From 45f48ed7dc25f503c279701828da484b85f639ea Mon Sep 17 00:00:00 2001
From: kyle <lelegrau04@gmail.com>
Date: Fri, 31 Jul 2026 23:17:55 +0200
Subject: [PATCH 1/5] refactor: remove unused server scaffolding

---
 ...fbb5f5a2c8074dffc2b6af58bb7c137a9b148.json |   15 -
 Cargo.lock                                    | 2058 +----------------
 Cargo.toml                                    |    7 -
 crates/vauxl-admin/Cargo.toml                 |   13 -
 crates/vauxl-admin/src/lib.rs                 |   14 -
 crates/vauxl-crypto/Cargo.toml                |    6 +-
 crates/vauxl-federation/Cargo.toml            |   15 -
 crates/vauxl-federation/src/lib.rs            |   14 -
 crates/vauxl-identity/Cargo.toml              |   13 -
 crates/vauxl-identity/src/lib.rs              |   14 -
 crates/vauxl-matrix/Cargo.toml                |    6 +-
 crates/vauxl-matrix/src/db/keys.rs            |   35 -
 crates/vauxl-matrix/src/db/sync.rs            |   28 -
 crates/vauxl-matrix/src/routes/client_info.rs |   36 -
 crates/vauxl-matrix/src/routes/login.rs       |   10 +-
 crates/vauxl-matrix/src/routes/media.rs       |    7 +-
 crates/vauxl-matrix/src/routes/rooms.rs       |   14 +-
 crates/vauxl-matrix/src/routes/sync.rs        |    6 +-
 crates/vauxl-matrix/src/state.rs              |    9 +-
 crates/vauxl-media/Cargo.toml                 |   13 -
 crates/vauxl-media/src/lib.rs                 |   14 -
 crates/vauxl-push/Cargo.toml                  |   10 -
 crates/vauxl-push/src/lib.rs                  |   14 -
 crates/vauxl-server/Cargo.toml                |    7 -
 crates/vauxl-server/src/main.rs               |    4 +-
 scripts/check.sh                              |  280 +--
 26 files changed, 85 insertions(+), 2577 deletions(-)
 delete mode 100644 .sqlx/query-078952dbae56d4c379132e87ce2fbb5f5a2c8074dffc2b6af58bb7c137a9b148.json
 delete mode 100644 crates/vauxl-admin/Cargo.toml
 delete mode 100644 crates/vauxl-admin/src/lib.rs
 delete mode 100644 crates/vauxl-federation/Cargo.toml
 delete mode 100644 crates/vauxl-federation/src/lib.rs
 delete mode 100644 crates/vauxl-identity/Cargo.toml
 delete mode 100644 crates/vauxl-identity/src/lib.rs
 delete mode 100644 crates/vauxl-media/Cargo.toml
 delete mode 100644 crates/vauxl-media/src/lib.rs
 delete mode 100644 crates/vauxl-push/Cargo.toml
 delete mode 100644 crates/vauxl-push/src/lib.rs

diff --git a/.sqlx/query-078952dbae56d4c379132e87ce2fbb5f5a2c8074dffc2b6af58bb7c137a9b148.json b/.sqlx/query-078952dbae56d4c379132e87ce2fbb5f5a2c8074dffc2b6af58bb7c137a9b148.json
deleted file mode 100644
index 2ce61ec..0000000
--- a/.sqlx/query-078952dbae56d4c379132e87ce2fbb5f5a2c8074dffc2b6af58bb7c137a9b148.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO device_otk_counts (user_id, device_id, algorithm, count)\n        SELECT\n            $1, $2,\n            split_part(key_id, ':', 1),\n            COUNT(*)::int\n        FROM one_time_keys\n        WHERE user_id   = $1\n        AND   device_id = $2\n        AND   claimed   = FALSE\n        GROUP BY split_part(key_id, ':', 1)\n        ON CONFLICT (user_id, device_id, algorithm)\n        DO UPDATE SET count = EXCLUDED.count\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "078952dbae56d4c379132e87ce2fbb5f5a2c8074dffc2b6af58bb7c137a9b148"
-}
diff --git a/Cargo.lock b/Cargo.lock
index 6fececa..e7da219 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,33 +2,6 @@
 # It is not intended for manual editing.
 version = 4
 
-[[package]]
-name = "adler2"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
-
-[[package]]
-name = "aead"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
-dependencies = [
- "crypto-common",
- "generic-array",
-]
-
-[[package]]
-name = "aes"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
-dependencies = [
- "cfg-if",
- "cipher",
- "cpufeatures 0.2.17",
-]
-
 [[package]]
 name = "aho-corasick"
 version = "1.1.4"
@@ -38,24 +11,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "aligned"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee4508988c62edf04abd8d92897fca0c2995d907ce1dfeaf369dac3716a40685"
-dependencies = [
- "as-slice",
-]
-
-[[package]]
-name = "aligned-vec"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc890384c8602f339876ded803c97ad529f3842aba97f6392b3dba0dd171769b"
-dependencies = [
- "equator",
-]
-
 [[package]]
 name = "allocator-api2"
 version = "0.2.21"
@@ -68,12 +23,6 @@ version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
-[[package]]
-name = "arbitrary"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
-
 [[package]]
 name = "arc-swap"
 version = "1.9.2"
@@ -83,17 +32,6 @@ dependencies = [
  "rustversion",
 ]
 
-[[package]]
-name = "arg_enum_proc_macro"
-version = "0.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ae92a5119aa49cdbcf6b9f893fe4e1d98b04ccbf82ee0584ad948a44a734dea"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "argon2"
 version = "0.5.3"
@@ -102,7 +40,7 @@ checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
 dependencies = [
  "base64ct",
  "blake2",
- "cpufeatures 0.2.17",
+ "cpufeatures",
  "password-hash",
 ]
 
@@ -112,75 +50,6 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d902e3d592a523def97af8f317b08ce16b7ab854c1985a0c671e6f15cebc236"
 
-[[package]]
-name = "arrayvec"
-version = "0.7.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "as-slice"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "516b6b4f0e40d50dcda9365d53964ec74560ad4284da2e7fc97122cd83174516"
-dependencies = [
- "stable_deref_trait",
-]
-
-[[package]]
-name = "as_variant"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dbc3a507a82b17ba0d98f6ce8fd6954ea0c8152e98009d36a40d8dcc8ce078a"
-
-[[package]]
-name = "asn1-rs"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5493c3bedbacf7fd7382c6346bbd66687d12bbaad3a89a2d2c303ee6cf20b048"
-dependencies = [
- "asn1-rs-derive",
- "asn1-rs-impl",
- "displaydoc",
- "nom 7.1.3",
- "num-traits",
- "rusticata-macros",
- "thiserror 1.0.69",
- "time",
-]
-
-[[package]]
-name = "asn1-rs-derive"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "965c2d33e53cb6b267e148a4cb0760bc01f4904c1cd4bb4002a085bb016d1490"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "synstructure",
-]
-
-[[package]]
-name = "asn1-rs-impl"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "assign"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f093eed78becd229346bf859eec0aa4dd7ddde0757287b2b4107a1f09c80002"
-
 [[package]]
 name = "async-trait"
 version = "0.1.89"
@@ -213,72 +82,6 @@ version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
-[[package]]
-name = "av-scenechange"
-version = "0.14.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f321d77c20e19b92c39e7471cf986812cbb46659d2af674adc4331ef3f18394"
-dependencies = [
- "aligned",
- "anyhow",
- "arg_enum_proc_macro",
- "arrayvec",
- "log",
- "num-rational",
- "num-traits",
- "pastey",
- "rayon",
- "thiserror 2.0.18",
- "v_frame",
- "y4m",
-]
-
-[[package]]
-name = "av1-grain"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8cfddb07216410377231960af4fcab838eaa12e013417781b78bd95ee22077f8"
-dependencies = [
- "anyhow",
- "arrayvec",
- "log",
- "nom 8.0.0",
- "num-rational",
- "v_frame",
-]
-
-[[package]]
-name = "avif-serialize"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7178fe5f7d460b13895ebb9dcb28a3a6216d2df2574a0806cb51b555d297f38"
-dependencies = [
- "arrayvec",
-]
-
-[[package]]
-name = "aws-lc-rs"
-version = "1.17.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4342d8937fc7e5dd9b1c60292261c0670c882a2cd1719cfc11b1af41731e32ad"
-dependencies = [
- "aws-lc-sys",
- "zeroize",
-]
-
-[[package]]
-name = "aws-lc-sys"
-version = "0.42.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d9ceb1da931507a12f4fccea479dccd00da1943e1b4ae72d8e502d707361444"
-dependencies = [
- "cc",
- "cmake",
- "dunce",
- "fs_extra",
- "pkg-config",
-]
-
 [[package]]
 name = "axum"
 version = "0.7.9"
@@ -334,12 +137,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "base64"
-version = "0.21.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
-
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -352,23 +149,6 @@ version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
-[[package]]
-name = "base64urlsafedata"
-version = "0.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b08e33815c87d8cadcddb1e74ac307368a3751fbe40c961538afa21a1899f21c"
-dependencies = [
- "base64 0.21.7",
- "pastey",
- "serde",
-]
-
-[[package]]
-name = "bit_field"
-version = "0.10.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e4b40c7323adcfc0a41c4b88143ed58346ff65a288fc144329c5c45e05d70c6"
-
 [[package]]
 name = "bitflags"
 version = "2.13.0"
@@ -378,15 +158,6 @@ dependencies = [
  "serde_core",
 ]
 
-[[package]]
-name = "bitstream-io"
-version = "4.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7eff00be299a18769011411c9def0d827e8f2d7bf0c3dbf53633147a8867fd1f"
-dependencies = [
- "no_std_io2",
-]
-
 [[package]]
 name = "blake2"
 version = "0.10.6"
@@ -405,60 +176,24 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "block-padding"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
-dependencies = [
- "generic-array",
-]
-
-[[package]]
-name = "built"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c0e531d93d39c34eef561e929e8a7f86d77a5af08aac4f6d6e39976c51858e9"
-
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
-[[package]]
-name = "bytemuck"
-version = "1.25.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
-
 [[package]]
 name = "byteorder"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
-[[package]]
-name = "byteorder-lite"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
-
 [[package]]
 name = "bytes"
 version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ae3f5d315924270530207e2a68396c3cc547f6dca3fbdca317cfb1a51edb593"
 
-[[package]]
-name = "cbc"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
-dependencies = [
- "cipher",
-]
-
 [[package]]
 name = "cc"
 version = "1.2.66"
@@ -477,73 +212,6 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
-[[package]]
-name = "cfg_aliases"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
-
-[[package]]
-name = "chacha20"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
-dependencies = [
- "cfg-if",
- "cipher",
- "cpufeatures 0.2.17",
-]
-
-[[package]]
-name = "chacha20"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.0",
- "rand_core 0.10.1",
-]
-
-[[package]]
-name = "chacha20poly1305"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
-dependencies = [
- "aead",
- "chacha20 0.9.1",
- "cipher",
- "poly1305",
- "zeroize",
-]
-
-[[package]]
-name = "cipher"
-version = "0.4.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
-dependencies = [
- "crypto-common",
- "inout",
- "zeroize",
-]
-
-[[package]]
-name = "cmake"
-version = "0.1.58"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "color_quant"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
-
 [[package]]
 name = "combine"
 version = "4.6.7"
@@ -582,8 +250,8 @@ dependencies = [
  "serde-untagged",
  "serde_core",
  "serde_json",
- "toml 1.1.2+spec-1.1.0",
- "winnow 1.0.3",
+ "toml",
+ "winnow",
  "yaml-rust2",
 ]
 
@@ -613,15 +281,6 @@ dependencies = [
  "tiny-keccak",
 ]
 
-[[package]]
-name = "const_panic"
-version = "0.2.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e262cdaac42494e3ae34c43969f9cdeb7da178bdb4b66fa6a1ea2edb4c8ae652"
-dependencies = [
- "typewit",
-]
-
 [[package]]
 name = "convert_case"
 version = "0.6.0"
@@ -640,15 +299,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "cpufeatures"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "crc"
 version = "3.4.0"
@@ -664,34 +314,6 @@ version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
 
-[[package]]
-name = "crc32fast"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "crossbeam-deque"
-version = "0.8.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5181e0de7b61eb03a81e347d6dd8797bae9da5146707b51077e2d71a54ec0ceb"
-dependencies = [
- "crossbeam-epoch",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-epoch"
-version = "0.9.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
-dependencies = [
- "crossbeam-utils",
-]
-
 [[package]]
 name = "crossbeam-queue"
 version = "0.3.13"
@@ -720,7 +342,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array",
- "rand_core 0.6.4",
  "typenum",
 ]
 
@@ -731,12 +352,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.2.17",
+ "cpufeatures",
  "curve25519-dalek-derive",
  "digest",
  "fiat-crypto",
  "rustc_version",
- "serde",
  "subtle",
  "zeroize",
 ]
@@ -752,18 +372,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "data-encoding"
-version = "2.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
-
-[[package]]
-name = "date_header"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c03c416ed1a30fbb027ef484ba6ab6f80e1eada675e1a2b92fd673c045a1f1d"
-
 [[package]]
 name = "der"
 version = "0.7.10"
@@ -771,53 +379,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
  "const-oid",
- "der_derive",
- "flagset",
  "pem-rfc7468",
  "zeroize",
 ]
 
 [[package]]
-name = "der-parser"
-version = "9.0.0"
+name = "digest"
+version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cd0a5c643689626bec213c4d8bd4d96acc8ffdb4ad4bb6bc16abf27d5f4b553"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
- "asn1-rs",
- "displaydoc",
- "nom 7.1.3",
- "num-bigint",
- "num-traits",
- "rusticata-macros",
-]
-
-[[package]]
-name = "der_derive"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8034092389675178f570469e6c3b0465d3d30b4505c294a6550db47f3c17ad18"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "deranged"
-version = "0.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
-
-[[package]]
-name = "digest"
-version = "0.10.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
-dependencies = [
- "block-buffer",
- "const-oid",
- "crypto-common",
- "subtle",
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
+ "subtle",
 ]
 
 [[package]]
@@ -859,7 +434,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
  "pkcs8",
- "serde",
  "signature",
 ]
 
@@ -871,7 +445,7 @@ checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
 dependencies = [
  "curve25519-dalek",
  "ed25519",
- "rand_core 0.6.4",
+ "rand_core",
  "serde",
  "sha2",
  "subtle",
@@ -896,26 +470,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "equator"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4711b213838dfee0117e3be6ac926007d7f433d7bbe33595975d4190cb07e6fc"
-dependencies = [
- "equator-macro",
-]
-
-[[package]]
-name = "equator-macro"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44f23cf4b44bfce11a86ace86f8a73ffdec849c9fd00a386a53d278bd9e81fb3"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -965,36 +519,6 @@ dependencies = [
  "pin-project-lite",
 ]
 
-[[package]]
-name = "exr"
-version = "1.74.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4300e043a56aa2cb633c01af81ca8f699a321879a7854d3896a0ba89056363be"
-dependencies = [
- "bit_field",
- "half",
- "lebe",
- "miniz_oxide",
- "rayon-core",
- "smallvec",
- "zune-inflate",
-]
-
-[[package]]
-name = "fax"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caf1079563223d5d59d83c85886a56e586cfd5c1a26292e971a0fa266531ac5a"
-
-[[package]]
-name = "fdeflate"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
-dependencies = [
- "simd-adler32",
-]
-
 [[package]]
 name = "fiat-crypto"
 version = "0.2.9"
@@ -1007,22 +531,6 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
-[[package]]
-name = "flagset"
-version = "0.4.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7ac824320a75a52197e8f2d787f6a38b6718bb6897a35142d749af3c0e8f4fe"
-
-[[package]]
-name = "flate2"
-version = "1.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
-dependencies = [
- "crc32fast",
- "miniz_oxide",
-]
-
 [[package]]
 name = "flume"
 version = "0.11.1"
@@ -1046,21 +554,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
-[[package]]
-name = "foreign-types"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
-dependencies = [
- "foreign-types-shared",
-]
-
-[[package]]
-name = "foreign-types-shared"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
-
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -1070,12 +563,6 @@ dependencies = [
  "percent-encoding",
 ]
 
-[[package]]
-name = "fs_extra"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
-
 [[package]]
 name = "futures-channel"
 version = "0.3.32"
@@ -1164,10 +651,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 dependencies = [
  "cfg-if",
- "js-sys",
  "libc",
  "wasi",
- "wasm-bindgen",
 ]
 
 [[package]]
@@ -1189,21 +674,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
- "js-sys",
  "libc",
  "r-efi 6.0.0",
- "rand_core 0.10.1",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "gif"
-version = "0.14.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee8cfcc411d9adbbaba82fb72661cc1bcca13e8bba98b364e62b2dba8f960159"
-dependencies = [
- "color_quant",
- "weezl",
 ]
 
 [[package]]
@@ -1212,17 +684,6 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
-[[package]]
-name = "half"
-version = "2.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
-dependencies = [
- "cfg-if",
- "crunchy",
- "zerocopy",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.14.5"
@@ -1375,23 +836,6 @@ dependencies = [
  "pin-project-lite",
  "smallvec",
  "tokio",
- "want",
-]
-
-[[package]]
-name = "hyper-rustls"
-version = "0.27.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
-dependencies = [
- "http",
- "hyper",
- "hyper-util",
- "rustls",
- "tokio",
- "tokio-rustls",
- "tower-service",
- "webpki-roots 1.0.8",
 ]
 
 [[package]]
@@ -1400,21 +844,13 @@ version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
- "base64 0.22.1",
  "bytes",
- "futures-channel",
- "futures-util",
  "http",
  "http-body",
  "hyper",
- "ipnet",
- "libc",
- "percent-encoding",
  "pin-project-lite",
- "socket2 0.6.4",
  "tokio",
  "tower-service",
- "tracing",
 ]
 
 [[package]]
@@ -1520,46 +956,6 @@ dependencies = [
  "icu_properties",
 ]
 
-[[package]]
-name = "image"
-version = "0.25.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85ab80394333c02fe689eaf900ab500fbd0c2213da414687ebf995a65d5a6104"
-dependencies = [
- "bytemuck",
- "byteorder-lite",
- "color_quant",
- "exr",
- "gif",
- "image-webp",
- "moxcms",
- "num-traits",
- "png",
- "qoi",
- "ravif",
- "rayon",
- "rgb",
- "tiff",
- "zune-core",
- "zune-jpeg",
-]
-
-[[package]]
-name = "image-webp"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "525e9ff3e1a4be2fbea1fdf0e98686a6d98b4d8f937e1bf7402245af1909e8c3"
-dependencies = [
- "byteorder-lite",
- "quick-error",
-]
-
-[[package]]
-name = "imgref"
-version = "1.12.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89194689a993ab15268672e99e7b0e19da2da3268ac682e8f02d29d4d1434cd7"
-
 [[package]]
 name = "indexmap"
 version = "2.14.0"
@@ -1568,37 +964,8 @@ checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
  "hashbrown 0.17.1",
- "serde",
- "serde_core",
-]
-
-[[package]]
-name = "inout"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
-dependencies = [
- "block-padding",
- "generic-array",
-]
-
-[[package]]
-name = "interpolate_name"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c34819042dc3d3971c46c2190835914dfbe0c3c13f61449b2997f4e9722dfa60"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
 ]
 
-[[package]]
-name = "ipnet"
-version = "2.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
-
 [[package]]
 name = "itertools"
 version = "0.13.0"
@@ -1608,15 +975,6 @@ dependencies = [
  "either",
 ]
 
-[[package]]
-name = "itertools"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
-dependencies = [
- "either",
-]
-
 [[package]]
 name = "itoa"
 version = "1.0.18"
@@ -1644,24 +1002,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "js_int"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d937f95470b270ce8b8950207715d71aa8e153c0d44c6684d59397ed4949160a"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "js_option"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68421373957a1593a767013698dbf206e2b221eefe97a44d98d18672ff38423c"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "json5"
 version = "0.4.1"
@@ -1673,26 +1013,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "konst"
-version = "0.3.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97feab15b395d1860944abe6a8dd8ed9f8eadfae01750fada8427abda531d887"
-dependencies = [
- "const_panic",
- "konst_kernel",
- "typewit",
-]
-
-[[package]]
-name = "konst_kernel"
-version = "0.3.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e4b1eb7788f3824c629b1116a7a9060d6e898c358ebff59070093d51103dcc3c"
-dependencies = [
- "typewit",
-]
-
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -1702,28 +1022,12 @@ dependencies = [
  "spin",
 ]
 
-[[package]]
-name = "lebe"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a79a3332a6609480d7d0c9eab957bca6b455b91bb84e66d19f5ff66294b85b8"
-
 [[package]]
 name = "libc"
 version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
-[[package]]
-name = "libfuzzer-sys"
-version = "0.4.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9fd2f41a1cba099f79a0b6b6c35656cf7c03351a7bae8ff0f28f25270f929d2"
-dependencies = [
- "arbitrary",
- "cc",
-]
-
 [[package]]
 name = "libm"
 version = "0.2.16"
@@ -1773,27 +1077,6 @@ version = "0.4.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
-[[package]]
-name = "loop9"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fae87c125b03c1d2c0150c90365d7d6bcc53fb73a9acaef207d2d065860f062"
-dependencies = [
- "imgref",
-]
-
-[[package]]
-name = "lru-slab"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
-
-[[package]]
-name = "maplit"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d"
-
 [[package]]
 name = "matchers"
 version = "0.2.0"
@@ -1809,38 +1092,6 @@ version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
 
-[[package]]
-name = "matrix-pickle"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3d65d46b7379dd0afa4a42f9b2269821d31afdee0111b5e0d74e3bee03553a0"
-dependencies = [
- "matrix-pickle-derive",
- "thiserror 2.0.18",
-]
-
-[[package]]
-name = "matrix-pickle-derive"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "414b5e4c34009f2bc3fe35dd018f25755ca38858096574841c7332f99e2c7e77"
-dependencies = [
- "proc-macro-crate",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "maybe-rayon"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ea1f30cedd69f0a2954655f7188c6a834246d2bcf1e315e2ac40c4b24dc9519"
-dependencies = [
- "cfg-if",
- "rayon",
-]
-
 [[package]]
 name = "md-5"
 version = "0.10.6"
@@ -1863,22 +1114,6 @@ version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
-[[package]]
-name = "minimal-lexical"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
-
-[[package]]
-name = "miniz_oxide"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
-dependencies = [
- "adler2",
- "simd-adler32",
-]
-
 [[package]]
 name = "mio"
 version = "1.2.1"
@@ -1890,56 +1125,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "moxcms"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb85c154ba489f01b25c0d36ae69a87e4a1c73a72631fc6c0eb6dde34a73e44b"
-dependencies = [
- "num-traits",
- "pxfm",
-]
-
-[[package]]
-name = "new_debug_unreachable"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
-
-[[package]]
-name = "no_std_io2"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "418abd1b6d34fbf6cae440dc874771b0525a604428704c76e48b29a5e67b8003"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "nom"
-version = "7.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
-dependencies = [
- "memchr",
- "minimal-lexical",
-]
-
-[[package]]
-name = "nom"
-version = "8.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "noop_proc_macro"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0676bb32a98c1a483ce53e500a81ad9c3d5b3f7c920c28c24e9cb0980d0b5bc8"
-
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -1970,28 +1155,11 @@ dependencies = [
  "num-integer",
  "num-iter",
  "num-traits",
- "rand 0.8.6",
+ "rand",
  "smallvec",
  "zeroize",
 ]
 
-[[package]]
-name = "num-conv"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
-
-[[package]]
-name = "num-derive"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "num-integer"
 version = "0.1.46"
@@ -2012,17 +1180,6 @@ dependencies = [
  "num-traits",
 ]
 
-[[package]]
-name = "num-rational"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
-dependencies = [
- "num-bigint",
- "num-integer",
- "num-traits",
-]
-
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -2033,64 +1190,12 @@ dependencies = [
  "libm",
 ]
 
-[[package]]
-name = "oid-registry"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8d8034d9489cdaf79228eb9f6a3b8d7bb32ba00d6645ebd48eef4077ceb5bd9"
-dependencies = [
- "asn1-rs",
-]
-
 [[package]]
 name = "once_cell"
 version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
-[[package]]
-name = "opaque-debug"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
-
-[[package]]
-name = "openssl"
-version = "0.10.81"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
-dependencies = [
- "bitflags",
- "cfg-if",
- "foreign-types",
- "libc",
- "openssl-macros",
- "openssl-sys",
-]
-
-[[package]]
-name = "openssl-macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "openssl-sys"
-version = "0.9.117"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
-dependencies = [
- "cc",
- "libc",
- "pkg-config",
- "vcpkg",
-]
-
 [[package]]
 name = "ordered-multimap"
 version = "0.7.3"
@@ -2137,22 +1242,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
 dependencies = [
  "base64ct",
- "rand_core 0.6.4",
+ "rand_core",
  "subtle",
 ]
 
-[[package]]
-name = "paste"
-version = "1.0.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
-
-[[package]]
-name = "pastey"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35fb2e5f958ec131621fdd531e9fc186ed768cbe395337403ae56c17a74c68ec"
-
 [[package]]
 name = "pathdiff"
 version = "0.2.3"
@@ -2233,17 +1326,6 @@ dependencies = [
  "spki",
 ]
 
-[[package]]
-name = "pkcs7"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d79178be066405e0602bf3035946edef6b11b3f9dde46dfe5f8bfd7dea4b77e7"
-dependencies = [
- "der",
- "spki",
- "x509-cert",
-]
-
 [[package]]
 name = "pkcs8"
 version = "0.10.2"
@@ -2266,30 +1348,6 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
-[[package]]
-name = "png"
-version = "0.18.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
-dependencies = [
- "bitflags",
- "crc32fast",
- "fdeflate",
- "flate2",
- "miniz_oxide",
-]
-
-[[package]]
-name = "poly1305"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
-dependencies = [
- "cpufeatures 0.2.17",
- "opaque-debug",
- "universal-hash",
-]
-
 [[package]]
 name = "potential_utf"
 version = "0.1.5"
@@ -2299,12 +1357,6 @@ dependencies = [
  "zerovec",
 ]
 
-[[package]]
-name = "powerfmt"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
-
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
@@ -2341,321 +1393,68 @@ dependencies = [
 
 [[package]]
 name = "pqcrypto-traits"
-version = "0.3.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94e851c7654eed9e68d7d27164c454961a616cf8c203d500607ef22c737b51bb"
-
-[[package]]
-name = "proc-macro-crate"
-version = "3.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
-dependencies = [
- "toml_edit 0.25.12+spec-1.1.0",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.106"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "profiling"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d595e54a326bc53c1c197b32d295e14b169e3cfeaa8dc82b529f947fba6bcf5"
-dependencies = [
- "profiling-procmacros",
-]
-
-[[package]]
-name = "profiling-procmacros"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4488a4a36b9a4ba6b9334a32a39971f77c1436ec82c38707bce707699cc3bbcb"
-dependencies = [
- "quote",
- "syn",
-]
-
-[[package]]
-name = "prost"
-version = "0.13.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2796faa41db3ec313a31f7624d9286acf277b52de526150b7e69f3debf891ee5"
-dependencies = [
- "bytes",
- "prost-derive",
-]
-
-[[package]]
-name = "prost-derive"
-version = "0.13.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
-dependencies = [
- "anyhow",
- "itertools 0.14.0",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "pxfm"
-version = "0.1.30"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d55d956fa96f5ec02be2e13af0e20391a5aa83d6a074e3ad368959d0fab299ea"
-
-[[package]]
-name = "qoi"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f6d64c71eb498fe9eae14ce4ec935c555749aef511cca85b5568910d6e48001"
-dependencies = [
- "bytemuck",
-]
-
-[[package]]
-name = "quick-error"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
-
-[[package]]
-name = "quinn"
-version = "0.11.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
-dependencies = [
- "bytes",
- "cfg_aliases",
- "pin-project-lite",
- "quinn-proto",
- "quinn-udp",
- "rustc-hash",
- "rustls",
- "socket2 0.6.4",
- "thiserror 2.0.18",
- "tokio",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-proto"
-version = "0.11.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
-dependencies = [
- "bytes",
- "getrandom 0.4.3",
- "lru-slab",
- "rand 0.10.2",
- "rand_pcg",
- "ring",
- "rustc-hash",
- "rustls",
- "rustls-pki-types",
- "slab",
- "thiserror 2.0.18",
- "tinyvec",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-udp"
-version = "0.5.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694"
-dependencies = [
- "cfg_aliases",
- "libc",
- "once_cell",
- "socket2 0.6.4",
- "tracing",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.46"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "r-efi"
-version = "5.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
-
-[[package]]
-name = "r-efi"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
-
-[[package]]
-name = "rand"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
-dependencies = [
- "libc",
- "rand_chacha 0.3.1",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
-dependencies = [
- "rand_chacha 0.9.0",
- "rand_core 0.9.5",
-]
-
-[[package]]
-name = "rand"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
-dependencies = [
- "chacha20 0.10.1",
- "getrandom 0.4.3",
- "rand_core 0.10.1",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.9.5",
-]
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94e851c7654eed9e68d7d27164c454961a616cf8c203d500607ef22c737b51bb"
 
 [[package]]
-name = "rand_core"
-version = "0.6.4"
+name = "proc-macro2"
+version = "1.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
 dependencies = [
- "getrandom 0.2.17",
+ "unicode-ident",
 ]
 
 [[package]]
-name = "rand_core"
-version = "0.9.5"
+name = "quote"
+version = "1.0.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
 dependencies = [
- "getrandom 0.3.4",
+ "proc-macro2",
 ]
 
 [[package]]
-name = "rand_core"
-version = "0.10.1"
+name = "r-efi"
+version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
 [[package]]
-name = "rand_pcg"
-version = "0.10.2"
+name = "r-efi"
+version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
-dependencies = [
- "rand_core 0.10.1",
-]
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
-name = "rav1e"
-version = "0.8.1"
+name = "rand"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43b6dd56e85d9483277cde964fd1bdb0428de4fec5ebba7540995639a21cb32b"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
 dependencies = [
- "aligned-vec",
- "arbitrary",
- "arg_enum_proc_macro",
- "arrayvec",
- "av-scenechange",
- "av1-grain",
- "bitstream-io",
- "built",
- "cfg-if",
- "interpolate_name",
- "itertools 0.14.0",
  "libc",
- "libfuzzer-sys",
- "log",
- "maybe-rayon",
- "new_debug_unreachable",
- "noop_proc_macro",
- "num-derive",
- "num-traits",
- "paste",
- "profiling",
- "rand 0.9.4",
- "rand_chacha 0.9.0",
- "simd_helpers",
- "thiserror 2.0.18",
- "v_frame",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "ravif"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e52310197d971b0f5be7fe6b57530dcd27beb35c1b013f29d66c1ad73fbbcc45"
-dependencies = [
- "avif-serialize",
- "imgref",
- "loop9",
- "quick-error",
- "rav1e",
- "rayon",
- "rgb",
+ "rand_chacha",
+ "rand_core",
 ]
 
 [[package]]
-name = "rayon"
-version = "1.12.0"
+name = "rand_chacha"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
- "either",
- "rayon-core",
+ "ppv-lite86",
+ "rand_core",
 ]
 
 [[package]]
-name = "rayon-core"
-version = "1.13.0"
+name = "rand_core"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "crossbeam-deque",
- "crossbeam-utils",
+ "getrandom 0.2.17",
 ]
 
 [[package]]
@@ -2669,7 +1468,7 @@ dependencies = [
  "bytes",
  "combine",
  "futures-util",
- "itertools 0.13.0",
+ "itertools",
  "itoa",
  "num-bigint",
  "percent-encoding",
@@ -2700,18 +1499,6 @@ dependencies = [
  "bitflags",
 ]
 
-[[package]]
-name = "regex"
-version = "1.12.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-automata",
- "regex-syntax",
-]
-
 [[package]]
 name = "regex-automata"
 version = "0.4.14"
@@ -2729,50 +1516,6 @@ version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
-[[package]]
-name = "reqwest"
-version = "0.12.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
-dependencies = [
- "base64 0.22.1",
- "bytes",
- "futures-core",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
- "hyper-rustls",
- "hyper-util",
- "js-sys",
- "log",
- "percent-encoding",
- "pin-project-lite",
- "quinn",
- "rustls",
- "rustls-pki-types",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper",
- "tokio",
- "tokio-rustls",
- "tower",
- "tower-http",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
- "webpki-roots 1.0.8",
-]
-
-[[package]]
-name = "rgb"
-version = "0.8.53"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47b34b781b31e5d73e9fbc8689c70551fd1ade9a19e3e28cfec8580a79290cc4"
-
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -2814,160 +1557,13 @@ dependencies = [
  "num-traits",
  "pkcs1",
  "pkcs8",
- "rand_core 0.6.4",
+ "rand_core",
  "signature",
  "spki",
  "subtle",
  "zeroize",
 ]
 
-[[package]]
-name = "ruma"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a555b3e7ca84892ef6e81eadb42c783b76ffb939d6ad9781a9da7023a501521"
-dependencies = [
- "assign",
- "js_int",
- "js_option",
- "ruma-client-api",
- "ruma-common",
- "ruma-events",
- "ruma-federation-api",
- "ruma-signatures",
- "web-time",
-]
-
-[[package]]
-name = "ruma-client-api"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7ec9d6b5fe002fc018b1daa36f888e80a670ffa7f7778d025e90478c0838ad"
-dependencies = [
- "as_variant",
- "assign",
- "bytes",
- "date_header",
- "http",
- "js_int",
- "js_option",
- "maplit",
- "ruma-common",
- "ruma-events",
- "serde",
- "serde_html_form",
- "serde_json",
- "thiserror 1.0.69",
- "web-time",
-]
-
-[[package]]
-name = "ruma-common"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ba97203cc4cab8dc10e62fe8156ae5c61d2553f37c3037759fbae601982fb7b"
-dependencies = [
- "as_variant",
- "base64 0.22.1",
- "bytes",
- "form_urlencoded",
- "http",
- "indexmap",
- "js_int",
- "konst",
- "percent-encoding",
- "regex",
- "ruma-identifiers-validation",
- "ruma-macros",
- "serde",
- "serde_html_form",
- "serde_json",
- "thiserror 1.0.69",
- "time",
- "tracing",
- "url",
- "web-time",
- "wildmatch",
-]
-
-[[package]]
-name = "ruma-events"
-version = "0.28.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fddef15eca0faee500016850a8473fb8c07b17b056b2ae5352ef67cf917102e3"
-dependencies = [
- "as_variant",
- "indexmap",
- "js_int",
- "js_option",
- "percent-encoding",
- "regex",
- "ruma-common",
- "ruma-identifiers-validation",
- "ruma-macros",
- "serde",
- "serde_json",
- "thiserror 1.0.69",
- "tracing",
- "url",
- "wildmatch",
-]
-
-[[package]]
-name = "ruma-federation-api"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea43deab72b76655e36305127894249e33f48696a5af3c8aa048dc42d772af45"
-dependencies = [
- "js_int",
- "ruma-common",
- "ruma-events",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "ruma-identifiers-validation"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fa38974f5901ed4e00e10aec57b9ad3b4d6d6c1a1ae683c51b88700b9f4ffba"
-dependencies = [
- "js_int",
- "thiserror 1.0.69",
-]
-
-[[package]]
-name = "ruma-macros"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d36857a3350ea611ecc9968dcc4f3d5a03227a6c3fcbb446e8530e3be8852282"
-dependencies = [
- "once_cell",
- "proc-macro-crate",
- "proc-macro2",
- "quote",
- "ruma-identifiers-validation",
- "serde",
- "syn",
- "toml 0.8.23",
-]
-
-[[package]]
-name = "ruma-signatures"
-version = "0.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d2bd9988e4434fb538eda8833bcb03ea680aaf50eae99db8deb5fe9959550a5"
-dependencies = [
- "base64 0.22.1",
- "ed25519-dalek",
- "pkcs8",
- "rand 0.8.6",
- "ruma-common",
- "serde_json",
- "sha2",
- "thiserror 1.0.69",
-]
-
 [[package]]
 name = "rust-ini"
 version = "0.21.3"
@@ -2978,12 +1574,6 @@ dependencies = [
  "ordered-multimap",
 ]
 
-[[package]]
-name = "rustc-hash"
-version = "2.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
-
 [[package]]
 name = "rustc_version"
 version = "0.4.1"
@@ -2993,23 +1583,12 @@ dependencies = [
  "semver",
 ]
 
-[[package]]
-name = "rusticata-macros"
-version = "4.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
-dependencies = [
- "nom 7.1.3",
-]
-
 [[package]]
 name = "rustls"
 version = "0.23.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
 dependencies = [
- "aws-lc-rs",
- "log",
  "once_cell",
  "ring",
  "rustls-pki-types",
@@ -3024,7 +1603,6 @@ version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046"
 dependencies = [
- "web-time",
  "zeroize",
 ]
 
@@ -3034,7 +1612,6 @@ version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
- "aws-lc-rs",
  "ring",
  "rustls-pki-types",
  "untrusted",
@@ -3086,26 +1663,6 @@ dependencies = [
  "typeid",
 ]
 
-[[package]]
-name = "serde_bytes"
-version = "0.11.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8"
-dependencies = [
- "serde",
- "serde_core",
-]
-
-[[package]]
-name = "serde_cbor_2"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34aec2709de9078e077090abd848e967abab63c9fb3fdb5d4799ad359d8d482c"
-dependencies = [
- "half",
- "serde",
-]
-
 [[package]]
 name = "serde_core"
 version = "1.0.228"
@@ -3126,19 +1683,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "serde_html_form"
-version = "0.2.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2f2d7ff8a2140333718bb329f5c40fc5f0865b84c426183ce14c97d2ab8154f"
-dependencies = [
- "form_urlencoded",
- "indexmap",
- "itoa",
- "ryu",
- "serde_core",
-]
-
 [[package]]
 name = "serde_json"
 version = "1.0.150"
@@ -3163,15 +1707,6 @@ dependencies = [
  "serde_core",
 ]
 
-[[package]]
-name = "serde_spanned"
-version = "0.6.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "serde_spanned"
 version = "1.1.1"
@@ -3200,7 +1735,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.2.17",
+ "cpufeatures",
  "digest",
 ]
 
@@ -3217,7 +1752,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.2.17",
+ "cpufeatures",
  "digest",
 ]
 
@@ -3253,22 +1788,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
  "digest",
- "rand_core 0.6.4",
-]
-
-[[package]]
-name = "simd-adler32"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
-
-[[package]]
-name = "simd_helpers"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95890f873bec569a0362c235787f3aca6e1e887302ba4840839bcc6459c42da6"
-dependencies = [
- "quote",
+ "rand_core",
 ]
 
 [[package]]
@@ -3344,7 +1864,7 @@ version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee6798b1838b6a0f69c007c133b8df5866302197e404e8b6ee8ed3e3a5e68dc6"
 dependencies = [
- "base64 0.22.1",
+ "base64",
  "bytes",
  "crc",
  "crossbeam-queue",
@@ -3419,7 +1939,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aa003f0038df784eb8fecbbac13affe3da23b45194bd57dba231c8f48199c526"
 dependencies = [
  "atoi",
- "base64 0.22.1",
+ "base64",
  "bitflags",
  "byteorder",
  "bytes",
@@ -3441,7 +1961,7 @@ dependencies = [
  "memchr",
  "once_cell",
  "percent-encoding",
- "rand 0.8.6",
+ "rand",
  "rsa",
  "serde",
  "sha1",
@@ -3461,7 +1981,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "db58fcd5a53cf07c184b154801ff91347e4c30d17a3562a635ff028ad5deda46"
 dependencies = [
  "atoi",
- "base64 0.22.1",
+ "base64",
  "bitflags",
  "byteorder",
  "crc",
@@ -3479,7 +1999,7 @@ dependencies = [
  "md-5",
  "memchr",
  "once_cell",
- "rand 0.8.6",
+ "rand",
  "serde",
  "serde_json",
  "sha2",
@@ -3554,9 +2074,6 @@ name = "sync_wrapper"
 version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
-dependencies = [
- "futures-core",
-]
 
 [[package]]
 name = "synstructure"
@@ -3618,50 +2135,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "tiff"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b63feaf3343d35b6ca4d50483f94843803b0f51634937cc2ec519fc32232bc52"
-dependencies = [
- "fax",
- "flate2",
- "half",
- "quick-error",
- "weezl",
- "zune-jpeg",
-]
-
-[[package]]
-name = "time"
-version = "0.3.53"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18dfaaeddcb932337b5e7866ee7d0ce9b76d2fd092997146f187ec09b4558a50"
-dependencies = [
- "deranged",
- "num-conv",
- "powerfmt",
- "serde_core",
- "time-core",
- "time-macros",
-]
-
-[[package]]
-name = "time-core"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
-
-[[package]]
-name = "time-macros"
-version = "0.2.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c431b87111666e491a90baa837f914fb45cd5dc3c268591b0220ff5057f2085f"
-dependencies = [
- "num-conv",
- "time-core",
-]
-
 [[package]]
 name = "tiny-keccak"
 version = "2.0.2"
@@ -3721,17 +2194,7 @@ checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
-]
-
-[[package]]
-name = "tokio-rustls"
-version = "0.26.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
-dependencies = [
- "rustls",
- "tokio",
+ "syn",
 ]
 
 [[package]]
@@ -3745,17 +2208,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "tokio-test"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f6d24790a10a7af737693a3e8f1d03faef7e6ca0cc99aae5066f533766de545"
-dependencies = [
- "futures-core",
- "tokio",
- "tokio-stream",
-]
-
 [[package]]
 name = "tokio-util"
 version = "0.7.18"
@@ -3769,18 +2221,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "toml"
-version = "0.8.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
-dependencies = [
- "serde",
- "serde_spanned 0.6.9",
- "toml_datetime 0.6.11",
- "toml_edit 0.22.27",
-]
-
 [[package]]
 name = "toml"
 version = "1.1.2+spec-1.1.0"
@@ -3788,19 +2228,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "81f3d15e84cbcd896376e6730314d59fb5a87f31e4b038454184435cd57defee"
 dependencies = [
  "serde_core",
- "serde_spanned 1.1.1",
- "toml_datetime 1.1.1+spec-1.1.0",
+ "serde_spanned",
+ "toml_datetime",
  "toml_parser",
- "winnow 1.0.3",
-]
-
-[[package]]
-name = "toml_datetime"
-version = "0.6.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
-dependencies = [
- "serde",
+ "winnow",
 ]
 
 [[package]]
@@ -3812,38 +2243,13 @@ dependencies = [
  "serde_core",
 ]
 
-[[package]]
-name = "toml_edit"
-version = "0.22.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
-dependencies = [
- "indexmap",
- "serde",
- "serde_spanned 0.6.9",
- "toml_datetime 0.6.11",
- "winnow 0.7.15",
-]
-
-[[package]]
-name = "toml_edit"
-version = "0.25.12+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2153edc6955a6c354fad8f5efd38b6a8769bdccf9fe50f8e1329f81b0baa5d7"
-dependencies = [
- "indexmap",
- "toml_datetime 1.1.1+spec-1.1.0",
- "toml_parser",
- "winnow 1.0.3",
-]
-
 [[package]]
 name = "toml_parser"
 version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
 dependencies = [
- "winnow 1.0.3",
+ "winnow",
 ]
 
 [[package]]
@@ -3870,15 +2276,12 @@ checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
  "bitflags",
  "bytes",
- "futures-util",
  "http",
  "http-body",
  "pin-project-lite",
- "tower",
  "tower-layer",
  "tower-service",
  "tracing",
- "url",
 ]
 
 [[package]]
@@ -3955,12 +2358,6 @@ dependencies = [
  "tracing-log",
 ]
 
-[[package]]
-name = "try-lock"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
-
 [[package]]
 name = "typeid"
 version = "1.0.3"
@@ -3973,21 +2370,6 @@ version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
-[[package]]
-name = "typewit"
-version = "1.15.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "214ca0b2191785cbc06209b9ca1861e048e39b5ba33574b3cedd58363d5bb5f6"
-dependencies = [
- "typewit_proc_macros",
-]
-
-[[package]]
-name = "typewit_proc_macros"
-version = "1.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e36a83ea2b3c704935a01b4642946aadd445cea40b10935e3f8bd8052b8193d6"
-
 [[package]]
 name = "ucd-trie"
 version = "0.1.7"
@@ -4027,16 +2409,6 @@ version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
 
-[[package]]
-name = "universal-hash"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
-dependencies = [
- "crypto-common",
- "subtle",
-]
-
 [[package]]
 name = "untrusted"
 version = "0.9.0"
@@ -4053,7 +2425,6 @@ dependencies = [
  "idna",
  "percent-encoding",
  "serde",
- "serde_derive",
 ]
 
 [[package]]
@@ -4070,18 +2441,6 @@ checksum = "bf80a72845275afea99e7f2b434723d3bc7e38470fcd1c7ed39a599c73319a53"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",
- "serde_core",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "v_frame"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "666b7727c8875d6ab5db9533418d7c764233ac9c0cff1d469aec8fa127597be2"
-dependencies = [
- "aligned-vec",
- "num-traits",
  "wasm-bindgen",
 ]
 
@@ -4091,62 +2450,22 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
-[[package]]
-name = "vauxl-admin"
-version = "0.1.0"
-dependencies = [
- "axum",
- "serde",
- "sqlx",
- "thiserror 1.0.69",
- "tokio",
- "vauxl-identity",
-]
-
 [[package]]
 name = "vauxl-crypto"
 version = "0.1.0"
 dependencies = [
- "base64 0.22.1",
+ "base64",
  "ed25519-dalek",
  "hkdf",
  "pqcrypto-mlkem",
  "pqcrypto-traits",
- "rand 0.8.6",
+ "rand",
  "sha2",
  "thiserror 1.0.69",
- "tokio-test",
- "vodozemac",
  "x25519-dalek",
  "zeroize",
 ]
 
-[[package]]
-name = "vauxl-federation"
-version = "0.1.0"
-dependencies = [
- "axum",
- "reqwest",
- "ruma",
- "serde",
- "sqlx",
- "thiserror 1.0.69",
- "tokio",
- "tracing",
-]
-
-[[package]]
-name = "vauxl-identity"
-version = "0.1.0"
-dependencies = [
- "argon2",
- "serde",
- "sqlx",
- "thiserror 1.0.69",
- "tokio",
- "webauthn-rs",
-]
-
 [[package]]
 name = "vauxl-matrix"
 version = "0.1.0"
@@ -4154,12 +2473,11 @@ dependencies = [
  "anyhow",
  "argon2",
  "axum",
- "base64 0.22.1",
+ "base64",
  "ed25519-dalek",
  "hex",
- "rand 0.8.6",
+ "rand",
  "redis",
- "ruma",
  "serde",
  "serde_json",
  "serde_urlencoded",
@@ -4167,49 +2485,20 @@ dependencies = [
  "sqlx",
  "thiserror 1.0.69",
  "tokio",
- "tokio-test",
  "tracing",
  "uuid",
 ]
 
-[[package]]
-name = "vauxl-media"
-version = "0.1.0"
-dependencies = [
- "axum",
- "image",
- "serde",
- "sqlx",
- "thiserror 1.0.69",
- "tokio",
-]
-
-[[package]]
-name = "vauxl-push"
-version = "0.1.0"
-dependencies = [
- "serde",
- "thiserror 1.0.69",
- "tokio",
-]
-
 [[package]]
 name = "vauxl-server"
 version = "0.1.0"
 dependencies = [
  "anyhow",
  "axum",
- "base64 0.22.1",
  "config",
- "ed25519-dalek",
- "rand 0.8.6",
  "redis",
- "serde",
- "serde_json",
  "sqlx",
- "thiserror 1.0.69",
  "tokio",
- "tokio-rustls",
  "tower-http",
  "tracing",
  "tracing-subscriber",
@@ -4228,46 +2517,6 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
-[[package]]
-name = "vodozemac"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "051d4af70b53b42adf2aac459a305851b8d754f210aaf11ab509e1065beff422"
-dependencies = [
- "aes",
- "arrayvec",
- "base64 0.22.1",
- "base64ct",
- "cbc",
- "chacha20poly1305",
- "curve25519-dalek",
- "ed25519-dalek",
- "getrandom 0.2.17",
- "hkdf",
- "hmac",
- "matrix-pickle",
- "pkcs7",
- "prost",
- "rand 0.8.6",
- "serde",
- "serde_bytes",
- "serde_json",
- "sha2",
- "subtle",
- "thiserror 1.0.69",
- "x25519-dalek",
- "zeroize",
-]
-
-[[package]]
-name = "want"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
-dependencies = [
- "try-lock",
-]
-
 [[package]]
 name = "wasi"
 version = "0.11.1+wasi-snapshot-preview1"
@@ -4302,16 +2551,6 @@ dependencies = [
  "wasm-bindgen-shared",
 ]
 
-[[package]]
-name = "wasm-bindgen-futures"
-version = "0.4.76"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
 [[package]]
 name = "wasm-bindgen-macro"
 version = "0.2.126"
@@ -4344,94 +2583,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "web-sys"
-version = "0.3.103"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "web-time"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "webauthn-attestation-ca"
-version = "0.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6475c0bbd1a3f04afaa3e98880408c5be61680c5e6bd3c6f8c250990d5d3e18e"
-dependencies = [
- "base64urlsafedata",
- "openssl",
- "openssl-sys",
- "serde",
- "tracing",
- "uuid",
-]
-
-[[package]]
-name = "webauthn-rs"
-version = "0.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c548915e0e92ee946bbf2aecf01ea21bef53d974b0793cc6732ba81a03fc422"
-dependencies = [
- "base64urlsafedata",
- "serde",
- "tracing",
- "url",
- "uuid",
- "webauthn-rs-core",
-]
-
-[[package]]
-name = "webauthn-rs-core"
-version = "0.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "296d2d501feb715d80b8e186fb88bab1073bca17f460303a1013d17b673bea6a"
-dependencies = [
- "base64 0.21.7",
- "base64urlsafedata",
- "der-parser",
- "hex",
- "nom 7.1.3",
- "openssl",
- "openssl-sys",
- "rand 0.9.4",
- "rand_chacha 0.9.0",
- "serde",
- "serde_cbor_2",
- "serde_json",
- "thiserror 1.0.69",
- "tracing",
- "url",
- "uuid",
- "webauthn-attestation-ca",
- "webauthn-rs-proto",
- "x509-parser",
-]
-
-[[package]]
-name = "webauthn-rs-proto"
-version = "0.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c37393beac9c1ed1ca6dbb30b1e01783fb316ab3a45d90ecd48c99052dd7ef1e"
-dependencies = [
- "base64 0.21.7",
- "base64urlsafedata",
- "serde",
- "serde_json",
- "url",
-]
-
 [[package]]
 name = "webpki-roots"
 version = "0.26.11"
@@ -4450,12 +2601,6 @@ dependencies = [
  "rustls-pki-types",
 ]
 
-[[package]]
-name = "weezl"
-version = "0.1.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a28ac98ddc8b9274cb41bb4d9d4d5c425b6020c50c46f25559911905610b4a88"
-
 [[package]]
 name = "whoami"
 version = "1.6.1"
@@ -4466,12 +2611,6 @@ dependencies = [
  "wasite",
 ]
 
-[[package]]
-name = "wildmatch"
-version = "2.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29333c3ea1ba8b17211763463ff24ee84e41c78224c16b001cd907e663a38c68"
-
 [[package]]
 name = "windows-link"
 version = "0.2.1"
@@ -4626,15 +2765,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "winnow"
-version = "0.7.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "winnow"
 version = "1.0.3"
@@ -4663,45 +2793,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
 dependencies = [
  "curve25519-dalek",
- "rand_core 0.6.4",
+ "rand_core",
  "serde",
  "zeroize",
 ]
 
-[[package]]
-name = "x509-cert"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1301e935010a701ae5f8655edc0ad17c44bad3ac5ce8c39185f75453b720ae94"
-dependencies = [
- "const-oid",
- "der",
- "spki",
-]
-
-[[package]]
-name = "x509-parser"
-version = "0.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcbc162f30700d6f3f82a24bf7cc62ffe7caea42c0b2cba8bf7f3ae50cf51f69"
-dependencies = [
- "asn1-rs",
- "data-encoding",
- "der-parser",
- "lazy_static",
- "nom 7.1.3",
- "oid-registry",
- "rusticata-macros",
- "thiserror 1.0.69",
- "time",
-]
-
-[[package]]
-name = "y4m"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a5a4b21e1a62b67a2970e6831bc091d7b87e119e7f9791aef9702e3bef04448"
-
 [[package]]
 name = "yaml-rust2"
 version = "0.11.0"
@@ -4835,27 +2931,3 @@ name = "zmij"
 version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
-
-[[package]]
-name = "zune-core"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb8a0807f7c01457d0379ba880ba6322660448ddebc890ce29bb64da71fb40f9"
-
-[[package]]
-name = "zune-inflate"
-version = "0.2.54"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73ab332fe2f6680068f3582b16a24f90ad7096d5d39b974d1c0aff0125116f02"
-dependencies = [
- "simd-adler32",
-]
-
-[[package]]
-name = "zune-jpeg"
-version = "0.5.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27bc9d5b815bc103f142aa054f561d9187d191692ec7c2d1e2b4737f8dbd7296"
-dependencies = [
- "zune-core",
-]
diff --git a/Cargo.toml b/Cargo.toml
index a8aa6a7..ad90a6e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,12 +2,7 @@
 members = [
     "crates/vauxl-server",
     "crates/vauxl-matrix",
-    "crates/vauxl-federation",
-    "crates/vauxl-identity",
     "crates/vauxl-crypto",
-    "crates/vauxl-media",
-    "crates/vauxl-admin",
-    "crates/vauxl-push",
 ]
 resolver = "2"
 
@@ -15,14 +10,12 @@ resolver = "2"
 tokio              = { version = "1", features = ["full"] }
 axum               = { version = "0.7" }
 sqlx               = { version = "0.8", features = ["postgres", "runtime-tokio-rustls", "migrate"] }
-ruma               = { version = "0.10", features = ["client-api", "federation-api", "events"] }
 serde              = { version = "1", features = ["derive"] }
 serde_json         = { version = "1.0.150" }
 tracing            = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 thiserror          = "1"
 anyhow             = "1"
-tokio-test         = "0.4"
 redis = { version = "0.27.6", features = ["aio", "tokio-comp"] }
 
 [workspace.lints.rust]
diff --git a/crates/vauxl-admin/Cargo.toml b/crates/vauxl-admin/Cargo.toml
deleted file mode 100644
index dc26e80..0000000
--- a/crates/vauxl-admin/Cargo.toml
+++ /dev/null
@@ -1,13 +0,0 @@
-[package]
-name    = "vauxl-admin"
-version = "0.1.0"
-edition = "2021"
-license = "MIT OR Apache-2.0"
-
-[dependencies]
-tokio     = { workspace = true }
-axum      = { workspace = true }
-sqlx      = { workspace = true }
-serde     = { workspace = true }
-thiserror = { workspace = true }
-vauxl-identity = { path = "../vauxl-identity" }
diff --git a/crates/vauxl-admin/src/lib.rs b/crates/vauxl-admin/src/lib.rs
deleted file mode 100644
index b93cf3f..0000000
--- a/crates/vauxl-admin/src/lib.rs
+++ /dev/null
@@ -1,14 +0,0 @@
-pub fn add(left: u64, right: u64) -> u64 {
-    left + right
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn it_works() {
-        let result = add(2, 2);
-        assert_eq!(result, 4);
-    }
-}
diff --git a/crates/vauxl-crypto/Cargo.toml b/crates/vauxl-crypto/Cargo.toml
index ccb4a98..cc03d1f 100644
--- a/crates/vauxl-crypto/Cargo.toml
+++ b/crates/vauxl-crypto/Cargo.toml
@@ -5,9 +5,8 @@ edition = "2021"
 license = "MIT OR Apache-2.0"
 
 [dependencies]
-vodozemac       = "0.7"
 x25519-dalek    = { version = "2", features = ["static_secrets", "zeroize"] }
-ed25519-dalek   = "2"
+ed25519-dalek   = { version = "2", features = ["rand_core"] }
 sha2            = "0.10"
 hkdf            = "0.12"
 zeroize         = { version = "1", features = ["derive"] }
@@ -16,6 +15,3 @@ rand            = "0.8"
 base64          = "0.22"
 pqcrypto-mlkem = "0.1.1"
 pqcrypto-traits = "0.3.5"
-
-[dev-dependencies]
-tokio-test = { workspace = true }
diff --git a/crates/vauxl-federation/Cargo.toml b/crates/vauxl-federation/Cargo.toml
deleted file mode 100644
index 90dd2dc..0000000
--- a/crates/vauxl-federation/Cargo.toml
+++ /dev/null
@@ -1,15 +0,0 @@
-[package]
-name    = "vauxl-federation"
-version = "0.1.0"
-edition = "2021"
-license = "MIT OR Apache-2.0"
-
-[dependencies]
-tokio     = { workspace = true }
-axum      = { workspace = true }
-sqlx      = { workspace = true }
-ruma      = { workspace = true }
-serde     = { workspace = true }
-tracing   = { workspace = true }
-thiserror = { workspace = true }
-reqwest   = { version = "0.12", features = ["rustls-tls"], default-features = false }
diff --git a/crates/vauxl-federation/src/lib.rs b/crates/vauxl-federation/src/lib.rs
deleted file mode 100644
index b93cf3f..0000000
--- a/crates/vauxl-federation/src/lib.rs
+++ /dev/null
@@ -1,14 +0,0 @@
-pub fn add(left: u64, right: u64) -> u64 {
-    left + right
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn it_works() {
-        let result = add(2, 2);
-        assert_eq!(result, 4);
-    }
-}
diff --git a/crates/vauxl-identity/Cargo.toml b/crates/vauxl-identity/Cargo.toml
deleted file mode 100644
index b802de2..0000000
--- a/crates/vauxl-identity/Cargo.toml
+++ /dev/null
@@ -1,13 +0,0 @@
-[package]
-name    = "vauxl-identity"
-version = "0.1.0"
-edition = "2021"
-license = "MIT OR Apache-2.0"
-
-[dependencies]
-tokio       = { workspace = true }
-sqlx        = { workspace = true }
-serde       = { workspace = true }
-thiserror   = { workspace = true }
-argon2      = "0.5"
-webauthn-rs = "0.5"
diff --git a/crates/vauxl-identity/src/lib.rs b/crates/vauxl-identity/src/lib.rs
deleted file mode 100644
index b93cf3f..0000000
--- a/crates/vauxl-identity/src/lib.rs
+++ /dev/null
@@ -1,14 +0,0 @@
-pub fn add(left: u64, right: u64) -> u64 {
-    left + right
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn it_works() {
-        let result = add(2, 2);
-        assert_eq!(result, 4);
-    }
-}
diff --git a/crates/vauxl-matrix/Cargo.toml b/crates/vauxl-matrix/Cargo.toml
index ba3491a..f844574 100644
--- a/crates/vauxl-matrix/Cargo.toml
+++ b/crates/vauxl-matrix/Cargo.toml
@@ -8,13 +8,12 @@ license = "MIT OR Apache-2.0"
 tokio         = { workspace = true }
 axum          = { workspace = true }
 sqlx          = { workspace = true }
-ruma          = { workspace = true }
 serde         = { workspace = true }
 serde_json    = { workspace = true }
 tracing       = { workspace = true }
 thiserror     = { workspace = true }
 anyhow        = { workspace = true }
-ed25519-dalek = "2"
+ed25519-dalek = { version = "2", features = ["rand_core"] }
 rand          = "0.8"
 base64        = "0.22"
 hex           = "0.4"
@@ -23,6 +22,3 @@ uuid          = { version = "1", features = ["v4"] }
 sha2          = "0.10"
 serde_urlencoded = "0.7"
 redis = { workspace = true}
-
-[dev-dependencies]
-tokio-test = { workspace = true }
diff --git a/crates/vauxl-matrix/src/db/keys.rs b/crates/vauxl-matrix/src/db/keys.rs
index 36593b8..0e3d68a 100644
--- a/crates/vauxl-matrix/src/db/keys.rs
+++ b/crates/vauxl-matrix/src/db/keys.rs
@@ -66,9 +66,6 @@ pub async fn store_one_time_keys(
         stored += result.rows_affected() as u32;
     }
 
-    // Update the OTK count
-    update_otk_count(pool, user_id, device_id).await?;
-
     Ok(stored)
 }
 
@@ -104,35 +101,6 @@ pub async fn get_otk_counts(
     Ok(Value::Object(map))
 }
 
-async fn update_otk_count(
-    pool: &PgPool,
-    user_id: &str,
-    device_id: &str,
-) -> Result<(), MatrixError> {
-    // Recount and upsert into device_otk_counts
-    sqlx::query!(
-        r#"
-        INSERT INTO device_otk_counts (user_id, device_id, algorithm, count)
-        SELECT
-            $1, $2,
-            split_part(key_id, ':', 1),
-            COUNT(*)::int
-        FROM one_time_keys
-        WHERE user_id   = $1
-        AND   device_id = $2
-        AND   claimed   = FALSE
-        GROUP BY split_part(key_id, ':', 1)
-        ON CONFLICT (user_id, device_id, algorithm)
-        DO UPDATE SET count = EXCLUDED.count
-        "#,
-        user_id,
-        device_id,
-    )
-    .execute(pool)
-    .await?;
-    Ok(())
-}
-
 // ── Query ─────────────────────────────────────────────────────────────────
 
 /// Returns device keys for a list of users.
@@ -191,8 +159,5 @@ pub async fn claim_one_time_key(
     .fetch_optional(pool)
     .await?;
 
-    // Update count after claiming
-    update_otk_count(pool, user_id, device_id).await?;
-
     Ok(row.map(|r| (r.key_id, r.key_json)))
 }
diff --git a/crates/vauxl-matrix/src/db/sync.rs b/crates/vauxl-matrix/src/db/sync.rs
index 84ee400..3e08a08 100644
--- a/crates/vauxl-matrix/src/db/sync.rs
+++ b/crates/vauxl-matrix/src/db/sync.rs
@@ -5,14 +5,6 @@ use sqlx::PgPool;
 
 use crate::error::MatrixError;
 
-/// A room the user is a member of, with recent events.
-pub struct SyncRoom {
-    pub room_id: String,
-    pub membership: String,
-    pub state_events: Vec<Value>,
-    pub timeline: Vec<Value>,
-}
-
 /// Returns all rooms a user is currently joined or invited to.
 pub async fn get_user_rooms(
     pool: &PgPool,
@@ -37,26 +29,6 @@ pub async fn get_user_rooms(
         .collect())
 }
 
-/// Returns current state events for a room (m.room.create, m.room.name, etc.)
-pub async fn get_room_state(pool: &PgPool, room_id: &str) -> Result<Vec<Value>, MatrixError> {
-    let rows = sqlx::query!(
-        r#"
-        SELECT e.raw_event
-        FROM   room_state rs
-        JOIN   events e ON e.event_id = rs.event_id
-        WHERE  rs.room_id = $1
-        "#,
-        room_id,
-    )
-    .fetch_all(pool)
-    .await?;
-
-    Ok(rows
-        .into_iter()
-        .filter_map(|r| serde_json::from_value(r.raw_event).ok())
-        .collect())
-}
-
 /// Returns the most recent timeline events for a room (last 50).
 // 1. Wir definieren das Struct explizit für die Abfrage
 struct EventRow {
diff --git a/crates/vauxl-matrix/src/routes/client_info.rs b/crates/vauxl-matrix/src/routes/client_info.rs
index 5b8eb54..4278556 100644
--- a/crates/vauxl-matrix/src/routes/client_info.rs
+++ b/crates/vauxl-matrix/src/routes/client_info.rs
@@ -65,16 +65,6 @@ pub async fn get_push_rule(
     Err(MatrixError::NotFound)
 }
 
-/// GET /_matrix/client/v3/publicRooms
-pub async fn public_rooms() -> Json<Value> {
-    Json(json!({
-        "chunk":             [],
-        "total_room_count_estimate": 0,
-        "next_batch":        null,
-        "prev_batch":        null
-    }))
-}
-
 /// GET /_matrix/client/v3/user/{userId}/account_data/{type}
 pub async fn get_account_data(
     _auth: AuthenticatedUser,
@@ -162,14 +152,6 @@ pub async fn logout(
     State(state): State<SharedState>,
     auth: AuthenticatedUser,
 ) -> Result<Json<Value>, MatrixError> {
-    use sha2::{Digest, Sha256};
-    let hash = format!(
-        "{:x}",
-        Sha256::digest(
-            // We don't have the raw token here, but we can delete by user+device
-            auth.device_id.as_bytes()
-        )
-    );
     // Delete all tokens for this device
     sqlx::query!(
         "DELETE FROM access_tokens WHERE user_id = $1 AND device_id = $2",
@@ -179,7 +161,6 @@ pub async fn logout(
     .execute(&state.db)
     .await
     .map_err(MatrixError::from)?;
-    let _ = hash; // suppress warning
     Ok(Json(json!({})))
 }
 
@@ -232,23 +213,6 @@ pub async fn whoami(State(state): State<SharedState>, auth: AuthenticatedUser) -
     }))
 }
 
-/// POST /_matrix/client/v3/rooms/{roomId}/receipt/{receiptType}/{eventId}
-pub async fn send_receipt(
-    _auth: AuthenticatedUser,
-    Path((_room_id, _receipt_type, _event_id)): Path<(String, String, String)>,
-) -> Json<Value> {
-    Json(json!({}))
-}
-
-/// PUT /_matrix/client/v3/rooms/{roomId}/typing/{userId}
-pub async fn send_typing(
-    _auth: AuthenticatedUser,
-    Path((_room_id, _user_id)): Path<(String, String)>,
-    Json(_body): Json<Value>,
-) -> Json<Value> {
-    Json(json!({}))
-}
-
 /// GET /_matrix/client/v3/room_keys/version
 pub async fn room_keys_version(_auth: AuthenticatedUser) -> Result<Json<Value>, MatrixError> {
     Err(MatrixError::NotFound) // intentional — key backup not implemented yet
diff --git a/crates/vauxl-matrix/src/routes/login.rs b/crates/vauxl-matrix/src/routes/login.rs
index 65699e2..3ceb467 100644
--- a/crates/vauxl-matrix/src/routes/login.rs
+++ b/crates/vauxl-matrix/src/routes/login.rs
@@ -2,7 +2,7 @@
 //! GET  /_matrix/client/v3/login  (returns supported flows)
 
 use axum::{extract::State, Json};
-use serde::{Deserialize, Serialize};
+use serde::Deserialize;
 use serde_json::{json, Value};
 
 use crate::{
@@ -34,14 +34,6 @@ pub struct UserIdentifier {
     pub user: Option<String>, // local part or full MXID
 }
 
-#[derive(Debug, Serialize)]
-pub struct LoginResponse {
-    pub user_id: String,
-    pub access_token: String,
-    pub device_id: String,
-    pub home_server: String,
-}
-
 // ── Handlers ──────────────────────────────────────────────────────────────
 
 /// GET /_matrix/client/v3/login
diff --git a/crates/vauxl-matrix/src/routes/media.rs b/crates/vauxl-matrix/src/routes/media.rs
index e605685..d41eb03 100644
--- a/crates/vauxl-matrix/src/routes/media.rs
+++ b/crates/vauxl-matrix/src/routes/media.rs
@@ -108,14 +108,14 @@ pub async fn download_media(
     State(state): State<SharedState>,
     Path((server_name, media_id)): Path<(String, String)>,
 ) -> Result<Response, MatrixError> {
-    serve_media(&state, &server_name, &media_id, false).await
+    serve_media(&state, &server_name, &media_id).await
 }
 
 pub async fn download_media_with_name(
     State(state): State<SharedState>,
     Path((server_name, media_id, _filename)): Path<(String, String, String)>,
 ) -> Result<Response, MatrixError> {
-    serve_media(&state, &server_name, &media_id, false).await
+    serve_media(&state, &server_name, &media_id).await
 }
 
 #[derive(Debug, Deserialize)]
@@ -133,14 +133,13 @@ pub async fn thumbnail_media(
 ) -> Result<Response, MatrixError> {
     // For MVP: serve the original file as the thumbnail
     // Real thumbnail generation with the `image` crate can be added later
-    serve_media(&state, &server_name, &media_id, true).await
+    serve_media(&state, &server_name, &media_id).await
 }
 
 async fn serve_media(
     state: &SharedState,
     server_name: &str,
     media_id: &str,
-    _thumbnail: bool,
 ) -> Result<Response, MatrixError> {
     // Only serve media from our own server in MVP
     if server_name != state.config.server.server_name {
diff --git a/crates/vauxl-matrix/src/routes/rooms.rs b/crates/vauxl-matrix/src/routes/rooms.rs
index d10750c..dff54a1 100644
--- a/crates/vauxl-matrix/src/routes/rooms.rs
+++ b/crates/vauxl-matrix/src/routes/rooms.rs
@@ -15,7 +15,7 @@ use crate::{
         get_room_messages, put_room_event, put_room_state_event,
     },
     error::MatrixError,
-    state::{SharedState, WakeEvent},
+    state::SharedState,
 };
 
 #[derive(Debug, Deserialize, Default)]
@@ -142,9 +142,7 @@ pub async fn send_state_event(
     )
     .await?;
 
-    let _ = state.wake_tx.send(WakeEvent {
-        room_id: room_id.clone(),
-    });
+    let _ = state.wake_tx.send(());
     Ok(Json(json!({ "event_id": event_id })))
 }
 
@@ -168,9 +166,7 @@ pub async fn send_state_event_no_key(
     )
     .await?;
 
-    let _ = state.wake_tx.send(WakeEvent {
-        room_id: room_id.clone(),
-    });
+    let _ = state.wake_tx.send(());
     Ok(Json(json!({ "event_id": event_id })))
 }
 
@@ -201,9 +197,7 @@ pub async fn send_message_event(
     .await?;
 
     // Wake any long-polling /sync handlers for this room
-    let _ = state.wake_tx.send(WakeEvent {
-        room_id: room_id.clone(),
-    });
+    let _ = state.wake_tx.send(());
 
     tracing::debug!(room_id = %room_id, event_id = %event_id, "Message sent");
     Ok(Json(json!({ "event_id": event_id })))
diff --git a/crates/vauxl-matrix/src/routes/sync.rs b/crates/vauxl-matrix/src/routes/sync.rs
index 7c476a5..2cb06dd 100644
--- a/crates/vauxl-matrix/src/routes/sync.rs
+++ b/crates/vauxl-matrix/src/routes/sync.rs
@@ -12,8 +12,8 @@ use tokio::time::{sleep, Duration};
 use crate::{
     auth::AuthenticatedUser,
     db::{
-        pop_to_device_messages,
-        sync::{get_room_state, get_room_timeline, get_user_rooms},
+        get_full_room_state, pop_to_device_messages,
+        sync::{get_room_timeline, get_user_rooms},
     },
     error::MatrixError,
     routes::{
@@ -116,7 +116,7 @@ async fn build_joined_room(
     _user_id: &str,
     since: u64,
 ) -> Result<Value, MatrixError> {
-    let state_events = get_room_state(&state.db, room_id).await?;
+    let state_events = get_full_room_state(&state.db, room_id).await?;
     let timeline_events = get_room_timeline(&state.db, room_id, since).await?;
     let limited = false;
 
diff --git a/crates/vauxl-matrix/src/state.rs b/crates/vauxl-matrix/src/state.rs
index ecc53c8..5aa1c3b 100644
--- a/crates/vauxl-matrix/src/state.rs
+++ b/crates/vauxl-matrix/src/state.rs
@@ -4,13 +4,6 @@ use tokio::sync::broadcast;
 
 use crate::{config::AppConfig, signing_key::HomeserverSigningKey};
 
-/// Sent on the wake channel whenever a new event is stored.
-/// /sync subscribers wake immediately instead of waiting for timeout.
-#[derive(Debug, Clone)]
-pub struct WakeEvent {
-    pub room_id: String,
-}
-
 pub struct AppState {
     pub config: AppConfig,
     pub db: PgPool,
@@ -18,7 +11,7 @@ pub struct AppState {
     pub signing_key: HomeserverSigningKey,
     /// Broadcast channel — send here when an event is stored,
     /// /sync receivers wake immediately
-    pub wake_tx: broadcast::Sender<WakeEvent>,
+    pub wake_tx: broadcast::Sender<()>,
 }
 
 pub type SharedState = Arc<AppState>;
diff --git a/crates/vauxl-media/Cargo.toml b/crates/vauxl-media/Cargo.toml
deleted file mode 100644
index 524b42e..0000000
--- a/crates/vauxl-media/Cargo.toml
+++ /dev/null
@@ -1,13 +0,0 @@
-[package]
-name    = "vauxl-media"
-version = "0.1.0"
-edition = "2021"
-license = "MIT OR Apache-2.0"
-
-[dependencies]
-tokio     = { workspace = true }
-axum      = { workspace = true }
-sqlx      = { workspace = true }
-serde     = { workspace = true }
-thiserror = { workspace = true }
-image     = "0.25"
diff --git a/crates/vauxl-media/src/lib.rs b/crates/vauxl-media/src/lib.rs
deleted file mode 100644
index b93cf3f..0000000
--- a/crates/vauxl-media/src/lib.rs
+++ /dev/null
@@ -1,14 +0,0 @@
-pub fn add(left: u64, right: u64) -> u64 {
-    left + right
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn it_works() {
-        let result = add(2, 2);
-        assert_eq!(result, 4);
-    }
-}
diff --git a/crates/vauxl-push/Cargo.toml b/crates/vauxl-push/Cargo.toml
deleted file mode 100644
index d6cc883..0000000
--- a/crates/vauxl-push/Cargo.toml
+++ /dev/null
@@ -1,10 +0,0 @@
-[package]
-name    = "vauxl-push"
-version = "0.1.0"
-edition = "2021"
-license = "MIT OR Apache-2.0"
-
-[dependencies]
-tokio     = { workspace = true }
-serde     = { workspace = true }
-thiserror = { workspace = true }
diff --git a/crates/vauxl-push/src/lib.rs b/crates/vauxl-push/src/lib.rs
deleted file mode 100644
index b93cf3f..0000000
--- a/crates/vauxl-push/src/lib.rs
+++ /dev/null
@@ -1,14 +0,0 @@
-pub fn add(left: u64, right: u64) -> u64 {
-    left + right
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn it_works() {
-        let result = add(2, 2);
-        assert_eq!(result, 4);
-    }
-}
diff --git a/crates/vauxl-server/Cargo.toml b/crates/vauxl-server/Cargo.toml
index 794923e..24246a7 100644
--- a/crates/vauxl-server/Cargo.toml
+++ b/crates/vauxl-server/Cargo.toml
@@ -12,17 +12,10 @@ path = "src/main.rs"
 tokio              = { workspace = true }
 axum               = { workspace = true }
 sqlx               = { workspace = true }
-serde              = { workspace = true }
-serde_json         = { workspace = true }
 tracing            = { workspace = true }
 tracing-subscriber = { workspace = true }
 anyhow             = { workspace = true }
-thiserror          = { workspace = true }
 vauxl-matrix       = { path = "../vauxl-matrix" }
 config             = "0.15"
-tokio-rustls       = "0.26"
-ed25519-dalek      = "2"
-rand               = "0.8"
-base64             = "0.22"
 tower-http         = { version = "0.6", features = ["cors", "trace"] }
 redis = { workspace = true }
diff --git a/crates/vauxl-server/src/main.rs b/crates/vauxl-server/src/main.rs
index 8d35daa..6195cad 100644
--- a/crates/vauxl-server/src/main.rs
+++ b/crates/vauxl-server/src/main.rs
@@ -41,7 +41,7 @@ use vauxl_matrix::{
         versions::client_versions,
     },
     signing_key::HomeserverSigningKey,
-    state::{AppState, WakeEvent},
+    state::AppState,
     well_known::{federation_version, key_v2_server, well_known_client, well_known_server},
 };
 
@@ -86,7 +86,7 @@ async fn main() -> Result<()> {
     let signing_key = HomeserverSigningKey::load_or_generate(&cfg.signing_key.path)?;
 
     // ── Shared state ──────────────────────────────────────────────────────
-    let (wake_tx, _) = tokio::sync::broadcast::channel::<WakeEvent>(1024);
+    let (wake_tx, _) = tokio::sync::broadcast::channel::<()>(1024);
 
     let state = Arc::new(AppState {
         config: cfg.clone(),
diff --git a/scripts/check.sh b/scripts/check.sh
index 67e1d68..795fddf 100755
--- a/scripts/check.sh
+++ b/scripts/check.sh
@@ -1,279 +1,7 @@
 #!/usr/bin/env bash
-# =============================================================================
-# check.sh — Vauxl development quality gate
-#
-# Usage:
-#   ./scripts/check.sh           — run all checks, fix what can be auto-fixed
-#   ./scripts/check.sh --ci      — same flags as CI, no auto-fix (read-only)
-#   ./scripts/check.sh --fix     — auto-fix fmt + clippy, then run all checks
-#   ./scripts/check.sh --fast    — fmt + clippy only, skip tests and audit
-#
-# Place this file at: scripts/check.sh
-# Make executable:    chmod +x scripts/check.sh
-# =============================================================================
-
 set -euo pipefail
 
-# ── Colours ──────────────────────────────────────────────────────────────────
-RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'
-BLUE='\033[0;34m'; CYAN='\033[0;36m'; BOLD='\033[1m'; DIM='\033[2m'
-RESET='\033[0m'
-
-# ── State ────────────────────────────────────────────────────────────────────
-FAILED=()
-PASSED=()
-SKIPPED=()
-START_TIME=$(date +%s)
-
-# ── Flags ────────────────────────────────────────────────────────────────────
-CI_MODE=false
-FIX_MODE=false
-FAST_MODE=false
-
-for arg in "$@"; do
-  case "$arg" in
-    --ci)   CI_MODE=true  ;;
-    --fix)  FIX_MODE=true ;;
-    --fast) FAST_MODE=true ;;
-    --help)
-      echo "Usage: $0 [--ci] [--fix] [--fast]"
-      echo "  --ci    Read-only mode, same flags as GitHub Actions"
-      echo "  --fix   Auto-fix fmt + clippy before checking"
-      echo "  --fast  Only fmt + clippy (skip tests, audit, deny)"
-      exit 0
-      ;;
-  esac
-done
-
-# ── Helpers ───────────────────────────────────────────────────────────────────
-header() {
-  echo ""
-  echo -e "${BOLD}${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}"
-  echo -e "${BOLD}${BLUE}  $1${RESET}"
-  echo -e "${BOLD}${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}"
-}
-
-step() {
-  echo -e "\n${CYAN}▶ $1${RESET}"
-}
-
-ok() {
-  echo -e "${GREEN}  ✓ $1${RESET}"
-  PASSED+=("$1")
-}
-
-fail() {
-  echo -e "${RED}  ✗ $1${RESET}"
-  FAILED+=("$1")
-}
-
-skip() {
-  echo -e "${DIM}  ○ $1 (skipped)${RESET}"
-  SKIPPED+=("$1")
-}
-
-warn() {
-  echo -e "${YELLOW}  ⚠ $1${RESET}"
-}
-
-# Run a command, capture result, never exit early (we collect all failures)
-run_check() {
-  local name="$1"
-  shift
-  if "$@" 2>&1; then
-    ok "$name"
-    return 0
-  else
-    fail "$name"
-    return 1
-  fi
-}
-
-# ── Check that we're in the workspace root ────────────────────────────────────
-if [[ ! -f "Cargo.toml" ]] || ! grep -q "\[workspace\]" Cargo.toml 2>/dev/null; then
-  echo -e "${RED}Error: run this from the workspace root (where Cargo.toml is)${RESET}"
-  exit 1
-fi
-
-# ── Banner ────────────────────────────────────────────────────────────────────
-header "Vauxl check.sh"
-echo -e "  Mode: ${BOLD}$([ "$CI_MODE" = true ] && echo "CI (read-only)" || ([ "$FIX_MODE" = true ] && echo "Fix + check" || ([ "$FAST_MODE" = true ] && echo "Fast (fmt + clippy)" || echo "Standard")))${RESET}"
-echo -e "  ${DIM}$(date '+%Y-%m-%d %H:%M:%S')${RESET}"
-
-# =============================================================================
-# STEP 1 — rustfmt
-# =============================================================================
-header "1 / 5  Formatting (rustfmt)"
-
-if [ "$FIX_MODE" = true ] && [ "$CI_MODE" = false ]; then
-  step "Auto-fixing formatting..."
-  if cargo fmt --all; then
-    ok "cargo fmt --all (auto-fixed)"
-  else
-    fail "cargo fmt --all"
-  fi
-else
-  step "Checking formatting (read-only)..."
-  if cargo fmt --all -- --check; then
-    ok "cargo fmt --check"
-  else
-    fail "cargo fmt --check"
-    if [ "$CI_MODE" = false ]; then
-      echo ""
-      echo -e "${YELLOW}  → Run ${BOLD}./scripts/check.sh --fix${RESET}${YELLOW} to auto-fix formatting${RESET}"
-      echo -e "${YELLOW}  → Or run ${BOLD}cargo fmt --all${RESET}${YELLOW} directly${RESET}"
-    fi
-  fi
-fi
-
-# =============================================================================
-# STEP 2 — Clippy
-# =============================================================================
-header "2 / 5  Linting (clippy)"
-
-CLIPPY_FLAGS="--all-targets --all-features"
-RUSTFLAGS_VAL="-D warnings"
-
-if [ "$FIX_MODE" = true ] && [ "$CI_MODE" = false ]; then
-  step "Auto-fixing clippy warnings..."
-  # --fix applies safe automatic fixes; -- -D warnings still shows what couldn't be fixed
-  if RUSTFLAGS="$RUSTFLAGS_VAL" cargo clippy --fix --allow-dirty --allow-staged $CLIPPY_FLAGS 2>&1; then
-    ok "cargo clippy --fix"
-  else
-    warn "Some clippy warnings need manual fixing (see above)"
-    fail "cargo clippy --fix (manual fixes required)"
-  fi
-  # Now run a clean check to show what's left
-  step "Checking remaining warnings..."
-  if RUSTFLAGS="$RUSTFLAGS_VAL" cargo clippy $CLIPPY_FLAGS 2>&1; then
-    ok "cargo clippy (clean after fix)"
-  else
-    fail "cargo clippy (warnings remain — fix manually)"
-  fi
-else
-  step "Running clippy..."
-  if RUSTFLAGS="$RUSTFLAGS_VAL" cargo clippy $CLIPPY_FLAGS 2>&1; then
-    ok "cargo clippy"
-  else
-    fail "cargo clippy"
-    if [ "$CI_MODE" = false ]; then
-      echo ""
-      echo -e "${YELLOW}  → Run ${BOLD}./scripts/check.sh --fix${RESET}${YELLOW} to auto-fix what clippy can${RESET}"
-      echo -e "${YELLOW}  → Manual fixes needed for the rest (see output above)${RESET}"
-    fi
-  fi
-fi
-
-# =============================================================================
-# STEP 3 — Tests  (skipped in --fast mode)
-# =============================================================================
-if [ "$FAST_MODE" = true ]; then
-  skip "Tests (--fast mode)"
-else
-  header "3 / 5  Tests"
-  step "Running cargo test --all..."
-  if cargo test --all 2>&1; then
-    ok "cargo test --all"
-  else
-    fail "cargo test --all"
-  fi
-fi
-
-# =============================================================================
-# STEP 4 — cargo-deny  (skipped in --fast mode)
-# =============================================================================
-if [ "$FAST_MODE" = true ]; then
-  skip "cargo deny (--fast mode)"
-elif ! command -v cargo-deny &>/dev/null; then
-  warn "cargo-deny not installed — skipping"
-  skip "cargo deny (not installed)"
-  echo -e "${DIM}  Install: cargo install cargo-deny${RESET}"
-else
-  header "4 / 5  Security & Licenses (cargo-deny)"
-  step "Running cargo deny check..."
-  if cargo deny check 2>&1; then
-    ok "cargo deny check"
-  else
-    fail "cargo deny check"
-    echo ""
-    echo -e "${YELLOW}  → Check deny.toml to add ignores for known advisories${RESET}"
-  fi
-fi
-
-# =============================================================================
-# STEP 5 — Uncommitted changes warning  (skipped in --fast and --ci mode)
-# =============================================================================
-if [ "$FAST_MODE" = false ] && [ "$CI_MODE" = false ]; then
-  header "5 / 5  Git status"
-  step "Checking for uncommitted changes..."
-
-  UNTRACKED=$(git ls-files --others --exclude-standard | wc -l)
-  MODIFIED=$(git diff --name-only | wc -l)
-  STAGED=$(git diff --cached --name-only | wc -l)
-
-  if [ "$MODIFIED" -gt 0 ]; then
-    warn "Modified files not staged:"
-    git diff --name-only | while read -r f; do
-      echo -e "    ${YELLOW}M  $f${RESET}"
-    done
-  fi
-
-  if [ "$STAGED" -gt 0 ]; then
-    echo -e "  ${GREEN}Staged files ready to commit:${RESET}"
-    git diff --cached --name-only | while read -r f; do
-      echo -e "    ${GREEN}S  $f${RESET}"
-    done
-  fi
-
-  if [ "$UNTRACKED" -gt 0 ]; then
-    warn "$UNTRACKED untracked file(s) — add to .gitignore or stage them"
-  fi
-
-  if [ "$MODIFIED" -eq 0 ] && [ "$STAGED" -eq 0 ] && [ "$UNTRACKED" -eq 0 ]; then
-    ok "Working tree clean"
-  fi
-fi
-
-# =============================================================================
-# SUMMARY
-# =============================================================================
-END_TIME=$(date +%s)
-ELAPSED=$((END_TIME - START_TIME))
-
-echo ""
-echo -e "${BOLD}${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}"
-echo -e "${BOLD}  Summary  (${ELAPSED}s)${RESET}"
-echo -e "${BOLD}${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}"
-
-for p in "${PASSED[@]+"${PASSED[@]}"}"; do
-  echo -e "  ${GREEN}✓${RESET}  $p"
-done
-for s in "${SKIPPED[@]+"${SKIPPED[@]}"}"; do
-  echo -e "  ${DIM}○${RESET}  $s"
-done
-for f in "${FAILED[@]+"${FAILED[@]}"}"; do
-  echo -e "  ${RED}✗${RESET}  $f"
-done
-
-echo ""
-PASS_COUNT=${#PASSED[@]}
-FAIL_COUNT=${#FAILED[@]}
-SKIP_COUNT=${#SKIPPED[@]}
-
-if [ "$FAIL_COUNT" -eq 0 ]; then
-  echo -e "  ${GREEN}${BOLD}All checks passed${RESET}  ${DIM}(${PASS_COUNT} passed, ${SKIP_COUNT} skipped)${RESET}"
-  echo ""
-  if [ "$CI_MODE" = false ] && [ "$FAST_MODE" = false ]; then
-    echo -e "  ${DIM}Ready to commit. Suggested message format:${RESET}"
-    echo -e "  ${DIM}  git commit -m \"type(scope): description\"${RESET}"
-    echo -e "  ${DIM}  types: feat fix chore docs test refactor security perf ci${RESET}"
-  fi
-  exit 0
-else
-  echo -e "  ${RED}${BOLD}${FAIL_COUNT} check(s) failed${RESET}  ${DIM}(${PASS_COUNT} passed, ${SKIP_COUNT} skipped)${RESET}"
-  echo ""
-  if [ "$CI_MODE" = false ]; then
-    echo -e "  ${YELLOW}Tip: run ${BOLD}./scripts/check.sh --fix${RESET}${YELLOW} to auto-fix fmt + clippy${RESET}"
-  fi
-  exit 1
-fi
+cargo fmt --all -- --check
+RUSTFLAGS="-D warnings" cargo clippy --all-targets --all-features
+cargo test --all
+cargo deny check advisories licenses bans sources

From 73f6f9016720b160ec6fd79407d553f510a97f4a Mon Sep 17 00:00:00 2001
From: kyle <lelegrau04@gmail.com>
Date: Mon, 3 Aug 2026 09:37:24 +0200
Subject: [PATCH 2/5] fix: update event-listener to 5.4.2

---
 Cargo.lock | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e7da219..3b9f39c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -226,15 +226,6 @@ dependencies = [
  "tokio-util",
 ]
 
-[[package]]
-name = "concurrent-queue"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
-dependencies = [
- "crossbeam-utils",
-]
-
 [[package]]
 name = "config"
 version = "0.15.25"
@@ -510,11 +501,10 @@ dependencies = [
 
 [[package]]
 name = "event-listener"
-version = "5.4.1"
+version = "5.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
 dependencies = [
- "concurrent-queue",
  "parking",
  "pin-project-lite",
 ]

From 90989c36653f9a229b196ab4c1f8777570d4e625 Mon Sep 17 00:00:00 2001
From: kyle <lelegrau04@gmail.com>
Date: Mon, 3 Aug 2026 11:11:01 +0200
Subject: [PATCH 3/5] ci: run pinned Complement smoke check

---
 .github/workflows/sytest.yml    | 57 +++++++++++++++++++++++++++------
 crates/vauxl-server/src/main.rs |  6 +++-
 docker/Dockerfile.complement    | 14 ++++++++
 docker/complement-entrypoint.sh |  8 +++++
 docs/progress.md                |  2 +-
 5 files changed, 75 insertions(+), 12 deletions(-)
 create mode 100644 docker/Dockerfile.complement
 create mode 100644 docker/complement-entrypoint.sh

diff --git a/.github/workflows/sytest.yml b/.github/workflows/sytest.yml
index bf9b9a4..d9ee6b8 100644
--- a/.github/workflows/sytest.yml
+++ b/.github/workflows/sytest.yml
@@ -1,20 +1,57 @@
-name: Matrix Spec Compliance
+name: Matrix API Smoke
+
 on: [pull_request]
 
 jobs:
-  sytest:
+  complement:
     runs-on: ubuntu-latest
-    continue-on-error: true  # don't block PRs until baseline established
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: vauxl
+          POSTGRES_PASSWORD: vauxl
+          POSTGRES_DB: vauxl
+          POSTGRES_HOST_AUTH_METHOD: trust
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U vauxl -d vauxl"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+      redis:
+        image: redis:7-alpine
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
     steps:
       - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
       - name: Build server
+        env:
+          SQLX_OFFLINE: true
         run: cargo build --release -p vauxl-server
-      - name: Run Sytest
-        uses: matrix-org/sytest-action@v0
+      - name: Build Complement image
+        run: docker build -f docker/Dockerfile.complement -t vauxl-complement .
+      - uses: actions/checkout@v4
         with:
-          server-binary: target/release/vauxl-server
-      - name: Upload results
-        uses: actions/upload-artifact@v4
+          repository: matrix-org/complement
+          ref: c466460957697faa4ec36ce1b37921cef238fb91
+          path: complement
+      - uses: actions/setup-go@v5
         with:
-          name: sytest-results
-          path: sytest-results.xml
+          go-version-file: complement/go.mod
+      - name: Run Complement smoke test
+        working-directory: complement
+        env:
+          COMPLEMENT_BASE_IMAGE: vauxl-complement
+          COMPLEMENT_SHARE_ENV_PREFIX: PASS_
+          COMPLEMENT_ALWAYS_PRINT_SERVER_LOGS: "1"
+          PASS_VAUXL_DATABASE__URL: postgres://vauxl:vauxl@host.docker.internal:5432/vauxl?sslmode=disable
+          PASS_VAUXL_REDIS__URL: redis://host.docker.internal:6379
+        run: go test -v -run '^TestVersionStructure$' ./tests/csapi
diff --git a/crates/vauxl-server/src/main.rs b/crates/vauxl-server/src/main.rs
index 6195cad..1d458a8 100644
--- a/crates/vauxl-server/src/main.rs
+++ b/crates/vauxl-server/src/main.rs
@@ -58,7 +58,11 @@ async fn main() -> Result<()> {
     let cfg: AppConfig = config::Config::builder()
         .add_source(config::File::with_name("config/default"))
         .add_source(config::File::with_name("config/dev").required(false))
-        .add_source(config::Environment::with_prefix("VAUXL").separator("__"))
+        .add_source(
+            config::Environment::with_prefix("VAUXL")
+                .prefix_separator("_")
+                .separator("__"),
+        )
         .build()?
         .try_deserialize()?;
 
diff --git a/docker/Dockerfile.complement b/docker/Dockerfile.complement
new file mode 100644
index 0000000..31daf12
--- /dev/null
+++ b/docker/Dockerfile.complement
@@ -0,0 +1,14 @@
+FROM debian:bookworm-slim
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates libssl3 \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+COPY target/release/vauxl-server ./vauxl-server
+COPY config/ ./config/
+COPY docker/complement-entrypoint.sh ./complement-entrypoint.sh
+
+EXPOSE 8008
+EXPOSE 8448
+ENTRYPOINT ["/bin/sh", "/app/complement-entrypoint.sh"]
diff --git a/docker/complement-entrypoint.sh b/docker/complement-entrypoint.sh
new file mode 100644
index 0000000..9eddac7
--- /dev/null
+++ b/docker/complement-entrypoint.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+set -eu
+
+export VAUXL_SERVER__SERVER_NAME="${SERVER_NAME:-localhost}"
+export VAUXL_SERVER__LISTEN_ADDRESS=0.0.0.0
+export VAUXL_SERVER__PORT=8008
+
+exec /app/vauxl-server "$@"
diff --git a/docs/progress.md b/docs/progress.md
index fce5cee..176637f 100644
--- a/docs/progress.md
+++ b/docs/progress.md
@@ -1 +1 @@
-P1 Sytest baseline: X/350 passing
+P1 Matrix API smoke: one pinned official Complement `TestVersionStructure` check runs. Full Client Server API and federation compatibility remains unmeasured.

From 6fde44b7aa21a555bc945089a78659c09b0f51d3 Mon Sep 17 00:00:00 2001
From: kyle <lelegrau04@gmail.com>
Date: Mon, 3 Aug 2026 15:11:14 +0200
Subject: [PATCH 4/5] fix: build Complement binary in image

---
 .github/workflows/sytest.yml            |  5 -----
 crates/vauxl-matrix/src/routes/rooms.rs |  2 +-
 docker/Dockerfile.complement            | 17 ++++++++++++++++-
 3 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/sytest.yml b/.github/workflows/sytest.yml
index d9ee6b8..adb4910 100644
--- a/.github/workflows/sytest.yml
+++ b/.github/workflows/sytest.yml
@@ -31,11 +31,6 @@ jobs:
           --health-retries 10
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - name: Build server
-        env:
-          SQLX_OFFLINE: true
-        run: cargo build --release -p vauxl-server
       - name: Build Complement image
         run: docker build -f docker/Dockerfile.complement -t vauxl-complement .
       - uses: actions/checkout@v4
diff --git a/crates/vauxl-matrix/src/routes/rooms.rs b/crates/vauxl-matrix/src/routes/rooms.rs
index dff54a1..00b2b42 100644
--- a/crates/vauxl-matrix/src/routes/rooms.rs
+++ b/crates/vauxl-matrix/src/routes/rooms.rs
@@ -196,7 +196,7 @@ pub async fn send_message_event(
     )
     .await?;
 
-    // Wake any long-polling /sync handlers for this room
+    // Wake any long-polling /sync handlers.
     let _ = state.wake_tx.send(());
 
     tracing::debug!(room_id = %room_id, event_id = %event_id, "Message sent");
diff --git a/docker/Dockerfile.complement b/docker/Dockerfile.complement
index 31daf12..6e73be2 100644
--- a/docker/Dockerfile.complement
+++ b/docker/Dockerfile.complement
@@ -1,3 +1,18 @@
+FROM rust:slim-bookworm AS builder
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends pkg-config libssl-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /build
+COPY Cargo.toml Cargo.lock ./
+COPY crates/ ./crates/
+COPY .sqlx/ ./.sqlx/
+COPY migrations/ ./migrations/
+
+ENV SQLX_OFFLINE=true
+RUN cargo build --release -p vauxl-server
+
 FROM debian:bookworm-slim
 
 RUN apt-get update \
@@ -5,7 +20,7 @@ RUN apt-get update \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
-COPY target/release/vauxl-server ./vauxl-server
+COPY --from=builder /build/target/release/vauxl-server ./vauxl-server
 COPY config/ ./config/
 COPY docker/complement-entrypoint.sh ./complement-entrypoint.sh
 

From d9746b9ec82d85fe24ffec1e299148961d3a13cb Mon Sep 17 00:00:00 2001
From: kyle <lelegrau04@gmail.com>
Date: Mon, 3 Aug 2026 16:32:39 +0200
Subject: [PATCH 5/5] fix: restore Matrix behavior and verification

---
 .current_token                                |   1 -
 .dockerignore                                 |  12 +
 .github/workflows/ci.yml                      |  81 ++-
 .github/workflows/nightly.yml                 |  60 +-
 .github/workflows/sytest.yml                  |  25 +-
 .gitignore                                    |   1 +
 .sqlx/README.md                               |  10 +-
 ...907fda323a809b7cb1cea3b072ed6d2baaf41.json |  23 +
 ...2864123c6d5cbb17ca72992c25dc1d82f39ea.json |  25 +
 ...fe383bd1421237b2bd1f7a81d05c8acc97a8.json} |   4 +-
 ...c2ed579683fbbb5679c0e17dd2dea9f0919e.json} |  11 +-
 ...f15c4311cd7af208f7d02cd09e5d657e6bd5f.json |  16 -
 ...4ef393d1bbfc840cb0df558c77927eccd1ea9.json |  24 +
 README.md                                     |   6 +-
 crates/vauxl-crypto/fuzz/.gitignore           |   2 +
 crates/vauxl-crypto/fuzz/Cargo.lock           | 612 ++++++++++++++++++
 crates/vauxl-crypto/fuzz/Cargo.toml           |  23 +
 .../fuzz/fuzz_targets/hkdf_derive.rs          |   0
 .../fuzz/fuzz_targets/kem_decapsulate.rs      |  23 +
 .../fuzz/fuzz_targets/kem_roundtrip.rs        |   0
 crates/vauxl-matrix/src/db/mod.rs             |   4 +-
 crates/vauxl-matrix/src/db/rooms.rs           | 141 +++-
 crates/vauxl-matrix/src/db/to_device.rs       |  26 -
 crates/vauxl-matrix/src/routes/client_info.rs |   4 +-
 crates/vauxl-matrix/src/routes/directory.rs   |   7 +
 crates/vauxl-matrix/src/routes/ephemeral.rs   |  98 ++-
 crates/vauxl-matrix/src/routes/keys.rs        |   2 +-
 crates/vauxl-matrix/src/routes/login.rs       |  54 +-
 crates/vauxl-matrix/src/routes/rooms.rs       |  22 +-
 crates/vauxl-matrix/src/routes/sync.rs        |   6 +-
 crates/vauxl-matrix/src/routes/versions.rs    |  11 +-
 deny.toml                                     |   4 +-
 docker/Dockerfile                             |   2 +-
 docker/Dockerfile.complement                  |   2 +-
 docker/compose.dev.yml                        |   2 +-
 docker/compose.prod.yml                       |   4 +-
 docs/MVP_CHECKLIST.md                         |   8 +-
 docs/progress.md                              |   2 +-
 scripts/check.sh                              | 130 +++-
 scripts/test-2.tmp.sh                         |  11 +-
 40 files changed, 1264 insertions(+), 235 deletions(-)
 delete mode 100644 .current_token
 create mode 100644 .dockerignore
 create mode 100644 .sqlx/query-38961c35783fc86528852eb4a09907fda323a809b7cb1cea3b072ed6d2baaf41.json
 create mode 100644 .sqlx/query-59e2560a3dbbddbb6287dbd9b1a2864123c6d5cbb17ca72992c25dc1d82f39ea.json
 rename .sqlx/{query-9ec4b0b9e725d2488060f9c48390c52d9e5a748d45ba0f35a27388dc08e28643.json => query-83c38602146a4f0f29dc1f9a5f90fe383bd1421237b2bd1f7a81d05c8acc97a8.json} (69%)
 rename .sqlx/{query-fedc8446f1ced33943496e6e0d1725c75d36c665b409d43c24e3bbcab6bfeec6.json => query-94b1e00e88fafaed3d97b6fa35adc2ed579683fbbb5679c0e17dd2dea9f0919e.json} (51%)
 delete mode 100644 .sqlx/query-b98fcd81b13ce711c9bed98232df15c4311cd7af208f7d02cd09e5d657e6bd5f.json
 create mode 100644 .sqlx/query-cea8c872379e07e9b633c2197b74ef393d1bbfc840cb0df558c77927eccd1ea9.json
 create mode 100644 crates/vauxl-crypto/fuzz/.gitignore
 create mode 100644 crates/vauxl-crypto/fuzz/Cargo.lock
 create mode 100644 crates/vauxl-crypto/fuzz/Cargo.toml
 delete mode 100644 crates/vauxl-crypto/fuzz/fuzz_targets/hkdf_derive.rs
 create mode 100644 crates/vauxl-crypto/fuzz/fuzz_targets/kem_decapsulate.rs
 delete mode 100644 crates/vauxl-crypto/fuzz/fuzz_targets/kem_roundtrip.rs

diff --git a/.current_token b/.current_token
deleted file mode 100644
index ecddd17..0000000
--- a/.current_token
+++ /dev/null
@@ -1 +0,0 @@
-TOKEN=vauxl_7bd8baa5aaae4c3bb62610913191ded1
diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..da8259f
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,12 @@
+.git
+.github
+target
+**/target
+**/fuzz/artifacts
+**/fuzz/corpus
+.env
+.env.*
+.current_token
+config/dev.toml
+data
+*.log
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d6bd987..19c6208 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,78 +2,73 @@ name: CI
 
 on:
   push:
-    branches: ["**"]
+    branches: [main]
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
-  RUSTFLAGS: "-D warnings"
   RUST_BACKTRACE: 1
+  RUSTFLAGS: "-Dwarnings -Funsafe_code"
 
 jobs:
-
-  fmt:
-    name: Format
+  quality:
+    name: Quality gate
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
-        with: { components: rustfmt }
-      - run: cargo fmt --all -- --check
-
-  clippy:
-    name: Clippy
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with: { components: clippy }
+        with:
+          components: clippy, rustfmt
       - uses: Swatinem/rust-cache@v2
-      - run: cargo clippy --all-targets --all-features
+      - uses: taiki-e/install-action@cargo-deny
+      - run: ./scripts/check.sh --ci
 
-  test:
-    name: Tests
+  sqlx:
+    name: Migrations and SQLx metadata
     runs-on: ubuntu-latest
     services:
       postgres:
-        image: postgres:16
+        image: postgres:16-alpine
         env:
           POSTGRES_USER: vauxl
           POSTGRES_PASSWORD: vauxl
           POSTGRES_DB: vauxl
-          POSTGRES_HOST_AUTH_METHOD: trust
-        ports: ["5432:5432"]
+        ports:
+          - 5432:5432
         options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
+          --health-cmd "pg_isready -U vauxl -d vauxl"
+          --health-interval 5s
           --health-timeout 5s
-          --health-retries 5
-      redis:
-        image: redis:7-alpine
-        ports: ["6379:6379"]
+          --health-retries 10
     env:
-      DATABASE_URL: postgres://vauxl:vauxl@localhost/vauxl?sslmode=disable
-      REDIS_URL: redis://localhost:6379
-      SQLX_OFFLINE: true
+      DATABASE_URL: postgres://vauxl:vauxl@localhost:5432/vauxl?sslmode=disable
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
-      - name: Install psql client
-        run: sudo apt-get install -y postgresql-client
-      - name: Run migrations
-        run: |
-          PGPASSWORD=vauxl psql -h localhost -U vauxl -d vauxl \
-            -f migrations/001_initial_schema.sql
-      - name: Run tests
-        run: cargo test --all
+      - name: Install SQLx CLI
+        run: cargo install sqlx-cli --version 0.8.6 --locked --no-default-features --features rustls,postgres
+      - name: Apply all migrations
+        run: cargo sqlx migrate run --source migrations
+      - name: Verify concurrent transaction retries
+        run: cargo test --locked -p vauxl-matrix concurrent_message_transaction_creates_one_event -- --ignored
+      - name: Verify SQLx metadata online
+        run: cargo sqlx prepare --workspace --check -- --locked --all-targets --all-features
 
-  deny:
-    name: Security & Licenses (cargo-deny)
+  production-image:
+    name: Production image
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: EmbarkStudios/cargo-deny-action@v2
-        with:
-          command: check advisories licenses bans sources
+      - name: Validate production Compose file
+        env:
+          DB_USER: vauxl
+          DB_PASSWORD: ci_only
+          DB_NAME: vauxl
+        run: docker compose -f docker/compose.prod.yml config --quiet
+      - name: Build production image
+        run: docker build --file docker/Dockerfile --tag vauxl-server:ci .
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 4496fbb..a64b367 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -2,65 +2,37 @@ name: Nightly Security Checks
 
 on:
   schedule:
-    - cron: "0 2 * * *"  # 02:00 UTC täglich
-  workflow_dispatch:      # Manuell auslösbar
+    - cron: "0 2 * * *"
+  workflow_dispatch:
 
-jobs:
+permissions:
+  contents: read
 
+jobs:
   audit:
-    name: Daily CVE Audit
+    name: Daily dependency audit
     runs-on: ubuntu-latest
-    permissions:
-      issues: write
     steps:
       - uses: actions/checkout@v4
-      - name: Run cargo-deny
-        uses: EmbarkStudios/cargo-deny-action@v2
-        with:
-          command: check advisories bans licenses
-
-
-#  deny:
-#    name: Security & Licenses (cargo-deny)
-#    runs-on: ubuntu-latest
-#    steps:
-#      - uses: actions/checkout@v4
-#      - uses: EmbarkStudios/cargo-deny-action@v2
-#      with:
-#       command: check advisories licenses bans sources
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: taiki-e/install-action@cargo-deny
+      - run: cargo deny --locked --all-features check advisories licenses bans sources
+      - run: cargo deny --manifest-path crates/vauxl-crypto/fuzz/Cargo.toml --locked --all-features check advisories licenses bans sources
 
   fuzz-kem:
-    name: Fuzz vauxl-crypto KEM
+    name: Fuzz KEM decapsulation
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@nightly
-      - uses: Swatinem/rust-cache@v2
-      - name: Install cargo-fuzz
-        run: cargo install cargo-fuzz
-      - name: Create fuzz target if missing
-        run: |
-          if [ ! -d "crates/vauxl-crypto/fuzz" ]; then
-            cd crates/vauxl-crypto
-            cargo fuzz init
-            cat > fuzz/fuzz_targets/fuzz_kem.rs << 'FUZZ'
-          #![no_main]
-          use libfuzzer_sys::fuzz_target;
-
-          fuzz_target!(|data: &[u8]| {
-              // Placeholder: sobald decapsulate() implementiert ist,
-              // wird das mit echten Inputs gefüttert
-              let _ = data;
-          });
-          FUZZ
-          fi
-      - name: Run fuzzer (60 seconds)
-        run: |
-          cd crates/vauxl-crypto
-          cargo +nightly fuzz run fuzz_kem -- -max_total_time=60 2>&1 || true
+      - uses: taiki-e/install-action@cargo-fuzz
+      - name: Run KEM fuzzer
+        working-directory: crates/vauxl-crypto
+        run: cargo +nightly fuzz run kem_decapsulate -- -max_total_time=60
       - name: Upload corpus
         uses: actions/upload-artifact@v4
         if: always()
         with:
           name: fuzz-corpus
           path: crates/vauxl-crypto/fuzz/corpus/
+          if-no-files-found: ignore
diff --git a/.github/workflows/sytest.yml b/.github/workflows/sytest.yml
index adb4910..e4db1c7 100644
--- a/.github/workflows/sytest.yml
+++ b/.github/workflows/sytest.yml
@@ -1,18 +1,30 @@
-name: Matrix API Smoke
+name: Matrix API Complement
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   complement:
+    name: Complement ${{ matrix.test }}
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        test:
+          - TestVersionStructure
+          - TestLogin
+          - TestTyping
+          - TestRoomReceipts
+          - TestSendMessageWithTxn
     services:
       postgres:
-        image: postgres:16
+        image: postgres:16-alpine
         env:
           POSTGRES_USER: vauxl
           POSTGRES_PASSWORD: vauxl
           POSTGRES_DB: vauxl
-          POSTGRES_HOST_AUTH_METHOD: trust
         ports:
           - 5432:5432
         options: >-
@@ -32,7 +44,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Build Complement image
-        run: docker build -f docker/Dockerfile.complement -t vauxl-complement .
+        run: docker build --file docker/Dockerfile.complement --tag vauxl-complement .
       - uses: actions/checkout@v4
         with:
           repository: matrix-org/complement
@@ -41,7 +53,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version-file: complement/go.mod
-      - name: Run Complement smoke test
+      - name: Run isolated Complement test
         working-directory: complement
         env:
           COMPLEMENT_BASE_IMAGE: vauxl-complement
@@ -49,4 +61,5 @@ jobs:
           COMPLEMENT_ALWAYS_PRINT_SERVER_LOGS: "1"
           PASS_VAUXL_DATABASE__URL: postgres://vauxl:vauxl@host.docker.internal:5432/vauxl?sslmode=disable
           PASS_VAUXL_REDIS__URL: redis://host.docker.internal:6379
-        run: go test -v -run '^TestVersionStructure$' ./tests/csapi
+          COMPLEMENT_TEST: ${{ matrix.test }}
+        run: go test -v -count=1 -timeout 6m -run "^${COMPLEMENT_TEST}$" ./tests/csapi
diff --git a/.gitignore b/.gitignore
index 52129d4..ee8833c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -37,3 +37,4 @@ Thumbs.db
 # Generated at runtime
 data/
 config/dev.toml
+.current_token
diff --git a/.sqlx/README.md b/.sqlx/README.md
index e3ed01f..8b9c783 100644
--- a/.sqlx/README.md
+++ b/.sqlx/README.md
@@ -1,7 +1,7 @@
-# sqlx offline query cache
+# SQLx offline query cache
 
-Dieses Verzeichnis enthält gecachte Query-Metadaten für `sqlx` im offline-Modus.
-Wird automatisch generiert durch: `cargo sqlx prepare --workspace`
+This directory contains generated query metadata for offline builds.
 
-Voraussetzung: lokale Postgres-DB muss laufen (via Docker im Container).
-Zum Aktualisieren: `docker exec docker-db-1 ...` (siehe CONTRIBUTING.md)
+Use the online mode of `scripts/check.sh` after changing a SQLx query. The
+script applies every migration to a disposable PostgreSQL database and checks
+the committed cache against that schema.
diff --git a/.sqlx/query-38961c35783fc86528852eb4a09907fda323a809b7cb1cea3b072ed6d2baaf41.json b/.sqlx/query-38961c35783fc86528852eb4a09907fda323a809b7cb1cea3b072ed6d2baaf41.json
new file mode 100644
index 0000000..292c6e9
--- /dev/null
+++ b/.sqlx/query-38961c35783fc86528852eb4a09907fda323a809b7cb1cea3b072ed6d2baaf41.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT EXISTS(\n            SELECT 1 FROM events WHERE room_id = $1 AND event_id = $2\n        ) AS \"exists!\"\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "38961c35783fc86528852eb4a09907fda323a809b7cb1cea3b072ed6d2baaf41"
+}
diff --git a/.sqlx/query-59e2560a3dbbddbb6287dbd9b1a2864123c6d5cbb17ca72992c25dc1d82f39ea.json b/.sqlx/query-59e2560a3dbbddbb6287dbd9b1a2864123c6d5cbb17ca72992c25dc1d82f39ea.json
new file mode 100644
index 0000000..fa5a7d6
--- /dev/null
+++ b/.sqlx/query-59e2560a3dbbddbb6287dbd9b1a2864123c6d5cbb17ca72992c25dc1d82f39ea.json
@@ -0,0 +1,25 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        INSERT INTO transaction_ids (user_id, device_id, txn_id, event_id, created_at)\n        VALUES ($1, $2, $3, $4, NOW())\n        ON CONFLICT (user_id, device_id, txn_id) DO NOTHING\n        RETURNING event_id AS \"event_id!\"\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "event_id!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "59e2560a3dbbddbb6287dbd9b1a2864123c6d5cbb17ca72992c25dc1d82f39ea"
+}
diff --git a/.sqlx/query-9ec4b0b9e725d2488060f9c48390c52d9e5a748d45ba0f35a27388dc08e28643.json b/.sqlx/query-83c38602146a4f0f29dc1f9a5f90fe383bd1421237b2bd1f7a81d05c8acc97a8.json
similarity index 69%
rename from .sqlx/query-9ec4b0b9e725d2488060f9c48390c52d9e5a748d45ba0f35a27388dc08e28643.json
rename to .sqlx/query-83c38602146a4f0f29dc1f9a5f90fe383bd1421237b2bd1f7a81d05c8acc97a8.json
index 9a60bda..0203a2f 100644
--- a/.sqlx/query-9ec4b0b9e725d2488060f9c48390c52d9e5a748d45ba0f35a27388dc08e28643.json
+++ b/.sqlx/query-83c38602146a4f0f29dc1f9a5f90fe383bd1421237b2bd1f7a81d05c8acc97a8.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        SELECT r.room_id,\n            (SELECT e.content->>'name' FROM room_state rs JOIN events e ON e.event_id = rs.event_id\n             WHERE rs.room_id = r.room_id AND rs.event_type = 'm.room.name' LIMIT 1) AS name,\n            (SELECT COUNT(*) FROM room_members WHERE room_id = r.room_id AND membership = 'join')\n             AS member_count\n        FROM rooms r\n        LIMIT $1\n        ",
+  "query": "\n        SELECT r.room_id,\n            (SELECT e.content->>'name' FROM room_state rs JOIN events e ON e.event_id = rs.event_id\n             WHERE rs.room_id = r.room_id AND rs.event_type = 'm.room.name' LIMIT 1) AS name,\n            (SELECT COUNT(*) FROM room_members WHERE room_id = r.room_id AND membership = 'join')\n             AS member_count\n        FROM rooms r\n        WHERE (\n            SELECT e.content->>'join_rule'\n            FROM room_state rs\n            JOIN events e ON e.event_id = rs.event_id\n            WHERE rs.room_id = r.room_id AND rs.event_type = 'm.room.join_rules'\n            LIMIT 1\n        ) = 'public'\n        LIMIT $1\n        ",
   "describe": {
     "columns": [
       {
@@ -30,5 +30,5 @@
       null
     ]
   },
-  "hash": "9ec4b0b9e725d2488060f9c48390c52d9e5a748d45ba0f35a27388dc08e28643"
+  "hash": "83c38602146a4f0f29dc1f9a5f90fe383bd1421237b2bd1f7a81d05c8acc97a8"
 }
diff --git a/.sqlx/query-fedc8446f1ced33943496e6e0d1725c75d36c665b409d43c24e3bbcab6bfeec6.json b/.sqlx/query-94b1e00e88fafaed3d97b6fa35adc2ed579683fbbb5679c0e17dd2dea9f0919e.json
similarity index 51%
rename from .sqlx/query-fedc8446f1ced33943496e6e0d1725c75d36c665b409d43c24e3bbcab6bfeec6.json
rename to .sqlx/query-94b1e00e88fafaed3d97b6fa35adc2ed579683fbbb5679c0e17dd2dea9f0919e.json
index 25e4d56..0d1202b 100644
--- a/.sqlx/query-fedc8446f1ced33943496e6e0d1725c75d36c665b409d43c24e3bbcab6bfeec6.json
+++ b/.sqlx/query-94b1e00e88fafaed3d97b6fa35adc2ed579683fbbb5679c0e17dd2dea9f0919e.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        SELECT user_id, event_id, ts\n        FROM   read_receipts\n        WHERE  room_id      = $1\n        AND    receipt_type = 'm.read'\n        ",
+  "query": "\n        SELECT user_id, event_id, receipt_type, ts\n        FROM   read_receipts\n        WHERE  room_id      = $1\n        AND   (receipt_type = 'm.read'\n               OR (receipt_type = 'm.read.private' AND user_id = $2))\n        ",
   "describe": {
     "columns": [
       {
@@ -15,20 +15,27 @@
       },
       {
         "ordinal": 2,
+        "name": "receipt_type",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
         "name": "ts",
         "type_info": "Int8"
       }
     ],
     "parameters": {
       "Left": [
+        "Text",
         "Text"
       ]
     },
     "nullable": [
+      false,
       false,
       false,
       false
     ]
   },
-  "hash": "fedc8446f1ced33943496e6e0d1725c75d36c665b409d43c24e3bbcab6bfeec6"
+  "hash": "94b1e00e88fafaed3d97b6fa35adc2ed579683fbbb5679c0e17dd2dea9f0919e"
 }
diff --git a/.sqlx/query-b98fcd81b13ce711c9bed98232df15c4311cd7af208f7d02cd09e5d657e6bd5f.json b/.sqlx/query-b98fcd81b13ce711c9bed98232df15c4311cd7af208f7d02cd09e5d657e6bd5f.json
deleted file mode 100644
index 7808ed8..0000000
--- a/.sqlx/query-b98fcd81b13ce711c9bed98232df15c4311cd7af208f7d02cd09e5d657e6bd5f.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO transaction_ids (user_id, device_id, txn_id, created_at)\n        VALUES ($1, $2, $3, NOW())\n        ON CONFLICT (user_id, device_id, txn_id) DO NOTHING\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "b98fcd81b13ce711c9bed98232df15c4311cd7af208f7d02cd09e5d657e6bd5f"
-}
diff --git a/.sqlx/query-cea8c872379e07e9b633c2197b74ef393d1bbfc840cb0df558c77927eccd1ea9.json b/.sqlx/query-cea8c872379e07e9b633c2197b74ef393d1bbfc840cb0df558c77927eccd1ea9.json
new file mode 100644
index 0000000..2aa71d9
--- /dev/null
+++ b/.sqlx/query-cea8c872379e07e9b633c2197b74ef393d1bbfc840cb0df558c77927eccd1ea9.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            SELECT event_id\n            FROM transaction_ids\n            WHERE user_id = $1 AND device_id = $2 AND txn_id = $3\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "event_id",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "cea8c872379e07e9b633c2197b74ef393d1bbfc840cb0df558c77927eccd1ea9"
+}
diff --git a/README.md b/README.md
index d50197a..c5d890b 100644
--- a/README.md
+++ b/README.md
@@ -12,11 +12,11 @@ This repository hosts the Matrix-first server strategy for Vauxl.
 - Undocumented proprietary event formats.
 
 ## Structure
-- `crates/` Cargo workspace: `vauxl-server` (binary), `vauxl-matrix` (client-server API), `vauxl-crypto`, plus stubs for federation, identity, media, admin, push
-- `migrations/` PostgreSQL schema (regenerate `.sqlx/` with `cargo sqlx prepare --workspace` after changing queries)
+- `crates/` Cargo workspace with the server binary, Matrix client API, and cryptographic primitives
+- `migrations/` PostgreSQL schema and committed SQLx metadata for offline builds
 - `config/` runtime configuration defaults
 - `docker/` dev compose stack and Dockerfiles
-- `scripts/` local dev helpers
+- `scripts/` local development and quality checks
 - `docs/` extension and operations docs
 
 ## Extension Policy
diff --git a/crates/vauxl-crypto/fuzz/.gitignore b/crates/vauxl-crypto/fuzz/.gitignore
new file mode 100644
index 0000000..535350d
--- /dev/null
+++ b/crates/vauxl-crypto/fuzz/.gitignore
@@ -0,0 +1,2 @@
+artifacts/
+corpus/
diff --git a/crates/vauxl-crypto/fuzz/Cargo.lock b/crates/vauxl-crypto/fuzz/Cargo.lock
new file mode 100644
index 0000000..c544308
--- /dev/null
+++ b/crates/vauxl-crypto/fuzz/Cargo.lock
@@ -0,0 +1,612 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "cc"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "digest",
+ "fiat-crypto",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid",
+ "zeroize",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "ed25519"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+dependencies = [
+ "pkcs8",
+ "signature",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "rand_core",
+ "serde",
+ "sha2",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+]
+
+[[package]]
+name = "glob"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
+
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom 0.4.3",
+ "libc",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "libfuzzer-sys"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9fd2f41a1cba099f79a0b6b6c35656cf7c03351a7bae8ff0f28f25270f929d2"
+dependencies = [
+ "arbitrary",
+ "cc",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "pqcrypto-internals"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4a326caf27cbf2ac291ca7fd56300497ba9e76a8cc6a7d95b7a18b57f22b61d"
+dependencies = [
+ "cc",
+ "dunce",
+ "getrandom 0.3.4",
+ "libc",
+]
+
+[[package]]
+name = "pqcrypto-mlkem"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb14d207f3749e8a59a026c22ceaa72d70fff931cfbf4c8d9b08f3fc56dc6e60"
+dependencies = [
+ "cc",
+ "glob",
+ "libc",
+ "pqcrypto-internals",
+ "pqcrypto-traits",
+]
+
+[[package]]
+name = "pqcrypto-traits"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94e851c7654eed9e68d7d27164c454961a616cf8c203d500607ef22c737b51bb"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "rand_core",
+]
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "vauxl-crypto"
+version = "0.1.0"
+dependencies = [
+ "base64",
+ "ed25519-dalek",
+ "hkdf",
+ "pqcrypto-mlkem",
+ "pqcrypto-traits",
+ "rand",
+ "sha2",
+ "thiserror",
+ "x25519-dalek",
+ "zeroize",
+]
+
+[[package]]
+name = "vauxl-crypto-fuzz"
+version = "0.0.0"
+dependencies = [
+ "libfuzzer-sys",
+ "vauxl-crypto",
+]
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "x25519-dalek"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
+dependencies = [
+ "curve25519-dalek",
+ "rand_core",
+ "serde",
+ "zeroize",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5a105cd7b140f6eeec8acff2ea38135d3cab283ada58540f629fe51e46696eb"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fe976fb70c78cd64cccfe3a6fc142244e8a77b70959b30faf9d0ac37ee228eb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
diff --git a/crates/vauxl-crypto/fuzz/Cargo.toml b/crates/vauxl-crypto/fuzz/Cargo.toml
new file mode 100644
index 0000000..899fdec
--- /dev/null
+++ b/crates/vauxl-crypto/fuzz/Cargo.toml
@@ -0,0 +1,23 @@
+[package]
+name = "vauxl-crypto-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2021"
+license = "MIT OR Apache-2.0"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+vauxl-crypto = { path = ".." }
+
+[[bin]]
+name = "kem_decapsulate"
+path = "fuzz_targets/kem_decapsulate.rs"
+test = false
+doc = false
+bench = false
+
+[workspace]
+members = ["."]
diff --git a/crates/vauxl-crypto/fuzz/fuzz_targets/hkdf_derive.rs b/crates/vauxl-crypto/fuzz/fuzz_targets/hkdf_derive.rs
deleted file mode 100644
index e69de29..0000000
diff --git a/crates/vauxl-crypto/fuzz/fuzz_targets/kem_decapsulate.rs b/crates/vauxl-crypto/fuzz/fuzz_targets/kem_decapsulate.rs
new file mode 100644
index 0000000..62b4b58
--- /dev/null
+++ b/crates/vauxl-crypto/fuzz/fuzz_targets/kem_decapsulate.rs
@@ -0,0 +1,23 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+use vauxl_crypto::kem::{decapsulate, encapsulate, generate_xwing_keypair};
+
+fuzz_target!(|data: &[u8]| {
+    let (public_key, secret_key) = generate_xwing_keypair();
+    let Ok((mut ciphertext, _)) = encapsulate(&public_key) else {
+        return;
+    };
+
+    for (index, byte) in data.iter().enumerate() {
+        if index < ciphertext.x25519_ephemeral_pub.len() {
+            ciphertext.x25519_ephemeral_pub[index] ^= byte;
+        } else {
+            let index = (index - ciphertext.x25519_ephemeral_pub.len())
+                % ciphertext.mlkem_ciphertext.len();
+            ciphertext.mlkem_ciphertext[index] ^= byte;
+        }
+    }
+
+    let _ = decapsulate(&secret_key, &ciphertext);
+});
diff --git a/crates/vauxl-crypto/fuzz/fuzz_targets/kem_roundtrip.rs b/crates/vauxl-crypto/fuzz/fuzz_targets/kem_roundtrip.rs
deleted file mode 100644
index e69de29..0000000
diff --git a/crates/vauxl-matrix/src/db/mod.rs b/crates/vauxl-matrix/src/db/mod.rs
index 8021792..9241754 100644
--- a/crates/vauxl-matrix/src/db/mod.rs
+++ b/crates/vauxl-matrix/src/db/mod.rs
@@ -96,7 +96,7 @@ pub mod rooms;
 
 pub use rooms::{
     assert_joined, create_room_with_state, generate_event_id, get_full_room_state,
-    get_room_messages, put_room_event, put_room_state_event,
+    get_room_messages, put_room_event_idempotent, put_room_state_event,
 };
 pub mod membership;
 
@@ -106,4 +106,4 @@ pub use membership::{
 };
 pub mod to_device;
 
-pub use to_device::{check_and_store_txn, pop_to_device_messages, store_to_device_messages};
+pub use to_device::{pop_to_device_messages, store_to_device_messages};
diff --git a/crates/vauxl-matrix/src/db/rooms.rs b/crates/vauxl-matrix/src/db/rooms.rs
index 20e2773..0e2e4de 100644
--- a/crates/vauxl-matrix/src/db/rooms.rs
+++ b/crates/vauxl-matrix/src/db/rooms.rs
@@ -185,16 +185,19 @@ pub async fn put_room_state_event(
     Ok(event_id)
 }
 
-/// Sends a message event (non-state), signed.
-pub async fn put_room_event(
+/// Sends a message event once for an endpoint-scoped client transaction ID.
+#[allow(clippy::too_many_arguments)]
+pub async fn put_room_event_idempotent(
     pool: &PgPool,
     room_id: &str,
     event_type: &str,
     sender: &str,
+    device_id: &str,
+    txn_id: &str,
     content: Value,
     server_name: &str,
     signing_key: &HomeserverSigningKey,
-) -> Result<String, MatrixError> {
+) -> Result<(String, bool), MatrixError> {
     let now_ms = now_millis();
     let event_id = generate_event_id(server_name);
 
@@ -213,6 +216,43 @@ pub async fn put_room_event(
     let event_id = raw_event["event_id"].as_str().unwrap().to_owned();
     let ev_content = raw_event["content"].clone();
 
+    let scoped_txn_id = serde_json::to_string(&("room.send", room_id, event_type, txn_id))
+        .expect("string tuple is serializable");
+    let mut tx = pool.begin().await?;
+
+    let claimed_event_id = sqlx::query_scalar!(
+        r#"
+        INSERT INTO transaction_ids (user_id, device_id, txn_id, event_id, created_at)
+        VALUES ($1, $2, $3, $4, NOW())
+        ON CONFLICT (user_id, device_id, txn_id) DO NOTHING
+        RETURNING event_id AS "event_id!"
+        "#,
+        sender,
+        device_id,
+        scoped_txn_id,
+        event_id,
+    )
+    .fetch_optional(&mut *tx)
+    .await?;
+
+    if claimed_event_id.is_none() {
+        let existing_event_id = sqlx::query_scalar!(
+            r#"
+            SELECT event_id
+            FROM transaction_ids
+            WHERE user_id = $1 AND device_id = $2 AND txn_id = $3
+            "#,
+            sender,
+            device_id,
+            scoped_txn_id,
+        )
+        .fetch_one(&mut *tx)
+        .await?
+        .ok_or_else(|| MatrixError::Internal("Transaction has no event ID".into()))?;
+        tx.commit().await?;
+        return Ok((existing_event_id, false));
+    }
+
     sqlx::query!(
         r#"
         INSERT INTO events
@@ -227,10 +267,11 @@ pub async fn put_room_event(
         ev_content,
         raw_event,
     )
-    .execute(pool)
+    .execute(&mut *tx)
     .await?;
 
-    Ok(event_id)
+    tx.commit().await?;
+    Ok((event_id, true))
 }
 
 /// Checks that a user is a joined member of a room.
@@ -364,3 +405,93 @@ fn now_millis() -> u64 {
         .unwrap_or_default()
         .as_millis() as u64
 }
+
+#[cfg(test)]
+mod tests {
+    use ed25519_dalek::SigningKey;
+    use rand::{rngs::OsRng, RngCore as _};
+    use sqlx::PgPool;
+
+    use super::{put_room_event_idempotent, HomeserverSigningKey};
+
+    #[test]
+    fn message_transaction_scope_includes_room_and_event_type() {
+        let txn = "same";
+        let first =
+            serde_json::to_string(&("room.send", "!a:test", "m.room.message", txn)).unwrap();
+        let other_room =
+            serde_json::to_string(&("room.send", "!b:test", "m.room.message", txn)).unwrap();
+        let other_type =
+            serde_json::to_string(&("room.send", "!a:test", "m.reaction", txn)).unwrap();
+
+        assert_ne!(first, other_room);
+        assert_ne!(first, other_type);
+    }
+
+    #[sqlx::test(migrations = "../../migrations")]
+    #[ignore = "requires PostgreSQL"]
+    async fn concurrent_message_transaction_creates_one_event(pool: PgPool) {
+        let mut random = [0_u8; 8];
+        OsRng.fill_bytes(&mut random);
+        let room_id = format!("!{}:test", hex::encode(random));
+        sqlx::query("INSERT INTO rooms (room_id) VALUES ($1)")
+            .bind(&room_id)
+            .execute(&pool)
+            .await
+            .unwrap();
+
+        let signing_key = SigningKey::generate(&mut OsRng);
+        let signing_key = HomeserverSigningKey {
+            verifying_key: signing_key.verifying_key(),
+            signing_key,
+            key_id: "ed25519:test".into(),
+        };
+        let content = serde_json::json!({"msgtype": "m.text", "body": "one event"});
+
+        let first = put_room_event_idempotent(
+            &pool,
+            &room_id,
+            "m.room.message",
+            "@alice:test",
+            "DEVICE",
+            "same-transaction",
+            content.clone(),
+            "test",
+            &signing_key,
+        );
+        let second = put_room_event_idempotent(
+            &pool,
+            &room_id,
+            "m.room.message",
+            "@alice:test",
+            "DEVICE",
+            "same-transaction",
+            content,
+            "test",
+            &signing_key,
+        );
+        let (first, second) = tokio::join!(first, second);
+        let first = first.unwrap();
+        let second = second.unwrap();
+
+        assert_eq!(first.0, second.0);
+        assert_ne!(first.1, second.1);
+
+        let event_count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM events WHERE room_id = $1")
+            .bind(&room_id)
+            .fetch_one(&pool)
+            .await
+            .unwrap();
+        let transaction_count: i64 = sqlx::query_scalar(
+            "SELECT COUNT(*) FROM transaction_ids WHERE user_id = $1 AND device_id = $2",
+        )
+        .bind("@alice:test")
+        .bind("DEVICE")
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+
+        assert_eq!(event_count, 1);
+        assert_eq!(transaction_count, 1);
+    }
+}
diff --git a/crates/vauxl-matrix/src/db/to_device.rs b/crates/vauxl-matrix/src/db/to_device.rs
index 587ac17..d9066d8 100644
--- a/crates/vauxl-matrix/src/db/to_device.rs
+++ b/crates/vauxl-matrix/src/db/to_device.rs
@@ -92,29 +92,3 @@ pub async fn pop_to_device_messages(
 
     Ok(events)
 }
-
-/// Checks and records a transaction ID to prevent duplicate event sends.
-/// Returns true if this txn_id is new (should process), false if duplicate.
-pub async fn check_and_store_txn(
-    pool: &PgPool,
-    user_id: &str,
-    device_id: &str,
-    txn_id: &str,
-) -> Result<bool, MatrixError> {
-    // Store txn with 24h expiry using a dedicated table
-    let result = sqlx::query!(
-        r#"
-        INSERT INTO transaction_ids (user_id, device_id, txn_id, created_at)
-        VALUES ($1, $2, $3, NOW())
-        ON CONFLICT (user_id, device_id, txn_id) DO NOTHING
-        "#,
-        user_id,
-        device_id,
-        txn_id,
-    )
-    .execute(pool)
-    .await?;
-
-    // rows_affected = 0 means it already existed → duplicate
-    Ok(result.rows_affected() > 0)
-}
diff --git a/crates/vauxl-matrix/src/routes/client_info.rs b/crates/vauxl-matrix/src/routes/client_info.rs
index 4278556..99bfec3 100644
--- a/crates/vauxl-matrix/src/routes/client_info.rs
+++ b/crates/vauxl-matrix/src/routes/client_info.rs
@@ -15,13 +15,13 @@ use crate::{auth::AuthenticatedUser, error::MatrixError, state::SharedState};
 pub async fn capabilities() -> Json<Value> {
     Json(json!({
         "capabilities": {
-            "m.change_password": { "enabled": true },
+            "m.change_password": { "enabled": false },
             "m.room_versions": {
                 "default":   "11",
                 "available": { "11": "stable" }
             },
             "m.set_displayname": { "enabled": true },
-            "m.set_avatar_url":  { "enabled": true }
+            "m.set_avatar_url":  { "enabled": false }
         }
     }))
 }
diff --git a/crates/vauxl-matrix/src/routes/directory.rs b/crates/vauxl-matrix/src/routes/directory.rs
index a21bfe2..a11f7ad 100644
--- a/crates/vauxl-matrix/src/routes/directory.rs
+++ b/crates/vauxl-matrix/src/routes/directory.rs
@@ -110,6 +110,13 @@ pub async fn public_rooms_post(
             (SELECT COUNT(*) FROM room_members WHERE room_id = r.room_id AND membership = 'join')
              AS member_count
         FROM rooms r
+        WHERE (
+            SELECT e.content->>'join_rule'
+            FROM room_state rs
+            JOIN events e ON e.event_id = rs.event_id
+            WHERE rs.room_id = r.room_id AND rs.event_type = 'm.room.join_rules'
+            LIMIT 1
+        ) = 'public'
         LIMIT $1
         "#,
         limit,
diff --git a/crates/vauxl-matrix/src/routes/ephemeral.rs b/crates/vauxl-matrix/src/routes/ephemeral.rs
index b1251a5..2514b81 100644
--- a/crates/vauxl-matrix/src/routes/ephemeral.rs
+++ b/crates/vauxl-matrix/src/routes/ephemeral.rs
@@ -11,7 +11,7 @@ use redis::AsyncCommands;
 use serde::Deserialize;
 use serde_json::{json, Value};
 
-use crate::{auth::AuthenticatedUser, error::MatrixError, state::SharedState};
+use crate::{auth::AuthenticatedUser, db::assert_joined, error::MatrixError, state::SharedState};
 
 // ── Typing ────────────────────────────────────────────────────────────────
 
@@ -25,9 +25,14 @@ pub struct TypingRequest {
 pub async fn send_typing(
     State(state): State<SharedState>,
     auth: AuthenticatedUser,
-    Path((room_id, _user_id)): Path<(String, String)>,
+    Path((room_id, user_id)): Path<(String, String)>,
     Json(body): Json<TypingRequest>,
 ) -> Result<Json<Value>, MatrixError> {
+    if user_id != auth.user_id {
+        return Err(MatrixError::Forbidden);
+    }
+    assert_joined(&state.db, &room_id, &auth.user_id).await?;
+
     let mut conn = state
         .redis
         .get_multiplexed_async_connection()
@@ -35,11 +40,17 @@ pub async fn send_typing(
         .map_err(|e| MatrixError::Internal(e.to_string()))?;
 
     let key = format!("typing:{}:{}", room_id, auth.user_id);
+    let dirty_key = format!("typing-dirty:{room_id}");
 
     if body.typing {
-        let ttl_secs = (body.timeout.unwrap_or(30_000) / 1000).clamp(1, 60) as i64;
+        let timeout_ms = body.timeout.unwrap_or(30_000).clamp(1, 60_000);
+        let dirty_ttl_ms = timeout_ms.saturating_add(35_000);
+        let _: () = conn
+            .pset_ex(&key, "1", timeout_ms)
+            .await
+            .map_err(|e| MatrixError::Internal(e.to_string()))?;
         let _: () = conn
-            .set_ex(&key, "1", ttl_secs as u64)
+            .pset_ex(&dirty_key, "1", dirty_ttl_ms)
             .await
             .map_err(|e| MatrixError::Internal(e.to_string()))?;
     } else {
@@ -47,24 +58,38 @@ pub async fn send_typing(
             .del(&key)
             .await
             .map_err(|e| MatrixError::Internal(e.to_string()))?;
+        let _: () = conn
+            .pset_ex(&dirty_key, "1", 35_000)
+            .await
+            .map_err(|e| MatrixError::Internal(e.to_string()))?;
     }
 
+    let _ = state.wake_tx.send(());
     Ok(Json(json!({})))
 }
 
-/// Returns current typers for a room — used by /sync ephemeral.
-pub async fn get_typing_users(redis: &redis::Client, room_id: &str) -> Vec<String> {
+/// Returns the current typing state when a typing update is pending.
+pub async fn get_typing_users(redis: &redis::Client, room_id: &str) -> Option<Vec<String>> {
     let Ok(mut conn) = redis.get_multiplexed_async_connection().await else {
-        return vec![];
+        return None;
     };
 
     let pattern = format!("typing:{}:*", room_id);
     let keys: Vec<String> = conn.keys(&pattern).await.unwrap_or_default();
 
-    keys.iter()
+    let mut users: Vec<String> = keys
+        .iter()
         .filter_map(|k| k.strip_prefix(&format!("typing:{}:", room_id)))
         .map(|u| u.to_owned())
-        .collect()
+        .collect();
+    users.sort();
+
+    let dirty: bool = conn
+        .exists(format!("typing-dirty:{room_id}"))
+        .await
+        .unwrap_or(false);
+
+    (!users.is_empty() || dirty).then_some(users)
 }
 
 // ── Read receipts ─────────────────────────────────────────────────────────
@@ -75,10 +100,28 @@ pub async fn send_receipt(
     auth: AuthenticatedUser,
     Path((room_id, receipt_type, event_id)): Path<(String, String, String)>,
 ) -> Result<Json<Value>, MatrixError> {
-    // Only store m.read and m.read.private
+    assert_joined(&state.db, &room_id, &auth.user_id).await?;
+
     match receipt_type.as_str() {
-        "m.read" | "m.read.private" | "m.fully_read" => {}
-        _ => return Ok(Json(json!({}))),
+        "m.read" | "m.read.private" => {}
+        _ => return Err(MatrixError::BadJson("Unsupported receipt type".into())),
+    }
+
+    let event_exists = sqlx::query_scalar!(
+        r#"
+        SELECT EXISTS(
+            SELECT 1 FROM events WHERE room_id = $1 AND event_id = $2
+        ) AS "exists!"
+        "#,
+        room_id,
+        event_id,
+    )
+    .fetch_one(&state.db)
+    .await
+    .map_err(MatrixError::from)?;
+
+    if !event_exists {
+        return Err(MatrixError::NotFound);
     }
 
     let now_ms = std::time::SystemTime::now()
@@ -103,20 +146,22 @@ pub async fn send_receipt(
     .await
     .map_err(MatrixError::from)?;
 
+    let _ = state.wake_tx.send(());
     Ok(Json(json!({})))
 }
 
-/// Returns receipt events for a room — used by /sync ephemeral.
-/// Only returns public m.read receipts (m.read.private is not shared).
-pub async fn get_room_receipts(pool: &sqlx::PgPool, room_id: &str) -> Vec<Value> {
+/// Returns public receipts plus the syncing user's private receipts.
+pub async fn get_room_receipts(pool: &sqlx::PgPool, room_id: &str, user_id: &str) -> Vec<Value> {
     let rows = sqlx::query!(
         r#"
-        SELECT user_id, event_id, ts
+        SELECT user_id, event_id, receipt_type, ts
         FROM   read_receipts
         WHERE  room_id      = $1
-        AND    receipt_type = 'm.read'
+        AND   (receipt_type = 'm.read'
+               OR (receipt_type = 'm.read.private' AND user_id = $2))
         "#,
         room_id,
+        user_id,
     )
     .fetch_all(pool)
     .await
@@ -126,18 +171,17 @@ pub async fn get_room_receipts(pool: &sqlx::PgPool, room_id: &str) -> Vec<Value>
         return vec![];
     }
 
-    // Matrix receipt format:
-    // {"type": "m.receipt", "content": {event_id: {"m.read": {user_id: {ts}}}}}
     let mut content = serde_json::Map::new();
     for row in rows {
-        content.insert(
-            row.event_id,
-            json!({
-                "m.read": {
-                    row.user_id: { "ts": row.ts }
-                }
-            }),
-        );
+        let event = content.entry(row.event_id).or_insert_with(|| json!({}));
+        let receipt_types = event.as_object_mut().expect("receipt event is an object");
+        let receipt = receipt_types
+            .entry(row.receipt_type)
+            .or_insert_with(|| json!({}));
+        receipt
+            .as_object_mut()
+            .expect("receipt users are an object")
+            .insert(row.user_id, json!({ "ts": row.ts }));
     }
 
     vec![json!({
diff --git a/crates/vauxl-matrix/src/routes/keys.rs b/crates/vauxl-matrix/src/routes/keys.rs
index e022161..0c39e66 100644
--- a/crates/vauxl-matrix/src/routes/keys.rs
+++ b/crates/vauxl-matrix/src/routes/keys.rs
@@ -72,7 +72,7 @@ pub async fn upload_keys(
 
 #[derive(Debug, Deserialize)]
 pub struct KeysQueryRequest {
-    /// Map of user_id → [device_id] — empty list means all devices
+    /// Map of user IDs to `device_id` lists. An empty list means all devices.
     pub device_keys: HashMap<String, Vec<String>>,
     /// Token for incremental key updates — ignored in MVP
     pub token: Option<String>,
diff --git a/crates/vauxl-matrix/src/routes/login.rs b/crates/vauxl-matrix/src/routes/login.rs
index 3ceb467..92b99db 100644
--- a/crates/vauxl-matrix/src/routes/login.rs
+++ b/crates/vauxl-matrix/src/routes/login.rs
@@ -129,11 +129,20 @@ fn resolve_user_id(identifier: &UserIdentifier, server_name: &str) -> Result<Str
                 .as_deref()
                 .ok_or_else(|| MatrixError::BadJson("Missing 'user' in identifier".into()))?;
 
-            if user.starts_with('@') {
-                // Already a full MXID — use as-is
-                Ok(user.to_owned())
+            if let Some(full_id) = user.strip_prefix('@') {
+                let (localpart, homeserver) = full_id
+                    .split_once(':')
+                    .filter(|(localpart, homeserver)| {
+                        !localpart.is_empty() && !homeserver.is_empty()
+                    })
+                    .ok_or_else(|| MatrixError::BadJson("Invalid Matrix user ID".into()))?;
+
+                if !homeserver.eq_ignore_ascii_case(server_name) {
+                    return Err(MatrixError::Forbidden);
+                }
+
+                Ok(format!("@{}:{}", localpart.to_lowercase(), server_name))
             } else {
-                // Local part only — prepend @ and server name
                 Ok(format!("@{}:{}", user.to_lowercase(), server_name))
             }
         }
@@ -154,3 +163,40 @@ fn verify_password(password: &str, hash: &str) -> Result<(), MatrixError> {
         .verify_password(password.as_bytes(), &parsed)
         .map_err(|_| MatrixError::Forbidden)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn user_identifier(user: &str) -> UserIdentifier {
+        UserIdentifier {
+            id_type: "m.id.user".into(),
+            user: Some(user.into()),
+        }
+    }
+
+    #[test]
+    fn resolves_localpart_to_canonical_user_id() {
+        let user_id = resolve_user_id(&user_identifier("Alice"), "matrix.test").unwrap();
+        assert_eq!(user_id, "@alice:matrix.test");
+    }
+
+    #[test]
+    fn resolves_local_full_mxid_case_insensitively() {
+        let user_id =
+            resolve_user_id(&user_identifier("@Alice:MATRIX.TEST"), "matrix.test").unwrap();
+        assert_eq!(user_id, "@alice:matrix.test");
+    }
+
+    #[test]
+    fn rejects_foreign_full_mxid() {
+        let result = resolve_user_id(&user_identifier("@alice:elsewhere.test"), "matrix.test");
+        assert!(matches!(result, Err(MatrixError::Forbidden)));
+    }
+
+    #[test]
+    fn rejects_malformed_full_mxid() {
+        let result = resolve_user_id(&user_identifier("@alice"), "matrix.test");
+        assert!(matches!(result, Err(MatrixError::BadJson(_))));
+    }
+}
diff --git a/crates/vauxl-matrix/src/routes/rooms.rs b/crates/vauxl-matrix/src/routes/rooms.rs
index 00b2b42..2af088e 100644
--- a/crates/vauxl-matrix/src/routes/rooms.rs
+++ b/crates/vauxl-matrix/src/routes/rooms.rs
@@ -11,8 +11,8 @@ use uuid::Uuid;
 use crate::{
     auth::AuthenticatedUser,
     db::{
-        assert_joined, check_and_store_txn, create_room_with_state, get_full_room_state,
-        get_room_messages, put_room_event, put_room_state_event,
+        assert_joined, create_room_with_state, get_full_room_state, get_room_messages,
+        put_room_event_idempotent, put_room_state_event,
     },
     error::MatrixError,
     state::SharedState,
@@ -178,28 +178,24 @@ pub async fn send_message_event(
 ) -> Result<Json<Value>, MatrixError> {
     assert_joined(&state.db, &room_id, &auth.user_id).await?;
 
-    let is_new = check_and_store_txn(&state.db, &auth.user_id, &auth.device_id, &txn_id).await?;
-
-    if !is_new {
-        tracing::debug!(txn_id = %txn_id, "Duplicate txn — skipping");
-        return Ok(Json(json!({ "event_id": format!("$dup:{}", txn_id) })));
-    }
-
-    let event_id = put_room_event(
+    let (event_id, inserted) = put_room_event_idempotent(
         &state.db,
         &room_id,
         &event_type,
         &auth.user_id,
+        &auth.device_id,
+        &txn_id,
         content,
         &state.config.server.server_name,
         &state.signing_key,
     )
     .await?;
 
-    // Wake any long-polling /sync handlers.
-    let _ = state.wake_tx.send(());
+    if inserted {
+        let _ = state.wake_tx.send(());
+    }
 
-    tracing::debug!(room_id = %room_id, event_id = %event_id, "Message sent");
+    tracing::debug!(room_id = %room_id, event_id = %event_id, inserted, "Message sent");
     Ok(Json(json!({ "event_id": event_id })))
 }
 
diff --git a/crates/vauxl-matrix/src/routes/sync.rs b/crates/vauxl-matrix/src/routes/sync.rs
index 2cb06dd..56a0c10 100644
--- a/crates/vauxl-matrix/src/routes/sync.rs
+++ b/crates/vauxl-matrix/src/routes/sync.rs
@@ -113,7 +113,7 @@ async fn build_sync_response(
 async fn build_joined_room(
     state: &SharedState,
     room_id: &str,
-    _user_id: &str,
+    user_id: &str,
     since: u64,
 ) -> Result<Value, MatrixError> {
     let state_events = get_full_room_state(&state.db, room_id).await?;
@@ -122,10 +122,10 @@ async fn build_joined_room(
 
     // Ephemeral: typing + receipts
     let typing_users = get_typing_users(&state.redis, room_id).await;
-    let receipts = get_room_receipts(&state.db, room_id).await;
+    let receipts = get_room_receipts(&state.db, room_id, user_id).await;
 
     let mut ephemeral_events = receipts;
-    if !typing_users.is_empty() {
+    if let Some(typing_users) = typing_users {
         ephemeral_events.push(json!({
             "type": "m.typing",
             "content": { "user_ids": typing_users }
diff --git a/crates/vauxl-matrix/src/routes/versions.rs b/crates/vauxl-matrix/src/routes/versions.rs
index 801b11e..18523fe 100644
--- a/crates/vauxl-matrix/src/routes/versions.rs
+++ b/crates/vauxl-matrix/src/routes/versions.rs
@@ -8,14 +8,7 @@ use serde_json::{json, Value};
 
 pub async fn client_versions() -> Json<Value> {
     Json(json!({
-        "versions": [
-            "r0.0.1", "r0.1.0", "r0.2.0", "r0.3.0", "r0.4.0",
-            "r0.5.0", "r0.6.0", "r0.6.1",
-            "v1.1", "v1.2", "v1.3", "v1.4", "v1.5", "v1.6"
-        ],
-        "unstable_features": {
-            "org.matrix.label_based_filtering": true,
-            "org.matrix.e2e_cross_signing":     true
-        }
+        "versions": ["v1.1"],
+        "unstable_features": {}
     }))
 }
diff --git a/deny.toml b/deny.toml
index ad1e892..30dd287 100644
--- a/deny.toml
+++ b/deny.toml
@@ -16,8 +16,8 @@ allow = [
 [bans]
 multiple-versions = "warn"
 deny = [
-    { name = "openssl",     wrappers = ["webauthn-attestation-ca", "webauthn-rs-core"] },
-    { name = "openssl-sys", wrappers = ["openssl", "webauthn-attestation-ca", "webauthn-rs-core"] },
+    { name = "openssl" },
+    { name = "openssl-sys" },
 ]
 
 [advisories]
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 2e7f452..1e93863 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -10,7 +10,7 @@ COPY .sqlx/ ./.sqlx/
 COPY migrations/ ./migrations/
 
 ENV SQLX_OFFLINE=true
-RUN cargo build --release -p vauxl-server
+RUN cargo build --locked --release -p vauxl-server
 
 # --- STAGE 2: Das winzige Runtime-Image ---
 FROM debian:bookworm-slim
diff --git a/docker/Dockerfile.complement b/docker/Dockerfile.complement
index 6e73be2..3a3a8b1 100644
--- a/docker/Dockerfile.complement
+++ b/docker/Dockerfile.complement
@@ -11,7 +11,7 @@ COPY .sqlx/ ./.sqlx/
 COPY migrations/ ./migrations/
 
 ENV SQLX_OFFLINE=true
-RUN cargo build --release -p vauxl-server
+RUN cargo build --locked --release -p vauxl-server
 
 FROM debian:bookworm-slim
 
diff --git a/docker/compose.dev.yml b/docker/compose.dev.yml
index e0ca1b6..9d1b8be 100644
--- a/docker/compose.dev.yml
+++ b/docker/compose.dev.yml
@@ -24,7 +24,7 @@ services:
       POSTGRES_PASSWORD: vauxl
       POSTGRES_DB: vauxl
       POSTGRES_HOST_AUTH_METHOD: trust
-    volumes: 
+    volumes:
       - pgdata:/var/lib/postgresql/data
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U vauxl"]
diff --git a/docker/compose.prod.yml b/docker/compose.prod.yml
index eb0d593..633d3d6 100644
--- a/docker/compose.prod.yml
+++ b/docker/compose.prod.yml
@@ -1,7 +1,7 @@
 services:
   vauxl:
     build:
-      context: .
+      context: ..
       dockerfile: docker/Dockerfile
     restart: unless-stopped
     ports:
@@ -33,7 +33,7 @@ services:
       POSTGRES_PASSWORD: ${DB_PASSWORD}
       POSTGRES_DB: ${DB_NAME}
     # KEIN PORTS-BLOCK!
-    volumes: 
+    volumes:
       - pgdata:/var/lib/postgresql/data
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U ${DB_USER}"]
diff --git a/docs/MVP_CHECKLIST.md b/docs/MVP_CHECKLIST.md
index 3798deb..be8fafb 100644
--- a/docs/MVP_CHECKLIST.md
+++ b/docs/MVP_CHECKLIST.md
@@ -18,7 +18,7 @@
 - [ ] Client fallback behavior documented
 
 ## Deferred Decisions (2026-07-06)
-- Workspace lints (`clippy pedantic`, `unsafe_code = "forbid"`) are declared in the root `Cargo.toml` but no crate sets `[lints] workspace = true`, so they are not enforced. CI runs with `RUSTFLAGS="-D warnings"`, so wiring them up requires fixing the pedantic fallout in the same change.
-- The `AuthenticatedUser` extractor in `vauxl-matrix` exists but no route uses it yet; gate endpoints with it as soon as the first protected route lands.
-- Redis is required by config and started by the dev compose stack but no crate uses it yet. Either wire it up or drop it from required config.
-- After changing any sqlx query, regenerate the offline cache with `cargo sqlx prepare --workspace` against a migrated database and commit `.sqlx/`.
+- Workspace lints (`clippy pedantic`, `unsafe_code = "forbid"`) are declared in the root `Cargo.toml` but no crate sets `[lints] workspace = true`. The quality gate denies warnings and unsafe code directly.
+- `AuthenticatedUser` gates protected client endpoints. New protected routes must use the same extractor.
+- Redis stores sync counters, presence, and typing state. The server requires it at runtime.
+- After changing a SQLx query, regenerate the workspace offline cache against a migrated database and commit `.sqlx/`.
diff --git a/docs/progress.md b/docs/progress.md
index 176637f..db39a06 100644
--- a/docs/progress.md
+++ b/docs/progress.md
@@ -1 +1 @@
-P1 Matrix API smoke: one pinned official Complement `TestVersionStructure` check runs. Full Client Server API and federation compatibility remains unmeasured.
+P1 Matrix API smoke runs five pinned official Complement checks in isolated jobs: `TestVersionStructure`, `TestLogin`, `TestTyping`, `TestRoomReceipts`, and `TestSendMessageWithTxn`. Broader Client Server API and federation compatibility remain unmeasured.
diff --git a/scripts/check.sh b/scripts/check.sh
index 795fddf..d0640de 100755
--- a/scripts/check.sh
+++ b/scripts/check.sh
@@ -1,7 +1,131 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+
+fast=false
+fix=false
+ci=false
+online=false
+
+usage() {
+    cat <<'EOF'
+Usage: scripts/check.sh [--fast] [--fix] [--ci] [--online]
+
+  --fast    Run whitespace, formatting, shell, and Clippy checks only
+  --fix     Apply Rust formatting and safe Clippy fixes before checking
+  --ci      Keep the Rust quality gate read-only for CI compatibility
+  --online  Also verify SQLx metadata against a disposable PostgreSQL container
+  --help    Show this help
+EOF
+}
+
+for arg in "$@"; do
+    case "$arg" in
+        --fast) fast=true ;;
+        --fix) fix=true ;;
+        --ci) ci=true ;;
+        --online) online=true ;;
+        --help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $arg" >&2
+            usage >&2
+            exit 2
+            ;;
+    esac
+done
+
+if $ci && $fix; then
+    echo "--ci and --fix cannot be combined" >&2
+    exit 2
+fi
+if $fast && $online; then
+    echo "--fast and --online cannot be combined" >&2
+    exit 2
+fi
+
+need() {
+    command -v "$1" >/dev/null 2>&1 || {
+        echo "Required tool not found: $1" >&2
+        exit 127
+    }
+}
+
+for tool in bash cargo cargo-clippy git rustc rustfmt; do
+    need "$tool"
+done
+if ! $fast; then
+    need cargo-deny
+    need rustdoc
+fi
+if $online; then
+    need cargo-sqlx
+    need docker
+fi
+
+export SQLX_OFFLINE=true
+export RUSTFLAGS="-Dwarnings -Funsafe_code"
+
+if $fix; then
+    cargo fmt --all
+    cargo clippy --fix --allow-dirty --allow-staged --locked --workspace --all-targets --all-features
+fi
+
+git diff --check HEAD
+if git grep -I -n -E '[[:blank:]]+$' -- .; then
+    echo "Tracked files contain trailing whitespace" >&2
+    exit 1
+fi
 cargo fmt --all -- --check
-RUSTFLAGS="-D warnings" cargo clippy --all-targets --all-features
-cargo test --all
-cargo deny check advisories licenses bans sources
+while IFS= read -r -d '' script; do
+    bash -n "$script"
+done < <(git ls-files -z '*.sh')
+cargo clippy --locked --workspace --all-targets --all-features
+
+if $fast; then
+    exit 0
+fi
+
+cargo test --locked --workspace --all-targets --all-features
+cargo test --locked --workspace --all-features --doc
+RUSTDOCFLAGS="-Dwarnings" cargo doc --locked --workspace --all-features --no-deps --document-private-items
+cargo build --locked --workspace --all-targets --all-features --release
+cargo deny --locked --all-features check advisories licenses bans sources
+cargo deny --manifest-path crates/vauxl-crypto/fuzz/Cargo.toml --locked --all-features check advisories licenses bans sources
+
+if $online; then
+    db_container="vauxl-sqlx-check-$$"
+    db_container_id=""
+    cleanup() {
+        if [[ -n "$db_container_id" ]]; then
+            docker rm -f "$db_container_id" >/dev/null 2>&1 || true
+        fi
+    }
+
+    db_container_id=$(docker run --detach --rm --name "$db_container" \
+        --env POSTGRES_USER=vauxl \
+        --env POSTGRES_PASSWORD=vauxl_check \
+        --env POSTGRES_DB=vauxl_check \
+        --publish 127.0.0.1::5432 \
+        postgres:16-alpine)
+    trap cleanup EXIT
+
+    for _ in {1..30}; do
+        docker exec "$db_container_id" pg_isready -U vauxl -d vauxl_check >/dev/null 2>&1 && break
+        sleep 1
+    done
+    docker exec "$db_container_id" pg_isready -U vauxl -d vauxl_check >/dev/null
+
+    db_port=$(docker port "$db_container_id" 5432/tcp | sed -n 's/.*://p' | tail -n 1)
+    database_url="postgres://vauxl:vauxl_check@127.0.0.1:${db_port}/vauxl_check?sslmode=disable"
+    DATABASE_URL="$database_url" cargo sqlx migrate run --source migrations
+    DATABASE_URL="$database_url" cargo test --locked -p vauxl-matrix \
+        concurrent_message_transaction_creates_one_event -- --ignored
+    (
+        unset SQLX_OFFLINE
+        DATABASE_URL="$database_url" cargo sqlx prepare --workspace --check -- --locked --all-targets --all-features
+    )
+fi
diff --git a/scripts/test-2.tmp.sh b/scripts/test-2.tmp.sh
index 6ce3641..1dec4d5 100755
--- a/scripts/test-2.tmp.sh
+++ b/scripts/test-2.tmp.sh
@@ -1,13 +1,12 @@
-#!/bin/bash
+#!/usr/bin/env bash
+set -euo pipefail
 
 # Konfiguration
-BASE_URL="http://localhost:8008"
-# Ersetze diesen Token durch einen gültigen Token aus deiner Datenbank
-TOKEN="vauxl_7bd8baa5aaae4c3bb62610913191ded1"
-ROOM_ID="!db0db72633f44a37:localhost"
+BASE_URL="${BASE_URL:-http://localhost:8008}"
+ROOM_ID="${ROOM_ID:-!db0db72633f44a37:localhost}"
+: "${TOKEN:?Set TOKEN to a valid development access token}"
 
 echo "--- Starte API-Integritätsprüfung ---"
-echo "DEBUG: Token: $TOKEN"
 # 1. Test: Öffentliche Endpunkte (Erwartung: 200 OK)
 echo -e "\n[Prüfe öffentliche Endpunkte]"
 for path in "/_matrix/client/versions" "/_matrix/client/v3/capabilities"; do