chore: News fragment

feat: Mark spec version 1.17 as supported
feat: Finish implementing MSC4190
2026-07-15 02:48:58 +00:00 · 2026-06-29 10:09:31 -04:00 · 2026-06-29 10:08:30 -04:00 · 2026-06-29 10:08:08 -04:00
244 changed files with 5470 additions and 8056 deletions
@@ -44,7 +44,7 @@ runs:

    - name: Login to builtin registry
      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
      with:
        registry: ${{ env.BUILTIN_REGISTRY }}
        username: ${{ inputs.registry_user }}
@@ -52,7 +52,7 @@ runs:

    - name: Set up Docker Buildx
      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
      with:
        # Use persistent BuildKit if BUILDKIT_ENDPOINT is set (e.g. tcp://buildkit:8125)
        driver: ${{ env.BUILDKIT_ENDPOINT != '' && 'remote' || 'docker-container' }}
@@ -61,7 +61,7 @@ runs:
    - name: Extract metadata (tags) for Docker
      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
      id: meta
-      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
+      uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
      with:
        flavor: |
          latest=auto
@@ -67,7 +67,7 @@ runs:
      uses: ./.forgejo/actions/rust-toolchain

    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
      with:
        # Use persistent BuildKit if BUILDKIT_ENDPOINT is set (e.g. tcp://buildkit:8125)
        driver: ${{ env.BUILDKIT_ENDPOINT != '' && 'remote' || 'docker-container' }}
@@ -75,11 +75,11 @@ runs:

    - name: Set up QEMU
      if: ${{ env.BUILDKIT_ENDPOINT == '' }}
-      uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
+      uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4

    - name: Login to builtin registry
      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
      with:
        registry: ${{ env.BUILTIN_REGISTRY }}
        username: ${{ inputs.registry_user }}
@@ -87,7 +87,7 @@ runs:

    - name: Extract metadata (labels, annotations) for Docker
      id: meta
-      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
+      uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
      with:
        images: ${{ inputs.images }}
        # default labels & annotations: https://github.com/docker/metadata-action/blob/master/src/meta.ts#L509
@@ -33,7 +33,7 @@ runs:
        echo "version=$(rustup --version)" >> $GITHUB_OUTPUT
    - name: Cache rustup toolchains
      if: steps.rustup-version.outputs.version == ''
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
      with:
        path: |
          ~/.rustup
@@ -57,7 +57,7 @@ runs:

    - name: Check for LLVM cache
      id: cache
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
      with:
        path: |
          /usr/bin/clang-*
@@ -120,7 +120,7 @@ runs:

    - name: Install additional packages
      if: inputs.extra-packages != ''
-      uses: https://github.com/awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # latest
+      uses: https://github.com/awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # latest
      with:
        packages: ${{ inputs.extra-packages }}
        version: 1.0
@@ -65,7 +65,7 @@ runs:

    - name: Cache toolchain binaries
      id: toolchain-cache
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
      with:
        path: |
          .cargo/bin
@@ -76,7 +76,7 @@ runs:

    - name: Cache Cargo registry and git
      id: registry-cache
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
      with:
        path: |
          .cargo/registry/index
@@ -31,7 +31,7 @@ runs:

    - name: Restore binary cache
      id: binary-cache
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
      with:
        path: |
          /usr/share/rust/.cargo/bin
@@ -71,13 +71,13 @@ runs:

    - name: Install timelord-cli and git-warp-time
      if: steps.check-binaries.outputs.need-install == 'true'
-      uses: https://github.com/taiki-e/install-action@50414676f9f5d50a65992c6dd2ed02641263226c # v2
+      uses: https://github.com/taiki-e/install-action@9e1e5806d4a4822de933115878265be9aaa786d9 # v2
      with:
        tool: git-warp-time,timelord-cli@3.0.1

    - name: Save binary cache
      if: steps.check-binaries.outputs.need-install == 'true'
-      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
      with:
        path: |
          /usr/share/rust/.cargo/bin
@@ -87,7 +87,7 @@ runs:

    - name: Restore timelord cache with fallbacks
      id: timelord-restore
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
      with:
        path: ${{ env.TIMELORD_CACHE_PATH }}
        key: ${{ env.TIMELORD_KEY }}
@@ -114,7 +114,7 @@ runs:
        timelord sync --source-dir ${{ env.TIMELORD_PATH }} --cache-dir ${{ env.TIMELORD_CACHE_PATH }}

    - name: Save updated timelord cache immediately
-      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
      with:
        path: ${{ env.TIMELORD_CACHE_PATH }}
        key: ${{ env.TIMELORD_KEY }}
@@ -49,7 +49,7 @@ jobs:
          ref: ${{ github.ref_name }}

      - name: Cache Cargo registry
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: |
            ~/.cargo/registry
@@ -0,0 +1,394 @@
+name: Build / Fedora RPM
+
+concurrency:
+  group: "build-fedora-${{ github.ref }}"
+  cancel-in-progress: true
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+    # paths:
+    #   - 'pkg/fedora/**'
+    #   - 'src/**'
+    #   - 'Cargo.toml'
+    #   - 'Cargo.lock'
+    #   - '.forgejo/workflows/build-fedora.yml'
+  workflow_dispatch:
+  schedule:
+    - cron: '30 0 * * 2'
+
+jobs:
+  build:
+    runs-on: fedora-latest
+    steps:
+      - name: Detect Fedora version
+        id: fedora
+        run: |
+          VERSION=$(rpm -E %fedora)
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Fedora version: $VERSION"
+
+      - name: Checkout repository with full history
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          fetch-depth: 0
+          ref: ${{ github.ref_name }}
+
+
+      - name: Cache DNF packages
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: |
+            /var/cache/dnf
+            /var/cache/yum
+          key: dnf-fedora${{ steps.fedora.outputs.version }}-${{ hashFiles('pkg/fedora/continuwuity.spec.rpkg') }}-v1
+          restore-keys: |
+            dnf-fedora${{ steps.fedora.outputs.version }}-
+
+      - name: Cache Cargo registry
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+          key: cargo-fedora${{ steps.fedora.outputs.version }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            cargo-fedora${{ steps.fedora.outputs.version }}-
+
+      - name: Cache Rust build dependencies
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: |
+            ~/rpmbuild/BUILD/*/target/release/deps
+            ~/rpmbuild/BUILD/*/target/release/build
+            ~/rpmbuild/BUILD/*/target/release/.fingerprint
+            ~/rpmbuild/BUILD/*/target/release/incremental
+          key: rust-deps-fedora${{ steps.fedora.outputs.version }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            rust-deps-fedora${{ steps.fedora.outputs.version }}-
+
+      - name: Setup sccache
+        uses: https://git.tomfos.tr/tom/sccache-action@v1
+
+      - name: Configure sccache environment
+        run: |
+          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
+          echo "CMAKE_C_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
+          echo "CMAKE_CXX_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
+          echo "SCCACHE_CACHE_SIZE=10G" >> $GITHUB_ENV
+          # Aggressive GC since cache restores don't increment counter
+          echo "CARGO_INCREMENTAL_GC_TRIGGER=5" >> $GITHUB_ENV
+
+      - name: Install base RPM tools
+        run: |
+          dnf install -y --setopt=keepcache=1 \
+            fedora-packager \
+            python3-pip \
+            rpm-sign \
+            rpkg \
+            wget
+
+      - name: Setup build environment and build SRPM
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          git config --global user.email "ci@continuwuity.org"
+          git config --global user.name "Continuwuity"
+
+          rpmdev-setuptree
+
+          cd "$GITHUB_WORKSPACE"
+
+          # Determine release suffix and version based on ref type and branch
+          if [[ "${{ github.ref }}" == "refs/tags/"* ]]; then
+            # Tags get clean version numbers for stable releases
+            RELEASE_SUFFIX=""
+            TAG_NAME="${{ github.ref_name }}"
+            # Extract version from tag (remove v prefix if present)
+            TAG_VERSION=$(echo "$TAG_NAME" | sed 's/^v//' | tr '-' '~')
+
+            # Create spec file with tag version
+            sed -e "s/^Version:.*$/Version:        $TAG_VERSION/" \
+                -e "s/^Release:.*$/Release:        1%{?dist}/" \
+                pkg/fedora/continuwuity.spec.rpkg > continuwuity.spec.rpkg
+          elif [ "${{ github.ref_name }}" = "main" ]; then
+            # Main branch gets .dev suffix
+            RELEASE_SUFFIX=".dev"
+
+            # Replace the Release line to include our suffix
+            sed "s/^Release:.*$/Release:        1${RELEASE_SUFFIX}%{?dist}/" \
+              pkg/fedora/continuwuity.spec.rpkg > continuwuity.spec.rpkg
+          else
+            # Other branches get sanitized branch name as suffix
+            SAFE_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[^a-zA-Z0-9]/_/g' | cut -c1-20)
+            RELEASE_SUFFIX=".${SAFE_BRANCH}"
+
+            # Replace the Release line to include our suffix
+            sed "s/^Release:.*$/Release:        1${RELEASE_SUFFIX}%{?dist}/" \
+              pkg/fedora/continuwuity.spec.rpkg > continuwuity.spec.rpkg
+          fi
+
+          rpkg srpm --outdir "$HOME/rpmbuild/SRPMS"
+
+          ls -la $HOME/rpmbuild/SRPMS/
+
+
+      - name: Install build dependencies from SRPM
+        run: |
+          SRPM=$(find "$HOME/rpmbuild/SRPMS" -name "*.src.rpm" | head -1)
+
+          if [ -z "$SRPM" ]; then
+            echo "Error: No SRPM file found"
+            exit 1
+          fi
+
+          echo "Installing build dependencies from: $(basename $SRPM)"
+          dnf builddep -y "$SRPM"
+
+      - name: Build RPM from SRPM
+        run: |
+          SRPM=$(find "$HOME/rpmbuild/SRPMS" -name "*.src.rpm" | head -1)
+
+          if [ -z "$SRPM" ]; then
+            echo "Error: No SRPM file found"
+            exit 1
+          fi
+
+          echo "Building from SRPM: $SRPM"
+
+          rpmbuild --rebuild "$SRPM" \
+            --define "_topdir $HOME/rpmbuild" \
+            --define "_sourcedir $GITHUB_WORKSPACE" \
+            --nocheck  # Skip %check section to avoid test dependencies
+
+
+      - name: Test RPM installation
+        run: |
+          # Find the main binary RPM (exclude debug and source RPMs)
+          RPM=$(find "$HOME/rpmbuild/RPMS" -name "continuwuity-*.rpm" \
+            ! -name "*debuginfo*" \
+            ! -name "*debugsource*" \
+            ! -name "*.src.rpm" | head -1)
+
+          if [ -z "$RPM" ]; then
+            echo "Error: No binary RPM file found"
+            exit 1
+          fi
+
+          echo "Testing installation of: $RPM"
+
+          # Dry run first
+          rpm -qpi "$RPM"
+          echo ""
+          rpm -qpl "$RPM"
+
+          # Actually install it
+          dnf install -y "$RPM"
+
+          # Verify installation
+          rpm -qa | grep continuwuity
+
+          # Check that the binary exists
+          [ -f /usr/bin/conduwuit ] && echo "✅ Binary installed successfully"
+          [ -f /usr/lib/systemd/system/conduwuit.service ] && echo "✅ Systemd service installed"
+          [ -f /etc/conduwuit/conduwuit.toml ] && echo "✅ Config file installed"
+
+      - name: List built packages
+        run: |
+          echo "Binary RPMs:"
+          find "$HOME/rpmbuild/RPMS" -name "*.rpm" -type f -exec ls -la {} \;
+
+          echo ""
+          echo "Source RPMs:"
+          find "$HOME/rpmbuild/SRPMS" -name "*.rpm" -type f -exec ls -la {} \;
+
+      - name: Collect artifacts
+        run: |
+          mkdir -p artifacts
+
+          find "$HOME/rpmbuild/RPMS" -name "*.rpm" -type f -exec cp {} artifacts/ \;
+          find "$HOME/rpmbuild/SRPMS" -name "*.rpm" -type f -exec cp {} artifacts/ \;
+
+          cd artifacts
+          echo "Build Information:" > BUILD_INFO.txt
+          echo "==================" >> BUILD_INFO.txt
+          echo "Git commit: ${{ github.sha }}" >> BUILD_INFO.txt
+          echo "Git branch: ${{ github.ref_name }}" >> BUILD_INFO.txt
+          echo "Build date: $(date -u +%Y-%m-%d_%H:%M:%S_UTC)" >> BUILD_INFO.txt
+          echo "" >> BUILD_INFO.txt
+          echo "Package contents:" >> BUILD_INFO.txt
+          echo "-----------------" >> BUILD_INFO.txt
+          for rpm in *.rpm; do
+            echo "" >> BUILD_INFO.txt
+            echo "File: $rpm" >> BUILD_INFO.txt
+            rpm -qpi "$rpm" 2>/dev/null | grep -E "^(Name|Version|Release|Architecture|Size)" >> BUILD_INFO.txt
+          done
+
+          ls -la
+
+      - name: Upload binary RPM artifact
+        run: |
+          # Find the main binary RPM (exclude debug and source RPMs)
+          BIN_RPM=$(find artifacts -name "continuwuity-*.rpm" \
+            ! -name "*debuginfo*" \
+            ! -name "*debugsource*" \
+            ! -name "*.src.rpm" \
+            -type f)
+
+          mkdir -p upload-bin
+          cp $BIN_RPM upload-bin/
+
+      - name: Upload binary RPM
+        uses: forgejo/upload-artifact@v4
+        with:
+          name: continuwuity
+          path: upload-bin/
+
+      - name: Upload debug RPM artifact
+        uses: forgejo/upload-artifact@v4
+        with:
+          name: continuwuity-debug
+          path: artifacts/*debuginfo*.rpm
+
+      - name: Publish to RPM Package Registry
+        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
+        run: |
+          # Find the main binary RPM (exclude debug and source RPMs)
+          RPM=$(find artifacts -name "continuwuity-*.rpm" \
+            ! -name "*debuginfo*" \
+            ! -name "*debugsource*" \
+            ! -name "*.src.rpm" \
+            -type f | head -1)
+
+          if [ -z "$RPM" ]; then
+            echo "No binary RPM found to publish"
+            exit 0
+          fi
+
+          RPM_BASENAME=$(basename "$RPM")
+          echo "Publishing: $RPM_BASENAME"
+
+          # Determine the group based on ref type and branch
+          if [[ "${{ github.ref }}" == "refs/tags/"* ]]; then
+            # For tags, extract the tag name for version info
+            TAG_NAME="${{ github.ref_name }}"
+            if [[ "$TAG_NAME" == *"-"* ]]; then
+              GROUP="unstable"
+            else
+              GROUP="stable"
+            fi
+          elif [ "${{ github.ref_name }}" = "main" ]; then
+            GROUP="dev"
+          else
+            # Use sanitized branch name as group for feature branches
+            GROUP=$(echo "${{ github.ref_name }}" | sed 's/[^a-zA-Z0-9]/-/g' | tr '[:upper:]' '[:lower:]' | cut -c1-30)
+          fi
+
+          PACKAGE_INFO=$(rpm -qpi "$RPM" 2>/dev/null)
+          PACKAGE_NAME=$(echo "$PACKAGE_INFO" | grep "^Name" | awk '{print $3}')
+          PACKAGE_VERSION=$(echo "$PACKAGE_INFO" | grep "^Version" | awk '{print $3}')
+          PACKAGE_RELEASE=$(echo "$PACKAGE_INFO" | grep "^Release" | awk '{print $3}')
+          PACKAGE_ARCH=$(echo "$PACKAGE_INFO" | grep "^Architecture" | awk '{print $2}')
+
+          # Full version includes release
+          FULL_VERSION="${PACKAGE_VERSION}-${PACKAGE_RELEASE}"
+
+          # Forgejo's RPM registry cannot overwrite existing packages, so we must delete first
+          # 404 is OK if package doesn't exist yet
+          echo "Removing any existing package: $PACKAGE_NAME-$FULL_VERSION.$PACKAGE_ARCH"
+          RESPONSE=$(curl -s -w "\n%{http_code}" -X DELETE \
+            -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
+            "https://forgejo.ellis.link/api/packages/continuwuation/rpm/$GROUP/package/$PACKAGE_NAME/$FULL_VERSION/$PACKAGE_ARCH")
+          HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
+
+          if [ "$HTTP_CODE" != "204" ] && [ "$HTTP_CODE" != "404" ]; then
+            echo "ERROR: Failed to delete package (HTTP $HTTP_CODE)"
+            echo "$RESPONSE" | head -n -1
+            exit 1
+          fi
+
+          curl --fail-with-body \
+            -X PUT \
+            -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
+            -H "Content-Type: application/x-rpm" \
+            -T "$RPM" \
+            "https://forgejo.ellis.link/api/packages/continuwuation/rpm/$GROUP/upload?sign=true"
+
+          echo ""
+          echo "✅ Published binary RPM to: https://forgejo.ellis.link/continuwuation/-/packages/rpm/continuwuity/"
+          echo "Group: $GROUP"
+
+          # Upload debug RPMs to separate group
+          DEBUG_RPMS=$(find artifacts -name "*debuginfo*.rpm")
+          if [ -n "$DEBUG_RPMS" ]; then
+            echo ""
+            echo "Publishing debug RPMs to group: ${GROUP}-debug"
+
+            for DEBUG_RPM in $DEBUG_RPMS; do
+              echo "Publishing: $(basename "$DEBUG_RPM")"
+
+              DEBUG_INFO=$(rpm -qpi "$DEBUG_RPM" 2>/dev/null)
+              DEBUG_NAME=$(echo "$DEBUG_INFO" | grep "^Name" | awk '{print $3}')
+              DEBUG_VERSION=$(echo "$DEBUG_INFO" | grep "^Version" | awk '{print $3}')
+              DEBUG_RELEASE=$(echo "$DEBUG_INFO" | grep "^Release" | awk '{print $3}')
+              DEBUG_ARCH=$(echo "$DEBUG_INFO" | grep "^Architecture" | awk '{print $2}')
+              DEBUG_FULL_VERSION="${DEBUG_VERSION}-${DEBUG_RELEASE}"
+
+              # Must delete existing package first (Forgejo limitation)
+              RESPONSE=$(curl -s -w "\n%{http_code}" -X DELETE \
+                -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
+                "https://forgejo.ellis.link/api/packages/continuwuation/rpm/${GROUP}-debug/package/$DEBUG_NAME/$DEBUG_FULL_VERSION/$DEBUG_ARCH")
+              HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
+
+              if [ "$HTTP_CODE" != "204" ] && [ "$HTTP_CODE" != "404" ]; then
+                echo "ERROR: Failed to delete debug package (HTTP $HTTP_CODE)"
+                echo "$RESPONSE" | head -n -1
+                exit 1
+              fi
+
+              curl --fail-with-body \
+                -X PUT \
+                -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
+                -H "Content-Type: application/x-rpm" \
+                -T "$DEBUG_RPM" \
+                "https://forgejo.ellis.link/api/packages/continuwuation/rpm/${GROUP}-debug/upload?sign=true"
+            done
+
+            echo "✅ Published debug RPMs to group: ${GROUP}-debug"
+          fi
+
+          # Also upload the SRPM to separate group
+          SRPM=$(find artifacts -name "*.src.rpm" | head -1)
+          if [ -n "$SRPM" ]; then
+            echo ""
+            echo "Publishing source RPM: $(basename "$SRPM")"
+            echo "Publishing to group: ${GROUP}-src"
+
+            SRPM_INFO=$(rpm -qpi "$SRPM" 2>/dev/null)
+            SRPM_NAME=$(echo "$SRPM_INFO" | grep "^Name" | awk '{print $3}')
+            SRPM_VERSION=$(echo "$SRPM_INFO" | grep "^Version" | awk '{print $3}')
+            SRPM_RELEASE=$(echo "$SRPM_INFO" | grep "^Release" | awk '{print $3}')
+            SRPM_FULL_VERSION="${SRPM_VERSION}-${SRPM_RELEASE}"
+
+            # Must delete existing SRPM first (Forgejo limitation)
+            echo "Removing any existing SRPM: $SRPM_NAME-$SRPM_FULL_VERSION.src"
+            RESPONSE=$(curl -s -w "\n%{http_code}" -X DELETE \
+              -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
+              "https://forgejo.ellis.link/api/packages/continuwuation/rpm/${GROUP}-src/package/$SRPM_NAME/$SRPM_FULL_VERSION/src")
+            HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
+
+            if [ "$HTTP_CODE" != "204" ] && [ "$HTTP_CODE" != "404" ]; then
+              echo "ERROR: Failed to delete SRPM (HTTP $HTTP_CODE)"
+              echo "$RESPONSE" | head -n -1
+              exit 1
+            fi
+
+            curl --fail-with-body \
+              -X PUT \
+              -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
+              -H "Content-Type: application/x-rpm" \
+              -T "$SRPM" \
+              "https://forgejo.ellis.link/api/packages/continuwuation/rpm/${GROUP}-src/upload?sign=true"
+
+            echo "✅ Published source RPM to group: ${GROUP}-src"
+          fi
@@ -32,12 +32,12 @@ jobs:

      - name: Setup Node.js
        if: steps.runner-env.outputs.node_major == '' || steps.runner-env.outputs.node_major < '20'
-        uses: https://github.com/actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: https://github.com/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22

      - name: Cache npm dependencies
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ~/.npm
          key: continuwuity-rspress-${{ steps.runner-env.outputs.slug }}-${{ steps.runner-env.outputs.arch }}-node-${{ steps.runner-env.outputs.node_version }}-${{ hashFiles('package-lock.json') }}
@@ -24,7 +24,7 @@ jobs:

    steps:
      - name: 📦 Setup Node.js
-        uses: https://github.com/actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: https://github.com/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: "22"

@@ -55,7 +55,7 @@ jobs:
      #     repositories: continuwuity

      - name: Install regsync
-        uses: https://github.com/regclient/actions/regsync-installer@39bf30ced4be9d147faaabbde2682e9725fb8bd1 # main
+        uses: https://github.com/regclient/actions/regsync-installer@4b4db1dcc7dad75ad67a788a380f75a20cc8a040 # main

      - name: Check what images need mirroring
        run: |
@@ -53,7 +53,7 @@ jobs:
          persist-credentials: false

      - name: Check for file changes
-        uses: https://github.com/dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4
+        uses: https://github.com/dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
        id: filter
        with:
          filters: |
@@ -62,7 +62,7 @@ jobs:
          registry_password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
      - name: Build and push Docker image by digest
        id: build
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
        with:
          context: .
          file: "docker/Dockerfile"
@@ -74,7 +74,6 @@ jobs:
            CARGO_INCREMENTAL=${{ env.BUILDKIT_ENDPOINT != '' && '1' || '0' }}
            TARGET_CPU=
            RUST_PROFILE=release
-            CARGO_FEATURES=default
          platforms: ${{ matrix.platform }}
          labels: ${{ steps.prepare.outputs.metadata_labels }}
          annotations: ${{ steps.prepare.outputs.metadata_annotations }}
@@ -150,7 +149,7 @@ jobs:
          registry_password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
      - name: Build and push max-perf Docker image by digest
        id: build
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
        with:
          context: .
          file: "docker/Dockerfile"
@@ -162,7 +161,6 @@ jobs:
            CARGO_INCREMENTAL=${{ env.BUILDKIT_ENDPOINT != '' && '1' || '0' }}
            TARGET_CPU=${{ matrix.target_cpu }}
            RUST_PROFILE=release-max-perf
-            CARGO_FEATURES=default,release_max_log_level
          platforms: ${{ matrix.platform }}
          labels: ${{ steps.prepare.outputs.metadata_labels }}
          annotations: ${{ steps.prepare.outputs.metadata_annotations }}
@@ -43,7 +43,7 @@ jobs:
    name: Renovate
    runs-on: ubuntu-latest
    container:
-      image: ghcr.io/renovatebot/renovate:43.260.2@sha256:60d830108d9ff6408d11a55d5f110ee0976bed78a6b82b08211e3ddb72f72952
+      image: ghcr.io/renovatebot/renovate:43.246.1@sha256:5965c08f8ca5baff8dc9bf3a32c44ca71fef843ad94880e9696d46e1d722b0fa
      options: --tmpfs /tmp:exec
    steps:
      - name: Checkout
@@ -55,7 +55,7 @@ jobs:
        run: /usr/local/renovate/node -e 'console.log(`node heap limit = ${require("v8").getHeapStatistics().heap_size_limit / (1024 * 1024)} Mb`)'

      - name: Restore renovate repo cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: |
            /tmp/renovate/cache/renovate/repository
@@ -64,7 +64,7 @@ jobs:
            renovate-repo-cache-

      - name: Restore renovate package cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: |
            /tmp/renovate/cache/renovate/renovate-cache-sqlite
@@ -73,7 +73,7 @@ jobs:
            renovate-package-cache-

      - name: Restore renovate OSV cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: |
            /tmp/osv
@@ -117,7 +117,7 @@ jobs:

      - name: Save renovate package cache
        if: always()
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: |
            /tmp/renovate/cache/renovate/renovate-cache-sqlite
@@ -125,7 +125,7 @@ jobs:

      - name: Save renovate OSV cache
        if: always()
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: |
            /tmp/osv
@@ -24,7 +24,7 @@ repos:
        - id: check-added-large-files

  - repo: https://github.com/crate-ci/typos
-    rev: v1.48.0
+    rev: v1.47.2
    hooks:
      - id: typos
      - id: typos
@@ -57,15 +57,3 @@ repos:
        types: [rust]
        stages:
          - pre-push
-
-  - repo: local
-    hooks:
-      - id: docs-build
-        name: docs build
-        entry: npm run docs:build
-        language: system
-        pass_filenames: false
-        files: docs/
-        types: [mdx]
-        stages:
-          - pre-commit
@@ -1,93 +1,3 @@
-# Continuwuity 26.6.2 (2026-07-12)
-
-## Bugfixes
-
- Fixed the server returning 500 errors if `admin_console_automatic` is enabled and no TTY is available. Contributed by @s1lv3r. (#1975)
- Fixed `global.oauth.compatibility_mode` being required, despite being ignored, when the `[global.oauth.oidc]` config section is provided.
- Fixed an issue with a migration that could cause user accounts imported from an identity provider to be marked as deactivated when the server started. If you have accounts affected by this issue, use `!admin users reset-password --convert-to-local-account` to reactivate them.
-
-
-# Continuwuity 26.6.1 (2026-07-12)
-
-## Features
-
- Added enforcement for new federated invite checks and corrected a bunch of related spec compliance issues along the way. Contributed by @nex. (#1952)
-
-## Bugfixes
-
- Fixed existing accounts failing to link when logging in with OIDC if `prompt_for_localpart` was `false`. (#1942)
- Authentication is no longer required on the `/_matrix/client/v3/account/3pid/email/requestToken` endpoint. (#1953)
- Fixed newly created rooms failing to sync properly in clients using legacy sync.
- Stopped appservice users from being erroneously marked as deactivated during a 26.6 database migration.
- Whitespace will now automatically be trimmed from the start and end of the `global.oauth.oidc.client_secret_file`.
-
-
-# Continuwuity 26.6.0 (2026-07-10)
-
-## Features
-
- Added support for linking an external identity provider with OIDC. Contributed by @ginger. (#765)
- Updated [MSC4284: Policy Servers](https://github.com/matrix-org/matrix-spec-proposals/pull/4284) implementation to support the newly stabilised proposal. Contributed by @nex. (#1487)
- Added config option for default room ACLs. Contributed by @eve. (#1691)
- Added support for fallback encryption keys. (#1710)
- Add `!admin users reject-all-invites` to clean invite spam (#1741)
- Implemented event rejection, which should resolve and prevent future netsplits of the kinds observed
-  within some Continuwuity rooms.
-  Also resolved several bugs related to both soft-failing events, and event backfilling, which should
-  improve state resolution stability.
-  The `!admin debug get-pdu` command was updated to disambiguate event acceptance status, and
-  `!admin debug show-auth-chain` was added to visually display event auth chains, which may assist
-  developers in debugging strangely complex events.
-
-  Contributed by @nex. (#1747)
- Added full support for [MSC4168: Update `m.space.*` state on room upgrade](https://github.com/matrix-org/matrix-spec-proposals/pull/4168). Contributed by @nex. (#1807)
- Improved the performance and reliability of fetching missing events, improving network partition recovery. Contributed
-  by @nex. (#1818)
- Added static builds using Nix, allowing for Continuwuity on musl. During this, we also introduced a `max-perf-haswell` package, separating it from `max-perf`, so you may want to swap to this if you are on NixOS. Contributed by @Henry-Hiles (QuadRadical). (#1853)
- Added support for MSC4380 invite blocking, which has become part of the Matrix specification in v1.18. Contributed by @nex. (#1875)
- Added `!admin debug get-state-at` command (#1877)
- Added a configuration option to allow choosing a client IP source that is not the TCP connecting IP. Contributed by @nex. (#1931)
- Added support for MSC4466, which allows clients to customize how changes to a user's global profile are propagated. Contributed by @ginger.
- Added support for Matrix 1.16's `state_after` feature, allowing clients which understand it to sync room state changes more reliably. Contributed by @ginger.
- Added support for authenticating clients using the new OAuth 2.0 login API. Contributed by @ginger.
- Appservice device management as outlined in MSC4190 (part of Matrix 1.17) is now fully supported. Contributed by @ginger.
- Users may now be forbidden from deactivating their own accounts with the new `allow_deactivation` config option. Contributed by @ginger.
-
-## Bugfixes
-
- Adjusted legacy sync logic to allow the `roomsynctoken_shortstatehash` database column to be dropped, massively reducing database sizes, especially for old deployments. Contributed by @ginger. (#917)
- Fixed a bug that caused the server to drop events during processing if several events for the same room were sent in a singular transaction. Contributed by @nex. (#1711)
- fix `!admin query account-data account-data-get` not returning the content (#1742)
- Fixed an issue where Continuwuity would only advertise support for the unstable endpoint for Mutual Rooms (MSC2666), despite only supporting the stable endpoint. Contributed by @Henry-Hiles (QuadRadical) (#1752)
- Fixed admin commands being ignored when they had leading whitespace before admin commands. Contributed by @kitvonsnookerz. (#1804)
- Fixed several bugs in the `POST /_matrix/client/v3/rooms/{roomId}/upgrade` endpoint. Contributed by @nex. (#1807)
- Devices which set their presence as "offline" will no longer be considered for presence updates. Contributed by @timedout.
- Improved invite and join reliability in clients using legacy sync. Contributed by @ginger
- The invite recipient's membership event is now included in invite stripped state, which should fix flaky invite display in some clients. Contributed by @ginger
-
-## Improved Documentation
-
- Add performance tuning documentation. Contributed by @stratself. (#1498)
- Explain accessing Continuwuity's server console when deployed via Docker. (#1671)
- Clarified in the config that `max_request_size` affects federated media as well. (#1706)
- Added example configuration using caddy-docker-proxy in the livekit setup section of the docs. Contributed by @Cease (#1762)
- Updated deployment docs to account for new RPM package availability across more distros. Contributed by @julian45. (#1912)
-
-## Deprecations and Removals
-
- Removed support for LDAP. (#1701)
- Removed support for guest user registration, a little-used and deprecated approach to room previews.
- Removed the `/_conduwuit/` versions of the `local_user_count` and `version` routes. These routes are still accessible under the `/_continuwuity` prefix.
- Support for server-side blurhashing (part of MSC2448) has been removed.
- The deprecated `well_known.rtc_focus_server_urls` config option has been removed. MatrixRTC foci should be configured using the `matrix_rtc.foci` config option.
-
-## Misc
-
- #1505, #1829, #1927, #1933, #1934
- Switched from Continuwuity's fork of Ruma back to upstream Ruma. Contributed by @ginger.
- The version of Debian that the Docker-based build process uses has been upgraded from Bookworm to Trixie, meaning that standalone binaries now have a minimum glibc of 2.41, and can no longer be used on distro versions from before 2025-01-30
-
-
 # Continuwuity 0.5.8 (2026-04-24)

 ## Features
@@ -12,7 +12,7 @@ license = "Apache-2.0"
 # See also `rust-toolchain.toml`
 readme = "README.md"
 repository = "https://forgejo.ellis.link/continuwuation/continuwuity"
-version = "26.6.2"
+version = "26.6.0-alpha.1"

 [workspace.metadata.crane]
 name = "conduwuit"
@@ -45,7 +45,7 @@ version = "1.0.6"
 version = "1.0.0"

 [workspace.dependencies.cargo_toml]
-version = "1.0"
+version = "0.22"
 default-features = false
 features = ["features"]

@@ -164,7 +164,7 @@ features = ["raw_value"]

 # Used for appservice registration files
 [workspace.dependencies.serde-saphyr]
-version = "0.0.29"
+version = "0.0.28"

 # Used to load forbidden room/user regex from config
 [workspace.dependencies.serde_regex]
@@ -344,7 +344,7 @@ version = "1.1.1"
 [workspace.dependencies.ruma]
 # version = "0.14.1"
 git = "https://github.com/ruma/ruma.git"
-rev = "9b6a2e7323649af926e4b5363d87239ee4247f4a"
+rev = "3ecd80b92794d2d93f657a7b3db62d4be237526b"
 features = [
    "appservice-api-c",
    "client-api",
@@ -356,7 +356,6 @@ features = [
    "ring-compat",
    "compat-upload-signatures",
    "compat-optional-txn-pdus",
-    "compat-get-3pids",
    "unstable-msc2666",
    "unstable-msc2867",
    "unstable-msc2870",
@@ -403,9 +402,6 @@ default-features = false
 version = "0.11.0"
 default-features = false

-[workspace.dependencies.openidconnect]
-version = "4.0.1"
-
 # optional opentelemetry, performance measurements, flamegraphs, etc for performance measurements and monitoring
 [workspace.dependencies.opentelemetry]
 version = "0.32.0"
@@ -496,7 +492,7 @@ version = "0.4.9"
 default-features = false

 [workspace.dependencies.termimad]
-version = "0.35.0"
+version = "0.34.0"
 default-features = false

 [workspace.dependencies.checked_ops]
@@ -563,9 +559,6 @@ features = ["std"]
 [workspace.dependencies.nonzero_ext]
 version = "0.3.0"

-[workspace.dependencies.resolvematrix]
-version = "1.2.0"
-
 [workspace.dependencies.serde_urlencoded]
 version = "0.7.1"

@@ -0,0 +1 @@
+Appservice device management as outlined in MSC4190 (part of Matrix 1.17) is now fully supported. Contributed by @ginger.
@@ -1 +0,0 @@
-Appservices are now properly able to create devices for E2EE.
@@ -0,0 +1 @@
+The invite recipient's membership event is now included in invite stripped state, which should fix flaky invite display in some clients. Contributed by @ginger
@@ -0,0 +1 @@
+Switched from Continuwuity's fork of Ruma back to upstream Ruma. Contributed by @ginger.
@@ -0,0 +1 @@
+Users may now be forbidden from deactivating their own accounts with the new `allow_deactivation` config option. Contributed by @ginger.
@@ -0,0 +1 @@
+Added support for Matrix 1.16's `state_after` feature, allowing clients which understand it to sync room state changes more reliably. Contributed by @ginger.
@@ -1 +0,0 @@
-Fixed newly created rooms failing to sync properly in clients using legacy sync.
@@ -0,0 +1 @@
+Added support for authenticating clients using the new OAuth 2.0 login API. Contributed by @ginger.
@@ -0,0 +1 @@
+Added support for MSC4466, which allows clients to customize how changes to a user's global profile are propagated. Contributed by @ginger.
@@ -0,0 +1 @@
+Devices which set their presence as "offline" will no longer be considered for presence updates. Contributed by @timedout.
@@ -0,0 +1 @@
+Removed support for guest user registration, a little-used and deprecated approach to room previews.
@@ -0,0 +1 @@
+The deprecated `well_known.rtc_focus_server_urls` config option has been removed. MatrixRTC foci should be configured using the `matrix_rtc.foci` config option.
@@ -1 +0,0 @@
-Appservices may now specify both the unstable and stable `device_id` query parameters in a request. The stable parameter will take priority. Contributed by @ginger.
@@ -0,0 +1 @@
+The version of Debian that the Docker-based build process uses has been upgraded from Bookworm to Trixie, meaning that standalone binaries now have a minimum glibc of 2.41, and can no longer be used on distro versions from before 2025-01-30
@@ -0,0 +1 @@
+Support for server-side blurhashing (part of MSC2448) has been removed.
@@ -0,0 +1 @@
+Updated [MSC4284: Policy Servers](https://github.com/matrix-org/matrix-spec-proposals/pull/4284) implementation to support the newly stabilised proposal. Contributed by @nex.
@@ -0,0 +1 @@
+Add performance tuning documentation. Contributed by @stratself.
@@ -0,0 +1 @@
+Explain accessing Continuwuity's server console when deployed via Docker.
@@ -0,0 +1 @@
+Added config option for default room ACLs. Contributed by @eve.
@@ -0,0 +1 @@
+Removed support for LDAP.
@@ -0,0 +1 @@
+Clarified in the config that `max_request_size` affects federated media as well.
@@ -0,0 +1 @@
+Added support for fallback encryption keys.
@@ -0,0 +1 @@
+Fixed a bug that caused the server to drop events during processing if several events for the same room were sent in a singular transaction. Contributed by @nex.
@@ -0,0 +1 @@
+Add `!admin users reject-all-invites` to clean invite spam
@@ -0,0 +1 @@
+fix `!admin query account-data account-data-get` not returning the content
@@ -0,0 +1,9 @@
+Implemented event rejection, which should resolve and prevent future netsplits of the kinds observed
+within some Continuwuity rooms.
+Also resolved several bugs related to both soft-failing events, and event backfilling, which should
+improve state resolution stability.
+The `!admin debug get-pdu` command was updated to disambiguate event acceptance status, and
+`!admin debug show-auth-chain` was added to visually display event auth chains, which may assist
+developers in debugging strangely complex events.
+
+Contributed by @nex.
@@ -0,0 +1 @@
+Fixed an issue where Continuwuity would only advertise support for the unstable endpoint for Mutual Rooms (MSC2666), despite only supporting the stable endpoint. Contributed by @Henry-Hiles (QuadRadical)
@@ -0,0 +1 @@
+Added example configuration using caddy-docker-proxy in the livekit setup section of the docs. Contributed by @Cease
@@ -0,0 +1 @@
+Fixed admin commands being ignored when they had leading whitespace before admin commands. Contributed by @kitvonsnookerz.
@@ -0,0 +1 @@
+Fixed several bugs in the `POST /_matrix/client/v3/rooms/{roomId}/upgrade` endpoint. Contributed by @nex.
@@ -0,0 +1 @@
+Added full support for [MSC4168: Update `m.space.*` state on room upgrade](https://github.com/matrix-org/matrix-spec-proposals/pull/4168). Contributed by @nex.
@@ -0,0 +1 @@
+Remove support for MSC4373, as the MSC is now closed. Contributed by @vel.
@@ -0,0 +1 @@
+Added static builds using Nix, allowing for Continuwuity on musl. During this, we also introduced a `max-perf-haswell` package, separating it from `max-perf`, so you may want to swap to this if you are on NixOS. Contributed by @Henry-Hiles (QuadRadical).
@@ -0,0 +1 @@
+Added support for MSC4380 invite blocking, which has become part of the Matrix specification in v1.18. Contributed by @nex.
@@ -0,0 +1 @@
+Added `!admin debug get-state-at` command
@@ -1 +0,0 @@
-Fixed the deeplink redirect for deleting devices. Contributed by @koen
@@ -0,0 +1 @@
+Adjusted legacy sync logic to no longer use the `roomsynctoken_shortstatehash` database column. Once this change has been confirmed to be stable and reliable, a future update will remove it entirely, significantly decreasing database sizes. Contributed by @ginger.
@@ -290,27 +290,6 @@
 #
 #ip_lookup_strategy = 5

-# The source to use for discovering the real connecting client IP.
-#
-# Takes any of the following options:
-#
-# "cf_connecting_ip" - `Cf-Connecting-Ip` header
-# "cloudfront_viewer_address" - `CloudFront-Viewer-Address` header
-# "fly_client_ip" - `Fly-Client-IP` header
-# "x_forwarded_for" - rightmost value of the `X-Forwarded-For` header
-# "true_client_ip" - `True-Client-Ip` header
-# "x_envoy_external_address" - `X-Envoy-External-Address` header
-# "x_real_ip" - `X-Real-Ip` header
-#
-# Only set this if you are certain only your reverse proxy
-# will send the expected header. There is no "is the connecting IP allowed
-# to set this header" check; if the header selected is present, it is
-# used.
-#
-# Defaults to the IP address actually making the connection.
-#
-#request_ip_source = false
-
 # Max request size for file uploads in bytes. Defaults to 20MB.
 # Also limits incoming federated media.
 #
@@ -318,7 +297,7 @@

 # This item is undocumented. Please contribute documentation for it.
 #
-#max_fetch_prev_events = 1024
+#max_fetch_prev_events = 192

 # How many incoming federation transactions the server is willing to be
 # processing at any given time before it becomes overloaded and starts
@@ -664,14 +643,6 @@
 #
 #default_room_acl_deny =

-# The number of forward extremities to tolerate in a room before
-# attempting to manually squash them with a "dummy event". Setting this
-# above 20 will hinder its efficacy, and setting it below 5 will cause
-# more dummy events to be sent than necessary (which increases federation
-# traffic).
-#
-#dummy_event_threshold = 10
-
 # Enable OpenTelemetry OTLP tracing export. This replaces the deprecated
 # Jaeger exporter. Traces will be sent via OTLP to a collector (such as
 # Jaeger) that supports the OpenTelemetry Protocol.
@@ -1455,11 +1426,6 @@
 #
 #send_messages_from_ignored_users_to_client = false

-# Send "org.matrix.dummy_event" events to the client. This is a debugging
-# option.
-#
-#send_dummy_events_to_clients = false
-
 # Vector list of IPv4 and IPv6 CIDR ranges / subnets *in quotes* that you
 # do not want continuwuity to send outbound requests to. Defaults to
 # RFC1918, unroutable, loopback, multicast, and testnet addresses for
@@ -2049,96 +2015,3 @@
 #   legacy authentication will be unable to log in.
 #
 #compatibility_mode = "hybrid"
-
-#[global.oauth.oidc]
-# Uncommenting this section will enable Continuwuity's support for
-# authenticating users using an OpenID Connect-compatible identity provider.
-# This is referred to as "delegated authentication".
-#
-# IMPORTANT NOTE: When delegated authentication is active, Continuwuity will behave as if
-# the `global.oauth.compatibility_mode` setting is set to `exclusive`.
-# Matrix clients which do not support OAuth login (also referred to as "next-gen auth") will NOT be able
-# to log in while delegated authentication is active.
-
-
-# The OIDC issuer URL. Continuwuity will use OpenID Connect Discovery to
-# automatically fetch the identity provider's metadata from this URL.
-# Generally you should set this to the base domain your identity provider
-# runs on.
-#
-#discovery_url =
-
-# The OAuth client ID for Continuwuity to use when communicating with the
-# identity provider.
-#
-#client_id =
-
-# The OAuth client secret for Continuwuity to use when communicating with
-# the identity provider.
-#
-#client_secret =
-
-# A path to a file which Continuwuity will read the client secret from.
-# If this option is set, it will override `client_secret`.
-#
-# The server will fail to start if the file cannot be read.
-#
-#client_secret_file =
-
-# Additional scopes Continuwuity should request from the IDP. This may be
-# necessary to access certain claims. Continuwuity always requests the
-# `openid` scope.
-#
-#additional_scopes = []
-
-# Whether the user should be prompted to choose a localpart
-# when signing in for the first time. If this is `false`, Continuwuity
-# will attempt to use the value of the `preferred_username_claim`
-# (see below) as the user's localpart. Authentication will
-# fail if this claim is missing or is not a valid localpart.
-#
-#prompt_for_localpart = true
-
-# The claim to use for the user's localpart, if `prompt_for_localpart` is
-# false.
-#
-#preferred_username_claim = "preferred_username"
-
-# The claim which will be used to set the user's email address,
-# either on initial registration or on every login depending on
-# the value of `profile_key_import_mode`. Continuwuity assumes that
-# the IDP has taken care of verifying that the user controls the email
-# address it provides.
-#
-# This option does nothing if SMTP is not configured.
-#
-# If this option is set, and `profile_key_import_mode` is `on_login`,
-# users will not be able to change their email addresses themselves.
-#
-#email_claim = "email"
-
-# Defines how claims returned from the IDP should be mapped to a user's
-# profile data. The profile field named in each key will be set from the
-# claim named in the corresponding value when the user first registers,
-# and possibly on subsequent logins as well, depending on the value of
-# `profile_key_import_mode` (see below).
-#
-# Per-room overrides to the user's display name or avatar will be
-# preserved by the import process.
-#
-# SECURITY NOTE: If the `avatar_url` field is set, Continuwuity will
-# perform a HTTP GET to the URL in the mapped claim and use the returned
-# file as the user's profile picture. Make sure your users are not able
-# to set the value of the mapped claim to an arbitrary URL.
-#
-#profile_key_map = { displayname = "name" }
-
-# When profile keys should be imported from the IDP's claims.
-#
-# - "on_registration": Listed keys will be imported once, when the user
-#   logs in for the first time and their shadow account is created.
-# - "on_login": Listed keys will be imported every time the user logs in.
-#   Additionally, users will not be able to manually edit any listed keys
-#   through their Matrix client.
-#
-#profile_key_import_mode = "on_registration"
@@ -171,7 +171,6 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/usr/local/cargo/git/db \
    --mount=type=cache,target=/app/target,id=continuwuity-cargo-target-${TARGET_CPU}-${TARGETPLATFORM}-${RUST_PROFILE} \
    bash <<'EOF'
-    set -euo pipefail
    set -o allexport
    set -o xtrace
    . /etc/environment
@@ -192,7 +191,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
            jq -r ".target_directory"))
    mkdir /out/sbin
    PACKAGE=conduwuit
-    CARGO_LOG=debug xx-cargo build --locked --profile ${RUST_PROFILE} \
+    xx-cargo build --locked --profile ${RUST_PROFILE} \
        --no-default-features --features ${CARGO_FEATURES} \
        -p $PACKAGE;
    BINARIES=($(cargo metadata --no-deps --format-version 1 | \
@@ -208,7 +207,6 @@ EOF
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/usr/local/cargo/git/db \
    bash <<'EOF'
-    set -euo pipefail
    set -o xtrace
    mkdir /out/sbom
    typeset -A PACKAGES
@@ -36,8 +36,8 @@
    },
    {
        "type": "dir",
-        "name": "guides",
-        "label": "Guides"
+        "name": "advanced",
+        "label": "Advanced"
    },
    "security",
    {
@@ -1,8 +1,8 @@
 [
    {
-        "text": "Documentation",
+        "text": "Guide",
        "link": "/introduction",
-        "activeMatch": "^/(introduction|configuration|deploying|calls|appservices|maintenance|troubleshooting|guides)"
+        "activeMatch": "^/(introduction|configuration|deploying|calls|appservices|maintenance|troubleshooting|advanced)"
    },
    {
        "text": "Development",
@@ -13,10 +13,6 @@
        "type": "file",
        "name": "performance",
        "label": "Performance tuning"
-    },
-    {
-        "type": "file",
-        "name": "oidc",
-        "label": "Delegated authentication"
    }
+
 ]
@@ -124,11 +124,7 @@ ## Reverse proxying well-known files to Continuwuity

 ### Serving well-known files manually

-Instead of reverse proxying well-known URIs, you can serve these files directly as static JSON that match the ones above. This is useful if your base domain points to a different physical server, and reverse proxying isn't feasible.
-
-:::warning
-Even if you choose to serve the well-known files manually, if you are using delegation at all, you **must** still set the `global.well_known.client` configuration option to the domain you're delegating to. Continuwuity needs to know the domain it runs on for OAuth-compatible clients to work correctly.
-:::
+Instead of configuring `[global.well_known]` options and reverse proxying well-known URIs, you can serve these files directly as static JSON that match the ones above. This is useful if your base domain points to a different physical server, and reverse proxying isn't feasible.

 <details>

@@ -156,17 +152,6 @@ ### Serving well-known files manually

 </details>

-<details>
-
-<summary>Accompanying Continuwuity configuration</summary>
-
-```toml
-[global.well_known]
-client = "https://matrix.example.com/"
-```
-
-</details>
-
 Remember to set the `Access-Control-Allow-Origin: *` header in your `/.well-known/matrix/client` path for web clients to work.

 ## Troubleshooting
@@ -16,8 +16,8 @@
    },
    {
        "type": "file",
-        "name": "rpm",
-        "label": "RPM"
+        "name": "fedora",
+        "label": "Fedora"
    },
    {
        "type": "file",
@@ -44,7 +44,7 @@ ### Prerequisites
    - Alternatively, if you want both client and federation traffic on `:443`, you can configure `CONTINUWUITY_WELL_KNOWN` following some of the [examples](#choose-your-reverse-proxy) below.

 :::tip Split-domain setups
-For more setups with `.well-known` delegation and split-domain deployments, consult the [Delegation/Split-domain](../guides/delegation) page.
+For more setups with `.well-known` delegation and split-domain deployments, consult the [Delegation/Split-domain](../advanced/delegation) page.
 :::

 ## Docker Compose
@@ -79,7 +79,7 @@ ### Choose Your Reverse Proxy
 nameserver 1.1.1.1
 ```

-Consult the [**DNS tuning guide (recommended)**](../guides/dns.mdx) for full solutions to this issue.
+Consult the [**DNS tuning guide (recommended)**](../advanced/dns.mdx) for full solutions to this issue.
 :::

 #### Caddy (using Caddyfile)
@@ -269,7 +269,7 @@ ### Accessing the Server's Console

 ## Next steps

- For smooth federation, set up a caching resolver according to the [**DNS tuning guide**](../guides/dns.mdx) (recommended)
+- For smooth federation, set up a caching resolver according to the [**DNS tuning guide**](../advanced/dns.mdx) (recommended)
 - To set up Audio/Video communication, see the [**Calls**](../calls.mdx) page.
 - Consult the [Maintenance](../maintenance.mdx) page for guidance on maintaining your homeserver.
 - If you want to set up an appservice, take a look at the [**Appservice Guide**](../appservices.mdx).
@@ -0,0 +1,189 @@
+# RPM Installation Guide
+
+Continuwuity is available as RPM packages for Fedora and compatible distributions.
+We do not currently have infrastructure to build RPMs for RHEL and compatible distributions, but this is a work in progress.
+
+The RPM packaging files are maintained in the `fedora/` directory:
+- `continuwuity.spec.rpkg` - RPM spec file using rpkg macros for building from git
+- `continuwuity.service` - Systemd service file for the server
+- `RPM-GPG-KEY-continuwuity.asc` - GPG public key for verifying signed packages
+
+RPM packages built by CI are signed with our GPG key (RSA, ID: `6595 E8DB 9191 D39A 46D6 A514 4BA7 F590 DF0B AA1D`). # spellchecker:disable-line
+
+```bash
+# Import the signing key
+sudo rpm --import https://forgejo.ellis.link/api/packages/continuwuation/rpm/repository.key
+
+# Verify a downloaded package
+rpm --checksig continuwuity-*.rpm
+```
+
+## Installation methods
+
+**Stable releases** (recommended)
+
+```bash
+# Add the repository and install
+sudo dnf config-manager addrepo --from-repofile=https://forgejo.ellis.link/api/packages/continuwuation/rpm/stable.repo
+sudo dnf install continuwuity
+```
+
+**Development builds** from main branch
+
+```bash
+# Add the dev repository and install
+sudo dnf config-manager addrepo --from-repofile=https://forgejo.ellis.link/api/packages/continuwuation/rpm/dev.repo
+sudo dnf install continuwuity
+```
+
+**Feature branch builds** (example: `tom/new-feature`)
+
+```bash
+# Branch names are sanitized (slashes become hyphens, lowercase only)
+sudo dnf config-manager addrepo --from-repofile=https://forgejo.ellis.link/api/packages/continuwuation/rpm/tom-new-feature.repo
+sudo dnf install continuwuity
+```
+
+**Manual repository configuration** (alternative method)
+
+```bash
+cat << 'EOF' | sudo tee /etc/yum.repos.d/continuwuity.repo
+[continuwuity]
+name=Continuwuity - Matrix homeserver
+baseurl=https://forgejo.ellis.link/api/packages/continuwuation/rpm/stable
+enabled=1
+gpgcheck=1
+gpgkey=https://forgejo.ellis.link/api/packages/continuwuation/rpm/repository.key
+EOF
+
+sudo dnf install continuwuity
+```
+
+## Package management
+
+**Automatic updates** with DNF Automatic
+
+```bash
+# Install and configure
+sudo dnf install dnf-automatic
+sudo nano /etc/dnf/automatic.conf  # Set: apply_updates = yes
+sudo systemctl enable --now dnf-automatic.timer
+```
+
+**Manual updates**
+
+```bash
+# Check for updates
+sudo dnf check-update continuwuity
+
+# Update to latest version
+sudo dnf update continuwuity
+```
+
+**Switching channels** (stable/dev/feature branches)
+
+```bash
+# List enabled repositories
+dnf repolist | grep continuwuation
+
+# Disable current repository
+sudo dnf config-manager --set-disabled continuwuation-stable  # or -dev, or branch name
+
+# Enable desired repository
+sudo dnf config-manager --set-enabled continuwuation-dev  # or -stable, or branch name
+
+# Update to the new channel's version
+sudo dnf update continuwuity
+```
+
+**Verifying installation**
+
+```bash
+# Check installed version
+rpm -q continuwuity
+
+# View package information
+rpm -qi continuwuity
+
+# List installed files
+rpm -ql continuwuity
+
+# Verify package integrity
+rpm -V continuwuity
+```
+
+## Service management and removal
+
+**Systemd service commands**
+
+```bash
+# Start the service
+sudo systemctl start conduwuit
+
+# Enable on boot
+sudo systemctl enable conduwuit
+
+# Check status
+sudo systemctl status conduwuit
+
+# View logs
+sudo journalctl -u conduwuit -f
+```
+
+**Uninstallation**
+
+```bash
+# Stop and disable the service
+sudo systemctl stop conduwuit
+sudo systemctl disable conduwuit
+
+# Remove the package
+sudo dnf remove continuwuity
+
+# Remove the repository (optional)
+sudo rm /etc/yum.repos.d/continuwuation-*.repo
+```
+
+## Troubleshooting
+
+**GPG key errors**: Temporarily disable GPG checking
+
+```bash
+sudo dnf --nogpgcheck install continuwuity
+```
+
+**Repository metadata issues**: Clear and rebuild cache
+
+```bash
+sudo dnf clean all
+sudo dnf makecache
+```
+
+**Finding specific versions**
+
+```bash
+# List all available versions
+dnf --showduplicates list continuwuity
+
+# Install a specific version
+sudo dnf install continuwuity-<version>
+```
+
+## Building locally
+
+Build the RPM locally using rpkg:
+
+```bash
+# Install dependencies
+sudo dnf install rpkg rpm-build cargo-rpm-macros systemd-rpm-macros
+
+# Clone the repository
+git clone https://forgejo.ellis.link/continuwuation/continuwuity.git
+cd continuwuity
+
+# Build SRPM
+rpkg srpm
+
+# Build RPM
+rpmbuild --rebuild *.src.rpm
+```
@@ -170,7 +170,7 @@ ## Exposing ports in the firewall or the router
 are: `ufw allow 8448/tcp` and `ufw allow 443/tcp`.

 :::tip Alternative port/domain setups
-If you would like to use only port 443, a different port, or a subdomain for the homeserver, you will need to set up `.well-known` delegation. Consult the `[global.well_known]` section of the config file, and the [**Delegation/Split-domain**](../guides/delegation) page to learn more about these kinds of deployments.
+If you would like to use only port 443, a different port, or a subdomain for the homeserver, you will need to set up `.well-known` delegation. Consult the `[global.well_known]` section of the config file, and the [**Delegation/Split-domain**](../advanced/delegation) page to learn more about these kinds of deployments.
 :::

 ## Setting up the Reverse Proxy
@@ -207,7 +207,7 @@ ### Other Reverse Proxies

  - `/_matrix/client` - core Client-Server APIs. These should be available on port :443

- `/_continuwuity/` - Continuwuity's integrated account management interface for OAuth-compatible clients
+- `/_conduwuit/` and `/_continuwuity/` - ad-hoc Continuwuity routes for password resets, email verification, and server details such as `/local_user_count` and `/server_version`.

 You can optionally reverse proxy the following individual routes:

@@ -300,8 +300,7 @@ # For client-server endpoints

 ## What's next?

- For smooth federation, set up a caching resolver according to the [**DNS tuning guide**](../guides/dns.mdx) (recommended)
- To configure OIDC login with an identity provider, see the [**delegated authentication guide**](../guides/oidc.mdx).
+- For smooth federation, set up a caching resolver according to the [**DNS tuning guide**](../advanced/dns.mdx) (recommended)
 - For Audio/Video call functionality see the [**Calls**](../calls.md) page.
 - Consult the [Maintenance](../maintenance.mdx) page for guidance on maintaining your homeserver.
 - If you want to set up an appservice, take a look at the [**Appservice Guide**](../appservices.md).
@@ -1,165 +0,0 @@
-import { Tab, Tabs} from '@rspress/core/theme';
-
-# RPM Installation Guide
-
-## Overview
-
-Continuwuity versions v0.5.10+ are available as RPM packages for the following distributions:
-
-<Tabs groupId="distro">
-<Tab label="Fedora">
-Available for upstream-supported Fedora versions (including compatible distributions, such as Ultramarine Linux) and Rawhide through Terra.
-</Tab>
-<Tab label="EL">
-Available for Enterprise Linux (RHEL, AlmaLinux, Rocky Linux, etc.) **10+** through Terra.
-
-:::warning Oracle Linux support
-Due to upstream limitations, Terra is only usable on Oracle Linux if you use [upstream EPEL](https://docs.fedoraproject.org/en-US/epel/getting-started/)
-rather than Oracle's rebuilds of EPEL. Oracle tends to lag behind on new EL versions, both major and minor—for example, as of the time of writing, 10.2 has been
-available for over a month through other ELs, but Oracle has not yet released corresponding updates—so you may encounter further compatibility issues with EPEL.
-**For this reason, it is recommended that you use another EL distribution if at all possible.**
-:::
-
-</Tab>
-<Tab label="SUSE">
-Available for openSUSE Tumbleweed and [supported Leap versions](https://en.opensuse.org/Lifetime) through the openSUSE Build Service.
-</Tab>
-</Tabs>
-
-## Installation methods
-
-### Stable releases (recommended)
-
-<Tabs groupId="distro">
-<Tab label="Fedora">
-1. Follow [Terra's directions for adding the Terra repo on your distribution](https://docs.terrapkg.com/usage/installing/#fedora-and-derivatives).
-2. Install the `continuwuity` package.
-</Tab>
-<Tab label="EL">
-1. Follow [Terra's directions for adding the Terra repo on your distribution](https://docs.terrapkg.com/usage/installing/#enterprise-linux). Be sure to acquire/enable relevant dependencies!
-2. Install the `continuwuity` package.
-</Tab>
-<Tab label="SUSE">
-openSUSE packages are available through an openSUSE Build Service project namespace provided by a community member.
-
-1. Navigate to [this page](https://software.opensuse.org/download.html?project=home%3Ajulian45&package=continuwuity).
-2. Click on the "Add repository and install manually" text to expand install instructions.
-3. Follow the provided instructions for your version of openSUSE.
-</Tab>
-</Tabs>
-
-### Nightly releases
-Nightly versions are built from the latest commit on the `main` branch every 24 hours.
-
-<Tabs groupId="distro">
-<Tab label="Fedora">
-1. Follow [Terra's directions for adding the Terra repo on your distribution](https://docs.terrapkg.com/usage/installing/#fedora-and-derivatives).
-2. Install the `continuwuity-nightly` package.
-</Tab>
-<Tab label="EL">
-1. Follow [Terra's directions for adding the Terra repo on your distribution](https://docs.terrapkg.com/usage/installing/#enterprise-linux). Be sure to acquire/enable relevant dependencies!
-2. Install the `continuwuity-nightly` package.
-</Tab>
-<Tab label="SUSE">
-Nightly packages for openSUSE are **not currently available**.
-
-If there is an ongoing need for these, please ask in `#continuwuity:continuwuity.org` or [open an issue on Forgejo](https://forgejo.ellis.link/continuwuation/continuwuity/issues/new).
-In the meantime, you may follow the [generic deployment instructions](generic).
-</Tab>
-</Tabs>
-
-## Service management and removal
-
-**Systemd service commands**
-
-```bash
-# Start the service
-sudo systemctl start conduwuit
-
-# Enable on boot
-sudo systemctl enable conduwuit
-
-# Check status
-sudo systemctl status conduwuit
-
-# View logs
-sudo journalctl -u conduwuit -f
-```
-
-**Uninstallation**
-
-```bash
-# Stop and disable the service
-sudo systemctl stop conduwuit
-sudo systemctl disable conduwuit
-
-# Remove the package
-sudo dnf remove continuwuity # replace `dnf` with `zypper` on openSUSE
-```
-
-## Troubleshooting
-
-**GPG key errors**: Temporarily disable GPG checking
-
-```bash
-sudo dnf --nogpgcheck install continuwuity
-```
-
-**Repository metadata issues**: Clear and rebuild cache
-
-```bash
-sudo dnf clean all
-sudo dnf makecache
-```
-
-**Finding specific versions**
-
-```bash
-# List all available versions
-dnf --showduplicates list continuwuity
-
-# Install a specific version
-sudo dnf install continuwuity-<version>
-```
-
-## Building locally
-
-<Tabs groupId="distro">
-<Tab label="Fedora">
-:::details Directly from Continuwuity source
-
-Build the RPM locally using rpkg:
-```bash
-# Install dependencies
-sudo dnf install rpkg rpm-build cargo-rpm-macros systemd-rpm-macros
-
-# Clone the repository
-git clone https://forgejo.ellis.link/continuwuation/continuwuity.git
-cd continuwuity
-
-# Build SRPM
-rpkg srpm
-
-# Build RPM
-rpmbuild --rebuild *.src.rpm
-```
-:::
-
-Or, use Terra:
-1. Follow [Terra's prep directions](https://docs.terrapkg.com/contributing/getting-started/#preparation) to bootstrap your development environment.
-2. `git clone` the [Terra sources repo](https://github.com/terrapkg/packages).
-3. Follow [Terra's build instructions](https://docs.terrapkg.com/contributing/getting-started/#building), using the path `anda/misc/continuwuity/nightly/pkg`. If desiring a build of the latest stable version, replace `nightly` with `stable` instead.
-</Tab>
-<Tab label="EL">
-1. Follow [Terra's prep directions](https://docs.terrapkg.com/contributing/getting-started/#preparation) to bootstrap your development environment.
-2. `git clone` the [Terra sources repo](https://github.com/terrapkg/packages).
-3. Follow [Terra's build instructions](https://docs.terrapkg.com/contributing/getting-started/#building), using the path `anda/misc/continuwuity/nightly/pkg`. If desiring a build of the latest stable version, replace `nightly` with `stable` instead.
-</Tab>
-<Tab label="SUSE">
-1. Navigate to [this package's location in the openSUSE Build Service web UI](https://build.opensuse.org/package/show/home:julian45/continuwuity).
-2. Click on the "Checkout package" text and follow the instructions to acquire a local copy of the packaging source.
-3. In the `_service` file, adjust the revision within the `<param name="revision">` tag (approx. line 6) to your desired git repo revision.
-4. Run `osc service ra` to update your copy of the Continuwuity sources and vendored packages.
-5. Run `osc build` to locally build an openSUSE-ready RPM.
-</Tab>
-</Tabs>
@@ -1,56 +0,0 @@
-# Configuring delegated authentication
-
-Continuwuity supports delegating user authentication to an external identity provider that implements the OpenID Connect specification, such as Authentik, kanidm, or Keycloak.
-
-:::warning{title="OIDC versus OAuth, and supported clients"}
-**OIDC** is not to be confused with **OAuth**. In the context of Matrix, OAuth is the protocol that Matrix clients use to authenticate with the _homeserver_. OIDC is the protocol that the _homeserver_ uses to communicate with the _identity provider_. Continuwuity supports OAuth by default, alongside the legacy **UIAA** authentication framework.
-
-When OIDC is configured, Continuwuity will disable its support for legacy authentication. **Only clients that support OAuth**, such as the Element family of clients, will be able to log in when OIDC is configured. If your client of choice shows an error when you try to log in after configuring OIDC, it likely does not support OAuth. This is an issue with your client, not Continuwuity, and should be reported to your client's developers.
-:::
-
-A simple OIDC configuration is as easy as creating a new OIDC application in your identity provider's settings and supplying Continuwuity with the client ID and client secret. This guide will use kanidm as an example, but the described steps are broadly applicable to other identity providers.
-
-First, create a new application for Continuwuity in your identity provider.
-```sh
-# Here, `c10y` is the client ID that kanidm will use, and `Continuwuity` is the display name.
-# Other identity providers may generate a client ID for you.
-# Use the domain that clients can reach Continuwuity at, which may not be the same as your server name
-# if you have configured well-known delegation.
-kanidm system oauth2 create c10y Continuwuity https://matrix.yourdomain.com
-```
-
-Configure the redirect URL that Continuwuity uses.
-```sh
-kanidm system oauth2 add-redirect-url c10y https://matrix.yourdomain.com/_continuwuity/oidc/complete
-```
-
-Allow Continuwuity to request the `openid` scope. Other identity providers may not require this step.
-```sh
-kanidm system oauth2 update-scope-map c10y idm_all_persons openid
-```
-
-Find the client secret that was generated. Other identity providers may show this information in their web UI.
-```sh
-kanidm system oauth2 show-basic-secret c10y
-d1qgx352kkuvs1j70b6w293d65x68jve1f7b27fyk90gjhpr
-```
-
-Configure Continuwuity with the client ID, client secret, and discovery URL. kanidm has a different discovery URL for each client, but other identity providers may have a single discovery URL at the root of their domain.
-
-```toml
-[global.oauth.oidc]
-
-# `/.well-known/openid-configuration` will be appended automatically
-discovery_url = "https://idm.example.com/oauth2/openid/c10y"
-
-# This may be randomly generated by your identity provider. kanidm requires
-# you to set it manually when you create the application.
-client_id = "c10y"
-
-# From the previous step
-client_secret = "d1qgx352kkuvs1j70b6w293d65x68jve1f7b27fyk90gjhpr"
-```
-
-Finally, restart Continuwuity, and log out and back in again. Your client should prompt you to continue in your web browser and open a webpage with the Continuwuity logo that allows you to continue in your identity provider. Once you log in successfully, you will be prompted to choose a user ID -- to link your existing account, enter its user ID, and then your old password when prompted.
-
-Continuwuity offers several additional configuration options to tweak its integration with your identity provider. Review the `[global.oauth.oidc]` section towards the bottom of the [reference configuration](../reference/config) for a complete list of options and documentation.
@@ -6,10 +6,10 @@
            "message": "Welcome to Continuwuity! Important announcements about the project will appear here."
        },
        {
-            "id": 16,
+            "id": 14,
            "mention_room": true,
-            "date": "2026-07-13",
-            "message": "[Continuwuity 26.6.2](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.6.1) has just been released! This release fixes a severe bug with OIDC that could cause users' accounts to be flagged as deactivated. If you use OIDC, please update as soon as possible."
+            "date": "2026-06-20",
+            "message": "[v0.5.10](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v0.5.10) has been released. It is a security release, so we suggest you update as soon as possible. Don't forget to also join [our announcements room](https://matrix.to/#/!jIdNjSM5X-V5JVx2h2kAhUZIIQ08GyzPL55NFZAH1vM/%24K1ISNKIqfNiZzsNVCaTt2E7ZtNeP6Dsy6sbz9l3rO0A?via=ellis.link&via=gingershaped.computer&via=matrix.org)."
        }
    ]
 }
@@ -27,7 +27,3 @@ ## `!admin appservices show-appservice-config`
 ## `!admin appservices list-registered`

 List all the currently registered appservices
-
-## `!admin appservices ensure-puppets-active`
-
-Ensure no appservice puppets are marked as deactivated. This is a debug command to fix issues caused by a faulty database migration in Continuwuity 26.6.0
@@ -10,13 +10,7 @@ ## `!admin debug echo`

 ## `!admin debug get-auth-chain`

-Loads the auth_chain of a PDU, reporting how long it took
-
-## `!admin debug show-auth-chain`
-
-Walks & displays the auth_chain of a PDU in a mermaid graph format.
-
-This is useless to basically anyone but developers, and is also probably slow and memory hungry.
+Get the auth_chain of a PDU

 ## `!admin debug parse-pdu`

@@ -50,12 +44,6 @@ ## `!admin debug get-room-state`

 Of course the check is still done on the actual client API.

-## `!admin debug get-state-at`
-
-Gets all the room state events at the specified event.
-
-State at event might not be available for some PDUs, such as rejected ones.
-
 ## `!admin debug get-signing-keys`

 Get and display signing keys from local cache or remote server
@@ -146,10 +134,6 @@ ## `!admin debug send-test-email`

 Send a test email to the invoking admin's email address

-## `!admin debug rooms-by-extremity-count`
-
-Lists room IDs by forward extremity count in descending order
-
 ## `!admin debug tester`

 Developer test stubs
@@ -14,7 +14,6 @@ ## Categories
 - [`!admin appservices`](appservices/): Commands for managing appservices
 - [`!admin users`](users/): Commands for managing local users
 - [`!admin token`](token/): Commands for managing registration tokens
- [`!admin oidc`](oidc/): Commands for managing OIDC
 - [`!admin rooms`](rooms/): Commands for managing rooms
 - [`!admin federation`](federation/): Commands for managing federation
 - [`!admin server`](server/): Commands for managing the server
@@ -1,13 +0,0 @@
-<!-- This file is generated by `cargo xtask generate-docs`. Do not edit. -->
-# `!admin oidc`
-
-Commands for managing OIDC
-
-
-## `!admin oidc link`
-
-Link a user ID to the given subject claim
-
-## `!admin oidc unlink`
-
-Unlink the given subject claim from its associated user ID
@@ -104,9 +104,13 @@ ## `!admin query resolver`

 resolver service

-### `!admin query resolver cache`
+### `!admin query resolver destinations-cache`

-Query the destinations or overrides cache, depending on the value of the `overrides` flag (default false)
+Query the destinations cache
+
+### `!admin query resolver overrides-cache`
+
+Query the overrides cache

 ### `!admin query resolver flush-cache`

@@ -12,6 +12,10 @@ ## `!admin users reset-password`

 Reset user password

+## `!admin users issue-password-reset-link`
+
+Issue a self-service password reset link for a user
+
 ## `!admin users get-email`

 Get a user's associated email address
@@ -92,14 +96,6 @@ ## `!admin users list-users`

 List local users in the database

-## `!admin users list-invited-rooms`
-
-Lists all the rooms (local and remote) that the specified user is invited to
-
-## `!admin users reject-all-invites`
-
-Manually make a user reject all current invites
-
 ## `!admin users list-joined-rooms`

 Lists all the rooms (local and remote) that the specified user is joined in
@@ -60,7 +60,7 @@ ### DNS server overload

 Matrix federation is extremely heavy and sends wild amounts of DNS requests. This makes normal resolvers like the ones above unsuitable for its activity. Ultimately, the best solution/fix for this is to selfhost a high quality caching DNS resolver such as Unbound, and configure Continuwuity to use it.

-Follow the [**DNS tuning guide**](./guides/dns) for details on setting it up.
+Follow the [**DNS tuning guide**](./advanced/dns) for details on setting it up.

 ### Intermittent federation failures to a specific server

@@ -3,11 +3,11 @@
    "advisory-db": {
      "flake": false,
      "locked": {
-        "lastModified": 1783840254,
-        "narHash": "sha256-XjyvZk0f3YiinVHmkGOotmLBAzvK+LwEJYj2QqJ5pn8=",
+        "lastModified": 1781566179,
+        "narHash": "sha256-Tqv8I586fYzWpEW/Smq/JqESFa3DVVzVWsnAMtvhy/I=",
        "owner": "rustsec",
        "repo": "advisory-db",
-        "rev": "6e3286f4efa8c142fb33e5ea4342c8db6693cf34",
+        "rev": "74e084413d979d52d2f93b1d93b1ab7b9ee648f5",
        "type": "github"
      },
      "original": {
@@ -18,11 +18,11 @@
    },
    "crane": {
      "locked": {
-        "lastModified": 1783203018,
-        "narHash": "sha256-G6R9IT/xwFuu+CYBWDUAok6AdC4ERC4ZfPPFtEpxnZE=",
+        "lastModified": 1780532242,
+        "narHash": "sha256-D+BsdpxmtUwtqGoY0IXPhHgTlmqgcZKCEo1oMyn7ep0=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "80db5bdc391be8a1794f6d8a2d56e3a84ebcede2",
+        "rev": "59a82a1222dd3b2080b5cc52a1a2e8d5f1b77f37",
        "type": "github"
      },
      "original": {
@@ -39,11 +39,11 @@
        "rust-analyzer-src": "rust-analyzer-src"
      },
      "locked": {
-        "lastModified": 1783844668,
-        "narHash": "sha256-3MOpw4y3reoErRLvFBDz0t9aG6FWXUj7leKvUns5eQA=",
+        "lastModified": 1781527054,
+        "narHash": "sha256-1fX9ev2Fh5QoKQ41G9dYutjo5j/jywu6tZse5Eb1Ck4=",
        "owner": "nix-community",
        "repo": "fenix",
-        "rev": "4e49ef62eedaa5c149d62b63b3f53844e1cc45d7",
+        "rev": "8c2e51dffefc040a21975da7abf6f252c8c9b783",
        "type": "github"
      },
      "original": {
@@ -74,11 +74,11 @@
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1782949081,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "lastModified": 1778716662,
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
        "type": "github"
      },
      "original": {
@@ -89,11 +89,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1783776592,
-        "narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=",
+        "lastModified": 1781074563,
+        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e7a3ca8092b61ff85b6a45bf863ea2b2d6a661b3",
+        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
        "type": "github"
      },
      "original": {
@@ -105,11 +105,11 @@
    },
    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1782614948,
-        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
+        "lastModified": 1777168982,
+        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
+        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
        "type": "github"
      },
      "original": {
@@ -132,11 +132,11 @@
    "rust-analyzer-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1783779020,
-        "narHash": "sha256-vpm418WZa9l1KUl6HRs+Ga+SIfE+D2/sV4olwTlilYc=",
+        "lastModified": 1781453968,
+        "narHash": "sha256-+V3nK4pCngbmgyVGXY6Kkrlevp4ocPkJJLf2aqwkDNA=",
        "owner": "rust-lang",
        "repo": "rust-analyzer",
-        "rev": "5be5e89cf0145d73a85c805726821b4adfc3af48",
+        "rev": "cc272809a173c2c11d0e479d639c811c1eacf049",
        "type": "github"
      },
      "original": {
@@ -9,7 +9,7 @@
    {
      # basic nix shell containing all things necessary to build continuwuity in all flavors manually (on x86_64-linux)
      devShells.default =
-        ((inputs.crane.mkLib pkgs).overrideToolchain (pkgs: self'.packages.stable-toolchain)).devShell
+        (inputs.crane.mkLib pkgs).overrideToolchain (pkgs: self'.packages.stable-toolchain).devShell
          {
            packages = [
              self'.packages.rocksdb
@@ -43,8 +43,6 @@ let
    env = {
      CARGO_PROFILE = profile;
      RUSTFLAGS = rustflags;
-      GIT_COMMIT_HASH = self.rev or self.dirtyRev or "";
-      GIT_COMMIT_HASH_SHORT = self.shortRev or self.dirtyShortRev or "";
    }
    // (lib.optionalAttrs (rocksdb != null) {
      ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
@@ -36,16 +36,14 @@
                  self'.packages.stable-toolchain
              );

-              # extra features via `cargoExtraArgs`
-              cargoExtraArgs = "-F http3";
-
              default = pkgs.callPackage ./continuwuity.nix {
                inherit self craneLib;

                liburing = (if isStatic then pkgs.pkgsStatic else pkgs).liburing;
                rocksdb = if isStatic then null else self'.packages.rocksdb;

-                inherit cargoExtraArgs;
+                # extra features via `cargoExtraArgs`
+                cargoExtraArgs = "-F http3";
                # extra RUSTFLAGS via `rustflags`
                # the stuff below is required for http3
                rustflags = "--cfg reqwest_unstable";
@@ -57,7 +55,6 @@
              max-perf = default.override {
                # compiles slower but with more thorough optimizations
                profile = "release-max-perf";
-                cargoExtraArgs = "${cargoExtraArgs} -F release_max_log_level";
              };

              max-perf-haswell = max-perf.override {
@@ -12,7 +12,7 @@
        target:
        target.fromToolchainName {
          name = (lib.importTOML "${inputs.self}/rust-toolchain.toml").toolchain.channel;
-          sha256 = "sha256-OATSZm98Es5kIFuqaba+UvkQtFsVgJEBMmS+t6od5/U=";
+          sha256 = "sha256-mvUGEOHYJpn3ikC5hckneuGixaC+yGrkMM/liDIDgoU=";
        };
    in
    {
@@ -25,6 +25,6 @@
    "@rspress/core": "^2.0.0",
    "@rspress/plugin-client-redirects": "^2.0.0",
    "@rspress/plugin-sitemap": "^2.0.0",
-    "typescript": "^7.0.0"
+    "typescript": "^6.0.0"
  }
 }
@@ -10,7 +10,7 @@

 [toolchain]
 profile = "minimal"
-channel = "1.97.0"
+channel = "1.96.0"
 components = [
    # For rust-analyzer
    "rust-src",
@@ -92,7 +92,6 @@ serde-saphyr.workspace = true
 tokio.workspace = true
 tracing-subscriber.workspace = true
 tracing.workspace = true
-resolvematrix.workspace = true

 [lints]
 workspace = true
@@ -1,5 +1,5 @@
 use clap::Parser;
-use conduwuit::{Err, Result};
+use conduwuit::Result;

 use crate::{
 	appservice::{self, AppserviceCommand},
@@ -8,7 +8,6 @@
 	debug::{self, DebugCommand},
 	federation::{self, FederationCommand},
 	media::{self, MediaCommand},
-	oidc::{self, OidcCommand},
 	query::{self, QueryCommand},
 	room::{self, RoomCommand},
 	server::{self, ServerCommand},
@@ -19,48 +18,44 @@
 #[derive(Debug, Parser)]
 #[command(name = conduwuit_core::BRANDING, version = conduwuit_core::version())]
 pub enum AdminCommand {
-	/// Commands for managing appservices
 	#[command(subcommand)]
+	/// Commands for managing appservices
 	Appservices(AppserviceCommand),

-	/// Commands for managing local users
 	#[command(subcommand)]
+	/// Commands for managing local users
 	Users(UserCommand),

-	/// Commands for managing registration tokens
 	#[command(subcommand)]
+	/// Commands for managing registration tokens
 	Token(TokenCommand),

-	/// Commands for managing OIDC
 	#[command(subcommand)]
-	Oidc(OidcCommand),
-
 	/// Commands for managing rooms
-	#[command(subcommand)]
 	Rooms(RoomCommand),

-	/// Commands for managing federation
 	#[command(subcommand)]
+	/// Commands for managing federation
 	Federation(FederationCommand),

-	/// Commands for managing the server
 	#[command(subcommand)]
+	/// Commands for managing the server
 	Server(ServerCommand),

-	/// Commands for managing media
 	#[command(subcommand)]
+	/// Commands for managing media
 	Media(MediaCommand),

-	/// Commands for checking integrity
 	#[command(subcommand)]
+	/// Commands for checking integrity
 	Check(CheckCommand),

-	/// Commands for debugging things
 	#[command(subcommand)]
+	/// Commands for debugging things
 	Debug(DebugCommand),

-	/// Low-level queries for database getters and iterators
 	#[command(subcommand)]
+	/// Low-level queries for database getters and iterators
 	Query(QueryCommand),
 }

@@ -85,16 +80,6 @@ pub(super) async fn process(command: AdminCommand, context: &Context<'_>) -> Res
 			context.bail_restricted()?;
 			token::process(command, context).await
 		},
-		| Oidc(command) => {
-			// OIDC commands are all restricted
-			context.bail_restricted()?;
-
-			if !context.services.oidc.enabled() {
-				return Err!("OIDC is not configured");
-			}
-
-			oidc::process(command, context).await
-		},
 		| Rooms(command) => room::process(command, context).await,
 		| Federation(command) => federation::process(command, context).await,
 		| Server(command) => server::process(command, context).await,
@@ -73,29 +73,4 @@ pub(super) async fn list_registered(&self) -> Result {
 			})
 			.await
 	}
-
-	pub(super) async fn ensure_puppets_active(&self) -> Result {
-		self.services
-			.users
-			.stream_local_users()
-			.filter_map(async |user_id| {
-				if self.services.appservice.is_user_id(&user_id).await {
-					Some(user_id)
-				} else {
-					None
-				}
-			})
-			.for_each(async |user_id| {
-				self.services
-					.users
-					.convert_to_shadow_account(&user_id)
-					.await
-					.expect("should be able to convert to shadow");
-			})
-			.await;
-
-		write!(self, "All appservice puppets have been marked as active.").await?;
-
-		Ok(())
-	}
 }
@@ -37,10 +37,4 @@ pub enum AppserviceCommand {
 	/// List all the currently registered appservices
 	#[clap(alias("list"))]
 	ListRegistered,
-
-	/// Ensure no appservice puppets are marked as deactivated.
-	/// This is a debug command to fix issues caused by a faulty database
-	/// migration in Continuwuity 26.6.0.
-	#[clap(hide = true)]
-	EnsurePuppetsActive,
 }
@@ -6,12 +6,7 @@
 impl Context<'_> {
 	pub(super) async fn check_all_users(&self) -> Result {
 		let timer = tokio::time::Instant::now();
-		let users = self
-			.services
-			.users
-			.stream_local_users()
-			.collect::<Vec<_>>()
-			.await;
+		let users = self.services.users.stream().collect::<Vec<_>>().await;
 		let query_time = timer.elapsed();

 		let total = users.len();
@@ -20,10 +20,6 @@
 };
 use futures::{FutureExt, StreamExt, TryStreamExt};
 use lettre::message::Mailbox;
-use resolvematrix::{
-	resolution::ResolvedDestination,
-	server::{MatrixResolver, MatrixResolverBuilder},
-};
 use ruma::{
 	CanonicalJsonObject, CanonicalJsonValue, EventId, OwnedEventId, OwnedRoomId,
 	OwnedRoomOrAliasId, OwnedServerName, RoomId, RoomVersionId, UInt,
@@ -35,8 +31,6 @@
 };
 use tracing_subscriber::EnvFilter;

-use crate::PAGE_SIZE;
-
 #[derive(Clone, Copy, Eq, PartialEq)]
 enum NodeStatus {
 	Normal(bool),
@@ -486,7 +480,7 @@ pub(super) async fn get_remote_pdu(
 						.services
 						.rooms
 						.event_handler
-						.parse_incoming_pdu(&response.pdu, None)
+						.parse_incoming_pdu(&response.pdu)
 						.boxed()
 						.await;

@@ -616,7 +610,7 @@ pub(super) async fn force_device_list_updates(&self) -> Result {
 		// Force E2EE device list updates for all users
 		self.services
 			.users
-			.stream_local_users()
+			.stream()
 			.for_each(async |user_id| self.services.users.mark_device_key_update(&user_id).await)
 			.await;

@@ -832,7 +826,7 @@ pub(super) async fn force_set_room_state_from_server(
 				.services
 				.rooms
 				.event_handler
-				.parse_incoming_pdu(&pdu, Some(&room_version_rules))
+				.parse_incoming_pdu(&pdu)
 				.await
 			{
 				| Ok(t) => t,
@@ -1011,26 +1005,13 @@ pub(super) async fn resolve_true_destination(
 			);
 		}

-		let resolver: &MatrixResolver = if no_cache {
-			&MatrixResolverBuilder::new()
-				.dangerous_tls_accept_invalid_certs(self.services.server.config.allow_invalid_tls_certificates_yes_i_know_what_the_fuck_i_am_doing_with_this_and_i_know_this_is_insecure)
-				.http_client(self.services.client.dns.clone())
-				.build()?
-		} else {
-			&self.services.client.matrix_resolver
-		};
+		let actual = self
+			.services
+			.resolver
+			.resolve_actual_dest(&server_name, !no_cache)
+			.await?;

-		let actual = resolver.resolve_server(server_name.as_str()).await?;
-
-		let destination = match actual.destination {
-			| ResolvedDestination::Literal(addr) => addr.to_string(),
-			| ResolvedDestination::Named(host, port) => format!("{host}:{port}"),
-		};
-
-		let msg = format!(
-			"Destination: {}\nHostname URI (SNI): {}\nIs override?: {}\nResolution step: {}",
-			destination, actual.host, actual.is_override, actual.resolution_step
-		);
+		let msg = format!("Destination: {}\nHostname URI: {}", actual.dest, actual.host);
 		self.write_str(&msg).await
 	}

@@ -1185,56 +1166,4 @@ pub(super) async fn send_test_email(&self) -> Result {

 		Ok(())
 	}
-
-	pub(super) async fn rooms_by_extremity_count(&self, page: Option<usize>) -> Result {
-		let page = page.unwrap_or(1);
-		// My Giant Chain:tm:
-		let mapped: HashMap<OwnedRoomId, u64> = self
-			.services
-			.rooms
-			.state
-			.all_forward_extremities()
-			.ready_fold(HashMap::new(), move |mut map, (room_id, _)| {
-				let count: u64 = map.get(&room_id).copied().unwrap_or(0);
-				map.insert(room_id, count.saturating_add(1));
-				map
-			})
-			.await
-			.into_iter()
-			.filter_map(|(room_id, count)| (count >= 2).then_some((room_id, count)))
-			.collect();
-		if mapped.is_empty() {
-			return Err!("No more rooms.");
-		}
-
-		let mut rooms = mapped.keys().collect::<Vec<_>>();
-		rooms.sort_by_key(|room_id| {
-			mapped
-				.get(*room_id)
-				.copied()
-				.expect("keys must have values")
-		});
-		rooms.reverse();
-
-		let body = rooms
-			.into_iter()
-			.stream()
-			.skip(page.saturating_sub(1).saturating_mul(PAGE_SIZE))
-			.take(PAGE_SIZE)
-			.map(|room_id| {
-				format!(
-					"{room_id}: {}",
-					mapped.get(room_id).copied().expect("keys must have values")
-				)
-			})
-			.collect::<Vec<_>>()
-			.await;
-
-		self.write_str(&format!(
-			"Rooms by extremity count ({}):\n```\n{}\n```",
-			body.len(),
-			body.join("\n")
-		))
-		.await
-	}
 }
@@ -245,11 +245,6 @@ pub enum DebugCommand {
 	/// Send a test email to the invoking admin's email address
 	SendTestEmail,

-	/// Lists room IDs by forward extremity count in descending order
-	RoomsByExtremityCount {
-		page: Option<usize>,
-	},
-
 	/// Developer test stubs
 	#[command(subcommand)]
 	#[allow(non_snake_case)]
@@ -54,7 +54,7 @@ pub(super) async fn fetch_support_well_known(&self, server_name: OwnedServerName
 		let response = self
 			.services
 			.client
-			.external_resource
+			.default
 			.get(format!("https://{server_name}/.well-known/matrix/support"))
 			.send()
 			.await?;
@@ -16,7 +16,6 @@
 pub(crate) mod debug;
 pub(crate) mod federation;
 pub(crate) mod media;
-pub(crate) mod oidc;
 pub(crate) mod query;
 pub(crate) mod room;
 pub(crate) mod server;
@@ -1,25 +0,0 @@
-use conduwuit::Result;
-
-use crate::utils::parse_active_local_user_id;
-
-impl crate::Context<'_> {
-	pub(super) async fn oidc_link(&self, user_id: String, subject: String) -> Result {
-		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
-
-		self.services.oidc.link_user(&user_id, &subject);
-
-		self.write_str(&format!("Subject `{subject}` linked to account `{user_id}`."))
-			.await?;
-
-		Ok(())
-	}
-
-	pub(super) async fn oidc_unlink(&self, subject: String) -> Result {
-		self.services.oidc.unlink_user(&subject);
-
-		self.write_str(&format!("Subject `{subject}` unlinked."))
-			.await?;
-
-		Ok(())
-	}
-}
@@ -1,22 +0,0 @@
-mod commands;
-
-use clap::Subcommand;
-use conduwuit::Result;
-use conduwuit_macros::admin_command_dispatch;
-
-#[admin_command_dispatch]
-#[derive(Debug, Subcommand)]
-pub enum OidcCommand {
-	/// Link a user ID to the given subject claim.
-	#[clap(name = "link")]
-	OidcLink {
-		user_id: String,
-		subject: String,
-	},
-
-	/// Unlink the given subject claim from its associated user ID.
-	#[clap(name = "unlink")]
-	OidcUnlink {
-		subject: String,
-	},
-}
@@ -1,6 +1,6 @@
 use clap::Subcommand;
 use conduwuit::{Err, Result, utils::time};
-use resolvematrix::resolution::Resolution;
+use futures::StreamExt;
 use ruma::OwnedServerName;

 use crate::admin_command_dispatch;
@@ -10,13 +10,14 @@
 #[allow(clippy::enum_variant_names)]
 /// Resolver service and caches
 pub enum ResolverCommand {
-	/// Query the destinations or overrides cache, depending on the value of the
-	/// `overrides` flag (default false)
-	Cache {
+	/// Query the destinations cache
+	DestinationsCache {
 		server_name: Option<OwnedServerName>,
+	},

-		#[arg(short, long)]
-		overrides: Option<bool>,
+	/// Query the overrides cache
+	OverridesCache {
+		name: Option<String>,
 	},

 	/// Flush a given server from the resolver caches or flush them completely
@@ -39,39 +40,49 @@ pub enum ResolverCommand {
 }

 impl crate::Context<'_> {
-	async fn cache(
-		&self,
-		server_name: Option<OwnedServerName>,
-		overrides: Option<bool>,
-	) -> Result {
-		writeln!(self, "| Server Name | Destination | SNI | Override | Step | Expires |").await?;
-		writeln!(self, "| ----------- | ----------- | --- | -------- | ---- | ------- |").await?;
+	async fn destinations_cache(&self, server_name: Option<OwnedServerName>) -> Result {
+		use service::resolver::cache::CachedDest;

-		let entries = self.services.client.matrix_resolver.get_all_cache_entries();
+		writeln!(self, "| Server Name | Destination | Hostname | Expires |").await?;
+		writeln!(self, "| ----------- | ----------- | -------- | ------- |").await?;

-		for (host, entry) in entries {
-			if let Some(ors) = overrides
-				&& entry.is_override != ors
-			{
-				continue;
+		let mut destinations = self.services.resolver.cache.destinations().boxed();
+
+		while let Some((name, CachedDest { dest, host, expire })) = destinations.next().await {
+			if let Some(server_name) = server_name.as_ref() {
+				if name != *server_name {
+					continue;
+				}
 			}

-			if let Some(server_name) = server_name.as_ref()
-				&& host != *server_name
-			{
-				continue;
+			let expire = time::format(expire, "%+");
+			self.write_str(&format!("| {name} | {dest} | {host} | {expire} |\n"))
+				.await?;
+		}
+
+		Ok(())
+	}
+
+	async fn overrides_cache(&self, server_name: Option<String>) -> Result {
+		use service::resolver::cache::CachedOverride;
+
+		writeln!(self, "| Server Name | IP  | Port | Expires | Overriding |").await?;
+		writeln!(self, "| ----------- | --- | ----:| ------- | ---------- |").await?;
+
+		let mut overrides = self.services.resolver.cache.overrides().boxed();
+
+		while let Some((name, CachedOverride { ips, port, expire, overriding })) =
+			overrides.next().await
+		{
+			if let Some(server_name) = server_name.as_ref() {
+				if name != *server_name {
+					continue;
+				}
 			}

-			let Resolution {
-				destination,
-				is_override,
-				host: sni_host,
-				resolution_step,
-			} = entry.resolution;
-			let expires = time::format(entry.expires_at, "%Y-%m-%dT%H:%M:%S%.3f%z");
+			let expire = time::format(expire, "%+");
 			self.write_str(&format!(
-				"| {host} | {destination:?} | {sni_host} | {is_override:?} | {resolution_step} \
-				 | {expires} |\n"
+				"| {name} | {ips:?} | {port} | {expire} | {overriding:?} |\n"
 			))
 			.await?;
 		}
@@ -81,14 +92,11 @@ async fn cache(

 	async fn flush_cache(&self, name: Option<OwnedServerName>, all: bool) -> Result {
 		if all {
-			self.services.client.matrix_resolver.clear_cache();
-			self.services.client.dns_resolver.clear_cache();
-			writeln!(self, "Resolver and DNS caches cleared!").await
+			self.services.resolver.cache.clear().await;
+			writeln!(self, "Resolver caches cleared!").await
 		} else if let Some(name) = name {
-			self.services
-				.client
-				.matrix_resolver
-				.remove_cache_entry(name.as_str());
+			self.services.resolver.cache.del_destination(&name);
+			self.services.resolver.cache.del_override(&name);
 			self.write_str(&format!("Cleared {name} from resolver caches!"))
 				.await
 		} else {
@@ -191,13 +191,8 @@ async fn get_latest_backup(&self, user_id: OwnedUserId) -> Result {

 	async fn iter_users(&self) -> Result {
 		let timer = tokio::time::Instant::now();
-		let result: Vec<OwnedUserId> = self
-			.services
-			.users
-			.stream_local_users()
-			.map(Into::into)
-			.collect()
-			.await;
+		let result: Vec<OwnedUserId> =
+			self.services.users.stream().map(Into::into).collect().await;

 		let query_time = timer.elapsed();

@@ -207,7 +202,7 @@ async fn iter_users(&self) -> Result {

 	async fn iter_users2(&self) -> Result {
 		let timer = tokio::time::Instant::now();
-		let result: Vec<_> = self.services.users.stream_local_users().collect().await;
+		let result: Vec<_> = self.services.users.stream().collect().await;
 		let result: Vec<_> = result
 			.into_iter()
 			.map(|user_id| String::from_utf8_lossy(user_id.as_bytes()).into_owned())
@@ -44,7 +44,7 @@ pub(super) async fn issue_token(&self, expires: super::TokenExpires) -> Result {
 			.services
 			.config
 			.oauth
-			.compatibility_mode()
+			.compatibility_mode
 			.oauth_available()
 		{
 			self.write_str(&format!(
@@ -20,7 +20,7 @@
 		tag::{TagEvent, TagEventContent, TagInfo},
 	},
 };
-use service::users::{AccountStatus, HashedPassword};
+use service::users::HashedPassword;

 use crate::{
 	get_room_info,
@@ -35,7 +35,7 @@ pub(super) async fn list_users(&self) -> Result {
 		let users: Vec<_> = self
 			.services
 			.users
-			.stream_local_users()
+			.list_local_users()
 			.map(|id| id.as_str().to_owned())
 			.collect()
 			.await;
@@ -54,16 +54,16 @@ pub(super) async fn create_user(&self, username: String, password: Option<String
 			.determine_registration_user_id(Some(username), None, None)
 			.await?;

-		let password =
-			&password.unwrap_or_else(|| utils::random_string(AUTO_GEN_PASSWORD_LENGTH));
+		let password = HashedPassword::new(
+			&password.unwrap_or_else(|| utils::random_string(AUTO_GEN_PASSWORD_LENGTH)),
+		)?;

 		self.services
 			.users
-			.create_local_account(&user_id, Some(HashedPassword::new(password)?), None)
-			.await?;
+			.create_local_account(&user_id, password, None)
+			.await;

-		self.write_str(&format!("Created user {user_id} with password `{password}`"))
-			.await
+		self.write_str(&format!("Created user {user_id}")).await
 	}

 	pub(super) async fn deactivate(&self, no_leave_rooms: bool, user_id: String) -> Result {
@@ -103,12 +103,15 @@ pub(super) async fn deactivate(&self, no_leave_rooms: bool, user_id: String) ->

 	pub(super) async fn suspend(&self, user_id: String) -> Result {
 		self.bail_restricted()?;
-		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
+		let user_id = parse_local_user_id(self.services, &user_id)?;

 		if user_id == self.services.globals.server_user {
 			return Err!("Not allowed to suspend the server service account.",);
 		}

+		if !self.services.users.exists(&user_id).await {
+			return Err!("User {user_id} does not exist.");
+		}
 		if self.services.users.is_admin(&user_id).await {
 			return Err!("Admin users cannot be suspended.");
 		}
@@ -124,12 +127,15 @@ pub(super) async fn suspend(&self, user_id: String) -> Result {

 	pub(super) async fn unsuspend(&self, user_id: String) -> Result {
 		self.bail_restricted()?;
-		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
+		let user_id = parse_local_user_id(self.services, &user_id)?;

 		if user_id == self.services.globals.server_user {
 			return Err!("Not allowed to unsuspend the server service account.",);
 		}

+		if !self.services.users.exists(&user_id).await {
+			return Err!("User {user_id} does not exist.");
+		}
 		self.services.users.unsuspend_account(&user_id).await;

 		self.write_str(&format!("User {user_id} has been unsuspended."))
@@ -141,7 +147,6 @@ pub(super) async fn reset_password(
 		logout: bool,
 		username: String,
 		password: Option<String>,
-		convert_to_local_account: bool,
 	) -> Result {
 		let user_id = parse_local_user_id(self.services, &username)?;

@@ -154,37 +159,15 @@ pub(super) async fn reset_password(

 		let new_password =
 			password.unwrap_or_else(|| utils::random_string(AUTO_GEN_PASSWORD_LENGTH));
-		let new_password_hash = HashedPassword::new(&new_password)?;

-		if convert_to_local_account {
-			self.services
-				.users
-				.convert_to_local_account(&user_id, new_password_hash)
-				.await?;
-		} else {
-			match self.services.users.status(&user_id).await {
-				| AccountStatus::Active if !self.services.users.is_shadow(&user_id).await => {
-					self.services
-						.users
-						.set_password(&user_id, new_password_hash)
-						.await?;
-				},
-				| AccountStatus::NotFound => {
-					return Err!("The provided user does not exist.");
-				},
-				| _ => {
-					return Err!(
-						"The provided user is a shadow or deactivated account. To convert it to \
-						 a local account, pass the --convert-to-local-account flag."
-					);
-				},
-			}
+		self.services
+			.users
+			.set_password(&user_id, Some(HashedPassword::new(&new_password)?));

-			self.write_str(&format!(
-				"Successfully reset the password for user {user_id}: `{new_password}`"
-			))
-			.await?;
-		}
+		self.write_str(&format!(
+			"Successfully reset the password for user {user_id}: `{new_password}`"
+		))
+		.await?;

 		if logout {
 			self.services
@@ -588,7 +571,7 @@ pub(super) async fn force_join_all_local_users(
 		for user_id in &self
 			.services
 			.users
-			.stream_local_users()
+			.list_local_users()
 			.collect::<Vec<_>>()
 			.await
 		{
@@ -936,16 +919,21 @@ pub(super) async fn force_leave_remote_room(

 	pub(super) async fn lock(&self, user_id: String) -> Result {
 		self.bail_restricted()?;
-		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
-
+		let user_id = parse_local_user_id(self.services, &user_id)?;
+		assert!(
+			self.services.globals.user_is_local(&user_id),
+			"Parsed user_id must be a local user"
+		);
 		if user_id == self.services.globals.server_user {
 			return Err!("Not allowed to lock the server service account.",);
 		}

+		if !self.services.users.exists(&user_id).await {
+			return Err!("User {user_id} does not exist.");
+		}
 		if self.services.users.is_admin(&user_id).await {
 			return Err!("Admin users cannot be locked.");
 		}
-
 		self.services
 			.users
 			.lock_account(&user_id, self.sender_or_service_user())
@@ -957,8 +945,11 @@ pub(super) async fn lock(&self, user_id: String) -> Result {

 	pub(super) async fn unlock(&self, user_id: String) -> Result {
 		self.bail_restricted()?;
-		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
-
+		let user_id = parse_local_user_id(self.services, &user_id)?;
+		assert!(
+			self.services.globals.user_is_local(&user_id),
+			"Parsed user_id must be a local user"
+		);
 		self.services.users.unlock_account(&user_id).await;

 		self.write_str(&format!("User {user_id} has been unlocked."))
@@ -967,16 +958,21 @@ pub(super) async fn unlock(&self, user_id: String) -> Result {

 	pub(super) async fn logout(&self, user_id: String) -> Result {
 		self.bail_restricted()?;
-		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
-
+		let user_id = parse_local_user_id(self.services, &user_id)?;
+		assert!(
+			self.services.globals.user_is_local(&user_id),
+			"Parsed user_id must be a local user"
+		);
 		if user_id == self.services.globals.server_user {
 			return Err!("Not allowed to log out the server service account.",);
 		}

+		if !self.services.users.exists(&user_id).await {
+			return Err!("User {user_id} does not exist.");
+		}
 		if self.services.users.is_admin(&user_id).await {
 			return Err!("You cannot forcefully log out admin users.");
 		}
-
 		self.services
 			.users
 			.all_device_ids(&user_id)
@@ -993,12 +989,18 @@ pub(super) async fn logout(&self, user_id: String) -> Result {

 	pub(super) async fn disable_login(&self, user_id: String) -> Result {
 		self.bail_restricted()?;
-		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
-
+		let user_id = parse_local_user_id(self.services, &user_id)?;
+		assert!(
+			self.services.globals.user_is_local(&user_id),
+			"Parsed user_id must be a local user"
+		);
 		if user_id == self.services.globals.server_user {
 			return Err!("Not allowed to disable login for the server service account.",);
 		}

+		if !self.services.users.exists(&user_id).await {
+			return Err!("User {user_id} does not exist.");
+		}
 		if self.services.users.is_admin(&user_id).await {
 			return Err!("Admin users cannot have their login disallowed.");
 		}
@@ -1012,8 +1014,14 @@ pub(super) async fn disable_login(&self, user_id: String) -> Result {

 	pub(super) async fn enable_login(&self, user_id: String) -> Result {
 		self.bail_restricted()?;
-		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
-
+		let user_id = parse_local_user_id(self.services, &user_id)?;
+		assert!(
+			self.services.globals.user_is_local(&user_id),
+			"Parsed user_id must be a local user"
+		);
+		if !self.services.users.exists(&user_id).await {
+			return Err!("User {user_id} does not exist.");
+		}
 		self.services.users.enable_login(&user_id);

 		self.write_str(&format!("{user_id} can now log in.")).await
@@ -1121,8 +1129,10 @@ pub(super) async fn change_email(&self, user_id: String, email: Option<String>)
 	}

 	pub(super) async fn reset_push_rules(&self, user_id: String) -> Result {
-		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
-
+		let user_id = parse_local_user_id(self.services, &user_id)?;
+		if !self.services.users.is_active(&user_id).await {
+			return Err!("User is not active.");
+		}
 		recreate_push_rules_and_return(self.services, &user_id).await?;
 		self.write_str("Reset user's push rules to the server default.")
 			.await
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Ginger	bcbaa3ec7e	chore: News fragment	2026-06-29 10:09:31 -04:00
Ginger	c0d0236239	feat: Mark spec version 1.17 as supported	2026-06-29 10:08:30 -04:00
Ginger	e3075ed718	feat: Finish implementing MSC4190	2026-06-29 10:08:08 -04:00
				`@@ -0,0 +1 @@`
				`Appservice device management as outlined in MSC4190 (part of Matrix 1.17) is now fully supported. Contributed by @ginger.`
				`@@ -1 +0,0 @@`
				`Appservices are now properly able to create devices for E2EE.`
				`@@ -0,0 +1 @@`
				`The invite recipient's membership event is now included in invite stripped state, which should fix flaky invite display in some clients. Contributed by @ginger`
				`@@ -0,0 +1 @@`
				`Switched from Continuwuity's fork of Ruma back to upstream Ruma. Contributed by @ginger.`
				`@@ -0,0 +1 @@`
				Users may now be forbidden from deactivating their own accounts with the new `allow_deactivation` config option. Contributed by @ginger.
				`@@ -0,0 +1 @@`
				Added support for Matrix 1.16's `state_after` feature, allowing clients which understand it to sync room state changes more reliably. Contributed by @ginger.
				`@@ -1 +0,0 @@`
				`Fixed newly created rooms failing to sync properly in clients using legacy sync.`
				`@@ -0,0 +1 @@`
				`Added support for authenticating clients using the new OAuth 2.0 login API. Contributed by @ginger.`
				`@@ -0,0 +1 @@`
				`Added support for MSC4466, which allows clients to customize how changes to a user's global profile are propagated. Contributed by @ginger.`