feat: implement ATProto labeler for copyright violations (#385)

* feat: implement ATProto labeler for copyright violations

adds a full ATProto-compliant labeler service that emits signed
`copyright-violation` labels when tracks are flagged by copyright scans.

moderation service (rust):
- add Label struct with DAG-CBOR serialization and secp256k1 signing
- add Postgres database for label storage with sequence numbers
- implement com.atproto.label.queryLabels XRPC endpoint
- implement com.atproto.label.subscribeLabels WebSocket with backfill
- add /emit-label endpoint for backend integration
- add landing page at root URL
- fix: split migrations into separate statements (postgres requirement)
- fix: enable tls-rustls for Neon database connections

backend (python):
- add _emit_copyright_label() to POST labels when tracks flagged
- add labeler_url config setting
- emit label only when track has atproto_record_uri

includes regression tests for label emission behavior.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[e-mail]>

* docs: update neon project names

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[e-mail]>

---------

Co-authored-by: Claude <[e-mail]>

backend/src/backend/_internal/moderation.py

···
 
 import httpx
 import logfire
+from sqlalchemy import select
 
 from backend.config import settings
-from backend.models import CopyrightScan
+from backend.models import CopyrightScan, Track
 from backend.utilities.database import db_session
 
 logger = logging.getLogger(__name__)
···
         result: scan result from moderation service
     """
     async with db_session() as db:
+        is_flagged = result.get("is_flagged", False)
+
         scan = CopyrightScan(
             track_id=track_id,
-            is_flagged=result.get("is_flagged", False),
+            is_flagged=is_flagged,
             highest_score=result.get("highest_score", 0),
             matches=result.get("matches", []),
             raw_response=result.get("raw_response", {}),
···
             highest_score=scan.highest_score,
             match_count=len(scan.matches),
         )
+
+        # emit ATProto label if flagged
+        if is_flagged:
+            track = await db.scalar(select(Track).where(Track.id == track_id))
+            if track and track.atproto_record_uri:
+                await _emit_copyright_label(
+                    uri=track.atproto_record_uri,
+                    cid=track.atproto_record_cid,
+                )
+
+
+async def _emit_copyright_label(uri: str, cid: str | None) -> None:
+    """emit a copyright-violation label to the ATProto labeler service.
+
+    this is fire-and-forget - failures are logged but don't affect the scan result.
+
+    args:
+        uri: AT URI of the track record
+        cid: optional CID of the record
+    """
+    try:
+        async with httpx.AsyncClient(timeout=httpx.Timeout(10.0)) as client:
+            response = await client.post(
+                f"{settings.moderation.labeler_url}/emit-label",
+                json={
+                    "uri": uri,
+                    "val": "copyright-violation",
+                    "cid": cid,
+                },
+                headers={"X-Moderation-Key": settings.moderation.auth_token},
+            )
+            response.raise_for_status()
+
+            logfire.info(
+                "copyright label emitted",
+                uri=uri,
+                cid=cid,
+            )
+    except Exception as e:
+        logger.warning("failed to emit copyright label for %s: %s", uri, e)
 
 
 async def _store_scan_error(track_id: int, error: str) -> None:

backend/src/backend/config.py

···
         default=300,
         description="Timeout for moderation service requests",
     )
+    labeler_url: str = Field(
+        default="https://moderation.plyr.fm",
+        description="URL of the ATProto labeler service for emitting labels",
+    )
 
 
 class RateLimitSettings(AppSettingsSection):

backend/tests/test_moderation.py

···
     assert scan.matches[0]["artist"] == "Test Artist"
 
 
+async def test_store_scan_result_flagged_emits_label(
+    db_session: AsyncSession,
+    mock_moderation_response: dict,
+) -> None:
+    """test that flagged scan result emits ATProto label."""
+    # create test artist and track with ATProto URI
+    artist = Artist(
+        did="did:plc:labelertest",
+        handle="labeler.bsky.social",
+        display_name="Labeler Test User",
+    )
+    db_session.add(artist)
+    await db_session.commit()
+
+    track = Track(
+        title="Labeler Test Track",
+        file_id="labeler_test_file",
+        file_type="mp3",
+        artist_did=artist.did,
+        r2_url="https://example.com/audio.mp3",
+        atproto_record_uri="at://did:plc:labelertest/fm.plyr.track/abc123",
+        atproto_record_cid="bafyreiabc123",
+    )
+    db_session.add(track)
+    await db_session.commit()
+
+    with patch(
+        "backend._internal.moderation._emit_copyright_label",
+        new_callable=AsyncMock,
+    ) as mock_emit:
+        await _store_scan_result(track.id, mock_moderation_response)
+
+        # verify label emission was called
+        mock_emit.assert_called_once_with(
+            uri="at://did:plc:labelertest/fm.plyr.track/abc123",
+            cid="bafyreiabc123",
+        )
+
+
+async def test_store_scan_result_flagged_no_atproto_uri_skips_label(
+    db_session: AsyncSession,
+    mock_moderation_response: dict,
+) -> None:
+    """test that flagged scan without ATProto URI skips label emission."""
+    # create test artist and track without ATProto URI
+    artist = Artist(
+        did="did:plc:nouri",
+        handle="nouri.bsky.social",
+        display_name="No URI User",
+    )
+    db_session.add(artist)
+    await db_session.commit()
+
+    track = Track(
+        title="No URI Track",
+        file_id="nouri_file",
+        file_type="mp3",
+        artist_did=artist.did,
+        r2_url="https://example.com/audio.mp3",
+        # no atproto_record_uri
+    )
+    db_session.add(track)
+    await db_session.commit()
+
+    with patch(
+        "backend._internal.moderation._emit_copyright_label",
+        new_callable=AsyncMock,
+    ) as mock_emit:
+        await _store_scan_result(track.id, mock_moderation_response)
+
+        # label emission should not be called
+        mock_emit.assert_not_called()
+
+
 async def test_store_scan_result_clear(
     db_session: AsyncSession,
     mock_clear_response: dict,

docs/tools/neon.md

···
 - storage size
 
 **plyr.fm projects:**
-- `plyr` (cold-butterfly-11920742) - production (us-east-1)
+- `plyr-prd` (cold-butterfly-11920742) - production (us-east-1)
+- `plyr-stg` (frosty-math-37367092) - staging (us-west-2)
 - `plyr-dev` (muddy-flower-98795112) - development (us-east-2)
-- `plyr-staging` (frosty-math-37367092) - staging (us-west-2)
 
 ### get project details
 

moderation/Cargo.lock

···
 ]
 
 [[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
 name = "anyhow"
 version = "1.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "atoi"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f28d99ec8bfea296261ca1af174f24225171fea9664ba9003cbebee704810528"
+dependencies = [
+ "num-traits",
 ]
 
 [[package]]
···
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
+name = "autocfg"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
+[[package]]
 name = "axum"
 version = "0.7.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "async-trait",
  "axum-core",
  "axum-macros",
+ "base64",
  "bytes",
  "futures-util",
  "http",
···
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
+ "sha1",
  "sync_wrapper",
  "tokio",
+ "tokio-tungstenite",
  "tower",
  "tower-layer",
  "tower-service",
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "base-x"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cbbc9d0964165b47557570cce6c952866c2678457aca742aafc9fb771d30270"
+
+[[package]]
+name = "base16ct"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
+
+[[package]]
+name = "base256emoji"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e9430d9a245a77c92176e649af6e275f20839a48389859d1661e9a128d077c"
+dependencies = [
+ "const-str",
+ "match-lookup",
 ]
 
 [[package]]
···
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
+name = "base64ct"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55248b47b0caf0546f7988906588779981c43bb1bc9d0c44087278f80cdb44ba"
+
+[[package]]
 name = "bitflags"
 version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
 
 [[package]]
 name = "bumpalo"
···
 checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
 
 [[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
 name = "bytes"
 version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3"
 
 [[package]]
+name = "cbor4ii"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b544cf8c89359205f4f990d0e6f3828db42df85b5dac95d09157a250eb0749c4"
+dependencies = [
+ "serde",
+]
+
+[[package]]
 name = "cc"
 version = "1.2.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
+name = "chrono"
+version = "0.4.42"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "145052bdd345b87320e369255277e3fb5152762ad123a901ef5c262dd38fe8d2"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "serde",
+ "wasm-bindgen",
+ "windows-link",
+]
+
+[[package]]
+name = "cid"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3147d8272e8fa0ccd29ce51194dd98f79ddfb8191ba9e3409884e751798acf3a"
+dependencies = [
+ "core2",
+ "multibase",
+ "multihash",
+ "serde",
+ "serde_bytes",
+ "unsigned-varint",
+]
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "const-str"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f421161cb492475f1661ddc9815a745a1c894592070661180fdec3d4872e9c3"
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "core2"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b49ba7ef1ad6107f8824dbe97de947cbaac53c44e7f9756a1fba0d37c1eec505"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
+dependencies = [
+ "crc-catalog",
+]
+
+[[package]]
+name = "crc-catalog"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19d374276b40fb8bbdee95aef7c7fa6b5316ec764510eb64b8dd0e2ed0d7e7f5"
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f58bbc28f91df819d0aa2a2c00cd19754769c2fad90579b3592b1c9ba7a3115"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+
+[[package]]
+name = "crypto-bigint"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
+
+[[package]]
+name = "data-encoding-macro"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47ce6c96ea0102f01122a185683611bd5ac8d99e62bc59dd12e6bda344ee673d"
+dependencies = [
+ "data-encoding",
+ "data-encoding-macro-internal",
+]
+
+[[package]]
+name = "data-encoding-macro-internal"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d162beedaa69905488a8da94f5ac3edb4dd4788b732fadb7bd120b2625c1976"
+dependencies = [
+ "data-encoding",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
 name = "displaydoc"
 version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "dotenvy"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
+
+[[package]]
+name = "ecdsa"
+version = "0.16.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
+dependencies = [
+ "der",
+ "digest",
+ "elliptic-curve",
+ "rfc6979",
+ "signature",
+ "spki",
+]
+
+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "elliptic-curve"
+version = "0.13.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
+dependencies = [
+ "base16ct",
+ "crypto-bigint",
+ "digest",
+ "ff",
+ "generic-array",
+ "group",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "sec1",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "etcetera"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "136d1b5283a1ab77bd9257427ffd09d8667ced0570b6f938942bc7568ed5b943"
+dependencies = [
+ "cfg-if",
+ "home",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "event-listener"
+version = "5.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+dependencies = [
+ "concurrent-queue",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "ff"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
+dependencies = [
+ "rand_core 0.6.4",
+ "subtle",
 ]
 
 [[package]]
···
 checksum = "3a3076410a55c90011c298b04d0cfa770b00fa04e1e3c97d3f6c9de105a03844"
 
 [[package]]
+name = "flume"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da0e4dd2a88388a1f4ccc7c9ce104604dab68d9f408dc34cd45823d5a9069095"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "spin",
+]
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
 name = "form_urlencoded"
 version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "futures"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
 name = "futures-channel"
 version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
 dependencies = [
  "futures-core",
+ "futures-sink",
 ]
 
 [[package]]
···
 checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
 
 [[package]]
+name = "futures-executor"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-intrusive"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
+dependencies = [
+ "futures-core",
+ "lock_api",
+ "parking_lot",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
+
+[[package]]
 name = "futures-task"
 version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
 dependencies = [
+ "futures-channel",
  "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
  "futures-task",
+ "memchr",
  "pin-project-lite",
  "pin-utils",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2"
+dependencies = [
+ "typenum",
+ "version_check",
+ "zeroize",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "group"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
+dependencies = [
+ "ff",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+
+[[package]]
+name = "hashlink"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
+dependencies = [
+ "hashbrown 0.15.5",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "home"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3d1354bf6b7235cb4a0576c2619fd4ed18183f689b12b006a0ee7329eeff9a5"
+dependencies = [
+ "windows-sys 0.52.0",
+]
+
+[[package]]
 name = "http"
 version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "iana-time-zone"
+version = "0.1.64"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33e57f83510bb73707521ebaffa789ec8caf86f9657cad665b092b581d40e9fb"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
 name = "icu_collections"
 version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "indexmap"
+version = "2.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ad4bb2b565bca0645f4d68c5c9af97fba094e9791da685bf83cb5f3ce74acf2"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.16.1",
+]
+
+[[package]]
+name = "ipld-core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "104718b1cc124d92a6d01ca9c9258a7df311405debb3408c445a36452f9bf8db"
+dependencies = [
+ "cid",
+ "serde",
+ "serde_bytes",
+]
+
+[[package]]
 name = "ipnet"
 version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "k256"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b"
+dependencies = [
+ "cfg-if",
+ "ecdsa",
+ "elliptic-curve",
+ "once_cell",
+ "sha2",
+ "signature",
+]
+
+[[package]]
 name = "lazy_static"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin",
+]
 
 [[package]]
 name = "libc"
···
 checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
 
 [[package]]
+name = "libm"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9fbbcab51052fe104eb5e5d351cf728d30a5be1fe14d9be8a3b097481fb97de"
+
+[[package]]
+name = "libredox"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "416f7e718bdb06000964960ffa43b4335ad4012ae8b99060261aa4a8088d5ccb"
+dependencies = [
+ "bitflags",
+ "libc",
+ "redox_syscall",
+]
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+dependencies = [
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
 name = "litemap"
 version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6373607a59f0be73a39b6fe456b8192fcc3585f602af20751600e974dd455e77"
 
 [[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
 name = "log"
 version = "0.4.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
 
 [[package]]
+name = "match-lookup"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1265724d8cb29dbbc2b0f06fffb8bf1a8c0cf73a78eede9ba73a4a66c52a981e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
 name = "matchers"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
 
 [[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest",
+]
+
+[[package]]
 name = "memchr"
 version = "2.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 dependencies = [
  "anyhow",
  "axum",
+ "bytes",
+ "chrono",
+ "futures",
+ "hex",
+ "k256",
+ "rand 0.8.5",
  "reqwest",
  "serde",
+ "serde_bytes",
+ "serde_ipld_dagcbor",
  "serde_json",
- "thiserror 1.0.69",
+ "sqlx",
+ "thiserror 2.0.17",
  "tokio",
+ "tokio-stream",
  "tracing",
  "tracing-subscriber",
 ]
 
 [[package]]
+name = "multibase"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8694bb4835f452b0e3bb06dbebb1d6fc5385b6ca1caf2e55fd165c042390ec77"
+dependencies = [
+ "base-x",
+ "base256emoji",
+ "data-encoding",
+ "data-encoding-macro",
+]
+
+[[package]]
+name = "multihash"
+version = "0.19.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b430e7953c29dd6a09afc29ff0bb69c6e306329ee6794700aee27b76a1aea8d"
+dependencies = [
+ "core2",
+ "serde",
+ "unsigned-varint",
+]
+
+[[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
+]
+
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
+dependencies = [
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.5",
+ "smallvec",
+ "zeroize",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+ "libm",
 ]
 
 [[package]]
···
 checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
 
 [[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
+[[package]]
 name = "percent-encoding"
 version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+
+[[package]]
 name = "potential_utf"
 version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "bytes",
  "getrandom 0.3.4",
  "lru-slab",
- "rand",
+ "rand 0.9.2",
  "ring",
  "rustc-hash",
  "rustls",
···
 
 [[package]]
 name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
 version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
 dependencies = [
- "rand_chacha",
- "rand_core",
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.3",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
 ]
 
 [[package]]
···
 checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.9.3",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.16",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
 name = "regex-automata"
 version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "rfc6979"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
+dependencies = [
+ "hmac",
+ "subtle",
+]
+
+[[package]]
 name = "ring"
 version = "0.17.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "rsa"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40a0376c50d0358279d9d643e4bf7b7be212f1f4ff1da9070a7b54d22ef75c88"
+dependencies = [
+ "const-oid",
+ "digest",
+ "num-bigint-dig",
+ "num-integer",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
 name = "rustc-hash"
 version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
 [[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "sec1"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
+dependencies = [
+ "base16ct",
+ "der",
+ "generic-array",
+ "pkcs8",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
 name = "serde"
 version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "serde_bytes"
+version = "0.11.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
+[[package]]
 name = "serde_core"
 version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "serde_ipld_dagcbor"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46182f4f08349a02b45c998ba3215d3f9de826246ba02bb9dddfe9a2a2100778"
+dependencies = [
+ "cbor4ii",
+ "ipld-core",
+ "scopeguard",
+ "serde",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
 name = "sharded-slab"
 version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest",
+ "rand_core 0.6.4",
+]
+
+[[package]]
 name = "slab"
 version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+dependencies = [
+ "serde",
+]
 
 [[package]]
 name = "socket2"
···
 ]
 
 [[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "sqlx"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fefb893899429669dcdd979aff487bd78f4064e5e7907e4269081e0ef7d97dc"
+dependencies = [
+ "sqlx-core",
+ "sqlx-macros",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+]
+
+[[package]]
+name = "sqlx-core"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee6798b1838b6a0f69c007c133b8df5866302197e404e8b6ee8ed3e3a5e68dc6"
+dependencies = [
+ "base64",
+ "bytes",
+ "chrono",
+ "crc",
+ "crossbeam-queue",
+ "either",
+ "event-listener",
+ "futures-core",
+ "futures-intrusive",
+ "futures-io",
+ "futures-util",
+ "hashbrown 0.15.5",
+ "hashlink",
+ "indexmap",
+ "log",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "thiserror 2.0.17",
+ "tokio",
+ "tokio-stream",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "sqlx-macros"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2d452988ccaacfbf5e0bdbc348fb91d7c8af5bee192173ac3636b5fb6e6715d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "sqlx-core",
+ "sqlx-macros-core",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "sqlx-macros-core"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19a9c1841124ac5a61741f96e1d9e2ec77424bf323962dd894bdb93f37d5219b"
+dependencies = [
+ "dotenvy",
+ "either",
+ "heck",
+ "hex",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "sha2",
+ "sqlx-core",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+ "syn 2.0.111",
+ "tokio",
+ "url",
+]
+
+[[package]]
+name = "sqlx-mysql"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa003f0038df784eb8fecbbac13affe3da23b45194bd57dba231c8f48199c526"
+dependencies = [
+ "atoi",
+ "base64",
+ "bitflags",
+ "byteorder",
+ "bytes",
+ "chrono",
+ "crc",
+ "digest",
+ "dotenvy",
+ "either",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "generic-array",
+ "hex",
+ "hkdf",
+ "hmac",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "rand 0.8.5",
+ "rsa",
+ "serde",
+ "sha1",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror 2.0.17",
+ "tracing",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-postgres"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db58fcd5a53cf07c184b154801ff91347e4c30d17a3562a635ff028ad5deda46"
+dependencies = [
+ "atoi",
+ "base64",
+ "bitflags",
+ "byteorder",
+ "chrono",
+ "crc",
+ "dotenvy",
+ "etcetera",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "hkdf",
+ "hmac",
+ "home",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "rand 0.8.5",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror 2.0.17",
+ "tracing",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-sqlite"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2d12fe70b2c1b4401038055f90f151b78208de1f9f89a7dbfd41587a10c3eea"
+dependencies = [
+ "atoi",
+ "chrono",
+ "flume",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-intrusive",
+ "futures-util",
+ "libsqlite3-sys",
+ "log",
+ "percent-encoding",
+ "serde",
+ "serde_urlencoded",
+ "sqlx-core",
+ "thiserror 2.0.17",
+ "tracing",
+ "url",
+]
+
+[[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
+name = "stringprep"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+ "unicode-properties",
+]
+
+[[package]]
 name = "subtle"
 version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 
 [[package]]
 name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
 version = "2.0.111"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "390cc9a294ab71bdb1aa2e99d13be9c753cd2d7bd6560c77118597410c4d2e87"
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.111",
 ]
 
 [[package]]
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.111",
 ]
 
 [[package]]
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.111",
 ]
 
 [[package]]
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.111",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "tokio-stream"
+version = "0.1.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eca58d7bba4a75707817a2c44174253f9236b2d5fbd055602e9d5c07c139a047"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+ "tokio-util",
+]
+
+[[package]]
+name = "tokio-tungstenite"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edc5f74e248dc973e0dbb7b74c7e0d6fcc301c694ff50049504004ef4d0cdcd9"
+dependencies = [
+ "futures-util",
+ "log",
+ "tokio",
+ "tungstenite",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2efa149fe76073d6e8fd97ef4f4eca7b67f599660115591483572e406e165594"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
 name = "tower"
 version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.111",
 ]
 
 [[package]]
···
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
+name = "tungstenite"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18e5b8366ee7a95b16d32197d0b2604b43a0be89dc5fac9f8e96ccafbaedda8a"
+dependencies = [
+ "byteorder",
+ "bytes",
+ "data-encoding",
+ "http",
+ "httparse",
+ "log",
+ "rand 0.8.5",
+ "sha1",
+ "thiserror 1.0.69",
+ "utf-8",
+]
+
+[[package]]
+name = "typenum"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
+[[package]]
 name = "unicode-ident"
 version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
 
 [[package]]
+name = "unicode-normalization"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
+
+[[package]]
+name = "unsigned-varint"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb066959b24b5196ae73cb057f45598450d2c5f71460e98c49b738086eff9c06"
+
+[[package]]
 name = "untrusted"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "percent-encoding",
  "serde",
 ]
+
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
 
 [[package]]
 name = "utf8_iter"
···
 checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
 [[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
 name = "want"
 version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "wasite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
+
+[[package]]
 name = "wasm-bindgen"
 version = "0.2.105"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.111",
  "wasm-bindgen-shared",
 ]
 
···
 ]
 
 [[package]]
+name = "whoami"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
+dependencies = [
+ "libredox",
+ "wasite",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
+]
+
+[[package]]
 name = "windows-link"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
 [[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
+[[package]]
 name = "windows-sys"
 version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 
 [[package]]
 name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
···
 
 [[package]]
 name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
···
 
 [[package]]
 name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
···
 
 [[package]]
 name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
···
 
 [[package]]
 name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
···
 
 [[package]]
 name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
···
 
 [[package]]
 name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
···
 
 [[package]]
 name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.111",
  "synstructure",
 ]
 
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.111",
 ]
 
 [[package]]
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.111",
  "synstructure",
 ]
 
···
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.111",
 ]

moderation/Cargo.toml

···
 
 [dependencies]
 anyhow = "1.0"
-axum = { version = "0.7", features = ["macros", "json"] }
+axum = { version = "0.7", features = ["macros", "json", "ws"] }
+bytes = "1.0"
+chrono = { version = "0.4", features = ["serde"] }
+futures = "0.3"
+hex = "0.4"
+k256 = { version = "0.13", features = ["ecdsa"] }
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
 serde = { version = "1.0", features = ["derive"] }
+serde_bytes = "0.11"
+serde_ipld_dagcbor = "0.6"
 serde_json = "1.0"
-thiserror = "1.0"
-tokio = { version = "1.40", features = ["rt-multi-thread", "macros", "signal"] }
+sqlx = { version = "0.8", features = ["runtime-tokio", "postgres", "chrono", "tls-rustls"] }
+thiserror = "2.0"
+tokio = { version = "1.40", features = ["rt-multi-thread", "macros", "signal", "sync"] }
+tokio-stream = { version = "0.1", features = ["sync"] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }
+
+[dev-dependencies]
+rand = "0.8"

moderation/Dockerfile

···
-FROM rust:1.83-slim as builder
+FROM rust:1.85-slim as builder
 
 WORKDIR /app
 COPY Cargo.toml Cargo.lock* ./

moderation/src/db.rs

···
+//! Database operations for the labeler.
+
+use chrono::{DateTime, Utc};
+use sqlx::{postgres::PgPoolOptions, PgPool};
+
+use crate::labels::Label;
+
+/// Database connection pool and operations.
+#[derive(Clone)]
+pub struct LabelDb {
+    pool: PgPool,
+}
+
+/// Stored label row from the database.
+#[derive(Debug, Clone, sqlx::FromRow)]
+pub struct LabelRow {
+    pub seq: i64,
+    pub src: String,
+    pub uri: String,
+    pub cid: Option<String>,
+    pub val: String,
+    pub neg: bool,
+    pub cts: DateTime<Utc>,
+    pub exp: Option<DateTime<Utc>>,
+    pub sig: Vec<u8>,
+}
+
+impl LabelDb {
+    /// Connect to the database.
+    pub async fn connect(database_url: &str) -> Result<Self, sqlx::Error> {
+        let pool = PgPoolOptions::new()
+            .max_connections(5)
+            .connect(database_url)
+            .await?;
+        Ok(Self { pool })
+    }
+
+    /// Run database migrations.
+    pub async fn migrate(&self) -> Result<(), sqlx::Error> {
+        sqlx::query(
+            r#"
+            CREATE TABLE IF NOT EXISTS labels (
+                id BIGSERIAL PRIMARY KEY,
+                seq BIGSERIAL UNIQUE NOT NULL,
+                src TEXT NOT NULL,
+                uri TEXT NOT NULL,
+                cid TEXT,
+                val TEXT NOT NULL,
+                neg BOOLEAN NOT NULL DEFAULT FALSE,
+                cts TIMESTAMPTZ NOT NULL,
+                exp TIMESTAMPTZ,
+                sig BYTEA NOT NULL,
+                created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+            )
+            "#,
+        )
+        .execute(&self.pool)
+        .await?;
+
+        sqlx::query("CREATE INDEX IF NOT EXISTS idx_labels_uri ON labels(uri)")
+            .execute(&self.pool)
+            .await?;
+        sqlx::query("CREATE INDEX IF NOT EXISTS idx_labels_src ON labels(src)")
+            .execute(&self.pool)
+            .await?;
+        sqlx::query("CREATE INDEX IF NOT EXISTS idx_labels_seq ON labels(seq)")
+            .execute(&self.pool)
+            .await?;
+        sqlx::query("CREATE INDEX IF NOT EXISTS idx_labels_val ON labels(val)")
+            .execute(&self.pool)
+            .await?;
+
+        Ok(())
+    }
+
+    /// Store a signed label and return its sequence number.
+    pub async fn store_label(&self, label: &Label) -> Result<i64, sqlx::Error> {
+        let sig = label.sig.as_ref().map(|b| b.to_vec()).unwrap_or_default();
+        let cts: DateTime<Utc> = label
+            .cts
+            .parse()
+            .unwrap_or_else(|_| Utc::now());
+        let exp: Option<DateTime<Utc>> = label.exp.as_ref().and_then(|e| e.parse().ok());
+
+        let row = sqlx::query_scalar::<_, i64>(
+            r#"
+            INSERT INTO labels (src, uri, cid, val, neg, cts, exp, sig)
+            VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+            RETURNING seq
+            "#,
+        )
+        .bind(&label.src)
+        .bind(&label.uri)
+        .bind(&label.cid)
+        .bind(&label.val)
+        .bind(label.neg.unwrap_or(false))
+        .bind(cts)
+        .bind(exp)
+        .bind(sig)
+        .fetch_one(&self.pool)
+        .await?;
+
+        Ok(row)
+    }
+
+    /// Query labels matching URI patterns.
+    ///
+    /// Patterns can contain `*` as a wildcard (e.g., `at://did:plc:*`).
+    pub async fn query_labels(
+        &self,
+        uri_patterns: &[String],
+        sources: Option<&[String]>,
+        cursor: Option<&str>,
+        limit: i64,
+    ) -> Result<(Vec<LabelRow>, Option<String>), sqlx::Error> {
+        // Build dynamic query
+        let mut conditions = Vec::new();
+        let mut param_idx = 1;
+
+        // URI pattern matching
+        let uri_conditions: Vec<String> = uri_patterns
+            .iter()
+            .map(|p| {
+                let idx = param_idx;
+                param_idx += 1;
+                if p.contains('*') {
+                    format!("uri LIKE ${}", idx)
+                } else {
+                    format!("uri = ${}", idx)
+                }
+            })
+            .collect();
+
+        if !uri_conditions.is_empty() {
+            conditions.push(format!("({})", uri_conditions.join(" OR ")));
+        }
+
+        // Source filtering
+        if let Some(srcs) = sources {
+            if !srcs.is_empty() {
+                let placeholders: Vec<String> = srcs
+                    .iter()
+                    .map(|_| {
+                        let idx = param_idx;
+                        param_idx += 1;
+                        format!("${}", idx)
+                    })
+                    .collect();
+                conditions.push(format!("src IN ({})", placeholders.join(", ")));
+            }
+        }
+
+        // Cursor for pagination
+        if cursor.is_some() {
+            conditions.push(format!("seq > ${}", param_idx));
+        }
+
+        let where_clause = if conditions.is_empty() {
+            String::new()
+        } else {
+            format!("WHERE {}", conditions.join(" AND "))
+        };
+
+        let query = format!(
+            r#"
+            SELECT seq, src, uri, cid, val, neg, cts, exp, sig
+            FROM labels
+            {}
+            ORDER BY seq ASC
+            LIMIT {}
+            "#,
+            where_clause,
+            limit + 1 // Fetch one extra to determine if there's more
+        );
+
+        // Build query with parameters
+        let mut q = sqlx::query_as::<_, LabelRow>(&query);
+
+        // Bind URI patterns (converting * to %)
+        for pattern in uri_patterns {
+            let sql_pattern = pattern.replace('*', "%");
+            q = q.bind(sql_pattern);
+        }
+
+        // Bind sources
+        if let Some(srcs) = sources {
+            for src in srcs {
+                q = q.bind(src);
+            }
+        }
+
+        // Bind cursor
+        if let Some(c) = cursor {
+            let cursor_seq: i64 = c.parse().unwrap_or(0);
+            q = q.bind(cursor_seq);
+        }
+
+        let mut rows: Vec<LabelRow> = q.fetch_all(&self.pool).await?;
+
+        // Determine next cursor
+        let next_cursor = if rows.len() > limit as usize {
+            rows.pop(); // Remove the extra row
+            rows.last().map(|r| r.seq.to_string())
+        } else {
+            None
+        };
+
+        Ok((rows, next_cursor))
+    }
+
+    /// Get labels since a sequence number (for subscribeLabels).
+    pub async fn get_labels_since(&self, cursor: i64, limit: i64) -> Result<Vec<LabelRow>, sqlx::Error> {
+        sqlx::query_as::<_, LabelRow>(
+            r#"
+            SELECT seq, src, uri, cid, val, neg, cts, exp, sig
+            FROM labels
+            WHERE seq > $1
+            ORDER BY seq ASC
+            LIMIT $2
+            "#,
+        )
+        .bind(cursor)
+        .bind(limit)
+        .fetch_all(&self.pool)
+        .await
+    }
+
+    /// Get the latest sequence number.
+    pub async fn get_latest_seq(&self) -> Result<i64, sqlx::Error> {
+        sqlx::query_scalar::<_, Option<i64>>("SELECT MAX(seq) FROM labels")
+            .fetch_one(&self.pool)
+            .await
+            .map(|s| s.unwrap_or(0))
+    }
+}
+
+impl LabelRow {
+    /// Convert database row to Label struct.
+    pub fn to_label(&self) -> Label {
+        Label {
+            ver: Some(1),
+            src: self.src.clone(),
+            uri: self.uri.clone(),
+            cid: self.cid.clone(),
+            val: self.val.clone(),
+            neg: if self.neg { Some(true) } else { None },
+            cts: self.cts.format("%Y-%m-%dT%H:%M:%S%.3fZ").to_string(),
+            exp: self.exp.map(|e| e.format("%Y-%m-%dT%H:%M:%S%.3fZ").to_string()),
+            sig: Some(bytes::Bytes::from(self.sig.clone())),
+        }
+    }
+}

moderation/src/labels.rs

···
+//! ATProto label types and signing.
+//!
+//! Labels are signed metadata tags that can be applied to ATProto resources.
+//! This module implements the com.atproto.label.defs#label schema.
+
+use bytes::Bytes;
+use chrono::Utc;
+use k256::ecdsa::{signature::Signer, Signature, SigningKey};
+use serde::{Deserialize, Serialize};
+
+/// ATProto label as defined in com.atproto.label.defs#label.
+///
+/// Labels are signed by the labeler's `#atproto_label` key.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Label {
+    /// Version of the label format (currently 1).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub ver: Option<i64>,
+
+    /// DID of the labeler that created this label.
+    pub src: String,
+
+    /// AT URI of the resource this label applies to.
+    pub uri: String,
+
+    /// CID of the specific version (optional).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cid: Option<String>,
+
+    /// The label value (e.g., "copyright-violation").
+    pub val: String,
+
+    /// If true, this negates a previous label.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub neg: Option<bool>,
+
+    /// Timestamp when label was created (ISO 8601).
+    pub cts: String,
+
+    /// Expiration timestamp (optional).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub exp: Option<String>,
+
+    /// DAG-CBOR signature of the label.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[serde(with = "serde_bytes_opt")]
+    pub sig: Option<Bytes>,
+}
+
+mod serde_bytes_opt {
+    use bytes::Bytes;
+    use serde::{Deserialize, Deserializer, Serialize, Serializer};
+
+    pub fn serialize<S>(value: &Option<Bytes>, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        match value {
+            Some(bytes) => serde_bytes::Bytes::new(bytes.as_ref()).serialize(serializer),
+            None => serializer.serialize_none(),
+        }
+    }
+
+    pub fn deserialize<'de, D>(deserializer: D) -> Result<Option<Bytes>, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        let opt: Option<serde_bytes::ByteBuf> = Option::deserialize(deserializer)?;
+        Ok(opt.map(|b| Bytes::from(b.into_vec())))
+    }
+}
+
+impl Label {
+    /// Create a new unsigned label.
+    pub fn new(src: impl Into<String>, uri: impl Into<String>, val: impl Into<String>) -> Self {
+        Self {
+            ver: Some(1),
+            src: src.into(),
+            uri: uri.into(),
+            cid: None,
+            val: val.into(),
+            neg: None,
+            cts: Utc::now().format("%Y-%m-%dT%H:%M:%S%.3fZ").to_string(),
+            exp: None,
+            sig: None,
+        }
+    }
+
+    /// Set the CID for a specific version of the resource.
+    pub fn with_cid(mut self, cid: impl Into<String>) -> Self {
+        self.cid = Some(cid.into());
+        self
+    }
+
+    /// Set this as a negation label.
+    pub fn negated(mut self) -> Self {
+        self.neg = Some(true);
+        self
+    }
+
+    /// Sign this label with a secp256k1 key.
+    ///
+    /// The signing process:
+    /// 1. Serialize the label without the `sig` field to DAG-CBOR
+    /// 2. Sign the bytes with the secp256k1 key
+    /// 3. Attach the signature
+    pub fn sign(mut self, signing_key: &SigningKey) -> Result<Self, LabelError> {
+        // Create unsigned version for signing
+        let unsigned = UnsignedLabel {
+            ver: self.ver,
+            src: &self.src,
+            uri: &self.uri,
+            cid: self.cid.as_deref(),
+            val: &self.val,
+            neg: self.neg,
+            cts: &self.cts,
+            exp: self.exp.as_deref(),
+        };
+
+        // Encode to DAG-CBOR
+        let cbor_bytes =
+            serde_ipld_dagcbor::to_vec(&unsigned).map_err(|e| LabelError::Serialization(e))?;
+
+        // Sign with secp256k1
+        let signature: Signature = signing_key.sign(&cbor_bytes);
+        self.sig = Some(Bytes::copy_from_slice(&signature.to_bytes()));
+
+        Ok(self)
+    }
+}
+
+/// Unsigned label for serialization during signing.
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct UnsignedLabel<'a> {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    ver: Option<i64>,
+    src: &'a str,
+    uri: &'a str,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    cid: Option<&'a str>,
+    val: &'a str,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    neg: Option<bool>,
+    cts: &'a str,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    exp: Option<&'a str>,
+}
+
+/// Label-related errors.
+#[derive(Debug, thiserror::Error)]
+pub enum LabelError {
+    #[error("failed to serialize label: {0}")]
+    Serialization(#[from] serde_ipld_dagcbor::EncodeError<std::collections::TryReserveError>),
+
+    #[error("invalid signing key: {0}")]
+    InvalidKey(String),
+
+    #[error("database error: {0}")]
+    Database(#[from] sqlx::Error),
+}
+
+/// Label signer that holds the signing key and labeler DID.
+#[derive(Clone)]
+pub struct LabelSigner {
+    signing_key: SigningKey,
+    labeler_did: String,
+}
+
+impl LabelSigner {
+    /// Create a new label signer from a hex-encoded private key.
+    pub fn from_hex(hex_key: &str, labeler_did: impl Into<String>) -> Result<Self, LabelError> {
+        let key_bytes = hex::decode(hex_key)
+            .map_err(|e| LabelError::InvalidKey(format!("invalid hex: {e}")))?;
+        let signing_key = SigningKey::from_slice(&key_bytes)
+            .map_err(|e| LabelError::InvalidKey(format!("invalid key: {e}")))?;
+        Ok(Self {
+            signing_key,
+            labeler_did: labeler_did.into(),
+        })
+    }
+
+    /// Get the labeler DID.
+    pub fn did(&self) -> &str {
+        &self.labeler_did
+    }
+
+    /// Sign an arbitrary label.
+    pub fn sign_label(&self, label: Label) -> Result<Label, LabelError> {
+        label.sign(&self.signing_key)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_label_creation() {
+        let label = Label::new(
+            "did:plc:test",
+            "at://did:plc:user/fm.plyr.track/abc123",
+            "copyright-violation",
+        );
+
+        assert_eq!(label.src, "did:plc:test");
+        assert_eq!(label.val, "copyright-violation");
+        assert!(label.sig.is_none());
+    }
+
+    #[test]
+    fn test_label_signing() {
+        // Generate a test key
+        let signing_key = SigningKey::random(&mut rand::thread_rng());
+
+        let label = Label::new(
+            "did:plc:test",
+            "at://did:plc:user/fm.plyr.track/abc123",
+            "copyright-violation",
+        )
+        .sign(&signing_key)
+        .unwrap();
+
+        assert!(label.sig.is_some());
+        assert_eq!(label.sig.as_ref().unwrap().len(), 64); // secp256k1 signature is 64 bytes
+    }
+}

moderation/src/main.rs

···
-use std::{env, net::SocketAddr};
+//! plyr.fm moderation service
+//!
+//! Provides:
+//! - AuDD audio fingerprinting for copyright detection
+//! - ATProto labeler endpoints (queryLabels, subscribeLabels)
+//! - Label emission for copyright violations
+
+use std::{env, net::SocketAddr, sync::Arc};
 
 use anyhow::anyhow;
 use axum::{
-    extract::Request,
+    extract::{
+        ws::{Message, WebSocket, WebSocketUpgrade},
+        Query, Request, State,
+    },
     http::StatusCode,
     middleware::{self, Next},
     response::{IntoResponse, Response},
     routing::{get, post},
     Json, Router,
 };
+use futures::StreamExt;
 use serde::{Deserialize, Serialize};
-use tokio::net::TcpListener;
+use tokio::{net::TcpListener, sync::broadcast};
+use tokio_stream::wrappers::BroadcastStream;
 use tracing::{error, info, warn};
 
+mod db;
+mod labels;
+
+use db::LabelDb;
+use labels::{Label, LabelSigner};
+
 // --- config ---
 
 struct Config {
···
     auth_token: Option<String>,
     audd_api_token: String,
     audd_api_url: String,
+    database_url: Option<String>,
+    labeler_did: Option<String>,
+    labeler_signing_key: Option<String>,
 }
 
 impl Config {
     fn from_env() -> anyhow::Result<Self> {
         Ok(Self {
-            host: env::var("MODERATION_HOST").unwrap_or_else(|_| "127.0.0.1".to_string()),
+            host: env::var("MODERATION_HOST").unwrap_or_else(|_| "0.0.0.0".to_string()),
             port: env::var("MODERATION_PORT")
                 .ok()
                 .and_then(|v| v.parse().ok())
···
                 .map_err(|_| anyhow!("MODERATION_AUDD_API_TOKEN is required"))?,
             audd_api_url: env::var("MODERATION_AUDD_API_URL")
                 .unwrap_or_else(|_| "https://enterprise.audd.io/".to_string()),
+            database_url: env::var("MODERATION_DATABASE_URL").ok(),
+            labeler_did: env::var("MODERATION_LABELER_DID").ok(),
+            labeler_signing_key: env::var("MODERATION_LABELER_SIGNING_KEY").ok(),
         })
+    }
+
+    fn labeler_enabled(&self) -> bool {
+        self.database_url.is_some()
+            && self.labeler_did.is_some()
+            && self.labeler_signing_key.is_some()
     }
 }
 
···
 #[derive(Debug, Serialize)]
 struct HealthResponse {
     status: &'static str,
+    labeler_enabled: bool,
+}
+
+// --- emit label request ---
+
+#[derive(Debug, Deserialize)]
+struct EmitLabelRequest {
+    /// AT URI of the resource to label (e.g., at://did:plc:xxx/fm.plyr.track/abc123)
+    uri: String,
+    /// Label value (e.g., "copyright-violation")
+    #[serde(default = "default_label_val")]
+    val: String,
+    /// Optional CID of specific version
+    cid: Option<String>,
+    /// If true, negate an existing label
+    #[serde(default)]
+    neg: bool,
+}
+
+fn default_label_val() -> String {
+    "copyright-violation".to_string()
+}
+
+#[derive(Debug, Serialize)]
+struct EmitLabelResponse {
+    seq: i64,
+    label: Label,
+}
+
+// --- xrpc types ---
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct QueryLabelsParams {
+    uri_patterns: String, // comma-separated
+    sources: Option<String>,
+    cursor: Option<String>,
+    limit: Option<i64>,
+}
+
+#[derive(Debug, Serialize)]
+struct QueryLabelsResponse {
+    cursor: Option<String>,
+    labels: Vec<Label>,
+}
+
+#[derive(Debug, Deserialize)]
+struct SubscribeLabelsParams {
+    cursor: Option<i64>,
 }
 
 // --- audd api types ---
···
 
 #[derive(Debug, Deserialize)]
 struct AuddGroup {
-    offset: Option<serde_json::Value>, // can be i64 (ms) or string like "00:00"
+    offset: Option<serde_json::Value>,
     songs: Option<Vec<AuddSong>>,
 }
 
 #[derive(Debug, Deserialize)]
-#[allow(dead_code)] // fields needed for deserialization
+#[allow(dead_code)]
 struct AuddSong {
     artist: Option<String>,
     title: Option<String>,
···
     let config = Config::from_env()?;
     let auth_token = config.auth_token.clone();
 
+    // Initialize labeler components if configured
+    let (db, signer, label_tx) = if config.labeler_enabled() {
+        let db = LabelDb::connect(config.database_url.as_ref().unwrap()).await?;
+        db.migrate().await?;
+        info!("labeler database connected and migrated");
+
+        let signer = LabelSigner::from_hex(
+            config.labeler_signing_key.as_ref().unwrap(),
+            config.labeler_did.as_ref().unwrap(),
+        )?;
+        info!(did = %signer.did(), "labeler signer initialized");
+
+        let (tx, _) = broadcast::channel::<(i64, Label)>(1024);
+        (Some(db), Some(signer), Some(tx))
+    } else {
+        warn!("labeler not configured - XRPC endpoints will return 503");
+        (None, None, None)
+    };
+
+    let state = AppState {
+        audd_api_token: config.audd_api_token,
+        audd_api_url: config.audd_api_url,
+        db: db.map(Arc::new),
+        signer: signer.map(Arc::new),
+        label_tx,
+    };
+
     let app = Router::new()
+        // Landing page
+        .route("/", get(landing))
+        // Health check
         .route("/health", get(health))
+        // AuDD scanning (existing)
         .route("/scan", post(scan))
+        // Label emission (internal API)
+        .route("/emit-label", post(emit_label))
+        // ATProto XRPC endpoints (public)
+        .route("/xrpc/com.atproto.label.queryLabels", get(query_labels))
+        .route(
+            "/xrpc/com.atproto.label.subscribeLabels",
+            get(subscribe_labels),
+        )
         .layer(middleware::from_fn(move |req, next| {
             auth_middleware(req, next, auth_token.clone())
         }))
-        .with_state(AppState {
-            audd_api_token: config.audd_api_token,
-            audd_api_url: config.audd_api_url,
-        });
+        .with_state(state);
 
     let addr: SocketAddr = format!("{}:{}", config.host, config.port)
         .parse()
···
 struct AppState {
     audd_api_token: String,
     audd_api_url: String,
+    db: Option<Arc<LabelDb>>,
+    signer: Option<Arc<LabelSigner>>,
+    label_tx: Option<broadcast::Sender<(i64, Label)>>,
 }
 
 // --- middleware ---
···
     next: Next,
     auth_token: Option<String>,
 ) -> Result<Response, StatusCode> {
-    if req.uri().path() == "/health" {
+    let path = req.uri().path();
+
+    // Public endpoints - no auth required
+    if path == "/"
+        || path == "/health"
+        || path.starts_with("/xrpc/com.atproto.label.")
+    {
         return Ok(next.run(req).await);
     }
 
···
 
 // --- handlers ---
 
-async fn health() -> Json<HealthResponse> {
-    Json(HealthResponse { status: "ok" })
+async fn health(State(state): State<AppState>) -> Json<HealthResponse> {
+    Json(HealthResponse {
+        status: "ok",
+        labeler_enabled: state.db.is_some(),
+    })
+}
+
+async fn landing(State(state): State<AppState>) -> axum::response::Html<String> {
+    let labeler_did = state
+        .signer
+        .as_ref()
+        .map(|s| s.did().to_string())
+        .unwrap_or_else(|| "not configured".to_string());
+
+    axum::response::Html(format!(
+        r#"<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>plyr.fm moderation</title>
+    <style>
+        body {{
+            font-family: system-ui, -apple-system, sans-serif;
+            background: #0a0a0a;
+            color: #e5e5e5;
+            max-width: 600px;
+            margin: 80px auto;
+            padding: 20px;
+            line-height: 1.6;
+        }}
+        h1 {{ color: #fff; margin-bottom: 8px; }}
+        .subtitle {{ color: #888; margin-bottom: 32px; }}
+        a {{ color: #3b82f6; }}
+        code {{
+            background: #1a1a1a;
+            padding: 2px 6px;
+            border-radius: 4px;
+            font-size: 0.9em;
+        }}
+        .endpoint {{
+            background: #111;
+            border: 1px solid #222;
+            border-radius: 8px;
+            padding: 16px;
+            margin: 12px 0;
+        }}
+        .endpoint-name {{ color: #10b981; font-family: monospace; }}
+    </style>
+</head>
+<body>
+    <h1>plyr.fm moderation</h1>
+    <p class="subtitle">ATProto labeler for audio content moderation</p>
+
+    <p>This service provides content labels for <a href="https://plyr.fm">plyr.fm</a>,
+    the music streaming platform on ATProto.</p>
+
+    <p><strong>Labeler DID:</strong> <code>{}</code></p>
+
+    <h2>Endpoints</h2>
+
+    <div class="endpoint">
+        <div class="endpoint-name">GET /xrpc/com.atproto.label.queryLabels</div>
+        <p>Query labels by URI pattern</p>
+    </div>
+
+    <div class="endpoint">
+        <div class="endpoint-name">GET /xrpc/com.atproto.label.subscribeLabels</div>
+        <p>WebSocket subscription for real-time label updates</p>
+    </div>
+
+    <p style="margin-top: 32px; color: #666;">
+        <a href="https://bsky.app/profile/moderation.plyr.fm">@moderation.plyr.fm</a>
+    </p>
+</body>
+</html>"#,
+        labeler_did
+    ))
 }
 
 async fn scan(
-    axum::extract::State(state): axum::extract::State<AppState>,
+    State(state): State<AppState>,
     Json(request): Json<ScanRequest>,
 ) -> Result<Json<ScanResponse>, AppError> {
     info!(audio_url = %request.audio_url, "scanning audio");
···
 
     let matches = extract_matches(&audd_response);
     let highest_score = matches.iter().map(|m| m.score).max().unwrap_or(0);
-    // flag if any matches are found - audd enterprise doesn't return confidence scores
     let is_flagged = !matches.is_empty();
 
     info!(
···
     }))
 }
 
+async fn emit_label(
+    State(state): State<AppState>,
+    Json(request): Json<EmitLabelRequest>,
+) -> Result<Json<EmitLabelResponse>, AppError> {
+    let db = state.db.as_ref().ok_or(AppError::LabelerNotConfigured)?;
+    let signer = state.signer.as_ref().ok_or(AppError::LabelerNotConfigured)?;
+
+    info!(uri = %request.uri, val = %request.val, neg = request.neg, "emitting label");
+
+    // Create and sign the label
+    let mut label = Label::new(signer.did(), &request.uri, &request.val);
+    if let Some(cid) = request.cid {
+        label = label.with_cid(cid);
+    }
+    if request.neg {
+        label = label.negated();
+    }
+    let label = signer.sign_label(label)?;
+
+    // Store in database
+    let seq = db.store_label(&label).await?;
+    info!(seq, uri = %request.uri, "label stored");
+
+    // Broadcast to subscribers
+    if let Some(tx) = &state.label_tx {
+        let _ = tx.send((seq, label.clone()));
+    }
+
+    Ok(Json(EmitLabelResponse { seq, label }))
+}
+
+async fn query_labels(
+    State(state): State<AppState>,
+    Query(params): Query<QueryLabelsParams>,
+) -> Result<Json<QueryLabelsResponse>, AppError> {
+    let db = state.db.as_ref().ok_or(AppError::LabelerNotConfigured)?;
+
+    let uri_patterns: Vec<String> = params
+        .uri_patterns
+        .split(',')
+        .map(|s| s.trim().to_string())
+        .collect();
+    let sources: Option<Vec<String>> = params
+        .sources
+        .map(|s| s.split(',').map(|s| s.trim().to_string()).collect());
+    let limit = params.limit.unwrap_or(50).min(250).max(1);
+
+    let (rows, cursor) = db
+        .query_labels(
+            &uri_patterns,
+            sources.as_deref(),
+            params.cursor.as_deref(),
+            limit,
+        )
+        .await?;
+
+    let labels: Vec<Label> = rows.iter().map(|r| r.to_label()).collect();
+
+    Ok(Json(QueryLabelsResponse { cursor, labels }))
+}
+
+async fn subscribe_labels(
+    State(state): State<AppState>,
+    Query(params): Query<SubscribeLabelsParams>,
+    ws: WebSocketUpgrade,
+) -> Result<Response, AppError> {
+    let db = state.db.clone().ok_or(AppError::LabelerNotConfigured)?;
+    let label_tx = state.label_tx.clone().ok_or(AppError::LabelerNotConfigured)?;
+
+    Ok(ws.on_upgrade(move |socket| handle_subscribe(socket, db, label_tx, params.cursor)))
+}
+
+async fn handle_subscribe(
+    mut socket: WebSocket,
+    db: Arc<LabelDb>,
+    label_tx: broadcast::Sender<(i64, Label)>,
+    cursor: Option<i64>,
+) {
+    // If cursor provided, backfill from that point
+    let start_seq = if let Some(c) = cursor {
+        // Send historical labels first
+        match db.get_labels_since(c, 1000).await {
+            Ok(rows) => {
+                for row in &rows {
+                    let msg = SubscribeLabelsMessage {
+                        seq: row.seq,
+                        labels: vec![row.to_label()],
+                    };
+                    if let Ok(json) = serde_json::to_string(&msg) {
+                        if socket.send(Message::Text(json.into())).await.is_err() {
+                            return;
+                        }
+                    }
+                }
+                rows.last().map(|r| r.seq).unwrap_or(c)
+            }
+            Err(e) => {
+                error!(error = %e, "failed to backfill labels");
+                return;
+            }
+        }
+    } else {
+        // Start from current position
+        db.get_latest_seq().await.unwrap_or(0)
+    };
+
+    // Subscribe to live updates
+    let rx = label_tx.subscribe();
+    let mut stream = BroadcastStream::new(rx);
+
+    let mut last_seq = start_seq;
+
+    loop {
+        tokio::select! {
+            // Receive from broadcast
+            Some(result) = stream.next() => {
+                match result {
+                    Ok((seq, label)) => {
+                        if seq > last_seq {
+                            let msg = SubscribeLabelsMessage {
+                                seq,
+                                labels: vec![label],
+                            };
+                            if let Ok(json) = serde_json::to_string(&msg) {
+                                if socket.send(Message::Text(json.into())).await.is_err() {
+                                    break;
+                                }
+                            }
+                            last_seq = seq;
+                        }
+                    }
+                    Err(_) => continue, // Lagged, skip
+                }
+            }
+            // Check for client disconnect
+            msg = socket.recv() => {
+                match msg {
+                    Some(Ok(Message::Close(_))) | None => break,
+                    Some(Ok(Message::Ping(data))) => {
+                        if socket.send(Message::Pong(data)).await.is_err() {
+                            break;
+                        }
+                    }
+                    _ => {}
+                }
+            }
+        }
+    }
+}
+
+#[derive(Serialize)]
+struct SubscribeLabelsMessage {
+    seq: i64,
+    labels: Vec<Label>,
+}
+
 fn extract_matches(response: &AuddResponse) -> Vec<AuddMatch> {
     let Some(result) = &response.result else {
         return vec![];
···
 }
 
 fn parse_song(song: &AuddSong, offset: Option<&serde_json::Value>) -> AuddMatch {
-    // convert offset to ms - can be i64 or string like "00:00" or "01:24"
     let offset_ms = offset.and_then(|v| match v {
         serde_json::Value::Number(n) => n.as_i64(),
         serde_json::Value::String(s) => parse_timecode_to_ms(s),
···
 }
 
 fn parse_timecode_to_ms(timecode: &str) -> Option<i64> {
-    // parse "MM:SS" or "HH:MM:SS" to milliseconds
     let parts: Vec<&str> = timecode.split(':').collect();
     match parts.len() {
         2 => {
···
 enum AppError {
     #[error("audd error: {0}")]
     Audd(String),
+
+    #[error("labeler not configured")]
+    LabelerNotConfigured,
+
+    #[error("label error: {0}")]
+    Label(#[from] labels::LabelError),
+
+    #[error("database error: {0}")]
+    Database(#[from] sqlx::Error),
 }
 
 impl IntoResponse for AppError {
     fn into_response(self) -> Response {
         error!(error = %self, "request failed");
-        let status = match self {
-            AppError::Audd(_) => StatusCode::BAD_GATEWAY,
+        let (status, error_type) = match &self {
+            AppError::Audd(_) => (StatusCode::BAD_GATEWAY, "AuddError"),
+            AppError::LabelerNotConfigured => (StatusCode::SERVICE_UNAVAILABLE, "LabelerNotConfigured"),
+            AppError::Label(_) => (StatusCode::INTERNAL_SERVER_ERROR, "LabelError"),
+            AppError::Database(_) => (StatusCode::INTERNAL_SERVER_ERROR, "DatabaseError"),
         };
-        let body = serde_json::json!({ "error": self.to_string() });
+        let body = serde_json::json!({
+            "error": error_type,
+            "message": self.to_string()
+        });
         (status, Json(body)).into_response()
     }
 }