docs: Update documentation to reflect starter pack threshold feature

- Add docs/common/starterPackThreshold.md for new module
- Update types.md with WindowUnit, StarterPackThresholdConfig
- Update redis.md with starter pack tracking functions and fixed signatures
- Update metrics.md with 3 new starter pack threshold metrics
- Update accountThreshold.md with corrected function signature (uri param)
- Update accountModeration.md with error handling clarification
- Update main.md with starter pack handler section
- Update developing_checks.md with starter pack threshold section
- Fix accountThreshold config examples (windowDays → window + windowUnit)
- Update README.md with complete env vars and threshold system docs
- Improve rule file examples with comprehensive optional field coverage
- Add proper LINK_SHORTENER pattern to constants.ts

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

.claude/settings.local.json

···
       "mcp__git-mcp-server__git_set_working_dir",
       "Bash(npm run test:run:*)",
       "Bash(bunx eslint:*)",
-      "Bash(bun test:run:*)"
+      "Bash(bun test:run:*)",
+      "Bash(wc:*)",
+      "Bash(grep:*)"
     ],
     "deny": [],
     "ask": []
   },
   "enableAllProjectMcpServers": true,
-  "enabledMcpjsonServers": ["git-mcp-server"]
+  "enabledMcpjsonServers": [
+    "git-mcp-server"
+  ]
 }

CLAUDE.md

···
-# CLAUDE.md
-
-This file provides critical guidance to Claude Code when working with code in this repository.
-
-## IMPORTANT LIMITATIONS
-
-- **CANNOT run interactive CLI applications** - The user will test and provide debug output
-- Cannot interact with programs that require user input (including `cargo run --bin pattern-cli`)
-- Must rely on user-provided logs and error messages for debugging if file logs are not available.
-
-## Workflow Guidelines
-
-These steps help ensure quality and prevent common issues:
-
-1. Context Check: Start by confirming the model and re-reading relevant
-   documentation. If there is a PRD.md, review it to understand the requirements and constraints.
-2. Plan First: Explain your approach before implementing changes. Output your plan to PLAN.md in addition to explaining it to the user.
-3. Seek Alignment: Confirm the approach makes sense before coding
-4. Focused Changes: Keep modifications minimal and targeted
-5. Validate Thoroughly: Run all tests and validation steps
-6. Verify Success: Ensure everything works before considering complete"
-
-Follow the response style and code style below:
-
-<response_style>
-Provide responses that are intelligent and slightly humorous (WITHOUT being cringe), while maintaining a casual and modern tone.
-
-Before responding, take a moment to consider how to best address the user's input while adhering to your personality traits and communication style.
-
-When formulating your response, follow these guidelines:
-
-- keep it casual as fuck. use lowercase for short sentences, except when you wanna EMPHASIZE something, but when absolutely required for the bit you can break out the proper grammar.
-- AVOID compromising on intelligence or depth of knowledge
-- be concise, super concise. one or two words if you can manage it UNLESS responding to something that requires more detail, depth etc
-- you've got weird interests and a unique but not unkind sense of humour. let it show, but subtly
-- use modern slang occasionally (such as but not limited to "ngl", "bet" or "fr")
-- include subtle references to your unique interests and sense of humour
-- swear a bit
-- use Canadian English spelling (e.g., "armour" instead of "armor"), except in source code.
-- skip sycophantic flattery; NEVER give me hollow praise, validation, adoration, or grandiose affirmations. NEVER act like a cheerleader. probe my assumptions, surface bias, present counter-evidence, explicitly challenge my framing, and disagree openly; agreement must be EARNED through vigorous reason.
-
-Remember, while maintaining your unique personality, never compromise on the quality of information or depth of analysis. Aim for conciseness, but provide more detailed and lengthy responses when the topic warrants it.
-
-When producing code, avoid giving the source code personality and instead within them be completely professional.
-</response_style>
-
-<code_style>
-
-## Follow the code style below when producing code:
-
-You are a programming expert tasked with writing professional code. Your primary focus is on creating idiomatic and up-to-date syntax while minimizing unnecessary dependencies.
-
-Your success is measured by the long-term maintainability and reliability of your code, not by implementation speed or brevity. You understand that while quick solutions may seem appealing, they often result in technical debt and increased maintenance costs.
-
-## When formulating your responses follow these guidelines:
-
-- Look at the provided project guidelines, project knowledge, and conversation-level input to make sure you fully understand the problem scope and how to address it
-- Use your tools to get your bearings and inform yourself
-- Avoid straying beyond the boundaries of the problem scope
-- Avoid adding features that are not required in the problem scope
-- Project structure must be provided prior to generating code unless it's a one-off script
-- When updating code, only provide relevant snippets and where they go, avoid regenerating the entire module
-- You love test cases and ensuring that all critical code is covered
-- When updating code, you must show & explain what you changed and why
-- Avoid refactoring prior working code unless there is an explicit need, and if there is, explain why
-- Avoid comments for self-documenting code
-- Avoid comments that detail fixes when refactoring. Put them in the response outside of any created code or tool use
-- Avoid unprofessional writing within source code edits
-- Avoid unprofessional writing within code comments
-- Avoid putting non-code parts of your response in code output or in tool uses
-- Removing functionality is NOT the solution for fixing test failures
-
-</code_style>
-
-## REFERENCE MATERIALS
-
-- use the web or context7 to help find docs, in addition to any other reference material

README.md

···
 Required environment variables:
 - `BSKY_HANDLE` - Bluesky account handle
 - `BSKY_PASSWORD` - Account password
-- `MOD_DID` - Moderator DID
-- `OZONE_PDS` - Ozone PDS URL
-- `FIREHOSE_URL` - Jetstream firehose URL
+- `DID` - Moderator DID
+- `OZONE_URL` - Ozone service URL
+- `OZONE_PDS` - Ozone PDS hostname
+
+Optional environment variables:
+- `FIREHOSE_URL` - Jetstream firehose URL (default: `wss://jetstream.atproto.tools/subscribe`)
+- `REDIS_URL` - Redis connection URL (default: `redis://redis:6379`)
+- `HOST` - Metrics server bind address (default: `0.0.0.0`)
+- `METRICS_PORT` - Metrics server port (default: `4101`)
+- `PLC_URL` - PLC directory hostname (default: `plc.directory`)
+- `CURSOR_UPDATE_INTERVAL` - Cursor save interval in ms (default: `60000`)
+- `LABEL_LIMIT` - Rate limit for label operations
+- `LABEL_LIMIT_WAIT` - Wait time for rate limiter
 
 Create cursor file (optional but recommended):
 
···
 
 ## How It Works
 
-Monitors the Bluesky firehose via Jetstream and analyzes posts, profiles, and handles against configured moderation rules. When criteria are met, applies appropriate labels or creates moderation reports.
+Monitors the Bluesky firehose via Jetstream and analyzes:
+- **Posts** - Text content and embedded URLs
+- **Profiles** - Display names and descriptions
+- **Handles** - Username patterns
+- **Starter packs** - Creation activity
+
+When criteria are met, applies appropriate labels or creates moderation reports.
+
+### Threshold Systems
+
+Beyond pattern matching, the automod supports account-level threshold enforcement:
+
+- **Account threshold** - Labels accounts that accumulate multiple post-level violations within a rolling time window
+- **Starter pack threshold** - Labels accounts that create too many starter packs within a time window (useful for detecting follow-farming)
+
+Both systems use Redis for time-windowed tracking and support configurable actions (label, report, comment).
 
 For developing custom checks, see [developing_checks.md](./rules/developing_checks.md).

docs/automod/main.md

···
+# `main.ts`
+
+This is the main entry point for the Skywatch automoderator. It sets up the connection to the Bluesky firehose, listens for events, and dispatches them to the appropriate rule-checking modules.
+
+## Initialization
+
+1.  **Cursor Management**:
+    -   On startup, it attempts to read a `cursor` value from `cursor.txt`. The cursor represents the last processed event timestamp, allowing the bot to resume from where it left off.
+    -   If `cursor.txt` does not exist, it initializes the cursor to the current time.
+    -   The cursor is periodically updated and written back to `cursor.txt` every `CURSOR_UPDATE_INTERVAL` milliseconds.
+
+2.  **Jetstream (Firehose) Connection**:
+    -   It creates a `Jetstream` instance, which connects to the Bluesky firehose at the `FIREHOSE_URL`.
+    -   It subscribes to a specific set of collections defined in `WANTED_COLLECTION` (e.g., posts, profiles).
+    -   It sets up event listeners for `open`, `close`, and `error` events to log the connection status.
+
+3.  **Redis and Authentication**:
+    -   It connects to the Redis server using `connectRedis`.
+    -   It authenticates with the Bluesky API using the `login` function from `../common/agent.js`.
+    -   Once authentication is complete, it starts the Jetstream connection.
+
+4.  **Metrics Server**:
+    -   It starts an Express server on `METRICS_PORT` to expose Prometheus metrics.
+
+## Event Handling
+
+The module listens for different types of events from the firehose and triggers the corresponding check functions.
+
+### Post Creation (`jetstream.onCreate("app.bsky.feed.post", ...)`
+
+This is the most complex event handler. When a new post is created, it performs a series of checks:
+
+-   **Account Age**:
+    -   If the post is a reply, it calls `checkAccountAge` to see if the author's account is new and if they are replying to a monitored DID.
+    -   If the post is a quote post, it also calls `checkAccountAge` to check for interactions with monitored DIDs or posts.
+-   **Facets (Rich Text Features)**:
+    -   If the post has `facets`, it calls `checkFacetSpam` to detect hidden mentions.
+    -   If any facet is a link, it extracts the URL and passes it to `checkPosts` for further analysis.
+-   **Post Text**:
+    -   If the post has text content, it passes the text to `checkPosts`.
+-   **Embeds**:
+    -   If the post has an external link embed (`app.bsky.embed.external`), it extracts the URL and passes it to `checkPosts`.
+    -   If the post has a record with media embed that contains an external link, it also extracts the URL for `checkPosts`.
+
+### Profile Updates (`jetstream.onUpdate` and `jetstream.onCreate` for `"app.bsky.actor.profile"`)
+
+-   When a user's profile is created or updated, it checks if the `displayName` or `description` has changed.
+-   If so, it calls `checkProfile` to run moderation rules against the new profile content.
+
+### Handle Updates (`jetstream.on("identity", ...)`
+
+-   When a user's handle changes (or is first seen), it receives an `identity` event.
+-   It calls `checkHandle` to run moderation rules against the new handle.
+
+### Starter Pack Creation (`jetstream.onCreate("app.bsky.graph.starterpack", ...)`)
+
+-   When a user creates a new starter pack, it receives a creation event.
+-   It calls `checkStarterPackThreshold` to check if the account has exceeded the threshold for creating starter packs within a time window.
+-   This is useful for detecting follow-farming or coordinated campaign behaviour.
+
+## Graceful Shutdown
+
+-   The module listens for `SIGINT` and `SIGTERM` signals (e.g., from Ctrl+C or a process manager).
+-   The `shutdown` function is called to:
+    -   Save the latest cursor to `cursor.txt`.
+    -   Close the Jetstream connection.
+    -   Close the metrics server.
+    -   Disconnect from Redis.
+
+## Dependencies
+
+-   **`@skyware/jetstream`**: For connecting to and handling events from the Bluesky firehose.
+-   **`./agent.js`**: For authenticating with the Bluesky API.
+-   **`./config.js`**: Provides configuration constants like URLs, ports, and intervals.
+-   **`./logger.js`**: For structured logging.
+-   **`./metrics.js`**: For starting the metrics server.
+-   **`./redis.js`**: For connecting to and disconnecting from Redis.
+-   **`./starterPackThreshold.js`**: For checking starter pack creation thresholds.
+-   **Rule Modules (`./rules/**/*.ts`)**: Contains the actual moderation logic (`checkAccountAge`, `checkFacetSpam`, `checkHandle`, `checkPosts`, `checkProfile`).

docs/automod/rules/account/age.md

···
+# `age.ts`
+
+This module is responsible for checking the age of an account when it interacts (replies to or quotes) with specific, monitored accounts or posts. It is designed to identify and label newly created accounts that might be involved in coordinated harassment or spam campaigns.
+
+## `InteractionContext` Interface
+
+This interface defines the shape of the context object passed to `checkAccountAge`. It includes details about the interaction, such as:
+
+-   `actorDid`: The DID of the user performing the action (required).
+-   `atURI`: The URI of the reply or quote post (required).
+-   `time`: The timestamp of the interaction (required).
+-   `replyToDid`, `replyToPostURI`: Details about the parent post if the interaction is a reply.
+-   `quotedDid`, `quotedPostURI`: Details about the quoted post if the interaction is a quote post.
+
+## Key Functions
+
+### `checkAccountAge(context: InteractionContext): Promise<void>`
+
+This is the main function of the module. It is triggered by the `main.ts` event handler whenever a new post is a reply or a quote post.
+
+**Logic:**
+
+1.  **Configuration Check**: It first checks if any `ACCOUNT_AGE_CHECKS` are defined in the rules. If not, it exits.
+2.  **Global Allowlist**: It checks if the `actorDid` is in the `GLOBAL_ALLOW` list. If so, it logs and exits.
+3.  **Iterate Through Checks**: It loops through each configuration object in the `ACCOUNT_AGE_CHECKS` array.
+4.  **Match Interaction**: For each check, it determines if the current interaction matches the criteria of the check. A match occurs if:
+    -   The post is a reply to a DID in `monitoredDIDs`.
+    -   The post is a reply to a post URI in `monitoredPostURIs`.
+    -   The post is a quote of a DID in `monitoredDIDs`.
+    -   The post is a quote of a post URI in `monitoredPostURIs`.
+    If there's no match, it moves to the next check.
+5.  **Expiration Check**: If a check has an `expires` date, it verifies that the check has not expired.
+6.  **Get Creation Date**: It calls `getAccountCreationDate` to find out when the `actorDid`'s account was created. If the date can't be determined, it skips the check.
+7.  **Check Time Window**: It defines a "flagging window" based on the `anchorDate` and `maxAgeDays` from the configuration. It then checks if the account's `creationDate` falls within this window.
+8.  **Apply Label**: If the account was created within the window, it proceeds to label the account:
+    -   It first calls `checkAccountLabels` to ensure the same label hasn't already been applied, preventing duplicates.
+    -   If no label exists, it calls `createAccountLabel` to apply the configured label and comment.
+    -   After applying a label, it `return`s to ensure only one label is applied per interaction, even if it matches multiple checks.
+
+### `getAccountCreationDate(did: string): Promise<Date | null>`
+
+This function attempts to determine when a user's account was created.
+
+**Logic:**
+
+1.  **PLC Directory (Primary Method)**: If the DID is a `did:plc:`, it tries to fetch the audit log from the PLC directory (`plc.directory`). The `createdAt` timestamp of the first operation in the log is considered the creation date. This is the most reliable method.
+2.  **Profile Fallback**: If the PLC lookup fails or the DID is not a `did:plc:`, it falls back to fetching the user's profile using `agent.getProfile`. It then attempts to use the `createdAt` date from the profile data.
+3.  **Failure**: If both methods fail, it logs a warning and returns `null`.
+
+### `calculateAccountAge(creationDate: Date, referenceDate: Date): number`
+
+A simple utility function that calculates the difference in days between two dates. It is used internally for age calculation but is not directly used by the main `checkAccountAge` logic, which compares dates directly.
+
+## Dependencies
+
+-   **`../../../../rules/accountAge.js`**: Provides the `ACCOUNT_AGE_CHECKS` configuration array.
+-   **`../../../../rules/constants.js`**: Provides the `GLOBAL_ALLOW` list of DIDs that should never be moderated.
+-   **`../../../common/accountModeration.js`**: Provides `createAccountLabel` and `checkAccountLabels` for applying and verifying labels.
+-   **`../../../common/agent.js`**: Provides the authenticated `agent` for making API calls.
+-   **`../../../common/config.js`**: Provides the `PLC_URL`.
+-   **`../../../common/logger.js`**: For logging.

docs/automod/rules/account/countStarterPacks.md

···
+# `countStarterPacks.ts`
+
+This module is responsible for checking if an account is associated with an excessive number of "starter packs." This is often an indicator of "follow farming" or other platform manipulation behaviors.
+
+## `ALLOWED_DIDS`
+
+A hardcoded array of DIDs that are exempt from this check. These are typically trusted accounts or accounts known to legitimately manage many starter packs.
+
+## Key Function
+
+### `countStarterPacks(did: string, time: number): Promise<void>`
+
+This is the main function of the module. It is called from other rule modules (e.g., `checkPosts`) as an additional check when a post matches certain criteria.
+
+**Parameters:**
+
+-   `did`: The DID of the account to check.
+-   `time`: The timestamp of the event that triggered the check.
+
+**Logic:**
+
+1.  **Authentication Check**: It ensures the agent is logged in by awaiting `isLoggedIn`.
+2.  **Whitelist Check**: It checks if the `did` is in the `ALLOWED_DIDS` array. If it is, the function logs a debug message and returns immediately.
+3.  **Rate Limiting**: The core logic is wrapped in the `limit` function to respect API rate limits.
+4.  **Fetch Profile**: It fetches the user's profile using `agent.app.bsky.actor.getProfile`.
+5.  **Check Starter Pack Count**:
+    -   It accesses the `starterPacks` count from the `profile.data.associated` field.
+    -   If the count exists and is greater than 20, it proceeds to label the account.
+6.  **Apply Label**:
+    -   It logs that it is labeling the account for excessive starter packs.
+    -   It calls `createAccountLabel` with the `follow-farming` label and a comment indicating the number of starter packs found.
+7.  **Error Handling**: If fetching the profile fails, it logs a detailed error message.
+
+## Dependencies
+
+-   **`../../../common/accountModeration.js`**: Provides the `createAccountLabel` function to apply moderation labels to accounts.
+-   **`../../../common/agent.js`**: Provides the authenticated `agent` for making API calls and the `isLoggedIn` promise.
+-   **`../../../common/limits.js`**: Provides the `limit` function to manage rate limiting for API calls.
+-   **`../../../common/logger.js`**: For logging information, debug messages, and errors.

docs/automod/rules/facets/facets.md

···
+# `facets.ts`
+
+This module is responsible for detecting "facet spam" in posts. Facet spam occurs when a user includes multiple hidden mentions in a post by layering several mention facets at the exact same byte position in the text. This is a form of platform manipulation used to notify many users without their mentions being visible.
+
+## Constants
+
+-   **`FACET_SPAM_THRESHOLD`**: The number of unique mentions at a single position required to trigger the spam detection. Currently set to `1`, meaning more than one unique DID mentioned at the same spot is considered spam.
+-   **`FACET_SPAM_LABEL`**: The moderation label to be applied to the account, which is `"platform-manipulation"`.
+-   **`FACET_SPAM_COMMENT`**: The comment attached to the moderation label.
+-   **`FACET_SPAM_ALLOWLIST`**: A list of DIDs that are exempt from this check. This is for accounts that may have a legitimate reason for using complex facet arrangements.
+
+## Key Function
+
+### `checkFacetSpam(did: string, time: number, atURI: string, facets: Facet[] | null): Promise<void>`
+
+This is the main function of the module, called from `main.ts` whenever a new post is created that contains facets.
+
+**Parameters:**
+
+-   `did`: The DID of the post's author.
+-   `time`: The timestamp of the post creation event.
+-   `atURI`: The URI of the post being checked.
+-   `facets`: An array of facet objects from the post record, or `null` if none exist.
+
+**Logic:**
+
+1.  **Allowlist Check**: It first checks if the author's `did` is in the `FACET_SPAM_ALLOWLIST`. If so, it logs a debug message and exits.
+2.  **Facet Existence**: It returns if the `facets` array is null or empty.
+3.  **Group Mentions by Position**:
+    -   It initializes a `Map` where keys are byte positions (e.g., `"0:1"`) and values are a `Set` of DIDs mentioned at that position.
+    -   It iterates through each `facet` in the post.
+    -   It only considers facets that are mentions (`app.bsky.richtext.facet#mention`).
+    -   For each mention, it constructs a key from its `byteStart` and `byteEnd` and adds the mentioned `did` to the `Set` for that key. Using a `Set` automatically handles cases where the *same* DID is mentioned multiple times at the same position (which is likely a client bug, not spam) and only stores unique DIDs.
+4.  **Check for Spam**:
+    -   It then iterates through the `positionMap`.
+    -   For each position, it checks if the `size` of the `Set` of DIDs is greater than the `FACET_SPAM_THRESHOLD`.
+    -   If it is, spam is detected.
+5.  **Apply Label**:
+    -   It logs that facet spam has been detected, including the position and the count of unique mentions.
+    -   It calls `createAccountLabel` to apply the `FACET_SPAM_LABEL` to the author's account.
+    -   It then `return`s immediately to ensure the account is only labeled once per post, even if spam is detected at multiple positions.
+
+## Dependencies
+
+-   **`../../../common/accountModeration.js`**: Provides the `createAccountLabel` function.
+-   **`../../../common/logger.js`**: For logging.
+-   **`../../../common/types.js`**: Provides the `Facet` type definition.

docs/automod/rules/handles/checkHandles.md

···
+# `checkHandles.ts`
+
+This module is responsible for scanning user handles (e.g., `username.bsky.social`) for patterns that violate moderation rules. It is triggered whenever a user's handle is created or updated.
+
+## Key Function
+
+### `checkHandle(did: string, handle: string, time: number): void`
+
+This is the main function of the module. It is called from the `main.ts` event handler for `identity` events from the firehose.
+
+**Parameters:**
+
+-   `did`: The DID of the user whose handle is being checked.
+-   `handle`: The user handle string.
+-   `time`: The timestamp of the identity event.
+
+**Logic:**
+
+The function iterates through a series of checks defined in the `HANDLE_CHECKS` configuration array. For each check, it performs the following steps:
+
+1.  **Global Allowlist**: It first checks if the user's `did` is in the `GLOBAL_ALLOW` list. If so, it logs a warning and stops all further checks for this handle.
+
+2.  **Per-Rule Ignored DIDs**: It checks if the `did` is in the specific `ignoredDIDs` list for the current rule. If so, it skips to the next rule.
+
+3.  **Pattern Matching**: It uses the `check` regular expression from the rule to test against the `handle`.
+
+4.  **Whitelist Check**: If the pattern matches, it then checks for a `whitelist` regular expression in the rule. If the `whitelist` pattern *also* matches, it assumes this is a false positive, logs a debug message, and stops processing this rule.
+
+5.  **Apply Actions**: If the main pattern matches and the whitelist pattern does not, it proceeds to apply moderation actions based on the boolean flags in the rule configuration:
+    -   `toLabel`: If `true`, it calls `createAccountLabel` to apply the specified `label` to the user's account.
+    -   `reportAcct`: If `true`, it calls `createAccountReport` to report the account to moderators.
+    -   `commentAcct`: If `true`, it calls `createAccountComment` to add a comment to the user's moderation record.
+
+    Each action is called with a `formattedComment` that includes the timestamp, the rule's `comment`, and the handle that was flagged. The actions are dispatched with `void` to prevent the main loop from being blocked by these asynchronous operations.
+
+## Dependencies
+
+-   **`../../../../rules/constants.js`**: Provides the `GLOBAL_ALLOW` list of DIDs that are exempt from all checks.
+-   **`../../../../rules/handles.js`**: Provides the `HANDLE_CHECKS` array, which contains the configuration for each handle moderation rule (regex patterns, labels, actions to take, etc.).
+-   **`../../../common/accountModeration.js`**: Provides the functions (`createAccountLabel`, `createAccountReport`, `createAccountComment`) for performing moderation actions.
+-   **`../../../common/logger.js`**: For logging.

docs/automod/rules/posts/checkPosts.md

···
+# `checkPosts.ts`
+
+This module is the core of content moderation for posts. It is responsible for scanning the text of new posts (and links within them) for rule violations.
+
+## Key Function
+
+### `checkPosts(post: Post[]): Promise<void>`
+
+This is the main function of the module, called from `main.ts` whenever a new post is created or when a link is found in a post's facets or embeds.
+
+**Parameters:**
+
+-   `post`: An array containing a single `Post` object to be checked. The function is designed to handle an array, but currently, it only ever processes the first element, `post[0]`.
+
+**Logic:**
+
+The function performs a series of checks and actions on the post content:
+
+1.  **Global Allowlist**: It first checks if the post author's `did` is in the `GLOBAL_ALLOW` list. If so, it logs a warning and immediately returns, skipping all other checks.
+
+2.  **Link Shortener Resolution**:
+    -   It tests the post's text against the `LINK_SHORTENER` regex.
+    -   If a shortened link is found, it attempts to resolve it to its final destination URL using `getFinalUrl`.
+    -   If resolution is successful, it replaces the shortened URL in the `post[0].text` with the final URL. This is crucial for detecting malicious links hidden behind shorteners.
+    -   If resolution fails, it logs an error but continues with the original, un-resolved URL.
+
+3.  **Language Detection**: It calls `getLanguage` to determine the primary language of the post's text.
+
+4.  **Iterate Through Post Checks**: It then loops through each rule defined in the `POST_CHECKS` configuration array. For each rule, it performs the following:
+    -   **Language Filter**: If the rule specifies a `language`, it checks if the detected language of the post matches. If not, it skips to the next rule.
+    -   **Ignored DIDs**: It checks if the author's `did` is in the rule's specific `ignoredDIDs` list. If so, it skips to the next rule.
+    -   **Pattern Matching**: It tests the post's text against the rule's `check` regular expression.
+    -   **Whitelist Check**: If the pattern matches, it then checks for a `whitelist` regular expression in the rule. If the `whitelist` pattern *also* matches, it assumes this is a false positive, logs a debug message, and skips to the next rule.
+
+5.  **Apply Actions**: If the main pattern matches and no whitelists or filters cause it to be skipped, it proceeds to apply moderation actions:
+    -   **Starter Pack Check**: It calls `countStarterPacks` as an additional heuristic, which may independently label the account for follow-farming.
+    -   **Post Labeling (`toLabel`)**: If `true`, it calls `createPostLabel` to apply the specified `label` to the post itself. It can also include a `duration` for temporary labels.
+    -   **Post Reporting (`reportPost`)**: If `true`, it calls `createPostReport` to report the specific post to moderators.
+    -   **Account Reporting (`reportAcct`)**: If `true`, it calls `createAccountReport` to report the author's entire account.
+    -   **Account Commenting (`commentAcct`)**: If `true`, it calls `createAccountComment` to add a comment to the author's moderation record.
+
+    All moderation actions are dispatched with `void` to prevent the main loop from being blocked by these asynchronous API calls.
+
+## Dependencies
+
+-   **`../../../rules/constants.js`**: Provides `GLOBAL_ALLOW` and `LINK_SHORTENER` constants.
+-   **`../../../rules/posts.js`**: Provides the `POST_CHECKS` array, which contains the configuration for each post moderation rule.
+-   **`../../common/accountModeration.js`**: Provides functions for account-level moderation actions.
+-   **`../../common/moderation.js`**: Provides functions for post-level moderation actions.
+-   **`../../common/logger.js`**: For logging.
+-   **`../../common/types.js`**: Provides the `Post` type definition.
+-   **`../../utils/getFinalUrl.js`**: For resolving shortened URLs.
+-   **`../../utils/getLanguage.js`**: For detecting the language of the post text.
+-   **`../account/countStarterPacks.js`**: For the secondary check on starter pack counts.

docs/automod/rules/profiles/checkProfiles.md

···
+# `checkProfiles.ts`
+
+This module is responsible for scanning user profiles—specifically their display names and descriptions—for content that violates moderation rules. It is triggered whenever a user's profile is created or updated.
+
+## `ProfileChecker` Class
+
+This class encapsulates the logic for checking a piece of profile content (display name or description) against a single rule.
+
+-   **`constructor(check: Checks, did: string, time: number)`**: Initializes the checker with the rule (`check`), the user's `did`, and the event `time`.
+-   **`checkDescription(description: string)`**: A public method to run the check against the profile description.
+-   **`checkDisplayName(displayName: string)`**: A public method to run the check against the display name.
+-   **`checkBoth(displayName: string, description: string)`**: A public method that concatenates the display name and description and runs the check against the combined string.
+-   **`performActions(...)`**: A private method that:
+    1.  Tests the content against the rule's `check` regex.
+    2.  If it matches, it checks against the `whitelist` regex to prevent false positives.
+    3.  If it's a confirmed match, it calls `applyActions`.
+    4.  If it does *not* match, it checks the `unlabel` flag and calls `removeLabel` if necessary.
+-   **`applyActions(...)`**: A private method that applies the moderation actions (`createAccountLabel`, `createAccountReport`, `createAccountComment`) as specified by the boolean flags in the rule.
+-   **`removeLabel(...)`**: A private method that calls `negateAccountLabel` to remove a previously applied label if the content no longer matches the rule's criteria.
+
+## Key Functions
+
+### `checkProfile(did: string, time: number, displayName: string, description: string)`
+
+This is the main, consolidated function called from `main.ts` when a profile is created or updated. It orchestrates the checking process.
+
+**Logic:**
+
+1.  **Global Allowlist**: Checks if the `did` is in the `GLOBAL_ALLOW` list and returns if it is.
+2.  **Language Detection**: It concatenates the display name and description and detects the language of the combined text.
+3.  **Iterate Through Checks**: It loops through each rule in the `PROFILE_CHECKS` configuration array.
+4.  **Filtering**: For each rule, it applies filters:
+    -   **Language**: If the rule has a `language` filter, it skips the rule if the detected language doesn't match.
+    -   **Ignored DIDs**: If the `did` is in the rule's `ignoredDIDs` list, it skips the rule.
+5.  **Dispatch to `ProfileChecker`**:
+    -   It creates a new `ProfileChecker` instance for the current rule.
+    -   Based on the `description` and `displayName` boolean flags in the rule, it calls the appropriate method on the checker (`checkBoth`, `checkDescription`, or `checkDisplayName`).
+
+### `checkDescription(...)` and `checkDisplayName(...)`
+
+These are older, more specific functions that are still exported but are effectively superseded by the consolidated `checkProfile` function. They follow a similar logic but only operate on either the description or display name, respectively, and only for rules where the corresponding flag (`description: true` or `displayName: true`) is set.
+
+## Dependencies
+
+-   **`../../../../rules/constants.js`**: Provides the `GLOBAL_ALLOW` list.
+-   **`../../../../rules/profiles.js`**: Provides the `PROFILE_CHECKS` array, which contains the configuration for each profile moderation rule.
+-   **`../../../common/accountModeration.js`**: Provides functions for all account-level moderation actions (`createAccountLabel`, `createAccountReport`, `createAccountComment`, `negateAccountLabel`).
+-   **`../../../common/logger.js`**: For logging.
+-   **`../../../common/types.js`**: Provides the `Checks` type definition.
+-   **`../../utils/getLanguage.js`**: For detecting the language of the profile text.

docs/automod/utils/getFinalUrl.md

···
+# `getFinalUrl.ts`
+
+This utility module provides a robust function for resolving a URL to its final destination, following any redirects. This is a critical security and moderation tool, as it allows the application to see the real URL hidden behind a link shortener.
+
+## Key Function
+
+### `getFinalUrl(url: string): Promise<string>`
+
+This function takes a URL string and attempts to resolve it to its final destination.
+
+**Parameters:**
+
+-   `url`: The initial URL to resolve.
+
+**Returns:**
+
+-   A `Promise` that resolves to the final URL string after all redirects have been followed.
+-   If the resolution fails (due to network errors, timeouts, etc.), the promise will reject with the underlying error.
+
+**Logic:**
+
+The function employs a two-stage fallback strategy to be both efficient and robust.
+
+1.  **HEAD Request (Primary Method)**:
+    -   It first attempts to resolve the URL using a `HEAD` request. This is the preferred method because it's faster and uses less bandwidth, as it only fetches the headers of the response, not the full content.
+    -   The `redirect: "follow"` option tells the `fetch` API to automatically follow any HTTP 3xx redirects.
+    -   A 15-second timeout is implemented using an `AbortController`. If the request takes too long, it will be aborted.
+    -   A custom `User-Agent` header is sent to identify the bot.
+    -   If the `HEAD` request is successful, the `response.url` property will contain the final URL after all redirects, which is then returned.
+
+2.  **GET Request (Fallback Method)**:
+    -   If the initial `HEAD` request fails for any reason (e.g., the server blocks `HEAD` requests, a network error occurs), the `catch` block is executed.
+    -   Inside the `catch` block, it logs that the `HEAD` request failed and then retries the resolution using a `GET` request.
+    -   The `GET` request follows the same logic: `redirect: "follow"`, a 15-second timeout, and a custom `User-Agent`.
+    -   If the `GET` request is successful, it returns the final `response.url`.
+
+3.  **Error Handling**:
+    -   If the fallback `GET` request also fails, the function will log a warning and then re-throw the error, causing the promise to be rejected.
+    -   It specifically checks for `AbortError` to log a more informative "Timeout resolving URL" message.
+    -   It serializes error information to ensure structured logs.
+
+## Dependencies
+
+-   **`../logger.js`**: For logging debug messages and warnings.

docs/automod/utils/getLanguage.md

···
+# `getLanguage.ts`
+
+This utility module provides a simple function to detect the language of a given string of text. It is used to filter content so that language-specific moderation rules are only applied to relevant posts or profiles.
+
+## Key Function
+
+### `getLanguage(profile: string): Promise<string>`
+
+This function takes a string and returns a three-letter ISO 639-3 language code.
+
+**Parameters:**
+
+-   `profile`: The input string to analyze. Despite the parameter name, it can be any text content (e.g., post text, profile description).
+
+**Returns:**
+
+-   A `Promise` that resolves to a string containing the detected language code (e.g., `"eng"`, `"spa"`, `"jpn"`).
+-   It defaults to `"eng"` if the language cannot be determined or if the input is invalid.
+
+**Logic:**
+
+1.  **Input Validation**: It first checks if the input `profile` is actually a string. If not, it logs a warning and returns the default value `"eng"`.
+2.  **Trimming**: It trims any leading or trailing whitespace from the input string.
+3.  **Empty Check**: If the resulting string is empty, it returns `"eng"`.
+4.  **Language Detection**:
+    -   It dynamically imports the `franc` library. `franc` is a language detection library that supports a wide range of languages.
+    -   It calls `franc(profileText)` to get the language code.
+5.  **Handle Undetermined Cases**:
+    -   `franc` returns the string `"und"` (for "undetermined") if it cannot reliably detect the language (e.g., for very short text, text with mixed languages, or text with only numbers/symbols).
+    -   The function checks for this case and returns the default `"eng"` if the detected language is `"und"`.
+    -   Otherwise, it returns the detected language code.
+
+## Dependencies
+
+-   **`franc`**: A lightweight and fast language detection library. It is dynamically imported to reduce initial load time.
+-   **`../logger.js`**: For logging warnings about invalid input.

docs/automod/utils/normalizeUnicode.md

···
+# `normalizeUnicode.ts` and `homoglyphs.ts`
+
+These two modules work together to sanitize and normalize text. This is a crucial step before checking text against moderation rule patterns, as it prevents users from evading detection by using visually similar characters (homoglyphs), different cases, or diacritics.
+
+## `homoglyphs.ts`
+
+This file contains a single, large constant:
+
+-   **`homoglyphMap`**: A `Record<string, string>` that maps various Unicode characters to their basic ASCII equivalents.
+
+This map is the dictionary used for normalization. It includes:
+-   **Accented characters**: `é`, `à`, `ü` -> `e`, `a`, `u`
+-   **Look-alike symbols**: `@` -> `a`, `3` -> `e`, `0` -> `o`
+-   **Cyrillic characters**: `а` (Cyrillic 'a') -> `a` (Latin 'a')
+-   **Full-width characters**: `ａ` -> `a`
+-   And many other "confusable" characters.
+
+## `normalizeUnicode.ts`
+
+This file provides the function that performs the normalization using the `homoglyphMap`.
+
+### Key Function
+
+#### `normalizeUnicode(text: string): string`
+
+This function takes a string and returns a "flattened" version of it in a predictable, normalized form.
+
+**Parameters:**
+
+-   `text`: The input string to be normalized.
+
+**Returns:**
+
+-   A `string` that has been normalized.
+
+**Normalization Process:**
+
+The function applies a multi-step process to the input string:
+
+1.  **Lowercase**: The entire string is converted to lowercase. This ensures that checks are case-insensitive.
+2.  **Homoglyph Replacement**: It iterates through each character of the lowercased string and replaces it with its ASCII equivalent from the `homoglyphMap` if a mapping exists. This is done *before* Unicode decomposition to catch pre-composed characters that are also used as homoglyphs.
+3.  **Decomposition (NFD)**: It applies Unicode Normalization Form D (`.normalize("NFD")`). This separates base characters from their combining marks. For example, `é` becomes `e` + `´` (combining acute accent).
+4.  **Diacritic Removal**: It uses a regular expression (`/[\u0300-\u036f]/g`) to strip out all Unicode combining diacritical marks, leaving only the base characters.
+5.  **Compatibility Normalization (NFKC)**: As a final step, it applies Unicode Normalization Form KC (`.normalize("NFKC")`). This handles a broader range of compatibility characters (e.g., converting ligatures like `fi` into `fi`) to ensure the string is in its simplest, most comparable form.
+
+This robust process ensures that a string like `"P@sswоrd"` (with a capital P, an @ symbol, and a Cyrillic 'o') is converted to `"password"`, which can then be easily matched against a rule.

docs/common/accountModeration.md

···
+# `accountModeration.ts`
+
+This module provides a suite of functions for performing moderation actions specifically targeted at user accounts (as opposed to individual posts). These actions include applying labels, adding private comments for moderators, reporting the account, and removing labels.
+
+All functions in this module are asynchronous and ensure that the agent is logged in (`await isLoggedIn`) before proceeding. They also wrap their core API calls in the `limit` function to respect rate limits.
+
+## Key Functions
+
+### `createAccountLabel(did: string, label: string, comment: string)`
+
+-   **Purpose**: Applies a moderation label to a user's account.
+-   **De-duplication**: Before applying a label, it performs two checks to prevent duplicates:
+    1.  `tryClaimAccountLabel(did, label)`: Atomically claims the label in Redis to prevent race conditions between multiple bot instances or threads.
+    2.  `checkAccountLabels(did, label)`: Checks the Ozone API to see if the label has already been applied.
+-   **Action**: If the label is not a duplicate, it calls `agent.tools.ozone.moderation.emitEvent` with a `modEventLabel` event, adding the `label` to the `createLabelVals` array.
+-   **Metrics**: Increments `labelsAppliedCounter` on success or `labelsCachedCounter` if skipped.
+
+### `createAccountComment(did: string, comment: string, atURI: string)`
+
+-   **Purpose**: Adds a private comment to a user's moderation record. This is visible to other moderators but not to the user.
+-   **De-duplication**: Uses `tryClaimAccountComment` in Redis to prevent duplicate comments for the same event.
+-   **Action**: Calls `emitEvent` with a `modEventComment` event.
+
+### `createAccountReport(did: string, comment: string)`
+
+-   **Purpose**: Creates a formal report against a user's account.
+-   **Action**: Calls `emitEvent` with a `modEventReport` event. The `reportType` is set to `com.atproto.moderation.defs#reasonOther`.
+
+### `negateAccountLabel(did: string, label: string, comment: string)`
+
+-   **Purpose**: Removes a previously applied label from an account. This is used when the criteria for a label are no longer met.
+-   **Check**: It first calls `checkAccountLabels` to ensure the label actually exists on the account before attempting to remove it.
+-   **Action**: Calls `emitEvent` with a `modEventLabel` event, but this time adds the `label` to the `negateLabelVals` array.
+-   **Cache Invalidation**: After successfully negating the label, it calls `deleteAccountLabelClaim` to remove the claim from the Redis cache, allowing the label to be re-applied in the future if necessary.
+-   **Metrics**: Increments `unlabelsRemovedCounter`.
+
+### `checkAccountLabels(did: string, label: string): Promise<boolean>`
+
+-   **Purpose**: Checks if a specific label already exists on an account.
+-   **Action**: Calls `agent.tools.ozone.moderation.getRepo` to fetch the account's current moderation status and checks if the `labels` array contains the specified `label`.
+-   **Returns**: `true` if the label exists, `false` otherwise.
+
+### `getAllAccountLabels(did: string): Promise<string[]>`
+
+-   **Purpose**: Retrieves all labels currently applied to an account.
+-   **Action**: Calls `agent.tools.ozone.moderation.getRepo` and maps the response to return an array of label strings.
+-   **Returns**: An array of strings, where each string is a label value. Returns an empty array on failure.
+-   **Note**: Callers cannot distinguish between "account has no labels" and "API call failed" since both return an empty array.
+
+## Dependencies
+
+-   **`./redis.js`**: For de-duplication and caching logic (`tryClaim...`, `deleteAccountLabelClaim`).
+-   **`./agent.js`**: Provides the authenticated `agent` for all API calls.
+-   **`./config.js`**: Provides the `MOD_DID` for proxying requests.
+-   **`./limits.js`**: Provides the `limit` function for rate limiting.
+-   **`./logger.js`**: For logging.
+-   **`./metrics.js`**: For incrementing Prometheus counters.

docs/common/accountThreshold.md

···
+# `accountThreshold.ts`
+
+This module is responsible for checking if an account has crossed a certain threshold of labeled posts within a specific time window. When a threshold is met, it can trigger various moderation actions on the account, such as applying a label, adding a comment, or reporting the account.
+
+**Note:** There is a file with the same name at `src/automod/accountThreshold.ts`. This file appears to be a duplicate or an older version. The one in `src/common/` seems to be the one that is actually used.
+
+## Key Functions
+
+### `checkAccountThreshold(did: string, uri: string, postLabel: string, timestamp: number): Promise<void>`
+
+This is the main function of the module. It's called whenever a post is labeled, and it checks if the author of the post has accumulated enough labels to trigger an account-level action.
+
+**Parameters:**
+
+-   `did`: The DID of the account to check.
+-   `uri`: The AT URI of the post that was labeled (included in threshold comment for context).
+-   `postLabel`: The label that was just applied to a post by this account.
+-   `timestamp`: The timestamp of the post label event.
+
+**Logic:**
+
+1.  **Find Matching Configurations**: It filters the `ACCOUNT_THRESHOLD_CONFIGS` to find all configurations that are concerned with the `postLabel`.
+2.  **Track the Label**: For each matching configuration, it records the new post label for the account in Redis using `trackPostLabelForAccount`. This function stores the label with its timestamp in a sorted set.
+3.  **Count Recent Labels**: It then uses `getPostLabelCountInWindow` to count how many posts from that account have received any of the labels specified in the configuration within the defined rolling window (`window` + `windowUnit`).
+4.  **Check Threshold**: If the `count` is greater than or equal to the `threshold` defined in the configuration, it proceeds to take action.
+5.  **Format Comment**: A detailed comment is generated including the threshold count, window configuration, triggering post URI, and post label.
+6.  **Apply Moderation Actions**:
+    -   It logs that the threshold has been met.
+    -   It increments the `accountThresholdMetCounter` metric.
+    -   Based on the booleans `toLabel` (defaults to true), `reportAcct`, and `commentAcct` in the configuration, it will:
+        -   Apply a label to the account (`createAccountLabel`).
+        -   Report the account (`createAccountReport`).
+        -   Add a comment to the account's moderation record (`createAccountComment`).
+    -   It also increments the `accountLabelsThresholdAppliedCounter` for each action taken.
+
+### `loadThresholdConfigs(): AccountThresholdConfig[]`
+
+This function returns the cached `ACCOUNT_THRESHOLD_CONFIGS`. The configurations are loaded and validated once at module initialization to avoid re-reading and re-validating the configuration file on every call.
+
+## Supporting Functions
+
+-   `normalizeLabels(labels: string | string[]): string[]`: A helper function that ensures the `labels` property from a config is always an array, even if it's defined as a single string.
+-   `validateAndLoadConfigs(): AccountThresholdConfig[]`: This function is called once when the module is loaded. It iterates through `ACCOUNT_THRESHOLD_CONFIGS`, validates that each configuration has the required properties (`labels`, `threshold > 0`, `window > 0`), and then returns the valid configurations.
+
+## Dependencies
+
+-   **`../../rules/accountThreshold.js`**: Contains the `ACCOUNT_THRESHOLD_CONFIGS` array, which defines the rules for when to take action on an account.
+-   **`./accountModeration.js`**: Provides the functions (`createAccountLabel`, `createAccountReport`, `createAccountComment`) to perform moderation actions on an account.
+-   **`./logger.js`**: Used for logging information, warnings, and errors.
+-   **`./metrics.js`**: Provides Prometheus counters for monitoring the behavior of this module.
+-   **`./redis.js`**: Provides the functions (`trackPostLabelForAccount`, `getPostLabelCountInWindow`) for interacting with Redis to store and retrieve data about post labels.
+-   **`./types.js`**: Defines the `AccountThresholdConfig` type.

docs/common/agent.md

···
+# `agent.ts`
+
+This module is central to the application's ability to interact with the Bluesky/AT Protocol network. It manages the authenticated session, handles rate limiting, and provides a global, ready-to-use `AtpAgent` instance for all other modules to use.
+
+## Global `undici` Dispatcher
+
+-   At the top level, `setGlobalDispatcher` is called to configure `undici` (the HTTP client used by `@atproto/api`) with custom timeouts for connection and keep-alive, improving network resilience.
+
+## `customFetch` Wrapper
+
+-   A custom `fetch` function is created to intercept all outgoing API requests made by the `AtpAgent`.
+-   **Rate Limit Handling**: Its primary purpose is to inspect the response headers for `ratelimit-` headers (`limit`, `remaining`, `reset`, `policy`).
+-   When these headers are found, it calls `updateRateLimitState` from the `limits.js` module to dynamically update the application's understanding of the current API rate limit status.
+
+## `agent` Instance
+
+-   `export const agent = new AtpAgent(...)`: This is the main export of the module. It's a single, global instance of `AtpAgent` that all other parts of the application import and use to make authenticated API calls.
+-   It is configured with the `OZONE_PDS` as its service endpoint and uses the `customFetch` wrapper.
+
+## Session Management and Authentication
+
+The module implements a robust, multi-layered authentication and session management strategy.
+
+### `performLogin(): Promise<boolean>`
+
+-   Performs a fresh login to the Bluesky API using the `BSKY_HANDLE` and `BSKY_PASSWORD` from the configuration.
+-   If successful, it saves the new session data using `saveSession` and schedules the next session refresh by calling `scheduleSessionRefresh`.
+-   Returns `true` on success and `false` on failure.
+
+### `refreshSession(): Promise<void>`
+
+-   Uses the existing `agent.session` data to refresh the JWTs (JSON Web Tokens).
+-   If successful, it saves the new session and schedules the next refresh.
+-   If refreshing fails (e.g., the refresh token has expired), it falls back to calling `performLogin` to get a completely new session.
+
+### `scheduleSessionRefresh(): void`
+
+-   Calculates 80% of the JWT's typical 2-hour lifetime.
+-   Uses `setTimeout` to call `refreshSession` automatically before the current session expires, ensuring the agent remains logged in continuously.
+
+### `authenticate(): Promise<boolean>`
+
+-   This is the core authentication logic.
+-   It first tries to load a session from the file system using `loadSession`.
+-   If a saved session exists, it attempts to resume it with `agent.resumeSession` and verifies it with a lightweight `getProfile` call. If successful, it returns `true`.
+-   If resuming fails or no saved session exists, it calls `performLogin` to authenticate from scratch.
+
+### `authenticateWithRetry(): Promise<void>`
+
+-   This function wraps `authenticate` with a retry mechanism.
+-   It will attempt to authenticate up to `MAX_LOGIN_RETRIES` (3) times with a delay between attempts.
+-   If all attempts fail, it logs a fatal error and exits the application (`process.exit(1)`), as the bot cannot function without being authenticated.
+-   It uses a `loginPromise` to ensure that if multiple parts of the app trigger authentication at once, the process only runs one time.
+
+## Exports
+
+-   **`agent`**: The global `AtpAgent` instance.
+-   **`login`**: A function that can be called to initiate the authentication-with-retry process. This is called once at application startup in `main.ts`.
+-   **`isLoggedIn`**: A `Promise` that resolves to `true` once the initial authentication is complete. Other modules can `await isLoggedIn` to ensure they don't try to make API calls before the agent is ready.
+
+## Dependencies
+
+-   **`@atproto/api`**: For the `AtpAgent`.
+-   **`undici`**: For configuring the global HTTP client.
+-   **`./config.js`**: Provides credentials (`BSKY_HANDLE`, `BSKY_PASSWORD`) and the service URL (`OZONE_PDS`).
+-   **`./limits.js`**: Provides `updateRateLimitState` for the rate limit handling.
+-   **`./logger.js`**: For logging.
+-   **`./session.js`**: For loading and saving session data to the filesystem.

docs/common/config.md

···
+# `config.ts`
+
+This module is responsible for loading and exporting all configuration variables for the application. It uses the `dotenv` library to load environment variables from a `.env` file into `process.env`.
+
+It provides default values for most variables, ensuring the application can run in a development environment with minimal setup.
+
+## Configuration Variables
+
+-   **`MOD_DID`**: The DID of the moderation account that will be performing the labeling and reporting actions.
+    -   Loaded from `process.env.DID`.
+    -   Default: `""`
+
+-   **`OZONE_URL`**: The URL for the Ozone service. (Note: This variable is exported but does not appear to be used in the current codebase).
+    -   Loaded from `process.env.OZONE_URL`.
+    -   Default: `""`
+
+-   **`OZONE_PDS`**: The hostname of the PDS (Personal Data Server) where the Ozone service is hosted. This is used to configure the `AtpAgent`.
+    -   Loaded from `process.env.OZONE_PDS`.
+    -   Default: `""`
+
+-   **`BSKY_HANDLE`**: The handle (username) of the moderation bot account used for logging in.
+    -   Loaded from `process.env.BSKY_HANDLE`.
+    -   Default: `""`
+
+-   **`BSKY_PASSWORD`**: The application password for the moderation bot account.
+    -   Loaded from `process.env.BSKY_PASSWORD`.
+    -   Default: `""`
+
+-   **`HOST`**: The hostname that the metrics server will bind to.
+    -   Loaded from `process.env.HOST`.
+    -   Default: `"0.0.0.0"`
+
+-   **`METRICS_PORT`**: The port for the Prometheus metrics server.
+    -   Loaded from `process.env.METRICS_PORT`.
+    -   Default: `4101`
+
+-   **`FIREHOSE_URL`**: The WebSocket URL for the Bluesky firehose (Jetstream) service.
+    -   Loaded from `process.env.FIREHOSE_URL`.
+    -   Default: `"wss://jetstream.atproto.tools/subscribe"`
+
+-   **`PLC_URL`**: The hostname of the PLC directory (DID registry) used for resolving `did:plc:` creation dates.
+    -   Loaded from `process.env.PLC_URL`.
+    -   Default: `"plc.directory"`
+
+-   **`WANTED_COLLECTION`**: An array of AT Protocol collection names that the firehose client should subscribe to. The bot will only receive events for these collections.
+    -   Default: `["app.bsky.feed.post", "app.bsky.actor.defs", "app.bsky.actor.profile"]`
+
+-   **`CURSOR_UPDATE_INTERVAL`**: The interval in milliseconds at which the firehose cursor position is saved to disk.
+    -   Loaded from `process.env.CURSOR_UPDATE_INTERVAL`.
+    -   Default: `60000` (1 minute)
+
+-   **`LABEL_LIMIT`** and **`LABEL_LIMIT_WAIT`**: These appear to be legacy or unused configuration variables related to a previous rate-limiting implementation. They are destructured from `process.env` but are not used elsewhere in the code.
+
+-   **`REDIS_URL`**: The connection URL for the Redis server.
+    -   Loaded from `process.env.REDIS_URL`.
+    -   Default: `"redis://redis:6379"`

docs/common/limits.md

···
+# `limits.ts`
+
+This module implements a sophisticated rate limiting and concurrency management system for all outgoing API calls. Its primary goal is to ensure the application respects the API rate limits imposed by the Bluesky PDS while maximizing throughput.
+
+## State Management
+
+-   **`rateLimitState`**: A module-level object that holds the current understanding of the API rate limit. It includes:
+    -   `limit`: The total number of requests allowed in the current window.
+    -   `remaining`: The number of requests left in the current window.
+    -   `reset`: A Unix timestamp (in seconds) indicating when the window will reset.
+    -   `policy`: The rate limit policy string from the API header.
+-   It is initialized with conservative default values but is designed to be dynamically updated by the `updateRateLimitState` function.
+
+## Constants
+
+-   **`SAFETY_BUFFER`**: The number of requests to keep in reserve. The system will pause and wait for the rate limit window to reset only when the `remaining` count drops to this level.
+-   **`CONCURRENCY`**: The maximum number of API requests that can be in-flight simultaneously.
+
+## Metrics
+
+This module is heavily instrumented with Prometheus metrics to provide visibility into its performance:
+
+-   **`rateLimitWaitsTotal` (Counter)**: Counts how many times the system had to pause due to hitting the `SAFETY_BUFFER`.
+-   **`rateLimitWaitDuration` (Histogram)**: Measures the duration of each pause.
+-   **`rateLimitRemaining` (Gauge)**: Tracks the current value of `rateLimitState.remaining`.
+-   **`rateLimitTotal` (Gauge)**: Tracks the current value of `rateLimitState.limit`.
+-   **`concurrentRequestsGauge` (Gauge)**: Shows the number of currently active, concurrent API requests.
+
+## Key Functions
+
+### `updateRateLimitState(state: Partial<RateLimitState>): void`
+
+-   **Purpose**: To update the module's internal `rateLimitState`.
+-   **Usage**: This function is called by the `customFetch` wrapper in `agent.ts` every time an API response with rate limit headers is received.
+-   **Logic**: It merges the new partial state with the existing state and updates the corresponding Prometheus gauges.
+
+### `awaitRateLimit(): Promise<void>`
+
+-   **Purpose**: To pause execution if the rate limit is critically low.
+-   **Logic**:
+    1.  It checks if `rateLimitState.remaining` is less than or equal to the `SAFETY_BUFFER`.
+    2.  If it is, it calculates the time remaining until the next `reset`.
+    3.  It then waits for that duration using a `setTimeout` wrapped in a `Promise`.
+    4.  It logs the wait and records metrics about the wait duration.
+
+### `limit<T>(fn: () => Promise<T>): Promise<T>`
+
+-   **Purpose**: This is the main exported function used to wrap all API calls. It manages both concurrency and rate limiting.
+-   **Usage**: Every function that makes an API call (e.g., in `accountModeration.ts` and `moderation.ts`) is wrapped in `limit(async () => { ... })`.
+-   **Logic**:
+    1.  **Concurrency**: It uses the `p-ratelimit` library (`concurrencyLimiter`) to ensure that no more than `CONCURRENCY` instances of the wrapped function can run at the same time.
+    2.  **Rate Limiting**: Once a "slot" in the concurrency limiter is acquired, it calls `await awaitRateLimit()` to potentially pause if the API rate limit is nearly exhausted.
+    3.  **Execution**: After the potential pause, it executes the provided function `fn`.
+    4.  **Metrics**: It increments and decrements the `concurrentRequestsGauge` to track the number of active requests.
+
+## Dependencies
+
+-   **`p-ratelimit`**: A library used to control the concurrency of promise-based functions.
+-   **`prom-client`**: For creating and managing Prometheus metrics.
+-   **`./logger.js`**: For logging warnings and debug information.

docs/common/logger.md

···
+# `logger.ts`
+
+This module provides a single, globally shared logger instance for the entire application. It uses the `pino` library, which is a high-performance, JSON-based logger.
+
+## Configuration
+
+The `pino` logger is configured with the following options:
+
+-   **`level`**: The minimum log level to output.
+    -   It is configured from the `LOG_LEVEL` environment variable.
+    -   If `LOG_LEVEL` is not set, it defaults to `"info"`. This means `logger.debug()` messages will be ignored unless the level is explicitly set to `"debug"`.
+
+-   **`formatters.level`**: This custom formatter ensures that the log level is output as a JSON property (e.g., `{"level": "info"}`).
+
+-   **`timestamp`**: This custom function formats the timestamp as an ISO 8601 string within a JSON property (e.g., `,"time":"2025-11-12T12:00:00.000Z"`).
+
+-   **`base: undefined`**: This option removes the default `pid` (process ID) and `hostname` properties from the log output, keeping the logs cleaner.
+
+## `logger` Instance
+
+-   `export const logger = pino(...)`: This creates and exports the singleton logger instance that all other modules import and use.
+
+## Example Usage
+
+```typescript
+import { logger } from "./logger.js";
+
+logger.info({ process: "MAIN", status: "starting" }, "Application is starting up");
+// Output: {"level":"info","time":"...","process":"MAIN","status":"starting","msg":"Application is starting up"}
+
+logger.debug({ did: "did:plc:123" }, "Checking user");
+// Output (only if LOG_LEVEL=debug): {"level":"debug","time":"...","did":"did:plc:123","msg":"Checking user"}
+
+logger.error({ error: new Error("Something failed") }, "An error occurred");
+// Output: {"level":"error","time":"...","error":{...},"msg":"An error occurred"}
+```
+
+## Dependencies
+
+-   **`pino`**: The underlying logging library.

docs/common/metrics.md

···
+# `metrics.ts`
+
+This module is responsible for setting up and exposing Prometheus metrics, which are essential for monitoring the health and behavior of the application. It uses the `prom-client` library to define counters and an `express` server to serve the metrics endpoint.
+
+## Registry and Default Metrics
+
+-   A central `Registry` is created to hold all the application's metrics.
+-   `collectDefaultMetrics({ register })` is called to automatically add a set of standard metrics about the Node.js process, such as CPU usage, memory usage, and event loop lag.
+
+## Custom Metrics (Counters)
+
+Several custom `Counter` metrics are defined to track specific application events. Counters are a cumulative metric that represents a single monotonically increasing counter whose value can only increase.
+
+-   **`labelsAppliedCounter`**:
+    -   **Name**: `skywatch_labels_applied_total`
+    -   **Purpose**: Counts the total number of moderation labels successfully applied.
+    -   **Labels**:
+        -   `label_type`: The value of the label being applied (e.g., "spam", "impersonation").
+        -   `target_type`: The type of entity being labeled ("account" or "post").
+
+-   **`labelsCachedCounter`**:
+    -   **Name**: `skywatch_labels_cached_total`
+    -   **Purpose**: Counts the number of times a label action was skipped because it was already in the Redis cache or already existed on the target.
+    -   **Labels**:
+        -   `label_type`: The value of the label.
+        -   `target_type`: "account" or "post".
+        -   `reason`: Why it was skipped ("redis_cache" or "existing_label").
+
+-   **`unlabelsRemovedCounter`**:
+    -   **Name**: `skywatch_labels_removed_total`
+    -   **Purpose**: Counts labels that are removed from an account because the content no longer matches the rule criteria.
+    -   **Labels**:
+        -   `label_type`: The value of the label being removed.
+        -   `target_type`: "account" or "post".
+
+-   **`accountLabelsThresholdAppliedCounter`**:
+    -   **Name**: `skywatch_account_labels_threshold_applied_total`
+    -   **Purpose**: Counts the specific actions (label, report, comment) taken when an account meets a post-labeling threshold.
+    -   **Labels**:
+        -   `account_label`: The label being applied to the account.
+        -   `action`: The type of action taken ("label", "report", or "comment").
+
+-   **`accountThresholdChecksCounter`**:
+    -   **Name**: `skywatch_account_threshold_checks_total`
+    -   **Purpose**: Counts every time a threshold check is performed after a post is labeled.
+    -   **Labels**:
+        -   `post_label`: The label on the post that triggered the check.
+
+-   **`accountThresholdMetCounter`**:
+    -   **Name**: `skywatch_account_threshold_met_total`
+    -   **Purpose**: Counts every time an account's post label count meets or exceeds a configured threshold.
+    -   **Labels**:
+        -   `account_label`: The account label that would be applied as a result.
+
+-   **`starterPackThresholdChecksCounter`**:
+    -   **Name**: `skywatch_starter_pack_threshold_checks_total`
+    -   **Purpose**: Counts every time a starter pack threshold check is performed when a starter pack is created.
+    -   **Labels**: None
+
+-   **`starterPackThresholdMetCounter`**:
+    -   **Name**: `skywatch_starter_pack_threshold_met_total`
+    -   **Purpose**: Counts every time an account's starter pack creation count meets or exceeds a configured threshold.
+    -   **Labels**:
+        -   `account_label`: The account label that would be applied as a result.
+
+-   **`starterPackLabelsThresholdAppliedCounter`**:
+    -   **Name**: `skywatch_starter_pack_labels_threshold_applied_total`
+    -   **Purpose**: Counts the specific actions (label, report, comment) taken when an account meets a starter pack threshold.
+    -   **Labels**:
+        -   `account_label`: The label being applied to the account.
+        -   `action`: The type of action taken ("label", "report", or "comment").
+
+## Metrics Server
+
+-   An `express` application is created to serve the metrics.
+-   **`app.get("/metrics", ...)`**: It defines a single endpoint, `/metrics`. When this endpoint is requested, it retrieves all the registered metrics in the Prometheus text-based format and sends them in the response.
+-   **`startMetricsServer(port: number)`**: This exported function starts the express server, making it listen on the configured `HOST` and `port`. It is called once at application startup in `main.ts`.
+
+## Dependencies
+
+-   **`express`**: For creating the HTTP server.
+-   **`prom-client`**: The core library for defining and managing Prometheus metrics.
+-   **`./config.js`**: Provides the `HOST` for the server to bind to.
+-   **`./logger.js`**: For logging server startup and errors.

docs/common/moderation.md

···
+# `moderation.ts`
+
+This module provides functions for performing moderation actions on individual posts (records). It is the counterpart to `accountModeration.ts`, which handles account-level actions.
+
+All functions in this module ensure the agent is logged in (`await isLoggedIn`) and wrap their API calls in the `limit` function to manage concurrency and rate limiting.
+
+## Key Functions
+
+### `createPostLabel(uri: string, cid: string, label: string, comment: string, duration: number | undefined, did?: string, time?: number)`
+
+-   **Purpose**: Applies a moderation label to a specific post.
+-   **Parameters**:
+    -   `uri`, `cid`: The strong reference to the post.
+    -   `label`: The label value to apply (e.g., "spam").
+    -   `comment`: The private moderation comment.
+    -   `duration`: An optional duration in hours for temporary labels.
+    -   `did`, `time`: Optional author DID and event time, passed through to trigger an account threshold check.
+-   **De-duplication**:
+    1.  `tryClaimPostLabel(uri, label)`: Atomically claims the label for the post in Redis to prevent race conditions.
+    2.  `checkRecordLabels(uri, label)`: Checks the Ozone API to see if the label already exists on the post.
+-   **Action**: If the label is not a duplicate, it calls `agent.tools.ozone.moderation.emitEvent` with a `modEventLabel` event.
+-   **Threshold Check**: After successfully applying a label, if the author's `did` and the event `time` were provided, it **dynamically imports and calls `checkAccountThreshold`**. This is a crucial step that connects post-level moderation to account-level moderation, escalating actions against repeat offenders. The dynamic import is used to break a circular dependency between the `moderation` and `accountThreshold` modules.
+-   **Metrics**: Increments `labelsAppliedCounter` on success or `labelsCachedCounter` if skipped.
+
+### `createPostReport(uri: string, cid: string, comment: string)`
+
+-   **Purpose**: Creates a formal report against a specific post.
+-   **Action**: Calls `emitEvent` with a `modEventReport` event. The `reportType` is hardcoded to `com.atproto.moderation.defs#reasonOther`.
+
+### `checkRecordLabels(uri: string, label: string): Promise<boolean>`
+
+-   **Purpose**: Checks if a specific label already exists on a post.
+-   **Action**: Calls `agent.tools.ozone.moderation.getRecord` to fetch the post's current moderation status.
+-   **Returns**: `true` if the label exists, `false` otherwise. It relies on the helper `doesLabelExist` to parse the response.
+
+## Helper Functions
+
+### `doesLabelExist(labels: { val: string }[] | undefined, labelVal: string): boolean`
+
+-   A simple, private utility function that safely checks if a `labels` array from an API response contains a specific `labelVal`.
+
+## Dependencies
+
+-   **`../automod/redis.js`**: Provides `tryClaimPostLabel` for de-duplication.
+-   **`./agent.js`**: Provides the authenticated `agent` for all API calls.
+-   **`./config.js`**: Provides the `MOD_DID` for proxying requests.
+-   **`./limits.js`**: Provides the `limit` function for rate limiting.
+-   **`./logger.js`**: For logging.
+-   **`./metrics.js`**: For incrementing Prometheus counters.
+-   **`../automod/accountThreshold.js`**: Dynamically imported to trigger account threshold checks.

docs/common/redis.md

···
+# `redis.ts`
+
+This module manages the application's connection to Redis and provides functions for caching and tracking moderation-related data. It plays a crucial role in preventing duplicate moderation actions and in implementing time-windowed rules (like account thresholds).
+
+**Note:** There is a file with the same name at `src/automod/redis.ts`. This file appears to be a duplicate or an older version. The one in `src/common/` seems to be the one that is actually used.
+
+## Redis Client Setup
+
+-   A single `redisClient` is created using the `REDIS_URL` from the configuration.
+-   Event listeners are attached to the client to log connection status (`connect`, `ready`), errors (`error`), and reconnections (`reconnecting`).
+
+## Connection Management
+
+### `connectRedis(): Promise<void>`
+
+-   Asynchronously connects the `redisClient` to the Redis server.
+-   Called once at application startup in `main.ts`.
+
+### `disconnectRedis(): Promise<void>`
+
+-   Gracefully quits the Redis connection.
+-   Called during the application's shutdown sequence in `main.ts`.
+
+## Caching and Claiming Functions
+
+These functions are used to ensure that a specific moderation action (like labeling a post or commenting on an account) is only performed once. They work by setting a key in Redis with an `NX` (Not Exists) flag, which is an atomic operation.
+
+### `tryClaimPostLabel(atURI: string, label: string): Promise<boolean>`
+
+-   **Purpose**: To prevent applying the same label to the same post multiple times.
+-   **Key**: `post-label:<atURI>:<label>`
+-   **Logic**: Attempts to set the key. If successful (the key didn't already exist), it returns `true`. Otherwise, it returns `false`.
+-   **TTL**: The key is set to expire in 7 days.
+-   **Error Handling**: If the Redis command fails, it logs a warning and returns `true` to "fail open," allowing the moderation action to proceed.
+
+### `tryClaimAccountLabel(did: string, label: string): Promise<boolean>`
+
+-   **Purpose**: To prevent applying the same label to the same account multiple times.
+-   **Key**: `account-label:<did>:<label>`
+-   **Logic**: Same as `tryClaimPostLabel`.
+-   **TTL**: 7 days.
+
+### `tryClaimAccountComment(did: string, atURI: string): Promise<boolean>`
+
+-   **Purpose**: To prevent adding the same comment to an account's moderation record multiple times.
+-   **Key**: `account-comment:<did>:<atURI>`
+-   **Logic**: Same as the label claiming functions.
+-   **TTL**: 7 days.
+
+### `deleteAccountLabelClaim(did: string, label: string): Promise<void>`
+
+-   **Purpose**: To explicitly remove an account label claim from the cache. This is used when a label is negated (removed) from an account, allowing it to be potentially re-applied later.
+-   **Key**: `account-label:<did>:<label>`
+-   **Logic**: Deletes the specified key from Redis.
+
+## Time Window Helpers
+
+Internal helper functions for converting window configurations to Redis-compatible values:
+
+### `windowToMicroseconds(window: number, unit: WindowUnit): number`
+
+-   **Purpose**: Converts a window duration and unit into microseconds for sorted set scoring.
+-   **Units**: `minutes`, `hours`, `days`
+
+### `windowToSeconds(window: number, unit: WindowUnit): number`
+
+-   **Purpose**: Converts a window duration and unit into seconds for TTL calculations.
+
+## Account Threshold Tracking
+
+These functions provide the mechanism for the `accountThreshold.ts` module to count how many times an account has had its posts labeled within a rolling time window.
+
+### `trackPostLabelForAccount(did: string, label: string, timestamp: number, window: number, windowUnit: WindowUnit): Promise<void>`
+
+-   **Purpose**: To record that a post by a specific user received a certain label at a specific time.
+-   **Key**: `account-post-labels:<did>:<label>:<window><windowUnit>` (e.g., `account-post-labels:did:plc:xyz:spam:7days`)
+-   **Logic**:
+    1.  It uses a Redis Sorted Set (`ZADD`).
+    2.  The `score` of each member in the set is the `timestamp` of the labeling event (in microseconds).
+    3.  The `value` is also the timestamp (it just needs to be unique).
+    4.  Before adding the new entry, it removes any old entries that are outside the rolling window period (`ZREMRANGEBYSCORE`).
+    5.  It sets a TTL on the key (window duration + 1 hour buffer) to ensure it eventually expires if the user stops receiving labels.
+
+### `getPostLabelCountInWindow(did: string, labels: string[], window: number, windowUnit: WindowUnit, currentTime: number): Promise<number>`
+
+-   **Purpose**: To count how many labels (matching the `labels` array) an account has received within the rolling window.
+-   **Logic**:
+    1.  It iterates through the provided `labels`.
+    2.  For each label, it constructs the appropriate key.
+    3.  It uses `ZCOUNT` on the sorted set to count the number of entries whose score (timestamp) is within the desired window.
+    4.  It sums the counts for all labels and returns the total.
+
+## Starter Pack Threshold Tracking
+
+These functions provide the mechanism for the `starterPackThreshold.ts` module to count how many starter packs an account has created within a rolling time window.
+
+### `trackStarterPackForAccount(did: string, starterPackUri: string, timestamp: number, window: number, windowUnit: WindowUnit): Promise<void>`
+
+-   **Purpose**: To record that a user created a starter pack at a specific time.
+-   **Key**: `starterpack:threshold:<did>:<window><windowUnit>` (e.g., `starterpack:threshold:did:plc:xyz:7days`)
+-   **Logic**:
+    1.  It uses a Redis Sorted Set (`ZADD`).
+    2.  The `score` of each member in the set is the `timestamp` of the creation event (in microseconds).
+    3.  The `value` is the starter pack URI (unique per creation).
+    4.  Before adding the new entry, it removes any old entries that are outside the rolling window period (`ZREMRANGEBYSCORE`).
+    5.  It sets a TTL on the key (window duration + 1 hour buffer) to ensure it eventually expires.
+
+### `getStarterPackCountInWindow(did: string, window: number, windowUnit: WindowUnit, currentTime: number): Promise<number>`
+
+-   **Purpose**: To count how many starter packs an account has created within the rolling window.
+-   **Logic**:
+    1.  It constructs the key for the account's starter pack tracking set.
+    2.  It uses `ZCOUNT` on the sorted set to count the number of entries whose score (timestamp) is within the desired window.
+    3.  Returns the count.

docs/common/session.md

···
+# `session.ts`
+
+This module provides simple file-based session persistence. It allows the application to save its authentication session to disk and load it again on the next startup. This avoids the need to perform a fresh login every time the bot is restarted, making startup faster and reducing unnecessary authentication requests.
+
+## `SESSION_FILE_PATH`
+
+-   A constant that defines the path to the session file: `.session` in the current working directory.
+
+## `SessionData` Interface
+
+-   Defines the structure of the session object that is saved to and loaded from the file. It includes essential fields like `accessJwt`, `refreshJwt`, `did`, and `handle`.
+
+## Key Functions
+
+### `loadSession(): SessionData | null`
+
+-   **Purpose**: To load and validate the session from the `.session` file.
+-   **Logic**:
+    1.  It checks if the `.session` file exists. If not, it returns `null`.
+    2.  It reads the file content, parses it as JSON, and casts it to the `SessionData` type.
+    3.  It performs a basic validation to ensure the essential JWT and DID fields are present. If not, it logs a warning and returns `null`.
+    4.  If the session is loaded and valid, it returns the `SessionData` object.
+-   **Error Handling**: If any part of the process fails (e.g., file read error, JSON parse error), it logs the error and returns `null`, forcing a fresh authentication.
+
+### `saveSession(session: SessionData): void`
+
+-   **Purpose**: To save the current authentication session to the `.session` file.
+-   **Usage**: This is called from `agent.ts` whenever a new session is created (after a fresh login) or an existing session is successfully refreshed.
+-   **Logic**:
+    1.  It serializes the `session` object into a formatted JSON string.
+    2.  It writes the string to the `.session` file.
+    3.  It sets the file permissions to `0o600` (`-rw-------`) using `chmodSync` to ensure the session file, which contains sensitive tokens, is only readable and writable by the user running the application.
+
+### `clearSession(): void`
+
+-   **Purpose**: To delete the `.session` file from disk.
+-   **Usage**: This function is exported but does not appear to be actively used in the current application flow. It could be used to implement a "logout" feature.
+-   **Logic**: It checks if the file exists and, if so, deletes it using `unlinkSync`.
+
+## Dependencies
+
+-   **`node:fs`**: Provides the file system functions for reading, writing, deleting, and changing permissions of the session file.
+-   **`node:path`**: Used to construct the absolute path to the session file.
+-   **`./logger.js`**: For logging session management activities and errors.

docs/common/starterPackThreshold.md

···
+# `starterPackThreshold.ts`
+
+This module is responsible for checking if an account has created too many starter packs within a specific time window. When a threshold is met, it can trigger various moderation actions on the account, such as applying a label, adding a comment, or reporting the account. This is useful for detecting follow-farming behaviour and coordinated campaign activity.
+
+## Key Functions
+
+### `checkStarterPackThreshold(did: string, starterPackUri: string, timestamp: number): Promise<void>`
+
+This is the main function of the module. It's called whenever a starter pack is created, and it checks if the creator has exceeded the configured threshold.
+
+**Parameters:**
+
+-   `did`: The DID of the account that created the starter pack.
+-   `starterPackUri`: The AT URI of the newly created starter pack.
+-   `timestamp`: The timestamp of the creation event.
+
+**Logic:**
+
+1.  **Load Configurations**: It retrieves the cached `STARTER_PACK_THRESHOLD_CONFIGS`.
+2.  **Check Allowlist**: For each configuration, it first checks if the account is in the `allowlist`. If so, the check is skipped for that configuration.
+3.  **Track the Creation**: It records the new starter pack creation for the account in Redis using `trackStarterPackForAccount`. This function stores the URI with its timestamp in a sorted set.
+4.  **Count Recent Creations**: It then uses `getStarterPackCountInWindow` to count how many starter packs the account has created within the defined rolling window (`window` + `windowUnit`).
+5.  **Check Threshold**: If the `count` is greater than or equal to the `threshold` defined in the configuration, it proceeds to take action.
+6.  **Format Comment**: A detailed comment is generated including the threshold count, window configuration, and the triggering starter pack URI.
+7.  **Apply Moderation Actions**:
+    -   It logs that the threshold has been met.
+    -   It increments the `starterPackThresholdMetCounter` metric.
+    -   Based on the booleans `toLabel` (defaults to true), `reportAcct`, and `commentAcct` in the configuration, it will:
+        -   Apply a label to the account (`createAccountLabel`).
+        -   Report the account (`createAccountReport`).
+        -   Add a comment to the account's moderation record (`createAccountComment`).
+    -   It also increments the `starterPackLabelsThresholdAppliedCounter` for each action taken.
+
+### `loadStarterPackThresholdConfigs(): StarterPackThresholdConfig[]`
+
+This function returns the cached `STARTER_PACK_THRESHOLD_CONFIGS`. The configurations are loaded and validated once at module initialization to avoid re-reading and re-validating the configuration file on every call.
+
+## Supporting Functions
+
+-   `validateAndLoadConfigs(): StarterPackThresholdConfig[]`: This function is called once when the module is loaded. It iterates through `STARTER_PACK_THRESHOLD_CONFIGS`, validates that each configuration has the required properties (`threshold > 0`, `window > 0`), and then returns the valid configurations.
+
+## Dependencies
+
+-   **`../../rules/starterPackThreshold.js`**: Contains the `STARTER_PACK_THRESHOLD_CONFIGS` array, which defines the rules for when to take action on an account.
+-   **`./accountModeration.js`**: Provides the functions (`createAccountLabel`, `createAccountReport`, `createAccountComment`) to perform moderation actions on an account.
+-   **`./logger.js`**: Used for logging information, warnings, and errors.
+-   **`./metrics.js`**: Provides Prometheus counters for monitoring the behavior of this module.
+-   **`./redis.js`**: Provides the functions (`trackStarterPackForAccount`, `getStarterPackCountInWindow`) for interacting with Redis to store and retrieve data about starter pack creations.
+-   **`./types.js`**: Defines the `StarterPackThresholdConfig` type.

docs/common/types.md

···
+# `types.ts`
+
+This module serves as a central repository for common TypeScript interfaces and type definitions used throughout the application. This helps ensure data consistency and provides type safety.
+
+## Core Data Structures
+
+-   **`Post`**: Represents a simplified post object, containing the essential fields needed for moderation checks.
+    -   `did`, `time`, `rkey`, `atURI`, `text`, `cid`
+
+-   **`Handle`**: Represents a user handle event.
+    -   `did`, `time`, `handle`
+
+-   **`Profile`**: Represents a user profile event.
+    -   `did`, `time`, `displayName`, `description`
+
+-   **`List`**: Represents a list object. (Note: This interface does not appear to be used in the current codebase).
+    -   `label`, `rkey`
+
+## Rule Configuration Interfaces
+
+-   **`Checks`**: A comprehensive interface that defines the structure for a single moderation rule (used for posts, profiles, and handles).
+    -   `check`: The primary `RegExp` used to test content.
+    -   `whitelist`: An optional `RegExp` to prevent false positives.
+    -   `label`: The moderation label to apply.
+    -   `comment`: The text to include in the moderation action.
+    -   `language`: An optional array of language codes to restrict the rule to.
+    -   `ignoredDIDs`: An optional array of DIDs to exempt from the rule.
+    -   `starterPacks`: An optional array of starter pack URIs to restrict the rule to members of those packs.
+    -   `knownVectors`: An optional array of known vector strings for tracking purposes.
+    -   Action booleans: `toLabel`, `reportPost`, `reportAcct`, `commentAcct`, `unlabel`, `trackOnly`.
+    -   `duration`: An optional duration in hours for temporary labels.
+    -   `description`, `displayName`: Booleans to specify which parts of a profile to check.
+
+-   **`AccountAgeCheck`**: Defines the structure for a rule in the `accountAge.ts` module.
+    -   `monitoredDIDs`, `monitoredPostURIs`: The targets of the monitoring.
+    -   `anchorDate`, `maxAgeDays`: The time window for checking the account's creation date.
+    -   `label`, `comment`: The action to take if the check passes.
+    -   `expires`: An optional date after which the rule is no longer active.
+
+-   **`WindowUnit`**: A type alias representing the unit for rolling time windows. Valid values are `"minutes"`, `"hours"`, or `"days"`.
+
+-   **`AccountThresholdConfig`**: Defines the structure for a rule in the `accountThreshold.ts` module.
+    -   `labels`: The post label(s) that contribute to the threshold (can be a single string or array for OR matching).
+    -   `threshold`: The number of labels required to trigger the action.
+    -   `window`: The rolling window duration (number).
+    -   `windowUnit`: The unit for the rolling window (`WindowUnit`).
+    -   `accountLabel`, `accountComment`: The label and comment for the resulting account action.
+    -   Action booleans: `reportAcct`, `commentAcct`, `toLabel` (optional, defaults to true).
+
+-   **`StarterPackThresholdConfig`**: Defines the structure for a rule in the `starterPackThreshold.ts` module.
+    -   `threshold`: The number of starter packs required to trigger the action.
+    -   `window`: The rolling window duration (number).
+    -   `windowUnit`: The unit for the rolling window (`WindowUnit`).
+    -   `accountLabel`, `accountComment`: The label and comment for the resulting account action.
+    -   `toLabel`: Optional boolean to apply label (defaults to true).
+    -   `reportAcct`: Optional boolean to report the account.
+    -   `commentAcct`: Optional boolean to comment on the account.
+    -   `allowlist`: Optional array of DIDs to exempt from this check.
+
+## Re-exported Lexicon Types
+
+-   For convenience, several facet-related types are re-exported directly from the `@atproto/ozone` library's generated lexicons. This avoids the need for other modules to have complex import paths.
+    -   `Facet`
+    -   `FacetIndex`
+    -   `FacetMention`
+    -   `LinkFeature`
+    -   `FacetTag`

rules/accountAge.ts

···
 /**
  * Account age monitoring configurations
  *
- * This file contains example values. Copy to accountAge.ts and configure with your checks.
+ * Labels new accounts that interact with monitored DIDs or posts.
+ * Useful for protecting high-profile accounts from coordinated harassment.
+ * Configure your checks below.
  */
 export const ACCOUNT_AGE_CHECKS: AccountAgeCheck[] = [
-  // Example configuration:
+  // Example - monitor replies to specific accounts:
   // {
-  //   monitoredDIDs: ["did:plc:example123"],
-  //   anchorDate: "2025-01-15",
-  //   maxAgeDays: 7,
-  //   label: "new-account",
-  //   comment: "Account created within monitored window",
+  //   monitoredDIDs: ["did:plc:example123", "did:plc:example456"],
+  //   anchorDate: "2025-01-15",           // Only check accounts created after this date
+  //   maxAgeDays: 7,                      // Flag accounts younger than 7 days
+  //   label: "new-account-reply",
+  //   comment: "New account replying to monitored user",
+  //   expires: "2025-02-15",              // Stop checking after this date
+  // },
+
+  // Example - monitor replies/quotes to specific posts:
+  // {
+  //   monitoredPostURIs: [
+  //     "at://did:plc:xyz/app.bsky.feed.post/abc123",
+  //     "at://did:plc:xyz/app.bsky.feed.post/def456",
+  //   ],
+  //   anchorDate: "2025-01-20",
+  //   maxAgeDays: 3,
+  //   label: "new-account-quote",
+  //   comment: "New account quoting monitored post",
+  // },
+
+  // Example - combine both DID and post monitoring:
+  // {
+  //   monitoredDIDs: ["did:plc:high-profile"],
+  //   monitoredPostURIs: ["at://did:plc:high-profile/app.bsky.feed.post/viral"],
+  //   anchorDate: "2025-01-01",
+  //   maxAgeDays: 14,
+  //   label: "new-account-interaction",
+  //   comment: "New account interacting with high-profile content",
+  //   expires: "2025-03-01",
   // },
 ];

rules/accountThreshold.ts

···
   //   threshold: 3,
   //   accountLabel: "repeat-offender",
   //   accountComment: "Account exceeded threshold",
-  //   windowDays: 7,
+  //   window: 5,
+  //   windowUnit: "hours",
   //   reportAcct: false,
   //   commentAcct: false,
   //   toLabel: true,

rules/constants.ts

···
 /**
  * Global allowlist for accounts that should bypass all checks
  *
- * This file contains example values. Copy to constants.ts and configure with your DIDs.
+ * Add DIDs here to exempt them from all moderation checks.
  */
 export const GLOBAL_ALLOW: string[] = [
-  // Example: "did:plc:example123",
+  // Example: "did:plc:trusted-account",
 ];
 
-export const LINK_SHORTENER = new RegExp("", "i");
+/**
+ * URL shortener detection pattern
+ *
+ * Matched URLs are resolved to their final destination before checking.
+ * Add domains for URL shorteners you want to expand.
+ */
+export const LINK_SHORTENER = new RegExp(
+  [
+    "bit\\.ly",
+    "tinyurl\\.com",
+    "t\\.co",
+    "goo\\.gl",
+    "ow\\.ly",
+    "is\\.gd",
+    "buff\\.ly",
+    "rebrand\\.ly",
+    "short\\.io",
+  ].join("|"),
+  "i",
+);

rules/developing_checks.md

···
     threshold: 3,
     accountLabel: "repeat-offender",
     accountComment: "Account exceeded spam threshold",
-    windowDays: 7,
+    window: 7,
+    windowUnit: "days",  // Options: "minutes", "hours", "days"
     reportAcct: true,
     commentAcct: false,
     toLabel: true,
···
 ];
 ```
 
+### Starter Pack Threshold Checks
+
+File: `rules/starterPackThreshold.ts`
+
+Applies account-level labels when an account creates too many starter packs within a time window. Useful for detecting follow-farming and coordinated campaign behaviour.
+
+```typescript
+import type { StarterPackThresholdConfig } from "../src/types.js";
+
+export const STARTER_PACK_THRESHOLD_CONFIGS: StarterPackThresholdConfig[] = [
+  {
+    threshold: 10,           // Account action triggered after 10 starter packs
+    window: 7,               // Within this duration
+    windowUnit: "days",      // Options: "minutes", "hours", "days"
+    accountLabel: "follow-farming",
+    accountComment: "Account created multiple starter packs in short period",
+    toLabel: true,           // Whether to apply the label (default: true)
+    reportAcct: true,        // Whether to report the account
+    commentAcct: false,      // Whether to comment on the account
+    allowlist: [],           // DIDs to exempt from this check
+  },
+];
+```
+
 ## Check Configuration Fields
 
 ### Basic Fields (Required)
···
 - `ignoredDIDs` - DIDs to skip checking (string[])
 - `starterPacks` - Filter by starter pack membership (string[])
 - `knownVectors` - Known attack vectors for tracking (string[])
+- `trackOnly` - Track without applying label (boolean)
+- `unlabel` - Remove existing label if content no longer matches (boolean)
+
+### Threshold Configuration Fields
+
+#### Account Threshold
+
+- `labels` - Single label or array of labels to aggregate (string | string[])
+- `threshold` - Number of labeled posts required to trigger account action (number)
+- `window` - Rolling window duration (number)
+- `windowUnit` - Unit for the rolling window: "minutes", "hours", or "days" (WindowUnit)
+- `accountLabel` - Label to apply to the account (string)
+- `accountComment` - Comment for the account action (string)
+- `toLabel` - Whether to apply the label, defaults to true (boolean)
+- `reportAcct` - Whether to report the account (boolean)
+- `commentAcct` - Whether to comment on the account (boolean)
+
+#### Starter Pack Threshold
+
+- `threshold` - Number of starter packs required to trigger account action (number)
+- `window` - Rolling window duration (number)
+- `windowUnit` - Unit for the rolling window: "minutes", "hours", or "days" (WindowUnit)
+- `accountLabel` - Label to apply to the account (string)
+- `accountComment` - Comment for the account action (string)
+- `toLabel` - Whether to apply the label, defaults to true (boolean)
+- `reportAcct` - Whether to report the account (boolean)
+- `commentAcct` - Whether to comment on the account (boolean)
+- `allowlist` - DIDs to exempt from this check (string[])
 
 ## Examples
 

rules/handles.ts

···
 /**
  * Handle-based moderation checks
  *
- * This file contains example values. Copy to handles.ts and configure with your checks.
+ * Monitors user handles (usernames) for pattern matches.
+ * Configure your checks below.
  */
 export const HANDLE_CHECKS: Checks[] = [
-  // Example check:
+  // Basic example - flag potential impersonation:
   // {
-  //   label: "example-label",
-  //   comment: "Example check found in handle",
-  //   reportAcct: false,
+  //   label: "impersonation",
+  //   comment: "Potential impersonation detected in handle",
+  //   reportAcct: true,
+  //   commentAcct: false,
+  //   toLabel: false,
+  //   check: new RegExp("official.*support", "i"),
+  // },
+
+  // Advanced example with optional fields:
+  // {
+  //   label: "suspicious-handle",
+  //   comment: "Handle matches known spam pattern",
+  //   reportAcct: true,
   //   commentAcct: false,
   //   toLabel: true,
-  //   check: new RegExp("example-pattern", "i"),
+  //   unlabel: true,                      // Remove label if handle changes
+  //   check: new RegExp("crypto.*airdrop", "i"),
+  //   whitelist: new RegExp("cryptography", "i"),  // Don't match legitimate use
+  //   ignoredDIDs: ["did:plc:verified123"],
   // },
 ];

rules/posts.ts

···
 /**
  * Post content moderation checks
  *
- * This file contains example values. Copy to posts.ts and configure with your checks.
+ * Monitors post text and embedded URLs for pattern matches.
+ * Configure your checks below.
  */
 export const POST_CHECKS: Checks[] = [
-  // Example check:
+  // Basic example - label posts matching a pattern:
   // {
-  //   label: "example-label",
-  //   comment: "Example content found in post",
+  //   label: "spam",
+  //   comment: "Spam content detected in post",
   //   reportAcct: false,
   //   commentAcct: false,
   //   toLabel: true,
-  //   check: new RegExp("example-pattern", "i"),
+  //   check: new RegExp("buy.*followers", "i"),
+  // },
+
+  // Advanced example - all optional fields:
+  // {
+  //   label: "scam-link",
+  //   comment: "Suspicious link detected",
+  //   language: ["eng", "spa"],           // Only check posts in these languages
+  //   reportAcct: true,                   // Create account report
+  //   reportPost: true,                   // Create post report
+  //   commentAcct: false,                 // Add comment to account record
+  //   toLabel: true,                      // Apply the label
+  //   trackOnly: false,                   // If true, track but don't take action
+  //   unlabel: false,                     // If true, remove label when no longer matching
+  //   duration: 24,                       // Label expires after 24 hours
+  //   check: new RegExp("crypto.*giveaway", "i"),
+  //   whitelist: new RegExp("legitimate-site\\.com", "i"),  // Skip if this matches
+  //   ignoredDIDs: ["did:plc:trusted123"],                  // Skip these accounts
+  //   starterPacks: ["at://did:plc:xyz/app.bsky.graph.starterpack/abc"],  // Only check members
+  //   knownVectors: ["telegram-scam", "discord-spam"],      // Tracking tags
   // },
 ];

rules/profiles.ts

···
 /**
  * Profile-based moderation checks
  *
- * This file contains example values. Copy to profiles.ts and configure with your checks.
+ * Monitors profile display names and descriptions for pattern matches.
+ * Configure your checks below.
  */
 export const PROFILE_CHECKS: Checks[] = [
-  // Example check:
+  // Basic example - check both displayName and description:
   // {
-  //   label: "example-label",
-  //   comment: "Example content found in profile",
-  //   description: true,
-  //   displayName: true,
+  //   label: "spam-profile",
+  //   comment: "Spam content in profile",
+  //   displayName: true,                  // Check display name
+  //   description: true,                  // Check description
   //   reportAcct: false,
   //   commentAcct: false,
   //   toLabel: true,
-  //   check: new RegExp("example-pattern", "i"),
+  //   check: new RegExp("follow.*back.*guaranteed", "i"),
+  // },
+
+  // Advanced example - displayName only with unlabel:
+  // {
+  //   label: "impersonation-profile",
+  //   comment: "Profile impersonating official account",
+  //   displayName: true,
+  //   description: false,                 // Only check display name
+  //   reportAcct: true,
+  //   commentAcct: false,
+  //   toLabel: true,
+  //   unlabel: true,                      // Remove label if profile changes
+  //   check: new RegExp("official.*bluesky.*team", "i"),
+  //   whitelist: new RegExp("parody|fan", "i"),
+  //   ignoredDIDs: ["did:plc:actual-team-member"],
   // },
 ];

rules/starterPackThreshold.ts

···
+import type { StarterPackThresholdConfig } from "../src/types.js";
+
+/**
+ * Starter pack threshold configurations
+ *
+ * Labels accounts that create too many starter packs within a time window.
+ * Useful for detecting follow-farming and coordinated campaign behaviour.
+ * Configure your checks below.
+ */
+export const STARTER_PACK_THRESHOLD_CONFIGS: StarterPackThresholdConfig[] = [
+  // Example - detect follow-farming:
+  // {
+  //   threshold: 10,                      // Trigger after 10 starter packs
+  //   window: 7,                          // Within this duration
+  //   windowUnit: "days",                 // Options: "minutes", "hours", "days"
+  //   accountLabel: "follow-farming",
+  //   accountComment: "Account created multiple starter packs in short period",
+  //   toLabel: true,                      // Apply the label (default: true)
+  //   reportAcct: true,                   // Create account report
+  //   commentAcct: false,                 // Add comment to account record
+  //   allowlist: ["did:plc:trusted123"],  // DIDs to exempt from this check
+  // },
+
+  // Example - stricter threshold for rapid creation:
+  // {
+  //   threshold: 5,
+  //   window: 1,
+  //   windowUnit: "hours",
+  //   accountLabel: "spam-starterpack",
+  //   accountComment: "Rapid starter pack creation detected",
+  //   toLabel: false,
+  //   reportAcct: true,
+  //   commentAcct: true,
+  // },
+];

src/accountModeration.ts

···
 import { MOD_DID } from "./config.js";
 import { limit } from "./limits.js";
 import { logger } from "./logger.js";
-import { labelsAppliedCounter, labelsCachedCounter } from "./metrics.js";
-import { tryClaimAccountComment, tryClaimAccountLabel } from "./redis.js";
+import {
+  labelsAppliedCounter,
+  labelsCachedCounter,
+  unlabelsRemovedCounter,
+} from "./metrics.js";
+import {
+  deleteAccountLabelClaim,
+  tryClaimAccountComment,
+  tryClaimAccountLabel,
+} from "./redis.js";
 
 const doesLabelExist = (
   labels: { val: string }[] | undefined,
···
           createdAt: new Date().toISOString(),
           modTool: {
             name: "skywatch/skywatch-automod",
+            meta: {
+              time: new Date().toISOString(),
+              externalUrl: `https://pdsls.dev/at://${did}`,
+            },
           },
         },
         {
···
           createdAt: new Date().toISOString(),
           modTool: {
             name: "skywatch/skywatch-automod",
+            meta: {
+              time: new Date().toISOString(),
+              externalUrl: `https://pdsls.dev/at://${did}`,
+            },
           },
         },
         {
···
           createdAt: new Date().toISOString(),
           modTool: {
             name: "skywatch/skywatch-automod",
+            meta: {
+              time: new Date().toISOString(),
+              externalUrl: `https://pdsls.dev/at://${did}`,
+            },
           },
         },
         {
···
   });
 };
 
+export const negateAccountLabel = async (
+  did: string,
+  label: string,
+  comment: string,
+) => {
+  await isLoggedIn;
+
+  const hasLabel = await checkAccountLabels(did, label);
+  if (!hasLabel) {
+    logger.debug(
+      { process: "MODERATION", did, label },
+      "Account does not have label, skipping",
+    );
+    return;
+  }
+
+  logger.info({ process: "MODERATION", did, label }, "Unlabeling account");
+  unlabelsRemovedCounter.inc({ label_type: label, target_type: "account" });
+
+  await limit(async () => {
+    try {
+      await agent.tools.ozone.moderation.emitEvent(
+        {
+          event: {
+            $type: "tools.ozone.moderation.defs#modEventLabel",
+            comment,
+            createLabelVals: [],
+            negateLabelVals: [label],
+          },
+          // specify the labeled post by strongRef
+          subject: {
+            $type: "com.atproto.admin.defs#repoRef",
+            did,
+          },
+          // put in the rest of the metadata
+          createdBy: agent.did ?? "",
+          createdAt: new Date().toISOString(),
+          modTool: {
+            name: "skywatch/skywatch-automod",
+            meta: {
+              time: new Date().toISOString(),
+              externalUrl: `https://pdsls.dev/at://${did}`,
+            },
+          },
+        },
+        {
+          encoding: "application/json",
+          headers: {
+            "atproto-proxy": `${MOD_DID}#atproto_labeler`,
+            "atproto-accept-labelers":
+              "did:plc:ar7c4by46qjdydhdevvrndac;redact",
+          },
+        },
+      );
+      await deleteAccountLabelClaim(did, label);
+    } catch (e) {
+      logger.error(
+        { process: "MODERATION", error: e },
+        "Failed to negate account label",
+      );
+    }
+  });
+};
+
 export const checkAccountLabels = async (
   did: string,
   label: string,
···
     }
   });
 };
+
+export const getAllAccountLabels = async (did: string): Promise<string[]> => {
+  await isLoggedIn;
+  return await limit(async () => {
+    try {
+      const response = await agent.tools.ozone.moderation.getRepo(
+        { did },
+        {
+          headers: {
+            "atproto-proxy": `${MOD_DID}#atproto_labeler`,
+            "atproto-accept-labelers":
+              "did:plc:ar7c4by46qjdydhdevvrndac;redact",
+          },
+        },
+      );
+
+      return (response.data.labels ?? []).map((label) => label.val);
+    } catch (e) {
+      logger.error(
+        { process: "MODERATION", did, error: e },
+        "Failed to get account labels",
+      );
+      return [];
+    }
+  });
+};

src/accountThreshold.ts

···
         `Invalid account threshold config: threshold must be positive`,
       );
     }
-    if (config.windowDays <= 0) {
+    if (config.window <= 0) {
       throw new Error(
-        `Invalid account threshold config: windowDays must be positive`,
+        `Invalid account threshold config: window must be positive`,
       );
     }
   }
···
 
 export async function checkAccountThreshold(
   did: string,
+  uri: string,
   postLabel: string,
   timestamp: number,
 ): Promise<void> {
···
         did,
         postLabel,
         timestamp,
-        config.windowDays,
+        config.window,
+        config.windowUnit,
       );
 
       const count = await getPostLabelCountInWindow(
         did,
         labels,
-        config.windowDays,
+        config.window,
+        config.windowUnit,
         timestamp,
       );
 
···
           labels,
           count,
           threshold: config.threshold,
-          windowDays: config.windowDays,
+          window: config.window,
+          windowUnit: config.windowUnit,
         },
         "Checked account threshold",
       );
···
 
         const shouldLabel = config.toLabel !== false;
 
+        const formattedComment = `${config.accountComment}\n\nThreshold: ${count.toString()}/${config.threshold.toString()} in ${config.window.toString()} ${config.windowUnit}\n\nPost: ${uri}\n\nPost Label: ${postLabel}`;
+
         if (shouldLabel) {
-          await createAccountLabel(
-            did,
-            config.accountLabel,
-            config.accountComment,
-          );
+          await createAccountLabel(did, config.accountLabel, formattedComment);
           accountLabelsThresholdAppliedCounter.inc({
             account_label: config.accountLabel,
             action: "label",
···
         }
 
         if (config.reportAcct) {
-          await createAccountReport(did, config.accountComment);
+          await createAccountReport(did, formattedComment);
           accountLabelsThresholdAppliedCounter.inc({
             account_label: config.accountLabel,
             action: "report",
···
 
         if (config.commentAcct) {
           const atURI = `threshold-comment:${config.accountLabel}:${timestamp.toString()}`;
-          await createAccountComment(did, config.accountComment, atURI);
+          await createAccountComment(did, formattedComment, atURI);
           accountLabelsThresholdAppliedCounter.inc({
             account_label: config.accountLabel,
             action: "comment",

src/agent.ts

···
   }
 }
 
+const MAX_LOGIN_RETRIES = 3;
+const RETRY_DELAY_MS = 2000;
+
+let loginPromise: Promise<void> | null = null;
+
+async function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
 async function authenticate(): Promise<boolean> {
   const savedSession = loadSession();
 
···
   return performLogin();
 }
 
-export const login = authenticate;
-export const isLoggedIn = authenticate()
-  .then((success) => success)
-  .catch(() => false);
+async function authenticateWithRetry(): Promise<void> {
+  // Reuse existing login attempt if one is in progress
+  if (loginPromise) {
+    return loginPromise;
+  }
+
+  loginPromise = (async () => {
+    for (let attempt = 1; attempt <= MAX_LOGIN_RETRIES; attempt++) {
+      logger.info(
+        { attempt, maxRetries: MAX_LOGIN_RETRIES },
+        "Attempting login",
+      );
+
+      const success = await authenticate();
+
+      if (success) {
+        logger.info("Authentication successful");
+        return;
+      }
+
+      if (attempt < MAX_LOGIN_RETRIES) {
+        logger.warn(
+          { attempt, maxRetries: MAX_LOGIN_RETRIES, retryInMs: RETRY_DELAY_MS },
+          "Login failed, retrying",
+        );
+        await sleep(RETRY_DELAY_MS);
+      }
+    }
+
+    logger.error(
+      { maxRetries: MAX_LOGIN_RETRIES },
+      "All login attempts failed, aborting",
+    );
+    process.exit(1);
+  })();
+
+  return loginPromise;
+}
+
+export const login = authenticateWithRetry;
+export const isLoggedIn = authenticateWithRetry().then(() => true);

src/config.ts

···
   "app.bsky.feed.post",
   "app.bsky.actor.defs",
   "app.bsky.actor.profile",
+  "app.bsky.graph.starterpack",
 ];
 export const CURSOR_UPDATE_INTERVAL = process.env.CURSOR_UPDATE_INTERVAL
   ? Number(process.env.CURSOR_UPDATE_INTERVAL)

src/main.ts

···
   IdentityEvent,
 } from "@skyware/jetstream";
 import { Jetstream } from "@skyware/jetstream";
+import { login } from "./agent.js";
 import {
   CURSOR_UPDATE_INTERVAL,
   FIREHOSE_URL,
···
 import { checkFacetSpam } from "./rules/facets/facets.js";
 import { checkHandle } from "./rules/handles/checkHandles.js";
 import { checkPosts } from "./rules/posts/checkPosts.js";
-import {
-  checkDescription,
-  checkDisplayName,
-} from "./rules/profiles/checkProfiles.js";
+import { checkProfile } from "./rules/profiles/checkProfiles.js";
+import { checkStarterPackThreshold } from "./starterPackThreshold.js";
 import type { Post } from "./types.js";
 
 let cursor = 0;
···
   async (event: CommitUpdateEvent<"app.bsky.actor.profile">) => {
     try {
       if (event.commit.record.displayName || event.commit.record.description) {
-        void checkDescription(
-          event.did,
-          event.time_us,
-          event.commit.record.displayName as string,
-          event.commit.record.description as string,
-        );
-        void checkDisplayName(
+        void checkProfile(
           event.did,
           event.time_us,
           event.commit.record.displayName as string,
···
   async (event: CommitCreateEvent<"app.bsky.actor.profile">) => {
     try {
       if (event.commit.record.displayName || event.commit.record.description) {
-        void checkDescription(
-          event.did,
-          event.time_us,
-          event.commit.record.displayName as string,
-          event.commit.record.description as string,
-        );
-        void checkDisplayName(
+        void checkProfile(
           event.did,
           event.time_us,
           event.commit.record.displayName as string,
···
   },
 );
 
+// Check for starter pack creation
+jetstream.onCreate(
+  "app.bsky.graph.starterpack",
+  (event: CommitCreateEvent<"app.bsky.graph.starterpack">) => {
+    const starterPackUri = `at://${event.did}/app.bsky.graph.starterpack/${event.commit.rkey}`;
+    void checkStarterPackThreshold(event.did, starterPackUri, event.time_us);
+  },
+);
+
 const metricsServer = startMetricsServer(METRICS_PORT);
 
 logger.info({ process: "MAIN" }, "Connecting to Redis");
 await connectRedis();
+
+logger.info({ process: "MAIN" }, "Authenticating with Bluesky");
+await login();
+logger.info({ process: "MAIN" }, "Authentication complete, starting Jetstream");
 
 jetstream.start();
 

src/metrics.ts

···
   registers: [register],
 });
 
+export const unlabelsRemovedCounter: Counter = new Counter({
+  name: "skywatch_labels_removed_total",
+  help: "Total number of labels removed due to criteria no longer matching",
+  labelNames: ["label_type", "target_type"],
+  registers: [register],
+});
+
 export const accountLabelsThresholdAppliedCounter = new Counter({
   name: "skywatch_account_labels_threshold_applied_total",
   help: "Total number of account actions applied due to threshold",
···
   name: "skywatch_account_threshold_met_total",
   help: "Total number of times account thresholds were met",
   labelNames: ["account_label"],
+  registers: [register],
+});
+
+export const starterPackThresholdChecksCounter = new Counter({
+  name: "skywatch_starter_pack_threshold_checks_total",
+  help: "Total number of starter pack threshold checks performed",
+  registers: [register],
+});
+
+export const starterPackThresholdMetCounter = new Counter({
+  name: "skywatch_starter_pack_threshold_met_total",
+  help: "Total number of times starter pack thresholds were met",
+  labelNames: ["account_label"],
+  registers: [register],
+});
+
+export const starterPackLabelsThresholdAppliedCounter = new Counter({
+  name: "skywatch_starter_pack_labels_threshold_applied_total",
+  help: "Total number of account actions applied due to starter pack threshold",
+  labelNames: ["account_label", "action"],
   registers: [register],
 });
 

src/moderation.ts

···
           createdAt: new Date().toISOString(),
           modTool: {
             name: "skywatch/skywatch-automod",
+            meta: {
+              time: new Date().toISOString(),
+              externalUrl: `https://pdsls.dev/${uri}`,
+            },
           },
         },
         {
···
           const { checkAccountThreshold } = await import(
             "./accountThreshold.js"
           );
-          await checkAccountThreshold(did, label, time);
+          await checkAccountThreshold(did, uri, label, time);
         } catch (error) {
           logger.error(
             { process: "ACCOUNT_THRESHOLD", did, label, error },
···
           createdAt: new Date().toISOString(),
           modTool: {
             name: "skywatch/skywatch-automod",
+            meta: {
+              time: new Date().toISOString(),
+              externalUrl: `https://pdsls.dev/${uri}`,
+            },
           },
         },
         {

src/redis.ts

···
 import { createClient } from "redis";
 import { REDIS_URL } from "./config.js";
 import { logger } from "./logger.js";
+import type { WindowUnit } from "./types.js";
 
 export const redisClient = createClient({
   url: REDIS_URL,
···
   }
 }
 
+export async function deleteAccountLabelClaim(
+  did: string,
+  label: string,
+): Promise<void> {
+  try {
+    const key = getAccountLabelCacheKey(did, label);
+    await redisClient.del(key);
+    logger.debug(
+      { did, label },
+      "Deleted account label claim from Redis cache",
+    );
+  } catch (err) {
+    logger.warn(
+      { err, did, label },
+      "Error deleting account label claim from Redis",
+    );
+  }
+}
+
 export async function tryClaimAccountComment(
   did: string,
   atURI: string,
···
   }
 }
 
+function windowToMicroseconds(window: number, unit: WindowUnit): number {
+  const multipliers: Record<WindowUnit, number> = {
+    minutes: 60 * 1000000,
+    hours: 60 * 60 * 1000000,
+    days: 24 * 60 * 60 * 1000000,
+  };
+  return window * multipliers[unit];
+}
+
+function windowToSeconds(window: number, unit: WindowUnit): number {
+  const multipliers: Record<WindowUnit, number> = {
+    minutes: 60,
+    hours: 60 * 60,
+    days: 24 * 60 * 60,
+  };
+  return window * multipliers[unit];
+}
+
 function getPostLabelTrackingKey(
   did: string,
   label: string,
-  windowDays: number,
+  window: number,
+  unit: WindowUnit,
+): string {
+  return `account-post-labels:${did}:${label}:${window.toString()}${unit}`;
+}
+
+function getStarterPackTrackingKey(
+  did: string,
+  window: number,
+  unit: WindowUnit,
 ): string {
-  return `account-post-labels:${did}:${label}:${windowDays.toString()}`;
+  return `starterpack:threshold:${did}:${window.toString()}${unit}`;
+}
+
+export async function trackStarterPackForAccount(
+  did: string,
+  starterPackUri: string,
+  timestamp: number,
+  window: number,
+  windowUnit: WindowUnit,
+): Promise<void> {
+  try {
+    const key = getStarterPackTrackingKey(did, window, windowUnit);
+    const windowStartTime = timestamp - windowToMicroseconds(window, windowUnit);
+
+    await redisClient.zRemRangeByScore(key, "-inf", windowStartTime);
+
+    await redisClient.zAdd(key, {
+      score: timestamp,
+      value: starterPackUri,
+    });
+
+    const ttlSeconds = windowToSeconds(window, windowUnit) + 60 * 60;
+    await redisClient.expire(key, ttlSeconds);
+
+    logger.debug(
+      { did, starterPackUri, timestamp, window, windowUnit },
+      "Tracked starter pack for account",
+    );
+  } catch (err) {
+    logger.error(
+      { err, did, starterPackUri, timestamp, window, windowUnit },
+      "Error tracking starter pack in Redis",
+    );
+    throw err;
+  }
+}
+
+export async function getStarterPackCountInWindow(
+  did: string,
+  window: number,
+  windowUnit: WindowUnit,
+  currentTime: number,
+): Promise<number> {
+  try {
+    const key = getStarterPackTrackingKey(did, window, windowUnit);
+    const windowStartTime = currentTime - windowToMicroseconds(window, windowUnit);
+    const count = await redisClient.zCount(key, windowStartTime, "+inf");
+
+    logger.debug(
+      { did, window, windowUnit, count },
+      "Retrieved starter pack count in window",
+    );
+
+    return count;
+  } catch (err) {
+    logger.error(
+      { err, did, window, windowUnit },
+      "Error getting starter pack count from Redis",
+    );
+    throw err;
+  }
 }
 
 export async function trackPostLabelForAccount(
   did: string,
   label: string,
   timestamp: number,
-  windowDays: number,
+  window: number,
+  windowUnit: WindowUnit,
 ): Promise<void> {
   try {
-    const key = getPostLabelTrackingKey(did, label, windowDays);
-    const windowStartTime = timestamp - windowDays * 24 * 60 * 60 * 1000000;
+    const key = getPostLabelTrackingKey(did, label, window, windowUnit);
+    const windowStartTime = timestamp - windowToMicroseconds(window, windowUnit);
 
     await redisClient.zRemRangeByScore(key, "-inf", windowStartTime);
 
···
       value: timestamp.toString(),
     });
 
-    const ttlSeconds = (windowDays + 1) * 24 * 60 * 60;
+    const ttlSeconds = windowToSeconds(window, windowUnit) + 60 * 60;
     await redisClient.expire(key, ttlSeconds);
 
     logger.debug(
-      { did, label, timestamp, windowDays },
+      { did, label, timestamp, window, windowUnit },
       "Tracked post label for account",
     );
   } catch (err) {
     logger.error(
-      { err, did, label, timestamp, windowDays },
+      { err, did, label, timestamp, window, windowUnit },
       "Error tracking post label in Redis",
     );
     throw err;
···
 export async function getPostLabelCountInWindow(
   did: string,
   labels: string[],
-  windowDays: number,
+  window: number,
+  windowUnit: WindowUnit,
   currentTime: number,
 ): Promise<number> {
   try {
-    const windowStartTime = currentTime - windowDays * 24 * 60 * 60 * 1000000;
+    const windowStartTime = currentTime - windowToMicroseconds(window, windowUnit);
     let totalCount = 0;
 
     for (const label of labels) {
-      const key = getPostLabelTrackingKey(did, label, windowDays);
+      const key = getPostLabelTrackingKey(did, label, window, windowUnit);
       const count = await redisClient.zCount(key, windowStartTime, "+inf");
       totalCount += count;
     }
 
     logger.debug(
-      { did, labels, windowDays, totalCount },
+      { did, labels, window, windowUnit, totalCount },
       "Retrieved post label count in window",
     );
 
     return totalCount;
   } catch (err) {
     logger.error(
-      { err, did, labels, windowDays },
+      { err, did, labels, window, windowUnit },
       "Error getting post label count from Redis",
     );
     throw err;

src/rules/account/age.ts

···
       await createAccountLabel(
         context.actorDid,
         check.label,
-        `${context.time.toString()}: ${check.comment} - Account created within monitored range - Interaction: ${context.atURI}`,
+        `${context.time.toString()}: ${check.comment} \n\nAccount created within monitored range. \n\nInteraction: ${context.atURI}`,
       );
 
       // Only apply one label per interaction

src/rules/account/countStarterPacks.ts

···
 import { limit } from "../../limits.js";
 import { logger } from "../../logger.js";
 
-const ALLOWED_DIDS = ["did:plc:gpunjjgvlyb4racypz3yfiq4"];
+const ALLOWED_DIDS = [
+  "did:plc:example"
+];
 
 export const countStarterPacks = async (did: string, time: number) => {
   await isLoggedIn;

src/rules/facets/facets.ts

···
 export const FACET_SPAM_THRESHOLD = 1;
 
 // Label configuration
-export const FACET_SPAM_LABEL = "suspect-inauthentic";
+export const FACET_SPAM_LABEL = "platform-manipulation";
 export const FACET_SPAM_COMMENT =
   "Abusive facet usage detected (hidden mentions)";
 
 // Allowlist for DIDs with legitimate duplicate facet use cases
 export const FACET_SPAM_ALLOWLIST: string[] = [
-  // Add DIDs here that should be exempt from facet spam detection
+  "did:plc:ei7hqam5oasdpw5cdihdphcv",
 ];
 
 /**
···
       await createAccountLabel(
         did,
         FACET_SPAM_LABEL,
-        `${time.toString()}: ${FACET_SPAM_COMMENT} - ${uniqueCount.toString()} unique mentions at position ${position} in ${atURI}`,
+        `${time.toString()}: ${FACET_SPAM_COMMENT} \n\n${uniqueCount.toString()} unique mentions at position ${position}. \n\nPost: ${atURI}`,
       );
 
       // Only label once per post even if multiple positions are suspicious

src/rules/facets/tests/facets.test.ts

···
       expect(createAccountLabel).toHaveBeenCalledWith(
         TEST_DID,
         FACET_SPAM_LABEL,
-        `${TEST_TIME}: ${FACET_SPAM_COMMENT} - 2 unique mentions at position 0:1 in ${TEST_URI}`,
+        `${TEST_TIME}: ${FACET_SPAM_COMMENT} \n\n2 unique mentions at position 0:1. \n\nPost: ${TEST_URI}`,
       );
     });
 
···
     });
 
     it("should use correct label and comment constants", () => {
-      expect(FACET_SPAM_LABEL).toBe("suspect-inauthentic");
+      expect(FACET_SPAM_LABEL).toBe("platform-manipulation");
       expect(FACET_SPAM_COMMENT).toBe(
         "Abusive facet usage detected (hidden mentions)",
       );

src/rules/handles/checkHandles.test.ts

···
 
       expect(createAccountReport).toHaveBeenCalledWith(
         "did:plc:user1",
-        `${time}: Spam detected - spam-account`,
+        `${time}: Spam detected\n\nHandle: spam-account`,
       );
     });
 
···
 
       expect(createAccountReport).toHaveBeenCalledWith(
         "did:plc:user1",
-        `${time}: Spam detected - SPAM-ACCOUNT`,
+        `${time}: Spam detected\n\nHandle: SPAM-ACCOUNT`,
       );
     });
   });
···
 
       expect(createAccountComment).toHaveBeenCalledWith(
         "did:plc:user1",
-        `${time}: Scam detected - scam-account`,
+        `${time}: Scam detected\n\nHandle: scam-account`,
         "handle:did:plc:user1:scam-account",
       );
     });
···
       expect(createAccountLabel).toHaveBeenCalledWith(
         "did:plc:normaluser",
         "bot",
-        `${time}: Bot detected - bot-456`,
+        `${time}: Bot detected\n\nHandle: bot-456`,
       );
     });
   });
···
 
       expect(createAccountReport).toHaveBeenCalledWith(
         "did:plc:user1",
-        `${time}: Spam detected - spam-user`,
+        `${time}: Spam detected\n\nHandle: spam-user`,
       );
     });
 
···
 
       expect(createAccountComment).toHaveBeenCalledWith(
         "did:plc:user1",
-        `${time}: Scam detected - scam-user`,
+        `${time}: Scam detected\n\nHandle: scam-user`,
         "handle:did:plc:user1:scam-user",
       );
     });
···
       expect(createAccountLabel).toHaveBeenCalledWith(
         "did:plc:user1",
         "bot",
-        `${time}: Bot detected - bot-789`,
+        `${time}: Bot detected\n\nHandle: bot-789`,
       );
     });
 
···
 
       expect(createAccountReport).toHaveBeenCalledWith(
         "did:plc:user1",
-        `${time}: Multi-action triggered - dangerous-account`,
+        `${time}: Multi-action triggered\n\nHandle: dangerous-account`,
       );
       expect(createAccountComment).toHaveBeenCalledWith(
         "did:plc:user1",
-        `${time}: Multi-action triggered - dangerous-account`,
+        `${time}: Multi-action triggered\n\nHandle: dangerous-account`,
         "handle:did:plc:user1:dangerous-account",
       );
       expect(createAccountLabel).toHaveBeenCalledWith(
         "did:plc:user1",
         "multi-action",
-        `${time}: Multi-action triggered - dangerous-account`,
+        `${time}: Multi-action triggered\n\nHandle: dangerous-account`,
       );
     });
   });
···
 
       expect(createAccountReport).toHaveBeenCalledWith(
         "did:plc:user1",
-        `${time}: Spam detected - ${longHandle}`,
+        `${time}: Spam detected\n\nHandle: ${longHandle}`,
       );
     });
 
···
 
       expect(createAccountReport).toHaveBeenCalledWith(
         "did:plc:user1",
-        "1234567890: Spam detected - spam-account",
+        "1234567890: Spam detected\n\nHandle: spam-account",
       );
     });
 

src/rules/handles/checkHandles.ts

···
         }
       }
 
+      const formattedComment = `${time.toString()}: ${checkList.comment}\n\nHandle: ${handle}`;
+
       if (checkList.toLabel) {
-        void createAccountLabel(
-          did,
-          checkList.label,
-          `${time.toString()}: ${checkList.comment} - ${handle}`,
-        );
+        void createAccountLabel(did, checkList.label, formattedComment);
       }
 
       if (checkList.reportAcct) {
···
           { process: "CHECKHANDLE", did, handle, time, label: checkList.label },
           "Reporting account",
         );
-        void createAccountReport(
-          did,
-          `${time.toString()}: ${checkList.comment} - ${handle}`,
-        );
+        void createAccountReport(did, formattedComment);
       }
 
       if (checkList.commentAcct) {
         void createAccountComment(
           did,
-          `${time.toString()}: ${checkList.comment} - ${handle}`,
+          formattedComment,
           `handle:${did}:${handle}`,
         );
       }

src/rules/posts/checkPosts.ts

···
   createAccountComment,
   createAccountReport,
 } from "../../accountModeration.js";
+import { checkAccountThreshold } from "../../accountThreshold.js";
 import { logger } from "../../logger.js";
 import { createPostLabel, createPostReport } from "../../moderation.js";
 import type { Post } from "../../types.js";
···
 
       void countStarterPacks(post[0].did, post[0].time);
 
+      const postURL = `https://pdsls.dev/${post[0].atURI}`;
+      const formattedComment = `${checkPost.comment}\n\nPost: ${postURL}\n\nText: "${post[0].text}"`;
+
       if (checkPost.toLabel) {
         void createPostLabel(
           post[0].atURI,
           post[0].cid,
           checkPost.label,
-          `${post[0].time.toString()}: ${checkPost.comment} at ${post[0].atURI} with text "${post[0].text}"`,
+          formattedComment,
           checkPost.duration,
           post[0].did,
           post[0].time,
         );
+      } else if (checkPost.trackOnly) {
+        void checkAccountThreshold(
+          post[0].did,
+          post[0].atURI,
+          checkPost.label,
+          post[0].time,
+        );
       }
 
       if (checkPost.reportPost === true) {
···
           },
           "Reporting post",
         );
-        void createPostReport(
-          post[0].atURI,
-          post[0].cid,
-          `${post[0].time.toString()}: ${checkPost.comment} at ${post[0].atURI} with text "${post[0].text}"`,
-        );
+        void createPostReport(post[0].atURI, post[0].cid, formattedComment);
       }
 
       if (checkPost.reportAcct) {
···
           },
           "Reporting account",
         );
-        void createAccountReport(
-          post[0].did,
-          `${post[0].time.toString()}: ${checkPost.comment} at ${post[0].atURI} with text "${post[0].text}"`,
-        );
+        void createAccountReport(post[0].did, formattedComment);
       }
 
       if (checkPost.commentAcct) {
-        void createAccountComment(
-          post[0].did,
-          `${post[0].time.toString()}: ${checkPost.comment} at ${post[0].atURI} with text "${post[0].text}"`,
-          post[0].atURI,
-        );
+        void createAccountComment(post[0].did, formattedComment, post[0].atURI);
       }
     }
   });

src/rules/posts/tests/checkPosts.test.ts

···
   createAccountComment,
   createAccountReport,
 } from "../../../accountModeration.js";
+import { checkAccountThreshold } from "../../../accountThreshold.js";
 import { logger } from "../../../logger.js";
 import { createPostLabel, createPostReport } from "../../../moderation.js";
 import type { Post } from "../../../types.js";
···
       reportAcct: true,
       commentAcct: true,
     },
+    {
+      label: "track-only-label",
+      comment: "Track only test",
+      check: /shopping/i,
+      toLabel: false,
+      trackOnly: true,
+      reportPost: false,
+      reportAcct: false,
+      commentAcct: false,
+    },
   ],
 }));
 
···
 vi.mock("../../../accountModeration.js", () => ({
   createAccountReport: vi.fn(),
   createAccountComment: vi.fn(),
+}));
+
+vi.mock("../../../accountThreshold.js", () => ({
+  checkAccountThreshold: vi.fn(),
 }));
 
 vi.mock("../../../moderation.js", () => ({
···
         post[0].did,
         expect.any(String),
         expect.any(String),
+      );
+    });
+  });
+
+  describe("trackOnly behavior", () => {
+    it("should track for account threshold without emitting post label when trackOnly is true", async () => {
+      const post = createMockPost({ text: "check out this shopping link" });
+
+      await checkPosts(post);
+
+      expect(createPostLabel).not.toHaveBeenCalledWith(
+        expect.any(String),
+        expect.any(String),
+        "track-only-label",
+        expect.any(String),
+        expect.any(Number),
+        expect.any(String),
+        expect.any(Number),
+      );
+
+      expect(checkAccountThreshold).toHaveBeenCalledWith(
+        post[0].did,
+        post[0].atURI,
+        "track-only-label",
+        post[0].time,
       );
     });
   });

src/rules/profiles/checkProfiles.ts

···
   createAccountComment,
   createAccountLabel,
   createAccountReport,
+  negateAccountLabel,
 } from "../../accountModeration.js";
 import { logger } from "../../logger.js";
+import type { Checks } from "../../types.js";
 import { getLanguage } from "../../utils/getLanguage.js";
 
+export class ProfileChecker {
+  private check: Checks;
+  private did: string;
+  private time: number;
+
+  constructor(check: Checks, did: string, time: number) {
+    this.check = check;
+    this.did = did;
+    this.time = time;
+  }
+
+  checkDescription(description: string): void {
+    if (!description) return;
+    this.performActions(description, "CHECKDESCRIPTION");
+  }
+
+  checkDisplayName(displayName: string): void {
+    if (!displayName) return;
+    this.performActions(displayName, "CHECKDISPLAYNAME");
+  }
+
+  checkBoth(displayName: string, description: string): void {
+    const profile = `${displayName} ${description}`;
+    if (!profile) return;
+    this.performActions(profile, "CHECKPROFILE");
+  }
+
+  private performActions(
+    content: string,
+    processType: "CHECKPROFILE" | "CHECKDESCRIPTION" | "CHECKDISPLAYNAME",
+  ): void {
+    const matched = this.check.check.test(content);
+
+    if (matched) {
+      if (this.check.whitelist?.test(content)) {
+        logger.debug(
+          { process: processType, did: this.did, time: this.time, content },
+          "Whitelisted phrase found",
+        );
+        return;
+      }
+
+      this.applyActions(content, processType);
+    } else {
+      if (this.check.unlabel) {
+        this.removeLabel(content, processType);
+      }
+    }
+  }
+
+  private applyActions(content: string, processType: string): void {
+    const formattedComment = `${this.time.toString()}: ${this.check.comment}\n\nContent: ${content}`;
+
+    if (this.check.toLabel) {
+      void createAccountLabel(this.did, this.check.label, formattedComment);
+    }
+
+    if (this.check.reportAcct) {
+      void createAccountReport(this.did, formattedComment);
+      logger.info(
+        {
+          process: processType,
+          did: this.did,
+          time: this.time,
+          label: this.check.label,
+        },
+        "Reporting account",
+      );
+    }
+
+    if (this.check.commentAcct) {
+      void createAccountComment(
+        this.did,
+        formattedComment,
+        `profile:${this.did}`,
+      );
+    }
+  }
+
+  private removeLabel(content: string, _processType: string): void {
+    const formattedComment = `${this.check.comment}\n\nContent: ${content}`;
+    void negateAccountLabel(this.did, this.check.label, formattedComment);
+  }
+}
+
 export const checkDescription = async (
   did: string,
   time: number,
   displayName: string,
   description: string,
-) => {
-  const lang = await getLanguage(description);
+): Promise<void> => {
+  if (!description) return;
 
-  // Check if DID is whitelisted
   if (GLOBAL_ALLOW.includes(did)) {
     logger.warn(
       { process: "CHECKDESCRIPTION", did, time, displayName, description },
···
     return;
   }
 
-  // iterate through the checks
-  PROFILE_CHECKS.forEach((checkProfiles) => {
-    if (checkProfiles.language) {
-      if (!checkProfiles.language.includes(lang)) {
-        return;
+  for (const checkRule of PROFILE_CHECKS) {
+    if (checkRule.language) {
+      const lang = await getLanguage(description);
+      if (!checkRule.language.includes(lang)) {
+        continue;
       }
     }
 
-    // Check if DID is whitelisted
-    if (checkProfiles.ignoredDIDs) {
-      if (checkProfiles.ignoredDIDs.includes(did)) {
-        logger.debug(
-          { process: "CHECKDESCRIPTION", did, time, displayName, description },
-          "Whitelisted DID",
-        );
-        return;
-      }
+    if (checkRule.ignoredDIDs?.includes(did)) {
+      logger.debug(
+        { process: "CHECKDESCRIPTION", did, time, displayName, description },
+        "Whitelisted DID",
+      );
+      continue;
     }
 
-    if (description) {
-      if (checkProfiles.description === true) {
-        if (checkProfiles.check.test(description)) {
-          // Check if description is whitelisted
-          if (checkProfiles.whitelist) {
-            if (checkProfiles.whitelist.test(description)) {
-              logger.debug(
-                {
-                  process: "CHECKDESCRIPTION",
-                  did,
-                  time,
-                  displayName,
-                  description,
-                },
-                "Whitelisted phrase found",
-              );
-              return;
-            }
-          }
-
-          if (checkProfiles.toLabel) {
-            void createAccountLabel(
-              did,
-              checkProfiles.label,
-              `${time.toString()}: ${checkProfiles.comment} - ${displayName} - ${description}`,
-            );
-          }
-
-          if (checkProfiles.reportAcct) {
-            void createAccountReport(
-              did,
-              `${time.toString()}: ${checkProfiles.comment} - ${displayName} - ${description}`,
-            );
-            logger.info(
-              {
-                process: "CHECKDESCRIPTION",
-                did,
-                time,
-                displayName,
-                description,
-                label: checkProfiles.label,
-              },
-              "Reporting account",
-            );
-          }
-
-          if (checkProfiles.commentAcct) {
-            void createAccountComment(
-              did,
-              `${time.toString()}: ${checkProfiles.comment} - ${displayName} - ${description}`,
-              `profile:${did}:${time.toString()}`,
-            );
-          }
-        }
-      }
+    if (checkRule.description === true) {
+      const checker = new ProfileChecker(checkRule, did, time);
+      checker.checkDescription(description);
     }
-  });
+  }
 };
 
 export const checkDisplayName = async (
···
   time: number,
   displayName: string,
   description: string,
-) => {
-  // Check if DID is whitelisted
+): Promise<void> => {
+  if (!displayName) return;
+
   if (GLOBAL_ALLOW.includes(did)) {
     logger.warn(
       { process: "CHECKDISPLAYNAME", did, time, displayName, description },
···
     return;
   }
 
-  const lang = await getLanguage(description);
-
-  // iterate through the checks
-  PROFILE_CHECKS.forEach((checkProfiles) => {
-    if (checkProfiles.language) {
-      if (!checkProfiles.language.includes(lang)) {
-        return;
+  for (const checkRule of PROFILE_CHECKS) {
+    if (checkRule.language) {
+      const lang = await getLanguage(displayName);
+      if (!checkRule.language.includes(lang)) {
+        continue;
       }
     }
 
-    // Check if DID is whitelisted
-    if (checkProfiles.ignoredDIDs) {
-      if (checkProfiles.ignoredDIDs.includes(did)) {
-        logger.debug(
-          { process: "CHECKDISPLAYNAME", did, time, displayName, description },
-          "Whitelisted DID",
-        );
-        return;
-      }
+    if (checkRule.ignoredDIDs?.includes(did)) {
+      logger.debug(
+        { process: "CHECKDISPLAYNAME", did, time, displayName, description },
+        "Whitelisted DID",
+      );
+      continue;
     }
 
-    if (displayName) {
-      if (checkProfiles.displayName === true) {
-        if (checkProfiles.check.test(displayName)) {
-          // Check if displayName is whitelisted
-          if (checkProfiles.whitelist) {
-            if (checkProfiles.whitelist.test(displayName)) {
-              logger.debug(
-                {
-                  process: "CHECKDISPLAYNAME",
-                  did,
-                  time,
-                  displayName,
-                  description,
-                },
-                "Whitelisted phrase found",
-              );
-              return;
-            }
-          }
+    if (checkRule.displayName === true) {
+      const checker = new ProfileChecker(checkRule, did, time);
+      checker.checkDisplayName(displayName);
+    }
+  }
+};
 
-          if (checkProfiles.toLabel) {
-            void createAccountLabel(
-              did,
-              checkProfiles.label,
-              `${time.toString()}: ${checkProfiles.comment} - ${displayName} - ${description}`,
-            );
-          }
+export const checkProfile = async (
+  did: string,
+  time: number,
+  displayName: string,
+  description: string,
+) => {
+  const profile = `${displayName} ${description}`;
+  const lang = await getLanguage(profile);
 
-          if (checkProfiles.reportAcct) {
-            void createAccountReport(
-              did,
-              `${time.toString()}: ${checkProfiles.comment} - ${displayName} - ${description}`,
-            );
-            logger.info(
-              {
-                process: "CHECKDISPLAYNAME",
-                did,
-                time,
-                displayName,
-                description,
-                label: checkProfiles.label,
-              },
-              "Reporting account",
-            );
-          }
+  // Check if DID is whitelisted at global level
+  if (GLOBAL_ALLOW.includes(did)) {
+    logger.warn(
+      { process: "CHECKPROFILE", did, time, profile },
+      "Global AllowListed DID",
+    );
+    return;
+  }
 
-          if (checkProfiles.commentAcct) {
-            void createAccountComment(
-              did,
-              `${time.toString()}: ${checkProfiles.comment} - ${displayName} - ${description}`,
-              `profile:${did}:${time.toString()}`,
-            );
-          }
-        }
+  // Iterate through checks and delegate to ProfileChecker
+  for (const checkRule of PROFILE_CHECKS) {
+    // Language filter (same for all branches)
+    if (checkRule.language) {
+      if (!checkRule.language.includes(lang)) {
+        continue;
       }
     }
-  });
+
+    // DID whitelist (same for all branches)
+    if (checkRule.ignoredDIDs?.includes(did)) {
+      logger.debug(
+        { process: "CHECKPROFILE", did, time, displayName, description },
+        "Whitelisted DID",
+      );
+      continue;
+    }
+
+    // Dispatch to correct method based on check configuration
+    const checker = new ProfileChecker(checkRule, did, time);
+
+    if (checkRule.description === true && checkRule.displayName === true) {
+      checker.checkBoth(displayName, description);
+    } else if (checkRule.description === true) {
+      checker.checkDescription(description);
+    } else if (checkRule.displayName === true) {
+      checker.checkDisplayName(displayName);
+    }
+  }
 };

src/rules/profiles/tests/checkProfiles.test.ts

···
             process: "CHECKDESCRIPTION",
             did: mockDid,
             time: mockTime,
-            displayName: mockDisplayName,
-            description: "this is good bad content",
+            content: "this is good bad content",
           },
           "Whitelisted phrase found",
         );

src/starterPackThreshold.ts

···
+import { STARTER_PACK_THRESHOLD_CONFIGS } from "../rules/starterPackThreshold.js";
+import {
+  createAccountComment,
+  createAccountLabel,
+  createAccountReport,
+} from "./accountModeration.js";
+import { logger } from "./logger.js";
+import {
+  starterPackLabelsThresholdAppliedCounter,
+  starterPackThresholdChecksCounter,
+  starterPackThresholdMetCounter,
+} from "./metrics.js";
+import {
+  getStarterPackCountInWindow,
+  trackStarterPackForAccount,
+} from "./redis.js";
+import type { StarterPackThresholdConfig } from "./types.js";
+
+function validateAndLoadConfigs(): StarterPackThresholdConfig[] {
+  if (STARTER_PACK_THRESHOLD_CONFIGS.length === 0) {
+    logger.warn(
+      { process: "STARTER_PACK_THRESHOLD" },
+      "No starter pack threshold configs found",
+    );
+    return [];
+  }
+
+  for (const config of STARTER_PACK_THRESHOLD_CONFIGS) {
+    if (config.threshold <= 0) {
+      throw new Error(
+        `Invalid starter pack threshold config: threshold must be positive`,
+      );
+    }
+    if (config.window <= 0) {
+      throw new Error(
+        `Invalid starter pack threshold config: window must be positive`,
+      );
+    }
+  }
+
+  logger.info(
+    { process: "STARTER_PACK_THRESHOLD", count: STARTER_PACK_THRESHOLD_CONFIGS.length },
+    "Loaded starter pack threshold configs",
+  );
+
+  return STARTER_PACK_THRESHOLD_CONFIGS;
+}
+
+const cachedConfigs = validateAndLoadConfigs();
+
+export function loadStarterPackThresholdConfigs(): StarterPackThresholdConfig[] {
+  return cachedConfigs;
+}
+
+export async function checkStarterPackThreshold(
+  did: string,
+  starterPackUri: string,
+  timestamp: number,
+): Promise<void> {
+  try {
+    const configs = loadStarterPackThresholdConfigs();
+
+    if (configs.length === 0) {
+      return;
+    }
+
+    starterPackThresholdChecksCounter.inc();
+
+    for (const config of configs) {
+      // Check allowlist
+      if (config.allowlist?.includes(did)) {
+        logger.debug(
+          { process: "STARTER_PACK_THRESHOLD", did, starterPackUri },
+          "Account is in allowlist, skipping threshold check",
+        );
+        continue;
+      }
+
+      await trackStarterPackForAccount(
+        did,
+        starterPackUri,
+        timestamp,
+        config.window,
+        config.windowUnit,
+      );
+
+      const count = await getStarterPackCountInWindow(
+        did,
+        config.window,
+        config.windowUnit,
+        timestamp,
+      );
+
+      logger.debug(
+        {
+          process: "STARTER_PACK_THRESHOLD",
+          did,
+          count,
+          threshold: config.threshold,
+          window: config.window,
+          windowUnit: config.windowUnit,
+        },
+        "Checked starter pack threshold",
+      );
+
+      if (count >= config.threshold) {
+        starterPackThresholdMetCounter.inc({ account_label: config.accountLabel });
+
+        logger.info(
+          {
+            process: "STARTER_PACK_THRESHOLD",
+            did,
+            starterPackUri,
+            accountLabel: config.accountLabel,
+            count,
+            threshold: config.threshold,
+          },
+          "Starter pack threshold met",
+        );
+
+        const shouldLabel = config.toLabel !== false;
+
+        const formattedComment = `${config.accountComment}\n\nThreshold: ${count.toString()}/${config.threshold.toString()} in ${config.window.toString()} ${config.windowUnit}\n\nStarter Pack: ${starterPackUri}`;
+
+        if (shouldLabel) {
+          await createAccountLabel(did, config.accountLabel, formattedComment);
+          starterPackLabelsThresholdAppliedCounter.inc({
+            account_label: config.accountLabel,
+            action: "label",
+          });
+        }
+
+        if (config.reportAcct) {
+          await createAccountReport(did, formattedComment);
+          starterPackLabelsThresholdAppliedCounter.inc({
+            account_label: config.accountLabel,
+            action: "report",
+          });
+        }
+
+        if (config.commentAcct) {
+          const atURI = `starterpack-threshold-comment:${config.accountLabel}:${timestamp.toString()}`;
+          await createAccountComment(did, formattedComment, atURI);
+          starterPackLabelsThresholdAppliedCounter.inc({
+            account_label: config.accountLabel,
+            action: "comment",
+          });
+        }
+      }
+    }
+  } catch (error) {
+    logger.error(
+      { process: "STARTER_PACK_THRESHOLD", did, starterPackUri, error },
+      "Error checking starter pack threshold",
+    );
+    throw error;
+  }
+}

src/tests/accountModeration.test.ts

···
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { getAllAccountLabels, negateAccountLabel } from "../accountModeration.js";
+import { agent } from "../agent.js";
+
+vi.mock("../agent.js", () => ({
+  agent: {
+    did: "did:plc:test-moderator",
+    tools: {
+      ozone: {
+        moderation: {
+          getRepo: vi.fn(),
+          emitEvent: vi.fn(),
+        },
+      },
+    },
+  },
+  isLoggedIn: Promise.resolve(),
+}));
+
+vi.mock("../logger.js", () => ({
+  logger: {
+    info: vi.fn(),
+    debug: vi.fn(),
+    error: vi.fn(),
+    warn: vi.fn(),
+  },
+}));
+
+vi.mock("../limits.js", () => ({
+  limit: vi.fn((fn) => fn()),
+}));
+
+vi.mock("../redis.js", () => ({
+  deleteAccountLabelClaim: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("../metrics.js", () => ({
+  unlabelsRemovedCounter: {
+    inc: vi.fn(),
+  },
+  labelsAppliedCounter: {
+    inc: vi.fn(),
+  },
+  labelsCachedCounter: {
+    inc: vi.fn(),
+  },
+}));
+
+const mockAgent = agent as any;
+
+describe("getAllAccountLabels", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("should return array of label strings from API response", async () => {
+    mockAgent.tools.ozone.moderation.getRepo.mockResolvedValueOnce({
+      data: {
+        labels: [{ val: "blue-heart-emoji" }, { val: "hammer-sickle" }],
+      },
+    });
+
+    const labels = await getAllAccountLabels("did:plc:test123");
+
+    expect(labels).toEqual(["blue-heart-emoji", "hammer-sickle"]);
+    expect(mockAgent.tools.ozone.moderation.getRepo).toHaveBeenCalledWith(
+      { did: "did:plc:test123" },
+      expect.objectContaining({
+        headers: expect.any(Object),
+      }),
+    );
+  });
+
+  it("should return empty array when account has no labels", async () => {
+    mockAgent.tools.ozone.moderation.getRepo.mockResolvedValueOnce({
+      data: {
+        labels: undefined,
+      },
+    });
+
+    const labels = await getAllAccountLabels("did:plc:test123");
+
+    expect(labels).toEqual([]);
+  });
+
+  it("should return empty array when labels array is empty", async () => {
+    mockAgent.tools.ozone.moderation.getRepo.mockResolvedValueOnce({
+      data: {
+        labels: [],
+      },
+    });
+
+    const labels = await getAllAccountLabels("did:plc:test123");
+
+    expect(labels).toEqual([]);
+  });
+
+  it("should return empty array on API error", async () => {
+    mockAgent.tools.ozone.moderation.getRepo.mockRejectedValueOnce(
+      new Error("API Error"),
+    );
+
+    const labels = await getAllAccountLabels("did:plc:test123");
+
+    expect(labels).toEqual([]);
+  });
+});
+
+describe("negateAccountLabel", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("should emit moderation event to remove label", async () => {
+    mockAgent.tools.ozone.moderation.getRepo.mockResolvedValueOnce({
+      data: {
+        labels: [{ val: "blue-heart-emoji" }],
+      },
+    });
+
+    mockAgent.tools.ozone.moderation.emitEvent.mockResolvedValueOnce({});
+
+    await negateAccountLabel(
+      "did:plc:test123",
+      "blue-heart-emoji",
+      "Test removal",
+    );
+
+    expect(mockAgent.tools.ozone.moderation.emitEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        event: expect.objectContaining({
+          $type: "tools.ozone.moderation.defs#modEventLabel",
+          createLabelVals: [],
+          negateLabelVals: ["blue-heart-emoji"],
+          comment: "Test removal",
+        }),
+        subject: expect.objectContaining({
+          $type: "com.atproto.admin.defs#repoRef",
+          did: "did:plc:test123",
+        }),
+      }),
+      expect.any(Object),
+    );
+  });
+
+  it("should not emit event if label does not exist on account", async () => {
+    mockAgent.tools.ozone.moderation.getRepo.mockResolvedValueOnce({
+      data: {
+        labels: [{ val: "other-label" }],
+      },
+    });
+
+    await negateAccountLabel(
+      "did:plc:test123",
+      "blue-heart-emoji",
+      "Test removal",
+    );
+
+    expect(mockAgent.tools.ozone.moderation.emitEvent).not.toHaveBeenCalled();
+  });
+
+  it("should not emit event if account has no labels", async () => {
+    mockAgent.tools.ozone.moderation.getRepo.mockResolvedValueOnce({
+      data: {
+        labels: [],
+      },
+    });
+
+    await negateAccountLabel(
+      "did:plc:test123",
+      "blue-heart-emoji",
+      "Test removal",
+    );
+
+    expect(mockAgent.tools.ozone.moderation.emitEvent).not.toHaveBeenCalled();
+  });
+
+  it("should delete Redis cache key on successful removal", async () => {
+    const { deleteAccountLabelClaim } = await import("../redis.js");
+
+    mockAgent.tools.ozone.moderation.getRepo.mockResolvedValueOnce({
+      data: {
+        labels: [{ val: "blue-heart-emoji" }],
+      },
+    });
+
+    mockAgent.tools.ozone.moderation.emitEvent.mockResolvedValueOnce({});
+
+    await negateAccountLabel(
+      "did:plc:test123",
+      "blue-heart-emoji",
+      "Test removal",
+    );
+
+    expect(deleteAccountLabelClaim).toHaveBeenCalledWith(
+      "did:plc:test123",
+      "blue-heart-emoji",
+    );
+  });
+
+  it("should log error if API call fails", async () => {
+    const { logger } = await import("../logger.js");
+
+    mockAgent.tools.ozone.moderation.getRepo.mockRejectedValueOnce(
+      new Error("API Error"),
+    );
+
+    await negateAccountLabel(
+      "did:plc:test123",
+      "blue-heart-emoji",
+      "Test removal",
+    );
+
+    expect(logger.error).toHaveBeenCalled();
+  });
+});

src/tests/accountThreshold.test.ts

···
       threshold: 3,
       accountLabel: "test-account-label",
       accountComment: "Test comment",
-      windowDays: 5,
+      window: 5,
+      windowUnit: "days",
       reportAcct: false,
       commentAcct: false,
       toLabel: true,
···
       threshold: 5,
       accountLabel: "multi-label-account",
       accountComment: "Multi label comment",
-      windowDays: 7,
+      window: 7,
+      windowUnit: "days",
       reportAcct: true,
       commentAcct: true,
       toLabel: true,
···
       threshold: 2,
       accountLabel: "monitored",
       accountComment: "Monitoring comment",
-      windowDays: 3,
+      window: 3,
+      windowUnit: "days",
       reportAcct: true,
       commentAcct: false,
       toLabel: false,
···
       threshold: 2,
       accountLabel: "shared-config",
       accountComment: "Shared config comment",
-      windowDays: 4,
+      window: 4,
+      windowUnit: "days",
       reportAcct: false,
       commentAcct: false,
       toLabel: true,
···
 
   describe("checkAccountThreshold", () => {
     const testDid = "did:plc:test123";
+    const testUri = "at://did:plc:test123/app.bsky.feed.post/abc123";
     const testTimestamp = 1640000000000000;
 
     it("should not check threshold for non-matching labels", async () => {
       vi.mocked(trackPostLabelForAccount).mockResolvedValue();
       vi.mocked(getPostLabelCountInWindow).mockResolvedValue(0);
 
-      await checkAccountThreshold(testDid, "non-matching-label", testTimestamp);
+      await checkAccountThreshold(
+        testDid,
+        testUri,
+        "non-matching-label",
+        testTimestamp,
+      );
 
       expect(trackPostLabelForAccount).not.toHaveBeenCalled();
       expect(getPostLabelCountInWindow).not.toHaveBeenCalled();
···
       vi.mocked(trackPostLabelForAccount).mockResolvedValue();
       vi.mocked(getPostLabelCountInWindow).mockResolvedValue(2);
 
-      await checkAccountThreshold(testDid, "test-label", testTimestamp);
+      await checkAccountThreshold(testDid, testUri, "test-label", testTimestamp);
 
       expect(accountThresholdChecksCounter.inc).toHaveBeenCalledWith({
         post_label: "test-label",
···
         "test-label",
         testTimestamp,
         5,
+        "days",
       );
       expect(getPostLabelCountInWindow).toHaveBeenCalledWith(
         testDid,
         ["test-label"],
         5,
+        "days",
         testTimestamp,
       );
     });
···
       vi.mocked(getPostLabelCountInWindow).mockResolvedValue(3);
       vi.mocked(createAccountLabel).mockResolvedValue();
 
-      await checkAccountThreshold(testDid, "test-label", testTimestamp);
+      await checkAccountThreshold(testDid, testUri, "test-label", testTimestamp);
 
       expect(accountThresholdMetCounter.inc).toHaveBeenCalledWith({
         account_label: "test-account-label",
···
       expect(createAccountLabel).toHaveBeenCalledWith(
         testDid,
         "test-account-label",
-        "Test comment",
+        `Test comment\n\nThreshold: 3/3 in 5 days\n\nPost: ${testUri}\n\nPost Label: test-label`,
       );
       expect(accountLabelsThresholdAppliedCounter.inc).toHaveBeenCalledWith({
         account_label: "test-account-label",
···
       vi.mocked(trackPostLabelForAccount).mockResolvedValue();
       vi.mocked(getPostLabelCountInWindow).mockResolvedValue(2);
 
-      await checkAccountThreshold(testDid, "test-label", testTimestamp);
+      await checkAccountThreshold(testDid, testUri, "test-label", testTimestamp);
 
       expect(accountThresholdMetCounter.inc).not.toHaveBeenCalled();
       expect(createAccountLabel).not.toHaveBeenCalled();
···
       vi.mocked(createAccountReport).mockResolvedValue();
       vi.mocked(createAccountComment).mockResolvedValue();
 
-      await checkAccountThreshold(testDid, "label-2", testTimestamp);
+      await checkAccountThreshold(testDid, testUri, "label-2", testTimestamp);
 
       expect(getPostLabelCountInWindow).toHaveBeenCalledWith(
         testDid,
         ["label-1", "label-2", "label-3"],
         7,
+        "days",
         testTimestamp,
       );
       expect(createAccountLabel).toHaveBeenCalledWith(
         testDid,
         "multi-label-account",
-        "Multi label comment",
+        `Multi label comment\n\nThreshold: 5/5 in 7 days\n\nPost: ${testUri}\n\nPost Label: label-2`,
       );
       expect(createAccountReport).toHaveBeenCalledWith(
         testDid,
-        "Multi label comment",
+        `Multi label comment\n\nThreshold: 5/5 in 7 days\n\nPost: ${testUri}\n\nPost Label: label-2`,
       );
       expect(createAccountComment).toHaveBeenCalled();
     });
···
       vi.mocked(getPostLabelCountInWindow).mockResolvedValue(2);
       vi.mocked(createAccountReport).mockResolvedValue();
 
-      await checkAccountThreshold(testDid, "monitor-only-label", testTimestamp);
+      await checkAccountThreshold(
+        testDid,
+        testUri,
+        "monitor-only-label",
+        testTimestamp,
+      );
 
       expect(trackPostLabelForAccount).toHaveBeenCalled();
       expect(getPostLabelCountInWindow).toHaveBeenCalled();
···
       vi.mocked(createAccountReport).mockResolvedValue();
       vi.mocked(createAccountComment).mockResolvedValue();
 
-      await checkAccountThreshold(testDid, "label-1", testTimestamp);
+      await checkAccountThreshold(testDid, testUri, "label-1", testTimestamp);
 
       expect(accountLabelsThresholdAppliedCounter.inc).toHaveBeenCalledTimes(3);
       expect(accountLabelsThresholdAppliedCounter.inc).toHaveBeenCalledWith({
···
       vi.mocked(trackPostLabelForAccount).mockRejectedValue(redisError);
 
       await expect(
-        checkAccountThreshold(testDid, "test-label", testTimestamp),
+        checkAccountThreshold(testDid, testUri, "test-label", testTimestamp),
       ).rejects.toThrow("Redis connection failed");
 
       expect(logger.error).toHaveBeenCalled();
···
       vi.mocked(getPostLabelCountInWindow).mockRejectedValue(redisError);
 
       await expect(
-        checkAccountThreshold(testDid, "test-label", testTimestamp),
+        checkAccountThreshold(testDid, testUri, "test-label", testTimestamp),
       ).rejects.toThrow("Redis query failed");
 
       expect(logger.error).toHaveBeenCalled();
···
       vi.mocked(createAccountReport).mockResolvedValue();
       vi.mocked(createAccountComment).mockResolvedValue();
 
-      await checkAccountThreshold(testDid, "label-1", testTimestamp);
+      await checkAccountThreshold(testDid, testUri, "label-1", testTimestamp);
 
       expect(trackPostLabelForAccount).toHaveBeenCalledTimes(2);
       expect(getPostLabelCountInWindow).toHaveBeenCalledTimes(2);

src/tests/agent.test.ts

···
       OZONE_PDS: "pds.test.com",
     }));
 
+    // Mock session
+    const mockSession = {
+      did: "did:plc:test123",
+      handle: "test.bsky.social",
+      accessJwt: "test-access-jwt",
+      refreshJwt: "test-refresh-jwt",
+    };
+
     // Mock the AtpAgent
-    const mockLogin = vi.fn(() => Promise.resolve());
+    const mockLogin = vi.fn(() =>
+      Promise.resolve({ success: true, data: mockSession }),
+    );
     const mockConstructor = vi.fn();
     vi.doMock("@atproto/api", () => ({
       AtpAgent: class {
         login = mockLogin;
         service: URL;
+        session = mockSession;
         constructor(options: { service: string }) {
           mockConstructor(options);
           this.service = new URL(options.service);

src/tests/redis.test.ts

···
   connectRedis,
   disconnectRedis,
   getPostLabelCountInWindow,
+  getStarterPackCountInWindow,
   trackPostLabelForAccount,
+  trackStarterPackForAccount,
   tryClaimAccountLabel,
   tryClaimPostLabel,
 } from "../redis.js";
···
       vi.mocked(mockRedisClient.expire).mockResolvedValue(true);
 
       const timestamp = 1640000000000000; // microseconds
-      const windowDays = 5;
+      const window = 5;
+      const windowUnit = "days" as const;
 
       await trackPostLabelForAccount(
         "did:plc:123",
         "test-label",
         timestamp,
-        windowDays,
+        window,
+        windowUnit,
       );
 
-      const expectedKey = "account-post-labels:did:plc:123:test-label:5";
-      const windowStartTime = timestamp - windowDays * 24 * 60 * 60 * 1000000;
+      const expectedKey = "account-post-labels:did:plc:123:test-label:5days";
+      const windowStartTime = timestamp - window * 24 * 60 * 60 * 1000000;
 
       expect(mockRedisClient.zRemRangeByScore).toHaveBeenCalledWith(
         expectedKey,
···
       });
       expect(mockRedisClient.expire).toHaveBeenCalledWith(
         expectedKey,
-        (windowDays + 1) * 24 * 60 * 60,
+        window * 24 * 60 * 60 + 60 * 60,
       );
     });
 
···
           "test-label",
           1640000000000000,
           5,
+          "days",
         ),
       ).rejects.toThrow("Redis down");
 
···
     });
   });
 
+  describe("trackStarterPackForAccount", () => {
+    it("should track starter pack with correct timestamp and TTL", async () => {
+      vi.mocked(mockRedisClient.zRemRangeByScore).mockResolvedValue(0);
+      vi.mocked(mockRedisClient.zAdd).mockResolvedValue(1);
+      vi.mocked(mockRedisClient.expire).mockResolvedValue(true);
+
+      const timestamp = 1640000000000000;
+      const window = 24;
+      const windowUnit = "hours" as const;
+
+      await trackStarterPackForAccount(
+        "did:plc:123",
+        "at://did:plc:123/app.bsky.graph.starterpack/abc",
+        timestamp,
+        window,
+        windowUnit,
+      );
+
+      const expectedKey = "starterpack:threshold:did:plc:123:24hours";
+      const windowStartTime = timestamp - window * 60 * 60 * 1000000;
+
+      expect(mockRedisClient.zRemRangeByScore).toHaveBeenCalledWith(
+        expectedKey,
+        "-inf",
+        windowStartTime,
+      );
+      expect(mockRedisClient.zAdd).toHaveBeenCalledWith(expectedKey, {
+        score: timestamp,
+        value: "at://did:plc:123/app.bsky.graph.starterpack/abc",
+      });
+      expect(mockRedisClient.expire).toHaveBeenCalledWith(
+        expectedKey,
+        window * 60 * 60 + 60 * 60,
+      );
+    });
+
+    it("should throw error on Redis failure", async () => {
+      const redisError = new Error("Redis down");
+      vi.mocked(mockRedisClient.zRemRangeByScore).mockRejectedValue(redisError);
+
+      await expect(
+        trackStarterPackForAccount(
+          "did:plc:123",
+          "at://did:plc:123/app.bsky.graph.starterpack/abc",
+          1640000000000000,
+          24,
+          "hours",
+        ),
+      ).rejects.toThrow("Redis down");
+
+      expect(logger.error).toHaveBeenCalled();
+    });
+  });
+
+  describe("getStarterPackCountInWindow", () => {
+    it("should count starter packs in window", async () => {
+      vi.mocked(mockRedisClient.zCount).mockResolvedValue(3);
+
+      const currentTime = 1640000000000000;
+      const window = 24;
+      const windowUnit = "hours" as const;
+      const count = await getStarterPackCountInWindow(
+        "did:plc:123",
+        window,
+        windowUnit,
+        currentTime,
+      );
+
+      expect(count).toBe(3);
+      const windowStartTime = currentTime - window * 60 * 60 * 1000000;
+      expect(mockRedisClient.zCount).toHaveBeenCalledWith(
+        "starterpack:threshold:did:plc:123:24hours",
+        windowStartTime,
+        "+inf",
+      );
+    });
+
+    it("should throw error on Redis failure", async () => {
+      const redisError = new Error("Redis down");
+      vi.mocked(mockRedisClient.zCount).mockRejectedValue(redisError);
+
+      await expect(
+        getStarterPackCountInWindow("did:plc:123", 24, "hours", 1640000000000000),
+      ).rejects.toThrow("Redis down");
+
+      expect(logger.error).toHaveBeenCalled();
+    });
+  });
+
   describe("getPostLabelCountInWindow", () => {
     it("should count posts for single label", async () => {
       vi.mocked(mockRedisClient.zCount).mockResolvedValue(3);
 
       const currentTime = 1640000000000000;
-      const windowDays = 5;
+      const window = 5;
+      const windowUnit = "days" as const;
       const count = await getPostLabelCountInWindow(
         "did:plc:123",
         ["test-label"],
-        windowDays,
+        window,
+        windowUnit,
         currentTime,
       );
 
       expect(count).toBe(3);
-      const windowStartTime = currentTime - windowDays * 24 * 60 * 60 * 1000000;
+      const windowStartTime = currentTime - window * 24 * 60 * 60 * 1000000;
       expect(mockRedisClient.zCount).toHaveBeenCalledWith(
-        "account-post-labels:did:plc:123:test-label:5",
+        "account-post-labels:did:plc:123:test-label:5days",
         windowStartTime,
         "+inf",
       );
···
         .mockResolvedValueOnce(1);
 
       const currentTime = 1640000000000000;
-      const windowDays = 5;
+      const window = 5;
+      const windowUnit = "days" as const;
       const count = await getPostLabelCountInWindow(
         "did:plc:123",
         ["label-1", "label-2", "label-3"],
-        windowDays,
+        window,
+        windowUnit,
         currentTime,
       );
 
···
         "did:plc:123",
         ["test-label"],
         5,
+        "days",
         1640000000000000,
       );
 
···
           "did:plc:123",
           ["test-label"],
           5,
+          "days",
           1640000000000000,
         ),
       ).rejects.toThrow("Redis down");

src/tests/starterPackThreshold.test.ts

···
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+  createAccountComment,
+  createAccountLabel,
+  createAccountReport,
+} from "../accountModeration.js";
+import { logger } from "../logger.js";
+import {
+  starterPackLabelsThresholdAppliedCounter,
+  starterPackThresholdChecksCounter,
+  starterPackThresholdMetCounter,
+} from "../metrics.js";
+import {
+  getStarterPackCountInWindow,
+  trackStarterPackForAccount,
+} from "../redis.js";
+import {
+  checkStarterPackThreshold,
+  loadStarterPackThresholdConfigs,
+} from "../starterPackThreshold.js";
+
+vi.mock("../logger.js", () => ({
+  logger: {
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    debug: vi.fn(),
+  },
+}));
+
+vi.mock("../../rules/starterPackThreshold.js", () => ({
+  STARTER_PACK_THRESHOLD_CONFIGS: [
+    {
+      threshold: 5,
+      window: 24,
+      windowUnit: "hours",
+      accountLabel: "starter-pack-spam",
+      accountComment: "Too many starter packs",
+      toLabel: true,
+      reportAcct: true,
+      commentAcct: false,
+      allowlist: ["did:plc:allowed123"],
+    },
+    {
+      threshold: 10,
+      window: 7,
+      windowUnit: "days",
+      accountLabel: "starter-pack-abuse",
+      accountComment: "Excessive starter pack creation",
+      toLabel: true,
+      reportAcct: false,
+      commentAcct: true,
+      allowlist: [],
+    },
+  ],
+}));
+
+vi.mock("../redis.js", () => ({
+  trackStarterPackForAccount: vi.fn(),
+  getStarterPackCountInWindow: vi.fn(),
+}));
+
+vi.mock("../accountModeration.js", () => ({
+  createAccountLabel: vi.fn(),
+  createAccountReport: vi.fn(),
+  createAccountComment: vi.fn(),
+}));
+
+vi.mock("../metrics.js", () => ({
+  starterPackLabelsThresholdAppliedCounter: {
+    inc: vi.fn(),
+  },
+  starterPackThresholdChecksCounter: {
+    inc: vi.fn(),
+  },
+  starterPackThresholdMetCounter: {
+    inc: vi.fn(),
+  },
+}));
+
+describe("Starter Pack Threshold Logic", () => {
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe("loadStarterPackThresholdConfigs", () => {
+    it("should load and cache configs successfully", () => {
+      const configs = loadStarterPackThresholdConfigs();
+      expect(configs).toHaveLength(2);
+      expect(configs[0].threshold).toBe(5);
+      expect(configs[1].threshold).toBe(10);
+    });
+  });
+
+  describe("checkStarterPackThreshold", () => {
+    const testDid = "did:plc:test123";
+    const testUri = "at://did:plc:test123/app.bsky.graph.starterpack/abc";
+    const testTimestamp = 1640000000000000;
+
+    it("should skip threshold check for allowlisted accounts", async () => {
+      vi.mocked(trackStarterPackForAccount).mockResolvedValue();
+      vi.mocked(getStarterPackCountInWindow).mockResolvedValue(0);
+
+      await checkStarterPackThreshold(
+        "did:plc:allowed123",
+        testUri,
+        testTimestamp,
+      );
+
+      expect(starterPackThresholdChecksCounter.inc).toHaveBeenCalled();
+      // Should skip first config (allowlist), but process second config
+      expect(trackStarterPackForAccount).toHaveBeenCalledTimes(1);
+      expect(logger.debug).toHaveBeenCalledWith(
+        expect.objectContaining({ did: "did:plc:allowed123" }),
+        "Account is in allowlist, skipping threshold check",
+      );
+    });
+
+    it("should track and check threshold for non-allowlisted accounts", async () => {
+      vi.mocked(trackStarterPackForAccount).mockResolvedValue();
+      vi.mocked(getStarterPackCountInWindow).mockResolvedValue(3);
+
+      await checkStarterPackThreshold(testDid, testUri, testTimestamp);
+
+      expect(starterPackThresholdChecksCounter.inc).toHaveBeenCalled();
+      expect(trackStarterPackForAccount).toHaveBeenCalledWith(
+        testDid,
+        testUri,
+        testTimestamp,
+        24,
+        "hours",
+      );
+      expect(getStarterPackCountInWindow).toHaveBeenCalledWith(
+        testDid,
+        24,
+        "hours",
+        testTimestamp,
+      );
+    });
+
+    it("should apply account label when threshold is met", async () => {
+      vi.mocked(trackStarterPackForAccount).mockResolvedValue();
+      vi.mocked(getStarterPackCountInWindow).mockResolvedValue(5);
+      vi.mocked(createAccountLabel).mockResolvedValue();
+      vi.mocked(createAccountReport).mockResolvedValue();
+
+      await checkStarterPackThreshold(testDid, testUri, testTimestamp);
+
+      expect(starterPackThresholdMetCounter.inc).toHaveBeenCalledWith({
+        account_label: "starter-pack-spam",
+      });
+      expect(createAccountLabel).toHaveBeenCalledWith(
+        testDid,
+        "starter-pack-spam",
+        expect.stringContaining("Too many starter packs"),
+      );
+      expect(createAccountReport).toHaveBeenCalled();
+      expect(starterPackLabelsThresholdAppliedCounter.inc).toHaveBeenCalledWith({
+        account_label: "starter-pack-spam",
+        action: "label",
+      });
+    });
+
+    it("should not apply label when threshold not met", async () => {
+      vi.mocked(trackStarterPackForAccount).mockResolvedValue();
+      vi.mocked(getStarterPackCountInWindow).mockResolvedValue(3);
+
+      await checkStarterPackThreshold(testDid, testUri, testTimestamp);
+
+      expect(starterPackThresholdMetCounter.inc).not.toHaveBeenCalled();
+      expect(createAccountLabel).not.toHaveBeenCalled();
+    });
+
+    it("should handle Redis errors", async () => {
+      const redisError = new Error("Redis connection failed");
+      vi.mocked(trackStarterPackForAccount).mockRejectedValue(redisError);
+
+      await expect(
+        checkStarterPackThreshold(testDid, testUri, testTimestamp),
+      ).rejects.toThrow("Redis connection failed");
+
+      expect(logger.error).toHaveBeenCalled();
+    });
+
+    it("should check all configs for each starter pack", async () => {
+      vi.mocked(trackStarterPackForAccount).mockResolvedValue();
+      vi.mocked(getStarterPackCountInWindow)
+        .mockResolvedValueOnce(5)
+        .mockResolvedValueOnce(10);
+      vi.mocked(createAccountLabel).mockResolvedValue();
+      vi.mocked(createAccountReport).mockResolvedValue();
+      vi.mocked(createAccountComment).mockResolvedValue();
+
+      await checkStarterPackThreshold(testDid, testUri, testTimestamp);
+
+      expect(trackStarterPackForAccount).toHaveBeenCalledTimes(2);
+      expect(getStarterPackCountInWindow).toHaveBeenCalledTimes(2);
+      expect(createAccountLabel).toHaveBeenCalledTimes(2);
+    });
+  });
+});

src/types.ts

···
 export interface Checks {
   language?: string[];
   label: string;
+  unlabel?: boolean;
   comment: string;
   description?: boolean;
   displayName?: boolean;
···
   commentAcct: boolean;
   reportPost?: boolean;
   toLabel: boolean;
+  trackOnly?: boolean;
   duration?: number;
   check: RegExp;
   whitelist?: RegExp;
···
   expires?: string; // Optional expiration date (ISO 8601) - check will be skipped after this date
 }
 
+export type WindowUnit = "minutes" | "hours" | "days";
+
 export interface AccountThresholdConfig {
   labels: string | string[]; // Single label or array for OR matching
   threshold: number; // Number of labeled posts required to trigger account action
   accountLabel: string; // Label to apply to the account
   accountComment: string; // Comment for the account action
-  windowDays: number; // Rolling window in days
+  window: number; // Rolling window duration
+  windowUnit: WindowUnit; // Unit for the rolling window
   reportAcct: boolean; // Whether to report the account
   commentAcct: boolean; // Whether to comment on the account
   toLabel?: boolean; // Whether to apply label (defaults to true)
 }
+
+export interface StarterPackThresholdConfig {
+  threshold: number;
+  window: number;
+  windowUnit: WindowUnit;
+  accountLabel: string;
+  accountComment: string;
+  toLabel?: boolean;
+  reportAcct?: boolean;
+  commentAcct?: boolean;
+  allowlist?: string[];
+}