Bump mediabunny to 1.49.0 in lockfile

Mediabunny shipped 1.49.0 since this PR was first committed; the lockfile check ("No manual pnpm-lock.yaml edits") was failing because a fresh `pnpm install --no-frozen-lockfile` would resolve to 1.49.0 within our `^1.25.3` range. Matches what CI expects from a fresh install against main's lockfile.
Address review: extract shared compression constants, log empty output
2026-06-23 11:23:00 -04:00 · 2026-06-23 11:09:10 -04:00 · 2026-06-18 17:59:36 -04:00 · 2026-06-18 17:51:19 -04:00 · 2026-06-18 17:51:19 -04:00 · 2026-06-18 10:13:41 -05:00
554 changed files with 168223 additions and 87196 deletions
@@ -0,0 +1 @@
+alt-blur@3076a2b5a593b0d7b37198b5aebfe3a222afd52d
@@ -0,0 +1,63 @@
+You are an experienced senior React Native engineer reviewing a pull
+request in the Bluesky Social app — a cross-platform (iOS, Android, Web)
+React Native + Expo application. Read the repo's CLAUDE.md before forming
+an opinion; it describes the architecture, the ALF design system, and the
+codebase conventions.
+
+Your audience is other senior engineers. Write peer-to-peer, not
+teacher-to-junior. Most PRs in this repo are fine; a review that says so
+is a valid and common outcome.
+
+Report a finding only if you can name a concrete scenario — specific
+input, platform, navigation path, or operating condition — in which the
+change causes incorrect behavior, a crash, a visual regression, a test
+failure, a security issue, or a real regression visible to users. Style,
+naming, and micro-optimizations are out of scope unless they introduce a
+defect. Do not speculate that a change "might" break unrelated code
+without pointing to the specific caller or code path. Do not repeat what
+the diff does.
+
+Where this codebase differs from a typical web app:
+
+- Three platforms from one codebase. Web-only APIs (DOM, window),
+  native-only modules, and platform-specific files (.web.tsx, .ios.tsx,
+  .android.tsx) are common sources of single-platform breakage. When a
+  change touches shared code, consider all three targets.
+- User-facing strings must go through Lingui (the `Trans` macro /
+  `useLingui`). Hardcoded English strings in UI are a finding. Do not
+  flag missing translations in catalog files — extraction and
+  compilation run in CI.
+- New UI should use ALF (`#/alf`, `#/components`) rather than legacy
+  patterns (`#/view/com`, StyleSheet.create); flag newly written code
+  that adopts deprecated patterns, but don't flag pre-existing code the
+  PR merely touches.
+- Server state lives in TanStack Query under src/state/queries. Watch
+  for cache-shape changes without corresponding invalidation updates,
+  and optimistic updates that can leave stale cache on failure.
+- List rendering is performance-critical (the main feed). Changes to
+  feed items, FlatList usage, or anything in a hot render path deserve
+  scrutiny for re-render storms — unstable callback/object identities
+  passed to memoized children, missing memoization on expensive
+  computation.
+- Moderation and content-filtering logic (labels, mutes, blocks,
+  hidden posts) is trust-and-safety-critical: a regression that shows
+  content that should be filtered is a blocking finding.
+- Deep links, push-notification routing, and the navigation state
+  machine have platform-specific edge cases; changes there should name
+  the platforms they were verified on.
+- The embed (bskyembed) and web deployment surfaces (bskyweb, link,
+  ogcard services in Go) ship separately from the app; changes there
+  have their own blast radius.
+
+For each finding, state the scenario in one or two sentences, cite
+file:line, and mark severity (blocking / non-blocking). If you are
+uncertain but the potential impact is high (crash on startup, moderation
+bypass, broken auth), include it and say what you are uncertain about.
+Otherwise, prefer silence over guessing.
+
+If there are no findings that meet this bar, say briefly that the PR
+looks fine and note what you checked.
+
+Post your review as a single top-level PR comment. Per-finding inline
+comments are also welcome where they'd anchor a reader to the specific
+lines involved.
@@ -0,0 +1,44 @@
+version: 2
+# Dependabot auto-update config.
+#
+# Cooldown (7 days) is the point of this config: it delays version-update
+# PRs until a newly-published version has aged. Supply-chain attacks like
+# the tanstack Shai-Hulud compromise (2026-05-11) live minutes-to-hours
+# before the registry yanks them; a 7-day cooldown keeps poisoned
+# versions out of our lockfiles.
+#
+# Security updates bypass cooldown and continue to flow immediately. See:
+# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown
+#
+# Auto-merge is deliberately NOT enabled. Every dependabot PR gets human
+# review.
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    groups:
+      production:
+        dependency-type: production
+        update-types: [minor, patch]
+      development:
+        dependency-type: development
+        update-types: [minor, patch]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 3
+    groups:
+      actions:
+        patterns: ["*"]
+        update-types: [minor, patch]
@@ -22,13 +22,13 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ env.USERNAME}}
@@ -36,7 +36,7 @@ jobs:

      - name: Extract Docker metadata
        id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -51,7 +51,7 @@ jobs:

      - name: Build and push Docker image
        id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
@@ -23,13 +23,13 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ env.USERNAME }}
@@ -37,7 +37,7 @@ jobs:

      - name: Extract Docker metadata
        id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -46,7 +46,7 @@ jobs:

      - name: Build and push Docker image
        id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
@@ -22,13 +22,13 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ env.USERNAME}}
@@ -36,7 +36,7 @@ jobs:

      - name: Extract Docker metadata
        id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -45,7 +45,7 @@ jobs:

      - name: Build and push Docker image
        id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
@@ -22,13 +22,13 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ env.USERNAME}}
@@ -36,7 +36,7 @@ jobs:

      - name: Extract Docker metadata
        id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -45,7 +45,7 @@ jobs:

      - name: Build and push Docker image
        id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          push: true
@@ -22,13 +22,13 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ env.USERNAME}}
@@ -36,7 +36,7 @@ jobs:

      - name: Extract Docker metadata
        id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -45,7 +45,7 @@ jobs:

      - name: Build and push Docker image
        id: build-and-push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          push: true
@@ -10,6 +10,23 @@ on:
        options:
          - testflight-android
          - production
+  workflow_call:
+    inputs:
+      profile:
+        type: string
+        description: Build profile to use
+        required: true
+    outputs:
+      package-version:
+        description: Version from package.json
+        value: ${{ jobs.build.outputs.package-version }}
+      version-code:
+        description: Android version code
+        value: ${{ jobs.build.outputs.version-code }}
+
+# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
+permissions:
+  contents: read

 jobs:
  build:
@@ -19,6 +36,10 @@ jobs:
    concurrency:
      group: android-build
      cancel-in-progress: false
+    outputs:
+      package-version: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
+      version-code: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}
+      apk-artifact-name: build-${{ steps.timestamp.outputs.time }}.apk
    steps:
      - name: Check for EXPO_TOKEN
        run: >
@@ -28,32 +49,32 @@ jobs:
          fi

      - name: ⬇️ Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 5

-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

      - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: .nvmrc
+          node-version-file: package.json
          cache: pnpm

      - name: 🪛 Setup jq
-        uses: dcarbone/install-jq-action@v2
+        uses: dcarbone/install-jq-action@b7ef57d46ece78760b4019dbc4080a1ba2a40b45 # v3.2.0

      - name: ⚙️ Install dependencies
        run: pnpm install --frozen-lockfile

      - name: 🔨 Setup Expo CLI
-        uses: expo/expo-github-action@main
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
        with:
          eas-version: '19.0.5'
          packager: 'pnpm --allow-build=dtrace-provider'
          token: ${{ secrets.EXPO_TOKEN }}

-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: "temurin"
          java-version: "17"
@@ -62,7 +83,8 @@ jobs:
        run: pnpm intl:build 2>&1 | tee i18n.log

      - name: Check for i18n compilation errors
-        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
+        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation
+          errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi

      # EXPO_PUBLIC_ENV is handled in eas.json
      - name: Env
@@ -92,99 +114,76 @@ jobs:
          --profile $PROFILE
          --local --output build.aab --non-interactive

-      - name: ✍️ Rename Testflight bundle
-        if: ${{ inputs.profile != 'production' }}
-        run: mv build.aab build.apk
-
-      - name: ⏰ Get a timestamp
-        id: timestamp
-        uses: nanzm/get-time-action@master
-        with:
-          format: "MM-DD-HH-mm-ss"
-
-      - name: 🚀 Upload Production Artifact
-        id: upload-artifact-production
-        if: ${{ inputs.profile == 'production' }}
-        uses: actions/upload-artifact@v7
-        with:
-          retention-days: 30
-          compression-level: 6
-          name: build-${{ steps.timestamp.outputs.time }}.aab
-          path: build.aab
-
-      - name: 🚀 Upload Testflight Artifact
-        id: upload-artifact-testflight
-        if: ${{ inputs.profile != 'production' }}
-        uses: actions/upload-artifact@v7
-        with:
-          retention-days: 30
-          compression-level: 6
-          name: build-${{ steps.timestamp.outputs.time }}.apk
-          path: build.apk
-
      - name: 📚 Get version from package.json
        id: get-build-info
        run: bash scripts/setGitHubOutput.sh

-      - name: 🔔 Notify Slack of Production Build
+      - name: 🚀 Submit to Google Play
+        env:
+          PROFILE: ${{ inputs.profile || 'testflight-android' }}
+        run: pnpm eas submit -p android --profile $PROFILE --non-interactive --path build.aab
+
+      - name: 🔔 Notify Slack of Play Store Submission
        if: ${{ inputs.profile == 'production' }}
-        uses: slackapi/slack-github-action@v2.1.1
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
        with:
          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
          webhook-type: incoming-webhook
          payload-templated: true
          payload: |
-            {"text": "Android production build for Google Play Store submission is ready!\n```Artifact: ${{ steps.upload-artifact-production.outputs.artifact-url }}\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}```"}
+            {"text": "Android ${{ inputs.profile || 'testflight-android' }} build submitted to Google Play!\n```Version Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}```"}

-      - name: 🔔 Notify Slack of Testflight Build
-        if: ${{ inputs.profile != 'production' }}
-        uses: slackapi/slack-github-action@v2.1.1
+      - name: 🔧 Setup bundletool
+        uses: amyu/setup-bundletool@cc2e1857284660bd625e43f2c8a45626f034302f # v1.1
        with:
-          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
-          webhook-type: incoming-webhook
-          payload-templated: true
-          payload: |
-            {"text": "Android build is ready for testing. Download the artifact here: ${{ steps.upload-artifact-testflight.outputs.artifact-url }}"}
+          bundletool-version: "1.17.2"

-      - name: 🧹 Clear Metro cache
-        if: ${{ inputs.profile == 'production' }}
-        # https://github.com/expo/eas-cli/issues/2959#issuecomment-2749791326
-        run: rm -rf ${TMPDIR:-/tmp}/metro-cache
+      - name: 🔑 Decode keystore
+        run: echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 --decode >
+          keystore.jks

-      - name: 🏗️ Build Production APK
-        if: ${{ inputs.profile == 'production' }}
-        run: >
-          SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
-          pnpm use-build-number-with-bump
-          pnpm eas build -p android
-          --profile production-apk
-          --local --output build.apk --non-interactive
+      - name: 📦 Build signed universal APK
+        run: |
+          bundletool build-apks \
+            --bundle=build.aab \
+            --output=universal.apks \
+            --mode=universal \
+            --ks=keystore.jks \
+            --ks-pass=pass:${{ secrets.ANDROID_KEYSTORE_PASSWORD }} \
+            --ks-key-alias=${{ secrets.ANDROID_KEY_ALIAS }} \
+            --key-pass=pass:${{ secrets.ANDROID_KEY_PASSWORD }}

-      - name: 🚀 Upload Production APK Artifact
-        id: upload-artifact-production-apk
-        if: ${{ inputs.profile == 'production' }}
-        uses: actions/upload-artifact@v7
+      - name: 📋 Rename to .zip for extraction
+        run: mv universal.apks universal.zip
+
+      - name: 📦 Extract universal APK
+        run: unzip -p universal.zip universal.apk > build.apk
+
+      - name: ⏰ Get a timestamp
+        id: timestamp
+        run: echo "time=$(date -u +'%m-%d-%H-%M-%S')" >> "$GITHUB_OUTPUT"
+
+      - name: 🚀 Upload APK Artifact
+        id: upload-artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          retention-days: 30
          compression-level: 6
          name: build-${{ steps.timestamp.outputs.time }}.apk
          path: build.apk

-      - name: 🔔 Notify Slack of Production APK Build
-        if: ${{ inputs.profile == 'production' }}
-        uses: slackapi/slack-github-action@v2.1.1
+      - name: 🔔 Notify Slack of APK Artifact
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
        with:
          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
          webhook-type: incoming-webhook
          payload-templated: true
          payload: |
-            {"text": "Android production build for GitHub/Obtanium is ready!\n```Artifact: ${{ steps.upload-artifact-production-apk.outputs.artifact-url }}\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}```"}
+            {"text": "Android ${{ inputs.profile || 'testflight-android' }} APK is ready for testing!\n```Artifact: ${{ steps.upload-artifact.outputs.artifact-url }}\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}```"}

      - name: ⬇️ Restore Cache
        id: get-base-commit
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        if: ${{ inputs.profile == 'testflight-android' }}
        with:
          path: most-recent-testflight-commit.txt
@@ -195,3 +194,62 @@ jobs:
        env:
          GITHUB_SHA: ${{ github.sha }}
        run: echo $GITHUB_SHA > most-recent-testflight-commit.txt
+
+  # Releases are cut from tags named after the version (e.g. "1.124.0"), so when a production
+  # build is dispatched against such a tag we attach the APK to the matching release. This runs
+  # as a separate job so that `contents: write` is isolated here and the build job stays read-only.
+  attachToRelease:
+    name: Attach APK to GitHub Release
+    runs-on: ubuntu-latest
+    needs: [build]
+    if: ${{ inputs.profile == 'production' && github.ref_type == 'tag' && github.repository == 'bluesky-social/social-app' }}
+    permissions:
+      contents: write
+    steps:
+      # We only attach to a release that already exists — never create one.
+      - name: 🔎 Check for matching GitHub Release
+        id: release-check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          status=$(curl -sS -o /dev/null -w '%{http_code}' \
+            -H "Authorization: Bearer $GH_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}")
+          if [ "$status" = "200" ]; then
+            echo "Found GitHub Release for tag $TAG"
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "No GitHub Release found for tag $TAG (HTTP $status); skipping APK attachment."
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: ⬇️ Download APK artifact
+        if: ${{ steps.release-check.outputs.exists == 'true' }}
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: ${{ needs.build.outputs.apk-artifact-name }}
+
+      - name: 🏷️ Rename APK for release
+        if: ${{ steps.release-check.outputs.exists == 'true' }}
+        run: cp build.apk "Bluesky-${{ needs.build.outputs.package-version }}.apk"
+
+      - name: 📎 Attach APK to GitHub Release
+        id: attach
+        if: ${{ steps.release-check.outputs.exists == 'true' }}
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        with:
+          tag_name: ${{ github.ref_name }}
+          files: Bluesky-${{ needs.build.outputs.package-version }}.apk
+          fail_on_unmatched_files: true
+
+      - name: 🔔 Notify Slack of Release Attachment
+        if: ${{ steps.release-check.outputs.exists == 'true' }}
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
+        with:
+          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload-templated: true
+          payload: |
+            {"text": "Android APK attached to GitHub Release ${{ github.ref_name }}!\n```Asset: Bluesky-${{ needs.build.outputs.package-version }}.apk\nRelease: ${{ steps.attach.outputs.url }}```"}
@@ -10,6 +10,31 @@ on:
        options:
          - testflight
          - production
+      assignTestFlightGroup:
+        type: boolean
+        description: Assign the build to the "QA Team" TestFlight group after submitting
+        default: false
+  workflow_call:
+    inputs:
+      profile:
+        type: string
+        description: Build profile to use
+        required: true
+      assignTestFlightGroup:
+        type: boolean
+        description: Assign the build to the "QA Team" TestFlight group after submitting
+        default: false
+    outputs:
+      package-version:
+        description: Version from package.json
+        value: ${{ jobs.build.outputs.package-version }}
+      build-number:
+        description: iOS build number
+        value: ${{ jobs.build.outputs.build-number }}
+
+# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
+permissions:
+  contents: read

 jobs:
  build:
@@ -19,6 +44,9 @@ jobs:
    concurrency:
      group: ios-build
      cancel-in-progress: false
+    outputs:
+      package-version: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
+      build-number: ${{ steps.ipa-build-number.outputs.build-number }}
    steps:
      - name: Check for EXPO_TOKEN
        run: >
@@ -28,42 +56,48 @@ jobs:
          fi

      - name: ⬇️ Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 5

-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

      - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: .nvmrc
+          node-version-file: package.json
          cache: pnpm

      - name: 🪛 Setup jq
-        uses: dcarbone/install-jq-action@v2
+        uses: dcarbone/install-jq-action@b7ef57d46ece78760b4019dbc4080a1ba2a40b45 # v3.2.0

      - name: ⚙️ Install dependencies
        run: pnpm install --frozen-lockfile

      - name: 🔨 Setup Expo CLI
-        uses: expo/expo-github-action@main
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
        with:
          eas-version: '19.0.5'
          packager: 'pnpm --allow-build=dtrace-provider'
          token: ${{ secrets.EXPO_TOKEN }}

-      - uses: maxim-lobanov/setup-xcode@v1
+      - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
        with:
          xcode-version: "26.4"

-      - name: ☕️ Setup Cocoapods
-        uses: maxim-lobanov/setup-cocoapods@v1
-        with:
-          version: 1.16.2
+      - name: ☕️ Assert Cocoapods version
+        run: |
+          EXPECTED=1.16.2
+          ACTUAL=$(pod --version)
+          if [ "$ACTUAL" != "$EXPECTED" ]; then
+            echo "Expected Cocoapods $EXPECTED but runner has $ACTUAL."
+            echo "The version ships preinstalled with the macOS runner image: https://github.com/actions/runner-images/blob/main/images/macos/macos-26-Readme.md"
+            echo "If the runner image changed, update EXPECTED here or reinstall the pinned version."
+            exit 1
+          fi

      - name: 💾 Cache Pods
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        id: pods-cache
        with:
          path: ./ios/Pods
@@ -75,7 +109,8 @@ jobs:
        run: pnpm intl:build 2>&1 | tee i18n.log

      - name: Check for i18n compilation errors
-        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
+        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation
+          errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi

      # EXPO_PUBLIC_ENV is handled in eas.json
      - name: ✏️ Write environment variables
@@ -153,19 +188,75 @@ jobs:
        id: get-build-info
        run: bash scripts/setGitHubOutput.sh

+      # Read the build number straight from the IPA's CFBundleVersion. This is the value
+      # baked in at build time by use-build-number-with-bump (remote counter + 1) and the
+      # number that actually lands in App Store Connect. `eas build:version:get` reads the
+      # remote counter, which a --local build does not advance, so it can be off by one —
+      # using it here would make distribute_only poll for a nonexistent build.
+      - name: 🔢 Read build number from IPA
+        id: ipa-build-number
+        run: |
+          plist_dir="$(mktemp -d)"
+          unzip -o -q "$BUILD_DIR/Bluesky.ipa" 'Payload/*.app/Info.plist' -d "$plist_dir"
+          plist="$(find "$plist_dir" -name Info.plist -print -quit)"
+          build_number="$(/usr/libexec/PlistBuddy -c 'Print CFBundleVersion' "$plist")"
+          rm -rf "$plist_dir"
+          if [ -z "$build_number" ]; then
+            echo "ERROR: could not read CFBundleVersion from IPA"
+            exit 1
+          fi
+          echo "IPA build number: $build_number"
+          echo "build-number=$build_number" >> "$GITHUB_OUTPUT"
+
+      # eas submit only uploads to App Store Connect; it can't assign a build to a
+      # TestFlight group. fastlane's distribute_only mode skips the upload and assigns the
+      # already-submitted build to the group, polling until Apple finishes processing it.
+      - name: 🧪 Assign build to TestFlight group
+        if: ${{ inputs.assignTestFlightGroup }}
+        env:
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+          ASC_KEY_P8_BASE64: ${{ secrets.ASC_KEY_P8_BASE64 }}
+          APP_VERSION: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
+          BUILD_NUMBER: ${{ steps.ipa-build-number.outputs.build-number }}
+        run: |
+          # Ensure the API key material is removed even if fastlane exits non-zero
+          # (the step runs under `bash -e`, which would otherwise abort before cleanup).
+          trap 'rm -f asc_api_key.json' EXIT
+          # fastlane's Token.from_json_file expects the .p8 contents inline under "key"
+          # (PEM with embedded newlines), not a path. jq handles the newline escaping.
+          key_content="$(echo "$ASC_KEY_P8_BASE64" | base64 --decode)"
+          jq -n \
+            --arg key_id "$ASC_KEY_ID" \
+            --arg issuer_id "$ASC_ISSUER_ID" \
+            --arg key "$key_content" \
+            '{key_id: $key_id, issuer_id: $issuer_id, key: $key, in_house: false}' \
+            > asc_api_key.json
+          # app_platform is required in non-interactive mode: distribute_only otherwise
+          # calls fetch_app_platform, which prompts for input and crashes without a TTY.
+          fastlane run upload_to_testflight \
+            api_key_path:"$PWD/asc_api_key.json" \
+            distribute_only:true \
+            app_platform:"ios" \
+            app_identifier:"xyz.blueskyweb.app" \
+            app_version:"$APP_VERSION" \
+            build_number:"$BUILD_NUMBER" \
+            groups:"QA Team" \
+            notify_external_testers:true
+
      - name: 🔔 Notify Slack of Production Build
        if: ${{ inputs.profile == 'production' }}
-        uses: slackapi/slack-github-action@v2.1.1
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
        with:
          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
          webhook-type: incoming-webhook
          payload-templated: true
          payload: |
-            {"text": "iOS production build for App Store submission is ready!\n```Artifact: Check TestFlight to know when it is available\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.get-build-info.outputs.BSKY_IOS_BUILD_NUMBER }}```"}
+            {"text": "iOS production build for App Store submission is ready!\n```Artifact: Check TestFlight to know when it is available\nVersion Number: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}\nBuild Number: ${{ steps.ipa-build-number.outputs.build-number }}```"}

      - name: ⬇️ Restore Cache
        id: get-base-commit
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        if: ${{ inputs.profile == 'testflight' }}
        with:
          path: most-recent-testflight-commit.txt
@@ -18,6 +18,10 @@ on:
        description: Runtime version (in x.x.x format) that this update is for
        required: true

+# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
+permissions:
+  contents: read
+
 jobs:
  bundleDeploy:
    if: github.repository == 'bluesky-social/social-app'
@@ -48,7 +52,7 @@ jobs:
          fi

      - name: ⬇️ Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0

@@ -56,38 +60,39 @@ jobs:
        if: ${{ github.ref != 'refs/heads/main' }}
        run: git fetch origin main:main --depth 100

-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

      - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: .nvmrc
+          node-version-file: package.json
          cache: pnpm

      - name: 📷 Check fingerprint and install dependencies
        id: fingerprint
-        uses: bluesky-social/github-actions/fingerprint-native@main
+        uses: bluesky-social/github-actions/fingerprint-native@ebc6aa6d7466dc1e78b1e832041b7b81f6f95030 # v0.1.0
        with:
          profile: ${{ inputs.channel || 'testflight' }}
          previous-commit-tag: ${{ inputs.runtimeVersion }}

+      - name: 🔤 Compile translations
+        run: pnpm intl:build 2>&1 | tee i18n.log
+
+      - name: Check for i18n compilation errors
+        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation
+          errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
+
      - name: Lint check
        run: pnpm lint

      - name: Prettier check
        run: pnpm prettier --check .

-      - name: 🔤 Compile translations
-        run: pnpm intl:build 2>&1 | tee i18n.log
-
-      - name: Check for i18n compilation errors
-        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi
-
      - name: Type check
        run: pnpm typecheck

      - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@main
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
        if: ${{ !steps.fingerprint.outputs.includes-changes }}
        with:
          eas-version: '19.0.5'
@@ -96,7 +101,7 @@ jobs:

      - name: 🪛 Setup jq
        if: ${{ !steps.fingerprint.outputs.includes-changes }}
-        uses: dcarbone/install-jq-action@v2
+        uses: dcarbone/install-jq-action@b7ef57d46ece78760b4019dbc4080a1ba2a40b45 # v3.2.0

      # eas.json not used here, set EXPO_PUBLIC_ENV
      - name: Env
@@ -137,7 +142,7 @@ jobs:

      - name: ⬇️ Restore Cache
        id: get-base-commit
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        if: ${{ !steps.fingerprint.outputs.includes-changes }}
        with:
          path: most-recent-testflight-commit.txt
@@ -157,7 +162,9 @@ jobs:
    needs: [bundleDeploy]
    # Gotta check if its NOT '[]' because any md5 hash in the outputs is detected as a possible secret and won't be
    # available here
-    if: ${{ inputs.channel != 'production' && needs.bundleDeploy.outputs.changes-detected && github.repository == 'bluesky-social/social-app' }}
+    if: ${{ inputs.channel != 'production' &&
+      needs.bundleDeploy.outputs.changes-detected && github.repository ==
+      'bluesky-social/social-app' }}
    steps:
      - name: Check for EXPO_TOKEN
        run: >
@@ -167,20 +174,20 @@ jobs:
          fi

      - name: ⬇️ Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 5

-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

      - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: .nvmrc
+          node-version-file: package.json
          cache: pnpm

      - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@main
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
        with:
          eas-version: '19.0.5'
          packager: 'pnpm --allow-build=dtrace-provider'
@@ -189,17 +196,23 @@ jobs:
      - name: ⚙️ Install dependencies
        run: pnpm install --frozen-lockfile

-      - uses: maxim-lobanov/setup-xcode@v1
+      - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
        with:
          xcode-version: "26.4"

-      - name: ☕️ Setup Cocoapods
-        uses: maxim-lobanov/setup-cocoapods@v1
-        with:
-          version: 1.16.2
+      - name: ☕️ Assert Cocoapods version
+        run: |
+          EXPECTED=1.16.2
+          ACTUAL=$(pod --version)
+          if [ "$ACTUAL" != "$EXPECTED" ]; then
+            echo "Expected Cocoapods $EXPECTED but runner has $ACTUAL."
+            echo "The version ships preinstalled with the macOS runner image: https://github.com/actions/runner-images/blob/main/images/macos/macos-26-Readme.md"
+            echo "If the runner image changed, update EXPECTED here or reinstall the pinned version."
+            exit 1
+          fi

      - name: 💾 Cache Pods
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        id: pods-cache
        with:
          path: ./ios/Pods
@@ -282,7 +295,7 @@ jobs:

      - name: ⬇️ Restore Cache
        id: get-base-commit
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        if: ${{ inputs.channel == 'testflight' }}
        with:
          path: most-recent-testflight-commit.txt
@@ -303,7 +316,9 @@ jobs:
    needs: [bundleDeploy]
    # Gotta check if its NOT '[]' because any md5 hash in the outputs is detected as a possible secret and won't be
    # available here
-    if: ${{ inputs.channel != 'production' && needs.bundleDeploy.outputs.changes-detected && github.repository == 'bluesky-social/social-app'}}
+    if: ${{ inputs.channel != 'production' &&
+      needs.bundleDeploy.outputs.changes-detected && github.repository ==
+      'bluesky-social/social-app'}}

    steps:
      - name: Check for EXPO_TOKEN
@@ -314,26 +329,26 @@ jobs:
          fi

      - name: ⬇️ Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 5

-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

      - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: .nvmrc
+          node-version-file: package.json
          cache: pnpm

      - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@main
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
        with:
          eas-version: '19.0.5'
          packager: 'pnpm --allow-build=dtrace-provider'
          token: ${{ secrets.EXPO_TOKEN }}

-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: "temurin"
          java-version: "17"
@@ -368,17 +383,49 @@ jobs:
          pnpm use-build-number-with-bump
          pnpm eas build -p android
          --profile testflight-android
-          --local --output build.apk --non-interactive
+          --local --output build.aab --non-interactive
+
+      - name: 📚 Get version from package.json
+        id: get-build-info
+        run: bash scripts/setGitHubOutput.sh
+
+      - name: 🚀 Submit to Google Play
+        run: pnpm eas submit -p android --profile testflight-android --non-interactive --path
+          build.aab
+
+      - name: 🔧 Setup bundletool
+        uses: amyu/setup-bundletool@cc2e1857284660bd625e43f2c8a45626f034302f # v1.1
+        with:
+          bundletool-version: "1.17.2"
+
+      - name: 🔑 Decode keystore
+        run: echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 --decode >
+          keystore.jks
+
+      - name: 📦 Build signed universal APK
+        run: |
+          bundletool build-apks \
+            --bundle=build.aab \
+            --output=universal.apks \
+            --mode=universal \
+            --ks=keystore.jks \
+            --ks-pass=pass:${{ secrets.ANDROID_KEYSTORE_PASSWORD }} \
+            --ks-key-alias=${{ secrets.ANDROID_KEY_ALIAS }} \
+            --key-pass=pass:${{ secrets.ANDROID_KEY_PASSWORD }}
+
+      - name: 📋 Rename to .zip for extraction
+        run: mv universal.apks universal.zip
+
+      - name: 📦 Extract universal APK
+        run: unzip -p universal.zip universal.apk > build.apk

      - name: ⏰ Get a timestamp
        id: timestamp
-        uses: nanzm/get-time-action@master
-        with:
-          format: "MM-DD-HH-mm-ss"
+        run: echo "time=$(date -u +'%m-%d-%H-%M-%S')" >> "$GITHUB_OUTPUT"

      - name: 🚀 Upload Artifact
        id: upload-artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          retention-days: 30
          compression-level: 0
@@ -386,7 +433,7 @@ jobs:
          path: build.apk

      - name: 🔔 Notify Slack
-        uses: slackapi/slack-github-action@v2.1.1
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
        with:
          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
          webhook-type: incoming-webhook
@@ -396,7 +443,7 @@ jobs:

      - name: ⬇️ Restore Cache
        id: get-base-commit
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        if: ${{ inputs.channel != 'testflight' && inputs.channel != 'production' }}
        with:
          path: most-recent-testflight-commit.txt
@@ -0,0 +1,76 @@
+name: claude-mention
+
+# @claude mention handler on PR conversation comments, inline review
+# comments, and review bodies. See the header comment in
+# claude-review.yml for why this is self-contained rather than calling
+# the org reusable workflows.
+#
+# Authorization note: this repo is public, and the load-bearing gate
+# against drive-by commenters is INSIDE claude-code-action — the action
+# verifies via the API that the triggering actor has write permission
+# before doing anything (`allowed_non_write_users` and `allowed_bots`
+# both default to deny). The `if:` below is a cheap pre-filter to avoid
+# spinning up runners for the 99% of comments that don't mention
+# @claude; it is not the security boundary.
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  pull_request_review:
+    types: [submitted]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+  actions: read
+  id-token: write
+
+jobs:
+  mention:
+    # Skip comments/reviews that don't mention @claude, non-PR issue
+    # comments, and events from claude[bot] itself (its review prose
+    # often quotes "@claude" and must not retrigger the workflow).
+    if: >
+      (
+        (github.event_name == 'issue_comment' &&
+          github.event.issue.pull_request != null &&
+          contains(github.event.comment.body, '@claude')) ||
+        (github.event_name == 'pull_request_review_comment' &&
+          contains(github.event.comment.body, '@claude')) ||
+        (github.event_name == 'pull_request_review' &&
+          contains(github.event.review.body, '@claude'))
+      ) &&
+      github.actor != 'claude[bot]'
+
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    concurrency:
+      group: claude-mention-${{ github.repository }}-${{ github.event.issue.number || github.event.pull_request.number }}
+      cancel-in-progress: false
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-depth: 1
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        with:
+          role-to-assume: ${{ secrets.AWS_BEDROCK_REVIEW_ROLE_ARN }}
+          aws-region: us-east-2
+
+      - name: Claude
+        uses: anthropics/claude-code-action@9dd8b95a392eb34b6f5fb56cf5a64cb735912d4b # v1.0.150
+        with:
+          use_bedrock: 'true'
+          additional_permissions: |
+            actions: read
+          track_progress: true
+          claude_args: |
+            --model global.anthropic.claude-opus-4-8
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__download_job_log,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
@@ -0,0 +1,68 @@
+name: claude-review
+
+# Automatic Claude review on PR creation/update, via Bedrock (OIDC, no
+# long-lived tokens). Self-contained: this intentionally uses upstream
+# claude-code-action defaults rather than the org reusable workflows in
+# bluesky-social/.github (which a public repo cannot call, and whose
+# customizations added no value over upstream).
+#
+# Review guidance lives in .github/claude-review-prompt.md.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: write
+  actions: read
+  id-token: write
+
+jobs:
+  review:
+    # Internal PRs only. This repo is public: fork PRs are the bulk of
+    # community traffic and MUST NOT trigger reviews (no Bedrock spend on
+    # unvetted code, and fork PRs can't mint the OIDC token anyway —
+    # belt-and-braces with this explicit guard). Branch PRs can only be
+    # created by people with write access, i.e. org members.
+    # Bot-authored PRs (dependabot, changesets) are also skipped.
+    if: >
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.type != 'Bot'
+
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    concurrency:
+      group: claude-review-${{ github.repository }}-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-depth: 1
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        with:
+          role-to-assume: ${{ secrets.AWS_BEDROCK_REVIEW_ROLE_ARN }}
+          aws-region: us-east-2
+
+      - name: Claude review
+        uses: anthropics/claude-code-action@9dd8b95a392eb34b6f5fb56cf5a64cb735912d4b # v1.0.150
+        with:
+          use_bedrock: 'true'
+          additional_permissions: |
+            actions: read
+          track_progress: true
+          claude_args: |
+            --model global.anthropic.claude-opus-4-8
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__download_job_log,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
+          prompt: |
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number }}
+
+            Read .github/claude-review-prompt.md in the checked-out repo
+            and review this pull request following its guidance.
@@ -1,54 +0,0 @@
-name: Claude Code
-
-on:
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-  issues:
-    types: [opened, assigned]
-  pull_request_review:
-    types: [submitted]
-
-jobs:
-  claude:
-    if: |
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
-      issues: read
-      id-token: write
-      actions: read # Required for Claude to read CI results on PRs
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 1
-
-      - name: Run Claude Code
-        id: claude
-        uses: anthropics/claude-code-action@v1
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-
-          # This is an optional setting that allows Claude to read CI results on PRs
-          additional_permissions: |
-            actions: read
-
-          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
-          # prompt: 'Update the pull request description to include a summary of changes.'
-
-          # Optional: Add claude_args to customize behavior and configuration
-          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
-          # or https://code.claude.com/docs/en/cli-reference for available options
-          # claude_args: '--allowed-tools Bash(gh pr:*)'
-
-          # NOTE(sfn): we can add a custom system prompt here
-
-          claude_args: |
-            --model claude-opus-4-7
@@ -10,16 +10,20 @@ concurrency:
  group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
  cancel-in-progress: true

+permissions:
+  contents: read
+
 jobs:
  build-and-test:
    runs-on: ubuntu-latest
    steps:
      - name: Git Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Set up Go tooling
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: bskyweb/go.mod
+          cache-dependency-path: bskyweb/go.sum
      - name: Dummy Static Files
        run: touch bskyweb/static/js/blah.js && touch bskyweb/static/css/blah.txt && touch bskyweb/static/media/blah.txt
      - name: Check
@@ -32,11 +36,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Git Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Set up Go tooling
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: bskyweb/go.mod
+          cache-dependency-path: bskyweb/go.sum
      - name: Dummy Static Files
        run: touch bskyweb/static/js/blah.js && touch bskyweb/static/css/blah.txt && touch bskyweb/static/media/blah.txt
      - name: Lint
@@ -6,34 +6,43 @@ on:
    branches:
      - main
 concurrency:
-  group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
+  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
  cancel-in-progress: true

+# These jobs only check out the repo and run checks, so read access to the
+# repo contents is all the GITHUB_TOKEN needs.
+permissions:
+  contents: read
+
 jobs:
  linting:
    name: Run linters
    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        job: [lint, prettier, typecheck]
    steps:
      - name: Check out Git repository
-        uses: actions/checkout@v5
-      - name: Verify Node version pins match .nvmrc
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Verify Node version pins match package.json
        run: |
          set -euo pipefail
-          expected=$(tr -d '[:space:]' < .nvmrc)
+          expected=$(node -p "require('./package.json').engines.node.replace(/[^0-9.]/g, '')")
          rc=0
          check() {
            if [ "$2" != "$expected" ]; then
-              echo "::error file=$1::Node version mismatch: $1 pins '$2' but .nvmrc is '$expected'"
+              echo "::error file=$1::Node version mismatch: $1 pins '$2' but package.json is '$expected'"
              rc=1
            fi
          }
-          # FROM node:X.Y.Z — service runtime images
+          # FROM node:X.Y.Z - service runtime images
          for f in Dockerfile.bskylink Dockerfile.bskyogcard; do
            v=$(grep -oE 'FROM node:[0-9]+\.[0-9]+\.[0-9]+' "$f" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | sort -u)
            check "$f" "$v"
          done
-          # ENV NODE_VERSION=X.Y.Z — Go images that nvm-install Node for the JS build stage
-          for f in Dockerfile Dockerfile.embedr; do
+          # ENV NODE_VERSION=X.Y.Z - Go images that nvm-install Node for the JS build stage
+          for f in Dockerfile.embedr; do
            v=$(grep -oE 'NODE_VERSION=[0-9]+\.[0-9]+\.[0-9]+' "$f" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | sort -u)
            check "$f" "$v"
          done
@@ -41,46 +50,70 @@ jobs:
          v=$(grep -oE '"node":[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+"' eas.json | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | sort -u)
          check "eas.json" "$v"
          exit $rc
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - name: Install node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: .nvmrc
+          node-version-file: package.json
          cache: pnpm
      - name: pnpm install
-        uses: Wandalen/wretry.action@master
-        with:
-          command: pnpm install --frozen-lockfile
-          attempt_limit: 3
-          attempt_delay: 2000
-      - name: Lint check
-        run: pnpm lint
-      - name: Prettier check
-        run: pnpm prettier --check .
+        run: pnpm install --frozen-lockfile
      - name: Check & compile i18n
        run: pnpm intl:build
-      - name: Type check
-        run: pnpm typecheck
+      - name: Lint checks
+        run: pnpm ${{ matrix.job }}
+  # Aggregates the matrix results into a single stable check name so branch
+  # protection can require "Run linters" regardless of how many matrix jobs run.
+  # The result is asserted in `run` (not `if`) so a malformed expression can
+  # never silently skip the check and report a false pass.
+  linting-summary:
+    name: Run linters
+    if: always()
+    needs: [linting]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require linting to have succeeded
+        env:
+          RESULT: ${{ needs.linting.result }}
+        run: |
+          echo "linting result: $RESULT"
+          test "$RESULT" = "success"
  testing:
    name: Run tests
    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
    steps:
      - name: Check out Git repository
-        uses: actions/checkout@v5
-      - uses: pnpm/action-setup@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - name: Install node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: .nvmrc
+          node-version-file: package.json
          cache: pnpm
      - name: pnpm install
-        uses: Wandalen/wretry.action@master
-        with:
-          command: pnpm install --frozen-lockfile
-          attempt_limit: 3
-          attempt_delay: 2000
+        run: pnpm install --frozen-lockfile
      - name: Check & compile i18n
        run: pnpm intl:build
      - name: Run tests
        run: |
-          NODE_ENV=test pnpm test --forceExit
+          NODE_ENV=test pnpm test --forceExit --shard=${{ matrix.shard }}/${{ strategy.job-total }}
+  # Aggregates the sharded test results into a single stable check name so branch
+  # protection can require "Run tests" regardless of how many shards run.
+  # The result is asserted in `run` (not `if`) so a malformed expression can
+  # never silently skip the check and report a false pass.
+  testing-summary:
+    name: Run tests
+    if: always()
+    needs: [testing]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require testing to have succeeded
+        env:
+          RESULT: ${{ needs.testing.result }}
+        run: |
+          echo "testing result: $RESULT"
+          test "$RESULT" = "success"
@@ -0,0 +1,173 @@
+---
+name: Nightly Build
+
+on:
+  schedule:
+    - cron: "10 2 * * *" # run at 2:10 AM UTC, after the nightly i18n job
+  workflow_dispatch:
+
+# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
+permissions:
+  contents: read
+
+jobs:
+  # Generate the changelog once, shared by both platforms. The range covers commits since
+  # the previous nightly, whose commit SHA is stored as a "nightly-build-commit" artifact
+  # (advanced by the record job below, only after both builds succeed).
+  prepare:
+    name: Prepare release notes
+    if: github.repository == 'bluesky-social/social-app'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    outputs:
+      notes: ${{ steps.notes.outputs.notes }}
+    steps:
+      - name: ⬇️ Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-depth: 0
+
+      - name: 📝 Generate release notes
+        id: notes
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Find the most recent non-expired nightly-build-commit artifact and read its SHA
+          # The artifacts API returns results newest-first, so the most recent marker is on
+          # page 1 — no --paginate needed (which would run the jq aggregation per page and
+          # could emit multiple URLs). Take the first non-expired match.
+          prev=""
+          url=$(gh api \
+            "repos/${GITHUB_REPOSITORY}/actions/artifacts?name=nightly-build-commit&per_page=100" \
+            --jq 'first(.artifacts[] | select(.expired == false)) | .archive_download_url' \
+            2>/dev/null || true)
+          if [ -n "$url" ] && [ "$url" != "null" ]; then
+            if curl -sSL -H "Authorization: Bearer $GH_TOKEN" -o marker.zip "$url" \
+              && unzip -o -q marker.zip; then
+              prev=$(cat nightly-build-commit.txt 2>/dev/null | tr -d '[:space:]')
+            fi
+            rm -f marker.zip nightly-build-commit.txt
+          fi
+
+          if [ -n "$prev" ] && git cat-file -e "${prev}^{commit}" 2>/dev/null; then
+            echo "Generating notes since previous nightly: $prev"
+            range="${prev}..HEAD"
+          else
+            echo "No reachable previous nightly commit; falling back to last 30 commits."
+            range="HEAD~30..HEAD"
+          fi
+          notes=$(git log --no-merges --pretty=format:'- %s' "$range" 2>/dev/null | head -n 50)
+          if [ -z "$notes" ]; then
+            notes="Nightly build — no new commits since the last nightly."
+          fi
+          # Cap the whole changelog to keep the Slack message a reasonable size.
+          # head -c caps the combined stream; cut -c would only cap each line independently.
+          notes=$(printf '%s' "$notes" | head -c 3900)
+          {
+            echo "notes<<NOTES_EOF"
+            echo "$notes"
+            echo "NOTES_EOF"
+          } >> "$GITHUB_OUTPUT"
+
+  ios:
+    name: Nightly iOS Build
+    needs: [prepare]
+    uses: ./.github/workflows/build-submit-ios.yml
+    with:
+      profile: testflight
+      assignTestFlightGroup: true
+    secrets: inherit
+
+  android:
+    name: Nightly Android Build
+    needs: [prepare]
+    # build-submit-android.yml contains an attachToRelease job that requests contents: write.
+    # That job is skipped for nightly (it needs a production tag build), but GitHub statically
+    # validates the reusable-workflow permission ceiling, so the caller must grant it here.
+    permissions:
+      contents: write
+    uses: ./.github/workflows/build-submit-android.yml
+    with:
+      profile: testflight-android
+    secrets: inherit
+
+  notify-ios:
+    name: Notify Slack of iOS nightly
+    needs: [prepare, ios]
+    runs-on: ubuntu-latest
+    steps:
+      - name: 📝 Build Slack payload
+        id: payload
+        env:
+          NOTES: ${{ needs.prepare.outputs.notes }}
+          VERSION: ${{ needs.ios.outputs.package-version }}
+          BUILD_NUMBER: ${{ needs.ios.outputs.build-number }}
+        run: |
+          text="*Nightly iOS build available in TestFlight (QA Team)*
+          Version ${VERSION} (${BUILD_NUMBER})
+
+          ${NOTES}"
+          payload=$(jq -n --arg text "$text" '{text: $text}')
+          {
+            echo "payload<<PAYLOAD_EOF"
+            echo "$payload"
+            echo "PAYLOAD_EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: 🔔 Notify Slack
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
+        with:
+          webhook: ${{ secrets.NIGHTLY_BUILDS_SLACK_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload: ${{ steps.payload.outputs.payload }}
+
+  notify-android:
+    name: Notify Slack of Android nightly
+    needs: [prepare, android]
+    runs-on: ubuntu-latest
+    steps:
+      - name: 📝 Build Slack payload
+        id: payload
+        env:
+          NOTES: ${{ needs.prepare.outputs.notes }}
+          VERSION: ${{ needs.android.outputs.package-version }}
+          VERSION_CODE: ${{ needs.android.outputs.version-code }}
+        run: |
+          text="*Nightly Android build available (Internal track)*
+          Version ${VERSION} (${VERSION_CODE})
+
+          ${NOTES}"
+          payload=$(jq -n --arg text "$text" '{text: $text}')
+          {
+            echo "payload<<PAYLOAD_EOF"
+            echo "$payload"
+            echo "PAYLOAD_EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: 🔔 Notify Slack
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
+        with:
+          webhook: ${{ secrets.NIGHTLY_BUILDS_SLACK_WEBHOOK }}
+          webhook-type: incoming-webhook
+          payload: ${{ steps.payload.outputs.payload }}
+
+  # Advance the nightly marker only after both builds succeed, so a failed night's commits
+  # roll into the next successful nightly's notes rather than being silently dropped.
+  record:
+    name: Record nightly commit
+    needs: [ios, android]
+    runs-on: ubuntu-latest
+    steps:
+      - name: ✏️ Write nightly commit marker
+        env:
+          GITHUB_SHA: ${{ github.sha }}
+        run: echo "$GITHUB_SHA" > nightly-build-commit.txt
+
+      - name: 🚀 Upload nightly commit marker
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: nightly-build-commit
+          path: nightly-build-commit.txt
+          retention-days: 90
@@ -16,30 +16,26 @@ jobs:

    steps:
      - name: Check out Git repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ssh-key: ${{secrets.GH_ACTION_DEPLOY_KEY}}
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
      - name: Install node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: .nvmrc
+          node-version-file: package.json
          cache: pnpm
      - name: pnpm install
-        uses: Wandalen/wretry.action@master
-        with:
-          command: pnpm install --frozen-lockfile
-          attempt_limit: 3
-          attempt_delay: 2000
+        run: pnpm install --frozen-lockfile
      - name: Extract language strings
        run: pnpm intl:extract
      - name: Create commit
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
        with:
          commit_message: Nightly source-language update
          file_pattern: ./src/locale/locales/en/messages.po
      - name: Push source lang to Crowdin
-        uses: crowdin/github-action@v2
+        uses: crowdin/github-action@52aa776766211d83d975df51f3b9c53c2f8ba35f # v2.16.3
        with:
          upload_sources: true
          upload_sources_args: "-b main"
@@ -5,16 +5,15 @@ on:
  issue_comment:
    types: [created]

-# Permissiosn to make comments in the pull request
-permissions:
-  pull-requests: write
-  actions: write
-  contents: read
+# Permissions are granted per-job below; anything unlisted defaults to none
+permissions: {}

 jobs:
  handle-comment:
    if: github.event.issue.pull_request
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    outputs:
      should-deploy: ${{ steps.check-org.outputs.result }}

@@ -45,10 +44,10 @@ jobs:
            echo "mentioned=false" >> $GITHUB_OUTPUT
          fi

-      - name: Check organization membership
+      - name: Check commenter has write access
        if: steps.check-mention.outputs.mentioned == 'true'
        id: check-org
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            try {
@@ -72,13 +71,16 @@ jobs:
    runs-on: ubuntu-latest
    needs: [handle-comment]
    if: needs.handle-comment.outputs.should-deploy == 'true'
+    permissions:
+      contents: read
+      pull-requests: write

    steps:
      - name: Get PR HEAD SHA
        env:
          ISSUE_NUMBER: ${{ github.event.issue.number }}
        id: pr-info
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const pr = await github.rest.pulls.get({
@@ -87,6 +89,16 @@ jobs:
              pull_number: process.env.ISSUE_NUMBER,
            });

+            // This workflow runs with repo secrets in scope, so never build
+            // code from a fork: the commenter authorizes the deploy, but a
+            // fork controls what code would run during it
+            const expected = `${context.repo.owner}/${context.repo.repo}`;
+            const head = pr.data.head.repo?.full_name;
+            if (head !== expected) {
+              core.setFailed(`OTA deploys are only allowed for branches in ${expected}, not forks (got ${head})`);
+              return;
+            }
+
            console.log(`PR HEAD SHA: ${pr.data.head.sha}`);
            console.log(`PR HEAD REF: ${pr.data.head.ref}`);

@@ -94,7 +106,7 @@ jobs:
            core.setOutput('head-ref', pr.data.head.ref);

      - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
        with:
          header: pull-request-eas-build-${{ steps.pr-info.outputs.head-sha }}
          number: ${{ github.event.issue.number }}
@@ -113,42 +125,42 @@ jobs:
          fi

      - name: ⬇️ Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: ${{ steps.pr-info.outputs.head-sha }}

-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

      - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: .nvmrc
+          node-version-file: package.json
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

-      - name: Lint check
-        run: pnpm lint
-
      - name: 🔤 Compile translations
        run: pnpm intl:build 2>&1 | tee i18n.log

      - name: Check for i18n compilation errors
        run: if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compilation errors!\n\n"; fi

+      - name: Lint check
+        run: pnpm lint
+
      - name: Type check
        run: pnpm typecheck

      - name: 🔨 Setup EAS
-        uses: expo/expo-github-action@main
+        uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
        with:
          eas-version: '19.0.5'
          packager: 'pnpm --allow-build=dtrace-provider'
          token: ${{ secrets.EXPO_TOKEN }}

      - name: 🪛 Setup jq
-        uses: dcarbone/install-jq-action@v2
+        uses: dcarbone/install-jq-action@b7ef57d46ece78760b4019dbc4080a1ba2a40b45 # v3.2.0

      - name: Env
        id: env
@@ -181,7 +193,7 @@ jobs:
          RUNTIME_VERSION:

      - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
        env:
          ISSUE_NUMBER: ${{ github.event.issue.number }}
        with:
@@ -198,7 +210,7 @@ jobs:
            *Generated by [PR labeler](https://github.com/expo/expo/actions/workflows/pr-labeler.yml) 🤖*

      - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
        if: failure()
        with:
          header: pull-request-eas-build-${{ steps.pr-info.outputs.head-sha }}
@@ -13,27 +13,30 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: true

-permissions:
-  pull-requests: write
-  actions: write
-  contents: read
+# Permissions are granted per-job below; anything unlisted defaults to none.
+# pull-requests: write is needed by sticky-pull-request-comment to post the
+# bundle-size and fingerprint diffs
+permissions: {}

 jobs:
  webpack-analyzer:
    runs-on: ubuntu-22.04
    if: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event_name == 'pull_request'}}
+    permissions:
+      contents: read
+      pull-requests: write
    steps:
      - name: ⬇️ Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0

-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

      - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: .nvmrc
+          node-version-file: package.json
          cache: pnpm

      - name: Ensure tracking relevant branches and checkout base
@@ -68,7 +71,7 @@ jobs:

      - name: ⬇️ Get base stats from cache
        id: get-base-stats
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: stats-base.json
          key: stats-base-${{ steps.base-commit.outputs.base-commit }}
@@ -89,14 +92,14 @@ jobs:

      - name: ％ Get diff
        id: get-diff
-        uses: NejcZdovc/bundle-size-diff@v1
+        uses: NejcZdovc/bundle-size-diff@5321de41d2d62a7b0f4d6e60f59d1280a0034160 # v1.1.0
        with:
          base_path: "stats-base.json"
          pr_path: "../stats-new.json"
          excluded_assets: "(.+).chunk.js|(.+).js.map|(.+).json|(.+).png|(.+).svg|(.+).webp|(.+).jpg|(.+).ico"

      - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
        with:
          header: bundle-diff
          message: |
@@ -108,9 +111,12 @@ jobs:
  fingerprint-native:
    runs-on: ubuntu-22.04
    if: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event_name == 'pull_request'}}
+    permissions:
+      contents: read
+      pull-requests: write
    steps:
      - name: ⬇️ Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 100

@@ -118,22 +124,22 @@ jobs:
        run: git fetch origin main:main --depth 100
        if: github.event_name == 'pull_request'

-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

      - name: 🔧 Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: .nvmrc
+          node-version-file: package.json
          cache: pnpm

      - name: 📷 Check fingerprint and install dependencies
        id: fingerprint
-        uses: bluesky-social/github-actions/fingerprint-native@main
+        uses: bluesky-social/github-actions/fingerprint-native@ebc6aa6d7466dc1e78b1e832041b7b81f6f95030 # v0.1.0
        with:
          profile: pull-request

      - name: 💬 Drop a comment
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
        if: ${{ steps.fingerprint.outputs.includes-changes }}
        with:
          header: fingerprint-diff
@@ -151,7 +157,7 @@ jobs:
            *Generated by [PR labeler](https://github.com/expo/expo/actions/workflows/pr-labeler.yml) 🤖*

      - name: 💬 Delete comment
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
        if: ${{ !steps.fingerprint.outputs.includes-changes }}
        with:
          header: fingerprint-diff
@@ -4,22 +4,29 @@ on:
  push:
    branches: [main]

+# The push to the internal repo uses the app token below, not the GITHUB_TOKEN
+permissions:
+  contents: read
+
 jobs:
  sync:
    runs-on: ubuntu-latest
    if: github.repository == 'bluesky-social/social-app'
    steps:
      - name: Checkout public repo
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0
      - name: Generate GitHub App Token
        id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ vars.SYNC_INTERNAL_APP_ID }}
          private-key: ${{ secrets.SYNC_INTERNAL_PK }}
          repositories: social-app-internal
+          # Scope the token down from the app's full installation permissions;
+          # pushing is the only thing this token is used for
+          permission-contents: write
      - name: Push to internal repo
        env:
          TOKEN: ${{ steps.app-token.outputs.token }}
@@ -6,13 +6,16 @@ concurrency:
  group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
  cancel-in-progress: true

+permissions:
+  contents: read
+
 jobs:
  verify-pnpm-lock:
    name: No manual pnpm-lock.yaml edits
    runs-on: ubuntu-latest
    steps:
      - name: Check out PR HEAD
-        uses: actions/checkout@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0

@@ -21,12 +24,12 @@ jobs:
          BASE_REF: ${{ github.base_ref }}
        run: git fetch origin $BASE_REF --depth=1

-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

      - name: Install node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: .nvmrc
+          node-version-file: package.json

      - name: Reset pnpm-lock.yaml to base
        env:
@@ -34,12 +37,8 @@ jobs:
        run: git show "origin/$BASE_REF:pnpm-lock.yaml" > pnpm-lock.yaml

      - name: pnpm install
-        uses: Wandalen/wretry.action@master
-        with:
-          # Fine to skip scripts since we don't run any code
-          command: pnpm clean && pnpm install --ignore-scripts --no-frozen-lockfile
-          attempt_limit: 3
-          attempt_delay: 2000
+        # Fine to skip scripts since we don't run any code
+        run: pnpm clean && pnpm install --ignore-scripts --no-frozen-lockfile

      - name: Verify pnpm-lock.yaml
        run: |
@@ -0,0 +1,37 @@
+name: Workflow security
+
+on:
+  push:
+    branches: [main]
+    paths: [".github/**"]
+  pull_request:
+    paths: [".github/**"]
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
+  cancel-in-progress: true
+
+# The github.token is only used by zizmor's online audits (read-only API calls)
+permissions:
+  contents: read
+
+jobs:
+  zizmor:
+    name: Audit workflows with zizmor
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          # Annotate the PR directly instead of uploading SARIF to the
+          # security tab, and fail the check on any finding
+          advanced-security: false
+          annotations: true
+          # Low-confidence findings (e.g. artipacked on workflows that never
+          # push) are too noisy to gate CI on
+          min-confidence: medium
@@ -133,3 +133,4 @@ bskyweb/static/media/*.svg

 # superpowers plugin plans/specs — local-only workspace
 docs/superpowers/
+.claude/worktrees
@@ -0,0 +1,62 @@
+/**
+ * Codemod to replace BskyAgent with AtpAgent
+ *
+ * Before:
+ *   import {BskyAgent} from '@atproto/api`
+ *   BskyAgent.appLabelers.includes(labeler)
+ *
+ * After:
+ *   import {AtpAgent} from '@atproto/api`
+ *   AtpAgent.appLabelers.includes(labeler)
+ *
+ * Handles import specifiers, type annotations, static member access
+ * (BskyAgent.configure), `extends BskyAgent`, and `new BskyAgent()`. Whole
+ * identifiers only, so names like `OpaqueBskyAgent` are left untouched.
+ *
+ * Usage: jscodeshift -t .jscodeshift/repo/bsky-agent.js <file-path>
+ * Example: jscodeshift -t .jscodeshift/repo/bsky-agent.js src/lib/moderation.ts
+ */
+
+/* eslint-disable */
+
+export const parser = 'tsx'
+
+export default function transformer(file, api) {
+  const j = api.jscodeshift
+  const root = j(file.source)
+
+  // Replace every standalone `BskyAgent` identifier with `AtpAgent`. This
+  // covers imports, type references, member expressions, `extends`, and `new`.
+  root
+    .find(j.Identifier, {name: 'BskyAgent'})
+    .replaceWith(() => j.identifier('AtpAgent'))
+
+  // Renaming can leave a duplicate `AtpAgent` specifier on the @atproto/api
+  // import if the file already imported it. Dedupe by imported name, keeping
+  // the type-only modifier only if every duplicate was type-only.
+  root
+    .find(j.ImportDeclaration, {source: {value: '@atproto/api'}})
+    .forEach(path => {
+      const seen = new Map()
+      for (const spec of path.value.specifiers) {
+        if (spec.type !== 'ImportSpecifier') {
+          seen.set(Symbol(), spec)
+          continue
+        }
+        const name = spec.imported.name
+        const existing = seen.get(name)
+        if (!existing) {
+          seen.set(name, spec)
+        } else if (
+          existing.importKind === 'type' &&
+          spec.importKind !== 'type'
+        ) {
+          // Prefer the value (non-type) import if either usage needs it.
+          seen.set(name, spec)
+        }
+      }
+      path.value.specifiers = Array.from(seen.values())
+    })
+
+  return root.toSource()
+}
@@ -206,7 +206,7 @@ function MyComponent() {

  return (
    <View style={[a.flex_row, a.gap_md, a.p_lg, t.atoms.bg]}>
-      <Text style={[a.text_md, a.font_bold, t.atoms.text]}>Hello</Text>
+      <Text style={[a.text_md, a.font_bold, t.atoms.text_contrast_high]}>Hello</Text>
    </View>
  )
 }
@@ -414,12 +414,16 @@ import {Text, H1, H2, P} from '#/components/Typography'

 <H1 style={[a.text_xl, a.font_bold]}>Heading</H1>
 <P>Paragraph text with default styling.</P>
-<Text style={[a.text_sm, t.atoms.text_contrast_medium]}>Custom text</Text>
+<Text style={[a.text_md, t.atoms.text_contrast_medium]}>Custom text</Text>

-// For text with emoji, add the emoji prop
+// For text with emoji, add the emoji prop. User-generated text (e.g. display names)
+// will almost certainly contain emoji, so only omit it when the text is static and
+// does not contain an emoji
 <Text emoji>Hello! 👋</Text>
 ```

+The `Text` component's default style is `[a.text_sm, a.leading_snug, t.atoms.text]`.
+
 ### TextField

 ```tsx
@@ -1,23 +1,21 @@
-FROM golang:1.26-bookworm AS build-env
+#
+# Stage 1: build the web bundle with pnpm.
+#
+# Uses the official pnpm image. Node is auto-downloaded by pnpm using the
+# `devEngines.runtime` field in package.json (onFail: "download").
+#
+FROM ghcr.io/pnpm/pnpm:11 AS web-build

-WORKDIR /usr/src/social-app
+WORKDIR /app

 ENV DEBIAN_FRONTEND=noninteractive

 #
-# Node
+# pnpm config
 #
-ENV NODE_VERSION=24.15.0
-ENV NVM_DIR=/usr/share/nvm
-
-#
-# Go
-#
-ENV GODEBUG="netdns=go"
-ENV GOOS="linux"
-ENV GOARCH="amd64"
-ENV CGO_ENABLED=1
-ENV GOEXPERIMENT="loopvar"
+ENV CI=1
+# use the pnpm version specified in package.json
+ENV pnpm_config_pm_on_fail=download

 # The latest git hash of the preview branch on render.com
 # https://render.com/docs/docker-secrets#environment-variables-in-docker-builds
@@ -42,41 +40,48 @@ ENV SENTRY_AUTH_TOKEN=${SENTRY_AUTH_TOKEN:-unknown}
 ARG EXPO_PUBLIC_SENTRY_DSN
 ENV EXPO_PUBLIC_SENTRY_DSN=$EXPO_PUBLIC_SENTRY_DSN

-#
-# Copy everything into the container
-#
 COPY . .

-#
-# Generate the JavaScript webpack.
-#
-RUN mkdir --parents $NVM_DIR && \
-  wget \
-    --output-document=/tmp/nvm-install.sh \
-    https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh && \
-  bash /tmp/nvm-install.sh
-
-RUN \. "$NVM_DIR/nvm.sh" && \
-  nvm install $NODE_VERSION && \
-  nvm use $NODE_VERSION && \
-  echo "Using bundle identifier: $EXPO_PUBLIC_BUNDLE_IDENTIFIER" && \
+RUN echo "Using bundle identifier: $EXPO_PUBLIC_BUNDLE_IDENTIFIER" && \
  echo "EXPO_PUBLIC_ENV=$EXPO_PUBLIC_ENV" >> .env && \
  echo "EXPO_PUBLIC_RELEASE_VERSION=$EXPO_PUBLIC_RELEASE_VERSION" >> .env && \
  echo "EXPO_PUBLIC_BUNDLE_IDENTIFIER=$EXPO_PUBLIC_BUNDLE_IDENTIFIER" >> .env && \
  echo "EXPO_PUBLIC_BUNDLE_DATE=$(date -u +"%y%m%d%H")" >> .env && \
-  echo "EXPO_PUBLIC_SENTRY_DSN=$EXPO_PUBLIC_SENTRY_DSN" >> .env && \
-  npm install --global pnpm@11.1.1 && \
-  pnpm install --frozen-lockfile && \
-  pnpm intl:build 2>&1 | tee i18n.log && \
-  if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compile errors!\n\n"; fi && \
-  SENTRY_AUTH_TOKEN=$SENTRY_AUTH_TOKEN SENTRY_RELEASE=$EXPO_PUBLIC_RELEASE_VERSION SENTRY_DIST=$EXPO_PUBLIC_BUNDLE_IDENTIFIER pnpm build-web
+  echo "EXPO_PUBLIC_SENTRY_DSN=$EXPO_PUBLIC_SENTRY_DSN" >> .env
+
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm install --frozen-lockfile
+
+RUN pnpm intl:build 2>&1 | tee i18n.log && \
+  if grep -q "invalid syntax" "i18n.log"; then echo "\n\nFound compilation errors!\n\n" && exit 1; else echo "\n\nNo compile errors!\n\n"; fi
+
+RUN SENTRY_AUTH_TOKEN=$SENTRY_AUTH_TOKEN \
+    SENTRY_RELEASE=$EXPO_PUBLIC_RELEASE_VERSION \
+    SENTRY_DIST=$EXPO_PUBLIC_BUNDLE_IDENTIFIER \
+    pnpm build-web
+
+#
+# Stage 2: build the bskyweb Go binary, embedding the assets from stage 1.
+#
+# post-web-build.js (run by `pnpm build-web`) writes the bundled JS/CSS/media
+# into bskyweb/static/* and regenerates bskyweb/templates/scripts.html, so
+# copying the bskyweb/ tree from stage 1 is enough for go:embed to find
+# everything.
+#
+FROM golang:1.26-bookworm AS go-build
+
+WORKDIR /usr/src/social-app
+
+ENV GODEBUG="netdns=go"
+ENV GOOS="linux"
+ENV GOARCH="amd64"
+ENV CGO_ENABLED=1
+ENV GOEXPERIMENT="loopvar"
+
+COPY --from=web-build /app/bskyweb ./bskyweb

 # DEBUG
-RUN find ./bskyweb/static && find ./web-build/static
+RUN find ./bskyweb/static

-#
-# Generate the bskyweb Go binary.
-#
 RUN cd bskyweb/ && \
  go mod download && \
  go mod verify
@@ -89,6 +94,9 @@ RUN cd bskyweb/ && \
    -o /bskyweb \
    ./cmd/bskyweb

+#
+# Stage 3: runtime image.
+#
 FROM debian:bookworm-slim

 ENV GODEBUG=netdns=go
@@ -102,7 +110,7 @@ RUN apt-get update && apt-get install --yes \
 ENTRYPOINT ["dumb-init", "--"]

 WORKDIR /bskyweb
-COPY --from=build-env /bskyweb /usr/bin/bskyweb
+COPY --from=go-build /bskyweb /usr/bin/bskyweb

 CMD ["/usr/bin/bskyweb"]

@@ -1,17 +1,22 @@
 FROM node:24.15.0-alpine3.22 AS build

+# Tells pnpm to run non-interactively (needed for install/script steps)
+ENV CI=true
+
 # Move files into the image and install
 WORKDIR /app

 COPY ./bskyogcard/package.json ./
-COPY ./bskyogcard/yarn.lock ./
-RUN yarn install --frozen-lockfile
+COPY ./bskyogcard/pnpm-lock.yaml ./
+COPY ./bskyogcard/pnpm-workspace.yaml ./
+RUN npm install --global pnpm@11.5.2
+RUN pnpm install --frozen-lockfile

 COPY ./bskyogcard ./

 # build then prune dev deps
-RUN yarn install-fonts && yarn build
-RUN yarn install --production --ignore-scripts --prefer-offline
+RUN pnpm install-fonts && pnpm build
+RUN pnpm install --prod --ignore-scripts --prefer-offline

 # Uses assets from build stage to reduce build size
 FROM node:24.15.0-alpine3.22
@@ -33,7 +33,7 @@ RUN mkdir --parents $NVM_DIR && \
 RUN \. "$NVM_DIR/nvm.sh" && \
  nvm install $NODE_VERSION && \
  nvm use $NODE_VERSION && \
-  npm install --global pnpm@11.1.3 && \
+  npm install --global pnpm@11.7.0 && \
  pnpm install --frozen-lockfile && \
  cd bskyembed && pnpm install --frozen-lockfile && cd .. && \
  pnpm intl:build && \
@@ -145,21 +145,21 @@ appId: xyz.blueskyweb.app
    id: "profileHeaderDropdownBtn"
 - tapOn: "Add to Lists"
 - assertVisible:
-    id: "userAddRemoveListsModal"
+    id: "userAddRemoveListsDialog"
 - tapOn:
    id: "user-bob.test-addBtn"
 - tapOn:
    id: "doneBtn"
 - assertNotVisible:
-    id: "userAddRemoveListsModal"
+    id: "userAddRemoveListsDialog"
 - tapOn:
    id: "profileHeaderDropdownBtn"
 - tapOn: "Add to Lists"
 - assertVisible:
-    id: "userAddRemoveListsModal"
+    id: "userAddRemoveListsDialog"
 - tapOn:
    id: "user-bob.test-addBtn"
 - tapOn:
    id: "doneBtn"
 - assertNotVisible:
-    id: "userAddRemoveListsModal"
+    id: "userAddRemoveListsDialog"
@@ -1,11 +1,12 @@
 import {createDownloadResumable, deleteAsync} from 'expo-file-system/legacy'
 import {manipulateAsync, SaveFormat} from 'expo-image-manipulator'

+import {IMAGE_SIZE_CONFIG_2K_1MB} from '../../src/lib/constants'
 import {
  downloadAndResize,
  type DownloadAndResizeOpts,
-  getResizedDimensions,
 } from '../../src/lib/media/manip'
+import {getResizedDimensions} from '../../src/lib/media/util'

 const mockResizedImage = {
  path: 'file://resized-image.jpg',
@@ -41,10 +42,8 @@ describe('downloadAndResize', () => {

    const opts: DownloadAndResizeOpts = {
      uri: 'https://example.com/image.jpg',
-      width: 100,
-      height: 100,
+      maxDimension: 2000,
      maxSize: 500000,
-      mode: 'cover',
      timeout: 10000,
    }

@@ -60,9 +59,11 @@ describe('downloadAndResize', () => {

    // First time it gets called is to get dimensions
    expect(manipulateAsync).toHaveBeenCalledWith(expect.any(String), [], {})
+    // The mocked source image is 100x100, below maxDimension, so it is not
+    // downsized.
    expect(manipulateAsync).toHaveBeenCalledWith(
      expect.any(String),
-      [{resize: {height: opts.height, width: opts.width}}],
+      [{resize: {height: 100, width: 100}}],
      {format: SaveFormat.JPEG, compress: 1.0},
    )
    expect(deleteAsync).toHaveBeenCalledWith(expect.any(String), {
@@ -73,10 +74,8 @@ describe('downloadAndResize', () => {
  it('should return undefined for invalid URI', async () => {
    const opts: DownloadAndResizeOpts = {
      uri: 'invalid-uri',
-      width: 100,
-      height: 100,
+      maxDimension: 2000,
      maxSize: 500000,
-      mode: 'cover',
      timeout: 10000,
    }

@@ -90,13 +89,19 @@ describe('downloadAndResize', () => {
      width: 1200,
      height: 1000,
    }
-    const resizedDimensionsOne = getResizedDimensions(initialDimensionsOne)
+    const resizedDimensionsOne = getResizedDimensions(
+      initialDimensionsOne,
+      IMAGE_SIZE_CONFIG_2K_1MB.maxDimension,
+    )

    const initialDimensionsTwo = {
      width: 1000,
      height: 1200,
    }
-    const resizedDimensionsTwo = getResizedDimensions(initialDimensionsTwo)
+    const resizedDimensionsTwo = getResizedDimensions(
+      initialDimensionsTwo,
+      IMAGE_SIZE_CONFIG_2K_1MB.maxDimension,
+    )

    expect(resizedDimensionsOne).toEqual(initialDimensionsOne)
    expect(resizedDimensionsTwo).toEqual(initialDimensionsTwo)
@@ -107,13 +112,19 @@ describe('downloadAndResize', () => {
      width: 3000,
      height: 1500,
    }
-    const resizedDimensionsOne = getResizedDimensions(initialDimensionsOne)
+    const resizedDimensionsOne = getResizedDimensions(
+      initialDimensionsOne,
+      IMAGE_SIZE_CONFIG_2K_1MB.maxDimension,
+    )

    const initialDimensionsTwo = {
      width: 2000,
      height: 4000,
    }
-    const resizedDimensionsTwo = getResizedDimensions(initialDimensionsTwo)
+    const resizedDimensionsTwo = getResizedDimensions(
+      initialDimensionsTwo,
+      IMAGE_SIZE_CONFIG_2K_1MB.maxDimension,
+    )

    expect(resizedDimensionsOne).toEqual({
      width: 2000,
@@ -1,6 +1,7 @@
 import {describe, expect, it} from '@jest/globals'

 import {
+  getChatInviteCodeFromUrl,
  isPossiblyAUrl,
  isTrustedUrl,
  linkRequiresWarning,
@@ -178,3 +179,47 @@ describe('isTrustedUrl', () => {
    expect(output).toEqual(expected)
  })
 })
+
+describe('getChatInviteCodeFromUrl', () => {
+  type Case = [string, string | undefined]
+
+  const cases: Case[] = [
+    ['https://bsky.app/chat/abcdefg', 'abcdefg'],
+    ['https://bsky.app/chat/abcdefghij', 'abcdefghij'],
+    // http is not recognized as a bsky.app url
+    ['http://bsky.app/chat/abcdefg', undefined],
+    ['https://bsky.app/chat/abcdefg?utm=foo', 'abcdefg'],
+    ['https://bsky.app/chat/abcdefg#section', 'abcdefg'],
+    ['/chat/abcdefg', 'abcdefg'],
+    ['/chat/abcdefg?utm=foo', 'abcdefg'],
+    ['/chat/abcdefg#section', 'abcdefg'],
+
+    // too short
+    ['https://bsky.app/chat/abcdef', undefined],
+    ['/chat/abcdef', undefined],
+    // too long
+    ['https://bsky.app/chat/abcdefghijk', undefined],
+    ['/chat/abcdefghijk', undefined],
+    // invalid characters
+    ['https://bsky.app/chat/abc-def', undefined],
+    ['/chat/abc def', undefined],
+    // trailing path
+    ['https://bsky.app/chat/abcdefg/extra', undefined],
+    ['/chat/abcdefg/extra', undefined],
+    // wrong path
+    ['https://bsky.app/profile/abcdefg', undefined],
+    ['https://bsky.app/chat', undefined],
+    // wrong host
+    ['https://example.com/chat/abcdefg', undefined],
+    // not a url, not a path
+    ['chat/abcdefg', undefined],
+    ['abcdefg', undefined],
+    ['', undefined],
+    // malformed url
+    ['https://[invalid/chat/abcdefg', undefined],
+  ]
+
+  it.each(cases)('given input %p, returns %p', (input, expected) => {
+    expect(getChatInviteCodeFromUrl(input)).toEqual(expected)
+  })
+})
@@ -349,7 +349,7 @@ module.exports = function (_config) {
          },
        ],
        [
-          '@mozzius/expo-dynamic-app-icon',
+          '@bsky.app/expo-dynamic-app-icon',
          {
            /**
             * Default set
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><path fill="#000" d="M5 5a1 1 0 0 0-2 0v4a7 7 0 0 0 7 7h8.086l-2.293 2.293a1 1 0 0 0 1.414 1.414l2.94-2.94a2.5 2.5 0 0 0 0-3.535l-2.94-2.94a1 1 0 1 0-1.414 1.415L18.086 14H10a5 5 0 0 1-5-5V5Z"/></svg>
@@ -13,7 +13,7 @@
    "format": "prettier -w src"
  },
  "dependencies": {
-    "@atproto/api": "^0.15.25",
+    "@atproto/api": "0.20.11",
    "preact": "^10.4.8"
  },
  "devDependencies": {
@@ -32,7 +32,7 @@
    "terser": "^5.43.1",
    "typescript": "^6.0.3",
    "typescript-eslint": "^8.20.0",
-    "vite": "^8.0.12",
+    "vite": "^8.0.16",
    "vite-bundle-analyzer": "^1.3.8"
  },
  "resolutions": {
@@ -1,5 +1,6 @@
 import {
  AppBskyEmbedExternal,
+  AppBskyEmbedGallery,
  AppBskyEmbedImages,
  AppBskyEmbedRecord,
  AppBskyEmbedRecordWithMedia,
@@ -43,6 +44,11 @@ export function Embed({
      return <ImageEmbed content={content} labelInfo={labelInfo} />
    }

+    // Case 1b: Gallery (Photos v2)
+    if (AppBskyEmbedGallery.isView(content)) {
+      return <GalleryEmbed content={content} labelInfo={labelInfo} />
+    }
+
    // Case 2: External link
    if (AppBskyEmbedExternal.isView(content)) {
      return <ExternalEmbed content={content} labelInfo={labelInfo} />
@@ -230,6 +236,8 @@ function Info({children}: {children: ComponentChildren}) {
  )
 }

+type GridImage = {thumb: string; alt: string}
+
 function ImageEmbed({
  content,
  labelInfo,
@@ -240,20 +248,45 @@ function ImageEmbed({
  if (labelInfo) {
    return <Info>{labelInfo}</Info>
  }
+  return (
+    <ImageGrid
+      images={content.images.map(i => ({thumb: i.thumb, alt: i.alt}))}
+    />
+  )
+}

-  switch (content.images.length) {
+function GalleryEmbed({
+  content,
+  labelInfo,
+}: {
+  content: AppBskyEmbedGallery.View
+  labelInfo?: string
+}) {
+  if (labelInfo) {
+    return <Info>{labelInfo}</Info>
+  }
+  const images = content.items
+    .filter(AppBskyEmbedGallery.isViewImage)
+    .map(i => ({thumb: i.thumbnail, alt: i.alt}))
+  return <ImageGrid images={images} />
+}
+
+function ImageGrid({images}: {images: GridImage[]}) {
+  switch (images.length) {
+    case 0:
+      return null
    case 1:
      return (
        <img
-          src={content.images[0].thumb}
-          alt={content.images[0].alt}
+          src={images[0].thumb}
+          alt={images[0].alt}
          className="w-full rounded-xl overflow-hidden object-cover h-auto max-h-[1000px]"
        />
      )
    case 2:
      return (
        <div className="flex gap-1 rounded-xl overflow-hidden w-full aspect-[2/1]">
-          {content.images.map((image, i) => (
+          {images.map((image, i) => (
            <img
              key={i}
              src={image.thumb}
@@ -268,13 +301,13 @@ function ImageEmbed({
        <div className="flex gap-1 rounded-xl overflow-hidden w-full aspect-[2/1]">
          <div className="flex-1 aspect-square">
            <img
-              src={content.images[0].thumb}
-              alt={content.images[0].alt}
+              src={images[0].thumb}
+              alt={images[0].alt}
              className="w-full h-full object-cover rounded-sm"
            />
          </div>
          <div className="flex flex-col gap-1 flex-1">
-            {content.images.slice(1).map((image, i) => (
+            {images.slice(1).map((image, i) => (
              <img
                key={i}
                src={image.thumb}
@@ -285,21 +318,36 @@ function ImageEmbed({
          </div>
        </div>
      )
-    case 4:
+    default: {
+      const remaining = images.length - 4
      return (
        <div className="grid grid-cols-2 gap-1 rounded-xl overflow-hidden">
-          {content.images.map((image, i) => (
-            <img
-              key={i}
-              src={image.thumb}
-              alt={image.alt}
-              className="aspect-[3/2] w-full object-cover rounded-sm"
-            />
-          ))}
+          {images.slice(0, 4).map((image, i) => {
+            const isOverflowCell = i === 3 && remaining > 0
+            return (
+              <div
+                key={i}
+                className="relative aspect-[3/2] rounded-sm overflow-hidden">
+                <img
+                  src={image.thumb}
+                  alt={image.alt}
+                  className="absolute inset-0 w-full h-full object-cover"
+                />
+                {isOverflowCell && (
+                  <div
+                    aria-label={`+${remaining} more image${remaining === 1 ? '' : 's'}, view post to see all`}
+                    className="absolute inset-0 flex items-center justify-center bg-black/50">
+                    <span className="text-white text-2xl font-semibold">
+                      +{remaining}
+                    </span>
+                  </div>
+                )}
+              </div>
+            )
+          })}
        </div>
      )
-    default:
-      return null
+    }
  }
 }

@@ -154,7 +154,9 @@ export function Post({thread}: Props) {
 }

 function PostContent({record}: {record: AppBskyFeedPost.Record | null}) {
-  if (!record) return null
+  // text-only check - posts with no text (e.g. gallery posts) would otherwise
+  // render an empty <p> that adds an extra flex gap above the embed
+  if (!record?.text) return null

  const rt = new RichText({
    text: record.text,
@@ -3,30 +3,38 @@
  "version": "0.0.0",
  "type": "module",
  "main": "src/index.ts",
+  "devEngines": {
+    "packageManager": {
+      "name": "pnpm",
+      "version": "11.5.2",
+      "onFail": "warn"
+    }
+  },
  "scripts": {
    "start": "tsx ./src/bin.ts",
-    "dev": "node --watch-path ./src --import tsx ./src/bin.ts",
+    "dev": "LOG_ENABLED=true LOG_LEVEL=debug node --watch-path ./src --import tsx ./src/bin.ts",
    "build": "tsc && cp -r src/assets dist/",
-    "install-fonts": "tsx scripts/install-fonts.ts"
+    "install-fonts": "tsx scripts/install-fonts.ts",
+    "typecheck": "tsc --noEmit"
  },
  "dependencies": {
-    "@atproto/api": "0.12.19-next.0",
-    "@atproto/common": "^0.4.0",
+    "@atproto/api": "0.20.13",
+    "@atproto/common": "^0.6.1",
    "@resvg/resvg-js": "^2.6.2",
    "express": "^4.19.2",
    "express-prom-bundle": "^7.0.0",
    "http-terminator": "^3.2.0",
    "pino": "^9.2.0",
    "prom-client": "^15.1.3",
-    "react": "^18.3.1",
-    "satori": "^0.10.13",
+    "react": "^19.2.6",
+    "satori": "^0.26.0",
    "twemoji": "^14.0.2"
  },
  "devDependencies": {
    "@types/express": "^4.17.21",
    "@types/node": "^24.12.2",
-    "@types/react": "^18.3.1",
+    "@types/react": "^19.2.15",
    "tsx": "^4.21.0",
-    "typescript": "^6.0.2"
+    "typescript": "^6.0.3"
  }
 }
@@ -0,0 +1,11 @@
+nodeLinker: 'hoisted'
+autoInstallPeers: true # default: true
+strictPeerDependencies: false # default: false
+trustPolicy: 'no-downgrade' # default: off
+trustPolicyIgnoreAfter: 10080 # 7 days, default: undefined
+minimumReleaseAgeExclude:
+  - '@atproto/*'
+  - '@bsky.app/*'
+allowBuilds:
+  cbor-extract: true
+  esbuild: true
@@ -0,0 +1,526 @@
+/* eslint-disable bsky-internal/avoid-unwrapped-text */
+import {ChatBskyGroupDefs} from '@atproto/api'
+
+import {Img} from './Img.js'
+
+export const CHAT_INVITE_HEIGHT = 630
+export const CHAT_INVITE_WIDTH = 1200
+
+const PADDING = 64
+
+export function ChatInvite({
+  preview,
+  ownerImage,
+}: {
+  preview: ChatBskyGroupDefs.JoinLinkPreviewView
+  ownerImage: Buffer<ArrayBufferLike> | null
+}) {
+  return (
+    <div
+      style={{
+        width: CHAT_INVITE_WIDTH,
+        height: CHAT_INVITE_HEIGHT,
+        display: 'flex',
+        position: 'relative',
+        backgroundColor: '#006AFF',
+      }}>
+      <Background
+        style={{
+          position: 'absolute',
+          inset: 0,
+        }}
+      />
+      <div
+        style={{
+          width: '100%',
+          height: '100%',
+          display: 'flex',
+          flexDirection: 'column',
+          padding: PADDING,
+          color: 'white',
+          fontFamily: 'Inter',
+        }}>
+        {/* Avatar */}
+        <div
+          style={{
+            display: 'flex',
+            width: 160,
+            height: 160,
+            borderRadius: '50%',
+            overflow: 'hidden',
+          }}>
+          {ownerImage && <Img src={ownerImage} width="100%" height="100%" />}
+        </div>
+
+        {/* Spacer pushes the text block to the bottom-left */}
+        <div style={{display: 'flex', flex: 1}} />
+
+        {/* Group Chat row */}
+        <div
+          style={{
+            display: 'flex',
+            alignItems: 'center',
+            fontSize: 26,
+            fontWeight: 600,
+            lineHeight: 1.3,
+          }}>
+          <ChatIcon style={{marginRight: 8, marginTop: -2}} />
+          Group Chat
+        </div>
+
+        {/* Chat name */}
+        <div
+          style={{
+            display: 'block',
+            fontSize: 80,
+            fontWeight: 700,
+            lineHeight: 1.1,
+            marginTop: 6,
+            minHeight: 130,
+            maxWidth: 1000,
+            wordBreak: 'break-word',
+            lineClamp: 2,
+            textOverflow: 'ellipsis',
+            overflow: 'hidden',
+          }}>
+          {preview.name}
+        </div>
+
+        {/* By @handle */}
+        <div
+          style={{
+            display: 'block',
+            fontSize: 34,
+            fontWeight: 400,
+            marginTop: 12,
+            lineHeight: 1.3,
+            lineClamp: 1,
+            textOverflow: 'ellipsis',
+            overflow: 'hidden',
+            maxWidth: 800,
+            wordBreak: 'break-all',
+          }}>
+          {'By @' + preview.owner.handle}
+        </div>
+      </div>
+    </div>
+  )
+}
+
+function ChatIcon(props: React.SVGProps<SVGSVGElement>) {
+  return (
+    <svg
+      width="32"
+      height="32"
+      viewBox="0 0 32 32"
+      fill="none"
+      xmlns="http://www.w3.org/2000/svg"
+      {...props}>
+      <path
+        d="M9.99935 14.3334C10.9198 14.3334 11.666 15.0796 11.666 16.0001C11.666 16.9206 10.9198 17.6667 9.99935 17.6667C9.07887 17.6667 8.33268 16.9206 8.33268 16.0001C8.33268 15.0796 9.07887 14.3334 9.99935 14.3334Z"
+        fill="white"
+      />
+      <path
+        d="M15.9993 14.3334C16.9198 14.3334 17.666 15.0796 17.666 16.0001C17.666 16.9206 16.9198 17.6667 15.9993 17.6667C15.0789 17.6667 14.3327 16.9206 14.3327 16.0001C14.3327 15.0796 15.0789 14.3334 15.9993 14.3334Z"
+        fill="white"
+      />
+      <path
+        d="M21.9993 14.3334C22.9198 14.3334 23.666 15.0796 23.666 16.0001C23.666 16.9206 22.9198 17.6667 21.9993 17.6667C21.0789 17.6667 20.3327 16.9206 20.3327 16.0001C20.3327 15.0796 21.0789 14.3334 21.9993 14.3334Z"
+        fill="white"
+      />
+      <path
+        fill-rule="evenodd"
+        clip-rule="evenodd"
+        d="M15.9993 2.66675C23.3631 2.66675 29.3327 8.63628 29.3327 16.0001C29.3327 23.3639 23.3631 29.3334 15.9993 29.3334C14.0352 29.3334 12.167 28.9082 10.485 28.1433L4.24414 29.3113C3.80802 29.3927 3.35993 29.2513 3.04883 28.935C2.73759 28.6183 2.60409 28.1668 2.69336 27.7319L3.93424 21.6824C3.12049 19.9572 2.66602 18.0301 2.66602 16.0001C2.66602 8.63629 8.63556 2.66676 15.9993 2.66675ZM15.9993 5.33341C10.1083 5.33343 5.33268 10.1091 5.33268 16.0001C5.33268 17.7656 5.76102 19.4272 6.51758 20.8907C6.65753 21.1615 6.69993 21.4723 6.63867 21.7709L5.70378 26.3243L10.4212 25.4415C10.7058 25.3883 11.0005 25.4298 11.2598 25.5587C12.6861 26.2674 14.2941 26.6667 15.9993 26.6667C21.8904 26.6667 26.666 21.8911 26.666 16.0001C26.666 10.109 21.8904 5.33341 15.9993 5.33341Z"
+        fill="white"
+      />
+    </svg>
+  )
+}
+
+function Background(props: React.SVGProps<SVGSVGElement>) {
+  return (
+    <svg
+      width="1200"
+      height="630"
+      viewBox="0 0 1200 630"
+      fill="none"
+      xmlns="http://www.w3.org/2000/svg"
+      {...props}>
+      <g clip-path="url(#clip0_3134_11977)">
+        <path
+          d="M938.799 522.018C944.511 526.47 950.654 535.496 952.91 540.34C955.166 535.496 961.309 526.47 967.021 522.018C971.142 518.806 977.82 516.32 977.82 524.229C977.82 525.808 976.948 537.498 976.436 539.396C974.658 545.993 968.178 547.676 962.413 546.657C972.489 548.438 975.053 554.335 969.517 560.232C957.062 573.5 952.91 553.134 952.91 553.134C952.91 553.134 948.758 573.5 936.303 560.232C930.768 554.335 933.331 548.438 943.407 546.657C937.642 547.676 931.162 545.993 929.384 539.396C928.872 537.498 928 525.808 928 524.229C928 516.32 934.678 518.806 938.799 522.018Z"
+          fill="white"
+        />
+        <path
+          d="M1008.88 541.392C1012.31 542.653 1014.13 545.565 1014.13 548.825C1014.13 554.346 1010.53 557.693 1003.63 557.693H989.527V526.743H1003.16C1009.73 526.743 1012.9 530.177 1012.9 534.742C1012.9 537.784 1011.55 540.001 1008.88 541.392ZM1002.74 531.568H995.244V539.653H1002.74C1005.66 539.653 1007.23 538.089 1007.23 535.48C1007.23 533.09 1005.62 531.568 1002.74 531.568ZM995.244 552.824H1003.33C1006.55 552.824 1008.29 551.303 1008.29 548.564C1008.29 545.695 1006.64 544.261 1003.33 544.261H995.244V552.824Z"
+          fill="white"
+        />
+        <path
+          d="M1022.06 557.693H1016.72V526.743H1022.06V557.693Z"
+          fill="white"
+        />
+        <path
+          d="M1039.75 547.825V535.263H1045.09V557.693H1039.92V554.432C1038.27 556.954 1035.98 558.214 1033.06 558.214C1028.44 558.214 1025.44 555.345 1025.44 550.129V535.263H1030.77V549.216C1030.77 552.042 1032.13 553.476 1034.88 553.476C1037.46 553.476 1039.75 551.52 1039.75 547.825Z"
+          fill="white"
+        />
+        <path
+          d="M1069.37 546.869V548.173H1053.03C1053.41 552.042 1055.48 553.954 1058.7 553.954C1061.16 553.954 1062.81 552.868 1063.7 550.738H1068.82C1067.68 555.302 1063.87 558.214 1058.66 558.214C1055.4 558.214 1052.77 557.127 1050.78 554.998C1048.79 552.868 1047.78 550.042 1047.78 546.478C1047.78 542.957 1048.75 540.132 1050.74 537.958C1052.73 535.828 1055.31 534.742 1058.57 534.742C1061.88 534.742 1064.5 535.872 1066.45 538.089C1068.4 540.305 1069.37 543.261 1069.37 546.869ZM1058.53 539.001C1055.61 539.001 1053.58 540.74 1053.07 544.348H1064.04C1063.57 541.088 1061.62 539.001 1058.53 539.001Z"
+          fill="white"
+        />
+        <path
+          d="M1081.2 558.301C1074.85 558.301 1071.5 555.737 1071.2 550.564H1076.41C1076.71 553.346 1078.06 554.389 1081.28 554.389C1084.16 554.389 1085.6 553.476 1085.6 551.694C1085.6 550.086 1084.59 549.303 1081.33 548.738L1078.83 548.303C1074.04 547.478 1071.67 545.217 1071.67 541.522C1071.67 537.306 1074.93 534.742 1080.73 534.742C1086.96 534.742 1090.18 537.263 1090.39 542.348H1085.35C1085.22 539.61 1083.65 538.654 1080.73 538.654C1078.19 538.654 1076.92 539.523 1076.92 541.262C1076.92 542.827 1078.02 543.522 1080.56 544L1083.32 544.435C1088.61 545.435 1090.9 547.434 1090.9 551.259C1090.9 555.78 1087.34 558.301 1081.2 558.301Z"
+          fill="white"
+        />
+        <path
+          d="M1114.31 557.693H1108.22L1101.86 547.26L1098.56 550.651V557.693H1093.31V526.743H1098.56V544.565L1107.45 535.263H1113.81L1105.55 543.739L1114.31 557.693Z"
+          fill="white"
+        />
+        <path
+          d="M1128.25 540.914L1130.03 535.263H1135.62L1127.19 559.518C1126.3 561.996 1125.2 563.778 1123.8 564.778C1122.41 565.778 1120.42 566.256 1117.79 566.256C1116.9 566.256 1116.14 566.212 1115.46 566.125V561.822H1117.49C1119.91 561.822 1121.09 560.301 1121.09 558.214C1121.09 557.171 1120.75 555.65 1120.08 553.694L1113.72 535.263H1119.48L1121.26 540.87C1122.58 545.087 1123.72 549.26 1124.74 553.389C1125.67 549.825 1126.85 545.652 1128.25 540.914Z"
+          fill="white"
+        />
+        <g filter="url(#filter0_d_3134_11977)">
+          <rect
+            x="236"
+            y="130"
+            width="145.6"
+            height="145.6"
+            rx="72.8"
+            fill="#4291FF"
+            shape-rendering="crispEdges"
+          />
+          <path
+            d="M308.006 202.8C321.082 202.8 331.09 210.636 335.154 221.624C336.316 224.765 335.52 227.861 333.674 230.062C331.874 232.207 329.095 233.512 326.102 233.512H289.909C286.916 233.512 284.138 232.206 282.339 230.062C280.492 227.861 279.696 224.765 280.858 221.624C284.922 210.636 294.929 202.8 308.006 202.8ZM308.001 168.675C316.482 168.675 323.357 175.551 323.357 184.032C323.357 192.513 316.482 199.387 308.001 199.387C299.52 199.387 292.644 192.513 292.644 184.032C292.644 175.551 299.52 168.675 308.001 168.675Z"
+            fill="#006AFF"
+          />
+        </g>
+        <g filter="url(#filter1_d_3134_11977)">
+          <rect
+            x="316"
+            y="-60"
+            width="191.1"
+            height="191.1"
+            rx="95.55"
+            fill="#4291FF"
+            shape-rendering="crispEdges"
+          />
+          <path
+            d="M412.006 35.5498C429.441 35.55 442.784 45.9985 448.202 60.6484C449.751 64.8366 448.691 68.9642 446.229 71.8984C443.829 74.7581 440.125 76.4999 436.135 76.5H387.876C383.886 76.5 380.182 74.7581 377.783 71.8984C375.32 68.9642 374.26 64.8366 375.809 60.6484C381.227 45.9983 394.571 35.5498 412.006 35.5498ZM411.999 -9.9502C423.307 -9.95 432.474 -0.782514 432.474 10.5254C432.474 21.8332 423.307 30.9998 411.999 31C400.691 31 391.524 21.8333 391.524 10.5254C391.524 -0.782633 400.691 -9.9502 411.999 -9.9502Z"
+            fill="#006AFF"
+          />
+        </g>
+        <g filter="url(#filter2_d_3134_11977)">
+          <rect
+            x="472"
+            y="84"
+            width="246"
+            height="246"
+            rx="123"
+            fill="#4291FF"
+            shape-rendering="crispEdges"
+          />
+          <path
+            d="M596.01 207C618.454 207.001 635.631 220.449 642.606 239.308C644.6 244.7 643.235 250.014 640.065 253.792C636.976 257.472 632.207 259.714 627.071 259.714H564.949C559.812 259.714 555.044 257.473 551.955 253.792C548.785 250.014 547.42 244.7 549.414 239.308C556.388 220.449 573.566 207 596.01 207ZM596.002 148.428C610.558 148.428 622.359 160.229 622.359 174.786C622.359 189.342 610.558 201.143 596.002 201.143C581.445 201.143 569.644 189.342 569.644 174.786C569.644 160.229 581.445 148.428 596.002 148.428Z"
+            fill="#006AFF"
+          />
+        </g>
+        <g filter="url(#filter3_d_3134_11977)">
+          <rect
+            x="870"
+            y="-22"
+            width="308.195"
+            height="308.195"
+            rx="154.098"
+            fill="#4291FF"
+            shape-rendering="crispEdges"
+          />
+          <path
+            d="M1024.01 132.098C1052.13 132.098 1073.65 148.948 1082.39 172.574C1084.89 179.329 1083.18 185.987 1079.21 190.719C1075.34 195.331 1069.36 198.14 1062.93 198.14H985.098C978.663 198.14 972.689 195.331 968.819 190.719C964.848 185.987 963.138 179.329 965.636 172.574C974.374 148.947 995.894 132.098 1024.01 132.098ZM1024 58.7178C1042.24 58.7178 1057.02 73.5023 1057.02 91.7393C1057.02 109.976 1042.24 124.76 1024 124.76C1005.76 124.76 990.981 109.976 990.981 91.7393C990.981 73.5024 1005.76 58.7179 1024 58.7178Z"
+            fill="#006AFF"
+          />
+        </g>
+        <g filter="url(#filter4_d_3134_11977)">
+          <rect
+            x="546"
+            y="-290"
+            width="374"
+            height="374"
+            rx="187"
+            fill="#4291FF"
+            shape-rendering="crispEdges"
+          />
+        </g>
+        <g filter="url(#filter5_d_3134_11977)">
+          <rect
+            x="728"
+            y="222"
+            width="180"
+            height="180"
+            rx="90"
+            fill="#4291FF"
+            shape-rendering="crispEdges"
+          />
+          <path
+            d="M818.006 312C834.429 312 846.998 321.841 852.101 335.64C853.56 339.585 852.561 343.473 850.242 346.237C847.981 348.931 844.492 350.571 840.734 350.571H795.278C791.519 350.571 788.03 348.931 785.77 346.237C783.451 343.473 782.453 339.585 783.912 335.64C789.015 321.841 801.584 312 818.006 312ZM817.999 269.143C828.651 269.143 837.286 277.778 837.286 288.429C837.285 299.08 828.651 307.714 817.999 307.714C807.348 307.714 798.714 299.08 798.714 288.429C798.714 277.778 807.348 269.143 817.999 269.143Z"
+            fill="#006AFF"
+          />
+        </g>
+        <g filter="url(#filter6_d_3134_11977)">
+          <rect
+            x="1146"
+            y="220"
+            width="178"
+            height="178"
+            rx="89"
+            fill="#4291FF"
+            shape-rendering="crispEdges"
+          />
+        </g>
+      </g>
+      <defs>
+        <filter
+          id="filter0_d_3134_11977"
+          x="204"
+          y="114"
+          width="209.6"
+          height="209.6"
+          filterUnits="userSpaceOnUse"
+          color-interpolation-filters="sRGB">
+          <feFlood flood-opacity="0" result="BackgroundImageFix" />
+          <feColorMatrix
+            in="SourceAlpha"
+            type="matrix"
+            values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"
+            result="hardAlpha"
+          />
+          <feOffset dy="16" />
+          <feGaussianBlur stdDeviation="16" />
+          <feComposite in2="hardAlpha" operator="out" />
+          <feColorMatrix
+            type="matrix"
+            values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.04 0"
+          />
+          <feBlend
+            mode="normal"
+            in2="BackgroundImageFix"
+            result="effect1_dropShadow_3134_11977"
+          />
+          <feBlend
+            mode="normal"
+            in="SourceGraphic"
+            in2="effect1_dropShadow_3134_11977"
+            result="shape"
+          />
+        </filter>
+        <filter
+          id="filter1_d_3134_11977"
+          x="284"
+          y="-76"
+          width="255.1"
+          height="255.1"
+          filterUnits="userSpaceOnUse"
+          color-interpolation-filters="sRGB">
+          <feFlood flood-opacity="0" result="BackgroundImageFix" />
+          <feColorMatrix
+            in="SourceAlpha"
+            type="matrix"
+            values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"
+            result="hardAlpha"
+          />
+          <feOffset dy="16" />
+          <feGaussianBlur stdDeviation="16" />
+          <feComposite in2="hardAlpha" operator="out" />
+          <feColorMatrix
+            type="matrix"
+            values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.04 0"
+          />
+          <feBlend
+            mode="normal"
+            in2="BackgroundImageFix"
+            result="effect1_dropShadow_3134_11977"
+          />
+          <feBlend
+            mode="normal"
+            in="SourceGraphic"
+            in2="effect1_dropShadow_3134_11977"
+            result="shape"
+          />
+        </filter>
+        <filter
+          id="filter2_d_3134_11977"
+          x="440"
+          y="68"
+          width="310"
+          height="310"
+          filterUnits="userSpaceOnUse"
+          color-interpolation-filters="sRGB">
+          <feFlood flood-opacity="0" result="BackgroundImageFix" />
+          <feColorMatrix
+            in="SourceAlpha"
+            type="matrix"
+            values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"
+            result="hardAlpha"
+          />
+          <feOffset dy="16" />
+          <feGaussianBlur stdDeviation="16" />
+          <feComposite in2="hardAlpha" operator="out" />
+          <feColorMatrix
+            type="matrix"
+            values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.04 0"
+          />
+          <feBlend
+            mode="normal"
+            in2="BackgroundImageFix"
+            result="effect1_dropShadow_3134_11977"
+          />
+          <feBlend
+            mode="normal"
+            in="SourceGraphic"
+            in2="effect1_dropShadow_3134_11977"
+            result="shape"
+          />
+        </filter>
+        <filter
+          id="filter3_d_3134_11977"
+          x="838"
+          y="-38"
+          width="372.195"
+          height="372.195"
+          filterUnits="userSpaceOnUse"
+          color-interpolation-filters="sRGB">
+          <feFlood flood-opacity="0" result="BackgroundImageFix" />
+          <feColorMatrix
+            in="SourceAlpha"
+            type="matrix"
+            values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"
+            result="hardAlpha"
+          />
+          <feOffset dy="16" />
+          <feGaussianBlur stdDeviation="16" />
+          <feComposite in2="hardAlpha" operator="out" />
+          <feColorMatrix
+            type="matrix"
+            values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.04 0"
+          />
+          <feBlend
+            mode="normal"
+            in2="BackgroundImageFix"
+            result="effect1_dropShadow_3134_11977"
+          />
+          <feBlend
+            mode="normal"
+            in="SourceGraphic"
+            in2="effect1_dropShadow_3134_11977"
+            result="shape"
+          />
+        </filter>
+        <filter
+          id="filter4_d_3134_11977"
+          x="514"
+          y="-306"
+          width="438"
+          height="438"
+          filterUnits="userSpaceOnUse"
+          color-interpolation-filters="sRGB">
+          <feFlood flood-opacity="0" result="BackgroundImageFix" />
+          <feColorMatrix
+            in="SourceAlpha"
+            type="matrix"
+            values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"
+            result="hardAlpha"
+          />
+          <feOffset dy="16" />
+          <feGaussianBlur stdDeviation="16" />
+          <feComposite in2="hardAlpha" operator="out" />
+          <feColorMatrix
+            type="matrix"
+            values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.04 0"
+          />
+          <feBlend
+            mode="normal"
+            in2="BackgroundImageFix"
+            result="effect1_dropShadow_3134_11977"
+          />
+          <feBlend
+            mode="normal"
+            in="SourceGraphic"
+            in2="effect1_dropShadow_3134_11977"
+            result="shape"
+          />
+        </filter>
+        <filter
+          id="filter5_d_3134_11977"
+          x="696"
+          y="206"
+          width="244"
+          height="244"
+          filterUnits="userSpaceOnUse"
+          color-interpolation-filters="sRGB">
+          <feFlood flood-opacity="0" result="BackgroundImageFix" />
+          <feColorMatrix
+            in="SourceAlpha"
+            type="matrix"
+            values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"
+            result="hardAlpha"
+          />
+          <feOffset dy="16" />
+          <feGaussianBlur stdDeviation="16" />
+          <feComposite in2="hardAlpha" operator="out" />
+          <feColorMatrix
+            type="matrix"
+            values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.04 0"
+          />
+          <feBlend
+            mode="normal"
+            in2="BackgroundImageFix"
+            result="effect1_dropShadow_3134_11977"
+          />
+          <feBlend
+            mode="normal"
+            in="SourceGraphic"
+            in2="effect1_dropShadow_3134_11977"
+            result="shape"
+          />
+        </filter>
+        <filter
+          id="filter6_d_3134_11977"
+          x="1114"
+          y="204"
+          width="242"
+          height="242"
+          filterUnits="userSpaceOnUse"
+          color-interpolation-filters="sRGB">
+          <feFlood flood-opacity="0" result="BackgroundImageFix" />
+          <feColorMatrix
+            in="SourceAlpha"
+            type="matrix"
+            values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0"
+            result="hardAlpha"
+          />
+          <feOffset dy="16" />
+          <feGaussianBlur stdDeviation="16" />
+          <feComposite in2="hardAlpha" operator="out" />
+          <feColorMatrix
+            type="matrix"
+            values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.04 0"
+          />
+          <feBlend
+            mode="normal"
+            in2="BackgroundImageFix"
+            result="effect1_dropShadow_3134_11977"
+          />
+          <feBlend
+            mode="normal"
+            in="SourceGraphic"
+            in2="effect1_dropShadow_3134_11977"
+            result="shape"
+          />
+        </filter>
+        <clipPath id="clip0_3134_11977">
+          <rect width="1200" height="630" fill="white" />
+        </clipPath>
+      </defs>
+    </svg>
+  )
+}
@@ -3,6 +3,7 @@ import {type AppBskyGraphDefs, AppBskyGraphStarterpack} from '@atproto/api'

 import {Butterfly} from './Butterfly.js'
 import {Img} from './Img.js'
+import * as bsky from '../types/bsky/index.js'

 export const STARTERPACK_HEIGHT = 630
 export const STARTERPACK_WIDTH = 1200
@@ -17,7 +18,10 @@ export function StarterPack(props: {
  images: Map<string, Buffer>
 }) {
  const {starterPack, images} = props
-  const record = AppBskyGraphStarterpack.isRecord(starterPack.record)
+  const record = bsky.dangerousIsType<AppBskyGraphStarterpack.Record>(
+    starterPack.record,
+    AppBskyGraphStarterpack.isRecord,
+  )
    ? starterPack.record
    : null
  const imagesArray = [...images.values()]
@@ -53,6 +57,7 @@ export function StarterPack(props: {
        backgroundColor: 'black',
        color: 'white',
        fontFamily: 'Inter',
+        fontWeight: 700,
      }}>
      {/* image tiles */}
      <div
@@ -133,6 +138,7 @@ export function StarterPack(props: {
            fontSize: isLongTitle ? 55 : 65,
            display: 'flex',
            textAlign: 'center',
+            textWrap: 'balance',
          }}>
          {record?.name || 'Starter Pack'}
        </div>
@@ -9,6 +9,7 @@ export type ServiceConfig = {
  metricsPort: number
  version?: string
  appviewUrl: string
+  chatUrl: string
  originVerify?: string
 }

@@ -17,6 +18,7 @@ export type Environment = {
  metricsPort?: number
  version?: string
  appviewUrl?: string
+  chatUrl?: string
  originVerify?: string
 }

@@ -26,6 +28,7 @@ export const readEnv = (): Environment => {
    metricsPort: envInt('CARD_METRICS_PORT'),
    version: envStr('CARD_VERSION'),
    appviewUrl: envStr('CARD_APPVIEW_URL'),
+    chatUrl: envStr('CARD_CHAT_URL'),
    originVerify: envStr('CARD_ORIGIN_VERIFY'),
  }
 }
@@ -36,6 +39,7 @@ export const envToCfg = (env: Environment): Config => {
    metricsPort: env.metricsPort ?? 3001,
    version: env.version,
    appviewUrl: env.appviewUrl ?? 'https://api.bsky.app',
+    chatUrl: env.chatUrl ?? 'https://api.bsky.chat',
    originVerify: env.originVerify,
  }
  return {
@@ -3,6 +3,7 @@ import * as path from 'node:path'
 import {fileURLToPath} from 'node:url'

 import {AtpAgent} from '@atproto/api'
+import {type FontWeight} from 'satori'

 import {type Config} from './config.js'

@@ -11,13 +12,15 @@ const __DIRNAME = path.dirname(fileURLToPath(import.meta.url))
 export type AppContextOptions = {
  cfg: Config
  appviewAgent: AtpAgent
-  fonts: {name: string; data: Buffer}[]
+  chatAgent: AtpAgent
+  fonts: {name: string; data: Buffer; weight?: FontWeight}[]
 }

 export class AppContext {
  cfg: Config
  appviewAgent: AtpAgent
-  fonts: {name: string; data: Buffer}[]
+  chatAgent: AtpAgent
+  fonts: {name: string; data: Buffer; weight?: FontWeight}[]
  abortController = new AbortController()

  private opts: AppContextOptions
@@ -26,24 +29,46 @@ export class AppContext {
    this.opts = opts
    this.cfg = opts.cfg
    this.appviewAgent = opts.appviewAgent
+    this.chatAgent = opts.chatAgent
    this.fonts = opts.fonts
  }

  static async fromConfig(cfg: Config, overrides?: Partial<AppContextOptions>) {
    const appviewAgent = new AtpAgent({service: cfg.service.appviewUrl})
+    const chatAgent = new AtpAgent({service: cfg.service.chatUrl})
    const fontDirectory = path.join(__DIRNAME, 'assets', 'fonts')
    const fontFiles = readdirSync(fontDirectory)
    const fonts = fontFiles.map(file => {
      return {
-        name: path.basename(file, path.extname(file)),
+        name: getName(file),
        data: readFileSync(path.join(fontDirectory, file)),
+        weight: getWeight(file),
      }
    })
    return new AppContext({
      cfg,
      appviewAgent,
+      chatAgent,
      fonts,
      ...overrides,
    })
  }
 }
+
+function getName(file: string): string {
+  const base = path.basename(file, path.extname(file))
+  if (base.startsWith('Inter-')) return 'Inter'
+  return base
+}
+
+function getWeight(file: string): FontWeight {
+  switch (path.basename(file, path.extname(file))) {
+    case 'Inter-Regular':
+      return 400
+    case 'Inter-SemiBold':
+      return 600
+    case 'Inter-Bold':
+    default:
+      return 700
+  }
+}
@@ -0,0 +1,82 @@
+import assert from 'node:assert'
+
+import {ChatBskyGroupDefs} from '@atproto/api'
+import resvg from '@resvg/resvg-js'
+import {type Express} from 'express'
+import satori from 'satori'
+
+import {
+  CHAT_INVITE_HEIGHT,
+  CHAT_INVITE_WIDTH,
+  ChatInvite,
+} from '../components/ChatInvite.js'
+import {type AppContext} from '../context.js'
+import {httpLogger} from '../logger.js'
+import {loadEmojiAsSvg} from '../util.js'
+import {
+  getImage,
+  handler,
+  hideAvatarLabels,
+  originVerifyMiddleware,
+} from './util.js'
+
+export default function (ctx: AppContext, app: Express) {
+  return app.get(
+    '/chat-invite/:code',
+    originVerifyMiddleware(ctx),
+    handler(async (req, res) => {
+      const {code} = req.params
+      let preview: ChatBskyGroupDefs.JoinLinkPreviewView
+      try {
+        const result = await ctx.chatAgent.chat.bsky.group.getJoinLinkPreviews({
+          codes: [code],
+        })
+        const found = result.data.joinLinkPreviews[0]
+        if (!ChatBskyGroupDefs.isJoinLinkPreviewView(found)) {
+          return res.status(404).end('not found')
+        }
+        preview = found
+      } catch (err) {
+        httpLogger.warn({err, code}, 'could not fetch chat invite preview')
+        return res.status(404).end('not found')
+      }
+
+      // Load the owner's avatar (if any, and not labeled).
+      let ownerImage: Buffer | null = null
+      const owner = preview.owner
+      const ownerHasSafeAvatar =
+        !!owner.avatar && !owner.labels?.some(l => hideAvatarLabels.has(l.val))
+      if (ownerHasSafeAvatar) {
+        try {
+          assert(owner.avatar)
+          ownerImage = await getImage(owner.avatar)
+        } catch (err) {
+          httpLogger.warn(
+            {err, code, did: owner.did},
+            'could not fetch owner image',
+          )
+        }
+      }
+
+      const svg = await satori(
+        <ChatInvite preview={preview} ownerImage={ownerImage} />,
+        {
+          fonts: ctx.fonts,
+          height: CHAT_INVITE_HEIGHT,
+          width: CHAT_INVITE_WIDTH,
+          loadAdditionalAsset: async (lang, text) => {
+            if (lang === 'emoji') {
+              return (await loadEmojiAsSvg(text)) ?? ''
+            }
+            return ''
+          },
+        },
+      )
+      const output = await resvg.renderAsync(svg)
+      res.statusCode = 200
+      res.setHeader('content-type', 'image/png')
+      res.setHeader('cdn-tag', owner.did)
+      return res.end(output.asPng())
+    }),
+  )
+}
@@ -2,6 +2,7 @@ import {type Express} from 'express'

 import {type AppContext} from '../context.js'
 import {default as avatarBubbles} from './avatar-bubbles.js'
+import {default as chatInvite} from './chat-invite.js'
 import {default as health} from './health.js'
 import {default as starterPack} from './starter-pack.js'

@@ -10,6 +11,7 @@ export * from './util.js'
 export default function (ctx: AppContext, app: Express) {
  app = health(ctx, app) // GET /_health
  app = starterPack(ctx, app) // GET /start/:actor/:rkey
+  app = chatInvite(ctx, app) // GET /chat-invite/:code
  app = avatarBubbles(ctx, app) // GET /avatar-bubbles?dids=...
  return app
 }
@@ -19,6 +19,7 @@ import {
  hideAvatarLabels,
  originVerifyMiddleware,
 } from './util.js'
+import * as bsky from '../types/bsky/index.js'

 export default function (ctx: AppContext, app: Express) {
  return app.get(
@@ -29,9 +30,9 @@ export default function (ctx: AppContext, app: Express) {
      const uri = AtUri.make(actor, 'app.bsky.graph.starterpack', rkey)
      let starterPack: AppBskyGraphDefs.StarterPackView
      try {
-        const result = await ctx.appviewAgent.api.app.bsky.graph.getStarterPack(
-          {starterPack: uri.toString()},
-        )
+        const result = await ctx.appviewAgent.app.bsky.graph.getStarterPack({
+          starterPack: uri.toString(),
+        })
        starterPack = result.data.starterPack
      } catch (err) {
        httpLogger.warn(
@@ -41,7 +42,7 @@ export default function (ctx: AppContext, app: Express) {
        return res.status(404).end('not found')
      }
      const imageEntries = await Promise.all(
-        [starterPack.creator]
+        ([starterPack.creator] as Array<bsky.profile.AnyProfileView>)
          .concat((starterPack.listItemsSample ?? []).map(li => li.subject))
          // has avatar
          .filter(p => p.avatar)
@@ -0,0 +1,50 @@
+import {type ValidationResult} from '@atproto/lexicon'
+
+export * as profile from './profile.js'
+export * as starterPack from './starterPack.js'
+
+/**
+ * Fast type checking without full schema validation, for use with data we
+ * trust, or for non-critical path use cases. Why? Our SDK's `is*` identity
+ * utils do not assert the type of the entire object, only the `$type` string.
+ *
+ * For full validation of the object schema, use the `validate` export from
+ * this file.
+ *
+ * Usage:
+ * ```ts
+ * import * as bsky from '#/types/bsky'
+ *
+ * if (bsky.dangerousIsType<AppBskyFeedPost.Record>(item, AppBskyFeedPost.isRecord)) {
+ *   // `item` has type `$Typed<AppBskyFeedPost.Record>` here
+ * }
+ * ```
+ */
+export function dangerousIsType<R extends {$type?: string}>(
+  record: unknown,
+  identity: <V>(v: V) => v is V & {$type: NonNullable<R['$type']>},
+): record is R {
+  return identity(record)
+}
+
+/**
+ * Fully validates the object schema, which has a performance cost.
+ *
+ * For faster checks with data we trust, like that from our app view, use the
+ * `dangerousIsType` export from this same file.
+ *
+ * Usage:
+ * ```ts
+ * import * as bsky from '#/types/bsky'
+ *
+ * if (bsky.validate(item, AppBskyFeedPost.validateRecord)) {
+ *   // `item` has type `$Typed<AppBskyFeedPost.Record>` here
+ * }
+ * ```
+ */
+export function validate<R extends {$type?: string}>(
+  record: unknown,
+  validator: (v: unknown) => ValidationResult<R>,
+): record is R {
+  return validator(record).success
+}
@@ -0,0 +1,10 @@
+import {type AppBskyActorDefs, type ChatBskyActorDefs} from '@atproto/api'
+
+/**
+ * Matches any profile view exported by our SDK
+ */
+export type AnyProfileView =
+  | AppBskyActorDefs.ProfileViewBasic
+  | AppBskyActorDefs.ProfileView
+  | AppBskyActorDefs.ProfileViewDetailed
+  | ChatBskyActorDefs.ProfileViewBasic
@@ -0,0 +1,11 @@
+import {AppBskyGraphDefs} from '@atproto/api'
+
+export const isBasicView = AppBskyGraphDefs.isStarterPackViewBasic
+export const isView = AppBskyGraphDefs.isStarterPackView
+
+/**
+ * Matches any starter pack view exported by our SDK
+ */
+export type AnyStarterPackView =
+  | AppBskyGraphDefs.StarterPackViewBasic
+  | AppBskyGraphDefs.StarterPackView
@@ -10,5 +10,5 @@
    "outDir": "dist",
    "skipLibCheck": true
  },
-  "include": ["./src/index.ts", "./src/bin.ts"]
+  "include": ["./src/**/*"]
 }
@@ -0,0 +1,37 @@
+package main
+
+import (
+	appbsky "github.com/bluesky-social/indigo/api/bsky"
+)
+
+// Helpers for extracting Open Graph metadata from post embeds. og:video
+// shares findVideoEmbed with the JSON-LD VideoObject path in jsonld.go so
+// the two outputs cannot drift.
+
+// videoMeta holds og:video meta tag data.
+type videoMeta struct {
+	URL     string
+	Type    string
+	Width   int64
+	Height  int64
+	HasSize bool
+}
+
+// extractVideoMeta returns og:video metadata, or the zero value if there's
+// no video embed. Respects embedHidden so og:video and og:image stay in sync.
+func extractVideoMeta(pv *appbsky.FeedDefs_PostView, embedHidden bool) videoMeta {
+	v := findVideoEmbed(pv, embedHidden)
+	if v == nil || v.Playlist == "" {
+		return videoMeta{}
+	}
+	out := videoMeta{
+		URL:  v.Playlist,
+		Type: "application/vnd.apple.mpegurl",
+	}
+	if v.AspectRatio != nil {
+		out.Width = v.AspectRatio.Width
+		out.Height = v.AspectRatio.Height
+		out.HasSize = true
+	}
+	return out
+}
@@ -0,0 +1,69 @@
+package main
+
+import (
+	"testing"
+
+	appbsky "github.com/bluesky-social/indigo/api/bsky"
+)
+
+func TestExtractVideoMeta(t *testing.T) {
+	// Plain post — no video.
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc", "hi")
+	if vm := extractVideoMeta(pv, false); vm.URL != "" {
+		t.Errorf("non-video post produced video meta: %+v", vm)
+	}
+
+	// Video embed with playlist + aspect ratio.
+	playlist := "https://video.bsky.app/playlist.m3u8"
+	pv = makePostView("alice.bsky.social", "did:plc:alice", "abc", "watch")
+	pv.Embed = &appbsky.FeedDefs_PostView_Embed{
+		EmbedVideo_View: &appbsky.EmbedVideo_View{
+			Thumbnail:   strPtr("https://cdn.bsky.app/thumb@jpg"),
+			Playlist:    playlist,
+			AspectRatio: &appbsky.EmbedDefs_AspectRatio{Width: 16, Height: 9},
+		},
+	}
+	vm := extractVideoMeta(pv, false)
+	if vm.URL != playlist {
+		t.Errorf("URL wrong: %v", vm.URL)
+	}
+	if vm.Type != "application/vnd.apple.mpegurl" {
+		t.Errorf("Type wrong: %v", vm.Type)
+	}
+	if !vm.HasSize || vm.Width != 16 || vm.Height != 9 {
+		t.Errorf("aspect ratio not propagated: %+v", vm)
+	}
+
+	// Hidden embed gate suppresses video too.
+	if vm := extractVideoMeta(pv, true); vm.URL != "" {
+		t.Errorf("hidden embed should suppress video meta")
+	}
+
+	// Video inside record-with-media.
+	pv2 := makePostView("alice.bsky.social", "did:plc:alice", "abc", "quote w/ video")
+	pv2.Embed = &appbsky.FeedDefs_PostView_Embed{
+		EmbedRecordWithMedia_View: &appbsky.EmbedRecordWithMedia_View{
+			Media: &appbsky.EmbedRecordWithMedia_View_Media{
+				EmbedVideo_View: &appbsky.EmbedVideo_View{Playlist: playlist},
+			},
+		},
+	}
+	vm2 := extractVideoMeta(pv2, false)
+	if vm2.URL != playlist {
+		t.Errorf("record-with-media video URL not extracted: %+v", vm2)
+	}
+	if vm2.HasSize {
+		t.Errorf("expected HasSize=false when no aspect ratio")
+	}
+
+	// Video without playlist — skip entirely.
+	pv3 := makePostView("alice.bsky.social", "did:plc:alice", "abc", "no playlist")
+	pv3.Embed = &appbsky.FeedDefs_PostView_Embed{
+		EmbedVideo_View: &appbsky.EmbedVideo_View{
+			Thumbnail: strPtr("https://cdn.bsky.app/thumb@jpg"),
+		},
+	}
+	if vm := extractVideoMeta(pv3, false); vm.URL != "" {
+		t.Errorf("video without playlist should produce empty meta, got %+v", vm)
+	}
+}
@@ -0,0 +1,690 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+
+	appbsky "github.com/bluesky-social/indigo/api/bsky"
+	"github.com/bluesky-social/indigo/atproto/syntax"
+)
+
+// schema.org structured-data types emitted on post and profile pages.
+// Building these as Go structs (rather than inline JSON in templates) gives
+// us correct JSON escaping via encoding/json and a single place to test the
+// schema. Optional fields use omitempty so empty values don't reach Google's
+// validator as null/empty strings.
+
+const schemaOrgContext = "https://schema.org"
+
+type interactionStat struct {
+	Type                 string `json:"@type"`
+	InteractionType      string `json:"interactionType"`
+	UserInteractionCount int64  `json:"userInteractionCount"`
+}
+
+type personOrOrg struct {
+	Type                 string            `json:"@type"`
+	Name                 string            `json:"name,omitempty"`
+	AlternateName        string            `json:"alternateName,omitempty"`
+	Identifier           string            `json:"identifier,omitempty"`
+	URL                  string            `json:"url,omitempty"`
+	Description          string            `json:"description,omitempty"`
+	Image                string            `json:"image,omitempty"`
+	InteractionStat      []interactionStat `json:"interactionStatistic,omitempty"`
+	AgentInteractionStat []interactionStat `json:"agentInteractionStatistic,omitempty"`
+	ReviewedBy           []*verifier       `json:"reviewedBy,omitempty"`
+}
+
+// verifier is the schema.org Person shape emitted under Person.reviewedBy.
+// Narrower than personOrOrg: just enough to identify the verifying entity.
+type verifier struct {
+	Type          string `json:"@type"`
+	Name          string `json:"name,omitempty"`
+	AlternateName string `json:"alternateName,omitempty"`
+	Identifier    string `json:"identifier,omitempty"`
+	URL           string `json:"url,omitempty"`
+}
+
+type sharedContent struct {
+	Type string `json:"@type"`
+	URL  string `json:"url"`
+}
+
+type discussionForumPosting struct {
+	Context         string            `json:"@context,omitempty"`
+	Type            string            `json:"@type"`
+	URL             string            `json:"url,omitempty"`
+	Identifier      string            `json:"identifier,omitempty"`
+	Author          *personOrOrg      `json:"author,omitempty"`
+	Text            string            `json:"text,omitempty"`
+	Image           []string          `json:"image,omitempty"`
+	ThumbnailURL    string            `json:"thumbnailUrl,omitempty"`
+	Video           *videoObject      `json:"video,omitempty"`
+	DatePublished   string            `json:"datePublished,omitempty"`
+	InteractionStat []interactionStat `json:"interactionStatistic,omitempty"`
+	CommentCount    *int64            `json:"commentCount,omitempty"`
+	Comment         []comment         `json:"comment,omitempty"`
+	IsBasedOn       string            `json:"isBasedOn,omitempty"`
+	SharedContent   *sharedContent    `json:"sharedContent,omitempty"`
+}
+
+// videoObject is the schema.org VideoObject shape for video embeds.
+// duration is omitted because the appview does not expose it.
+type videoObject struct {
+	Type         string `json:"@type"`
+	Name         string `json:"name,omitempty"`
+	Description  string `json:"description,omitempty"`
+	ThumbnailURL string `json:"thumbnailUrl,omitempty"`
+	UploadDate   string `json:"uploadDate,omitempty"`
+	ContentURL   string `json:"contentUrl,omitempty"`
+	EmbedURL     string `json:"embedUrl,omitempty"`
+	Width        int64  `json:"width,omitempty"`
+	Height       int64  `json:"height,omitempty"`
+}
+
+// comment is the schema.org Comment shape used in
+// DiscussionForumPosting.comment[]. The comment property does not accept
+// DiscussionForumPosting, so replies map to Comment.
+type comment struct {
+	Type          string       `json:"@type"`
+	URL           string       `json:"url,omitempty"`
+	Identifier    string       `json:"identifier,omitempty"`
+	Author        *personOrOrg `json:"author,omitempty"`
+	Text          string       `json:"text,omitempty"`
+	Image         []string     `json:"image,omitempty"`
+	ThumbnailURL  string       `json:"thumbnailUrl,omitempty"`
+	Video         *videoObject `json:"video,omitempty"`
+	DatePublished string       `json:"datePublished,omitempty"`
+}
+
+type webPage struct {
+	Context    string                 `json:"@context"`
+	Type       string                 `json:"@type"`
+	URL        string                 `json:"url,omitempty"`
+	MainEntity discussionForumPosting `json:"mainEntity"`
+}
+
+type profilePage struct {
+	Context     string                   `json:"@context"`
+	Type        string                   `json:"@type"`
+	DateCreated string                   `json:"dateCreated,omitempty"`
+	MainEntity  *personOrOrg             `json:"mainEntity"`
+	HasPart     []discussionForumPosting `json:"hasPart,omitempty"`
+}
+
+// maxComments caps DiscussionForumPosting.comment[] to keep SSR HTML small.
+const maxComments = 10
+
+// maxRecentPosts caps ProfilePage.hasPart[].
+const maxRecentPosts = 10
+
+// maxReviewedBy caps Person.reviewedBy entries.
+const maxReviewedBy = 10
+
+// authorFeedFetchLimit oversamples getAuthorFeed because posts_no_replies
+// still returns reposts; we drop those client-side. 3x is a safe margin.
+const authorFeedFetchLimit = 3 * maxRecentPosts
+
+// bskyPostURL returns the canonical handle-form post URL, or "" if handle
+// or rkey is unusable.
+func bskyPostURL(handle, rkey string) string {
+	if handle == "" || handle == "handle.invalid" || rkey == "" {
+		return ""
+	}
+	return fmt.Sprintf("https://bsky.app/profile/%s/post/%s", handle, rkey)
+}
+
+// bskyPostURLFromATURI is bskyPostURL for callers holding an at-uri.
+func bskyPostURLFromATURI(handle, atURI string) string {
+	parsed, err := syntax.ParseATURI(atURI)
+	if err != nil {
+		return ""
+	}
+	return bskyPostURL(handle, parsed.RecordKey().String())
+}
+
+// bskyPostURLFromATURIWithDIDFallback returns the handle-form post URL
+// when the handle is usable, otherwise falls back to the DID-form URL
+// derived from the AT-URI's authority. Returns "" only when the AT-URI is
+// unparseable or has no record key. Used for nested fields (e.g.
+// VideoObject.embedUrl) where omitting on handle.invalid would weaken the
+// emitted structured data.
+func bskyPostURLFromATURIWithDIDFallback(handle, atURI string) string {
+	parsed, err := syntax.ParseATURI(atURI)
+	if err != nil {
+		return ""
+	}
+	rkey := parsed.RecordKey().String()
+	if rkey == "" {
+		return ""
+	}
+	if url := bskyPostURL(handle, rkey); url != "" {
+		return url
+	}
+	did := parsed.Authority().String()
+	if did == "" {
+		return ""
+	}
+	return fmt.Sprintf("https://bsky.app/profile/%s/post/%s", did, rkey)
+}
+
+// bskyProfileURL returns the canonical handle-form profile URL, or "" if
+// the handle is unusable.
+func bskyProfileURL(handle string) string {
+	if handle == "" || handle == "handle.invalid" {
+		return ""
+	}
+	return fmt.Sprintf("https://bsky.app/profile/%s", handle)
+}
+
+// extractPostMedia returns thumbnail URLs for the post's image, gallery,
+// or video embed, byte-identical to what we put in og:image. Callers
+// derive thumbnailUrl from urls[0].
+func extractPostMedia(pv *appbsky.FeedDefs_PostView, embedHidden bool) []string {
+	if pv == nil || pv.Embed == nil || embedHidden {
+		return nil
+	}
+
+	if pv.Embed.EmbedImages_View != nil {
+		return imageThumbs(pv.Embed.EmbedImages_View.Images)
+	}
+	if pv.Embed.EmbedGallery_View != nil {
+		return galleryThumbs(pv.Embed.EmbedGallery_View.Items)
+	}
+	if pv.Embed.EmbedVideo_View != nil && pv.Embed.EmbedVideo_View.Thumbnail != nil {
+		return []string{*pv.Embed.EmbedVideo_View.Thumbnail}
+	}
+	if pv.Embed.EmbedRecordWithMedia_View != nil && pv.Embed.EmbedRecordWithMedia_View.Media != nil {
+		media := pv.Embed.EmbedRecordWithMedia_View.Media
+		if media.EmbedImages_View != nil {
+			return imageThumbs(media.EmbedImages_View.Images)
+		}
+		if media.EmbedGallery_View != nil {
+			return galleryThumbs(media.EmbedGallery_View.Items)
+		}
+		if media.EmbedVideo_View != nil && media.EmbedVideo_View.Thumbnail != nil {
+			return []string{*media.EmbedVideo_View.Thumbnail}
+		}
+	}
+	return nil
+}
+
+// imageThumbs returns the thumb URLs, or nil if empty.
+func imageThumbs(images []*appbsky.EmbedImages_ViewImage) []string {
+	if len(images) == 0 {
+		return nil
+	}
+	urls := make([]string, 0, len(images))
+	for _, img := range images {
+		urls = append(urls, img.Thumb)
+	}
+	return urls
+}
+
+// galleryThumbs returns the thumbnail URLs of image items in a gallery
+// embed, or nil if empty. Items_Elem is a union; non-image variants and
+// nil entries are skipped so future gallery item types don't break SEO
+// extraction. Empty Thumbnail strings are also skipped to avoid emitting
+// <meta property="og:image" content=""> if the appview ever returns one.
+func galleryThumbs(items []*appbsky.EmbedGallery_View_Items_Elem) []string {
+	if len(items) == 0 {
+		return nil
+	}
+	urls := make([]string, 0, len(items))
+	for _, item := range items {
+		if item == nil || item.EmbedGallery_ViewImage == nil {
+			continue
+		}
+		if item.EmbedGallery_ViewImage.Thumbnail == "" {
+			continue
+		}
+		urls = append(urls, item.EmbedGallery_ViewImage.Thumbnail)
+	}
+	if len(urls) == 0 {
+		return nil
+	}
+	return urls
+}
+
+// findVideoEmbed returns the post's video embed view, or nil if there is
+// none or embeds are hidden. Shared with extractVideoMeta so og:video and
+// JSON-LD VideoObject stay in sync.
+func findVideoEmbed(pv *appbsky.FeedDefs_PostView, embedHidden bool) *appbsky.EmbedVideo_View {
+	if pv == nil || pv.Embed == nil || embedHidden {
+		return nil
+	}
+	if pv.Embed.EmbedVideo_View != nil {
+		return pv.Embed.EmbedVideo_View
+	}
+	if pv.Embed.EmbedRecordWithMedia_View != nil &&
+		pv.Embed.EmbedRecordWithMedia_View.Media != nil &&
+		pv.Embed.EmbedRecordWithMedia_View.Media.EmbedVideo_View != nil {
+		return pv.Embed.EmbedRecordWithMedia_View.Media.EmbedVideo_View
+	}
+	return nil
+}
+
+// buildVideoObject returns a VideoObject for the post's video embed, or
+// nil if there's no usable video. Falls back to "Video by @<handle>" when
+// alt text is empty so name is always populated (Google requires it).
+// description falls back to name for the same reason.
+func buildVideoObject(pv *appbsky.FeedDefs_PostView, embedURL, postText string, embedHidden bool) *videoObject {
+	v := findVideoEmbed(pv, embedHidden)
+	if v == nil || v.Playlist == "" {
+		return nil
+	}
+	vo := &videoObject{
+		Type:       "VideoObject",
+		ContentURL: v.Playlist,
+		EmbedURL:   embedURL,
+		// uploadDate uses IndexedAt (not record CreatedAt) for consistency
+		// with DiscussionForumPosting.datePublished on the parent post.
+		UploadDate: pv.IndexedAt,
+	}
+	if v.Thumbnail != nil {
+		vo.ThumbnailURL = *v.Thumbnail
+	}
+	switch {
+	case v.Alt != nil && *v.Alt != "":
+		vo.Name = *v.Alt
+	case pv.Author != nil && pv.Author.Handle != "" && pv.Author.Handle != "handle.invalid":
+		vo.Name = "Video by @" + pv.Author.Handle
+	default:
+		vo.Name = "Video on Bluesky"
+	}
+	if postText != "" {
+		vo.Description = postText
+	} else {
+		vo.Description = vo.Name
+	}
+	if v.AspectRatio != nil {
+		vo.Width = v.AspectRatio.Width
+		vo.Height = v.AspectRatio.Height
+	}
+	return vo
+}
+
+// extractQuotedPostURL returns the canonical URL of a quoted post, or ""
+// if the embed is blocked / not-found / detached / a non-post record.
+func extractQuotedPostURL(pv *appbsky.FeedDefs_PostView) string {
+	if pv == nil || pv.Embed == nil {
+		return ""
+	}
+	var rec *appbsky.EmbedRecord_View
+	if pv.Embed.EmbedRecord_View != nil {
+		rec = pv.Embed.EmbedRecord_View
+	} else if pv.Embed.EmbedRecordWithMedia_View != nil {
+		rec = pv.Embed.EmbedRecordWithMedia_View.Record
+	}
+	if rec == nil || rec.Record == nil {
+		return ""
+	}
+	vr := rec.Record.EmbedRecord_ViewRecord
+	if vr == nil || vr.Author == nil {
+		return ""
+	}
+	return bskyPostURLFromATURI(vr.Author.Handle, vr.Uri)
+}
+
+// extractSharedContentURL returns the URL of an external link embed (also
+// from the media slot of a record-with-media embed).
+func extractSharedContentURL(pv *appbsky.FeedDefs_PostView) string {
+	if pv == nil || pv.Embed == nil {
+		return ""
+	}
+	if pv.Embed.EmbedExternal_View != nil && pv.Embed.EmbedExternal_View.External != nil {
+		return pv.Embed.EmbedExternal_View.External.Uri
+	}
+	if pv.Embed.EmbedRecordWithMedia_View != nil &&
+		pv.Embed.EmbedRecordWithMedia_View.Media != nil &&
+		pv.Embed.EmbedRecordWithMedia_View.Media.EmbedExternal_View != nil &&
+		pv.Embed.EmbedRecordWithMedia_View.Media.EmbedExternal_View.External != nil {
+		return pv.Embed.EmbedRecordWithMedia_View.Media.EmbedExternal_View.External.Uri
+	}
+	return ""
+}
+
+// buildAuthor constructs a Person. Organization classification for
+// custom-domain accounts is a future enhancement.
+func buildAuthor(author *appbsky.ActorDefs_ProfileViewBasic) *personOrOrg {
+	if author == nil {
+		return nil
+	}
+	p := &personOrOrg{
+		Type: "Person",
+	}
+	if author.Did != "" {
+		p.Identifier = author.Did
+	}
+	if author.DisplayName != nil && *author.DisplayName != "" {
+		p.Name = *author.DisplayName
+		if author.Handle != "" {
+			p.AlternateName = "@" + author.Handle
+		}
+	} else if author.Handle != "" {
+		p.Name = "@" + author.Handle
+	}
+	if url := bskyProfileURL(author.Handle); url != "" {
+		p.URL = url
+	}
+	return p
+}
+
+// buildReviewedBy maps a profile's verifications to Person entries for
+// Person.reviewedBy. Skips !IsValid and missing Issuer; caps at
+// maxReviewedBy. URL falls back to DID-form when the verifier's handle is
+// missing or "handle.invalid".
+func buildReviewedBy(state *appbsky.ActorDefs_VerificationState) []*verifier {
+	if state == nil || len(state.Verifications) == 0 {
+		return nil
+	}
+	var out []*verifier
+	for _, v := range state.Verifications {
+		if v == nil || !v.IsValid || v.Issuer == "" {
+			continue
+		}
+		if len(out) >= maxReviewedBy {
+			break
+		}
+		entry := &verifier{
+			Type:       "Person",
+			Identifier: v.Issuer,
+		}
+		var handle string
+		if v.IssuerHandle != nil {
+			handle = *v.IssuerHandle
+		}
+		if v.IssuerDisplayName != nil && *v.IssuerDisplayName != "" {
+			entry.Name = *v.IssuerDisplayName
+			if handle != "" && handle != "handle.invalid" {
+				entry.AlternateName = "@" + handle
+			}
+		} else if handle != "" && handle != "handle.invalid" {
+			entry.Name = "@" + handle
+		}
+		if url := bskyProfileURL(handle); url != "" {
+			entry.URL = url
+		} else {
+			entry.URL = "https://bsky.app/profile/" + v.Issuer
+		}
+		out = append(out, entry)
+	}
+	return out
+}
+
+// postHasHideLabel reports whether the post-view or self-labels include
+// any non-negated label in labelSet. Self-labels have no negation.
+func postHasHideLabel(pv *appbsky.FeedDefs_PostView, labelSet map[string]bool) bool {
+	if pv == nil {
+		return false
+	}
+	for _, label := range pv.Labels {
+		isNeg := label.Neg != nil && *label.Neg
+		if labelSet[label.Val] && !isNeg {
+			return true
+		}
+	}
+	if pv.Record != nil {
+		if rec, ok := pv.Record.Val.(*appbsky.FeedPost); ok {
+			if rec.Labels != nil && rec.Labels.LabelDefs_SelfLabels != nil {
+				for _, label := range rec.Labels.LabelDefs_SelfLabels.Values {
+					if labelSet[label.Val] {
+						return true
+					}
+				}
+			}
+		}
+	}
+	return false
+}
+
+// postEmbedHidden reports whether any post-view label or self-label asks
+// embeds to be omitted. WebPost uses this so og:image and JSON-LD media
+// suppression stay in sync.
+func postEmbedHidden(pv *appbsky.FeedDefs_PostView, hideLabels map[string]bool) bool {
+	return postHasHideLabel(pv, hideLabels)
+}
+
+// postRecordText returns the post's expanded text, or "" if the record is
+// missing or malformed.
+func postRecordText(pv *appbsky.FeedDefs_PostView) string {
+	if pv == nil || pv.Record == nil {
+		return ""
+	}
+	rec, ok := pv.Record.Val.(*appbsky.FeedPost)
+	if !ok {
+		return ""
+	}
+	return ExpandPostText(rec)
+}
+
+// buildPostStats returns the like / comment / share interaction triple.
+// commentCount is emitted separately on DiscussionForumPosting.
+func buildPostStats(pv *appbsky.FeedDefs_PostView) []interactionStat {
+	if pv == nil {
+		return nil
+	}
+	deref := func(p *int64) int64 {
+		if p == nil {
+			return 0
+		}
+		return *p
+	}
+	return []interactionStat{
+		{Type: "InteractionCounter", InteractionType: "https://schema.org/LikeAction", UserInteractionCount: deref(pv.LikeCount)},
+		{Type: "InteractionCounter", InteractionType: "https://schema.org/CommentAction", UserInteractionCount: deref(pv.ReplyCount)},
+		{Type: "InteractionCounter", InteractionType: "https://schema.org/ShareAction", UserInteractionCount: deref(pv.RepostCount) + deref(pv.QuoteCount)},
+	}
+}
+
+// buildPostNode constructs a DiscussionForumPosting in nested form (no
+// envelope, no @context). Used for top-level posts and for entries in
+// hasPart / comment arrays. Returns the zero value if pv or pv.Author is
+// nil; callers should treat that as "skip". Replies whose own labels match
+// hideLabels or hideReplyLabels are dropped from comment[].
+func buildPostNode(pv *appbsky.FeedDefs_PostView, replies []*appbsky.FeedDefs_ThreadViewPost_Replies_Elem, hideLabels, hideReplyLabels map[string]bool) discussionForumPosting {
+	if pv == nil || pv.Author == nil {
+		return discussionForumPosting{}
+	}
+	embedHidden := postEmbedHidden(pv, hideLabels)
+	images := extractPostMedia(pv, embedHidden)
+	var thumb string
+	if len(images) > 0 {
+		thumb = images[0]
+	}
+
+	postURL := bskyPostURLFromATURIWithDIDFallback(pv.Author.Handle, pv.Uri)
+	postText := postRecordText(pv)
+
+	node := discussionForumPosting{
+		Type:            "DiscussionForumPosting",
+		URL:             postURL,
+		Identifier:      pv.Uri,
+		Author:          buildAuthor(pv.Author),
+		Text:            postText,
+		Image:           images,
+		ThumbnailURL:    thumb,
+		Video:           buildVideoObject(pv, postURL, postText, embedHidden),
+		DatePublished:   pv.IndexedAt,
+		InteractionStat: buildPostStats(pv),
+	}
+
+	// Surface verifications on the post author only; replies do not.
+	if node.Author != nil {
+		if rb := buildReviewedBy(pv.Author.Verification); len(rb) > 0 {
+			node.Author.ReviewedBy = rb
+		}
+	}
+
+	if pv.ReplyCount != nil {
+		node.CommentCount = pv.ReplyCount
+	} else {
+		zero := int64(0)
+		node.CommentCount = &zero
+	}
+
+	if !embedHidden {
+		if quoted := extractQuotedPostURL(pv); quoted != "" {
+			node.IsBasedOn = quoted
+		}
+		if shared := extractSharedContentURL(pv); shared != "" {
+			node.SharedContent = &sharedContent{Type: "WebPage", URL: shared}
+		}
+	}
+
+	for _, r := range replies {
+		if r == nil || r.FeedDefs_ThreadViewPost == nil || r.FeedDefs_ThreadViewPost.Post == nil {
+			continue
+		}
+		if len(node.Comment) >= maxComments {
+			break
+		}
+		replyPV := r.FeedDefs_ThreadViewPost.Post
+		// Drop labeled replies entirely so abusive/spam text isn't surfaced
+		// into the parent post's structured data.
+		if postHasHideLabel(replyPV, hideReplyLabels) || postHasHideLabel(replyPV, hideLabels) {
+			continue
+		}
+		reply := buildReplyNode(replyPV, hideLabels)
+		if reply.Type == "" {
+			continue
+		}
+		node.Comment = append(node.Comment, reply)
+	}
+
+	return node
+}
+
+// buildReplyNode builds a schema.org Comment for a reply. Returns the
+// zero value if pv or pv.Author is nil.
+func buildReplyNode(pv *appbsky.FeedDefs_PostView, hideLabels map[string]bool) comment {
+	if pv == nil || pv.Author == nil {
+		return comment{}
+	}
+	embedHidden := postEmbedHidden(pv, hideLabels)
+	images := extractPostMedia(pv, embedHidden)
+	var thumb string
+	if len(images) > 0 {
+		thumb = images[0]
+	}
+	postURL := bskyPostURLFromATURIWithDIDFallback(pv.Author.Handle, pv.Uri)
+	postText := postRecordText(pv)
+	return comment{
+		Type:          "Comment",
+		URL:           postURL,
+		Identifier:    pv.Uri,
+		Author:        buildAuthor(pv.Author),
+		Text:          postText,
+		Image:         images,
+		ThumbnailURL:  thumb,
+		Video:         buildVideoObject(pv, postURL, postText, embedHidden),
+		DatePublished: pv.IndexedAt,
+	}
+}
+
+// buildPostJSONLD marshals the WebPage envelope wrapping a
+// DiscussionForumPosting. canonicalURL is used for both envelope.url and
+// (as a fallback) mainEntity.url so they always agree.
+func buildPostJSONLD(pv *appbsky.FeedDefs_PostView, replies []*appbsky.FeedDefs_ThreadViewPost_Replies_Elem, canonicalURL string, hideLabels, hideReplyLabels map[string]bool) (string, error) {
+	if pv == nil || pv.Author == nil {
+		return "", fmt.Errorf("nil post view or author")
+	}
+	node := buildPostNode(pv, replies, hideLabels, hideReplyLabels)
+
+	// mainEntity.url is empty when the author handle is unusable; fall back
+	// to canonicalURL so it agrees with envelope.url.
+	if node.URL == "" {
+		node.URL = canonicalURL
+	}
+
+	envelope := webPage{
+		Context:    schemaOrgContext,
+		Type:       "WebPage",
+		URL:        canonicalURL,
+		MainEntity: node,
+	}
+	b, err := json.Marshal(envelope)
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
+}
+
+// buildProfileJSONLD marshals a ProfilePage (with hasPart recent posts).
+// Recent posts whose own labels match hideLabels or hideReplyLabels are
+// dropped from hasPart, mirroring the gating applied to comment[].
+func buildProfileJSONLD(pv *appbsky.ActorDefs_ProfileViewDetailed, recentPosts []*appbsky.FeedDefs_PostView, hideLabels, hideReplyLabels map[string]bool) (string, error) {
+	if pv == nil {
+		return "", fmt.Errorf("nil profile view")
+	}
+
+	person := &personOrOrg{
+		Type:       "Person",
+		Identifier: pv.Did,
+	}
+	if pv.DisplayName != nil && *pv.DisplayName != "" {
+		person.Name = *pv.DisplayName
+		person.AlternateName = "@" + pv.Handle
+	} else {
+		person.Name = "@" + pv.Handle
+	}
+	if pv.Description != nil {
+		person.Description = *pv.Description
+	}
+	if pv.Avatar != nil {
+		person.Image = *pv.Avatar
+	}
+
+	deref := func(p *int64) int64 {
+		if p == nil {
+			return 0
+		}
+		return *p
+	}
+	person.InteractionStat = []interactionStat{
+		{Type: "InteractionCounter", InteractionType: "https://schema.org/FollowAction", UserInteractionCount: deref(pv.FollowersCount)},
+	}
+	person.AgentInteractionStat = []interactionStat{
+		{Type: "InteractionCounter", InteractionType: "https://schema.org/FollowAction", UserInteractionCount: deref(pv.FollowsCount)},
+		{Type: "InteractionCounter", InteractionType: "https://schema.org/WriteAction", UserInteractionCount: deref(pv.PostsCount)},
+	}
+	if rb := buildReviewedBy(pv.Verification); len(rb) > 0 {
+		person.ReviewedBy = rb
+	}
+
+	page := profilePage{
+		Context:    schemaOrgContext,
+		Type:       "ProfilePage",
+		MainEntity: person,
+	}
+	if pv.CreatedAt != nil {
+		page.DateCreated = *pv.CreatedAt
+	}
+
+	for _, rp := range recentPosts {
+		if rp == nil {
+			continue
+		}
+		if len(page.HasPart) >= maxRecentPosts {
+			break
+		}
+		// Drop labeled posts entirely so flagged content isn't surfaced
+		// into the profile's structured data.
+		if postHasHideLabel(rp, hideReplyLabels) || postHasHideLabel(rp, hideLabels) {
+			continue
+		}
+		// Recent posts go in nested form. No replies are passed, so the
+		// reply-label set is irrelevant; pass nil.
+		node := buildPostNode(rp, nil, hideLabels, nil)
+		if node.Type == "" {
+			continue
+		}
+		page.HasPart = append(page.HasPart, node)
+	}
+
+	b, err := json.Marshal(page)
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
+}
@@ -0,0 +1,22 @@
+package main
+
+import (
+	appbsky "github.com/bluesky-social/indigo/api/bsky"
+)
+
+// Helpers for inspecting profile / post labels.
+
+// profileRequiresAuth reports whether the profile has self-applied the
+// !no-unauthenticated label. SSR responses for these profiles omit post
+// content beyond minimal identity.
+func profileRequiresAuth(pv *appbsky.ActorDefs_ProfileViewDetailed) bool {
+	if pv == nil {
+		return false
+	}
+	for _, label := range pv.Labels {
+		if label.Src == pv.Did && label.Val == "!no-unauthenticated" {
+			return true
+		}
+	}
+	return false
+}
@@ -0,0 +1,79 @@
+package main
+
+import (
+	"testing"
+
+	comatprototypes "github.com/bluesky-social/indigo/api/atproto"
+	appbsky "github.com/bluesky-social/indigo/api/bsky"
+)
+
+func TestProfileRequiresAuth(t *testing.T) {
+	negTrue := true
+
+	tests := []struct {
+		name string
+		pv   *appbsky.ActorDefs_ProfileViewDetailed
+		want bool
+	}{
+		{
+			name: "nil profile",
+			pv:   nil,
+			want: false,
+		},
+		{
+			name: "no labels",
+			pv:   &appbsky.ActorDefs_ProfileViewDetailed{Did: "did:plc:alice"},
+			want: false,
+		},
+		{
+			name: "self-applied !no-unauthenticated",
+			pv: &appbsky.ActorDefs_ProfileViewDetailed{
+				Did: "did:plc:alice",
+				Labels: []*comatprototypes.LabelDefs_Label{
+					{Src: "did:plc:alice", Val: "!no-unauthenticated"},
+				},
+			},
+			want: true,
+		},
+		{
+			name: "label from a different src does not gate",
+			pv: &appbsky.ActorDefs_ProfileViewDetailed{
+				Did: "did:plc:alice",
+				Labels: []*comatprototypes.LabelDefs_Label{
+					{Src: "did:plc:labeler", Val: "!no-unauthenticated"},
+				},
+			},
+			want: false,
+		},
+		{
+			name: "different label value does not gate",
+			pv: &appbsky.ActorDefs_ProfileViewDetailed{
+				Did: "did:plc:alice",
+				Labels: []*comatprototypes.LabelDefs_Label{
+					{Src: "did:plc:alice", Val: "spam"},
+				},
+			},
+			want: false,
+		},
+		{
+			// Negation isn't honored — matches prior inline behavior in
+			// WebPost / WebProfile / WebProfileRSS.
+			name: "negated label still triggers (matches prior behavior)",
+			pv: &appbsky.ActorDefs_ProfileViewDetailed{
+				Did: "did:plc:alice",
+				Labels: []*comatprototypes.LabelDefs_Label{
+					{Src: "did:plc:alice", Val: "!no-unauthenticated", Neg: &negTrue},
+				},
+			},
+			want: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := profileRequiresAuth(tt.pv); got != tt.want {
+				t.Errorf("got %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
@@ -46,6 +46,12 @@ func run(args []string) {
 					Required: false,
 					EnvVars:  []string{"OGCARD_HOST"},
 				},
+				&cli.StringFlag{
+					Name:     "chat-host",
+					Usage:    "scheme, hostname, and port of chat appview",
+					Required: false,
+					EnvVars:  []string{"CHAT_HOST"},
+				},
 				&cli.StringFlag{
 					Name:     "http-address",
 					Usage:    "Specify the local IP/port to bind to",
@@ -53,6 +59,13 @@ func run(args []string) {
 					Value:    ":8100",
 					EnvVars:  []string{"HTTP_ADDRESS"},
 				},
+				&cli.StringFlag{
+					Name:     "metrics-address",
+					Usage:    "Specify the local IP/port to bind the metrics server to",
+					Required: false,
+					Value:    ":9090",
+					EnvVars:  []string{"METRICS_HTTP_ADDRESS"},
+				},
 				&cli.StringFlag{
 					Name:     "link-host",
 					Usage:    "scheme, hostname, and port of link service",
@@ -0,0 +1,299 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"regexp"
+	"strings"
+	"testing"
+
+	"github.com/bluesky-social/social-app/bskyweb"
+	"github.com/flosch/pongo2/v6"
+)
+
+// renderTemplate executes a template using the live renderer and returns
+// the output. base.html includes templates/scripts.html, which is generated
+// by `yarn build-web`; skip the test if it's missing.
+func renderTemplate(t *testing.T, name string, ctx pongo2.Context) string {
+	t.Helper()
+	if _, err := bskyweb.TemplateFS.ReadFile("templates/scripts.html"); err != nil {
+		t.Skip("templates/scripts.html not present (run yarn build-web first)")
+	}
+	r := NewRenderer("templates/", &bskyweb.TemplateFS, false)
+	tmpl, err := r.TemplateSet.FromCache(name)
+	if err != nil {
+		t.Fatalf("template load %q: %v", name, err)
+	}
+	var buf bytes.Buffer
+	if err := tmpl.ExecuteWriter(ctx, &buf); err != nil {
+		t.Fatalf("template execute %q: %v", name, err)
+	}
+	return buf.String()
+}
+
+var jsonLDRe = regexp.MustCompile(`(?s)<script type="application/ld\+json">(.*?)</script>`)
+
+// extractJSONLD pulls out the body of the application/ld+json script tag.
+func extractJSONLD(t *testing.T, html string) string {
+	t.Helper()
+	m := jsonLDRe.FindStringSubmatch(html)
+	if m == nil {
+		t.Fatalf("no application/ld+json script tag in rendered HTML:\n%s", html)
+	}
+	return strings.TrimSpace(m[1])
+}
+
+func TestRenderBase_NoindexMeta(t *testing.T) {
+    html := renderTemplate(t, "base.html", pongo2.Context{"noindex": true, "nofollow": true})
+    if !strings.Contains(html, `<meta name="robots" content="noindex, nofollow">`) {
+        t.Errorf("expected combined noindex,nofollow meta; got:\n%s", html)
+    }
+}
+
+func TestRenderPost_EmitsJSONLD(t *testing.T) {
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "hello")
+	ld, err := buildPostJSONLD(pv, nil, "https://bsky.app/profile/alice.bsky.social/post/abc123", hideEmbedLabels, hideReplyLabels)
+	if err != nil {
+		t.Fatal(err)
+	}
+	html := renderTemplate(t, "post.html", pongo2.Context{
+		"postView":     pv,
+		"requestURI":   "https://bsky.app/profile/alice.bsky.social/post/abc123",
+		"canonicalURL": "https://bsky.app/profile/alice.bsky.social/post/abc123",
+		"postJSONLD":   ld,
+	})
+
+	body := extractJSONLD(t, html)
+	var parsed map[string]any
+	if err := json.Unmarshal([]byte(body), &parsed); err != nil {
+		t.Fatalf("rendered JSON-LD does not parse: %v\n%s", err, body)
+	}
+	if parsed["@type"] != "WebPage" {
+		t.Errorf("expected WebPage envelope, got %v", parsed["@type"])
+	}
+	// Canonical link should be the handle-form URL.
+	if !strings.Contains(html, `<link rel="canonical" href="https://bsky.app/profile/alice.bsky.social/post/abc123" />`) {
+		t.Errorf("canonical link missing or wrong:\n%s", html)
+	}
+}
+
+func TestRenderPost_OGImageMatchesJSONLD(t *testing.T) {
+	thumb1 := "https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:alice/abc@jpeg"
+	thumb2 := "https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:alice/def@jpeg"
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "look", withImages(thumb1, thumb2))
+	ld, _ := buildPostJSONLD(pv, nil, "https://bsky.app/profile/alice.bsky.social/post/abc123", hideEmbedLabels, hideReplyLabels)
+	html := renderTemplate(t, "post.html", pongo2.Context{
+		"postView":     pv,
+		"requestURI":   "https://bsky.app/profile/alice.bsky.social/post/abc123",
+		"canonicalURL": "https://bsky.app/profile/alice.bsky.social/post/abc123",
+		"postJSONLD":   ld,
+		"imgThumbUrls": []string{thumb1, thumb2},
+	})
+
+	// og:image and JSON-LD image[] must be byte-identical.
+	if !strings.Contains(html, `<meta property="og:image" content="`+thumb1+`">`) {
+		t.Errorf("og:image[0] not found in rendered HTML")
+	}
+	body := extractJSONLD(t, html)
+	var parsed map[string]any
+	_ = json.Unmarshal([]byte(body), &parsed)
+	main := parsed["mainEntity"].(map[string]any)
+	imgs := main["image"].([]any)
+	if imgs[0] != thumb1 || main["thumbnailUrl"] != thumb1 {
+		t.Errorf("JSON-LD image strings drifted from og:image; image[0]=%v thumbnailUrl=%v",
+			imgs[0], main["thumbnailUrl"])
+	}
+}
+
+// Gallery posts must hit the same og:image / JSON-LD image[] byte-equality
+// contract that legacy images posts do. Regression guard for the
+// app.bsky.embed.gallery extraction path.
+func TestRenderPost_OGImageMatchesJSONLD_Gallery(t *testing.T) {
+	thumb1 := "https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:alice/g1@jpeg"
+	thumb2 := "https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:alice/g2@jpeg"
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "gallery", withGallery(thumb1, thumb2))
+	thumbs := extractPostMedia(pv, false)
+	ld, _ := buildPostJSONLD(pv, nil, "https://bsky.app/profile/alice.bsky.social/post/abc123", hideEmbedLabels, hideReplyLabels)
+	html := renderTemplate(t, "post.html", pongo2.Context{
+		"postView":     pv,
+		"requestURI":   "https://bsky.app/profile/alice.bsky.social/post/abc123",
+		"canonicalURL": "https://bsky.app/profile/alice.bsky.social/post/abc123",
+		"postJSONLD":   ld,
+		"imgThumbUrls": thumbs,
+	})
+
+	if !strings.Contains(html, `<meta property="og:image" content="`+thumb1+`">`) {
+		t.Errorf("og:image[0] not found in rendered HTML for gallery post")
+	}
+	if !strings.Contains(html, `<meta property="og:image" content="`+thumb2+`">`) {
+		t.Errorf("og:image[1] not found in rendered HTML for gallery post")
+	}
+	body := extractJSONLD(t, html)
+	var parsed map[string]any
+	_ = json.Unmarshal([]byte(body), &parsed)
+	main := parsed["mainEntity"].(map[string]any)
+	imgs := main["image"].([]any)
+	if len(imgs) != 2 || imgs[0] != thumb1 || main["thumbnailUrl"] != thumb1 {
+		t.Errorf("JSON-LD image strings drifted from og:image for gallery; image=%v thumbnailUrl=%v",
+			imgs, main["thumbnailUrl"])
+	}
+}
+
+func TestRenderPost_FallsBackToCanonicalizeFilter(t *testing.T) {
+	// Without canonicalURL, the template falls back to requestURI|canonicalize_url.
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "hi")
+	ld, _ := buildPostJSONLD(pv, nil, "u", hideEmbedLabels, hideReplyLabels)
+	html := renderTemplate(t, "post.html", pongo2.Context{
+		"postView":   pv,
+		"requestURI": "https://bsky.app/profile/alice.bsky.social/post/abc123?utm=foo",
+		"postJSONLD": ld,
+	})
+	if !strings.Contains(html, `<link rel="canonical" href="https://bsky.app/profile/alice.bsky.social/post/abc123" />`) {
+		t.Errorf("expected canonicalize_url filter to strip query; got:\n%s", html)
+	}
+}
+
+func TestRenderProfile_EmitsJSONLD(t *testing.T) {
+	pv := newProfileViewDetailed()
+	ld, err := buildProfileJSONLD(pv, nil, hideEmbedLabels, hideReplyLabels)
+	if err != nil {
+		t.Fatal(err)
+	}
+	html := renderTemplate(t, "profile.html", pongo2.Context{
+		"profileView":   pv,
+		"requestURI":    "https://bsky.app/profile/alice.bsky.social",
+		"canonicalURL":  "https://bsky.app/profile/alice.bsky.social",
+		"profileJSONLD": ld,
+	})
+
+	body := extractJSONLD(t, html)
+	var parsed map[string]any
+	if err := json.Unmarshal([]byte(body), &parsed); err != nil {
+		t.Fatalf("rendered JSON-LD does not parse: %v\n%s", err, body)
+	}
+	if parsed["@type"] != "ProfilePage" {
+		t.Errorf("expected ProfilePage, got %v", parsed["@type"])
+	}
+}
+
+// Regression: auth-required profiles must still emit ProfilePage JSON-LD
+// (without hasPart). Previously regressed when WebProfile short-circuited
+// before buildProfileJSONLD.
+func TestRenderProfile_AuthRequiredEmitsJSONLD(t *testing.T) {
+	pv := newProfileViewDetailed()
+	ld, err := buildProfileJSONLD(pv, nil, hideEmbedLabels, hideReplyLabels)
+	if err != nil {
+		t.Fatal(err)
+	}
+	html := renderTemplate(t, "profile.html", pongo2.Context{
+		"profileView":   pv,
+		"requestURI":    "https://bsky.app/profile/alice.bsky.social",
+		"requiresAuth":  true,
+		"profileJSONLD": ld,
+	})
+
+	body := extractJSONLD(t, html)
+	var parsed map[string]any
+	if err := json.Unmarshal([]byte(body), &parsed); err != nil {
+		t.Fatalf("rendered JSON-LD does not parse: %v\n%s", err, body)
+	}
+	if parsed["@type"] != "ProfilePage" {
+		t.Errorf("expected ProfilePage, got %v", parsed["@type"])
+	}
+	if _, present := parsed["hasPart"]; present {
+		t.Errorf("auth-required profile should not have hasPart")
+	}
+}
+
+// og:url and <link rel="canonical"> must emit the same URL.
+func TestRenderPost_OGUrlMatchesCanonical(t *testing.T) {
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "hi")
+	ld, _ := buildPostJSONLD(pv, nil, "u", hideEmbedLabels, hideReplyLabels)
+	canonical := "https://bsky.app/profile/alice.bsky.social/post/abc123"
+	html := renderTemplate(t, "post.html", pongo2.Context{
+		"postView":     pv,
+		"requestURI":   "https://bsky.app/profile/did:plc:alice/post/abc123",
+		"canonicalURL": canonical,
+		"postJSONLD":   ld,
+	})
+	if !strings.Contains(html, `<meta property="og:url" content="`+canonical+`">`) {
+		t.Errorf("og:url should equal canonical URL when set; got:\n%s", html)
+	}
+	if !strings.Contains(html, `<link rel="canonical" href="`+canonical+`" />`) {
+		t.Errorf("canonical link missing or wrong:\n%s", html)
+	}
+	// DID-form request URI must not leak into og:url.
+	if strings.Contains(html, `<meta property="og:url" content="https://bsky.app/profile/did:plc:alice/post/abc123">`) {
+		t.Errorf("og:url should not echo DID-form request URI when canonical is set")
+	}
+}
+
+// og:video must emit even when there is no thumbnail. Previously the
+// {% if videoUrl %} block was nested inside {% if imgThumbUrls %}, so a
+// video without a thumbnail dropped og:video entirely.
+func TestRenderPost_VideoWithoutThumbnailEmitsOGVideo(t *testing.T) {
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "watch")
+	ld, _ := buildPostJSONLD(pv, nil, "u", hideEmbedLabels, hideReplyLabels)
+	videoURL := "https://video.bsky.app/v.m3u8"
+	html := renderTemplate(t, "post.html", pongo2.Context{
+		"postView":     pv,
+		"requestURI":   "https://bsky.app/profile/alice.bsky.social/post/abc123",
+		"canonicalURL": "https://bsky.app/profile/alice.bsky.social/post/abc123",
+		"postJSONLD":   ld,
+		"videoUrl":     videoURL,
+		"videoType":    "application/x-mpegURL",
+	})
+	if !strings.Contains(html, `<meta property="og:video" content="`+videoURL+`">`) {
+		t.Errorf("og:video should emit even without imgThumbUrls; got:\n%s", html)
+	}
+	if !strings.Contains(html, `<meta property="og:video:type" content="application/x-mpegURL">`) {
+		t.Errorf("og:video:type should emit even without imgThumbUrls; got:\n%s", html)
+	}
+}
+
+// Auth-required posts must emit noindex,nofollow so the stub page (no body
+// text, no comments) is not indexed.
+func TestRenderPost_AuthRequiredNoindex(t *testing.T) {
+	html := renderTemplate(t, "post.html", pongo2.Context{
+		"requiresAuth":  true,
+		"profileHandle": "alice.bsky.social",
+		"requestURI":    "https://bsky.app/profile/alice.bsky.social/post/abc123",
+		"canonicalURL":  "https://bsky.app/profile/alice.bsky.social/post/abc123",
+		"noindex":       true,
+		"nofollow":      true,
+	})
+	if !strings.Contains(html, `<meta name="robots" content="noindex, nofollow">`) {
+		t.Errorf("auth-required post should emit noindex,nofollow; got:\n%s", html)
+	}
+}
+
+// Auth-required profiles must emit noindex,nofollow.
+func TestRenderProfile_AuthRequiredNoindex(t *testing.T) {
+	pv := newProfileViewDetailed()
+	html := renderTemplate(t, "profile.html", pongo2.Context{
+		"profileView":  pv,
+		"requestURI":   "https://bsky.app/profile/alice.bsky.social",
+		"requiresAuth": true,
+		"noindex":      true,
+		"nofollow":     true,
+	})
+	if !strings.Contains(html, `<meta name="robots" content="noindex, nofollow">`) {
+		t.Errorf("auth-required profile should emit noindex,nofollow; got:\n%s", html)
+	}
+}
+
+// Public posts must NOT emit a robots meta tag. Guards against an accidental
+// flip of the noindex flag for indexable pages.
+func TestRenderPost_PublicNoNoindex(t *testing.T) {
+	pv := makePostView("alice.bsky.social", "did:plc:alice", "abc123", "hello")
+	ld, _ := buildPostJSONLD(pv, nil, "https://bsky.app/profile/alice.bsky.social/post/abc123", hideEmbedLabels, hideReplyLabels)
+	html := renderTemplate(t, "post.html", pongo2.Context{
+		"postView":     pv,
+		"requestURI":   "https://bsky.app/profile/alice.bsky.social/post/abc123",
+		"canonicalURL": "https://bsky.app/profile/alice.bsky.social/post/abc123",
+		"postJSONLD":   ld,
+	})
+	if strings.Contains(html, `<meta name="robots"`) {
+		t.Errorf("public post should not emit robots meta; got:\n%s", html)
+	}
+}
@@ -58,10 +58,8 @@ func (srv *Server) WebProfileRSS(c echo.Context) error {
 		if err != nil {
 			return echo.NewHTTPError(404, fmt.Sprintf("account not found: %s", handle))
 		}
-		for _, label := range pv.Labels {
-			if label.Src == pv.Did && label.Val == "!no-unauthenticated" {
-				return echo.NewHTTPError(403, fmt.Sprintf("account does not allow public views: %s", handle))
-			}
+		if profileRequiresAuth(pv) {
+			return echo.NewHTTPError(403, fmt.Sprintf("account does not allow public views: %s", handle))
 		}
 		return c.Redirect(http.StatusFound, fmt.Sprintf("/profile/%s/rss", pv.Did))
 	}
@@ -76,10 +74,8 @@ func (srv *Server) WebProfileRSS(c echo.Context) error {
 	if err != nil {
 		return echo.NewHTTPError(404, fmt.Sprintf("account not found: %s", did))
 	}
-	for _, label := range pv.Labels {
-		if label.Src == pv.Did && label.Val == "!no-unauthenticated" {
-			return echo.NewHTTPError(403, fmt.Sprintf("account does not allow public views: %s", did))
-		}
+	if profileRequiresAuth(pv) {
+		return echo.NewHTTPError(403, fmt.Sprintf("account does not allow public views: %s", did))
 	}

 	af, err := appbsky.FeedGetAuthorFeed(ctx, srv.xrpcc, did.String(), "", "posts_no_replies", false, 30)
@@ -12,16 +12,19 @@ import (
 	"io"
 	"io/fs"
 	"log/slog"
+	"net"
 	"net/http"
 	"net/netip"
 	"net/url"
 	"os"
 	"os/signal"
+	"regexp"
 	"strings"
 	"syscall"
 	"time"

 	appbsky "github.com/bluesky-social/indigo/api/bsky"
+	chat "github.com/bluesky-social/indigo/api/chat"
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"github.com/bluesky-social/indigo/util/cliutil"
 	"github.com/bluesky-social/indigo/xrpc"
@@ -33,14 +36,17 @@ import (
 	"github.com/labstack/echo-contrib/echoprometheus"
 	"github.com/labstack/echo/v4"
 	"github.com/labstack/echo/v4/middleware"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"github.com/urfave/cli/v2"
 )

 type Server struct {
-	echo  *echo.Echo
-	httpd *http.Server
-	xrpcc *xrpc.Client
-	cfg   *Config
+	echo         *echo.Echo
+	httpd        *http.Server
+	metricsHttpd *http.Server
+	xrpcc        *xrpc.Client
+	chatXrpcc    *xrpc.Client
+	cfg          *Config

 	ipccClient http.Client

@@ -54,6 +60,7 @@ type Config struct {
 	debug         bool
 	httpAddress   string
 	appviewHost   string
+	chatHost      string
 	ogcardHost    string
 	linkHost      string
 	ipccHost      string
@@ -63,7 +70,9 @@ type Config struct {
 func serve(cctx *cli.Context) error {
 	debug := cctx.Bool("debug")
 	httpAddress := cctx.String("http-address")
+	metricsAddress := cctx.String("metrics-address")
 	appviewHost := cctx.String("appview-host")
+	chatHost := cctx.String("chat-host")
 	ogcardHost := cctx.String("ogcard-host")
 	linkHost := cctx.String("link-host")
 	ipccHost := cctx.String("ipcc-host")
@@ -83,6 +92,15 @@ func serve(cctx *cli.Context) error {
 		Host:   appviewHost,
 	}

+	// optional client for the chat appview, used by /chat/<code> for OG previews.
+	var chatXrpcc *xrpc.Client
+	if chatHost != "" {
+		chatXrpcc = &xrpc.Client{
+			Client: cliutil.NewHttpClient(),
+			Host:   chatHost,
+		}
+	}
+
 	// httpd
 	var (
 		httpTimeout          = 2 * time.Minute
@@ -106,12 +124,14 @@ func serve(cctx *cli.Context) error {
 	// server
 	//
 	server := &Server{
-		echo:  e,
-		xrpcc: xrpcc,
+		echo:      e,
+		xrpcc:     xrpcc,
+		chatXrpcc: chatXrpcc,
 		cfg: &Config{
 			debug:         debug,
 			httpAddress:   httpAddress,
 			appviewHost:   appviewHost,
+			chatHost:      chatHost,
 			ogcardHost:    ogcardHost,
 			linkHost:      linkHost,
 			ipccHost:      ipccHost,
@@ -280,57 +300,50 @@ func serve(cctx *cli.Context) error {
 	// generic routes
 	e.GET("/hashtag/:tag", server.WebGeneric)
 	e.GET("/topic/:topic", server.WebGeneric)
-	e.GET("/search", server.WebGeneric)
-	e.GET("/feeds", server.WebGeneric)
-	e.GET("/notifications", server.WebGeneric)
-	e.GET("/notifications/settings", server.WebGeneric)
-	e.GET("/notifications/activity", server.WebGeneric)
-	e.GET("/lists", server.WebGeneric)
-	e.GET("/moderation", server.WebGeneric)
-	e.GET("/moderation/modlists", server.WebGeneric)
-	e.GET("/moderation/muted-accounts", server.WebGeneric)
-	e.GET("/moderation/blocked-accounts", server.WebGeneric)
-	e.GET("/moderation/verification-settings", server.WebGeneric)
-	e.GET("/settings", server.WebGeneric)
-	e.GET("/settings/language", server.WebGeneric)
-	e.GET("/settings/app-passwords", server.WebGeneric)
-	e.GET("/settings/following-feed", server.WebGeneric)
-	e.GET("/settings/saved-feeds", server.WebGeneric)
-	e.GET("/settings/threads", server.WebGeneric)
-	e.GET("/settings/external-embeds", server.WebGeneric)
-	e.GET("/settings/accessibility", server.WebGeneric)
-	e.GET("/settings/appearance", server.WebGeneric)
-	e.GET("/settings/account", server.WebGeneric)
-	e.GET("/settings/automation-label", server.WebGeneric)
-	e.GET("/settings/privacy-and-security", server.WebGeneric)
-	e.GET("/settings/privacy-and-security/activity", server.WebGeneric)
-	e.GET("/settings/content-and-media", server.WebGeneric)
-	e.GET("/settings/interests", server.WebGeneric)
-	e.GET("/settings/about", server.WebGeneric)
-	e.GET("/settings/notifications", server.WebGeneric)
-	e.GET("/settings/notifications/replies", server.WebGeneric)
-	e.GET("/settings/notifications/mentions", server.WebGeneric)
-	e.GET("/settings/notifications/quotes", server.WebGeneric)
-	e.GET("/settings/notifications/likes", server.WebGeneric)
-	e.GET("/settings/notifications/reposts", server.WebGeneric)
-	e.GET("/settings/notifications/new-followers", server.WebGeneric)
-	e.GET("/settings/notifications/likes-on-reposts", server.WebGeneric)
-	e.GET("/settings/notifications/reposts-on-reposts", server.WebGeneric)
-	e.GET("/settings/notifications/activity", server.WebGeneric)
-	e.GET("/settings/notifications/miscellaneous", server.WebGeneric)
-	e.GET("/sys/debug", server.WebGeneric)
-	e.GET("/sys/debug-mod", server.WebGeneric)
-	e.GET("/sys/log", server.WebGeneric)
+	e.GET("/search", server.WebGenericNoindex)
+	e.GET("/feeds", server.WebGenericNoindex)
+	e.GET("/notifications", server.WebGenericNoindex)
+	e.GET("/notifications/settings", server.WebGenericNoindex)
+	e.GET("/notifications/activity", server.WebGenericNoindex)
+	e.GET("/lists", server.WebGenericNoindex)
+	e.GET("/moderation", server.WebGenericNoindex)
+	e.GET("/moderation/modlists", server.WebGenericNoindex)
+	e.GET("/moderation/muted-accounts", server.WebGenericNoindex)
+	e.GET("/moderation/blocked-accounts", server.WebGenericNoindex)
+	e.GET("/moderation/verification-settings", server.WebGenericNoindex)
+	e.GET("/settings", server.WebGenericNoindex)
+	e.GET("/settings/language", server.WebGenericNoindex)
+	e.GET("/settings/app-passwords", server.WebGenericNoindex)
+	e.GET("/settings/following-feed", server.WebGenericNoindex)
+	e.GET("/settings/saved-feeds", server.WebGenericNoindex)
+	e.GET("/settings/threads", server.WebGenericNoindex)
+	e.GET("/settings/external-embeds", server.WebGenericNoindex)
+	e.GET("/settings/accessibility", server.WebGenericNoindex)
+	e.GET("/settings/appearance", server.WebGenericNoindex)
+	e.GET("/settings/account", server.WebGenericNoindex)
+	e.GET("/settings/automation-label", server.WebGenericNoindex)
+	e.GET("/settings/privacy-and-security", server.WebGenericNoindex)
+	e.GET("/settings/privacy-and-security/activity", server.WebGenericNoindex)
+	e.GET("/settings/content-and-media", server.WebGenericNoindex)
+	e.GET("/settings/interests", server.WebGenericNoindex)
+	e.GET("/settings/about", server.WebGenericNoindex)
+	e.GET("/settings/notifications", server.WebGenericNoindex)
+	e.GET("/sys/debug", server.WebGenericNoindex)
+	e.GET("/sys/debug-mod", server.WebGenericNoindex)
+	e.GET("/sys/log", server.WebGenericNoindex)
 	e.GET("/support", server.WebGeneric)
 	e.GET("/support/privacy", server.WebGeneric)
 	e.GET("/support/tos", server.WebGeneric)
 	e.GET("/support/community-guidelines", server.WebGeneric)
 	e.GET("/support/copyright", server.WebGeneric)
-	e.GET("/intent/compose", server.WebGeneric)
-	e.GET("/intent/verify-email", server.WebGeneric)
-	e.GET("/intent/age-assurance", server.WebGeneric)
-	e.GET("/messages", server.WebGeneric)
-	e.GET("/messages/:conversation", server.WebGeneric)
+	e.GET("/intent/compose", server.WebGenericNoindexNofollow)
+	e.GET("/intent/verify-email", server.WebGenericNoindexNofollow)
+	e.GET("/intent/age-assurance", server.WebGenericNoindexNofollow)
+	e.GET("/messages", server.WebGenericNoindex)
+	e.GET("/messages/inbox", server.WebGenericNoindex)
+	e.GET("/messages/:conversation", server.WebGenericNoindex)
+	e.GET("/messages/:conversation/settings", server.WebGenericNoindex)
+	e.GET("/messages/:conversation/requests", server.WebGenericNoindex)

 	// profile endpoints; only first populates info
 	e.GET("/profile/:handleOrDID", server.WebProfile)
@@ -354,11 +367,14 @@ func serve(cctx *cli.Context) error {

 	// starter packs
 	e.GET("/starter-pack/:handleOrDID/:rkey", server.WebStarterPack)
-	e.GET("/starter-pack-short/:code", server.WebGeneric)
+	e.GET("/starter-pack-short/:code", server.WebGenericNoindex)
 	e.GET("/start/:handleOrDID/:rkey", server.WebStarterPack)

+	// chat invites
+	e.GET("/chat/:code", server.WebChatInvite)
+
 	// bookmarks
-	e.GET("/saved", server.WebGeneric)
+	e.GET("/saved", server.WebGenericNoindex)

 	// ipcc
 	e.GET("/ipcc", server.WebIpCC)
@@ -375,6 +391,19 @@ func serve(cctx *cli.Context) error {
 		e.Group("/:linkId", server.LinkProxyMiddleware(linkUrl))
 	}

+	metricsHttpd, metricsListener, err := newMetricsHTTPServer(metricsAddress)
+	if err != nil {
+		return err
+	}
+	server.metricsHttpd = metricsHttpd
+
+	log.Infof("starting metrics server address=%s", metricsAddress)
+	go func() {
+		if err := metricsHttpd.Serve(metricsListener); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			log.Errorf("metrics HTTP server shutting down unexpectedly: %s", err)
+		}
+	}()
+
 	// Start the server.
 	log.Infof("starting server address=%s", httpAddress)
 	go func() {
@@ -407,6 +436,24 @@ func serve(cctx *cli.Context) error {
 	return nil
 }

+func newMetricsHTTPServer(address string) (*http.Server, net.Listener, error) {
+	metricsMux := http.NewServeMux()
+	metricsMux.Handle("/metrics", promhttp.Handler())
+
+	metricsHttpd := &http.Server{
+		Addr:              address,
+		Handler:           metricsMux,
+		ReadHeaderTimeout: 5 * time.Second,
+	}
+
+	metricsListener, err := net.Listen("tcp", address)
+	if err != nil {
+		return nil, nil, fmt.Errorf("listen metrics address %s: %w", address, err)
+	}
+
+	return metricsHttpd, metricsListener, nil
+}
+
 func (srv *Server) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 	srv.echo.ServeHTTP(rw, req)
 }
@@ -417,7 +464,18 @@ func (srv *Server) Shutdown() error {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()

-	return srv.httpd.Shutdown(ctx)
+	var shutdownErr error
+	if srv.metricsHttpd != nil {
+		if err := srv.metricsHttpd.Shutdown(ctx); err != nil {
+			shutdownErr = fmt.Errorf("metrics HTTP server shutdown error: %w", err)
+		}
+	}
+
+	if err := srv.httpd.Shutdown(ctx); err != nil {
+		return errors.Join(shutdownErr, err)
+	}
+
+	return shutdownErr
 }

 // NewTemplateContext returns a new pongo2 context with some default values.
@@ -425,6 +483,8 @@ func (srv *Server) NewTemplateContext() pongo2.Context {
 	return pongo2.Context{
 		"staticCDNHost": srv.cfg.staticCDNHost,
 		"favicon":       fmt.Sprintf("%s/static/favicon.png", srv.cfg.staticCDNHost),
+		"noindex":       false,
+		"nofollow":      false,
 	}
 }

@@ -477,10 +537,38 @@ func (srv *Server) LinkProxyMiddleware(url *url.URL) echo.MiddlewareFunc {
 	)
 }

+// renderOptions controls per-request rendering flags for the generic web handler.
+type renderOptions struct {
+	noindex  bool
+	nofollow bool
+}
+
+// webGeneric returns a handler that renders the base SPA shell with the given
+// render options applied to the template context.
+func (srv *Server) webGeneric(c echo.Context, o renderOptions) error {
+	data := srv.NewTemplateContext()
+	data["noindex"] = o.noindex
+	data["nofollow"] = o.nofollow
+	return c.Render(http.StatusOK, "base.html", data)
+}
+
 // handler for endpoint that have no specific server-side handling
 func (srv *Server) WebGeneric(c echo.Context) error {
-	data := srv.NewTemplateContext()
-	return c.Render(http.StatusOK, "base.html", data)
+	return srv.webGeneric(c, renderOptions{})
+}
+
+// handler for routes that should not be indexed by search engines
+// (e.g. auth-only user-state surfaces, internal/debug pages, action/intent dispatch URLs, search results)
+func (srv *Server) WebGenericNoindex(c echo.Context) error {
+	return srv.webGeneric(c, renderOptions{noindex: true})
+}
+
+// handler for action/intent dispatch URLs (e.g. /intent/compose). These accept
+// arbitrary query parameters from arbitrary third-party referrers, so we treat
+// them as link-graph dead-ends in addition to noindex. Anything legitimately
+// reachable from a hydrated intent page is also reachable via its canonical URL.
+func (srv *Server) WebGenericNoindexNofollow(c echo.Context) error {
+	return srv.webGeneric(c, renderOptions{noindex: true, nofollow: true})
 }

 func (srv *Server) WebHome(c echo.Context) error {
@@ -500,6 +588,20 @@ var hideEmbedLabels = map[string]bool{
 	"sensitive":         true,
 }

+// Replies surfaced into a post's JSON-LD comment[] are dropped entirely when
+// any of these labels are present (in addition to hideEmbedLabels). Targets
+// abuse/spam in third-party reply text, since reply text would otherwise be
+// emitted into the parent post's structured data.
+var hideReplyLabels = map[string]bool{
+	"!hide":         true,
+	"!warn":         true,
+	"porn":          true,
+	"sexual":        true,
+	"nudity":        true,
+	"graphic-media": true,
+	"spam":          true,
+}
+
 func (srv *Server) WebPost(c echo.Context) error {
 	ctx := c.Request().Context()
 	data := srv.NewTemplateContext()
@@ -524,18 +626,25 @@ func (srv *Server) WebPost(c echo.Context) error {
 		log.Warnf("failed to fetch profile for: %s\t%v", identifier, err)
 		return c.Render(http.StatusOK, "post.html", data)
 	}
-	unauthedViewingOkay := true
-	for _, label := range pv.Labels {
-		if label.Src == pv.Did && label.Val == "!no-unauthenticated" {
-			unauthedViewingOkay = false
-		}
-	}
+	unauthedViewingOkay := !profileRequiresAuth(pv)

 	req := c.Request()
+	requestURI := fmt.Sprintf("https://%s%s", req.Host, req.URL.Path)
+
+	// Always prefer the handle-form URL so JSON-LD `url` and
+	// <link rel="canonical"> match. Falls back to requestURI when the
+	// handle is unusable (template strips query/fragment).
+	canonicalURL := bskyPostURL(pv.Handle, rkey.String())
+
 	if !unauthedViewingOkay {
 		// Provide minimal OpenGraph data for auth-required posts
-		data["requestURI"] = fmt.Sprintf("https://%s%s", req.Host, req.URL.Path)
+		data["requestURI"] = requestURI
+		if canonicalURL != "" {
+			data["canonicalURL"] = canonicalURL
+		}
 		data["requiresAuth"] = true
+		data["noindex"] = true
+		data["nofollow"] = true
 		data["profileHandle"] = pv.Handle
 		if pv.DisplayName != nil {
 			data["profileDisplayName"] = *pv.DisplayName
@@ -551,81 +660,44 @@ func (srv *Server) WebPost(c echo.Context) error {
 		return c.Render(http.StatusOK, "post.html", data)
 	}

-	postView := tpv.Thread.FeedDefs_ThreadViewPost.Post
+	threadView := tpv.Thread.FeedDefs_ThreadViewPost
+	if threadView == nil || threadView.Post == nil {
+		return c.Render(http.StatusOK, "post.html", data)
+	}
+	postView := threadView.Post
 	data["postView"] = postView
-	data["requestURI"] = fmt.Sprintf("https://%s%s", req.Host, req.URL.Path)
+	data["requestURI"] = requestURI
+	if canonicalURL != "" {
+		data["canonicalURL"] = canonicalURL
+	}

-	// If any undesirable labels are set, the embed will not be included in
-	// metadata
-	isEmbedHidden := false
-	for _, label := range postView.Labels {
-		isNeg := label.Neg != nil && *label.Neg
-		if hideEmbedLabels[label.Val] && !isNeg {
-			isEmbedHidden = true
-			break
+	// Share extraction helpers with jsonld.go so og:image and JSON-LD
+	// image[] are byte-identical (per Google's requirement).
+	isEmbedHidden := postEmbedHidden(postView, hideEmbedLabels)
+	data["postText"] = postRecordText(postView)
+
+	if thumbs := extractPostMedia(postView, isEmbedHidden); len(thumbs) > 0 {
+		data["imgThumbUrls"] = thumbs
+	}
+	if vm := extractVideoMeta(postView, isEmbedHidden); vm.URL != "" {
+		data["videoUrl"] = vm.URL
+		data["videoType"] = vm.Type
+		if vm.HasSize {
+			data["videoWidth"] = vm.Width
+			data["videoHeight"] = vm.Height
 		}
 	}

-	if postView.Record != nil {
-		postRecord, ok := postView.Record.Val.(*appbsky.FeedPost)
-		if ok {
-			data["postText"] = ExpandPostText(postRecord)
-
-			if !isEmbedHidden && postRecord.Labels != nil && postRecord.Labels.LabelDefs_SelfLabels != nil {
-				for _, label := range postRecord.Labels.LabelDefs_SelfLabels.Values {
-					if hideEmbedLabels[label.Val] {
-						isEmbedHidden = true
-						break
-					}
-				}
-			}
-		}
+	// Build JSON-LD. Fall back to requestURI when handle is unusable so the
+	// envelope url is never empty.
+	jsonldURL := canonicalURL
+	if jsonldURL == "" {
+		jsonldURL = requestURI
 	}
-
-	if postView.Embed != nil && !isEmbedHidden {
-		hasImages := postView.Embed.EmbedImages_View != nil
-		hasVideo := postView.Embed.EmbedVideo_View != nil
-		hasMedia := postView.Embed.EmbedRecordWithMedia_View != nil && postView.Embed.EmbedRecordWithMedia_View.Media != nil
-		hasMediaImages := hasMedia && postView.Embed.EmbedRecordWithMedia_View.Media.EmbedImages_View != nil
-		hasMediaVideo := hasMedia && postView.Embed.EmbedRecordWithMedia_View.Media.EmbedVideo_View != nil
-
-		if hasImages {
-			var thumbUrls []string
-			for i := range postView.Embed.EmbedImages_View.Images {
-				thumbUrls = append(thumbUrls, postView.Embed.EmbedImages_View.Images[i].Thumb)
-			}
-			data["imgThumbUrls"] = thumbUrls
-		} else if hasVideo {
-			if postView.Embed.EmbedVideo_View.Thumbnail != nil {
-				data["imgThumbUrls"] = []string{*postView.Embed.EmbedVideo_View.Thumbnail}
-			}
-			if postView.Embed.EmbedVideo_View.Playlist != "" {
-				data["videoUrl"] = postView.Embed.EmbedVideo_View.Playlist
-				data["videoType"] = "application/vnd.apple.mpegurl"
-				if postView.Embed.EmbedVideo_View.AspectRatio != nil {
-					data["videoWidth"] = postView.Embed.EmbedVideo_View.AspectRatio.Width
-					data["videoHeight"] = postView.Embed.EmbedVideo_View.AspectRatio.Height
-				}
-			}
-		} else if hasMediaImages {
-			var thumbUrls []string
-			for i := range postView.Embed.EmbedRecordWithMedia_View.Media.EmbedImages_View.Images {
-				thumbUrls = append(thumbUrls, postView.Embed.EmbedRecordWithMedia_View.Media.EmbedImages_View.Images[i].Thumb)
-			}
-			data["imgThumbUrls"] = thumbUrls
-		} else if hasMediaVideo {
-			if postView.Embed.EmbedRecordWithMedia_View.Media.EmbedVideo_View.Thumbnail != nil {
-				data["imgThumbUrls"] = []string{*postView.Embed.EmbedRecordWithMedia_View.Media.EmbedVideo_View.Thumbnail}
-			}
-			if postView.Embed.EmbedRecordWithMedia_View.Media.EmbedVideo_View.Playlist != "" {
-				data["videoUrl"] = postView.Embed.EmbedRecordWithMedia_View.Media.EmbedVideo_View.Playlist
-				data["videoType"] = "application/vnd.apple.mpegurl"
-				if postView.Embed.EmbedRecordWithMedia_View.Media.EmbedVideo_View.AspectRatio != nil {
-					data["videoWidth"] = postView.Embed.EmbedRecordWithMedia_View.Media.EmbedVideo_View.AspectRatio.Width
-					data["videoHeight"] = postView.Embed.EmbedRecordWithMedia_View.Media.EmbedVideo_View.AspectRatio.Height
-				}
-			}
-		}
+	if jsonld, err := buildPostJSONLD(postView, threadView.Replies, jsonldURL, hideEmbedLabels, hideReplyLabels); err == nil {
+		data["postJSONLD"] = jsonld
+	} else {
+		log.Warnf("failed to build post JSON-LD for %s: %v", uri, err)
 	}

 	return c.Render(http.StatusOK, "post.html", data)
@@ -670,6 +742,44 @@ func (srv *Server) WebStarterPack(c echo.Context) error {
 	return c.Render(http.StatusOK, "starterpack.html", data)
 }

+// chatInviteCodeRe is a permissive sanity check on the join code so we don't
+// proxy obviously-bad input to the chat appview. Codes are opaque per the
+// lexicon, but in practice URL-safe and short.
+var chatInviteCodeRe = regexp.MustCompile(`^[A-Za-z0-9_-]{1,64}$`)
+
+func (srv *Server) WebChatInvite(c echo.Context) error {
+	req := c.Request()
+	ctx := req.Context()
+	data := srv.NewTemplateContext()
+	data["noindex"] = true
+	data["requestURI"] = fmt.Sprintf("https://%s%s", req.Host, req.URL.Path)
+
+	code := c.Param("code")
+	if !chatInviteCodeRe.MatchString(code) {
+		return c.Render(http.StatusOK, "chatinvite.html", data)
+	}
+	if srv.chatXrpcc == nil {
+		return c.Render(http.StatusOK, "chatinvite.html", data)
+	}
+
+	out, err := chat.GroupGetJoinLinkPreviews(ctx, srv.chatXrpcc, []string{code})
+	if err != nil {
+		log.Errorf("failed to fetch chat invite preview for code=%s: %v", code, err)
+		return c.Render(http.StatusOK, "chatinvite.html", data)
+	}
+	if len(out.JoinLinkPreviews) == 0 {
+		return c.Render(http.StatusOK, "chatinvite.html", data)
+	}
+	preview := out.JoinLinkPreviews[0]
+
+	data["title"] = preview.Name
+	if srv.cfg.ogcardHost != "" {
+		// bskyogcard registers this route as /chat-invite/:code, not /chat/:code.
+		data["imgThumbUrl"] = fmt.Sprintf("%s/chat-invite/%s", srv.cfg.ogcardHost, code)
+	}
+	return c.Render(http.StatusOK, "chatinvite.html", data)
+}
+
 func (srv *Server) WebProfile(c echo.Context) error {
 	ctx := c.Request().Context()
 	data := srv.NewTemplateContext()
@@ -687,20 +797,56 @@ func (srv *Server) WebProfile(c echo.Context) error {
 		log.Warnf("failed to fetch profile for: %s\t%v", identifier, err)
 		return c.Render(http.StatusOK, "profile.html", data)
 	}
-	unauthedViewingOkay := true
-	for _, label := range pv.Labels {
-		if label.Src == pv.Did && label.Val == "!no-unauthenticated" {
-			unauthedViewingOkay = false
-		}
-	}
+	unauthedViewingOkay := !profileRequiresAuth(pv)

 	req := c.Request()
 	data["profileView"] = pv
 	data["requestURI"] = fmt.Sprintf("https://%s%s", req.Host, req.URL.Path)
 	data["requestHost"] = req.Host

-	if !unauthedViewingOkay {
+	// Prefer the handle-form URL so JSON-LD `url` and
+	// <link rel="canonical"> match. Template falls back to requestURI
+	// when the handle is unusable.
+	if url := bskyProfileURL(pv.Handle); url != "" {
+		data["canonicalURL"] = url
+	}
+
+	// Fetch recent posts for ProfilePage.hasPart. Skipped for auth-required
+	// profiles (posts aren't publicly indexable anyway). Failures degrade
+	// gracefully — the profile still renders without hasPart.
+	//
+	// NOTE: extra XRPC call on every public profile render; consider
+	// caching per-profile if upstream load becomes a concern.
+	var recentPosts []*appbsky.FeedDefs_PostView
+	if unauthedViewingOkay {
+		af, err := appbsky.FeedGetAuthorFeed(ctx, srv.xrpcc, pv.Did, "", "posts_no_replies", false, authorFeedFetchLimit)
+		if err != nil {
+			log.Warnf("failed to fetch author feed for: %s\t%v", pv.Did, err)
+		} else {
+			for _, p := range af.Feed {
+				if p == nil || p.Post == nil {
+					continue
+				}
+				// Only the author's own posts (matches RSS handler).
+				if p.Post.Author == nil || p.Post.Author.Did != pv.Did {
+					continue
+				}
+				recentPosts = append(recentPosts, p.Post)
+				if len(recentPosts) >= maxRecentPosts {
+					break
+				}
+			}
+		}
+	} else {
 		data["requiresAuth"] = true
+		data["noindex"] = true
+		data["nofollow"] = true
+	}
+
+	if jsonld, err := buildProfileJSONLD(pv, recentPosts, hideEmbedLabels, hideReplyLabels); err == nil {
+		data["profileJSONLD"] = jsonld
+	} else {
+		log.Warnf("failed to build profile JSON-LD for %s: %v", pv.Did, err)
 	}

 	return c.Render(http.StatusOK, "profile.html", data)
@@ -730,12 +876,7 @@ func (srv *Server) WebFeed(c echo.Context) error {
 		log.Warnf("failed to fetch profile for: %s\t%v", identifier, err)
 		return c.Render(http.StatusOK, "feed.html", data)
 	}
-	unauthedViewingOkay := true
-	for _, label := range pv.Labels {
-		if label.Src == pv.Did && label.Val == "!no-unauthenticated" {
-			unauthedViewingOkay = false
-		}
-	}
+	unauthedViewingOkay := !profileRequiresAuth(pv)

 	if !unauthedViewingOkay {
 		return c.Render(http.StatusOK, "feed.html", data)
@@ -95,7 +95,7 @@ func (srv *Server) parseBlueskyURL(ctx context.Context, raw string) (*syntax.ATU
 	}
 	var did syntax.DID
 	if atid.IsHandle() {
-		ident, err := srv.dir.Lookup(ctx, *atid)
+		ident, err := srv.dir.Lookup(ctx, atid)
 		if err != nil {
 			return nil, err
 		}
@@ -3,7 +3,7 @@ module github.com/bluesky-social/social-app/bskyweb
 go 1.26

 require (
-	github.com/bluesky-social/indigo v0.0.0-20250729223159-573ae927246a
+	github.com/bluesky-social/indigo v0.0.0-20260605210604-af2fec94f34c
 	github.com/flosch/pongo2/v6 v6.0.0
 	github.com/ipfs/go-log v1.0.5
 	github.com/joho/godotenv v1.5.1
@@ -18,11 +18,10 @@ require github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indir

 require (
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/bradfitz/gomemcache v0.0.0-20230905024940-24af94b03874 // indirect
-	github.com/carlmjohnson/versioninfo v0.22.5 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
+	github.com/earthboundkid/versioninfo/v2 v2.24.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
@@ -32,7 +31,6 @@ require (
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.5 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
-	github.com/hashicorp/golang-lru/arc/v2 v2.0.6 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/ipfs/bbloom v0.0.4 // indirect
 	github.com/ipfs/go-block-format v0.2.0 // indirect
@@ -82,7 +80,6 @@ require (
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.2 // indirect
 	github.com/whyrusleeping/cbor-gen v0.2.1-0.20241030202151-b7a6831be65e // indirect
-	github.com/whyrusleeping/go-did v0.0.0-20230824162731-404d1707d5d6 // indirect
 	github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
 	gitlab.com/yawning/secp256k1-voi v0.0.0-20230925100816-f2616030848b // indirect
 	gitlab.com/yawning/tuplehash v0.0.0-20230713102510-df83abbf9a02 // indirect
@@ -93,11 +90,11 @@ require (
 	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.26.0 // indirect
-	golang.org/x/crypto v0.40.0 // indirect
-	golang.org/x/net v0.42.0 // indirect
-	golang.org/x/sync v0.16.0 // indirect
-	golang.org/x/sys v0.34.0 // indirect
-	golang.org/x/text v0.27.0 // indirect
+	golang.org/x/crypto v0.45.0 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/sync v0.18.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
 	golang.org/x/time v0.12.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
 	google.golang.org/protobuf v1.36.6 // indirect
@@ -2,12 +2,8 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bluesky-social/indigo v0.0.0-20250729223159-573ae927246a h1:S12KN45uIkRglMHC8PqD/Vsz0+u3KbIaBF/6rit8/Pg=
-github.com/bluesky-social/indigo v0.0.0-20250729223159-573ae927246a/go.mod h1:0XUyOCRtL4/OiyeqMTmr6RlVHQMDgw3LS7CfibuZR5Q=
-github.com/bradfitz/gomemcache v0.0.0-20230905024940-24af94b03874 h1:N7oVaKyGp8bttX0bfZGmcGkjz7DLQXhAn3DNd3T0ous=
-github.com/bradfitz/gomemcache v0.0.0-20230905024940-24af94b03874/go.mod h1:r5xuitiExdLAJ09PR7vBVENGvp4ZuTBeWTGtxuX3K+c=
-github.com/carlmjohnson/versioninfo v0.22.5 h1:O00sjOLUAFxYQjlN/bzYTuZiS0y6fWDQjMRvwtKgwwc=
-github.com/carlmjohnson/versioninfo v0.22.5/go.mod h1:QT9mph3wcVfISUKd0i9sZfVrPviHuSF+cUtLjm2WSf8=
+github.com/bluesky-social/indigo v0.0.0-20260605210604-af2fec94f34c h1:Jr82+1HUmwwZzDpt/eeU4sieya27iXjuPMdXZkOXoBc=
+github.com/bluesky-social/indigo v0.0.0-20260605210604-af2fec94f34c/go.mod h1:JqQkz8lrOI6YZivP38GHmtVOTtzsNToITKj1gMpU5Jo=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
@@ -19,6 +15,8 @@ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/decred/dcrd/crypto/blake256 v1.0.1/go.mod h1:2OfgNZ5wDpcsFmHmCK5gZTPcCXqlm2ArzUIkw9czNJo=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 h1:8UrgZ3GkP4i/CLijOJx79Yu+etlyjdBU4sfcs2WYQMs=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0/go.mod h1:v57UDF4pDQJcEfFUCRop3lJL149eHGSe9Jvczhzjo/0=
+github.com/earthboundkid/versioninfo/v2 v2.24.1 h1:SJTMHaoUx3GzjjnUO1QzP3ZXK6Ee/nbWyCm58eY3oUg=
+github.com/earthboundkid/versioninfo/v2 v2.24.1/go.mod h1:VcWEooDEuyUJnMfbdTh0uFN4cfEIg+kHMuWB2CDCLjw=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/flosch/pongo2/v6 v6.0.0 h1:lsGru8IAzHgIAw6H2m4PCyleO58I40ow6apih0WprMU=
@@ -48,8 +46,6 @@ github.com/hashicorp/go-retryablehttp v0.7.5 h1:bJj+Pj19UZMIweq/iie+1u5YCdGrnxCT
 github.com/hashicorp/go-retryablehttp v0.7.5/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
 github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
 github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
-github.com/hashicorp/golang-lru/arc/v2 v2.0.6 h1:4NU7uP5vSoK6TbaMj3NtY478TTAWLso/vL1gpNrInHg=
-github.com/hashicorp/golang-lru/arc/v2 v2.0.6/go.mod h1:cfdDIX05DWvYV6/shsxDfa/OVcRieOt+q4FnM8x+Xno=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
@@ -211,8 +207,6 @@ github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0 h1:GDDkbFiaK8jsSD
 github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0/go.mod h1:x6AKhvSSexNrVSrViXSHUEbICjmGXhtgABaHIySUSGw=
 github.com/whyrusleeping/cbor-gen v0.2.1-0.20241030202151-b7a6831be65e h1:28X54ciEwwUxyHn9yrZfl5ojgF4CBNLWX7LR0rvBkf4=
 github.com/whyrusleeping/cbor-gen v0.2.1-0.20241030202151-b7a6831be65e/go.mod h1:pM99HXyEbSQHcosHc0iW7YFmwnscr+t9Te4ibko05so=
-github.com/whyrusleeping/go-did v0.0.0-20230824162731-404d1707d5d6 h1:yJ9/LwIGIk/c0CdoavpC9RNSGSruIspSZtxG3Nnldic=
-github.com/whyrusleeping/go-did v0.0.0-20230824162731-404d1707d5d6/go.mod h1:39U9RRVr4CKbXpXYopWn+FSH5s+vWu6+RmguSPWAq5s=
 github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 h1:bAn7/zixMGCfxrRTfdpNzjtPYqr8smhKouy9mxVdGPU=
 github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673/go.mod h1:N3UwUGtsrSj3ccvlPHLoLsHnpR27oXr4ZE984MbSER8=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -253,8 +247,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
-golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
-golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
+golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -272,16 +266,16 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
-golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
-golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
+golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -297,8 +291,8 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
-golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
@@ -310,8 +304,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
-golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
 golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
 golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -139,6 +139,7 @@
  <meta name="theme-color">
  <meta name="application-name" content="Bluesky">
  <meta name="generator" content="bskyweb">
+  {% if noindex %}<meta name="robots" content="noindex{% if nofollow %}, nofollow{% endif %}">{% endif %}
  <meta property="og:site_name" content="Bluesky Social">
  <meta property="og:logo" content="{{ favicon }}">
  <meta name="twitter:site" content="@bluesky" />
@@ -0,0 +1,25 @@
+{% extends "base.html" %}
+
+{% block html_head_extra -%}
+  {%- if requestURI %}
+  <meta property="og:url" content="{{ requestURI }}">
+  {% endif -%}
+  {%- if imgThumbUrl %}
+  <meta property="og:image" content="{{ imgThumbUrl }}">
+  <meta property="twitter:image" content="{{ imgThumbUrl }}">
+  {%- else -%}
+  <meta property="og:image" content="https://bsky.app/static/social-card-default-gradient.png" />
+  <meta property="twitter:image" content="https://bsky.app/static/social-card-default-gradient.png"  />
+  {% endif -%}
+  <meta name="twitter:card" content="summary_large_image" />
+  {%- if title %}
+  <meta property="og:title" content="{{ title }}" />
+  <meta name="twitter:title" content="{{ title }}" />
+  {%- else -%}
+  <meta property="og:title" content="Bluesky" />
+  <meta name="twitter:title" content="Bluesky" />
+  {% endif -%}
+  <meta name="description" content="Join this group chat on Bluesky" />
+  <meta name="og:description" content="Join this group chat on Bluesky" />
+  <meta name="twitter:description" content="Join this group chat on Bluesky" />
+{%- endblock %}
@@ -15,8 +15,13 @@
  <meta property="og:type" content="article">
  <meta property="profile:username" content="{{ postView.Author.Handle }}">
  {%- if requestURI %}
+  {% if canonicalURL %}
+  <meta property="og:url" content="{{ canonicalURL }}">
+  <link rel="canonical" href="{{ canonicalURL }}" />
+  {% else %}
  <meta property="og:url" content="{{ requestURI }}">
  <link rel="canonical" href="{{ requestURI|canonicalize_url }}" />
+  {% endif %}
  {% endif -%}
  {%- if postView.Author.DisplayName %}
  <meta property="og:title" content="{{ postView.Author.DisplayName }} (@{{ postView.Author.Handle }})">
@@ -34,6 +39,11 @@
  <meta property="twitter:image" content="{{ imgThumbUrl }}">
  {% endfor %}
  <meta name="twitter:card" content="summary_large_image">
+  {% else %}
+  <meta property="og:image" content="{{ postView.Author.Avatar|avatar_thumbnail }}">
+  <meta property="twitter:image" content="{{ postView.Author.Avatar|avatar_thumbnail }}">
+  <meta name="twitter:card" content="summary">
+  {% endif %}
  {%- if videoUrl %}
  <meta property="og:video" content="{{ videoUrl }}">
  <meta property="og:video:type" content="{{ videoType }}">
@@ -42,11 +52,6 @@
  <meta property="og:video:height" content="{{ videoHeight }}">
  {% endif -%}
  {% endif -%}
-  {% else %}
-  <meta property="og:image" content="{{ postView.Author.Avatar|avatar_thumbnail }}">
-  <meta property="twitter:image" content="{{ postView.Author.Avatar|avatar_thumbnail }}">
-  <meta name="twitter:card" content="summary">
-  {% endif %}
  <meta name="twitter:label1" content="Posted At">
  <meta name="twitter:value1" content="{{ postView.IndexedAt }}">
  {%- if postView.LikeCount %}
@@ -64,52 +69,20 @@
  <meta property="article:published_time" content="{{ postView.IndexedAt }}">
  <link rel="alternate" type="application/json+oembed" href="https://embed.bsky.app/oembed?format=json&url={{ postView.Uri | urlencode }}" />
  <link rel="alternate" href="{{ postView.Uri }}" />
-  <script type="application/ld+json">
-    {
-      "@context": "https://schema.org",
-      "@type": "DiscussionForumPosting",
-      "author": {
-        "@type": "Person",
-        {%- if postView.Author.DisplayName %}
-        "name": "{{ postView.Author.DisplayName }}",
-        "alternateName": "@{{ postView.Author.Handle }}",
-        {% else %}
-        "name": "@{{ postView.Author.Handle }}",
-        {% endif -%}
-        "url": "https://bsky.app/profile/{{ postView.Author.Handle }}"
-      },
-      {%- if postText %}
-      "text": "{{ postText }}",
-      {% endif %}
-      {%- if imageThumbUrls %}
-      "image": "{{ imageThumbUrls[0] }}",
-      {% endif %}
-      "datePublished": "{{ postView.IndexedAt }}",
-      "interactionStatistic": [
-        {
-          "@type": "InteractionCounter",
-          "interactionType": "https://schema.org/LikeAction",
-          "userInteractionCount": {{ postView.LikeCount }}
-        },
-        {
-          "@type": "InteractionCounter",
-          "interactionType": "https://schema.org/CommentAction",
-          "userInteractionCount": {{ postView.ReplyCount }}
-        },
-        {
-          "@type": "InteractionCounter",
-          "interactionType": "https://schema.org/ShareAction",
-          "userInteractionCount": {{ postView.RepostCount + postView.QuoteCount }}
-        }
-      ]
-    }
-  </script>
+  {%- if postJSONLD %}
+  <script type="application/ld+json">{{ postJSONLD|safe }}</script>
+  {% endif -%}
 {%- elif requiresAuth and profileHandle -%}
  <meta property="og:type" content="article">
  <meta property="profile:username" content="{{ profileHandle }}">
  {%- if requestURI %}
+  {% if canonicalURL %}
+  <meta property="og:url" content="{{ canonicalURL }}">
+  <link rel="canonical" href="{{ canonicalURL }}" />
+  {% else %}
  <meta property="og:url" content="{{ requestURI }}">
  <link rel="canonical" href="{{ requestURI|canonicalize_url }}" />
+  {% endif %}
  {% endif -%}
  {%- if profileDisplayName %}
  <meta property="og:title" content="{{ profileDisplayName }} (@{{ profileHandle }})">
@@ -12,8 +12,13 @@
  <meta property="og:site_name" content="Bluesky Social">
  <meta property="og:type" content="profile">
 {%- if requestURI %}
+  {% if canonicalURL %}
+  <meta property="og:url" content="{{ canonicalURL }}">
+  <link rel="canonical" href="{{ canonicalURL }}" />
+  {% else %}
  <meta property="og:url" content="{{ requestURI }}">
  <link rel="canonical" href="{{ requestURI|canonicalize_url }}" />
+  {% endif %}
 {% endif -%}

 {%- if profileView -%}
@@ -52,44 +57,9 @@
    <meta property="twitter:description" content="This profile requires authentication to view.">
  {% endif %}
  
-  <script type="application/ld+json">
-  {
-    "@context": "https://schema.org",
-    "@type": "ProfilePage",
-    "dateCreated": "{{ profileView.CreatedAt }}",
-    "mainEntity": {
-      "@type": "Person",
-      {%- if profileView.DisplayName %}
-      "name": "{{ profileView.DisplayName }}",
-      "alternateName": "@{{ profileView.Handle }}",
-      {% else %}
-      "name": "@{{ profileView.Handle }}",
-      {% endif -%}
-      "identifier": "{{ profileView.Did }}",
-      "description": "{{ profileView.Description }}",
-      "image": "{{ profileView.Avatar }}",
-      "interactionStatistic": [
-        {
-          "@type": "InteractionCounter",
-          "interactionType": "https://schema.org/FollowAction",
-          "userInteractionCount": {{ profileView.FollowersCount }}
-        }
-      ],
-      "agentInteractionStatistic": [
-        {
-          "@type": "InteractionCounter",
-          "interactionType": "https://schema.org/FollowAction",
-          "userInteractionCount": {{ profileView.FollowsCount }}
-        },
-        {
-          "@type": "InteractionCounter",
-          "interactionType": "https://schema.org/WriteAction",
-          "userInteractionCount": {{ profileView.PostsCount }}
-        }
-      ]
-    }
-  }
-  </script>
+  {%- if profileJSONLD %}
+  <script type="application/ld+json">{{ profileJSONLD|safe }}</script>
+  {% endif -%}
 {% endif -%}
 {%- endblock %}

@@ -57,6 +57,9 @@ release or OTA.
 Log in to the EAS CLI with `eas login` and manually set the build numbers to the
 values you found in **Step 1**.

+> [!NOTE]
+> If you don’t already have the EAS CLI, you can install it with `pnpm add -g eas-cli`.
+
 ```sh
 > npx eas build:version:set -p ios
 >
@@ -114,7 +117,7 @@ To confirm this, as mentioned above, you must completely clear the TestFlight
 build from your device and re-install from the App Store. Then, you'll need to:
 - Launch the app (or quit and reopen) and wait ~15s for the download to complete
 - Quit and reopen the app
- Check the `Settings > About` page and confirm the has matches the most recent has on your OTA branch
+- Check the `Settings > About` page and confirm the hash matches the most recent hash on your OTA branch

 ### 9. Reset build numbers

@@ -6,7 +6,7 @@ values.
 Install dependencies in `/dev-env`

 ```
-cd dev-env && yarn
+cd dev-env && pnpm i
 ```

 ## Using Maestro
@@ -27,7 +27,7 @@ adb reverse tcp:3000 tcp:3000

 - In one tab, run `pnpm e2e:mock-server`
 - In a second tab, run `pnpm e2e:build`
- In a third tab, run `pnpm e2e:run`
+- In a third tab, run `pnpm e2e:run __e2e__`

 ## Using Flashlight for Performance Testing
 1. Make sure Maestro is installed (optional: only for automated testing) by following the instructions above
@@ -47,21 +47,6 @@
        "EXPO_PUBLIC_ENV": "production"
      }
    },
-    "production-apk": {
-      "extends": "base",
-      "distribution": "internal",
-      "ios": {
-        "autoIncrement": false,
-        "buildArtifactPaths": ["ios/build/*"]
-      },
-      "android": {
-        "autoIncrement": false
-      },
-      "channel": "production",
-      "env": {
-        "EXPO_PUBLIC_ENV": "production"
-      }
-    },
    "testflight": {
      "extends": "base",
      "ios": {
@@ -78,7 +63,6 @@
    },
    "testflight-android": {
      "extends": "base",
-      "distribution": "internal",
      "ios": {
        "autoIncrement": true,
        "buildArtifactPaths": ["ios/build/*"]
@@ -96,6 +80,14 @@
    "production": {
      "ios": {
        "ascAppId": "6444370199"
+      },
+      "android": {
+        "track": "production"
+      }
+    },
+    "testflight-android": {
+      "android": {
+        "track": "internal"
      }
    }
  }
@@ -134,11 +134,10 @@ export default defineConfig(
      'react-native/no-inline-styles': 'off',
      ...reactNativeA11y.configs.all.rules,
      'react-compiler/react-compiler': 'warn',
-      // TODO: Fix these and set to error
-      'react-hooks/set-state-in-effect': 'warn',
-      'react-hooks/purity': 'warn',
-      'react-hooks/refs': 'warn',
-      'react-hooks/immutability': 'warn',
+      'react-hooks/set-state-in-effect': 'error',
+      'react-hooks/purity': 'error',
+      'react-hooks/refs': 'error',
+      'react-hooks/immutability': 'error',

      /**
       * Import sorting
@@ -235,9 +234,8 @@ export default defineConfig(
        },
      ],
      /**
-       * Maintain previous behavior - these are stricter in typescript-eslint
-       * v8 `warn` ones are probably worth fixing. `off` ones are a bit too
-       * nit-picky
+       * Maintain previous behavior via eslint-suppressions.json - these are
+       * stricter in typescript-eslint v8. `off` ones are a bit too nit-picky.
       */
      '@typescript-eslint/no-explicit-any': 'error',
      '@typescript-eslint/ban-ts-comment': 'off',
@@ -247,18 +245,18 @@ export default defineConfig(
      '@typescript-eslint/unbound-method': 'off',
      '@typescript-eslint/no-unsafe-argument': 'off',
      '@typescript-eslint/no-unsafe-return': 'off',
-      '@typescript-eslint/no-unsafe-member-access': 'warn',
-      '@typescript-eslint/no-unsafe-call': 'warn',
-      '@typescript-eslint/no-floating-promises': 'warn',
-      '@typescript-eslint/no-misused-promises': 'warn',
-      '@typescript-eslint/require-await': 'warn',
-      '@typescript-eslint/no-unsafe-enum-comparison': 'warn',
-      '@typescript-eslint/no-unnecessary-type-assertion': 'warn',
-      '@typescript-eslint/no-redundant-type-constituents': 'warn',
-      '@typescript-eslint/no-duplicate-type-constituents': 'warn',
-      '@typescript-eslint/no-base-to-string': 'warn',
-      '@typescript-eslint/prefer-promise-reject-errors': 'warn',
-      '@typescript-eslint/await-thenable': 'warn',
+      '@typescript-eslint/no-unsafe-member-access': 'error',
+      '@typescript-eslint/no-unsafe-call': 'error',
+      '@typescript-eslint/no-floating-promises': 'error',
+      '@typescript-eslint/no-misused-promises': 'error',
+      '@typescript-eslint/require-await': 'error',
+      '@typescript-eslint/no-unsafe-enum-comparison': 'error',
+      '@typescript-eslint/no-unnecessary-type-assertion': 'error',
+      '@typescript-eslint/no-redundant-type-constituents': 'error',
+      '@typescript-eslint/no-duplicate-type-constituents': 'error',
+      '@typescript-eslint/no-base-to-string': 'error',
+      '@typescript-eslint/prefer-promise-reject-errors': 'error',
+      '@typescript-eslint/await-thenable': 'error',

      'no-restricted-imports': [
        'error',
@@ -41,11 +41,14 @@ class BottomSheetView(
  private val screenHeight: Float =
    if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.VANILLA_ICE_CREAM) {
      // API 35+: edge-to-edge is mandatory, heightPixels is the full display
-      context.resources.displayMetrics.heightPixels.toFloat()
+      context.resources.displayMetrics.heightPixels
+        .toFloat()
    } else if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.R) {
      // API 30-34: heightPixels may exclude nav bar, use currentWindowMetrics
      val wm = context.getSystemService(Context.WINDOW_SERVICE) as android.view.WindowManager
-      wm.currentWindowMetrics.bounds.height().toFloat()
+      wm.currentWindowMetrics.bounds
+        .height()
+        .toFloat()
    } else {
      // API < 30: currentWindowMetrics not available, use getRealSize
      // which includes system bars (heightPixels may exclude them)
@@ -166,6 +169,7 @@ class BottomSheetView(
    when {
      // Full height sheets
      contentHeight >= screenHeight -> 0.99f
+
      else -> this.clampRatio(this.getTargetHeight() / screenHeight)
    }

@@ -271,8 +275,9 @@ class BottomSheetView(
            }
            // Apply deferred layout update after gesture completes
            if (newState != BottomSheetBehavior.STATE_DRAGGING &&
-                newState != BottomSheetBehavior.STATE_SETTLING &&
-                pendingLayoutUpdate) {
+              newState != BottomSheetBehavior.STATE_SETTLING &&
+              pendingLayoutUpdate
+            ) {
              pendingLayoutUpdate = false
              updateLayout()
            }
@@ -292,7 +297,6 @@ class BottomSheetView(
    if (!fullHeight) {
      this.startObservingContentHeight()
    }
-
  }

  fun updateLayout() {
@@ -365,17 +369,18 @@ class BottomSheetView(

    val innerViewGroup = this.innerView as? ViewGroup ?: return

-    val listener = OnLayoutChangeListener { _, _, top, _, bottom, _, _, oldTop, oldBottom ->
-      val newHeight = bottom - top
-      val oldHeight = oldBottom - oldTop
-      if (newHeight != oldHeight) {
-        val contentHeight = getContentHeight()
-        if (contentHeight != lastObservedContentHeight && contentHeight > 0 && (isOpen || isOpening) && !isClosing) {
-          lastObservedContentHeight = contentHeight
-          updateLayout()
+    val listener =
+      OnLayoutChangeListener { _, _, top, _, bottom, _, _, oldTop, oldBottom ->
+        val newHeight = bottom - top
+        val oldHeight = oldBottom - oldTop
+        if (newHeight != oldHeight) {
+          val contentHeight = getContentHeight()
+          if (contentHeight != lastObservedContentHeight && contentHeight > 0 && (isOpen || isOpening) && !isClosing) {
+            lastObservedContentHeight = contentHeight
+            updateLayout()
+          }
        }
      }
-    }

    val children = mutableListOf<View>()
    for (i in 0 until innerViewGroup.childCount) {
@@ -1,4 +1,4 @@
-import {BottomSheetViewProps} from './BottomSheet.types'
+import {type BottomSheetViewProps} from './BottomSheet.types'

 export function BottomSheet(_: BottomSheetViewProps) {
  throw new Error('BottomSheet is not available on web')
@@ -1,6 +1,6 @@
 import React from 'react'

-import {BackgroundNotificationHandlerPreferences} from './ExpoBackgroundNotificationHandler.types'
+import {type BackgroundNotificationHandlerPreferences} from './ExpoBackgroundNotificationHandler.types'
 import {BackgroundNotificationHandler} from './ExpoBackgroundNotificationHandlerModule'

 interface BackgroundNotificationPreferencesContext {
@@ -1,6 +1,6 @@
 import {requireNativeModule} from 'expo-modules-core'

-import {ExpoBackgroundNotificationHandlerModule} from './ExpoBackgroundNotificationHandler.types'
+import {type ExpoBackgroundNotificationHandlerModule} from './ExpoBackgroundNotificationHandler.types'

 export const BackgroundNotificationHandler =
  requireNativeModule<ExpoBackgroundNotificationHandlerModule>(
@@ -1,6 +1,6 @@
 import {
-  BackgroundNotificationHandlerPreferences,
-  ExpoBackgroundNotificationHandlerModule,
+  type BackgroundNotificationHandlerPreferences,
+  type ExpoBackgroundNotificationHandlerModule,
 } from './ExpoBackgroundNotificationHandler.types'

 // Stub for web
@@ -2,7 +2,7 @@ import React from 'react'
 import {requireNativeModule} from 'expo'
 import {requireNativeViewManager} from 'expo-modules-core'

-import {GifViewProps} from './GifView.types'
+import {type GifViewProps} from './GifView.types'

 const NativeModule = requireNativeModule('ExpoBlueskyGifView')
 const NativeView: React.ComponentType<
@@ -67,7 +67,18 @@ export class GifView extends PureComponent<GifViewProps> {
  }

  async playAsync(): Promise<void> {
-    this.videoPlayerRef.current?.play()
+    try {
+      await this.videoPlayerRef.current?.play()
+    } catch (err) {
+      // `play()` rejects with a NotAllowedError when the browser blocks
+      // playback (e.g. Safari low-power mode or autoplay policy). This is
+      // expected and benign - the GIF simply stays paused - so swallow it
+      // rather than letting it surface as an unhandled rejection.
+      if (err instanceof DOMException && err.name === 'NotAllowedError') {
+        return
+      }
+      throw err
+    }
  }

  async pauseAsync(): Promise<void> {
@@ -1,7 +1,7 @@
 import {Platform} from 'react-native'
 import {requireNativeModule} from 'expo-modules-core'

-import {AudioCategory} from './types'
+import {type AudioCategory} from './types'

 const NativeModule = requireNativeModule('ExpoPlatformInfo')

@@ -1,5 +1,5 @@
 import {NotImplementedError} from '../NotImplemented'
-import {AudioCategory} from './types'
+import {type AudioCategory} from './types'

 export function getIsReducedMotionEnabled(): boolean {
  throw new NotImplementedError()
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`alt-blur@3076a2b5a593b0d7b37198b5aebfe3a222afd52d`
				`@@ -0,0 +1 @@`
				`<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><path fill="#000" d="M5 5a1 1 0 0 0-2 0v4a7 7 0 0 0 7 7h8.086l-2.293 2.293a1 1 0 0 0 1.414 1.414l2.94-2.94a2.5 2.5 0 0 0 0-3.535l-2.94-2.94a1 1 0 1 0-1.414 1.415L18.086 14H10a5 5 0 0 1-5-5V5Z"/></svg>`