before-super": "off",
+        "no-unreachable": "off",
+        "no-unsafe-negation": "off",
+        "no-var": "error",
+        "no-with": "off",
+        "prefer-const": "error",
+        "prefer-rest-params": "error",
+        "prefer-spread": "error"
+      }
+    },
+    {
+      "files": [
+        "**/*.{js,jsx,ts,tsx}"
+      ],
+      "rules": {
+        "bsky-internal/avoid-unwrapped-text": [
+          "error",
+          {
+            "impliedTextComponents": [
+              "H1",
+              "H2",
+              "H3",
+              "H4",
+              "H5",
+              "H6",
+              "P",
+              "Admonition",
+              "Admonition.Admonition",
+              "Toast.Action",
+              "AgeAssuranceAdmonition",
+              "Span",
+              "StackedButton"
+            ],
+            "impliedTextProps": [],
+            "suggestedTextWrappers": {
+              "Button": "ButtonText",
+              "ToggleButton.Button": "ToggleButton.ButtonText",
+              "SegmentedControl.Item": "SegmentedControl.ItemText"
+            }
+          }
+        ],
+        "bsky-internal/use-exact-imports": "error",
+        "bsky-internal/use-prefixed-imports": "error",
+        "bsky-internal/lingui-msg-rule": "error",
+        "react/display-name": "error",
+        "react/jsx-key": "error",
+        "react/jsx-no-comment-textnodes": "error",
+        "react/jsx-no-duplicate-props": "error",
+        "react/jsx-no-target-blank": "error",
+        "react/jsx-no-undef": "error",
+        "react/no-children-prop": "error",
+        "react/no-danger-with-children": "error",
+        "react/no-direct-mutation-state": "error",
+        "react/no-find-dom-node": "error",
+        "react/no-is-mounted": "error",
+        "react/no-render-return-value": "error",
+        "react/no-string-refs": "error",
+        "react/no-unescaped-entities": "off",
+        "react/no-unknown-property": "error",
+        "react/no-unsafe": "off",
+        "react/react-in-jsx-scope": "off",
+        "react/hook-use-state": "warn",
+        "react-native/no-inline-styles": "off",
+        "react-native-a11y/has-accessibility-hint": "error",
+        "react-native-a11y/has-accessibility-props": "error",
+        "react-native-a11y/has-valid-accessibility-actions": "error",
+        "react-native-a11y/has-valid-accessibility-component-type": "error",
+        "react-native-a11y/has-valid-accessibility-descriptors": "error",
+        "react-native-a11y/has-valid-accessibility-role": "error",
+        "react-native-a11y/has-valid-accessibility-state": "error",
+        "react-native-a11y/has-valid-accessibility-states": "error",
+        "react-native-a11y/has-valid-accessibility-traits": "error",
+        "react-native-a11y/has-valid-accessibility-value": "error",
+        "react-native-a11y/no-nested-touchables": "error",
+        "react-native-a11y/has-valid-accessibility-ignores-invert-colors": "error",
+        "react-native-a11y/has-valid-accessibility-live-region": "error",
+        "react-native-a11y/has-valid-important-for-accessibility": "error",
+        "react-compiler/react-compiler": "warn",
+        "simple-import-sort/imports": [
+          "error",
+          {
+            "groups": [
+              [
+                "^\\u0000"
+              ],
+              [
+                "^node:"
+              ],
+              [
+                "^(react\\/(.*)$)|^(react$)|^(react-native(.*)$)",
+                "^(expo(.*)$)|^(expo$)",
+                "^(?!(?:alf|components|lib|locale|logger|platform|screens|state|view)(?:$|\\/))@?\\w"
+              ],
+              [
+                "^(?:#\\/)?(?:lib|state|logger|platform|locale)(?:$|\\/)",
+                "^(?:#\\/)?view(?:$|\\/)",
+                "^(?:#\\/)?screens(?:$|\\/)",
+                "^(?:#\\/)?alf(?:$|\\/)",
+                "^(?:#\\/)?components(?:$|\\/)",
+                "^#\\/",
+                "^\\."
+              ],
+              [
+                "^"
+              ]
+            ]
+          }
+        ],
+        "simple-import-sort/exports": "error",
+        "no-unused-vars": [
+          "error",
+          {
+            "argsIgnorePattern": "^_",
+            "varsIgnorePattern": "^_.+",
+            "caughtErrors": "none",
+            "ignoreRestSiblings": true
+          }
+        ],
+        "no-restricted-imports": [
+          "error",
+          {
+            "paths": [
+              {
+                "name": "react",
+                "importNames": [
+                  "React",
+                  "default"
+                ],
+                "message": "React is already in the global type namespace. Use named imports for runtime modules."
+              }
+            ]
+          }
+        ],
+        "no-empty-pattern": "off",
+        "no-async-promise-executor": "off",
+        "no-constant-binary-expression": "warn",
+        "prefer-const": "off",
+        "no-empty": "off",
+        "no-unsafe-optional-chaining": "off",
+        "no-prototype-builtins": "off",
+        "no-var": "off",
+        "prefer-rest-params": "off",
+        "no-case-declarations": "off",
+        "no-irregular-whitespace": "off",
+        "no-useless-escape": "off",
+        "no-sparse-arrays": "off",
+        "no-fallthrough": "off",
+        "no-control-regex": "off",
+        "no-unused-expressions": [
+          "error",
+          {
+            "allowTernary": true
+          }
+        ],
+        "import/consistent-type-specifier-style": [
+          "warn",
+          "prefer-inline"
+        ],
+        "import/no-nodejs-modules": "error",
+        "typescript/consistent-type-imports": [
+          "warn",
+          {
+            "prefer": "type-imports",
+            "fixStyle": "inline-type-imports"
+          }
+        ],
+        "typescript/no-require-imports": "off",
+        "typescript/ban-ts-comment": "off",
+        "typescript/no-empty-object-type": "off",
+        "typescript/no-unsafe-function-type": "off",
+        "typescript/no-unsafe-assignment": "off",
+        "typescript/unbound-method": "off",
+        "typescript/no-unsafe-argument": "off",
+        "typescript/no-unsafe-return": "off"
+      },
+      "jsPlugins": [
+        "eslint-plugin-bsky-internal",
+        "eslint-plugin-react-native",
+        "eslint-plugin-react-native-a11y",
+        "eslint-plugin-react-compiler",
+        "eslint-plugin-simple-import-sort"
+      ],
+      "env": {
+        "es2026": true,
+        "browser": true,
+        "node": true
+      }
+    },
+    {
+      "files": [
+        "bskyogcard/**/*.{js,jsx,ts,tsx}",
+        "dev-env/**/*.{js,jsx,ts,tsx}"
+      ],
+      "rules": {
+        "import/no-nodejs-modules": "off"
+      }
+    },
+    {
+      "files": [
+        "**/__tests__/**/*.{js,jsx,ts,tsx}",
+        "**/*.test.{js,jsx,ts,tsx}"
+      ],
+      "env": {
+        "jest": true
+      }
+    }
+  ]
+}

.prettierignore

@@ -5,15 +5,20 @@
 !**/*.jsx
 !**/*.ts
 !**/*.tsx
+!**/*.mjs
+!**/*.cjs
 !*/
 
 !**/*.css
 
+!**/pnpm-workspace.yaml
+
 # More specific ignores go below.
 .expo
 android
 ios
 src/locale/locales
+src/lexicons
 lib/react-compiler-runtime
 bskyweb/static
 coverage

ASSETS.md

@@ -0,0 +1,208 @@
+# Asset licensing
+
+The [MIT license](./LICENSE) in this repository covers our source code. It does not cover
+every file in the tree.
+
+Some of the images, icons, fonts, and brand assets here are licensed to Bluesky Social PBC
+by third parties, or are our trademarks, or are third-party trademarks. We cannot pass those
+rights on to you. This document identifies them.
+
+We should have written this down sooner. If you have already forked this repository and
+shipped one of the assets listed below, we are not treating that as bad faith on your part —
+the repository did not tell you, and that is our fault. Please work through the
+[If you are forking](#if-you-are-forking) checklist when you can.
+
+Assets are scoped by directory wherever possible, so that adding a file to a carved-out
+directory does not require an edit here. Individual paths are listed only where an asset does
+not sit in a dedicated directory.
+
+**The rule:** if a file is listed in this document, the MIT license does not grant you rights
+to it. Everything in [Section 6](#6-third-party-assets-you-may-redistribute) is redistributable
+on its own terms, which travel with the files.
+
+---
+
+## 1. Commissioned artwork — licensed to Bluesky only
+
+**`assets/illustrations/`**
+
+The landing-screen illustration, in light and dark variants, used by
+`src/view/com/auth/SplashScreen.tsx` (`illustration-mobile.png` and
+`illustration-mobile-dark.png`).
+
+This artwork was commissioned by Bluesky Social PBC from illustrator Owen D. Pomery, through
+his agent Brilliant Artists Ltd. Copyright remains with the artist. Our license is limited to
+Bluesky's own products and channels, it is exclusive to us, and it does not permit us to
+sublicense the artwork or to distribute modified versions of it.
+
+**If you are forking this repository, replace these files.** They are not available for
+third-party licensing while our license runs, so please do not contact the artist or his agent
+to request permission — the answer is constrained by our agreement, not by their willingness.
+See [`assets/illustrations/README.md`](./assets/illustrations/README.md).
+
+## 2. Licensed icon system — not ours to pass on
+
+**`assets/icons/` (top level), and the icon glyphs in `bskyembed/assets/`**
+
+The user-interface glyphs at the top level of `assets/icons/`, plus copies of several in
+`bskyembed/assets/`, come from the Central icon system by Iconists (David & Storm GbR). Bluesky
+Social PBC licenses these icons for use in our own products. **That license is for our own use.
+It does not include the right to pass any rights to the icons on to you.**
+
+This is not us telling you that you cannot use these icons. It is us telling you that any right
+you have to use them has to come from Iconists rather than from us, and that you should not
+assume our MIT license gave you one. Licenses are available directly from
+[iconists.co](https://iconists.co), and there are good openly licensed alternatives if you would
+rather not buy one.
+
+This section covers every file at the top level of `assets/icons/` **except** those named
+elsewhere in this document — specifically `logomark.svg`, `newskie.svg`, `verifiedCheck.svg`,
+`verifierCheck.svg`, `starterPack.svg`, `starterPack_stroke2_corner0_rounded.svg`, `custom_logo_japan.svg`,
+`apple_logo.svg`, and `android_logo.svg`. The `assets/icons/flags/` and `assets/icons/community/`
+subdirectories are covered by [Section 6](#6-third-party-assets-you-may-redistribute) and
+[Section 5](#5-third-party-trademarks) respectively.
+
+See [`assets/icons/README.md`](./assets/icons/README.md).
+
+## 3. Bluesky trademarks and brand assets
+
+Our name, logo, butterfly mark, logotype, and app icons are trademarks of Bluesky Social PBC.
+They are not licensed to you under the MIT license or by this document. Use of them is governed
+by our [Trademark Policy](https://bsky.social/about/support/trademarks) and [Brand Guidelines](https://bsky.social/about/support/branding).
+
+You may refer to Bluesky by name to describe interoperability or origin — for example, "a client
+for Bluesky," or "based on the Bluesky app." You may not use our marks as the identity of your
+own product or service, or in any way likely to suggest that Bluesky publishes, endorses, or
+supports it.
+
+- `assets/app-icons/` — all iOS and Android app icon variants, including the `.icon` bundles
+- `assets/favicon.png`
+- `assets/logo.png`
+- `assets/default-avatar.png`
+- `assets/icon-android-foreground.png`
+- `assets/icon-android-monochrome.png`
+- `assets/icon-android-notification.png`
+- `assets/splash/splash.png`
+- `assets/splash/splash-dark.png`
+- `assets/splash/android-splash-logo-white.png`
+- `assets/icons/logomark.svg`
+- `assets/icons/newskie.svg`
+- `assets/icons/verifiedCheck.svg`
+- `assets/icons/verifierCheck.svg`
+- `assets/icons/starterPack.svg`, `assets/icons/starterPack_stroke2_corner0_rounded.svg`
+- `bskyembed/assets/logo.svg`
+- `bskyembed/assets/logo_full_name.svg`
+- `bskyweb/static/favicon.png`, `favicon-16x16.png`, `favicon-32x32.png`
+- `bskyweb/static/apple-touch-icon.png`
+- `bskyweb/static/safari-pinned-tab.svg`
+- `bskyweb/static/social-card-default.png`, `bskyweb/static/social-card-default-gradient.png`
+- `bskyweb/embedr-static/favicon.png`, `favicon-16x16.png`, `favicon-32x32.png`
+- `modules/BlueskyClip/Images.xcassets/AppIcon.appiconset/`
+- Inline vector path data in `src/view/icons/Logo.tsx` and `src/view/icons/Logotype.tsx`
+
+We are not asking anyone to remove these files from the repository. They are here because the
+app needs them to build. Replacing them is a forker's responsibility, not ours.
+
+## 4. Community and contest artwork — credited, but not ours to license
+
+These are third-party artworks that appear in the app with attribution. We hold no license that
+lets us pass rights to them on to you.
+
+- `assets/kawaii.png`, `assets/kawaii_smol.png` — logo by
+  [@sawaratsuki.bsky.social](https://bsky.app/profile/sawaratsuki.bsky.social), shown as an
+  opt-in variant and credited in `src/view/shell/Drawer.tsx` and
+  `src/view/shell/desktop/RightNav.tsx`
+- `assets/icons/custom_logo_japan.svg` — the winning entry from the Bluesky Japan logo contest,
+  created by a contest entrant
+
+Replace these if you fork. If you want to use them, that is a conversation with the artist,
+not with us.
+
+## 5. Third-party trademarks
+
+These marks belong to other companies. We include them to identify their services in our UI —
+sign-in buttons, store badges, and links to third-party applications. We are neither granting
+nor withholding permission, because it is not ours to give. Your use of them rests on your own
+nominative-use basis or on permission from the mark owner.
+
+- `assets/icons/apple_logo.svg` — Apple Inc.
+- `assets/icons/android_logo.svg` — Google LLC
+- `assets/icons/community/` — Leaflet, Offprint, pckt (`pckt.svg`, `pckt-full.svg`),
+  Standard.site, and Germ Network (`germ_logo.webp`)
+
+Apple's and Google's marks in particular carry their own brand guidelines governing size,
+spacing, and permitted contexts. If you ship a sign-in button or a store badge, follow theirs,
+not ours.
+
+## 6. Third-party assets you may redistribute
+
+These are licensed on terms that permit redistribution. Nothing in this document restricts them.
+Their license text travels with the files, and you must keep it there.
+
+| Asset | Path | License | Notice |
+|---|---|---|---|
+| Inter typeface | `assets/fonts/inter/` | SIL Open Font License 1.1 | [`OFL.txt`](./assets/fonts/inter/OFL.txt) |
+| Inter typeface (OG card service) | `bskyogcard/src/assets/fonts/` | SIL Open Font License 1.1 | [`README.md`](./bskyogcard/src/assets/fonts/README.md) |
+| country-flag-icons | `assets/icons/flags/` | MIT, © @catamphetamine | [`README.md`](./assets/icons/flags/README.md) |
+| Material Icons | `bskyweb/static/media/MaterialIcons.*.ttf` | Apache License 2.0 | [`NOTICE.md`](./NOTICE.md) |
+
+Build output under `bskyweb/static/media/` also contains compiled Inter files. They are the same
+OFL-licensed typeface, emitted by the web build.
+
+**One thing to watch on Inter:** OFL 1.1 includes a Reserved Font Name provision. If you modify
+or subset the font, the result cannot be distributed under the name "Inter."
+
+See [`NOTICE.md`](./NOTICE.md) for the consolidated third-party notices.
+
+## 7. Product imagery — treat as not licensed to you
+
+**`assets/images/`**
+
+Product illustration and announcement imagery — onboarding value-prop art, chat backgrounds,
+feature announcement graphics, and similar.
+
+**Treat everything in this directory as outside the MIT license and not licensed for your use.**
+Some of it is commissioned work. Rather than have you guess file by file which is which, we are
+drawing the line at the directory.
+
+If you are forking, replace these or ship without them.
+See [`assets/images/README.md`](./assets/images/README.md).
+
+---
+
+## If you are forking
+
+You have our blessing to fork this application. To do it cleanly:
+
+1. **Replace `assets/illustrations/`.** Commissioned artwork, licensed to Bluesky only. See
+   [Section 1](#1-commissioned-artwork--licensed-to-bluesky-only).
+2. **Source your own UI icons.** The glyph set in `assets/icons/` is licensed to us for our own
+   use. See [Section 2](#2-licensed-icon-system--not-ours-to-pass-on).
+3. **Replace `assets/images/`.** Treat as not licensed to you. See
+   [Section 7](#7-product-imagery--treat-as-not-licensed-to-you).
+4. **Replace the Bluesky marks** listed in [Section 3](#3-bluesky-trademarks-and-brand-assets) —
+   app icons, favicons, logo files, and the inline logo paths in `src/view/icons/`.
+5. **Replace or remove the community artwork** in
+   [Section 4](#4-community-and-contest-artwork--credited-but-not-ours-to-license).
+6. **Check your own position on the third-party marks** in
+   [Section 5](#5-third-party-trademarks).
+7. **Keep the license notices** for the assets in
+   [Section 6](#6-third-party-assets-you-may-redistribute).
+8. **Change your branding, support links, and analytics** as described in the
+   [Forking guidelines](./README.md#forking-guidelines).
+
+This list is about licensing. The [Forking guidelines](./README.md#forking-guidelines) in the
+README cover the rest of what makes a fork clearly distinguishable from Bluesky, which matters
+both for your users and for app store review.
+
+## Questions
+
+If something in this repository looks like it should be on this list and is not, or if you are
+unsure whether an asset is covered, open an issue or email us and we will sort it out. We would
+much rather answer the question than have someone guess.
+
+---
+
+*Last reviewed: August 2026. This document describes the licensing position of assets in this
+repository. It is not a grant of rights, and it does not modify the [MIT license](./LICENSE) as
+it applies to source code.*

CLAUDE.md

@@ -1,4 +1,4 @@
-# CLAUDE.md - Bluesky Social App Development Guide
+# CLAUDE.md – Bluesky Social App Development Guide
 
 This document provides guidance for working effectively in the Bluesky Social app codebase.
 
@@ -7,35 +7,41 @@ This document provides guidance for working effectively in the Bluesky Social ap
 Bluesky Social is a cross-platform social media application built with React Native and Expo. It runs on iOS, Android, and Web, connecting to the AT Protocol (atproto) decentralized social network.
 
 **Tech Stack:**
+
+- React 19.1
 - React Native 0.81 with Expo 54
-- TypeScript
-- React Navigation for routing
+- TypeScript 7
+- React Navigation 7 for routing
 - TanStack Query (React Query) for data fetching
-- Lingui for internationalization
+- Lingui 5 for internationalization
 - Custom design system called ALF (Application Layout Framework)
 
+Prefer using the latest features available for each of these libraries (exact versions are found in `package.json`). For example, prefer `@lingui/react/macro` over `@lingui/react`. Suggest refactoring legacy or deprecated uses.
+
 ## Essential Commands
 
 ```bash
 # Development
-yarn start              # Start Expo dev server
-yarn web                # Start web version
-yarn android            # Run on Android
-yarn ios                # Run on iOS
+pnpm start              # Start Expo dev server
+pnpm web                # Start web version
+pnpm android            # Run on Android
+pnpm ios                # Run on iOS
 
 # Testing & Quality
-yarn test               # Run Jest tests
-yarn lint               # Run ESLint
-yarn typecheck          # Run TypeScript type checking
+# IMPORTANT: Always use these pnpm scripts, never call the underlying tools directly
+pnpm test               # Run Jest tests
+pnpm lint               # Run Oxlint
+pnpm typecheck          # Run TypeScript type checking
+pnpm prettier           # Run Prettier for code formatting
 
 # Internationalization
 # DO NOT run these commands - extraction and compilation are handled by CI
-yarn intl:extract       # Extract translation strings (nightly CI job)
-yarn intl:compile       # Compile translations for runtime (nightly CI job)
+pnpm intl:extract       # Extract translation strings (nightly CI job)
+pnpm intl:compile       # Compile translations for runtime (nightly CI job)
 
 # Build
-yarn build-web          # Build web version
-yarn prebuild           # Generate native projects
+pnpm build-web          # Build web version
+pnpm prebuild           # Generate native projects
 ```
 
 ## Project Structure
@@ -45,6 +51,7 @@ src/
 ├── alf/                    # Design system (ALF) - themes, atoms, tokens
 ├── components/             # Shared UI components (Button, Dialog, Menu, etc.)
 ├── screens/                # Full-page screen components (newer pattern)
+├── features/               # Macro-features that bridge components/screens
 ├── view/
 │   ├── screens/            # Full-page screens (legacy location)
 │   ├── com/                # Reusable view components
@@ -59,64 +66,148 @@ src/
 └── Navigation.tsx          # Main navigation configuration
 ```
 
+### Project Structure in Depth
+
+When building new things, follow these guidelines for where to put code.
+
+#### Components vs Screens vs Features
+
+**Components** are reusable UI elements that are not full screens. Should be
+platform-agnostic when possible. Examples: Button, Dialog, Menu, TextField. Put
+these in `/components` if they are shared across screens.
+
+**Screens** are full-page components that represent a route in the app. They
+often contain multiple components and handle layout for a page. New screens
+should go in `/screens` (not `/view/screens`) to encourage better organization
+and separation from legacy code.
+
+For complex screens that have specific components or data needs that _are not
+shared by other screens_, we encourage subdirectories within `/screens/<name>`
+e.g. `/screens/ProfileScreen/ProfileScreen.tsx` and
+`/screens/ProfileScreen/components/`.
+
+**Features** are higher-level modules that may include context, data fetching,
+components, and utilities related to a specific feature e.g.
+`/features/liveNow`. They don't neatly fit into components or screens and often
+span multiple screens. This is an optional pattern for organizing complex
+features.
+
+#### Legacy Directories
+
+For the most part, avoid writing new files into the `/view` directory and
+subdirectories. This is the older pattern for organizing screens and components,
+and it has become a bit disorganized over time. New development should go into
+`/screens`, `/components`, and `/features`.
+
+#### State
+
+The `/state` directory is where we've historically put all our data fetching and
+state management logic. This is perfectly fine, but for new features, consider
+organizing state logic closer to the components that use it, either within a
+feature directory or co-located with a screen. The key is to keep related code
+together and avoid having "god files" with too much unrelated logic.
+
+#### Lib
+
+The `/lib` directory is for utilities and helpers that don't fit into other
+categories. This can include things like API clients, formatting functions,
+constants, and other shared logic.
+
+#### Top Level Directories
+
+Avoid writing new top-level subdirectories within `/src`. We've done this for a
+few things in the past that, but we have stronger patterns now. Examples:
+`/logger` should probably have been written into `/lib`. And `ageAssurance` is
+better classified within `/features`. We will probably migrate these things
+eventually.
+
+### File and Directory Naming Conventions
+
+Typically JS style for variables, functions, etc. We use ProudCamelCase for
+components, and camelCase directories and files.
+
+For "macro" cases in `/features`, `/screens`, or `/components`, co-locate related
+code in a directory with an `index.tsx` main component plus sibling
+components/hooks/utils (e.g. `screens/ProfileScreen/index.tsx` +
+`screens/ProfileScreen/components/`). Keep related code together so it lives where
+someone would look for it. Don't overdo it: a component that fits in one file
+should just be `Component.tsx`, not `Component/index.tsx`.
+
+Platform-specific files are covered under "Platform-Specific Code" below.
+
+### Comments
+
+Comment code when necessary to explain the “why” behind something; avoid
+comments that simply describe the code. Avoid Unicode characters in comments,
+e.g., use `-` not `—`.
+
+Always use docblock (`/** */`) syntax for comments that document a type, type
+member, method, function, or variable. These are the comments a reader expects
+to find attached to a named declaration, and the docblock form makes that intent
+clear and surfaces nicely in editor tooltips.
+
+```tsx
+type DateFieldProps = {
+  /**
+   * An empty string renders the placeholder and opens the picker at today (or
+   * maximumDate, if earlier).
+   */
+  value: string | Date
+}
+
+/**
+ * Date-only input. Accepts a string in the format YYYY-MM-DD, or a Date object.
+ */
+export function DateField() {}
+```
+
+More generally, any multiline comment should use the `/* */` block syntax rather
+than stacked `//` lines. Reserve `//` for short, single-line comments.
+
+```tsx
+/*
+ * The picker requires a valid date, so when value is empty we fall back to
+ * maximumDate (if set) or today.
+ */
+const fallbackDate = maximumDate ? toSimpleDateString(maximumDate) : today
+```
+
+### Documentation and Tests Within Features
+
+For larger features or components, co-locate documentation and tests with the
+code. A `README.md` in the directory (the `/Component/index.tsx` pattern lends
+itself well to this) can document the whole feature, and feature-specific tests
+belong alongside it as `Component.test.tsx` or in a `__tests__/` subdirectory.
+Both are optional.
+
 ## Styling System (ALF)
 
-ALF is the custom design system. It uses Tailwind-inspired naming with underscores instead of hyphens.
+ALF is the custom design system. Tailwind-inspired naming with underscores
+instead of hyphens. Static atoms (`atoms as a`) are theme-independent; theme
+atoms/palette come from `useTheme()` (`t.atoms.bg`, `t.palette.primary_500`).
+Style props take an array of atoms + theme atoms + raw styles.
 
-### Basic Usage
+Order atoms by: flexbox (`a.flex_row`), spacing (`a.px_md`), text (`a.font_bold`),
+themes (`t.atoms.text`), then raw styles (`{backgroundColor: t.palette.primary_500}`).
 
 ```tsx
 import {atoms as a, useTheme} from '#/alf'
 
-function MyComponent() {
-  const t = useTheme()
-
-  return (
-    <View style={[a.flex_row, a.gap_md, a.p_lg, t.atoms.bg]}>
-      <Text style={[a.text_md, a.font_bold, t.atoms.text]}>
-        Hello
-      </Text>
-    </View>
-  )
-}
+const t = useTheme()
+<View style={[a.flex_row, a.gap_md, a.p_lg, t.atoms.bg]} />
 ```
 
 ### Key Concepts
 
-**Static Atoms** - Theme-independent styles imported from `atoms`:
-```tsx
-import {atoms as a} from '#/alf'
-// a.flex_row, a.p_md, a.gap_sm, a.rounded_md, a.text_lg, etc.
-```
+Static atoms live in `a.*` (e.g. `a.flex_row`, `a.p_md`, `a.rounded_md`,
+`a.text_lg`). Theme atoms/palette come from `useTheme()` (`t.atoms.bg`,
+`t.atoms.text`, `t.atoms.border_contrast_low`, `t.palette.primary_500`).
 
-**Theme Atoms** - Theme-dependent colors from `useTheme()`:
-```tsx
-const t = useTheme()
-// t.atoms.bg, t.atoms.text, t.atoms.border_contrast_low, etc.
-// t.palette.primary_500, t.palette.negative_400, etc.
-```
+**Platform utilities** (`import {web, native, ios, android, platform} from '#/alf'`)
+return conditional styles inline in a style array: `web({cursor: 'pointer'})`,
+`native({paddingBottom: 20})`, `platform({ios: {...}, android: {...}, web: {...}})`.
 
-**Platform Utilities** - For platform-specific styles:
-```tsx
-import {web, native, ios, android, platform} from '#/alf'
-
-const styles = [
-  a.p_md,
-  web({cursor: 'pointer'}),
-  native({paddingBottom: 20}),
-  platform({ios: {...}, android: {...}, web: {...}}),
-]
-```
-
-**Breakpoints** - Responsive design:
-```tsx
-import {useBreakpoints} from '#/alf'
-
-const {gtPhone, gtMobile, gtTablet} = useBreakpoints()
-if (gtMobile) {
-  // Tablet or desktop layout
-}
-```
+**Breakpoints:** `const {gtPhone, gtMobile, gtTablet} = useBreakpoints()` from `#/alf`.
 
 ### Naming Conventions
 
@@ -128,336 +219,200 @@ if (gtMobile) {
 
 ## Component Patterns
 
-### Dialog Component
-
-Dialogs use a bottom sheet on native and a modal on web. Use `useDialogControl()` hook to manage state.
+- Prefer fragment shorthand over `Fragment` unless a `key` is needed.
+- Prefer functions over arrow functions for component declarations.
+- Prefer prop destructuring via parameters over a const within the component.
+- Prefer inline types over `Props` types or interfaces.
+- Set reasonable defaults for optional props.
+- Prefer the implicit global `React` for types over `type` imports.
 
 ```tsx
-import * as Dialog from '#/components/Dialog'
+import {Fragment} from 'react'
+import {View} from 'react-native'
+import {Trans} from '@lingui/react/macro'
 
-function MyFeature() {
-  const control = Dialog.useDialogControl()
+import {Text} from '#/components/Typography'
 
+function MyComponent({
+  items = [],
+  children,
+}: {
+  items?: string[]
+  children: React.ReactNode
+}) {
   return (
     <>
-      <Button label="Open" onPress={control.open}>
-        <ButtonText>Open Dialog</ButtonText>
-      </Button>
-
-      <Dialog.Outer control={control}>
-        {/* Typically the inner part is in its own component */}
-        <Dialog.Handle />  {/* Native-only drag handle */}
-        <Dialog.ScrollableInner label={_(msg`My Dialog`)}>
-          <Dialog.Header>
-            <Dialog.HeaderText>Title</Dialog.HeaderText>
-          </Dialog.Header>
-
-          <Text>Dialog content here</Text>
-
-          <Button label="Done" onPress={() => control.close()}>
-            <ButtonText>Done</ButtonText>
-          </Button>
-          <Dialog.Close /> {/* Web-only X button in top left */}
-        </Dialog.ScrollableInner>
-      </Dialog.Outer>
+      <View>
+        <Text>
+          <Trans>Example</Trans>
+        </Text>
+      </View>
+      <View>
+        {items.map((item, index) => (
+          <Fragment key={item}>
+            <Text>{index}</Text>
+            <Text>{item}</Text>
+          </Fragment>
+        ))}
+        {children}
+      </View>
     </>
   )
 }
 ```
 
+### Dialog Component
+
+Lives in `#/components/Dialog`. Bottom sheet on native, modal on web. Manage
+state with `useDialogControl()`. `Dialog.Handle` renders native-only, `Dialog.Close`
+web-only. CRITICAL: run any post-close action inside the `control.close(() => ...)`
+callback (see Footguns). Compound-component usage; canonical example in any dialog
+under `#/components`.
+
 ### Menu Component
 
-Menus render as a dropdown on web and a bottom sheet dialog on native.
-
-```tsx
-import * as Menu from '#/components/Menu'
-
-function MyMenu() {
-  return (
-    <Menu.Root>
-      <Menu.Trigger label="Open menu">
-        {({props}) => (
-          <Button {...props} label="Menu">
-            <ButtonIcon icon={DotsHorizontal} />
-          </Button>
-        )}
-      </Menu.Trigger>
-
-      <Menu.Outer>
-        <Menu.Group>
-          <Menu.Item label="Edit" onPress={handleEdit}>
-            <Menu.ItemIcon icon={Pencil} />
-            <Menu.ItemText>Edit</Menu.ItemText>
-          </Menu.Item>
-          <Menu.Item label="Delete" onPress={handleDelete}>
-            <Menu.ItemIcon icon={Trash} />
-            <Menu.ItemText>Delete</Menu.ItemText>
-          </Menu.Item>
-        </Menu.Group>
-      </Menu.Outer>
-    </Menu.Root>
-  )
-}
-```
+Lives in `#/components/Menu`. Dropdown on web, bottom sheet dialog on native.
+`Menu.Divider` is web-only, `Menu.ContainerItem` native-only. Compound API
+(`Menu.Root` / `Menu.Trigger` / `Menu.Outer` / `Menu.Group` / `Menu.Item`); grep
+existing usages across the app for a canonical example.
 
 ### Button Component
 
-```tsx
-import {Button, ButtonText, ButtonIcon} from '#/components/Button'
+`import {Button, ButtonText, ButtonIcon} from '#/components/Button'`. Props:
 
-// Solid primary button (most common)
-<Button label="Save" onPress={handleSave} color="primary" size="large">
-  <ButtonText>Save</ButtonText>
-</Button>
-
-// With icon
-<Button label="Share" onPress={handleShare} color="secondary" size="small">
-  <ButtonIcon icon={Share} />
-  <ButtonText>Share</ButtonText>
-</Button>
-
-// Icon-only button
-<Button label="Close" onPress={handleClose} color="secondary" size="small" shape="round">
-  <ButtonIcon icon={XIcon} />
-</Button>
-
-// Ghost variant (deprecated - use color prop)
-<Button label="Cancel" variant="ghost" color="secondary" size="small">
-  <ButtonText>Cancel</ButtonText>
-</Button>
-```
-
-**Button Props:**
 - `color`: `'primary'` | `'secondary'` | `'negative'` | `'primary_subtle'` | `'negative_subtle'` | `'secondary_inverted'`
 - `size`: `'tiny'` | `'small'` | `'large'`
 - `shape`: `'default'` (pill) | `'round'` | `'square'` | `'rectangular'`
-- `variant`: `'solid'` | `'outline'` | `'ghost'` (deprecated, use `color`)
-
-### Typography
-
-```tsx
-import {Text, H1, H2, P} from '#/components/Typography'
-
-<H1 style={[a.text_xl, a.font_bold]}>Heading</H1>
-<P>Paragraph text with default styling.</P>
-<Text style={[a.text_sm, t.atoms.text_contrast_medium]}>Custom text</Text>
-
-// For text with emoji, add the emoji prop
-<Text emoji>Hello! 👋</Text>
-```
+- `variant`: `'solid'` | `'outline'` | `'ghost'` (deprecated, prefer `color`)
 
 ### TextField
 
-```tsx
-import * as TextField from '#/components/forms/TextField'
+Compound component at `#/components/forms/TextField` (`TextField.LabelText`,
+`TextField.Root`, `TextField.Icon`, `TextField.Input`). Prefer `defaultValue` over
+`value` (see Footguns).
 
-<TextField.LabelText>Email</TextField.LabelText>
-<TextField.Root>
-  <TextField.Icon icon={AtSign} />
-  <TextField.Input
-    label="Email address"
-    placeholder="you@example.com"
-    defaultValue={email}
-    onChangeText={setEmail}
-    keyboardType="email-address"
-    autoCapitalize="none"
-  />
-</TextField.Root>
-```
+### Typography
+
+`import {Text, H1, H2, P} from '#/components/Typography'`. The `Text` default style
+is `[a.text_sm, a.leading_snug, t.atoms.text]`. Pass the `emoji` prop to any `Text`
+that may contain emoji - user-generated text (display names etc.) almost always
+does, so only omit it for static, emoji-free strings: `<Text emoji>Hello!</Text>`.
 
 ## Internationalization (i18n)
 
-All user-facing strings must be wrapped for translation using Lingui.
+All user-facing strings must be wrapped for translation using Lingui. Include `comment` and/or `context` props when necessary to avoid ambiguity, e.g., “Post” as a noun vs a verb.
+
+Prefer using `t` via `import {useLingui} '@lingui/react/macro'` vs `_` via `import {useLingui} from '@lingui/react'`. Alias `t` to `l` to avoid collisions with `const t = useTheme()`. Refactor existing uses of ``_(msg`foo`)`` to use `` l`foo` ``.
+
+Prefer Unicode punctuation over keyboard punctuation, e.g., `“quote”` over `"quote"`. Prefer en dashes preceded by a non-breaking space over em dashes, e.g., `one – two` over `one—two`.
 
 ```tsx
-import {msg, Trans, plural} from '@lingui/macro'
-import {useLingui} from '@lingui/react'
+import {plural} from '@lingui/core/macro'
+import {Trans, useLingui} from '@lingui/react/macro'
 
 function MyComponent() {
-  const {_} = useLingui()
+  const {t: l} = useLingui()
 
-  // Simple strings - use msg() with _() function
-  const title = _(msg`Settings`)
-  const errorMessage = _(msg`Something went wrong`)
+  // Simple strings - use the l macro
+  const title = l`Settings`
+  const errorMessage = l({
+    message: 'Something went wrong',
+    comment: 'Generic error message for unknown/unhandled errors.',
+    context: 'Toast',
+  })
 
   // Strings with variables
-  const greeting = _(msg`Hello, ${name}!`)
+  const greeting = l`Hello, ${name}!`
 
   // Pluralization
-  const countLabel = _(plural(count, {
+  const countLabel = plural(count, {
     one: '# item',
     other: '# items',
-  }))
+  })
 
   // JSX content - use Trans component
   return (
     <Text>
-      <Trans>Welcome to <Text style={a.font_bold}>Bluesky</Text></Trans>
+      <Trans>
+        Welcome to <Text style={a.font_bold}>Bluesky</Text>, {name}!
+      </Trans>
     </Text>
   )
 }
 ```
 
+Prefer `i18n.date` for date and time formatting. This ensures formatting is re-applied when the language changes at runtime. Refactor existing uses of `Intl.DateTimeFormat` to use `i18n.date`.
+
+```tsx
+import {useLingui} from '@lingui/react/macro'
+
+function MyComponent() {
+  const {i18n} = useLingui()
+
+  const createdAt = new Date()
+
+  return i18n.date(createdAt, {
+    dateStyle: 'medium',
+    timeStyle: 'medium',
+  })
+}
+```
+
 **Commands:**
+
 ```bash
 # DO NOT run these commands - extraction and compilation are handled by a nightly CI job
-yarn intl:extract    # Extract new strings to locale files
-yarn intl:compile    # Compile translations for runtime
+pnpm intl:extract    # Extract new strings to locale files
+pnpm intl:compile    # Compile translations for runtime
 ```
 
 ## State Management
 
 ### TanStack Query (Data Fetching)
 
-```tsx
-// src/state/queries/profile.ts
-import {useQuery, useMutation, useQueryClient} from '@tanstack/react-query'
+Follow the established pattern in `src/state/queries/`; `src/state/queries/feed.ts`
+is a good canonical reference (it uses `createQueryKey`, matching key roots,
+`useInfiniteQuery`, and `persistedVersion`).
 
-// Query key pattern
-const RQKEY_ROOT = 'profile'
-export const RQKEY = (did: string) => [RQKEY_ROOT, did]
-
-// Query hook
-export function useProfileQuery({did}: {did: string}) {
-  const agent = useAgent()
-
-  return useQuery({
-    queryKey: RQKEY(did),
-    queryFn: async () => {
-      const res = await agent.getProfile({actor: did})
-      return res.data
-    },
-    staleTime: STALE.MINUTES.FIVE,
-    enabled: !!did,
-  })
-}
-
-// Mutation hook
-export function useUpdateProfile() {
-  const queryClient = useQueryClient()
-
-  return useMutation({
-    mutationFn: async (data) => {
-      // Update logic
-    },
-    onSuccess: (_, variables) => {
-      queryClient.invalidateQueries({queryKey: RQKEY(variables.did)})
-    },
-    onError: (error) => {
-      if (isNetworkError(error)) {
-        // don't log, but inform user
-      } else if (error instanceof AppBskyExampleProcedure.ExampleError) {
-        // XRPC APIs often have typed errors, allows nicer handling
-      } else {
-        // Log unexpected errors to Sentry
-        logger.error('Error updating profile', {safeMessage: error})
-      }
-    }
-  })
-}
-```
-
-**Stale Time Constants** (from `src/state/queries/index.ts`):
-```tsx
-STALE.SECONDS.FIFTEEN  // 15 seconds
-STALE.MINUTES.ONE      // 1 minute
-STALE.MINUTES.FIVE     // 5 minutes
-STALE.HOURS.ONE        // 1 hour
-STALE.INFINITY         // Never stale
-```
-
-**Paginated APIs:** Many atproto APIs return paginated results with a `cursor`. Use `useInfiniteQuery` for these:
-
-```tsx
-export function useDraftsQuery() {
-  const agent = useAgent()
-
-  return useInfiniteQuery({
-    queryKey: ['drafts'],
-    queryFn: async ({pageParam}) => {
-      const res = await agent.app.bsky.draft.getDrafts({cursor: pageParam})
-      return res.data
-    },
-    initialPageParam: undefined as string | undefined,
-    getNextPageParam: page => page.cursor,
-  })
-}
-```
-
-To get all items from pages: `data?.pages.flatMap(page => page.items) ?? []`
+- Build query keys with `createQueryKey(root, args)` (from `#/state/queries/util`)
+  using an object for `args`. The key root variable should match the hook name.
+- Naming conventions: `use[Name]Query` for queries, `use[Name]Mutation` for
+  mutations, `use[Name]CacheMutation` for helpers that mutate cached data directly.
+- Stale times come from `STALE` in `src/state/queries/index.ts`: `STALE.SECONDS.FIFTEEN`,
+  `STALE.MINUTES.ONE`, `STALE.MINUTES.FIVE`, `STALE.HOURS.ONE`, `STALE.INFINITY`.
+- Paginated atproto APIs (those returning a `cursor`) use `useInfiniteQuery` with
+  `getNextPageParam: page => page.cursor`; flatten results with
+  `data?.pages.flatMap(page => page.items) ?? []`.
+- Persist a query across restarts by passing options:
+  `createQueryKey(root, args, {persistedVersion: n})`. Bumping `n` clears the old
+  persisted data and refetches - do this whenever the data shape changes.
+- Error handling in mutations: don't log network errors (just inform the user),
+  handle typed XRPC errors specifically (e.g. `err instanceof SomeNsid.SomeError`),
+  and send unexpected errors to `logger.error('...', {safeMessage: error})`.
 
 ### Preferences (React Context)
 
-```tsx
-// Simple boolean preference pattern
-import {useAutoplayDisabled, useSetAutoplayDisabled} from '#/state/preferences'
-
-function SettingsScreen() {
-  const autoplayDisabled = useAutoplayDisabled()
-  const setAutoplayDisabled = useSetAutoplayDisabled()
-
-  return (
-    <Toggle
-      value={autoplayDisabled}
-      onValueChange={setAutoplayDisabled}
-    />
-  )
-}
-```
+Boolean/simple UI preferences are exposed as paired hooks from `#/state/preferences`,
+e.g. `useAutoplayDisabled()` / `useSetAutoplayDisabled()`.
 
 ### Session State
 
-```tsx
-import {useSession, useAgent} from '#/state/session'
-
-function MyComponent() {
-  const {hasSession, currentAccount} = useSession()
-  const agent = useAgent()
-
-  if (!hasSession) {
-    return <LoginPrompt />
-  }
-
-  // Use agent for API calls
-  const response = await agent.getProfile({actor: currentAccount.did})
-}
-```
+`import {useSession, useAgent} from '#/state/session'`. `useSession()` gives
+`hasSession` and `currentAccount`; `useAgent()` gives the atproto agent for API calls.
 
 ## Navigation
 
-Navigation uses React Navigation with type-safe route parameters.
-
-```tsx
-// Screen component
-import {type NativeStackScreenProps} from '@react-navigation/native-stack'
-import {type CommonNavigatorParams} from '#/lib/routes/types'
-
-type Props = NativeStackScreenProps<CommonNavigatorParams, 'Profile'>
-
-export function ProfileScreen({route, navigation}: Props) {
-  const {name} = route.params  // Type-safe params
-
-  return (
-    <Layout.Screen>
-      {/* Screen content */}
-    </Layout.Screen>
-  )
-}
-
-// Programmatic navigation
-import {useNavigation} from '@react-navigation/native'
-
-const navigation = useNavigation()
-navigation.navigate('Profile', {name: 'alice.bsky.social'})
-
-// Or use the navigate helper
-import {navigate} from '#/Navigation'
-navigate('Profile', {name: 'alice.bsky.social'})
-```
+React Navigation with type-safe route params. Type a screen with
+`NativeStackScreenProps<CommonNavigatorParams, 'X'>` (`route`/`navigation` come
+from props; params via `route.params`). Navigate programmatically with
+`useNavigation()`, or the `navigate` helper from `#/Navigation`. Config lives in
+`src/Navigation.tsx`, routes in `src/routes.ts`, types in `src/lib/routes/types.ts`.
 
 ## Platform-Specific Code
 
-Use file extensions for platform-specific implementations:
+Use file extensions for platform-specific implementations. The bundler resolves
+them automatically - just import the base path normally, never a conditional
+`require()`.
 
 ```
 Component.tsx          # Shared/default
@@ -467,11 +422,11 @@ Component.ios.tsx      # iOS-only
 Component.android.tsx  # Android-only
 ```
 
-Example from Dialog:
-- `src/components/Dialog/index.tsx` - Native (uses BottomSheet)
-- `src/components/Dialog/index.web.tsx` - Web (uses modal with Radix primitives)
-
-**Important:** The bundler automatically resolves platform-specific files. Just import normally:
+Prefer grouping variants into a `Component/` directory (`index.tsx`,
+`index.web.tsx`, `index.native.tsx`) rather than sibling `Component.web.tsx` files,
+so the shared surface reads as one "macro" module (e.g. `src/components/Dialog/index.tsx`
+native vs `index.web.tsx` web). The app has both patterns; the directory form is
+preferred for new code.
 
 ```tsx
 // CORRECT - bundler picks storage.ts or storage.web.ts automatically
@@ -483,14 +438,7 @@ const storage = IS_NATIVE
   : require('#/state/drafts/storage.web')
 ```
 
-Platform detection (for runtime logic, not imports):
-```tsx
-import {IS_WEB, IS_NATIVE, IS_IOS, IS_ANDROID} from '#/env'
-
-if (IS_NATIVE) {
-  // Native-specific logic
-}
-```
+Runtime platform detection (not for imports): `import {IS_WEB, IS_NATIVE, IS_IOS, IS_ANDROID} from '#/env'`.
 
 ## Import Aliases
 
@@ -518,13 +466,13 @@ Common pitfalls to avoid in this codebase:
 // WRONG - causes bugs with state updates, navigation, opening other dialogs
 const onConfirm = () => {
   control.close()
-  navigation.navigate('Home')  // May race with dialog animation
+  navigation.navigate('Home') // May race with dialog animation
 }
 
 // WRONG - same problem
 const onConfirm = () => {
   control.close()
-  otherDialogControl.open()  // Will likely fail or cause visual glitches
+  otherDialogControl.open() // Will likely fail or cause visual glitches
 }
 
 // CORRECT - action runs after dialog fully closes
@@ -551,12 +499,13 @@ const onConfirm = () => {
 ```
 
 This applies to:
+
 - Navigation (`navigation.navigate()`, `navigation.push()`)
 - Opening other dialogs or menus
 - State updates that affect UI (`setState`, `queryClient.invalidateQueries`)
 - Callbacks passed from parent components
 
-The Menu component on iOS specifically uses this pattern - see `src/components/Menu/index.tsx:151`.
+The Menu component on iOS specifically uses this pattern – see `src/components/Menu/index.tsx:151`.
 
 ### Controlled vs Uncontrolled Inputs
 
@@ -579,10 +528,11 @@ Prefer `defaultValue` over `value` for TextInput on the old architecture:
 ### Platform-Specific Behavior
 
 Some components behave differently across platforms:
-- `Dialog.Handle` - Only renders on native (drag handle for bottom sheet)
-- `Dialog.Close` - Only renders on web (X button)
-- `Menu.Divider` - Only renders on web
-- `Menu.ContainerItem` - Only works on native
+
+- `Dialog.Handle` – Only renders on native (drag handle for bottom sheet)
+- `Dialog.Close` – Only renders on web (X button)
+- `Menu.Divider` – Only renders on web
+- `Menu.ContainerItem` – Only works on native
 
 Always test on multiple platforms when using these components.
 
@@ -603,6 +553,7 @@ const handlePress = () => {
 ```
 
 Only use `useMemo`/`useCallback` when you have a specific reason, such as:
+
 - The value is immediately used in an effect's dependency array
 - You're passing a callback to a non-React library that needs referential stability
 
@@ -610,7 +561,7 @@ Only use `useMemo`/`useCallback` when you have a specific reason, such as:
 
 1. **Accessibility**: Always provide `label` prop for interactive elements, use `accessibilityHint` where helpful
 
-2. **Translations**: Wrap ALL user-facing strings with `msg()` or `<Trans>`
+2. **Translations**: Wrap ALL user-facing strings with ` `l` `` or `<Trans>`
 
 3. **Styling**: Combine static atoms with theme atoms, use platform utilities for platform-specific styles
 
@@ -624,14 +575,14 @@ Only use `useMemo`/`useCallback` when you have a specific reason, such as:
 
 ## Key Files Reference
 
-| Purpose | Location |
-|---------|----------|
-| Theme definitions | `src/alf/themes.ts` |
-| Design tokens | `src/alf/tokens.ts` |
-| Static atoms | `src/alf/atoms.ts` (extends `@bsky.app/alf`) |
-| Navigation config | `src/Navigation.tsx` |
-| Route definitions | `src/routes.ts` |
-| Route types | `src/lib/routes/types.ts` |
-| Query hooks | `src/state/queries/*.ts` |
-| Session state | `src/state/session/index.tsx` |
-| i18n setup | `src/locale/i18n.ts` |
+| Purpose           | Location                                     |
+| ----------------- | -------------------------------------------- |
+| Theme definitions | `src/alf/themes.ts`                          |
+| Design tokens     | `src/alf/tokens.ts`                          |
+| Static atoms      | `src/alf/atoms.ts` (extends `@bsky.app/alf`) |
+| Navigation config | `src/Navigation.tsx`                         |
+| Route definitions | `src/routes.ts`                              |
+| Route types       | `src/lib/routes/types.ts`                    |
+| Query hooks       | `src/state/queries/*.ts`                     |
+| Session state     | `src/state/session/index.tsx`                |
+| i18n setup        | `src/locale/i18n.ts`                         |

Dockerfile

@@ -1,23 +1,21 @@
-FROM golang:1.25-bookworm AS build-env
+#
+# Stage 1: build the web bundle with pnpm.
+#
+# Uses the official pnpm image. Node is auto-downloaded by pnpm using the
+# `devEngines.runtime` field in package.json (onFail: "download").
+#
+FROM ghcr.io/pnpm/pnpm:11 AS web-build
 
-WORKDIR /usr/src/social-app
+WORKDIR /app
 
 ENV DEBIAN_FRONTEND=noninteractive
 
 #
-# Node
+# pnpm config
 #
-ENV NODE_VERSION=20
-ENV NVM_DIR=/usr/share/nvm
-
-#
-# Go
-#
-ENV GODEBUG="netdns=go"
-ENV GOOS="linux"
-ENV GOARCH="amd64"
-ENV CGO_ENABLED=1
-ENV GOEXPERIMENT="loopvar"
+ENV CI=1
+# use the pnpm version specified in package.json
+ENV pnpm_config_pm_on_fail=download
 
 # The latest git hash of the preview branch on render.com
 # https://render.com/docs/docker-secrets#environment-variables-in-docker-builds
@@ -42,41 +40,48 @@ ENV SENTRY_AUTH_TOKEN=${SENTRY_AUTH_TOKEN:-unknown}
 ARG EXPO_PUBLIC_SENTRY_DSN
 ENV EXPO_PUBLIC_SENTRY_DSN=$EXPO_PUBLIC_SENTRY_DSN
 
-#
-# Copy everything into the container
-#
 COPY . .
 
-#
-# Generate the JavaScript webpack.
-#
-RUN mkdir --parents $NVM_DIR && \
-  wget \
-    --output-document=/tmp/nvm-install.sh \
-    https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh && \
-  bash /tmp/nvm-install.sh
-
-RUN \. "$NVM_DIR/nvm.sh" && \
-  nvm install $NODE_VERSION && \
-  nvm use $NODE_VERSION && \
-  echo "Using bundle identifier: $EXPO_PUBLIC_BUNDLE_IDENTIFIER" && \
+RUN echo "Using bundle identifier: $EXPO_PUBLIC_BUNDLE_IDENTIFIER" && \
   echo "EXPO_PUBLIC_ENV=$EXPO_PUBLIC_ENV" >> .env && \
   echo "EXPO_PUBLIC_RELEASE_VERSION=$EXPO_PUBLIC_RELEASE_VERSION" >> .env && \
   echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$EXPO_PUBLIC_BUNDLE_IDENTIFIER" >> .env && \
   echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env && \
-  echo "EXPO_PUBLIC_SENTRY_DSN=$EXPO_PUBLIC_SENTRY_DSN" >> .env && \
-  npm install --global yarn && \
-  yarn && \
-  yarn intl:build 2>&1 | tee i18n.log && \
-  if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compile errors!\n\n"; fi && \
-  SENTRY_AUTH_TOKEN=$SENTRY_AUTH_TOKEN SENTRY_RELEASE=$EXPO_PUBLIC_RELEASE_VERSION SENTRY_DIST=$EXPO_PUBLIC_BUNDLE_IDENTIFIER yarn build-web
+  echo "EXPO_PUBLIC_SENTRY_DSN=$EXPO_PUBLIC_SENTRY_DSN" >> .env
+
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm install --frozen-lockfile
+
+RUN pnpm intl:build 2>&1 | tee i18n.log && \
+  if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compile errors!\n\n"; fi
+
+RUN SENTRY_AUTH_TOKEN=$SENTRY_AUTH_TOKEN \
+    SENTRY_RELEASE=$EXPO_PUBLIC_RELEASE_VERSION \
+    SENTRY_DIST=$EXPO_PUBLIC_BUNDLE_IDENTIFIER \
+    pnpm build-web
+
+#
+# Stage 2: build the bskyweb Go binary, embedding the assets from stage 1.
+#
+# post-web-build.js (run by `pnpm build-web`) writes the bundled JS/CSS/media
+# into bskyweb/static/* and regenerates bskyweb/templates/scripts.html, so
+# copying the bskyweb/ tree from stage 1 is enough for go:embed to find
+# everything.
+#
+FROM golang:1.26-bookworm AS go-build
+
+WORKDIR /usr/src/social-app
+
+ENV GODEBUG="netdns=go"
+ENV GOOS="linux"
+ENV GOARCH="amd64"
+ENV CGO_ENABLED=1
+ENV GOEXPERIMENT="loopvar"
+
+COPY --from=web-build /app/bskyweb ./bskyweb
 
 # DEBUG
-RUN find ./bskyweb/static && find ./web-build/static
+RUN find ./bskyweb/static
 
-#
-# Generate the bskyweb Go binary.
-#
 RUN cd bskyweb/ && \
   go mod download && \
   go mod verify
@@ -89,6 +94,9 @@ RUN cd bskyweb/ && \
     -o /bskyweb \
     ./cmd/bskyweb
 
+#
+# Stage 3: runtime image.
+#
 FROM debian:bookworm-slim
 
 ENV GODEBUG=netdns=go
@@ -102,7 +110,7 @@ RUN apt-get update && apt-get install --yes \
 ENTRYPOINT ["dumb-init", "--"]
 
 WORKDIR /bskyweb
-COPY --from=build-env /bskyweb /usr/bin/bskyweb
+COPY --from=go-build /bskyweb /usr/bin/bskyweb
 
 CMD ["/usr/bin/bskyweb"]
 

Dockerfile.bskylink

@@ -1,4 +1,4 @@
-FROM node:20.11-alpine3.18 as build
+FROM node:24.18.0-alpine3.23 AS build
 
 # Move files into the image and install
 WORKDIR /app
@@ -14,7 +14,7 @@ RUN yarn build
 RUN yarn install --production --ignore-scripts --prefer-offline
 
 # Uses assets from build stage to reduce build size
-FROM node:20.11-alpine3.18
+FROM node:24.18.0-alpine3.23
 
 RUN apk add --update dumb-init
 
@@ -29,8 +29,6 @@ VOLUME /app/data
 EXPOSE 3000
 ENV LINK_PORT=3000
 ENV NODE_ENV=production
-# potential perf issues w/ io_uring on this version of node
-ENV UV_USE_IO_URING=0
 
 # https://github.com/nodejs/docker-node/blob/master/docs/BestPractices.md#non-root-user
 USER node

Dockerfile.bskyogcard

@@ -1,20 +1,25 @@
-FROM node:20.11-alpine3.18 as build
+FROM node:24.18.0-alpine3.23 AS build
+
+# Tells pnpm to run non-interactively (needed for install/script steps)
+ENV CI=true
 
 # Move files into the image and install
 WORKDIR /app
 
 COPY ./bskyogcard/package.json ./
-COPY ./bskyogcard/yarn.lock ./
-RUN yarn install --frozen-lockfile
+COPY ./bskyogcard/pnpm-lock.yaml ./
+COPY ./bskyogcard/pnpm-workspace.yaml ./
+RUN npm install --global pnpm@11.21.0
+RUN pnpm install --frozen-lockfile
 
 COPY ./bskyogcard ./
 
 # build then prune dev deps
-RUN yarn install-fonts && yarn build
-RUN yarn install --production --ignore-scripts --prefer-offline
+RUN pnpm install-fonts && pnpm build
+RUN pnpm install --prod --ignore-scripts --prefer-offline
 
 # Uses assets from build stage to reduce build size
-FROM node:20.11-alpine3.18
+FROM node:24.18.0-alpine3.23
 
 RUN apk add --update dumb-init
 
@@ -30,8 +35,6 @@ EXPOSE 3000 3001
 ENV CARD_PORT=3000
 ENV CARD_METRICS_PORT=3001
 ENV NODE_ENV=production
-# potential perf issues w/ io_uring on this version of node
-ENV UV_USE_IO_URING=0
 
 # https://github.com/nodejs/docker-node/blob/master/docs/BestPractices.md#non-root-user
 USER node

Dockerfile.embedr

@@ -1,20 +1,24 @@
-FROM golang:1.25-bookworm AS build-env
+FROM golang:1.26-bookworm AS build-env
 
 WORKDIR /usr/src/social-app
 
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Node
-ENV NODE_VERSION=20
+ENV NODE_VERSION=24.18.0
 ENV NVM_DIR=/usr/share/nvm
 
 # Go
 ENV GODEBUG="netdns=go"
 ENV GOOS="linux"
-ENV GOARCH="amd64"
+ARG TARGETARCH
+ENV GOARCH=${TARGETARCH:-amd64}
 ENV CGO_ENABLED=1
 ENV GOEXPERIMENT="loopvar"
 
+# CI environment for pnpm
+ENV CI=true
+
 COPY . .
 
 #
@@ -29,11 +33,11 @@ RUN mkdir --parents $NVM_DIR && \
 RUN \. "$NVM_DIR/nvm.sh" && \
   nvm install $NODE_VERSION && \
   nvm use $NODE_VERSION && \
-  npm install --global yarn && \
-  yarn && \
-  cd bskyembed && yarn install --frozen-lockfile && cd .. && \
-  yarn intl:build && \
-  yarn build-embed
+  npm install --global pnpm@11.21.0 && \
+  pnpm install --frozen-lockfile && \
+  cd bskyembed && pnpm install --frozen-lockfile && cd .. && \
+  pnpm intl:build && \
+  pnpm build-embed
 
 # DEBUG
 RUN find ./bskyweb/embedr-static && find ./bskyweb/embedr-templates && find ./bskyembed/dist

Makefile

@@ -10,33 +10,33 @@ help: ## Print info about all commands
 
 .PHONY: build-web
 build-web: ## Compile web bundle, copy to bskyweb directory
-	yarn intl:build
-	yarn build-web
+	pnpm intl:build
+	pnpm build-web
 
 .PHONY: build-web-embed
 build-web-embed: ## Compile web embed bundle, copy to bskyweb/embedr* directories
-	yarn intl:build
-	yarn build-embed
+	pnpm intl:build
+	pnpm build-embed
 
 .PHONY: test
 test: ## Run all tests
-	NODE_ENV=test yarn test
+	NODE_ENV=test pnpm test
 
 .PHONY: lint
 lint: ## Run style checks and verify syntax
-	yarn run lint
+	pnpm run lint
 
 #.PHONY: fmt
 #fmt: ## Run syntax re-formatting
-#	yarn prettier
+#	pnpm prettier
 
 .PHONY: deps
-deps: ## Installs dependent libs using 'yarn install'
-	yarn install --frozen-lockfile
+deps: ## Installs dependent libs using 'pnpm install'
+	pnpm install --frozen-lockfile
 	cd bskyembed && yarn install --frozen-lockfile
 
 .PHONY: nvm-setup
-nvm-setup: ## Use NVM to install and activate node+yarn
+nvm-setup: ## Use NVM to install and activate node+pnpm
 	nvm install 20
 	nvm use 20
-	npm install --global yarn
+	npm install --global pnpm

NOTICE.md

@@ -0,0 +1,62 @@
+# Third-party notices
+
+This file collects the attribution and license notices that third-party components in this
+repository require us to carry. It is separate from [`ASSETS.md`](./ASSETS.md), which describes
+which assets our [MIT license](./LICENSE) does and does not cover.
+
+If you distribute this software or a fork of it, these notices need to travel with it.
+
+---
+
+## Material Icons
+
+**Path:** `bskyweb/static/media/MaterialIcons.*.ttf`
+**License:** Apache License, Version 2.0 — full text at [`licenses/APACHE-2.0.txt`](./licenses/APACHE-2.0.txt)
+
+```
+Copyright 2018 Google, Inc. All Rights Reserved.
+```
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+in compliance with the License. You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed under the License
+is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+or implied. See the License for the specific language governing permissions and limitations under
+the License.
+
+*This font is emitted into the web build by `@expo/vector-icons`, which the Expo toolchain pulls
+in transitively. It is a distributed artifact rather than a source asset, which is why the notice
+lives here rather than beside the file.*
+
+## Inter
+
+**Paths:** `assets/fonts/inter/`, `bskyogcard/src/assets/fonts/`, and compiled copies under
+`bskyweb/static/media/`
+**License:** SIL Open Font License, Version 1.1 — full text at
+[`assets/fonts/inter/OFL.txt`](./assets/fonts/inter/OFL.txt)
+
+```
+Copyright (c) 2016 The Inter Project Authors (https://github.com/rsms/inter)
+```
+
+Inter is licensed under the SIL Open Font License, Version 1.1. The license includes a Reserved
+Font Name provision: a modified or subsetted version of the font may not be distributed under the
+name "Inter."
+
+## country-flag-icons
+
+**Path:** `assets/icons/flags/`
+**License:** MIT — see [`assets/icons/flags/README.md`](./assets/icons/flags/README.md)
+
+```
+Copyright (c) 2020 @catamphetamine <purecatamphetamine@gmail.com>
+```
+
+---
+
+For the licensing position of assets that are **not** covered by our MIT license — commissioned
+artwork, the licensed icon system, Bluesky trademarks, and third-party marks — see
+[`ASSETS.md`](./ASSETS.md).

README.md

@@ -57,6 +57,15 @@ Please be sure to:
 - Change all branding in the repository and UI to clearly differentiate from Bluesky.
 - Change any support links (feedback, email, terms of service, etc) to your own systems.
 - Replace any analytics or error-collection systems with your own so we don't get super confused.
+- Replace the landing-screen illustration in `assets/illustrations/`. It is commissioned artwork licensed to Bluesky alone, and our MIT license does not cover it.
+- Source your own UI icons. The glyph set in `assets/icons/` is licensed to us by a third party for our own use, and that license does not extend to you.
+- Replace the Bluesky logo, app icons, and other brand assets. Our trademarks are not licensed with the code.
+
+Please read [./ASSETS.md](./ASSETS.md) before you ship. Not every file in this repository is
+covered by our MIT license — some of the artwork, icons, fonts, and brand assets are licensed to
+us by third parties or are trademarks, and `ASSETS.md` says which ones and what to do about them.
+That file is new. Its absence is why some forks have shipped assets they did not have rights to,
+and that was our omission rather than theirs.
 
 ## Security disclosures
 
@@ -68,7 +77,11 @@ Bluesky is an open social network built on the AT Protocol, a flexible technolog
 
 ## License (MIT)
 
-See [./LICENSE](./LICENSE) for the full license.
+See [./LICENSE](./LICENSE) for the full license, which covers the source code in this repository.
+
+It does not cover every file. Certain images, icons, fonts, and brand assets are licensed to us
+by third parties, or are trademarks, and are carved out — see [./ASSETS.md](./ASSETS.md). Required
+third-party attribution notices are collected in [./NOTICE.md](./NOTICE.md).
 
 Bluesky Social PBC has committed to a software patent non-aggression pledge. For details see [the original announcement](https://bsky.social/about/blog/10-01-2025-patent-pledge).
 

__e2e__/flows/composer.yml

@@ -44,6 +44,12 @@ appId: xyz.blueskyweb.app
     id: "e2eRefreshHome"
 - tapOn:
     id: "replyBtn"
+# Wait for the composer to fully open before typing. Tapping replyBtn right
+# after the previous publish can race the closing composer on Android.
+- extendedWaitUntil:
+    visible:
+      id: "composerPublishBtn"
+    timeout: 10000
 - inputText: "Reply text only"
 - tapOn:
     id: "composerPublishBtn"
@@ -51,6 +57,11 @@ appId: xyz.blueskyweb.app
     id: "composeFAB"
 - tapOn:
     id: "replyBtn"
+# Wait for the composer to fully open before typing.
+- extendedWaitUntil:
+    visible:
+      id: "composerPublishBtn"
+    timeout: 10000
 - inputText: "Reply with an image"
 - tapOn:
     id: "openMediaBtn"
@@ -63,6 +74,11 @@ appId: xyz.blueskyweb.app
     id: "composeFAB"
 - tapOn:
     id: "replyBtn"
+# Wait for the composer to fully open before typing.
+- extendedWaitUntil:
+    visible:
+      id: "composerPublishBtn"
+    timeout: 10000
 - inputText: "Reply with a https://example.com link card"
 - tapOn:
     id: "composerPublishBtn"

__e2e__/flows/curate-lists.yml

@@ -39,7 +39,6 @@ appId: xyz.blueskyweb.app
     id: "editListNameInput"
 - eraseText
 - inputText: "Bad Ppl"
-- hideKeyboard
 - tapOn:
     id: "editListDescriptionInput"
 - eraseText
@@ -92,7 +91,8 @@ appId: xyz.blueskyweb.app
 - tapOn: "Add user to list"
 - swipe:
     direction: DOWN
-- assertVisible: "View Bob's profile"
+- assertVisible:
+    id: "profileCard-bob.test-link"
 
 - tapOn: "Posts"
 - assertVisible:
@@ -124,7 +124,8 @@ appId: xyz.blueskyweb.app
 - tapOn: "Good Ppl"
 
 - tapOn: "People"
-- assertVisible: "View Bob's profile"
+- assertVisible:
+    id: "profileCard-bob.test-link"
 - tapOn:
     point: "90%,43%"
 - tapOn:
@@ -134,7 +135,8 @@ appId: xyz.blueskyweb.app
 
 - tapOn:
     id: "bottomBarSearchBtn"
-- tapOn: "Search for posts, users[,]? or feeds"
+- tapOn:
+    id: "searchScreenInput"
 - inputText: "bob"
 - tapOn:
     id: "searchAutoCompleteResult-bob.test"
@@ -144,21 +146,21 @@ appId: xyz.blueskyweb.app
     id: "profileHeaderDropdownBtn"
 - tapOn: "Add to Lists"
 - assertVisible:
-    id: "userAddRemoveListsModal"
+    id: "userAddRemoveListsDialog"
 - tapOn:
     id: "user-bob.test-addBtn"
 - tapOn:
     id: "doneBtn"
 - assertNotVisible:
-    id: "userAddRemoveListsModal"
+    id: "userAddRemoveListsDialog"
 - tapOn:
     id: "profileHeaderDropdownBtn"
 - tapOn: "Add to Lists"
 - assertVisible:
-    id: "userAddRemoveListsModal"
+    id: "userAddRemoveListsDialog"
 - tapOn:
     id: "user-bob.test-addBtn"
 - tapOn:
     id: "doneBtn"
 - assertNotVisible:
-    id: "userAddRemoveListsModal"
+    id: "userAddRemoveListsDialog"

__e2e__/flows/feed-reorder.yml

@@ -29,45 +29,88 @@ appId: xyz.blueskyweb.app
     id: "homeScreenFeedTabs-selector-1"
     text: "alice-favs"
 
-# Set alice-favs first
-- tapOn: "Open drawer menu"
-- tapOn:
-    id: "menuItemButton-Feeds"
-- tapOn:
-    id: "editFeedsBtn"
-- tapOn:
-    label: "Tap on down arrow"
-    id: "feed-timeline-moveDown"
-- tapOn:
-      label: "Save button"
-      id: "saveChangesBtn"
-- tapOn: "Go back"
-- assertVisible:
-    id: "homeScreenFeedTabs-selector-0"
-    text: "alice-favs"
-- assertVisible:
-    id: "homeScreenFeedTabs-selector-1"
-    text: "Following"
+# Reordering feeds is driven by a drag on the feed-drag-handle. Maestro cannot
+# activate the RNGH Pan gesture from a synthetic swipe on Android (proven
+# twice - coordinate swipes never register the pan), so the reorder
+# verification below runs on iOS only. If Android drag coverage is needed,
+# revisit with the SavedFeedsA11y move buttons rather than a swipe.
+- runFlow:
+    when:
+      platform: iOS
+    commands:
+      # Set alice-favs first
+      - tapOn: "Open drawer menu"
+      - tapOn:
+          id: "menuItemButton-Feeds"
+      - tapOn:
+          id: "editFeedsBtn"
+      - swipe:
+          label: "Drag feed down"
+          from:
+            id: "feed-drag-handle"
+          direction: "DOWN"
+          duration: 1000
+      - assertVisible:
+          id: "saveChangesBtn"
+          enabled: true
+      - tapOn:
+            label: "Save button"
+            id: "saveChangesBtn"
+      - tapOn: "Go back"
+      - assertVisible:
+          id: "homeScreenFeedTabs-selector-0"
+          text: "alice-favs"
+      - assertVisible:
+          id: "homeScreenFeedTabs-selector-1"
+          text: "Following"
 
-# Set following first
-- tapOn: "Open drawer menu"
-- tapOn:
-    id: "menuItemButton-Feeds"
-- tapOn:
-    id: "editFeedsBtn"
-- tapOn:
-    label: "Tap on down arrow"
-    id: "feed-feed-moveDown"
-- tapOn:
-    label: "Save button"
-    id: "saveChangesBtn"
-- tapOn: "Go back"
-- assertVisible:
-    id: "homeScreenFeedTabs-selector-0"
-    text: "Following"
-- assertVisible:
-    id: "homeScreenFeedTabs-selector-1"
-    text: "alice-favs"
+      # Set following first
+      - tapOn: "Open drawer menu"
+      - tapOn:
+          id: "menuItemButton-Feeds"
+      - tapOn:
+          id: "editFeedsBtn"
+      - swipe:
+          label: "Drag feed down"
+          from:
+            id: "feed-drag-handle"
+          direction: "DOWN"
+          duration: 1000
+      - assertVisible:
+          id: "saveChangesBtn"
+          enabled: true
+      - tapOn:
+          label: "Save button"
+          id: "saveChangesBtn"
+      - tapOn: "Go back"
+      - assertVisible:
+          id: "homeScreenFeedTabs-selector-0"
+          text: "Following"
+      - assertVisible:
+          id: "homeScreenFeedTabs-selector-1"
+          text: "alice-favs"
+
+# On Android, the reorder path above is skipped. Smoke-test that the feeds
+# edit screen opens and the pinned feeds render, then return to a valid state.
+- runFlow:
+    when:
+      platform: Android
+    commands:
+      - tapOn: "Open drawer menu"
+      - tapOn:
+          id: "menuItemButton-Feeds"
+      - tapOn:
+          id: "editFeedsBtn"
+      - assertVisible: "Following"
+      - assertVisible: "alice-favs"
+      # Two back presses to reach Home: the first pops the saved-feeds editor
+      # back to the Feeds screen, the second pops Feeds back to Home. On iOS the
+      # equivalent path saves changes first (saveChangesBtn calls
+      # navigation.goBack), so a single "Go back" there already lands on Home.
+      # This Android smoke branch never saves, so it needs the extra pop to
+      # leave the screen state on Home, which the shared steps below expect.
+      - tapOn: "Go back"
+      - tapOn: "Go back"
 
 # Remove following
 - tapOn: "Open drawer menu"

__e2e__/flows/login.yml

@@ -11,11 +11,18 @@ appId: xyz.blueskyweb.app
 - tapOn: "Sign in"
 - tapOn:
     id: "selectServiceButton"
-- tapOn: "Custom"
+- tapOn:
+    id: "manualSelectBtn"
 - tapOn:
     id: "customServerTextInput"
 - inputText: "http://localhost:3000"
-- tapOn: "Done"
+- runFlow:
+    when:
+      platform: Android
+    commands:
+      - hideKeyboard
+- tapOn:
+    id: "doneBtn"
 - tapOn:
     id: "loginUsernameInput"
 - inputText: "Alice"

__e2e__/flows/onboarding-avatar-creator.yml

@@ -15,6 +15,24 @@ appId: xyz.blueskyweb.app
 - tapOn:
     id: "e2eStartOnboarding"
 - tapOn: "Open avatar creator"
+# The avatar-creator bottom sheet (Dialog.Inner, non-scrollable) opens only
+# half-expanded on the short E2E emulator (720x1600), a ~220px sliver with the
+# emoji grid below the fold. It is NOT a scroll view, so scrollUntilVisible's
+# swipe grabs the sheet's own drag gesture and flings it closed. Instead, drag
+# the sheet upward to expand it to full height, which brings the picker into
+# view. iOS opens the sheet fully already, so this is Android-only.
+- runFlow:
+    when:
+      platform: Android
+    commands:
+      - swipe:
+          label: "Drag the bottom sheet up to expand it"
+          start: "50%, 90%"
+          end: "50%, 20%"
+          duration: 600
+      - extendedWaitUntil:
+          visible: "Select an emoji"
+          timeout: 10000
 - tapOn: "Select the zap emoji as your avatar"
 - tapOn:
     label: "Tap on yellow"
@@ -22,6 +40,20 @@ appId: xyz.blueskyweb.app
 - tapOn: "Done"
 - waitForAnimationToEnd
 - tapOn: "Select an avatar"
+# Reopening the creator sheet lands on the same half-expanded sliver on
+# Android, so expand it again before reaching for the emoji grid. No-op on iOS.
+- runFlow:
+    when:
+      platform: Android
+    commands:
+      - swipe:
+          label: "Drag the bottom sheet up to expand it"
+          start: "50%, 90%"
+          end: "50%, 20%"
+          duration: 600
+      - extendedWaitUntil:
+          visible: "Select an emoji"
+          timeout: 10000
 - tapOn: "Select the atom emoji as your avatar"
 - tapOn: "Done"
 - waitForAnimationToEnd

__e2e__/flows/onboarding.yml

@@ -16,13 +16,28 @@ appId: xyz.blueskyweb.app
     id: "e2eStartOnboarding"
 - tapOn: "Select an avatar"
 - waitForAnimationToEnd
-- assertVisible: "Photos"
-- assertVisible: "Collections"
-- tapOn:
-    point: "50%,22%"
-- waitForAnimationToEnd
-- tapOn: "Done"
-- waitForAnimationToEnd
+- runFlow:
+    when:
+      platform: iOS
+    commands:
+      - assertVisible: "Photos"
+      - assertVisible: "Collections"
+      - tapOn:
+          point: "50%,22%"
+      - waitForAnimationToEnd
+      - tapOn: "Done"
+      - waitForAnimationToEnd
+- runFlow:
+    when:
+      platform: Android
+    commands:
+      # The system photo picker opened here shows MediaStore photos, which
+      # the e2e run doesn't seed (media is seeded into app-scoped storage for
+      # the composer's mocked picker instead). With no photo to pick, dismiss
+      # the picker and continue - onContinue falls back to the generated
+      # placeholder avatar, and nothing later in the flow depends on the image.
+      - back
+      - waitForAnimationToEnd
 - tapOn:
     id: "onboardingContinue"
 - assertVisible: "What are your interests?"

__e2e__/flows/profile-screen-edit.yml

@@ -45,7 +45,7 @@ appId: xyz.blueskyweb.app
     id: "editProfileSaveBtn"
 - assertNotVisible:
     id: "editProfileModal"
-- assertVisible: "Alicia"
+- assertVisible: ".*Alicia.*"
 - assertVisible: "One cool hacker"
 
 # Remove display name and description via the edit profile modal
@@ -64,7 +64,10 @@ appId: xyz.blueskyweb.app
     id: "editProfileSaveBtn"
 - assertNotVisible:
     id: "editProfileModal"
-- assertVisible: "alice.test"
+# The display-name node renders the handle as a Text with a nested badge View
+# once the display name is cleared, so the a11y text is not the bare handle
+# string on Android. Match it as a substring instead.
+- assertVisible: ".*alice\\.test.*"
 - assertNotVisible: "One cool hacker"
 
 # Set avi and banner via the edit profile modal

__e2e__/flows/profile-screen.yml

@@ -15,7 +15,8 @@ appId: xyz.blueskyweb.app
       id: "bottomBarSearchBtn"
 - tapOn:
     id: "bottomBarSearchBtn"
-- tapOn: "Search for posts, users[,]? or feeds"
+- tapOn:
+    id: "searchScreenInput"
 - inputText: "b"
 - tapOn:
     id: "searchAutoCompleteResult-bob.test"

__e2e__/flows/report-dialog/account.default.yml

@@ -22,5 +22,7 @@ appId: xyz.blueskyweb.app
     text: "Send report to Dev-env Moderation"
 - tapOn:
     id: "report:submit"
-- assertNotVisible:
-    id: "report:dialog"
+- extendedWaitUntil:
+    notVisible:
+      id: "report:dialog"
+    timeout: 20000

__e2e__/flows/report-dialog/post.default.yml

@@ -22,5 +22,7 @@ appId: xyz.blueskyweb.app
     text: "Send report to Dev-env Moderation"
 - tapOn:
     id: "report:submit"
-- assertNotVisible:
-    id: "report:dialog"
+- extendedWaitUntil:
+    notVisible:
+      id: "report:dialog"
+    timeout: 20000

__e2e__/flows/report-dialog/post.edit-reason.yml

@@ -39,5 +39,7 @@ appId: xyz.blueskyweb.app
     text: Your report will be sent to Dev-env Moderation.*
 - tapOn:
     id: "report:submit"
-- assertNotVisible:
-    id: "report:dialog"
+- extendedWaitUntil:
+    notVisible:
+      id: "report:dialog"
+    timeout: 20000

__e2e__/flows/report-dialog/post.reason-other.yml

@@ -26,7 +26,10 @@ appId: xyz.blueskyweb.app
 - tapOn:
     id: "report:details"
 - inputText: "This is a test report"
+- hideKeyboard
 - tapOn:
     id: "report:submit"
-- assertNotVisible:
-    id: "report:dialog"
+- extendedWaitUntil:
+    notVisible:
+      id: "report:dialog"
+    timeout: 20000

__e2e__/flows/search-screen.yml

@@ -15,8 +15,10 @@ appId: xyz.blueskyweb.app
       id: "bottomBarSearchBtn"
 - tapOn:
     id: "bottomBarSearchBtn"
-- assertVisible: "Search for posts, users[,]? or feeds"
-- tapOn: "Search for posts, users[,]? or feeds"
+- assertVisible:
+    id: "searchScreenInput"
+- tapOn:
+    id: "searchScreenInput"
 - inputText: "b"
 - tapOn:
     id: "searchAutoCompleteResult-bob.test"

__e2e__/flows/thread-muting.yml

@@ -20,6 +20,12 @@ appId: xyz.blueskyweb.app
 - inputText: "Test thread"
 - tapOn:
     id: "composerPublishBtn"
+# Wait for the composer to close and the home feed to settle before signing
+# out. Without a settle guard the next action can race the closing composer.
+- extendedWaitUntil:
+    visible:
+      id: "composeFAB"
+    timeout: 10000
 
 # Login, reply to the thread, and log out
 - tapOn:
@@ -31,9 +37,19 @@ appId: xyz.blueskyweb.app
       id: "viewHeaderHomeFeedPrefsBtn"
 - tapOn:
     id: "replyBtn"
+# Wait for the composer to fully open before typing.
+- extendedWaitUntil:
+    visible:
+      id: "composerPublishBtn"
+    timeout: 10000
 - inputText: "Reply 1"
 - tapOn:
     id: "composerPublishBtn"
+# Wait for the composer to close before signing out.
+- extendedWaitUntil:
+    visible:
+      id: "composeFAB"
+    timeout: 10000
 
 # Login, confirm notification exists, mute thread, and log out
 - tapOn:
@@ -45,10 +61,8 @@ appId: xyz.blueskyweb.app
       id: "viewHeaderHomeFeedPrefsBtn"
 - tapOn:
     id: "bottomBarNotificationsBtn"
-- assertVisible:
-    id: "feedItem-by-bob.test"
-- tapOn:
-    id: "feedItem-by-bob.test"
+- assertVisible: ".*Reply 1.*"
+- tapOn: ".*Reply 1.*"
 - tapOn:
     id: "postDropdownBtn"
     childOf:
@@ -67,16 +81,78 @@ appId: xyz.blueskyweb.app
     id: "bottomBarProfileBtn"
 - tapOn:
     id: "profilePager-selector-1"
-- tapOn:
-    id: "replyBtn"
+# Both replies target the thread root ("Test thread" by alice), which sits at
+# the top of bob's Replies tab. That tab renders each post in the thread with
+# its own replyBtn, so scope the tap to the root post's card
+# (feedItem-by-alice.test) rather than relying on which replyBtn Maestro picks
+# first. This keeps both reply taps deterministic regardless of list order or
+# how many posts have rendered.
+#
+# Even with the close-gating below, the replyBtn tap can land on a recycled list
+# row while the author feed re-renders after a publish, and be swallowed so the
+# composer never opens. Wrapping the tap + open-wait in retry makes opening the
+# composer idempotent: a swallowed tap just re-taps until the publish button
+# appears. A first-try success does not retry.
+- retry:
+    maxRetries: 3
+    commands:
+      - tapOn:
+          id: "replyBtn"
+          childOf:
+            id: "feedItem-by-alice.test"
+      # Wait for the composer to fully open before typing.
+      - extendedWaitUntil:
+          visible:
+            id: "composerPublishBtn"
+          timeout: 10000
 - inputText: "Reply 2"
 - tapOn:
     id: "composerPublishBtn"
-- tapOn:
-    id: "replyBtn"
+# Wait for the composer to actually close before opening it again. replyBtn
+# stays in the accessibility tree behind the open composer sheet, so waiting on
+# its visibility returns immediately and does not gate on the close animation or
+# the author-feed re-render that follows a post - the next replyBtn tap then
+# fires mid-transition and is swallowed, so the composer never opens. Gate on
+# the publish button disappearing (the composer is gone), then confirm the
+# reply button underneath is back and let animations settle.
+- extendedWaitUntil:
+    notVisible:
+      id: "composerPublishBtn"
+    timeout: 15000
+- extendedWaitUntil:
+    visible:
+      id: "replyBtn"
+    timeout: 10000
+- waitForAnimationToEnd
+# As with Reply 2: even after gating on the composer close, this tap can hit a
+# recycled row during the post-publish feed re-render and be swallowed, so wrap
+# the open in retry to make it idempotent.
+- retry:
+    maxRetries: 3
+    commands:
+      - tapOn:
+          id: "replyBtn"
+          childOf:
+            id: "feedItem-by-alice.test"
+      # Wait for the composer to fully open before typing.
+      - extendedWaitUntil:
+          visible:
+            id: "composerPublishBtn"
+          timeout: 10000
 - inputText: "Reply 3"
 - tapOn:
     id: "composerPublishBtn"
+# Wait for the composer to actually close before signing out. As above,
+# replyBtn stays visible behind the sheet, so gate on the publish button
+# disappearing first, then confirm the reply button underneath has returned.
+- extendedWaitUntil:
+    notVisible:
+      id: "composerPublishBtn"
+    timeout: 15000
+- extendedWaitUntil:
+    visible:
+      id: "replyBtn"
+    timeout: 10000
 
 # Login, confirm notifications dont exist, unmute the thread, ~~confirm notifications exist~~
 # Mute thread behaviour no longer change old notifications after muting/unmuting a thread -sfn
@@ -92,10 +168,7 @@ appId: xyz.blueskyweb.app
 - assertVisible: ".*Reply 1.*"
 - assertNotVisible: ".*Reply 2.*"
 - assertNotVisible: ".*Reply 3.*"
-- assertVisible:
-    id: "feedItem-by-bob.test"
-- tapOn:
-    id: "feedItem-by-bob.test"
+- tapOn: ".*Reply 1.*"
 - tapOn:
     id: "postDropdownBtn"
     childOf:

__e2e__/mock-server.ts

@@ -1,529 +0,0 @@
-import {createServer as createHTTPServer} from 'node:http'
-import {parse} from 'node:url'
-
-import {createServer, type TestPDS} from '../jest/test-pds'
-
-async function main() {
-  let server: TestPDS
-  createHTTPServer(async (req, res) => {
-    const url = parse(req.url || '/', true)
-    if (req.method !== 'POST') {
-      return res.writeHead(200).end()
-    }
-    try {
-      console.log('Closing old server')
-      await server?.close()
-      console.log('Starting new server')
-      const inviteRequired = url?.query && 'invite' in url.query
-      server = await createServer({inviteRequired})
-      console.log('Listening at', server.pdsUrl)
-      if (url?.query) {
-        if ('users' in url.query) {
-          console.log('Generating mock users')
-          await server.mocker.createUser('alice')
-          await server.mocker.createUser('bob')
-          await server.mocker.createUser('carla')
-          await server.mocker.users.alice.agent.upsertProfile(() => ({
-            displayName: 'Alice',
-            description: 'Test user 1',
-          }))
-          await server.mocker.users.bob.agent.upsertProfile(() => ({
-            displayName: 'Bob',
-            description: 'Test user 2',
-          }))
-          await server.mocker.users.carla.agent.upsertProfile(() => ({
-            displayName: 'Carla',
-            description: 'Test user 3',
-          }))
-          if (inviteRequired) {
-            await server.mocker.createInvite(server.mocker.users.alice.did)
-          }
-        }
-        if ('follows' in url.query) {
-          console.log('Generating mock follows')
-          await server.mocker.follow('alice', 'bob')
-          await server.mocker.follow('alice', 'carla')
-          await server.mocker.follow('bob', 'alice')
-          await server.mocker.follow('bob', 'carla')
-          await server.mocker.follow('carla', 'alice')
-          await server.mocker.follow('carla', 'bob')
-        }
-        if ('posts' in url.query) {
-          console.log('Generating mock posts')
-          for (let user in server.mocker.users) {
-            await server.mocker.users[user].agent.post({text: 'Post'})
-          }
-        }
-        if ('feeds' in url.query) {
-          console.log('Generating mock feed')
-          await server.mocker.createFeed('alice', 'alice-favs', [])
-        }
-        if ('thread' in url.query) {
-          console.log('Generating mock posts')
-          const res = await server.mocker.users.bob.agent.post({
-            text: 'Thread root',
-          })
-          await server.mocker.users.carla.agent.post({
-            text: 'Thread reply',
-            reply: {
-              parent: {cid: res.cid, uri: res.uri},
-              root: {cid: res.cid, uri: res.uri},
-            },
-          })
-        }
-        if ('mergefeed' in url.query) {
-          console.log('Generating mock users')
-          await server.mocker.createUser('alice')
-          await server.mocker.createUser('bob')
-          await server.mocker.createUser('carla')
-          await server.mocker.createUser('dan')
-          await server.mocker.users.alice.agent.upsertProfile(() => ({
-            displayName: 'Alice',
-            description: 'Test user 1',
-          }))
-          await server.mocker.users.bob.agent.upsertProfile(() => ({
-            displayName: 'Bob',
-            description: 'Test user 2',
-          }))
-          await server.mocker.users.carla.agent.upsertProfile(() => ({
-            displayName: 'Carla',
-            description: 'Test user 3',
-          }))
-          await server.mocker.users.dan.agent.upsertProfile(() => ({
-            displayName: 'Dan',
-            description: 'Test user 4',
-          }))
-          console.log('Generating mock follows')
-          await server.mocker.follow('alice', 'bob')
-          await server.mocker.follow('alice', 'carla')
-          console.log('Generating mock posts')
-          let posts: Record<string, any[]> = {
-            alice: [],
-            bob: [],
-            carla: [],
-            dan: [],
-          }
-          for (let i = 0; i < 10; i++) {
-            for (let user in server.mocker.users) {
-              if (user === 'alice') continue
-              posts[user].push(
-                await server.mocker.createPost(user, `Post ${i}`),
-              )
-            }
-          }
-          for (let i = 0; i < 10; i++) {
-            for (let user in server.mocker.users) {
-              if (user === 'alice') continue
-              if (i % 5 === 0) {
-                await server.mocker.createReply(user, 'Self reply', {
-                  cid: posts[user][i].cid,
-                  uri: posts[user][i].uri,
-                })
-              }
-              if (i % 5 === 1) {
-                await server.mocker.createReply(user, 'Reply to bob', {
-                  cid: posts.bob[i].cid,
-                  uri: posts.bob[i].uri,
-                })
-              }
-              if (i % 5 === 2) {
-                await server.mocker.createReply(user, 'Reply to dan', {
-                  cid: posts.dan[i].cid,
-                  uri: posts.dan[i].uri,
-                })
-              }
-              await server.mocker.users[user].agent.post({text: `Post ${i}`})
-            }
-          }
-          console.log('Generating mock feeds')
-          await server.mocker.createFeed(
-            'alice',
-            'alice-favs',
-            posts.dan.map(p => p.uri),
-          )
-          await server.mocker.createFeed(
-            'alice',
-            'alice-favs2',
-            posts.dan.map(p => p.uri),
-          )
-        }
-        if ('labels' in url.query) {
-          console.log('Generating naughty users with labels')
-
-          const anchorPost = await server.mocker.createPost(
-            'alice',
-            'Anchor post',
-          )
-
-          for (const user of [
-            'dmca-account',
-            'dmca-profile',
-            'dmca-posts',
-            'porn-account',
-            'porn-profile',
-            'porn-posts',
-            'nudity-account',
-            'nudity-profile',
-            'nudity-posts',
-            'scam-account',
-            'scam-profile',
-            'scam-posts',
-            'unknown-account',
-            'unknown-profile',
-            'unknown-posts',
-            'hide-account',
-            'hide-profile',
-            'hide-posts',
-            'no-promote-account',
-            'no-promote-profile',
-            'no-promote-posts',
-            'warn-account',
-            'warn-profile',
-            'warn-posts',
-            'muted-account',
-            'muted-by-list-acc',
-            'blocking-account',
-            'blockedby-account',
-            'mutual-block-acc',
-          ]) {
-            await server.mocker.createUser(user)
-            await server.mocker.follow('alice', user)
-            await server.mocker.follow(user, 'alice')
-            await server.mocker.createPost(user, `Unlabeled post from ${user}`)
-            await server.mocker.createReply(
-              user,
-              `Unlabeled reply from ${user}`,
-              anchorPost,
-            )
-            await server.mocker.like(user, anchorPost)
-          }
-
-          await server.mocker.labelAccount('dmca-violation', 'dmca-account')
-          await server.mocker.labelProfile('dmca-violation', 'dmca-profile')
-          await server.mocker.labelPost(
-            'dmca-violation',
-            await server.mocker.createPost('dmca-posts', 'dmca post'),
-          )
-          await server.mocker.labelPost(
-            'dmca-violation',
-            await server.mocker.createQuotePost(
-              'dmca-posts',
-              'dmca quote post',
-              anchorPost,
-            ),
-          )
-          await server.mocker.labelPost(
-            'dmca-violation',
-            await server.mocker.createReply(
-              'dmca-posts',
-              'dmca reply',
-              anchorPost,
-            ),
-          )
-
-          await server.mocker.labelAccount('porn', 'porn-account')
-          await server.mocker.labelProfile('porn', 'porn-profile')
-          await server.mocker.labelPost(
-            'porn',
-            await server.mocker.createImagePost('porn-posts', 'porn post'),
-          )
-          await server.mocker.labelPost(
-            'porn',
-            await server.mocker.createQuotePost(
-              'porn-posts',
-              'porn quote post',
-              anchorPost,
-            ),
-          )
-          await server.mocker.labelPost(
-            'porn',
-            await server.mocker.createReply(
-              'porn-posts',
-              'porn reply',
-              anchorPost,
-            ),
-          )
-
-          await server.mocker.labelAccount('nudity', 'nudity-account')
-          await server.mocker.labelProfile('nudity', 'nudity-profile')
-          await server.mocker.labelPost(
-            'nudity',
-            await server.mocker.createImagePost('nudity-posts', 'nudity post'),
-          )
-          await server.mocker.labelPost(
-            'nudity',
-            await server.mocker.createQuotePost(
-              'nudity-posts',
-              'nudity quote post',
-              anchorPost,
-            ),
-          )
-          await server.mocker.labelPost(
-            'nudity',
-            await server.mocker.createReply(
-              'nudity-posts',
-              'nudity reply',
-              anchorPost,
-            ),
-          )
-
-          await server.mocker.labelAccount('scam', 'scam-account')
-          await server.mocker.labelProfile('scam', 'scam-profile')
-          await server.mocker.labelPost(
-            'scam',
-            await server.mocker.createPost('scam-posts', 'scam post'),
-          )
-          await server.mocker.labelPost(
-            'scam',
-            await server.mocker.createQuotePost(
-              'scam-posts',
-              'scam quote post',
-              anchorPost,
-            ),
-          )
-          await server.mocker.labelPost(
-            'scam',
-            await server.mocker.createReply(
-              'scam-posts',
-              'scam reply',
-              anchorPost,
-            ),
-          )
-
-          await server.mocker.labelAccount(
-            'not-a-real-label',
-            'unknown-account',
-          )
-          await server.mocker.labelProfile(
-            'not-a-real-label',
-            'unknown-profile',
-          )
-          await server.mocker.labelPost(
-            'not-a-real-label',
-            await server.mocker.createPost('unknown-posts', 'unknown post'),
-          )
-          await server.mocker.labelPost(
-            'not-a-real-label',
-            await server.mocker.createQuotePost(
-              'unknown-posts',
-              'unknown quote post',
-              anchorPost,
-            ),
-          )
-          await server.mocker.labelPost(
-            'not-a-real-label',
-            await server.mocker.createReply(
-              'unknown-posts',
-              'unknown reply',
-              anchorPost,
-            ),
-          )
-
-          await server.mocker.labelAccount('!hide', 'hide-account')
-          await server.mocker.labelProfile('!hide', 'hide-profile')
-          await server.mocker.labelPost(
-            '!hide',
-            await server.mocker.createPost('hide-posts', 'hide post'),
-          )
-          await server.mocker.labelPost(
-            '!hide',
-            await server.mocker.createQuotePost(
-              'hide-posts',
-              'hide quote post',
-              anchorPost,
-            ),
-          )
-          await server.mocker.labelPost(
-            '!hide',
-            await server.mocker.createReply(
-              'hide-posts',
-              'hide reply',
-              anchorPost,
-            ),
-          )
-
-          await server.mocker.labelAccount('!no-promote', 'no-promote-account')
-          await server.mocker.labelProfile('!no-promote', 'no-promote-profile')
-          await server.mocker.labelPost(
-            '!no-promote',
-            await server.mocker.createPost(
-              'no-promote-posts',
-              'no-promote post',
-            ),
-          )
-          await server.mocker.labelPost(
-            '!no-promote',
-            await server.mocker.createQuotePost(
-              'no-promote-posts',
-              'no-promote quote post',
-              anchorPost,
-            ),
-          )
-          await server.mocker.labelPost(
-            '!no-promote',
-            await server.mocker.createReply(
-              'no-promote-posts',
-              'no-promote reply',
-              anchorPost,
-            ),
-          )
-
-          await server.mocker.labelAccount('!warn', 'warn-account')
-          await server.mocker.labelProfile('!warn', 'warn-profile')
-          await server.mocker.labelPost(
-            '!warn',
-            await server.mocker.createPost('warn-posts', 'warn post'),
-          )
-          await server.mocker.labelPost(
-            '!warn',
-            await server.mocker.createQuotePost(
-              'warn-posts',
-              'warn quote post',
-              anchorPost,
-            ),
-          )
-          await server.mocker.labelPost(
-            '!warn',
-            await server.mocker.createReply(
-              'warn-posts',
-              'warn reply',
-              anchorPost,
-            ),
-          )
-
-          await server.mocker.users.alice.agent.mute('muted-account.test')
-          await server.mocker.createPost('muted-account', 'muted post')
-          await server.mocker.createQuotePost(
-            'muted-account',
-            'muted quote post',
-            anchorPost,
-          )
-          await server.mocker.createReply(
-            'muted-account',
-            'muted reply',
-            anchorPost,
-          )
-
-          const list = await server.mocker.createMuteList(
-            'alice',
-            'Muted Users',
-          )
-          await server.mocker.addToMuteList(
-            'alice',
-            list,
-            server.mocker.users['muted-by-list-acc'].did,
-          )
-          await server.mocker.createPost('muted-by-list-acc', 'muted post')
-          await server.mocker.createQuotePost(
-            'muted-by-list-acc',
-            'account quote post',
-            anchorPost,
-          )
-          await server.mocker.createReply(
-            'muted-by-list-acc',
-            'account reply',
-            anchorPost,
-          )
-
-          await server.mocker.createPost('blocking-account', 'blocking post')
-          await server.mocker.createQuotePost(
-            'blocking-account',
-            'blocking quote post',
-            anchorPost,
-          )
-          await server.mocker.createReply(
-            'blocking-account',
-            'blocking reply',
-            anchorPost,
-          )
-          await server.mocker.users.alice.agent.app.bsky.graph.block.create(
-            {
-              repo: server.mocker.users.alice.did,
-            },
-            {
-              subject: server.mocker.users['blocking-account'].did,
-              createdAt: new Date().toISOString(),
-            },
-          )
-
-          await server.mocker.createPost('blockedby-account', 'blockedby post')
-          await server.mocker.createQuotePost(
-            'blockedby-account',
-            'blockedby quote post',
-            anchorPost,
-          )
-          await server.mocker.createReply(
-            'blockedby-account',
-            'blockedby reply',
-            anchorPost,
-          )
-          await server.mocker.users[
-            'blockedby-account'
-          ].agent.app.bsky.graph.block.create(
-            {
-              repo: server.mocker.users['blockedby-account'].did,
-            },
-            {
-              subject: server.mocker.users.alice.did,
-              createdAt: new Date().toISOString(),
-            },
-          )
-
-          await server.mocker.createPost(
-            'mutual-block-acc',
-            'mutual-block post',
-          )
-          await server.mocker.createQuotePost(
-            'mutual-block-acc',
-            'mutual-block quote post',
-            anchorPost,
-          )
-          await server.mocker.createReply(
-            'mutual-block-acc',
-            'mutual-block reply',
-            anchorPost,
-          )
-          await server.mocker.users.alice.agent.app.bsky.graph.block.create(
-            {
-              repo: server.mocker.users.alice.did,
-            },
-            {
-              subject: server.mocker.users['mutual-block-acc'].did,
-              createdAt: new Date().toISOString(),
-            },
-          )
-          await server.mocker.users[
-            'mutual-block-acc'
-          ].agent.app.bsky.graph.block.create(
-            {
-              repo: server.mocker.users['mutual-block-acc'].did,
-            },
-            {
-              subject: server.mocker.users.alice.did,
-              createdAt: new Date().toISOString(),
-            },
-          )
-
-          // flush caches
-          await server.mocker.testNet.processAll()
-        }
-      }
-      console.log('Ready')
-      return res
-        .writeHead(200, {
-          'content-type': 'application/json',
-        })
-        .end(
-          JSON.stringify({
-            pdsUrl: server.pdsUrl,
-            appviewDid: server.appviewDid,
-          }),
-        )
-    } catch (e) {
-      console.error('Error!', e)
-      return res.writeHead(500).end()
-    }
-  }).listen(1986)
-  console.log('Mock server manager listening on 1986')
-}
-main()

__e2e__/setupApp.yml

@@ -3,15 +3,33 @@ appId: xyz.blueskyweb.app
 - launchApp:
     appId: "xyz.blueskyweb.app"
     clearState: true
-- waitForAnimationToEnd
-- tapOn: "http://localhost:8081"
-- waitForAnimationToEnd
+    arguments:
+      "-EXDevMenuIsOnboardingFinished": true
+- runFlow:
+    when:
+      platform: iOS
+    commands:
+      - extendedWaitUntil:
+          visible: "http://localhost:8081"
+          timeout: 60000
+      - tapOn: "http://localhost:8081"
+- runFlow:
+    when:
+      platform: Android
+    commands:
+      - extendedWaitUntil:
+          visible: "http://10.0.2.2:8081"
+          timeout: 60000
+      - tapOn: "http://10.0.2.2:8081"
+      - extendedWaitUntil:
+          visible: "Continue"
+          timeout: 180000
+      - tapOn: "Continue"
+      - back
 - extendedWaitUntil:
-    visible: "Continue"
-- swipe:
-    from: "Bluesky"
-    direction: DOWN
-    duration: 100
+    visible:
+      id: e2eProxyHeaderInput
+    timeout: 180000
 - tapOn:
     id: e2eProxyHeaderInput
 - inputText: ${output.result}

__mocks__/@notifee/react-native.ts

@@ -1,6 +0,0 @@
-export default {
-  requestPermission: jest.fn(),
-  onForegroundEvent: jest.fn(),
-  setBadgeCount: jest.fn(),
-  displayNotification: jest.fn(),
-}

__mocks__/@react-native-camera-roll/camera-roll.js

@@ -1,9 +0,0 @@
-export const CameraRoll = {
-  getPhotos: jest.fn().mockResolvedValue({
-    edges: [
-      {node: {image: {uri: 'path/to/image1.jpg'}}},
-      {node: {image: {uri: 'path/to/image2.jpg'}}},
-      {node: {image: {uri: 'path/to/image3.jpg'}}},
-    ],
-  }),
-}

__mocks__/react-native-background-fetch.ts

@@ -1,4 +0,0 @@
-export default {
-  configure: jest.fn().mockResolvedValue(0),
-  finish: jest.fn(),
-}

__mocks__/react-native-fs.js

@@ -1 +0,0 @@
-export default {}

__mocks__/rn-fetch-blob.js

@@ -1,10 +0,0 @@
-jest.mock('rn-fetch-blob', () => {
-  return {
-    __esModule: true,
-    default: {
-      fs: {
-        unlink: jest.fn(),
-      },
-    },
-  }
-})

__mocks__/zeego/dropdown-menu.js

@@ -1,2 +0,0 @@
-export const DropdownMenu = jest.fn().mockImplementation(() => {})
-export const create = jest.fn().mockImplementation(() => {})

__tests__/lib/images.test.ts

@@ -1,11 +1,12 @@
 import {createDownloadResumable, deleteAsync} from 'expo-file-system/legacy'
 import {manipulateAsync, SaveFormat} from 'expo-image-manipulator'
 
+import {IMAGE_SIZE_CONFIG_2K_1MB} from '../../src/lib/constants'
 import {
   downloadAndResize,
   type DownloadAndResizeOpts,
-  getResizedDimensions,
 } from '../../src/lib/media/manip'
+import {getResizedDimensions} from '../../src/lib/media/util'
 
 const mockResizedImage = {
   path: 'file://resized-image.jpg',
@@ -41,10 +42,8 @@ describe('downloadAndResize', () => {
 
     const opts: DownloadAndResizeOpts = {
       uri: 'https://example.com/image.jpg',
-      width: 100,
-      height: 100,
+      maxDimension: 2000,
       maxSize: 500000,
-      mode: 'cover',
       timeout: 10000,
     }
 
@@ -60,9 +59,11 @@ describe('downloadAndResize', () => {
 
     // First time it gets called is to get dimensions
     expect(manipulateAsync).toHaveBeenCalledWith(expect.any(String), [], {})
+    // The mocked source image is 100x100, below maxDimension, so it is not
+    // downsized.
     expect(manipulateAsync).toHaveBeenCalledWith(
       expect.any(String),
-      [{resize: {height: opts.height, width: opts.width}}],
+      [{resize: {height: 100, width: 100}}],
       {format: SaveFormat.JPEG, compress: 1.0},
     )
     expect(deleteAsync).toHaveBeenCalledWith(expect.any(String), {
@@ -73,10 +74,8 @@ describe('downloadAndResize', () => {
   it('should return undefined for invalid URI', async () => {
     const opts: DownloadAndResizeOpts = {
       uri: 'invalid-uri',
-      width: 100,
-      height: 100,
+      maxDimension: 2000,
       maxSize: 500000,
-      mode: 'cover',
       timeout: 10000,
     }
 
@@ -90,13 +89,19 @@ describe('downloadAndResize', () => {
       width: 1200,
       height: 1000,
     }
-    const resizedDimensionsOne = getResizedDimensions(initialDimensionsOne)
+    const resizedDimensionsOne = getResizedDimensions(
+      initialDimensionsOne,
+      IMAGE_SIZE_CONFIG_2K_1MB.maxDimension,
+    )
 
     const initialDimensionsTwo = {
       width: 1000,
       height: 1200,
     }
-    const resizedDimensionsTwo = getResizedDimensions(initialDimensionsTwo)
+    const resizedDimensionsTwo = getResizedDimensions(
+      initialDimensionsTwo,
+      IMAGE_SIZE_CONFIG_2K_1MB.maxDimension,
+    )
 
     expect(resizedDimensionsOne).toEqual(initialDimensionsOne)
     expect(resizedDimensionsTwo).toEqual(initialDimensionsTwo)
@@ -107,13 +112,19 @@ describe('downloadAndResize', () => {
       width: 3000,
       height: 1500,
     }
-    const resizedDimensionsOne = getResizedDimensions(initialDimensionsOne)
+    const resizedDimensionsOne = getResizedDimensions(
+      initialDimensionsOne,
+      IMAGE_SIZE_CONFIG_2K_1MB.maxDimension,
+    )
 
     const initialDimensionsTwo = {
       width: 2000,
       height: 4000,
     }
-    const resizedDimensionsTwo = getResizedDimensions(initialDimensionsTwo)
+    const resizedDimensionsTwo = getResizedDimensions(
+      initialDimensionsTwo,
+      IMAGE_SIZE_CONFIG_2K_1MB.maxDimension,
+    )
 
     expect(resizedDimensionsOne).toEqual({
       width: 2000,

__tests__/lib/routes-helpers.test.ts

@@ -0,0 +1,107 @@
+import {
+  buildStateObject,
+  getCurrentRoute,
+  isStateAtTabRoot,
+} from '#/lib/routes/helpers'
+import {type State} from '#/lib/routes/types'
+
+describe('getCurrentRoute', () => {
+  it('returns Home when there is no state', () => {
+    expect(getCurrentRoute(undefined).name).toBe('Home')
+  })
+
+  it('descends into nested state using the index', () => {
+    const state = {
+      index: 0,
+      routes: [
+        {
+          name: 'HomeTab',
+          state: {
+            index: 1,
+            routes: [{name: 'Home'}, {name: 'PostThread'}],
+          },
+        },
+      ],
+    } as unknown as State
+
+    expect(getCurrentRoute(state).name).toBe('PostThread')
+  })
+
+  /*
+   * Right after a cold start from a deep link, nested navigator states are
+   * still partial and have no `index`. React Navigation focuses the last
+   * route when rehydrating such a state, so getCurrentRoute must do the
+   * same (previously it stopped at the tab route, which re-enabled the
+   * drawer swipe gesture on top of the deep-linked screen).
+   */
+  it('descends into partial nested state without an index', () => {
+    const state = {
+      routes: [
+        {
+          name: 'HomeTab',
+          state: {
+            routes: [{name: 'Home'}, {name: 'PostThread'}],
+          },
+        },
+      ],
+    } as unknown as State
+
+    expect(getCurrentRoute(state).name).toBe('PostThread')
+  })
+})
+
+describe('isStateAtTabRoot', () => {
+  it('returns true for the initial deep link state of a tab root', () => {
+    const state = buildStateObject('HomeTab', 'Home', {}) as unknown as State
+    expect(isStateAtTabRoot(state)).toBe(true)
+  })
+
+  it('returns false for the initial deep link state of a nested screen', () => {
+    const state = buildStateObject(
+      'HomeTab',
+      'PostThread',
+      {name: 'alice.test', rkey: '123'},
+      [{name: 'Home', params: {}}],
+    ) as unknown as State
+    expect(isStateAtTabRoot(state)).toBe(false)
+  })
+})
+
+describe('buildStateObject', () => {
+  it('focuses the deep-linked route in the nested state', () => {
+    const state = buildStateObject(
+      'HomeTab',
+      'PostThread',
+      {name: 'alice.test', rkey: '123'},
+      [{name: 'Home', params: {}}],
+    )
+
+    expect(state).toEqual({
+      index: 0,
+      routes: [
+        {
+          name: 'HomeTab',
+          state: {
+            index: 1,
+            routes: [
+              {name: 'Home', params: {}},
+              {name: 'PostThread', params: {name: 'alice.test', rkey: '123'}},
+            ],
+          },
+        },
+      ],
+    })
+  })
+
+  it('builds a single-route state for the Flat navigator', () => {
+    const state = buildStateObject('Flat', 'PostThread', {
+      name: 'alice.test',
+      rkey: '123',
+    })
+
+    expect(state).toEqual({
+      index: 0,
+      routes: [{name: 'PostThread', params: {name: 'alice.test', rkey: '123'}}],
+    })
+  })
+})

__tests__/lib/string.test.ts

@@ -1,4 +1,5 @@
-import {RichText} from '@atproto/api'
+import {RichText} from '@bsky.app/sdk/richtext'
+import {i18n} from '@lingui/core'
 
 import {parseEmbedPlayerFromUrl} from '#/lib/strings/embed-player'
 import {
@@ -6,7 +7,8 @@ import {
   createStarterPackLinkFromAndroidReferrer,
   parseStarterPackUri,
 } from '#/lib/strings/starter-pack'
-import {tenorUrlToBskyGifUrl} from '#/state/queries/tenor'
+import {messages} from '#/locale/locales/en/messages'
+import {klipyUrlToBskyGifUrl} from '#/features/gifPicker/utils'
 import {cleanError} from '../../src/lib/strings/errors'
 import {createFullHandle, makeValidHandle} from '../../src/lib/strings/handles'
 import {enforceLen} from '../../src/lib/strings/helpers'
@@ -202,6 +204,9 @@ describe('enforceLen', () => {
 })
 
 describe('cleanError', () => {
+  // cleanError uses lingui
+  i18n.loadAndActivate({locale: 'en', messages})
+
   const inputs = [
     'TypeError: Network request failed',
     'Error: Aborted',
@@ -327,6 +332,7 @@ describe('shortenLinks', () => {
       expect(outputRT.text).toEqual(outputs[i][0])
       expect(outputRT.facets?.length).toEqual(outputs[i][1].length)
       for (let j = 0; j < outputs[i][1].length; j++) {
+        // @ts-expect-error whatever
         expect(outputRT.facets![j].features[0].uri).toEqual(outputs[i][1][j])
       }
     }
@@ -437,6 +443,20 @@ describe('parseEmbedPlayerFromUrl', () => {
 
     'https://www.flickr.com/groups/898944@N23/',
     'https://www.flickr.com/groups',
+
+    'https://maxblansjaar.bandcamp.com/album/false-comforts',
+    'https://grmnygrmny.bandcamp.com/track/fluid',
+    'https://sufjanstevens.bandcamp.com/',
+    'https://sufjanstevens.bandcamp.com',
+    'https://bandcamp.com/',
+    'https://bandcamp.com',
+
+    'https://static.klipy.com/ii/abc123/73/ac/someFile.gif?hh=200&ww=300',
+    'https://static.klipy.com/ii/abc123/73/ac/someFile.gif?hh=200&ww=300&mp4=videoSlugMp4&webm=videoSlugWebm',
+    'https://static.klipy.com/ii/abc123/73/ac/someFile.gif?hh=200',
+    'https://static.klipy.com/ii/abc123/73/ac/someFile.gif',
+    'https://static.klipy.com/other/path.gif?hh=200&ww=300',
+    'https://static.klipy.com',
   ]
 
   const outputs = [
@@ -815,6 +835,52 @@ describe('parseEmbedPlayerFromUrl', () => {
 
     undefined,
     undefined,
+
+    {
+      type: 'bandcamp_album',
+      source: 'bandcamp',
+      playerUri:
+        'https://bandcamp.com/EmbeddedPlayer/url=https%3A%2F%2Fmaxblansjaar.bandcamp.com%2Falbum%2Ffalse-comforts/size=large/bgcol=ffffff/linkcol=0687f5/minimal=true/transparent=true/',
+    },
+    {
+      type: 'bandcamp_track',
+      source: 'bandcamp',
+      playerUri:
+        'https://bandcamp.com/EmbeddedPlayer/url=https%3A%2F%2Fgrmnygrmny.bandcamp.com%2Ftrack%2Ffluid/size=large/bgcol=ffffff/linkcol=0687f5/minimal=true/transparent=true/',
+    },
+    undefined,
+    undefined,
+    undefined,
+    undefined,
+
+    {
+      type: 'klipy_gif',
+      source: 'klipy',
+      isGif: true,
+      hideDetails: true,
+      playerUri: 'https://k.gifs.bsky.app/ii/abc123/73/ac/someFile.gif',
+      dimensions: {
+        width: 300,
+        height: 200,
+      },
+    },
+    // With video slug params — on native (test env), keeps gif filename,
+    // strips mp4/webm params. On web, would swap to video filename.
+    {
+      type: 'klipy_gif',
+      source: 'klipy',
+      isGif: true,
+      hideDetails: true,
+      playerUri: 'https://k.gifs.bsky.app/ii/abc123/73/ac/someFile.gif',
+      dimensions: {
+        width: 300,
+        height: 200,
+      },
+    },
+    undefined,
+    undefined,
+    undefined,
+    undefined,
   ]
 
   it('correctly grabs the correct id from uri', () => {
@@ -1005,17 +1071,30 @@ describe('createStarterPackGooglePlayUri', () => {
   })
 })
 
-describe('tenorUrlToBskyGifUrl', () => {
+describe('klipyUrlToBskyGifUrl', () => {
   const inputs = [
-    'https://media.tenor.com/someID_AAAAC/someName.gif',
-    'https://media.tenor.com/someID/someName.gif',
+    'https://static.klipy.com/ii/abc123/73/ac/someFile.gif',
+    'https://static.klipy.com/ii/abc123/73/ac/someFile.gif?hh=200&ww=300',
   ]
 
   it.each(inputs)(
-    'returns url with t.gifs.bsky.app as hostname for input url',
+    'returns url with k.gifs.bsky.app as hostname for input url',
     input => {
-      const out = tenorUrlToBskyGifUrl(input)
-      expect(out.startsWith('https://t.gifs.bsky.app/')).toEqual(true)
+      const out = klipyUrlToBskyGifUrl(input)
+      expect(out.startsWith('https://k.gifs.bsky.app/')).toEqual(true)
     },
   )
+
+  it('preserves the path and query params when rewriting', () => {
+    const out = klipyUrlToBskyGifUrl(
+      'https://static.klipy.com/ii/abc123/73/ac/someFile.gif?hh=200&ww=300',
+    )
+    expect(out).toEqual(
+      'https://k.gifs.bsky.app/ii/abc123/73/ac/someFile.gif?hh=200&ww=300',
+    )
+  })
+
+  it('returns empty string for invalid URLs', () => {
+    expect(klipyUrlToBskyGifUrl('not-a-url')).toEqual('')
+  })
 })

__tests__/lib/strings/url-helpers.test.ts

@@ -1,6 +1,7 @@
 import {describe, expect, it} from '@jest/globals'
 
 import {
+  getChatInviteCodeFromUrl,
   isPossiblyAUrl,
   isTrustedUrl,
   linkRequiresWarning,
@@ -178,3 +179,47 @@ describe('isTrustedUrl', () => {
     expect(output).toEqual(expected)
   })
 })
+
+describe('getChatInviteCodeFromUrl', () => {
+  type Case = [string, string | undefined]
+
+  const cases: Case[] = [
+    ['https://bsky.app/chat/abcdefg', 'abcdefg'],
+    ['https://bsky.app/chat/abcdefghij', 'abcdefghij'],
+    // http is not recognized as a bsky.app url
+    ['http://bsky.app/chat/abcdefg', undefined],
+    ['https://bsky.app/chat/abcdefg?utm=foo', 'abcdefg'],
+    ['https://bsky.app/chat/abcdefg#section', 'abcdefg'],
+    ['/chat/abcdefg', 'abcdefg'],
+    ['/chat/abcdefg?utm=foo', 'abcdefg'],
+    ['/chat/abcdefg#section', 'abcdefg'],
+
+    // too short
+    ['https://bsky.app/chat/abcdef', undefined],
+    ['/chat/abcdef', undefined],
+    // too long
+    ['https://bsky.app/chat/abcdefghijk', undefined],
+    ['/chat/abcdefghijk', undefined],
+    // invalid characters
+    ['https://bsky.app/chat/abc-def', undefined],
+    ['/chat/abc def', undefined],
+    // trailing path
+    ['https://bsky.app/chat/abcdefg/extra', undefined],
+    ['/chat/abcdefg/extra', undefined],
+    // wrong path
+    ['https://bsky.app/profile/abcdefg', undefined],
+    ['https://bsky.app/chat', undefined],
+    // wrong host
+    ['https://example.com/chat/abcdefg', undefined],
+    // not a url, not a path
+    ['chat/abcdefg', undefined],
+    ['abcdefg', undefined],
+    ['', undefined],
+    // malformed url
+    ['https://[invalid/chat/abcdefg', undefined],
+  ]
+
+  it.each(cases)('given input %p, returns %p', (input, expected) => {
+    expect(getChatInviteCodeFromUrl(input)).toEqual(expected)
+  })
+})

app.config.js

@@ -35,6 +35,13 @@ module.exports = function (_config) {
 
   const USE_SENTRY = Boolean(process.env.SENTRY_AUTH_TOKEN)
 
+  const IOS_ICON_FILE =
+    PLATFORM === 'web' // web build doesn't like .icon files
+      ? './assets/app-icons/ios_icon_default_next.png'
+      : IS_TESTFLIGHT
+        ? './assets/app-icons/ios_icon_testflight.icon'
+        : './assets/app-icons/ios_icon_default.icon'
+
   return {
     expo: {
       version: VERSION,
@@ -47,20 +54,19 @@ module.exports = function (_config) {
       },
       icon: './assets/app-icons/ios_icon_default_next.png',
       userInterfaceStyle: 'automatic',
-      primaryColor: '#1083fe',
-      newArchEnabled: false,
+      primaryColor: '#006AFF',
       ios: {
         supportsTablet: false,
         bundleIdentifier: 'xyz.blueskyweb.app',
+        appleTeamId: process.env.EXPO_APPLE_TEAM_ID,
         config: {
           usesNonExemptEncryption: false,
         },
-        icon:
-          PLATFORM === 'web' // web build doesn't like .icon files
-            ? './assets/app-icons/ios_icon_default_next.png'
-            : './assets/app-icons/ios_icon_default.icon',
+        icon: IOS_ICON_FILE,
         infoPlist: {
+          CADisableMinimumFrameDurationOnPhone: true,
           UIBackgroundModes: ['remote-notification'],
+          NSUserActivityTypes: ['INSendMessageIntent'],
           NSCameraUsageDescription:
             'Used for profile pictures, posts, and other kinds of content.',
           NSMicrophoneUsageDescription:
@@ -75,6 +81,7 @@ module.exports = function (_config) {
             'an',
             'ast',
             'ca',
+            'cs',
             'cy',
             'da',
             'de',
@@ -112,14 +119,15 @@ module.exports = function (_config) {
             'zh-Hans',
             'zh-Hant',
           ],
-          UIDesignRequiresCompatibility: true,
         },
         associatedDomains: ASSOCIATED_DOMAINS,
         entitlements: {
           'com.apple.developer.kernel.increased-memory-limit': true,
           'com.apple.developer.kernel.extended-virtual-addressing': true,
           'com.apple.security.application-groups': 'group.app.bsky',
+          'com.apple.developer.usernotifications.communication': true,
           // 'com.apple.developer.device-information.user-assigned-device-name': true,
+          'com.apple.developer.declared-age-range': true,
         },
         privacyManifests: {
           NSPrivacyCollectedDataTypes: [
@@ -256,9 +264,17 @@ module.exports = function (_config) {
               deploymentTarget: '15.1',
               buildReactNativeFromSource: true,
               ccacheEnabled: IS_DEV,
+              cxxLanguageStandard: 'c++23',
+              extraPods: [
+                {
+                  name: 'MCEmojiPicker',
+                  git: 'https://github.com/bluesky-social/MCEmojiPicker.git',
+                  branch: 'main',
+                },
+              ],
             },
             android: {
-              compileSdkVersion: 35,
+              compileSdkVersion: 36,
               targetSdkVersion: 35,
               buildToolsVersion: '35.0.0',
               buildReactNativeFromSource: IS_PRODUCTION,
@@ -286,7 +302,6 @@ module.exports = function (_config) {
         './plugins/withAndroidManifestFCMIconPlugin.js',
         './plugins/withAndroidManifestIntentQueriesPlugin.js',
         './plugins/withAndroidStylesAccentColorPlugin.js',
-        './plugins/withAndroidDayNightThemePlugin.js',
         './plugins/withAndroidNoJitpackPlugin.js',
         './plugins/shareExtension/withShareExtensions.js',
         './plugins/notificationsExtension/withNotificationsExtension.js',
@@ -336,7 +351,7 @@ module.exports = function (_config) {
           },
         ],
         [
-          '@mozzius/expo-dynamic-app-icon',
+          '@bsky.app/expo-dynamic-app-icon',
           {
             /**
              * Default set

assets/app-icons/README.md

@@ -0,0 +1,16 @@
+The app icons in this directory are trademarks of Bluesky Social
+PBC — the butterfly mark and its variants, as shipped to the iOS App Store and Google Play.
+
+**These are not covered by the [MIT license](../../LICENSE) that applies to the rest of this
+repository.** Use of Bluesky's marks is governed by our Trademark Policy and Brand Guidelines,
+not by the license on our source code.
+
+You may say that your app is a client for Bluesky, or that it is based on the Bluesky app. You
+may not use our marks as the identity of your own product, or in any way likely to suggest that
+Bluesky publishes, endorses, or supports it.
+
+If you are forking this repository, replace these files with your own icons. Shipping an app that
+looks like Bluesky is also a problem under the app stores' own rules on copycat apps, quite apart
+from trademark.
+
+See [`ASSETS.md`](../../ASSETS.md) for the full asset licensing picture.

assets/app-icons/ios_icon_testflight.icon/icon.json

@@ -0,0 +1,113 @@
+{
+  "fill" : {
+    "automatic-gradient" : "srgb:1.00000,1.00000,1.00000,1.00000"
+  },
+  "groups" : [
+    {
+      "blend-mode-specializations" : [
+        {
+          "value" : "overlay"
+        },
+        {
+          "appearance" : "dark",
+          "value" : "screen"
+        },
+        {
+          "appearance" : "tinted",
+          "value" : "screen"
+        }
+      ],
+      "blur-material-specializations" : [
+        {
+          "value" : 0.5
+        },
+        {
+          "appearance" : "dark",
+          "value" : 0.5
+        },
+        {
+          "appearance" : "tinted",
+          "value" : null
+        }
+      ],
+      "hidden" : false,
+      "layers" : [
+        {
+          "image-name" : "TestFlight notice.png",
+          "name" : "TestFlight notice"
+        }
+      ],
+      "lighting" : "individual",
+      "position" : {
+        "scale" : 0.4,
+        "translation-in-points" : [
+          0,
+          350
+        ]
+      },
+      "shadow" : {
+        "kind" : "neutral",
+        "opacity" : 0.5
+      },
+      "specular-specializations" : [
+        {
+          "value" : false
+        },
+        {
+          "appearance" : "dark",
+          "value" : false
+        },
+        {
+          "appearance" : "tinted",
+          "value" : false
+        }
+      ],
+      "translucency-specializations" : [
+        {
+          "value" : {
+            "enabled" : true,
+            "value" : 0.5
+          }
+        },
+        {
+          "appearance" : "dark",
+          "value" : {
+            "enabled" : true,
+            "value" : 0.5
+          }
+        },
+        {
+          "appearance" : "tinted",
+          "value" : {
+            "enabled" : true,
+            "value" : 0.5
+          }
+        }
+      ]
+    },
+    {
+      "layers" : [
+        {
+          "fill" : "none",
+          "glass" : false,
+          "image-name" : "iOS transparent.png",
+          "name" : "iOS transparent"
+        }
+      ],
+      "shadow" : {
+        "kind" : "neutral",
+        "opacity" : 0.5
+      },
+      "translucency" : {
+        "enabled" : true,
+        "value" : 0.5
+      }
+    }
+  ],
+  "supported-platforms" : {
+    "circles" : [
+      "watchOS"
+    ],
+    "squares" : "shared"
+  }
+}

assets/fonts/inter/OFL.txt

@@ -0,0 +1,92 @@
+Copyright (c) 2016 The Inter Project Authors (https://github.com/rsms/inter)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://openfontlicense.org/
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION AND CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

assets/fonts/inter/README.md

@@ -0,0 +1,15 @@
+[Inter](https://rsms.me/inter/) is a typeface by Rasmus
+Andersson, licensed under the SIL Open Font License, Version 1.1.
+
+The full license text is in [`OFL.txt`](./OFL.txt) and must travel with these files.
+
+```
+Copyright (c) 2016 The Inter Project Authors (https://github.com/rsms/inter)
+```
+
+**You may redistribute these files.** Nothing in [`ASSETS.md`](../../../ASSETS.md) restricts them
+— they are here because the OFL requires the license text to accompany the font, not because they
+are carved out of our [MIT license](../../../LICENSE).
+
+**One thing to watch:** OFL 1.1 includes a Reserved Font Name provision. If you modify or subset
+the font, you may not distribute the result under the name "Inter."

assets/icons/README.md

@@ -0,0 +1,23 @@
+The user-interface glyphs in this directory are from the
+[Central icon system](https://iconists.co/central) by Iconists (David & Storm GbR). Bluesky
+Social PBC licenses them for use in our own products. **That license is for our own use, and it
+does not extend to you.**
+
+**These icons are not covered by the [MIT license](../../LICENSE) that applies to the rest of
+this repository.** If you want to use them, buy a license from
+[iconists.co](https://iconists.co). There are also good openly licensed icon sets if you would
+rather not.
+
+This notice covers the SVG files at the top level of this directory. It does not cover:
+
+- `flags/` — country-flag-icons, MIT licensed, see [`flags/README.md`](./flags/README.md)
+- `community/` — third-party service marks, see [`community/README.md`](./community/README.md)
+- `logomark.svg`, `newskie.svg`, `verifiedCheck.svg`, `verifierCheck.svg`, `starterPack.svg`,
+  `starterPack_stroke2_corner0_rounded.svg` — Bluesky trademarks and brand assets
+- `custom_logo_japan.svg` — artwork by a Bluesky Japan logo contest entrant
+- `apple_logo.svg`, `android_logo.svg` — Apple and Google trademarks
+
+Each of those is described in [`ASSETS.md`](../../ASSETS.md).
+
+Adding an icon here? If it came from Central, this notice already covers it. If it came from
+anywhere else, add it to `ASSETS.md` so the notice does not go stale.

assets/icons/arrowBoxRight_stroke2_corner3_rounded.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><path fill="#000" d="M17 3a4 4 0 0 1 4 4v10a4 4 0 0 1-4 4h-2a1 1 0 1 1 0-2h2a2 2 0 0 0 2-2V7a2 2 0 0 0-2-2h-2a1 1 0 1 1 0-2h2Zm-6.707 4.793a1 1 0 0 1 1.414 0l3.5 3.5a1 1 0 0 1 0 1.414l-3.5 3.5a1 1 0 1 1-1.414-1.414L12.086 13H4a1 1 0 1 1 0-2h8.086l-1.793-1.793a1 1 0 0 1 0-1.414Z"/></svg>

assets/icons/arrowCornerDownRight_stroke2_corner3_rounded.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><path fill="#000" d="M5 5a1 1 0 0 0-2 0v4a7 7 0 0 0 7 7h8.086l-2.293 2.293a1 1 0 0 0 1.414 1.414l2.94-2.94a2.5 2.5 0 0 0 0-3.535l-2.94-2.94a1 1 0 1 0-1.414 1.415L18.086 14H10a5 5 0 0 1-5-5V5Z"/></svg>

assets/icons/bookmarkFilled.svg

@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><path fill="#006AFF" d="M16 2.5a4 4 0 0 1 4 4v12.995c0 1.62-1.825 2.567-3.15 1.636l-3.7-2.6a2 2 0 0 0-2.3 0l-3.7 2.6C5.825 22.062 4 21.115 4 19.495V6.5a4 4 0 0 1 4-4h8Z"/></svg>
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><path fill="#006aff" d="M16 2.5a4 4 0 0 1 4 4v12.995c0 1.62-1.825 2.567-3.15 1.636l-3.7-2.6a2 2 0 0 0-2.3 0l-3.7 2.6C5.825 22.062 4 21.115 4 19.495V6.5a4 4 0 0 1 4-4h8Z"/></svg>

assets/icons/bot_filled.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><path fill="#000" fill-rule="evenodd" d="M12 0a2 2 0 0 1 1 3.73V5h4.2c1.68 0 2.52 0 3.162.327a3 3 0 0 1 1.31 1.31C22 7.28 22 8.12 22 9.8v.25a2.501 2.501 0 0 1 0 4.9V15c0 2.8 0 4.2-.545 5.27a5 5 0 0 1-2.185 2.185C18.2 23 16.8 23 14 23h-4c-2.8 0-4.2 0-5.27-.545a5 5 0 0 1-2.185-2.185C2 19.2 2 17.8 2 15v-.05a2.5 2.5 0 0 1 0-4.9V9.8c0-1.68 0-2.52.327-3.162a3 3 0 0 1 1.31-1.31C4.28 5 5.12 5 6.8 5H11V3.73A2 2 0 0 1 12 0M8 10a2 2 0 0 0-2 2v2a2 2 0 1 0 4 0v-2a2 2 0 0 0-2-2m8 0a2 2 0 0 0-2 2v2a2 2 0 1 0 4 0v-2a2 2 0 0 0-2-2" clip-rule="evenodd"/></svg>

assets/icons/bot_stroke.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><path fill="#000" d="M12 2a1 1 0 0 1 1 1v2h3.2l1.113.005c.975.015 1.568.077 2.05.322a3 3 0 0 1 1.31 1.31C21 7.28 21 8.12 21 9.8v.287a1.498 1.498 0 0 1-.005 2.827c-.006 2.204-.058 3.41-.54 4.356l-.093.174a5 5 0 0 1-2.092 2.011l-.205.096c-.766.33-1.72.417-3.21.44L13 20h-2l-1.854-.009c-1.49-.023-2.445-.11-3.211-.44l-.205-.096a5 5 0 0 1-2.185-2.185c-.409-.803-.51-1.79-.536-3.415l-.005-.94A1.498 1.498 0 0 1 3 10.086V9.8c0-1.575 0-2.412.27-3.04l.057-.122a3 3 0 0 1 1.105-1.196l.206-.115C5.279 5 6.12 5 7.8 5H11V3a1 1 0 0 1 1-1M7.8 7c-.873 0-1.408.002-1.808.034a3 3 0 0 0-.367.051l-.063.018-.016.006a1 1 0 0 0-.437.437l-.006.016-.018.063a3 3 0 0 0-.05.367C5.001 8.392 5 8.927 5 9.8V12c0 1.433.002 2.388.062 3.121.058.71.16 1.036.265 1.241a3 3 0 0 0 1.31 1.31c.207.106.532.209 1.242.267.733.06 1.688.061 3.121.061h2c1.433 0 2.388-.002 3.121-.061.71-.058 1.036-.161 1.241-.266a3 3 0 0 0 1.31-1.31c.106-.206.209-.532.267-1.242.06-.733.061-1.688.061-3.121V9.8c0-.873-.002-1.408-.034-1.808a2.5 2.5 0 0 0-.051-.367l-.017-.063-.007-.016a1 1 0 0 0-.437-.437l-.015-.006-.064-.018a3 3 0 0 0-.367-.05C17.608 7.001 17.073 7 16.2 7zM9 10a1 1 0 0 1 1 1v2a1 1 0 1 1-2 0v-2a1 1 0 0 1 1-1m6 0a1 1 0 0 1 1 1v2a1 1 0 1 1-2 0v-2a1 1 0 0 1 1-1"/></svg>

assets/icons/bubbleSmile_stroke2_corner0_rounded_large.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 64 64"><path fill="#111822" d="M55 32C55 19.298 44.703 9 32 9S9 19.298 9 32c0 3.463.765 6.745 2.134 9.688.358.769.479 1.658.267 2.525l-2.076 8.51a1.667 1.667 0 0 0 1.987 2.02l8.876-2.005a3.84 3.84 0 0 1 2.412.26A22.9 22.9 0 0 0 32 55c12.703 0 23-10.297 23-23Zm2 0c0 13.807-11.193 25-25 25-3.638 0-7.098-.778-10.219-2.177a1.84 1.84 0 0 0-1.152-.133l-8.877 2.004c-2.655.6-5.015-1.802-4.37-4.446l2.077-8.51a1.84 1.84 0 0 0-.139-1.207A24.9 24.9 0 0 1 7 32C7 18.193 18.193 7 32 7s25 11.193 25 25Z"/><path fill="#111822" d="M17.667 32a2.333 2.333 0 1 0 4.667 0 2.333 2.333 0 0 0-4.667 0Zm24 0a2.334 2.334 0 1 0 4.667 0 2.334 2.334 0 0 0-4.667 0Z"/><path fill="#000" d="M35.137 37.215a1 1 0 0 1 1.414 1.414 6.143 6.143 0 0 1-8.687 0 1 1 0 0 1 1.415-1.414 4.14 4.14 0 0 0 5.858 0Z"/></svg>

assets/icons/chainLinkBroken_stroke2_corner0_rounded.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><path fill="#000" d="M14.3 23v-1.1a1 1 0 0 1 2 0V23a1 1 0 1 1-2 0Zm5.243-3.457a1 1 0 0 1 1.414 0l1.1 1.1a1 1 0 1 1-1.414 1.414l-1.1-1.1a1 1 0 0 1 0-1.414ZM4.788 9.298a1 1 0 0 1 1.424 1.404l-.742.752-.004.005a5.003 5.003 0 1 0 7.075 7.075l.005-.004.752-.742a1 1 0 0 1 1.404 1.424l-.747.736a7.003 7.003 0 1 1-9.904-9.904l.737-.746ZM23 14.3a1 1 0 0 1 0 2h-1.1a1 1 0 1 1 0-2H23ZM10.044 4.05a7.005 7.005 0 0 1 9.905 9.906h0l-.737.746a1 1 0 0 1-1.424-1.404l.742-.752.004-.005a5.003 5.003 0 1 0-7.075-7.075l-.005.004-.752.742a1 1 0 0 1-1.404-1.424l.746-.737ZM2.1 7.7a1 1 0 1 1 0 2H1a1 1 0 0 1 0-2h1.1Zm-.157-5.757a1 1 0 0 1 1.414 0l1.1 1.1a1 1 0 1 1-1.414 1.414l-1.1-1.1a1 1 0 0 1 0-1.414ZM7.7 2.1V1a1 1 0 1 1 2 0v1.1a1 1 0 0 1-2 0Z"/></svg>

assets/icons/community/README.md

@@ -0,0 +1,14 @@
+The icons in this directory are the marks of third-party
+services that appear in the Bluesky app — [Leaflet](https://leaflet.pub),
+[Offprint](https://offprint.net), [pckt](https://pckt.blog), [Standard.site](https://standard.site), and
+[Germ Network](https://germnetwork.com).
+
+**These marks belong to their respective owners.** They are not Bluesky trademarks, they are not
+covered by the [MIT license](../../../LICENSE) that applies to the rest of this repository, and we
+are not in a position to grant or withhold permission to use them. We include them to identify
+those services in our UI.
+
+If you fork this repository and keep these icons, your use of them rests on your own
+nominative-use basis or on permission from the mark owner.
+
+See [`ASSETS.md`](../../../ASSETS.md) for the full asset licensing picture.