diff --git a/.githooks/pre-push b/.githooks/pre-push
new file mode 100644
index 0000000..1860f3a
--- /dev/null
+++ b/.githooks/pre-push
@@ -0,0 +1,21 @@
+#!/bin/sh
+# Blocks a push that would publish a credential.
+#
+# This runs here rather than in CI on purpose. A secret-scanning job on GitHub Actions only fires
+# after the objects are already on GitHub, where they stay reachable through the API even if the
+# branch is deleted, so a red build reports the leak instead of preventing it. CI runs the checks
+# that are still useful once the code is public: the dependency audit, the type check, the tests.
+#
+# Enable in a fresh clone with:   git config core.hooksPath .githooks
+# Bypass deliberately with:       git push --no-verify
+set -e
+
+root=$(git rev-parse --show-toplevel)
+
+if ! command -v node >/dev/null 2>&1; then
+  echo "pre-push: node is not on PATH, so the secret scan cannot run." >&2
+  echo "pre-push: install Node or push with --no-verify if you have checked the diff yourself." >&2
+  exit 1
+fi
+
+node "$root/backend/scripts/secret-scan.mjs"
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index 8a0dc48..364c8a1 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -32,8 +32,8 @@ body:
     attributes:
       label: SS2 Revive version
       description: >-
-        The first SS2 Revive line in the log says it: `SS2 Revive 0.2.0 starting.`
-      placeholder: "0.2.0"
+        The first SS2 Revive line in the log says it: `SS2 Revive 1.2.0 starting.`
+      placeholder: "1.2.0"
     validations:
       required: true
 
@@ -42,10 +42,10 @@ body:
     attributes:
       label: Game build
       description: >-
-        The line straight after that one, at the end: `Unity ... | product ... | version '1.3.1.276'`.
-        Anything other than 1.3.1.276 is untested, which is worth knowing rather than a reason not
-        to report.
-      placeholder: "1.3.1.276"
+        The line straight after that one, at the end: `Unity ... | product ... | version '1.3.7.3054'`.
+        SS2 Revive supports build 1.3.7.3054. Version 1.5.x removed the networking code the mod
+        restores and cannot work.
+      placeholder: "1.3.7.3054"
     validations:
       required: true
 
@@ -65,7 +65,7 @@ body:
       placeholder: |
         1. Launched the game
         2. Opened the party menu
-        3. Invited a friend with F10
+        3. Invited a friend through Steam
         4. ...
     validations:
       required: true
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..b213c9f
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,136 @@
+name: CI
+
+# What this deliberately does not do is scan for committed secrets. That check has to happen before
+# the objects reach GitHub, or it is only a notification that the leak already shipped, so it lives
+# in .githooks/pre-push instead. Everything here is a check that is still worth running on code that
+# is already public.
+
+on:
+  push:
+    branches: ["**"]
+    # Tagged pushes are the release build's job; running both would duplicate the work.
+    tags-ignore: ["v*.*.*"]
+  pull_request:
+  # Advisories are published against dependencies that have not changed, so the audit needs a clock
+  # of its own rather than waiting for the next commit.
+  schedule:
+    - cron: "23 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  WRANGLER_SEND_METRICS: "false"
+
+jobs:
+  worker:
+    name: Worker types and tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: backend
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          # There is no package.json at the repository root, so the version has to be pointed at the
+          # backend workspace explicitly instead of being discovered.
+          package_json_file: backend/package.json
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: backend/pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Check generated bindings and types
+        # Regenerates worker-configuration.d.ts from wrangler.jsonc and fails if the committed copy
+        # has drifted, then type-checks against it. A binding added to the config but never wired up
+        # is caught here rather than at deploy time.
+        run: pnpm run check
+
+      - name: Run Worker tests
+        # Real Miniflare D1 and R2, including the migrations, so a migration that does not apply
+        # cleanly fails here instead of against production.
+        run: pnpm test
+
+      - name: Build Worker bundle
+        # A dry-run deploy. Proves the Worker still bundles without needing any Cloudflare
+        # credentials in CI.
+        run: pnpm run build
+
+  audit:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    defaults:
+      run:
+        working-directory: backend
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          package_json_file: backend/package.json
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: backend/pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Audit dependencies
+        # Kept in its own job so a newly published advisory reports as an advisory, rather than
+        # turning up as a mystery failure in the middle of the test job.
+        run: pnpm run security:audit
+
+  data:
+    name: SS2Revive_Data tests
+    runs-on: windows-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Set up .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: 8.0.x
+
+      - name: Run data tests
+        # SS2Revive_Data references no game assembly, and the runner reports SKIP for the checks
+        # that need an installed copy of the game, so this is meaningful on a bare runner. The
+        # plugin itself is not built here: SS2Revive.csproj compiles against the game's Managed
+        # directory, which no hosted runner has.
+        shell: pwsh
+        run: |
+          dotnet run --project tests/DataTests/DataTests.csproj --configuration Release
+          if ($LASTEXITCODE -ne 0) { throw 'Data tests failed.' }
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..4d14528
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,144 @@
+name: Build draft release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: write
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  setup:
+    name: Build Windows setup
+    runs-on: windows-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out tagged source
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: 8.0.x
+
+      - name: Validate tag and project version
+        id: metadata
+        shell: pwsh
+        env:
+          RELEASE_TAG_INPUT: ${{ github.ref_name }}
+        run: |
+          $tag = $env:RELEASE_TAG_INPUT
+          if ($tag -notmatch '^v(?<version>\d+\.\d+\.\d+)$') {
+            throw "Release tags must use the exact vMAJOR.MINOR.PATCH form. Received: $tag"
+          }
+
+          [xml]$props = Get-Content -LiteralPath 'Directory.Build.props'
+          $projectVersion = [string]$props.Project.PropertyGroup.SS2ReviveVersion
+          $version = $Matches.version
+          if ($projectVersion -ne $version) {
+            throw "Tag $tag does not match SS2ReviveVersion $projectVersion."
+          }
+
+          "tag=$tag" >> $env:GITHUB_OUTPUT
+          "version=$version" >> $env:GITHUB_OUTPUT
+
+      - name: Publish single-file setup
+        shell: pwsh
+        run: |
+          $output = Join-Path $env:RUNNER_TEMP 'ss2revive-release'
+          dotnet publish tools/Setup/SS2Revive.Setup.csproj `
+            --configuration Release `
+            --runtime win-x64 `
+            --self-contained true `
+            --output $output
+          if ($LASTEXITCODE -ne 0) { throw 'Setup publish failed.' }
+
+          $source = Join-Path $output 'SS2Revive.Setup.exe'
+          $name = 'SS2Revive-Setup-${{ steps.metadata.outputs.version }}.exe'
+          $destination = Join-Path $output $name
+          Move-Item -LiteralPath $source -Destination $destination
+
+          & $destination --self-test
+          if ($LASTEXITCODE -ne 0) { throw 'Published setup self-test failed.' }
+
+          $hash = (Get-FileHash -LiteralPath $destination -Algorithm SHA256).Hash.ToLowerInvariant()
+          "$hash  $name" | Set-Content `
+            -LiteralPath (Join-Path $output "$name.sha256") `
+            -Encoding ascii `
+            -NoNewline
+
+      - name: Prepare draft release notes
+        shell: pwsh
+        run: |
+          @'
+          # SS2 Revive ${{ steps.metadata.outputs.tag }}
+
+          SS2 Revive restores multiplayer, progression, Creation Mode, and community-made maps for Surgeon Simulator 2 build 1.3.7.3054.
+
+          ## Install
+
+          1. Download `SS2Revive-Setup-${{ steps.metadata.outputs.version }}.exe`.
+          2. Verify it with the attached `.sha256` file.
+          3. Run Setup, choose an install location, and enter the Steam login name for an account that owns Surgeon Simulator 2.
+          4. Complete the password and Steam Guard prompts in DepotDownloader's separate window.
+          5. Start the game with the launcher Setup creates.
+
+          The setup executable is currently unsigned, so Windows may display a SmartScreen warning.
+
+          ## Maintainer checklist before publishing
+
+          - Attach `SS2Revive-${{ steps.metadata.outputs.version }}.zip`, created locally with `./pack.ps1`.
+          - Confirm the mod ZIP contains `SS2Revive.dll`, `SS2Revive_Data.dll`, and `newsfeed/NewsFeed.json`.
+          - Confirm the public community service is healthy.
+          - Replace or expand these draft notes from the local ignored release-description document if needed.
+          - Publish this draft only after all assets are present.
+
+          ## Compatibility
+
+          Windows x64 and Surgeon Simulator 2 build 1.3.7.3054 are required. Legacy maps are preserved as-is and some may contain bugs, fail to load, or open to a black screen.
+          '@ | Set-Content -LiteralPath (Join-Path $env:RUNNER_TEMP 'release-notes.md') -Encoding utf8
+
+      - name: Create or update draft release
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ steps.metadata.outputs.tag }}
+          RELEASE_VERSION: ${{ steps.metadata.outputs.version }}
+        run: |
+          $output = Join-Path $env:RUNNER_TEMP 'ss2revive-release'
+          $exe = Join-Path $output "SS2Revive-Setup-$env:RELEASE_VERSION.exe"
+          $checksum = "$exe.sha256"
+          $notes = Join-Path $env:RUNNER_TEMP 'release-notes.md'
+
+          $existing = & gh release view $env:RELEASE_TAG --json isDraft 2>$null
+          if ($LASTEXITCODE -eq 0) {
+            $release = $existing | ConvertFrom-Json
+            if (-not $release.isDraft) {
+              throw "Release $env:RELEASE_TAG is already public; refusing to replace its assets."
+            }
+
+            gh release upload $env:RELEASE_TAG $exe $checksum --clobber
+            if ($LASTEXITCODE -ne 0) { throw 'Uploading setup assets failed.' }
+            gh release edit $env:RELEASE_TAG `
+              --draft `
+              --title "SS2 Revive $env:RELEASE_TAG" `
+              --notes-file $notes
+            if ($LASTEXITCODE -ne 0) { throw 'Updating the draft release failed.' }
+          }
+          else {
+            gh release create $env:RELEASE_TAG $exe $checksum `
+              --verify-tag `
+              --draft `
+              --title "SS2 Revive $env:RELEASE_TAG" `
+              --notes-file $notes
+            if ($LASTEXITCODE -ne 0) { throw 'Creating the draft release failed.' }
+          }
diff --git a/.gitignore b/.gitignore
index fb208f9..c208032 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,8 +10,9 @@ obj/
 # Local machine paths live here and must never be published.
 Directory.Build.user.props
 
-# Working notes and protocol write-ups. Kept on disk, not in the repository.
+# Documentation is retained locally and transferred manually, not published from this branch.
 docs/
+*.md
 
 # BepInEx is linked from the README, never vendored here.
 lib/
@@ -25,3 +26,15 @@ dist/
 # Inventory.dat, ProgressionConfig.json and the news tile artwork.
 *.dat
 assets/newsfeed/images/*.png
+
+# Local Cloudflare Worker development. Never commit local state or secrets.
+backend/node_modules/
+backend/**/node_modules/
+backend/**/.wrangler/
+backend/**/.dev.vars
+backend/**/.env*
+backend/**/wrangler.production.jsonc
+backend/**/coverage/
+backend/**/dist/
+backend/**/dist-production/
+.pnpm-store/
diff --git a/BUILDING.md b/BUILDING.md
deleted file mode 100644
index db539f7..0000000
--- a/BUILDING.md
+++ /dev/null
@@ -1,63 +0,0 @@
-# Building SS2 Revive from source
-
-You need the [.NET SDK](https://dotnet.microsoft.com/download) (10 or newer) and a copy of the game
-installed. BepInEx and HarmonyX come from NuGet, so there is nothing else to fetch.
-
-```powershell
-dotnet build SS2Revive.sln -c Release
-```
-
-The build finds the game through Steam. If it cannot, because your library lives on another drive
-or you run the game outside Steam, copy `Directory.Build.user.props.example` to
-`Directory.Build.user.props` and set `GameDir` in it. That filename is gitignored. You can also
-pass the path directly:
-
-```powershell
-dotnet build SS2Revive.sln -c Release -p:GameDir="D:\SteamLibrary\steamapps\common\Surgeon Simulator 2"
-```
-
-A successful build copies both DLLs and the news feed straight into your `BepInEx\plugins\SS2Revive`
-folder, so the edit-build-launch loop needs no copying by hand.
-
-There is a self-check that runs the backend against your installed game files:
-
-```powershell
-dotnet run --project tests\DataTests
-```
-
-It prints a line per check and exits non-zero if any fail. Checks that need `Inventory.dat` report
-`SKIP` rather than failing when no install is found.
-
-## Making a release
-
-```powershell
-.\pack.ps1
-```
-
-Builds, runs the self-check, and writes `dist\SS2Revive-<version>.zip` containing exactly what the
-install step in the README tells you to copy. It refuses to package anything if the self-check
-fails.
-
-Attach that file to the release as it is. `installCurrentVersion.ps1` asks GitHub for the newest
-release and takes the `SS2Revive-*.zip` on it, so the version in the name never has to be told to
-anything - but the `SS2Revive-` prefix does have to stay.
-
-It also verifies that the `SS2Revive_Data.dll` going into the zip is the **net472** build. That
-project multi-targets, the two outputs look interchangeable, and shipping the netstandard2.0 one
-boots the game to a black screen with no main menu - the reason is at the top of
-`src/SS2Revive_Data/SS2Revive_Data.csproj`. It is not a mistake you would catch by looking.
-
-The version comes from `SS2ReviveVersion` in `Directory.Build.props`, which is the only place it
-is written down. Both assemblies and the `[BepInPlugin]` attribute are generated from it, so the
-number the log prints and the number on the zip cannot drift apart.
-
-## Layout
-
-| Path | What it is |
-|---|---|
-| `src/SS2Revive` | The plugin. Harmony patches, Steam lobbies, Steam P2P transport, news feed. |
-| `src/SS2Revive_Data` | The backend, as a plain library. Request router, save file, challenge catalogue, JSON.|
-| `tests/DataTests` | A console runner for the library. No test framework, no packages. |
-| `assets/newsfeed` | The authored news feed that ships with a release. |
-| `installCurrentVersion.ps1` | Installs build 1.3.7, BepInEx and the mod, into a folder of its own. |
-| `pack.ps1` | Builds, self-checks and assembles the release zip. |
diff --git a/Directory.Build.props b/Directory.Build.props
index 6acb9c5..07b1b71 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -9,7 +9,7 @@
     zip cannot drift apart.
   -->
   <PropertyGroup Label="Version">
-    <SS2ReviveVersion>1.1.0</SS2ReviveVersion>
+    <SS2ReviveVersion>1.2.0</SS2ReviveVersion>
   </PropertyGroup>
 
   <!--
diff --git a/README.md b/README.md
deleted file mode 100644
index 7be6ac9..0000000
--- a/README.md
+++ /dev/null
@@ -1,155 +0,0 @@
-# SS2 Revive
-
-Restores multiplayer, progression, and Creation Mode to **Surgeon Simulator 2** after Bossa's servers went offline.
-
-> **Not affiliated with Bossa Studios or Curve Games.** Unofficial fan mod. Ships no game code, no game assets. See [Disclaimer](#disclaimer).
-
-- **Requires build:** 1.3.7.3054, Windows 64-bit
-- **1.5.x will NOT work** — the offline patch removed the netcode this mod restores. If Steam is serving you 1.5.x, see [Getting Build 1.3.7](#getting-build-137).
-
----
-
-## Quick Start
-
-**New install:**
-```powershell
-.\installCurrentVersion.ps1
-```
-Enter your Steam login when prompted — [DepotDownloader](https://github.com/SteamRE/DepotDownloader) handles the password/Guard code and fetches the game itself. This creates a **separate folder**; your normal Steam copy (1.5.x) is untouched. Launch with the generated `Launch Surgeon Simulator 2 - 1.3.7.cmd`.
-
-**Already have 1.3.7 installed?** Skip to [Install](#install), step 3.
-
----
-
-## What It Restores
-
-- **Sign-in & version check** — no longer blocks startup
-- **Parties & invites** — via Steam lobbies
-- **Multiplayer traffic** — peer-to-peer over Steam, not Bossa's relay
-- **Progression** — daily challenges, campaign grades, cosmetics all served & saved locally
-- **Creation Mode** — build, save, and playtest levels to your own disk
-- **Main menu news tiles** — reads from a local, editable file
-
----
-
-## Requirements
-
-- Surgeon Simulator 2 on Steam, Windows 64-bit, **build 1.3.7**
-- BepInEx 5.4.23.2, **x64** — [direct download](https://github.com/BepInEx/BepInEx/releases/download/v5.4.23.2/BepInEx_win_x64_5.4.23.2.zip) ([all files](https://github.com/BepInEx/BepInEx/releases/tag/v5.4.23.2))
-- Steam running and signed in
-
-> ⚠️ Get the **x64** build specifically — the 32-bit one installs without complaining, then loads nothing.
-
----
-
-## Getting Build 1.3.7
-
-Steam serves 1.5.x by default, which won't work with this mod.
-
-- **New install** → run `installCurrentVersion.ps1` (see [Quick Start](#quick-start))
-- **Already have 1.3.7** → skip to [Install](#install), step 3
-
-<details>
-<summary>Why 1.5.x doesn't work / how the installer works</summary>
-
-1.5.x removed the netcode the mod attaches to. The mod will detect this, log it, and stop rather than half-working.
-
-`installCurrentVersion.ps1` does the whole install — game, BepInEx, and the mod. It asks where to install, then for the Steam login of the account that owns the game, and hands that off to DepotDownloader, which prompts for the password and Steam Guard code itself. **Nothing about your credentials is stored by this script** — it only fetches a build of a game the account already owns.
-
-The result is a separate, self-contained folder, not a change to your Steam copy. Steam keeps serving 1.5.x to your library and is unaware of this folder. The installer also writes `steam_appid.txt` — without it, `SteamAPI.Init` has no app ID to resolve outside a Steam launch, and the game stops at "Authentication Failed: Platform Authentication Error."
-
-Steam still needs to be running and signed in when you play — parties, invites, and P2P traffic all go through it.
-
-</details>
-
----
-
-## Install
-
-*Only needed if you skipped the installer, or it couldn't fetch a release (in which case steps 1–2 are already done).*
-
-1. **Install BepInEx.** Extract the zip into your game folder (the one with the `.exe` — usually `steamapps\common\Surgeon Simulator 2`; right-click the game in Steam → Manage → Browse local files). You should end up with `winhttp.dll`, `doorstop_config.ini`, and a `BepInEx\` folder next to the exe.
-2. **Launch the game once through Steam, then quit.** This lets BepInEx create its `config`/`plugins` folders and a first `LogOutput.log`.
-3. **Install the plugin.** Download the latest release and copy its contents into:
-   ```
-   Surgeon Simulator 2\BepInEx\plugins\SS2Revive\
-   ```
-   You need `SS2Revive.dll`, `SS2Revive_Data.dll`, and the `newsfeed` folder — all together in that one folder. Both DLLs must sit side by side (BepInEx resolves a plugin's dependencies from its own folder).
-4. **Launch the game.** Confirm it loaded by checking `BepInEx\LogOutput.log` for lines tagged `[Info   :SS2 Revive]`.
-
----
-
-## Uninstall
-
-- **Mod only:** delete `BepInEx\plugins\SS2Revive\`
-- **Mod + BepInEx:** also delete `winhttp.dll`, `doorstop_config.ini`, `.doorstop_version`, and the `BepInEx` folder
-
-Nothing in the game's own files is ever modified — a Steam file verification won't undo this and won't complain about it either.
-
----
-
-## Reporting a Bug
-
-- Open an issue and attach `Surgeon Simulator 2\BepInEx\LogOutput.log` from the run where it happened. Almost nothing can be diagnosed without it.
-- Press **F9** in-game to write a state dump to that same log — do this for anything involving parties, progression, or cosmetics.
-- The log includes your **SteamID64** (identifies your profile, can't be used to sign in as you). Redact it if you'd rather not have it public.
-
----
-
-## Where Your Progress Is Saved
-
-```
-%LOCALAPPDATA%\Bossa Studios\Surgeon Simulator 2\SS2Revive\progress.json
-```
-
-- Sits outside both the game and BepInEx directories, so verifying game files or reinstalling the mod can't delete it
-- Plain JSON — override the location with `SaveDirectory` in the config
-- Each save replaces the file in one atomic step and keeps the previous version as `progress.json.bak` — a power loss mid-write costs nothing. If `progress.json` gets damaged, delete it and rename `.bak` over it
-- Creation Mode levels live in the `levels` folder next to it, one folder per level (metadata + revisions as readable JSON). Copy the folder to move a level to another machine
-
----
-
-## Configuration
-
-Config file appears after first run at `BepInEx\config\dev.ss2revive.core.cfg`. Defaults are the intended experience — the ones worth knowing about:
-
-| Setting | Default | What it does |
-|---|---|---|
-| `Bypass.ConnectionCheck` | `true` | Skips asking the shut-down server for permission to start. Disabling this on 1.3.7+ leaves you stuck at the "requires an active internet connection" box. |
-| `Backend.Mode` | `Local` | Where the game's dead HTTP calls get answered. `Local` answers in-process. `Off` is diagnostic-only — disables progression/challenges/cosmetics rather than restoring them. |
-| `Backend.GrantAllCosmetics` | `true` | Unlocks every cosmetic set. Set `false` to earn them via the reward track. |
-| `Backend.SaveDirectory` | *(empty)* | Overrides where `progress.json` and levels are written. |
-| `CreationMode.Enabled` | `true` | Saves built levels to this machine. Off = Creation Mode loads into a black screen (game won't open a level until it's "uploaded"). |
-| `FreeForAll.Enabled` | `true` | Fills the Free-for-all queue from levels on this machine. Off = empty queue (Bossa served this from published community levels). |
-| `FreeForAll.IncludeGameLevels` | `true` | Lets Free-for-all fall back to campaign levels when your library has nothing that fits. No FFA level ships with the game. |
-| `Party.SteamP2PTransport` | `true` | Sends gameplay traffic over Steam peer-to-peer. |
-| `Party.InviteKey` | `F10` | Opens the Steam invite overlay. |
-| `Party.ShareLevelOverSteam` | `true` | Publishes your season level to lobby members/friends. |
-| `NewsFeed.Enabled` | `true` | Points the main menu tiles at the local feed. |
-| `Diagnostics.ProbeKey` | `F9` | Dumps current state to the log. |
-| `Diagnostics.Verbose` | `true` | Includes live session/patient state in that dump — leave on for bug reports. |
-
----
-
-## Editing the News Feed
-
-Edit `BepInEx\plugins\SS2Revive\newsfeed\NewsFeed.json` and restart the game.
-
-- Each tile: title, subtitle, image filename, optional `ClickUrl`
-- Images go in `newsfeed\images\`, **512×289 PNG**
-- The game's own artwork is copied in on first run, so tiles are never blank to start (those images belong to Bossa and aren't distributed here)
-- Building from source? Edit `assets\newsfeed\NewsFeed.json` instead — see [BUILDING.md](BUILDING.md)
-
----
-
-## Building From Source
-
-Covered in [BUILDING.md](BUILDING.md).
-
----
-
-## Disclaimer
-
-SS2 Revive is an unofficial, non-commercial fan modification. It is not affiliated with, endorsed by, sponsored by, or connected to Bossa Studios, Curve Games, or anyone else involved in making or publishing Surgeon Simulator 2. All trademarks and copyrights belong to their respective owners.
-
-The repository contains no game code and no game assets. The mod reads data from the copy of the game you already own, on your own machine, and modifies nothing the game installed. It exists so that a game people paid for keeps working after its servers were switched off.
diff --git a/backend/.npmrc b/backend/.npmrc
new file mode 100644
index 0000000..3bcafd1
--- /dev/null
+++ b/backend/.npmrc
@@ -0,0 +1,5 @@
+save-exact=true
+strict-peer-dependencies=true
+auto-install-peers=false
+audit=true
+fund=false
diff --git a/backend/community-api/.dev.vars.example b/backend/community-api/.dev.vars.example
new file mode 100644
index 0000000..6e30d98
--- /dev/null
+++ b/backend/community-api/.dev.vars.example
@@ -0,0 +1,6 @@
+# Copy this file to .dev.vars and replace the value with a base64-encoded 32-byte random secret.
+# PowerShell example:
+#   $bytes = [byte[]]::new(32)
+#   [Security.Cryptography.RandomNumberGenerator]::Fill($bytes)
+#   [Convert]::ToBase64String($bytes)
+LOCAL_AUTH_SECRET=<generate-a-local-secret-at-least-32-characters-long>
diff --git a/backend/community-api/migrations/0001_phase0.sql b/backend/community-api/migrations/0001_phase0.sql
new file mode 100644
index 0000000..16a1de8
--- /dev/null
+++ b/backend/community-api/migrations/0001_phase0.sql
@@ -0,0 +1,109 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE users (
+  steam_id64 TEXT PRIMARY KEY NOT NULL,
+  status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'suspended', 'deleted')),
+  created_at INTEGER NOT NULL,
+  last_login_at INTEGER NOT NULL
+) STRICT;
+
+CREATE TABLE auth_sessions (
+  id TEXT PRIMARY KEY NOT NULL,
+  steam_id64 TEXT NOT NULL REFERENCES users(steam_id64),
+  status TEXT NOT NULL CHECK (status IN ('active', 'revoked')),
+  created_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  revoked_at INTEGER
+) STRICT;
+CREATE INDEX idx_auth_sessions_user_status ON auth_sessions(steam_id64, status);
+
+CREATE TABLE device_auth_sessions (
+  id TEXT PRIMARY KEY NOT NULL,
+  device_secret_hash TEXT NOT NULL UNIQUE,
+  user_code_hash TEXT NOT NULL UNIQUE,
+  steam_id64 TEXT REFERENCES users(steam_id64),
+  status TEXT NOT NULL CHECK (status IN ('pending', 'approved', 'denied', 'consumed')),
+  created_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  approved_at INTEGER,
+  consumed_at INTEGER
+) STRICT;
+CREATE INDEX idx_device_auth_expiry ON device_auth_sessions(status, expires_at);
+
+CREATE TABLE refresh_token_families (
+  id TEXT PRIMARY KEY NOT NULL,
+  session_id TEXT NOT NULL REFERENCES auth_sessions(id),
+  steam_id64 TEXT NOT NULL REFERENCES users(steam_id64),
+  created_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  revoked_at INTEGER,
+  revoke_reason TEXT
+) STRICT;
+CREATE INDEX idx_refresh_families_session ON refresh_token_families(session_id);
+
+CREATE TABLE refresh_tokens (
+  id TEXT PRIMARY KEY NOT NULL,
+  family_id TEXT NOT NULL REFERENCES refresh_token_families(id),
+  token_hash TEXT NOT NULL UNIQUE,
+  status TEXT NOT NULL CHECK (status IN ('active', 'rotated', 'revoked')),
+  created_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  used_at INTEGER,
+  rotated_to_id TEXT
+) STRICT;
+CREATE INDEX idx_refresh_tokens_family_status ON refresh_tokens(family_id, status);
+
+CREATE TABLE maps (
+  id TEXT PRIMARY KEY NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('published', 'unpublished', 'archived')),
+  current_revision INTEGER NOT NULL CHECK (current_revision >= 1),
+  title TEXT NOT NULL,
+  title_sort TEXT NOT NULL,
+  description TEXT NOT NULL,
+  created_at_ms INTEGER NOT NULL CHECK (created_at_ms >= 0),
+  updated_at_ms INTEGER NOT NULL CHECK (updated_at_ms >= created_at_ms)
+) STRICT;
+CREATE INDEX idx_maps_published_updated ON maps(status, updated_at_ms DESC, id ASC);
+CREATE INDEX idx_maps_published_created ON maps(status, created_at_ms DESC, id ASC);
+CREATE INDEX idx_maps_published_title ON maps(status, title_sort ASC, id ASC);
+
+CREATE TABLE map_versions (
+  map_id TEXT NOT NULL REFERENCES maps(id),
+  revision INTEGER NOT NULL CHECK (revision >= 1),
+  status TEXT NOT NULL CHECK (status IN ('published', 'unpublished', 'rejected')),
+  code TEXT NOT NULL,
+  creator_ids_json TEXT NOT NULL,
+  tags_json TEXT NOT NULL,
+  configurations_json TEXT NOT NULL,
+  validations_json TEXT NOT NULL,
+  player_counts_csv TEXT NOT NULL,
+  client_version INTEGER NOT NULL CHECK (client_version = 29),
+  map_format_version INTEGER NOT NULL CHECK (map_format_version = 29),
+  minimum_revive_version TEXT NOT NULL,
+  revive_version TEXT,
+  size_bytes INTEGER NOT NULL CHECK (size_bytes BETWEEN 1 AND 25165824),
+  sha256 TEXT NOT NULL CHECK (length(sha256) = 64 AND sha256 NOT GLOB '*[^0-9a-f]*'),
+  bundle_key TEXT NOT NULL UNIQUE,
+  thumbnail_size_bytes INTEGER,
+  thumbnail_sha256 TEXT,
+  thumbnail_key TEXT UNIQUE,
+  created_at_ms INTEGER NOT NULL CHECK (created_at_ms >= 0),
+  CHECK (
+    (thumbnail_size_bytes IS NULL AND thumbnail_sha256 IS NULL AND thumbnail_key IS NULL)
+    OR
+    (thumbnail_size_bytes BETWEEN 1 AND 8388608 AND
+     thumbnail_sha256 IS NOT NULL AND length(thumbnail_sha256) = 64 AND
+     thumbnail_sha256 NOT GLOB '*[^0-9a-f]*' AND thumbnail_key IS NOT NULL)
+  ),
+  PRIMARY KEY (map_id, revision)
+) STRICT;
+CREATE INDEX idx_map_versions_published ON map_versions(map_id, status, revision DESC);
+
+CREATE TABLE map_tags (
+  map_id TEXT NOT NULL,
+  revision INTEGER NOT NULL,
+  tag TEXT NOT NULL,
+  PRIMARY KEY (map_id, revision, tag),
+  FOREIGN KEY (map_id, revision) REFERENCES map_versions(map_id, revision) ON DELETE CASCADE
+) STRICT;
+CREATE INDEX idx_map_tags_lookup ON map_tags(tag, map_id, revision);
diff --git a/backend/community-api/migrations/0002_phase1_auth_and_limits.sql b/backend/community-api/migrations/0002_phase1_auth_and_limits.sql
new file mode 100644
index 0000000..1d8195e
--- /dev/null
+++ b/backend/community-api/migrations/0002_phase1_auth_and_limits.sql
@@ -0,0 +1,60 @@
+ALTER TABLE auth_sessions ADD COLUMN source_device_session_id TEXT;
+CREATE UNIQUE INDEX idx_auth_sessions_source_device
+  ON auth_sessions(source_device_session_id)
+  WHERE source_device_session_id IS NOT NULL;
+
+ALTER TABLE device_auth_sessions ADD COLUMN last_polled_at INTEGER;
+
+CREATE UNIQUE INDEX idx_refresh_family_one_active
+  ON refresh_tokens(family_id)
+  WHERE status = 'active';
+
+CREATE TRIGGER trg_auth_session_requires_approved_device
+BEFORE INSERT ON auth_sessions
+WHEN NEW.source_device_session_id IS NOT NULL
+  AND NOT EXISTS (
+    SELECT 1 FROM device_auth_sessions d
+    WHERE d.id = NEW.source_device_session_id
+      AND d.status = 'approved'
+      AND d.expires_at > NEW.created_at
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'device_session_not_approved');
+END;
+
+CREATE TABLE steam_openid_sessions (
+  id TEXT PRIMARY KEY NOT NULL,
+  device_session_id TEXT NOT NULL UNIQUE REFERENCES device_auth_sessions(id) ON DELETE CASCADE,
+  state_hash TEXT NOT NULL UNIQUE,
+  status TEXT NOT NULL CHECK (status IN ('pending', 'verified', 'confirmed', 'failed')),
+  return_to TEXT NOT NULL,
+  steam_id64 TEXT,
+  response_nonce_hash TEXT UNIQUE,
+  confirm_token_hash TEXT,
+  created_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  verified_at INTEGER,
+  confirmed_at INTEGER
+) STRICT;
+CREATE INDEX idx_steam_openid_expiry ON steam_openid_sessions(status, expires_at);
+
+CREATE TABLE download_usage_daily (
+  steam_id64 TEXT NOT NULL REFERENCES users(steam_id64),
+  day_utc TEXT NOT NULL,
+  bytes_reserved INTEGER NOT NULL DEFAULT 0 CHECK (bytes_reserved >= 0),
+  download_starts INTEGER NOT NULL DEFAULT 0 CHECK (download_starts >= 0),
+  updated_at INTEGER NOT NULL,
+  PRIMARY KEY (steam_id64, day_utc)
+) STRICT;
+
+CREATE TABLE download_leases (
+  id TEXT PRIMARY KEY NOT NULL,
+  steam_id64 TEXT NOT NULL REFERENCES users(steam_id64),
+  day_utc TEXT NOT NULL,
+  bytes_reserved INTEGER NOT NULL CHECK (bytes_reserved > 0),
+  created_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL
+) STRICT;
+CREATE INDEX idx_download_leases_actor_expiry
+  ON download_leases(steam_id64, expires_at);
+CREATE INDEX idx_download_leases_expiry ON download_leases(expires_at);
diff --git a/backend/community-api/migrations/0003_authenticated_uploads.sql b/backend/community-api/migrations/0003_authenticated_uploads.sql
new file mode 100644
index 0000000..26fdd10
--- /dev/null
+++ b/backend/community-api/migrations/0003_authenticated_uploads.sql
@@ -0,0 +1,31 @@
+CREATE TABLE map_uploads (
+  id TEXT PRIMARY KEY NOT NULL,
+  steam_id64 TEXT NOT NULL REFERENCES users(steam_id64),
+  status TEXT NOT NULL CHECK (
+    status IN ('reserved', 'uploaded', 'validating', 'published', 'rejected', 'cancelled', 'expired')
+  ),
+  expected_size_bytes INTEGER NOT NULL CHECK (expected_size_bytes BETWEEN 1 AND 25165824),
+  expected_sha256 TEXT NOT NULL CHECK (
+    length(expected_sha256) = 64 AND expected_sha256 NOT GLOB '*[^0-9a-f]*'
+  ),
+  quarantine_key TEXT NOT NULL UNIQUE,
+  map_id TEXT,
+  revision INTEGER CHECK (revision IS NULL OR revision >= 1),
+  error_code TEXT,
+  error_message TEXT,
+  created_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  uploaded_at INTEGER,
+  completed_at INTEGER,
+  CHECK (expires_at > created_at),
+  CHECK (
+    (status = 'published' AND map_id IS NOT NULL AND revision IS NOT NULL)
+    OR status != 'published'
+  )
+) STRICT;
+
+CREATE INDEX idx_map_uploads_owner_created
+  ON map_uploads(steam_id64, created_at DESC);
+CREATE INDEX idx_map_uploads_status_expiry
+  ON map_uploads(status, expires_at);
+
diff --git a/backend/community-api/migrations/0004_upload_validation_leases.sql b/backend/community-api/migrations/0004_upload_validation_leases.sql
new file mode 100644
index 0000000..bb38462
--- /dev/null
+++ b/backend/community-api/migrations/0004_upload_validation_leases.sql
@@ -0,0 +1,5 @@
+ALTER TABLE map_uploads ADD COLUMN validation_lease TEXT;
+ALTER TABLE map_uploads ADD COLUMN validation_started_at INTEGER;
+
+CREATE INDEX idx_map_uploads_validation_lease
+  ON map_uploads(id, status, validation_lease);
diff --git a/backend/community-api/migrations/0005_public_publishing_and_moderation.sql b/backend/community-api/migrations/0005_public_publishing_and_moderation.sql
new file mode 100644
index 0000000..368c58b
--- /dev/null
+++ b/backend/community-api/migrations/0005_public_publishing_and_moderation.sql
@@ -0,0 +1,53 @@
+ALTER TABLE maps ADD COLUMN owner_steam_id64 TEXT REFERENCES users(steam_id64);
+ALTER TABLE maps ADD COLUMN unpublished_at_ms INTEGER;
+ALTER TABLE maps ADD COLUMN archived_at_ms INTEGER;
+ALTER TABLE maps ADD COLUMN moderation_reason TEXT;
+
+UPDATE maps
+   SET owner_steam_id64 = (
+     SELECT u.steam_id64
+       FROM map_uploads u
+      WHERE u.map_id = maps.id AND u.status = 'published'
+      ORDER BY u.completed_at DESC
+      LIMIT 1
+   )
+ WHERE owner_steam_id64 IS NULL;
+
+CREATE INDEX idx_maps_owner_status
+  ON maps(owner_steam_id64, status, updated_at_ms DESC);
+
+CREATE TABLE upload_usage_daily (
+  steam_id64 TEXT NOT NULL REFERENCES users(steam_id64),
+  day_utc TEXT NOT NULL,
+  reservations INTEGER NOT NULL DEFAULT 0 CHECK (reservations >= 0),
+  updated_at INTEGER NOT NULL,
+  PRIMARY KEY (steam_id64, day_utc)
+) STRICT;
+
+CREATE TABLE map_reports (
+  id TEXT PRIMARY KEY NOT NULL,
+  map_id TEXT NOT NULL REFERENCES maps(id),
+  reporter_steam_id64 TEXT NOT NULL REFERENCES users(steam_id64),
+  reason TEXT NOT NULL CHECK (
+    reason IN ('BROKEN', 'NSFW_CONTENT', 'COPY', 'LEVEL_DESIGN_COPYRIGHT', 'FARMING', 'OTHER')
+  ),
+  note TEXT NOT NULL DEFAULT '' CHECK (length(note) <= 512),
+  status TEXT NOT NULL CHECK (status IN ('open', 'resolved', 'dismissed')),
+  created_at INTEGER NOT NULL,
+  resolved_at INTEGER,
+  resolved_by_steam_id64 TEXT REFERENCES users(steam_id64),
+  resolution TEXT,
+  UNIQUE (map_id, reporter_steam_id64)
+) STRICT;
+CREATE INDEX idx_map_reports_status_created ON map_reports(status, created_at ASC);
+CREATE INDEX idx_map_reports_map_status ON map_reports(map_id, status);
+
+CREATE TABLE moderation_events (
+  id TEXT PRIMARY KEY NOT NULL,
+  map_id TEXT NOT NULL REFERENCES maps(id),
+  maintainer_steam_id64 TEXT NOT NULL REFERENCES users(steam_id64),
+  action TEXT NOT NULL CHECK (action IN ('takedown', 'restore')),
+  reason TEXT NOT NULL CHECK (length(reason) BETWEEN 1 AND 256),
+  created_at INTEGER NOT NULL
+) STRICT;
+CREATE INDEX idx_moderation_events_map_created ON moderation_events(map_id, created_at DESC);
diff --git a/backend/community-api/migrations/0006_storage_quotas_and_lease_recovery.sql b/backend/community-api/migrations/0006_storage_quotas_and_lease_recovery.sql
new file mode 100644
index 0000000..944487b
--- /dev/null
+++ b/backend/community-api/migrations/0006_storage_quotas_and_lease_recovery.sql
@@ -0,0 +1,53 @@
+-- Storage accounting, validation-lease recovery, and index/retention gaps found in the
+-- 2026-08-10 security review.
+
+-- The lifetime map-count quota only applied to new map identifiers, so republishing revisions of
+-- an existing map consumed R2 without bound. Charge every accepted revision against a daily byte
+-- allowance as well as the reservation count.
+ALTER TABLE upload_usage_daily ADD COLUMN bytes_published INTEGER NOT NULL DEFAULT 0
+  CHECK (bytes_published >= 0);
+
+-- Running total of approved bytes an account currently has retained, maintained as revisions are
+-- published and released so a per-account ceiling can be enforced without scanning R2.
+CREATE TABLE account_storage (
+  steam_id64 TEXT PRIMARY KEY NOT NULL REFERENCES users(steam_id64),
+  retained_bytes INTEGER NOT NULL DEFAULT 0 CHECK (retained_bytes >= 0),
+  updated_at INTEGER NOT NULL
+) STRICT;
+
+-- A validator killed between claiming its lease and completing left the row stranded in
+-- 'validating' forever: the claim requires status 'uploaded', and the maintenance sweep only
+-- looked at 'reserved'/'uploaded'. Record when the lease expires so it can be reclaimed safely.
+ALTER TABLE map_uploads ADD COLUMN validation_lease_expires_at INTEGER;
+
+CREATE INDEX idx_map_uploads_validating_lease
+  ON map_uploads(status, validation_lease_expires_at);
+
+-- The per-account daily report count filtered on reporter_steam_id64, but every existing index
+-- leads with map_id or status, so each report scanned the whole table.
+CREATE INDEX idx_map_reports_reporter_created
+  ON map_reports(reporter_steam_id64, created_at);
+
+-- Retention for moderation history and resolved reports, which previously had no policy at all.
+CREATE INDEX idx_map_reports_resolved_at ON map_reports(resolved_at);
+
+-- The device-link confirmation page asked the user to approve "the code you entered" without ever
+-- showing which code that was, so an attacker could send a victim a prefilled activation link on
+-- the real domain and have them approve the attacker's device. Carry the code on the short-lived
+-- OpenID session so the confirmation page can display it for comparison (RFC 8628 section 5.4).
+ALTER TABLE steam_openid_sessions ADD COLUMN user_code TEXT;
+
+-- Seed the running total from what each account already has stored, so the new ceiling reflects
+-- reality instead of granting every existing publisher a fresh allowance.
+INSERT INTO account_storage (steam_id64, retained_bytes, updated_at)
+SELECT m.owner_steam_id64,
+       COALESCE(SUM(v.size_bytes + COALESCE(v.thumbnail_size_bytes, 0)), 0),
+       CAST(strftime('%s', 'now') AS INTEGER) * 1000
+  FROM maps m JOIN map_versions v ON v.map_id = m.id
+ WHERE m.owner_steam_id64 IS NOT NULL
+ GROUP BY m.owner_steam_id64
+ON CONFLICT(steam_id64) DO NOTHING;
+
+-- The now-unused download_leases and download_usage_daily tables are dropped in migration 0007,
+-- after the Worker that still references them has been replaced. Dropping them here would break
+-- the currently deployed cron in the window between migrating and deploying.
diff --git a/backend/community-api/migrations/0007_drop_dead_download_quota.sql b/backend/community-api/migrations/0007_drop_dead_download_quota.sql
new file mode 100644
index 0000000..f1bc9f6
--- /dev/null
+++ b/backend/community-api/migrations/0007_drop_dead_download_quota.sql
@@ -0,0 +1,11 @@
+-- The per-account download budget in download-quota.ts was implemented, tested, and never wired
+-- into any request path: nothing outside the test suite ever called reserveDownload, while
+-- config.ts still hard-failed startup when its variables were malformed. Downloads are
+-- intentionally anonymous, so the tables are removed rather than left as an inert control that
+-- implies a protection the service does not actually have.
+--
+-- Kept separate from 0006 so the destructive step is reviewable on its own. Note that
+-- `wrangler d1 migrations apply` runs every pending migration in one invocation, so this does not
+-- by itself create a gap between schema and code: deploy the Worker immediately after migrating.
+DROP TABLE IF EXISTS download_leases;
+DROP TABLE IF EXISTS download_usage_daily;
diff --git a/backend/community-api/package.json b/backend/community-api/package.json
new file mode 100644
index 0000000..f6b07d7
--- /dev/null
+++ b/backend/community-api/package.json
@@ -0,0 +1,27 @@
+{
+  "name": "@ss2revive/community-api",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "wrangler deploy --dry-run --outdir dist",
+    "check": "wrangler types worker-configuration.d.ts --include-runtime false --strict-vars false --check && tsc --noEmit",
+    "types": "wrangler types worker-configuration.d.ts --include-runtime false --strict-vars false",
+    "dev": "wrangler dev --local --ip 127.0.0.1",
+    "db:migrate:local": "wrangler d1 migrations apply ss2revive-community-local --local",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage"
+  },
+  "dependencies": {
+    "@ss2revive/community-contracts": "workspace:*"
+  },
+  "devDependencies": {
+    "@cloudflare/vitest-pool-workers": "0.20.3",
+    "@cloudflare/workers-types": "5.20260804.1",
+    "@types/node": "26.2.0",
+    "@vitest/coverage-istanbul": "4.1.10",
+    "typescript": "7.0.2",
+    "vitest": "4.1.10",
+    "wrangler": "4.120.0"
+  }
+}
diff --git a/backend/community-api/src/auth.ts b/backend/community-api/src/auth.ts
new file mode 100644
index 0000000..27688fd
--- /dev/null
+++ b/backend/community-api/src/auth.ts
@@ -0,0 +1,367 @@
+import { hasOnlyKeys, isSteamId64, type AuthPrincipal } from "@ss2revive/community-contracts";
+import type { RuntimeConfig } from "./config";
+import { issueAccessToken, opaqueHash, randomToken, verifyAccessToken } from "./crypto";
+import { emptyResponse, HttpError, jsonResponse, readBoundedBody, readJsonObject, responseHeaders } from "./http";
+
+const DEVICE_SESSION_LIFETIME_MS = 10 * 60 * 1000;
+const LOGIN_SESSION_LIFETIME_MS = 30 * 24 * 60 * 60 * 1000;
+const USER_CODE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+
+interface DeviceSessionRow {
+  id: string;
+  steam_id64: string | null;
+  status: "pending" | "approved" | "denied" | "consumed";
+  expires_at: number;
+  last_polled_at: number | null;
+}
+
+interface RefreshTokenRow {
+  id: string;
+  family_id: string;
+  status: "active" | "rotated" | "revoked";
+  expires_at: number;
+  session_id: string;
+  steam_id64: string;
+  family_revoked_at: number | null;
+  session_status: "active" | "revoked";
+  user_status: "active" | "suspended" | "deleted";
+}
+
+function userCode(): string {
+  const bytes = new Uint8Array(8);
+  crypto.getRandomValues(bytes);
+  const characters = [...bytes].map((value) => USER_CODE_ALPHABET[value % USER_CODE_ALPHABET.length]);
+  return `${characters.slice(0, 4).join("")}-${characters.slice(4).join("")}`;
+}
+
+function tokenResponse(
+  accessToken: string,
+  accessExpiresAtMs: number,
+  refreshToken: string,
+  nowMs: number,
+  scope: string,
+): Record<string, unknown> {
+  return {
+    tokenType: "Bearer",
+    accessToken,
+    expiresInSeconds: Math.max(0, Math.floor((accessExpiresAtMs - nowMs) / 1000)),
+    refreshToken,
+    refreshExpiresInSeconds: Math.floor(LOGIN_SESSION_LIFETIME_MS / 1000),
+    scope,
+  };
+}
+
+export async function createDeviceSession(
+  request: Request,
+  env: Env,
+  config: RuntimeConfig,
+  requestId: string,
+  nowMs: number,
+): Promise<Response> {
+  const body = await readJsonObject(request, 1024);
+  if (!hasOnlyKeys(body, []) || Object.keys(body).length !== 0) {
+    throw new HttpError(400, "invalid_request", "The request body must be an empty object.");
+  }
+  const id = crypto.randomUUID();
+  const deviceSecret = randomToken();
+  const code = userCode();
+  const expiresAt = nowMs + DEVICE_SESSION_LIFETIME_MS;
+  await env.DB.prepare(
+    `INSERT INTO device_auth_sessions
+       (id, device_secret_hash, user_code_hash, status, created_at, expires_at)
+     VALUES (?, ?, ?, 'pending', ?, ?)`,
+  ).bind(
+    id,
+    await opaqueHash(config, "device-secret", deviceSecret),
+    await opaqueHash(config, "user-code", code),
+    nowMs,
+    expiresAt,
+  ).run();
+
+  return jsonResponse({
+    deviceSessionId: id,
+    deviceSecret,
+    userCode: code,
+    // The complete URL is a convenience, not approval: the browser still shows the code again
+    // after Steam verification and requires a deliberate code-match confirmation.
+    activationPath: `/activate?user_code=${encodeURIComponent(code)}`,
+    expiresAt: new Date(expiresAt).toISOString(),
+    pollIntervalSeconds: 5,
+  }, 201, requestId);
+}
+
+export async function pollDeviceSession(
+  request: Request,
+  env: Env,
+  config: RuntimeConfig,
+  requestId: string,
+  nowMs: number,
+): Promise<Response> {
+  const body = await readJsonObject(request, 4096);
+  if (!hasOnlyKeys(body, ["deviceSessionId", "deviceSecret"]) ||
+      typeof body.deviceSessionId !== "string" || typeof body.deviceSecret !== "string" ||
+      !/^[0-9a-f-]{36}$/.test(body.deviceSessionId) || body.deviceSecret.length !== 43) {
+    throw new HttpError(400, "invalid_request", "The device-session credentials are malformed.");
+  }
+  const secretHash = await opaqueHash(config, "device-secret", body.deviceSecret);
+  const row = await env.DB.prepare(
+    `SELECT id, steam_id64, status, expires_at, last_polled_at
+       FROM device_auth_sessions WHERE id = ? AND device_secret_hash = ?`,
+  ).bind(body.deviceSessionId, secretHash).first<DeviceSessionRow>();
+  if (row === null) throw new HttpError(400, "invalid_request", "The device-session credentials are invalid.");
+  if (row.expires_at <= nowMs) throw new HttpError(410, "device_session_expired", "The device session expired.");
+  if (row.status === "denied") throw new HttpError(403, "device_session_denied", "The device session was denied.");
+  if (row.status === "consumed") throw new HttpError(409, "device_session_consumed", "The device session was already consumed.");
+  if (row.status === "pending") {
+    const allowed = await env.DB.prepare(
+      `UPDATE device_auth_sessions SET last_polled_at = ?
+        WHERE id = ? AND status = 'pending'
+          AND (last_polled_at IS NULL OR last_polled_at <= ?)
+        RETURNING id`,
+    ).bind(nowMs, row.id, nowMs - 5000).first<{ id: string }>();
+    if (allowed === null) {
+      const retryAfter = Math.max(1, Math.ceil(((row.last_polled_at ?? nowMs) + 5000 - nowMs) / 1000));
+      throw new HttpError(429, "authorization_slow_down", "Wait before polling this device session again.", {
+        "Retry-After": String(retryAfter),
+      });
+    }
+    return jsonResponse(
+      { status: "pending", expiresAt: new Date(row.expires_at).toISOString() },
+      202,
+      requestId,
+      { "Retry-After": "5" },
+    );
+  }
+
+  if (!isSteamId64(row.steam_id64)) {
+    throw new HttpError(409, "device_session_consumed", "The device session is no longer available.");
+  }
+
+  const sessionId = crypto.randomUUID();
+  const familyId = crypto.randomUUID();
+  const refreshId = crypto.randomUUID();
+  const refreshToken = randomToken();
+  const refreshHash = await opaqueHash(config, "refresh-token", refreshToken);
+  const sessionExpiresAt = nowMs + LOGIN_SESSION_LIFETIME_MS;
+  try {
+    await env.DB.batch([
+      env.DB.prepare(
+        `INSERT INTO users (steam_id64, status, created_at, last_login_at)
+         VALUES (?, 'active', ?, ?)
+         ON CONFLICT(steam_id64) DO UPDATE SET last_login_at = excluded.last_login_at`,
+      ).bind(row.steam_id64, nowMs, nowMs),
+      env.DB.prepare(
+        `INSERT INTO auth_sessions
+           (id, steam_id64, status, created_at, expires_at, source_device_session_id)
+         VALUES (?, ?, 'active', ?, ?, ?)`,
+      ).bind(sessionId, row.steam_id64, nowMs, sessionExpiresAt, row.id),
+      env.DB.prepare(
+        `INSERT INTO refresh_token_families (id, session_id, steam_id64, created_at, expires_at)
+         VALUES (?, ?, ?, ?, ?)`,
+      ).bind(familyId, sessionId, row.steam_id64, nowMs, sessionExpiresAt),
+      env.DB.prepare(
+        `INSERT INTO refresh_tokens (id, family_id, token_hash, status, created_at, expires_at)
+         VALUES (?, ?, ?, 'active', ?, ?)`,
+      ).bind(refreshId, familyId, refreshHash, nowMs, sessionExpiresAt),
+      env.DB.prepare(
+        `UPDATE device_auth_sessions SET status = 'consumed', consumed_at = ?
+          WHERE id = ? AND device_secret_hash = ? AND status = 'approved' AND expires_at > ?`,
+      ).bind(nowMs, row.id, secretHash, nowMs),
+    ]);
+  } catch {
+    throw new HttpError(409, "device_session_consumed", "The device session is no longer available.");
+  }
+  const access = await issueAccessToken(config, row.steam_id64, sessionId, nowMs);
+  return jsonResponse(tokenResponse(access.token, access.expiresAtMs, refreshToken, nowMs, access.scope), 200, requestId);
+}
+
+async function refreshRow(env: Env, config: RuntimeConfig, refreshToken: string): Promise<RefreshTokenRow | null> {
+  const hash = await opaqueHash(config, "refresh-token", refreshToken);
+  return env.DB.prepare(
+    `SELECT t.id, t.family_id, t.status, t.expires_at,
+            f.session_id, f.steam_id64, f.revoked_at AS family_revoked_at,
+            s.status AS session_status, u.status AS user_status
+       FROM refresh_tokens t
+       JOIN refresh_token_families f ON f.id = t.family_id
+       JOIN auth_sessions s ON s.id = f.session_id
+       JOIN users u ON u.steam_id64 = f.steam_id64
+      WHERE t.token_hash = ?`,
+  ).bind(hash).first<RefreshTokenRow>();
+}
+
+async function revokeFamily(env: Env, row: RefreshTokenRow, nowMs: number, reason: string): Promise<void> {
+  await env.DB.batch([
+    env.DB.prepare(
+      `UPDATE refresh_token_families SET revoked_at = COALESCE(revoked_at, ?), revoke_reason = ? WHERE id = ?`,
+    ).bind(nowMs, reason, row.family_id),
+    env.DB.prepare(`UPDATE refresh_tokens SET status = 'revoked' WHERE family_id = ?`).bind(row.family_id),
+    env.DB.prepare(
+      `UPDATE auth_sessions SET status = 'revoked', revoked_at = COALESCE(revoked_at, ?) WHERE id = ?`,
+    ).bind(nowMs, row.session_id),
+  ]);
+}
+
+export async function refreshSession(
+  request: Request,
+  env: Env,
+  config: RuntimeConfig,
+  requestId: string,
+  nowMs: number,
+): Promise<Response> {
+  const body = await readJsonObject(request, 4096);
+  if (!hasOnlyKeys(body, ["refreshToken"]) || typeof body.refreshToken !== "string" || body.refreshToken.length !== 43) {
+    throw new HttpError(400, "invalid_request", "The refresh token is malformed.");
+  }
+  const row = await refreshRow(env, config, body.refreshToken);
+  if (row === null) throw new HttpError(401, "token_invalid", "The refresh token is invalid.");
+  if (row.status !== "active") {
+    await revokeFamily(env, row, nowMs, "refresh_token_reuse");
+    throw new HttpError(401, "token_invalid", "The refresh-token family was revoked.");
+  }
+  if (row.expires_at <= nowMs || row.family_revoked_at !== null || row.session_status !== "active") {
+    throw new HttpError(401, "token_invalid", "The refresh token is expired or revoked.");
+  }
+  if (row.user_status !== "active") throw new HttpError(403, "account_suspended", "The account is not active.");
+
+  const nextId = crypto.randomUUID();
+  const nextToken = randomToken();
+  const nextHash = await opaqueHash(config, "refresh-token", nextToken);
+  let rotationResults: D1Result<unknown>[];
+  try {
+    rotationResults = await env.DB.batch([
+      env.DB.prepare(
+        `UPDATE refresh_tokens SET status = 'rotated', used_at = ?, rotated_to_id = ?
+          WHERE id = ? AND status = 'active'`,
+      ).bind(nowMs, nextId, row.id),
+      env.DB.prepare(
+        `INSERT INTO refresh_tokens (id, family_id, token_hash, status, created_at, expires_at)
+         VALUES (?, ?, ?, 'active', ?, ?)`,
+      ).bind(nextId, row.family_id, nextHash, nowMs, row.expires_at),
+    ]);
+  } catch {
+    const current = await refreshRow(env, config, body.refreshToken);
+    if (current !== null && current.status !== "active") {
+      await revokeFamily(env, current, nowMs, "concurrent_refresh_reuse");
+      throw new HttpError(401, "token_invalid", "The refresh-token family was revoked.");
+    }
+    throw new HttpError(503, "temporarily_unavailable", "The session could not be refreshed.", { "Retry-After": "5" });
+  }
+  if ((rotationResults[0]?.meta.changes ?? 0) !== 1) {
+    await revokeFamily(env, row, nowMs, "concurrent_refresh_reuse");
+    throw new HttpError(401, "token_invalid", "The refresh-token family was revoked.");
+  }
+  const access = await issueAccessToken(config, row.steam_id64, row.session_id, nowMs);
+  return jsonResponse(tokenResponse(access.token, access.expiresAtMs, nextToken, nowMs, access.scope), 200, requestId);
+}
+
+export async function logoutSession(
+  request: Request,
+  env: Env,
+  config: RuntimeConfig,
+  requestId: string,
+  nowMs: number,
+): Promise<Response> {
+  const body = await readJsonObject(request, 4096);
+  if (!hasOnlyKeys(body, ["refreshToken"]) || typeof body.refreshToken !== "string") {
+    throw new HttpError(400, "invalid_request", "The refresh token is malformed.");
+  }
+  const row = body.refreshToken.length === 43 ? await refreshRow(env, config, body.refreshToken) : null;
+  if (row !== null) await revokeFamily(env, row, nowMs, "logout");
+  return emptyResponse(204, requestId);
+}
+
+export async function authenticate(
+  request: Request,
+  env: Env,
+  config: RuntimeConfig,
+  requiredScope: "maps:read" | "maps:download" | "maps:upload" | "maps:manage" | "maps:report" | "maps:moderate",
+  nowMs: number,
+): Promise<AuthPrincipal> {
+  const authorization = request.headers.get("Authorization");
+  if (authorization === null || !authorization.startsWith("Bearer ")) {
+    throw new HttpError(401, "auth_required", "A bearer access token is required.", {
+      "WWW-Authenticate": 'Bearer realm="ss2revive-community"',
+    });
+  }
+  const token = authorization.slice(7);
+  if (token.length < 32 || token.length > 4096) {
+    throw new HttpError(401, "token_invalid", "The access token is invalid.");
+  }
+  const principal = await verifyAccessToken(config, token, requiredScope, nowMs);
+  const row = await env.DB.prepare(
+    `SELECT s.status AS session_status, s.expires_at, u.status AS user_status
+       FROM auth_sessions s JOIN users u ON u.steam_id64 = s.steam_id64
+      WHERE s.id = ? AND s.steam_id64 = ?`,
+  ).bind(principal.sessionId, principal.steamId64).first<{
+    session_status: "active" | "revoked";
+    expires_at: number;
+    user_status: "active" | "suspended" | "deleted";
+  }>();
+  if (row === null || row.session_status !== "active" || row.expires_at <= nowMs) {
+    throw new HttpError(401, "token_invalid", "The access session is expired or revoked.");
+  }
+  if (row.user_status !== "active") throw new HttpError(403, "account_suspended", "The account is not active.");
+  return principal;
+}
+
+export async function approveLocalDeviceByCode(
+  env: Env,
+  config: RuntimeConfig,
+  code: string,
+  nowMs: number,
+): Promise<boolean> {
+  if (!config.allowMockAuth || !isSteamId64(config.mockSteamId64) || !/^[A-Z2-9]{4}-[A-Z2-9]{4}$/.test(code)) {
+    return false;
+  }
+  const codeHash = await opaqueHash(config, "user-code", code);
+  await env.DB.prepare(
+    `INSERT INTO users (steam_id64, status, created_at, last_login_at)
+     VALUES (?, 'active', ?, ?)
+     ON CONFLICT(steam_id64) DO NOTHING`,
+  ).bind(config.mockSteamId64, nowMs, nowMs).run();
+  const updated = await env.DB.prepare(
+    `UPDATE device_auth_sessions
+        SET status = 'approved', steam_id64 = ?, approved_at = ?
+      WHERE user_code_hash = ? AND status = 'pending' AND expires_at > ?
+      RETURNING id`,
+  ).bind(config.mockSteamId64, nowMs, codeHash, nowMs).first<{ id: string }>();
+  return updated !== null;
+}
+
+function escapeHtml(value: string): string {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+
+export async function localActivationPage(
+  request: Request,
+  env: Env,
+  config: RuntimeConfig,
+  requestId: string,
+  nowMs: number,
+): Promise<Response> {
+  if (!config.allowMockAuth) throw new HttpError(404, "not_found", "The route was not found.");
+  let code = new URL(request.url).searchParams.get("user_code")?.toUpperCase() ?? "";
+  let message = "This page is available only in local development.";
+  if (request.method === "POST") {
+    const contentType = request.headers.get("Content-Type")?.split(";", 1)[0]?.trim().toLowerCase();
+    if (contentType !== "application/x-www-form-urlencoded") {
+      throw new HttpError(415, "invalid_request", "The activation form has an invalid content type.");
+    }
+    const body = await readBoundedBody(request, 4096);
+    code = new URLSearchParams(new TextDecoder().decode(body)).get("user_code")?.toUpperCase() ?? "";
+    message = await approveLocalDeviceByCode(env, config, code, nowMs)
+      ? `Approved local Steam user ${config.mockSteamId64}. Return to the client.`
+      : "The code is invalid, expired, or already used.";
+  } else if (request.method !== "GET") {
+    throw new HttpError(405, "method_not_allowed", "The method is not allowed.", { Allow: "GET, POST" });
+  }
+  const html = `<!doctype html><html><head><meta charset="utf-8"><title>SS2Revive local activation</title></head>
+<body><main><h1>SS2Revive local activation</h1><p>${escapeHtml(message)}</p>
+<form method="post" action="/activate"><label>Code <input name="user_code" value="${escapeHtml(code)}" pattern="[A-Z2-9]{4}-[A-Z2-9]{4}" required></label>
+<button type="submit">Approve local test device</button></form></main></body></html>`;
+  const headers = responseHeaders(requestId, {
+    "Content-Type": "text/html; charset=utf-8",
+    "Content-Security-Policy": "default-src 'none'; form-action 'self'; frame-ancestors 'none'",
+  });
+  return new Response(html, { status: 200, headers });
+}
diff --git a/backend/community-api/src/community-controls.ts b/backend/community-api/src/community-controls.ts
new file mode 100644
index 0000000..29996fb
--- /dev/null
+++ b/backend/community-api/src/community-controls.ts
@@ -0,0 +1,328 @@
+import {
+  hasOnlyKeys,
+  isCanonicalUuid,
+  type AuthPrincipal,
+} from "@ss2revive/community-contracts";
+import type { RuntimeConfig } from "./config";
+import { purgeMapCache } from "./edge-cache";
+import { emptyResponse, HttpError, jsonResponse, readJsonObject, requireMethod } from "./http";
+
+const REPORT_REASONS = new Set([
+  "BROKEN",
+  "NSFW_CONTENT",
+  "COPY",
+  "LEVEL_DESIGN_COPYRIGHT",
+  "FARMING",
+  "OTHER",
+]);
+const MAX_REPORTS_PER_DAY = 20;
+
+interface OwnershipRow {
+  owner_steam_id64: string | null;
+  creator_ids_json: string;
+  status: "published" | "unpublished" | "archived";
+  current_revision: number;
+}
+
+interface ModerationReportRow {
+  id: string;
+  map_id: string;
+  title: string;
+  reporter_steam_id64: string;
+  reason: string;
+  note: string;
+  created_at: number;
+}
+
+function gamePlayerId(steamId64: string): string {
+  return `STEAM-${steamId64}`.padEnd(36, "-");
+}
+
+function creatorIds(text: string): string[] {
+  try {
+    const value = JSON.parse(text) as unknown;
+    return Array.isArray(value) && value.every((item) => typeof item === "string") ? value : [];
+  } catch {
+    return [];
+  }
+}
+
+async function ownershipRow(env: Env, mapId: string): Promise<OwnershipRow | null> {
+  return env.DB.prepare(
+    `SELECT m.owner_steam_id64, m.status, m.current_revision, v.creator_ids_json
+       FROM maps m
+       JOIN map_versions v ON v.map_id = m.id AND v.revision = m.current_revision
+      WHERE m.id = ?`,
+  ).bind(mapId).first<OwnershipRow>();
+}
+
+async function requireOwner(env: Env, mapId: string, steamId64: string): Promise<OwnershipRow> {
+  if (!isCanonicalUuid(mapId)) throw new HttpError(404, "map_not_found", "The map was not found.");
+  const row = await ownershipRow(env, mapId);
+  if (row === null) throw new HttpError(404, "map_not_found", "The map was not found.");
+  if (row.owner_steam_id64 === steamId64) return row;
+  if (row.owner_steam_id64 === null && creatorIds(row.creator_ids_json).includes(gamePlayerId(steamId64))) {
+    const repaired = await env.DB.prepare(
+      `UPDATE maps SET owner_steam_id64 = ? WHERE id = ? AND owner_steam_id64 IS NULL`,
+    ).bind(steamId64, mapId).run();
+    if ((repaired.meta.changes ?? 0) === 1) return { ...row, owner_steam_id64: steamId64 };
+    const reread = await ownershipRow(env, mapId);
+    if (reread?.owner_steam_id64 === steamId64) return reread;
+  }
+  throw new HttpError(403, "map_owner_required", "Only the map owner can change this publication.");
+}
+
+async function readEmptyObject(request: Request): Promise<void> {
+  const body = await readJsonObject(request, 1024);
+  if (!hasOnlyKeys(body, []) || Object.keys(body).length !== 0) {
+    throw new HttpError(400, "invalid_request", "The request body must be an empty object.");
+  }
+}
+
+export async function unpublishOwnMap(
+  request: Request,
+  env: Env,
+  config: RuntimeConfig,
+  ctx: ExecutionContext,
+  principal: AuthPrincipal,
+  mapId: string,
+  requestId: string,
+  nowMs: number,
+): Promise<Response> {
+  requireMethod(request, "POST");
+  await readEmptyObject(request);
+  const row = await requireOwner(env, mapId, principal.steamId64);
+  if (row.status !== "published") {
+    throw new HttpError(409, "map_not_published", "The map is not currently published.");
+  }
+  const results = await env.DB.batch([
+    env.DB.prepare(
+      `UPDATE maps SET status = 'unpublished', unpublished_at_ms = ?, archived_at_ms = NULL
+        WHERE id = ? AND owner_steam_id64 = ? AND status = 'published'`,
+    ).bind(nowMs, mapId, principal.steamId64),
+    env.DB.prepare(
+      `UPDATE map_versions SET status = 'unpublished' WHERE map_id = ? AND revision = ?`,
+    ).bind(mapId, row.current_revision),
+  ]);
+  if ((results[0]?.meta.changes ?? 0) !== 1) {
+    throw new HttpError(409, "map_state_changed", "The map state changed before it could be unpublished.");
+  }
+  purgeMapCache(ctx, config, mapId, [row.current_revision]);
+  return jsonResponse({ requestId, mapId, status: "unpublished" }, 200, requestId, {
+    "Cache-Control": "no-store",
+  });
+}
+
+export async function archiveOwnMap(
+  request: Request,
+  env: Env,
+  config: RuntimeConfig,
+  ctx: ExecutionContext,
+  principal: AuthPrincipal,
+  mapId: string,
+  requestId: string,
+  nowMs: number,
+): Promise<Response> {
+  requireMethod(request, "DELETE");
+  if (request.body !== null || Number(request.headers.get("Content-Length") ?? "0") !== 0) {
+    throw new HttpError(400, "invalid_request", "The delete request must not have a body.");
+  }
+  const row = await requireOwner(env, mapId, principal.steamId64);
+  if (row.status === "archived") return emptyResponse(204, requestId);
+  const results = await env.DB.batch([
+    env.DB.prepare(
+      `UPDATE maps SET status = 'archived', archived_at_ms = ?, unpublished_at_ms = COALESCE(unpublished_at_ms, ?)
+        WHERE id = ? AND owner_steam_id64 = ? AND status != 'archived'`,
+    ).bind(nowMs, nowMs, mapId, principal.steamId64),
+    env.DB.prepare(
+      `UPDATE map_versions SET status = 'unpublished' WHERE map_id = ? AND revision = ?`,
+    ).bind(mapId, row.current_revision),
+  ]);
+  if ((results[0]?.meta.changes ?? 0) !== 1) {
+    throw new HttpError(409, "map_state_changed", "The map state changed before it could be archived.");
+  }
+  purgeMapCache(ctx, config, mapId, [row.current_revision]);
+  return emptyResponse(204, requestId);
+}
+
+export async function reportMap(
+  request: Request,
+  env: Env,
+  principal: AuthPrincipal,
+  mapId: string,
+  requestId: string,
+  nowMs: number,
+): Promise<Response> {
+  requireMethod(request, "POST");
+  if (!isCanonicalUuid(mapId)) throw new HttpError(404, "map_not_found", "The map was not found.");
+  const body = await readJsonObject(request, 2048);
+  if (!hasOnlyKeys(body, ["reason", "note"]) || typeof body.reason !== "string" ||
+      !REPORT_REASONS.has(body.reason) ||
+      (body.note !== undefined && (typeof body.note !== "string" || body.note.length > 512 ||
+        /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/u.test(body.note)))) {
+    throw new HttpError(400, "invalid_request", "The report reason or note is invalid.");
+  }
+  const map = await ownershipRow(env, mapId);
+  if (map === null || map.status !== "published") {
+    throw new HttpError(404, "map_not_found", "The map was not found.");
+  }
+  if (map.owner_steam_id64 === principal.steamId64 ||
+      (map.owner_steam_id64 === null && creatorIds(map.creator_ids_json).includes(gamePlayerId(principal.steamId64)))) {
+    throw new HttpError(409, "cannot_report_own_map", "A creator cannot report their own map.");
+  }
+  const dayStart = Date.parse(`${new Date(nowMs).toISOString().slice(0, 10)}T00:00:00.000Z`);
+  const daily = await env.DB.prepare(
+    `SELECT COUNT(*) AS count FROM map_reports WHERE reporter_steam_id64 = ? AND created_at >= ?`,
+  ).bind(principal.steamId64, dayStart).first<{ count: number }>();
+  if (daily === null || !Number.isSafeInteger(daily.count)) {
+    throw new HttpError(503, "temporarily_unavailable", "The report quota could not be checked.");
+  }
+  if (daily.count >= MAX_REPORTS_PER_DAY) {
+    throw new HttpError(429, "daily_report_limit_reached", "The daily report limit has been reached.", {
+      "Retry-After": String(Math.max(60, Math.ceil((dayStart + 86_400_000 - nowMs) / 1000))),
+    });
+  }
+  const reportId = crypto.randomUUID();
+  await env.DB.prepare(
+    `INSERT INTO map_reports
+       (id, map_id, reporter_steam_id64, reason, note, status, created_at)
+     VALUES (?, ?, ?, ?, ?, 'open', ?)
+     ON CONFLICT(map_id, reporter_steam_id64) DO UPDATE SET
+       reason = excluded.reason, note = excluded.note, status = 'open', created_at = excluded.created_at,
+       resolved_at = NULL, resolved_by_steam_id64 = NULL, resolution = NULL`,
+  ).bind(reportId, mapId, principal.steamId64, body.reason, body.note ?? "", nowMs).run();
+  return jsonResponse({ requestId, mapId, status: "reported" }, 201, requestId, {
+    "Cache-Control": "no-store",
+  });
+}
+
+function requireMaintainer(config: RuntimeConfig, principal: AuthPrincipal): void {
+  if (!principal.scopes.includes("maps:moderate") || !config.maintainerSteamIds.has(principal.steamId64)) {
+    throw new HttpError(403, "maintainer_required", "Maintainer authorization is required.");
+  }
+}
+
+export async function listOpenReports(
+  request: Request,
+  env: Env,
+  config: RuntimeConfig,
+  principal: AuthPrincipal,
+  requestId: string,
+): Promise<Response> {
+  requireMethod(request, "GET");
+  requireMaintainer(config, principal);
+  const url = new URL(request.url);
+  if ([...url.searchParams.keys()].some((key) => key !== "limit")) {
+    throw new HttpError(400, "invalid_request", "The report query contains an unsupported field.");
+  }
+  const limitText = url.searchParams.get("limit") ?? "50";
+  if (!/^[1-9][0-9]*$/u.test(limitText) || Number(limitText) > 100) {
+    throw new HttpError(400, "invalid_request", "limit must be between 1 and 100.");
+  }
+  const result = await env.DB.prepare(
+    `SELECT r.id, r.map_id, m.title, r.reporter_steam_id64, r.reason, r.note, r.created_at
+       FROM map_reports r JOIN maps m ON m.id = r.map_id
+      WHERE r.status = 'open' ORDER BY r.created_at ASC LIMIT ?`,
+  ).bind(Number(limitText)).all<ModerationReportRow>();
+  return jsonResponse({ requestId, items: result.results.map((row) => ({
+    id: row.id,
+    mapId: row.map_id,
+    title: row.title,
+    reporterSteamId64: row.reporter_steam_id64,
+    reason: row.reason,
+    note: row.note,
+    createdAt: new Date(row.created_at).toISOString(),
+  })) }, 200, requestId, { "Cache-Control": "no-store" });
+}
+
+async function moderationAction(
+  request: Request,
+  env: Env,
+  config: RuntimeConfig,
+  ctx: ExecutionContext,
+  principal: AuthPrincipal,
+  mapId: string,
+  action: "takedown" | "restore",
+  requestId: string,
+  nowMs: number,
+): Promise<Response> {
+  requireMethod(request, "POST");
+  requireMaintainer(config, principal);
+  if (!isCanonicalUuid(mapId)) throw new HttpError(404, "map_not_found", "The map was not found.");
+  const body = await readJsonObject(request, 2048);
+  const allowedKeys = action === "takedown" ? ["reason"] : ["reason"];
+  if (!hasOnlyKeys(body, allowedKeys) || typeof body.reason !== "string" ||
+      body.reason.trim().length < 1 || body.reason.length > 256 ||
+      /[\u0000-\u001f\u007f-\u009f]/u.test(body.reason)) {
+    throw new HttpError(400, "invalid_request", "A bounded moderation reason is required.");
+  }
+  const map = await ownershipRow(env, mapId);
+  if (map === null) throw new HttpError(404, "map_not_found", "The map was not found.");
+  // Restore undoes a maintainer takedown; it must not resurrect a map the owner themselves
+  // unpublished or deleted, and it must not republish something no takedown ever removed.
+  if (action === "restore") {
+    const moderated = await env.DB.prepare(
+      `SELECT moderation_reason FROM maps WHERE id = ? AND moderation_reason IS NOT NULL`,
+    ).bind(mapId).first<{ moderation_reason: string }>();
+    if (moderated === null) {
+      throw new HttpError(409, "map_not_moderated", "This map is not under a maintainer takedown.");
+    }
+  }
+  const nextStatus = action === "takedown" ? "archived" : "published";
+  const versionStatus = action === "takedown" ? "unpublished" : "published";
+  const eventId = crypto.randomUUID();
+  const results = await env.DB.batch([
+    env.DB.prepare(
+      `UPDATE maps SET status = ?, moderation_reason = ?,
+                       archived_at_ms = CASE WHEN ? = 'archived' THEN ? ELSE NULL END,
+                       unpublished_at_ms = CASE WHEN ? = 'archived' THEN COALESCE(unpublished_at_ms, ?) ELSE NULL END
+        WHERE id = ? AND (? = 'archived' OR moderation_reason IS NOT NULL)`,
+    ).bind(nextStatus, action === "takedown" ? body.reason.trim() : null,
+      nextStatus, nowMs, nextStatus, nowMs, mapId, nextStatus),
+    env.DB.prepare(
+      `UPDATE map_versions SET status = ? WHERE map_id = ? AND revision = ?`,
+    ).bind(versionStatus, mapId, map.current_revision),
+    env.DB.prepare(
+      `INSERT INTO moderation_events
+         (id, map_id, maintainer_steam_id64, action, reason, created_at)
+       VALUES (?, ?, ?, ?, ?, ?)`,
+    ).bind(eventId, mapId, principal.steamId64, action, body.reason.trim(), nowMs),
+    env.DB.prepare(
+      `UPDATE map_reports SET status = 'resolved', resolved_at = ?, resolved_by_steam_id64 = ?, resolution = ?
+        WHERE map_id = ? AND status = 'open'`,
+    ).bind(nowMs, principal.steamId64, `${action}: ${body.reason.trim()}`.slice(0, 512), mapId),
+  ]);
+  if ((results[0]?.meta.changes ?? 0) !== 1) {
+    throw new HttpError(409, "map_state_changed", "The map state changed before moderation completed.");
+  }
+  purgeMapCache(ctx, config, mapId, [map.current_revision]);
+  return jsonResponse({ requestId, mapId, status: nextStatus }, 200, requestId, {
+    "Cache-Control": "no-store",
+  });
+}
+
+export function takedownMap(
+  request: Request,
+  env: Env,
+  config: RuntimeConfig,
+  ctx: ExecutionContext,
+  principal: AuthPrincipal,
+  mapId: string,
+  requestId: string,
+  nowMs: number,
+): Promise<Response> {
+  return moderationAction(request, env, config, ctx, principal, mapId, "takedown", requestId, nowMs);
+}
+
+export function restoreMap(
+  request: Request,
+  env: Env,
+  config: RuntimeConfig,
+  ctx: ExecutionContext,
+  principal: AuthPrincipal,
+  mapId: string,
+  requestId: string,
+  nowMs: number,
+): Promise<Response> {
+  return moderationAction(request, env, config, ctx, principal, mapId, "restore", requestId, nowMs);
+}
diff --git a/backend/community-api/src/config.ts b/backend/community-api/src/config.ts
new file mode 100644
index 0000000..2c8956a
--- /dev/null
+++ b/backend/community-api/src/config.ts
@@ -0,0 +1,116 @@
+import { isSteamId64 } from "@ss2revive/community-contracts";
+import { HttpError } from "./http";
+
+export interface RuntimeConfig {
+  environment: "local" | "staging" | "production";
+  allowMockAuth: boolean;
+  issuer: string;
+  audience: string;
+  authSecret: string;
+  mockSteamId64: string;
+  publicOrigin: string;
+  uploadDailyLimit: number;
+  uploadDailyBytes: number;
+  retainedBytesPerAccount: number;
+  mapsPerAccountLimit: number;
+  maintainerSteamIds: ReadonlySet<string>;
+}
+
+function isBase64Secret(value: unknown): value is string {
+  if (typeof value !== "string" || !/^[A-Za-z0-9+/]{43}=$/u.test(value)) return false;
+  try {
+    return atob(value).length === 32;
+  } catch {
+    return false;
+  }
+}
+
+function boundedInteger(value: unknown, minimum: number, maximum: number): number | null {
+  if (typeof value !== "string" || !/^[1-9][0-9]*$/u.test(value)) return null;
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) && parsed >= minimum && parsed <= maximum ? parsed : null;
+}
+
+function validPublicOrigin(value: unknown, environment: RuntimeConfig["environment"]): value is string {
+  if (typeof value !== "string" || value.length > 256) return false;
+  try {
+    const url = new URL(value);
+    if (url.origin !== value || url.username !== "" || url.password !== "") return false;
+    if (environment === "local") {
+      return url.protocol === "http:" &&
+        (url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "[::1]");
+    }
+    return url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
+export function runtimeConfig(env: Env): RuntimeConfig {
+  if (env.ENVIRONMENT !== "local" && env.ENVIRONMENT !== "staging" && env.ENVIRONMENT !== "production") {
+    throw new HttpError(503, "temporarily_unavailable", "The service configuration is invalid.");
+  }
+  const authSecret = env.ENVIRONMENT === "local" ? env.LOCAL_AUTH_SECRET : env.AUTH_SIGNING_SECRET;
+  if (!isBase64Secret(authSecret)) {
+    throw new HttpError(503, "temporarily_unavailable", "The authentication signing secret is not configured.");
+  }
+  if (
+    typeof env.AUTH_ISSUER !== "string" || typeof env.AUTH_AUDIENCE !== "string" ||
+    env.AUTH_ISSUER.length < 1 || env.AUTH_ISSUER.length > 256 ||
+    env.AUTH_AUDIENCE.length < 1 || env.AUTH_AUDIENCE.length > 128 ||
+    /[\u0000-\u001f\u007f-\u009f]/u.test(env.AUTH_ISSUER) ||
+    /[\u0000-\u001f\u007f-\u009f]/u.test(env.AUTH_AUDIENCE)
+  ) {
+    throw new HttpError(503, "temporarily_unavailable", "The authentication token configuration is invalid.");
+  }
+  const allowMockAuth = env.ENVIRONMENT === "local" && env.ALLOW_MOCK_AUTH === "true";
+  if (allowMockAuth && !isSteamId64(env.MOCK_STEAM_ID64)) {
+    throw new HttpError(503, "temporarily_unavailable", "The local Steam identity is invalid.");
+  }
+  if (!validPublicOrigin(env.PUBLIC_ORIGIN, env.ENVIRONMENT)) {
+    throw new HttpError(503, "temporarily_unavailable", "The public origin configuration is invalid.");
+  }
+  const uploadDailyLimit = boundedInteger(env.UPLOAD_DAILY_LIMIT, 1, 50);
+  const mapsPerAccountLimit = boundedInteger(env.MAPS_PER_ACCOUNT_LIMIT, 1, 200);
+  const uploadDailyBytes = boundedInteger(env.UPLOAD_DAILY_BYTES, 1024 * 1024, 8 * 1024 * 1024 * 1024);
+  const retainedBytesPerAccount = boundedInteger(
+    env.RETAINED_BYTES_PER_ACCOUNT,
+    1024 * 1024,
+    64 * 1024 * 1024 * 1024,
+  );
+  if (
+    uploadDailyLimit === null || mapsPerAccountLimit === null ||
+    uploadDailyBytes === null || retainedBytesPerAccount === null
+  ) {
+    throw new HttpError(503, "temporarily_unavailable", "The publishing quota configuration is invalid.");
+  }
+  if (typeof env.MAINTAINER_STEAM_IDS !== "string" || env.MAINTAINER_STEAM_IDS.length > 1024) {
+    throw new HttpError(503, "temporarily_unavailable", "The maintainer configuration is invalid.");
+  }
+  const maintainerSteamIds = new Set<string>();
+  for (const value of env.MAINTAINER_STEAM_IDS.split(",")) {
+    const steamId64 = value.trim();
+    if (steamId64 === "") continue;
+    if (!isSteamId64(steamId64)) {
+      throw new HttpError(503, "temporarily_unavailable", "The maintainer configuration is invalid.");
+    }
+    maintainerSteamIds.add(steamId64);
+  }
+  if (maintainerSteamIds.size === 0) {
+    throw new HttpError(503, "temporarily_unavailable", "No community maintainer is configured.");
+  }
+  return {
+    environment: env.ENVIRONMENT,
+    allowMockAuth,
+    issuer: env.AUTH_ISSUER,
+    audience: env.AUTH_AUDIENCE,
+    authSecret,
+    mockSteamId64: env.MOCK_STEAM_ID64,
+    publicOrigin: env.PUBLIC_ORIGIN,
+    uploadDailyLimit,
+    uploadDailyBytes,
+    retainedBytesPerAccount,
+    mapsPerAccountLimit,
+    maintainerSteamIds,
+  };
+}
diff --git a/backend/community-api/src/crypto.ts b/backend/community-api/src/crypto.ts
new file mode 100644
index 0000000..0e9f622
--- /dev/null
+++ b/backend/community-api/src/crypto.ts
@@ -0,0 +1,161 @@
+import type { AuthPrincipal } from "@ss2revive/community-contracts";
+import { isPlainObject, isSteamId64 } from "@ss2revive/community-contracts";
+import type { RuntimeConfig } from "./config";
+import { HttpError } from "./http";
+
+const encoder = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { fatal: true });
+
+function base64UrlEncode(bytes: Uint8Array): string {
+  let binary = "";
+  for (let offset = 0; offset < bytes.length; offset += 0x8000) {
+    binary += String.fromCharCode(...bytes.subarray(offset, Math.min(bytes.length, offset + 0x8000)));
+  }
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+}
+
+function base64UrlDecode(value: string): Uint8Array | null {
+  if (!/^[A-Za-z0-9_-]+$/.test(value)) return null;
+  const padding = "=".repeat((4 - (value.length % 4)) % 4);
+  try {
+    const binary = atob(value.replaceAll("-", "+").replaceAll("_", "/") + padding);
+    const decoded = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+    return base64UrlEncode(decoded) === value ? decoded : null;
+  } catch {
+    return null;
+  }
+}
+
+async function hmac(secret: string, value: string): Promise<Uint8Array> {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  return new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(value)));
+}
+
+function constantTimeEqual(left: Uint8Array, right: Uint8Array): boolean {
+  let difference = left.length ^ right.length;
+  const maximum = Math.max(left.length, right.length);
+  for (let index = 0; index < maximum; index += 1) {
+    difference |= (left[index] ?? 0) ^ (right[index] ?? 0);
+  }
+  return difference === 0;
+}
+
+export function randomToken(bytes = 32): string {
+  const value = new Uint8Array(bytes);
+  crypto.getRandomValues(value);
+  return base64UrlEncode(value);
+}
+
+export async function opaqueHash(config: RuntimeConfig, context: string, value: string): Promise<string> {
+  return base64UrlEncode(await hmac(config.authSecret, `${context}\u0000${value}`));
+}
+
+interface AccessClaims {
+  iss: string;
+  aud: string;
+  sub: string;
+  sid: string;
+  scope: string;
+  iat: number;
+  exp: number;
+}
+
+export async function issueAccessToken(
+  config: RuntimeConfig,
+  steamId64: string,
+  sessionId: string,
+  nowMs: number,
+): Promise<{ token: string; expiresAtMs: number; scope: string }> {
+  const header = base64UrlEncode(encoder.encode(JSON.stringify({ alg: "HS256", typ: "JWT" })));
+  const expiresAtMs = nowMs + 15 * 60 * 1000;
+  const scopes = ["maps:read", "maps:download", "maps:upload", "maps:manage", "maps:report"];
+  if (config.maintainerSteamIds.has(steamId64)) scopes.push("maps:moderate");
+  const scope = scopes.join(" ");
+  const claims: AccessClaims = {
+    iss: config.issuer,
+    aud: config.audience,
+    sub: steamId64,
+    sid: sessionId,
+    scope,
+    iat: Math.floor(nowMs / 1000),
+    exp: Math.floor(expiresAtMs / 1000),
+  };
+  const payload = base64UrlEncode(encoder.encode(JSON.stringify(claims)));
+  const signature = base64UrlEncode(await hmac(config.authSecret, `${header}.${payload}`));
+  return { token: `${header}.${payload}.${signature}`, expiresAtMs, scope };
+}
+
+export async function verifyAccessToken(
+  config: RuntimeConfig,
+  token: string,
+  requiredScope: string,
+  nowMs: number,
+): Promise<AuthPrincipal> {
+  const parts = token.split(".");
+  if (parts.length !== 3) throw new HttpError(401, "token_invalid", "The access token is invalid.");
+  const [headerText, payloadText, signatureText] = parts as [string, string, string];
+  const signature = base64UrlDecode(signatureText);
+  const expected = await hmac(config.authSecret, `${headerText}.${payloadText}`);
+  if (signature === null || !constantTimeEqual(signature, expected)) {
+    throw new HttpError(401, "token_invalid", "The access token is invalid.");
+  }
+  const headerBytes = base64UrlDecode(headerText);
+  const payloadBytes = base64UrlDecode(payloadText);
+  if (headerBytes === null || payloadBytes === null) {
+    throw new HttpError(401, "token_invalid", "The access token is invalid.");
+  }
+  let header: unknown;
+  let claims: unknown;
+  try {
+    header = JSON.parse(decoder.decode(headerBytes)) as unknown;
+    claims = JSON.parse(decoder.decode(payloadBytes)) as unknown;
+  } catch {
+    throw new HttpError(401, "token_invalid", "The access token is invalid.");
+  }
+  if (!isPlainObject(header) || header.alg !== "HS256" || header.typ !== "JWT" || !isPlainObject(claims)) {
+    throw new HttpError(401, "token_invalid", "The access token is invalid.");
+  }
+  if (
+    claims.iss !== config.issuer || claims.aud !== config.audience || !isSteamId64(claims.sub) ||
+    typeof claims.sid !== "string" || !/^[0-9a-f-]{36}$/.test(claims.sid) ||
+    typeof claims.scope !== "string" || !Number.isSafeInteger(claims.iat) || !Number.isSafeInteger(claims.exp) ||
+    (claims.exp as number) <= Math.floor(nowMs / 1000) || (claims.iat as number) > Math.floor(nowMs / 1000) + 60
+  ) {
+    throw new HttpError(401, "token_invalid", "The access token is invalid or expired.");
+  }
+  const scopes = claims.scope.split(" ").filter(Boolean);
+  if (!scopes.includes(requiredScope)) throw new HttpError(403, "scope_denied", "The token lacks the required scope.");
+  return { steamId64: claims.sub, sessionId: claims.sid, scopes };
+}
+
+export async function signedValue(config: RuntimeConfig, context: string, payload: unknown): Promise<string> {
+  const body = base64UrlEncode(encoder.encode(JSON.stringify(payload)));
+  const signature = base64UrlEncode(await hmac(config.authSecret, `${context}\u0000${body}`));
+  return `${body}.${signature}`;
+}
+
+export async function verifySignedValue(
+  config: RuntimeConfig,
+  context: string,
+  value: string,
+): Promise<Record<string, unknown> | null> {
+  const separator = value.lastIndexOf(".");
+  if (separator < 1) return null;
+  const body = value.slice(0, separator);
+  const supplied = base64UrlDecode(value.slice(separator + 1));
+  const expected = await hmac(config.authSecret, `${context}\u0000${body}`);
+  const decoded = base64UrlDecode(body);
+  if (supplied === null || decoded === null || !constantTimeEqual(supplied, expected)) return null;
+  try {
+    const result = JSON.parse(decoder.decode(decoded)) as unknown;
+    return isPlainObject(result) ? result : null;
+  } catch {
+    return null;
+  }
+}
diff --git a/backend/community-api/src/downloads.ts b/backend/community-api/src/downloads.ts
new file mode 100644
index 0000000..53c2d31
--- /dev/null
+++ b/backend/community-api/src/downloads.ts
@@ -0,0 +1,157 @@
+import { isSha256, MAX_BUNDLE_BYTES, MAX_IMAGE_BYTES } from "@ss2revive/community-contracts";
+import { cachedObjectBody } from "./edge-cache";
+import { emptyResponse, HttpError, responseHeaders } from "./http";
+import { downloadableVersion, type MapRow } from "./maps";
+
+/** Takedowns must reach shared caches promptly, so published objects cache only briefly. */
+const DOWNLOAD_CACHE_SECONDS = 300;
+
+interface ByteRange {
+  offset: number;
+  length: number;
+}
+
+function etagMatches(header: string | null, etag: string): boolean {
+  if (header === null) return false;
+  return header.split(",").map((value) => value.trim()).some((value) => value === "*" || value === etag);
+}
+
+function parseRange(header: string, total: number): ByteRange | null {
+  if (!header.startsWith("bytes=") || header.includes(",")) return null;
+  const value = header.slice(6);
+  const match = /^(\d*)-(\d*)$/.exec(value);
+  if (match === null) return null;
+  const startText = match[1] ?? "";
+  const endText = match[2] ?? "";
+  if (startText === "" && endText === "") return null;
+  if (startText === "") {
+    if (!/^[1-9][0-9]*$/.test(endText)) return null;
+    const suffix = Number(endText);
+    if (!Number.isSafeInteger(suffix) || suffix < 1) return null;
+    const length = Math.min(suffix, total);
+    return { offset: total - length, length };
+  }
+  if (!/^(?:0|[1-9][0-9]*)$/.test(startText)) return null;
+  const start = Number(startText);
+  if (!Number.isSafeInteger(start) || start >= total) return null;
+  if (endText === "") return { offset: start, length: total - start };
+  if (!/^(?:0|[1-9][0-9]*)$/.test(endText)) return null;
+  const requestedEnd = Number(endText);
+  if (!Number.isSafeInteger(requestedEnd) || requestedEnd < start) return null;
+  const end = Math.min(requestedEnd, total - 1);
+  return { offset: start, length: end - start + 1 };
+}
+
+function objectMetadata(row: MapRow, kind: "bundle" | "thumbnail"): {
+  key: string;
+  size: number;
+  sha256: string;
+  contentType: string;
+  disposition?: string;
+} {
+  if (kind === "bundle") {
+    return {
+      key: row.bundle_key,
+      size: row.size_bytes,
+      sha256: row.sha256,
+      contentType: "application/vnd.ss2revive.level",
+      disposition: `attachment; filename="map-${row.id}-r${row.revision}.ss2level"`,
+    };
+  }
+  if (row.thumbnail_key === null || row.thumbnail_size_bytes === null || row.thumbnail_sha256 === null) {
+    throw new HttpError(404, "revision_not_found", "The map thumbnail was not found.");
+  }
+  return {
+    key: row.thumbnail_key,
+    size: row.thumbnail_size_bytes,
+    sha256: row.thumbnail_sha256,
+    contentType: "application/octet-stream",
+  };
+}
+
+export async function downloadObject(
+  request: Request,
+  env: Env,
+  ctx: ExecutionContext,
+  mapId: string,
+  revision: number,
+  kind: "bundle" | "thumbnail",
+  requestId: string,
+): Promise<Response> {
+  if (request.method !== "GET" && request.method !== "HEAD") {
+    throw new HttpError(405, "method_not_allowed", "The method is not allowed.", { Allow: "GET, HEAD" });
+  }
+  const row = await downloadableVersion(env, mapId, revision);
+  const metadata = objectMetadata(row, kind);
+  const maximumSize = kind === "bundle" ? MAX_BUNDLE_BYTES : MAX_IMAGE_BYTES;
+  if (metadata.size < 1 || metadata.size > maximumSize || !isSha256(metadata.sha256) || metadata.key.length > 512) {
+    throw new HttpError(503, "object_metadata_mismatch", "The stored object metadata is invalid.", { "Retry-After": "30" });
+  }
+  const etag = `"sha256-${metadata.sha256}"`;
+  if (request.headers.has("If-Match") && !etagMatches(request.headers.get("If-Match"), etag)) {
+    throw new HttpError(412, "etag_mismatch", "The requested object version does not match.");
+  }
+
+  const rangeHeader = request.headers.get("Range");
+  if (etagMatches(request.headers.get("If-None-Match"), etag)) {
+    return emptyResponse(304, requestId, { ETag: etag });
+  }
+  const head = await env.MAP_BUCKET.head(metadata.key);
+  if (head === null || head.size !== metadata.size || head.customMetadata?.sha256 !== metadata.sha256) {
+    throw new HttpError(503, "object_metadata_mismatch", "The stored object failed its metadata check.", { "Retry-After": "30" });
+  }
+
+  let range: ByteRange | null = null;
+  if (rangeHeader !== null && (request.headers.get("If-Range") === null || request.headers.get("If-Range") === etag)) {
+    range = parseRange(rangeHeader, metadata.size);
+    if (range === null) {
+      throw new HttpError(416, "range_not_satisfiable", "The byte range is not satisfiable.", {
+        "Content-Range": `bytes */${metadata.size}`,
+      });
+    }
+  }
+
+  const status = range === null ? 200 : 206;
+  const contentLength = range?.length ?? metadata.size;
+  const headers = responseHeaders(requestId, {
+    "Accept-Ranges": "bytes",
+    // The bytes at (mapId, revision) are immutable, but the *authorization* to serve them is not:
+    // a takedown or unpublish makes this route 404. A year-long immutable directive let shared
+    // caches keep serving removed content long after moderation acted, so keep the window short.
+    "Cache-Control": `public, max-age=${DOWNLOAD_CACHE_SECONDS}, stale-while-revalidate=60`,
+    "Content-Length": String(contentLength),
+    "Content-Type": metadata.contentType,
+    ETag: etag,
+    "X-Content-SHA256": metadata.sha256,
+  });
+  if (metadata.disposition !== undefined) headers.set("Content-Disposition", metadata.disposition);
+  if (range !== null) {
+    headers.set("Content-Range", `bytes ${range.offset}-${range.offset + range.length - 1}/${metadata.size}`);
+  }
+  if (request.method === "HEAD") return new Response(null, { status, headers });
+
+  // Whole-object reads share bytes across every caller, so they are served from the
+  // content-addressed body cache. The D1 authorization lookup above still runs on every request.
+  if (range === null) {
+    const body = await cachedObjectBody(ctx, metadata.sha256, async () => {
+      const object = await env.MAP_BUCKET.get(metadata.key);
+      if (object === null || object.size !== metadata.size || object.customMetadata?.sha256 !== metadata.sha256) {
+        throw new HttpError(503, "object_metadata_mismatch", "The stored object failed its metadata check.", { "Retry-After": "30" });
+      }
+      return object.body;
+    });
+    if (body === null) {
+      throw new HttpError(503, "object_metadata_mismatch", "The stored object failed its metadata check.", { "Retry-After": "30" });
+    }
+    return new Response(body, { status, headers });
+  }
+
+  const object = await env.MAP_BUCKET.get(
+    metadata.key,
+    { range: { offset: range.offset, length: range.length } },
+  );
+  if (object === null || object.size !== metadata.size || object.customMetadata?.sha256 !== metadata.sha256) {
+    throw new HttpError(503, "object_metadata_mismatch", "The stored object failed its metadata check.", { "Retry-After": "30" });
+  }
+  return new Response(object.body, { status, headers });
+}
diff --git a/backend/community-api/src/edge-cache.ts b/backend/community-api/src/edge-cache.ts
new file mode 100644
index 0000000..1ec0d38
--- /dev/null
+++ b/backend/community-api/src/edge-cache.ts
@@ -0,0 +1,83 @@
+import type { RuntimeConfig } from "./config";
+
+/**
+ * A Worker response is not stored in Cloudflare's cache just because it carries a public
+ * Cache-Control directive — the Worker *is* the origin, so every request re-ran the D1 query and
+ * the R2 operations behind it. Reads that are identical for every caller go through the Cache API
+ * explicitly so repeat traffic costs nothing beyond the Worker invocation itself.
+ */
+const edgeCache = (caches as unknown as { default: Cache }).default;
+
+/** Conditional and ranged reads bypass the cache so validator and range semantics stay exact. */
+function isCacheable(request: Request): boolean {
+  return request.method === "GET" &&
+    !request.headers.has("Range") && !request.headers.has("If-Range") &&
+    !request.headers.has("If-None-Match") && !request.headers.has("If-Match") &&
+    !request.headers.has("Authorization");
+}
+
+function cacheKey(url: string): Request {
+  return new Request(url, { method: "GET" });
+}
+
+/**
+ * Cache an approved object's bytes under a content-addressed key rather than under its public URL.
+ * Caching the URL would let a cached 200 outlive the authorization that produced it — a takedown,
+ * an unpublish, or corrupted D1 metadata would keep serving from cache because the database check
+ * no longer ran. Keying on the SHA-256 means the entry is immutable by construction, so the
+ * per-request D1 authorization lookup always happens and only the R2 read is elided.
+ */
+export async function cachedObjectBody(
+  ctx: ExecutionContext,
+  sha256: string,
+  load: () => Promise<ReadableStream | null>,
+): Promise<ReadableStream | null> {
+  const key = cacheKey(`https://object.invalid/sha256/${sha256}`);
+  const hit = await edgeCache.match(key);
+  if (hit?.body != null) return hit.body;
+  const body = await load();
+  if (body === null) return null;
+  const [toCache, toReturn] = body.tee();
+  ctx.waitUntil(edgeCache.put(key, new Response(toCache, {
+    headers: { "Cache-Control": "public, max-age=31536000, immutable" },
+  })));
+  return toReturn;
+}
+
+export async function withEdgeCache(
+  request: Request,
+  ctx: ExecutionContext,
+  handler: () => Promise<Response>,
+): Promise<Response> {
+  if (!isCacheable(request)) return handler();
+  const key = cacheKey(new URL(request.url).toString());
+  const hit = await edgeCache.match(key);
+  if (hit !== undefined) return hit;
+  const response = await handler();
+  if (response.status === 200 && (response.headers.get("Cache-Control") ?? "").includes("public")) {
+    ctx.waitUntil(edgeCache.put(key, response.clone()));
+  }
+  return response;
+}
+
+/**
+ * Drop the cached public views of a map after its publication or moderation state changes, so a
+ * takedown is visible immediately rather than after the cache entry expires.
+ */
+export function purgeMapCache(
+  ctx: ExecutionContext,
+  config: RuntimeConfig,
+  mapId: string,
+  revisions: readonly number[],
+): void {
+  const urls = [
+    `${config.publicOrigin}/v1/catalog`,
+    `${config.publicOrigin}/v1/maps/${mapId}`,
+    `${config.publicOrigin}/v1/maps/${mapId}/versions`,
+  ];
+  for (const revision of revisions) {
+    urls.push(`${config.publicOrigin}/v1/maps/${mapId}/versions/${revision}/download`);
+    urls.push(`${config.publicOrigin}/v1/maps/${mapId}/versions/${revision}/thumbnail`);
+  }
+  ctx.waitUntil(Promise.all(urls.map((url) => edgeCache.delete(cacheKey(url)))).then(() => undefined));
+}
diff --git a/backend/community-api/src/http.ts b/backend/community-api/src/http.ts
new file mode 100644
index 0000000..79bd4d7
--- /dev/null
+++ b/backend/community-api/src/http.ts
@@ -0,0 +1,110 @@
+import type { ApiErrorBody } from "@ss2revive/community-contracts";
+
+export class HttpError extends Error {
+  readonly status: number;
+  readonly code: string;
+  readonly headers: HeadersInit | undefined;
+
+  constructor(status: number, code: string, message: string, headers?: HeadersInit) {
+    super(message);
+    this.name = "HttpError";
+    this.status = status;
+    this.code = code;
+    this.headers = headers;
+  }
+}
+
+const BASE_HEADERS: Record<string, string> = {
+  "Cache-Control": "no-store",
+  "Content-Security-Policy": "default-src 'none'; frame-ancestors 'none'; base-uri 'none'",
+  "Referrer-Policy": "no-referrer",
+  "Permissions-Policy": "camera=(), microphone=(), geolocation=(), payment=(), usb=()",
+  "Cross-Origin-Opener-Policy": "same-origin",
+  "X-Permitted-Cross-Domain-Policies": "none",
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+};
+
+export function responseHeaders(requestId: string, extra?: HeadersInit): Headers {
+  const headers = new Headers(BASE_HEADERS);
+  headers.set("X-Request-Id", requestId);
+  if (extra !== undefined) {
+    const supplied = new Headers(extra);
+    supplied.forEach((value, key) => headers.set(key, value));
+  }
+  return headers;
+}
+
+export function jsonResponse(value: unknown, status: number, requestId: string, extra?: HeadersInit): Response {
+  const text = JSON.stringify(value);
+  const headers = responseHeaders(requestId, extra);
+  headers.set("Content-Type", "application/json; charset=utf-8");
+  return new Response(text, { status, headers });
+}
+
+export function emptyResponse(status: number, requestId: string, extra?: HeadersInit): Response {
+  return new Response(null, { status, headers: responseHeaders(requestId, extra) });
+}
+
+export function errorResponse(error: HttpError, requestId: string): Response {
+  const body: ApiErrorBody = { error: { code: error.code, message: error.message, requestId } };
+  return jsonResponse(body, error.status, requestId, error.headers);
+}
+
+export async function readBoundedBody(request: Request, maximumBytes: number): Promise<Uint8Array> {
+  const declared = request.headers.get("Content-Length");
+  if (declared !== null) {
+    if (!/^(?:0|[1-9][0-9]*)$/.test(declared) || Number(declared) > maximumBytes) {
+      throw new HttpError(413, "invalid_request", "The request body is too large.");
+    }
+  }
+  if (request.body === null) return new Uint8Array();
+  const reader = request.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  try {
+    for (;;) {
+      const result = await reader.read();
+      if (result.done) break;
+      total += result.value.byteLength;
+      if (total > maximumBytes) {
+        await reader.cancel("body limit exceeded");
+        throw new HttpError(413, "invalid_request", "The request body is too large.");
+      }
+      chunks.push(result.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return body;
+}
+
+export async function readJsonObject(request: Request, maximumBytes = 16 * 1024): Promise<Record<string, unknown>> {
+  const contentType = request.headers.get("Content-Type")?.split(";", 1)[0]?.trim().toLowerCase();
+  if (contentType !== "application/json") {
+    throw new HttpError(415, "invalid_request", "Content-Type must be application/json.");
+  }
+  const bytes = await readBoundedBody(request, maximumBytes);
+  let value: unknown;
+  try {
+    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)) as unknown;
+  } catch {
+    throw new HttpError(400, "invalid_request", "The JSON body is invalid.");
+  }
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new HttpError(400, "invalid_request", "The JSON body must be an object.");
+  }
+  return value as Record<string, unknown>;
+}
+
+export function requireMethod(request: Request, method: string): void {
+  if (request.method !== method) {
+    throw new HttpError(405, "method_not_allowed", "The method is not allowed.", { Allow: method });
+  }
+}
diff --git a/backend/community-api/src/local-fixture.ts b/backend/community-api/src/local-fixture.ts
new file mode 100644
index 0000000..c3332bd
--- /dev/null
+++ b/backend/community-api/src/local-fixture.ts
@@ -0,0 +1,213 @@
+import { inspectLevelBundle, sha256Hex } from "@ss2revive/community-contracts";
+import type { RuntimeConfig } from "./config";
+import { HttpError } from "./http";
+
+const FIXTURE_ID = "1a658233-92c5-4b63-87fc-4740c855730b";
+const FIXTURE_CREATED_AT = Date.UTC(2026, 0, 1, 0, 0, 0);
+const encoder = new TextEncoder();
+const FIXTURE_CONFIGURATIONS = [{
+  id: "5f3ff27f-126f-43b3-999f-e55cd44f4a27",
+  numberPlayers: 1,
+  numberTeams: 1,
+  teamMode: "COOP",
+  levelTeamConfigurations: [{ objectives: [""], playersInTeam: [] }],
+}];
+const FIXTURE_VALIDATIONS = [{
+  id: "f9dab629-2372-4eb3-b24a-063f382f6043",
+  description: "Local deterministic fixture",
+  validated: false,
+}];
+
+function writeUint16(output: number[], value: number): void {
+  output.push(value & 0xff, (value >>> 8) & 0xff);
+}
+
+function writeInt32(output: number[], value: number): void {
+  output.push(value & 0xff, (value >>> 8) & 0xff, (value >>> 16) & 0xff, (value >>> 24) & 0xff);
+}
+
+function writeEntry(output: number[], name: string, payload: Uint8Array): void {
+  const nameBytes = encoder.encode(name);
+  writeUint16(output, nameBytes.length);
+  output.push(...nameBytes);
+  writeInt32(output, payload.length);
+  output.push(...payload);
+}
+
+function writeBits(bytes: Uint8Array, start: number, value: number, count: number): number {
+  for (let bit = 0; bit < count; bit += 1) {
+    if ((Math.floor(value / 2 ** bit) & 1) !== 0) {
+      const absolute = start + bit;
+      bytes[Math.floor(absolute / 8)]! |= 1 << (absolute % 8);
+    }
+  }
+  return start + count;
+}
+
+function writeGameString(bytes: Uint8Array, start: number, value: string): number {
+  let bit = Math.ceil(start / 8) * 8;
+  bit = writeBits(bytes, bit, value.length, 8);
+  for (let index = 0; index < value.length; index += 1) {
+    bit = writeBits(bytes, bit, value.charCodeAt(index), 16);
+  }
+  return bit;
+}
+
+function fixtureLevelContent(): Uint8Array {
+  const bytes = new Uint8Array(256);
+  bytes.set(encoder.encode("Surgeons"), 0);
+  bytes[8] = 29;
+  let bit = 80;
+  bit = writeGameString(bytes, bit, FIXTURE_ID);
+  bit = writeBits(bytes, bit, 0, 1); // uncompressed format-29 body
+  bit = Math.ceil(bit / 8) * 8;
+  bit = writeGameString(bytes, bit, "Fixture");
+  for (const dimension of [1, 1, 1]) bit = writeBits(bytes, bit, dimension + 0x80000000, 32);
+  bit = writeBits(bytes, bit, 0, 1); // one empty voxel
+  bit = writeBits(bytes, bit, 0x80000000, 32); // textured voxel value 0
+  bit = writeBits(bytes, bit, 0x80000000, 32); // zero prop definitions
+  bit = writeBits(bytes, bit, 0x80000000, 32); // zero prop instances
+  return bytes.slice(0, Math.ceil(bit / 8));
+}
+
+function fixtureThumbnail(): Uint8Array {
+  const bytes = new Uint8Array(17);
+  let bit = 0;
+  bit = writeBits(bytes, bit, 1, 31);
+  bit = writeBits(bytes, bit, 1, 31);
+  bit = writeBits(bytes, bit, 4, 4);
+  writeBits(bytes, bit, 4, 31);
+  bytes.set([0x33, 0x66, 0x99, 0xff], 13);
+  return bytes;
+}
+
+export async function buildLocalFixture(options: {
+  configurations?: unknown[];
+  validations?: unknown[];
+  contentVersion?: number;
+  exportedAtMs?: number;
+  title?: string;
+  tags?: string[];
+  /** Test hook: container entries the real writer never emits, used to pin rejection behaviour. */
+  extraEntries?: ReadonlyArray<{ name: string; payload: Uint8Array }>;
+  /** Test hook: replaces the generated thumbnail payload verbatim. */
+  thumbnail?: Uint8Array;
+  /** Test hook: the server time the manifest is validated against. */
+  nowMs?: number;
+} = {}): Promise<{
+  bytes: Uint8Array;
+  thumbnail: Uint8Array;
+  bundleKey: string;
+  thumbnailKey: string;
+  sha256: string;
+  thumbnailSha256: string;
+}> {
+  const content = fixtureLevelContent();
+  const thumbnail = options.thumbnail ?? fixtureThumbnail();
+  const contentSha256 = await sha256Hex(content);
+  const manifest = encoder.encode(JSON.stringify({
+    bundleVersion: 2,
+    id: FIXTURE_ID,
+    title: options.title ?? "Phase 0 Local Test Room",
+    description: "A deterministic local-only backend fixture.",
+    createdAt: FIXTURE_CREATED_AT,
+    exportedAt: options.exportedAtMs ?? FIXTURE_CREATED_AT + 1000,
+    clientVersion: 29,
+    contentVersion: options.contentVersion ?? 1,
+    reviveVersion: "0.1.0",
+    contentSha256,
+    creators: ["STEAM-76561198145479980-------------"],
+    tags: options.tags ?? ["TEAM_COOP", "LOCAL_TEST"],
+    configurations: options.configurations ?? FIXTURE_CONFIGURATIONS,
+    validations: options.validations ?? FIXTURE_VALIDATIONS,
+  }));
+  const output = [...encoder.encode("SS2REVIVE LEVEL\n")];
+  writeUint16(output, 2);
+  writeEntry(output, "asset.json", manifest);
+  writeEntry(output, "level.bin", content);
+  writeEntry(output, "thumb.png", thumbnail);
+  for (const entry of options.extraEntries ?? []) writeEntry(output, entry.name, entry.payload);
+  writeUint16(output, 0);
+  const bytes = new Uint8Array(output);
+  const inspected = await inspectLevelBundle(bytes, { nowMs: options.nowMs ?? Date.UTC(2026, 7, 8) });
+  const thumbnailSha256 = await sha256Hex(thumbnail);
+  return {
+    bytes,
+    thumbnail,
+    sha256: inspected.bundleSha256,
+    thumbnailSha256,
+    bundleKey: `approved/maps/${FIXTURE_ID}/r${inspected.manifest.contentVersion}/${inspected.bundleSha256}.ss2level`,
+    thumbnailKey: `approved/thumbnails/${FIXTURE_ID}/r${inspected.manifest.contentVersion}/${thumbnailSha256}.bin`,
+  };
+}
+
+export async function seedLocalFixture(env: Env, config: RuntimeConfig): Promise<{ id: string; revision: number }> {
+  if (!config.allowMockAuth) throw new HttpError(404, "not_found", "The route was not found.");
+  const fixture = await buildLocalFixture();
+  await env.MAP_BUCKET.put(fixture.bundleKey, fixture.bytes, {
+    httpMetadata: { contentType: "application/vnd.ss2revive.level" },
+    customMetadata: { sha256: fixture.sha256 },
+  });
+  await env.MAP_BUCKET.put(fixture.thumbnailKey, fixture.thumbnail, {
+    httpMetadata: { contentType: "application/octet-stream" },
+    customMetadata: { sha256: fixture.thumbnailSha256 },
+  });
+
+  await env.DB.batch([
+    env.DB.prepare(
+      `INSERT INTO users (steam_id64, status, created_at, last_login_at)
+       VALUES (?, 'active', ?, ?)
+       ON CONFLICT(steam_id64) DO UPDATE SET last_login_at = excluded.last_login_at`,
+    ).bind(config.mockSteamId64, FIXTURE_CREATED_AT, FIXTURE_CREATED_AT),
+    env.DB.prepare(
+      `INSERT INTO maps
+         (id, status, current_revision, title, title_sort, description, created_at_ms, updated_at_ms,
+          owner_steam_id64)
+       VALUES (?, 'published', 1, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(id) DO UPDATE SET
+         status = excluded.status, current_revision = excluded.current_revision,
+         title = excluded.title, title_sort = excluded.title_sort, description = excluded.description,
+         created_at_ms = excluded.created_at_ms, updated_at_ms = excluded.updated_at_ms,
+         owner_steam_id64 = excluded.owner_steam_id64`,
+    ).bind(
+      FIXTURE_ID,
+      "Phase 0 Local Test Room",
+      "phase 0 local test room",
+      "A deterministic local-only backend fixture.",
+      FIXTURE_CREATED_AT,
+      FIXTURE_CREATED_AT + 1000,
+      config.mockSteamId64,
+    ),
+    env.DB.prepare(`DELETE FROM map_tags WHERE map_id = ? AND revision = 1`).bind(FIXTURE_ID),
+    env.DB.prepare(`DELETE FROM map_versions WHERE map_id = ? AND revision = 1`).bind(FIXTURE_ID),
+    env.DB.prepare(
+      `INSERT INTO map_versions
+         (map_id, revision, status, code, creator_ids_json, tags_json,
+          configurations_json, validations_json, player_counts_csv,
+          client_version, map_format_version, minimum_revive_version, revive_version,
+          size_bytes, sha256, bundle_key,
+          thumbnail_size_bytes, thumbnail_sha256, thumbnail_key, created_at_ms)
+       VALUES (?, 1, 'published', ?, ?, ?, ?, ?, ?, 29, 29, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    ).bind(
+      FIXTURE_ID,
+      "M4JlGsWSY0uH_EdAyFVzCw",
+      JSON.stringify(["STEAM-76561198145479980-------------"]),
+      JSON.stringify(["TEAM_COOP", "LOCAL_TEST"]),
+      JSON.stringify(FIXTURE_CONFIGURATIONS),
+      JSON.stringify(FIXTURE_VALIDATIONS),
+      ",1,",
+      "0.1.0",
+      "0.1.0",
+      fixture.bytes.length,
+      fixture.sha256,
+      fixture.bundleKey,
+      fixture.thumbnail.length,
+      fixture.thumbnailSha256,
+      fixture.thumbnailKey,
+      FIXTURE_CREATED_AT + 1000,
+    ),
+    env.DB.prepare(`INSERT INTO map_tags (map_id, revision, tag) VALUES (?, 1, ?)`).bind(FIXTURE_ID, "TEAM_COOP"),
+    env.DB.prepare(`INSERT INTO map_tags (map_id, revision, tag) VALUES (?, 1, ?)`).bind(FIXTURE_ID, "LOCAL_TEST"),
+  ]);
+  return { id: FIXTURE_ID, revision: 1 };
+}
diff --git a/backend/community-api/src/maintenance.ts b/backend/community-api/src/maintenance.ts
new file mode 100644
index 0000000..ca458e0
--- /dev/null
+++ b/backend/community-api/src/maintenance.ts
@@ -0,0 +1,118 @@
+/**
+ * A validator that is evicted between claiming its lease and completing leaves its row in
+ * 'validating' forever: the claim requires status 'uploaded', and the queue message is acked once
+ * the claim fails. Reclaim expired leases so the reservation can finish or expire normally, and
+ * release the quarantine object it was holding.
+ */
+const VALIDATION_LEASE_TTL_MS = 10 * 60 * 1000;
+
+async function reclaimStaleValidations(env: Env, nowMs: number): Promise<void> {
+  const stale = await env.DB.prepare(
+    `SELECT id, quarantine_key, expires_at FROM map_uploads
+      WHERE status = 'validating' AND validation_started_at IS NOT NULL
+        AND validation_started_at <= ? LIMIT 100`,
+  ).bind(nowMs - VALIDATION_LEASE_TTL_MS).all<{ id: string; quarantine_key: string; expires_at: number }>();
+  if (stale.results.length === 0) return;
+
+  const expired = stale.results.filter((row) => row.expires_at <= nowMs);
+  const recoverable = stale.results.filter((row) => row.expires_at > nowMs);
+  if (expired.length > 0) {
+    await env.MAP_BUCKET.delete(expired.map((row) => row.quarantine_key));
+  }
+  await env.DB.batch([
+    // Past its reservation window: terminate and stop holding the quarantine object.
+    ...expired.map((row) => env.DB.prepare(
+      `UPDATE map_uploads
+          SET status = 'expired', completed_at = ?, validation_lease = NULL,
+              validation_started_at = NULL, validation_lease_expires_at = NULL
+        WHERE id = ? AND status = 'validating'`,
+    ).bind(nowMs, row.id)),
+    // Still inside its window: drop the dead lease so a redelivery can claim it again. Any
+    // in-flight validator that survives cannot complete, because completion compares the lease.
+    ...recoverable.map((row) => env.DB.prepare(
+      `UPDATE map_uploads
+          SET status = 'uploaded', validation_lease = NULL,
+              validation_started_at = NULL, validation_lease_expires_at = NULL
+        WHERE id = ? AND status = 'validating'`,
+    ).bind(row.id)),
+  ]);
+}
+
+/**
+ * Approved objects are written before the D1 publication batch commits, so a failure in between
+ * can leave an object no row references. Sweep a bounded slice of the approved prefix and delete
+ * anything D1 does not know about. Objects are only considered once they are old enough that no
+ * publication could still be mid-flight.
+ */
+const ORPHAN_GRACE_MS = 60 * 60 * 1000;
+
+async function reconcileOrphanedObjects(env: Env, nowMs: number): Promise<void> {
+  const listed = await env.MAP_BUCKET.list({ prefix: "approved/", limit: 200 });
+  const candidates = listed.objects.filter((object) => object.uploaded.getTime() <= nowMs - ORPHAN_GRACE_MS);
+  if (candidates.length === 0) return;
+
+  const referenced = new Set<string>();
+  for (let index = 0; index < candidates.length; index += 50) {
+    const slice = candidates.slice(index, index + 50);
+    const placeholders = slice.map(() => "?").join(", ");
+    const rows = await env.DB.prepare(
+      `SELECT bundle_key AS key FROM map_versions WHERE bundle_key IN (${placeholders})
+       UNION ALL
+       SELECT thumbnail_key AS key FROM map_versions WHERE thumbnail_key IN (${placeholders})`,
+    ).bind(...slice.map((object) => object.key), ...slice.map((object) => object.key)).all<{ key: string }>();
+    for (const row of rows.results) referenced.add(row.key);
+  }
+  const orphans = candidates.filter((object) => !referenced.has(object.key)).map((object) => object.key);
+  if (orphans.length === 0) return;
+  await env.MAP_BUCKET.delete(orphans);
+  console.log(JSON.stringify({ event: "orphan_objects_collected", count: orphans.length }));
+}
+
+export async function cleanupExpiredState(env: Env, nowMs: number): Promise<void> {
+  const retentionCutoff = nowMs - 24 * 60 * 60 * 1000;
+  await reclaimStaleValidations(env, nowMs);
+  const expiredUploads = await env.DB.prepare(
+    `SELECT id, quarantine_key FROM map_uploads
+      WHERE status IN ('reserved', 'uploaded') AND expires_at <= ? LIMIT 100`,
+  ).bind(nowMs).all<{ id: string; quarantine_key: string }>();
+  if (expiredUploads.results.length > 0) {
+    await env.MAP_BUCKET.delete(expiredUploads.results.map((row) => row.quarantine_key));
+    await env.DB.batch(expiredUploads.results.map((row) => env.DB.prepare(
+      `UPDATE map_uploads SET status = 'expired', completed_at = ?
+        WHERE id = ? AND status IN ('reserved', 'uploaded')`,
+    ).bind(nowMs, row.id)));
+  }
+  await env.DB.batch([
+    env.DB.prepare(`DELETE FROM steam_openid_sessions WHERE expires_at <= ?`).bind(retentionCutoff),
+    env.DB.prepare(`DELETE FROM refresh_tokens WHERE expires_at <= ?`).bind(retentionCutoff),
+    env.DB.prepare(
+      `DELETE FROM refresh_token_families
+        WHERE expires_at <= ? AND NOT EXISTS
+          (SELECT 1 FROM refresh_tokens t WHERE t.family_id = refresh_token_families.id)`,
+    ).bind(retentionCutoff),
+    env.DB.prepare(
+      `DELETE FROM auth_sessions
+        WHERE expires_at <= ? AND NOT EXISTS
+          (SELECT 1 FROM refresh_token_families f WHERE f.session_id = auth_sessions.id)`,
+    ).bind(retentionCutoff),
+    env.DB.prepare(
+      `DELETE FROM device_auth_sessions
+        WHERE expires_at <= ? AND NOT EXISTS
+          (SELECT 1 FROM steam_openid_sessions o WHERE o.device_session_id = device_auth_sessions.id)`,
+    ).bind(retentionCutoff),
+    env.DB.prepare(`DELETE FROM upload_usage_daily WHERE day_utc < ?`)
+      .bind(new Date(nowMs - 8 * 24 * 60 * 60 * 1000).toISOString().slice(0, 10)),
+    env.DB.prepare(
+      `DELETE FROM map_uploads
+        WHERE completed_at IS NOT NULL AND completed_at <= ?
+          AND status IN ('published', 'rejected', 'cancelled', 'expired')`,
+    ).bind(nowMs - 30 * 24 * 60 * 60 * 1000),
+    // Resolved moderation reports and their events are kept for a quarter, then released.
+    env.DB.prepare(
+      `DELETE FROM map_reports WHERE status != 'open' AND resolved_at IS NOT NULL AND resolved_at <= ?`,
+    ).bind(nowMs - 90 * 24 * 60 * 60 * 1000),
+    env.DB.prepare(`DELETE FROM moderation_events WHERE created_at <= ?`)
+      .bind(nowMs - 365 * 24 * 60 * 60 * 1000),
+  ]);
+  await reconcileOrphanedObjects(env, nowMs);
+}
diff --git a/backend/community-api/src/maps.ts b/backend/community-api/src/maps.ts
new file mode 100644
index 0000000..a7df58b
--- /dev/null
+++ b/backend/community-api/src/maps.ts
@@ -0,0 +1,412 @@
+import {
+  isCanonicalUuid,
+  levelCodeFromId,
+  isSemanticVersion,
+  isSha256,
+  MAX_BUNDLE_BYTES,
+  MAX_CATALOG_BYTES,
+  MAX_DESCRIPTION_CHARACTERS,
+  MAX_IMAGE_BYTES,
+  MAX_MAP_PAGE_BYTES,
+  MAX_PAGE_SIZE,
+  MAX_TITLE_CHARACTERS,
+  parseBoundedPositiveInteger,
+  sha256Hex,
+  type CommunityMap,
+  type MapPage,
+} from "@ss2revive/community-contracts";
+import type { RuntimeConfig } from "./config";
+import { signedValue, verifySignedValue } from "./crypto";
+import { HttpError, jsonResponse } from "./http";
+
+type MapSort = "updated_desc" | "created_desc" | "title_asc";
+
+interface MapRow {
+  id: string;
+  revision: number;
+  title: string;
+  title_sort: string;
+  description: string;
+  created_at_ms: number;
+  updated_at_ms: number;
+  code: string;
+  creator_ids_json: string;
+  tags_json: string;
+  configurations_json: string;
+  validations_json: string;
+  client_version: number;
+  map_format_version: number;
+  minimum_revive_version: string;
+  revive_version: string | null;
+  size_bytes: number;
+  sha256: string;
+  bundle_key: string;
+  thumbnail_size_bytes: number | null;
+  thumbnail_sha256: string | null;
+  thumbnail_key: string | null;
+  version_created_at_ms: number;
+}
+
+const MAP_SELECT = `
+  SELECT m.id, v.revision, m.title, m.title_sort, m.description,
+         m.created_at_ms, m.updated_at_ms, v.code,
+         v.creator_ids_json, v.tags_json, v.configurations_json, v.validations_json,
+         v.client_version, v.map_format_version, v.minimum_revive_version, v.revive_version,
+         v.size_bytes, v.sha256, v.bundle_key,
+         v.thumbnail_size_bytes, v.thumbnail_sha256, v.thumbnail_key,
+         v.created_at_ms AS version_created_at_ms
+    FROM maps m
+    JOIN map_versions v ON v.map_id = m.id`;
+
+function parseArray(text: string, maximum: number, field: string): unknown[] {
+  let value: unknown;
+  try {
+    value = JSON.parse(text) as unknown;
+  } catch {
+    throw new HttpError(503, "object_metadata_mismatch", `Stored ${field} metadata is invalid.`);
+  }
+  if (!Array.isArray(value) || value.length > maximum) {
+    throw new HttpError(503, "object_metadata_mismatch", `Stored ${field} metadata is invalid.`);
+  }
+  return value;
+}
+
+function stringArray(text: string, maximum: number, field: string): string[] {
+  const value = parseArray(text, maximum, field);
+  if (!value.every((item) => typeof item === "string" && item.length >= 1 && item.length <= 128)) {
+    throw new HttpError(503, "object_metadata_mismatch", `Stored ${field} metadata is invalid.`);
+  }
+  return value as string[];
+}
+
+function mapDto(row: MapRow): CommunityMap {
+  if (
+    !isCanonicalUuid(row.id) || row.revision < 1 || !Number.isSafeInteger(row.revision) ||
+    row.title.length < 1 || row.title.length > MAX_TITLE_CHARACTERS ||
+    row.description.length > MAX_DESCRIPTION_CHARACTERS ||
+    row.code !== levelCodeFromId(row.id) ||
+    !Number.isSafeInteger(row.created_at_ms) || !Number.isSafeInteger(row.updated_at_ms) ||
+    row.created_at_ms < 0 || row.updated_at_ms < row.created_at_ms ||
+    row.client_version !== 29 || row.map_format_version !== 29 ||
+    !isSemanticVersion(row.minimum_revive_version) ||
+    (row.revive_version !== null && !isSemanticVersion(row.revive_version)) ||
+    row.size_bytes < 1 || row.size_bytes > MAX_BUNDLE_BYTES || !isSha256(row.sha256)
+  ) {
+    throw new HttpError(503, "object_metadata_mismatch", "Stored map metadata is invalid.");
+  }
+  const expectedBundleKey = `approved/maps/${row.id}/r${row.revision}/${row.sha256}.ss2level`;
+  if (row.bundle_key !== expectedBundleKey) {
+    throw new HttpError(503, "object_metadata_mismatch", "Stored bundle metadata is invalid.");
+  }
+  const map: CommunityMap = {
+    id: row.id,
+    code: row.code,
+    revision: row.revision,
+    title: row.title,
+    description: row.description,
+    creatorIds: stringArray(row.creator_ids_json, 4, "creator"),
+    tags: stringArray(row.tags_json, 32, "tag"),
+    createdAtMs: row.created_at_ms,
+    updatedAtMs: row.updated_at_ms,
+    clientVersion: 29,
+    mapFormatVersion: 29,
+    minimumReviveVersion: row.minimum_revive_version,
+    sizeBytes: row.size_bytes,
+    sha256: row.sha256,
+    configurations: parseArray(row.configurations_json, 8, "configuration"),
+    validations: parseArray(row.validations_json, 32, "validation"),
+    downloadUrl: `/v1/maps/${row.id}/versions/${row.revision}/download`,
+  };
+  if (row.revive_version !== null) map.reviveVersion = row.revive_version;
+  const thumbnailCount = Number(row.thumbnail_key !== null) + Number(row.thumbnail_sha256 !== null) +
+    Number(row.thumbnail_size_bytes !== null);
+  if (thumbnailCount !== 0 && thumbnailCount !== 3) {
+    throw new HttpError(503, "object_metadata_mismatch", "Stored thumbnail metadata is incomplete.");
+  }
+  if (row.thumbnail_key !== null && row.thumbnail_sha256 !== null && row.thumbnail_size_bytes !== null) {
+    const expectedThumbnailKey = `approved/thumbnails/${row.id}/r${row.revision}/${row.thumbnail_sha256}.bin`;
+    if (
+      !isSha256(row.thumbnail_sha256) || row.thumbnail_size_bytes < 1 ||
+      row.thumbnail_size_bytes > MAX_IMAGE_BYTES || row.thumbnail_key !== expectedThumbnailKey
+    ) {
+      throw new HttpError(503, "object_metadata_mismatch", "Stored thumbnail metadata is invalid.");
+    }
+    map.thumbnail = {
+      url: `/v1/maps/${row.id}/versions/${row.revision}/thumbnail`,
+      sizeBytes: row.thumbnail_size_bytes,
+      sha256: row.thumbnail_sha256,
+    };
+  }
+  return map;
+}
+
+function boundedSearch(value: string | null, name: string, maximum: number): string {
+  if (value === null) return "";
+  if (value.length > maximum || /[\u0000-\u001f\u007f-\u009f]/u.test(value)) {
+    throw new HttpError(400, "invalid_request", `${name} is invalid.`);
+  }
+  return value.trim();
+}
+
+function escapeLike(value: string): string {
+  return value.replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_");
+}
+
+async function filterHash(query: string, tag: string, players: number | null, sort: MapSort): Promise<string> {
+  return sha256Hex(new TextEncoder().encode(JSON.stringify({ query, tag, players, sort })));
+}
+
+/** Envelope headroom left for requestId, cursor, and the surrounding JSON structure. */
+const RESPONSE_ENVELOPE_BYTES = 4096;
+
+/**
+ * Serialize rows until the response budget is spent, then stop. Previously these listings threw a
+ * 503 whenever the total exceeded the budget, which let a publisher take the public catalogue
+ * offline for everyone simply by publishing a few maps with maximal metadata. Dropping the overflow
+ * keeps the listing available and self-healing; the first row is always included so pagination can
+ * never stall.
+ */
+function takeWithinBudget(rows: MapRow[], budgetBytes: number): {
+  selected: MapRow[];
+  items: CommunityMap[];
+  truncated: boolean;
+} {
+  const encoder = new TextEncoder();
+  const selected: MapRow[] = [];
+  const items: CommunityMap[] = [];
+  let remaining = budgetBytes - RESPONSE_ENVELOPE_BYTES;
+  for (const row of rows) {
+    const item = mapDto(row);
+    const cost = encoder.encode(JSON.stringify(item)).length + 1;
+    if (items.length > 0 && cost > remaining) {
+      return { selected, items, truncated: true };
+    }
+    remaining -= cost;
+    selected.push(row);
+    items.push(item);
+  }
+  return { selected, items, truncated: false };
+}
+
+export async function listMaps(
+  request: Request,
+  env: Env,
+  config: RuntimeConfig,
+  requestId: string,
+  nowMs: number,
+): Promise<Response> {
+  const url = new URL(request.url);
+  const limit = parseBoundedPositiveInteger(url.searchParams.get("limit"), 20, MAX_PAGE_SIZE);
+  if (limit === null) throw new HttpError(400, "invalid_request", "limit must be between 1 and 50.");
+  const query = boundedSearch(url.searchParams.get("query"), "query", 128);
+  const tag = boundedSearch(url.searchParams.get("tag"), "tag", 128);
+  if (tag !== "" && !/^[A-Za-z0-9_.-]+$/.test(tag)) throw new HttpError(400, "invalid_request", "tag is invalid.");
+  const playersText = url.searchParams.get("players");
+  const players = playersText === null ? null : parseBoundedPositiveInteger(playersText, 1, 4);
+  if (playersText !== null && players === null) throw new HttpError(400, "invalid_request", "players must be between 1 and 4.");
+  const sortText = url.searchParams.get("sort") ?? "updated_desc";
+  if (sortText !== "updated_desc" && sortText !== "created_desc" && sortText !== "title_asc") {
+    throw new HttpError(400, "unsupported_sort", "sort must be updated_desc, created_desc, or title_asc.");
+  }
+  const sort: MapSort = sortText;
+  const expectedFilterHash = await filterHash(query, tag, players, sort);
+
+  const clauses = [
+    "m.status = 'published'",
+    "v.status = 'published'",
+    "v.revision = m.current_revision",
+    "v.client_version = 29",
+    "v.map_format_version = 29",
+  ];
+  const values: unknown[] = [];
+  if (query !== "") {
+    clauses.push("(v.code = ? OR m.title_sort LIKE ? ESCAPE '\\')");
+    values.push(query, `${escapeLike(query.toLocaleLowerCase("en-US"))}%`);
+  }
+  if (tag !== "") {
+    clauses.push("EXISTS (SELECT 1 FROM map_tags mt WHERE mt.map_id = m.id AND mt.revision = v.revision AND mt.tag = ?)");
+    values.push(tag);
+  }
+  if (players !== null) {
+    clauses.push("instr(v.player_counts_csv, ?) > 0");
+    values.push(`,${players},`);
+  }
+
+  const cursorText = url.searchParams.get("cursor");
+  if (cursorText !== null) {
+    if (cursorText.length > 2048) throw new HttpError(400, "invalid_cursor", "The cursor is invalid.");
+    const cursor = await verifySignedValue(config, "map-cursor", cursorText);
+    if (
+      cursor === null || cursor.v !== 1 || cursor.sort !== sort || cursor.filterHash !== expectedFilterHash ||
+      typeof cursor.id !== "string" || !isCanonicalUuid(cursor.id) ||
+      typeof cursor.iat !== "number" || !Number.isSafeInteger(cursor.iat) ||
+      cursor.iat < nowMs - 60 * 60 * 1000 || cursor.iat > nowMs + 60_000
+    ) {
+      throw new HttpError(400, "invalid_cursor", "The cursor is invalid or does not match these filters.");
+    }
+    if (sort === "title_asc") {
+      if (typeof cursor.value !== "string" || cursor.value.length > MAX_TITLE_CHARACTERS) {
+        throw new HttpError(400, "invalid_cursor", "The cursor is invalid.");
+      }
+      clauses.push("(m.title_sort > ? OR (m.title_sort = ? AND m.id > ?))");
+      values.push(cursor.value, cursor.value, cursor.id);
+    } else {
+      if (typeof cursor.value !== "number" || !Number.isSafeInteger(cursor.value)) {
+        throw new HttpError(400, "invalid_cursor", "The cursor is invalid.");
+      }
+      const column = sort === "updated_desc" ? "m.updated_at_ms" : "m.created_at_ms";
+      clauses.push(`(${column} < ? OR (${column} = ? AND m.id > ?))`);
+      values.push(cursor.value, cursor.value, cursor.id);
+    }
+  }
+
+  const order = sort === "updated_desc" ? "m.updated_at_ms DESC, m.id ASC"
+    : sort === "created_desc" ? "m.created_at_ms DESC, m.id ASC"
+    : "m.title_sort ASC, m.id ASC";
+  const result = await env.DB.prepare(
+    `${MAP_SELECT} WHERE ${clauses.join(" AND ")} ORDER BY ${order} LIMIT ?`,
+  ).bind(...values, limit + 1).all<MapRow>();
+  const rows = result.results;
+  const { selected, items, truncated } = takeWithinBudget(rows.slice(0, limit), MAX_MAP_PAGE_BYTES);
+  const hasMore = rows.length > limit || truncated;
+  let nextCursor: string | null = null;
+  const last = selected.at(-1);
+  if (hasMore && last !== undefined) {
+    const value = sort === "updated_desc" ? last.updated_at_ms
+      : sort === "created_desc" ? last.created_at_ms
+      : last.title_sort;
+    nextCursor = await signedValue(config, "map-cursor", {
+      v: 1,
+      sort,
+      filterHash: expectedFilterHash,
+      value,
+      id: last.id,
+      iat: nowMs,
+    });
+  }
+  const page: MapPage & { requestId: string } = { requestId, items, nextCursor };
+  return jsonResponse(page, 200, requestId);
+}
+
+/**
+ * Bounded compatibility document consumed by the current in-game catalogue client.
+ * Object locators are API paths relative to /v1/catalog, never private R2 keys.
+ */
+export async function catalogDocument(
+  env: Env,
+  requestId: string,
+  nowMs: number,
+): Promise<Response> {
+  const result = await env.DB.prepare(
+    `${MAP_SELECT}
+      WHERE m.status = 'published' AND v.status = 'published'
+        AND v.revision = m.current_revision
+        AND v.client_version = 29 AND v.map_format_version = 29
+      ORDER BY m.updated_at_ms DESC, m.id ASC
+      LIMIT 2001`,
+  ).all<MapRow>();
+  const { items, truncated } = takeWithinBudget(result.results.slice(0, 2000), MAX_CATALOG_BYTES);
+  const maps = items.map((map) => {
+    const bundleKey = map.downloadUrl.startsWith("/v1/") ? map.downloadUrl.slice(4) : "";
+    if (bundleKey === "") {
+      throw new HttpError(503, "object_metadata_mismatch", "Stored bundle metadata is invalid.");
+    }
+    const entry: Record<string, unknown> = {
+      id: map.id,
+      code: map.code,
+      revision: map.revision,
+      title: map.title,
+      description: map.description,
+      creatorIds: map.creatorIds,
+      tags: map.tags,
+      createdAtMs: map.createdAtMs,
+      updatedAtMs: map.updatedAtMs,
+      clientVersion: map.clientVersion,
+      mapFormatVersion: map.mapFormatVersion,
+      minimumReviveVersion: map.minimumReviveVersion,
+      sizeBytes: map.sizeBytes,
+      sha256: map.sha256,
+      bundleKey,
+      configurations: map.configurations,
+      validations: map.validations,
+    };
+    if (map.reviveVersion !== undefined) entry.reviveVersion = map.reviveVersion;
+    if (map.thumbnail !== undefined) {
+      const thumbnailKey = map.thumbnail.url.startsWith("/v1/") ? map.thumbnail.url.slice(4) : "";
+      if (thumbnailKey === "") {
+        throw new HttpError(503, "object_metadata_mismatch", "Stored thumbnail metadata is invalid.");
+      }
+      entry.thumbnailKey = thumbnailKey;
+      entry.thumbnailSizeBytes = map.thumbnail.sizeBytes;
+      entry.thumbnailSha256 = map.thumbnail.sha256;
+    }
+    return entry;
+  });
+  // Catalogue entries carry a few more locator fields than the map DTO the budget was measured
+  // against, so trim once more against the real serialized size rather than failing the request.
+  const encoder = new TextEncoder();
+  let dropped = truncated;
+  while (
+    maps.length > 1 &&
+    encoder.encode(JSON.stringify({ schemaVersion: 1, generatedAtUtc: "", maps })).length > MAX_CATALOG_BYTES
+  ) {
+    maps.pop();
+    dropped = true;
+  }
+  const document = {
+    schemaVersion: 1,
+    generatedAtUtc: new Date(nowMs).toISOString(),
+    truncated: dropped,
+    maps,
+  };
+  return jsonResponse(document, 200, requestId, {
+    "Cache-Control": "public, max-age=60, stale-while-revalidate=300",
+  });
+}
+
+async function publishedMapRow(env: Env, mapId: string, revision?: number): Promise<MapRow | null> {
+  const revisionClause = revision === undefined ? "v.revision = m.current_revision" : "v.revision = ?";
+  const statement = env.DB.prepare(
+    `${MAP_SELECT}
+      WHERE m.id = ? AND m.status = 'published' AND v.status = 'published'
+        AND ${revisionClause} AND v.client_version = 29 AND v.map_format_version = 29`,
+  );
+  return revision === undefined
+    ? statement.bind(mapId).first<MapRow>()
+    : statement.bind(mapId, revision).first<MapRow>();
+}
+
+export async function mapDetail(env: Env, mapId: string, requestId: string): Promise<Response> {
+  if (!isCanonicalUuid(mapId)) throw new HttpError(404, "map_not_found", "The map was not found.");
+  const row = await publishedMapRow(env, mapId);
+  if (row === null) throw new HttpError(404, "map_not_found", "The map was not found.");
+  return jsonResponse({ requestId, map: mapDto(row) }, 200, requestId);
+}
+
+export async function mapVersions(env: Env, mapId: string, requestId: string): Promise<Response> {
+  if (!isCanonicalUuid(mapId)) throw new HttpError(404, "map_not_found", "The map was not found.");
+  const visible = await env.DB.prepare(`SELECT 1 FROM maps WHERE id = ? AND status = 'published'`).bind(mapId).first();
+  if (visible === null) throw new HttpError(404, "map_not_found", "The map was not found.");
+  const result = await env.DB.prepare(
+    `${MAP_SELECT}
+      WHERE m.id = ? AND m.status = 'published' AND v.status = 'published'
+        AND v.client_version = 29 AND v.map_format_version = 29
+      ORDER BY v.revision DESC LIMIT 50`,
+  ).bind(mapId).all<MapRow>();
+  // Every sibling listing bounds its response; this one did not, so 50 retained revisions of a
+  // maximal-metadata map turned a single anonymous GET into a large Worker/D1/egress amplifier.
+  const { items } = takeWithinBudget(result.results, MAX_MAP_PAGE_BYTES);
+  return jsonResponse({ requestId, items, nextCursor: null }, 200, requestId);
+}
+
+export async function downloadableVersion(env: Env, mapId: string, revision: number): Promise<MapRow> {
+  if (!isCanonicalUuid(mapId) || !Number.isSafeInteger(revision) || revision < 1) {
+    throw new HttpError(404, "revision_not_found", "The map revision was not found.");
+  }
+  const row = await publishedMapRow(env, mapId, revision);
+  if (row === null) throw new HttpError(404, "revision_not_found", "The map revision was not found.");
+  mapDto(row);
+  return row;
+}
+
+export type { MapRow };
diff --git a/backend/community-api/src/rate-limit.ts b/backend/community-api/src/rate-limit.ts
new file mode 100644
index 0000000..3731a1c
--- /dev/null
+++ b/backend/community-api/src/rate-limit.ts
@@ -0,0 +1,68 @@
+import type { RuntimeConfig } from "./config";
+import { opaqueHash } from "./crypto";
+import { HttpError } from "./http";
+
+/**
+ * Anonymous limits key on the caller's address. Keying on a full IPv6 address makes those limits
+ * meaningless, because a routed /64 - the standard residential and VPS allocation - hands the
+ * caller 2^64 distinct buckets. Collapse IPv6 to its /64 prefix so one allocation counts once.
+ */
+function clientAddress(request: Request): string {
+  const value = request.headers.get("CF-Connecting-IP") ?? "unknown";
+  if (value.length > 64 || /[\u0000-\u0020\u007f-\u009f]/u.test(value)) return "invalid";
+  if (!value.includes(":")) return value;
+  const groups = expandIpv6(value.toLowerCase());
+  return groups === null ? value : `${groups.slice(0, 4).join(":")}::/64`;
+}
+
+/** Expand an IPv6 literal to its eight groups, or null when it is not a plain IPv6 address. */
+function expandIpv6(value: string): string[] | null {
+  if (!/^[0-9a-f:]+$/u.test(value)) return null;
+  const halves = value.split("::");
+  if (halves.length > 2) return null;
+  const head = halves[0] === "" ? [] : halves[0]!.split(":");
+  const tail = halves.length === 2 ? (halves[1] === "" ? [] : halves[1]!.split(":")) : [];
+  if (!head.every(isIpv6Group) || !tail.every(isIpv6Group)) return null;
+  if (halves.length === 1) return head.length === 8 ? head : null;
+  const missing = 8 - head.length - tail.length;
+  if (missing < 1) return null;
+  return [...head, ...Array<string>(missing).fill("0"), ...tail];
+}
+
+function isIpv6Group(group: string): boolean {
+  return /^[0-9a-f]{1,4}$/u.test(group);
+}
+
+export async function anonymousRateKey(
+  request: Request,
+  config: RuntimeConfig,
+  routeClass: string,
+): Promise<string> {
+  return opaqueHash(config, "rate-limit", `${routeClass}\u0000${clientAddress(request)}`);
+}
+
+export async function actorRateKey(
+  config: RuntimeConfig,
+  routeClass: string,
+  steamId64: string,
+): Promise<string> {
+  return opaqueHash(config, "rate-limit", `${routeClass}\u0000steam\u0000${steamId64}`);
+}
+
+export async function enforceRateLimit(
+  limiter: RateLimit | undefined,
+  key: string,
+  retryAfterSeconds = 60,
+): Promise<void> {
+  if (limiter === undefined || typeof limiter.limit !== "function") {
+    throw new HttpError(503, "temporarily_unavailable", "The request limiter is unavailable.", {
+      "Retry-After": "30",
+    });
+  }
+  const result = await limiter.limit({ key });
+  if (!result.success) {
+    throw new HttpError(429, "rate_limited", "Try again later.", {
+      "Retry-After": String(retryAfterSeconds),
+    });
+  }
+}
diff --git a/backend/community-api/src/steam-openid.ts b/backend/community-api/src/steam-openid.ts
new file mode 100644
index 0000000..bd2aaff
--- /dev/null
+++ b/backend/community-api/src/steam-openid.ts
@@ -0,0 +1,399 @@
+import { isSteamId64 } from "@ss2revive/community-contracts";
+import type { RuntimeConfig } from "./config";
+import { opaqueHash, randomToken } from "./crypto";
+import { HttpError, readBoundedBody, responseHeaders } from "./http";
+
+const STEAM_OPENID_ENDPOINT = "https://steamcommunity.com/openid/login";
+const OPENID_NAMESPACE = "http://specs.openid.net/auth/2.0";
+const IDENTIFIER_SELECT = "http://specs.openid.net/auth/2.0/identifier_select";
+const LOGIN_LIFETIME_MS = 10 * 60 * 1000;
+
+interface OpenIdSessionRow {
+  id: string;
+  device_session_id: string;
+  status: "pending" | "verified" | "confirmed" | "failed";
+  return_to: string;
+  steam_id64: string | null;
+  expires_at: number;
+  user_code: string | null;
+}
+
+function escapeHtml(value: string): string {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+
+const PAGE_STYLES = `
+:root{color-scheme:dark;font-family:Inter,ui-sans-serif,system-ui,-apple-system,"Segoe UI",sans-serif;background:#0c151c;color:#eaf1f5}
+*{box-sizing:border-box}
+body{margin:0;min-height:100vh;background:#0c151c;display:grid;place-items:center;padding:32px 18px}
+.shell{width:min(100%,680px)}
+.brand{display:flex;align-items:baseline;gap:10px;margin:0 0 16px 4px;letter-spacing:.08em;text-transform:uppercase}
+.brand strong{font-family:Georgia,"Times New Roman",serif;font-size:24px;letter-spacing:.04em;color:#fff}
+.brand span{font-size:12px;font-weight:750;color:#8ea6b5}
+.card{background:#14222c;border:1px solid #31444f;border-top:4px solid #e7a84c;box-shadow:0 18px 55px rgba(0,0,0,.28);padding:clamp(26px,6vw,48px)}
+.eyebrow{margin:0 0 8px;color:#e7a84c;font-size:12px;font-weight:800;letter-spacing:.14em;text-transform:uppercase}
+h1{font-family:Georgia,"Times New Roman",serif;font-size:clamp(31px,7vw,46px);line-height:1.04;letter-spacing:-.02em;margin:0 0 18px;color:#fff}
+p{font-size:16px;line-height:1.65;margin:0 0 18px;color:#c6d3da}
+.lede{font-size:18px;color:#e4ebef}
+.notice{border-left:3px solid #e7a84c;background:#101c24;padding:14px 16px;margin:24px 0;color:#dbe5ea}
+.notice strong{color:#fff}
+form{margin-top:26px}
+label{display:block;margin-bottom:9px;font-size:14px;font-weight:750;color:#f3f6f8}
+.hint{display:block;margin:8px 0 0;font-size:13px;line-height:1.5;color:#93a8b5}
+input[type=text]{width:100%;height:60px;border:1px solid #5f7582;background:#0a1218;color:#fff;border-radius:2px;padding:0 16px;font:700 24px/1 ui-monospace,SFMono-Regular,Consolas,monospace;letter-spacing:.18em;text-transform:uppercase}
+input:focus-visible,button:focus-visible,a:focus-visible{outline:3px solid #8fd4e8;outline-offset:3px}
+.facts{display:grid;grid-template-columns:minmax(110px,.55fr) 1fr;border-top:1px solid #31444f;margin:24px 0}
+.facts dt,.facts dd{margin:0;padding:13px 0;border-bottom:1px solid #31444f}
+.facts dt{color:#8ea6b5;font-size:13px;font-weight:750;text-transform:uppercase;letter-spacing:.06em}
+.facts dd{color:#fff;font-weight:700;overflow-wrap:anywhere}
+.device-code{font:800 22px/1 ui-monospace,SFMono-Regular,Consolas,monospace;letter-spacing:.12em}
+.actions{display:flex;align-items:center;gap:18px;flex-wrap:wrap;margin-top:26px}
+button,.button{appearance:none;border:0;border-radius:2px;background:#e7a84c;color:#172028;cursor:pointer;display:inline-flex;align-items:center;justify-content:center;min-height:52px;padding:0 22px;font:800 15px/1 ui-sans-serif,system-ui,sans-serif;text-decoration:none}
+button:hover,.button:hover{background:#f3ba68}
+.text-link{color:#a8d8e6;font-weight:700;text-underline-offset:3px}
+.site{margin:15px 4px 0;color:#708895;font-size:12px;letter-spacing:.04em}
+.request{font:12px/1.5 ui-monospace,SFMono-Regular,Consolas,monospace;color:#78909d;overflow-wrap:anywhere}
+@media(max-width:520px){body{padding:0}.shell{width:100%}.brand{margin:18px}.card{border-left:0;border-right:0;padding:28px 20px}.facts{grid-template-columns:1fr}.facts dt{border-bottom:0;padding-bottom:3px}.facts dd{padding-top:3px}.actions button,.actions .button{width:100%}}
+`;
+
+function htmlResponse(
+  title: string,
+  content: string,
+  status: number,
+  requestId: string,
+  extraHeaders?: HeadersInit,
+): Response {
+  const nonce = randomToken();
+  const html = `<!doctype html><html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1"><meta name="color-scheme" content="dark">
+<title>${escapeHtml(title)}</title><style nonce="${nonce}">${PAGE_STYLES}</style></head>
+<body><main class="shell"><header class="brand"><strong>SS2Revive</strong><span>Community maps</span></header>
+<section class="card">${content}</section><p class="site">community.m12labs.net</p></main></body></html>`;
+  const headers = responseHeaders(requestId, extraHeaders);
+  headers.set("Content-Type", "text/html; charset=utf-8");
+  headers.set(
+    "Content-Security-Policy",
+    `default-src 'none'; style-src 'nonce-${nonce}'; form-action 'self' https://steamcommunity.com; frame-ancestors 'none'; base-uri 'none'`,
+  );
+  return new Response(html, { status, headers });
+}
+
+function exactParameter(parameters: URLSearchParams, name: string, maximum = 2048): string {
+  const values = parameters.getAll(name);
+  if (values.length !== 1 || values[0] === undefined || values[0].length < 1 || values[0].length > maximum) {
+    throw new HttpError(400, "steam_assertion_invalid", "Steam authentication could not be verified.");
+  }
+  return values[0];
+}
+
+async function boundedText(response: Response, maximumBytes: number): Promise<string> {
+  if (response.body === null) return "";
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  let total = 0;
+  let text = "";
+  try {
+    for (;;) {
+      const result = await reader.read();
+      if (result.done) break;
+      total += result.value.byteLength;
+      if (total > maximumBytes) {
+        await reader.cancel("response limit exceeded");
+        throw new HttpError(502, "steam_unavailable", "Steam authentication is temporarily unavailable.");
+      }
+      text += decoder.decode(result.value, { stream: true });
+    }
+    text += decoder.decode();
+    return text;
+  } catch (error) {
+    if (error instanceof HttpError) throw error;
+    throw new HttpError(502, "steam_unavailable", "Steam authentication is temporarily unavailable.");
+  } finally {
+    reader.releaseLock();
+  }
+}
+
+export async function verifySteamOpenIdAssertion(
+  parameters: URLSearchParams,
+  expectedReturnTo: string,
+  nowMs: number,
+  fetcher: typeof fetch = fetch,
+): Promise<{ steamId64: string; responseNonce: string }> {
+  if ([...parameters.keys()].length > 24) {
+    throw new HttpError(400, "steam_assertion_invalid", "Steam authentication could not be verified.");
+  }
+  const mode = exactParameter(parameters, "openid.mode", 64);
+  const namespace = exactParameter(parameters, "openid.ns", 128);
+  const endpoint = exactParameter(parameters, "openid.op_endpoint", 256);
+  const claimedId = exactParameter(parameters, "openid.claimed_id", 256);
+  const identity = exactParameter(parameters, "openid.identity", 256);
+  const returnTo = exactParameter(parameters, "openid.return_to", 512);
+  const responseNonce = exactParameter(parameters, "openid.response_nonce", 255);
+  const signedText = exactParameter(parameters, "openid.signed", 512);
+  exactParameter(parameters, "openid.assoc_handle", 255);
+  exactParameter(parameters, "openid.sig", 1024);
+  if (
+    mode !== "id_res" || namespace !== OPENID_NAMESPACE || endpoint !== STEAM_OPENID_ENDPOINT ||
+    claimedId !== identity || returnTo !== expectedReturnTo
+  ) {
+    throw new HttpError(400, "steam_assertion_invalid", "Steam authentication could not be verified.");
+  }
+  const match = /^https:\/\/steamcommunity\.com\/openid\/id\/([1-9][0-9]{16,19})$/u.exec(claimedId);
+  const steamId64 = match?.[1] ?? "";
+  if (!isSteamId64(steamId64)) {
+    throw new HttpError(400, "steam_assertion_invalid", "Steam authentication could not be verified.");
+  }
+  const signed = new Set(signedText.split(","));
+  for (const required of ["op_endpoint", "claimed_id", "identity", "return_to", "response_nonce", "assoc_handle"]) {
+    if (!signed.has(required)) {
+      throw new HttpError(400, "steam_assertion_invalid", "Steam authentication could not be verified.");
+    }
+  }
+  const nonceTimeText = responseNonce.slice(0, 20);
+  if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/u.test(nonceTimeText)) {
+    throw new HttpError(400, "steam_assertion_invalid", "Steam authentication could not be verified.");
+  }
+  const nonceTime = Date.parse(nonceTimeText);
+  if (!Number.isFinite(nonceTime) || nonceTime < nowMs - LOGIN_LIFETIME_MS || nonceTime > nowMs + 2 * 60 * 1000) {
+    throw new HttpError(400, "steam_assertion_invalid", "Steam authentication could not be verified.");
+  }
+
+  const verification = new URLSearchParams();
+  for (const [key, value] of parameters) {
+    if (key.startsWith("openid.")) verification.append(key, value);
+  }
+  verification.set("openid.mode", "check_authentication");
+  let response: Response;
+  try {
+    response = await fetcher(STEAM_OPENID_ENDPOINT, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded; charset=utf-8" },
+      body: verification.toString(),
+      redirect: "manual",
+      signal: AbortSignal.timeout(5000),
+    });
+  } catch {
+    throw new HttpError(502, "steam_unavailable", "Steam authentication is temporarily unavailable.", {
+      "Retry-After": "30",
+    });
+  }
+  if (response.status !== 200) {
+    throw new HttpError(502, "steam_unavailable", "Steam authentication is temporarily unavailable.", {
+      "Retry-After": "30",
+    });
+  }
+  const responseText = await boundedText(response, 4096);
+  const fields = new Map<string, string>();
+  for (const line of responseText.split(/\r?\n/u)) {
+    if (line === "") continue;
+    const separator = line.indexOf(":");
+    if (separator < 1) throw new HttpError(502, "steam_unavailable", "Steam returned an invalid response.");
+    const key = line.slice(0, separator);
+    if (fields.has(key)) throw new HttpError(502, "steam_unavailable", "Steam returned an invalid response.");
+    fields.set(key, line.slice(separator + 1));
+  }
+  if (fields.get("is_valid") !== "true" || (fields.has("ns") && fields.get("ns") !== OPENID_NAMESPACE)) {
+    throw new HttpError(400, "steam_assertion_invalid", "Steam authentication could not be verified.");
+  }
+  return { steamId64, responseNonce };
+}
+
+export function steamActivationPage(request: Request, requestId: string): Response {
+  if (request.method !== "GET") {
+    throw new HttpError(405, "method_not_allowed", "The method is not allowed.", { Allow: "GET" });
+  }
+  const suppliedCodes = new URL(request.url).searchParams.getAll("user_code");
+  const suppliedCode = suppliedCodes.length === 1 ? suppliedCodes[0]!.toUpperCase() : "";
+  const code = /^[A-Z2-9]{4}-[A-Z2-9]{4}$/u.test(suppliedCode) ? suppliedCode : "";
+  return htmlResponse("Connect SS2Revive to Steam", `
+<p class="eyebrow">Steam account link</p><h1>Connect SS2Revive</h1>
+<p class="lede">Confirm the code from the game, then continue to Steam in the next step.</p>
+<div class="notice"><strong>Only continue if SS2Revive opened this page for you.</strong>
+Never approve a code sent by another person. SS2Revive does not receive or store your Steam password.</div>
+<form method="post" action="/v1/auth/steam/start">
+<label for="user-code">Device code</label>
+<input id="user-code" name="user_code" value="${escapeHtml(code)}" maxlength="9"
+ pattern="[A-Za-z2-9]{4}-[A-Za-z2-9]{4}" autocomplete="one-time-code" autocapitalize="characters"
+ spellcheck="false" aria-describedby="code-hint" required autofocus>
+<span class="hint" id="code-hint">The same nine-character code must be visible inside SS2Revive.</span>
+<div class="actions"><button type="submit">Continue to Steam</button></div></form>`, 200, requestId);
+}
+
+export async function startSteamLogin(
+  request: Request,
+  env: Env,
+  config: RuntimeConfig,
+  requestId: string,
+  nowMs: number,
+): Promise<Response> {
+  const contentType = request.headers.get("Content-Type")?.split(";", 1)[0]?.trim().toLowerCase();
+  if (contentType !== "application/x-www-form-urlencoded") {
+    throw new HttpError(415, "invalid_request", "The Steam login form has an invalid content type.");
+  }
+  const form = new URLSearchParams(new TextDecoder().decode(await readBoundedBody(request, 4096)));
+  const values = form.getAll("user_code");
+  const code = values.length === 1 ? values[0]!.toUpperCase() : "";
+  if (!/^[A-Z2-9]{4}-[A-Z2-9]{4}$/u.test(code)) {
+    throw new HttpError(400, "invalid_request", "The device code is invalid or expired.");
+  }
+  const codeHash = await opaqueHash(config, "user-code", code);
+  const device = await env.DB.prepare(
+    `SELECT id FROM device_auth_sessions
+      WHERE user_code_hash = ? AND status = 'pending' AND expires_at > ?`,
+  ).bind(codeHash, nowMs).first<{ id: string }>();
+  if (device === null) throw new HttpError(400, "invalid_request", "The device code is invalid or expired.");
+
+  const state = randomToken();
+  const stateHash = await opaqueHash(config, "steam-openid-state", state);
+  const returnTo = `${config.publicOrigin}/v1/auth/steam/callback?state=${encodeURIComponent(state)}`;
+  const id = crypto.randomUUID();
+  const result = await env.DB.prepare(
+    `INSERT INTO steam_openid_sessions
+       (id, device_session_id, state_hash, status, return_to, user_code, created_at, expires_at)
+     VALUES (?, ?, ?, 'pending', ?, ?, ?, ?)
+     ON CONFLICT(device_session_id) DO UPDATE SET
+       id = excluded.id, state_hash = excluded.state_hash, status = 'pending',
+       return_to = excluded.return_to, user_code = excluded.user_code, steam_id64 = NULL,
+       response_nonce_hash = NULL,
+       confirm_token_hash = NULL, created_at = excluded.created_at,
+       expires_at = excluded.expires_at, verified_at = NULL, confirmed_at = NULL
+     WHERE steam_openid_sessions.status IN ('pending', 'failed')
+        OR steam_openid_sessions.expires_at <= ?`,
+  ).bind(id, device.id, stateHash, returnTo, code, nowMs, nowMs + LOGIN_LIFETIME_MS, nowMs).run();
+  if ((result.meta.changes ?? 0) !== 1) {
+    throw new HttpError(409, "steam_login_in_progress", "This device already has a verified Steam login to confirm.");
+  }
+
+  const steamUrl = new URL(STEAM_OPENID_ENDPOINT);
+  steamUrl.searchParams.set("openid.ns", OPENID_NAMESPACE);
+  steamUrl.searchParams.set("openid.mode", "checkid_setup");
+  steamUrl.searchParams.set("openid.return_to", returnTo);
+  steamUrl.searchParams.set("openid.realm", `${config.publicOrigin}/`);
+  steamUrl.searchParams.set("openid.identity", IDENTIFIER_SELECT);
+  steamUrl.searchParams.set("openid.claimed_id", IDENTIFIER_SELECT);
+  return new Response(null, {
+    status: 303,
+    headers: responseHeaders(requestId, { Location: steamUrl.toString() }),
+  });
+}
+
+export async function steamCallback(
+  request: Request,
+  env: Env,
+  config: RuntimeConfig,
+  requestId: string,
+  nowMs: number,
+  fetcher: typeof fetch = fetch,
+): Promise<Response> {
+  const parameters = new URL(request.url).searchParams;
+  const state = exactParameter(parameters, "state", 64);
+  if (state.length !== 43) throw new HttpError(400, "steam_assertion_invalid", "Steam authentication could not be verified.");
+  const stateHash = await opaqueHash(config, "steam-openid-state", state);
+  const login = await env.DB.prepare(
+    `SELECT id, device_session_id, status, return_to, steam_id64, expires_at, user_code
+       FROM steam_openid_sessions WHERE state_hash = ?`,
+  ).bind(stateHash).first<OpenIdSessionRow>();
+  if (login === null || login.status !== "pending" || login.expires_at <= nowMs) {
+    throw new HttpError(400, "steam_assertion_invalid", "The Steam login is invalid, expired, or already used.");
+  }
+  const verified = await verifySteamOpenIdAssertion(parameters, login.return_to, nowMs, fetcher);
+  const nonceHash = await opaqueHash(config, "steam-openid-nonce", verified.responseNonce);
+  const confirmToken = randomToken();
+  const confirmHash = await opaqueHash(config, "steam-confirm-token", confirmToken);
+  let updated: { id: string } | null;
+  try {
+    updated = await env.DB.prepare(
+      `UPDATE steam_openid_sessions
+          SET status = 'verified', steam_id64 = ?, response_nonce_hash = ?,
+              confirm_token_hash = ?, verified_at = ?
+        WHERE id = ? AND status = 'pending' AND expires_at > ?
+        RETURNING id`,
+    ).bind(verified.steamId64, nonceHash, confirmHash, nowMs, login.id, nowMs).first<{ id: string }>();
+  } catch {
+    throw new HttpError(400, "steam_assertion_invalid", "The Steam assertion was already used.");
+  }
+  if (updated === null) throw new HttpError(409, "steam_login_consumed", "The Steam login was already consumed.");
+  return htmlResponse("Confirm SS2Revive link", `
+<p class="eyebrow">Steam verified</p><h1>Confirm this device</h1>
+<p class="lede">Steam accepted the account. Check the details against the game before approving it.</p>
+<dl class="facts"><dt>Steam ID</dt><dd>${escapeHtml(verified.steamId64)}</dd>
+<dt>Device code</dt><dd class="device-code">${escapeHtml(login.user_code ?? "unknown")}</dd></dl>
+<div class="notice"><strong>The code must exactly match the one visible in SS2Revive.</strong>
+If it differs&mdash;or you did not start this login&mdash;close this page without approving.</div>
+<form method="post" action="/v1/auth/steam/confirm">
+<input type="hidden" name="state" value="${escapeHtml(state)}">
+<input type="hidden" name="confirm_token" value="${escapeHtml(confirmToken)}">
+<div class="actions"><button type="submit">Approve this device</button>
+<a class="text-link" href="/activate">Cancel and start over</a></div></form>`, 200, requestId);
+}
+
+export async function confirmSteamLogin(
+  request: Request,
+  env: Env,
+  config: RuntimeConfig,
+  requestId: string,
+  nowMs: number,
+): Promise<Response> {
+  const contentType = request.headers.get("Content-Type")?.split(";", 1)[0]?.trim().toLowerCase();
+  if (contentType !== "application/x-www-form-urlencoded") {
+    throw new HttpError(415, "invalid_request", "The confirmation form has an invalid content type.");
+  }
+  const form = new URLSearchParams(new TextDecoder().decode(await readBoundedBody(request, 4096)));
+  const states = form.getAll("state");
+  const tokens = form.getAll("confirm_token");
+  const state = states.length === 1 ? states[0]! : "";
+  const token = tokens.length === 1 ? tokens[0]! : "";
+  if (state.length !== 43 || token.length !== 43) {
+    throw new HttpError(400, "invalid_request", "The confirmation is invalid or expired.");
+  }
+  const login = await env.DB.prepare(
+    `SELECT id, device_session_id, status, return_to, steam_id64, expires_at
+       FROM steam_openid_sessions
+      WHERE state_hash = ? AND confirm_token_hash = ?`,
+  ).bind(
+    await opaqueHash(config, "steam-openid-state", state),
+    await opaqueHash(config, "steam-confirm-token", token),
+  ).first<OpenIdSessionRow>();
+  if (login === null || login.status !== "verified" || login.expires_at <= nowMs || !isSteamId64(login.steam_id64)) {
+    throw new HttpError(400, "invalid_request", "The confirmation is invalid or expired.");
+  }
+  const results = await env.DB.batch([
+    env.DB.prepare(
+      `INSERT INTO users (steam_id64, status, created_at, last_login_at)
+       VALUES (?, 'active', ?, ?)
+       ON CONFLICT(steam_id64) DO UPDATE SET last_login_at = excluded.last_login_at`,
+    ).bind(login.steam_id64, nowMs, nowMs),
+    env.DB.prepare(
+      `UPDATE device_auth_sessions SET status = 'approved', steam_id64 = ?, approved_at = ?
+        WHERE id = ? AND status = 'pending' AND expires_at > ?`,
+    ).bind(login.steam_id64, nowMs, login.device_session_id, nowMs),
+    env.DB.prepare(
+      `UPDATE steam_openid_sessions SET status = 'confirmed', confirmed_at = ?, confirm_token_hash = NULL
+        WHERE id = ? AND status = 'verified'
+          AND EXISTS (SELECT 1 FROM device_auth_sessions d
+                       WHERE d.id = steam_openid_sessions.device_session_id
+                         AND d.status = 'approved' AND d.steam_id64 = ?)
+        RETURNING id`,
+    ).bind(nowMs, login.id, login.steam_id64),
+  ]);
+  const confirmed = results[2]?.results as Array<{ id?: unknown }> | undefined;
+  if (confirmed?.[0]?.id !== login.id) {
+    throw new HttpError(409, "steam_login_consumed", "The Steam login could not be confirmed.");
+  }
+  return htmlResponse("SS2Revive linked", `
+<p class="eyebrow">Device approved</p><h1>You're connected</h1>
+<p class="lede">Return to SS2Revive. The game will finish signing in automatically.</p>
+<div class="notice">You can close this browser tab. Manage or end this session with the
+<strong>Log out</strong> button in Creation Mode.</div>`, 200, requestId);
+}
+
+export function steamAuthErrorPage(error: HttpError, requestId: string): Response {
+  return htmlResponse("SS2Revive sign-in problem", `
+<p class="eyebrow">Sign-in stopped</p><h1>We couldn't continue</h1>
+<p class="lede">${escapeHtml(error.message)}</p>
+<div class="notice">Return to SS2Revive and start the sign-in again. Device codes expire and can
+only be approved once.</div>
+<div class="actions"><a class="button" href="/activate">Try another code</a></div>
+<p class="request">Request ${escapeHtml(requestId)}</p>`, error.status, requestId, error.headers);
+}
diff --git a/backend/community-api/src/uploads.ts b/backend/community-api/src/uploads.ts
new file mode 100644
index 0000000..286fcc3
--- /dev/null
+++ b/backend/community-api/src/uploads.ts
@@ -0,0 +1,831 @@
+import {
+  BundleValidationError,
+  hasOnlyKeys,
+  inspectLevelBundle,
+  isCanonicalUuid,
+  isPlainObject,
+  isSemanticVersion,
+  isSha256,
+  MAX_BUNDLE_BYTES,
+  MAX_TITLE_CHARACTERS,
+  sha256Hex,
+  type AuthPrincipal,
+  type InspectedLevelBundle,
+  type UploadStatus,
+} from "@ss2revive/community-contracts";
+import { runtimeConfig, type RuntimeConfig } from "./config";
+import { emptyResponse, HttpError, jsonResponse, readJsonObject, requireMethod } from "./http";
+
+const RESERVATION_LIFETIME_MS = 30 * 60 * 1000;
+const MAX_ACTIVE_UPLOADS = 3;
+const MINIMUM_REVIVE_VERSION = "1.1.0";
+/** Current revision plus the two before it stay downloadable; older approved objects are released. */
+const RETAINED_REVISIONS = 3;
+/** How long a claimed validation lease stays valid before maintenance may reclaim it. */
+const VALIDATION_LEASE_TTL_MS = 10 * 60 * 1000;
+
+export interface UploadQueueMessage {
+  kind: "map-upload";
+  uploadId: string;
+}
+
+interface UploadRow {
+  id: string;
+  steam_id64: string;
+  status: UploadStatus;
+  expected_size_bytes: number;
+  expected_sha256: string;
+  quarantine_key: string;
+  map_id: string | null;
+  revision: number | null;
+  error_code: string | null;
+  error_message: string | null;
+  expires_at: number;
+  validation_lease: string | null;
+  validation_started_at: number | null;
+}
+
+interface ExistingMapRow {
+  current_revision: number;
+  creator_ids_json: string;
+  sha256: string;
+  bundle_key: string;
+  owner_steam_id64: string | null;
+  status: "published" | "unpublished" | "archived";
+  moderation_reason: string | null;
+}
+
+class UploadRejected extends Error {
+  readonly code: string;
+
+  constructor(code: string, message: string) {
+    super(message);
+    this.name = "UploadRejected";
+    this.code = code;
+  }
+}
+
+function gamePlayerId(steamId64: string): string {
+  return `STEAM-${steamId64}`.padEnd(36, "-");
+}
+
+function requirePublisher(principal: AuthPrincipal): void {
+  if (!principal.scopes.includes("maps:upload")) {
+    throw new HttpError(403, "scope_denied", "The token lacks the required publishing scope.");
+  }
+}
+
+async function reserveDailyQuota(
+  env: Env,
+  config: RuntimeConfig,
+  steamId64: string,
+  nowMs: number,
+): Promise<void> {
+  const dayUtc = new Date(nowMs).toISOString().slice(0, 10);
+  const row = await env.DB.prepare(
+    `INSERT INTO upload_usage_daily (steam_id64, day_utc, reservations, updated_at)
+     VALUES (?, ?, 1, ?)
+     ON CONFLICT(steam_id64, day_utc) DO UPDATE SET
+       reservations = upload_usage_daily.reservations + 1,
+       updated_at = excluded.updated_at
+     WHERE upload_usage_daily.reservations < ?
+     RETURNING reservations`,
+  ).bind(steamId64, dayUtc, nowMs, config.uploadDailyLimit).first<{ reservations: number }>();
+  if (row === null) {
+    const nextDayMs = Date.parse(`${dayUtc}T00:00:00.000Z`) + 24 * 60 * 60 * 1000;
+    throw new HttpError(429, "daily_upload_limit_reached", "The daily upload limit has been reached.", {
+      "Retry-After": String(Math.max(60, Math.ceil((nextDayMs - nowMs) / 1000))),
+    });
+  }
+}
+
+async function uploadRow(env: Env, uploadId: string, steamId64?: string): Promise<UploadRow | null> {
+  const ownerClause = steamId64 === undefined ? "" : " AND steam_id64 = ?";
+  const statement = env.DB.prepare(
+    `SELECT id, steam_id64, status, expected_size_bytes, expected_sha256, quarantine_key,
+            map_id, revision, error_code, error_message, expires_at,
+            validation_lease, validation_started_at
+       FROM map_uploads WHERE id = ?${ownerClause}`,
+  );
+  return steamId64 === undefined
+    ? statement.bind(uploadId).first<UploadRow>()
+    : statement.bind(uploadId, steamId64).first<UploadRow>();
+}
+
+function statusBody(row: UploadRow, requestId: string): Record<string, unknown> {
+  const body: Record<string, unknown> = {
+    requestId,
+    uploadId: row.id,
+    status: row.status,
+  };
+  if (row.map_id !== null) body.mapId = row.map_id;
+  if (row.revision !== null) body.revision = row.revision;
+  if (row.error_code !== null) body.errorCode = row.error_code;
+  if (row.error_message !== null) body.errorMessage = row.error_message;
+  return body;
+}
+
+export async function reserveUpload(
+  request: Request,
+  env: Env,
+  config: RuntimeConfig,
+  principal: AuthPrincipal,
+  requestId: string,
+  nowMs: number,
+): Promise<Response> {
+  requireMethod(request, "POST");
+  requirePublisher(principal);
+  const body = await readJsonObject(request, 4096);
+  if (
+    !hasOnlyKeys(body, ["sizeBytes", "sha256"]) ||
+    !Number.isSafeInteger(body.sizeBytes) || (body.sizeBytes as number) < 1 ||
+    (body.sizeBytes as number) > MAX_BUNDLE_BYTES || !isSha256(body.sha256)
+  ) {
+    throw new HttpError(400, "invalid_request", "The upload size or SHA-256 is invalid.");
+  }
+  const active = await env.DB.prepare(
+    `SELECT COUNT(*) AS count FROM map_uploads
+      WHERE steam_id64 = ? AND status IN ('reserved', 'uploaded', 'validating') AND expires_at > ?`,
+  ).bind(principal.steamId64, nowMs).first<{ count: number }>();
+  if (active === null || !Number.isSafeInteger(active.count)) {
+    throw new HttpError(503, "temporarily_unavailable", "The upload quota could not be checked.");
+  }
+  if (active.count >= MAX_ACTIVE_UPLOADS) {
+    throw new HttpError(429, "upload_limit_reached", "Finish or cancel an existing upload first.", {
+      "Retry-After": "60",
+    });
+  }
+  await reserveDailyQuota(env, config, principal.steamId64, nowMs);
+
+  const uploadId = crypto.randomUUID();
+  const expiresAt = nowMs + RESERVATION_LIFETIME_MS;
+  const quarantineKey = `quarantine/uploads/${principal.steamId64}/${uploadId}/${body.sha256}.ss2level`;
+  await env.DB.prepare(
+    `INSERT INTO map_uploads
+       (id, steam_id64, status, expected_size_bytes, expected_sha256, quarantine_key, created_at, expires_at)
+     VALUES (?, ?, 'reserved', ?, ?, ?, ?, ?)`,
+  ).bind(
+    uploadId,
+    principal.steamId64,
+    body.sizeBytes,
+    body.sha256,
+    quarantineKey,
+    nowMs,
+    expiresAt,
+  ).run();
+  return jsonResponse({
+    requestId,
+    uploadId,
+    status: "reserved",
+    bundleUploadPath: `/v1/uploads/${uploadId}/bundle`,
+    statusPath: `/v1/uploads/${uploadId}`,
+    expiresAt: new Date(expiresAt).toISOString(),
+  }, 201, requestId, { "Cache-Control": "no-store" });
+}
+
+async function enqueueValidation(env: Env, uploadId: string): Promise<void> {
+  await env.VALIDATION_QUEUE.send({ kind: "map-upload", uploadId } satisfies UploadQueueMessage, {
+    contentType: "json",
+  });
+}
+
+export async function putUploadBundle(
+  request: Request,
+  env: Env,
+  _config: RuntimeConfig,
+  principal: AuthPrincipal,
+  uploadId: string,
+  requestId: string,
+  nowMs: number,
+): Promise<Response> {
+  requireMethod(request, "PUT");
+  requirePublisher(principal);
+  if (!isCanonicalUuid(uploadId)) throw new HttpError(404, "upload_not_found", "The upload was not found.");
+  const row = await uploadRow(env, uploadId, principal.steamId64);
+  if (row === null) throw new HttpError(404, "upload_not_found", "The upload was not found.");
+  if (row.expires_at <= nowMs && row.status !== "published") {
+    throw new HttpError(410, "upload_expired", "The upload reservation expired.");
+  }
+  if (row.status === "uploaded" || row.status === "validating") {
+    await enqueueValidation(env, row.id);
+    return jsonResponse(statusBody(row, requestId), 202, requestId, { "Retry-After": "2" });
+  }
+  if (row.status !== "reserved") {
+    throw new HttpError(409, "upload_not_writable", "The upload is no longer writable.");
+  }
+  const contentType = request.headers.get("Content-Type")?.split(";", 1)[0]?.trim().toLowerCase();
+  const lengthText = request.headers.get("Content-Length") ?? "";
+  const suppliedSha256 = request.headers.get("X-Content-SHA256") ?? "";
+  if (
+    contentType !== "application/vnd.ss2revive.level" ||
+    !/^[1-9][0-9]*$/u.test(lengthText) || Number(lengthText) !== row.expected_size_bytes ||
+    suppliedSha256 !== row.expected_sha256 || request.body === null
+  ) {
+    throw new HttpError(400, "upload_metadata_mismatch", "The upload headers do not match the reservation.");
+  }
+
+  let object: R2Object | null;
+  try {
+    object = await env.MAP_BUCKET.put(row.quarantine_key, request.body, {
+      onlyIf: { etagDoesNotMatch: "*" },
+      sha256: row.expected_sha256,
+      httpMetadata: { contentType: "application/vnd.ss2revive.level" },
+      customMetadata: {
+        sha256: row.expected_sha256,
+        uploadId: row.id,
+        owner: row.steam_id64,
+        state: "quarantine",
+      },
+    });
+  } catch {
+    throw new HttpError(400, "upload_checksum_mismatch", "The uploaded bytes failed their SHA-256 check.");
+  }
+  if (object === null) object = await env.MAP_BUCKET.head(row.quarantine_key);
+  if (
+    object === null || object.size !== row.expected_size_bytes ||
+    object.customMetadata?.sha256 !== row.expected_sha256 ||
+    object.customMetadata.uploadId !== row.id || object.customMetadata.owner !== row.steam_id64
+  ) {
+    throw new HttpError(409, "upload_conflict", "The quarantine object does not match this reservation.");
+  }
+  const updated = await env.DB.prepare(
+    `UPDATE map_uploads SET status = 'uploaded', uploaded_at = ?
+      WHERE id = ? AND steam_id64 = ? AND status = 'reserved' AND expires_at > ?`,
+  ).bind(nowMs, row.id, row.steam_id64, nowMs).run();
+  if ((updated.meta.changes ?? 0) !== 1) {
+    throw new HttpError(409, "upload_conflict", "The upload state changed while bytes were being received.");
+  }
+  try {
+    await enqueueValidation(env, row.id);
+  } catch {
+    await env.DB.prepare(
+      `UPDATE map_uploads SET status = 'cancelled', completed_at = ?
+        WHERE id = ? AND steam_id64 = ? AND status = 'uploaded'`,
+    ).bind(nowMs, row.id, row.steam_id64).run();
+    await env.MAP_BUCKET.delete(row.quarantine_key);
+    throw new HttpError(503, "validation_unavailable", "Validation could not be scheduled. Retry the upload.");
+  }
+  row.status = "uploaded";
+  return jsonResponse(statusBody(row, requestId), 202, requestId, { "Retry-After": "2" });
+}
+
+export async function getUploadStatus(
+  request: Request,
+  env: Env,
+  _config: RuntimeConfig,
+  principal: AuthPrincipal,
+  uploadId: string,
+  requestId: string,
+): Promise<Response> {
+  requireMethod(request, "GET");
+  requirePublisher(principal);
+  if (!isCanonicalUuid(uploadId)) throw new HttpError(404, "upload_not_found", "The upload was not found.");
+  const row = await uploadRow(env, uploadId, principal.steamId64);
+  if (row === null) throw new HttpError(404, "upload_not_found", "The upload was not found.");
+  return jsonResponse(statusBody(row, requestId), 200, requestId, {
+    "Cache-Control": "no-store",
+    ...(row.status === "uploaded" || row.status === "validating" ? { "Retry-After": "2" } : {}),
+  });
+}
+
+export async function cancelUpload(
+  request: Request,
+  env: Env,
+  _config: RuntimeConfig,
+  principal: AuthPrincipal,
+  uploadId: string,
+  requestId: string,
+  nowMs: number,
+): Promise<Response> {
+  requireMethod(request, "DELETE");
+  requirePublisher(principal);
+  if (!isCanonicalUuid(uploadId)) throw new HttpError(404, "upload_not_found", "The upload was not found.");
+  const row = await uploadRow(env, uploadId, principal.steamId64);
+  if (row === null) throw new HttpError(404, "upload_not_found", "The upload was not found.");
+  if (row.status !== "reserved" && row.status !== "uploaded") {
+    throw new HttpError(409, "upload_not_cancellable", "The upload can no longer be cancelled.");
+  }
+  const changed = await env.DB.prepare(
+    `UPDATE map_uploads SET status = 'cancelled', completed_at = ?
+      WHERE id = ? AND steam_id64 = ? AND status IN ('reserved', 'uploaded')`,
+  ).bind(nowMs, row.id, row.steam_id64).run();
+  if ((changed.meta.changes ?? 0) !== 1) {
+    throw new HttpError(409, "upload_not_cancellable", "The upload can no longer be cancelled.");
+  }
+  await env.MAP_BUCKET.delete(row.quarantine_key);
+  return emptyResponse(204, requestId);
+}
+
+function checksumHex(value: ArrayBuffer | undefined): string | null {
+  if (value === undefined) return null;
+  return [...new Uint8Array(value)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+function creatorArray(text: string): string[] {
+  try {
+    const value = JSON.parse(text) as unknown;
+    return Array.isArray(value) && value.every((item) => typeof item === "string") ? value : [];
+  } catch {
+    return [];
+  }
+}
+
+function playerCounts(configurations: unknown[]): string {
+  const values = new Set<number>();
+  for (const item of configurations) {
+    if (item !== null && typeof item === "object" && !Array.isArray(item)) {
+      const value = (item as Record<string, unknown>).numberPlayers;
+      if (Number.isSafeInteger(value) && (value as number) >= 1 && (value as number) <= 4) values.add(value as number);
+    }
+  }
+  if (values.size === 0) values.add(1);
+  return `,${[...values].sort((left, right) => left - right).join(",")},`;
+}
+
+function equalBytes(left: Uint8Array | undefined, right: Uint8Array | undefined): boolean {
+  if (left === undefined || right === undefined) return left === right;
+  if (left.length !== right.length) return false;
+  for (let index = 0; index < left.length; index += 1) {
+    if (left[index] !== right[index]) return false;
+  }
+  return true;
+}
+
+function validationIdentity(validations: unknown[]): string {
+  return JSON.stringify(validations.map((validation) => {
+    if (!isPlainObject(validation)) return validation;
+    return { id: validation.id, description: validation.description };
+  }));
+}
+
+function sameLogicalRevision(left: InspectedLevelBundle, right: InspectedLevelBundle): boolean {
+  const leftManifest = left.manifest;
+  const rightManifest = right.manifest;
+  return leftManifest.id === rightManifest.id && leftManifest.title === rightManifest.title &&
+    leftManifest.description === rightManifest.description && leftManifest.createdAt === rightManifest.createdAt &&
+    leftManifest.clientVersion === rightManifest.clientVersion &&
+    leftManifest.contentVersion === rightManifest.contentVersion &&
+    leftManifest.contentSha256 === rightManifest.contentSha256 &&
+    JSON.stringify(leftManifest.creators) === JSON.stringify(rightManifest.creators) &&
+    JSON.stringify(leftManifest.tags) === JSON.stringify(rightManifest.tags) &&
+    JSON.stringify(leftManifest.configurations) === JSON.stringify(rightManifest.configurations) &&
+    validationIdentity(leftManifest.validations) === validationIdentity(rightManifest.validations) &&
+    equalBytes(left.contentImage, right.contentImage) && equalBytes(left.thumbnail, right.thumbnail);
+}
+
+async function isIdempotentRevision(
+  env: Env,
+  existing: ExistingMapRow,
+  incoming: InspectedLevelBundle,
+  nowMs: number,
+): Promise<boolean> {
+  if (incoming.bundleSha256 === existing.sha256) return true;
+  const expectedKey = `approved/maps/${incoming.manifest.id}/r${existing.current_revision}/${existing.sha256}.ss2level`;
+  if (existing.bundle_key !== expectedKey) throw new Error("the current approved bundle key is inconsistent");
+  const object = await env.MAP_BUCKET.get(existing.bundle_key);
+  if (object === null || object.size < 1 || object.size > MAX_BUNDLE_BYTES) {
+    throw new Error("the current approved bundle is missing or invalid");
+  }
+  const approved = await inspectLevelBundle(new Uint8Array(await object.arrayBuffer()), { nowMs });
+  if (approved.bundleSha256 !== existing.sha256) throw new Error("the current approved bundle checksum is invalid");
+  return sameLogicalRevision(approved, incoming);
+}
+
+/**
+ * Charge an accepted revision against the account's daily byte allowance and its total retained
+ * footprint. The lifetime map-count quota only gates new map identifiers, so without these an
+ * account could republish revisions of one map and consume storage without bound.
+ */
+async function reserveStorageQuota(
+  env: Env,
+  config: RuntimeConfig,
+  steamId64: string,
+  bytes: number,
+  nowMs: number,
+): Promise<void> {
+  const dayUtc = new Date(nowMs).toISOString().slice(0, 10);
+  const daily = await env.DB.prepare(
+    `UPDATE upload_usage_daily SET bytes_published = bytes_published + ?, updated_at = ?
+      WHERE steam_id64 = ? AND day_utc = ? AND bytes_published + ? <= ?
+      RETURNING bytes_published`,
+  ).bind(bytes, nowMs, steamId64, dayUtc, bytes, config.uploadDailyBytes).first<{ bytes_published: number }>();
+  if (daily === null) {
+    throw new UploadRejected(
+      "daily_upload_bytes_reached",
+      "This Steam account has published its daily storage allowance. Try again tomorrow.",
+    );
+  }
+  const retained = await env.DB.prepare(
+    `INSERT INTO account_storage (steam_id64, retained_bytes, updated_at)
+     VALUES (?, ?, ?)
+     ON CONFLICT(steam_id64) DO UPDATE SET
+       retained_bytes = account_storage.retained_bytes + excluded.retained_bytes,
+       updated_at = excluded.updated_at
+     WHERE account_storage.retained_bytes + excluded.retained_bytes <= ?
+     RETURNING retained_bytes`,
+  ).bind(steamId64, bytes, nowMs, config.retainedBytesPerAccount).first<{ retained_bytes: number }>();
+  if (retained === null) {
+    await env.DB.prepare(
+      `UPDATE upload_usage_daily SET bytes_published = MAX(0, bytes_published - ?), updated_at = ?
+        WHERE steam_id64 = ? AND day_utc = ?`,
+    ).bind(bytes, nowMs, steamId64, dayUtc).run();
+    throw new UploadRejected(
+      "storage_quota_reached",
+      "This Steam account has reached its retained storage limit. Delete an old map to publish more.",
+    );
+  }
+}
+
+/** Return released bytes to the account's retained footprint after revisions are collected. */
+async function releaseStorageQuota(
+  env: Env,
+  steamId64: string | null,
+  bytes: number,
+  nowMs: number,
+): Promise<void> {
+  if (steamId64 === null || bytes <= 0) return;
+  await env.DB.prepare(
+    `UPDATE account_storage SET retained_bytes = MAX(0, retained_bytes - ?), updated_at = ?
+      WHERE steam_id64 = ?`,
+  ).bind(bytes, nowMs, steamId64).run();
+}
+
+/**
+ * Approved bundles and thumbnails used to be retained for every revision ever published, so a
+ * single account could grow R2 without bound by republishing the same map. Keep the current
+ * revision plus a short rollback window and release the rest.
+ *
+ * D1 rows are removed before their objects: an unreferenced object is collected by the scheduled
+ * reconciler, whereas a row pointing at a deleted object would break downloads.
+ */
+async function retireSupersededRevisions(
+  env: Env,
+  mapId: string,
+  currentRevision: number,
+  ownerSteamId64: string,
+  nowMs: number,
+): Promise<void> {
+  const oldestRetained = currentRevision - (RETAINED_REVISIONS - 1);
+  if (oldestRetained < 2) return;
+  const stale = await env.DB.prepare(
+    `SELECT revision, bundle_key, thumbnail_key, size_bytes, thumbnail_size_bytes
+       FROM map_versions
+      WHERE map_id = ? AND revision < ? ORDER BY revision ASC LIMIT 100`,
+  ).bind(mapId, oldestRetained).all<{
+    revision: number;
+    bundle_key: string;
+    thumbnail_key: string | null;
+    size_bytes: number;
+    thumbnail_size_bytes: number | null;
+  }>();
+  if (stale.results.length === 0) return;
+
+  const statements: D1PreparedStatement[] = [];
+  const keys: string[] = [];
+  let released = 0;
+  for (const version of stale.results) {
+    statements.push(env.DB.prepare(
+      `DELETE FROM map_tags WHERE map_id = ? AND revision = ?`,
+    ).bind(mapId, version.revision));
+    statements.push(env.DB.prepare(
+      `DELETE FROM map_versions WHERE map_id = ? AND revision = ? AND revision < ?`,
+    ).bind(mapId, version.revision, currentRevision));
+    keys.push(version.bundle_key);
+    released += version.size_bytes;
+    if (version.thumbnail_key !== null) {
+      keys.push(version.thumbnail_key);
+      released += version.thumbnail_size_bytes ?? 0;
+    }
+  }
+  await env.DB.batch(statements);
+  await env.MAP_BUCKET.delete(keys);
+  await releaseStorageQuota(env, ownerSteamId64, released, nowMs);
+}
+
+async function rejectUpload(env: Env, row: UploadRow, code: string, message: string, nowMs: number): Promise<void> {
+  await env.MAP_BUCKET.delete(row.quarantine_key);
+  await env.DB.prepare(
+    `UPDATE map_uploads
+        SET status = 'rejected', error_code = ?, error_message = ?, completed_at = ?
+      WHERE id = ? AND status IN ('uploaded', 'validating')`,
+  ).bind(code.slice(0, 64), message.slice(0, 512), nowMs, row.id).run();
+}
+
+async function publishValidatedUpload(
+  env: Env,
+  config: RuntimeConfig,
+  row: UploadRow,
+  validationLease: string,
+  nowMs: number,
+): Promise<void> {
+  const object = await env.MAP_BUCKET.get(row.quarantine_key);
+  if (
+    object === null || object.size !== row.expected_size_bytes ||
+    object.customMetadata?.sha256 !== row.expected_sha256 ||
+    checksumHex(object.checksums.sha256) !== row.expected_sha256
+  ) {
+    throw new UploadRejected("quarantine_mismatch", "The quarantined object failed its metadata check.");
+  }
+  const bytes = new Uint8Array(await object.arrayBuffer());
+  if (bytes.length !== row.expected_size_bytes) {
+    throw new UploadRejected("quarantine_mismatch", "The quarantined object size changed during validation.");
+  }
+  const inspected = await inspectLevelBundle(bytes, { nowMs });
+  if (inspected.bundleSha256 !== row.expected_sha256) {
+    throw new UploadRejected("bundle_checksum_invalid", "The bundle SHA-256 does not match its reservation.");
+  }
+  const uploaderPlayerId = gamePlayerId(row.steam_id64);
+  if (!inspected.manifest.creators.includes(uploaderPlayerId)) {
+    throw new UploadRejected("creator_mismatch", "The authenticated Steam user is not a creator of this map.");
+  }
+  if (!isSemanticVersion(inspected.manifest.reviveVersion)) {
+    throw new UploadRejected("revive_version_invalid", "The bundle does not declare a supported SS2Revive version.");
+  }
+
+  const revision = inspected.manifest.contentVersion;
+  // updated_at_ms is the default catalogue sort key and comes from a publisher-declared timestamp.
+  // Clamp it to server time so a manifest cannot rank itself above every legitimate map.
+  const publishedAtMs = Math.min(inspected.manifest.exportedAt, nowMs);
+  const existing = await env.DB.prepare(
+    `SELECT m.current_revision, m.owner_steam_id64, m.status, m.moderation_reason,
+            v.creator_ids_json, v.sha256, v.bundle_key
+       FROM maps m JOIN map_versions v ON v.map_id = m.id AND v.revision = m.current_revision
+      WHERE m.id = ?`,
+  ).bind(inspected.manifest.id).first<ExistingMapRow>();
+  if (existing !== null) {
+    if ((existing.owner_steam_id64 !== null && existing.owner_steam_id64 !== row.steam_id64) ||
+        (existing.owner_steam_id64 === null && !creatorArray(existing.creator_ids_json).includes(uploaderPlayerId))) {
+      throw new UploadRejected("map_owner_mismatch", "This Steam user does not own the existing community map.");
+    }
+    if (existing.moderation_reason !== null) {
+      throw new UploadRejected(
+        "map_under_moderation",
+        "This map was removed by a maintainer and cannot be republished until it is restored.",
+      );
+    }
+    if (revision <= existing.current_revision) {
+      if (revision === existing.current_revision &&
+          await isIdempotentRevision(env, existing, inspected, nowMs)) {
+        // The moderation check above is a read; a maintainer can take the map down between that
+        // read and this write. Re-assert it as a compare-and-swap so a takedown always wins, and
+        // never clear moderation_reason as a side effect of an ordinary publication.
+        const results = await env.DB.batch([
+          env.DB.prepare(
+            `UPDATE maps SET status = 'published', owner_steam_id64 = COALESCE(owner_steam_id64, ?),
+                             unpublished_at_ms = NULL, archived_at_ms = NULL,
+                             updated_at_ms = MAX(updated_at_ms, ?)
+              WHERE id = ? AND (owner_steam_id64 = ? OR owner_steam_id64 IS NULL)
+                AND moderation_reason IS NULL`,
+          ).bind(row.steam_id64, publishedAtMs, inspected.manifest.id, row.steam_id64),
+          env.DB.prepare(
+            `UPDATE map_versions SET status = 'published'
+              WHERE map_id = ? AND revision = ?
+                AND EXISTS (SELECT 1 FROM maps m WHERE m.id = map_versions.map_id
+                             AND m.moderation_reason IS NULL)`,
+          ).bind(inspected.manifest.id, revision),
+          env.DB.prepare(
+            `UPDATE map_uploads SET status = 'published', map_id = ?, revision = ?, completed_at = ?
+              WHERE id = ? AND status = 'validating' AND validation_lease = ?`,
+          ).bind(inspected.manifest.id, revision, nowMs, row.id, validationLease),
+        ]);
+        if ((results[0]?.meta.changes ?? 0) !== 1) {
+          throw new UploadRejected(
+            "map_under_moderation",
+            "This map was removed by a maintainer and cannot be republished until it is restored.",
+          );
+        }
+        if ((results.at(-1)?.meta.changes ?? 0) !== 1) {
+          throw new Error("idempotent publication state did not advance");
+        }
+        await env.MAP_BUCKET.delete(row.quarantine_key);
+        return;
+      }
+      throw new UploadRejected("revision_not_newer", "Save the level again before uploading a new revision.");
+    }
+  }
+  if (existing === null) {
+    const owned = await env.DB.prepare(
+      `SELECT COUNT(*) AS count FROM maps WHERE owner_steam_id64 = ?`,
+    ).bind(row.steam_id64).first<{ count: number }>();
+    if (owned === null || !Number.isSafeInteger(owned.count)) {
+      throw new Error("the map ownership quota could not be checked");
+    }
+    if (owned.count >= config.mapsPerAccountLimit) {
+      throw new UploadRejected("map_quota_reached", "This Steam account has reached its map limit.");
+    }
+  }
+
+  const thumbnailBytes = inspected.thumbnail?.length ?? 0;
+  await reserveStorageQuota(env, config, row.steam_id64, bytes.length + thumbnailBytes, nowMs);
+
+  const bundleKey = `approved/maps/${inspected.manifest.id}/r${revision}/${inspected.bundleSha256}.ss2level`;
+  const bundleObject = await env.MAP_BUCKET.put(bundleKey, bytes, {
+    onlyIf: { etagDoesNotMatch: "*" },
+    sha256: inspected.bundleSha256,
+    httpMetadata: { contentType: "application/vnd.ss2revive.level" },
+    customMetadata: { sha256: inspected.bundleSha256, state: "approved" },
+  });
+  if (bundleObject === null) {
+    const existingBundle = await env.MAP_BUCKET.head(bundleKey);
+    if (
+      existingBundle === null || existingBundle.size !== bytes.length ||
+      checksumHex(existingBundle.checksums.sha256) !== inspected.bundleSha256 ||
+      existingBundle.customMetadata?.sha256 !== inspected.bundleSha256 ||
+      existingBundle.customMetadata.state !== "approved"
+    ) {
+      throw new Error("an existing approved bundle failed its integrity check");
+    }
+  }
+  let thumbnailKey: string | null = null;
+  let thumbnailSha256: string | null = null;
+  let thumbnailSize: number | null = null;
+  let thumbnailObject: R2Object | null = null;
+  if (inspected.thumbnail !== undefined) {
+    thumbnailSha256 = await sha256Hex(inspected.thumbnail);
+    thumbnailSize = inspected.thumbnail.length;
+    thumbnailKey = `approved/thumbnails/${inspected.manifest.id}/r${revision}/${thumbnailSha256}.bin`;
+    thumbnailObject = await env.MAP_BUCKET.put(thumbnailKey, inspected.thumbnail, {
+      onlyIf: { etagDoesNotMatch: "*" },
+      sha256: thumbnailSha256,
+      httpMetadata: { contentType: "application/octet-stream" },
+      customMetadata: { sha256: thumbnailSha256, state: "approved" },
+    });
+    if (thumbnailObject === null) {
+      const existingThumbnail = await env.MAP_BUCKET.head(thumbnailKey);
+      if (
+        existingThumbnail === null || existingThumbnail.size !== thumbnailSize ||
+        checksumHex(existingThumbnail.checksums.sha256) !== thumbnailSha256 ||
+        existingThumbnail.customMetadata?.sha256 !== thumbnailSha256 ||
+        existingThumbnail.customMetadata.state !== "approved"
+      ) {
+        throw new Error("an existing approved thumbnail failed its integrity check");
+      }
+    }
+  }
+
+  const manifest = inspected.manifest;
+  // Lowercasing can lengthen a string (U+0130 becomes two code units under en-US), and the
+  // title_asc cursor rejects any sort value longer than a title. Refuse the map rather than
+  // issue a pagination cursor the listing will later reject.
+  const titleSort = manifest.title.toLocaleLowerCase("en-US");
+  if (titleSort.length > MAX_TITLE_CHARACTERS) {
+    throw new UploadRejected("title_invalid", "The level title cannot be sorted within its length limit.");
+  }
+  const statements: D1PreparedStatement[] = [
+    env.DB.prepare(
+      `INSERT INTO maps
+         (id, status, current_revision, title, title_sort, description, created_at_ms, updated_at_ms,
+          owner_steam_id64, unpublished_at_ms, archived_at_ms, moderation_reason)
+       SELECT ?, 'published', ?, ?, ?, ?, ?, ?, ?, NULL, NULL, NULL
+        WHERE EXISTS (SELECT 1 FROM maps WHERE id = ?)
+           OR (SELECT COUNT(*) FROM maps WHERE owner_steam_id64 = ?) < ?
+       ON CONFLICT(id) DO UPDATE SET
+         status = 'published', current_revision = excluded.current_revision,
+         title = excluded.title, title_sort = excluded.title_sort,
+         description = excluded.description, updated_at_ms = excluded.updated_at_ms
+         , owner_steam_id64 = COALESCE(maps.owner_steam_id64, excluded.owner_steam_id64)
+         , unpublished_at_ms = NULL, archived_at_ms = NULL
+       WHERE maps.current_revision < excluded.current_revision
+         AND (maps.owner_steam_id64 = excluded.owner_steam_id64 OR maps.owner_steam_id64 IS NULL)
+         AND maps.moderation_reason IS NULL`,
+    ).bind(
+      manifest.id,
+      revision,
+      manifest.title,
+      titleSort,
+      manifest.description,
+      manifest.createdAt,
+      publishedAtMs,
+      row.steam_id64,
+      manifest.id,
+      row.steam_id64,
+      config.mapsPerAccountLimit,
+    ),
+    env.DB.prepare(
+      `INSERT INTO map_versions
+         (map_id, revision, status, code, creator_ids_json, tags_json,
+          configurations_json, validations_json, player_counts_csv,
+          client_version, map_format_version, minimum_revive_version, revive_version,
+          size_bytes, sha256, bundle_key,
+          thumbnail_size_bytes, thumbnail_sha256, thumbnail_key, created_at_ms)
+       VALUES (?, ?, 'unpublished', ?, ?, ?, ?, ?, ?, 29, 29, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    ).bind(
+      manifest.id,
+      revision,
+      inspected.code,
+      JSON.stringify(manifest.creators),
+      JSON.stringify(manifest.tags),
+      JSON.stringify(manifest.configurations),
+      JSON.stringify(manifest.validations),
+      playerCounts(manifest.configurations),
+      MINIMUM_REVIVE_VERSION,
+      manifest.reviveVersion,
+      bytes.length,
+      inspected.bundleSha256,
+      bundleKey,
+      thumbnailSize,
+      thumbnailSha256,
+      thumbnailKey,
+      publishedAtMs,
+    ),
+  ];
+  for (const tag of manifest.tags) {
+    statements.push(env.DB.prepare(
+      `INSERT INTO map_tags (map_id, revision, tag) VALUES (?, ?, ?)`,
+    ).bind(manifest.id, revision, tag));
+  }
+  statements.push(env.DB.prepare(
+    `UPDATE map_versions SET status = 'published'
+      WHERE map_id = ? AND revision = ?
+        AND EXISTS (SELECT 1 FROM maps m WHERE m.id = map_versions.map_id
+                     AND m.current_revision = map_versions.revision)`,
+  ).bind(manifest.id, revision));
+  statements.push(env.DB.prepare(
+    `UPDATE map_uploads SET status = 'published', map_id = ?, revision = ?, completed_at = ?
+      WHERE id = ? AND status = 'validating' AND validation_lease = ?
+        AND EXISTS (SELECT 1 FROM map_versions v WHERE v.map_id = ? AND v.revision = ?
+                     AND v.status = 'published')`,
+  ).bind(manifest.id, revision, nowMs, row.id, validationLease, manifest.id, revision));
+
+  try {
+    const results = await env.DB.batch(statements);
+    if ((results.at(-1)?.meta.changes ?? 0) !== 1) {
+      // The maps upsert is now guarded on moderation_reason IS NULL, so a takedown that landed
+      // during validation blocks promotion here. That is a terminal outcome for this upload, not a
+      // transient fault: report it as a rejection so the queue stops retrying into the dead letter.
+      const blocked = await env.DB.prepare(
+        `SELECT moderation_reason FROM maps WHERE id = ? AND moderation_reason IS NOT NULL`,
+      ).bind(manifest.id).first<{ moderation_reason: string }>();
+      if (blocked !== null) {
+        throw new UploadRejected(
+          "map_under_moderation",
+          "This map was removed by a maintainer and cannot be republished until it is restored.",
+        );
+      }
+      throw new Error("publication state did not advance");
+    }
+  } catch (error) {
+    // Approved keys are immutable and content-addressed. Leaving an unreferenced object for
+    // later garbage collection is safer than deleting an object another idempotent attempt won;
+    // the scheduled reconciler removes anything D1 does not reference.
+    if (error instanceof UploadRejected) throw error;
+    if (existing === null) {
+      const [map, owned] = await Promise.all([
+        env.DB.prepare(`SELECT id FROM maps WHERE id = ?`).bind(manifest.id).first<{ id: string }>(),
+        env.DB.prepare(`SELECT COUNT(*) AS count FROM maps WHERE owner_steam_id64 = ?`)
+          .bind(row.steam_id64).first<{ count: number }>(),
+      ]);
+      if (map === null && owned !== null && owned.count >= config.mapsPerAccountLimit) {
+        throw new UploadRejected("map_quota_reached", "This Steam account has reached its map limit.");
+      }
+    }
+    throw error;
+  }
+  await env.MAP_BUCKET.delete(row.quarantine_key);
+  await retireSupersededRevisions(env, manifest.id, revision, row.steam_id64, nowMs);
+}
+
+export async function validateUploadMessage(env: Env, value: unknown, nowMs = Date.now()): Promise<void> {
+  if (!isPlainObject(value) || !hasOnlyKeys(value, ["kind", "uploadId"]) ||
+      value.kind !== "map-upload" || !isCanonicalUuid(value.uploadId)) return;
+  const message: UploadQueueMessage = { kind: "map-upload", uploadId: value.uploadId };
+  const row = await uploadRow(env, message.uploadId);
+  if (row === null || row.status === "published" || row.status === "rejected" ||
+      row.status === "cancelled" || row.status === "expired" || row.status === "reserved") return;
+  if (row.expires_at <= nowMs) {
+    await env.MAP_BUCKET.delete(row.quarantine_key);
+    await env.DB.prepare(
+      `UPDATE map_uploads SET status = 'expired', completed_at = ?
+        WHERE id = ? AND status IN ('uploaded', 'validating')`,
+    ).bind(nowMs, row.id).run();
+    return;
+  }
+  const validationLease = crypto.randomUUID();
+  const claimed = await env.DB.prepare(
+    `UPDATE map_uploads
+        SET status = 'validating', validation_lease = ?, validation_started_at = ?,
+            validation_lease_expires_at = ?
+      WHERE id = ? AND status = 'uploaded'`,
+  ).bind(validationLease, nowMs, nowMs + VALIDATION_LEASE_TTL_MS, row.id).run();
+  if ((claimed.meta.changes ?? 0) !== 1) return;
+  row.status = "validating";
+  try {
+    await publishValidatedUpload(env, runtimeConfig(env), row, validationLease, nowMs);
+  } catch (error) {
+    if (error instanceof BundleValidationError) {
+      await rejectUpload(env, row, error.code, error.message, nowMs);
+      return;
+    }
+    if (error instanceof UploadRejected) {
+      await rejectUpload(env, row, error.code, error.message, nowMs);
+      return;
+    }
+    await env.DB.prepare(
+      `UPDATE map_uploads
+          SET status = 'uploaded', validation_lease = NULL, validation_started_at = NULL,
+              validation_lease_expires_at = NULL
+        WHERE id = ? AND status = 'validating' AND validation_lease = ?`,
+    ).bind(row.id, validationLease).run();
+    throw error;
+  }
+}
diff --git a/backend/community-api/src/worker.ts b/backend/community-api/src/worker.ts
new file mode 100644
index 0000000..87ea151
--- /dev/null
+++ b/backend/community-api/src/worker.ts
@@ -0,0 +1,372 @@
+import { isCanonicalUuid } from "@ss2revive/community-contracts";
+import {
+  authenticate,
+  createDeviceSession,
+  localActivationPage,
+  logoutSession,
+  pollDeviceSession,
+  refreshSession,
+} from "./auth";
+import { runtimeConfig } from "./config";
+import {
+  archiveOwnMap,
+  listOpenReports,
+  reportMap,
+  restoreMap,
+  takedownMap,
+  unpublishOwnMap,
+} from "./community-controls";
+import { opaqueHash } from "./crypto";
+import { downloadObject } from "./downloads";
+import { withEdgeCache } from "./edge-cache";
+import { errorResponse, HttpError, jsonResponse, requireMethod } from "./http";
+import { seedLocalFixture } from "./local-fixture";
+import { cleanupExpiredState } from "./maintenance";
+import { catalogDocument, listMaps, mapDetail, mapVersions } from "./maps";
+import { actorRateKey, anonymousRateKey, enforceRateLimit } from "./rate-limit";
+import {
+  confirmSteamLogin,
+  startSteamLogin,
+  steamActivationPage,
+  steamAuthErrorPage,
+  steamCallback,
+} from "./steam-openid";
+import {
+  cancelUpload,
+  getUploadStatus,
+  putUploadBundle,
+  reserveUpload,
+  validateUploadMessage,
+} from "./uploads";
+
+function safePath(request: Request): string {
+  if (request.url.length > 4096) throw new HttpError(414, "invalid_request", "The request URL is too long.");
+  const rawAfterScheme = request.url.indexOf("://");
+  const rawPathStart = request.url.indexOf("/", rawAfterScheme < 0 ? 0 : rawAfterScheme + 3);
+  const rawPathWithQuery = rawPathStart < 0 ? "/" : request.url.slice(rawPathStart);
+  const rawPath = rawPathWithQuery.split("?", 1)[0] ?? "/";
+  if (
+    rawPath.length > 1024 || rawPath.includes("\\") || rawPath.includes("//") ||
+    /%(?:2f|5c|2e|25)/iu.test(rawPath) || /[\u0000-\u001f\u007f-\u009f]/u.test(rawPath)
+  ) {
+    throw new HttpError(400, "invalid_request", "The request path is invalid.");
+  }
+  let decoded: string;
+  try {
+    decoded = decodeURIComponent(rawPath);
+  } catch {
+    throw new HttpError(400, "invalid_request", "The request path is invalid.");
+  }
+  if (decoded !== new URL(request.url).pathname) {
+    throw new HttpError(400, "invalid_request", "The request path is ambiguous.");
+  }
+  return decoded;
+}
+
+function requireLoopbackMockRoute(request: Request, allowMockAuth: boolean): void {
+  const url = new URL(request.url);
+  const loopback = url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "[::1]";
+  if (!allowMockAuth || !loopback || url.protocol !== "http:") {
+    throw new HttpError(404, "not_found", "The route was not found.");
+  }
+}
+
+function requireCanonicalOrigin(request: Request, config: ReturnType<typeof runtimeConfig>): void {
+  if (new URL(request.url).origin !== config.publicOrigin) {
+    throw new HttpError(421, "misdirected_request", "The request was sent to an unexpected origin.");
+  }
+}
+
+async function limitAnonymous(
+  request: Request,
+  env: Env,
+  config: ReturnType<typeof runtimeConfig>,
+  routeClass: string,
+): Promise<void> {
+  await enforceRateLimit(env.AUTH_RATE_LIMITER, await anonymousRateKey(request, config, routeClass));
+}
+
+async function limitPublicRead(
+  request: Request,
+  env: Env,
+  config: ReturnType<typeof runtimeConfig>,
+  routeClass: string,
+  download = false,
+): Promise<void> {
+  const limiter = download ? env.DOWNLOAD_RATE_LIMITER : env.API_RATE_LIMITER;
+  await enforceRateLimit(limiter, await anonymousRateKey(request, config, routeClass));
+}
+
+async function limitActor(
+  env: Env,
+  config: ReturnType<typeof runtimeConfig>,
+  routeClass: string,
+  steamId64: string,
+): Promise<void> {
+  await enforceRateLimit(env.API_RATE_LIMITER, await actorRateKey(config, routeClass, steamId64));
+}
+
+async function localSeed(
+  request: Request,
+  env: Env,
+  requestId: string,
+): Promise<Response> {
+  const config = runtimeConfig(env);
+  requireLoopbackMockRoute(request, config.allowMockAuth);
+  requireMethod(request, "POST");
+  const supplied = request.headers.get("X-Local-Setup-Secret") ?? "";
+  const suppliedHash = await opaqueHash(config, "local-setup", supplied);
+  const expectedHash = await opaqueHash(config, "local-setup", config.authSecret);
+  if (supplied.length < 32 || suppliedHash !== expectedHash) {
+    throw new HttpError(401, "auth_required", "The local setup secret is required.");
+  }
+  if (request.body !== null || Number(request.headers.get("Content-Length") ?? "0") !== 0) {
+    throw new HttpError(400, "invalid_request", "The local seed request must not have a body.");
+  }
+  const fixture = await seedLocalFixture(env, config);
+  return jsonResponse({ requestId, seeded: fixture }, 200, requestId);
+}
+
+async function route(
+  request: Request,
+  env: Env,
+  ctx: ExecutionContext,
+  requestId: string,
+): Promise<Response> {
+  const config = runtimeConfig(env);
+  requireCanonicalOrigin(request, config);
+  const path = safePath(request);
+  const nowMs = Date.now();
+
+  if (path === "/health") {
+    requireMethod(request, "GET");
+    return jsonResponse({ status: "ok" }, 200, requestId);
+  }
+  if (path === "/_local/seed") return localSeed(request, env, requestId);
+  if (path === "/activate") {
+    await limitAnonymous(request, env, config, "activation");
+    if (!config.allowMockAuth) return steamActivationPage(request, requestId);
+    requireLoopbackMockRoute(request, config.allowMockAuth);
+    return localActivationPage(request, env, config, requestId, nowMs);
+  }
+
+  if (path === "/v1/auth/device-sessions") {
+    requireMethod(request, "POST");
+    await limitAnonymous(request, env, config, "device-create");
+    return createDeviceSession(request, env, config, requestId, nowMs);
+  }
+  if (path === "/v1/auth/device-sessions/token") {
+    requireMethod(request, "POST");
+    await limitAnonymous(request, env, config, "device-poll");
+    return pollDeviceSession(request, env, config, requestId, nowMs);
+  }
+  if (path === "/v1/auth/refresh") {
+    requireMethod(request, "POST");
+    await limitAnonymous(request, env, config, "refresh");
+    return refreshSession(request, env, config, requestId, nowMs);
+  }
+  if (path === "/v1/auth/logout") {
+    requireMethod(request, "POST");
+    await limitAnonymous(request, env, config, "logout");
+    return logoutSession(request, env, config, requestId, nowMs);
+  }
+  if (path === "/v1/auth/steam/start") {
+    requireMethod(request, "POST");
+    if (config.allowMockAuth) throw new HttpError(404, "not_found", "The route was not found.");
+    await limitAnonymous(request, env, config, "steam-start");
+    return startSteamLogin(request, env, config, requestId, nowMs);
+  }
+  if (path === "/v1/auth/steam/callback") {
+    requireMethod(request, "GET");
+    if (config.allowMockAuth) throw new HttpError(404, "not_found", "The route was not found.");
+    await limitAnonymous(request, env, config, "steam-callback");
+    return steamCallback(request, env, config, requestId, nowMs);
+  }
+  if (path === "/v1/auth/steam/confirm") {
+    requireMethod(request, "POST");
+    if (config.allowMockAuth) throw new HttpError(404, "not_found", "The route was not found.");
+    await limitAnonymous(request, env, config, "steam-confirm");
+    return confirmSteamLogin(request, env, config, requestId, nowMs);
+  }
+  if (path === "/v1/me") {
+    requireMethod(request, "GET");
+    const principal = await authenticate(request, env, config, "maps:read", nowMs);
+    await limitActor(env, config, "account", principal.steamId64);
+    return jsonResponse({ requestId, steamId64: principal.steamId64, scopes: principal.scopes }, 200, requestId);
+  }
+
+  if (path === "/v1/uploads") {
+    requireMethod(request, "POST");
+    const principal = await authenticate(request, env, config, "maps:upload", nowMs);
+    await limitActor(env, config, "upload-reserve", principal.steamId64);
+    return reserveUpload(request, env, config, principal, requestId, nowMs);
+  }
+
+  const uploadBundleMatch = /^\/v1\/uploads\/([^/]+)\/bundle$/u.exec(path);
+  if (uploadBundleMatch !== null) {
+    const principal = await authenticate(request, env, config, "maps:upload", nowMs);
+    await limitActor(env, config, "upload-bytes", principal.steamId64);
+    return putUploadBundle(
+      request,
+      env,
+      config,
+      principal,
+      uploadBundleMatch[1] ?? "",
+      requestId,
+      nowMs,
+    );
+  }
+
+  const uploadMatch = /^\/v1\/uploads\/([^/]+)$/u.exec(path);
+  if (uploadMatch !== null) {
+    const principal = await authenticate(request, env, config, "maps:upload", nowMs);
+    await limitActor(env, config, "upload-status", principal.steamId64);
+    if (request.method === "GET") {
+      return getUploadStatus(request, env, config, principal, uploadMatch[1] ?? "", requestId);
+    }
+    if (request.method === "DELETE") {
+      return cancelUpload(request, env, config, principal, uploadMatch[1] ?? "", requestId, nowMs);
+    }
+    throw new HttpError(405, "method_not_allowed", "The method is not allowed.", { Allow: "GET, DELETE" });
+  }
+
+  if (path === "/v1/catalog") {
+    requireMethod(request, "GET");
+    await limitPublicRead(request, env, config, "catalog");
+    return withEdgeCache(request, ctx, () => catalogDocument(env, requestId, nowMs));
+  }
+
+  if (path === "/v1/maps") {
+    requireMethod(request, "GET");
+    await limitPublicRead(request, env, config, "maps");
+    return listMaps(request, env, config, requestId, nowMs);
+  }
+
+  if (path === "/v1/moderation/reports") {
+    const principal = await authenticate(request, env, config, "maps:moderate", nowMs);
+    await limitActor(env, config, "moderation-reports", principal.steamId64);
+    return listOpenReports(request, env, config, principal, requestId);
+  }
+
+  const moderationMatch = /^\/v1\/moderation\/maps\/([^/]+)\/(takedown|restore)$/u.exec(path);
+  if (moderationMatch !== null) {
+    const principal = await authenticate(request, env, config, "maps:moderate", nowMs);
+    await limitActor(env, config, "moderation-action", principal.steamId64);
+    return moderationMatch[2] === "takedown"
+      ? takedownMap(request, env, config, ctx, principal, moderationMatch[1] ?? "", requestId, nowMs)
+      : restoreMap(request, env, config, ctx, principal, moderationMatch[1] ?? "", requestId, nowMs);
+  }
+
+  const reportMatch = /^\/v1\/maps\/([^/]+)\/reports$/u.exec(path);
+  if (reportMatch !== null) {
+    const principal = await authenticate(request, env, config, "maps:report", nowMs);
+    await limitActor(env, config, "map-report", principal.steamId64);
+    return reportMap(request, env, principal, reportMatch[1] ?? "", requestId, nowMs);
+  }
+
+  const unpublishMatch = /^\/v1\/maps\/([^/]+)\/unpublish$/u.exec(path);
+  if (unpublishMatch !== null) {
+    const principal = await authenticate(request, env, config, "maps:manage", nowMs);
+    await limitActor(env, config, "map-unpublish", principal.steamId64);
+    return unpublishOwnMap(request, env, config, ctx, principal, unpublishMatch[1] ?? "", requestId, nowMs);
+  }
+
+  const downloadMatch = /^\/v1\/maps\/([^/]+)\/versions\/([1-9][0-9]*)\/(download|thumbnail)$/u.exec(path);
+  if (downloadMatch !== null) {
+    const mapId = downloadMatch[1] ?? "";
+    const revision = Number(downloadMatch[2]);
+    if (!isCanonicalUuid(mapId) || !Number.isSafeInteger(revision)) {
+      throw new HttpError(404, "revision_not_found", "The map revision was not found.");
+    }
+    await limitPublicRead(request, env, config, "download", true);
+    return downloadObject(
+      request,
+      env,
+      ctx,
+      mapId,
+      revision,
+      downloadMatch[3] === "download" ? "bundle" : "thumbnail",
+      requestId,
+    );
+  }
+
+  const versionsMatch = /^\/v1\/maps\/([^/]+)\/versions$/u.exec(path);
+  if (versionsMatch !== null) {
+    requireMethod(request, "GET");
+    await limitPublicRead(request, env, config, "maps");
+    return mapVersions(env, versionsMatch[1] ?? "", requestId);
+  }
+
+  const detailMatch = /^\/v1\/maps\/([^/]+)$/u.exec(path);
+  if (detailMatch !== null) {
+    if (request.method === "DELETE") {
+      const principal = await authenticate(request, env, config, "maps:manage", nowMs);
+      await limitActor(env, config, "map-archive", principal.steamId64);
+      return archiveOwnMap(request, env, config, ctx, principal, detailMatch[1] ?? "", requestId, nowMs);
+    }
+    requireMethod(request, "GET");
+    await limitPublicRead(request, env, config, "maps");
+    return mapDetail(env, detailMatch[1] ?? "", requestId);
+  }
+
+  throw new HttpError(404, "not_found", "The route was not found.");
+}
+
+export default {
+  async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+    const requestId = crypto.randomUUID();
+    const startedAt = Date.now();
+    let response: Response;
+    try {
+      response = await route(request, env, ctx, requestId);
+    } catch (error) {
+      if (error instanceof HttpError) {
+        const pathname = new URL(request.url).pathname;
+        const browserAuthRoute = pathname === "/activate"
+          || pathname === "/v1/auth/steam/start"
+          || pathname === "/v1/auth/steam/callback"
+          || pathname === "/v1/auth/steam/confirm";
+        response = browserAuthRoute
+          ? steamAuthErrorPage(error, requestId)
+          : errorResponse(error, requestId);
+      }
+      else {
+        console.error(JSON.stringify({ event: "unhandled_error", requestId, name: error instanceof Error ? error.name : "unknown" }));
+        response = errorResponse(new HttpError(500, "internal_error", "The request could not be completed."), requestId);
+      }
+    }
+    if (env.ENVIRONMENT === "production") {
+      response.headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+    }
+    if (env.ENVIRONMENT !== "local" || response.status >= 400) {
+      console.log(JSON.stringify({
+        event: "http_request",
+        requestId,
+        method: request.method,
+        pathname: new URL(request.url).pathname.slice(0, 256),
+        status: response.status,
+        durationMs: Date.now() - startedAt,
+      }));
+    }
+    return response;
+  },
+  async scheduled(controller: ScheduledController, env: Env, ctx: ExecutionContext): Promise<void> {
+    ctx.waitUntil(cleanupExpiredState(env, controller.scheduledTime));
+  },
+  async queue(batch: MessageBatch<unknown>, env: Env): Promise<void> {
+    for (const message of batch.messages) {
+      try {
+        await validateUploadMessage(env, message.body);
+        message.ack();
+      } catch (error) {
+        console.error(JSON.stringify({
+          event: "upload_validation_failed",
+          messageId: message.id,
+          attempt: message.attempts,
+          name: error instanceof Error ? error.name : "unknown",
+        }));
+        message.retry({ delaySeconds: Math.min(300, 10 * Math.max(1, message.attempts)) });
+      }
+    }
+  },
+} satisfies ExportedHandler<Env>;
diff --git a/backend/community-api/test-bindings.d.ts b/backend/community-api/test-bindings.d.ts
new file mode 100644
index 0000000..c197b75
--- /dev/null
+++ b/backend/community-api/test-bindings.d.ts
@@ -0,0 +1,13 @@
+// Wrangler generates the platform bindings in worker-configuration.d.ts. These bindings exist
+// only in Vitest/Miniflare or as Worker secrets, so they cannot be inferred from wrangler.jsonc.
+interface TestOnlyBindings {
+  LOCAL_AUTH_SECRET: string;
+  AUTH_SIGNING_SECRET: string;
+  TEST_MIGRATIONS: D1Migration[];
+}
+
+declare namespace Cloudflare {
+  interface Env extends TestOnlyBindings {}
+}
+
+interface Env extends TestOnlyBindings {}
diff --git a/backend/community-api/test/apply-migrations.ts b/backend/community-api/test/apply-migrations.ts
new file mode 100644
index 0000000..34141ef
--- /dev/null
+++ b/backend/community-api/test/apply-migrations.ts
@@ -0,0 +1,4 @@
+import { env } from "cloudflare:workers";
+import { applyD1Migrations } from "cloudflare:test";
+
+await applyD1Migrations(env.DB, env.TEST_MIGRATIONS);
diff --git a/backend/community-api/test/bundle.test.ts b/backend/community-api/test/bundle.test.ts
new file mode 100644
index 0000000..3716487
--- /dev/null
+++ b/backend/community-api/test/bundle.test.ts
@@ -0,0 +1,134 @@
+import { describe, expect, it } from "vitest";
+import {
+  BundleValidationError,
+  inspectLevelBundle,
+  levelCodeFromId,
+  MAX_BUNDLE_BYTES,
+} from "@ss2revive/community-contracts";
+import { buildLocalFixture } from "../src/local-fixture";
+
+function expectBundleError(code: string, action: () => Promise<unknown>): Promise<void> {
+  return expect(action()).rejects.toMatchObject({ name: "BundleValidationError", code });
+}
+
+describe("Level bundle contract", () => {
+  it("matches the game's fixed GUID share-code vector", () => {
+    expect(levelCodeFromId("1a658233-92c5-4b63-87fc-4740c855730b")).toBe("M4JlGsWSY0uH_EdAyFVzCw");
+    expect(levelCodeFromId("not-a-guid")).toBe("");
+  });
+
+  it("accepts the deterministic current-format fixture", async () => {
+    const fixture = await buildLocalFixture();
+    const parsed = await inspectLevelBundle(fixture.bytes, { nowMs: Date.UTC(2026, 7, 8) });
+    expect(parsed.manifest.id).toBe("1a658233-92c5-4b63-87fc-4740c855730b");
+    expect(parsed.manifest.clientVersion).toBe(29);
+    expect(parsed.code).toBe("M4JlGsWSY0uH_EdAyFVzCw");
+    expect(parsed.bundleSha256).toBe(fixture.sha256);
+    expect(parsed.thumbnailInfo).toMatchObject({ width: 1, height: 1, format: 4, dataLength: 4 });
+    expect(parsed.manifest.configurations).toEqual([{
+      id: "5f3ff27f-126f-43b3-999f-e55cd44f4a27",
+      numberPlayers: 1,
+      numberTeams: 1,
+      teamMode: "COOP",
+      levelTeamConfigurations: [{ objectives: [""], playersInTeam: [] }],
+    }]);
+    expect(parsed.manifest.validations).toEqual([{
+      id: "f9dab629-2372-4eb3-b24a-063f382f6043",
+      description: "Local deterministic fixture",
+      validated: false,
+    }]);
+  });
+
+  it("rejects unknown configuration fields without rejecting the game's complete schema", async () => {
+    await expect(buildLocalFixture({
+      configurations: [{
+        id: "5f3ff27f-126f-43b3-999f-e55cd44f4a27",
+        numberPlayers: 1,
+        numberTeams: 1,
+        teamMode: "COOP",
+        levelTeamConfigurations: [{ objectives: [], playersInTeam: [0] }],
+        unexpected: true,
+      }],
+    })).rejects.toMatchObject({ code: "manifest_metadata_invalid" });
+  });
+
+  it("rejects unknown team modes and non-boolean validation state", async () => {
+    await expect(buildLocalFixture({
+      configurations: [{
+        id: "5f3ff27f-126f-43b3-999f-e55cd44f4a27",
+        numberPlayers: 1,
+        numberTeams: 1,
+        teamMode: "UNKNOWN",
+        levelTeamConfigurations: [],
+      }],
+    })).rejects.toMatchObject({ code: "manifest_metadata_invalid" });
+
+    await expect(buildLocalFixture({
+      validations: [{
+        id: "f9dab629-2372-4eb3-b24a-063f382f6043",
+        description: "Local deterministic fixture",
+        validated: "false",
+      }],
+    })).rejects.toMatchObject({ code: "manifest_metadata_invalid" });
+  });
+
+  it("rejects truncation, trailing bytes, and checksum tampering", async () => {
+    const fixture = await buildLocalFixture();
+    await expectBundleError("bundle_malformed", () => inspectLevelBundle(fixture.bytes.slice(0, -1)));
+    const trailing = new Uint8Array(fixture.bytes.length + 1);
+    trailing.set(fixture.bytes);
+    await expectBundleError("bundle_trailing_data", () => inspectLevelBundle(trailing));
+    const tampered = fixture.bytes.slice();
+    const contentMarker = new TextEncoder().encode("Surgeons");
+    const contentIndex = tampered.findIndex((_, offset) =>
+      contentMarker.every((value, inner) => tampered[offset + inner] === value));
+    expect(contentIndex).toBeGreaterThan(0);
+    const tamperedIndex = contentIndex + 10;
+    tampered[tamperedIndex] = (tampered[tamperedIndex] ?? 0) ^ 1;
+    await expectBundleError("content_checksum_invalid", () => inspectLevelBundle(tampered));
+  });
+
+  it("rejects an oversized bundle before parsing", async () => {
+    await expectBundleError("bundle_oversized", () => inspectLevelBundle(new Uint8Array(MAX_BUNDLE_BYTES + 1)));
+  });
+
+  it("rejects legacy container versions", async () => {
+    const fixture = await buildLocalFixture();
+    const legacy = fixture.bytes.slice();
+    legacy[16] = 1;
+    legacy[17] = 0;
+    await expectBundleError("bundle_version_invalid", () => inspectLevelBundle(legacy));
+  });
+
+  it("rejects duplicate manifest keys", async () => {
+    const fixture = await buildLocalFixture();
+    const bytes = fixture.bytes.slice();
+    const marker = new TextEncoder().encode('"title":');
+    const index = bytes.findIndex((_, offset) => marker.every((value, inner) => bytes[offset + inner] === value));
+    expect(index).toBeGreaterThan(0);
+    const replacement = new TextEncoder().encode('"id"   :');
+    expect(replacement.length).toBe(marker.length);
+    bytes.set(replacement, index);
+    await expectBundleError("manifest_duplicate_key", () => inspectLevelBundle(bytes));
+  });
+
+  it("rejects duplicate known container entries", async () => {
+    const fixture = await buildLocalFixture();
+    const marker = new TextEncoder().encode("thumb.png");
+    const nameIndex = fixture.bytes.findIndex((_, offset) =>
+      marker.every((value, inner) => fixture.bytes[offset + inner] === value));
+    expect(nameIndex).toBeGreaterThan(1);
+    const entryStart = nameIndex - 2;
+    const entryLength = 2 + marker.length + 4 + fixture.thumbnail.length;
+    const duplicate = fixture.bytes.slice(entryStart, entryStart + entryLength);
+    const bytes = new Uint8Array(fixture.bytes.length + duplicate.length);
+    bytes.set(fixture.bytes.slice(0, -2));
+    bytes.set(duplicate, fixture.bytes.length - 2);
+    await expectBundleError("bundle_duplicate_entry", () => inspectLevelBundle(bytes));
+  });
+
+  it("exposes typed validation errors without raw payloads", () => {
+    const error = new BundleValidationError("bundle_malformed", "safe message");
+    expect(error).toMatchObject({ name: "BundleValidationError", code: "bundle_malformed", message: "safe message" });
+  });
+});
diff --git a/backend/community-api/test/community-controls.test.ts b/backend/community-api/test/community-controls.test.ts
new file mode 100644
index 0000000..1298ca1
--- /dev/null
+++ b/backend/community-api/test/community-controls.test.ts
@@ -0,0 +1,135 @@
+import { env } from "cloudflare:workers";
+import { beforeEach, describe, expect, it } from "vitest";
+import type { AuthPrincipal } from "@ss2revive/community-contracts";
+import {
+  archiveOwnMap,
+  listOpenReports,
+  reportMap,
+  restoreMap,
+  takedownMap,
+  unpublishOwnMap,
+} from "../src/community-controls";
+import { runtimeConfig } from "../src/config";
+import { seedLocalFixture } from "../src/local-fixture";
+
+const ORIGIN = "http://127.0.0.1:8787";
+const OWNER = "76561198145479980";
+const REPORTER = "76561198145479981";
+const MAP_ID = "1a658233-92c5-4b63-87fc-4740c855730b";
+const ownerPrincipal: AuthPrincipal = {
+  steamId64: OWNER,
+  sessionId: "11111111-1111-1111-1111-111111111111",
+  scopes: ["maps:manage", "maps:report", "maps:moderate"],
+};
+const reporterPrincipal: AuthPrincipal = {
+  steamId64: REPORTER,
+  sessionId: "22222222-2222-2222-2222-222222222222",
+  scopes: ["maps:manage", "maps:report"],
+};
+
+async function clearState(): Promise<void> {
+  await env.DB.batch([
+    env.DB.prepare("DELETE FROM moderation_events"),
+    env.DB.prepare("DELETE FROM map_reports"),
+    env.DB.prepare("DELETE FROM upload_usage_daily"),
+    env.DB.prepare("DELETE FROM account_storage"),
+    env.DB.prepare("DELETE FROM map_uploads"),
+    env.DB.prepare("DELETE FROM map_tags"),
+    env.DB.prepare("DELETE FROM map_versions"),
+    env.DB.prepare("DELETE FROM maps"),
+    env.DB.prepare("DELETE FROM steam_openid_sessions"),
+    env.DB.prepare("DELETE FROM refresh_tokens"),
+    env.DB.prepare("DELETE FROM refresh_token_families"),
+    env.DB.prepare("DELETE FROM auth_sessions"),
+    env.DB.prepare("DELETE FROM device_auth_sessions"),
+    env.DB.prepare("DELETE FROM users"),
+  ]);
+  await seedLocalFixture(env, runtimeConfig(env));
+  await env.DB.prepare(
+    `INSERT INTO users (steam_id64, status, created_at, last_login_at) VALUES (?, 'active', ?, ?)`,
+  ).bind(REPORTER, Date.UTC(2026, 7, 8), Date.UTC(2026, 7, 8)).run();
+}
+
+const testContext = {
+  waitUntil(promise: Promise<unknown>): void {
+    void promise.catch(() => undefined);
+  },
+  passThroughOnException(): void {},
+  props: {},
+} as unknown as ExecutionContext;
+
+beforeEach(clearState);
+
+describe("community ownership and moderation controls", () => {
+  it("lets the verified owner unpublish and archive without deleting approved objects", async () => {
+    const nowMs = Date.UTC(2026, 7, 8, 12);
+    const unpublished = await unpublishOwnMap(
+      new Request(`${ORIGIN}/v1/maps/${MAP_ID}/unpublish`, {
+        method: "POST", headers: { "Content-Type": "application/json" }, body: "{}",
+      }), env, runtimeConfig(env), testContext, ownerPrincipal, MAP_ID, crypto.randomUUID(), nowMs,
+    );
+    expect(unpublished.status).toBe(200);
+    expect(await env.DB.prepare("SELECT status FROM maps WHERE id = ?").bind(MAP_ID).first())
+      .toMatchObject({ status: "unpublished" });
+
+    const archived = await archiveOwnMap(
+      new Request(`${ORIGIN}/v1/maps/${MAP_ID}`, { method: "DELETE" }),
+      env, runtimeConfig(env), testContext, ownerPrincipal, MAP_ID, crypto.randomUUID(), nowMs + 1,
+    );
+    expect(archived.status).toBe(204);
+    expect(await env.DB.prepare("SELECT status FROM maps WHERE id = ?").bind(MAP_ID).first())
+      .toMatchObject({ status: "archived" });
+    const objects = await env.MAP_BUCKET.list({ prefix: `approved/maps/${MAP_ID}/` });
+    expect(objects.objects.length).toBeGreaterThan(0);
+  });
+
+  it("stores one bounded report per reporter and exposes it only to the maintainer", async () => {
+    const nowMs = Date.UTC(2026, 7, 8, 12);
+    const request = (reason: string) => new Request(`${ORIGIN}/v1/maps/${MAP_ID}/reports`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ reason, note: "Needs review" }),
+    });
+    expect((await reportMap(request("BROKEN"), env, reporterPrincipal, MAP_ID,
+      crypto.randomUUID(), nowMs)).status).toBe(201);
+    expect((await reportMap(request("COPY"), env, reporterPrincipal, MAP_ID,
+      crypto.randomUUID(), nowMs + 1)).status).toBe(201);
+    expect(await env.DB.prepare("SELECT COUNT(*) AS count FROM map_reports").first())
+      .toMatchObject({ count: 1 });
+
+    await expect(listOpenReports(new Request(`${ORIGIN}/v1/moderation/reports`), env,
+      runtimeConfig(env), reporterPrincipal, crypto.randomUUID()))
+      .rejects.toMatchObject({ code: "maintainer_required", status: 403 });
+    const reports = await listOpenReports(new Request(`${ORIGIN}/v1/moderation/reports`), env,
+      runtimeConfig(env), ownerPrincipal, crypto.randomUUID());
+    expect(await reports.json()).toMatchObject({ items: [{ mapId: MAP_ID, reason: "COPY" }] });
+  });
+
+  it("records maintainer takedowns, resolves reports, and can restore the map", async () => {
+    const nowMs = Date.UTC(2026, 7, 8, 12);
+    await reportMap(new Request(`${ORIGIN}/v1/maps/${MAP_ID}/reports`, {
+      method: "POST", headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ reason: "BROKEN" }),
+    }), env, reporterPrincipal, MAP_ID, crypto.randomUUID(), nowMs);
+    const config = runtimeConfig(env);
+    const takedown = await takedownMap(new Request(`${ORIGIN}/v1/moderation/maps/${MAP_ID}/takedown`, {
+      method: "POST", headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ reason: "Confirmed broken" }),
+    }), env, config, testContext, ownerPrincipal, MAP_ID, crypto.randomUUID(), nowMs + 1);
+    expect(takedown.status).toBe(200);
+    expect(await env.DB.prepare("SELECT status FROM maps WHERE id = ?").bind(MAP_ID).first())
+      .toMatchObject({ status: "archived" });
+    expect(await env.DB.prepare("SELECT status FROM map_reports WHERE map_id = ?").bind(MAP_ID).first())
+      .toMatchObject({ status: "resolved" });
+
+    const restored = await restoreMap(new Request(`${ORIGIN}/v1/moderation/maps/${MAP_ID}/restore`, {
+      method: "POST", headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ reason: "Issue corrected" }),
+    }), env, config, testContext, ownerPrincipal, MAP_ID, crypto.randomUUID(), nowMs + 2);
+    expect(restored.status).toBe(200);
+    expect(await env.DB.prepare("SELECT status FROM maps WHERE id = ?").bind(MAP_ID).first())
+      .toMatchObject({ status: "published" });
+    expect(await env.DB.prepare("SELECT COUNT(*) AS count FROM moderation_events WHERE map_id = ?")
+      .bind(MAP_ID).first()).toMatchObject({ count: 2 });
+  });
+});
diff --git a/backend/community-api/test/hardening.test.ts b/backend/community-api/test/hardening.test.ts
new file mode 100644
index 0000000..53d68df
--- /dev/null
+++ b/backend/community-api/test/hardening.test.ts
@@ -0,0 +1,384 @@
+import { env } from "cloudflare:workers";
+import { beforeEach, describe, expect, it } from "vitest";
+import {
+  inspectLevelBundle,
+  MAX_STRUCTURED_METADATA_BYTES,
+  sha256Hex,
+  type AuthPrincipal,
+} from "@ss2revive/community-contracts";
+import { runtimeConfig } from "../src/config";
+import { takedownMap } from "../src/community-controls";
+import { buildLocalFixture } from "../src/local-fixture";
+import { cleanupExpiredState } from "../src/maintenance";
+import { catalogDocument, listMaps } from "../src/maps";
+import { anonymousRateKey } from "../src/rate-limit";
+import { putUploadBundle, reserveUpload, validateUploadMessage } from "../src/uploads";
+
+const STEAM_ID = "76561198145479980";
+const MAP_ID = "1a658233-92c5-4b63-87fc-4740c855730b";
+const ORIGIN = "http://127.0.0.1:8787";
+const NOW = Date.UTC(2026, 7, 8, 12, 0, 0);
+
+const principal: AuthPrincipal = {
+  steamId64: STEAM_ID,
+  sessionId: "11111111-1111-1111-1111-111111111111",
+  scopes: ["maps:read", "maps:download", "maps:upload", "maps:manage", "maps:report", "maps:moderate"],
+};
+
+const testContext = {
+  waitUntil(promise: Promise<unknown>): void {
+    void promise.catch(() => undefined);
+  },
+  passThroughOnException(): void {},
+  props: {},
+} as unknown as ExecutionContext;
+
+async function clearState(): Promise<void> {
+  await env.DB.batch([
+    env.DB.prepare("DELETE FROM moderation_events"),
+    env.DB.prepare("DELETE FROM map_reports"),
+    env.DB.prepare("DELETE FROM upload_usage_daily"),
+    env.DB.prepare("DELETE FROM account_storage"),
+    env.DB.prepare("DELETE FROM map_uploads"),
+    env.DB.prepare("DELETE FROM map_tags"),
+    env.DB.prepare("DELETE FROM map_versions"),
+    env.DB.prepare("DELETE FROM maps"),
+    env.DB.prepare("DELETE FROM steam_openid_sessions"),
+    env.DB.prepare("DELETE FROM refresh_tokens"),
+    env.DB.prepare("DELETE FROM refresh_token_families"),
+    env.DB.prepare("DELETE FROM auth_sessions"),
+    env.DB.prepare("DELETE FROM device_auth_sessions"),
+    env.DB.prepare("DELETE FROM users"),
+  ]);
+  const objects = await env.MAP_BUCKET.list({ limit: 1000 });
+  if (objects.objects.length > 0) await env.MAP_BUCKET.delete(objects.objects.map((object) => object.key));
+  await env.DB.prepare(
+    `INSERT INTO users (steam_id64, status, created_at, last_login_at) VALUES (?, 'active', ?, ?)`,
+  ).bind(STEAM_ID, NOW, NOW).run();
+}
+
+async function publish(
+  fixture: { bytes: Uint8Array; sha256: string },
+  atMs: number,
+): Promise<string> {
+  const reserved = await reserveUpload(
+    new Request(`${ORIGIN}/v1/uploads`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ sizeBytes: fixture.bytes.length, sha256: fixture.sha256 }),
+    }),
+    env, runtimeConfig(env), principal, crypto.randomUUID(), atMs,
+  );
+  const { uploadId } = await reserved.json<{ uploadId: string }>();
+  const body = new ArrayBuffer(fixture.bytes.length);
+  new Uint8Array(body).set(fixture.bytes);
+  await putUploadBundle(
+    new Request(`${ORIGIN}/v1/uploads/${uploadId}/bundle`, {
+      method: "PUT",
+      headers: {
+        "Content-Type": "application/vnd.ss2revive.level",
+        "Content-Length": String(fixture.bytes.length),
+        "X-Content-SHA256": fixture.sha256,
+      },
+      body,
+    }),
+    env, runtimeConfig(env), principal, uploadId, crypto.randomUUID(), atMs + 1,
+  );
+  await validateUploadMessage(env, { kind: "map-upload", uploadId }, atMs + 2);
+  return uploadId;
+}
+
+/** A configuration whose objectives are padded up to the per-field character limits. */
+function fatConfigurations(): unknown[] {
+  return [{
+    id: "5f3ff27f-126f-43b3-999f-e55cd44f4a27",
+    numberPlayers: 1,
+    numberTeams: 1,
+    teamMode: "COOP",
+    levelTeamConfigurations: [{
+      objectives: Array.from({ length: 32 }, (_, index) => `${index}`.padEnd(128, "一")),
+      playersInTeam: [],
+    }],
+  }];
+}
+
+beforeEach(clearState);
+
+describe("catalogue availability", () => {
+  it("refuses a manifest whose echoed metadata exceeds the per-map budget", async () => {
+    await expect(buildLocalFixture({ configurations: fatConfigurations() }))
+      .rejects.toMatchObject({ code: "manifest_metadata_oversized" });
+  });
+
+  it("keeps the metadata budget generous enough for a fully populated real manifest", async () => {
+    const fixture = await buildLocalFixture({
+      validations: Array.from({ length: 32 }, (_, index) => ({
+        id: `f9dab629-2372-4eb3-b24a-063f382f60${index.toString(16).padStart(2, "0")}`,
+        description: `Objective ${index} completed as expected`,
+        validated: true,
+      })),
+    });
+    const parsed = await inspectLevelBundle(fixture.bytes, { nowMs: NOW });
+    expect(parsed.manifest.validations).toHaveLength(32);
+    expect(new TextEncoder().encode(JSON.stringify({
+      tags: parsed.manifest.tags,
+      configurations: parsed.manifest.configurations,
+      validations: parsed.manifest.validations,
+    })).length).toBeLessThanOrEqual(MAX_STRUCTURED_METADATA_BYTES);
+  });
+
+  it("degrades the catalogue instead of failing when the response budget is reached", async () => {
+    // One oversized stored row stands in for the many a publisher would previously have needed.
+    const bulky = JSON.stringify(Array.from({ length: 8 }, (_, index) => ({
+      id: `5f3ff27f-126f-43b3-999f-e55cd44f4a${index.toString(16).padStart(2, "0")}`,
+      note: "一".repeat(60_000),
+    })));
+    for (let index = 0; index < 60; index += 1) {
+      const id = `1a658233-92c5-4b63-87fc-4740c85573${index.toString(16).padStart(2, "0")}`;
+      await env.DB.batch([
+        env.DB.prepare(
+          `INSERT INTO maps (id, status, current_revision, title, title_sort, description,
+                             created_at_ms, updated_at_ms, owner_steam_id64)
+           VALUES (?, 'published', 1, ?, ?, '', ?, ?, ?)`,
+        ).bind(id, `Map ${index}`, `map ${index}`, NOW, NOW + index, STEAM_ID),
+        env.DB.prepare(
+          `INSERT INTO map_versions (map_id, revision, status, code, creator_ids_json, tags_json,
+             configurations_json, validations_json, player_counts_csv, client_version,
+             map_format_version, minimum_revive_version, revive_version, size_bytes, sha256,
+             bundle_key, created_at_ms)
+           VALUES (?, 1, 'published', ?, '[]', '[]', ?, '[]', ',1,', 29, 29, '1.1.0', '1.1.0', 1, ?, ?, ?)`,
+        ).bind(
+          id,
+          (await import("@ss2revive/community-contracts")).levelCodeFromId(id),
+          bulky,
+          "a".repeat(64),
+          `approved/maps/${id}/r1/${"a".repeat(64)}.ss2level`,
+          NOW,
+        ),
+      ]);
+    }
+
+    const response = await catalogDocument(env, crypto.randomUUID(), NOW);
+    expect(response.status).toBe(200);
+    const document = await response.json<{ truncated: boolean; maps: unknown[] }>();
+    expect(document.truncated).toBe(true);
+    expect(document.maps.length).toBeGreaterThan(0);
+    expect(document.maps.length).toBeLessThan(60);
+
+    const listed = await listMaps(
+      new Request(`${ORIGIN}/v1/maps?limit=50`), env, runtimeConfig(env), crypto.randomUUID(), NOW,
+    );
+    expect(listed.status).toBe(200);
+    const page = await listed.json<{ items: unknown[]; nextCursor: string | null }>();
+    expect(page.items.length).toBeGreaterThan(0);
+    expect(page.nextCursor).not.toBeNull();
+  });
+});
+
+describe("bundle container strictness", () => {
+  it("rejects an entry this level format does not define", async () => {
+    await expect(buildLocalFixture({
+      extraEntries: [{ name: "payload.bin", payload: new Uint8Array(1024) }],
+    })).rejects.toMatchObject({ code: "bundle_unknown_entry" });
+  });
+
+  it("rejects an image whose payload is longer than its pixels require", async () => {
+    // 1x1 RGBA32 needs exactly 4 bytes; the header used to permit an arbitrarily larger payload.
+    const padded = new Uint8Array(13 + 4096);
+    padded.set([0x02, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0x02, 0x00, 0x10, 0x00], 0);
+    await expect(buildLocalFixture({ thumbnail: padded }))
+      .rejects.toMatchObject({ code: "image_invalid" });
+  });
+});
+
+describe("moderation integrity", () => {
+  it("lets a maintainer takedown win over a validation that completes afterwards", async () => {
+    const first = await buildLocalFixture();
+    await publish(first, NOW);
+
+    // The validator reads moderation state, then the maintainer removes the map, then the
+    // validator's publication lands. The takedown must survive.
+    const second = await buildLocalFixture({ contentVersion: 2, exportedAtMs: NOW - 1000, nowMs: NOW });
+    const reserved = await reserveUpload(
+      new Request(`${ORIGIN}/v1/uploads`, {
+        method: "POST", headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ sizeBytes: second.bytes.length, sha256: second.sha256 }),
+      }),
+      env, runtimeConfig(env), principal, crypto.randomUUID(), NOW + 10,
+    );
+    const { uploadId } = await reserved.json<{ uploadId: string }>();
+    const body = new ArrayBuffer(second.bytes.length);
+    new Uint8Array(body).set(second.bytes);
+    await putUploadBundle(
+      new Request(`${ORIGIN}/v1/uploads/${uploadId}/bundle`, {
+        method: "PUT",
+        headers: {
+          "Content-Type": "application/vnd.ss2revive.level",
+          "Content-Length": String(second.bytes.length),
+          "X-Content-SHA256": second.sha256,
+        },
+        body,
+      }),
+      env, runtimeConfig(env), principal, uploadId, crypto.randomUUID(), NOW + 11,
+    );
+
+    await takedownMap(
+      new Request(`${ORIGIN}/v1/moderation/maps/${MAP_ID}/takedown`, {
+        method: "POST", headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ reason: "Removed pending review" }),
+      }),
+      env, runtimeConfig(env), testContext, principal, MAP_ID, crypto.randomUUID(), NOW + 12,
+    );
+    await validateUploadMessage(env, { kind: "map-upload", uploadId }, NOW + 13);
+
+    expect(await env.DB.prepare(
+      "SELECT status, moderation_reason, current_revision FROM maps WHERE id = ?",
+    ).bind(MAP_ID).first()).toMatchObject({
+      status: "archived",
+      moderation_reason: "Removed pending review",
+      current_revision: 1,
+    });
+    expect(await env.DB.prepare("SELECT status, error_code FROM map_uploads WHERE id = ?")
+      .bind(uploadId).first()).toMatchObject({ status: "rejected", error_code: "map_under_moderation" });
+  });
+});
+
+describe("storage retention", () => {
+  it("releases approved objects outside the rollback window and refunds the account", async () => {
+    for (let revision = 1; revision <= 4; revision += 1) {
+      const fixture = await buildLocalFixture({
+        contentVersion: revision,
+        exportedAtMs: NOW - 5000 + revision,
+        nowMs: NOW,
+      });
+      await publish(fixture, NOW + revision * 100);
+    }
+
+    const retained = await env.DB.prepare(
+      "SELECT revision FROM map_versions WHERE map_id = ? ORDER BY revision ASC",
+    ).bind(MAP_ID).all<{ revision: number }>();
+    expect(retained.results.map((row) => row.revision)).toEqual([2, 3, 4]);
+
+    const objects = await env.MAP_BUCKET.list({ prefix: `approved/maps/${MAP_ID}/`, limit: 100 });
+    expect(objects.objects.some((object) => object.key.includes("/r1/"))).toBe(false);
+    expect(objects.objects.some((object) => object.key.includes("/r4/"))).toBe(true);
+
+    const storage = await env.DB.prepare(
+      "SELECT retained_bytes FROM account_storage WHERE steam_id64 = ?",
+    ).bind(STEAM_ID).first<{ retained_bytes: number }>();
+    expect(storage).not.toBeNull();
+    expect(storage!.retained_bytes).toBeGreaterThan(0);
+  });
+
+  it("refuses a revision once the account's retained storage limit is spent", async () => {
+    const fixture = await buildLocalFixture();
+    await env.DB.prepare(
+      `INSERT INTO account_storage (steam_id64, retained_bytes, updated_at) VALUES (?, ?, ?)`,
+    ).bind(STEAM_ID, 5 * 1024 * 1024 * 1024, NOW).run();
+    const uploadId = await publish(fixture, NOW);
+    expect(await env.DB.prepare("SELECT status, error_code FROM map_uploads WHERE id = ?")
+      .bind(uploadId).first()).toMatchObject({ status: "rejected", error_code: "storage_quota_reached" });
+  });
+});
+
+describe("validation lease recovery", () => {
+  it("reclaims a validation whose worker died so the reservation is not stuck forever", async () => {
+    const fixture = await buildLocalFixture();
+    const reserved = await reserveUpload(
+      new Request(`${ORIGIN}/v1/uploads`, {
+        method: "POST", headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ sizeBytes: fixture.bytes.length, sha256: fixture.sha256 }),
+      }),
+      env, runtimeConfig(env), principal, crypto.randomUUID(), NOW,
+    );
+    const { uploadId } = await reserved.json<{ uploadId: string }>();
+    const body = new ArrayBuffer(fixture.bytes.length);
+    new Uint8Array(body).set(fixture.bytes);
+    await putUploadBundle(
+      new Request(`${ORIGIN}/v1/uploads/${uploadId}/bundle`, {
+        method: "PUT",
+        headers: {
+          "Content-Type": "application/vnd.ss2revive.level",
+          "Content-Length": String(fixture.bytes.length),
+          "X-Content-SHA256": fixture.sha256,
+        },
+        body,
+      }),
+      env, runtimeConfig(env), principal, uploadId, crypto.randomUUID(), NOW + 1,
+    );
+    // Simulate an isolate killed between claiming the lease and completing.
+    await env.DB.prepare(
+      `UPDATE map_uploads SET status = 'validating', validation_lease = ?,
+                              validation_started_at = ?, validation_lease_expires_at = ?
+        WHERE id = ?`,
+    ).bind(crypto.randomUUID(), NOW + 2, NOW + 2 + 600_000, uploadId).run();
+
+    await cleanupExpiredState(env, NOW + 20 * 60 * 1000);
+
+    expect(await env.DB.prepare(
+      "SELECT status, validation_lease FROM map_uploads WHERE id = ?",
+    ).bind(uploadId).first()).toMatchObject({ status: "uploaded", validation_lease: null });
+
+    // Once reclaimed, a redelivery can complete it normally.
+    await validateUploadMessage(env, { kind: "map-upload", uploadId }, NOW + 20 * 60 * 1000 + 1);
+    expect(await env.DB.prepare("SELECT status FROM map_uploads WHERE id = ?")
+      .bind(uploadId).first()).toMatchObject({ status: "published" });
+  });
+});
+
+describe("anonymous rate-limit keying", () => {
+  it("collapses an IPv6 allocation to one bucket instead of 2^64", async () => {
+    const config = runtimeConfig(env);
+    const key = (address: string) => anonymousRateKey(
+      new Request(`${ORIGIN}/v1/catalog`, { headers: { "CF-Connecting-IP": address } }),
+      config,
+      "catalog",
+    );
+    // Different addresses inside one /64 must share a bucket.
+    expect(await key("2001:db8:1234:5678::1")).toBe(await key("2001:db8:1234:5678:aaaa:bbbb:cccc:dddd"));
+    // A different /64 must not.
+    expect(await key("2001:db8:1234:5678::1")).not.toBe(await key("2001:db8:1234:9999::1"));
+    // IPv4 keying is unchanged.
+    expect(await key("203.0.113.7")).not.toBe(await key("203.0.113.8"));
+  });
+});
+
+describe("publisher-declared timestamps", () => {
+  it("clamps a future export time so it cannot pin a map above the catalogue", async () => {
+    await expect(buildLocalFixture({ exportedAtMs: NOW + 12 * 60 * 60 * 1000, nowMs: NOW }))
+      .rejects.toMatchObject({ code: "manifest_metadata_invalid" });
+
+    // Within the skew tolerance the manifest is accepted, but the stored sort key is clamped to
+    // the server clock at publication rather than the publisher's declared future timestamp.
+    const fixture = await buildLocalFixture({ exportedAtMs: NOW + 60_000, nowMs: NOW });
+    await publish(fixture, NOW);
+    const row = await env.DB.prepare("SELECT updated_at_ms FROM maps WHERE id = ?")
+      .bind(MAP_ID).first<{ updated_at_ms: number }>();
+    expect(row).not.toBeNull();
+    expect(row!.updated_at_ms).toBeLessThan(NOW + 60_000);
+    expect(row!.updated_at_ms).toBeLessThanOrEqual(NOW + 2);
+  });
+});
+
+describe("download authorization after moderation", () => {
+  it("stops serving a taken-down revision", async () => {
+    const fixture = await buildLocalFixture();
+    await publish(fixture, NOW);
+    const sha = await sha256Hex(fixture.bytes);
+    expect(sha).toBe(fixture.sha256);
+
+    await takedownMap(
+      new Request(`${ORIGIN}/v1/moderation/maps/${MAP_ID}/takedown`, {
+        method: "POST", headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ reason: "Reported content" }),
+      }),
+      env, runtimeConfig(env), testContext, principal, MAP_ID, crypto.randomUUID(), NOW + 100,
+    );
+
+    const { downloadObject } = await import("../src/downloads");
+    await expect(downloadObject(
+      new Request(`${ORIGIN}/v1/maps/${MAP_ID}/versions/1/download`),
+      env, testContext, MAP_ID, 1, "bundle", crypto.randomUUID(),
+    )).rejects.toMatchObject({ status: 404 });
+  });
+});
diff --git a/backend/community-api/test/phase1.test.ts b/backend/community-api/test/phase1.test.ts
new file mode 100644
index 0000000..ae6619d
--- /dev/null
+++ b/backend/community-api/test/phase1.test.ts
@@ -0,0 +1,209 @@
+import { env } from "cloudflare:workers";
+import { beforeEach, describe, expect, it } from "vitest";
+import { createDeviceSession, pollDeviceSession } from "../src/auth";
+import { runtimeConfig, type RuntimeConfig } from "../src/config";
+import { HttpError } from "../src/http";
+import { enforceRateLimit } from "../src/rate-limit";
+import {
+  confirmSteamLogin,
+  startSteamLogin,
+  steamActivationPage,
+  steamAuthErrorPage,
+  steamCallback,
+  verifySteamOpenIdAssertion,
+} from "../src/steam-openid";
+
+const LOCAL_ORIGIN = "http://127.0.0.1:8787";
+const PUBLIC_ORIGIN = "https://community.m12labs.net";
+
+function productionConfig(): RuntimeConfig {
+  return runtimeConfig({
+    ...env,
+    ENVIRONMENT: "production",
+    ALLOW_MOCK_AUTH: "false",
+    PUBLIC_ORIGIN,
+  });
+}
+
+async function json<T>(response: Response): Promise<T> {
+  return response.json() as Promise<T>;
+}
+
+async function clearDatabase(): Promise<void> {
+  await env.DB.batch([
+    env.DB.prepare("DELETE FROM map_uploads"),
+    env.DB.prepare("DELETE FROM steam_openid_sessions"),
+    env.DB.prepare("DELETE FROM refresh_tokens"),
+    env.DB.prepare("DELETE FROM refresh_token_families"),
+    env.DB.prepare("DELETE FROM auth_sessions"),
+    env.DB.prepare("DELETE FROM device_auth_sessions"),
+    env.DB.prepare("DELETE FROM users"),
+    env.DB.prepare("DELETE FROM map_tags"),
+    env.DB.prepare("DELETE FROM map_versions"),
+    env.DB.prepare("DELETE FROM maps"),
+  ]);
+}
+
+function steamAssertion(returnTo: string, state: string, nowMs: number): URLSearchParams {
+  const steamId64 = "76561198145479980";
+  const parameters = new URLSearchParams({
+    state,
+    "openid.ns": "http://specs.openid.net/auth/2.0",
+    "openid.mode": "id_res",
+    "openid.op_endpoint": "https://steamcommunity.com/openid/login",
+    "openid.claimed_id": `https://steamcommunity.com/openid/id/${steamId64}`,
+    "openid.identity": `https://steamcommunity.com/openid/id/${steamId64}`,
+    "openid.return_to": returnTo,
+    "openid.response_nonce": `${new Date(nowMs).toISOString().replace(/\.\d{3}Z$/u, "Z")}phase1-test`,
+    "openid.assoc_handle": "1234567890",
+    "openid.signed": "signed,op_endpoint,claimed_id,identity,return_to,response_nonce,assoc_handle",
+    "openid.sig": "test-signature",
+  });
+  return parameters;
+}
+
+const validSteamFetcher = (async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+  expect(String(input)).toBe("https://steamcommunity.com/openid/login");
+  expect(init?.method).toBe("POST");
+  expect(String(init?.body)).toContain("openid.mode=check_authentication");
+  return new Response("ns:http://specs.openid.net/auth/2.0\nis_valid:true\n", { status: 200 });
+}) as typeof fetch;
+
+beforeEach(clearDatabase);
+
+describe("Phase 1 production authentication", () => {
+  it("prefills only a canonical device code and keeps the activation page script-free", async () => {
+    const requestId = crypto.randomUUID();
+    const activation = steamActivationPage(
+      new Request(`${PUBLIC_ORIGIN}/activate?user_code=abcd-efgh`), requestId,
+    );
+    const html = await activation.text();
+    expect(html).toContain('value="ABCD-EFGH"');
+    expect(html).toContain('autocomplete="one-time-code"');
+    expect(html).not.toContain("<script");
+    expect(activation.headers.get("Content-Security-Policy")).toMatch(
+      /style-src 'nonce-[A-Za-z0-9_-]{43}'/u,
+    );
+    expect(activation.headers.get("Content-Security-Policy")).not.toContain("unsafe-inline");
+
+    const invalid = steamActivationPage(
+      new Request(`${PUBLIC_ORIGIN}/activate?user_code=${encodeURIComponent('<script>')}`), requestId,
+    );
+    expect(await invalid.text()).toContain('name="user_code" value=""');
+  });
+
+  it("renders browser authentication failures as bounded HTML", async () => {
+    const requestId = crypto.randomUUID();
+    const response = steamAuthErrorPage(
+      new HttpError(400, "invalid_request", "The device code is invalid or expired."),
+      requestId,
+    );
+    expect(response.status).toBe(400);
+    expect(response.headers.get("Content-Type")).toBe("text/html; charset=utf-8");
+    const html = await response.text();
+    expect(html).toContain("We couldn't continue");
+    expect(html).toContain(requestId);
+    expect(html.length).toBeLessThan(20_000);
+  });
+
+  it("verifies a Steam OpenID assertion through direct provider verification", async () => {
+    const nowMs = Date.UTC(2026, 7, 8, 12, 0, 0);
+    const returnTo = `${PUBLIC_ORIGIN}/v1/auth/steam/callback?state=test`;
+    const result = await verifySteamOpenIdAssertion(
+      steamAssertion(returnTo, "test", nowMs), returnTo, nowMs, validSteamFetcher,
+    );
+    expect(result.steamId64).toBe("76561198145479980");
+    await expect(verifySteamOpenIdAssertion(
+      steamAssertion(`${PUBLIC_ORIGIN}/wrong`, "test", nowMs), returnTo, nowMs, validSteamFetcher,
+    )).rejects.toMatchObject({ code: "steam_assertion_invalid" });
+  });
+
+  it("links a pending device only after Steam verification and explicit confirmation", async () => {
+    const nowMs = Date.UTC(2026, 7, 8, 12, 0, 0);
+    const config = productionConfig();
+    const created = await createDeviceSession(
+      new Request(`${PUBLIC_ORIGIN}/v1/auth/device-sessions`, {
+        method: "POST", headers: { "Content-Type": "application/json" }, body: "{}",
+      }), env, config, crypto.randomUUID(), nowMs,
+    );
+    const device = await json<{ deviceSessionId: string; deviceSecret: string; userCode: string }>(created);
+    const start = await startSteamLogin(
+      new Request(`${PUBLIC_ORIGIN}/v1/auth/steam/start`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ user_code: device.userCode }),
+      }), env, config, crypto.randomUUID(), nowMs,
+    );
+    expect(start.status).toBe(303);
+    const providerUrl = new URL(start.headers.get("Location")!);
+    const returnTo = providerUrl.searchParams.get("openid.return_to")!;
+    const state = new URL(returnTo).searchParams.get("state")!;
+    const assertion = steamAssertion(returnTo, state, nowMs);
+    const callback = await steamCallback(
+      new Request(`${PUBLIC_ORIGIN}/v1/auth/steam/callback?${assertion}`),
+      env, config, crypto.randomUUID(), nowMs, validSteamFetcher,
+    );
+    expect(callback.status).toBe(200);
+    const callbackHtml = await callback.text();
+    const confirmToken = /name="confirm_token" value="([A-Za-z0-9_-]{43})"/u.exec(callbackHtml)?.[1];
+    expect(confirmToken).toBeTruthy();
+    const confirmation = await confirmSteamLogin(
+      new Request(`${PUBLIC_ORIGIN}/v1/auth/steam/confirm`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ state, confirm_token: confirmToken! }),
+      }), env, config, crypto.randomUUID(), nowMs,
+    );
+    expect(confirmation.status).toBe(200);
+    const token = await pollDeviceSession(
+      new Request(`${PUBLIC_ORIGIN}/v1/auth/device-sessions/token`, {
+        method: "POST", headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ deviceSessionId: device.deviceSessionId, deviceSecret: device.deviceSecret }),
+      }), env, config, crypto.randomUUID(), nowMs + 1,
+    );
+    expect(token.status).toBe(200);
+    expect((await json<{ tokenType: string; scope: string }>(token))).toMatchObject({
+      tokenType: "Bearer",
+      scope: "maps:read maps:download maps:upload maps:manage maps:report maps:moderate",
+    });
+    await expect(confirmSteamLogin(
+      new Request(`${PUBLIC_ORIGIN}/v1/auth/steam/confirm`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ state, confirm_token: confirmToken! }),
+      }), env, config, crypto.randomUUID(), nowMs + 2,
+    )).rejects.toMatchObject({ code: "invalid_request" });
+  });
+
+  it("enforces the server-provided device polling interval", async () => {
+    const nowMs = Date.UTC(2026, 7, 8, 12, 0, 0);
+    const config = runtimeConfig(env);
+    const created = await createDeviceSession(
+      new Request(`${LOCAL_ORIGIN}/v1/auth/device-sessions`, {
+        method: "POST", headers: { "Content-Type": "application/json" }, body: "{}",
+      }), env, config, crypto.randomUUID(), nowMs,
+    );
+    const device = await json<{ deviceSessionId: string; deviceSecret: string }>(created);
+    const request = (): Request => new Request(`${LOCAL_ORIGIN}/v1/auth/device-sessions/token`, {
+      method: "POST", headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ deviceSessionId: device.deviceSessionId, deviceSecret: device.deviceSecret }),
+    });
+    expect((await pollDeviceSession(request(), env, config, crypto.randomUUID(), nowMs)).status).toBe(202);
+    await expect(pollDeviceSession(request(), env, config, crypto.randomUUID(), nowMs + 1000))
+      .rejects.toMatchObject({ code: "authorization_slow_down", status: 429 });
+  });
+});
+
+describe("Phase 1 abuse controls", () => {
+  it("returns a stable 429 when the edge limiter denies a request", async () => {
+    const limiter = { limit: async () => ({ success: false }) } as unknown as RateLimit;
+    await expect(enforceRateLimit(limiter, "actor-key"))
+      .rejects.toMatchObject({ code: "rate_limited", status: 429 });
+  });
+
+  it("uses typed HTTP errors for unavailable limiter bindings", async () => {
+    await expect(enforceRateLimit(undefined, "actor-key"))
+      .rejects.toBeInstanceOf(HttpError);
+  });
+
+});
diff --git a/backend/community-api/test/uploads.test.ts b/backend/community-api/test/uploads.test.ts
new file mode 100644
index 0000000..0527be9
--- /dev/null
+++ b/backend/community-api/test/uploads.test.ts
@@ -0,0 +1,298 @@
+import { env } from "cloudflare:workers";
+import { beforeEach, describe, expect, it } from "vitest";
+import { sha256Hex, type AuthPrincipal } from "@ss2revive/community-contracts";
+import { runtimeConfig } from "../src/config";
+import { issueAccessToken } from "../src/crypto";
+import { buildLocalFixture } from "../src/local-fixture";
+import {
+  getUploadStatus,
+  putUploadBundle,
+  reserveUpload,
+  validateUploadMessage,
+} from "../src/uploads";
+
+const STEAM_ID = "76561198145479980";
+const ORIGIN = "http://127.0.0.1:8787";
+const principal: AuthPrincipal = {
+  steamId64: STEAM_ID,
+  sessionId: "11111111-1111-1111-1111-111111111111",
+  scopes: ["maps:read", "maps:download", "maps:upload", "maps:manage", "maps:report", "maps:moderate"],
+};
+
+async function clearState(): Promise<void> {
+  await env.DB.batch([
+    env.DB.prepare("DELETE FROM moderation_events"),
+    env.DB.prepare("DELETE FROM map_reports"),
+    env.DB.prepare("DELETE FROM upload_usage_daily"),
+    env.DB.prepare("DELETE FROM account_storage"),
+    env.DB.prepare("DELETE FROM map_uploads"),
+    env.DB.prepare("DELETE FROM map_tags"),
+    env.DB.prepare("DELETE FROM map_versions"),
+    env.DB.prepare("DELETE FROM maps"),
+    env.DB.prepare("DELETE FROM refresh_tokens"),
+    env.DB.prepare("DELETE FROM refresh_token_families"),
+    env.DB.prepare("DELETE FROM auth_sessions"),
+    env.DB.prepare("DELETE FROM device_auth_sessions"),
+    env.DB.prepare("DELETE FROM steam_openid_sessions"),
+    env.DB.prepare("DELETE FROM users"),
+  ]);
+  const objects = await env.MAP_BUCKET.list({ limit: 1000 });
+  if (objects.objects.length > 0) await env.MAP_BUCKET.delete(objects.objects.map((object) => object.key));
+  const nowMs = Date.UTC(2026, 7, 8, 12, 0, 0);
+  await env.DB.prepare(
+    `INSERT INTO users (steam_id64, status, created_at, last_login_at) VALUES (?, 'active', ?, ?)`,
+  ).bind(STEAM_ID, nowMs, nowMs).run();
+}
+
+async function reserve(bytes: Uint8Array, sha256: string, nowMs: number): Promise<string> {
+  const response = await reserveUpload(
+    new Request(`${ORIGIN}/v1/uploads`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ sizeBytes: bytes.length, sha256 }),
+    }),
+    env,
+    runtimeConfig(env),
+    principal,
+    crypto.randomUUID(),
+    nowMs,
+  );
+  const body = await response.json<{ uploadId: string }>();
+  return body.uploadId;
+}
+
+async function put(uploadId: string, bytes: Uint8Array, sha256: string, nowMs: number): Promise<Response> {
+  const requestBody = new ArrayBuffer(bytes.length);
+  new Uint8Array(requestBody).set(bytes);
+  return putUploadBundle(
+    new Request(`${ORIGIN}/v1/uploads/${uploadId}/bundle`, {
+      method: "PUT",
+      headers: {
+        "Content-Type": "application/vnd.ss2revive.level",
+        "Content-Length": String(bytes.length),
+        "X-Content-SHA256": sha256,
+      },
+      body: requestBody,
+    }),
+    env,
+    runtimeConfig(env),
+    principal,
+    uploadId,
+    crypto.randomUUID(),
+    nowMs,
+  );
+}
+
+beforeEach(clearState);
+
+describe("authenticated map uploads", () => {
+  it("quarantines, validates, publishes, and exposes a current-format bundle", async () => {
+    const nowMs = Date.UTC(2026, 7, 8, 12, 0, 0);
+    const fixture = await buildLocalFixture();
+    const uploadId = await reserve(fixture.bytes, fixture.sha256, nowMs);
+    expect((await put(uploadId, fixture.bytes, fixture.sha256, nowMs + 1)).status).toBe(202);
+
+    await validateUploadMessage(env, { kind: "map-upload", uploadId }, nowMs + 2);
+    const status = await getUploadStatus(
+      new Request(`${ORIGIN}/v1/uploads/${uploadId}`),
+      env,
+      runtimeConfig(env),
+      principal,
+      uploadId,
+      crypto.randomUUID(),
+    );
+    expect(await status.json()).toMatchObject({
+      uploadId,
+      status: "published",
+      mapId: "1a658233-92c5-4b63-87fc-4740c855730b",
+      revision: 1,
+    });
+    expect(await env.DB.prepare(
+      "SELECT status FROM map_versions WHERE map_id = ? AND revision = 1",
+    ).bind("1a658233-92c5-4b63-87fc-4740c855730b").first()).toMatchObject({ status: "published" });
+    expect(await env.MAP_BUCKET.head(fixture.bundleKey)).not.toBeNull();
+    expect(await env.MAP_BUCKET.head(fixture.thumbnailKey)).not.toBeNull();
+  });
+
+  it("rejects a bundle whose creator does not match the authenticated Steam account", async () => {
+    const nowMs = Date.UTC(2026, 7, 8, 12, 0, 0);
+    const fixture = await buildLocalFixture();
+    const bytes = fixture.bytes.slice();
+    const source = new TextEncoder().encode("76561198145479980");
+    const replacement = new TextEncoder().encode("76561198145479981");
+    const index = bytes.findIndex((_, offset) => source.every((value, inner) => bytes[offset + inner] === value));
+    expect(index).toBeGreaterThan(0);
+    bytes.set(replacement, index);
+    const sha256 = await sha256Hex(bytes);
+    const uploadId = await reserve(bytes, sha256, nowMs);
+    expect((await put(uploadId, bytes, sha256, nowMs + 1)).status).toBe(202);
+    await validateUploadMessage(env, { kind: "map-upload", uploadId }, nowMs + 2);
+    expect(await env.DB.prepare(
+      "SELECT status, error_code FROM map_uploads WHERE id = ?",
+    ).bind(uploadId).first()).toMatchObject({ status: "rejected", error_code: "creator_mismatch" });
+    expect(await env.DB.prepare("SELECT id FROM maps").first()).toBeNull();
+  });
+
+  it("publishes exactly once when the queue delivers the same upload concurrently", async () => {
+    const nowMs = Date.UTC(2026, 7, 8, 12, 0, 0);
+    const fixture = await buildLocalFixture();
+    const uploadId = await reserve(fixture.bytes, fixture.sha256, nowMs);
+    expect((await put(uploadId, fixture.bytes, fixture.sha256, nowMs + 1)).status).toBe(202);
+
+    await Promise.all([
+      validateUploadMessage(env, { kind: "map-upload", uploadId }, nowMs + 2),
+      validateUploadMessage(env, { kind: "map-upload", uploadId }, nowMs + 2),
+    ]);
+
+    expect(await env.DB.prepare(
+      "SELECT status FROM map_uploads WHERE id = ?",
+    ).bind(uploadId).first()).toMatchObject({ status: "published" });
+    expect(await env.DB.prepare(
+      "SELECT COUNT(*) AS count FROM map_versions WHERE map_id = ? AND revision = 1",
+    ).bind("1a658233-92c5-4b63-87fc-4740c855730b").first()).toMatchObject({ count: 1 });
+    expect(await env.MAP_BUCKET.head(fixture.bundleKey)).not.toBeNull();
+    expect(await env.MAP_BUCKET.head(fixture.thumbnailKey)).not.toBeNull();
+  });
+
+  it("accepts an unchanged revision again when only export time and validation state changed", async () => {
+    const nowMs = Date.UTC(2026, 7, 8, 12, 0, 0);
+    const fixture = await buildLocalFixture();
+    const firstId = await reserve(fixture.bytes, fixture.sha256, nowMs);
+    expect((await put(firstId, fixture.bytes, fixture.sha256, nowMs + 1)).status).toBe(202);
+    await validateUploadMessage(env, { kind: "map-upload", uploadId: firstId }, nowMs + 2);
+
+    const repeated = await buildLocalFixture({
+      exportedAtMs: Date.UTC(2026, 0, 1, 0, 0, 3),
+      validations: [{
+        id: "f9dab629-2372-4eb3-b24a-063f382f6043",
+        description: "Local deterministic fixture",
+        validated: true,
+      }],
+    });
+    expect(repeated.sha256).not.toBe(fixture.sha256);
+    const repeatedId = await reserve(repeated.bytes, repeated.sha256, nowMs + 3);
+    expect((await put(repeatedId, repeated.bytes, repeated.sha256, nowMs + 4)).status).toBe(202);
+    await validateUploadMessage(env, { kind: "map-upload", uploadId: repeatedId }, nowMs + 5);
+
+    expect(await env.DB.prepare(
+      "SELECT status, map_id, revision FROM map_uploads WHERE id = ?",
+    ).bind(repeatedId).first()).toMatchObject({
+      status: "published",
+      map_id: "1a658233-92c5-4b63-87fc-4740c855730b",
+      revision: 1,
+    });
+    expect(await env.DB.prepare(
+      "SELECT COUNT(*) AS count FROM map_versions WHERE map_id = ?",
+    ).bind("1a658233-92c5-4b63-87fc-4740c855730b").first()).toMatchObject({ count: 1 });
+  });
+
+  it("replaces the current community revision after the same owner saves a newer revision", async () => {
+    const nowMs = Date.UTC(2026, 7, 8, 12, 0, 0);
+    const first = await buildLocalFixture();
+    const firstId = await reserve(first.bytes, first.sha256, nowMs);
+    expect((await put(firstId, first.bytes, first.sha256, nowMs + 1)).status).toBe(202);
+    await validateUploadMessage(env, { kind: "map-upload", uploadId: firstId }, nowMs + 2);
+
+    const second = await buildLocalFixture({
+      contentVersion: 2,
+      exportedAtMs: Date.UTC(2026, 0, 1, 0, 0, 4),
+    });
+    const secondId = await reserve(second.bytes, second.sha256, nowMs + 3);
+    expect((await put(secondId, second.bytes, second.sha256, nowMs + 4)).status).toBe(202);
+    await validateUploadMessage(env, { kind: "map-upload", uploadId: secondId }, nowMs + 5);
+
+    expect(await env.DB.prepare(
+      "SELECT status, current_revision FROM maps WHERE id = ?",
+    ).bind("1a658233-92c5-4b63-87fc-4740c855730b").first()).toMatchObject({
+      status: "published",
+      current_revision: 2,
+    });
+    expect(await env.DB.prepare(
+      "SELECT status FROM map_versions WHERE map_id = ? AND revision = 2",
+    ).bind("1a658233-92c5-4b63-87fc-4740c855730b").first()).toMatchObject({ status: "published" });
+    expect(await env.MAP_BUCKET.head(second.bundleKey)).not.toBeNull();
+  });
+
+  it("does not let an owner bypass a maintainer takedown by uploading again", async () => {
+    const nowMs = Date.UTC(2026, 7, 8, 12, 0, 0);
+    const first = await buildLocalFixture();
+    const firstId = await reserve(first.bytes, first.sha256, nowMs);
+    expect((await put(firstId, first.bytes, first.sha256, nowMs + 1)).status).toBe(202);
+    await validateUploadMessage(env, { kind: "map-upload", uploadId: firstId }, nowMs + 2);
+    await env.DB.prepare(
+      `UPDATE maps SET status = 'archived', moderation_reason = 'Maintainer review'
+        WHERE id = ?`,
+    ).bind("1a658233-92c5-4b63-87fc-4740c855730b").run();
+
+    const second = await buildLocalFixture({
+      contentVersion: 2,
+      exportedAtMs: Date.UTC(2026, 0, 1, 0, 0, 4),
+    });
+    const secondId = await reserve(second.bytes, second.sha256, nowMs + 3);
+    expect((await put(secondId, second.bytes, second.sha256, nowMs + 4)).status).toBe(202);
+    await validateUploadMessage(env, { kind: "map-upload", uploadId: secondId }, nowMs + 5);
+
+    expect(await env.DB.prepare(
+      "SELECT status, error_code FROM map_uploads WHERE id = ?",
+    ).bind(secondId).first()).toMatchObject({
+      status: "rejected",
+      error_code: "map_under_moderation",
+    });
+    expect(await env.DB.prepare(
+      "SELECT status, current_revision, moderation_reason FROM maps WHERE id = ?",
+    ).bind("1a658233-92c5-4b63-87fc-4740c855730b").first()).toMatchObject({
+      status: "archived",
+      current_revision: 1,
+      moderation_reason: "Maintainer review",
+    });
+  });
+
+  it("issues publishing scope to every Steam identity and moderation only to maintainers", async () => {
+    const nowMs = Date.UTC(2026, 7, 8, 12, 0, 0);
+    const config = runtimeConfig(env);
+    expect((await issueAccessToken(config, STEAM_ID, crypto.randomUUID(), nowMs)).scope)
+      .toContain("maps:upload");
+    expect((await issueAccessToken(config, "76561198145479981", crypto.randomUUID(), nowMs)).scope)
+      .toContain("maps:upload");
+    expect((await issueAccessToken(config, STEAM_ID, crypto.randomUUID(), nowMs)).scope)
+      .toContain("maps:moderate");
+    expect((await issueAccessToken(config, "76561198145479981", crypto.randomUUID(), nowMs)).scope)
+      .not.toContain("maps:moderate");
+  });
+
+  it("enforces the atomic UTC-day reservation quota", async () => {
+    const nowMs = Date.UTC(2026, 7, 8, 12, 0, 0);
+    const fixture = await buildLocalFixture();
+    const config = { ...runtimeConfig(env), uploadDailyLimit: 1 };
+    const request = () => new Request(`${ORIGIN}/v1/uploads`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ sizeBytes: fixture.bytes.length, sha256: fixture.sha256 }),
+    });
+    expect((await reserveUpload(request(), env, config, principal, crypto.randomUUID(), nowMs)).status).toBe(201);
+    await expect(reserveUpload(request(), env, config, principal, crypto.randomUUID(), nowMs + 1))
+      .rejects.toMatchObject({ code: "daily_upload_limit_reached", status: 429 });
+  });
+
+  it("rejects a new map after the lifetime per-account map quota is reached", async () => {
+    const nowMs = Date.UTC(2026, 7, 8, 12, 0, 0);
+    const statements: D1PreparedStatement[] = [];
+    for (let index = 0; index < 25; index += 1) {
+      const id = crypto.randomUUID();
+      statements.push(env.DB.prepare(
+        `INSERT INTO maps
+           (id, status, current_revision, title, title_sort, description,
+            created_at_ms, updated_at_ms, owner_steam_id64)
+         VALUES (?, 'archived', 1, ?, ?, '', ?, ?, ?)`,
+      ).bind(id, `Archived ${index}`, `archived ${index}`, nowMs, nowMs, STEAM_ID));
+    }
+    await env.DB.batch(statements);
+    const fixture = await buildLocalFixture();
+    const uploadId = await reserve(fixture.bytes, fixture.sha256, nowMs + 1);
+    expect((await put(uploadId, fixture.bytes, fixture.sha256, nowMs + 2)).status).toBe(202);
+    await validateUploadMessage(env, { kind: "map-upload", uploadId }, nowMs + 3);
+    expect(await env.DB.prepare(
+      "SELECT status, error_code FROM map_uploads WHERE id = ?",
+    ).bind(uploadId).first()).toMatchObject({ status: "rejected", error_code: "map_quota_reached" });
+  });
+});
diff --git a/backend/community-api/test/worker.test.ts b/backend/community-api/test/worker.test.ts
new file mode 100644
index 0000000..bf27879
--- /dev/null
+++ b/backend/community-api/test/worker.test.ts
@@ -0,0 +1,313 @@
+import { env } from "cloudflare:workers";
+import { beforeEach, describe, expect, it } from "vitest";
+import { runtimeConfig } from "../src/config";
+import { approveLocalDeviceByCode } from "../src/auth";
+import worker from "../src/worker";
+
+const ORIGIN = "http://127.0.0.1:8787";
+
+const testContext = {
+  waitUntil(promise: Promise<unknown>): void {
+    void promise.catch(() => undefined);
+  },
+  passThroughOnException(): void {},
+  props: {},
+} as unknown as ExecutionContext;
+
+async function fetchApi(path: string, init?: RequestInit): Promise<Response> {
+  return worker.fetch(new Request(`${ORIGIN}${path}`, init), env, testContext);
+}
+
+async function json<T>(response: Response): Promise<T> {
+  return response.json() as Promise<T>;
+}
+
+async function accessToken(): Promise<{ accessToken: string; refreshToken: string }> {
+  const created = await fetchApi("/v1/auth/device-sessions", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: "{}",
+  });
+  expect(created.status).toBe(201);
+  const session = await json<{ deviceSessionId: string; deviceSecret: string; userCode: string }>(created);
+  expect(await approveLocalDeviceByCode(env, runtimeConfig(env), session.userCode, Date.now())).toBe(true);
+  const token = await fetchApi("/v1/auth/device-sessions/token", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ deviceSessionId: session.deviceSessionId, deviceSecret: session.deviceSecret }),
+  });
+  expect(token.status).toBe(200);
+  return json<{ accessToken: string; refreshToken: string }>(token);
+}
+
+async function seed(): Promise<void> {
+  const response = await fetchApi("/_local/seed", {
+    method: "POST",
+    headers: { "X-Local-Setup-Secret": env.LOCAL_AUTH_SECRET },
+  });
+  expect(response.status).toBe(200);
+}
+
+beforeEach(async () => {
+  await env.DB.batch([
+    env.DB.prepare("DELETE FROM moderation_events"),
+    env.DB.prepare("DELETE FROM map_reports"),
+    env.DB.prepare("DELETE FROM upload_usage_daily"),
+    env.DB.prepare("DELETE FROM account_storage"),
+    env.DB.prepare("DELETE FROM map_uploads"),
+    env.DB.prepare("DELETE FROM steam_openid_sessions"),
+    env.DB.prepare("DELETE FROM refresh_tokens"),
+    env.DB.prepare("DELETE FROM refresh_token_families"),
+    env.DB.prepare("DELETE FROM auth_sessions"),
+    env.DB.prepare("DELETE FROM device_auth_sessions"),
+    env.DB.prepare("DELETE FROM map_tags"),
+    env.DB.prepare("DELETE FROM map_versions"),
+    env.DB.prepare("DELETE FROM maps"),
+    env.DB.prepare("DELETE FROM users"),
+  ]);
+});
+
+describe("Phase 0 Worker", () => {
+  it("keeps upload reservations behind bearer authentication", async () => {
+    const response = await fetchApi("/v1/uploads", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ sizeBytes: 100, sha256: "a".repeat(64) }),
+    });
+    expect(response.status).toBe(401);
+    expect(await json(response)).toMatchObject({ error: { code: "auth_required" } });
+  });
+
+  it("routes authenticated owner unpublish and archive actions and removes the map publicly", async () => {
+    const tokens = await accessToken();
+    await seed();
+    const mapId = "1a658233-92c5-4b63-87fc-4740c855730b";
+    const unpublished = await fetchApi(`/v1/maps/${mapId}/unpublish`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${tokens.accessToken}`, "Content-Type": "application/json" },
+      body: "{}",
+    });
+    expect(unpublished.status).toBe(200);
+    const catalog = await fetchApi("/v1/catalog");
+    expect((await json<{ maps: unknown[] }>(catalog)).maps).toEqual([]);
+    const archived = await fetchApi(`/v1/maps/${mapId}`, {
+      method: "DELETE",
+      headers: { Authorization: `Bearer ${tokens.accessToken}` },
+    });
+    expect(archived.status).toBe(204);
+  });
+
+  it("returns only shallow health and security headers", async () => {
+    const response = await fetchApi("/health");
+    expect(response.status).toBe(200);
+    expect(await json(response)).toEqual({ status: "ok" });
+    expect(response.headers.get("X-Content-Type-Options")).toBe("nosniff");
+    expect(response.headers.get("Cache-Control")).toBe("no-store");
+    expect(response.headers.get("X-Request-Id")).toMatch(/^[0-9a-f-]{36}$/);
+  });
+
+  it("serves published map metadata publicly while keeping account data authenticated", async () => {
+    const response = await fetchApi("/v1/maps");
+    expect(response.status).toBe(200);
+    expect(await json(response)).toMatchObject({ items: [], nextCursor: null });
+    const me = await fetchApi("/v1/me");
+    expect(me.status).toBe(401);
+    expect(me.headers.get("WWW-Authenticate")).toContain("Bearer");
+  });
+
+  it("supports pending, approval, one-time consumption, and /me", async () => {
+    const created = await fetchApi("/v1/auth/device-sessions", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: "{}",
+    });
+    const session = await json<{ deviceSessionId: string; deviceSecret: string; userCode: string }>(created);
+    const pollBody = JSON.stringify({ deviceSessionId: session.deviceSessionId, deviceSecret: session.deviceSecret });
+    const pending = await fetchApi("/v1/auth/device-sessions/token", {
+      method: "POST", headers: { "Content-Type": "application/json" }, body: pollBody,
+    });
+    expect(pending.status).toBe(202);
+    expect(pending.headers.get("Retry-After")).toBe("5");
+    expect(await approveLocalDeviceByCode(env, runtimeConfig(env), session.userCode, Date.now())).toBe(true);
+    const approved = await fetchApi("/v1/auth/device-sessions/token", {
+      method: "POST", headers: { "Content-Type": "application/json" }, body: pollBody,
+    });
+    expect(approved.status).toBe(200);
+    const tokens = await json<{ accessToken: string; refreshToken: string }>(approved);
+    const consumed = await fetchApi("/v1/auth/device-sessions/token", {
+      method: "POST", headers: { "Content-Type": "application/json" }, body: pollBody,
+    });
+    expect(consumed.status).toBe(409);
+    const me = await fetchApi("/v1/me", { headers: { Authorization: `Bearer ${tokens.accessToken}` } });
+    expect(me.status).toBe(200);
+    expect((await json<{ steamId64: string }>(me)).steamId64).toBe(env.MOCK_STEAM_ID64);
+  });
+
+  it("rotates refresh tokens and revokes the family on replay", async () => {
+    const initial = await accessToken();
+    const refresh = await fetchApi("/v1/auth/refresh", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refreshToken: initial.refreshToken }),
+    });
+    expect(refresh.status).toBe(200);
+    const rotated = await json<{ accessToken: string; refreshToken: string }>(refresh);
+    expect(rotated.refreshToken).not.toBe(initial.refreshToken);
+    const replay = await fetchApi("/v1/auth/refresh", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refreshToken: initial.refreshToken }),
+    });
+    expect(replay.status).toBe(401);
+    const familyRevoked = await fetchApi("/v1/auth/refresh", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refreshToken: rotated.refreshToken }),
+    });
+    expect(familyRevoked.status).toBe(401);
+    const oldAccessRevoked = await fetchApi("/v1/me", { headers: { Authorization: `Bearer ${rotated.accessToken}` } });
+    expect(oldAccessRevoked.status).toBe(401);
+  });
+
+  it("lists, filters, details, and downloads the seeded bundle", async () => {
+    await seed();
+    const list = await fetchApi("/v1/maps?players=1&tag=TEAM_COOP&query=Phase&limit=1");
+    expect(list.status).toBe(200);
+    const page = await json<{ items: Array<{ id: string; thumbnail: { url: string }; downloadUrl: string }> }>(list);
+    expect(page.items).toHaveLength(1);
+    expect(page.items[0]?.id).toBe("1a658233-92c5-4b63-87fc-4740c855730b");
+    expect(page.items[0]?.thumbnail.url).toContain("/versions/1/thumbnail");
+
+    const detail = await fetchApi(`/v1/maps/${page.items[0]!.id}`);
+    expect(detail.status).toBe(200);
+    const catalog = await fetchApi("/v1/catalog");
+    expect(catalog.status).toBe(200);
+    expect(catalog.headers.get("Cache-Control")).toContain("public");
+    const catalogBody = await json<{ schemaVersion: number; maps: Array<{ bundleKey: string }> }>(catalog);
+    expect(catalogBody.schemaVersion).toBe(1);
+    expect(catalogBody.maps[0]?.bundleKey).toBe(page.items[0]!.downloadUrl.slice(4));
+    const downloadPath = page.items[0]!.downloadUrl;
+    const full = await fetchApi(downloadPath);
+    expect(full.status).toBe(200);
+    const bytes = new Uint8Array(await full.arrayBuffer());
+    expect(bytes.length).toBe(Number(full.headers.get("Content-Length")));
+    expect(new TextDecoder().decode(bytes.slice(0, 16))).toBe("SS2REVIVE LEVEL\n");
+    const etag = full.headers.get("ETag")!;
+
+    const head = await fetchApi(downloadPath, { method: "HEAD" });
+    expect(head.status).toBe(200);
+    expect((await head.arrayBuffer()).byteLength).toBe(0);
+    expect(head.headers.get("ETag")).toBe(etag);
+
+    const partial = await fetchApi(downloadPath, { headers: { Range: "bytes=0-15", "If-Range": etag } });
+    expect(partial.status).toBe(206);
+    expect(partial.headers.get("Content-Range")).toBe(`bytes 0-15/${bytes.length}`);
+    expect(new Uint8Array(await partial.arrayBuffer())).toEqual(bytes.slice(0, 16));
+
+    const notModified = await fetchApi(downloadPath, { headers: { "If-None-Match": etag } });
+    expect(notModified.status).toBe(304);
+    const rangedNotModified = await fetchApi(downloadPath, {
+      headers: { Range: "bytes=0-15", "If-None-Match": etag },
+    });
+    expect(rangedNotModified.status).toBe(304);
+    const invalidRange = await fetchApi(downloadPath, { headers: { Range: "bytes=0-1,4-5" } });
+    expect(invalidRange.status).toBe(416);
+  });
+
+  it("rejects cursor tampering and ambiguous paths", async () => {
+    await seed();
+    const secondId = "2a658233-92c5-4b63-87fc-4740c855730b";
+    await env.DB.batch([
+      env.DB.prepare(
+        `INSERT INTO maps (id, status, current_revision, title, title_sort, description, created_at_ms, updated_at_ms)
+         SELECT ?, status, current_revision, 'Second room', 'second room', description, created_at_ms, updated_at_ms - 1
+           FROM maps WHERE id = ?`,
+      ).bind(secondId, "1a658233-92c5-4b63-87fc-4740c855730b"),
+      env.DB.prepare(
+        `INSERT INTO map_versions
+           (map_id, revision, status, code, creator_ids_json, tags_json, configurations_json,
+            validations_json, player_counts_csv, client_version, map_format_version,
+            minimum_revive_version, revive_version, size_bytes, sha256, bundle_key,
+            thumbnail_size_bytes, thumbnail_sha256, thumbnail_key, created_at_ms)
+         SELECT ?, revision, status, 'M4JlKsWSY0uH_EdAyFVzCw', creator_ids_json, tags_json,
+                 configurations_json, validations_json, player_counts_csv, client_version,
+                 map_format_version, minimum_revive_version, revive_version, size_bytes, sha256,
+                 replace(bundle_key,
+                   '1a658233-92c5-4b63-87fc-4740c855730b',
+                   '2a658233-92c5-4b63-87fc-4740c855730b'),
+                 NULL, NULL, NULL, created_at_ms
+           FROM map_versions WHERE map_id = ? AND revision = 1`,
+      ).bind(secondId, "1a658233-92c5-4b63-87fc-4740c855730b"),
+    ]);
+    const first = await fetchApi("/v1/maps?limit=1");
+    const page = await json<{ items: unknown[]; nextCursor: string }>(first);
+    expect(page.items).toHaveLength(1);
+    expect(page.nextCursor).toBeTruthy();
+    const next = await fetchApi(`/v1/maps?limit=1&cursor=${encodeURIComponent(page.nextCursor)}`);
+    expect(next.status).toBe(200);
+    const tamperedCursor = `${page.nextCursor.slice(0, -1)}${page.nextCursor.endsWith("A") ? "B" : "A"}`;
+    const tampered = await fetchApi(`/v1/maps?limit=1&cursor=${encodeURIComponent(tamperedCursor)}`);
+    expect(tampered.status).toBe(400);
+    const ambiguous = await fetchApi("/v1//maps");
+    expect(ambiguous.status).toBe(400);
+    const encoded = await fetchApi("/v1/%6daps");
+    expect(encoded.status).toBe(400);
+  });
+
+  it("refuses D1 object-key metadata that could cross an R2 authorization boundary", async () => {
+    await seed();
+    await env.DB.prepare(
+      "UPDATE map_versions SET bundle_key = 'approved/maps/another-object.ss2level' WHERE map_id = ? AND revision = 1",
+    ).bind("1a658233-92c5-4b63-87fc-4740c855730b").run();
+    const response = await fetchApi(
+      "/v1/maps/1a658233-92c5-4b63-87fc-4740c855730b/versions/1/download",
+    );
+    expect(response.status).toBe(503);
+    expect((await json<{ error: { code: string } }>(response)).error.code).toBe("object_metadata_mismatch");
+  });
+
+  it("uses Steam activation and fails closed for local setup routes in production", async () => {
+    const productionEnv: Env = {
+      ...env,
+      ENVIRONMENT: "production",
+      ALLOW_MOCK_AUTH: "true",
+      PUBLIC_ORIGIN: "https://community.m12labs.net",
+    };
+    const activation = await worker.fetch(
+      new Request("https://community.m12labs.net/activate"), productionEnv, testContext,
+    );
+    expect(activation.status).toBe(200);
+    expect(await activation.text()).toContain("Continue to Steam");
+    const invalidStart = await worker.fetch(new Request(
+      "https://community.m12labs.net/v1/auth/steam/start",
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ user_code: "NOT-A-CODE" }),
+      },
+    ), productionEnv, testContext);
+    expect(invalidStart.status).toBe(400);
+    expect(invalidStart.headers.get("Content-Type")).toBe("text/html; charset=utf-8");
+    expect(await invalidStart.text()).toContain("We couldn't continue");
+    const seeded = await worker.fetch(new Request("https://community.m12labs.net/_local/seed", {
+      method: "POST", headers: { "X-Local-Setup-Secret": env.LOCAL_AUTH_SECRET },
+    }), productionEnv, testContext);
+    expect(seeded.status).toBe(404);
+  });
+
+  it("never exposes mock routes on a public origin even with local flags", async () => {
+    const activation = await worker.fetch(new Request("https://community.m12labs.net/activate"), env, testContext);
+    expect(activation.status).toBe(421);
+    const seeded = await worker.fetch(new Request("https://community.m12labs.net/_local/seed", {
+      method: "POST", headers: { "X-Local-Setup-Secret": env.LOCAL_AUTH_SECRET },
+    }), env, testContext);
+    expect(seeded.status).toBe(421);
+  });
+
+  it("fails closed when security-sensitive environment values are invalid", async () => {
+    const invalidEnv: Env = { ...env, LOCAL_AUTH_SECRET: "short" };
+    const response = await worker.fetch(new Request(`${ORIGIN}/health`), invalidEnv, testContext);
+    expect(response.status).toBe(503);
+    expect((await json<{ error: { code: string } }>(response)).error.code).toBe("temporarily_unavailable");
+  });
+});
diff --git a/backend/community-api/tsconfig.json b/backend/community-api/tsconfig.json
new file mode 100644
index 0000000..6c21f2b
--- /dev/null
+++ b/backend/community-api/tsconfig.json
@@ -0,0 +1,15 @@
+{
+  "extends": "../tsconfig.base.json",
+  "compilerOptions": {
+    "lib": ["ES2022", "WebWorker"],
+    "types": ["node", "@cloudflare/workers-types", "@cloudflare/vitest-pool-workers/types"],
+    "noEmit": true
+  },
+  "include": [
+    "src/**/*.ts",
+    "test/**/*.ts",
+    "vitest.config.ts",
+    "worker-configuration.d.ts",
+    "test-bindings.d.ts"
+  ]
+}
diff --git a/backend/community-api/vitest.config.ts b/backend/community-api/vitest.config.ts
new file mode 100644
index 0000000..abfdaa3
--- /dev/null
+++ b/backend/community-api/vitest.config.ts
@@ -0,0 +1,29 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { cloudflareTest, readD1Migrations } from "@cloudflare/vitest-pool-workers";
+import { defineConfig } from "vitest/config";
+
+const directory = path.dirname(fileURLToPath(import.meta.url));
+
+export default defineConfig({
+  plugins: [
+    cloudflareTest(async () => ({
+      wrangler: { configPath: path.join(directory, "wrangler.jsonc") },
+      miniflare: {
+        bindings: {
+          LOCAL_AUTH_SECRET: "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=",
+          AUTH_SIGNING_SECRET: "YWJjZGVmMDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODg=",
+          TEST_MIGRATIONS: await readD1Migrations(path.join(directory, "migrations")),
+        },
+      },
+    })),
+  ],
+  test: {
+    setupFiles: ["./test/apply-migrations.ts"],
+    coverage: {
+      provider: "istanbul",
+      reporter: ["text", "json-summary"],
+      reportsDirectory: "coverage",
+    },
+  },
+});
diff --git a/backend/community-api/worker-configuration.d.ts b/backend/community-api/worker-configuration.d.ts
new file mode 100644
index 0000000..98df525
--- /dev/null
+++ b/backend/community-api/worker-configuration.d.ts
@@ -0,0 +1,28 @@
+/* eslint-disable */
+// Generated by Wrangler by running `wrangler types --include-runtime=false --strict-vars=false` (hash: fa34fa9f0eaa1228acd20299272177a0)
+interface __BaseEnv_Env {
+	MAP_BUCKET: R2Bucket;
+	DB: D1Database;
+	VALIDATION_QUEUE: Queue;
+	AUTH_RATE_LIMITER: RateLimit;
+	API_RATE_LIMITER: RateLimit;
+	DOWNLOAD_RATE_LIMITER: RateLimit;
+	ENVIRONMENT: string;
+	ALLOW_MOCK_AUTH: string;
+	AUTH_ISSUER: string;
+	AUTH_AUDIENCE: string;
+	MOCK_STEAM_ID64: string;
+	PUBLIC_ORIGIN: string;
+	UPLOAD_DAILY_LIMIT: string;
+	UPLOAD_DAILY_BYTES: string;
+	RETAINED_BYTES_PER_ACCOUNT: string;
+	MAPS_PER_ACCOUNT_LIMIT: string;
+	MAINTAINER_STEAM_IDS: string;
+}
+declare namespace Cloudflare {
+	interface GlobalProps {
+		mainModule: typeof import("./src/worker");
+	}
+	interface Env extends __BaseEnv_Env {}
+}
+interface Env extends __BaseEnv_Env {}
diff --git a/backend/community-api/wrangler.jsonc b/backend/community-api/wrangler.jsonc
new file mode 100644
index 0000000..1c4e16f
--- /dev/null
+++ b/backend/community-api/wrangler.jsonc
@@ -0,0 +1,73 @@
+{
+  "$schema": "node_modules/wrangler/config-schema.json",
+  "name": "ss2revive-community-api-local",
+  "main": "src/worker.ts",
+  "compatibility_date": "2026-08-08",
+  "workers_dev": false,
+  "preview_urls": false,
+  "vars": {
+    "ENVIRONMENT": "local",
+    "ALLOW_MOCK_AUTH": "true",
+    "AUTH_ISSUER": "urn:ss2revive:community:local",
+    "AUTH_AUDIENCE": "ss2revive-community-client",
+    "MOCK_STEAM_ID64": "76561198145479980",
+    "PUBLIC_ORIGIN": "http://127.0.0.1:8787",
+    "UPLOAD_DAILY_LIMIT": "10",
+    "UPLOAD_DAILY_BYTES": "1073741824",
+    "RETAINED_BYTES_PER_ACCOUNT": "5368709120",
+    "MAPS_PER_ACCOUNT_LIMIT": "25",
+    "MAINTAINER_STEAM_IDS": "76561198145479980"
+  },
+  "d1_databases": [
+    {
+      "binding": "DB",
+      "database_name": "ss2revive-community-local",
+      "database_id": "00000000-0000-0000-0000-000000000001",
+      "migrations_dir": "migrations",
+      "remote": false
+    }
+  ],
+  "r2_buckets": [
+    {
+      "binding": "MAP_BUCKET",
+      "bucket_name": "ss2revive-community-local",
+      "remote": false
+    }
+  ],
+  "queues": {
+    "producers": [
+      {
+        "binding": "VALIDATION_QUEUE",
+        "queue": "ss2revive-validation-local"
+      }
+    ],
+    "consumers": [
+      {
+        "queue": "ss2revive-validation-local",
+        "max_batch_size": 1,
+        "max_batch_timeout": 5,
+        "max_retries": 5
+      }
+    ]
+  },
+  "ratelimits": [
+    {
+      "name": "AUTH_RATE_LIMITER",
+      "namespace_id": "1001",
+      "simple": { "limit": 10000, "period": 60 }
+    },
+    {
+      "name": "API_RATE_LIMITER",
+      "namespace_id": "1002",
+      "simple": { "limit": 10000, "period": 60 }
+    },
+    {
+      "name": "DOWNLOAD_RATE_LIMITER",
+      "namespace_id": "1003",
+      "simple": { "limit": 10000, "period": 60 }
+    }
+  ],
+  "triggers": {
+    "crons": ["17 * * * *"]
+  }
+}
diff --git a/backend/community-api/wrangler.production.example.jsonc b/backend/community-api/wrangler.production.example.jsonc
new file mode 100644
index 0000000..ef8d0cc
--- /dev/null
+++ b/backend/community-api/wrangler.production.example.jsonc
@@ -0,0 +1,87 @@
+{
+  "$schema": "node_modules/wrangler/config-schema.json",
+  "name": "ss2revive-community-api-production",
+  "main": "src/worker.ts",
+  "compatibility_date": "2026-08-08",
+  "workers_dev": false,
+  "preview_urls": false,
+  "routes": [
+    {
+      "pattern": "community.m12labs.net",
+      "custom_domain": true
+    }
+  ],
+  "vars": {
+    "ENVIRONMENT": "production",
+    "ALLOW_MOCK_AUTH": "false",
+    "AUTH_ISSUER": "urn:ss2revive:community:production",
+    "AUTH_AUDIENCE": "ss2revive-community-client",
+    "MOCK_STEAM_ID64": "",
+    "PUBLIC_ORIGIN": "https://community.m12labs.net",
+    "UPLOAD_DAILY_LIMIT": "10",
+    "UPLOAD_DAILY_BYTES": "1073741824",
+    "RETAINED_BYTES_PER_ACCOUNT": "5368709120",
+    "MAPS_PER_ACCOUNT_LIMIT": "25",
+    "MAINTAINER_STEAM_IDS": "76561198145479980"
+  },
+  "secrets": {
+    "required": ["AUTH_SIGNING_SECRET"]
+  },
+  "d1_databases": [
+    {
+      "binding": "DB",
+      "database_name": "ss2revive-community-production",
+      "database_id": "00000000-0000-0000-0000-000000000000",
+      "migrations_dir": "migrations"
+    }
+  ],
+  "r2_buckets": [
+    {
+      "binding": "MAP_BUCKET",
+      "bucket_name": "ss2revive-community-production"
+    }
+  ],
+  "queues": {
+    "producers": [
+      {
+        "binding": "VALIDATION_QUEUE",
+        "queue": "ss2revive-validation-production"
+      }
+    ],
+    "consumers": [
+      {
+        "queue": "ss2revive-validation-production",
+        "max_batch_size": 1,
+        "max_batch_timeout": 5,
+        "max_retries": 5,
+        "dead_letter_queue": "ss2revive-validation-production-dlq"
+      }
+    ]
+  },
+  "ratelimits": [
+    {
+      "name": "AUTH_RATE_LIMITER",
+      "namespace_id": "1101",
+      "simple": { "limit": 10, "period": 60 }
+    },
+    {
+      "name": "API_RATE_LIMITER",
+      "namespace_id": "1102",
+      "simple": { "limit": 120, "period": 60 }
+    },
+    {
+      "name": "DOWNLOAD_RATE_LIMITER",
+      "namespace_id": "1103",
+      "simple": { "limit": 30, "period": 60 }
+    }
+  ],
+  "triggers": {
+    "crons": ["17 * * * *"]
+  },
+  // Explicit CPU limits require a paid Workers plan; re-enable this block after upgrading.
+  // "limits": { "cpu_ms": 30000 },
+  "observability": {
+    "enabled": true,
+    "head_sampling_rate": 0.1
+  }
+}
diff --git a/backend/community-contracts/package.json b/backend/community-contracts/package.json
new file mode 100644
index 0000000..9331221
--- /dev/null
+++ b/backend/community-contracts/package.json
@@ -0,0 +1,9 @@
+{
+  "name": "@ss2revive/community-contracts",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  }
+}
diff --git a/backend/community-contracts/src/index.ts b/backend/community-contracts/src/index.ts
new file mode 100644
index 0000000..5c1045c
--- /dev/null
+++ b/backend/community-contracts/src/index.ts
@@ -0,0 +1,4 @@
+export * from "./level-bundle";
+export * from "./level-code";
+export * from "./types";
+export * from "./validation";
diff --git a/backend/community-contracts/src/level-bundle.ts b/backend/community-contracts/src/level-bundle.ts
new file mode 100644
index 0000000..139475f
--- /dev/null
+++ b/backend/community-contracts/src/level-bundle.ts
@@ -0,0 +1,731 @@
+import { levelCodeFromId } from "./level-code";
+import {
+  MAP_FORMAT_VERSION,
+  MAX_BUNDLE_BYTES,
+  MAX_CONTENT_BYTES,
+  MAX_CREATORS,
+  MAX_DESCRIPTION_CHARACTERS,
+  MAX_IMAGE_BYTES,
+  MAX_MANIFEST_BYTES,
+  MAX_METADATA_ITEM_CHARACTERS,
+  MAX_STRUCTURED_METADATA_BYTES,
+  MAX_TAGS,
+  MAX_TITLE_CHARACTERS,
+} from "./types";
+import { hasOnlyKeys, isCanonicalUuid, isPlainObject, isSha256 } from "./validation";
+
+const BUNDLE_MAGIC = new TextEncoder().encode("SS2REVIVE LEVEL\n");
+const LEVEL_MAGIC = new TextEncoder().encode("Surgeons");
+const KNOWN_ENTRIES = new Set(["asset.json", "level.bin", "level.png", "thumb.png"]);
+const MAX_ENTRIES = 16;
+const MAX_NAME_BYTES = 64;
+const MAX_JSON_DEPTH = 32;
+const MAX_INT32 = 2_147_483_647;
+const CLOCK_SKEW_TOLERANCE_MS = 5 * 60 * 1000;
+
+export type BundleValidationCode =
+  | "bundle_empty"
+  | "bundle_oversized"
+  | "bundle_magic_invalid"
+  | "bundle_version_invalid"
+  | "bundle_malformed"
+  | "bundle_too_many_entries"
+  | "bundle_unknown_entry"
+  | "bundle_duplicate_entry"
+  | "bundle_entry_oversized"
+  | "bundle_trailing_data"
+  | "manifest_missing"
+  | "manifest_invalid"
+  | "manifest_duplicate_key"
+  | "manifest_metadata_invalid"
+  | "manifest_metadata_oversized"
+  | "content_missing"
+  | "content_magic_invalid"
+  | "content_format_invalid"
+  | "content_structure_invalid"
+  | "content_checksum_invalid"
+  | "image_invalid";
+
+export class BundleValidationError extends Error {
+  readonly code: BundleValidationCode;
+
+  constructor(code: BundleValidationCode, message: string) {
+    super(message);
+    this.name = "BundleValidationError";
+    this.code = code;
+  }
+}
+
+export interface BundleManifest {
+  bundleVersion: 2;
+  id: string;
+  title: string;
+  description: string;
+  createdAt: number;
+  exportedAt: number;
+  clientVersion: 29;
+  contentVersion: number;
+  reviveVersion: string;
+  contentSha256: string;
+  creators: string[];
+  tags: string[];
+  configurations: unknown[];
+  validations: unknown[];
+}
+
+export interface GameImageInfo {
+  width: number;
+  height: number;
+  format: 1 | 2 | 3 | 4 | 5 | 7;
+  dataLength: number;
+  dataOffset: number;
+}
+
+export interface InspectedLevelBundle {
+  containerVersion: 2;
+  manifest: BundleManifest;
+  code: string;
+  content: Uint8Array;
+  contentImage?: Uint8Array;
+  thumbnail?: Uint8Array;
+  thumbnailInfo?: GameImageInfo;
+  bundleSha256: string;
+}
+
+export interface InspectBundleOptions {
+  nowMs?: number;
+}
+
+interface ParsedEntries {
+  manifest?: Uint8Array;
+  content?: Uint8Array;
+  contentImage?: Uint8Array;
+  thumbnail?: Uint8Array;
+}
+
+function fail(code: BundleValidationCode, message: string): never {
+  throw new BundleValidationError(code, message);
+}
+
+function equalPrefix(bytes: Uint8Array, expected: Uint8Array): boolean {
+  if (bytes.length < expected.length) return false;
+  for (let index = 0; index < expected.length; index += 1) {
+    if (bytes[index] !== expected[index]) return false;
+  }
+  return true;
+}
+
+function entryLimit(name: string): number {
+  if (name === "asset.json") return MAX_MANIFEST_BYTES;
+  if (name === "level.bin") return MAX_CONTENT_BYTES;
+  return MAX_IMAGE_BYTES;
+}
+
+function parseEntries(bytes: Uint8Array): { containerVersion: 2; entries: ParsedEntries } {
+  if (bytes.length < BUNDLE_MAGIC.length + 2) fail("bundle_empty", "The bundle is empty or truncated.");
+  if (bytes.length > MAX_BUNDLE_BYTES) fail("bundle_oversized", "The bundle exceeds 24 MiB.");
+  if (!equalPrefix(bytes, BUNDLE_MAGIC)) fail("bundle_magic_invalid", "The bundle magic is invalid.");
+
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  let offset = BUNDLE_MAGIC.length;
+  const containerVersion = view.getUint16(offset, true);
+  offset += 2;
+  if (containerVersion !== 2) {
+    fail("bundle_version_invalid", "Only clean-slate container version 2 is supported.");
+  }
+
+  const entries: ParsedEntries = {};
+  const known = new Set<string>();
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+
+  for (let entryCount = 0; ; entryCount += 1) {
+    if (entryCount >= MAX_ENTRIES) fail("bundle_too_many_entries", "The bundle has too many entries.");
+    if (offset + 2 > bytes.length) fail("bundle_malformed", "The bundle ends inside an entry header.");
+    const nameLength = view.getUint16(offset, true);
+    offset += 2;
+    if (nameLength === 0) break;
+    if (nameLength > MAX_NAME_BYTES || offset + nameLength + 4 > bytes.length) {
+      fail("bundle_malformed", "The bundle entry header is malformed.");
+    }
+
+    let name: string;
+    try {
+      name = decoder.decode(bytes.subarray(offset, offset + nameLength));
+    } catch {
+      fail("bundle_malformed", "The bundle entry name is not valid UTF-8.");
+    }
+    offset += nameLength;
+    const length = view.getInt32(offset, true);
+    offset += 4;
+    if (length < 0 || length > bytes.length - offset) {
+      fail("bundle_malformed", "The bundle entry length is invalid.");
+    }
+    // An unrecognised entry used to be skipped, so a publisher could staple megabytes of arbitrary
+    // bytes to a bundle that is then promoted verbatim and served from a public immutable path.
+    // Only the four entries this format defines may appear, and only once each. The name is
+    // attacker-controlled, so it is never interpolated into an error the uploader can read back.
+    if (!KNOWN_ENTRIES.has(name)) {
+      fail("bundle_unknown_entry", "The bundle contains an entry this level format does not define.");
+    }
+    if (known.has(name)) fail("bundle_duplicate_entry", "A bundle entry appears more than once.");
+    known.add(name);
+    if (length > entryLimit(name)) {
+      fail("bundle_entry_oversized", "A bundle entry exceeds its limit.");
+    }
+
+    if (name === "asset.json") entries.manifest = bytes.slice(offset, offset + length);
+    else if (name === "level.bin") entries.content = bytes.slice(offset, offset + length);
+    else if (name === "level.png") entries.contentImage = bytes.slice(offset, offset + length);
+    else if (name === "thumb.png") entries.thumbnail = bytes.slice(offset, offset + length);
+    offset += length;
+  }
+
+  if (offset !== bytes.length) fail("bundle_trailing_data", "The bundle has trailing data.");
+  return { containerVersion, entries };
+}
+
+class JsonShapeScanner {
+  readonly #text: string;
+  #offset = 0;
+  duplicateKey = false;
+
+  constructor(text: string) {
+    this.#text = text;
+  }
+
+  scan(): boolean {
+    try {
+      this.#skipWhitespace();
+      this.#value(0);
+      this.#skipWhitespace();
+      return this.#offset === this.#text.length;
+    } catch {
+      return false;
+    }
+  }
+
+  #value(depth: number): void {
+    if (depth > MAX_JSON_DEPTH) throw new Error("depth");
+    const character = this.#text[this.#offset];
+    if (character === "{") this.#object(depth + 1);
+    else if (character === "[") this.#array(depth + 1);
+    else if (character === '"') this.#string();
+    else if (character === "t") this.#literal("true");
+    else if (character === "f") this.#literal("false");
+    else if (character === "n") this.#literal("null");
+    else this.#number();
+  }
+
+  #object(depth: number): void {
+    this.#offset += 1;
+    this.#skipWhitespace();
+    const keys = new Set<string>();
+    if (this.#text[this.#offset] === "}") {
+      this.#offset += 1;
+      return;
+    }
+    for (;;) {
+      if (this.#text[this.#offset] !== '"') throw new Error("object key");
+      const keyLiteral = this.#string();
+      const key = JSON.parse(keyLiteral) as string;
+      if (keys.has(key)) this.duplicateKey = true;
+      keys.add(key);
+      this.#skipWhitespace();
+      if (this.#text[this.#offset] !== ":") throw new Error("colon");
+      this.#offset += 1;
+      this.#skipWhitespace();
+      this.#value(depth);
+      this.#skipWhitespace();
+      const character = this.#text[this.#offset];
+      if (character === "}") {
+        this.#offset += 1;
+        return;
+      }
+      if (character !== ",") throw new Error("object delimiter");
+      this.#offset += 1;
+      this.#skipWhitespace();
+    }
+  }
+
+  #array(depth: number): void {
+    this.#offset += 1;
+    this.#skipWhitespace();
+    if (this.#text[this.#offset] === "]") {
+      this.#offset += 1;
+      return;
+    }
+    for (;;) {
+      this.#value(depth);
+      this.#skipWhitespace();
+      const character = this.#text[this.#offset];
+      if (character === "]") {
+        this.#offset += 1;
+        return;
+      }
+      if (character !== ",") throw new Error("array delimiter");
+      this.#offset += 1;
+      this.#skipWhitespace();
+    }
+  }
+
+  #string(): string {
+    const start = this.#offset;
+    this.#offset += 1;
+    for (;;) {
+      const character = this.#text[this.#offset];
+      if (character === undefined || character.charCodeAt(0) < 32) throw new Error("string");
+      if (character === '"') {
+        this.#offset += 1;
+        return this.#text.slice(start, this.#offset);
+      }
+      if (character === "\\") {
+        this.#offset += 1;
+        const escape = this.#text[this.#offset];
+        if (escape === "u") {
+          const digits = this.#text.slice(this.#offset + 1, this.#offset + 5);
+          if (!/^[0-9a-fA-F]{4}$/.test(digits)) throw new Error("unicode escape");
+          this.#offset += 5;
+          continue;
+        }
+        if (escape === undefined || !'"\\/bfnrt'.includes(escape)) throw new Error("escape");
+      }
+      this.#offset += 1;
+    }
+  }
+
+  #number(): void {
+    const remaining = this.#text.slice(this.#offset);
+    const match = /^-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/.exec(remaining);
+    if (match === null) throw new Error("number");
+    this.#offset += match[0].length;
+  }
+
+  #literal(value: string): void {
+    if (!this.#text.startsWith(value, this.#offset)) throw new Error("literal");
+    this.#offset += value.length;
+  }
+
+  #skipWhitespace(): void {
+    while (/\s/.test(this.#text[this.#offset] ?? "") && this.#offset < this.#text.length) {
+      const character = this.#text[this.#offset];
+      if (character !== " " && character !== "\t" && character !== "\r" && character !== "\n") {
+        throw new Error("whitespace");
+      }
+      this.#offset += 1;
+    }
+  }
+}
+
+function requireInteger(value: unknown, name: string, minimum = 0, maximum = Number.MAX_SAFE_INTEGER): number {
+  if (!Number.isSafeInteger(value) || (value as number) < minimum || (value as number) > maximum) {
+    fail("manifest_metadata_invalid", `${name} is not a bounded integer.`);
+  }
+  return value as number;
+}
+
+function requireString(value: unknown, name: string, maximum: number, allowEmpty: boolean): string {
+  if (typeof value !== "string" || value.length > maximum || (!allowEmpty && value.trim().length === 0)) {
+    fail("manifest_metadata_invalid", `${name} is invalid.`);
+  }
+  for (const character of value) {
+    const code = character.codePointAt(0) ?? 0;
+    if ((code >= 0 && code < 32) || (code >= 127 && code <= 159)) {
+      fail("manifest_metadata_invalid", `${name} contains control characters.`);
+    }
+  }
+  return value;
+}
+
+function requireBoolean(value: unknown, name: string): boolean {
+  if (typeof value !== "boolean") {
+    fail("manifest_metadata_invalid", `${name} must be a boolean.`);
+  }
+  return value;
+}
+
+function requireStringArray(value: unknown, name: string, maximumItems: number, allowEmpty = false): string[] {
+  if (!Array.isArray(value) || value.length > maximumItems) {
+    fail("manifest_metadata_invalid", `${name} has too many entries or is not an array.`);
+  }
+  const result: string[] = [];
+  const seen = new Set<string>();
+  for (const item of value) {
+    const text = requireString(item, name, MAX_METADATA_ITEM_CHARACTERS, allowEmpty);
+    if (seen.has(text)) fail("manifest_metadata_invalid", `${name} contains a duplicate entry.`);
+    seen.add(text);
+    result.push(text);
+  }
+  return result;
+}
+
+/**
+ * The catalogue echoes tags, configurations and validations back verbatim, so their serialized
+ * size — not just their element counts — decides what one map costs every reader. Charge the
+ * publisher for the exact bytes the listing will carry.
+ */
+function requireMetadataBudget(tags: string[], configurations: unknown[], validations: unknown[]): void {
+  const serialized = JSON.stringify({ tags, configurations, validations });
+  if (new TextEncoder().encode(serialized).length > MAX_STRUCTURED_METADATA_BYTES) {
+    fail(
+      "manifest_metadata_oversized",
+      "The level tags, configurations and validations exceed the published metadata budget.",
+    );
+  }
+}
+
+function validateStructuredMetadata(configurations: unknown, validations: unknown): {
+  configurations: unknown[];
+  validations: unknown[];
+} {
+  if (!Array.isArray(configurations) || configurations.length > 8) {
+    fail("manifest_metadata_invalid", "configurations must be an array with at most 8 entries.");
+  }
+  for (const configuration of configurations) {
+    if (!isPlainObject(configuration)) fail("manifest_metadata_invalid", "A configuration is not an object.");
+    if (!hasOnlyKeys(configuration, [
+      "id", "numberPlayers", "numberTeams", "teamMode", "levelTeamConfigurations",
+    ])) {
+      fail("manifest_metadata_invalid", "A configuration contains an unsupported field.");
+    }
+    if (!isCanonicalUuid(configuration.id)) {
+      fail("manifest_metadata_invalid", "A configuration id is not a canonical GUID.");
+    }
+    requireInteger(configuration.numberPlayers, "numberPlayers", 1, 4);
+    requireInteger(configuration.numberTeams, "numberTeams", 0, 4);
+    const teamMode = requireString(configuration.teamMode, "teamMode", 16, false);
+    if (!["COOP", "FREE_FOR_ALL", "TEAM_BASED", "FREE_PLAY"].includes(teamMode)) {
+      fail("manifest_metadata_invalid", "teamMode is not supported.");
+    }
+    const teams = configuration.levelTeamConfigurations;
+    if (!Array.isArray(teams) || teams.length > 4) {
+      fail("manifest_metadata_invalid", "levelTeamConfigurations is invalid.");
+    }
+    for (const team of teams) {
+      if (!isPlainObject(team)) fail("manifest_metadata_invalid", "A team configuration is not an object.");
+      if (!hasOnlyKeys(team, ["objectives", "playersInTeam"])) {
+        fail("manifest_metadata_invalid", "A team configuration contains an unsupported field.");
+      }
+      if (team.objectives !== undefined) requireStringArray(team.objectives, "objectives", 32, true);
+      if (team.playersInTeam !== undefined) {
+        if (!Array.isArray(team.playersInTeam) || team.playersInTeam.length > 4) {
+          fail("manifest_metadata_invalid", "playersInTeam is invalid.");
+        }
+        for (const player of team.playersInTeam) requireInteger(player, "player index", 0, 3);
+      }
+    }
+  }
+
+  if (!Array.isArray(validations) || validations.length > 32) {
+    fail("manifest_metadata_invalid", "validations must be an array with at most 32 entries.");
+  }
+  for (const validation of validations) {
+    if (!isPlainObject(validation)) fail("manifest_metadata_invalid", "A validation is not an object.");
+    if (!hasOnlyKeys(validation, ["id", "description", "validated"])) {
+      fail("manifest_metadata_invalid", "A validation contains an unsupported field.");
+    }
+    if (!isCanonicalUuid(validation.id)) {
+      fail("manifest_metadata_invalid", "A validation id is not a canonical GUID.");
+    }
+    requireString(validation.description, "validation description", 255, true);
+    requireBoolean(validation.validated, "validated");
+  }
+  return { configurations, validations };
+}
+
+function parseManifest(bytes: Uint8Array, containerVersion: 2, nowMs: number): BundleManifest {
+  if (bytes.length === 0 || bytes.length > MAX_MANIFEST_BYTES) {
+    fail("manifest_missing", "The bundle has no readable manifest.");
+  }
+  let text: string;
+  try {
+    text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    fail("manifest_invalid", "The manifest is not valid UTF-8.");
+  }
+  const scanner = new JsonShapeScanner(text);
+  if (!scanner.scan()) fail("manifest_invalid", "The manifest is invalid or nested too deeply.");
+  if (scanner.duplicateKey) fail("manifest_duplicate_key", "The manifest contains a duplicate object key.");
+
+  let raw: unknown;
+  try {
+    raw = JSON.parse(text) as unknown;
+  } catch {
+    fail("manifest_invalid", "The manifest is not valid JSON.");
+  }
+  if (!isPlainObject(raw)) fail("manifest_invalid", "The manifest root must be an object.");
+  if (!hasOnlyKeys(raw, [
+    "bundleVersion", "id", "title", "description", "createdAt", "exportedAt",
+    "clientVersion", "contentVersion", "reviveVersion", "contentSha256",
+    "creators", "tags", "configurations", "validations",
+  ])) {
+    fail("manifest_metadata_invalid", "The manifest contains an unsupported field.");
+  }
+
+  const bundleVersion = requireInteger(raw.bundleVersion, "bundleVersion", 2, 2);
+  if (bundleVersion !== containerVersion) fail("manifest_metadata_invalid", "Bundle versions disagree.");
+  if (!isCanonicalUuid(raw.id)) fail("manifest_metadata_invalid", "The map id is not a canonical GUID.");
+  const title = requireString(raw.title, "title", MAX_TITLE_CHARACTERS, false);
+  const description = requireString(raw.description, "description", MAX_DESCRIPTION_CHARACTERS, true);
+  const createdAt = requireInteger(raw.createdAt, "createdAt");
+  const exportedAt = requireInteger(raw.exportedAt, "exportedAt");
+  // A future exportedAt becomes updated_at_ms, which is the default catalogue sort key. The old
+  // 24-hour allowance let a publisher pin a map above every legitimate entry for a day and hold
+  // the top slot by re-uploading. Permit only enough slack to absorb client clock skew; the
+  // publisher additionally clamps the stored value to server time.
+  if (
+    exportedAt < createdAt || createdAt > nowMs + CLOCK_SKEW_TOLERANCE_MS ||
+    exportedAt > nowMs + CLOCK_SKEW_TOLERANCE_MS
+  ) {
+    fail("manifest_metadata_invalid", "The manifest timestamps are inconsistent.");
+  }
+  const clientVersion = requireInteger(raw.clientVersion, "clientVersion", MAP_FORMAT_VERSION, MAP_FORMAT_VERSION);
+  const contentVersion = requireInteger(raw.contentVersion, "contentVersion", 1, MAX_INT32);
+  const reviveVersion = requireString(raw.reviveVersion, "reviveVersion", 64, true);
+  if (!isSha256(raw.contentSha256)) fail("content_checksum_invalid", "contentSha256 is not canonical lowercase SHA-256.");
+  const creators = requireStringArray(raw.creators, "creators", MAX_CREATORS);
+  const tags = requireStringArray(raw.tags, "tags", MAX_TAGS);
+  const structured = validateStructuredMetadata(raw.configurations, raw.validations);
+  requireMetadataBudget(tags, structured.configurations, structured.validations);
+
+  return {
+    bundleVersion: bundleVersion as 2,
+    id: raw.id,
+    title,
+    description,
+    createdAt,
+    exportedAt,
+    clientVersion: clientVersion as 29,
+    contentVersion,
+    reviveVersion,
+    contentSha256: raw.contentSha256,
+    creators,
+    tags,
+    configurations: structured.configurations,
+    validations: structured.validations,
+  };
+}
+
+function readBits(bytes: Uint8Array, startBit: number, count: number): number | null {
+  if (startBit < 0 || count < 0 || count > 32 || startBit + count > bytes.length * 8) return null;
+  let value = 0;
+  for (let bit = 0; bit < count; bit += 1) {
+    const absolute = startBit + bit;
+    const set = ((bytes[Math.floor(absolute / 8)] ?? 0) >> (absolute % 8)) & 1;
+    value += set * 2 ** bit;
+  }
+  return value;
+}
+
+const MAX_LEVEL_BODY_BYTES = 4_096_000;
+const MAX_COMPRESSED_LEVEL_BYTES = 8 * 1024 * 1024;
+const MAX_VOXEL_AXIS = 256;
+const MAX_VOXEL_VOLUME = 1024 * 1024;
+const MAX_PROP_DEFINITIONS = 4096;
+const MAX_PROP_INSTANCES = 20_000;
+
+class LevelBitReader {
+  private bit = 0;
+
+  constructor(private readonly bytes: Uint8Array, startBit = 0) {
+    this.bit = startBit;
+  }
+
+  align(): void {
+    this.bit = Math.ceil(this.bit / 8) * 8;
+    if (this.bit > this.bytes.length * 8) this.invalid();
+  }
+
+  bits(count: number): number {
+    const value = readBits(this.bytes, this.bit, count);
+    if (value === null) this.invalid();
+    this.bit += count;
+    return value;
+  }
+
+  signedInt(): number {
+    return this.bits(32) - 0x80000000;
+  }
+
+  string(): string {
+    this.align();
+    const length = this.bits(8);
+    let value = "";
+    for (let index = 0; index < length; index += 1) value += String.fromCharCode(this.bits(16));
+    return value;
+  }
+
+  skip(count: number): void {
+    if (!Number.isSafeInteger(count) || count < 0 || this.bit + count > this.bytes.length * 8) this.invalid();
+    this.bit += count;
+  }
+
+  byteSlice(count: number): Uint8Array {
+    this.align();
+    if (!Number.isSafeInteger(count) || count < 0) this.invalid();
+    const start = this.bit / 8;
+    if (start + count > this.bytes.length) this.invalid();
+    this.bit += count * 8;
+    return this.bytes.subarray(start, start + count);
+  }
+
+  private invalid(): never {
+    fail("content_structure_invalid", "level.bin is truncated or has an invalid bit stream.");
+  }
+}
+
+async function inflateLevelBody(compressed: Uint8Array): Promise<Uint8Array> {
+  if (compressed.length < 1 || compressed.length > MAX_COMPRESSED_LEVEL_BYTES) {
+    fail("content_structure_invalid", "The compressed level body size is unsafe.");
+  }
+  let stream: ReadableStream<Uint8Array>;
+  try {
+    const source = new Uint8Array(compressed.length);
+    source.set(compressed);
+    stream = new Blob([source]).stream().pipeThrough(new DecompressionStream("deflate-raw"));
+  } catch {
+    fail("content_structure_invalid", "The compressed level body is invalid.");
+  }
+  const reader = stream.getReader();
+  const chunks: Uint8Array[] = [];
+  let length = 0;
+  try {
+    while (true) {
+      const result = await reader.read();
+      if (result.done) break;
+      length += result.value.length;
+      if (length > MAX_LEVEL_BODY_BYTES) {
+        await reader.cancel();
+        fail("content_structure_invalid", "The level body expands beyond the game writer's limit.");
+      }
+      chunks.push(result.value);
+    }
+  } catch (error) {
+    if (error instanceof BundleValidationError) throw error;
+    fail("content_structure_invalid", "The compressed level body cannot be decompressed.");
+  }
+  const body = new Uint8Array(length);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return body;
+}
+
+async function inspectLevelContentStructure(content: Uint8Array): Promise<void> {
+  if (content.length < 12 || content.length > MAX_LEVEL_BODY_BYTES) {
+    fail("content_structure_invalid", "The level file size is outside the game writer's bounds.");
+  }
+  const envelope = new LevelBitReader(content, 80);
+  const clientLevelId = envelope.string();
+  if (clientLevelId.length < 1 || clientLevelId.length > 64 || /[\u0000-\u001f]/u.test(clientLevelId)) {
+    fail("content_structure_invalid", "The client level identifier is invalid.");
+  }
+  const compressed = envelope.bits(1) === 1;
+  let body: Uint8Array;
+  if (compressed) {
+    const compressedLength = envelope.signedInt();
+    body = await inflateLevelBody(envelope.byteSlice(compressedLength));
+  } else {
+    envelope.align();
+    body = content.subarray(Math.ceil((80 + 8 + clientLevelId.length * 16 + 1) / 8));
+  }
+  if (body.length < 14 || body.length > MAX_LEVEL_BODY_BYTES) {
+    fail("content_structure_invalid", "The decoded level body size is invalid.");
+  }
+
+  const reader = new LevelBitReader(body);
+  reader.string();
+  const x = reader.signedInt();
+  const y = reader.signedInt();
+  const z = reader.signedInt();
+  if (
+    x < 1 || y < 1 || z < 1 || x > MAX_VOXEL_AXIS || y > MAX_VOXEL_AXIS || z > MAX_VOXEL_AXIS ||
+    x > Math.floor(MAX_VOXEL_VOLUME / y / z)
+  ) {
+    fail("content_structure_invalid", "The level voxel dimensions are unsafe.");
+  }
+  const volume = x * y * z;
+  reader.skip(volume);
+  reader.skip(volume * 32);
+  const definitions = reader.signedInt();
+  if (definitions < 0 || definitions > MAX_PROP_DEFINITIONS) {
+    fail("content_structure_invalid", "The prop-definition count is unsafe.");
+  }
+  reader.skip(definitions * 128);
+  const propInstances = reader.signedInt();
+  if (propInstances < 0 || propInstances > MAX_PROP_INSTANCES) {
+    fail("content_structure_invalid", "The prop-instance count is unsafe.");
+  }
+}
+
+export function inspectGameImage(bytes: Uint8Array): GameImageInfo {
+  if (bytes.length < 13 || bytes.length > MAX_IMAGE_BYTES) fail("image_invalid", "The game image size is invalid.");
+  const width = readBits(bytes, 0, 31);
+  const height = readBits(bytes, 31, 31);
+  const format = readBits(bytes, 62, 4);
+  const dataLength = readBits(bytes, 66, 31);
+  if (width === null || height === null || format === null || dataLength === null) {
+    fail("image_invalid", "The game image header is truncated.");
+  }
+  const bytesPerPixel = new Map<number, number>([[1, 1], [2, 2], [3, 3], [4, 4], [5, 4], [7, 2]]).get(format);
+  // Every supported format id is an uncompressed linear layout and the header carries no mip
+  // count, so the payload length is fully determined by the dimensions. Accepting a payload merely
+  // *at least* that large let a 1x1 image smuggle 8 MiB of arbitrary bytes into a published bundle.
+  if (
+    width < 1 || height < 1 || width > 2048 || height > 2048 || width * height > 4 * 1024 * 1024 ||
+    dataLength < 1 || dataLength > MAX_IMAGE_BYTES || bytesPerPixel === undefined ||
+    width * height * bytesPerPixel !== dataLength || 13 + dataLength !== bytes.length
+  ) {
+    fail("image_invalid", "The game image dimensions, format, or payload length is unsafe.");
+  }
+  return { width, height, format: format as GameImageInfo["format"], dataLength, dataOffset: 13 };
+}
+
+export async function sha256Hex(bytes: Uint8Array): Promise<string> {
+  const source = new Uint8Array(bytes.byteLength);
+  source.set(bytes);
+  const digest = await crypto.subtle.digest("SHA-256", source);
+  return [...new Uint8Array(digest)].map((value) => value.toString(16).padStart(2, "0")).join("");
+}
+
+export async function inspectLevelBundle(
+  input: ArrayBuffer | Uint8Array,
+  options: InspectBundleOptions = {},
+): Promise<InspectedLevelBundle> {
+  const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
+  const { containerVersion, entries } = parseEntries(bytes);
+  if (entries.manifest === undefined) fail("manifest_missing", "The bundle has no asset.json entry.");
+  if (entries.content === undefined || entries.content.length === 0) fail("content_missing", "The bundle has no level.bin entry.");
+  if (entries.content.length < 10 || !equalPrefix(entries.content, LEVEL_MAGIC)) {
+    fail("content_magic_invalid", "level.bin is not a Surgeon Simulator 2 level.");
+  }
+  const levelVersion = entries.content[8]! | (entries.content[9]! << 8);
+  if (levelVersion !== MAP_FORMAT_VERSION) fail("content_format_invalid", "Only map format 29 is accepted.");
+
+  const manifest = parseManifest(entries.manifest, containerVersion, options.nowMs ?? Date.now());
+  if (manifest.clientVersion !== levelVersion) {
+    fail("content_format_invalid", "The declared and embedded map versions disagree.");
+  }
+  const contentSha256 = await sha256Hex(entries.content);
+  if (contentSha256 !== manifest.contentSha256) {
+    fail("content_checksum_invalid", "level.bin does not match contentSha256.");
+  }
+  await inspectLevelContentStructure(entries.content);
+
+  let thumbnailInfo: GameImageInfo | undefined;
+  if (entries.contentImage !== undefined) inspectGameImage(entries.contentImage);
+  if (entries.thumbnail !== undefined) thumbnailInfo = inspectGameImage(entries.thumbnail);
+
+  const result: InspectedLevelBundle = {
+    containerVersion,
+    manifest,
+    code: levelCodeFromId(manifest.id),
+    content: entries.content,
+    bundleSha256: await sha256Hex(bytes),
+  };
+  if (entries.contentImage !== undefined) result.contentImage = entries.contentImage;
+  if (entries.thumbnail !== undefined) result.thumbnail = entries.thumbnail;
+  if (thumbnailInfo !== undefined) result.thumbnailInfo = thumbnailInfo;
+  return result;
+}
diff --git a/backend/community-contracts/src/level-code.ts b/backend/community-contracts/src/level-code.ts
new file mode 100644
index 0000000..6e35774
--- /dev/null
+++ b/backend/community-contracts/src/level-code.ts
@@ -0,0 +1,34 @@
+import { isCanonicalUuid } from "./validation";
+
+const BASE64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+function guidBytes(levelId: string): Uint8Array | null {
+  if (!isCanonicalUuid(levelId)) return null;
+  const hex = levelId.replaceAll("-", "");
+  const raw = new Uint8Array(16);
+  for (let index = 0; index < raw.length; index += 1) {
+    raw[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);
+  }
+  return new Uint8Array([
+    raw[3]!, raw[2]!, raw[1]!, raw[0]!,
+    raw[5]!, raw[4]!, raw[7]!, raw[6]!,
+    raw[8]!, raw[9]!, raw[10]!, raw[11]!, raw[12]!, raw[13]!, raw[14]!, raw[15]!,
+  ]);
+}
+
+export function levelCodeFromId(levelId: string): string {
+  const bytes = guidBytes(levelId);
+  if (bytes === null) return "";
+  let output = "";
+  for (let index = 0; index < bytes.length; index += 3) {
+    const a = bytes[index] ?? 0;
+    const b = bytes[index + 1] ?? 0;
+    const c = bytes[index + 2] ?? 0;
+    const remaining = bytes.length - index;
+    output += BASE64[(a >> 2) & 63];
+    output += BASE64[((a & 3) << 4) | (b >> 4)];
+    output += remaining > 1 ? BASE64[((b & 15) << 2) | (c >> 6)] : "=";
+    output += remaining > 2 ? BASE64[c & 63] : "=";
+  }
+  return output.slice(0, 22).replaceAll("/", "_").replaceAll("+", "-");
+}
diff --git a/backend/community-contracts/src/types.ts b/backend/community-contracts/src/types.ts
new file mode 100644
index 0000000..7c60f17
--- /dev/null
+++ b/backend/community-contracts/src/types.ts
@@ -0,0 +1,132 @@
+export const API_VERSION = 1 as const;
+export const MAP_FORMAT_VERSION = 29 as const;
+export const MAX_BUNDLE_BYTES = 24 * 1024 * 1024;
+export const MAX_CONTENT_BYTES = 4_096_000;
+export const MAX_IMAGE_BYTES = 8 * 1024 * 1024;
+export const MAX_MANIFEST_BYTES = 1024 * 1024;
+export const MAX_TITLE_CHARACTERS = 128;
+export const MAX_DESCRIPTION_CHARACTERS = 2048;
+export const MAX_CREATORS = 4;
+export const MAX_TAGS = 32;
+export const MAX_METADATA_ITEM_CHARACTERS = 128;
+export const MAX_PAGE_SIZE = 50;
+
+/**
+ * Serialized UTF-8 ceiling for the free-form manifest metadata that the catalogue echoes back
+ * verbatim (tags, configurations, validations). The per-field count limits alone allow roughly
+ * 131,000 characters of objectives per manifest, which a publisher could use to push a handful of
+ * maps past the catalogue response budget and take the public listing offline for everyone. The
+ * per-map ceiling keeps that cost predictable; the listing endpoints additionally degrade rather
+ * than fail when the total budget is reached.
+ */
+export const MAX_STRUCTURED_METADATA_BYTES = 12 * 1024;
+
+/** Response budget for the paged map listing. */
+export const MAX_MAP_PAGE_BYTES = 1024 * 1024;
+
+/** Response budget for the compatibility catalogue document. */
+export const MAX_CATALOG_BYTES = 2 * 1024 * 1024;
+
+export interface ApiErrorBody {
+  error: {
+    code: string;
+    message: string;
+    requestId: string;
+  };
+}
+
+export interface MockSessionResponse {
+  accessToken: string;
+  expiresAtUtc: string;
+  tokenType: "Bearer";
+}
+
+export interface DeviceSessionResponse {
+  deviceSessionId: string;
+  deviceSecret: string;
+  userCode: string;
+  activationPath: string;
+  expiresAt: string;
+  pollIntervalSeconds: number;
+}
+
+export interface SessionTokenResponse {
+  tokenType: "Bearer";
+  accessToken: string;
+  expiresInSeconds: number;
+  refreshToken: string;
+  refreshExpiresInSeconds: number;
+  scope: string;
+}
+
+export type UploadStatus =
+  | "reserved"
+  | "uploaded"
+  | "validating"
+  | "published"
+  | "rejected"
+  | "cancelled"
+  | "expired";
+
+export interface UploadReservationResponse {
+  requestId: string;
+  uploadId: string;
+  status: UploadStatus;
+  bundleUploadPath: string;
+  statusPath: string;
+  expiresAt: string;
+}
+
+export interface UploadStatusResponse {
+  requestId: string;
+  uploadId: string;
+  status: UploadStatus;
+  mapId?: string;
+  revision?: number;
+  errorCode?: string;
+  errorMessage?: string;
+}
+
+export interface MapThumbnail {
+  url: string;
+  sizeBytes: number;
+  sha256: string;
+}
+
+export interface CommunityMap {
+  id: string;
+  code: string;
+  revision: number;
+  title: string;
+  description: string;
+  creatorIds: string[];
+  tags: string[];
+  createdAtMs: number;
+  updatedAtMs: number;
+  clientVersion: 29;
+  mapFormatVersion: 29;
+  minimumReviveVersion: string;
+  reviveVersion?: string;
+  sizeBytes: number;
+  sha256: string;
+  configurations: unknown[];
+  validations: unknown[];
+  downloadUrl: string;
+  thumbnail?: MapThumbnail;
+}
+
+export interface MapPage {
+  items: CommunityMap[];
+  nextCursor: string | null;
+}
+
+export interface MapVersionsResponse {
+  mapId: string;
+  versions: CommunityMap[];
+}
+
+export interface AuthPrincipal {
+  steamId64: string;
+  sessionId: string;
+  scopes: readonly string[];
+}
diff --git a/backend/community-contracts/src/validation.ts b/backend/community-contracts/src/validation.ts
new file mode 100644
index 0000000..34e3154
--- /dev/null
+++ b/backend/community-contracts/src/validation.ts
@@ -0,0 +1,82 @@
+import {
+  MAX_DESCRIPTION_CHARACTERS,
+  MAX_METADATA_ITEM_CHARACTERS,
+  MAX_TITLE_CHARACTERS,
+} from "./types";
+
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const SHA256_PATTERN = /^[0-9a-f]{64}$/;
+const SEMVER_PATTERN = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+const MAX_UINT64 = 18_446_744_073_709_551_615n;
+
+export function isCanonicalUuid(value: unknown): value is string {
+  return typeof value === "string" && UUID_PATTERN.test(value);
+}
+
+export function isSha256(value: unknown): value is string {
+  return typeof value === "string" && SHA256_PATTERN.test(value);
+}
+
+export function isSemanticVersion(value: unknown): value is string {
+  return typeof value === "string" && value.length <= 29 && SEMVER_PATTERN.test(value);
+}
+
+export function isSteamId64(value: unknown): value is string {
+  if (typeof value !== "string" || !/^[1-9][0-9]{16,19}$/.test(value)) return false;
+  try {
+    return BigInt(value) <= MAX_UINT64;
+  } catch {
+    return false;
+  }
+}
+
+export function isPlainObject(value: unknown): value is Record<string, unknown> {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value) as object | null;
+  return prototype === Object.prototype || prototype === null;
+}
+
+export function hasOnlyKeys(value: Record<string, unknown>, keys: readonly string[]): boolean {
+  const allowed = new Set(keys);
+  return Object.keys(value).every((key) => allowed.has(key));
+}
+
+export function cleanText(value: unknown, maximum: number): string {
+  if (typeof value !== "string") return "";
+  let result = "";
+  for (const character of value) {
+    if (result.length >= maximum) break;
+    const code = character.codePointAt(0) ?? 0;
+    if (character === "\r" || character === "\n" || character === "\t") {
+      result += " ";
+    } else if ((code >= 0 && code < 32) || (code >= 127 && code <= 159)) {
+      continue;
+    } else {
+      result += character;
+    }
+  }
+  return result.trim();
+}
+
+export function cleanTitle(value: unknown): string {
+  return cleanText(value, MAX_TITLE_CHARACTERS) || "Untitled level";
+}
+
+export function cleanDescription(value: unknown): string {
+  return cleanText(value, MAX_DESCRIPTION_CHARACTERS);
+}
+
+export function cleanMetadataItem(value: unknown): string {
+  return cleanText(value, MAX_METADATA_ITEM_CHARACTERS);
+}
+
+export function parseBoundedPositiveInteger(
+  value: string | null,
+  fallback: number,
+  maximum: number,
+): number | null {
+  if (value === null || value === "") return fallback;
+  if (!/^[1-9][0-9]*$/.test(value)) return null;
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) && parsed <= maximum ? parsed : null;
+}
diff --git a/backend/community-contracts/tsconfig.json b/backend/community-contracts/tsconfig.json
new file mode 100644
index 0000000..15d4fd6
--- /dev/null
+++ b/backend/community-contracts/tsconfig.json
@@ -0,0 +1,8 @@
+{
+  "extends": "../tsconfig.base.json",
+  "compilerOptions": {
+    "lib": ["ES2022", "WebWorker"],
+    "noEmit": true
+  },
+  "include": ["src/**/*.ts"]
+}
diff --git a/backend/package.json b/backend/package.json
new file mode 100644
index 0000000..d4352cf
--- /dev/null
+++ b/backend/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "ss2revive-backend",
+  "private": true,
+  "packageManager": "pnpm@11.16.0",
+  "scripts": {
+    "build": "pnpm --filter @ss2revive/community-api build",
+    "check": "pnpm --filter @ss2revive/community-api check",
+    "test": "pnpm --filter @ss2revive/community-api test",
+    "test:coverage": "pnpm --filter @ss2revive/community-api test:coverage",
+    "security:secrets": "node scripts/secret-scan.mjs",
+    "security:audit": "pnpm audit --audit-level high",
+    "security:hooks": "git config --local core.hooksPath .githooks",
+    "security": "pnpm run security:secrets && pnpm run security:audit"
+  }
+}
diff --git a/backend/pnpm-lock.yaml b/backend/pnpm-lock.yaml
new file mode 100644
index 0000000..90509a8
--- /dev/null
+++ b/backend/pnpm-lock.yaml
@@ -0,0 +1,2269 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .: {}
+
+  community-api:
+    dependencies:
+      '@ss2revive/community-contracts':
+        specifier: workspace:*
+        version: link:../community-contracts
+    devDependencies:
+      '@cloudflare/vitest-pool-workers':
+        specifier: 0.20.3
+        version: 0.20.3(@cloudflare/workers-types@5.20260804.1)(@vitest/runner@4.1.10)(@vitest/snapshot@4.1.10)(vitest@4.1.10)
+      '@cloudflare/workers-types':
+        specifier: 5.20260804.1
+        version: 5.20260804.1
+      '@types/node':
+        specifier: 26.2.0
+        version: 26.2.0
+      '@vitest/coverage-istanbul':
+        specifier: 4.1.10
+        version: 4.1.10(supports-color@10.2.2)(vitest@4.1.10)
+      typescript:
+        specifier: 7.0.2
+        version: 7.0.2
+      vitest:
+        specifier: 4.1.10
+        version: 4.1.10(@types/node@26.2.0)(@vitest/coverage-istanbul@4.1.10)(@vitest/coverage-v8@4.1.10)(vite@8.2.1(@types/node@26.2.0)(esbuild@0.28.1))
+      wrangler:
+        specifier: 4.120.0
+        version: 4.120.0(@cloudflare/workers-types@5.20260804.1)
+
+  community-contracts: {}
+
+packages:
+
+  '@babel/code-frame@7.29.7':
+    resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/compat-data@7.29.7':
+    resolution: {integrity: sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/core@7.29.7':
+    resolution: {integrity: sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/generator@7.29.8':
+    resolution: {integrity: sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-compilation-targets@7.29.7':
+    resolution: {integrity: sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-globals@7.29.7':
+    resolution: {integrity: sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-imports@7.29.7':
+    resolution: {integrity: sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-transforms@7.29.7':
+    resolution: {integrity: sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/helper-string-parser@7.29.7':
+    resolution: {integrity: sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-identifier@7.29.7':
+    resolution: {integrity: sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-option@7.29.7':
+    resolution: {integrity: sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helpers@7.29.7':
+    resolution: {integrity: sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/parser@7.29.8':
+    resolution: {integrity: sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  '@babel/template@7.29.7':
+    resolution: {integrity: sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/traverse@7.29.8':
+    resolution: {integrity: sha512-I5z7H3bf/41ktsNVLtpN0wAa336HkqIHQ5BuPLEhTkt1jVSyZpeNKIzTgEWmlxjdg81R0IgUCcaE+Ok3NvrfZg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/types@7.29.8':
+    resolution: {integrity: sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==}
+    engines: {node: '>=6.9.0'}
+
+  '@bcoe/v8-coverage@1.0.2':
+    resolution: {integrity: sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA==}
+    engines: {node: '>=18'}
+
+  '@cloudflare/kv-asset-handler@0.5.0':
+    resolution: {integrity: sha512-jxQYkj8dSIzc0cD6cMMNdOc1UVjqSqu8BZdor5s8cGjW2I8BjODt/kWPVdY+u9zj3ms75Q5qaZgnxUad83+eAg==}
+    engines: {node: '>=22.0.0'}
+
+  '@cloudflare/unenv-preset@2.16.1':
+    resolution: {integrity: sha512-ECxObrMfyTl5bhQf/lZCXwo5G6xX9IAUo+nDMKK4SZ8m4Jvvxp52vilxyySSWh2YTZz8+HQ07qGH/2rEom1vDw==}
+    peerDependencies:
+      unenv: 2.0.0-rc.24
+      workerd: '>1.20260305.0 <2.0.0-0'
+    peerDependenciesMeta:
+      workerd:
+        optional: true
+
+  '@cloudflare/vitest-pool-workers@0.20.3':
+    resolution: {integrity: sha512-aCMvM5zQ3MTz8SorSZB6ZxjVK2Gof6UhIc2Z1z9zbX/obucSYwDUkx8A0MUOod4I7clfB0QLarKBjRdIczK3vg==}
+    peerDependencies:
+      '@vitest/runner': ^4.1.0
+      '@vitest/snapshot': ^4.1.0
+      vitest: ^4.1.0
+
+  '@cloudflare/workerd-darwin-64@1.20260801.1':
+    resolution: {integrity: sha512-wuJWbXpKvncJi1P0GKS+iYpN5tHdb7JPJJ/+6ZQe8zzovHHVMkLJPNBsgWpqeUhpM3g9qTwEKd2rglNKejuh5A==}
+    engines: {node: '>=16'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@cloudflare/workerd-darwin-arm64@1.20260801.1':
+    resolution: {integrity: sha512-kwoZiTpnhNrF3+APx84Q/oAqvJ3sU9yefGagwm/ASaH/2W19x0vghkW/r4qCoHCK0WW7EPugZ+aXjgPMRtlq1Q==}
+    engines: {node: '>=16'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@cloudflare/workerd-linux-64@1.20260801.1':
+    resolution: {integrity: sha512-r0vAxCZH+Jih9Unm1yoyiByPNWNgawcKciOHDm5Q37ZVGOkKLsT9AtLe3yLSaul76WrKqtf+JP2n0WW32VBLJg==}
+    engines: {node: '>=16'}
+    cpu: [x64]
+    os: [linux]
+
+  '@cloudflare/workerd-linux-arm64@1.20260801.1':
+    resolution: {integrity: sha512-zWgpdZtSozvIgzQNmQiDSF8yEOQJUkRAWNsDXXzAAoy+fCn8YUoSibj3mpFSbZRvbUldeBEaW6SCdC2VEMkhNQ==}
+    engines: {node: '>=16'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@cloudflare/workerd-windows-64@1.20260801.1':
+    resolution: {integrity: sha512-2oQz+Ksu4ji6e/+ZoYX+tWQEcxAii2p7l+iR8kx48W1llMalaufAsmVxTlk+3/vrM7D3/2c0iK448e0UQTcIMg==}
+    engines: {node: '>=16'}
+    cpu: [x64]
+    os: [win32]
+
+  '@cloudflare/workers-types@5.20260804.1':
+    resolution: {integrity: sha512-B1dwxpN6e5RZXZkE5zpZj+ooNeNZ1mwavLIyHDYe10ojhlGTwDfe8sAl7R1mMXc1cyIsbr+jKVdvmMEyVcdTdg==}
+
+  '@cspotcode/source-map-support@0.8.1':
+    resolution: {integrity: sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw==}
+    engines: {node: '>=12'}
+
+  '@emnapi/runtime@1.11.3':
+    resolution: {integrity: sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA==}
+
+  '@esbuild/aix-ppc64@0.28.1':
+    resolution: {integrity: sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@esbuild/android-arm64@0.28.1':
+    resolution: {integrity: sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm@0.28.1':
+    resolution: {integrity: sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-x64@0.28.1':
+    resolution: {integrity: sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/darwin-arm64@0.28.1':
+    resolution: {integrity: sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.28.1':
+    resolution: {integrity: sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/freebsd-arm64@0.28.1':
+    resolution: {integrity: sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.28.1':
+    resolution: {integrity: sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/linux-arm64@0.28.1':
+    resolution: {integrity: sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.28.1':
+    resolution: {integrity: sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.28.1':
+    resolution: {integrity: sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.28.1':
+    resolution: {integrity: sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.28.1':
+    resolution: {integrity: sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.28.1':
+    resolution: {integrity: sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.28.1':
+    resolution: {integrity: sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.28.1':
+    resolution: {integrity: sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.28.1':
+    resolution: {integrity: sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/netbsd-arm64@0.28.1':
+    resolution: {integrity: sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.28.1':
+    resolution: {integrity: sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/openbsd-arm64@0.28.1':
+    resolution: {integrity: sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.28.1':
+    resolution: {integrity: sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openharmony-arm64@0.28.1':
+    resolution: {integrity: sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@esbuild/sunos-x64@0.28.1':
+    resolution: {integrity: sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/win32-arm64@0.28.1':
+    resolution: {integrity: sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.28.1':
+    resolution: {integrity: sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.28.1':
+    resolution: {integrity: sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
+  '@img/colour@1.1.0':
+    resolution: {integrity: sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==}
+    engines: {node: '>=18'}
+
+  '@img/sharp-darwin-arm64@0.35.2':
+    resolution: {integrity: sha512-eEieHsMksAW4IiO5NzauESRl2D2qz3J/kwUxUrSfV06A93eEaRfMpHXyUb1mAqrR7i8U9A0GRqE9pjn6u1Jjpg==}
+    engines: {node: '>=20.9.0'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@img/sharp-darwin-x64@0.35.2':
+    resolution: {integrity: sha512-BaktuGPCeHJMARpodR8jK4uKiZrPAy9WrfQW0sdI37clracq8Bp01AYS3SZgi5FS/y5twa9t4+LIuuxQjqRrWw==}
+    engines: {node: '>=20.9.0'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@img/sharp-freebsd-wasm32@0.35.2':
+    resolution: {integrity: sha512-YoAxdnd8hPUkvLHd3bWY+YA8nw3xM/RyRopYucNsWHVSan8NLVM3X2volsfoRDcXdUJPg6tXahSd7HXPK7lRnw==}
+    engines: {node: '>=20.9.0'}
+    os: [freebsd]
+
+  '@img/sharp-libvips-darwin-arm64@1.3.1':
+    resolution: {integrity: sha512-4V/M3roRMTYjiwZY9IOVQOE8OyeCxFAkYmyZDrZl51uOKjibm3oeEJ4WAmLxutAfzFbC9jqUiPs2gbnGflH+7g==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@img/sharp-libvips-darwin-x64@1.3.1':
+    resolution: {integrity: sha512-c0/DxItpJv2+dGhgycJBBgotdqruGYDvA79drdh0MD1dFpy7JzJ/PlXwi1H4rFf0eTy8tgbI91aHDnZIceY3jQ==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@img/sharp-libvips-linux-arm64@1.3.1':
+    resolution: {integrity: sha512-JznefmcK9j1JKPz8AkQDh89kjojubyfOasWBPKfzMIhPwsgDy9evpE/naJTXXXmghS1iFwR8u/kTwh/I2/+GCw==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-libvips-linux-arm@1.3.1':
+    resolution: {integrity: sha512-aGGy9aWzXgHBG7HNyQPWorZthlp7+x6fDRoPAQbGO3ThcttuTyKIx3NuSHb6zb4gBNq6/yNn9f1cy9nFKS/Vmg==}
+    cpu: [arm]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-libvips-linux-ppc64@1.3.1':
+    resolution: {integrity: sha512-1EkwGNCZk6iWNCMWqrvdJ+r1j0PT1zIz60CNPhYnJlK/zyeWqlsPZIe+ocBVqPF8k/Ssee/NCk+tE9Ryrko6ng==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-libvips-linux-riscv64@1.3.1':
+    resolution: {integrity: sha512-Ilays+w2bXdnxzxtQdmXR62u8o8GYa3eL4+Gr+1KiE4xperMZUslRaVPJwwPkzlHEjGfXAfRVAa/7CYCtSqsBw==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-libvips-linux-s390x@1.3.1':
+    resolution: {integrity: sha512-VfBwVHQTbRoj4XlpA/KLZ7ltgMpz+4WSejFzQ+GnoImjo1PtEJ59QB2qR1xQEeRPYIkNrPIm2L4cICMvz4C2ew==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-libvips-linux-x64@1.3.1':
+    resolution: {integrity: sha512-+c8ukgwU62DS54nCAjw7keOfHUkmr0B5QHEdcOqRnodF/MNXJbVI8Eopoj4B/0H8Asr65I+A4Amrn7a85/md6A==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-libvips-linuxmusl-arm64@1.3.1':
+    resolution: {integrity: sha512-qlKb/pwbkAi1WMsJrYHk7CuDrd12s27U2QnRhFYUoJNrRCmkosMTttuRFat/DDB3IlDm5qE1TJgZ4JDnHX8Ldw==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@img/sharp-libvips-linuxmusl-x64@1.3.1':
+    resolution: {integrity: sha512-yO21HwoUVLN8Qa+/SBjQLMYwBWAVJjeGPNe+hc0OUeMeifEtJqu5a1c4HayE1nNpDih9y3/KkoltfkDodmKAlg==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@img/sharp-linux-arm64@0.35.2':
+    resolution: {integrity: sha512-af12Pnd0ZGu2HfP8NayB0kk6eC/lrfbQE6HlR4jD+34wdJ1Vw9TF6TMn6ZvffT+WgqVsl0hRbmNvz2u/23VmwA==}
+    engines: {node: '>=20.9.0'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-linux-arm@0.35.2':
+    resolution: {integrity: sha512-SE4kzF2mepn6z+6E7L6lsV8FzuLL6IPQdyX8ZiwROAG/G8td+hP/m7FsFPwidtrF19gvajuC9l6TxAVcsA4S7A==}
+    engines: {node: '>=20.9.0'}
+    cpu: [arm]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-linux-ppc64@0.35.2':
+    resolution: {integrity: sha512-hYSBm7zcNtDCozCxQHYZJiu63b/bXsgRZuOxCIBZsStMM9Vap47iFHdbX4kCvQsblPB/k+clhELpdQJHQLSHvg==}
+    engines: {node: '>=20.9.0'}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-linux-riscv64@0.35.2':
+    resolution: {integrity: sha512-qQt0Kc13+Hoan/Awq/qMSQw3L+RI1NCRPgD5cUJ/1WSSmIoysLOc72jlRM3E0OHN9Yr313jgeQ2T+zW+F03QFA==}
+    engines: {node: '>=20.9.0'}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-linux-s390x@0.35.2':
+    resolution: {integrity: sha512-E4fLLfRPzDLlEeDaTzI98OFLcv++WL5ChLLMwPoVd0CIoZQqupBSNbOisPL5am9XsbQ9T84+iiMpUvbFtkunbA==}
+    engines: {node: '>=20.9.0'}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-linux-x64@0.35.2':
+    resolution: {integrity: sha512-gi0zFJJRLswfCZmHtJdikXPOc5u7qamSOS3NHedLqLd4W8Q0NqjdBr6TTRIgsfFjqfTsHFgdfvJ9LwqSgcHiAA==}
+    engines: {node: '>=20.9.0'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@img/sharp-linuxmusl-arm64@0.35.2':
+    resolution: {integrity: sha512-siWbOW1u6HFnFLrp0waKyW7VEf7jYvcDWdrXEFa8AkdAQgEvuu5Fz8/Y70w9EeqAdwDtfU012BhEHHaDqvQNzg==}
+    engines: {node: '>=20.9.0'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@img/sharp-linuxmusl-x64@0.35.2':
+    resolution: {integrity: sha512-YBqMMcjDi4QGYiSn4vNOYBhmlC4z5AXqkOUUqI2e0AFA4urNv4ESgOgwNl3K+4etQhha0twXlzeF20bbULm9Yg==}
+    engines: {node: '>=20.9.0'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@img/sharp-wasm32@0.35.2':
+    resolution: {integrity: sha512-Mrv4JQNYVQ94xH+jzZ9r+gowleN8mv2FTgKT+PI6bx5C0G8TdNYndu161pg2i7uoBwxy2ImPMHrJOM2LZef7Bw==}
+    engines: {node: '>=20.9.0'}
+
+  '@img/sharp-webcontainers-wasm32@0.35.2':
+    resolution: {integrity: sha512-QNV27pxs9wpApEiCfvHM1RDoP1w1+2KrUWWDPEhEwg+latvOrfuhWrHWZKwdSFwU6jh3myjw/yOCRsUIuOft3g==}
+    engines: {node: '>=20.9.0'}
+    cpu: [wasm32]
+
+  '@img/sharp-win32-arm64@0.35.2':
+    resolution: {integrity: sha512-BiVRYc/t6/Vl3e1hBx0hugG4oN9Pydf4fgMSpxTQJmwGUg/YoXTWHiFeRymHfCZzifxu4F4rpk/I67D0LQ20wQ==}
+    engines: {node: '>=20.9.0'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@img/sharp-win32-ia32@0.35.2':
+    resolution: {integrity: sha512-YYEhx9PImCC7T0tI8JDMi4DB9LwLCXCU5OWNYEXAxh5Q1ShKkyC6byxzoBJ3gEFDnH2lQckWuDe70G7mB2XJog==}
+    engines: {node: ^20.9.0}
+    cpu: [ia32]
+    os: [win32]
+
+  '@img/sharp-win32-x64@0.35.2':
+    resolution: {integrity: sha512-imoOyBcoM/iiUr4J6VPpCNjPnjvP/Gks95898yB8YqoGGYmHYbOyCuNv9FMhFgtaiHFGbHW8bxKqRV6VjtXThQ==}
+    engines: {node: '>=20.9.0'}
+    cpu: [x64]
+    os: [win32]
+
+  '@istanbuljs/schema@0.1.6':
+    resolution: {integrity: sha512-+Sg6GCR/wy1oSmQDFq4LQDAhm3ETKnorxN+y5nbLULOR3P0c14f2Wurzj3/xqPXtasLFfHd5iRFQ7AJt4KH2cw==}
+    engines: {node: '>=8'}
+
+  '@jridgewell/gen-mapping@0.3.13':
+    resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
+
+  '@jridgewell/remapping@2.3.5':
+    resolution: {integrity: sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==}
+
+  '@jridgewell/resolve-uri@3.1.2':
+    resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==}
+    engines: {node: '>=6.0.0'}
+
+  '@jridgewell/sourcemap-codec@1.5.5':
+    resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
+
+  '@jridgewell/trace-mapping@0.3.9':
+    resolution: {integrity: sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ==}
+
+  '@oxc-project/types@0.143.0':
+    resolution: {integrity: sha512-u6JZdLBTLotrNC9Vd6vPssINdzcCzleKAH6EJKImQb7GtYvX5keN2dxkoK44stCc4tffE6QQRtZTXVSzsLUlWA==}
+
+  '@poppinss/colors@4.1.6':
+    resolution: {integrity: sha512-H9xkIdFswbS8n1d6vmRd8+c10t2Qe+rZITbbDHHkQixH5+2x1FDGmi/0K+WgWiqQFKPSlIYB7jlH6Kpfn6Fleg==}
+
+  '@poppinss/dumper@0.6.5':
+    resolution: {integrity: sha512-NBdYIb90J7LfOI32dOewKI1r7wnkiH6m920puQ3qHUeZkxNkQiFnXVWoE6YtFSv6QOiPPf7ys6i+HWWecDz7sw==}
+
+  '@poppinss/exception@1.2.3':
+    resolution: {integrity: sha512-dCED+QRChTVatE9ibtoaxc+WkdzOSjYTKi/+uacHWIsfodVfpsueo3+DKpgU5Px8qXjgmXkSvhXvSCz3fnP9lw==}
+
+  '@rolldown/binding-android-arm64@1.2.3':
+    resolution: {integrity: sha512-zrJtHDcaZJ1Fp7xf4hNl+7seH9Cn/N5TwLYkhgXREtBwAd/jaqW3uqeHxpDugJLVICWg4eW44kOQEGJ1r6jCGw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [android]
+
+  '@rolldown/binding-darwin-arm64@1.2.3':
+    resolution: {integrity: sha512-ieIiibVCp0tX7TLu2cafoNPv8wJyYi01ekXpbf8q2j7F4rGAhhXb/eQh7ge9DRBY78GwmRQtvjZDux7EDbA8kA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@rolldown/binding-darwin-x64@1.2.3':
+    resolution: {integrity: sha512-Zh9tCon19eDXJoihx0rqKhMUlMYqzwj3aPsSuHmI4RWZh62dWUL+DJN4C5YQya5TcQBJU/Fe8+rY0jhXTQITqA==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [darwin]
+
+  '@rolldown/binding-freebsd-x64@1.2.3':
+    resolution: {integrity: sha512-nGbJWewA1wrXXZiQhjAT5rhibGfns5ZNkDVqxsO6zJ3f3YvpoDNNmGMSbbhLuXKjNScaBJVOAboztAWVespQMg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@rolldown/binding-linux-arm-gnueabihf@1.2.3':
+    resolution: {integrity: sha512-QNniJr5Kml0kDEB98jiDOJjXNroxIIi0IXIbdYzY26Xt1pVbeP62+KnoIZLwirOymX/0jDk/2gI/bNUv7A7OIw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm]
+    os: [linux]
+
+  '@rolldown/binding-linux-arm64-gnu@1.2.3':
+    resolution: {integrity: sha512-TkqEAcmmvH3I/q4114NB4RVt6241Dao48pF45uLcFGrwAaIn0iITgTAKP/dLjbN0R4buJjGb91+UHSoFmpgIWw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rolldown/binding-linux-arm64-musl@1.2.3':
+    resolution: {integrity: sha512-NHqjnxpsndf4MPymxteFAWHHfkTL8HjWh1KB7z23ofZ6QO2euONuxDXjat69dKZRALnGypg8k8SsK8vZJoXv1Q==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@rolldown/binding-linux-ppc64-gnu@1.2.3':
+    resolution: {integrity: sha512-6tbrbwfz5GB9DQ4Jwo6hy9v+vR31xZlvzZ6n5Xut6Hhx5PvrA9q/HsK8KMaYQp063iqZGXwNvZtYNLD7EM/x0w==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rolldown/binding-linux-s390x-gnu@1.2.3':
+    resolution: {integrity: sha512-oyuXxXmoZHjXC917IAPFAAv4wWAa0cM9afk8nx1+9/jNNOX1uPf8yDA6p7G0RypOfw/X0PQt5IfoquY1um+zSg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@rolldown/binding-linux-x64-gnu@1.2.3':
+    resolution: {integrity: sha512-TytMwF2KVGqP2tgd0I1OY0PAv78dZRAYcF5ssDzjM34SUXCED3uXvSd5+lHoC0bTD6eEdFz7LdQNCO1y0oVk9w==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rolldown/binding-linux-x64-musl@1.2.3':
+    resolution: {integrity: sha512-/E9m3qstrJFVPoULV25mVQblSNExY2+kBsYe4sy0Tn0yOOgJ8wZbZt3KnRbF/XeU2Gl1STKUQnDNTqhIE5MD4A==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@rolldown/binding-openharmony-arm64@1.2.3':
+    resolution: {integrity: sha512-Kr0OcsoQI816i6HOl3vFHpd1K0eZyh76zgfj4c1nTyaTsd5r2Mj1lwM4R90y/qaCfmTn9eHy0SKwi98eitRxug==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@rolldown/binding-win32-arm64-msvc@1.2.3':
+    resolution: {integrity: sha512-hOtMwTqnME+/gJcH/PCZ0wn0zPUjiWOgkHpxbSJpfGKMezHltx1S7/k1SitzVa7Ww2cqrDDaFbZEhcJZO8o+Jw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [arm64]
+    os: [win32]
+
+  '@rolldown/binding-win32-x64-msvc@1.2.3':
+    resolution: {integrity: sha512-ekcqMMkI2PlhYnfzQnB/cEdYUVVJViWvoUyLrbzgDoi3Snfc1mVBwdnc306ufA5ejy8JSPjT2RlW1nQSjW7efg==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    cpu: [x64]
+    os: [win32]
+
+  '@rolldown/pluginutils@1.0.1':
+    resolution: {integrity: sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==}
+
+  '@sindresorhus/is@7.2.0':
+    resolution: {integrity: sha512-P1Cz1dWaFfR4IR+U13mqqiGsLFf1KbayybWwdd2vfctdV6hDpUkgCY0nKOLLTMSoRd/jJNjtbqzf13K8DCCXQw==}
+    engines: {node: '>=18'}
+
+  '@speed-highlight/core@1.2.23':
+    resolution: {integrity: sha512-iRoq6i6JDJP6Mt2A5JaPvzw0pgYHH6k92ij+yXiTrB7T2y9N789aWE3EHWj/5ztlJBokcCBja3iYLVdu5wgnkg==}
+
+  '@standard-schema/spec@1.1.0':
+    resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
+
+  '@types/chai@5.2.3':
+    resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
+
+  '@types/deep-eql@4.0.2':
+    resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
+
+  '@types/estree@1.0.9':
+    resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
+
+  '@types/node@26.2.0':
+    resolution: {integrity: sha512-5IviulTZeRNp2vAJ514cc/HUlY5nZ9fCbq9DMyC52BrhFZACo3nI0R7qBxhQmo/d27NFe96ur/b7Wwxklda+kg==}
+
+  '@typescript/typescript-aix-ppc64@7.0.2':
+    resolution: {integrity: sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==}
+    engines: {node: '>=16.20.0'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@typescript/typescript-darwin-arm64@7.0.2':
+    resolution: {integrity: sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==}
+    engines: {node: '>=16.20.0'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@typescript/typescript-darwin-x64@7.0.2':
+    resolution: {integrity: sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==}
+    engines: {node: '>=16.20.0'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@typescript/typescript-freebsd-arm64@7.0.2':
+    resolution: {integrity: sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==}
+    engines: {node: '>=16.20.0'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@typescript/typescript-freebsd-x64@7.0.2':
+    resolution: {integrity: sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==}
+    engines: {node: '>=16.20.0'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@typescript/typescript-linux-arm64@7.0.2':
+    resolution: {integrity: sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==}
+    engines: {node: '>=16.20.0'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@typescript/typescript-linux-arm@7.0.2':
+    resolution: {integrity: sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==}
+    engines: {node: '>=16.20.0'}
+    cpu: [arm]
+    os: [linux]
+
+  '@typescript/typescript-linux-loong64@7.0.2':
+    resolution: {integrity: sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==}
+    engines: {node: '>=16.20.0'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@typescript/typescript-linux-mips64el@7.0.2':
+    resolution: {integrity: sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==}
+    engines: {node: '>=16.20.0'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@typescript/typescript-linux-ppc64@7.0.2':
+    resolution: {integrity: sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==}
+    engines: {node: '>=16.20.0'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@typescript/typescript-linux-riscv64@7.0.2':
+    resolution: {integrity: sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==}
+    engines: {node: '>=16.20.0'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@typescript/typescript-linux-s390x@7.0.2':
+    resolution: {integrity: sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==}
+    engines: {node: '>=16.20.0'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@typescript/typescript-linux-x64@7.0.2':
+    resolution: {integrity: sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==}
+    engines: {node: '>=16.20.0'}
+    cpu: [x64]
+    os: [linux]
+
+  '@typescript/typescript-netbsd-arm64@7.0.2':
+    resolution: {integrity: sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==}
+    engines: {node: '>=16.20.0'}
+    cpu: [arm64]
+    os: [netbsd]
+
+  '@typescript/typescript-netbsd-x64@7.0.2':
+    resolution: {integrity: sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==}
+    engines: {node: '>=16.20.0'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@typescript/typescript-openbsd-arm64@7.0.2':
+    resolution: {integrity: sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==}
+    engines: {node: '>=16.20.0'}
+    cpu: [arm64]
+    os: [openbsd]
+
+  '@typescript/typescript-openbsd-x64@7.0.2':
+    resolution: {integrity: sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==}
+    engines: {node: '>=16.20.0'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@typescript/typescript-sunos-x64@7.0.2':
+    resolution: {integrity: sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==}
+    engines: {node: '>=16.20.0'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@typescript/typescript-win32-arm64@7.0.2':
+    resolution: {integrity: sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==}
+    engines: {node: '>=16.20.0'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@typescript/typescript-win32-x64@7.0.2':
+    resolution: {integrity: sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==}
+    engines: {node: '>=16.20.0'}
+    cpu: [x64]
+    os: [win32]
+
+  '@vitest/coverage-istanbul@4.1.10':
+    resolution: {integrity: sha512-AyNJ5pQRFqCX7pwB9PSTmoVKPaZ4H5IEVJfJsT+q1DYkXvZMEFYgJlyk5sfStmt9rVYRyYYRRsuBeImCOc39ww==}
+    peerDependencies:
+      vitest: 4.1.10
+
+  '@vitest/coverage-v8@4.1.10':
+    resolution: {integrity: sha512-IM49HmthevbgAO4anp1hwtoT9wYe59w0LR00gr+eagHE+ZJ5lK4sLPeO0ubgoJcwLk6dehU3R24N+FbEEKDc8g==}
+    peerDependencies:
+      '@vitest/browser': 4.1.10
+      vitest: 4.1.10
+    peerDependenciesMeta:
+      '@vitest/browser':
+        optional: true
+
+  '@vitest/expect@4.1.10':
+    resolution: {integrity: sha512-YsCn+qAk1GWjQOWFEsEcL2gNQ0zmVmQu3T03qP6UyjhtmdtwtbuI+DASn/7iQB3HGTXkdBwGddzxPlmiql5vlA==}
+
+  '@vitest/mocker@4.1.10':
+    resolution: {integrity: sha512-v0xaezt+DKEmKfaxg133ldzADrwLGd7Ze1MfQQTYfvs8OqZIwbxyxaYURivwV7sWy5fqn3rH5uOrSp07bp44Ow==}
+    peerDependencies:
+      msw: ^2.4.9
+      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
+    peerDependenciesMeta:
+      msw:
+        optional: true
+      vite:
+        optional: true
+
+  '@vitest/pretty-format@4.1.10':
+    resolution: {integrity: sha512-W1HsjSH4MXQ9YfmmhLAoIYf1HRfekQCGngeIgcei6MP5QQGWUe0gkopdZQaVCFO+JDJMrAJGwa5pRpNpvy4P8Q==}
+
+  '@vitest/runner@4.1.10':
+    resolution: {integrity: sha512-IKI6kpIH+LmpROplyLwBBaCfMgOZOMsygVa6BARD6ahA04VRuJSa6OaVG7kRvSEMD870Vd91rSSw0eegtWyLGg==}
+
+  '@vitest/snapshot@4.1.10':
+    resolution: {integrity: sha512-xRkfOT1qpTAi/Ti4Y1LtfRc3kEuqxGw59eN2jN9pRWMtS/XDevekhcFSqvQqjUNGksfjMJu3Y+oJ+4Ypn2OaJw==}
+
+  '@vitest/spy@4.1.10':
+    resolution: {integrity: sha512-PLf/Ugvoq5wO/b4rwYCR1h2PSIdXz7wnkQFMiUpLdtM7l6pqVFcQIBEHyT1+l+cj7mNwAfZHzqXqDyjvOuwbDw==}
+
+  '@vitest/utils@4.1.10':
+    resolution: {integrity: sha512-fy9am/HWxbaGt/Sawrp90vt6Y6jQwf1RX77cz3uwoJwJVMli/e1IEwRPnMNJ7vKfPTwo0diXifkpPvwH9v7nGA==}
+
+  assertion-error@2.0.1:
+    resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
+    engines: {node: '>=12'}
+
+  ast-v8-to-istanbul@1.0.5:
+    resolution: {integrity: sha512-UPAgKJFSEGMWSDr3LX4tqnAb4f7KGT8O40Tyx8wbYmmZ/yn58lNCm8h3svs3eXgiGd5AXxz8NDOvXWvicq+rJA==}
+
+  baseline-browser-mapping@2.11.12:
+    resolution: {integrity: sha512-r7WnVImvVCeFpf2DOXfy41aPWzeNg3H/A2X4dKmy1QL0MSyyk/e7z8ihJ3N6Nn2PsdhkVlqnEfnUE4a05P2aTA==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  blake3-wasm@2.1.5:
+    resolution: {integrity: sha512-F1+K8EbfOZE49dtoPtmxUQrpXaBIl3ICvasLh+nJta0xkz+9kF/7uet9fLnwKqhDrmj6g+6K3Tw9yQPUg2ka5g==}
+
+  browserslist@4.28.7:
+    resolution: {integrity: sha512-JxV13hNrFxqjOc8alRbq9dK1MM79NEXYpma2B2J4wAtpWS5zIEIKqWPGCl7N4o7Uc7B7itylh7SuDujATRyyTw==}
+    engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
+    hasBin: true
+
+  caniuse-lite@1.0.30001809:
+    resolution: {integrity: sha512-xxWVywk6a6Arlk+hymeycyn/VgqEfLDxupvhH/xiY5SJ/18kmi9o6MiO320DCUzypORHLtvh0I4i04tUhCNHNQ==}
+
+  chai@6.2.2:
+    resolution: {integrity: sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==}
+    engines: {node: '>=18'}
+
+  cjs-module-lexer@1.2.3:
+    resolution: {integrity: sha512-0TNiGstbQmCFwt4akjjBg5pLRTSyj/PkWQ1ZoO2zntmg9yLqSRxwEa4iCfQLGjqhiqBfOJa7W/E8wfGrTDmlZQ==}
+
+  convert-source-map@2.0.0:
+    resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
+
+  cookie@1.1.1:
+    resolution: {integrity: sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==}
+    engines: {node: '>=18'}
+
+  debug@4.4.3:
+    resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
+    engines: {node: '>=6.0'}
+    peerDependencies:
+      supports-color: '*'
+    peerDependenciesMeta:
+      supports-color:
+        optional: true
+
+  detect-libc@2.1.2:
+    resolution: {integrity: sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==}
+    engines: {node: '>=8'}
+
+  electron-to-chromium@1.5.402:
+    resolution: {integrity: sha512-/oOpMaPT6Yg+6/1XQhyIPlzgj7Ye9zf+nNM2Uh6OcE2G2oNptWazFa+qB2Pdqqbsc9KnIDzgAntoYN0dbwOXwA==}
+
+  error-stack-parser-es@1.0.5:
+    resolution: {integrity: sha512-5qucVt2XcuGMcEGgWI7i+yZpmpByQ8J1lHhcL7PwqCwu9FPP3VUXzT4ltHe5i2z9dePwEHcDVOAfSnHsOlCXRA==}
+
+  es-module-lexer@2.3.1:
+    resolution: {integrity: sha512-shc1dbU90Yl/xq1QrC7QRtfcwURZuVRfPhZbDoldJ1cn1gzDvBaBWlv0eFolj5+0znnPJz5TXLxsN77X/12KTA==}
+
+  esbuild@0.28.1:
+    resolution: {integrity: sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  escalade@3.2.0:
+    resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
+    engines: {node: '>=6'}
+
+  estree-walker@3.0.3:
+    resolution: {integrity: sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==}
+
+  expect-type@1.4.0:
+    resolution: {integrity: sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==}
+    engines: {node: '>=12.0.0'}
+
+  fdir@6.5.0:
+    resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      picomatch: ^3 || ^4
+    peerDependenciesMeta:
+      picomatch:
+        optional: true
+
+  fsevents@2.3.3:
+    resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
+    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+    os: [darwin]
+
+  gensync@1.0.0-beta.2:
+    resolution: {integrity: sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
+    engines: {node: '>=6.9.0'}
+
+  has-flag@4.0.0:
+    resolution: {integrity: sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
+    engines: {node: '>=8'}
+
+  html-escaper@2.0.2:
+    resolution: {integrity: sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==}
+
+  istanbul-lib-coverage@3.2.2:
+    resolution: {integrity: sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==}
+    engines: {node: '>=8'}
+
+  istanbul-lib-report@3.0.1:
+    resolution: {integrity: sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==}
+    engines: {node: '>=10'}
+
+  istanbul-reports@3.2.0:
+    resolution: {integrity: sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==}
+    engines: {node: '>=8'}
+
+  js-tokens@10.0.0:
+    resolution: {integrity: sha512-lM/UBzQmfJRo9ABXbPWemivdCW8V2G8FHaHdypQaIy523snUjog0W71ayWXTjiR+ixeMyVHN2XcpnTd/liPg/Q==}
+
+  js-tokens@4.0.0:
+    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
+
+  jsesc@3.1.0:
+    resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  json5@2.2.3:
+    resolution: {integrity: sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  kleur@4.1.5:
+    resolution: {integrity: sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==}
+    engines: {node: '>=6'}
+
+  lightningcss-android-arm64@1.33.0:
+    resolution: {integrity: sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [android]
+
+  lightningcss-darwin-arm64@1.33.0:
+    resolution: {integrity: sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [darwin]
+
+  lightningcss-darwin-x64@1.33.0:
+    resolution: {integrity: sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [darwin]
+
+  lightningcss-freebsd-x64@1.33.0:
+    resolution: {integrity: sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [freebsd]
+
+  lightningcss-linux-arm-gnueabihf@1.33.0:
+    resolution: {integrity: sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm]
+    os: [linux]
+
+  lightningcss-linux-arm64-gnu@1.33.0:
+    resolution: {integrity: sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  lightningcss-linux-arm64-musl@1.33.0:
+    resolution: {integrity: sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  lightningcss-linux-x64-gnu@1.33.0:
+    resolution: {integrity: sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  lightningcss-linux-x64-musl@1.33.0:
+    resolution: {integrity: sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  lightningcss-win32-arm64-msvc@1.33.0:
+    resolution: {integrity: sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [win32]
+
+  lightningcss-win32-x64-msvc@1.33.0:
+    resolution: {integrity: sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [win32]
+
+  lightningcss@1.33.0:
+    resolution: {integrity: sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==}
+    engines: {node: '>= 12.0.0'}
+
+  lru-cache@5.1.1:
+    resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}
+
+  magic-string@0.30.21:
+    resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
+
+  magicast@0.5.4:
+    resolution: {integrity: sha512-llBEhWm1SacoRwgHUoQJYtwp4PBLF4faQi5TCpIGyGs9n4y5+juI0tDgyKIfpqxckRHaHzouUEph3THklWh03w==}
+
+  make-dir@4.0.0:
+    resolution: {integrity: sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==}
+    engines: {node: '>=10'}
+
+  miniflare@5.20260801.1-alpha:
+    resolution: {integrity: sha512-BHPVzIDA6mbx7LefxpvkXW7DHx9FKB9GorZatbnrrFTt3CVMU8zuUpbgyCuebwDKcTTOZos43ta8GQ0eMVEpxA==}
+    engines: {node: '>=22.0.0'}
+
+  ms@2.1.3:
+    resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
+
+  nanoid@3.3.18:
+    resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==}
+    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
+    hasBin: true
+
+  node-releases@2.0.53:
+    resolution: {integrity: sha512-D9UOmYG3UH1V+ENW56t5QXBwJw1YEY18ruVeus89Rw+SyIgjPkCO84bRzO3uNIYosJbNwiabWVn48o3uJLjxFQ==}
+    engines: {node: '>=18'}
+
+  obug@2.1.4:
+    resolution: {integrity: sha512-4a+OsYv9UktOJKE+l1A4OufDgdRF9PifWj+tJnHURo/P+WOxpG4GzUFL9qCalmWauao6ogiG+QvnCovwPoyAWA==}
+    engines: {node: '>=12.20.0'}
+
+  path-to-regexp@6.3.0:
+    resolution: {integrity: sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==}
+
+  pathe@2.0.3:
+    resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
+
+  picocolors@1.1.1:
+    resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
+
+  picomatch@4.0.5:
+    resolution: {integrity: sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==}
+    engines: {node: '>=12'}
+
+  postcss@8.5.26:
+    resolution: {integrity: sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==}
+    engines: {node: ^10 || ^12 || >=14}
+
+  rolldown@1.2.3:
+    resolution: {integrity: sha512-rn9wpmxplLf7NLNyCk9FyWh3FM43DbY8jOzCdEPzH7uflhTftRbCEpqi6Ly2osgoU8OwObtmavMbWLaWy4LX7A==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    hasBin: true
+
+  semver@6.3.1:
+    resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
+    hasBin: true
+
+  semver@7.8.5:
+    resolution: {integrity: sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+  sharp@0.35.2:
+    resolution: {integrity: sha512-FVtFjtBCMiJS6yb5CX7Sop45WFMpeGw6oRKuJnXYgf/f1ms/D7LE/ZUSNxnW7rZ/dbslQWYkoqFHGPaDBtaK4w==}
+    engines: {node: '>=20.9.0'}
+
+  siginfo@2.0.0:
+    resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==}
+
+  source-map-js@1.2.1:
+    resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+    engines: {node: '>=0.10.0'}
+
+  stackback@0.0.2:
+    resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
+
+  std-env@4.2.0:
+    resolution: {integrity: sha512-oCUKSupKTHX53EyjDtuZQ64pjLJ6yYCtpmEw0goYxtjG9KpbRe8KAsl2tBUGU9DyMcJ0RwJ8GqJAFzMXcXW1Rw==}
+
+  supports-color@10.2.2:
+    resolution: {integrity: sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g==}
+    engines: {node: '>=18'}
+
+  supports-color@7.2.0:
+    resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
+    engines: {node: '>=8'}
+
+  tinybench@2.9.0:
+    resolution: {integrity: sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==}
+
+  tinyexec@1.3.0:
+    resolution: {integrity: sha512-QKAl9m8gWWGHV8jZcPeym6j+XULi6tOf1mT83WYJ4Lk2ytW/uwAWkrP0uFsdoYMdueVJ0qs26wZ+23xeB4ibNQ==}
+    engines: {node: '>=18'}
+
+  tinyglobby@0.2.17:
+    resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
+    engines: {node: '>=12.0.0'}
+
+  tinyrainbow@3.1.1:
+    resolution: {integrity: sha512-yau8yJdTt989Mm0Bd/236QnzEiPf2xLLTqUZRUJOo/3CB078LSwzei343DgtJVmfJKJE3TMINY1u42SQsP6mXw==}
+    engines: {node: '>=14.0.0'}
+
+  tslib@2.8.1:
+    resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
+
+  typescript@7.0.2:
+    resolution: {integrity: sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==}
+    engines: {node: '>=16.20.0'}
+    hasBin: true
+
+  undici-types@8.3.0:
+    resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==}
+
+  undici@7.29.0:
+    resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==}
+    engines: {node: '>=20.18.1'}
+
+  unenv@2.0.0-rc.24:
+    resolution: {integrity: sha512-i7qRCmY42zmCwnYlh9H2SvLEypEFGye5iRmEMKjcGi7zk9UquigRjFtTLz0TYqr0ZGLZhaMHl/foy1bZR+Cwlw==}
+
+  update-browserslist-db@1.3.0:
+    resolution: {integrity: sha512-x/M6q3w4Ybp91CNaS4S69UnliqR3BzRpOT6LWbksjth0S/+jhfaPJsWjt/TewpT8j9eLIojUf5jr29WextHroA==}
+    hasBin: true
+    peerDependencies:
+      browserslist: '>= 4.21.0'
+
+  vite@8.2.1:
+    resolution: {integrity: sha512-EU/eS7BH3XROHh2YnBefjM6DBKA6ZeMZEYQbj7NLWg5wHYlhB8B/Mayd5XsgWq+NFYccDOTemRpdETWR6Ka/lw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
+    hasBin: true
+    peerDependencies:
+      '@types/node': ^20.19.0 || >=22.12.0
+      '@vitejs/devtools': ^0.4.0
+      esbuild: ^0.27.0 || ^0.28.0
+      jiti: '>=1.21.0'
+      less: ^4.0.0
+      sass: ^1.70.0
+      sass-embedded: ^1.70.0
+      stylus: '>=0.54.8'
+      sugarss: ^5.0.0
+      terser: ^5.16.0
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+      '@vitejs/devtools':
+        optional: true
+      esbuild:
+        optional: true
+      jiti:
+        optional: true
+      less:
+        optional: true
+      sass:
+        optional: true
+      sass-embedded:
+        optional: true
+      stylus:
+        optional: true
+      sugarss:
+        optional: true
+      terser:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+  vitest@4.1.10:
+    resolution: {integrity: sha512-R9jUTe5S4Qb0HCd4TNqpC7oGcrMssMRGXLW80ubjWsW9VH5GF8y1Y0SFLY9AbqSk6nt0PnOx4H4WNJYZ13GUPw==}
+    engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
+    hasBin: true
+    peerDependencies:
+      '@edge-runtime/vm': '*'
+      '@opentelemetry/api': ^1.9.0
+      '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
+      '@vitest/browser-playwright': 4.1.10
+      '@vitest/browser-preview': 4.1.10
+      '@vitest/browser-webdriverio': 4.1.10
+      '@vitest/coverage-istanbul': 4.1.10
+      '@vitest/coverage-v8': 4.1.10
+      '@vitest/ui': 4.1.10
+      happy-dom: '*'
+      jsdom: '*'
+      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
+    peerDependenciesMeta:
+      '@edge-runtime/vm':
+        optional: true
+      '@opentelemetry/api':
+        optional: true
+      '@types/node':
+        optional: true
+      '@vitest/browser-playwright':
+        optional: true
+      '@vitest/browser-preview':
+        optional: true
+      '@vitest/browser-webdriverio':
+        optional: true
+      '@vitest/coverage-istanbul':
+        optional: true
+      '@vitest/coverage-v8':
+        optional: true
+      '@vitest/ui':
+        optional: true
+      happy-dom:
+        optional: true
+      jsdom:
+        optional: true
+
+  why-is-node-running@2.3.0:
+    resolution: {integrity: sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==}
+    engines: {node: '>=8'}
+    hasBin: true
+
+  workerd@1.20260801.1:
+    resolution: {integrity: sha512-/g9JGTyqnHtoIscpBHqKD8swE2V4StBs2i69PmLiOhH45OP95jCFICl4F1hKlgN57rqfni5LiCitttoX5OOkVA==}
+    engines: {node: '>=16'}
+    hasBin: true
+
+  wrangler@4.120.0:
+    resolution: {integrity: sha512-cBmu/MeaB/fPacC0JpATs4duTOCagBxrZo+vBzuTX06tLzwSyAHE1drlHUZ8rP0VqVz1fy3ReGYTiHdKkoHltg==}
+    engines: {node: '>=22.0.0'}
+    hasBin: true
+    peerDependencies:
+      '@cloudflare/workers-types': ^5.20260801.1
+    peerDependenciesMeta:
+      '@cloudflare/workers-types':
+        optional: true
+
+  ws@8.21.0:
+    resolution: {integrity: sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==}
+    engines: {node: '>=10.0.0'}
+    peerDependencies:
+      bufferutil: ^4.0.1
+      utf-8-validate: '>=5.0.2'
+    peerDependenciesMeta:
+      bufferutil:
+        optional: true
+      utf-8-validate:
+        optional: true
+
+  yallist@3.1.1:
+    resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}
+
+  youch-core@0.3.3:
+    resolution: {integrity: sha512-ho7XuGjLaJ2hWHoK8yFnsUGy2Y5uDpqSTq1FkHLK4/oqKtyUU1AFbOOxY4IpC9f0fTLjwYbslUz0Po5BpD1wrA==}
+
+  youch@4.1.0-beta.10:
+    resolution: {integrity: sha512-rLfVLB4FgQneDr0dv1oddCVZmKjcJ6yX6mS4pU82Mq/Dt9a3cLZQ62pDBL4AUO+uVrCvtWz3ZFUL2HFAFJ/BXQ==}
+
+  zod@4.4.3:
+    resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==}
+
+snapshots:
+
+  '@babel/code-frame@7.29.7':
+    dependencies:
+      '@babel/helper-validator-identifier': 7.29.7
+      js-tokens: 4.0.0
+      picocolors: 1.1.1
+
+  '@babel/compat-data@7.29.7': {}
+
+  '@babel/core@7.29.7(supports-color@10.2.2)':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/generator': 7.29.8
+      '@babel/helper-compilation-targets': 7.29.7
+      '@babel/helper-module-transforms': 7.29.7(@babel/core@7.29.7(supports-color@10.2.2))(supports-color@10.2.2)
+      '@babel/helpers': 7.29.7
+      '@babel/parser': 7.29.8
+      '@babel/template': 7.29.7
+      '@babel/traverse': 7.29.8(supports-color@10.2.2)
+      '@babel/types': 7.29.8
+      '@jridgewell/remapping': 2.3.5
+      convert-source-map: 2.0.0
+      debug: 4.4.3(supports-color@10.2.2)
+      gensync: 1.0.0-beta.2
+      json5: 2.2.3
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/generator@7.29.8':
+    dependencies:
+      '@babel/parser': 7.29.8
+      '@babel/types': 7.29.8
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+      jsesc: 3.1.0
+
+  '@babel/helper-compilation-targets@7.29.7':
+    dependencies:
+      '@babel/compat-data': 7.29.7
+      '@babel/helper-validator-option': 7.29.7
+      browserslist: 4.28.7
+      lru-cache: 5.1.1
+      semver: 6.3.1
+
+  '@babel/helper-globals@7.29.7': {}
+
+  '@babel/helper-module-imports@7.29.7(supports-color@10.2.2)':
+    dependencies:
+      '@babel/traverse': 7.29.8(supports-color@10.2.2)
+      '@babel/types': 7.29.8
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-module-transforms@7.29.7(@babel/core@7.29.7(supports-color@10.2.2))(supports-color@10.2.2)':
+    dependencies:
+      '@babel/core': 7.29.7(supports-color@10.2.2)
+      '@babel/helper-module-imports': 7.29.7(supports-color@10.2.2)
+      '@babel/helper-validator-identifier': 7.29.7
+      '@babel/traverse': 7.29.8(supports-color@10.2.2)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-string-parser@7.29.7': {}
+
+  '@babel/helper-validator-identifier@7.29.7': {}
+
+  '@babel/helper-validator-option@7.29.7': {}
+
+  '@babel/helpers@7.29.7':
+    dependencies:
+      '@babel/template': 7.29.7
+      '@babel/types': 7.29.8
+
+  '@babel/parser@7.29.8':
+    dependencies:
+      '@babel/types': 7.29.8
+
+  '@babel/template@7.29.7':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/parser': 7.29.8
+      '@babel/types': 7.29.8
+
+  '@babel/traverse@7.29.8(supports-color@10.2.2)':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/generator': 7.29.8
+      '@babel/helper-globals': 7.29.7
+      '@babel/parser': 7.29.8
+      '@babel/template': 7.29.7
+      '@babel/types': 7.29.8
+      debug: 4.4.3(supports-color@10.2.2)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/types@7.29.8':
+    dependencies:
+      '@babel/helper-string-parser': 7.29.7
+      '@babel/helper-validator-identifier': 7.29.7
+
+  '@bcoe/v8-coverage@1.0.2':
+    optional: true
+
+  '@cloudflare/kv-asset-handler@0.5.0': {}
+
+  '@cloudflare/unenv-preset@2.16.1(unenv@2.0.0-rc.24)(workerd@1.20260801.1)':
+    dependencies:
+      unenv: 2.0.0-rc.24
+    optionalDependencies:
+      workerd: 1.20260801.1
+
+  '@cloudflare/vitest-pool-workers@0.20.3(@cloudflare/workers-types@5.20260804.1)(@vitest/runner@4.1.10)(@vitest/snapshot@4.1.10)(vitest@4.1.10)':
+    dependencies:
+      '@vitest/runner': 4.1.10
+      '@vitest/snapshot': 4.1.10
+      cjs-module-lexer: 1.2.3
+      esbuild: 0.28.1
+      miniflare: 5.20260801.1-alpha
+      vitest: 4.1.10(@types/node@26.2.0)(@vitest/coverage-istanbul@4.1.10)(@vitest/coverage-v8@4.1.10)(vite@8.2.1(@types/node@26.2.0)(esbuild@0.28.1))
+      wrangler: 4.120.0(@cloudflare/workers-types@5.20260804.1)
+      zod: 4.4.3
+    transitivePeerDependencies:
+      - '@cloudflare/workers-types'
+      - bufferutil
+      - utf-8-validate
+
+  '@cloudflare/workerd-darwin-64@1.20260801.1':
+    optional: true
+
+  '@cloudflare/workerd-darwin-arm64@1.20260801.1':
+    optional: true
+
+  '@cloudflare/workerd-linux-64@1.20260801.1':
+    optional: true
+
+  '@cloudflare/workerd-linux-arm64@1.20260801.1':
+    optional: true
+
+  '@cloudflare/workerd-windows-64@1.20260801.1':
+    optional: true
+
+  '@cloudflare/workers-types@5.20260804.1': {}
+
+  '@cspotcode/source-map-support@0.8.1':
+    dependencies:
+      '@jridgewell/trace-mapping': 0.3.9
+
+  '@emnapi/runtime@1.11.3':
+    dependencies:
+      tslib: 2.8.1
+    optional: true
+
+  '@esbuild/aix-ppc64@0.28.1':
+    optional: true
+
+  '@esbuild/android-arm64@0.28.1':
+    optional: true
+
+  '@esbuild/android-arm@0.28.1':
+    optional: true
+
+  '@esbuild/android-x64@0.28.1':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.28.1':
+    optional: true
+
+  '@esbuild/darwin-x64@0.28.1':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.28.1':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.28.1':
+    optional: true
+
+  '@esbuild/linux-arm64@0.28.1':
+    optional: true
+
+  '@esbuild/linux-arm@0.28.1':
+    optional: true
+
+  '@esbuild/linux-ia32@0.28.1':
+    optional: true
+
+  '@esbuild/linux-loong64@0.28.1':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.28.1':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.28.1':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.28.1':
+    optional: true
+
+  '@esbuild/linux-s390x@0.28.1':
+    optional: true
+
+  '@esbuild/linux-x64@0.28.1':
+    optional: true
+
+  '@esbuild/netbsd-arm64@0.28.1':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.28.1':
+    optional: true
+
+  '@esbuild/openbsd-arm64@0.28.1':
+    optional: true
+
+  '@esbuild/openbsd-x64@0.28.1':
+    optional: true
+
+  '@esbuild/openharmony-arm64@0.28.1':
+    optional: true
+
+  '@esbuild/sunos-x64@0.28.1':
+    optional: true
+
+  '@esbuild/win32-arm64@0.28.1':
+    optional: true
+
+  '@esbuild/win32-ia32@0.28.1':
+    optional: true
+
+  '@esbuild/win32-x64@0.28.1':
+    optional: true
+
+  '@img/colour@1.1.0': {}
+
+  '@img/sharp-darwin-arm64@0.35.2':
+    optionalDependencies:
+      '@img/sharp-libvips-darwin-arm64': 1.3.1
+    optional: true
+
+  '@img/sharp-darwin-x64@0.35.2':
+    optionalDependencies:
+      '@img/sharp-libvips-darwin-x64': 1.3.1
+    optional: true
+
+  '@img/sharp-freebsd-wasm32@0.35.2':
+    dependencies:
+      '@img/sharp-wasm32': 0.35.2
+    optional: true
+
+  '@img/sharp-libvips-darwin-arm64@1.3.1':
+    optional: true
+
+  '@img/sharp-libvips-darwin-x64@1.3.1':
+    optional: true
+
+  '@img/sharp-libvips-linux-arm64@1.3.1':
+    optional: true
+
+  '@img/sharp-libvips-linux-arm@1.3.1':
+    optional: true
+
+  '@img/sharp-libvips-linux-ppc64@1.3.1':
+    optional: true
+
+  '@img/sharp-libvips-linux-riscv64@1.3.1':
+    optional: true
+
+  '@img/sharp-libvips-linux-s390x@1.3.1':
+    optional: true
+
+  '@img/sharp-libvips-linux-x64@1.3.1':
+    optional: true
+
+  '@img/sharp-libvips-linuxmusl-arm64@1.3.1':
+    optional: true
+
+  '@img/sharp-libvips-linuxmusl-x64@1.3.1':
+    optional: true
+
+  '@img/sharp-linux-arm64@0.35.2':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-arm64': 1.3.1
+    optional: true
+
+  '@img/sharp-linux-arm@0.35.2':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-arm': 1.3.1
+    optional: true
+
+  '@img/sharp-linux-ppc64@0.35.2':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-ppc64': 1.3.1
+    optional: true
+
+  '@img/sharp-linux-riscv64@0.35.2':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-riscv64': 1.3.1
+    optional: true
+
+  '@img/sharp-linux-s390x@0.35.2':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-s390x': 1.3.1
+    optional: true
+
+  '@img/sharp-linux-x64@0.35.2':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-x64': 1.3.1
+    optional: true
+
+  '@img/sharp-linuxmusl-arm64@0.35.2':
+    optionalDependencies:
+      '@img/sharp-libvips-linuxmusl-arm64': 1.3.1
+    optional: true
+
+  '@img/sharp-linuxmusl-x64@0.35.2':
+    optionalDependencies:
+      '@img/sharp-libvips-linuxmusl-x64': 1.3.1
+    optional: true
+
+  '@img/sharp-wasm32@0.35.2':
+    dependencies:
+      '@emnapi/runtime': 1.11.3
+    optional: true
+
+  '@img/sharp-webcontainers-wasm32@0.35.2':
+    dependencies:
+      '@img/sharp-wasm32': 0.35.2
+    optional: true
+
+  '@img/sharp-win32-arm64@0.35.2':
+    optional: true
+
+  '@img/sharp-win32-ia32@0.35.2':
+    optional: true
+
+  '@img/sharp-win32-x64@0.35.2':
+    optional: true
+
+  '@istanbuljs/schema@0.1.6': {}
+
+  '@jridgewell/gen-mapping@0.3.13':
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.5.5
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/remapping@2.3.5':
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/resolve-uri@3.1.2': {}
+
+  '@jridgewell/sourcemap-codec@1.5.5': {}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    dependencies:
+      '@jridgewell/resolve-uri': 3.1.2
+      '@jridgewell/sourcemap-codec': 1.5.5
+
+  '@jridgewell/trace-mapping@0.3.9':
+    dependencies:
+      '@jridgewell/resolve-uri': 3.1.2
+      '@jridgewell/sourcemap-codec': 1.5.5
+
+  '@oxc-project/types@0.143.0': {}
+
+  '@poppinss/colors@4.1.6':
+    dependencies:
+      kleur: 4.1.5
+
+  '@poppinss/dumper@0.6.5':
+    dependencies:
+      '@poppinss/colors': 4.1.6
+      '@sindresorhus/is': 7.2.0
+      supports-color: 10.2.2
+
+  '@poppinss/exception@1.2.3': {}
+
+  '@rolldown/binding-android-arm64@1.2.3':
+    optional: true
+
+  '@rolldown/binding-darwin-arm64@1.2.3':
+    optional: true
+
+  '@rolldown/binding-darwin-x64@1.2.3':
+    optional: true
+
+  '@rolldown/binding-freebsd-x64@1.2.3':
+    optional: true
+
+  '@rolldown/binding-linux-arm-gnueabihf@1.2.3':
+    optional: true
+
+  '@rolldown/binding-linux-arm64-gnu@1.2.3':
+    optional: true
+
+  '@rolldown/binding-linux-arm64-musl@1.2.3':
+    optional: true
+
+  '@rolldown/binding-linux-ppc64-gnu@1.2.3':
+    optional: true
+
+  '@rolldown/binding-linux-s390x-gnu@1.2.3':
+    optional: true
+
+  '@rolldown/binding-linux-x64-gnu@1.2.3':
+    optional: true
+
+  '@rolldown/binding-linux-x64-musl@1.2.3':
+    optional: true
+
+  '@rolldown/binding-openharmony-arm64@1.2.3':
+    optional: true
+
+  '@rolldown/binding-win32-arm64-msvc@1.2.3':
+    optional: true
+
+  '@rolldown/binding-win32-x64-msvc@1.2.3':
+    optional: true
+
+  '@rolldown/pluginutils@1.0.1': {}
+
+  '@sindresorhus/is@7.2.0': {}
+
+  '@speed-highlight/core@1.2.23': {}
+
+  '@standard-schema/spec@1.1.0': {}
+
+  '@types/chai@5.2.3':
+    dependencies:
+      '@types/deep-eql': 4.0.2
+      assertion-error: 2.0.1
+
+  '@types/deep-eql@4.0.2': {}
+
+  '@types/estree@1.0.9': {}
+
+  '@types/node@26.2.0':
+    dependencies:
+      undici-types: 8.3.0
+
+  '@typescript/typescript-aix-ppc64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-darwin-arm64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-darwin-x64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-freebsd-arm64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-freebsd-x64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-linux-arm64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-linux-arm@7.0.2':
+    optional: true
+
+  '@typescript/typescript-linux-loong64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-linux-mips64el@7.0.2':
+    optional: true
+
+  '@typescript/typescript-linux-ppc64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-linux-riscv64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-linux-s390x@7.0.2':
+    optional: true
+
+  '@typescript/typescript-linux-x64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-netbsd-arm64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-netbsd-x64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-openbsd-arm64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-openbsd-x64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-sunos-x64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-win32-arm64@7.0.2':
+    optional: true
+
+  '@typescript/typescript-win32-x64@7.0.2':
+    optional: true
+
+  '@vitest/coverage-istanbul@4.1.10(supports-color@10.2.2)(vitest@4.1.10)':
+    dependencies:
+      '@babel/core': 7.29.7(supports-color@10.2.2)
+      '@istanbuljs/schema': 0.1.6
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+      istanbul-lib-coverage: 3.2.2
+      istanbul-lib-report: 3.0.1
+      istanbul-reports: 3.2.0
+      magicast: 0.5.4
+      obug: 2.1.4
+      tinyrainbow: 3.1.1
+      vitest: 4.1.10(@types/node@26.2.0)(@vitest/coverage-istanbul@4.1.10)(@vitest/coverage-v8@4.1.10)(vite@8.2.1(@types/node@26.2.0)(esbuild@0.28.1))
+    transitivePeerDependencies:
+      - supports-color
+
+  '@vitest/coverage-v8@4.1.10(vitest@4.1.10)':
+    dependencies:
+      '@bcoe/v8-coverage': 1.0.2
+      '@vitest/utils': 4.1.10
+      ast-v8-to-istanbul: 1.0.5
+      istanbul-lib-coverage: 3.2.2
+      istanbul-lib-report: 3.0.1
+      istanbul-reports: 3.2.0
+      magicast: 0.5.4
+      obug: 2.1.4
+      std-env: 4.2.0
+      tinyrainbow: 3.1.1
+      vitest: 4.1.10(@types/node@26.2.0)(@vitest/coverage-istanbul@4.1.10)(@vitest/coverage-v8@4.1.10)(vite@8.2.1(@types/node@26.2.0)(esbuild@0.28.1))
+    optional: true
+
+  '@vitest/expect@4.1.10':
+    dependencies:
+      '@standard-schema/spec': 1.1.0
+      '@types/chai': 5.2.3
+      '@vitest/spy': 4.1.10
+      '@vitest/utils': 4.1.10
+      chai: 6.2.2
+      tinyrainbow: 3.1.1
+
+  '@vitest/mocker@4.1.10(vite@8.2.1(@types/node@26.2.0)(esbuild@0.28.1))':
+    dependencies:
+      '@vitest/spy': 4.1.10
+      estree-walker: 3.0.3
+      magic-string: 0.30.21
+    optionalDependencies:
+      vite: 8.2.1(@types/node@26.2.0)(esbuild@0.28.1)
+
+  '@vitest/pretty-format@4.1.10':
+    dependencies:
+      tinyrainbow: 3.1.1
+
+  '@vitest/runner@4.1.10':
+    dependencies:
+      '@vitest/utils': 4.1.10
+      pathe: 2.0.3
+
+  '@vitest/snapshot@4.1.10':
+    dependencies:
+      '@vitest/pretty-format': 4.1.10
+      '@vitest/utils': 4.1.10
+      magic-string: 0.30.21
+      pathe: 2.0.3
+
+  '@vitest/spy@4.1.10': {}
+
+  '@vitest/utils@4.1.10':
+    dependencies:
+      '@vitest/pretty-format': 4.1.10
+      convert-source-map: 2.0.0
+      tinyrainbow: 3.1.1
+
+  assertion-error@2.0.1: {}
+
+  ast-v8-to-istanbul@1.0.5:
+    dependencies:
+      '@jridgewell/trace-mapping': 0.3.31
+      estree-walker: 3.0.3
+      js-tokens: 10.0.0
+    optional: true
+
+  baseline-browser-mapping@2.11.12: {}
+
+  blake3-wasm@2.1.5: {}
+
+  browserslist@4.28.7:
+    dependencies:
+      baseline-browser-mapping: 2.11.12
+      caniuse-lite: 1.0.30001809
+      electron-to-chromium: 1.5.402
+      node-releases: 2.0.53
+      update-browserslist-db: 1.3.0(browserslist@4.28.7)
+
+  caniuse-lite@1.0.30001809: {}
+
+  chai@6.2.2: {}
+
+  cjs-module-lexer@1.2.3: {}
+
+  convert-source-map@2.0.0: {}
+
+  cookie@1.1.1: {}
+
+  debug@4.4.3(supports-color@10.2.2):
+    dependencies:
+      ms: 2.1.3
+    optionalDependencies:
+      supports-color: 10.2.2
+
+  detect-libc@2.1.2: {}
+
+  electron-to-chromium@1.5.402: {}
+
+  error-stack-parser-es@1.0.5: {}
+
+  es-module-lexer@2.3.1: {}
+
+  esbuild@0.28.1:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.28.1
+      '@esbuild/android-arm': 0.28.1
+      '@esbuild/android-arm64': 0.28.1
+      '@esbuild/android-x64': 0.28.1
+      '@esbuild/darwin-arm64': 0.28.1
+      '@esbuild/darwin-x64': 0.28.1
+      '@esbuild/freebsd-arm64': 0.28.1
+      '@esbuild/freebsd-x64': 0.28.1
+      '@esbuild/linux-arm': 0.28.1
+      '@esbuild/linux-arm64': 0.28.1
+      '@esbuild/linux-ia32': 0.28.1
+      '@esbuild/linux-loong64': 0.28.1
+      '@esbuild/linux-mips64el': 0.28.1
+      '@esbuild/linux-ppc64': 0.28.1
+      '@esbuild/linux-riscv64': 0.28.1
+      '@esbuild/linux-s390x': 0.28.1
+      '@esbuild/linux-x64': 0.28.1
+      '@esbuild/netbsd-arm64': 0.28.1
+      '@esbuild/netbsd-x64': 0.28.1
+      '@esbuild/openbsd-arm64': 0.28.1
+      '@esbuild/openbsd-x64': 0.28.1
+      '@esbuild/openharmony-arm64': 0.28.1
+      '@esbuild/sunos-x64': 0.28.1
+      '@esbuild/win32-arm64': 0.28.1
+      '@esbuild/win32-ia32': 0.28.1
+      '@esbuild/win32-x64': 0.28.1
+
+  escalade@3.2.0: {}
+
+  estree-walker@3.0.3:
+    dependencies:
+      '@types/estree': 1.0.9
+
+  expect-type@1.4.0: {}
+
+  fdir@6.5.0(picomatch@4.0.5):
+    optionalDependencies:
+      picomatch: 4.0.5
+
+  fsevents@2.3.3:
+    optional: true
+
+  gensync@1.0.0-beta.2: {}
+
+  has-flag@4.0.0: {}
+
+  html-escaper@2.0.2: {}
+
+  istanbul-lib-coverage@3.2.2: {}
+
+  istanbul-lib-report@3.0.1:
+    dependencies:
+      istanbul-lib-coverage: 3.2.2
+      make-dir: 4.0.0
+      supports-color: 7.2.0
+
+  istanbul-reports@3.2.0:
+    dependencies:
+      html-escaper: 2.0.2
+      istanbul-lib-report: 3.0.1
+
+  js-tokens@10.0.0:
+    optional: true
+
+  js-tokens@4.0.0: {}
+
+  jsesc@3.1.0: {}
+
+  json5@2.2.3: {}
+
+  kleur@4.1.5: {}
+
+  lightningcss-android-arm64@1.33.0:
+    optional: true
+
+  lightningcss-darwin-arm64@1.33.0:
+    optional: true
+
+  lightningcss-darwin-x64@1.33.0:
+    optional: true
+
+  lightningcss-freebsd-x64@1.33.0:
+    optional: true
+
+  lightningcss-linux-arm-gnueabihf@1.33.0:
+    optional: true
+
+  lightningcss-linux-arm64-gnu@1.33.0:
+    optional: true
+
+  lightningcss-linux-arm64-musl@1.33.0:
+    optional: true
+
+  lightningcss-linux-x64-gnu@1.33.0:
+    optional: true
+
+  lightningcss-linux-x64-musl@1.33.0:
+    optional: true
+
+  lightningcss-win32-arm64-msvc@1.33.0:
+    optional: true
+
+  lightningcss-win32-x64-msvc@1.33.0:
+    optional: true
+
+  lightningcss@1.33.0:
+    dependencies:
+      detect-libc: 2.1.2
+    optionalDependencies:
+      lightningcss-android-arm64: 1.33.0
+      lightningcss-darwin-arm64: 1.33.0
+      lightningcss-darwin-x64: 1.33.0
+      lightningcss-freebsd-x64: 1.33.0
+      lightningcss-linux-arm-gnueabihf: 1.33.0
+      lightningcss-linux-arm64-gnu: 1.33.0
+      lightningcss-linux-arm64-musl: 1.33.0
+      lightningcss-linux-x64-gnu: 1.33.0
+      lightningcss-linux-x64-musl: 1.33.0
+      lightningcss-win32-arm64-msvc: 1.33.0
+      lightningcss-win32-x64-msvc: 1.33.0
+
+  lru-cache@5.1.1:
+    dependencies:
+      yallist: 3.1.1
+
+  magic-string@0.30.21:
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.5.5
+
+  magicast@0.5.4:
+    dependencies:
+      '@babel/parser': 7.29.8
+      '@babel/types': 7.29.8
+      source-map-js: 1.2.1
+
+  make-dir@4.0.0:
+    dependencies:
+      semver: 7.8.5
+
+  miniflare@5.20260801.1-alpha:
+    dependencies:
+      '@cspotcode/source-map-support': 0.8.1
+      sharp: 0.35.2
+      undici: 7.29.0
+      workerd: 1.20260801.1
+      ws: 8.21.0
+      youch: 4.1.0-beta.10
+    transitivePeerDependencies:
+      - bufferutil
+      - utf-8-validate
+
+  ms@2.1.3: {}
+
+  nanoid@3.3.18: {}
+
+  node-releases@2.0.53: {}
+
+  obug@2.1.4: {}
+
+  path-to-regexp@6.3.0: {}
+
+  pathe@2.0.3: {}
+
+  picocolors@1.1.1: {}
+
+  picomatch@4.0.5: {}
+
+  postcss@8.5.26:
+    dependencies:
+      nanoid: 3.3.18
+      picocolors: 1.1.1
+      source-map-js: 1.2.1
+
+  rolldown@1.2.3:
+    dependencies:
+      '@oxc-project/types': 0.143.0
+      '@rolldown/pluginutils': 1.0.1
+    optionalDependencies:
+      '@rolldown/binding-android-arm64': 1.2.3
+      '@rolldown/binding-darwin-arm64': 1.2.3
+      '@rolldown/binding-darwin-x64': 1.2.3
+      '@rolldown/binding-freebsd-x64': 1.2.3
+      '@rolldown/binding-linux-arm-gnueabihf': 1.2.3
+      '@rolldown/binding-linux-arm64-gnu': 1.2.3
+      '@rolldown/binding-linux-arm64-musl': 1.2.3
+      '@rolldown/binding-linux-ppc64-gnu': 1.2.3
+      '@rolldown/binding-linux-s390x-gnu': 1.2.3
+      '@rolldown/binding-linux-x64-gnu': 1.2.3
+      '@rolldown/binding-linux-x64-musl': 1.2.3
+      '@rolldown/binding-openharmony-arm64': 1.2.3
+      '@rolldown/binding-win32-arm64-msvc': 1.2.3
+      '@rolldown/binding-win32-x64-msvc': 1.2.3
+
+  semver@6.3.1: {}
+
+  semver@7.8.5: {}
+
+  sharp@0.35.2:
+    dependencies:
+      '@img/colour': 1.1.0
+      detect-libc: 2.1.2
+      semver: 7.8.5
+    optionalDependencies:
+      '@img/sharp-darwin-arm64': 0.35.2
+      '@img/sharp-darwin-x64': 0.35.2
+      '@img/sharp-freebsd-wasm32': 0.35.2
+      '@img/sharp-libvips-darwin-arm64': 1.3.1
+      '@img/sharp-libvips-darwin-x64': 1.3.1
+      '@img/sharp-libvips-linux-arm': 1.3.1
+      '@img/sharp-libvips-linux-arm64': 1.3.1
+      '@img/sharp-libvips-linux-ppc64': 1.3.1
+      '@img/sharp-libvips-linux-riscv64': 1.3.1
+      '@img/sharp-libvips-linux-s390x': 1.3.1
+      '@img/sharp-libvips-linux-x64': 1.3.1
+      '@img/sharp-libvips-linuxmusl-arm64': 1.3.1
+      '@img/sharp-libvips-linuxmusl-x64': 1.3.1
+      '@img/sharp-linux-arm': 0.35.2
+      '@img/sharp-linux-arm64': 0.35.2
+      '@img/sharp-linux-ppc64': 0.35.2
+      '@img/sharp-linux-riscv64': 0.35.2
+      '@img/sharp-linux-s390x': 0.35.2
+      '@img/sharp-linux-x64': 0.35.2
+      '@img/sharp-linuxmusl-arm64': 0.35.2
+      '@img/sharp-linuxmusl-x64': 0.35.2
+      '@img/sharp-webcontainers-wasm32': 0.35.2
+      '@img/sharp-win32-arm64': 0.35.2
+      '@img/sharp-win32-ia32': 0.35.2
+      '@img/sharp-win32-x64': 0.35.2
+
+  siginfo@2.0.0: {}
+
+  source-map-js@1.2.1: {}
+
+  stackback@0.0.2: {}
+
+  std-env@4.2.0: {}
+
+  supports-color@10.2.2: {}
+
+  supports-color@7.2.0:
+    dependencies:
+      has-flag: 4.0.0
+
+  tinybench@2.9.0: {}
+
+  tinyexec@1.3.0: {}
+
+  tinyglobby@0.2.17:
+    dependencies:
+      fdir: 6.5.0(picomatch@4.0.5)
+      picomatch: 4.0.5
+
+  tinyrainbow@3.1.1: {}
+
+  tslib@2.8.1:
+    optional: true
+
+  typescript@7.0.2:
+    optionalDependencies:
+      '@typescript/typescript-aix-ppc64': 7.0.2
+      '@typescript/typescript-darwin-arm64': 7.0.2
+      '@typescript/typescript-darwin-x64': 7.0.2
+      '@typescript/typescript-freebsd-arm64': 7.0.2
+      '@typescript/typescript-freebsd-x64': 7.0.2
+      '@typescript/typescript-linux-arm': 7.0.2
+      '@typescript/typescript-linux-arm64': 7.0.2
+      '@typescript/typescript-linux-loong64': 7.0.2
+      '@typescript/typescript-linux-mips64el': 7.0.2
+      '@typescript/typescript-linux-ppc64': 7.0.2
+      '@typescript/typescript-linux-riscv64': 7.0.2
+      '@typescript/typescript-linux-s390x': 7.0.2
+      '@typescript/typescript-linux-x64': 7.0.2
+      '@typescript/typescript-netbsd-arm64': 7.0.2
+      '@typescript/typescript-netbsd-x64': 7.0.2
+      '@typescript/typescript-openbsd-arm64': 7.0.2
+      '@typescript/typescript-openbsd-x64': 7.0.2
+      '@typescript/typescript-sunos-x64': 7.0.2
+      '@typescript/typescript-win32-arm64': 7.0.2
+      '@typescript/typescript-win32-x64': 7.0.2
+
+  undici-types@8.3.0: {}
+
+  undici@7.29.0: {}
+
+  unenv@2.0.0-rc.24:
+    dependencies:
+      pathe: 2.0.3
+
+  update-browserslist-db@1.3.0(browserslist@4.28.7):
+    dependencies:
+      browserslist: 4.28.7
+      escalade: 3.2.0
+      picocolors: 1.1.1
+
+  vite@8.2.1(@types/node@26.2.0)(esbuild@0.28.1):
+    dependencies:
+      lightningcss: 1.33.0
+      picomatch: 4.0.5
+      postcss: 8.5.26
+      rolldown: 1.2.3
+      tinyglobby: 0.2.17
+    optionalDependencies:
+      '@types/node': 26.2.0
+      esbuild: 0.28.1
+      fsevents: 2.3.3
+
+  vitest@4.1.10(@types/node@26.2.0)(@vitest/coverage-istanbul@4.1.10)(@vitest/coverage-v8@4.1.10)(vite@8.2.1(@types/node@26.2.0)(esbuild@0.28.1)):
+    dependencies:
+      '@vitest/expect': 4.1.10
+      '@vitest/mocker': 4.1.10(vite@8.2.1(@types/node@26.2.0)(esbuild@0.28.1))
+      '@vitest/pretty-format': 4.1.10
+      '@vitest/runner': 4.1.10
+      '@vitest/snapshot': 4.1.10
+      '@vitest/spy': 4.1.10
+      '@vitest/utils': 4.1.10
+      es-module-lexer: 2.3.1
+      expect-type: 1.4.0
+      magic-string: 0.30.21
+      obug: 2.1.4
+      pathe: 2.0.3
+      picomatch: 4.0.5
+      std-env: 4.2.0
+      tinybench: 2.9.0
+      tinyexec: 1.3.0
+      tinyglobby: 0.2.17
+      tinyrainbow: 3.1.1
+      vite: 8.2.1(@types/node@26.2.0)(esbuild@0.28.1)
+      why-is-node-running: 2.3.0
+    optionalDependencies:
+      '@types/node': 26.2.0
+      '@vitest/coverage-istanbul': 4.1.10(supports-color@10.2.2)(vitest@4.1.10)
+      '@vitest/coverage-v8': 4.1.10(vitest@4.1.10)
+    transitivePeerDependencies:
+      - msw
+
+  why-is-node-running@2.3.0:
+    dependencies:
+      siginfo: 2.0.0
+      stackback: 0.0.2
+
+  workerd@1.20260801.1:
+    optionalDependencies:
+      '@cloudflare/workerd-darwin-64': 1.20260801.1
+      '@cloudflare/workerd-darwin-arm64': 1.20260801.1
+      '@cloudflare/workerd-linux-64': 1.20260801.1
+      '@cloudflare/workerd-linux-arm64': 1.20260801.1
+      '@cloudflare/workerd-windows-64': 1.20260801.1
+
+  wrangler@4.120.0(@cloudflare/workers-types@5.20260804.1):
+    dependencies:
+      '@cloudflare/kv-asset-handler': 0.5.0
+      '@cloudflare/unenv-preset': 2.16.1(unenv@2.0.0-rc.24)(workerd@1.20260801.1)
+      blake3-wasm: 2.1.5
+      esbuild: 0.28.1
+      miniflare: 5.20260801.1-alpha
+      path-to-regexp: 6.3.0
+      unenv: 2.0.0-rc.24
+      workerd: 1.20260801.1
+    optionalDependencies:
+      '@cloudflare/workers-types': 5.20260804.1
+      fsevents: 2.3.3
+    transitivePeerDependencies:
+      - bufferutil
+      - utf-8-validate
+
+  ws@8.21.0: {}
+
+  yallist@3.1.1: {}
+
+  youch-core@0.3.3:
+    dependencies:
+      '@poppinss/exception': 1.2.3
+      error-stack-parser-es: 1.0.5
+
+  youch@4.1.0-beta.10:
+    dependencies:
+      '@poppinss/colors': 4.1.6
+      '@poppinss/dumper': 0.6.5
+      '@speed-highlight/core': 1.2.23
+      cookie: 1.1.1
+      youch-core: 0.3.3
+
+  zod@4.4.3: {}
diff --git a/backend/pnpm-workspace.yaml b/backend/pnpm-workspace.yaml
new file mode 100644
index 0000000..29e69ab
--- /dev/null
+++ b/backend/pnpm-workspace.yaml
@@ -0,0 +1,7 @@
+packages:
+  - community-contracts
+  - community-api
+allowBuilds:
+  esbuild: true
+  workerd: true
+confirmModulesPurge: false
diff --git a/backend/scripts/secret-scan.mjs b/backend/scripts/secret-scan.mjs
new file mode 100644
index 0000000..1106f9b
--- /dev/null
+++ b/backend/scripts/secret-scan.mjs
@@ -0,0 +1,109 @@
+// Last check before anything reaches GitHub. Intended to run from the pre-push hook in
+// .githooks/pre-push, not from CI: by the time CI sees a commit the secret is already published,
+// and a red build cannot unpublish it.
+//
+// Scope is every file Git tracks, resolved from the repository root rather than from this script's
+// parent. An earlier version walked `backend/` only, which silently excluded src/, tools/, tests/,
+// assets/ and the workflow files. Asking Git for the file list also means ignored working files -
+// .dev.vars, .env.production, wrangler.production.jsonc - are never read, so the real secrets on
+// this machine cannot produce a finding and train someone to skip the hook.
+//
+// Known gap: this looks at the working tree, not at history. A secret that was committed and then
+// deleted still ships in the objects being pushed. Removing that needs a history rewrite, which is
+// not something a hook should attempt.
+
+import { readFile } from "node:fs/promises";
+import { execFileSync } from "node:child_process";
+import path from "node:path";
+import process from "node:process";
+
+const root = execFileSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
+
+/** Generated, machine-written, or the scanner's own pattern list. */
+const ignoredFiles = new Set(["pnpm-lock.yaml", "secret-scan.mjs"]);
+
+/** Names whose assigned value is a credential in every form this repository writes them. */
+const secretNames = [
+  "LOCAL_AUTH_SECRET",
+  "AUTH_SIGNING_SECRET",
+  "STEAM_API_KEY",
+  "R2_ACCESS_KEY_ID",
+  "R2_SECRET_ACCESS_KEY",
+  "CLOUDFLARE_API_TOKEN",
+  "CF_API_TOKEN",
+  "CF_ACCESS_CLIENT_ID",
+  "CF_ACCESS_CLIENT_SECRET",
+].join("|");
+
+// Both spellings the repository can produce: `NAME=value` in .dev.vars and shell, and
+// `"NAME": "value"` in the wrangler configs and any JSON that gets pasted into an example file.
+const assignmentForms = [
+  new RegExp(String.raw`\b(?:${secretNames})\s*=\s*"?([^\s"'\r\n]+)`, "gi"),
+  new RegExp(String.raw`"(?:${secretNames})"\s*:\s*"([^"\r\n]+)"`, "gi"),
+];
+
+/** Self-identifying credentials, where the shape alone is the finding. */
+const literalPatterns = [
+  ["private key", /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/],
+  ["AWS-style access key", /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/],
+  ["GitHub token", /\bgh(?:p|o|u|s|r)_[A-Za-z0-9]{30,}\b/],
+  ["GitHub fine-grained token", /\bgithub_pat_[A-Za-z0-9_]{60,}\b/],
+  ["Slack token", /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/],
+  ["Cloudflare Global API key", /\b[a-f0-9]{37}\b/],
+];
+
+/**
+ * Distinguishes a real credential from the placeholders the example files are supposed to contain.
+ *
+ * Generated secrets here are base64 or hex over random bytes, so they mix character classes.
+ * Placeholders are English written in one case: `<generate-a-local-secret...>`,
+ * `replace-with-your-token`. Requiring two of upper/lower/digit rejects those without needing a
+ * list of placeholder spellings to keep up to date.
+ */
+function looksLikeSecret(value) {
+  if (value.length < 24) return false;
+  if (/^[<{$%]/.test(value) || value.includes("${")) return false;
+  if (!/^[A-Za-z0-9+/_=-]+$/.test(value)) return false;
+  if (/^[a-f0-9]{32,}$/i.test(value)) return true;
+  const classes = [/[A-Z]/, /[a-z]/, /[0-9]/].filter((pattern) => pattern.test(value)).length;
+  return classes >= 2;
+}
+
+function scan(relative, text, findings) {
+  for (const [label, pattern] of literalPatterns) {
+    if (pattern.test(text)) findings.push(`${relative}: ${label}`);
+  }
+  for (const pattern of assignmentForms) {
+    pattern.lastIndex = 0;
+    for (const match of text.matchAll(pattern)) {
+      if (looksLikeSecret(match[1] ?? "")) findings.push(`${relative}: assigned secret value`);
+    }
+  }
+}
+
+const tracked = execFileSync("git", ["-C", root, "ls-files", "-z"], {
+  encoding: "utf8",
+  maxBuffer: 64 * 1024 * 1024,
+})
+  .split("\0")
+  .filter((entry) => entry !== "");
+
+const findings = [];
+for (const relative of tracked) {
+  if (ignoredFiles.has(path.basename(relative))) continue;
+  const text = await readFile(path.join(root, relative), "utf8").catch(() => null);
+  // Unreadable, deleted since `ls-files`, or binary - a NUL byte means the pattern list cannot say
+  // anything useful about it anyway.
+  if (text === null || text.includes("\0")) continue;
+  scan(relative, text, findings);
+}
+
+if (findings.length > 0) {
+  console.error(
+    `Potential secrets found in ${findings.length} place(s). Do not push until these are resolved:\n` +
+      [...new Set(findings)].join("\n"),
+  );
+  process.exitCode = 1;
+} else {
+  console.log(`Secret scan passed (${tracked.length} tracked files).`);
+}
diff --git a/backend/tsconfig.base.json b/backend/tsconfig.base.json
new file mode 100644
index 0000000..a6b574e
--- /dev/null
+++ b/backend/tsconfig.base.json
@@ -0,0 +1,18 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "exactOptionalPropertyTypes": true,
+    "noImplicitOverride": true,
+    "noFallthroughCasesInSwitch": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "useUnknownInCatchVariables": true,
+    "verbatimModuleSyntax": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true
+  }
+}
diff --git a/installCurrentVersion.ps1 b/installCurrentVersion.ps1
deleted file mode 100644
index 3969d7d..0000000
--- a/installCurrentVersion.ps1
+++ /dev/null
@@ -1,281 +0,0 @@
-<#
-.SYNOPSIS
-    Installs Surgeon Simulator 2 build 1.3.7, BepInEx, and SS2 Revive.
-
-.DESCRIPTION
-    Steam serves 1.5.x, which SS2 Revive cannot work on - that build removed the netcode the mod
-    restores. This downloads 1.3.7 from Steam's depot for an account that owns the game, into a
-    self-contained folder that leaves your Steam copy alone.
-
-    DepotDownloader prompts for the password and Steam Guard code itself; nothing about your
-    credentials passes through this script.
-
-    The mod is fetched from the latest GitHub release. If there is not one yet, or GitHub cannot be
-    reached, the game and BepInEx are still installed and the script says what to do by hand.
-
-.PARAMETER SteamUsername
-    Steam login name. Prompted for when not given.
-
-.PARAMETER InstallDirectory
-    Where to install. Prompted for when not given.
-
-.PARAMETER NoPause
-    Do not wait for a keypress at the end. For unattended runs.
-
-.EXAMPLE
-    .\installCurrentVersion.ps1
-#>
-[CmdletBinding()]
-param(
-    [string]$SteamUsername,
-    [string]$InstallDirectory,
-    [switch]$NoPause
-)
-
-Set-StrictMode -Version Latest
-$ErrorActionPreference = 'Stop'
-
-$InstallerVersion = '4.0'
-
-# Exact Surgeon Simulator 2 Steam depot build.
-$AppId    = '774791'
-$DepotId  = '774793'
-$Manifest = '5729349529999704019'
-$GameExe  = 'Surgeon Simulator 2.exe'
-
-$BuildFolderName = 'Surgeon Simulator 2 - 1.3.7'
-
-# The x64 build, pinned. The 32-bit one installs without complaining and then loads nothing at
-# all, which is a miserable thing to debug.
-$BepInExVersion = '5.4.23.2'
-$BepInExUrl     = "https://github.com/BepInEx/BepInEx/releases/download/v$BepInExVersion/BepInEx_win_x64_$BepInExVersion.zip"
-
-$ModRepo = 'macery12/SS2Revive'
-
-$UserAgent = @{ 'User-Agent' = "SS2Revive-Installer/$InstallerVersion" }
-
-$InstallerDirectory = if ($PSScriptRoot) { $PSScriptRoot } else { (Get-Location).Path }
-$ToolRoot = Join-Path $InstallerDirectory '_tools\DepotDownloader'
-$ToolExe  = Join-Path $ToolRoot 'DepotDownloader.exe'
-
-# ---------------------------------------------------------------------------- helpers
-
-function Write-Step {
-    param([Parameter(Mandatory = $true)][string]$Message)
-    Write-Host "`n==> $Message" -ForegroundColor Cyan
-}
-
-function Wait-ForClose {
-    if ($NoPause) { return }
-    Write-Host ''
-    # Guarded: a redirected or closed stdin must not turn "finished" into a crash.
-    try { Read-Host 'Press Enter to close' | Out-Null } catch { }
-}
-
-<#
-    Downloads a zip and copies its payload into $Destination.
-
-    All three things this script installs arrive the same way, and the only thing that differs is
-    a file that proves the extraction worked. $Marker is that file: it is looked for at the root
-    first, then anywhere below it, so a release that grew or lost a wrapper folder still installs
-    rather than silently copying nothing.
-#>
-function Install-RemoteZip {
-    param(
-        [Parameter(Mandatory = $true)][string]$Uri,
-        [Parameter(Mandatory = $true)][string]$Marker,
-        [Parameter(Mandatory = $true)][string]$Destination
-    )
-
-    $staging = Join-Path $env:TEMP ("ss2revive-" + [System.Guid]::NewGuid().ToString('N'))
-    $zip     = Join-Path $staging 'download.zip'
-    $extract = Join-Path $staging 'extracted'
-
-    New-Item -ItemType Directory -Path $staging -Force | Out-Null
-
-    try {
-        Invoke-WebRequest -Uri $Uri -OutFile $zip -Headers $UserAgent
-        Expand-Archive -LiteralPath $zip -DestinationPath $extract -Force
-
-        $payload = $extract
-        if (-not (Test-Path -LiteralPath (Join-Path $payload $Marker))) {
-            $found = Get-ChildItem -LiteralPath $extract -Filter $Marker -Recurse -File |
-                Select-Object -First 1
-
-            if (-not $found) { throw "$Marker was not found in the archive from $Uri" }
-            $payload = $found.Directory.FullName
-        }
-
-        New-Item -ItemType Directory -Path $Destination -Force | Out-Null
-        Get-ChildItem -LiteralPath $payload -Force | ForEach-Object {
-            Copy-Item -LiteralPath $_.FullName -Destination $Destination -Recurse -Force
-        }
-    }
-    finally {
-        Remove-Item -LiteralPath $staging -Recurse -Force -ErrorAction SilentlyContinue
-    }
-}
-
-<#
-    Finds the download URL of one asset on a repository's newest release.
-
-    GitHub's releases/latest is the newest published release, and it skips drafts and
-    pre-releases - so this always lands on the current version without the version being named
-    anywhere in this script.
-
-    $Prefer is not a nicety. DepotDownloader publishes one zip per platform and the first one
-    alphabetically is a Linux build, so "any zip" would install something that cannot run here.
-    $AllowAnyZip relaxes that for our own releases, which carry a single file.
-#>
-function Get-LatestReleaseZipUrl {
-    param(
-        [Parameter(Mandatory = $true)][string]$Repo,
-        [Parameter(Mandatory = $true)][string]$Prefer,
-        [switch]$AllowAnyZip
-    )
-
-    $headers = $UserAgent + @{ 'Accept' = 'application/vnd.github+json' }
-    $release = Invoke-RestMethod -Uri "https://api.github.com/repos/$Repo/releases/latest" -Headers $headers
-
-    $zips = @(@($release.assets) | Where-Object { $_.name -like '*.zip' })
-    if ($zips.Count -eq 0) { throw "release $($release.tag_name) has no .zip attached" }
-
-    $asset = $zips | Where-Object { $_.name -like $Prefer } | Select-Object -First 1
-    if (-not $asset -and $AllowAnyZip) { $asset = $zips[0] }
-    if (-not $asset) {
-        throw "release $($release.tag_name) has no asset matching '$Prefer' (found: " +
-              (($zips | ForEach-Object { $_.name }) -join ', ') + ")"
-    }
-
-    return [pscustomobject]@{
-        Tag  = $release.tag_name
-        Name = $asset.name
-        Url  = $asset.browser_download_url
-    }
-}
-
-# ---------------------------------------------------------------------------- install
-
-try {
-    Write-Host "SS2 Revive installer V$InstallerVersion" -ForegroundColor Green
-    Write-Host "Surgeon Simulator 2 build 1.3.7  (app $AppId, depot $DepotId)"
-
-    if ([string]::IsNullOrWhiteSpace($InstallDirectory)) {
-        $default = Join-Path $InstallerDirectory $BuildFolderName
-        Write-Host ''
-        Write-Host 'Where should the game be installed?' -ForegroundColor Cyan
-        Write-Host "Press Enter for: $default" -ForegroundColor DarkGray
-
-        $answer = Read-Host 'Install folder'
-
-        # Explorer's "Copy as path" hands over a quoted string.
-        $InstallDirectory = if ([string]::IsNullOrWhiteSpace($answer)) {
-            $default
-        }
-        else {
-            $answer.Trim().Trim('"')
-        }
-    }
-
-    $InstallDirectory = [System.IO.Path]::GetFullPath($InstallDirectory)
-    Write-Host "Installing to: $InstallDirectory"
-
-    if ([string]::IsNullOrWhiteSpace($SteamUsername)) {
-        $SteamUsername = Read-Host 'Steam login name of the account that owns Surgeon Simulator 2'
-    }
-    if ([string]::IsNullOrWhiteSpace($SteamUsername)) {
-        throw 'A Steam account login name is required.'
-    }
-
-    if (-not (Test-Path -LiteralPath $ToolExe)) {
-        Write-Step 'Downloading DepotDownloader'
-        # The self-contained Windows x64 build, so there is no .NET runtime to install first.
-        $tool = Get-LatestReleaseZipUrl -Repo 'SteamRE/DepotDownloader' -Prefer '*windows-x64*'
-        Write-Host "$($tool.Name) from $($tool.Tag)" -ForegroundColor DarkGray
-        Install-RemoteZip -Uri $tool.Url -Marker 'DepotDownloader.exe' -Destination $ToolRoot
-    }
-
-    Write-Step 'Downloading Surgeon Simulator 2 1.3.7'
-    Write-Host 'DepotDownloader will ask for your Steam password and Steam Guard code.' -ForegroundColor Yellow
-    Write-Host 'They are handled by that tool and are not saved by this script.' -ForegroundColor Yellow
-
-    New-Item -ItemType Directory -Path $InstallDirectory -Force | Out-Null
-
-    & $ToolExe -app $AppId -depot $DepotId -manifest $Manifest `
-               -username $SteamUsername -remember-password `
-               -dir $InstallDirectory -validate
-    if ($LASTEXITCODE -ne 0) { throw "DepotDownloader exited with code $LASTEXITCODE." }
-
-    $exe = Get-ChildItem -LiteralPath $InstallDirectory -Filter $GameExe -Recurse -File |
-        Select-Object -First 1
-    if (-not $exe) { throw "The download finished, but '$GameExe' was not found." }
-
-    $gameFolder = $exe.Directory.FullName
-
-    # Without this, SteamAPI.Init has no app id to resolve outside a Steam launch, fails, and the
-    # game stops at "Authentication Failed: Platform Authentication Error". Written once.
-    $appIdFile = Join-Path $gameFolder 'steam_appid.txt'
-    if (-not (Test-Path -LiteralPath $appIdFile)) {
-        [System.IO.File]::WriteAllText($appIdFile, $AppId)
-    }
-
-    Write-Step "Installing BepInEx $BepInExVersion (x64)"
-    Install-RemoteZip -Uri $BepInExUrl -Marker 'winhttp.dll' -Destination $gameFolder
-
-    $pluginFolder = Join-Path $gameFolder 'BepInEx\plugins\SS2Revive'
-
-    Write-Step 'Installing SS2 Revive'
-    $modInstalled = $false
-    try {
-        # Whatever the newest release carries. The zip is named for its version, so the pattern
-        # matches the shape rather than a number this script would otherwise have to be kept in
-        # step with; -AllowAnyZip covers a release that named it something else entirely.
-        $mod = Get-LatestReleaseZipUrl -Repo $ModRepo -Prefer 'SS2Revive-*.zip' -AllowAnyZip
-        Install-RemoteZip -Uri $mod.Url -Marker 'SS2Revive.dll' -Destination $pluginFolder
-        $modInstalled = $true
-        Write-Host "Installed SS2 Revive $($mod.Tag) ($($mod.Name))." -ForegroundColor Green
-    }
-    catch {
-        # Not fatal. A playable 1.3.7 with BepInEx on it is most of the work, and the mod is three
-        # files the player can drop in themselves once a release exists.
-        New-Item -ItemType Directory -Path $pluginFolder -Force | Out-Null
-        Write-Host "Could not fetch a release from github.com/$ModRepo" -ForegroundColor Yellow
-        Write-Host "  $($_.Exception.Message)" -ForegroundColor DarkGray
-        Write-Host 'The game and BepInEx are installed; only the mod is missing.' -ForegroundColor Yellow
-    }
-
-    $launcher = Join-Path $InstallDirectory 'Launch Surgeon Simulator 2 - 1.3.7.cmd'
-    @(
-        '@echo off',
-        'cd /d "' + $gameFolder + '"',
-        'start "" "' + $exe.FullName + '"'
-    ) | Set-Content -LiteralPath $launcher -Encoding ASCII
-
-    Write-Step 'Done'
-    Write-Host "Game:     $gameFolder" -ForegroundColor Green
-    Write-Host "Launcher: $launcher" -ForegroundColor Green
-
-    if ($modInstalled) {
-        Write-Host ''
-        Write-Host 'Run the launcher to play. Steam must be running and signed in.' -ForegroundColor Cyan
-        Write-Host 'To check the mod loaded, open BepInEx\LogOutput.log and look for' -ForegroundColor Cyan
-        Write-Host '[Info   :SS2 Revive].' -ForegroundColor Cyan
-    }
-    else {
-        Write-Host ''
-        Write-Host 'To finish, put SS2Revive.dll, SS2Revive_Data.dll and the newsfeed folder in:' -ForegroundColor Cyan
-        Write-Host "  $pluginFolder" -ForegroundColor White
-        Write-Host 'Both DLLs must sit side by side in that one folder.' -ForegroundColor Cyan
-    }
-
-    Write-Host ''
-    Write-Host 'This install is separate from Steam. Steam still has 1.5.x and will not' -ForegroundColor Yellow
-    Write-Host 'touch or update this copy.' -ForegroundColor Yellow
-
-    Wait-ForClose
-}
-catch {
-    Write-Host "`nINSTALL FAILED: $($_.Exception.Message)" -ForegroundColor Red
-    Wait-ForClose
-    exit 1
-}
diff --git a/pack.ps1 b/pack.ps1
index 5254896..6c49915 100644
--- a/pack.ps1
+++ b/pack.ps1
@@ -6,7 +6,7 @@
     Produces dist\SS2Revive-<version>.zip holding exactly what the README tells a player to copy
     into BepInEx\plugins\SS2Revive: both DLLs and the newsfeed folder.
 
-    installCurrentVersion.ps1 finds it by asking GitHub for the latest release and taking the
+    SS2Revive Setup finds it by asking GitHub for the latest release and taking the
     SS2Revive-*.zip attached to it, so the version in the filename does not have to be known
     ahead of time - only the shape of the name.
 
@@ -146,7 +146,7 @@ try {
     Write-Host ""
     Write-Host "$zip ($size KB)" -ForegroundColor Green
     Write-Host "Its contents go in BepInEx\plugins\SS2Revive\." -ForegroundColor Cyan
-    Write-Host "Attach it to a v$version release as-is; installCurrentVersion.ps1 finds it by" -ForegroundColor Cyan
+    Write-Host "Attach it to a v$version release as-is; SS2Revive Setup finds it by" -ForegroundColor Cyan
     Write-Host "asking GitHub for the newest release and taking its SS2Revive-*.zip." -ForegroundColor Cyan
 }
 catch {
diff --git a/src/SS2Revive/CommunityCatalogClient.cs b/src/SS2Revive/CommunityCatalogClient.cs
new file mode 100644
index 0000000..24c9210
--- /dev/null
+++ b/src/SS2Revive/CommunityCatalogClient.cs
@@ -0,0 +1,536 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Net;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using SS2ReviveData;
+
+namespace SS2Revive
+{
+    /// <summary>
+    /// Read-only client for the public community-map catalogue. Browsing and downloading published
+    /// maps intentionally require no account; authenticated upload is a separate API boundary.
+    /// </summary>
+    internal static class CommunityCatalogClient
+    {
+        internal const string KeyPrefix = "ss2revive-catalog/";
+
+        private const int RequestTimeoutMs = 10000;
+        private const long MaxCacheBytes = 128L * 1024 * 1024;
+        private const int MaxCacheFiles = 128;
+
+        private static readonly object Gate = new object();
+        private static readonly object ObjectCacheGate = new object();
+        private static readonly Dictionary<string, int> ConfirmedPublished =
+            new Dictionary<string, int>(StringComparer.OrdinalIgnoreCase);
+        private static readonly TimeSpan RefreshInterval = TimeSpan.FromMinutes(10);
+
+        private static UgcStore _store;
+        private static Uri _catalogUri;
+        private static Uri _objectsBaseUri;
+        private static string _catalogCacheFile;
+        private static string _objectCacheDirectory;
+        private static CommunityCatalog _catalog;
+        private static bool _refreshing;
+        private static DateTime _lastRefreshUtc = DateTime.MinValue;
+
+        internal static bool Enabled => _catalogUri != null;
+
+        internal static void ForceRefresh()
+        {
+            lock (Gate) _lastRefreshUtc = DateTime.MinValue;
+            EnsureRefresh(false);
+        }
+
+        internal static void Initialise(UgcStore store, string configuredUrl)
+        {
+            _store = store;
+            lock (Gate) ConfirmedPublished.Clear();
+            Uri catalogUri;
+            if (store == null || string.IsNullOrWhiteSpace(configuredUrl)) return;
+            if (!Uri.TryCreate(configuredUrl.Trim(), UriKind.Absolute, out catalogUri)
+                || !string.Equals(catalogUri.Scheme, Uri.UriSchemeHttps,
+                                  StringComparison.OrdinalIgnoreCase)
+                || !string.IsNullOrEmpty(catalogUri.UserInfo)
+                || !string.IsNullOrEmpty(catalogUri.Fragment)
+                || !string.IsNullOrEmpty(catalogUri.Query))
+            {
+                Plugin.Log.LogWarning("Community catalogue URL must be an absolute HTTPS URL "
+                                      + "without a query or fragment; community browsing is disabled.");
+                return;
+            }
+
+            try
+            {
+                _catalogUri = catalogUri;
+                _objectsBaseUri = new Uri(catalogUri, ".");
+                var root = Path.GetDirectoryName(store.Root) ?? store.Root;
+                var cacheRoot = Path.Combine(root, "catalog-cache");
+                _objectCacheDirectory = Path.Combine(cacheRoot, "objects");
+                Directory.CreateDirectory(_objectCacheDirectory);
+                _catalogCacheFile = Path.Combine(cacheRoot,
+                    "catalog-" + Sha256Hex(Encoding.UTF8.GetBytes(catalogUri.AbsoluteUri)).Substring(0, 16)
+                    + ".json");
+                Plugin.Log.LogInfo("Community catalogue enabled from " + catalogUri.GetLeftPart(UriPartial.Path));
+                EnsureRefresh(true);
+            }
+            catch (Exception ex)
+            {
+                _catalogUri = null;
+                _objectsBaseUri = null;
+                Plugin.Log.LogWarning("Could not initialise the community catalogue: " + ex.Message);
+            }
+        }
+
+        /// <summary>
+        /// Returns every matching entry. Paging happens after local and remote results are merged,
+        /// otherwise a page from each source would produce duplicates and incorrect page counts.
+        /// </summary>
+        internal static List<CommunityCatalogEntry> Search(UgcQuery query)
+        {
+            EnsureRefresh(false);
+            CommunityCatalog snapshot;
+            lock (Gate) snapshot = _catalog;
+            var result = snapshot == null
+                ? new List<CommunityCatalogEntry>()
+                : snapshot.Search(query);
+            for (var i = result.Count - 1; i >= 0; i--)
+            {
+                if (CommunityCatalog.CompatibilityError(result[i], Plugin.PluginVersion) != null)
+                    result.RemoveAt(i);
+            }
+            return result;
+        }
+
+        internal static void NotePublished(string mapId, int revision)
+        {
+            Guid parsed;
+            if (!Guid.TryParse(mapId, out parsed) || revision < 1) return;
+            lock (Gate)
+            {
+                int current;
+                var id = parsed.ToString();
+                if (!ConfirmedPublished.TryGetValue(id, out current) || revision > current)
+                    ConfirmedPublished[id] = revision;
+            }
+        }
+
+        internal static void NoteRemoved(string mapId)
+        {
+            if (string.IsNullOrEmpty(mapId)) return;
+            lock (Gate)
+            {
+                ConfirmedPublished.Remove(mapId);
+                if (_catalog != null)
+                    for (var i = _catalog.Entries.Count - 1; i >= 0; i--)
+                        if (string.Equals(_catalog.Entries[i].Id, mapId,
+                                          StringComparison.OrdinalIgnoreCase))
+                            _catalog.Entries.RemoveAt(i);
+            }
+            UgcBackend.MarkCommunityUnpublished(mapId);
+            Dispatcher.NextFrame(SharingPatches.RefreshCurrentCreateScreen);
+            ForceRefresh();
+        }
+
+        internal static List<CommunityCatalogEntry> SearchOwned(UgcQuery query, string creatorId)
+        {
+            EnsureRefresh(false);
+            CommunityCatalog snapshot;
+            lock (Gate) snapshot = _catalog;
+            var result = snapshot == null
+                ? new List<CommunityCatalogEntry>()
+                : snapshot.Search(query);
+            for (var i = result.Count - 1; i >= 0; i--)
+            {
+                if (string.IsNullOrEmpty(creatorId) || result[i].CreatorIds == null
+                    || !result[i].CreatorIds.Contains(creatorId)
+                    || CommunityCatalog.CompatibilityError(result[i], Plugin.PluginVersion) != null)
+                    result.RemoveAt(i);
+            }
+            return result;
+        }
+
+        internal static bool IsPublishedMap(string mapId)
+        {
+            if (string.IsNullOrEmpty(mapId)) return false;
+            lock (Gate)
+            {
+                if (ConfirmedPublished.ContainsKey(mapId)) return true;
+                if (_catalog == null) return false;
+                for (var i = 0; i < _catalog.Entries.Count; i++)
+                    if (string.Equals(_catalog.Entries[i].Id, mapId,
+                                      StringComparison.OrdinalIgnoreCase)) return true;
+                return false;
+            }
+        }
+
+        internal static string ContentKey(CommunityCatalogEntry entry) =>
+            KeyPrefix + entry.Id + "/" + entry.Revision + "/bundle";
+
+        internal static string ThumbnailKey(CommunityCatalogEntry entry) =>
+            string.IsNullOrEmpty(entry.ThumbnailKey)
+                ? string.Empty
+                : KeyPrefix + entry.Id + "/" + entry.Revision + "/thumbnail";
+
+        internal static bool OwnsKey(string key) =>
+            !string.IsNullOrEmpty(key) && key.StartsWith(KeyPrefix, StringComparison.Ordinal);
+
+        /// <summary>Starts a bounded worker-thread fetch and always completes on Unity's thread.</summary>
+        internal static void ReadKey(string key, Action<byte[]> succeeded, Action failed)
+        {
+            CommunityCatalogEntry entry;
+            bool thumbnail;
+            if (!TryResolveKey(key, out entry, out thumbnail))
+            {
+                Dispatcher.NextFrame(failed);
+                return;
+            }
+
+            ThreadPool.QueueUserWorkItem(delegate
+            {
+                byte[] result = null;
+                try
+                {
+                    result = thumbnail ? ReadThumbnail(entry) : ReadAndInstallBundle(entry);
+                }
+                catch (Exception ex)
+                {
+                    Plugin.Log.LogWarning("Community map download failed for " + entry.Id + ": "
+                                          + ex.Message);
+                }
+
+                Dispatcher.NextFrame(() =>
+                {
+                    if (result != null)
+                    {
+                        if (succeeded != null) succeeded(result);
+                    }
+                    else if (failed != null) failed();
+                });
+            });
+        }
+
+        private static byte[] ReadThumbnail(CommunityCatalogEntry entry)
+        {
+            var bytes = ReadObject(entry.ThumbnailKey, entry.ThumbnailSizeBytes,
+                                   entry.ThumbnailSha256, LevelBundle.MaxImageBytes, ".image");
+            if (!LevelBundle.IsSafeGameImage(bytes))
+                throw new InvalidDataException("The thumbnail is not a safe game image.");
+            return bytes;
+        }
+
+        private static byte[] ReadAndInstallBundle(CommunityCatalogEntry entry)
+        {
+            var incompatibility = CommunityCatalog.CompatibilityError(entry, Plugin.PluginVersion);
+            if (incompatibility != null) throw new InvalidDataException(incompatibility);
+            var bytes = ReadObject(entry.BundleKey, entry.SizeBytes, entry.Sha256,
+                                   LevelBundle.MaxBundleBytes, ".bundle");
+            string error;
+            var bundle = LevelBundle.Unpack(bytes, out error);
+            if (bundle == null) throw new InvalidDataException(error ?? "The level bundle is invalid.");
+            if (!string.Equals(bundle.Id, entry.Id, StringComparison.OrdinalIgnoreCase)
+                || bundle.ContentVersion != entry.Revision || bundle.ClientVersion != entry.ClientVersion)
+            {
+                throw new InvalidDataException("The bundle does not match its catalogue entry.");
+            }
+
+            var prototype = new UgcLevelRecord
+            {
+                Id = bundle.Id,
+                Title = bundle.Title,
+                Description = bundle.Description,
+                CreatorIds = new List<string>(bundle.CreatorIds),
+                Tags = new List<string>(bundle.Tags),
+                CreatedAtMs = bundle.CreatedAtMs,
+                Configurations = bundle.Configurations,
+                Validations = bundle.Validations,
+            };
+            UgcInstallOutcome outcome;
+            var installed = _store.Install(prototype, bundle.ClientVersion, bundle.ContentVersion,
+                                           bundle.ExportedAtMs, bundle.Content, bundle.ContentImage,
+                                           bundle.Thumbnail, out outcome, out error);
+            if (installed == null || outcome == UgcInstallOutcome.Conflict
+                                  || outcome == UgcInstallOutcome.Failed)
+            {
+                throw new InvalidDataException(error ?? "The level could not be installed.");
+            }
+
+            var latest = installed.LatestContent();
+            var content = latest == null ? null : _store.ReadKey(latest.Key);
+            if (content == null) throw new IOException("The installed level data could not be read back.");
+            Plugin.Log.LogInfo("Community map " + entry.Id + " is ready (" + outcome + ").");
+            return content;
+        }
+
+        private static byte[] ReadObject(string objectKey, long expectedBytes, string expectedSha,
+                                         int maximumBytes, string suffix)
+        {
+            Uri uri;
+            if (!TryResolveObjectUri(objectKey, out uri))
+                throw new InvalidDataException("The catalogue contains an unsafe object key.");
+
+            var cached = Path.Combine(_objectCacheDirectory, expectedSha + suffix);
+            byte[] bytes;
+            lock (ObjectCacheGate) bytes = ReadCacheFile(cached, maximumBytes);
+            if (IsExpected(bytes, expectedBytes, expectedSha)) return bytes;
+
+            bytes = Download(uri, maximumBytes);
+            if (!IsExpected(bytes, expectedBytes, expectedSha))
+                throw new InvalidDataException("The downloaded object does not match its size or SHA-256.");
+            lock (ObjectCacheGate)
+            {
+                var wonRace = ReadCacheFile(cached, maximumBytes);
+                if (IsExpected(wonRace, expectedBytes, expectedSha)) return wonRace;
+                WriteAtomic(cached, bytes);
+                EvictObjectCache();
+            }
+            return bytes;
+        }
+
+        private static bool TryResolveObjectUri(string key, out Uri uri)
+        {
+            uri = null;
+            if (_objectsBaseUri == null || !CommunityCatalog.IsSafeObjectKey(key)) return false;
+            Uri candidate;
+            if (!Uri.TryCreate(_objectsBaseUri, key, out candidate)) return false;
+            if (!string.Equals(candidate.Scheme, Uri.UriSchemeHttps, StringComparison.OrdinalIgnoreCase)
+                || !string.Equals(candidate.Host, _objectsBaseUri.Host,
+                                  StringComparison.OrdinalIgnoreCase)
+                || candidate.Port != _objectsBaseUri.Port) return false;
+            uri = candidate;
+            return true;
+        }
+
+        private static bool TryResolveKey(string key, out CommunityCatalogEntry entry,
+                                          out bool thumbnail)
+        {
+            entry = null;
+            thumbnail = false;
+            if (!OwnsKey(key)) return false;
+            var parts = key.Substring(KeyPrefix.Length).Split('/');
+            Guid id;
+            int revision;
+            if (parts.Length != 3 || !Guid.TryParse(parts[0], out id)
+                || !int.TryParse(parts[1], out revision) || revision < 1
+                || (parts[2] != "bundle" && parts[2] != "thumbnail")) return false;
+
+            CommunityCatalog snapshot;
+            lock (Gate) snapshot = _catalog;
+            if (snapshot == null) return false;
+            for (var i = 0; i < snapshot.Entries.Count; i++)
+            {
+                var candidate = snapshot.Entries[i];
+                if (candidate.Revision == revision
+                    && string.Equals(candidate.Id, id.ToString(), StringComparison.OrdinalIgnoreCase))
+                {
+                    thumbnail = parts[2] == "thumbnail";
+                    if (thumbnail && string.IsNullOrEmpty(candidate.ThumbnailKey)) return false;
+                    entry = candidate;
+                    return true;
+                }
+            }
+            return false;
+        }
+
+        private static void EnsureRefresh(bool loadCacheFirst)
+        {
+            lock (Gate)
+            {
+                if (_catalogUri == null || _refreshing
+                    || (!loadCacheFirst && DateTime.UtcNow - _lastRefreshUtc < RefreshInterval)) return;
+                _refreshing = true;
+            }
+
+            ThreadPool.QueueUserWorkItem(delegate
+            {
+                if (loadCacheFirst) TryLoadCachedCatalog();
+                try
+                {
+                    var bytes = Download(_catalogUri, CommunityCatalog.MaxDocumentBytes);
+                    CommunityCatalog parsed;
+                    string warning;
+                    if (!CommunityCatalog.TryParse(bytes, out parsed, out warning))
+                        throw new InvalidDataException(warning ?? "The catalogue is invalid.");
+                    lock (Gate) _catalog = parsed;
+                    UgcBackend.ReconcileCommunityPublications(parsed.Entries);
+                    Dispatcher.NextFrame(SharingPatches.RefreshCurrentCreateScreen);
+                    WriteAtomic(_catalogCacheFile, bytes);
+                    if (!string.IsNullOrEmpty(warning))
+                        Plugin.Log.LogWarning("Community catalogue: " + warning);
+                    Plugin.Log.LogInfo("Community catalogue loaded " + parsed.Entries.Count + " map(s)." );
+                }
+                catch (Exception ex)
+                {
+                    Plugin.Log.LogWarning("Could not refresh the community catalogue; using the "
+                                          + "local library/cache: " + ex.Message);
+                }
+                finally
+                {
+                    lock (Gate)
+                    {
+                        _lastRefreshUtc = DateTime.UtcNow;
+                        _refreshing = false;
+                    }
+                }
+            });
+        }
+
+        private static void TryLoadCachedCatalog()
+        {
+            try
+            {
+                var bytes = ReadCacheFile(_catalogCacheFile, CommunityCatalog.MaxDocumentBytes);
+                CommunityCatalog parsed;
+                string warning;
+                if (CommunityCatalog.TryParse(bytes, out parsed, out warning))
+                {
+                    lock (Gate) _catalog = parsed;
+                    UgcBackend.ReconcileCommunityPublications(parsed.Entries);
+                    Dispatcher.NextFrame(SharingPatches.RefreshCurrentCreateScreen);
+                    Plugin.Log.LogInfo("Loaded " + parsed.Entries.Count + " cached community map(s)." );
+                }
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogWarning("Ignoring the cached community catalogue: " + ex.Message);
+            }
+        }
+
+        private static byte[] Download(Uri uri, int maximumBytes)
+        {
+            var stopwatch = Stopwatch.StartNew();
+            var current = uri;
+            for (var redirects = 0; redirects <= 4; redirects++)
+            {
+                var remaining = RequestTimeoutMs - (int)stopwatch.ElapsedMilliseconds;
+                if (remaining <= 0) throw new TimeoutException("The HTTPS request exceeded 10 seconds.");
+                var request = (HttpWebRequest)WebRequest.Create(current);
+                request.Method = "GET";
+                request.AllowAutoRedirect = false;
+                request.AutomaticDecompression = DecompressionMethods.None;
+                request.Timeout = remaining;
+                request.ReadWriteTimeout = remaining;
+                request.UserAgent = "SS2Revive/" + Plugin.PluginVersion;
+
+                using (var deadline = new Timer(delegate { try { request.Abort(); } catch { } }, null,
+                                                remaining, Timeout.Infinite))
+                using (var response = (HttpWebResponse)request.GetResponse())
+                {
+                    var status = (int)response.StatusCode;
+                    if (status == 301 || status == 302 || status == 303 || status == 307 || status == 308)
+                    {
+                        Uri next;
+                        if (redirects == 4 || !Uri.TryCreate(current, response.Headers["Location"], out next)
+                            || !IsAllowedRedirect(current, next))
+                            throw new WebException("HTTPS returned an unsafe redirect.");
+                        current = next;
+                        continue;
+                    }
+                    if (response.StatusCode != HttpStatusCode.OK)
+                        throw new WebException("HTTPS returned " + status + ".");
+                    if (response.ContentLength > maximumBytes)
+                        throw new InvalidDataException("The response exceeds its byte limit.");
+
+                    using (var input = response.GetResponseStream())
+                    using (var output = new MemoryStream())
+                    {
+                        var buffer = new byte[32 * 1024];
+                        while (true)
+                        {
+                            if (stopwatch.ElapsedMilliseconds > RequestTimeoutMs)
+                                throw new TimeoutException("The HTTPS request exceeded 10 seconds.");
+                            var read = input.Read(buffer, 0, buffer.Length);
+                            if (read <= 0) break;
+                            if (output.Length + read > maximumBytes)
+                                throw new InvalidDataException("The response exceeds its byte limit.");
+                            output.Write(buffer, 0, read);
+                        }
+                        return output.ToArray();
+                    }
+                }
+            }
+            throw new WebException("HTTPS returned too many redirects.");
+        }
+
+        /// <summary>
+        /// Keep redirects same-origin. GitHub Releases is the one explicit exception: its stable
+        /// github.com asset URLs redirect to GitHub's own immutable content CDN.
+        /// </summary>
+        private static bool IsAllowedRedirect(Uri from, Uri to)
+        {
+            if (to == null || !string.Equals(to.Scheme, Uri.UriSchemeHttps,
+                                             StringComparison.OrdinalIgnoreCase)) return false;
+            if (string.Equals(from.Host, to.Host, StringComparison.OrdinalIgnoreCase)
+                && from.Port == to.Port) return true;
+            return string.Equals(from.Host, "github.com", StringComparison.OrdinalIgnoreCase)
+                   && (string.Equals(to.Host, "githubusercontent.com", StringComparison.OrdinalIgnoreCase)
+                       || to.Host.EndsWith(".githubusercontent.com", StringComparison.OrdinalIgnoreCase));
+        }
+
+        private static byte[] ReadCacheFile(string path, int maximumBytes)
+        {
+            if (string.IsNullOrEmpty(path) || !File.Exists(path)) return null;
+            var info = new FileInfo(path);
+            if (info.Length <= 0 || info.Length > maximumBytes) return null;
+            return File.ReadAllBytes(path);
+        }
+
+        private static bool IsExpected(byte[] bytes, long size, string sha) =>
+            bytes != null && bytes.LongLength == size
+            && string.Equals(Sha256Hex(bytes), sha, StringComparison.OrdinalIgnoreCase);
+
+        private static string Sha256Hex(byte[] bytes)
+        {
+            if (bytes == null) return string.Empty;
+            using (var sha = SHA256.Create())
+            {
+                var hash = sha.ComputeHash(bytes);
+                var result = new StringBuilder(hash.Length * 2);
+                for (var i = 0; i < hash.Length; i++) result.Append(hash[i].ToString("x2"));
+                return result.ToString();
+            }
+        }
+
+        private static void WriteAtomic(string path, byte[] bytes)
+        {
+            Directory.CreateDirectory(Path.GetDirectoryName(path));
+            var temporary = path + "." + Guid.NewGuid().ToString("N") + ".tmp";
+            try
+            {
+                File.WriteAllBytes(temporary, bytes);
+                if (File.Exists(path)) File.Replace(temporary, path, null);
+                else File.Move(temporary, path);
+            }
+            finally
+            {
+                try { if (File.Exists(temporary)) File.Delete(temporary); }
+                catch { }
+            }
+        }
+
+        private static void EvictObjectCache()
+        {
+            try
+            {
+                var files = new List<FileInfo>(new DirectoryInfo(_objectCacheDirectory).GetFiles());
+                files.Sort((a, b) => a.LastWriteTimeUtc.CompareTo(b.LastWriteTimeUtc));
+                long total = 0;
+                for (var i = 0; i < files.Count; i++) total += files[i].Length;
+                while (files.Count > MaxCacheFiles || total > MaxCacheBytes)
+                {
+                    var oldest = files[0];
+                    files.RemoveAt(0);
+                    total -= oldest.Length;
+                    oldest.Delete();
+                }
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogWarning("Could not trim the community-map cache: " + ex.Message);
+            }
+        }
+    }
+}
diff --git a/src/SS2Revive/CommunityLevelPatches.cs b/src/SS2Revive/CommunityLevelPatches.cs
new file mode 100644
index 0000000..2cf05ea
--- /dev/null
+++ b/src/SS2Revive/CommunityLevelPatches.cs
@@ -0,0 +1,186 @@
+using System;
+using System.Collections.Generic;
+using HarmonyLib;
+using TMPro;
+using UnityEngine;
+
+namespace SS2Revive
+{
+    /// <summary>Adds a compact, prefab-native marker to maps present in the online catalogue.</summary>
+    internal static class CommunityLevelPatches
+    {
+        private const string AuthorLabelName = "SS2ReviveCommunityAuthors";
+
+        internal static void Apply(Harmony harmony)
+        {
+            PatchSet.Try("TerminalLevelButton.Init() -> online community marker", () =>
+            {
+                harmony.Patch(PatchSet.Method(typeof(TerminalLevelButton), "Init",
+                        Type.EmptyTypes), null,
+                    new HarmonyMethod(AccessTools.Method(typeof(CommunityLevelPatches),
+                        nameof(LevelButtonInitialised_Postfix))));
+            });
+
+            PatchSet.Try("TerminalLevelModalController.DisplayLevelData -> community author names", () =>
+            {
+                harmony.Patch(PatchSet.Method(typeof(TerminalLevelModalController),
+                        "DisplayLevelData", Type.EmptyTypes), null,
+                    new HarmonyMethod(AccessTools.Method(typeof(CommunityLevelPatches),
+                        nameof(LevelModalDisplayed_Postfix))));
+            });
+        }
+
+        private static void LevelButtonInitialised_Postfix(TerminalLevelButton __instance)
+        {
+            try
+            {
+                var summary = __instance?.GetLevelSummary();
+                if (summary == null || !CommunityCatalogClient.IsPublishedMap(summary.serverLevelId))
+                    return;
+
+                // Community Spotlight no longer has its own browser and this card icon is otherwise
+                // unused by the revived catalogue. Reusing it preserves the authored layout without
+                // introducing a runtime sprite or another overlapping text object.
+                var icon = AccessTools.Field(typeof(TerminalLevelButton), "_communitySpotlightIcon")
+                    ?.GetValue(__instance) as GameObject;
+                icon?.SetActive(true);
+
+                var type = AccessTools.Field(typeof(TerminalLevelButton), "_LevelTypeText")
+                    ?.GetValue(__instance) as TMP_Text;
+                if (type != null && type.gameObject.activeSelf
+                    && !type.text.StartsWith("ONLINE | ", StringComparison.Ordinal))
+                    type.text = "ONLINE | " + type.text;
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogWarning("Displaying the online community marker threw: " + ex.Message);
+            }
+        }
+
+        private static void LevelModalDisplayed_Postfix(TerminalLevelModalController __instance)
+        {
+            try
+            {
+                var summary = AccessTools.Field(typeof(TerminalLevelModalController),
+                    "_currentDisplayedLevel")?.GetValue(__instance) as Data.LevelSummaryData;
+                var profiles = AccessTools.Field(typeof(TerminalLevelModalController),
+                    "_profileImageEditPanel")?.GetValue(__instance) as ProfileIcon[];
+                if (profiles == null || profiles.Length == 0 || profiles[0] == null) return;
+
+                var parent = profiles[0].transform.parent as RectTransform;
+                if (parent == null) return;
+                var existing = parent.Find(AuthorLabelName);
+
+                if (summary == null || !CommunityCatalogClient.IsPublishedMap(summary.serverLevelId)
+                    || summary.creatorPlayerIds == null || summary.creatorPlayerIds.Count == 0)
+                {
+                    if (existing != null) existing.gameObject.SetActive(false);
+                    return;
+                }
+
+                CommunityAuthorLabel authorLabel;
+                if (existing == null)
+                {
+                    var sourceText = AccessTools.Field(typeof(TerminalLevelModalController),
+                        "_saveTimeInfoPanel")?.GetValue(__instance) as TMP_Text;
+                    if (sourceText == null) return;
+
+                    var root = new GameObject(AuthorLabelName, typeof(RectTransform),
+                        typeof(CanvasRenderer), typeof(TextMeshProUGUI),
+                        typeof(CommunityAuthorLabel));
+                    root.transform.SetParent(parent, false);
+                    var text = root.GetComponent<TextMeshProUGUI>();
+                    text.font = sourceText.font;
+                    text.fontSharedMaterial = sourceText.fontSharedMaterial;
+                    text.fontSize = Mathf.Max(18f, sourceText.fontSize * 0.9f);
+                    text.color = sourceText.color;
+                    text.alignment = TextAlignmentOptions.MidlineLeft;
+                    text.enableWordWrapping = false;
+                    text.overflowMode = TextOverflowModes.Ellipsis;
+                    text.raycastTarget = false;
+                    authorLabel = root.GetComponent<CommunityAuthorLabel>();
+                }
+                else
+                {
+                    authorLabel = existing.GetComponent<CommunityAuthorLabel>();
+                }
+                if (authorLabel == null) return;
+
+                var visibleProfiles = Math.Min(summary.creatorPlayerIds.Count, profiles.Length);
+                var sourceRect = profiles[Math.Max(0, visibleProfiles - 1)].transform as RectTransform;
+                var labelRect = authorLabel.transform as RectTransform;
+                if (sourceRect != null && labelRect != null)
+                {
+                    labelRect.anchorMin = sourceRect.anchorMin;
+                    labelRect.anchorMax = sourceRect.anchorMax;
+                    labelRect.pivot = new Vector2(0f, 0.5f);
+                    labelRect.anchoredPosition = sourceRect.anchoredPosition
+                        + new Vector2(sourceRect.rect.width + 12f, 0f);
+                    labelRect.sizeDelta = new Vector2(460f, Mathf.Max(36f, sourceRect.rect.height));
+                    labelRect.SetAsLastSibling();
+                }
+
+                var steamIds = new List<ulong>(summary.creatorPlayerIds.Count);
+                for (var i = 0; i < summary.creatorPlayerIds.Count; i++)
+                {
+                    var steamId = SteamIdentity.TryGetSteamId(summary.creatorPlayerIds[i]);
+                    if (steamId != 0UL) steamIds.Add(steamId);
+                }
+                authorLabel.Show(steamIds);
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogWarning("Displaying community author names threw: " + ex.Message);
+            }
+        }
+    }
+
+    /// <summary>
+    /// Resolves display-only Steam persona names without trusting a name embedded in an uploaded
+    /// bundle. SteamID64 remains the ownership identity; this component only improves attribution.
+    /// </summary>
+    internal sealed class CommunityAuthorLabel : MonoBehaviour
+    {
+        private readonly List<ulong> _steamIds = new List<ulong>();
+        private TMP_Text _text;
+        private float _nextLookup;
+        private float _stopLookup;
+
+        internal void Show(List<ulong> steamIds)
+        {
+            _steamIds.Clear();
+            if (steamIds != null) _steamIds.AddRange(steamIds);
+            _text = GetComponent<TMP_Text>();
+            gameObject.SetActive(_steamIds.Count > 0);
+            _stopLookup = Time.unscaledTime + 15f;
+            _nextLookup = 0f;
+            Resolve();
+        }
+
+        private void Update()
+        {
+            if (_steamIds.Count == 0 || Time.unscaledTime < _nextLookup
+                || Time.unscaledTime > _stopLookup) return;
+            Resolve();
+        }
+
+        private void Resolve()
+        {
+            if (_text == null) return;
+            var names = new List<string>(_steamIds.Count);
+            var pending = false;
+            for (var i = 0; i < _steamIds.Count; i++)
+            {
+                var name = SteamIdentity.GetPersonaName(_steamIds[i]);
+                if (string.IsNullOrEmpty(name))
+                {
+                    pending = true;
+                    name = "Steam " + _steamIds[i];
+                }
+                names.Add(name);
+            }
+            _text.text = string.Join(", ", names.ToArray());
+            _nextLookup = pending ? Time.unscaledTime + 0.5f : float.PositiveInfinity;
+        }
+    }
+}
diff --git a/src/SS2Revive/CommunityManagementPatches.cs b/src/SS2Revive/CommunityManagementPatches.cs
new file mode 100644
index 0000000..4884ddc
--- /dev/null
+++ b/src/SS2Revive/CommunityManagementPatches.cs
@@ -0,0 +1,380 @@
+using System;
+using System.Collections.Generic;
+using HarmonyLib;
+using TMPro;
+using UnityEngine;
+using UnityEngine.UI;
+
+namespace SS2Revive
+{
+    /// <summary>Adds a published-only Your Maps browser and authenticated account actions.</summary>
+    internal static class CommunityManagementPatches
+    {
+        private const int ReplacedFilterIndex = 4; // Newest
+        private const string TileName = "SS2ReviveYourMapsButton";
+        private const string ManageButtonName = "SS2ReviveManageCommunityButton";
+        private const string OldUnpublishButtonName = "SS2ReviveUnpublishCommunityButton";
+        private const string OldArchiveButtonName = "SS2ReviveArchiveCommunityButton";
+
+        private static bool _browseActive;
+        private static TerminalLevelBrowseOptions _browseScreen;
+        private static TerminalCustomGameScreen _customGameScreen;
+        private static TerminalUIController _terminalUi;
+        private static TerminalLevelModalController _managementModal;
+        private static CommunityPublishOperation _activeOperation;
+
+        internal static void Apply(Harmony harmony)
+        {
+            PatchSet.Try("TerminalLevelBrowseOptions.InitializeScreen -> Your Maps browser", () =>
+            {
+                harmony.Patch(PatchSet.Method(typeof(TerminalLevelBrowseOptions), "InitializeScreen"),
+                    null, new HarmonyMethod(AccessTools.Method(typeof(CommunityManagementPatches),
+                        nameof(BrowseInitialised_Postfix))));
+            });
+            PatchSet.Try("TerminalLevelBrowseOptions.OnLanguageUpdated -> retain Your Maps tile", () =>
+            {
+                harmony.Patch(PatchSet.Method(typeof(TerminalLevelBrowseOptions), "OnLanguageUpdated"),
+                    null, new HarmonyMethod(AccessTools.Method(typeof(CommunityManagementPatches),
+                        nameof(LanguageUpdated_Postfix))));
+            });
+            PatchSet.Try("TerminalCustomGameScreen.OnScreenLeft -> leave Your Maps browser", () =>
+            {
+                harmony.Patch(PatchSet.Method(typeof(TerminalCustomGameScreen), "OnScreenLeft",
+                        new[] { typeof(bool) }), null,
+                    new HarmonyMethod(AccessTools.Method(typeof(CommunityManagementPatches),
+                        nameof(CustomGameScreenLeft_Postfix))));
+            });
+            PatchSet.Try("TerminalCustomGameScreen.OnTerminalExited -> leave Your Maps browser", () =>
+            {
+                harmony.Patch(PatchSet.Method(typeof(TerminalCustomGameScreen), "OnTerminalExited",
+                        new[] { typeof(bool) }), null,
+                    new HarmonyMethod(AccessTools.Method(typeof(CommunityManagementPatches),
+                        nameof(CustomGameScreenLeft_Postfix))));
+            });
+            PatchSet.Try("TerminalLevelModalController.DisplayLevelData -> online owner actions", () =>
+            {
+                harmony.Patch(PatchSet.Method(typeof(TerminalLevelModalController), "DisplayLevelData",
+                        Type.EmptyTypes), null,
+                    new HarmonyMethod(AccessTools.Method(typeof(CommunityManagementPatches),
+                        nameof(LevelDisplayed_Postfix))));
+            });
+            PatchSet.Try("ReportLevelModalController.Submit -> authenticated community report", () =>
+            {
+                harmony.Patch(PatchSet.Method(typeof(ReportLevelModalController), "Submit",
+                        Type.EmptyTypes),
+                    new HarmonyMethod(AccessTools.Method(typeof(CommunityManagementPatches),
+                        nameof(Report_Prefix))));
+            });
+            PatchSet.Try("TerminalUIController.DisableUI -> cancel community account action", () =>
+            {
+                harmony.Patch(PatchSet.Method(typeof(TerminalUIController), "DisableUI"),
+                    new HarmonyMethod(AccessTools.Method(typeof(CommunityManagementPatches),
+                        nameof(TerminalDisabled_Prefix))));
+            });
+        }
+
+        internal static bool ApplyBrowseFilter(out string creatorId)
+        {
+            creatorId = string.Empty;
+            if (!_browseActive) return false;
+            var player = SteamIdentity.GetLocalPlayerId();
+            creatorId = player == null ? string.Empty : player.ToString();
+            return !string.IsNullOrEmpty(creatorId);
+        }
+
+        private static void BrowseInitialised_Postfix(TerminalLevelBrowseOptions __instance)
+        {
+            try
+            {
+                if (__instance == null || !CommunityCatalogClient.Enabled) return;
+                _browseActive = false;
+                _browseScreen = __instance;
+                _customGameScreen = AccessTools.Field(typeof(TerminalLevelBrowseOptions),
+                    "_customGameScreen")?.GetValue(__instance) as TerminalCustomGameScreen;
+                _terminalUi = AccessTools.Field(typeof(TerminalLevelBrowseOptions),
+                    "_terminalUIController")?.GetValue(__instance) as TerminalUIController;
+                var buttons = AccessTools.Field(typeof(TerminalLevelBrowseOptions), "_discoverButtons")
+                    ?.GetValue(__instance) as TerminalDiscoverButton[];
+                if (buttons == null || buttons.Length <= ReplacedFilterIndex
+                    || buttons[ReplacedFilterIndex] == null) return;
+                buttons[ReplacedFilterIndex].gameObject.name = TileName;
+                ConfigureTile(buttons[ReplacedFilterIndex]);
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogError("Creating the Your Maps browser button threw: " + ex);
+            }
+        }
+
+        private static void LanguageUpdated_Postfix(TerminalLevelBrowseOptions __instance)
+        {
+            try
+            {
+                var buttons = AccessTools.Field(typeof(TerminalLevelBrowseOptions), "_discoverButtons")
+                    ?.GetValue(__instance) as TerminalDiscoverButton[];
+                if (buttons != null && buttons.Length > ReplacedFilterIndex
+                    && buttons[ReplacedFilterIndex] != null)
+                    ConfigureTile(buttons[ReplacedFilterIndex]);
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogWarning("Refreshing Your Maps browser text threw: " + ex.Message);
+            }
+        }
+
+        private static void ConfigureTile(TerminalDiscoverButton tile)
+        {
+            tile.gameObject.SetActive(true);
+            tile.SetText("YOUR MAPS", "Manage community maps published by your Steam account.");
+            var title = AccessTools.Field(typeof(TerminalDiscoverButton), "_titleText")
+                ?.GetValue(tile) as TMP_Text;
+            var description = AccessTools.Field(typeof(TerminalDiscoverButton), "_descriptionText")
+                ?.GetValue(tile) as TMP_Text;
+            if (title != null)
+            {
+                title.enableWordWrapping = false;
+                title.overflowMode = TextOverflowModes.Ellipsis;
+            }
+            if (description != null)
+            {
+                description.enableWordWrapping = true;
+                description.overflowMode = TextOverflowModes.Ellipsis;
+            }
+            var extended = tile.ExtendedButton;
+            if (extended == null) return;
+            extended.onClick = new Button.ButtonClickedEvent();
+            extended.OnPointerClickButton = YourMapsClicked;
+            extended.interactable = true;
+            extended.navigation = new Navigation { mode = Navigation.Mode.Automatic };
+        }
+
+        private static void YourMapsClicked(ExtendedButton ignored)
+        {
+            if (_browseScreen == null || _customGameScreen == null || _terminalUi == null) return;
+            if (SteamIdentity.GetSteamId64() == 0UL)
+            {
+                TerminalMessage.Show("Steam must be online to identify your published maps.", true);
+                return;
+            }
+            try
+            {
+                _browseActive = true;
+                _customGameScreen.SetFilter(TerminalCreateScreenData.LevelSortBy.Newest,
+                    TerminalCreateScreenData.LevelFilterBy.AllLevels, "YOUR MAPS");
+                _terminalUi.TransitionBetweenScreens(_browseScreen, _customGameScreen);
+            }
+            catch (Exception ex)
+            {
+                _browseActive = false;
+                Plugin.Log.LogError("Opening the Your Maps browser threw: " + ex);
+            }
+        }
+
+        private static void CustomGameScreenLeft_Postfix(TerminalCustomGameScreen __instance)
+        {
+            if (__instance == _customGameScreen) _browseActive = false;
+        }
+
+        internal static void RefreshBrowse()
+        {
+            if (!_browseActive || _customGameScreen == null) return;
+            try
+            {
+                AccessTools.Method(typeof(TerminalCustomGameScreen), "NewSearch")
+                    ?.Invoke(_customGameScreen, null);
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogWarning("Refreshing Your Maps after an account action threw: "
+                                      + ex.Message);
+            }
+        }
+
+        private static void LevelDisplayed_Postfix(TerminalLevelModalController __instance)
+        {
+            try
+            {
+                var summary = AccessTools.Field(typeof(TerminalLevelModalController),
+                    "_currentDisplayedLevel")?.GetValue(__instance) as Data.LevelSummaryData;
+                var localPlayer = SteamIdentity.GetLocalPlayerId();
+                var ownsOnlineMap = summary != null && localPlayer != null
+                    && CommunityCatalogClient.IsPublishedMap(summary.serverLevelId)
+                    && summary.creatorPlayerIds != null && summary.creatorPlayerIds.Contains(localPlayer);
+                var template = AccessTools.Field(typeof(TerminalLevelModalController), "_editButton")
+                    ?.GetValue(__instance) as ExtendedButton;
+                HideObsoleteAction(__instance, OldUnpublishButtonName);
+                HideObsoleteAction(__instance, OldArchiveButtonName);
+                var manage = EnsureActionButton(__instance, template, ManageButtonName,
+                    "ONLINE OPTIONS", ManageOnlineClicked, 1);
+                SetVisible(manage, ownsOnlineMap);
+                if (ownsOnlineMap) _managementModal = __instance;
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogError("Applying community owner actions threw: " + ex);
+            }
+        }
+
+        private static ExtendedButton EnsureActionButton(TerminalLevelModalController modal,
+            ExtendedButton template, string name, string label, PointerClick<ExtendedButton> callback,
+            int offset)
+        {
+            if (template == null || template.transform.parent == null) return null;
+            var parent = template.transform.parent;
+            var existing = parent.Find(name);
+            ExtendedButton button;
+            if (existing == null)
+            {
+                var clone = UnityEngine.Object.Instantiate(template.gameObject, parent);
+                clone.name = name;
+                clone.transform.SetSiblingIndex(template.transform.GetSiblingIndex() + offset);
+                button = clone.GetComponent<ExtendedButton>();
+                if (button == null)
+                {
+                    UnityEngine.Object.Destroy(clone);
+                    return null;
+                }
+                SharingPatches.StripLocalisation(clone);
+                var buttons = AccessTools.Field(typeof(TerminalLevelModalController), "_buttons")
+                    ?.GetValue(modal) as List<ExtendedButton>;
+                if (buttons != null && !buttons.Contains(button)) buttons.Add(button);
+                if (parent.GetComponent<LayoutGroup>() == null)
+                {
+                    var rect = clone.transform as RectTransform;
+                    var source = template.transform as RectTransform;
+                    if (rect != null && source != null)
+                        rect.anchoredPosition = source.anchoredPosition
+                                                + new Vector2((source.rect.width + 8f) * offset, 0f);
+                }
+            }
+            else button = existing.GetComponent<ExtendedButton>();
+            if (button == null) return null;
+            button.onClick = new Button.ButtonClickedEvent();
+            button.OnPointerClickButton = callback;
+            button.OnPointerEnterButton = null;
+            button.OnPointerExitButton = null;
+            SharingPatches.SetLabel(button, label);
+            return button;
+        }
+
+        private static void SetVisible(ExtendedButton button, bool visible)
+        {
+            if (button == null) return;
+            button.gameObject.SetActive(visible);
+            button.interactable = visible && _activeOperation == null;
+        }
+
+        private static void HideObsoleteAction(TerminalLevelModalController modal, string name)
+        {
+            var template = AccessTools.Field(typeof(TerminalLevelModalController), "_editButton")
+                ?.GetValue(modal) as ExtendedButton;
+            var old = template == null || template.transform.parent == null
+                ? null : template.transform.parent.Find(name)?.GetComponent<ExtendedButton>();
+            if (old != null) old.gameObject.SetActive(false);
+        }
+
+        private static void ManageOnlineClicked(ExtendedButton ignored)
+        {
+            var modal = _managementModal;
+            var terminal = AccessTools.Field(typeof(TerminalLevelModalController),
+                "_owningTerminalUIController")?.GetValue(modal) as TerminalUIController;
+            if (modal == null || terminal == null || _activeOperation != null) return;
+            terminal.GetTerminalConfirmationModal().Show(
+                "ONLINE OPTIONS",
+                "UNPUBLISH",
+                "REMOVE ONLINE",
+                () => BeginOwnerAction(modal, false),
+                () => BeginOwnerAction(modal, true));
+        }
+
+        private static void BeginOwnerAction(TerminalLevelModalController modal, bool archive)
+        {
+            var summary = AccessTools.Field(typeof(TerminalLevelModalController),
+                "_currentDisplayedLevel")?.GetValue(modal) as Data.LevelSummaryData;
+            if (summary == null || !CommunityCatalogClient.IsPublishedMap(summary.serverLevelId)) return;
+            var mapId = summary.serverLevelId;
+            var callbacks = new CommunityAccountCallbacks
+            {
+                Status = text => TerminalMessage.Show(text),
+                AuthenticationRequired = (code, uri) => OpenAuthentication(code, uri),
+                Completed = () =>
+                {
+                    _activeOperation = null;
+                    TerminalMessage.Show(archive
+                        ? "The map was removed from the community catalogue. Your local copy remains."
+                        : "The map is now unpublished. Upload it again to republish it.");
+                    try { modal.Hide(); } catch { }
+                    RefreshBrowse();
+                },
+                Failed = message =>
+                {
+                    _activeOperation = null;
+                    TerminalMessage.Show(message, true);
+                    LevelDisplayed_Postfix(modal);
+                },
+            };
+            _activeOperation = archive
+                ? CommunityPublishClient.Archive(mapId, callbacks)
+                : CommunityPublishClient.Unpublish(mapId, callbacks);
+            LevelDisplayed_Postfix(modal);
+        }
+
+        private static bool Report_Prefix(ReportLevelModalController __instance)
+        {
+            try
+            {
+                var mapId = AccessTools.Field(typeof(ReportLevelModalController), "_serverLevelId")
+                    ?.GetValue(__instance) as string;
+                if (!CommunityCatalogClient.IsPublishedMap(mapId)) return true;
+                var reasons = AccessTools.Field(typeof(ReportLevelModalController), "_reportReasons")
+                    ?.GetValue(__instance) as string[];
+                var dropdown = AccessTools.Field(typeof(ReportLevelModalController), "_issueDropdown")
+                    ?.GetValue(__instance) as TMP_Dropdown;
+                if (reasons == null || dropdown == null || dropdown.value < 0
+                    || dropdown.value >= reasons.Length) return true;
+                var reason = reasons[dropdown.value];
+                __instance.Hide();
+                _activeOperation = CommunityPublishClient.Report(mapId, reason,
+                    new CommunityAccountCallbacks
+                    {
+                        Status = text => TerminalMessage.Show(text),
+                        AuthenticationRequired = (code, uri) => OpenAuthentication(code, uri),
+                        Completed = () =>
+                        {
+                            _activeOperation = null;
+                            TerminalMessage.Show("Thank you. The map report was sent to the maintainer.");
+                        },
+                        Failed = message =>
+                        {
+                            _activeOperation = null;
+                            TerminalMessage.Show(message, true);
+                        },
+                    });
+                return false;
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogError("Submitting a community report threw: " + ex);
+                return true;
+            }
+        }
+
+        private static void OpenAuthentication(string code, Uri uri)
+        {
+            TerminalMessage.Show("Finish Steam sign-in in your browser. Code " + code + ".",
+                                 false, 12f);
+            try { Application.OpenURL(uri.AbsoluteUri); }
+            catch (Exception ex)
+            {
+                TerminalMessage.Show("Could not open Steam login: " + ex.Message, true);
+            }
+        }
+
+        private static void TerminalDisabled_Prefix()
+        {
+            _browseActive = false;
+            _activeOperation?.Cancel();
+            _activeOperation = null;
+        }
+    }
+}
diff --git a/src/SS2Revive/CommunityPublishClient.cs b/src/SS2Revive/CommunityPublishClient.cs
new file mode 100644
index 0000000..2038e28
--- /dev/null
+++ b/src/SS2Revive/CommunityPublishClient.cs
@@ -0,0 +1,808 @@
+using System;
+using System.IO;
+using System.Net;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using SS2ReviveData;
+
+namespace SS2Revive
+{
+    internal sealed class CommunityPublishCallbacks
+    {
+        internal Action<string> Status;
+        internal Action<float> Progress;
+        internal Action<string, Uri> AuthenticationRequired;
+        internal Action<string, int> Published;
+        internal Action<string> Failed;
+    }
+
+    internal sealed class CommunityAccountCallbacks
+    {
+        internal Action<string> Status;
+        internal Action<string, Uri> AuthenticationRequired;
+        internal Action Completed;
+        internal Action<string> Failed;
+    }
+
+    internal sealed class CommunityPublishOperation
+    {
+        private readonly ManualResetEvent _cancelled = new ManualResetEvent(false);
+        private readonly object _gate = new object();
+        private HttpWebRequest _activeRequest;
+        private int _isCancelled;
+
+        internal bool IsCancelled => Interlocked.CompareExchange(ref _isCancelled, 0, 0) != 0;
+
+        internal void Cancel()
+        {
+            if (Interlocked.Exchange(ref _isCancelled, 1) != 0) return;
+            _cancelled.Set();
+            lock (_gate)
+            {
+                try { _activeRequest?.Abort(); }
+                catch { }
+            }
+        }
+
+        internal void SetRequest(HttpWebRequest request)
+        {
+            lock (_gate)
+            {
+                if (IsCancelled)
+                {
+                    request.Abort();
+                    throw new OperationCanceledException();
+                }
+                _activeRequest = request;
+            }
+        }
+
+        internal void ClearRequest(HttpWebRequest request)
+        {
+            lock (_gate)
+                if (ReferenceEquals(_activeRequest, request)) _activeRequest = null;
+        }
+
+        internal void Wait(int milliseconds)
+        {
+            if (_cancelled.WaitOne(Math.Max(1, milliseconds))) throw new OperationCanceledException();
+        }
+    }
+
+    /// <summary>
+    /// Authenticated publishing client. Steam sign-in happens only in the system browser; this
+    /// class receives short-lived API tokens, stores only the refresh token under Windows DPAPI,
+    /// and streams the exact preflighted bundle to the Worker rather than exposing R2 credentials.
+    /// </summary>
+    internal static class CommunityPublishClient
+    {
+        private const int JsonLimit = 64 * 1024;
+        private const int RequestTimeoutMs = 20000;
+        private const int UploadTimeoutMs = 120000;
+        private static readonly object AuthGate = new object();
+        // DPAPI entropy, the on-disk file name, and a field inside the blob are all derived from
+        // the configured origin. A refresh token minted by one server can therefore never be
+        // replayed to another: repointing ApiCatalogUrl at a different host no longer hands that
+        // host a working credential for the original one.
+        private const string TokenEntropyPrefix = "SS2Revive|community-session|v2|";
+        private const char SessionFieldSeparator = '|';
+
+        private static Uri _origin;
+        private static Uri _apiBase;
+        private static string _tokenPath;
+        private static bool _tokenLoaded;
+        private static string _refreshToken;
+        private static string _accessToken;
+        private static DateTime _accessExpiresUtc = DateTime.MinValue;
+
+        internal static bool Enabled => _origin != null && _apiBase != null;
+
+        /// <summary>
+        /// A fast UI hint only. The server remains authoritative and the encrypted token is still
+        /// decrypted and validated under <see cref="AuthGate"/> before it can be used.
+        /// </summary>
+        internal static bool HasStoredSession
+        {
+            get
+            {
+                try
+                {
+                    if (!Enabled) return false;
+                    if (Volatile.Read(ref _tokenLoaded))
+                        return !string.IsNullOrEmpty(Volatile.Read(ref _refreshToken));
+                    return !string.IsNullOrEmpty(_tokenPath) && File.Exists(_tokenPath);
+                }
+                catch { return false; }
+            }
+        }
+
+        internal static void Initialise(string saveRoot, string configuredCatalogUrl)
+        {
+            _origin = null;
+            _apiBase = null;
+            _tokenPath = null;
+            _tokenLoaded = false;
+            _refreshToken = null;
+            _accessToken = null;
+            _accessExpiresUtc = DateTime.MinValue;
+            Uri catalog;
+            if (string.IsNullOrWhiteSpace(saveRoot)
+                || !Uri.TryCreate(configuredCatalogUrl, UriKind.Absolute, out catalog)
+                || catalog.Scheme != Uri.UriSchemeHttps || !string.IsNullOrEmpty(catalog.UserInfo)
+                || !string.IsNullOrEmpty(catalog.Query) || !string.IsNullOrEmpty(catalog.Fragment)) return;
+            _origin = new Uri(catalog.GetLeftPart(UriPartial.Authority) + "/", UriKind.Absolute);
+            _apiBase = new Uri(catalog, ".");
+            _tokenPath = Path.Combine(saveRoot, "auth",
+                "community-session." + OriginFingerprint(_origin) + ".v2");
+        }
+
+        internal static CommunityPublishOperation Publish(LevelSharing.UploadPackage package,
+                                                            CommunityPublishCallbacks callbacks)
+        {
+            var operation = new CommunityPublishOperation();
+            // Steamworks calls remain on Unity's main thread. Only this immutable identity crosses
+            // into the network worker for the browser-account mismatch check.
+            var expectedSteamId64 = SteamIdentity.GetSteamId64().ToString();
+            ThreadPool.QueueUserWorkItem(delegate
+            {
+                try
+                {
+                    if (!Enabled) throw new InvalidOperationException("The community API is disabled.");
+                    if (package == null || string.IsNullOrEmpty(package.Path)
+                        || package.SizeBytes < 1 || package.SizeBytes > LevelBundle.MaxBundleBytes
+                        || string.IsNullOrEmpty(package.Sha256))
+                    {
+                        throw new InvalidDataException("The prepared upload package is invalid.");
+                    }
+                    Post(callbacks.Status, "Checking the protected Steam publishing session...");
+                    if (expectedSteamId64 == "0")
+                        throw new InvalidOperationException("Steam must be online before publishing.");
+                    var accessToken = EnsureAccessToken(operation, callbacks.AuthenticationRequired,
+                                                        expectedSteamId64);
+                    operation.CancelIfRequested();
+
+                    Post(callbacks.Status, "Reserving private upload space...");
+                    var reservationJson = Json.Object()
+                        .Add("sizeBytes", package.SizeBytes)
+                        .Add("sha256", package.Sha256)
+                        .ToString();
+                    var reservation = SendJson("POST", new Uri(_apiBase, "uploads"), reservationJson,
+                                               accessToken, operation, RequestTimeoutMs);
+                    RequireStatus(reservation, 201);
+                    var reservationBody = ParseObject(reservation);
+                    var uploadId = reservationBody["uploadId"].AsStringOr(string.Empty);
+                    var bundlePath = reservationBody["bundleUploadPath"].AsStringOr(string.Empty);
+                    var statusPath = reservationBody["statusPath"].AsStringOr(string.Empty);
+                    if (!IsGuid(uploadId) || !IsSafeApiPath(bundlePath, "/v1/uploads/", "/bundle")
+                        || !IsSafeApiPath(statusPath, "/v1/uploads/", string.Empty))
+                    {
+                        throw new InvalidDataException("The server returned an invalid upload reservation.");
+                    }
+
+                    Post(callbacks.Status, "Uploading the validated package to private quarantine...");
+                    var upload = UploadFile(new Uri(_origin, bundlePath), package, accessToken,
+                                            operation, callbacks);
+                    RequireStatus(upload, 202);
+
+                    Post(callbacks.Status, "Upload complete. Server validation is running...");
+                    PollPublication(new Uri(_origin, statusPath), uploadId, accessToken,
+                                    operation, callbacks);
+                }
+                catch (OperationCanceledException)
+                {
+                    Post(callbacks.Status, "Publishing cancelled.");
+                }
+                catch (Exception ex)
+                {
+                    Plugin.Log.LogWarning("Community publishing failed: " + ex.Message);
+                    Post(callbacks.Failed, SafeMessage(ex));
+                }
+            });
+            return operation;
+        }
+
+        internal static CommunityPublishOperation Unpublish(string mapId,
+                                                             CommunityAccountCallbacks callbacks)
+        {
+            return MapAction("POST", mapId, "unpublish", "{}", 200, true,
+                             "Removing this map from the community catalogue...", callbacks);
+        }
+
+        internal static CommunityPublishOperation Archive(string mapId,
+                                                           CommunityAccountCallbacks callbacks)
+        {
+            return MapAction("DELETE", mapId, string.Empty, null, 204, true,
+                             "Archiving this community map...", callbacks);
+        }
+
+        internal static CommunityPublishOperation Login(CommunityAccountCallbacks callbacks)
+        {
+            var operation = new CommunityPublishOperation();
+            var expectedSteamId64 = SteamIdentity.GetSteamId64().ToString();
+            ThreadPool.QueueUserWorkItem(delegate
+            {
+                try
+                {
+                    if (!Enabled) throw new InvalidOperationException("The community API is disabled.");
+                    if (expectedSteamId64 == "0")
+                        throw new InvalidOperationException("Steam must be online before signing in.");
+                    Post(callbacks?.Status, "Starting protected Steam community sign-in...");
+                    EnsureAccessToken(operation, callbacks?.AuthenticationRequired, expectedSteamId64);
+                    operation.CancelIfRequested();
+                    Post(callbacks?.Completed);
+                }
+                catch (OperationCanceledException)
+                {
+                    Post(callbacks?.Status, "Steam community sign-in cancelled.");
+                }
+                catch (Exception ex)
+                {
+                    Plugin.Log.LogWarning("Community login failed: " + ex.Message);
+                    Post(callbacks?.Failed, SafeMessage(ex));
+                }
+            });
+            return operation;
+        }
+
+        internal static CommunityPublishOperation Logout(CommunityAccountCallbacks callbacks)
+        {
+            var operation = new CommunityPublishOperation();
+            ThreadPool.QueueUserWorkItem(delegate
+            {
+                try
+                {
+                    if (!Enabled) throw new InvalidOperationException("The community API is disabled.");
+                    lock (AuthGate)
+                    {
+                        operation.CancelIfRequested();
+                        LoadRefreshToken();
+                        var token = _refreshToken;
+                        if (string.IsNullOrEmpty(token))
+                        {
+                            DeleteRefreshToken();
+                        }
+                        else
+                        {
+                            try
+                            {
+                                Post(callbacks?.Status, "Ending the protected Steam community session...");
+                                var response = SendJson("POST", new Uri(_apiBase, "auth/logout"),
+                                    Json.Object().Add("refreshToken", token).ToString(), null,
+                                    operation, RequestTimeoutMs);
+                                RequireStatus(response, 204);
+                            }
+                            finally
+                            {
+                                // User intent wins even when the network is unavailable. The
+                                // server token may expire later, but this PC must stop using it now.
+                                DeleteRefreshToken();
+                            }
+                        }
+                    }
+                    Post(callbacks?.Completed);
+                }
+                catch (OperationCanceledException)
+                {
+                    lock (AuthGate) DeleteRefreshToken();
+                }
+                catch (Exception ex)
+                {
+                    lock (AuthGate) DeleteRefreshToken();
+                    Plugin.Log.LogWarning("Community logout could not revoke the server session: "
+                                          + ex.Message);
+                    Post(callbacks?.Failed,
+                         "Signed out on this PC, but the server could not be reached to revoke the session."
+                         + " The unused server token will expire automatically.");
+                }
+            });
+            return operation;
+        }
+
+        internal static CommunityPublishOperation Report(string mapId, string reason,
+                                                          CommunityAccountCallbacks callbacks)
+        {
+            var allowed = reason == "BROKEN" || reason == "NSFW_CONTENT" || reason == "COPY"
+                          || reason == "LEVEL_DESIGN_COPYRIGHT" || reason == "FARMING";
+            if (!allowed)
+            {
+                Dispatcher.NextFrame(() => callbacks?.Failed?.Invoke("The report reason is invalid."));
+                return new CommunityPublishOperation();
+            }
+            return MapAction("POST", mapId, "reports",
+                Json.Object().Add("reason", reason).ToString(), 201, false,
+                "Sending the authenticated map report...", callbacks);
+        }
+
+        private static CommunityPublishOperation MapAction(
+            string method, string mapId, string suffix, string json, int expectedStatus,
+            bool removeFromCatalogue, string statusText, CommunityAccountCallbacks callbacks)
+        {
+            var operation = new CommunityPublishOperation();
+            var expectedSteamId64 = SteamIdentity.GetSteamId64().ToString();
+            ThreadPool.QueueUserWorkItem(delegate
+            {
+                try
+                {
+                    if (!Enabled) throw new InvalidOperationException("The community API is disabled.");
+                    if (!IsGuid(mapId)) throw new InvalidDataException("The community map id is invalid.");
+                    if (expectedSteamId64 == "0")
+                        throw new InvalidOperationException("Steam must be online for this action.");
+                    Post(callbacks?.Status, statusText);
+                    var accessToken = EnsureAccessToken(operation, callbacks?.AuthenticationRequired,
+                                                        expectedSteamId64);
+                    operation.CancelIfRequested();
+                    var path = "maps/" + mapId + (string.IsNullOrEmpty(suffix) ? string.Empty : "/" + suffix);
+                    ApiResponse response;
+                    if (json == null)
+                        response = Send(method, new Uri(_apiBase, path), null, null, accessToken,
+                                        operation, RequestTimeoutMs, null);
+                    else
+                        response = SendJson(method, new Uri(_apiBase, path), json, accessToken,
+                                            operation, RequestTimeoutMs);
+                    RequireStatus(response, expectedStatus);
+                    if (removeFromCatalogue) CommunityCatalogClient.NoteRemoved(mapId);
+                    Post(callbacks?.Completed);
+                }
+                catch (OperationCanceledException)
+                {
+                    Post(callbacks?.Status, "Community action cancelled.");
+                }
+                catch (Exception ex)
+                {
+                    Plugin.Log.LogWarning("Community account action failed: " + ex.Message);
+                    Post(callbacks?.Failed, SafeMessage(ex));
+                }
+            });
+            return operation;
+        }
+
+        private static string EnsureAccessToken(CommunityPublishOperation operation,
+                                                Action<string, Uri> authenticationRequired,
+                                                string expectedSteamId64)
+        {
+            lock (AuthGate)
+            {
+                operation.CancelIfRequested();
+                LoadRefreshToken();
+                if (!string.IsNullOrEmpty(_accessToken)
+                    && _accessExpiresUtc > DateTime.UtcNow.AddMinutes(1)) return _accessToken;
+                if (!string.IsNullOrEmpty(_refreshToken))
+                {
+                    try
+                    {
+                        var refreshed = SendJson("POST", new Uri(_apiBase, "auth/refresh"),
+                            Json.Object().Add("refreshToken", _refreshToken).ToString(), null,
+                            operation, RequestTimeoutMs);
+                        if (refreshed.Status == 200)
+                        {
+                            AcceptTokenResponse(refreshed);
+                            ValidateIdentity(operation, expectedSteamId64);
+                            return _accessToken;
+                        }
+                        if (refreshed.Status == 401 || refreshed.Status == 403) DeleteRefreshToken();
+                        else RequireStatus(refreshed, 200);
+                    }
+                    catch (ApiException ex)
+                    {
+                        if (ex.Status == 401 || ex.Status == 403) DeleteRefreshToken();
+                        else throw;
+                    }
+                }
+
+                var created = SendJson("POST", new Uri(_apiBase, "auth/device-sessions"), "{}",
+                                       null, operation, RequestTimeoutMs);
+                RequireStatus(created, 201);
+                var body = ParseObject(created);
+                var sessionId = body["deviceSessionId"].AsStringOr(string.Empty);
+                var secret = body["deviceSecret"].AsStringOr(string.Empty);
+                var userCode = body["userCode"].AsStringOr(string.Empty);
+                var activationPath = body["activationPath"].AsStringOr(string.Empty);
+                var pollSeconds = body["pollIntervalSeconds"].AsIntOr(5);
+                if (!IsGuid(sessionId) || secret.Length != 43 || userCode.Length != 9
+                    || !activationPath.StartsWith("/activate?", StringComparison.Ordinal)
+                    || pollSeconds < 1 || pollSeconds > 30)
+                {
+                    throw new InvalidDataException("The server returned an invalid Steam device session.");
+                }
+                var activationUri = new Uri(_origin, activationPath);
+                if (activationUri.Scheme != Uri.UriSchemeHttps || activationUri.Authority != _origin.Authority)
+                    throw new InvalidDataException("The Steam activation URL was not on the configured server.");
+                Post(authenticationRequired, userCode, activationUri);
+
+                while (true)
+                {
+                    operation.Wait(pollSeconds * 1000);
+                    var poll = SendJson("POST", new Uri(_apiBase, "auth/device-sessions/token"),
+                        Json.Object().Add("deviceSessionId", sessionId).Add("deviceSecret", secret).ToString(),
+                        null, operation, RequestTimeoutMs);
+                    if (poll.Status == 202) continue;
+                    if (poll.Status == 429)
+                    {
+                        pollSeconds = Math.Max(pollSeconds, RetryAfter(poll, pollSeconds));
+                        continue;
+                    }
+                    RequireStatus(poll, 200);
+                    AcceptTokenResponse(poll);
+                    ValidateIdentity(operation, expectedSteamId64);
+                    return _accessToken;
+                }
+            }
+        }
+
+        private static void ValidateIdentity(CommunityPublishOperation operation,
+                                             string expectedSteamId64)
+        {
+            var response = Send("GET", new Uri(_apiBase, "me"), null, null, _accessToken,
+                                operation, RequestTimeoutMs, null);
+            RequireStatus(response, 200);
+            var steamId = ParseObject(response)["steamId64"].AsStringOr(string.Empty);
+            if (steamId.Length < 17 || steamId != expectedSteamId64)
+            {
+                DeleteRefreshToken();
+                throw new InvalidOperationException("The browser signed into a different Steam account than the game.");
+            }
+        }
+
+        private static void AcceptTokenResponse(ApiResponse response)
+        {
+            var body = ParseObject(response);
+            var access = body["accessToken"].AsStringOr(string.Empty);
+            var refresh = body["refreshToken"].AsStringOr(string.Empty);
+            var expires = body["expiresInSeconds"].AsIntOr(0);
+            var scope = body["scope"].AsStringOr(string.Empty);
+            if (access.Length < 32 || access.Length > 4096 || refresh.Length != 43
+                || expires < 60 || expires > 3600 || !HasScope(scope, "maps:upload"))
+            {
+                throw new InvalidDataException("Steam authentication did not grant a valid publishing session.");
+            }
+            _accessToken = access;
+            _accessExpiresUtc = DateTime.UtcNow.AddSeconds(expires);
+            _refreshToken = refresh;
+            SaveRefreshToken();
+            SharingPatches.RefreshCommunitySessionButton();
+        }
+
+        private static void PollPublication(Uri statusUri, string uploadId, string accessToken,
+                                            CommunityPublishOperation operation,
+                                            CommunityPublishCallbacks callbacks)
+        {
+            for (var attempt = 0; attempt < 150; attempt++)
+            {
+                operation.Wait(attempt == 0 ? 500 : 2000);
+                var response = Send("GET", statusUri, null, null, accessToken, operation,
+                                    RequestTimeoutMs, null);
+                RequireStatus(response, 200);
+                var body = ParseObject(response);
+                if (body["uploadId"].AsStringOr(string.Empty) != uploadId)
+                    throw new InvalidDataException("The upload status identity changed.");
+                var status = body["status"].AsStringOr(string.Empty);
+                if (status == "published")
+                {
+                    var mapId = body["mapId"].AsStringOr(string.Empty);
+                    var revision = body["revision"].AsIntOr(0);
+                    if (!IsGuid(mapId) || revision < 1)
+                        throw new InvalidDataException("The published map response is invalid.");
+                    CommunityCatalogClient.NotePublished(mapId, revision);
+                    CommunityCatalogClient.ForceRefresh();
+                    Post(callbacks.Published, mapId, revision);
+                    return;
+                }
+                if (status == "rejected" || status == "expired" || status == "cancelled")
+                {
+                    var message = body["errorMessage"].AsStringOr("The server rejected the upload.");
+                    throw new InvalidDataException(message);
+                }
+                if (status != "uploaded" && status != "validating" && status != "reserved")
+                    throw new InvalidDataException("The server returned an unknown upload state.");
+            }
+            throw new TimeoutException("Server validation did not finish in time.");
+        }
+
+        private static ApiResponse UploadFile(Uri uri, LevelSharing.UploadPackage package,
+                                              string accessToken, CommunityPublishOperation operation,
+                                              CommunityPublishCallbacks callbacks)
+        {
+            using (var input = new FileStream(package.Path, FileMode.Open, FileAccess.Read, FileShare.Read))
+            {
+                if (input.Length != package.SizeBytes) throw new IOException("The package changed after preflight.");
+                return Send("PUT", uri, input, "application/vnd.ss2revive.level", accessToken,
+                    operation, UploadTimeoutMs, delegate(long sent)
+                    {
+                        var progress = package.SizeBytes <= 0 ? 0f : (float)sent / package.SizeBytes;
+                        Post(callbacks.Progress, Math.Max(0f, Math.Min(1f, progress)));
+                    }, package.SizeBytes, package.Sha256);
+            }
+        }
+
+        private static ApiResponse SendJson(string method, Uri uri, string json, string accessToken,
+                                            CommunityPublishOperation operation, int timeout)
+        {
+            var bytes = Encoding.UTF8.GetBytes(json ?? string.Empty);
+            using (var input = new MemoryStream(bytes, false))
+                return Send(method, uri, input, "application/json", accessToken, operation,
+                            timeout, null, bytes.LongLength, null);
+        }
+
+        private static ApiResponse Send(string method, Uri uri, Stream body, string contentType,
+                                        string accessToken, CommunityPublishOperation operation,
+                                        int timeout, Action<long> progress, long contentLength = 0,
+                                        string sha256 = null)
+        {
+            if (uri == null || uri.Scheme != Uri.UriSchemeHttps || uri.Authority != _origin.Authority)
+                throw new InvalidOperationException("Refusing an API request outside the configured HTTPS origin.");
+            var request = (HttpWebRequest)WebRequest.Create(uri);
+            request.Method = method;
+            request.AllowAutoRedirect = false;
+            request.AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate;
+            request.Timeout = timeout;
+            request.ReadWriteTimeout = timeout;
+            request.KeepAlive = false;
+            request.UserAgent = "SS2Revive/" + Plugin.PluginVersion;
+            request.Accept = "application/json";
+            if (!string.IsNullOrEmpty(accessToken)) request.Headers[HttpRequestHeader.Authorization] = "Bearer " + accessToken;
+            if (body != null)
+            {
+                request.ContentType = contentType;
+                request.ContentLength = contentLength;
+                request.AllowWriteStreamBuffering = false;
+                if (!string.IsNullOrEmpty(sha256)) request.Headers["X-Content-SHA256"] = sha256;
+            }
+            operation.SetRequest(request);
+            try
+            {
+                if (body != null)
+                {
+                    using (var output = request.GetRequestStream())
+                    {
+                        var buffer = new byte[64 * 1024];
+                        long sent = 0;
+                        while (true)
+                        {
+                            operation.CancelIfRequested();
+                            var read = body.Read(buffer, 0, buffer.Length);
+                            if (read <= 0) break;
+                            output.Write(buffer, 0, read);
+                            sent += read;
+                            progress?.Invoke(sent);
+                        }
+                        if (sent != contentLength) throw new IOException("The upload size changed while sending.");
+                    }
+                }
+                try
+                {
+                    using (var response = (HttpWebResponse)request.GetResponse())
+                        return ReadResponse(response);
+                }
+                catch (WebException ex)
+                {
+                    var response = ex.Response as HttpWebResponse;
+                    if (response == null) throw;
+                    using (response) return ReadResponse(response);
+                }
+            }
+            finally
+            {
+                operation.ClearRequest(request);
+            }
+        }
+
+        private static ApiResponse ReadResponse(HttpWebResponse response)
+        {
+            using (var input = response.GetResponseStream())
+            using (var output = new MemoryStream())
+            {
+                if (input != null)
+                {
+                    var buffer = new byte[4096];
+                    while (true)
+                    {
+                        var read = input.Read(buffer, 0, buffer.Length);
+                        if (read <= 0) break;
+                        if (output.Length + read > JsonLimit)
+                            throw new InvalidDataException("The server response exceeded its limit.");
+                        output.Write(buffer, 0, read);
+                    }
+                }
+                return new ApiResponse
+                {
+                    Status = (int)response.StatusCode,
+                    Body = Encoding.UTF8.GetString(output.ToArray()),
+                    RetryAfter = response.Headers["Retry-After"],
+                };
+            }
+        }
+
+        private static Json ParseObject(ApiResponse response)
+        {
+            var parsed = SafeParse(response.Body);
+            if (parsed == null || parsed.Kind != JsonKind.Object)
+                throw new InvalidDataException("The server returned invalid JSON.");
+            return parsed;
+        }
+
+        private static void RequireStatus(ApiResponse response, int expected)
+        {
+            if (response.Status == expected) return;
+            var code = "http_" + response.Status;
+            var message = "The community server returned HTTP " + response.Status + ".";
+            var parsed = SafeParse(response.Body);
+            if (parsed != null)
+            {
+                var error = parsed["error"];
+                if (error != null)
+                {
+                    code = error["code"].AsStringOr(code);
+                    message = error["message"].AsStringOr(message);
+                }
+            }
+            throw new ApiException(response.Status, code, message);
+        }
+
+        private static int RetryAfter(ApiResponse response, int fallback)
+        {
+            int seconds;
+            return int.TryParse(response.RetryAfter, out seconds) && seconds >= 1 && seconds <= 60
+                ? seconds : fallback;
+        }
+
+        private static bool HasScope(string scopes, string required)
+        {
+            var split = (scopes ?? string.Empty).Split(new[] { ' ' }, StringSplitOptions.RemoveEmptyEntries);
+            for (var i = 0; i < split.Length; i++) if (split[i] == required) return true;
+            return false;
+        }
+
+        private static bool IsGuid(string value)
+        {
+            Guid ignored;
+            return !string.IsNullOrEmpty(value) && Guid.TryParseExact(value, "D", out ignored)
+                   && value == value.ToLowerInvariant();
+        }
+
+        private static bool IsSafeApiPath(string value, string prefix, string suffix)
+        {
+            return !string.IsNullOrEmpty(value) && value.StartsWith(prefix, StringComparison.Ordinal)
+                   && value.EndsWith(suffix, StringComparison.Ordinal)
+                   && value.IndexOf("..", StringComparison.Ordinal) < 0
+                   && value.IndexOf('\\') < 0 && value.IndexOf("//", StringComparison.Ordinal) < 0;
+        }
+
+        /// <summary>
+        /// Json.Parse is recursive descent and Json.TryParse catches only FormatException, so a
+        /// deeply nested body from a hostile or compromised server would overflow the stack and
+        /// kill the process. Bound the nesting first, as the catalogue and bundle readers do.
+        /// </summary>
+        private static Json SafeParse(string body)
+        {
+            if (string.IsNullOrEmpty(body)) return null;
+            if (!SS2ReviveData.CommunityCatalog.HasSafeNesting(body)) return null;
+            return Json.TryParse(body);
+        }
+
+        private static byte[] TokenEntropy()
+        {
+            return Encoding.UTF8.GetBytes(TokenEntropyPrefix + _origin.Authority.ToLowerInvariant());
+        }
+
+        private static string OriginFingerprint(Uri origin)
+        {
+            using (var sha = SHA256.Create())
+            {
+                var digest = sha.ComputeHash(Encoding.UTF8.GetBytes(origin.Authority.ToLowerInvariant()));
+                var text = new StringBuilder(16);
+                for (var i = 0; i < 8; i++) text.Append(digest[i].ToString("x2"));
+                return text.ToString();
+            }
+        }
+
+        private static void LoadRefreshToken()
+        {
+            if (_tokenLoaded) return;
+            _tokenLoaded = true;
+            if (string.IsNullOrEmpty(_tokenPath) || !File.Exists(_tokenPath)) return;
+            try
+            {
+                var encrypted = File.ReadAllBytes(_tokenPath);
+                if (encrypted.Length < 32 || encrypted.Length > 8192) throw new InvalidDataException();
+                var plain = ProtectedData.Unprotect(encrypted, TokenEntropy(), DataProtectionScope.CurrentUser);
+                var value = Encoding.UTF8.GetString(plain);
+                Array.Clear(plain, 0, plain.Length);
+                var parts = value.Split(SessionFieldSeparator);
+                if (parts.Length != 3 || parts[0] != "v2" || parts[1].Length == 0
+                    || parts[2].Length != 43)
+                    throw new InvalidDataException();
+                // Refuse a session minted by a different server even if the file was copied here.
+                if (!string.Equals(parts[1], _origin.Authority, StringComparison.OrdinalIgnoreCase))
+                    throw new InvalidDataException();
+                _refreshToken = parts[2];
+            }
+            catch
+            {
+                DeleteRefreshToken();
+            }
+        }
+
+        private static void SaveRefreshToken()
+        {
+            if (string.IsNullOrEmpty(_tokenPath) || string.IsNullOrEmpty(_refreshToken)) return;
+            var plain = Encoding.UTF8.GetBytes("v2" + SessionFieldSeparator + _origin.Authority
+                                               + SessionFieldSeparator + _refreshToken);
+            try
+            {
+                var encrypted = ProtectedData.Protect(plain, TokenEntropy(), DataProtectionScope.CurrentUser);
+                AtomicFile.WriteAllBytes(_tokenPath, encrypted);
+                Array.Clear(encrypted, 0, encrypted.Length);
+            }
+            finally
+            {
+                Array.Clear(plain, 0, plain.Length);
+            }
+        }
+
+        private static void DeleteRefreshToken()
+        {
+            _refreshToken = null;
+            _accessToken = null;
+            _accessExpiresUtc = DateTime.MinValue;
+            try { if (!string.IsNullOrEmpty(_tokenPath) && File.Exists(_tokenPath)) File.Delete(_tokenPath); }
+            catch (Exception ex) { Plugin.Log.LogWarning("Could not remove the community session: " + ex.Message); }
+        }
+
+        private static string SafeMessage(Exception error)
+        {
+            var message = error?.Message ?? "Publishing failed.";
+            if (message.Length > 400) message = message.Substring(0, 400);
+            return message.Replace('\r', ' ').Replace('\n', ' ').Trim();
+        }
+
+        private static void Post(Action<string> callback, string value)
+        {
+            if (callback != null) Dispatcher.NextFrame(() => callback(value));
+        }
+
+        private static void Post(Action callback)
+        {
+            if (callback != null) Dispatcher.NextFrame(callback);
+        }
+
+        private static void Post(Action<float> callback, float value)
+        {
+            if (callback != null) Dispatcher.NextFrame(() => callback(value));
+        }
+
+        private static void Post(Action<string, Uri> callback, string code, Uri uri)
+        {
+            if (callback != null) Dispatcher.NextFrame(() => callback(code, uri));
+        }
+
+        private static void Post(Action<string, int> callback, string mapId, int revision)
+        {
+            if (callback != null) Dispatcher.NextFrame(() => callback(mapId, revision));
+        }
+
+        private sealed class ApiResponse
+        {
+            internal int Status;
+            internal string Body;
+            internal string RetryAfter;
+        }
+
+        private sealed class ApiException : Exception
+        {
+            internal readonly int Status;
+            internal readonly string Code;
+
+            internal ApiException(int status, string code, string message) : base(message)
+            {
+                Status = status;
+                Code = code;
+            }
+        }
+
+        private static void CancelIfRequested(this CommunityPublishOperation operation)
+        {
+            if (operation.IsCancelled) throw new OperationCanceledException();
+        }
+    }
+}
diff --git a/src/SS2Revive/CommunityPublishOverlay.cs b/src/SS2Revive/CommunityPublishOverlay.cs
new file mode 100644
index 0000000..b2c1746
--- /dev/null
+++ b/src/SS2Revive/CommunityPublishOverlay.cs
@@ -0,0 +1,390 @@
+using System;
+using System.Threading;
+using Data;
+using HarmonyLib;
+using InControl;
+using Services;
+using TMPro;
+using UnityEngine;
+using UnityEngine.UI;
+
+namespace SS2Revive
+{
+    /// <summary>
+    /// Full-size terminal overlay for the online publication flow. The first implementation is a
+    /// deliberately local preflight: it proves the modal lifecycle, controller navigation and
+    /// bundle export, Steam device authentication, private quarantine upload, server validation
+    /// and publication without ever putting an R2 credential in the mod.
+    /// </summary>
+    internal sealed class CommunityPublishOverlay : MonoBehaviour
+    {
+        private const string ObjectName = "SS2ReviveCommunityPublishOverlay";
+
+        private static CommunityPublishOverlay _active;
+
+        private InputService _inputService;
+        private InputTarget _inputTarget;
+        private DynamicPlayerActionSet _actionSet;
+        private PlayerAction _menuBackAction;
+        private Selectable _previousSelectable;
+        private ExtendedButton _prepareButton;
+        private ExtendedButton _closeButton;
+        private TextMeshProUGUI _status;
+        private string _serverLevelId;
+        private bool _released;
+        private bool _closed;
+        private CommunityPublishOperation _operation;
+        private float _lastProgressUpdate;
+        private bool _wasMenuInputEnabled;
+        private bool _menuInputStateCaptured;
+
+        internal static void Show(TerminalLevelModalController modal, LevelSummaryData summary)
+        {
+            if (modal == null || summary == null || string.IsNullOrEmpty(summary.serverLevelId)) return;
+            HideActive();
+
+            var parent = modal.transform.parent;
+            var template = AccessTools.Field(typeof(TerminalLevelModalController), "_cancelButton")
+                ?.GetValue(modal) as ExtendedButton;
+            if (parent == null || template == null)
+            {
+                TerminalMessage.Show("The online publishing panel is unavailable in this terminal.",
+                                     isWarning: true);
+                return;
+            }
+
+            try
+            {
+                var root = new GameObject(ObjectName, typeof(RectTransform), typeof(Canvas),
+                                          typeof(GraphicRaycaster), typeof(CanvasRenderer),
+                                          typeof(Image), typeof(CanvasGroup));
+                root.transform.SetParent(parent, false);
+                var overlay = root.AddComponent<CommunityPublishOverlay>();
+                _active = overlay;
+                overlay.Build(modal, summary, template);
+                modal.Hide();
+                root.transform.SetAsLastSibling();
+                overlay.AcquireInput();
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogError("Opening the online publishing overlay threw: " + ex);
+                HideActive();
+                TerminalMessage.Show("Could not open online publishing. See the log.", isWarning: true);
+            }
+        }
+
+        internal static void HideActive()
+        {
+            var active = _active;
+            _active = null;
+            if (active == null) return;
+            active._closed = true;
+            active._operation?.Cancel();
+            active.ReleaseInput();
+            if (active.gameObject != null) UnityEngine.Object.Destroy(active.gameObject);
+        }
+
+        private void Build(TerminalLevelModalController modal, LevelSummaryData summary,
+                           ExtendedButton template)
+        {
+            _serverLevelId = summary.serverLevelId;
+
+            var rootRect = transform as RectTransform;
+            rootRect.anchorMin = Vector2.zero;
+            rootRect.anchorMax = Vector2.one;
+            rootRect.offsetMin = Vector2.zero;
+            rootRect.offsetMax = Vector2.zero;
+            rootRect.localScale = Vector3.one;
+
+            // This is a sibling of a stock modal whose close animation and InputTarget disable
+            // CanvasGroups asynchronously. Give the overlay its own raycaster/sort boundary and
+            // ignore those parent groups so it stays genuinely interactive while the stock modal
+            // finishes closing underneath it.
+            var canvas = GetComponent<Canvas>();
+            canvas.overrideSorting = true;
+            canvas.sortingOrder = 30000;
+
+            var backdrop = GetComponent<Image>();
+            backdrop.color = new Color(0.015f, 0.02f, 0.035f, 0.97f);
+            backdrop.raycastTarget = true;
+
+            var canvasGroup = GetComponent<CanvasGroup>();
+            canvasGroup.alpha = 1f;
+            canvasGroup.interactable = true;
+            canvasGroup.blocksRaycasts = true;
+            canvasGroup.ignoreParentGroups = true;
+
+            var panel = Panel("PublishPanel", transform, new Vector2(1040f, 610f),
+                              new Color(0.055f, 0.075f, 0.11f, 1f));
+            var sourceText = template.GetComponentInChildren<TextMeshProUGUI>(true);
+
+            Text("Header", panel, sourceText, "PUBLISH ONLINE", 38f,
+                 new Vector2(40f, -30f), new Vector2(-40f, -90f), TextAlignmentOptions.MidlineLeft);
+            Text("LevelName", panel, sourceText, Safe(summary.levelName, 128), 29f,
+                 new Vector2(410f, -125f), new Vector2(-45f, -175f), TextAlignmentOptions.MidlineLeft);
+            Text("Description", panel, sourceText,
+                 string.IsNullOrWhiteSpace(summary.levelDescription)
+                     ? "No description has been set for this level."
+                     : Safe(summary.levelDescription, 600),
+                 20f, new Vector2(410f, -180f), new Vector2(-45f, -330f),
+                 TextAlignmentOptions.TopLeft);
+
+            var sourceImage = AccessTools.Field(typeof(TerminalLevelModalController), "_levelImageInfoPanel")
+                ?.GetValue(modal) as Image;
+            var preview = Image("Thumbnail", panel, sourceImage == null ? null : sourceImage.sprite,
+                                new Vector2(325f, 183f));
+            var previewRect = preview.transform as RectTransform;
+            previewRect.anchorMin = new Vector2(0f, 1f);
+            previewRect.anchorMax = new Vector2(0f, 1f);
+            previewRect.pivot = new Vector2(0f, 1f);
+            previewRect.anchoredPosition = new Vector2(45f, -130f);
+
+            Text("ValidationHeader", panel, sourceText, "SECURE UPLOAD PREFLIGHT", 22f,
+                 new Vector2(45f, -350f), new Vector2(-45f, -390f), TextAlignmentOptions.MidlineLeft);
+            _status = Text("Status", panel, sourceText,
+                "The level will be packaged locally, linked to your Steam account in the system "
+                + "browser, uploaded into private quarantine, validated, and then published.",
+                18f, new Vector2(45f, -395f), new Vector2(-45f, -485f), TextAlignmentOptions.TopLeft);
+
+            _prepareButton = CloneButton(template, panel, "PrepareButton", "PUBLISH");
+            _closeButton = CloneButton(template, panel, "CloseButton", "CLOSE");
+            PositionButton(_prepareButton, new Vector2(-265f, 42f));
+            PositionButton(_closeButton, new Vector2(-45f, 42f));
+            _prepareButton.OnPointerClickButton = Prepare;
+            _closeButton.OnPointerClickButton = Close;
+
+            var prepareNavigation = new Navigation
+            {
+                mode = Navigation.Mode.Explicit,
+                selectOnRight = _closeButton,
+            };
+            _prepareButton.navigation = prepareNavigation;
+            var closeNavigation = new Navigation
+            {
+                mode = Navigation.Mode.Explicit,
+                selectOnLeft = _prepareButton,
+            };
+            _closeButton.navigation = closeNavigation;
+        }
+
+        private void AcquireInput()
+        {
+            _inputService = Shell.Instance.GetInputService();
+            _wasMenuInputEnabled = _inputService.MainMenuInputActionSet.Enabled;
+            _menuInputStateCaptured = true;
+            _previousSelectable = _inputService.GetCurrentDefaultSelectable();
+            var menuBack = _inputService.GetInputProfile()._levelEditor.MenuBack;
+            _actionSet = new DynamicPlayerActionSet();
+            _menuBackAction = _actionSet.AddPlayerAction("MenuBack", menuBack);
+            _inputTarget = new InputTarget(InputCursorMode.WithinWindow,
+                new PlayerActionSet[] { _actionSet }, new[] { GetComponent<CanvasGroup>() },
+                _prepareButton);
+            _inputService.PushInputTarget(_inputTarget);
+            if (!_wasMenuInputEnabled) _inputService.EnableMenuInput();
+            _inputService.SetDefaultSelectable(_prepareButton);
+        }
+
+        private void ReleaseInput()
+        {
+            if (_released) return;
+            _released = true;
+            if (_inputService != null && _inputTarget != null
+                && _inputService.IsInputTargetActive(_inputTarget))
+            {
+                _inputService.PopInputTarget();
+            }
+            if (_inputService != null && _previousSelectable != null)
+                _inputService.SetDefaultSelectable(_previousSelectable);
+            if (_inputService != null && _menuInputStateCaptured && !_wasMenuInputEnabled)
+                _inputService.DisableMenuInput();
+        }
+
+        private void Prepare(ExtendedButton ignored)
+        {
+            _prepareButton.interactable = false;
+            _status.text = "Preparing and hashing the current level package...";
+            var levelId = _serverLevelId;
+            ThreadPool.QueueUserWorkItem(delegate
+            {
+                LevelSharing.UploadPackage package;
+                string message;
+                var prepared = LevelSharing.PrepareUpload(levelId, out package, out message);
+                Dispatcher.NextFrame(() =>
+                {
+                    if (_closed || this == null) return;
+                    if (!prepared)
+                    {
+                        Failed("Preflight failed: " + Safe(message, 360));
+                        return;
+                    }
+                    _status.text = "Preflight passed. Starting protected Steam authentication...";
+                    CommunityPublishOperation operation = null;
+                    var callbacks = new CommunityPublishCallbacks
+                    {
+                        Status = value => { if (IsCurrent(operation)) _status.text = Safe(value, 400); },
+                        Progress = value => { if (IsCurrent(operation)) UploadProgress(value); },
+                        AuthenticationRequired = (code, uri) =>
+                        {
+                            if (!IsCurrent(operation)) return;
+                            _status.text = "Steam code " + Safe(code, 16)
+                                + " opened in your browser. Approve the device, then return here.";
+                            try { Application.OpenURL(uri.AbsoluteUri); }
+                            catch (Exception ex) { Failed("Could not open Steam login: " + ex.Message); }
+                        },
+                        Published = (mapId, revision) =>
+                        {
+                            if (!IsCurrent(operation)) return;
+                            if (!string.Equals(mapId, package.LevelId,
+                                               StringComparison.OrdinalIgnoreCase)
+                                || revision != package.Revision)
+                            {
+                                Failed("The server published a different map revision than the prepared package.");
+                                return;
+                            }
+                            CommunityCatalogClient.NotePublished(mapId, revision);
+                            UgcBackend.ConfirmCommunityPublished(mapId, revision);
+                            SharingPatches.RefreshCurrentCreateScreen();
+                            _status.text = "Published successfully as revision " + revision
+                                + ". This local map is now marked Published and Online.";
+                            SharingPatches.SetLabel(_prepareButton, "PUBLISHED");
+                        },
+                        Failed = value => { if (IsCurrent(operation)) Failed(value); },
+                    };
+                    operation = CommunityPublishClient.Publish(package, callbacks);
+                    _operation = operation;
+                });
+            });
+        }
+
+        private bool IsCurrent(CommunityPublishOperation operation) =>
+            !_closed && operation != null && ReferenceEquals(_operation, operation);
+
+        private void UploadProgress(float value)
+        {
+            if (value < 1f && Time.realtimeSinceStartup - _lastProgressUpdate < 0.1f) return;
+            _lastProgressUpdate = Time.realtimeSinceStartup;
+            _status.text = "Uploading to private quarantine... "
+                + Math.Round(Math.Max(0f, Math.Min(1f, value)) * 100f) + "%";
+        }
+
+        private void Failed(string value)
+        {
+            _status.text = "Publishing failed: " + Safe(value, 360);
+            _operation?.Cancel();
+            _operation = null;
+            _prepareButton.interactable = true;
+            SharingPatches.SetLabel(_prepareButton, "RETRY");
+        }
+
+        private void Close(ExtendedButton ignored) => HideActive();
+
+        private void Update()
+        {
+            if (_menuBackAction != null && _menuBackAction.WasPressed) HideActive();
+        }
+
+        private void OnDestroy()
+        {
+            _closed = true;
+            _operation?.Cancel();
+            if (ReferenceEquals(_active, this)) _active = null;
+            ReleaseInput();
+        }
+
+        private static RectTransform Panel(string name, Transform parent, Vector2 size, Color color)
+        {
+            var gameObject = new GameObject(name, typeof(RectTransform), typeof(CanvasRenderer), typeof(Image));
+            gameObject.transform.SetParent(parent, false);
+            var rect = gameObject.transform as RectTransform;
+            rect.anchorMin = new Vector2(0.5f, 0.5f);
+            rect.anchorMax = new Vector2(0.5f, 0.5f);
+            rect.pivot = new Vector2(0.5f, 0.5f);
+            rect.sizeDelta = size;
+            rect.anchoredPosition = Vector2.zero;
+            gameObject.GetComponent<Image>().color = color;
+            return rect;
+        }
+
+        private static TextMeshProUGUI Text(string name, Transform parent, TextMeshProUGUI style,
+                                            string value, float size, Vector2 offsetMin,
+                                            Vector2 offsetMax, TextAlignmentOptions alignment)
+        {
+            var gameObject = new GameObject(name, typeof(RectTransform), typeof(CanvasRenderer),
+                                            typeof(TextMeshProUGUI));
+            gameObject.transform.SetParent(parent, false);
+            var rect = gameObject.transform as RectTransform;
+            rect.anchorMin = new Vector2(0f, 1f);
+            rect.anchorMax = new Vector2(1f, 1f);
+            rect.pivot = new Vector2(0.5f, 1f);
+            // Callers provide top-left then bottom-right coordinates from the panel's top edge.
+            rect.offsetMin = new Vector2(offsetMin.x, offsetMax.y);
+            rect.offsetMax = new Vector2(offsetMax.x, offsetMin.y);
+            var text = gameObject.GetComponent<TextMeshProUGUI>();
+            if (style != null)
+            {
+                text.font = style.font;
+                text.fontSharedMaterial = style.fontSharedMaterial;
+            }
+            text.text = value ?? string.Empty;
+            text.fontSize = size;
+            text.color = Color.white;
+            text.alignment = alignment;
+            text.enableWordWrapping = true;
+            text.richText = false;
+            text.raycastTarget = false;
+            return text;
+        }
+
+        private static Image Image(string name, Transform parent, Sprite sprite, Vector2 size)
+        {
+            var gameObject = new GameObject(name, typeof(RectTransform), typeof(CanvasRenderer), typeof(Image));
+            gameObject.transform.SetParent(parent, false);
+            var rect = gameObject.transform as RectTransform;
+            rect.sizeDelta = size;
+            var image = gameObject.GetComponent<Image>();
+            image.sprite = sprite;
+            image.preserveAspect = true;
+            image.color = sprite == null ? new Color(0.11f, 0.14f, 0.18f, 1f) : Color.white;
+            image.raycastTarget = false;
+            return image;
+        }
+
+        private static ExtendedButton CloneButton(ExtendedButton template, Transform parent,
+                                                   string name, string label)
+        {
+            var clone = UnityEngine.Object.Instantiate(template.gameObject, parent);
+            clone.name = name;
+            var button = clone.GetComponent<ExtendedButton>();
+            button.onClick = new Button.ButtonClickedEvent();
+            button.OnPointerClickButton = null;
+            button.OnPointerEnterButton = null;
+            button.OnPointerExitButton = null;
+            button.interactable = true;
+            SharingPatches.StripLocalisation(clone);
+            SharingPatches.SetLabel(button, label);
+            return button;
+        }
+
+        private static void PositionButton(ExtendedButton button, Vector2 position)
+        {
+            var rect = button.transform as RectTransform;
+            rect.anchorMin = new Vector2(1f, 0f);
+            rect.anchorMax = new Vector2(1f, 0f);
+            rect.pivot = new Vector2(1f, 0f);
+            rect.anchoredPosition = position;
+        }
+
+        private static string Safe(string value, int maximum)
+        {
+            if (string.IsNullOrEmpty(value)) return string.Empty;
+            var length = Math.Min(value.Length, maximum);
+            var result = value.Substring(0, length);
+            for (var i = 0; i < result.Length; i++)
+            {
+                if (result[i] < ' ') result = result.Replace(result[i], ' ');
+            }
+            return result.Trim();
+        }
+    }
+}
diff --git a/src/SS2Revive/LegacyLevelCatalog.cs b/src/SS2Revive/LegacyLevelCatalog.cs
new file mode 100644
index 0000000..4322f14
--- /dev/null
+++ b/src/SS2Revive/LegacyLevelCatalog.cs
@@ -0,0 +1,438 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Security.Cryptography;
+using System.Text;
+using Data;
+using Services;
+using SS2ReviveData;
+using UnityEngine;
+
+namespace SS2Revive
+{
+    /// <summary>
+    /// Read-only view over the levels Bossa left in StreamingAssets/LegacyLevels.
+    ///
+    /// These are part of the game install, but the final game only scans StreamingAssets/Levels.
+    /// Treating the archive as another UGC source lets the existing Discover screen display and
+    /// launch it without copying, converting or uploading anything. Content keys resolve only to
+    /// files discovered beneath that exact directory, and a file is hashed again when opened so a
+    /// changed file cannot inherit the trust granted to the installed one at startup.
+    /// </summary>
+    internal static class LegacyLevelCatalog
+    {
+        internal const string LegacyTag = "LEGACY_MAP";
+        internal const string DisplayPrefix = "[LEGACY] ";
+
+        private const string KeyPrefix = "ss2revive-legacy/";
+        private const int MaxLevelBytes = 4096000;
+        private const int MaxImageBytes = 1024 * 1024;
+
+        private sealed class Entry
+        {
+            internal string Id;
+            internal string ContentKey;
+            internal string LevelPath;
+            internal string Sha256;
+            internal Bossa.Framework.Utils.Guid ClientLevelId;
+            internal LevelSummaryImageData LegacyImage;
+            internal UgcLevelRecord Record;
+        }
+
+        private static readonly List<Entry> Entries = new List<Entry>();
+        private static readonly Dictionary<string, Entry> ById =
+            new Dictionary<string, Entry>(StringComparer.OrdinalIgnoreCase);
+        private static readonly Dictionary<string, Entry> ByKey =
+            new Dictionary<string, Entry>(StringComparer.Ordinal);
+
+        private static string _root;
+        private static bool _browseOnly;
+
+        internal static int Count => Entries.Count;
+        internal static bool BrowseActive => _browseOnly;
+
+        internal static void Initialise()
+        {
+            Entries.Clear();
+            ById.Clear();
+            ByKey.Clear();
+
+            _root = Path.Combine(Application.streamingAssetsPath, "LegacyLevels");
+            if (!Directory.Exists(_root))
+            {
+                Plugin.Log.LogInfo("No bundled LegacyLevels archive was found at " + _root + ".");
+                return;
+            }
+
+            var skipped = 0;
+            var summaryFallbacks = 0;
+            try
+            {
+                var files = Directory.GetFiles(_root, "*.lvl", SearchOption.AllDirectories);
+                Array.Sort(files, StringComparer.OrdinalIgnoreCase);
+                for (var i = 0; i < files.Length; i++)
+                {
+                    try
+                    {
+                        var entry = ReadEntry(files[i], ref summaryFallbacks);
+                        if (entry == null) { skipped++; continue; }
+
+                        // The archive contains one byte-identical onboarding duplicate. Content
+                        // hashes are the ids, so it naturally appears only once in the browser.
+                        if (ById.ContainsKey(entry.Id)) continue;
+
+                        Entries.Add(entry);
+                        ById.Add(entry.Id, entry);
+                        ByKey.Add(entry.ContentKey, entry);
+                    }
+                    catch (Exception ex)
+                    {
+                        skipped++;
+                        Plugin.Log.LogWarning("Skipping legacy level " + files[i] + ": "
+                                              + ex.Message);
+                    }
+                }
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogError("Could not scan the bundled LegacyLevels archive: " + ex);
+                Entries.Clear();
+                ById.Clear();
+                ByKey.Clear();
+                return;
+            }
+
+            Entries.Sort((a, b) => string.Compare(a.Record.Title, b.Record.Title,
+                                                   StringComparison.OrdinalIgnoreCase));
+            Plugin.Log.LogInfo("Legacy map catalogue ready: " + Entries.Count
+                               + " unique map(s), " + summaryFallbacks
+                               + " reconstructed summary file(s), " + skipped + " skipped.");
+        }
+
+        private static Entry ReadEntry(string levelPath, ref int summaryFallbacks)
+        {
+            var info = new FileInfo(levelPath);
+            if (info.Length < 10 || info.Length > MaxLevelBytes) return null;
+
+            byte[] header;
+            using (var input = new FileStream(levelPath, FileMode.Open, FileAccess.Read, FileShare.Read))
+            {
+                header = new byte[10];
+                if (input.Read(header, 0, header.Length) != header.Length) return null;
+            }
+
+            if (header[0] != 83 || header[1] != 117 || header[2] != 114 || header[3] != 103
+                || header[4] != 101 || header[5] != 111 || header[6] != 110 || header[7] != 115)
+                return null;
+
+            var version = header[8] | (header[9] << 8);
+            if (version < 1 || version >= 29 || version == 25) return null;
+
+            string hash;
+            using (var input = new FileStream(levelPath, FileMode.Open, FileAccess.Read, FileShare.Read))
+            using (var sha = SHA256.Create())
+                hash = Hex(sha.ComputeHash(input));
+
+            var idBytes = new byte[16];
+            for (var i = 0; i < idBytes.Length; i++) idBytes[i] = Convert.ToByte(hash.Substring(i * 2, 2), 16);
+            var systemId = new System.Guid(idBytes).ToString();
+            var clientId = new Bossa.Framework.Utils.Guid(systemId);
+
+            LevelSummaryData source = null;
+            var summaryPath = Path.ChangeExtension(levelPath, ".sdata");
+            if (File.Exists(summaryPath))
+            {
+                try
+                {
+                    var summaryInfo = new FileInfo(summaryPath);
+                    if (summaryInfo.Length > 0 && summaryInfo.Length <= MaxImageBytes)
+                        source = LevelFormatGuard.ReadTrustedBundledSummary(
+                            File.ReadAllBytes(summaryPath));
+                }
+                catch (Exception ex)
+                {
+                    Plugin.Log.LogWarning("Legacy summary could not be read for " + levelPath
+                                          + "; reconstructing it. " + ex.Message);
+                }
+            }
+
+            if (source == null)
+            {
+                summaryFallbacks++;
+                source = new LevelSummaryData(clientId, Path.GetFileNameWithoutExtension(levelPath),
+                    string.Empty);
+            }
+
+            var originalTitle = string.IsNullOrWhiteSpace(source.levelName)
+                ? Path.GetFileNameWithoutExtension(levelPath)
+                : source.levelName.Trim();
+            var title = Bound(DisplayPrefix + originalTitle, LevelBundle.MaxTitleCharacters);
+
+            var archiveNote = "Local legacy map from the Surgeon Simulator 2 installation"
+                              + " (level format " + version + ").";
+            var description = string.IsNullOrWhiteSpace(source.levelDescription)
+                ? archiveNote
+                : archiveNote + "\n\n" + source.levelDescription.Trim();
+            description = Bound(description, LevelBundle.MaxDescriptionCharacters);
+
+            var configurations = ValidConfigurations(source.levelConfigurations);
+            var tags = ValidTags(source.tags);
+            if (!tags.Contains(LegacyTag))
+            {
+                while (tags.Count >= LevelBundle.MaxTags) tags.RemoveAt(tags.Count - 1);
+                tags.Add(LegacyTag);
+            }
+            AddModeTag(tags, configurations);
+
+            var created = PlausibleDate(source.createdAt)
+                ? source.createdAt.ToUniversalTime()
+                : new DateTime(2019, 1, 1, 0, 0, 0, DateTimeKind.Utc);
+            var updated = PlausibleDate(source.updatedAt)
+                ? source.updatedAt.ToUniversalTime()
+                : created;
+
+            var validation = new LevelValidationStep("LEGACY_ARCHIVE")
+            {
+                id = System.Guid.NewGuid().ToString(),
+                validated = true,
+            };
+
+            var contentKey = KeyPrefix + systemId + "/level";
+            var record = new UgcLevelRecord
+            {
+                Id = systemId,
+                Title = title,
+                Description = description,
+                Status = UgcStore.StatusPublished,
+                CreatedAtMs = UnixMilliseconds(created),
+                UpdatedAtMs = UnixMilliseconds(updated),
+                IsImported = true,
+                Configurations = UgcBackend.ToStoredConfigurations(configurations),
+                Validations = UgcBackend.ToStoredValidations(
+                    new List<LevelValidationStep> { validation }),
+            };
+            record.Tags.AddRange(tags);
+            record.Contents.Add(new UgcContentRecord
+            {
+                Id = systemId,
+                Key = contentKey,
+                ImageKey = string.Empty,
+                CreatedAtMs = record.UpdatedAtMs,
+                ClientVersion = version,
+                ContentVersion = 1,
+                IsAutoSave = false,
+            });
+
+            var image = source.legacyLevelImage;
+            if (!ValidImage(image)) image = default(LevelSummaryImageData);
+
+            return new Entry
+            {
+                Id = systemId,
+                ContentKey = contentKey,
+                LevelPath = Path.GetFullPath(levelPath),
+                Sha256 = hash,
+                ClientLevelId = clientId,
+                LegacyImage = image,
+                Record = record,
+            };
+        }
+
+        internal static List<UgcLevelRecord> Search(UgcQuery query)
+        {
+            var result = new List<UgcLevelRecord>();
+            if (!_browseOnly) return result;
+            if (query == null) query = new UgcQuery();
+            for (var i = 0; i < Entries.Count; i++)
+            {
+                var record = Entries[i].Record;
+                if (Matches(record, query)) result.Add(record);
+            }
+            return result;
+        }
+
+        private static bool Matches(UgcLevelRecord level, UgcQuery query)
+        {
+            if (!query.AnyStatus && !string.IsNullOrEmpty(query.Status)
+                && !string.Equals(query.Status, UgcStore.StatusPublished,
+                                  StringComparison.OrdinalIgnoreCase)) return false;
+            if (!string.IsNullOrEmpty(query.CreatorId)) return false;
+            if (!string.IsNullOrEmpty(query.Tag) && !level.Tags.Contains(query.Tag)) return false;
+            if (!string.IsNullOrEmpty(query.TitleContains)
+                && level.Title.IndexOf(query.TitleContains, StringComparison.OrdinalIgnoreCase) < 0)
+                return false;
+            if (query.Ids != null && query.Ids.Count > 0 && !query.Ids.Contains(level.Id)) return false;
+            if (query.PartySize > 0 && !SupportsPartySize(level, query.PartySize)) return false;
+            return true;
+        }
+
+        private static bool SupportsPartySize(UgcLevelRecord level, int partySize)
+        {
+            if (level.Configurations == null || level.Configurations.Count == 0) return true;
+            foreach (var configuration in level.Configurations.Items)
+            {
+                var players = configuration["numberPlayers"];
+                if (players != null && players.AsInt() == partySize) return true;
+            }
+            return false;
+        }
+
+        internal static UgcLevelRecord Get(string id)
+        {
+            if (string.IsNullOrEmpty(id)) return null;
+            return ById.TryGetValue(id, out var entry) ? entry.Record : null;
+        }
+
+        internal static bool IsLegacy(string id) =>
+            !string.IsNullOrEmpty(id) && ById.ContainsKey(id);
+
+        internal static bool OwnsKey(string key) =>
+            !string.IsNullOrEmpty(key) && key.StartsWith(KeyPrefix, StringComparison.Ordinal)
+            && ByKey.ContainsKey(key);
+
+        internal static byte[] ReadKey(string key)
+        {
+            if (!ByKey.TryGetValue(key ?? string.Empty, out var entry)) return null;
+            try
+            {
+                var path = Path.GetFullPath(entry.LevelPath);
+                var root = Path.GetFullPath(_root).TrimEnd(Path.DirectorySeparatorChar)
+                           + Path.DirectorySeparatorChar;
+                if (!path.StartsWith(root, StringComparison.OrdinalIgnoreCase)) return null;
+
+                var info = new FileInfo(path);
+                if (!info.Exists || info.Length < 10 || info.Length > MaxLevelBytes) return null;
+                var bytes = File.ReadAllBytes(path);
+                using (var sha = SHA256.Create())
+                {
+                    if (!string.Equals(Hex(sha.ComputeHash(bytes)), entry.Sha256,
+                                       StringComparison.Ordinal))
+                    {
+                        Plugin.Log.LogError("Refusing changed legacy map bytes at " + path + ".");
+                        return null;
+                    }
+                }
+                return bytes;
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogWarning("Could not read legacy map " + entry.LevelPath + ": "
+                                      + ex.Message);
+                return null;
+            }
+        }
+
+        internal static void Decorate(LevelSummaryData summary)
+        {
+            if (summary == null || !ById.TryGetValue(summary.serverLevelId ?? string.Empty,
+                                                     out var entry)) return;
+            summary.clientLevelId = entry.ClientLevelId;
+            summary.legacyLevelImage = entry.LegacyImage;
+            summary.levelThumbnailS3Url = null;
+            summary.levelContentImage3Url = null;
+            summary.otherLevelImageS3Urls = new List<string>();
+        }
+
+        internal static void AddTags(List<string> tags)
+        {
+            if (tags != null && Entries.Count > 0 && !tags.Contains(LegacyTag)) tags.Add(LegacyTag);
+        }
+
+        internal static void BeginBrowse() => _browseOnly = true;
+        internal static void EndBrowse() => _browseOnly = false;
+
+        internal static bool ApplyBrowseFilter(UgcQuery query)
+        {
+            if (_browseOnly && query != null) query.Tag = LegacyTag;
+            return _browseOnly;
+        }
+
+        private static List<LevelConfiguration> ValidConfigurations(
+            List<LevelConfiguration> source)
+        {
+            var result = new List<LevelConfiguration>();
+            if (source != null)
+            {
+                for (var i = 0; i < source.Count; i++)
+                {
+                    var configuration = source[i];
+                    if (configuration == null || configuration.numberOfPlayers < 1
+                        || configuration.numberOfPlayers > 4 || configuration.numberOfTeams < 1
+                        || configuration.numberOfTeams > 4) continue;
+                    if (configuration.levelTeamConfigurations == null)
+                        configuration.levelTeamConfigurations = new List<LevelTeamConfiguration>();
+                    result.Add(configuration);
+                }
+            }
+
+            if (result.Count == 0)
+            {
+                for (var players = 1; players <= 4; players++)
+                    result.Add(LevelSummaryFormat.GetDefaultLevelConfiguration(players));
+            }
+            return result;
+        }
+
+        private static List<string> ValidTags(List<string> source)
+        {
+            var result = new List<string>();
+            if (source == null) return result;
+            for (var i = 0; i < source.Count && result.Count < LevelBundle.MaxTags; i++)
+            {
+                var tag = Bound(source[i], LevelBundle.MaxMetadataItemCharacters);
+                if (!string.IsNullOrWhiteSpace(tag) && !result.Contains(tag)) result.Add(tag);
+            }
+            return result;
+        }
+
+        private static void AddModeTag(List<string> tags, List<LevelConfiguration> configurations)
+        {
+            if (configurations == null || configurations.Count == 0) return;
+            string tag = null;
+            switch (configurations[0].levelType)
+            {
+                case LevelType.CoOp: tag = UGCService2.TAG_TEAM_COOP; break;
+                case LevelType.TeamBased: tag = UGCService2.TAG_TEAM_COMPETITIVE; break;
+                case LevelType.FreeForAll: tag = UGCService2.TAG_FREEFORALL; break;
+                case LevelType.Freeplay: tag = UGCService2.TAG_TEAM_FREEPLAY; break;
+            }
+            if (!string.IsNullOrEmpty(tag) && !tags.Contains(tag)
+                && tags.Count < LevelBundle.MaxTags) tags.Add(tag);
+        }
+
+        private static bool ValidImage(LevelSummaryImageData image)
+        {
+            return image.data != null && image.data.Length <= MaxImageBytes
+                   && LevelBundle.IsSafeRawGameImage(
+                       (uint)Math.Max(0, image.width), (uint)Math.Max(0, image.height),
+                       (uint)image.format, (uint)image.data.Length);
+        }
+
+        private static bool PlausibleDate(DateTime value) =>
+            value.Year >= 2000 && value.Year <= 2035;
+
+        private static long UnixMilliseconds(DateTime value) =>
+            (long)(value.ToUniversalTime() - new DateTime(1970, 1, 1, 0, 0, 0,
+                                                          DateTimeKind.Utc)).TotalMilliseconds;
+
+        private static string Bound(string value, int maximum)
+        {
+            if (string.IsNullOrEmpty(value)) return string.Empty;
+            var clean = new StringBuilder(Math.Min(value.Length, maximum));
+            for (var i = 0; i < value.Length && clean.Length < maximum; i++)
+            {
+                var c = value[i];
+                if (c == '\r') continue;
+                if (c == '\n' || c == '\t' || !char.IsControl(c)) clean.Append(c);
+            }
+            return clean.ToString();
+        }
+
+        private static string Hex(byte[] bytes)
+        {
+            var text = new StringBuilder(bytes.Length * 2);
+            for (var i = 0; i < bytes.Length; i++) text.Append(bytes[i].ToString("x2"));
+            return text.ToString();
+        }
+    }
+}
diff --git a/src/SS2Revive/LegacyLevelPatches.cs b/src/SS2Revive/LegacyLevelPatches.cs
new file mode 100644
index 0000000..5018fae
--- /dev/null
+++ b/src/SS2Revive/LegacyLevelPatches.cs
@@ -0,0 +1,528 @@
+using System;
+using Bossa.Localization;
+using HarmonyLib;
+using TMPro;
+using UnityEngine;
+using UnityEngine.UI;
+
+namespace SS2Revive
+{
+    /// <summary>Terminal affordances for the read-only local legacy catalogue.</summary>
+    internal static class LegacyLevelPatches
+    {
+        private const string ButtonName = "SS2ReviveLegacyMapsButton";
+        private const int ReplacedFilterIndex = 1; // Community Spotlight
+
+        private static TerminalLevelBrowseOptions _browseScreen;
+        private static TerminalCustomGameScreen _customGameScreen;
+        private static TerminalUIController _terminalUi;
+
+        internal static void Apply(Harmony harmony)
+        {
+            PatchSet.Try("TerminalLevelBrowseOptions.InitializeScreen -> Legacy Maps browser", () =>
+            {
+                harmony.Patch(PatchSet.Method(typeof(TerminalLevelBrowseOptions), "InitializeScreen"),
+                    null, new HarmonyMethod(AccessTools.Method(typeof(LegacyLevelPatches),
+                        nameof(BrowseInitialised_Postfix))));
+            });
+
+            PatchSet.Try("TerminalLevelModalController.DisplayLevelData -> read-only legacy actions", () =>
+            {
+                harmony.Patch(PatchSet.Method(typeof(TerminalLevelModalController),
+                        "DisplayLevelData"), null,
+                    new HarmonyMethod(AccessTools.Method(typeof(LegacyLevelPatches),
+                        nameof(LevelDisplayed_Postfix))));
+            });
+
+            PatchSet.Try("TerminalLevelButton.Init() -> legacy previews and readable titles", () =>
+            {
+                harmony.Patch(PatchSet.Method(typeof(TerminalLevelButton), "Init",
+                        Type.EmptyTypes), null,
+                    new HarmonyMethod(AccessTools.Method(typeof(LegacyLevelPatches),
+                        nameof(LevelButtonInitialised_Postfix))));
+            });
+
+            PatchSet.Try("TerminalLevelBrowseOptions.OnLanguageUpdated -> retain Legacy Maps tile", () =>
+            {
+                harmony.Patch(PatchSet.Method(typeof(TerminalLevelBrowseOptions),
+                        "OnLanguageUpdated"),
+                    new HarmonyMethod(AccessTools.Method(typeof(LegacyLevelPatches),
+                        nameof(LanguageUpdated_Prefix))));
+            });
+
+            PatchSet.Try("TerminalCustomGameScreen.LoadMoreResults -> preserve legacy scroll", () =>
+            {
+                harmony.Patch(PatchSet.Method(typeof(TerminalCustomGameScreen),
+                        "LoadMoreResults"),
+                    new HarmonyMethod(AccessTools.Method(typeof(LegacyLevelPatches),
+                        nameof(LoadMore_Prefix))));
+            });
+
+            PatchSet.Try("TerminalCustomGameScreen.Populate -> restore legacy scroll", () =>
+            {
+                harmony.Patch(PatchSet.Method(typeof(TerminalCustomGameScreen), "Populate"), null,
+                    new HarmonyMethod(AccessTools.Method(typeof(LegacyLevelPatches),
+                        nameof(Populate_Postfix))));
+            });
+
+            PatchSet.Try("TerminalCustomGameScreen.NewSearch -> clear preserved scroll", () =>
+            {
+                harmony.Patch(PatchSet.Method(typeof(TerminalCustomGameScreen), "NewSearch"),
+                    new HarmonyMethod(AccessTools.Method(typeof(LegacyLevelPatches),
+                        nameof(NewSearch_Prefix))));
+            });
+
+            PatchSet.Try("TerminalCustomGameScreen.OnScreenLeft -> leave Legacy Maps browser", () =>
+            {
+                harmony.Patch(PatchSet.Method(typeof(TerminalCustomGameScreen), "OnScreenLeft",
+                        new[] { typeof(bool) }), null,
+                    new HarmonyMethod(AccessTools.Method(typeof(LegacyLevelPatches),
+                        nameof(CustomGameScreenLeft_Postfix))));
+            });
+
+            PatchSet.Try("TerminalCustomGameScreen.OnTerminalExited -> leave Legacy Maps browser", () =>
+            {
+                harmony.Patch(PatchSet.Method(typeof(TerminalCustomGameScreen), "OnTerminalExited",
+                        new[] { typeof(bool) }), null,
+                    new HarmonyMethod(AccessTools.Method(typeof(LegacyLevelPatches),
+                        nameof(CustomGameScreenLeft_Postfix))));
+            });
+        }
+
+        private static void BrowseInitialised_Postfix(TerminalLevelBrowseOptions __instance)
+        {
+            try
+            {
+                if (__instance == null || LegacyLevelCatalog.Count == 0) return;
+                LegacyLevelCatalog.EndBrowse();
+
+                _browseScreen = __instance;
+                _customGameScreen = AccessTools.Field(typeof(TerminalLevelBrowseOptions),
+                    "_customGameScreen")?.GetValue(__instance) as TerminalCustomGameScreen;
+                _terminalUi = AccessTools.Field(typeof(TerminalLevelBrowseOptions),
+                    "_terminalUIController")?.GetValue(__instance) as TerminalUIController;
+                if (_customGameScreen == null || _terminalUi == null) return;
+
+                var buttons = AccessTools.Field(typeof(TerminalLevelBrowseOptions),
+                    "_discoverButtons")?.GetValue(__instance) as TerminalDiscoverButton[];
+                if (buttons == null || buttons.Length <= ReplacedFilterIndex
+                    || buttons[ReplacedFilterIndex] == null) return;
+
+                var parent = buttons[ReplacedFilterIndex].transform.parent;
+                if (parent == null) return;
+
+                var replacement = buttons[ReplacedFilterIndex];
+                var existing = parent.Find(ButtonName);
+                if (existing != null && existing != replacement.transform)
+                    UnityEngine.Object.Destroy(existing.gameObject);
+
+                // Community Spotlight depended on the retired service and has no unique local
+                // catalogue to show. Reusing its authored tile avoids all runtime grid arithmetic
+                // and ensures there is only one title and description renderer in this position.
+                replacement.gameObject.name = ButtonName;
+                ConfigureLegacyButton(replacement);
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogError("Creating the Legacy Maps browser button threw: " + ex);
+            }
+        }
+
+        private static bool LanguageUpdated_Prefix(TerminalLevelBrowseOptions __instance)
+        {
+            if (__instance == null || LegacyLevelCatalog.Count == 0) return true;
+            try
+            {
+                var buttons = AccessTools.Field(typeof(TerminalLevelBrowseOptions),
+                    "_discoverButtons")?.GetValue(__instance) as TerminalDiscoverButton[];
+                if (buttons == null) return true;
+
+                var filters = TerminalLevelBrowseOptions.LevelFilters;
+                for (var i = 0; i < filters.Length && i < buttons.Length; i++)
+                {
+                    if (i == ReplacedFilterIndex) continue;
+                    if (buttons[i] == null) continue;
+                    buttons[i].SetText(
+                        StaticLocalizedText.Localize(filters[i].DisplayNameTranslationKey),
+                        StaticLocalizedText.Localize(filters[i].DescriptionTranslationKey));
+                }
+
+                var parent = buttons.Length > 0 && buttons[0] != null
+                    ? buttons[0].transform.parent : null;
+                var legacy = parent?.Find(ButtonName)?.GetComponent<TerminalDiscoverButton>();
+                if (legacy != null) ConfigureLegacyButton(legacy);
+                return false;
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogWarning("Refreshing Legacy Maps browser text threw: " + ex.Message);
+                return true;
+            }
+        }
+
+        private static void ConfigureLegacyButton(TerminalDiscoverButton legacyButton)
+        {
+            legacyButton.gameObject.SetActive(true);
+            legacyButton.SetText("LEGACY MAPS",
+                "Play maps preserved inside the game's local LegacyLevels archive.");
+
+            var title = AccessTools.Field(typeof(TerminalDiscoverButton), "_titleText")
+                ?.GetValue(legacyButton) as TMP_Text;
+            var description = AccessTools.Field(typeof(TerminalDiscoverButton), "_descriptionText")
+                ?.GetValue(legacyButton) as TMP_Text;
+            if (title != null)
+            {
+                title.enableWordWrapping = false;
+                title.overflowMode = TextOverflowModes.Ellipsis;
+            }
+            if (description != null)
+            {
+                description.enableWordWrapping = true;
+                description.overflowMode = TextOverflowModes.Ellipsis;
+            }
+
+            // A few terminal-prefab variants carry presentation-only TMP duplicates inside the
+            // tile. They are harmless on stock localized buttons but become visibly offset after
+            // a runtime clone. The serialized title and description are the only text this tile
+            // needs, so remove the redundant renderers from this tile alone.
+            var texts = legacyButton.GetComponentsInChildren<TMP_Text>(true);
+            for (var i = 0; i < texts.Length; i++)
+                if (texts[i] != title && texts[i] != description)
+                    texts[i].gameObject.SetActive(false);
+
+            var extended = legacyButton.ExtendedButton;
+            if (extended == null) return;
+            extended.onClick = new Button.ButtonClickedEvent();
+            extended.OnPointerClickButton = LegacyBrowseClicked;
+            extended.interactable = true;
+            extended.navigation = new Navigation { mode = Navigation.Mode.Automatic };
+        }
+
+        private static void LevelButtonInitialised_Postfix(TerminalLevelButton __instance)
+        {
+            try
+            {
+                if (__instance == null) return;
+                var summary = __instance.GetLevelSummary();
+                var layout = __instance.GetComponent<LegacyLevelCardLayout>();
+                if (summary == null || !LegacyLevelCatalog.IsLegacy(summary.serverLevelId))
+                {
+                    layout?.Restore();
+                    return;
+                }
+
+                if (layout == null) layout = __instance.gameObject.AddComponent<LegacyLevelCardLayout>();
+                var levelName = AccessTools.Field(typeof(TerminalLevelButton), "_levelName")
+                    ?.GetValue(__instance) as TMP_Text;
+                var lastEdited = AccessTools.Field(typeof(TerminalLevelButton), "_lastEditedTime")
+                    ?.GetValue(__instance) as TMP_Text;
+                layout.Apply(levelName, lastEdited);
+
+                var rawImage = AccessTools.Field(typeof(TerminalLevelButton), "_levelImage")
+                    ?.GetValue(__instance) as RawImage;
+                if (rawImage != null && !summary.legacyLevelImage.IsTextureNull())
+                    rawImage.texture = summary.legacyLevelImage.GetTexture();
+                else if (rawImage != null)
+                {
+                    var fallback = AccessTools.Field(typeof(TerminalLevelButton),
+                        "_defaultLevelImage")?.GetValue(__instance) as Sprite;
+                    if (fallback != null) rawImage.texture = fallback.texture;
+                }
+
+                // A legacy entry deliberately has no remote URL. Mark its local result complete
+                // whether it has an archived screenshot or the stock placeholder.
+                AccessTools.Field(typeof(TerminalLevelButton), "_imageSet")
+                    ?.SetValue(__instance, true);
+                var loading = AccessTools.Field(typeof(TerminalLevelButton), "_loadingOverlay")
+                    ?.GetValue(__instance) as GameObject;
+                loading?.SetActive(false);
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogWarning("Displaying a legacy map card threw: " + ex.Message);
+            }
+        }
+
+        private static void LoadMore_Prefix(TerminalCustomGameScreen __instance)
+        {
+            try
+            {
+                if (!LegacyLevelCatalog.BrowseActive) return;
+
+                var scroll = AccessTools.Field(typeof(TerminalCustomGameScreen), "_scrollRect")
+                    ?.GetValue(__instance) as ScrollRect;
+                if (scroll == null || scroll.content == null) return;
+                var keeper = __instance.GetComponent<LegacyScrollPositionKeeper>();
+                if (keeper == null)
+                    keeper = __instance.gameObject.AddComponent<LegacyScrollPositionKeeper>();
+                keeper.Capture(scroll);
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogWarning("Capturing the legacy browser position threw: "
+                                      + ex.Message);
+            }
+        }
+
+        private static void Populate_Postfix(TerminalCustomGameScreen __instance)
+        {
+            __instance?.GetComponent<LegacyScrollPositionKeeper>()?.RestoreAfterRedraw();
+        }
+
+        private static void NewSearch_Prefix(TerminalCustomGameScreen __instance)
+        {
+            __instance?.GetComponent<LegacyScrollPositionKeeper>()?.Cancel();
+        }
+
+        private static void CustomGameScreenLeft_Postfix(TerminalCustomGameScreen __instance)
+        {
+            if (__instance != _customGameScreen) return;
+            LegacyLevelCatalog.EndBrowse();
+            __instance.GetComponent<LegacyScrollPositionKeeper>()?.Cancel();
+        }
+
+        private static void LegacyBrowseClicked(ExtendedButton ignored)
+        {
+            if (_browseScreen == null || _customGameScreen == null || _terminalUi == null) return;
+            try
+            {
+                _customGameScreen.SetFilter(TerminalCreateScreenData.LevelSortBy.Alphabetical,
+                    TerminalCreateScreenData.LevelFilterBy.Search, "LEGACY MAPS");
+
+                // This state remains active until the custom-game screen is left. Every search,
+                // sort change and subsequent page is therefore legacy-only, even if the player
+                // edits the visible search text.
+                LegacyLevelCatalog.BeginBrowse();
+                _terminalUi.TransitionBetweenScreens(_browseScreen, _customGameScreen);
+
+                var term = LegacyLevelCatalog.DisplayPrefix.Trim();
+                AccessTools.Field(typeof(TerminalCustomGameScreen), "_searchTerm")
+                    ?.SetValue(_customGameScreen, term);
+                var search = AccessTools.Field(typeof(TerminalCustomGameScreen), "_searchBar")
+                    ?.GetValue(_customGameScreen) as TMP_InputField;
+                if (search != null) search.SetTextWithoutNotify(term);
+            }
+            catch (Exception ex)
+            {
+                LegacyLevelCatalog.EndBrowse();
+                Plugin.Log.LogError("Opening the Legacy Maps browser threw: " + ex);
+            }
+        }
+
+        private static void LevelDisplayed_Postfix(TerminalLevelModalController __instance)
+        {
+            try
+            {
+                var summary = AccessTools.Field(typeof(TerminalLevelModalController),
+                    "_currentDisplayedLevel")?.GetValue(__instance) as Data.LevelSummaryData;
+                var imageState = __instance.GetComponent<LegacyModalImageState>();
+                if (summary == null || !LegacyLevelCatalog.IsLegacy(summary.serverLevelId))
+                {
+                    imageState?.Release();
+                    return;
+                }
+
+                if (imageState == null)
+                    imageState = __instance.gameObject.AddComponent<LegacyModalImageState>();
+                var imagePanel = AccessTools.Field(typeof(TerminalLevelModalController),
+                    "_levelImageInfoPanel")?.GetValue(__instance) as Image;
+                var levelData = AccessTools.Field(typeof(TerminalLevelModalController),
+                    "_currentLevelData")?.GetValue(__instance) as TerminalLevelButtonData;
+                Sprite fallback = null;
+                if (levelData?.AttachedButton != null)
+                    fallback = AccessTools.Field(typeof(TerminalLevelButton), "_defaultLevelImage")
+                        ?.GetValue(levelData.AttachedButton) as Sprite;
+                imageState.Show(imagePanel, summary, fallback);
+
+                // A legacy map is an immutable game asset. Playing, queueing and favouriting are
+                // useful; reporting, sharing, deleting, editing and publishing are misleading.
+                Hide(__instance, "_shareButton");
+                Hide(__instance, "_reportButton");
+                Hide(__instance, "_deleteButton");
+                Hide(__instance, "_editButton");
+                Hide(__instance, "_publishButton");
+                Hide(__instance, "_cancelValidationButton");
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogError("Applying read-only legacy map actions threw: " + ex);
+            }
+        }
+
+        private static void Hide(TerminalLevelModalController modal, string fieldName)
+        {
+            var component = AccessTools.Field(typeof(TerminalLevelModalController), fieldName)
+                ?.GetValue(modal) as Component;
+            if (component != null) component.gameObject.SetActive(false);
+        }
+    }
+
+    /// <summary>Captures and restores pooled card layout when a button changes data source.</summary>
+    internal sealed class LegacyLevelCardLayout : MonoBehaviour
+    {
+        private TMP_Text _name;
+        private TMP_Text _date;
+        private bool _captured;
+        private bool _dateActive;
+        private bool _wordWrapping;
+        private bool _autoSizing;
+        private TextOverflowModes _overflow;
+        private int _maxVisibleLines;
+        private float _fontSizeMin;
+        private float _fontSizeMax;
+        private Vector2 _namePosition;
+        private Vector2 _nameSize;
+
+        internal void Apply(TMP_Text name, TMP_Text date)
+        {
+            if (!_captured)
+            {
+                _name = name;
+                _date = date;
+                if (_name == null) return;
+                _captured = true;
+                _dateActive = _date != null && _date.gameObject.activeSelf;
+                _wordWrapping = _name.enableWordWrapping;
+                _autoSizing = _name.enableAutoSizing;
+                _overflow = _name.overflowMode;
+                _maxVisibleLines = _name.maxVisibleLines;
+                _fontSizeMin = _name.fontSizeMin;
+                _fontSizeMax = _name.fontSizeMax;
+                _namePosition = _name.rectTransform.anchoredPosition;
+                _nameSize = _name.rectTransform.sizeDelta;
+            }
+            if (!_captured) return;
+
+            _name.enableWordWrapping = true;
+            _name.enableAutoSizing = true;
+            _name.fontSizeMin = Math.Max(12f, Math.Min(_name.fontSize, 18f));
+            _name.fontSizeMax = Math.Max(_name.fontSize, _name.fontSizeMin);
+            _name.overflowMode = TextOverflowModes.Ellipsis;
+            _name.maxVisibleLines = 2;
+
+            if (_date != null && _date.rectTransform.parent == _name.rectTransform.parent
+                && _date.rectTransform.anchorMin == _name.rectTransform.anchorMin
+                && _date.rectTransform.anchorMax == _name.rectTransform.anchorMax)
+            {
+                var nameRect = _name.rectTransform;
+                var dateRect = _date.rectTransform;
+                var top = Math.Max(
+                    nameRect.anchoredPosition.y + nameRect.rect.height * (1f - nameRect.pivot.y),
+                    dateRect.anchoredPosition.y + dateRect.rect.height * (1f - dateRect.pivot.y));
+                var bottom = Math.Min(
+                    nameRect.anchoredPosition.y - nameRect.rect.height * nameRect.pivot.y,
+                    dateRect.anchoredPosition.y - dateRect.rect.height * dateRect.pivot.y);
+                nameRect.SetSizeWithCurrentAnchors(RectTransform.Axis.Vertical, top - bottom);
+                var position = nameRect.anchoredPosition;
+                position.y = bottom + (top - bottom) * nameRect.pivot.y;
+                nameRect.anchoredPosition = position;
+                _date.gameObject.SetActive(false);
+            }
+        }
+
+        internal void Restore()
+        {
+            if (!_captured || _name == null) return;
+            _name.enableWordWrapping = _wordWrapping;
+            _name.enableAutoSizing = _autoSizing;
+            _name.overflowMode = _overflow;
+            _name.maxVisibleLines = _maxVisibleLines;
+            _name.fontSizeMin = _fontSizeMin;
+            _name.fontSizeMax = _fontSizeMax;
+            _name.rectTransform.anchoredPosition = _namePosition;
+            _name.rectTransform.sizeDelta = _nameSize;
+            if (_date != null) _date.gameObject.SetActive(_dateActive);
+        }
+    }
+
+    /// <summary>Keeps a paged legacy grid anchored to the same visible content.</summary>
+    internal sealed class LegacyScrollPositionKeeper : MonoBehaviour
+    {
+        private ScrollRect _scroll;
+        private Vector2 _contentPosition;
+        private bool _captured;
+        private int _restoreFrames;
+
+        internal void Capture(ScrollRect scroll)
+        {
+            _scroll = scroll;
+            _scroll.StopMovement();
+            _contentPosition = scroll.content.anchoredPosition;
+            _captured = true;
+            _restoreFrames = 0;
+        }
+
+        internal void RestoreAfterRedraw()
+        {
+            if (_captured) _restoreFrames = 2;
+        }
+
+        internal void Cancel()
+        {
+            _captured = false;
+            _restoreFrames = 0;
+            _scroll = null;
+        }
+
+        private void LateUpdate()
+        {
+            if (!_captured || _restoreFrames <= 0 || _scroll == null
+                || _scroll.content == null) return;
+
+            _scroll.StopMovement();
+            _scroll.velocity = Vector2.zero;
+            _scroll.content.anchoredPosition = _contentPosition;
+            _restoreFrames--;
+            if (_restoreFrames == 0) Cancel();
+        }
+    }
+
+    /// <summary>Owns only sprites created for the legacy detail modal.</summary>
+    internal sealed class LegacyModalImageState : MonoBehaviour
+    {
+        private Sprite _ownedSprite;
+        private Image _panel;
+        private bool _previousPreserveAspect;
+
+        internal void Show(Image panel, Data.LevelSummaryData summary, Sprite fallback)
+        {
+            Release();
+            if (panel == null || summary == null) return;
+            _panel = panel;
+            _previousPreserveAspect = panel.preserveAspect;
+
+            var image = summary.legacyLevelImage;
+            if (!image.IsTextureNull() && image.data != null && image.data.Length > 0
+                && image.width > 0 && image.height > 0)
+            {
+                _ownedSprite = Sprite.Create(image.GetTexture(),
+                    new Rect(0f, 0f, image.width, image.height), new Vector2(0.5f, 0.5f));
+                panel.sprite = _ownedSprite;
+            }
+            else
+            {
+                panel.sprite = fallback;
+            }
+            panel.preserveAspect = true;
+        }
+
+        internal void Release()
+        {
+            if (_ownedSprite != null)
+            {
+                UnityEngine.Object.Destroy(_ownedSprite);
+                _ownedSprite = null;
+            }
+            if (_panel != null)
+            {
+                _panel.preserveAspect = _previousPreserveAspect;
+                _panel = null;
+            }
+        }
+
+        private void OnDestroy()
+        {
+            Release();
+        }
+    }
+}
diff --git a/src/SS2Revive/LevelFormatGuard.cs b/src/SS2Revive/LevelFormatGuard.cs
new file mode 100644
index 0000000..ae8c61b
--- /dev/null
+++ b/src/SS2Revive/LevelFormatGuard.cs
@@ -0,0 +1,724 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.IO.Compression;
+using System.Reflection;
+using System.Security.Cryptography;
+using System.Text;
+using Data;
+using HarmonyLib;
+using Services;
+using Services.Network;
+using UnityEngine;
+
+namespace SS2Revive
+{
+    /// <summary>
+    /// Bounds on the level reader, so that a level file which lies about its own size cannot take
+    /// the game down.
+    ///
+    /// The level format has three places where a number read straight out of the file decides the
+    /// size of an allocation, none of them checked. In format 29 - the one the game writes today -
+    /// they are:
+    /// <code>
+    ///   Serializer.ReadInt(readStream, out var value3, int.MinValue, int.MaxValue);
+    ///   byte[] array = new byte[value3];                 // any size, including negative
+    ///   ...
+    ///   deflateStream.CopyTo(memoryStream);              // no cap on what comes out
+    ///   ...
+    ///   Serializer.ReadVector3Int(readStream, out var value);
+    ///   levelData._voxelStates = new VoxelState[value.x, value.y, value.z];
+    /// </code>
+    /// The last one is the worst, and it is a regression rather than an oversight that was always
+    /// there: formats 1 to 9 read their dimensions as 16-bit values and refused any level whose
+    /// volume passed 262,144 - <c>if (value * value2 * value3 &gt; 262144) throw new
+    /// SerializeException();</c> - and the check was dropped when the format moved to a full 32-bit
+    /// <c>Vector3Int</c>. Every format from 10 up allocates two three-dimensional arrays from
+    /// numbers an attacker chooses.
+    ///
+    /// This matters more here than it would in a single-player game. The party host's level is sent
+    /// to every peer and read by all of them, so one crafted level does not cost one player - it
+    /// costs the lobby. And it is reachable today through any route that moves a level between
+    /// machines, which is exactly what this build adds one of.
+    ///
+    /// The limits are not guesses. <c>LevelDataService.WriteLevelData</c> serialises into a fixed
+    /// <c>new byte[4096000]</c>, so the game is incapable of producing a level body larger than
+    /// that; and a voxel costs one bit for its state plus a 32-bit word for its textures, so a body
+    /// that size cannot describe more than about 993,000 voxels. Both bounds below sit just above
+    /// what the game's own writer can emit, which means no level this game ever wrote can trip
+    /// them.
+    ///
+    /// Nothing here throws. A refused level loads as an empty room and says so in the log, because
+    /// on the receiving end of a party the alternative to a wrong level is not a right one, it is
+    /// everybody dropping out.
+    /// </summary>
+    internal static class LevelFormatGuard
+    {
+        /// <summary>
+        /// The working buffer <c>LevelDataService.WriteLevelData</c> serialises into. A level body
+        /// bigger than this did not come from this game.
+        /// </summary>
+        private const int MaxBodyBytes = 4096000;
+
+        /// <summary>Deflate can expand incompressible input slightly; this is room for that.</summary>
+        private const int MaxCompressedBytes = 8 * 1024 * 1024;
+
+        /// <summary>
+        /// 2^20, against the ~993,000 voxels a maximum-sized body could actually describe. For
+        /// scale, every format before the check was dropped refused anything past 262,144.
+        /// </summary>
+        private const long MaxVoxelVolume = 1024 * 1024;
+        private const int MaxVoxelAxis = 256;
+        private const int MaxSummaryBytes = 1024 * 1024;
+        private const int MaxWarningDefinitions = 4096;
+        private const int MaxWarningsPerDefinition = 256;
+        private const int MaxPropDefinitions = 4096;
+        private const int MaxPropInstances = 20000;
+        private const int MaxCircuitLinks = 20000;
+
+        private static MethodInfo _readBody;
+        private static readonly HashSet<string> TrustedBundledLevelHashes =
+            new HashSet<string>(StringComparer.Ordinal);
+        [ThreadStatic] private static bool _readingBody;
+        [ThreadStatic] private static bool _readingSummary;
+        [ThreadStatic] private static bool _readingTrustedBundledSummary;
+        [ThreadStatic] private static bool _publicationReadFailed;
+
+        /// <summary>
+        /// Reads metadata from the exact-hash bundled LegacyLevels archive. Early game builds
+        /// wrote a complete 512x289 RGB24 preview but left its width and height fields at zero.
+        /// Keep that compatibility signal scoped to the local archive: imported and downloaded
+        /// summaries continue through the strict reader unchanged.
+        /// </summary>
+        internal static LevelSummaryData ReadTrustedBundledSummary(byte[] data)
+        {
+            var previous = _readingTrustedBundledSummary;
+            _readingTrustedBundledSummary = true;
+            try
+            {
+                var summary = LevelSummaryDataService.ReadLevelSummaryData(data);
+                if (summary != null)
+                {
+                    var image = summary.legacyLevelImage;
+                    if (TryRepairTrustedBundledImage(ref image))
+                        summary.legacyLevelImage = image;
+                }
+                return summary;
+            }
+            finally
+            {
+                _readingTrustedBundledSummary = previous;
+                _readingSummary = false;
+            }
+        }
+
+        internal static void Apply(Harmony harmony)
+        {
+            LoadTrustedBundledLevelHashes();
+
+            PatchSet.Try("Serializer.ReadVector3Int -> bound level dimensions", () =>
+            {
+                var target = PatchSet.Method(typeof(Serializer), "ReadVector3Int");
+                harmony.Patch(target, null, new HarmonyMethod(
+                    AccessTools.Method(typeof(LevelFormatGuard), nameof(ReadVector3Int_Postfix))));
+            });
+
+            PatchSet.Try("LevelFormat.ReadLevelData_Format29 -> bound the compressed body", () =>
+            {
+                _readBody = AccessTools.Method(typeof(LevelFormat), "ReadLevelData",
+                    new[] { typeof(ReadStream), typeof(LevelData).MakeByRefType() });
+
+                if (_readBody == null)
+                    throw new MissingMethodException("LevelFormat.ReadLevelData(ReadStream, ref LevelData)");
+
+                var target = PatchSet.Method(typeof(LevelFormat), "ReadLevelData_Format29");
+                harmony.Patch(target, new HarmonyMethod(
+                    AccessTools.Method(typeof(LevelFormatGuard), nameof(Format29_Prefix))));
+            });
+
+            PatchSet.Try("LevelDataService.ReadLevelData -> current or trusted bundled formats", () =>
+            {
+                var target = PatchSet.Method(typeof(LevelDataService), "ReadLevelData",
+                    new[] { typeof(byte[]) });
+                harmony.Patch(target, new HarmonyMethod(
+                    AccessTools.Method(typeof(LevelFormatGuard), nameof(ReadLevelData_Prefix))));
+            });
+
+            PatchSet.Try("format 29 dictionaries -> bound allocation counts", () =>
+            {
+                PatchDictionaryConstructor(harmony,
+                    typeof(Dictionary<int, Bossa.Framework.Utils.Guid>));
+                PatchDictionaryConstructor(harmony, typeof(Dictionary<int, PropInstanceData>));
+                PatchDictionaryConstructor(harmony, typeof(Dictionary<int, CircuitLinkInstanceData>));
+            });
+
+            PatchSet.Try("Serializer.ReadInt -> bound summary allocations", () =>
+            {
+                var target = PatchSet.Method(typeof(Serializer), "ReadInt",
+                    new[] { typeof(ReadStream), typeof(int).MakeByRefType(), typeof(int), typeof(int) });
+                harmony.Patch(target, null, new HarmonyMethod(
+                    AccessTools.Method(typeof(LevelFormatGuard), nameof(SummaryReadInt_Postfix))));
+            });
+
+            PatchSet.Try("MessageSerializer.ReadLevelDataMessage -> preflight compressed level", () =>
+            {
+                var target = PatchSet.Method(typeof(MessageSerializer), "ReadLevelDataMessage");
+                harmony.Patch(target,
+                    new HarmonyMethod(AccessTools.Method(typeof(LevelFormatGuard),
+                        nameof(NetworkLevelMessage_Prefix))),
+                    new HarmonyMethod(AccessTools.Method(typeof(LevelFormatGuard),
+                        nameof(NetworkLevelMessage_Postfix))));
+            });
+
+            PatchSet.Try("LevelSummaryDataService.ReadLevelSummaryData -> bound collection counts", () =>
+            {
+                var target = PatchSet.Method(typeof(LevelSummaryDataService), "ReadLevelSummaryData",
+                    new[] { typeof(byte[]) });
+                harmony.Patch(target,
+                    new HarmonyMethod(AccessTools.Method(typeof(LevelFormatGuard),
+                        nameof(SummaryRead_Prefix))),
+                    new HarmonyMethod(AccessTools.Method(typeof(LevelFormatGuard),
+                        nameof(SummaryRead_Postfix))));
+            });
+
+            PatchSet.Try("LevelSummaryDataService.ReadLevelSummaryDataImage -> validate image envelope", () =>
+            {
+                var target = PatchSet.Method(typeof(LevelSummaryDataService),
+                    "ReadLevelSummaryDataImage", new[] { typeof(byte[]) });
+                harmony.Patch(target, new HarmonyMethod(AccessTools.Method(typeof(LevelFormatGuard),
+                    nameof(ImageRead_Prefix))));
+            });
+        }
+
+        // -------------------------------------------------------------- dimensions
+
+        /// <summary>
+        /// Every call to <c>ReadVector3Int</c> in the game is a level-size read - thirteen of them,
+        /// one per format version, and nothing else uses it. So a blanket bound here is as narrow
+        /// as a bound at each call site would be, and does not depend on which format reader a file
+        /// asked for.
+        ///
+        /// Refused dimensions become zero rather than being clamped to the limit. Clamping would
+        /// hand the loops below a size the file's own bit stream does not match, and they would
+        /// read a million voxels' worth of whatever came next; zero skips them, and the reads after
+        /// the grid carry on from the right place because the dimensions themselves were already
+        /// consumed.
+        /// </summary>
+        private static void ReadVector3Int_Postfix(ref Vector3Int value)
+        {
+            var x = value.x;
+            var y = value.y;
+            var z = value.z;
+
+            if (x > 0 && y > 0 && z > 0
+                && x <= MaxVoxelAxis && y <= MaxVoxelAxis && z <= MaxVoxelAxis
+                && x <= MaxVoxelVolume / y / z)
+            {
+                return;
+            }
+
+            _publicationReadFailed = true;
+            Plugin.Log.LogError("Refusing a level that says it is " + x + "x" + y + "x" + z
+                                + " voxels. The largest this game can write is under "
+                                + MaxVoxelVolume + ", so this file is corrupt or was built to "
+                                + "crash whoever opens it. Loading it as an empty room instead.");
+
+            // Continuing after changing the dimensions would leave the original voxel bits unread
+            // and make every later field start at the wrong offset. Reject the whole level.
+            throw new SerializeException();
+        }
+
+        private static bool ReadLevelData_Prefix(byte[] data, ref LevelData __result)
+        {
+            var validEnvelope = data != null && data.Length >= 10 && data.Length <= MaxBodyBytes
+                                && data[0] == 83 && data[1] == 117
+                                && data[2] == 114 && data[3] == 103
+                                && data[4] == 101 && data[5] == 111
+                                && data[6] == 110 && data[7] == 115;
+            if (validEnvelope)
+            {
+                var version = data[8] | (data[9] << 8);
+                if (version == 29) return true;
+
+                // Build 1.3.7 ships its active lobby/campaign catalogue and a dormant historical
+                // archive in old formats. Both are trusted by exact SHA-256 from this installation
+                // at startup. Merely naming a custom file like a bundled map grants nothing; its
+                // bytes have to match one of the installed game objects exactly.
+                if (version > 0 && version < 29 && version != 25
+                    && IsTrustedBundledLevel(data))
+                {
+                    return true;
+                }
+            }
+
+            _publicationReadFailed = true;
+            Plugin.Log.LogError("Refusing level data that is oversized, malformed, or uses an old "
+                                + "format without matching a level bundled with this game install. "
+                                + "Custom and shared content is restricted to current format 29.");
+            __result = new LevelData();
+            return false;
+        }
+
+        private static void LoadTrustedBundledLevelHashes()
+        {
+            TrustedBundledLevelHashes.Clear();
+            try
+            {
+                var roots = new[]
+                {
+                    Path.Combine(Application.streamingAssetsPath, "Levels"),
+                    Path.Combine(Application.streamingAssetsPath, "LegacyLevels"),
+                };
+                var foundRoot = false;
+                for (var rootIndex = 0; rootIndex < roots.Length; rootIndex++)
+                {
+                    var root = roots[rootIndex];
+                    if (!Directory.Exists(root)) continue;
+                    foundRoot = true;
+
+                    var files = Directory.GetFiles(root, "*.lvl", SearchOption.AllDirectories);
+                    for (var i = 0; i < files.Length; i++)
+                    {
+                        try
+                        {
+                            var info = new FileInfo(files[i]);
+                            if (info.Length < 10 || info.Length > MaxBodyBytes) continue;
+                            using (var input = new FileStream(files[i], FileMode.Open, FileAccess.Read,
+                                                              FileShare.Read))
+                            using (var sha = SHA256.Create())
+                            {
+                                TrustedBundledLevelHashes.Add(Hex(sha.ComputeHash(input)));
+                            }
+                        }
+                        catch (Exception ex)
+                        {
+                            Plugin.Log.LogWarning("Could not trust bundled level " + files[i] + ": "
+                                                  + ex.Message);
+                        }
+                    }
+                }
+
+                if (!foundRoot)
+                {
+                    Plugin.Log.LogWarning("Could not find the bundled level directories under "
+                                          + Application.streamingAssetsPath
+                                          + "; older bundled maps will remain restricted.");
+                    return;
+                }
+
+                Plugin.Log.LogInfo("Trusted " + TrustedBundledLevelHashes.Count
+                                   + " exact active or legacy bundled level file(s); custom maps "
+                                   + "still require format 29.");
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogWarning("Could not catalogue the game's bundled levels: " + ex.Message);
+            }
+        }
+
+        private static bool IsTrustedBundledLevel(byte[] data)
+        {
+            if (data == null || TrustedBundledLevelHashes.Count == 0) return false;
+            using (var sha = SHA256.Create())
+            {
+                return TrustedBundledLevelHashes.Contains(Hex(sha.ComputeHash(data)));
+            }
+        }
+
+        private static string Hex(byte[] bytes)
+        {
+            var text = new StringBuilder(bytes.Length * 2);
+            for (var i = 0; i < bytes.Length; i++) text.Append(bytes[i].ToString("x2"));
+            return text.ToString();
+        }
+
+        private static void PatchDictionaryConstructor(Harmony harmony, Type dictionaryType)
+        {
+            var target = AccessTools.Constructor(dictionaryType, new[] { typeof(int) });
+            if (target == null) throw new MissingMethodException(dictionaryType.FullName, ".ctor(int)");
+            harmony.Patch(target, new HarmonyMethod(
+                AccessTools.Method(typeof(LevelFormatGuard), nameof(BodyDictionary_Prefix))));
+        }
+
+        private static void BodyDictionary_Prefix(int capacity, MethodBase __originalMethod)
+        {
+            if (!_readingBody) return;
+
+            var dictionaryType = __originalMethod.DeclaringType;
+            var valueType = dictionaryType == null ? null : dictionaryType.GetGenericArguments()[1];
+            var maximum = valueType == typeof(Bossa.Framework.Utils.Guid)
+                ? MaxPropDefinitions
+                : valueType == typeof(PropInstanceData)
+                    ? MaxPropInstances
+                    : MaxCircuitLinks;
+            if (capacity >= 0 && capacity <= maximum) return;
+
+            _publicationReadFailed = true;
+            Plugin.Log.LogError("Refusing a level body that requests a " + capacity
+                                + "-entry " + valueType.Name + " dictionary (maximum "
+                                + maximum + ").");
+            throw new SerializeException();
+        }
+
+        private static void SummaryReadInt_Postfix(ref int value)
+        {
+            if (!_readingSummary || (value >= -MaxSummaryBytes && value <= MaxSummaryBytes)) return;
+
+            Plugin.Log.LogError("Refusing level-summary data containing an integer outside its "
+                                + MaxSummaryBytes + " byte envelope: " + value + ".");
+            _readingSummary = false;
+            throw new SerializeException();
+        }
+
+        private static bool SummaryRead_Prefix(byte[] data, ref LevelSummaryData __result)
+        {
+            _readingSummary = false;
+            if (data == null || data.Length == 0 || data.Length > MaxSummaryBytes)
+            {
+                Plugin.Log.LogError("Refusing empty or oversized level-summary data.");
+                __result = null;
+                return false;
+            }
+
+            _readingSummary = true;
+            return true;
+        }
+
+        private static void SummaryRead_Postfix(ref LevelSummaryData __result)
+        {
+            _readingSummary = false;
+            if (__result == null) return;
+
+            var image = __result.legacyLevelImage;
+            var bytes = image.data;
+            if (bytes == null || bytes.Length == 0) return;
+            if (SS2ReviveData.LevelBundle.IsSafeRawGameImage(
+                    (uint)Math.Max(0, image.width), (uint)Math.Max(0, image.height),
+                    (uint)image.format, (uint)bytes.Length)) return;
+
+            if (_readingTrustedBundledSummary && TryRepairTrustedBundledImage(ref image))
+            {
+                __result.legacyLevelImage = image;
+                return;
+            }
+
+            Plugin.Log.LogError("Dropping an invalid embedded level-summary image.");
+            __result.legacyLevelImage = new LevelSummaryImageData(null, 0, 0, TextureFormat.Alpha8);
+        }
+
+        private static bool TryRepairTrustedBundledImage(ref LevelSummaryImageData image)
+        {
+            // The pre-release archive serializer omitted only the dimensions. Its RGB byte count
+            // is exact, so this repair neither guesses nor permits a variable-sized allocation.
+            const int legacyWidth = 512;
+            const int legacyHeight = 289;
+            const int legacyRgbBytes = legacyWidth * legacyHeight * 3;
+            var bytes = image.data;
+            if (bytes == null || image.width != 0 || image.height != 0
+                || image.format != TextureFormat.RGB24 || bytes.Length != legacyRgbBytes)
+                return false;
+
+            image = new LevelSummaryImageData(
+                bytes, legacyWidth, legacyHeight, TextureFormat.RGB24);
+            return true;
+        }
+
+        private static bool ImageRead_Prefix(byte[] data, ref LevelSummaryImageData __result)
+        {
+            if (SS2ReviveData.LevelBundle.IsSafeGameImage(data)) return true;
+
+            Plugin.Log.LogError("Refusing an invalid or oversized level image envelope.");
+            __result = new LevelSummaryImageData(null, 0, 0, TextureFormat.Alpha8);
+            return false;
+        }
+
+        private static void NetworkLevelMessage_Prefix(MessageSerializer __instance, ref int __state)
+        {
+            __state = -1;
+            try
+            {
+                var lengthField = AccessTools.Field(typeof(MessageSerializer), "_readBufferLength");
+                var bufferField = AccessTools.Field(typeof(MessageSerializer), "_readBuffer");
+                var length = (int)lengthField.GetValue(__instance);
+                var buffer = bufferField.GetValue(__instance) as byte[];
+
+                if (ValidateNetworkLevelMessage(buffer, length)) return;
+
+                __state = length;
+                lengthField.SetValue(__instance, 0);
+                Plugin.Log.LogError("Refusing a malformed or oversized multiplayer level message.");
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogError("Could not preflight a multiplayer level message: " + ex.Message);
+                var lengthField = AccessTools.Field(typeof(MessageSerializer), "_readBufferLength");
+                __state = (int)lengthField.GetValue(__instance);
+                lengthField.SetValue(__instance, 0);
+            }
+        }
+
+        private static void NetworkLevelMessage_Postfix(MessageSerializer __instance, int __state)
+        {
+            if (__state >= 0)
+                AccessTools.Field(typeof(MessageSerializer), "_readBufferLength")
+                    .SetValue(__instance, __state);
+        }
+
+        private static bool ValidateNetworkLevelMessage(byte[] buffer, int length)
+        {
+            if (buffer == null || length <= 0 || length > buffer.Length
+                || length > MaxCompressedBytes + MaxSummaryBytes) return false;
+
+            var stream = new ReadStream();
+            stream.Start(new uint[(length + 3) / 4], buffer, length);
+
+            byte messageType;
+            int ignored;
+            bool optional;
+            Bossa.Framework.Utils.Guid ignoredGuid;
+
+            Serializer.ReadBits(stream, out messageType, 8);
+            if (messageType != 21) return false;
+            Serializer.ReadInt(stream, out ignored, 0, int.MaxValue);
+            Serializer.ReadInt(stream, out ignored, 0, int.MaxValue);
+            Serializer.ReadBool(stream, out optional);
+            if (optional) Serializer.ReadInt(stream, out ignored, 0, int.MaxValue);
+            Serializer.ReadInt(stream, out ignored, 0, int.MaxValue);
+            Serializer.ReadInt(stream, out ignored, 0, int.MaxValue);
+            Serializer.ReadBool(stream, out optional);
+            Serializer.ReadBool(stream, out optional);
+            Serializer.ReadGuid(stream, out ignoredGuid);
+
+            int summaryLength;
+            Serializer.ReadInt(stream, out summaryLength, 0, int.MaxValue);
+            if (summaryLength < 0 || summaryLength > MaxSummaryBytes
+                || !stream.SerializeAlign()) return false;
+            stream.SkipBytes(summaryLength);
+
+            Serializer.ReadInt(stream, out ignored, 0, int.MaxValue); // level mode
+
+            int definitions;
+            Serializer.ReadInt(stream, out definitions, 0, int.MaxValue);
+            if (definitions < 0 || definitions > MaxWarningDefinitions) return false;
+            var definitionIds = new HashSet<Bossa.Framework.Utils.Guid>();
+            for (var i = 0; i < definitions; i++)
+            {
+                Serializer.ReadGuid(stream, out ignoredGuid);
+                if (!definitionIds.Add(ignoredGuid)) return false;
+                int warnings;
+                Serializer.ReadInt(stream, out warnings, 0, int.MaxValue);
+                if (warnings < 0 || warnings > MaxWarningsPerDefinition) return false;
+                for (var w = 0; w < warnings; w++)
+                    Serializer.ReadInt(stream, out ignored, 0, 255);
+            }
+
+            int compressedLength;
+            Serializer.ReadInt(stream, out compressedLength, 0, int.MaxValue);
+            if (compressedLength <= 0 || compressedLength > MaxCompressedBytes
+                || !stream.SerializeAlign()) return false;
+
+            var compressed = new byte[compressedLength];
+            Serializer.ReadBytes(stream, compressed, compressedLength);
+
+            byte[] levelBytes;
+            if (!TryInflateGZip(compressed, out levelBytes)) return false;
+            return levelBytes.Length >= 10 && levelBytes.Length <= MaxBodyBytes
+                   && levelBytes[0] == 83 && levelBytes[1] == 117
+                   && levelBytes[2] == 114 && levelBytes[3] == 103
+                   && levelBytes[4] == 101 && levelBytes[5] == 111
+                   && levelBytes[6] == 110 && levelBytes[7] == 115
+                   && (levelBytes[8] | (levelBytes[9] << 8)) == 29;
+        }
+
+        private static bool TryInflateGZip(byte[] compressed, out byte[] outputBytes)
+        {
+            outputBytes = null;
+            try
+            {
+                using (var source = new MemoryStream(compressed))
+                using (var gzip = new GZipStream(source, CompressionMode.Decompress))
+                using (var output = new MemoryStream())
+                {
+                    var chunk = new byte[64 * 1024];
+                    while (true)
+                    {
+                        var read = gzip.Read(chunk, 0, chunk.Length);
+                        if (read <= 0) break;
+                        if (output.Length + read > MaxBodyBytes) return false;
+                        output.Write(chunk, 0, read);
+                    }
+                    outputBytes = output.ToArray();
+                    return true;
+                }
+            }
+            catch (Exception)
+            {
+                return false;
+            }
+        }
+
+        // ------------------------------------------------------------- compression
+
+        /// <summary>
+        /// The original, with the two unbounded steps bounded. Everything else about it is
+        /// unchanged, including the bit widths, so a file this accepts deserialises identically.
+        /// </summary>
+        private static bool Format29_Prefix(LevelData levelData, ReadStream readStream,
+                                            ref LevelData __result)
+        {
+            __result = levelData;
+
+            try
+            {
+                string clientLevelId;
+                Serializer.ReadString(readStream, out clientLevelId);
+                levelData.clientLevelId = new Bossa.Framework.Utils.Guid(clientLevelId);
+
+                bool isCompressed;
+                Serializer.ReadBool(readStream, out isCompressed);
+
+                if (!isCompressed)
+                {
+                    ReadBody(readStream, ref levelData);
+                    __result = levelData;
+                    return false;
+                }
+
+                int compressedLength;
+                Serializer.ReadInt(readStream, out compressedLength, int.MinValue, int.MaxValue);
+
+                if (compressedLength < 0 || compressedLength > MaxCompressedBytes)
+                {
+                    _publicationReadFailed = true;
+                    Plugin.Log.LogError("Refusing a level whose compressed body claims to be "
+                                        + compressedLength + " bytes. Loading it as an empty room.");
+                    return false;
+                }
+
+                var compressed = new byte[compressedLength];
+                Serializer.ReadBytes(readStream, compressed, compressedLength);
+
+                byte[] body;
+                if (!TryInflate(compressed, out body))
+                {
+                    _publicationReadFailed = true;
+                    return false;
+                }
+
+                var inner = new ReadStream();
+                inner.Start(new uint[(body.Length + 3) / 4], body, body.Length);
+                ReadBody(inner, ref levelData);
+
+                __result = levelData;
+                return false;
+            }
+            catch (Exception ex)
+            {
+                _publicationReadFailed = true;
+                // The original would have thrown out of here too, but out of a reader with no
+                // bounds in it. Whatever is left of levelData is returned rather than propagating,
+                // for the same reason the dimension check does not throw.
+                Plugin.Log.LogError("Reading a level failed: " + ex);
+                return false;
+            }
+        }
+
+        /// <summary>
+        /// Decompresses with a ceiling, which <c>CopyTo</c> does not have. A few hundred bytes of
+        /// deflate expand to gigabytes if that is what they were built to do, and the original both
+        /// holds the result in a MemoryStream and then copies it again with <c>ToArray</c> - so the
+        /// peak is twice whatever the file asks for.
+        /// </summary>
+        private static bool TryInflate(byte[] compressed, out byte[] body)
+        {
+            body = null;
+
+            using (var source = new MemoryStream(compressed))
+            using (var deflate = new DeflateStream(source, CompressionMode.Decompress))
+            using (var output = new MemoryStream())
+            {
+                var chunk = new byte[64 * 1024];
+                var total = 0;
+
+                while (true)
+                {
+                    var read = deflate.Read(chunk, 0, chunk.Length);
+                    if (read <= 0) break;
+
+                    total += read;
+                    if (total > MaxBodyBytes)
+                    {
+                        Plugin.Log.LogError("Refusing a level that expands past " + MaxBodyBytes
+                                            + " bytes; the game's own writer cannot produce one "
+                                            + "that large. Loading it as an empty room.");
+                        return false;
+                    }
+
+                    output.Write(chunk, 0, read);
+                }
+
+                body = output.ToArray();
+                return true;
+            }
+        }
+
+        private static void ReadBody(ReadStream stream, ref LevelData levelData)
+        {
+            _readingBody = true;
+            try
+            {
+                var args = new object[] { stream, levelData };
+                _readBody.Invoke(null, args);
+                levelData = (LevelData)args[1];
+            }
+            finally
+            {
+                _readingBody = false;
+            }
+        }
+
+        /// <summary>
+        /// Publication is stricter than normal play fallback: the complete current-format reader
+        /// must finish and produce a bounded, non-empty voxel grid. This runs only on a package
+        /// built from the local library and never on an arbitrary network thread.
+        /// </summary>
+        internal static bool ValidateForPublication(byte[] data, out string message)
+        {
+            message = null;
+            if (_readBody == null)
+            {
+                message = "The protected level reader is not installed.";
+                return false;
+            }
+            _publicationReadFailed = false;
+            try
+            {
+                var parsed = LevelDataService.ReadLevelData(data);
+                var voxels = parsed == null ? null : parsed._voxelStates;
+                if (_publicationReadFailed || voxels == null
+                    || voxels.GetLength(0) < 1 || voxels.GetLength(1) < 1 || voxels.GetLength(2) < 1)
+                {
+                    message = "The complete format-29 level reader rejected this save.";
+                    return false;
+                }
+                var volume = (long)voxels.GetLength(0) * voxels.GetLength(1) * voxels.GetLength(2);
+                if (volume > MaxVoxelVolume)
+                {
+                    message = "The level voxel grid exceeds the publication limit.";
+                    return false;
+                }
+                return true;
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogWarning("Publication preflight rejected level data: " + ex.Message);
+                message = "The complete format-29 level reader rejected this save.";
+                return false;
+            }
+            finally
+            {
+                _publicationReadFailed = false;
+            }
+        }
+    }
+}
diff --git a/src/SS2Revive/LevelSharing.cs b/src/SS2Revive/LevelSharing.cs
new file mode 100644
index 0000000..f540bd6
--- /dev/null
+++ b/src/SS2Revive/LevelSharing.cs
@@ -0,0 +1,485 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Security.Cryptography;
+using SS2ReviveData;
+
+namespace SS2Revive
+{
+    /// <summary>
+    /// Levels moving between machines as files, because there is no service left to move them
+    /// through.
+    ///
+    /// The shape of this is set by what the game already does rather than by what would be tidy.
+    /// Surgeon Simulator 2 ships a share window that shows a 22-character code and copies it to the
+    /// clipboard, and a search box that turns a code of exactly that length back into a level-id
+    /// lookup. Both still work; the only thing missing was ever a way for the bytes to arrive. So a
+    /// level is exported to one file, that file is sent however people already talk to each other,
+    /// and the code stays what it always was - the name of the level, not the level itself.
+    ///
+    /// The code cannot carry the level, and it is worth being plain about why. A level blob is
+    /// kilobytes at the small end and megabytes at the large; a chat message is two thousand
+    /// characters. Even a nearly empty level does not fit, so any design where the code is the
+    /// whole payload was never available.
+    ///
+    /// What arrives is somebody else's level and stays that way: it comes in published, credited to
+    /// whoever built it, under the id it was exported with. That last part is what makes the code
+    /// worth anything - the same level answers to the same code on every machine that has it, which
+    /// is the property a shared index would otherwise have had to provide.
+    /// </summary>
+    internal static class LevelSharing
+    {
+        private const int MaxFilesPerPass = 8;
+        internal static string ExportDirectory { get; private set; }
+        internal static string ImportDirectory { get; private set; }
+
+        /// <summary>
+        /// Where a bundle goes once it has been taken in. Moving it is what stops the folder being
+        /// imported twice - the Create screen scans it every time it opens. A repeated current
+        /// revision is harmless, but moving handled files keeps the inbox and its feedback clear.
+        /// </summary>
+        internal static string ImportedDirectory { get; private set; }
+        internal static string RejectedDirectory { get; private set; }
+
+        /// <summary>
+        /// Files taken in this session, as a backstop for the move above failing - a bundle still
+        /// open in the browser that downloaded it, say. Without it a failed move would import the
+        /// same file again on the next scan.
+        /// </summary>
+        private static readonly HashSet<string> Handled =
+            new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+        internal static bool Available => ExportDirectory != null && UgcBackend.Store != null;
+
+        internal sealed class UploadPackage
+        {
+            internal string Path;
+            internal string Code;
+            internal string LevelId;
+            internal int Revision;
+            internal long SizeBytes;
+            internal string Sha256;
+        }
+
+        internal static void Initialise(string saveDirectory)
+        {
+            try
+            {
+                var root = SaveLocation.ResolveDirectory(saveDirectory);
+
+                ExportDirectory = Path.Combine(root, "export");
+                ImportDirectory = Path.Combine(root, "import");
+                ImportedDirectory = Path.Combine(ImportDirectory, "imported");
+                RejectedDirectory = Path.Combine(ImportDirectory, "rejected");
+
+                // Created now rather than on first use, so both folders are there to be found by
+                // somebody who has been told to put a file in one of them.
+                Directory.CreateDirectory(ExportDirectory);
+                Directory.CreateDirectory(ImportDirectory);
+                Directory.CreateDirectory(ImportedDirectory);
+                Directory.CreateDirectory(RejectedDirectory);
+
+                Plugin.Log.LogInfo("Level sharing ready. Export: " + ExportDirectory
+                                   + " | Import: " + ImportDirectory);
+            }
+            catch (Exception ex)
+            {
+                ExportDirectory = null;
+                ImportDirectory = null;
+                Plugin.Log.LogError("Could not prepare the level sharing folders; export and import "
+                                    + "are off for this session. " + ex);
+            }
+        }
+
+        // ------------------------------------------------------------------ export
+
+        /// <summary>
+        /// Writes one level to <c>export\</c> and answers with the share code for it.
+        ///
+        /// Overwriting a file of the same name is deliberate. The name carries the level's id, so
+        /// the only file it can collide with is an older export of the same level, and keeping that
+        /// one would leave the player with two files and no way to tell which is current.
+        /// </summary>
+        internal static bool Export(string serverLevelId, out string code, out string message)
+        {
+            UploadPackage package;
+            var result = PrepareUpload(serverLevelId, out package, out message);
+            code = package == null ? string.Empty : package.Code;
+            return result;
+        }
+
+        internal static bool PrepareUpload(string serverLevelId, out UploadPackage package,
+                                           out string message)
+        {
+            package = null;
+            message = null;
+            var store = UgcBackend.Store;
+            if (store == null || ExportDirectory == null)
+            {
+                message = "The level library is not open, so nothing can be exported.";
+                return false;
+            }
+            var level = store.Get(serverLevelId);
+            if (level == null)
+            {
+                message = "That level is not in this machine's library.";
+                return false;
+            }
+            string error;
+            var bundle = LevelBundle.FromLevel(level, store.ReadKey, out error);
+            if (bundle == null)
+            {
+                message = error ?? "The level could not be read.";
+                return false;
+            }
+            bundle.ReviveVersion = Plugin.PluginVersion;
+            if (!LevelFormatGuard.ValidateForPublication(bundle.Content, out error))
+            {
+                message = error ?? "The level failed the protected format-29 preflight.";
+                return false;
+            }
+            try
+            {
+                var bytes = bundle.Pack();
+                if (bytes == null || bytes.Length < 1 || bytes.Length > LevelBundle.MaxBundleBytes)
+                {
+                    message = "The package is empty or exceeds the upload limit.";
+                    return false;
+                }
+                var path = Path.Combine(ExportDirectory, bundle.SuggestedFileName());
+                AtomicFile.WriteAllBytes(path, bytes);
+                RemoveOlderExports(bundle.Code, path);
+                string hash;
+                using (var sha = SHA256.Create()) hash = Hex(sha.ComputeHash(bytes));
+                package = new UploadPackage
+                {
+                    Path = path,
+                    Code = bundle.Code,
+                    LevelId = bundle.Id,
+                    Revision = bundle.ContentVersion,
+                    SizeBytes = bytes.LongLength,
+                    Sha256 = hash,
+                };
+                Plugin.Log.LogInfo("Prepared '" + level.Title + "' (" + level.Id + ") at " + path
+                                   + " for authenticated upload. Share code " + bundle.Code + ".");
+                return true;
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogError("Preparing '" + level.Title + "' for upload failed: " + ex);
+                message = "The package could not be written: " + ex.Message;
+                return false;
+            }
+        }
+
+        private static string Hex(byte[] bytes)
+        {
+            var text = new System.Text.StringBuilder(bytes.Length * 2);
+            for (var i = 0; i < bytes.Length; i++) text.Append(bytes[i].ToString("x2"));
+            return text.ToString();
+        }
+
+        private static void RemoveOlderExports(string code, string keepPath)
+        {
+            if (string.IsNullOrEmpty(code) || ExportDirectory == null) return;
+
+            try
+            {
+                var files = Directory.GetFiles(ExportDirectory, "*" + LevelBundle.Extension,
+                                               SearchOption.TopDirectoryOnly);
+                var marker = "[" + code + "]";
+                for (var i = 0; i < files.Length; i++)
+                {
+                    if (string.Equals(files[i], keepPath, StringComparison.OrdinalIgnoreCase)) continue;
+                    if (Path.GetFileName(files[i]).IndexOf(marker,
+                            StringComparison.OrdinalIgnoreCase) < 0) continue;
+                    File.Delete(files[i]);
+                }
+            }
+            catch (Exception ex)
+            {
+                // The new export is already durable. A stale older filename is untidy, not a
+                // reason to report that the export itself failed.
+                Plugin.Log.LogWarning("Could not remove an older export for " + code + ": "
+                                      + ex.Message);
+            }
+        }
+
+        // ------------------------------------------------------------------ import
+
+        /// <summary>What one pass over the import folder did.</summary>
+        internal struct ImportResult
+        {
+            internal int Imported;
+            internal int Updated;
+            internal int Current;
+            internal int Older;
+            internal int Rejected;
+            internal int Pending;
+            internal string FirstError;
+
+            internal int Seen => Imported + Updated + Current + Older + Rejected;
+            internal int Added => Imported + Updated;
+        }
+
+        /// <summary>
+        /// Reads every bundle sitting in <c>import\</c> into the library, and moves each one into
+        /// <c>import\imported\</c> as it goes.
+        ///
+        /// The install itself is idempotent by id and revision; the move also keeps an already
+        /// handled file from producing the same "current" message on every screen visit.
+        /// </summary>
+        internal static ImportResult ImportAll()
+        {
+            var result = new ImportResult();
+
+            var store = UgcBackend.Store;
+            if (store == null || ImportDirectory == null) return result;
+
+            string[] files;
+            try
+            {
+                files = Directory.GetFiles(ImportDirectory, "*" + LevelBundle.Extension,
+                                           SearchOption.TopDirectoryOnly);
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogWarning("Could not read the import folder: " + ex.Message);
+                return result;
+            }
+
+            var attempted = 0;
+            for (var i = 0; i < files.Length; i++)
+            {
+                if (Handled.Contains(files[i])) continue;
+                if (attempted >= MaxFilesPerPass)
+                {
+                    result.Pending++;
+                    continue;
+                }
+                attempted++;
+                ImportOne(store, files[i], ref result);
+            }
+
+            return result;
+        }
+
+        private static void ImportOne(UgcStore store, string path, ref ImportResult result)
+        {
+            var name = Path.GetFileName(path);
+
+            byte[] bytes;
+            try
+            {
+                var info = new FileInfo(path);
+                // A browser or Explorer copy exposes its destination before the last byte has
+                // arrived. Leave recently-written files alone so the next deliberate scan sees a
+                // complete bundle instead of quarantining a transient truncation.
+                if (DateTime.UtcNow - info.LastWriteTimeUtc < TimeSpan.FromSeconds(2)) return;
+
+                if (info.Length <= 0 || info.Length > LevelBundle.MaxBundleBytes)
+                {
+                    Reject(ref result, path, "its size is outside the 1-"
+                                             + (LevelBundle.MaxBundleBytes / (1024 * 1024)) + " MB limit");
+                    return;
+                }
+
+                // Open once and keep the handle while checking and reading. This prevents a file
+                // from being replaced or grown between FileInfo.Length and ReadAllBytes, which
+                // would otherwise allocate before the bundle reader gets a chance to reject it.
+                using (var input = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.Read))
+                {
+                    if (input.Length <= 0 || input.Length > LevelBundle.MaxBundleBytes)
+                    {
+                        Reject(ref result, path, "its size is outside the 1-"
+                                                 + (LevelBundle.MaxBundleBytes / (1024 * 1024)) + " MB limit");
+                        return;
+                    }
+
+                    bytes = new byte[(int)input.Length];
+                    var offset = 0;
+                    while (offset < bytes.Length)
+                    {
+                        var read = input.Read(bytes, offset, bytes.Length - offset);
+                        if (read <= 0) throw new EndOfStreamException("The bundle changed while it was read.");
+                        offset += read;
+                    }
+                    if (input.ReadByte() != -1)
+                        throw new InvalidDataException("The bundle grew while it was read.");
+                }
+            }
+            catch (Exception ex)
+            {
+                // Sharing clients and browsers can hold the destination open briefly after its
+                // final write. Treat I/O failures as transient and retry on the next scan.
+                Plugin.Log.LogWarning("Could not read " + name + " yet: " + ex.Message);
+                return;
+            }
+
+            string error;
+            var bundle = LevelBundle.Unpack(bytes, out error);
+            if (bundle == null)
+            {
+                Reject(ref result, path, error);
+                return;
+            }
+
+            var prototype = new UgcLevelRecord
+            {
+                Id = bundle.Id,
+                Title = bundle.Title,
+                Description = bundle.Description,
+                CreatorIds = new List<string>(bundle.CreatorIds),
+                Tags = new List<string>(bundle.Tags),
+                CreatedAtMs = bundle.CreatedAtMs,
+                Configurations = bundle.Configurations,
+                Validations = bundle.Validations,
+            };
+
+            UgcInstallOutcome outcome;
+            var adopted = store.Install(prototype, bundle.ClientVersion, bundle.ContentVersion,
+                                        bundle.ExportedAtMs, bundle.Content, bundle.ContentImage,
+                                        bundle.Thumbnail, out outcome, out error);
+
+            if (outcome == UgcInstallOutcome.Failed || outcome == UgcInstallOutcome.Conflict)
+            {
+                Reject(ref result, path, error);
+                return;
+            }
+
+            switch (outcome)
+            {
+                case UgcInstallOutcome.Added: result.Imported++; break;
+                case UgcInstallOutcome.Updated: result.Updated++; break;
+                case UgcInstallOutcome.Current: result.Current++; break;
+                case UgcInstallOutcome.Older: result.Older++; break;
+            }
+
+            Plugin.Log.LogInfo((outcome == UgcInstallOutcome.Updated ? "Updated '"
+                               : outcome == UgcInstallOutcome.Current ? "Already current: '"
+                               : outcome == UgcInstallOutcome.Older ? "Ignored older copy of '"
+                               : "Installed '") + adopted.Title + "' (" + adopted.Id + ", revision "
+                               + adopted.LatestContent().ContentVersion + ", code "
+                               + LevelCode.FromLevelId(adopted.Id) + ") from " + name + ".");
+
+            MoveAside(path);
+        }
+
+        /// <summary>
+        /// Moves a bundle out of the way once it is in the library, so the next scan does not see
+        /// it again. A failure here is recorded in memory instead, which covers the session; the
+        /// worst a restart can then do is add one more copy, which is visible and deletable rather
+        /// than silent.
+        /// </summary>
+        private static void MoveAside(string path)
+        {
+            Handled.Add(path);
+
+            if (ImportedDirectory == null) return;
+
+            try
+            {
+                Directory.CreateDirectory(ImportedDirectory);
+
+                var name = Path.GetFileNameWithoutExtension(path);
+                var extension = Path.GetExtension(path);
+
+                var destination = Path.Combine(ImportedDirectory, name + extension);
+                for (var n = 2; File.Exists(destination) && n < 1000; n++)
+                    destination = Path.Combine(ImportedDirectory, name + " (" + n + ")" + extension);
+
+                File.Move(path, destination);
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogWarning("Imported " + Path.GetFileName(path) + " but could not move it "
+                                      + "into the imported folder, so please move or delete it "
+                                      + "yourself: " + ex.Message);
+            }
+        }
+
+        private static void Reject(ref ImportResult result, string path, string reason)
+        {
+            result.Rejected++;
+            if (result.FirstError == null) result.FirstError = reason;
+
+            Plugin.Log.LogWarning("Skipped " + Path.GetFileName(path) + ": "
+                                  + (reason ?? "it could not be read."));
+
+            MoveRejected(path);
+        }
+
+        private static void MoveRejected(string path)
+        {
+            Handled.Add(path);
+            if (RejectedDirectory == null) return;
+
+            try
+            {
+                Directory.CreateDirectory(RejectedDirectory);
+                var name = Path.GetFileNameWithoutExtension(path);
+                var extension = Path.GetExtension(path);
+                var destination = Path.Combine(RejectedDirectory, name + extension);
+                for (var n = 2; File.Exists(destination) && n < 1000; n++)
+                    destination = Path.Combine(RejectedDirectory, name + " (" + n + ")" + extension);
+                File.Move(path, destination);
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogWarning("Could not move rejected " + Path.GetFileName(path)
+                                      + " into quarantine: " + ex.Message);
+            }
+        }
+
+        /// <summary>
+        /// One line fit for an in-game prompt. Null when there is nothing worth interrupting the
+        /// player about, which is the usual case on a screen that scans the folder every time it
+        /// opens.
+        /// </summary>
+        internal static string Describe(ImportResult result, bool sayNothingHappened)
+        {
+            if (result.Added > 0)
+            {
+                var line = result.Imported > 0 && result.Updated > 0
+                    ? "Installed " + result.Imported + " and updated " + result.Updated + " levels"
+                    : result.Updated > 0
+                        ? (result.Updated == 1 ? "Updated 1 level" : "Updated " + result.Updated + " levels")
+                        : (result.Imported == 1 ? "Installed 1 level" : "Installed " + result.Imported + " levels");
+
+                line += ". Look under Discover.";
+
+                if (result.Current > 0) line += " " + result.Current + " already current.";
+                if (result.Older > 0) line += " " + result.Older + " older version skipped.";
+                if (result.Pending > 0) line += " More files are waiting; press Import again.";
+
+                return result.Rejected > 0 ? line + " " + result.Rejected + " skipped." : line;
+            }
+
+            if (result.Current > 0 || result.Older > 0)
+            {
+                var line = result.Current > 0
+                    ? (result.Current == 1 ? "That level is already current."
+                                          : result.Current + " levels are already current.")
+                    : string.Empty;
+                if (result.Older > 0)
+                    line += (line.Length > 0 ? " " : string.Empty) + result.Older
+                            + (result.Older == 1 ? " older version was skipped."
+                                                : " older versions were skipped.");
+                return line;
+            }
+
+            if (result.Rejected > 0)
+            {
+                return result.Rejected == 1
+                    ? "Could not import that file: " + (result.FirstError ?? "it could not be read.")
+                    : "Could not import " + result.Rejected + " files. See the log for why.";
+            }
+
+            return sayNothingHappened
+                ? (result.Pending > 0
+                    ? "More files are waiting; press Import again."
+                    : "Nothing to import. Put .ss2level files in the import folder and press this again.")
+                : null;
+        }
+    }
+}
diff --git a/src/SS2Revive/NewsFeed.cs b/src/SS2Revive/NewsFeed.cs
index c40f772..ce0aeb1 100644
--- a/src/SS2Revive/NewsFeed.cs
+++ b/src/SS2Revive/NewsFeed.cs
@@ -43,7 +43,7 @@ internal static class NewsFeed
             ""ImageUrl"": ""tile-1.png"",
             ""ClickUrl"": """",
             ""Title"": ""Multiplayer Restored"",
-            ""SubTitle"": ""Parties, invites and peer-to-peer play now run over Steam. Press F10 in a lobby to invite a friend.""
+            ""SubTitle"": ""Parties, invites and peer-to-peer play now run over Steam. Invite friends or join them through Steam's Friends list.""
         },
         {
             ""ImageUrl"": ""tile-2.png"",
@@ -75,9 +75,26 @@ internal static string Initialise(string configuredUrl)
         {
             if (!string.IsNullOrEmpty(configuredUrl))
             {
-                BaseUrl = configuredUrl.EndsWith("/") ? configuredUrl : configuredUrl + "/";
-                Plugin.Log.LogInfo("News feed served from " + BaseUrl);
-                return BaseUrl;
+                // Tiles carry a ClickUrl the game opens on click, so a plaintext feed lets anyone
+                // on the network rewrite what the player sees and where clicking takes them.
+                // Require the same absolute-HTTPS shape the community catalogue client enforces.
+                Uri parsed;
+                if (!Uri.TryCreate(configuredUrl, UriKind.Absolute, out parsed)
+                    || parsed.Scheme != Uri.UriSchemeHttps
+                    || !string.IsNullOrEmpty(parsed.UserInfo)
+                    || !string.IsNullOrEmpty(parsed.Query)
+                    || !string.IsNullOrEmpty(parsed.Fragment))
+                {
+                    Plugin.Log.LogWarning(
+                        "Ignoring the configured news feed URL: it must be an absolute https:// URL "
+                        + "with no credentials, query or fragment. Falling back to the local feed.");
+                }
+                else
+                {
+                    BaseUrl = configuredUrl.EndsWith("/") ? configuredUrl : configuredUrl + "/";
+                    Plugin.Log.LogInfo("News feed served from " + BaseUrl);
+                    return BaseUrl;
+                }
             }
 
             try
diff --git a/src/SS2Revive/PatchSet.cs b/src/SS2Revive/PatchSet.cs
index 95be7c1..a899b81 100644
--- a/src/SS2Revive/PatchSet.cs
+++ b/src/SS2Revive/PatchSet.cs
@@ -34,6 +34,12 @@ internal static void ApplyAll(Harmony harmony)
             if (Plugin.DisableVoip.Value)
                 ApplyVoipDisable(harmony);
 
+            // Independent of Creation Mode and of level sharing on purpose. Levels arrive from
+            // other machines through the party as well - the host's level is pushed to every peer -
+            // so the reader wants bounding whether or not this player ever imports a file.
+            if (Plugin.HardenLevelReader.Value)
+                LevelFormatGuard.Apply(harmony);
+
             if (Plugin.NewsFeedEnabled.Value)
                 ApplyNewsFeed(harmony);
 
@@ -68,9 +74,27 @@ internal static void ApplyAll(Harmony harmony)
             {
                 UgcBackend.Initialise(Plugin.SaveDirectory.Value);
                 if (UgcBackend.Available)
+                {
                     UgcPatches.Apply(harmony);
+                    LegacyLevelPatches.Apply(harmony);
+                    CommunityLevelPatches.Apply(harmony);
+                    CommunityManagementPatches.Apply(harmony);
+
+                    // After the library, because export and import are both operations on it and
+                    // there is nothing to share without one.
+                    if (Plugin.LevelSharingEnabled.Value)
+                    {
+                        LevelSharing.Initialise(Plugin.SaveDirectory.Value);
+                        if (LevelSharing.Available)
+                            SharingPatches.Apply(harmony);
+                        else
+                            Report.Add("FAIL Level sharing -> the export and import folders could not be opened");
+                    }
+                }
                 else
+                {
                     Report.Add("FAIL Creation Mode -> the level library could not be opened");
+                }
             }
 
             // After the level library, because that is where the levels worth queueing come from.
diff --git a/src/SS2Revive/Plugin.cs b/src/SS2Revive/Plugin.cs
index ca85e15..824743f 100644
--- a/src/SS2Revive/Plugin.cs
+++ b/src/SS2Revive/Plugin.cs
@@ -64,7 +64,10 @@ public sealed class Plugin : BaseUnityPlugin
         internal static ConfigEntry<bool> LocalParty;
         internal static ConfigEntry<bool> HttpFailFast;
         internal static ConfigEntry<bool> SkipMatchmaking;
+        internal static ConfigEntry<bool> HardenLevelReader;
         internal static ConfigEntry<bool> CreationMode;
+        internal static ConfigEntry<bool> LevelSharingEnabled;
+        internal static ConfigEntry<string> CommunityCatalogUrl;
         internal static ConfigEntry<bool> FreeForAll;
         internal static ConfigEntry<bool> FreeForAllIncludeGameLevels;
         internal static ConfigEntry<BackendMode> Backend;
@@ -107,13 +110,40 @@ private void Awake()
                 "Start levels with whoever is already in the party instead of holding the vactube "
                 + "screen open for strangers. Bossa's matchmaking server is gone, so the wait can "
                 + "only ever time out.");
+            HardenLevelReader = Config.Bind("Security", "HardenLevelReader", true,
+                "Put bounds on the level file reader. The format lets a file declare its own voxel "
+                + "dimensions and its own decompressed size with nothing checking either, so a "
+                + "level built to do so can ask for an allocation no machine can satisfy. That "
+                + "matters in a party, where the host's level is sent to everyone: one bad level "
+                + "would take out the whole lobby rather than one player. Custom/shared maps must "
+                + "use current format 29; older maps are accepted only when their SHA-256 exactly "
+                + "matches a level in this installation's bundled catalogue. Leave this on.");
             CreationMode = Config.Bind("CreationMode", "Enabled", true,
                 "Keep the level editor working by saving levels to this machine instead of Bossa's "
                 + "UGC service. Without it, loading into Creation Mode hangs on a black screen: the "
                 + "game uploads a new level before it will open it, and that upload can no longer "
                 + "complete or fail. Levels go to the SS2Revive folder beside your other saves, one "
-                + "folder each. Publishing works, but only you can see the result - there is no "
-                + "shared level browser left to publish to.");
+                + "folder each. Saved levels can be published to the restored community browser "
+                + "after Steam authentication.");
+            LevelSharingEnabled = Config.Bind("CreationMode", "LevelSharing", true,
+                "Turn the terminal's Share button into an Export button, and add an Import button "
+                + "to the Create screen. Export writes the level to one .ss2level file and copies "
+                + "the game's own 22-character share code to the clipboard; import reads any "
+                + ".ss2level file left in the import folder. Both folders sit beside your saves, in "
+                + "the SS2Revive folder. Send the file however you like and post the code with it - "
+                + "the terminal's search box has always accepted a code, so once somebody has "
+                + "imported the file, the code finds the level on their machine too. Manually "
+                + "imported levels are published only in the local library and stay credited to "
+                + "whoever built them, so they can be played and browsed but not edited.");
+            // This intentionally uses a new key. Older builds wrote an empty CommunityCatalogUrl
+            // into existing config files; reusing it would silently keep the new public service
+            // disabled for every upgrading player.
+            CommunityCatalogUrl = Config.Bind("CommunityMaps", "ApiCatalogUrl",
+                "https://community.m12labs.net/v1/catalog",
+                "HTTPS URL of the public SS2Revive community-map catalogue. Published maps are "
+                + "merged into Discover without requiring a login. Bundles and thumbnails are "
+                + "checksum-verified, cached, and installed locally only when opened. Leave this "
+                + "empty only when a completely local library is desired.");
             FreeForAll = Config.Bind("FreeForAll", "Enabled", true,
                 "Draw the Free-for-all queue from the levels on this machine. Bossa served that "
                 + "queue from a curated slice of what the community had published, so without this "
@@ -149,7 +179,7 @@ private void Awake()
                 + "without this they stay white.");
             NewsFeedUrl = Config.Bind("NewsFeed", "Url", "",
                 "Where to fetch NewsFeed.json and images/ from. Leave empty to read them out of "
-                + "BepInEx/plugins/SS2Revive/newsfeed/, which needs no server. Set an http(s) URL "
+                + "BepInEx/plugins/SS2Revive/newsfeed/, which needs no server. Set an https:// URL "
                 + "with a trailing slash to serve the feed to several machines from one place.");
 
             SteamTransport = Config.Bind("Party", "SteamP2PTransport", true,
@@ -224,9 +254,9 @@ private static void WarnAboutGameVersion(string gameVersion)
                 Log.LogError("Build 1.5.0 was the offline patch, and it removed the netcode this "
                              + "mod exists to restore - there is nothing left for the party, "
                              + "transport and backend patches to attach to.");
-                Log.LogError($"Install build {TestedGameVersion} instead. installCurrentVersion.ps1 "
-                             + "in the mod's repository downloads it from Steam for an account "
-                             + "that owns the game.");
+                Log.LogError($"Install build {TestedGameVersion} instead. SS2Revive-Setup.exe "
+                             + "from the latest release downloads it from Steam for an account "
+                             + "that owns the game, then installs BepInEx and this mod.");
                 Log.LogError("Everything below this line is a consequence of that, not a separate "
                              + "problem.");
                 Log.LogError("=====================================================================");
diff --git a/src/SS2Revive/SS2Revive.csproj b/src/SS2Revive/SS2Revive.csproj
index 5567134..c0df0a6 100644
--- a/src/SS2Revive/SS2Revive.csproj
+++ b/src/SS2Revive/SS2Revive.csproj
@@ -92,6 +92,10 @@
       <HintPath>$(GameManagedDir)\Assembly-CSharp.dll</HintPath>
       <Private>false</Private>
     </Reference>
+    <Reference Include="Assembly-CSharp-firstpass">
+      <HintPath>$(GameManagedDir)\Assembly-CSharp-firstpass.dll</HintPath>
+      <Private>false</Private>
+    </Reference>
     <Reference Include="Steamworks.NET">
       <HintPath>$(GameManagedDir)\Steamworks.NET.dll</HintPath>
       <Private>false</Private>
@@ -108,6 +112,32 @@
       <HintPath>$(GameManagedDir)\UnityEngine.InputLegacyModule.dll</HintPath>
       <Private>false</Private>
     </Reference>
+
+    <!--
+      The terminal UI, for the export and import buttons in SharingPatches. IMGUIModule is here for
+      GUIUtility.systemCopyBuffer alone - the clipboard is where the share code has to end up, and
+      it is the same call the game's own share window makes.
+    -->
+    <Reference Include="UnityEngine.IMGUIModule">
+      <HintPath>$(GameManagedDir)\UnityEngine.IMGUIModule.dll</HintPath>
+      <Private>false</Private>
+    </Reference>
+    <Reference Include="UnityEngine.UI">
+      <HintPath>$(GameManagedDir)\UnityEngine.UI.dll</HintPath>
+      <Private>false</Private>
+    </Reference>
+    <Reference Include="UnityEngine.UIModule">
+      <HintPath>$(GameManagedDir)\UnityEngine.UIModule.dll</HintPath>
+      <Private>false</Private>
+    </Reference>
+    <Reference Include="Unity.TextMeshPro">
+      <HintPath>$(GameManagedDir)\Unity.TextMeshPro.dll</HintPath>
+      <Private>false</Private>
+    </Reference>
+  </ItemGroup>
+
+  <ItemGroup Label="Framework">
+    <Reference Include="System.Security" />
   </ItemGroup>
 
   <!--
diff --git a/src/SS2Revive/SharingPatches.cs b/src/SS2Revive/SharingPatches.cs
new file mode 100644
index 0000000..7c04229
--- /dev/null
+++ b/src/SS2Revive/SharingPatches.cs
@@ -0,0 +1,547 @@
+using System;
+using Data;
+using HarmonyLib;
+using Services;
+using TMPro;
+using UnityEngine;
+using UnityEngine.UI;
+
+namespace SS2Revive
+{
+    /// <summary>
+    /// Entry points that make local sharing and online publication reachable without leaving the
+    /// game. Folder import remains automatic; online publication replaces the game's obsolete
+    /// Publish action and opens a full-size overlay.
+    ///
+    /// Export takes over the Share button. The terminal normally shows Publish while a level is a
+    /// draft and Share once it is published:
+    /// <code>
+    ///   _publishButton.gameObject.SetActive(... &amp;&amp; _isInCreateMode &amp;&amp; flag);   // flag  = Draft
+    ///   _shareButton.gameObject.SetActive(flag3);                            // flag3 = Published
+    /// </code>
+    /// SS2Revive keeps Export available for both states and makes Publish the authenticated online
+    /// action. This removes the duplicate Publish Online button while preserving the familiar
+    /// modal layout and navigation.
+    ///
+    /// Import is scanned silently whenever Create opens. The previous cloned training-video button
+    /// was intentionally removed because its large tile was the wrong interaction for publication.
+    /// </summary>
+    internal static class SharingPatches
+    {
+        private const string LogoutButtonName = "SS2ReviveCommunityLogoutButton";
+
+        /// <summary>
+        /// The Create screen currently open, so the Import button can redraw it. The button's
+        /// handler is static - it is a delegate on a cloned GameObject, not a component of ours -
+        /// and there is only ever one of these screens.
+        /// </summary>
+        private static TerminalCreateScreen _screen;
+        private static TerminalLevelModalController _publishModal;
+        private static ExtendedButton _accountButton;
+        private static CommunityPublishOperation _accountOperation;
+
+        internal static void Apply(Harmony harmony)
+        {
+            PatchSet.Try("TerminalLevelModalController.OnShareBtnClicked -> export to a file", () =>
+            {
+                var target = PatchSet.Method(typeof(TerminalLevelModalController), "OnShareBtnClicked");
+                harmony.Patch(target, new HarmonyMethod(
+                    AccessTools.Method(typeof(SharingPatches), nameof(Share_Prefix))));
+            });
+
+            PatchSet.Try("TerminalCreateScreen.OnScreenEntered -> import folder and button", () =>
+            {
+                var target = PatchSet.Method(typeof(TerminalCreateScreen), "OnScreenEntered",
+                    new[] { typeof(bool) });
+                harmony.Patch(target, null, new HarmonyMethod(
+                    AccessTools.Method(typeof(SharingPatches), nameof(CreateScreenEntered_Postfix))));
+            });
+
+            PatchSet.Try("TerminalLevelModalController.DisplayLevelData -> export drafts too", () =>
+            {
+                var target = PatchSet.Method(typeof(TerminalLevelModalController), "DisplayLevelData");
+                harmony.Patch(target, null, new HarmonyMethod(
+                    AccessTools.Method(typeof(SharingPatches), nameof(DisplayLevelData_Postfix))));
+            });
+
+            PatchSet.Try("TerminalCreateScreen.SetupNavigation -> community logout", () =>
+            {
+                var target = PatchSet.Method(typeof(TerminalCreateScreen), "SetupNavigation");
+                harmony.Patch(target, null, new HarmonyMethod(
+                    AccessTools.Method(typeof(SharingPatches), nameof(CreateNavigation_Postfix))));
+            });
+
+            PatchSet.Try("TerminalLevelModalController.OnPublishLevelClicked -> publish online", () =>
+            {
+                var target = PatchSet.Method(typeof(TerminalLevelModalController),
+                    "OnPublishLevelClicked", new[] { typeof(ExtendedButton) });
+                harmony.Patch(target, new HarmonyMethod(
+                    AccessTools.Method(typeof(SharingPatches), nameof(Publish_Prefix))));
+            });
+
+            PatchSet.Try("TerminalUIController.DisableUI -> close community publish overlay", () =>
+            {
+                var target = PatchSet.Method(typeof(TerminalUIController), "DisableUI");
+                harmony.Patch(target, new HarmonyMethod(
+                    AccessTools.Method(typeof(SharingPatches), nameof(TerminalDisabled_Prefix))));
+            });
+        }
+
+        /// <summary>
+        /// Shows Export on saved drafts as well as published levels, then turns the stock Publish
+        /// action into authenticated online publication. Neither operation depends on the retired
+        /// Bossa UGC service.
+        /// </summary>
+        private static void DisplayLevelData_Postfix(TerminalLevelModalController __instance)
+        {
+            try
+            {
+                var summary = CurrentLevel(__instance);
+                if (summary == null) return;
+
+                ConfigureInstalledActions(__instance, summary);
+                ConfigureOnlinePublishAction(__instance, summary);
+                RefreshStockActionLabelsNextFrame(__instance, summary.serverLevelId);
+                if (summary.LevelStatus != UGCApi.EStatus.Draft) return;
+
+                var inCreateMode = AccessTools
+                    .Field(typeof(TerminalLevelModalController), "_isInCreateMode")
+                    ?.GetValue(__instance);
+
+                if (!(inCreateMode is bool) || !(bool)inCreateMode) return;
+
+                // A level with no server id has never been saved, so there is nothing to export.
+                if (string.IsNullOrEmpty(summary.serverLevelId)) return;
+
+                var button = AccessTools.Field(typeof(TerminalLevelModalController), "_shareButton")
+                    ?.GetValue(__instance) as ExtendedButton;
+
+                if (button != null)
+                {
+                    button.gameObject.SetActive(true);
+                    SetLabel(button, "EXPORT");
+                }
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogError("Showing the export button on a draft threw: " + ex);
+            }
+        }
+
+        private static LevelSummaryData CurrentLevel(TerminalLevelModalController modal) =>
+            AccessTools.Field(typeof(TerminalLevelModalController), "_currentDisplayedLevel")
+                ?.GetValue(modal) as LevelSummaryData;
+
+        private static void RefreshStockActionLabelsNextFrame(
+            TerminalLevelModalController modal, string expectedLevelId)
+        {
+            Dispatcher.NextFrame(() =>
+            {
+                var current = modal == null ? null : CurrentLevel(modal);
+                if (current == null || current.serverLevelId != expectedLevelId) return;
+                var share = AccessTools.Field(typeof(TerminalLevelModalController), "_shareButton")
+                    ?.GetValue(modal) as ExtendedButton;
+                if (share != null && share.gameObject.activeSelf) SetLabel(share, "EXPORT");
+                var publish = AccessTools.Field(typeof(TerminalLevelModalController), "_publishButton")
+                    ?.GetValue(modal) as ExtendedButton;
+                if (publish != null && publish.gameObject.activeSelf) SetLabel(publish, "PUBLISH");
+            });
+        }
+
+        private static void ConfigureInstalledActions(TerminalLevelModalController modal,
+                                                      LevelSummaryData summary)
+        {
+            if (modal == null || summary == null) return;
+
+            var share = AccessTools.Field(typeof(TerminalLevelModalController), "_shareButton")
+                ?.GetValue(modal) as ExtendedButton;
+            if (share != null && share.gameObject.activeSelf) SetLabel(share, "EXPORT");
+
+            var imported = UgcBackend.IsImported(summary.serverLevelId);
+            var remove = AccessTools.Field(typeof(TerminalLevelModalController), "_deleteButton")
+                ?.GetValue(modal) as ExtendedButton;
+            if (remove != null && imported)
+            {
+                remove.gameObject.SetActive(true);
+                remove.interactable = true;
+                SetLabel(remove, "REMOVE");
+            }
+            else if (remove != null && remove.gameObject.activeSelf)
+            {
+                SetLabel(remove, "DELETE");
+            }
+
+            // Reporting was a call to Bossa's dead moderation backend. An installed file can be
+            // removed locally; presenting both actions would imply a report goes somewhere.
+            if (imported)
+            {
+                var report = AccessTools.Field(typeof(TerminalLevelModalController), "_reportButton")
+                    ?.GetValue(modal) as Button;
+                if (report != null) report.gameObject.SetActive(false);
+            }
+        }
+
+        private static void TerminalDisabled_Prefix()
+        {
+            CommunityPublishOverlay.HideActive();
+            _accountOperation?.Cancel();
+            _accountOperation = null;
+        }
+
+        private static void ConfigureOnlinePublishAction(TerminalLevelModalController modal,
+                                                         LevelSummaryData summary)
+        {
+            var button = AccessTools.Field(typeof(TerminalLevelModalController), "_publishButton")
+                ?.GetValue(modal) as ExtendedButton;
+            if (button == null) return;
+
+            var inCreateMode = AccessTools.Field(typeof(TerminalLevelModalController), "_isInCreateMode")
+                ?.GetValue(modal) as bool? ?? false;
+            var localPlayer = Shell.Instance.GetLocalPlayerService().GetPlayerId(0);
+            var ownsLevel = summary.creatorPlayerIds != null && summary.creatorPlayerIds.Contains(localPlayer);
+            var visible = Plugin.LevelSharingEnabled.Value && inCreateMode && ownsLevel
+                          && !UgcBackend.IsImported(summary.serverLevelId)
+                          && !string.IsNullOrEmpty(summary.serverLevelId);
+            SetLabel(button, "PUBLISH");
+            button.gameObject.SetActive(visible);
+            button.interactable = visible;
+            if (visible) _publishModal = modal;
+        }
+
+        private static bool Publish_Prefix(TerminalLevelModalController __instance)
+        {
+            var modal = __instance ?? _publishModal;
+            var summary = modal == null ? null : CurrentLevel(modal);
+            if (modal == null || summary == null)
+            {
+                TerminalMessage.Show("No saved level is selected for publication.", isWarning: true);
+                return false;
+            }
+            CommunityPublishOverlay.Show(modal, summary);
+            return false;
+        }
+
+        // ------------------------------------------------------------------ export
+
+        /// <summary>
+        /// Writes the level to a file and puts its code on the clipboard, which is what the window
+        /// this replaces did with the code alone.
+        ///
+        /// The original is skipped rather than run afterwards. Its window is a modal whose only
+        /// action is "copy the code", and leaving it in the way would mean the player dismisses a
+        /// dialog to find out whether the file they came for was written.
+        /// </summary>
+        private static bool Share_Prefix(TerminalLevelModalController __instance)
+        {
+            try
+            {
+                var summary = CurrentLevel(__instance);
+
+                if (summary == null)
+                {
+                    Plugin.Log.LogWarning("Export: the modal is not showing a level.");
+                    return false;
+                }
+
+                string code, message;
+                if (!LevelSharing.Export(summary.serverLevelId, out code, out message))
+                {
+                    TerminalMessage.Show(message, isWarning: true);
+                    return false;
+                }
+
+                // The code is what gets pasted next to the file wherever it is being sent, so it is
+                // the thing worth having on the clipboard - the file itself is picked out of a
+                // folder, not pasted.
+                try
+                {
+                    GUIUtility.systemCopyBuffer = code;
+                }
+                catch (Exception ex)
+                {
+                    Plugin.Log.LogWarning("Could not put the share code on the clipboard: " + ex.Message);
+                }
+
+                OpenExportFolder();
+                TerminalMessage.Show("Exported to the SS2Revive export folder and opened it. Code "
+                                     + code + " copied to your clipboard.");
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogError("Export threw: " + ex);
+                TerminalMessage.Show("Export failed. See the log.", isWarning: true);
+            }
+
+            return false;
+        }
+
+        // ------------------------------------------------------------------ import
+
+        private static void CreateScreenEntered_Postfix(TerminalCreateScreen __instance, bool isLocalPlayer)
+        {
+            if (!isLocalPlayer) return;
+
+            _screen = __instance;
+            ConfigureLogoutButton(__instance);
+
+            try
+            {
+                // Silent: a screen that opens every time somebody walks up to the terminal must not
+                // report "nothing to do" every time. Only an actual import is worth saying.
+                var result = LevelSharing.ImportAll();
+                var message = LevelSharing.Describe(result, sayNothingHappened: false);
+
+                if (message != null)
+                {
+                    TerminalMessage.Show(message, isWarning: result.Added == 0);
+                    if (result.Added > 0) Refresh(__instance);
+                }
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogError("Scanning the import folder threw: " + ex);
+            }
+
+        }
+
+        private static void OnImportClicked(ExtendedButton button)
+        {
+            try
+            {
+                var result = LevelSharing.ImportAll();
+                TerminalMessage.Show(LevelSharing.Describe(result, sayNothingHappened: true),
+                                     isWarning: result.Added == 0 && result.Rejected > 0);
+
+                // The screen is listing a search that ran before any of this arrived, so it is
+                // redrawn rather than left to look as though nothing happened. It is also the
+                // refresh half of this button: pressing it after dropping a file in re-runs the
+                // search whether or not there was anything new to take in.
+                Refresh(_screen);
+
+                // Only when the folder was empty, and only on a deliberate press. Somebody who has
+                // just been told to put files somewhere needs to be shown where that is; somebody
+                // who already has files there does not want their game minimised.
+                if (result.Seen == 0) OpenImportFolder();
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogError("Import threw: " + ex);
+                TerminalMessage.Show("Import failed. See the log.", isWarning: true);
+            }
+        }
+
+        /// <summary>
+        /// Re-runs the screen's own search, which is what redraws the level grid. Imported levels
+        /// belong to whoever built them, so somebody else's level appears under Discover rather than
+        /// here - but a copy of one of your own does show up, and either way a stale list after a
+        /// button press reads as a button that did nothing.
+        /// </summary>
+        private static void Refresh(TerminalCreateScreen screen)
+        {
+            if (screen == null) return;
+
+            try
+            {
+                AccessTools.Method(typeof(TerminalCreateScreen), "NewSearch")?.Invoke(screen, null);
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogWarning("Could not refresh the Create screen: " + ex.Message);
+            }
+        }
+
+        internal static void RefreshCurrentCreateScreen()
+        {
+            if (_screen == null) return;
+            Refresh(_screen);
+            ConfigureLogoutButton(_screen);
+        }
+
+        internal static void RefreshCommunitySessionButton()
+        {
+            Dispatcher.NextFrame(() =>
+            {
+                if (_screen != null) ConfigureLogoutButton(_screen);
+            });
+        }
+
+        private static void ConfigureLogoutButton(TerminalCreateScreen screen)
+        {
+            if (screen == null) return;
+            var existing = screen.transform.Find(LogoutButtonName);
+            var button = existing == null ? null : existing.GetComponent<ExtendedButton>();
+            if (button == null)
+            {
+                var template = AccessTools.Field(typeof(TerminalCreateScreen), "_loadNextPageBtn")
+                    ?.GetValue(screen) as ExtendedButton;
+                if (template == null) return;
+                var clone = UnityEngine.Object.Instantiate(template.gameObject, screen.transform);
+                clone.name = LogoutButtonName;
+                clone.transform.SetAsLastSibling();
+                button = clone.GetComponent<ExtendedButton>();
+                if (button == null)
+                {
+                    UnityEngine.Object.Destroy(clone);
+                    return;
+                }
+                StripLocalisation(clone);
+                var rect = clone.transform as RectTransform;
+                if (rect != null)
+                {
+                    rect.anchorMin = new Vector2(1f, 1f);
+                    rect.anchorMax = new Vector2(1f, 1f);
+                    rect.pivot = new Vector2(1f, 1f);
+                    rect.anchoredPosition = new Vector2(-34f, -34f);
+                    rect.sizeDelta = new Vector2(180f, 54f);
+                    rect.localScale = Vector3.one;
+                }
+                button.onClick = new Button.ButtonClickedEvent();
+                button.OnPointerClickButton = AccountClicked;
+                button.OnPointerEnterButton = null;
+                button.OnPointerExitButton = null;
+            }
+            _accountButton = button;
+            var signedIn = CommunityPublishClient.HasStoredSession;
+            SetLabel(button, signedIn ? "LOG OUT" : "LOG IN");
+            var visible = CommunityPublishClient.Enabled;
+            button.gameObject.SetActive(visible);
+            button.interactable = visible && _accountOperation == null;
+            CreateNavigation_Postfix(screen);
+        }
+
+        private static void CreateNavigation_Postfix(TerminalCreateScreen __instance)
+        {
+            var account = _accountButton;
+            if (__instance == null || account == null || !account.gameObject.activeSelf) return;
+            var training = AccessTools.Field(typeof(TerminalCreateScreen), "_trainingVideosButton")
+                ?.GetValue(__instance) as ExtendedButton;
+            if (training == null) return;
+            var trainingNavigation = training.navigation;
+            trainingNavigation.selectOnRight = account;
+            training.navigation = trainingNavigation;
+            account.navigation = new Navigation
+            {
+                mode = Navigation.Mode.Explicit,
+                selectOnLeft = training,
+                selectOnUp = training,
+            };
+        }
+
+        private static void AccountClicked(ExtendedButton ignored)
+        {
+            if (_accountOperation != null || _accountButton == null) return;
+            _accountButton.interactable = false;
+            if (CommunityPublishClient.HasStoredSession)
+            {
+                SetLabel(_accountButton, "SIGNING OUT");
+                _accountOperation = CommunityPublishClient.Logout(new CommunityAccountCallbacks
+                {
+                    Status = text => TerminalMessage.Show(text),
+                    Completed = () => FinishAccountAction(null,
+                        "Signed out of SS2Revive community publishing on this PC."),
+                    Failed = message => FinishAccountAction(message, null),
+                });
+                return;
+            }
+
+            SetLabel(_accountButton, "SIGNING IN");
+            _accountOperation = CommunityPublishClient.Login(new CommunityAccountCallbacks
+            {
+                Status = text => TerminalMessage.Show(text),
+                AuthenticationRequired = OpenAccountAuthentication,
+                Completed = () => FinishAccountAction(null,
+                    "Signed in to SS2Revive community publishing."),
+                Failed = message => FinishAccountAction(message, null),
+            });
+        }
+
+        private static void OpenAccountAuthentication(string code, Uri uri)
+        {
+            TerminalMessage.Show("Finish Steam sign-in in your browser. Code " + code + ".",
+                                 false, 12f);
+            try { Application.OpenURL(uri.AbsoluteUri); }
+            catch (Exception ex)
+            {
+                _accountOperation?.Cancel();
+                FinishAccountAction("Could not open Steam login: " + ex.Message, null);
+            }
+        }
+
+        private static void FinishAccountAction(string warning, string success)
+        {
+            _accountOperation = null;
+            if (_accountButton != null)
+            {
+                SetLabel(_accountButton,
+                    CommunityPublishClient.HasStoredSession ? "LOG OUT" : "LOG IN");
+                _accountButton.gameObject.SetActive(CommunityPublishClient.Enabled);
+                _accountButton.interactable = CommunityPublishClient.Enabled;
+            }
+            TerminalMessage.Show(string.IsNullOrEmpty(warning) ? success : warning,
+                                 !string.IsNullOrEmpty(warning));
+        }
+
+        private static void OpenImportFolder()
+        {
+            if (LevelSharing.ImportDirectory == null) return;
+
+            try
+            {
+                Application.OpenURL("file:///" + LevelSharing.ImportDirectory.Replace('\\', '/'));
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogWarning("Could not open the import folder: " + ex.Message);
+            }
+        }
+
+        private static void OpenExportFolder()
+        {
+            if (LevelSharing.ExportDirectory == null) return;
+
+            try
+            {
+                Application.OpenURL("file:///" + LevelSharing.ExportDirectory.Replace('\\', '/'));
+            }
+            catch (Exception ex)
+            {
+                Plugin.Log.LogWarning("Could not open the export folder: " + ex.Message);
+            }
+        }
+
+        /// <summary>
+        /// A localised label rewrites itself from a key on enable, which would put the template's
+        /// text back over ours. Nothing on this clone needs translating, so the components go.
+        /// </summary>
+        internal static void StripLocalisation(GameObject clone)
+        {
+            var components = clone.GetComponentsInChildren<MonoBehaviour>(true);
+            for (var i = 0; i < components.Length; i++)
+            {
+                var component = components[i];
+                if (component == null) continue;
+
+                var name = component.GetType().Name;
+                if (name.IndexOf("Localiz", StringComparison.OrdinalIgnoreCase) < 0
+                    && name.IndexOf("Localis", StringComparison.OrdinalIgnoreCase) < 0)
+                {
+                    continue;
+                }
+
+                UnityEngine.Object.Destroy(component);
+            }
+        }
+
+        internal static void SetLabel(ExtendedButton button, string label)
+        {
+            var text = AccessTools.Field(typeof(ExtendedButton), "_buttonText")
+                ?.GetValue(button) as TextMeshProUGUI;
+
+            if (text == null) text = button.GetComponentInChildren<TextMeshProUGUI>(true);
+            if (text == null) return;
+
+            text.text = label;
+        }
+
+    }
+}
diff --git a/src/SS2Revive/TerminalMessage.cs b/src/SS2Revive/TerminalMessage.cs
new file mode 100644
index 0000000..4a97ab1
--- /dev/null
+++ b/src/SS2Revive/TerminalMessage.cs
@@ -0,0 +1,80 @@
+using System;
+using System.Collections.Generic;
+using HarmonyLib;
+using Services;
+
+namespace SS2Revive
+{
+    /// <summary>
+    /// Says something to the player through the game's own prompt, with text of our own.
+    ///
+    /// <c>PromptController.ShowPrompt</c> looks like it takes a message and does not. Its parameter
+    /// is named <c>promptDescriptionKey</c>, and it ends up on a <c>DynamicLocalizedText</c>, whose
+    /// base resolves it through the translation table:
+    /// <code>
+    ///   public void UpdateLocalization() {
+    ///       UpdateTranslation(Shell.Instance.GetLocalizationService().GetText(key));
+    ///   }
+    ///   // and GetText returns null for a key it does not have, which becomes:
+    ///   Text.text = string.Empty;
+    /// </code>
+    /// A missing key therefore does not fall back to the string that was passed - it renders an
+    /// empty prompt. Bossa's own code passes English sentences into it in a few places, which look
+    /// like messages and have never displayed either.
+    ///
+    /// So the text is registered as a translation first and the prompt is given a key that resolves.
+    /// Each message gets a fresh key, for two reasons: <c>LeanLocalizedBehaviour.Key</c> only
+    /// refreshes when the value it is assigned actually differs, so reusing one key would leave the
+    /// second message showing the first; and a prompt of the same <see cref="PromptType"/> is reused
+    /// rather than rebuilt, which is the same trap from the other side.
+    /// </summary>
+    internal static class TerminalMessage
+    {
+        /// <summary>
+        /// How many of our keys to leave in the table. They are small and few - one per export or
+        /// import - but the table is the game's, not ours, and it should not grow without limit
+        /// across a long session.
+        /// </summary>
+        private const int Keep = 16;
+
+        private static readonly Queue<string> Issued = new Queue<string>();
+        private static int _counter;
+
+        internal static void Show(string message, bool isWarning = false, float seconds = 6f)
+        {
+            if (string.IsNullOrEmpty(message)) return;
+
+            Plugin.Log.LogInfo("Terminal: " + message);
+
+            try
+            {
+                var service = Shell.Instance.GetLocalizationService();
+                var translations = AccessTools.Field(typeof(LocalizationService), "_translations")
+                    ?.GetValue(service) as Dictionary<string, string>;
+
+                if (translations == null)
+                {
+                    Plugin.Log.LogWarning("No translation table to register '" + message + "' in; "
+                                          + "the prompt would come up blank, so it is being left "
+                                          + "in the log only.");
+                    return;
+                }
+
+                var key = "SS2REVIVE_MESSAGE_" + (++_counter);
+                translations[key] = message;
+
+                Issued.Enqueue(key);
+                while (Issued.Count > Keep) translations.Remove(Issued.Dequeue());
+
+                Shell.Instance.GetUIModel()
+                     .GetUI<PromptController>(UIType.PromptController)
+                     .ShowPrompt(PromptType.LevelSaveMessage, key, isWarning, seconds);
+            }
+            catch (Exception ex)
+            {
+                // The message is already in the log by this point, which is the part that matters.
+                Plugin.Log.LogWarning("Could not show a prompt in game: " + ex.Message);
+            }
+        }
+    }
+}
diff --git a/src/SS2Revive/UgcBackend.cs b/src/SS2Revive/UgcBackend.cs
index 9d83c88..1e2e2b8 100644
--- a/src/SS2Revive/UgcBackend.cs
+++ b/src/SS2Revive/UgcBackend.cs
@@ -30,10 +30,19 @@ namespace SS2Revive
     /// </summary>
     internal static class UgcBackend
     {
+        private static readonly HashSet<string> CommunityPublishedIds =
+            new HashSet<string>(StringComparer.OrdinalIgnoreCase);
         private static UgcStore _store;
 
         internal static bool Available => _store != null;
 
+        /// <summary>
+        /// The library itself, for the one caller that is not translating a game call into a local
+        /// answer. <see cref="LevelSharing"/> moves whole levels in and out of it as files, which is
+        /// a level-library operation with no <see cref="UGCService2"/> method behind it.
+        /// </summary>
+        internal static UgcStore Store => _store;
+
         internal static void Initialise(string saveDirectory)
         {
             try
@@ -41,6 +50,9 @@ internal static void Initialise(string saveDirectory)
                 var root = SaveLocation.ResolveDirectory(saveDirectory);
                 _store = new UgcStore(root, message => Plugin.Log.LogWarning("UGC store: " + message));
                 Plugin.Log.LogInfo("Local level library ready: " + _store.Describe());
+                LegacyLevelCatalog.Initialise();
+                CommunityCatalogClient.Initialise(_store, Plugin.CommunityCatalogUrl.Value);
+                CommunityPublishClient.Initialise(_store.Root, Plugin.CommunityCatalogUrl.Value);
             }
             catch (Exception ex)
             {
@@ -168,6 +180,16 @@ internal static void AllImages(string serverLevelId,
                                        Action<List<UGCApi.AssetImageResponse_SurgeonUgc>> succeeded,
                                        Action failed)
         {
+            if (LegacyLevelCatalog.IsLegacy(serverLevelId))
+            {
+                Defer(() =>
+                {
+                    if (succeeded != null)
+                        succeeded(new List<UGCApi.AssetImageResponse_SurgeonUgc>());
+                });
+                return;
+            }
+
             var level = _store == null ? null : _store.Get(serverLevelId);
             if (level == null) { Defer(failed); return; }
 
@@ -197,7 +219,7 @@ internal static void Search(UgcQuery query, Action<List<LevelSummaryData>, int>
             try
             {
                 int pageCount;
-                var matches = _store.Search(query, out pageCount);
+                var matches = SearchLocalAndCommunity(query, out pageCount);
 
                 var summaries = new List<LevelSummaryData>(matches.Count);
                 for (var i = 0; i < matches.Count; i++) summaries.Add(ToSummary(matches[i]));
@@ -226,7 +248,7 @@ internal static List<LevelSummaryData> PublishedSummaries()
             try
             {
                 int pageCount;
-                var matches = _store.Search(new UgcQuery
+                var matches = SearchLocalAndCommunity(new UgcQuery
                 {
                     Status = UgcStore.StatusPublished,
                     ResultsPerPage = int.MaxValue,
@@ -242,6 +264,125 @@ internal static List<LevelSummaryData> PublishedSummaries()
             return summaries;
         }
 
+        internal static bool ConfirmCommunityPublished(string serverLevelId, int revision)
+        {
+            var level = _store == null ? null : _store.Get(serverLevelId);
+            var latest = level == null ? null : level.LatestContent();
+            if (level == null || level.IsImported || latest == null
+                || latest.ContentVersion != revision) return false;
+            if (string.Equals(level.Status, UgcStore.StatusPublished,
+                              StringComparison.OrdinalIgnoreCase)) return true;
+
+            level.Status = UgcStore.StatusPublished;
+            MarkValidationsComplete(level);
+            _store.Update(level);
+            Plugin.Log.LogInfo("Synchronized community publication for '" + level.Title + "' ("
+                               + level.Id + "), revision " + revision + ".");
+            return true;
+        }
+
+        internal static void ReconcileCommunityPublications(List<CommunityCatalogEntry> entries)
+        {
+            if (entries == null) return;
+            var next = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+            for (var i = 0; i < entries.Count; i++)
+            {
+                next.Add(entries[i].Id);
+                ConfirmCommunityPublished(entries[i].Id, entries[i].Revision);
+            }
+            foreach (var previous in CommunityPublishedIds)
+                if (!next.Contains(previous)) MarkCommunityUnpublished(previous);
+            CommunityPublishedIds.Clear();
+            foreach (var id in next) CommunityPublishedIds.Add(id);
+        }
+
+        internal static void MarkCommunityUnpublished(string serverLevelId)
+        {
+            var level = _store == null ? null : _store.Get(serverLevelId);
+            if (level == null || level.IsImported
+                || !string.Equals(level.Status, UgcStore.StatusPublished,
+                                  StringComparison.OrdinalIgnoreCase)) return;
+            level.Status = UgcStore.StatusDraft;
+            _store.Update(level);
+            Plugin.Log.LogInfo("Synchronized community removal for '" + level.Title + "' ("
+                               + level.Id + "). The editable local copy remains available.");
+        }
+
+        /// <summary>
+        /// Merges before paging so the terminal sees one coherent Discover library. Authored local
+        /// levels always win an id collision; an installed community map wins while current, and a
+        /// newer catalogue revision replaces its summary so selecting it performs an in-place update.
+        /// </summary>
+        private static List<UgcLevelRecord> SearchLocalAndCommunity(UgcQuery query, out int pageCount)
+        {
+            if (query == null) query = new UgcQuery();
+            var legacyOnly = LegacyLevelCatalog.ApplyBrowseFilter(query);
+            string ownedCreatorId;
+            var communityOwnedOnly = CommunityManagementPatches.ApplyBrowseFilter(out ownedCreatorId);
+            var allQuery = new UgcQuery
+            {
+                Status = query.Status,
+                CreatorId = query.CreatorId,
+                Tag = query.Tag,
+                TitleContains = query.TitleContains,
+                PartySize = query.PartySize,
+                Ids = query.Ids,
+                PageIndex = 0,
+                ResultsPerPage = int.MaxValue,
+                AnyStatus = query.AnyStatus,
+            };
+
+            List<UgcLevelRecord> combined;
+            if (legacyOnly)
+            {
+                combined = LegacyLevelCatalog.Search(allQuery);
+            }
+            else if (communityOwnedOnly)
+            {
+                allQuery.CreatorId = null;
+                combined = new List<UgcLevelRecord>();
+                var owned = CommunityCatalogClient.SearchOwned(allQuery, ownedCreatorId);
+                for (var i = 0; i < owned.Count; i++)
+                    combined.Add(owned[i].ToRecord(CommunityCatalogClient.ContentKey(owned[i]),
+                                                  CommunityCatalogClient.ThumbnailKey(owned[i])));
+            }
+            else
+            {
+                int ignoredPages;
+                combined = _store.Search(allQuery, out ignoredPages);
+                var remote = CommunityCatalogClient.Search(allQuery);
+                for (var i = 0; i < remote.Count; i++)
+                {
+                    var entry = remote[i];
+                    var installed = _store.Get(entry.Id);
+                    if (installed != null)
+                    {
+                        if (!installed.IsImported) continue;
+                        var latest = installed.LatestContent();
+                        if (latest != null && latest.ContentVersion >= entry.Revision) continue;
+                        for (var localIndex = combined.Count - 1; localIndex >= 0; localIndex--)
+                        {
+                            if (string.Equals(combined[localIndex].Id, entry.Id,
+                                              StringComparison.OrdinalIgnoreCase))
+                                combined.RemoveAt(localIndex);
+                        }
+                    }
+
+                    combined.Add(entry.ToRecord(CommunityCatalogClient.ContentKey(entry),
+                                                CommunityCatalogClient.ThumbnailKey(entry)));
+                }
+            }
+
+            combined.Sort((a, b) => b.UpdatedAtMs.CompareTo(a.UpdatedAtMs));
+            var perPage = query.ResultsPerPage > 0 ? query.ResultsPerPage : UgcStore.DefaultResultsPerPage;
+            pageCount = combined.Count == 0 ? 1 : (int)(((long)combined.Count + perPage - 1) / perPage);
+            var page = query.PageIndex < 0 ? 0 : query.PageIndex;
+            var start = (long)page * perPage;
+            if (start >= combined.Count) return new List<UgcLevelRecord>();
+            var take = Math.Min(perPage, combined.Count - (int)start);
+            return combined.GetRange((int)start, take);
+        }
+
         // ----------------------------------------------------------------- edits
 
         internal static void Delete(UGCService2 service, string serverLevelId, Action succeeded, Action failed)
@@ -445,6 +586,16 @@ internal static void ConfirmValidated(string serverLevelId, Action<string> succe
 
         internal static void Played(UGCService2 service, string serverLevelId, Action succeeded, Action failed)
         {
+            if (LegacyLevelCatalog.IsLegacy(serverLevelId))
+            {
+                Defer(() =>
+                {
+                    if (succeeded != null) succeeded();
+                    Raise(service, "OnUGCLevelPlayed", serverLevelId);
+                });
+                return;
+            }
+
             var level = _store == null ? null : _store.Get(serverLevelId);
             if (level == null) { Defer(failed); return; }
 
@@ -460,6 +611,8 @@ internal static void Played(UGCService2 service, string serverLevelId, Action su
 
         internal static void Rate(string serverLevelId, UGCApi.ERating rating, Action succeeded, Action failed)
         {
+            if (LegacyLevelCatalog.IsLegacy(serverLevelId)) { Defer(succeeded); return; }
+
             var level = _store == null ? null : _store.Get(serverLevelId);
             if (level == null) { Defer(failed); return; }
 
@@ -513,21 +666,38 @@ internal static void AllTags(UGCService2 service, Action succeeded, Action faile
                 }
             }
 
+            LegacyLevelCatalog.AddTags(tags);
+
             service.Tags = tags;
             Defer(succeeded);
         }
 
         // ------------------------------------------------------------- blob reads
 
-        internal static bool OwnsKey(string key) => UgcStore.OwnsKey(key);
+        internal static bool OwnsKey(string key) =>
+            LegacyLevelCatalog.OwnsKey(key) || UgcStore.OwnsKey(key);
 
-        internal static byte[] ReadKey(string key) => _store == null ? null : _store.ReadKey(key);
+        internal static byte[] ReadKey(string key)
+        {
+            if (LegacyLevelCatalog.OwnsKey(key)) return LegacyLevelCatalog.ReadKey(key);
+            return _store == null ? null : _store.ReadKey(key);
+        }
+
+        internal static bool IsImported(string serverLevelId)
+        {
+            var level = _store == null ? null : _store.Get(serverLevelId);
+            return level != null && level.IsImported;
+        }
+
+        internal static bool IsLegacy(string serverLevelId) =>
+            LegacyLevelCatalog.IsLegacy(serverLevelId);
 
         // ------------------------------------------------------------ conversions
 
         private static UgcLevelRecord Find(string serverLevelId, UGCApi.EStatus status)
         {
-            var level = _store == null ? null : _store.Get(serverLevelId);
+            var level = LegacyLevelCatalog.Get(serverLevelId)
+                        ?? (_store == null ? null : _store.Get(serverLevelId));
             if (level == null) return null;
 
             // The caller asks for a level in a particular state. Answering with a level in a
@@ -563,6 +733,7 @@ private static LevelSummaryData ToSummary(UgcLevelRecord level)
             };
 
             summary.levelValidationFlags = LevelRulesHelper.ConvertValidationStepsToFlag(summary.levelValidationSteps);
+            LegacyLevelCatalog.Decorate(summary);
             return summary;
         }
 
@@ -596,7 +767,7 @@ private static UGCApi.AssetImageResponse_SurgeonUgc ToImageResponse(UgcImageReco
             };
         }
 
-        private static Json ToStoredConfigurations(List<LevelConfiguration> configurations)
+        internal static Json ToStoredConfigurations(List<LevelConfiguration> configurations)
         {
             var array = Json.Array();
             if (configurations == null) return array;
@@ -700,7 +871,7 @@ private static List<LevelConfiguration> FromStoredConfigurations(Json stored)
             return configurations;
         }
 
-        private static Json ToStoredValidations(List<LevelValidationStep> steps)
+        internal static Json ToStoredValidations(List<LevelValidationStep> steps)
         {
             var array = Json.Array();
             if (steps == null) return array;
diff --git a/src/SS2Revive/UgcPatches.cs b/src/SS2Revive/UgcPatches.cs
index 74a30ff..af1a288 100644
--- a/src/SS2Revive/UgcPatches.cs
+++ b/src/SS2Revive/UgcPatches.cs
@@ -436,6 +436,12 @@ private static bool ByIds_Prefix(List<string> levelIDS,
         private static bool GetResource_Prefix(string resourceUrl, Action<byte[]> succeedDelegate,
                                                Action failedDelegate)
         {
+            if (CommunityCatalogClient.OwnsKey(resourceUrl))
+            {
+                CommunityCatalogClient.ReadKey(resourceUrl, succeedDelegate, failedDelegate);
+                return false;
+            }
+
             if (!UgcBackend.OwnsKey(resourceUrl)) return true;
 
             var bytes = UgcBackend.ReadKey(resourceUrl);
diff --git a/src/SS2Revive_Data/AtomicFile.cs b/src/SS2Revive_Data/AtomicFile.cs
index d9126e4..bb12206 100644
--- a/src/SS2Revive_Data/AtomicFile.cs
+++ b/src/SS2Revive_Data/AtomicFile.cs
@@ -20,17 +20,17 @@ namespace SS2ReviveData
     /// Replace only works within one volume and refuses some filesystems outright, so the
     /// delete-then-move path is kept as the fallback. That is no worse than what this replaced.
     /// </summary>
-    internal static class AtomicFile
+    public static class AtomicFile
     {
-        internal const string BackupSuffix = ".bak";
+        public const string BackupSuffix = ".bak";
 
-        internal static void WriteAllText(string path, string contents, Encoding encoding,
-                                          bool keepBackup = false)
+        public static void WriteAllText(string path, string contents, Encoding encoding,
+                                        bool keepBackup = false)
         {
             Write(path, keepBackup, temporary => File.WriteAllText(temporary, contents, encoding));
         }
 
-        internal static void WriteAllBytes(string path, byte[] contents, bool keepBackup = false)
+        public static void WriteAllBytes(string path, byte[] contents, bool keepBackup = false)
         {
             Write(path, keepBackup, temporary => File.WriteAllBytes(temporary, contents));
         }
diff --git a/src/SS2Revive_Data/CommunityCatalog.cs b/src/SS2Revive_Data/CommunityCatalog.cs
new file mode 100644
index 0000000..d97dc24
--- /dev/null
+++ b/src/SS2Revive_Data/CommunityCatalog.cs
@@ -0,0 +1,467 @@
+using System;
+using System.Collections.Generic;
+using System.Text;
+
+namespace SS2ReviveData
+{
+    /// <summary>
+    /// One entry in the public community catalogue. Object locations are deliberately relative
+    /// keys, never arbitrary URLs: the client resolves them against the configured API origin, so
+    /// catalogue data cannot redirect a thumbnail or level request to another host.
+    /// </summary>
+    public sealed class CommunityCatalogEntry
+    {
+        public string Id = string.Empty;
+        public int Revision;
+        public string Title = string.Empty;
+        public string Description = string.Empty;
+        public List<string> CreatorIds = new List<string>();
+        public List<string> Tags = new List<string>();
+        public long CreatedAtMs;
+        public long UpdatedAtMs;
+        public int ClientVersion;
+        public int MapFormatVersion;
+        public string ReviveVersion = string.Empty;
+        public string MinimumReviveVersion = string.Empty;
+        public long SizeBytes;
+        public string Sha256 = string.Empty;
+        public string BundleKey = string.Empty;
+        public long ThumbnailSizeBytes;
+        public string ThumbnailSha256 = string.Empty;
+        public string ThumbnailKey = string.Empty;
+        public Json Configurations;
+        public Json Validations;
+
+        public UgcLevelRecord ToRecord(string contentKey, string thumbnailKey)
+        {
+            return new UgcLevelRecord
+            {
+                Id = Id,
+                Title = Title,
+                Description = Description,
+                Status = UgcStore.StatusPublished,
+                CreatorIds = new List<string>(CreatorIds),
+                Tags = new List<string>(Tags),
+                CreatedAtMs = CreatedAtMs,
+                UpdatedAtMs = UpdatedAtMs,
+                IsImported = true,
+                ThumbnailKey = thumbnailKey ?? string.Empty,
+                Configurations = Configurations,
+                Validations = Validations,
+                Contents = new List<UgcContentRecord>
+                {
+                    new UgcContentRecord
+                    {
+                        Id = Id + "-catalog-" + Revision,
+                        Key = contentKey ?? string.Empty,
+                        CreatedAtMs = UpdatedAtMs,
+                        ClientVersion = ClientVersion,
+                        ContentVersion = Revision,
+                    },
+                },
+            };
+        }
+    }
+
+    /// <summary>
+    /// Parser and query model for the Worker-produced community catalogue. It has no networking
+    /// dependency, which keeps the hostile-input rules testable outside Unity.
+    /// </summary>
+    public sealed class CommunityCatalog
+    {
+        public const int SchemaVersion = 1;
+        public const int MaxDocumentBytes = 2 * 1024 * 1024;
+        public const int MaxEntries = 2000;
+        public const int MaxObjectKeyCharacters = 256;
+        public const int SupportedMapFormatVersion = 29;
+
+        private static readonly UTF8Encoding StrictUtf8 = new UTF8Encoding(false, true);
+
+        public string GeneratedAtUtc = string.Empty;
+        public List<CommunityCatalogEntry> Entries = new List<CommunityCatalogEntry>();
+
+        public static bool TryParse(byte[] bytes, out CommunityCatalog catalog, out string error)
+        {
+            catalog = null;
+            error = null;
+            if (bytes == null || bytes.Length == 0)
+            {
+                error = "The catalogue is empty.";
+                return false;
+            }
+            if (bytes.Length > MaxDocumentBytes)
+            {
+                error = "The catalogue is larger than the 2 MB safety limit.";
+                return false;
+            }
+
+            string text;
+            try { text = StrictUtf8.GetString(bytes); }
+            catch (DecoderFallbackException)
+            {
+                error = "The catalogue is not valid UTF-8.";
+                return false;
+            }
+            if (!HasSafeNesting(text))
+            {
+                error = "The catalogue JSON is nested too deeply.";
+                return false;
+            }
+
+            Json root;
+            try { root = Json.Parse(text); }
+            catch (Exception ex)
+            {
+                error = "The catalogue JSON could not be read: " + ex.Message;
+                return false;
+            }
+
+            if (root == null || root.Kind != JsonKind.Object)
+            {
+                error = "The catalogue root must be a JSON object.";
+                return false;
+            }
+            if (root["schemaVersion"] == null || root["schemaVersion"].AsIntOr(0) != SchemaVersion)
+            {
+                error = "The catalogue schema is not supported by this build.";
+                return false;
+            }
+
+            var maps = root["maps"];
+            if (maps == null || maps.Kind != JsonKind.Array)
+            {
+                error = "The catalogue has no maps array.";
+                return false;
+            }
+            if (maps.Count > MaxEntries)
+            {
+                error = "The catalogue has more than " + MaxEntries + " entries.";
+                return false;
+            }
+
+            var parsed = new CommunityCatalog
+            {
+                GeneratedAtUtc = Clean(root["generatedAtUtc"].AsStringOr(string.Empty), 64),
+            };
+            var byId = new Dictionary<string, CommunityCatalogEntry>(StringComparer.OrdinalIgnoreCase);
+            var rejected = 0;
+            foreach (var value in maps.Items)
+            {
+                CommunityCatalogEntry entry;
+                if (!TryReadEntry(value, out entry))
+                {
+                    rejected++;
+                    continue;
+                }
+
+                CommunityCatalogEntry prior;
+                if (byId.TryGetValue(entry.Id, out prior))
+                {
+                    if (entry.Revision > prior.Revision) byId[entry.Id] = entry;
+                }
+                else byId.Add(entry.Id, entry);
+            }
+
+            foreach (var pair in byId) parsed.Entries.Add(pair.Value);
+            catalog = parsed;
+            if (rejected > 0) error = "Ignored " + rejected + " invalid catalogue entr"
+                                      + (rejected == 1 ? "y." : "ies.");
+            return true;
+        }
+
+        /// <summary>Filters without ever putting a remote entry in an author's local Create list.</summary>
+        public List<CommunityCatalogEntry> Search(UgcQuery query)
+        {
+            var result = new List<CommunityCatalogEntry>();
+            if (query == null) query = new UgcQuery();
+
+            // Creator-filtered searches are the game's My Levels rows. Catalogue attribution is
+            // display-only and must not grant edit ownership, even if a manifest claims the local id.
+            if (!string.IsNullOrEmpty(query.CreatorId)) return result;
+            if (!query.AnyStatus && !string.IsNullOrEmpty(query.Status)
+                && !string.Equals(query.Status, UgcStore.StatusPublished,
+                                  StringComparison.OrdinalIgnoreCase)) return result;
+
+            for (var i = 0; i < Entries.Count; i++)
+            {
+                var entry = Entries[i];
+                if (!string.IsNullOrEmpty(query.Tag) && !entry.Tags.Contains(query.Tag)) continue;
+                if (!string.IsNullOrEmpty(query.TitleContains)
+                    && entry.Title.IndexOf(query.TitleContains,
+                                           StringComparison.OrdinalIgnoreCase) < 0) continue;
+                if (query.Ids != null && query.Ids.Count > 0 && !query.Ids.Contains(entry.Id)) continue;
+                if (query.PartySize > 0 && !SupportsPartySize(entry.Configurations, query.PartySize)) continue;
+                result.Add(entry);
+            }
+
+            result.Sort((a, b) => b.UpdatedAtMs.CompareTo(a.UpdatedAtMs));
+            return result;
+        }
+
+        /// <summary>Returns a player-facing reason, or null when this build can install the map.</summary>
+        public static string CompatibilityError(CommunityCatalogEntry entry, string currentReviveVersion)
+        {
+            if (entry == null) return "The catalogue entry is missing.";
+            if (entry.MapFormatVersion != SupportedMapFormatVersion)
+                return "Map format " + entry.MapFormatVersion + " is not supported (this game uses "
+                       + SupportedMapFormatVersion + ").";
+            if (!string.IsNullOrEmpty(entry.MinimumReviveVersion)
+                && CompareVersions(currentReviveVersion, entry.MinimumReviveVersion) < 0)
+                return "Requires SS2Revive " + entry.MinimumReviveVersion + " or newer.";
+            return null;
+        }
+
+        public static bool IsSafeObjectKey(string key)
+        {
+            if (string.IsNullOrEmpty(key) || key.Length > MaxObjectKeyCharacters
+                || key[0] == '/' || key[key.Length - 1] == '/' || key.IndexOf("//", StringComparison.Ordinal) >= 0)
+                return false;
+
+            var segmentLength = 0;
+            for (var i = 0; i < key.Length; i++)
+            {
+                var c = key[i];
+                if (c == '/')
+                {
+                    if (segmentLength == 1 && key[i - 1] == '.') return false;
+                    if (segmentLength == 2 && key[i - 1] == '.' && key[i - 2] == '.') return false;
+                    segmentLength = 0;
+                    continue;
+                }
+                if (!(c >= 'a' && c <= 'z') && !(c >= 'A' && c <= 'Z')
+                    && !(c >= '0' && c <= '9') && c != '-' && c != '_' && c != '.') return false;
+                segmentLength++;
+            }
+            return !(segmentLength == 1 && key[key.Length - 1] == '.')
+                   && !(segmentLength == 2 && key[key.Length - 1] == '.' && key[key.Length - 2] == '.');
+        }
+
+        private static bool TryReadEntry(Json value, out CommunityCatalogEntry entry)
+        {
+            entry = null;
+            if (value == null || value.Kind != JsonKind.Object) return false;
+
+            Guid id;
+            if (!Guid.TryParse(value["id"].AsStringOr(string.Empty), out id)) return false;
+            var revision = value["revision"].AsIntOr(0);
+            var clientVersion = value["clientVersion"].AsIntOr(0);
+            var mapFormatVersion = value["mapFormatVersion"].AsIntOr(clientVersion);
+            var minimumReviveVersion = value["minimumReviveVersion"].AsStringOr(string.Empty);
+            var size = value["sizeBytes"].AsLongOr(0);
+            var sha = value["sha256"].AsStringOr(string.Empty).ToLowerInvariant();
+            var bundleKey = value["bundleKey"].AsStringOr(string.Empty);
+            if (revision < 1 || clientVersion < 1 || mapFormatVersion < 1
+                || clientVersion != mapFormatVersion
+                || (!string.IsNullOrEmpty(minimumReviveVersion) && !IsVersion(minimumReviveVersion))
+                || size < 1 || size > LevelBundle.MaxBundleBytes
+                || !IsSha256(sha) || !IsSafeObjectKey(bundleKey)) return false;
+
+            var thumbnailKey = value["thumbnailKey"].AsStringOr(string.Empty);
+            var thumbnailSize = value["thumbnailSizeBytes"].AsLongOr(0);
+            var thumbnailSha = value["thumbnailSha256"].AsStringOr(string.Empty).ToLowerInvariant();
+            if (!string.IsNullOrEmpty(thumbnailKey)
+                && (!IsSafeObjectKey(thumbnailKey) || thumbnailSize < 1
+                    || thumbnailSize > LevelBundle.MaxImageBytes || !IsSha256(thumbnailSha))) return false;
+            if (string.IsNullOrEmpty(thumbnailKey))
+            {
+                thumbnailSize = 0;
+                thumbnailSha = string.Empty;
+            }
+
+            var configurations = value["configurations"];
+            var validations = value["validations"];
+            if (!IsSafeConfigurations(configurations) || !IsSafeValidations(validations)) return false;
+
+            var normalizedId = id.ToString();
+            var code = value["code"].AsStringOr(string.Empty);
+            if (!string.IsNullOrEmpty(code)
+                && !string.Equals(code, LevelCode.FromLevelId(normalizedId), StringComparison.Ordinal)) return false;
+
+            entry = new CommunityCatalogEntry
+            {
+                Id = normalizedId,
+                Revision = revision,
+                Title = Clean(value["title"].AsStringOr("Untitled level"), LevelBundle.MaxTitleCharacters),
+                Description = Clean(value["description"].AsStringOr(string.Empty), LevelBundle.MaxDescriptionCharacters),
+                CreatedAtMs = SafeTime(value["createdAtMs"].AsLongOr(0)),
+                UpdatedAtMs = SafeTime(value["updatedAtMs"].AsLongOr(value["exportedAtMs"].AsLongOr(0))),
+                ClientVersion = clientVersion,
+                MapFormatVersion = mapFormatVersion,
+                ReviveVersion = Clean(value["reviveVersion"].AsStringOr(string.Empty), 64),
+                MinimumReviveVersion = minimumReviveVersion,
+                SizeBytes = size,
+                Sha256 = sha,
+                BundleKey = bundleKey,
+                ThumbnailSizeBytes = thumbnailSize,
+                ThumbnailSha256 = thumbnailSha,
+                ThumbnailKey = thumbnailKey,
+                Configurations = configurations,
+                Validations = validations,
+            };
+            ReadStrings(value["creatorIds"], entry.CreatorIds, LevelBundle.MaxCreators);
+            ReadStrings(value["tags"], entry.Tags, LevelBundle.MaxTags);
+            if (entry.UpdatedAtMs == 0) entry.UpdatedAtMs = entry.CreatedAtMs;
+            if (string.IsNullOrEmpty(entry.Title)) entry.Title = "Untitled level";
+            return true;
+        }
+
+        private static void ReadStrings(Json array, List<string> result, int maximum)
+        {
+            if (array == null || array.Kind != JsonKind.Array) return;
+            foreach (var item in array.Items)
+            {
+                if (result.Count >= maximum) break;
+                var text = Clean(item.AsStringOr(string.Empty), LevelBundle.MaxMetadataItemCharacters);
+                if (!string.IsNullOrEmpty(text) && !result.Contains(text)) result.Add(text);
+            }
+        }
+
+        private static bool SupportsPartySize(Json configurations, int partySize)
+        {
+            if (configurations == null || configurations.Kind != JsonKind.Array || configurations.Count == 0)
+                return true;
+            foreach (var item in configurations.Items)
+            {
+                if (item["numberPlayers"].AsIntOr(-1) == partySize) return true;
+            }
+            return false;
+        }
+
+        private static bool IsSha256(string value)
+        {
+            if (value == null || value.Length != 64) return false;
+            for (var i = 0; i < value.Length; i++)
+            {
+                var c = value[i];
+                if (!((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f'))) return false;
+            }
+            return true;
+        }
+
+        private static bool IsSafeConfigurations(Json configurations)
+        {
+            if (configurations == null) return true;
+            if (configurations.Kind != JsonKind.Array || configurations.Count > 16) return false;
+            foreach (var configuration in configurations.Items)
+            {
+                if (configuration == null || configuration.Kind != JsonKind.Object) return false;
+                var teams = configuration["levelTeamConfigurations"];
+                if (teams == null) continue;
+                if (teams.Kind != JsonKind.Array || teams.Count > 4) return false;
+                foreach (var team in teams.Items)
+                {
+                    if (team == null || team.Kind != JsonKind.Object) return false;
+                    var objectives = team["objectives"];
+                    var players = team["playersInTeam"];
+                    if (objectives != null && (objectives.Kind != JsonKind.Array || objectives.Count > 32))
+                        return false;
+                    if (players != null && (players.Kind != JsonKind.Array || players.Count > 4))
+                        return false;
+                    if (objectives != null)
+                    {
+                        foreach (var objective in objectives.Items)
+                        {
+                            if (objective.AsStringOr(string.Empty).Length > 128) return false;
+                        }
+                    }
+                }
+            }
+            return true;
+        }
+
+        private static bool IsSafeValidations(Json validations)
+        {
+            if (validations == null) return true;
+            if (validations.Kind != JsonKind.Array || validations.Count > 128) return false;
+            foreach (var validation in validations.Items)
+            {
+                if (validation == null || validation.Kind != JsonKind.Object
+                    || validation["id"].AsStringOr(string.Empty).Length > 128
+                    || validation["description"].AsStringOr(string.Empty).Length > 512) return false;
+            }
+            return true;
+        }
+
+        private static bool IsVersion(string value)
+        {
+            int[] ignored;
+            return TryVersion(value, out ignored);
+        }
+
+        /// <summary>
+        /// Bounds JSON nesting before a recursive-descent parse. Exposed so every untrusted-JSON
+        /// entry point can share one guard rather than each remembering to add its own.
+        /// </summary>
+        public static bool HasSafeNesting(string text)
+        {
+            var depth = 0;
+            var inString = false;
+            var escaped = false;
+            for (var i = 0; i < text.Length; i++)
+            {
+                var c = text[i];
+                if (inString)
+                {
+                    if (escaped) escaped = false;
+                    else if (c == '\\') escaped = true;
+                    else if (c == '"') inString = false;
+                    continue;
+                }
+                if (c == '"') inString = true;
+                else if (c == '{' || c == '[')
+                {
+                    depth++;
+                    if (depth > 64) return false;
+                }
+                else if (c == '}' || c == ']') depth--;
+                if (depth < 0) return false;
+            }
+            return depth == 0 && !inString;
+        }
+
+        private static int CompareVersions(string left, string right)
+        {
+            int[] a, b;
+            if (!TryVersion(left, out a)) return -1;
+            if (!TryVersion(right, out b)) return 0;
+            for (var i = 0; i < 4; i++)
+            {
+                if (a[i] != b[i]) return a[i].CompareTo(b[i]);
+            }
+            return 0;
+        }
+
+        private static bool TryVersion(string value, out int[] parts)
+        {
+            parts = new int[4];
+            if (string.IsNullOrWhiteSpace(value)) return false;
+            var dash = value.IndexOf('-');
+            if (dash >= 0) value = value.Substring(0, dash);
+            var split = value.Split('.');
+            if (split.Length < 1 || split.Length > 4) return false;
+            for (var i = 0; i < split.Length; i++)
+            {
+                if (split[i].Length == 0 || !int.TryParse(split[i], out parts[i]) || parts[i] < 0)
+                    return false;
+            }
+            return true;
+        }
+
+        private static long SafeTime(long value)
+        {
+            var now = UgcStore.NowMs();
+            return value < 0 || value > now + 24L * 60 * 60 * 1000 ? now : value;
+        }
+
+        private static string Clean(string value, int maximum)
+        {
+            if (string.IsNullOrEmpty(value)) return string.Empty;
+            var output = new StringBuilder(Math.Min(value.Length, maximum));
+            for (var i = 0; i < value.Length && output.Length < maximum; i++)
+            {
+                if (value[i] >= ' ') output.Append(value[i]);
+            }
+            return output.ToString().Trim();
+        }
+    }
+}
diff --git a/src/SS2Revive_Data/GameCatalogue.cs b/src/SS2Revive_Data/GameCatalogue.cs
index c16849f..0399b3b 100644
--- a/src/SS2Revive_Data/GameCatalogue.cs
+++ b/src/SS2Revive_Data/GameCatalogue.cs
@@ -406,18 +406,18 @@ internal string String()
     /// Null-tolerant readers, so parsing a document with a missing key reads as a default instead
     /// of needing a check at every access.
     /// </summary>
-    internal static class JsonDefaults
+    public static class JsonDefaults
     {
-        internal static string AsStringOr(this Json value, string fallback) =>
+        public static string AsStringOr(this Json value, string fallback) =>
             value == null ? fallback : value.AsString(fallback);
 
-        internal static int AsIntOr(this Json value, int fallback) =>
+        public static int AsIntOr(this Json value, int fallback) =>
             value == null ? fallback : value.AsInt(fallback);
 
-        internal static long AsLongOr(this Json value, long fallback) =>
+        public static long AsLongOr(this Json value, long fallback) =>
             value == null ? fallback : value.AsLong(fallback);
 
-        internal static double AsDoubleOr(this Json value, double fallback) =>
+        public static double AsDoubleOr(this Json value, double fallback) =>
             value == null ? fallback : value.AsDouble(fallback);
 
         internal static bool AsBoolOr(this Json value, bool fallback) =>
diff --git a/src/SS2Revive_Data/LevelBundle.cs b/src/SS2Revive_Data/LevelBundle.cs
new file mode 100644
index 0000000..cd01a03
--- /dev/null
+++ b/src/SS2Revive_Data/LevelBundle.cs
@@ -0,0 +1,838 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace SS2ReviveData
+{
+    /// <summary>
+    /// One level in one file, so a level can be handed to another player without a service in the
+    /// middle.
+    ///
+    /// A bundle carries a single revision - the newest - rather than a level's whole history. The
+    /// history is a working record for the person building the level; nobody receiving one has any
+    /// use for the twenty autosaves that led to it, and shipping them would multiply the file size
+    /// by the number of afternoons its author spent on it.
+    ///
+    /// The container is hand-rolled rather than a zip, for a reason that is not taste: the game's
+    /// <c>Managed</c> folder ships no <c>System.IO.Compression.dll</c> and no
+    /// <c>System.IO.Compression.FileSystem.dll</c>, so <c>ZipArchive</c> and <c>ZipFile</c> cannot be
+    /// resolved at runtime at all. Compression would buy little in any case: the level blob is
+    /// already deflated inside its own format and images are raw game texture envelopes. Storing everything
+    /// uncompressed also means a bundle cannot be a decompression bomb, which matters when the whole
+    /// point of the file is that it arrives from a stranger.
+    ///
+    /// Layout, all integers little-endian:
+    /// <code>
+    ///   "SS2REVIVE LEVEL\n"          16 bytes
+    ///   uint16                       container version
+    ///   repeated:
+    ///     uint16                     entry name length in bytes; 0 ends the file
+    ///     bytes                      entry name, UTF-8
+    ///     int32                      payload length
+    ///     bytes                      payload
+    /// </code>
+    ///
+    /// <see cref="Unpack"/> treats every one of those numbers as hostile. Each is bounded before it
+    /// is used to size an allocation, entries are counted, and the level blob is checked for the
+    /// game's own file magic before it is ever handed to the game. That does not make a bundle safe
+    /// to load - the level format needs the separate bounded guards installed by the plugin - but
+    /// it does mean a malformed or malicious bundle is rejected by this reader rather than by an
+    /// out-of-memory somewhere inside Unity.
+    /// </summary>
+    public sealed class LevelBundle
+    {
+        /// <summary>What an exported level is called on disk.</summary>
+        public const string Extension = ".ss2level";
+
+        /// <summary>The container layout this build writes. Bumped only if the layout changes.</summary>
+        public const int CurrentFormatVersion = 2;
+
+        // Limits. Generous against anything a person would really build, tight enough that a
+        // crafted header cannot ask for an allocation that matters. For scale: a small hand-built
+        // level's blob is around 3 KB and its screenshot around 800 KB.
+        public const int MaxContentBytes = 4096000;
+        public const int MaxImageBytes = 8 * 1024 * 1024;
+        public const int MaxManifestBytes = 1024 * 1024;
+        public const int MaxBundleBytes = 24 * 1024 * 1024;
+
+        public const int MaxTitleCharacters = 128;
+        public const int MaxDescriptionCharacters = 2048;
+        public const int MaxCreators = 4;
+        public const int MaxTags = 32;
+        public const int MaxMetadataItemCharacters = 128;
+
+        private const int MaxEntries = 16;
+        private const int MaxNameBytes = 64;
+
+        private const string ManifestEntry = "asset.json";
+        private const string ContentEntry = "level.bin";
+        private const string ContentImageEntry = "level.png";
+        private const string ThumbnailEntry = "thumb.png";
+
+        private static readonly byte[] Magic =
+        {
+            (byte)'S', (byte)'S', (byte)'2', (byte)'R', (byte)'E', (byte)'V', (byte)'I', (byte)'V',
+            (byte)'E', (byte)' ', (byte)'L', (byte)'E', (byte)'V', (byte)'E', (byte)'L', (byte)'\n',
+        };
+
+        /// <summary>
+        /// The first eight bytes of every level file the game has ever written, spelling "Surgeons".
+        /// Copied from <c>LevelDataService.FILE_START_MAGIC</c>; checking it here rejects a bundle
+        /// whose payload is not a level before the game's own reader is asked to make sense of it.
+        /// </summary>
+        private static readonly byte[] LevelMagic = { 83, 117, 114, 103, 101, 111, 110, 115 };
+
+        // ------------------------------------------------------------------ state
+
+        public string Id = string.Empty;
+        public string Title = string.Empty;
+        public string Description = string.Empty;
+        public List<string> CreatorIds = new List<string>();
+        public List<string> Tags = new List<string>();
+        public long CreatedAtMs;
+        public long ExportedAtMs;
+        public int ClientVersion;
+        public int ContentVersion;
+        public string ReviveVersion = string.Empty;
+        public string ContentSha256 = string.Empty;
+        public Json Configurations;
+        public Json Validations;
+
+        public byte[] Content;
+        public byte[] ContentImage;
+        public byte[] Thumbnail;
+
+        /// <summary>The share code for this level, which is what gets posted alongside the file.</summary>
+        public string Code => LevelCode.FromLevelId(Id);
+
+        /// <summary>
+        /// What to call the exported file. The code is in the name on purpose: a file that has been
+        /// through a chat client, a download folder and a rename still says which level it is, and
+        /// the name is the thing someone reads back when they paste the code.
+        /// </summary>
+        public string SuggestedFileName()
+        {
+            var name = new StringBuilder(64);
+            var invalid = Path.GetInvalidFileNameChars();
+
+            var title = Title ?? string.Empty;
+            for (var i = 0; i < title.Length && name.Length < 48; i++)
+            {
+                var character = title[i];
+                if (Array.IndexOf(invalid, character) >= 0) continue;
+                name.Append(character);
+            }
+
+            var stem = name.ToString().Trim();
+            if (stem.Length == 0) stem = "level";
+
+            var code = Code;
+            return code.Length == 0 ? stem + Extension : stem + " [" + code + "]" + Extension;
+        }
+
+        // ------------------------------------------------------------------ export
+
+        /// <summary>
+        /// Reads a level out of the library into a bundle, newest revision only.
+        ///
+        /// <paramref name="readKey"/> is the store's own blob reader rather than a path, because a
+        /// key is the only handle the rest of the system has on a level's bytes and resolving one
+        /// is the store's job - it is the thing that refuses a key pointing outside the library.
+        /// </summary>
+        public static LevelBundle FromLevel(UgcLevelRecord level, Func<string, byte[]> readKey,
+                                            out string error)
+        {
+            error = null;
+
+            if (level == null) { error = "There is no such level."; return null; }
+            if (readKey == null) { error = "No way to read the level's data."; return null; }
+
+            var latest = level.LatestContent();
+            if (latest == null)
+            {
+                error = "'" + level.Title + "' has never been saved, so there is nothing to export.";
+                return null;
+            }
+
+            var content = readKey(latest.Key);
+            if (content == null || content.Length == 0)
+            {
+                error = "'" + level.Title + "' is missing its level data on disk.";
+                return null;
+            }
+
+            if (content.Length > MaxContentBytes)
+            {
+                error = "'" + level.Title + "' is " + (content.Length / (1024 * 1024))
+                        + " MB, past the " + (MaxContentBytes / (1024 * 1024)) + " MB export limit.";
+                return null;
+            }
+
+            var bundle = new LevelBundle
+            {
+                Id = level.Id,
+                Title = level.Title ?? string.Empty,
+                Description = level.Description ?? string.Empty,
+                CreatorIds = new List<string>(level.CreatorIds),
+                Tags = new List<string>(level.Tags),
+                CreatedAtMs = level.CreatedAtMs,
+                ExportedAtMs = UgcStore.NowMs(),
+                ClientVersion = latest.ClientVersion,
+                ContentVersion = latest.ContentVersion,
+                ContentSha256 = Sha256Hex(content),
+                Configurations = level.Configurations,
+                Validations = level.Validations,
+                Content = content,
+            };
+
+            // Both images are optional. A level with no screenshot is still a level; one that
+            // refuses to export because a thumbnail went missing is a level nobody can share.
+            bundle.ContentImage = ReadImage(readKey, latest.ImageKey);
+            bundle.Thumbnail = ReadImage(readKey, level.ThumbnailKey);
+
+            return bundle;
+        }
+
+        private static byte[] ReadImage(Func<string, byte[]> readKey, string key)
+        {
+            if (string.IsNullOrEmpty(key)) return null;
+
+            var bytes = readKey(key);
+            if (bytes == null || bytes.Length == 0 || bytes.Length > MaxImageBytes) return null;
+            return bytes;
+        }
+
+        /// <summary>Serialises this bundle into the bytes that get written to a <c>.ss2level</c>.</summary>
+        public byte[] Pack()
+        {
+            var storedClientVersion = ClientVersion > 0 ? ClientVersion
+                : Content != null && Content.Length >= 10 ? ReadLevelVersion(Content) : 0;
+            var storedContentVersion = ContentVersion > 0 ? ContentVersion : 1;
+            var manifest = Json.Object()
+                .Add("bundleVersion", CurrentFormatVersion)
+                .Add("id", Id ?? string.Empty)
+                .Add("title", Title ?? string.Empty)
+                .Add("description", Description ?? string.Empty)
+                .Add("createdAt", CreatedAtMs)
+                .Add("exportedAt", ExportedAtMs)
+                .Add("clientVersion", storedClientVersion);
+            manifest.Add("contentVersion", storedContentVersion);
+            manifest.Add("reviveVersion", ReviveVersion ?? string.Empty);
+            manifest.Add("contentSha256", string.IsNullOrEmpty(ContentSha256)
+                    ? Sha256Hex(Content)
+                    : ContentSha256);
+
+            var creators = Json.Array();
+            if (CreatorIds != null)
+            {
+                for (var i = 0; i < CreatorIds.Count; i++) creators.Add(Json.Str(CreatorIds[i]));
+            }
+            manifest.Add("creators", creators);
+
+            var tags = Json.Array();
+            if (Tags != null)
+            {
+                for (var i = 0; i < Tags.Count; i++) tags.Add(Json.Str(Tags[i]));
+            }
+            manifest.Add("tags", tags);
+
+            manifest.Add("configurations", Configurations ?? Json.Array());
+            manifest.Add("validations", Validations ?? Json.Array());
+
+            var text = new StringBuilder(2048);
+            manifest.Write(text);
+
+            using (var stream = new MemoryStream())
+            {
+                stream.Write(Magic, 0, Magic.Length);
+                WriteUInt16(stream, CurrentFormatVersion);
+
+                WriteEntry(stream, ManifestEntry, new UTF8Encoding(false).GetBytes(text.ToString()));
+                WriteEntry(stream, ContentEntry, Content);
+                WriteEntry(stream, ContentImageEntry, ContentImage);
+                WriteEntry(stream, ThumbnailEntry, Thumbnail);
+
+                WriteUInt16(stream, 0);
+                return stream.ToArray();
+            }
+        }
+
+        // ------------------------------------------------------------------ import
+
+        /// <summary>
+        /// Reads a bundle that arrived from somewhere else. Every failure is a message fit to show
+        /// a player, because every one of them is something they can act on - a truncated download,
+        /// the wrong file, a level from a newer build.
+        /// </summary>
+        public static LevelBundle Unpack(byte[] bytes, out string error)
+        {
+            error = null;
+
+            if (bytes == null || bytes.Length < Magic.Length + 2)
+            {
+                error = "The file is empty or truncated.";
+                return null;
+            }
+
+            if (bytes.Length > MaxBundleBytes)
+            {
+                error = "The file is " + (bytes.Length / (1024 * 1024)) + " MB, past the "
+                        + (MaxBundleBytes / (1024 * 1024)) + " MB limit.";
+                return null;
+            }
+
+            for (var i = 0; i < Magic.Length; i++)
+            {
+                if (bytes[i] == Magic[i]) continue;
+                error = "This is not an SS2 Revive level bundle.";
+                return null;
+            }
+
+            var offset = Magic.Length;
+            var version = ReadUInt16(bytes, ref offset);
+            if (version < 1 || version > CurrentFormatVersion)
+            {
+                error = version < 1
+                    ? "The bundle has an invalid container version."
+                    : "This bundle was written by a newer version of SS2 Revive (format "
+                      + version + "; this build reads " + CurrentFormatVersion + ").";
+                return null;
+            }
+
+            byte[] manifestBytes = null, content = null, contentImage = null, thumbnail = null;
+            var knownEntries = new HashSet<string>(StringComparer.Ordinal);
+
+            for (var entries = 0; ; entries++)
+            {
+                if (entries >= MaxEntries) { error = "The bundle has too many parts."; return null; }
+                if (offset + 2 > bytes.Length) { error = "The bundle ends mid-way through."; return null; }
+
+                var nameLength = ReadUInt16(bytes, ref offset);
+                if (nameLength == 0) break;
+
+                if (nameLength > MaxNameBytes || offset + nameLength + 4 > bytes.Length)
+                {
+                    error = "The bundle is malformed.";
+                    return null;
+                }
+
+                var name = Encoding.UTF8.GetString(bytes, offset, nameLength);
+                offset += nameLength;
+
+                var length = ReadInt32(bytes, ref offset);
+
+                // The one place a hostile file could ask for an allocation: bound it against what
+                // is left in the buffer before believing it, not after.
+                if (length < 0 || length > bytes.Length - offset)
+                {
+                    error = "The bundle is malformed or truncated.";
+                    return null;
+                }
+
+                switch (name)
+                {
+                    case ManifestEntry:
+                    case ContentEntry:
+                    case ContentImageEntry:
+                    case ThumbnailEntry:
+                        if (!knownEntries.Add(name))
+                        {
+                            error = "The bundle contains the same part more than once.";
+                            return null;
+                        }
+                        break;
+                    // Unknown parts are skipped rather than refused, so a future build can add one
+                    // without every older build rejecting the whole file.
+                }
+
+                var limit = name == ManifestEntry ? MaxManifestBytes
+                    : name == ContentEntry ? MaxContentBytes
+                    : name == ContentImageEntry || name == ThumbnailEntry ? MaxImageBytes
+                    : MaxManifestBytes;
+
+                if (length > limit)
+                {
+                    error = "The bundle contains an oversized " + name + " part.";
+                    return null;
+                }
+
+                // Unknown future parts are skipped without allocating them. Known parts are copied
+                // only after their own type-specific ceiling has been checked.
+                if (name == ManifestEntry || name == ContentEntry
+                    || name == ContentImageEntry || name == ThumbnailEntry)
+                {
+                    var payload = new byte[length];
+                    Buffer.BlockCopy(bytes, offset, payload, 0, length);
+
+                    switch (name)
+                    {
+                        case ManifestEntry: manifestBytes = payload; break;
+                        case ContentEntry: content = payload; break;
+                        case ContentImageEntry: contentImage = payload; break;
+                        case ThumbnailEntry: thumbnail = payload; break;
+                    }
+                }
+
+                offset += length;
+            }
+
+            if (offset != bytes.Length)
+            {
+                error = "The bundle has unexpected data after its final part.";
+                return null;
+            }
+
+            if (manifestBytes == null || manifestBytes.Length == 0 || manifestBytes.Length > MaxManifestBytes)
+            {
+                error = "The bundle has no readable level details.";
+                return null;
+            }
+
+            if (content == null || content.Length == 0)
+            {
+                error = "The bundle has no level data in it.";
+                return null;
+            }
+
+            if (content.Length > MaxContentBytes)
+            {
+                error = "The level data is " + (content.Length / (1024 * 1024)) + " MB, past the "
+                        + (MaxContentBytes / (1024 * 1024)) + " MB limit.";
+                return null;
+            }
+
+            if (!HasLevelMagic(content))
+            {
+                error = "The bundle's level data is not a Surgeon Simulator 2 level.";
+                return null;
+            }
+
+            var levelVersion = ReadLevelVersion(content);
+            if (levelVersion != 29)
+            {
+                error = "This shared level uses map format " + levelVersion
+                        + ". SS2 Revive accepts format 29 bundles so older unsafe readers are never "
+                        + "reached by downloaded content.";
+                return null;
+            }
+
+            if (!HasReasonableJsonDepth(manifestBytes))
+            {
+                error = "The bundle's level details are nested too deeply.";
+                return null;
+            }
+
+            Json manifest;
+            try
+            {
+                manifest = Json.TryParse(Encoding.UTF8.GetString(manifestBytes));
+            }
+            catch (Exception)
+            {
+                manifest = null;
+            }
+
+            if (manifest == null)
+            {
+                error = "The bundle's level details could not be read.";
+                return null;
+            }
+
+            var bundle = new LevelBundle
+            {
+                Id = manifest["id"].AsStringOr(string.Empty),
+                Title = manifest["title"].AsStringOr(string.Empty),
+                Description = manifest["description"].AsStringOr(string.Empty),
+                CreatedAtMs = manifest["createdAt"].AsLongOr(0),
+                ExportedAtMs = manifest["exportedAt"].AsLongOr(0),
+                ClientVersion = manifest["clientVersion"].AsIntOr(0),
+                ContentVersion = manifest["contentVersion"].AsIntOr(1),
+                ReviveVersion = manifest["reviveVersion"].AsStringOr(string.Empty),
+                ContentSha256 = manifest["contentSha256"].AsStringOr(string.Empty),
+                Configurations = manifest["configurations"],
+                Validations = manifest["validations"],
+                Content = content,
+                ContentImage = IsSafeGameImage(contentImage) ? contentImage : null,
+                Thumbnail = IsSafeGameImage(thumbnail) ? thumbnail : null,
+            };
+
+            var creators = manifest["creators"];
+            if (creators != null)
+            {
+                foreach (var item in creators.Items)
+                {
+                    if (bundle.CreatorIds.Count >= MaxCreators) break;
+                    bundle.CreatorIds.Add(CleanText(item.AsString(), MaxMetadataItemCharacters));
+                }
+            }
+
+            var tags = manifest["tags"];
+            if (tags != null)
+            {
+                foreach (var item in tags.Items)
+                {
+                    if (bundle.Tags.Count >= MaxTags) break;
+                    bundle.Tags.Add(CleanText(item.AsString(), MaxMetadataItemCharacters));
+                }
+            }
+
+            // The id becomes a folder name and the share code, so it has to be a GUID and nothing
+            // else. This is also the check that stops a crafted id from naming a path.
+            Guid parsed;
+            if (string.IsNullOrEmpty(bundle.Id) || !Guid.TryParse(bundle.Id, out parsed))
+            {
+                error = "The bundle does not carry a valid level id.";
+                return null;
+            }
+
+            bundle.Id = parsed.ToString();
+
+            bundle.Title = CleanText(bundle.Title, MaxTitleCharacters);
+            bundle.Description = CleanText(bundle.Description, MaxDescriptionCharacters);
+            if (string.IsNullOrEmpty(bundle.Title)) bundle.Title = "Untitled level";
+
+            var now = UgcStore.NowMs();
+            // DateTime.AddMilliseconds throws outside its supported range, and these values reach
+            // the terminal's display conversion. Attribution dates are useful, but never trusted.
+            if (bundle.CreatedAtMs < 0 || bundle.CreatedAtMs > now + 24L * 60 * 60 * 1000)
+                bundle.CreatedAtMs = now;
+            if (bundle.ExportedAtMs < bundle.CreatedAtMs
+                || bundle.ExportedAtMs > now + 24L * 60 * 60 * 1000)
+            {
+                bundle.ExportedAtMs = now;
+            }
+
+            if (bundle.ClientVersion != levelVersion)
+            {
+                error = "The bundle's declared map format does not match its level data.";
+                return null;
+            }
+
+            if (bundle.ContentVersion < 1)
+            {
+                error = "The bundle does not carry a valid map revision.";
+                return null;
+            }
+
+            if (!HasSafeStructuredMetadata(bundle.Configurations, bundle.Validations))
+            {
+                error = "The bundle contains oversized or invalid level configuration metadata.";
+                return null;
+            }
+
+            var actualHash = Sha256Hex(content);
+            if (version >= 2 && !IsSha256(bundle.ContentSha256))
+            {
+                error = "The bundle does not carry a valid SHA-256 checksum.";
+                return null;
+            }
+            if (!string.IsNullOrEmpty(bundle.ContentSha256)
+                && !string.Equals(bundle.ContentSha256, actualHash,
+                                  StringComparison.OrdinalIgnoreCase))
+            {
+                error = "The level data does not match the bundle's SHA-256 checksum.";
+                return null;
+            }
+            bundle.ContentSha256 = actualHash;
+
+            return bundle;
+        }
+
+        private static bool IsSha256(string value)
+        {
+            if (string.IsNullOrEmpty(value) || value.Length != 64) return false;
+            for (var i = 0; i < value.Length; i++)
+            {
+                var c = value[i];
+                if (!((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f')
+                      || (c >= 'A' && c <= 'F'))) return false;
+            }
+            return true;
+        }
+
+        private static bool HasSafeStructuredMetadata(Json configurations, Json validations)
+        {
+            if (configurations != null && configurations.Kind != JsonKind.Array) return false;
+            if (validations != null && validations.Kind != JsonKind.Array) return false;
+            if (configurations != null && configurations.Count > 8) return false;
+            if (validations != null && validations.Count > 32) return false;
+
+            if (configurations != null)
+            {
+                foreach (var configuration in configurations.Items)
+                {
+                    var players = configuration["numberPlayers"].AsIntOr(1);
+                    var teamCount = configuration["numberTeams"].AsIntOr(1);
+                    if (players < 1 || players > 4 || teamCount < 0 || teamCount > 4) return false;
+
+                    var teams = configuration["levelTeamConfigurations"];
+                    if (teams != null && (teams.Kind != JsonKind.Array || teams.Count > 4)) return false;
+                    if (teams == null) continue;
+
+                    foreach (var team in teams.Items)
+                    {
+                        var objectives = team["objectives"];
+                        var indices = team["playersInTeam"];
+                        if (objectives != null
+                            && (objectives.Kind != JsonKind.Array || objectives.Count > 32)) return false;
+                        if (indices != null
+                            && (indices.Kind != JsonKind.Array || indices.Count > 4)) return false;
+
+                        if (objectives != null)
+                        {
+                            foreach (var objective in objectives.Items)
+                            {
+                                if (objective.AsString().Length > MaxMetadataItemCharacters) return false;
+                            }
+                        }
+
+                        if (indices != null)
+                        {
+                            foreach (var index in indices.Items)
+                            {
+                                var value = index.AsIntOr(-1);
+                                if (value < 0 || value > 3) return false;
+                            }
+                        }
+                    }
+                }
+            }
+
+            if (validations != null)
+            {
+                foreach (var validation in validations.Items)
+                {
+                    if (validation["description"].AsStringOr(string.Empty).Length > 255) return false;
+                }
+            }
+
+            return true;
+        }
+
+        private static bool HasLevelMagic(byte[] content)
+        {
+            if (content.Length < LevelMagic.Length + 2) return false;
+            for (var i = 0; i < LevelMagic.Length; i++)
+            {
+                if (content[i] != LevelMagic[i]) return false;
+            }
+            return true;
+        }
+
+        private static int ReadLevelVersion(byte[] content) => content[8] | (content[9] << 8);
+
+        /// <summary>
+        /// Images use the game's bit-packed LevelSummaryImageData envelope, not PNG despite the
+        /// historical <c>.png</c> key suffix. Its stock reader allocates both the declared byte
+        /// count and a texture of the declared dimensions without bounds, so validate both here.
+        /// </summary>
+        public static bool IsSafeGameImage(byte[] image)
+        {
+            if (image == null || image.Length < 13 || image.Length > MaxImageBytes) return false;
+
+            var bit = 0;
+            uint width, height, format, dataLength;
+            // Serializer.WriteInt(0, int.MaxValue) consumes 31 bits, not 32.
+            if (!TryReadGameBits(image, ref bit, 31, out width)
+                || !TryReadGameBits(image, ref bit, 31, out height)
+                || !TryReadGameBits(image, ref bit, 4, out format)
+                || !TryReadGameBits(image, ref bit, 31, out dataLength))
+            {
+                return false;
+            }
+
+            bit = (bit + 7) & ~7;
+            if (!IsSafeRawGameImage(width, height, format, dataLength))
+            {
+                return false;
+            }
+
+            return (ulong)bit + (ulong)dataLength * 8 <= (ulong)image.Length * 8;
+        }
+
+        /// <summary>
+        /// Validates the unwrapped fields before Unity allocates a Texture2D. The game serialiser
+        /// reserves values 0..8, but only these six are real uncompressed TextureFormat values in
+        /// this build. Require at least the base texture's byte count. The game can preserve extra
+        /// platform texture bytes (its own 512x289 ARGB32 images do), so equality would reject
+        /// files written by the stock serializer; the independent 8 MB ceiling bounds that tail.
+        /// </summary>
+        public static bool IsSafeRawGameImage(uint width, uint height, uint format, uint dataLength)
+        {
+            if (width == 0 || height == 0 || width > 2048 || height > 2048
+                || (ulong)width * height > 4UL * 1024 * 1024
+                || dataLength == 0 || dataLength > MaxImageBytes)
+            {
+                return false;
+            }
+
+            uint bytesPerPixel;
+            switch (format)
+            {
+                case 1: // Alpha8
+                    bytesPerPixel = 1;
+                    break;
+                case 2: // ARGB4444
+                case 7: // RGB565
+                    bytesPerPixel = 2;
+                    break;
+                case 3: // RGB24
+                    bytesPerPixel = 3;
+                    break;
+                case 4: // RGBA32
+                case 5: // ARGB32
+                    bytesPerPixel = 4;
+                    break;
+                default:
+                    return false;
+            }
+
+            return (ulong)width * height * bytesPerPixel <= dataLength;
+        }
+
+        private static bool TryReadGameBits(byte[] bytes, ref int bitOffset, int count,
+                                            out uint value)
+        {
+            value = 0;
+            if (count < 0 || count > 32 || bitOffset < 0
+                || (long)bitOffset + count > (long)bytes.Length * 8)
+            {
+                return false;
+            }
+
+            var written = 0;
+            while (written < count)
+            {
+                var wordIndex = bitOffset / 32;
+                var withinWord = bitOffset % 32;
+                var byteIndex = wordIndex * 4;
+
+                uint word = 0;
+                for (var i = 0; i < 4; i++)
+                {
+                    if (byteIndex + i < bytes.Length)
+                        word |= (uint)bytes[byteIndex + i] << (i * 8);
+                }
+
+                var take = Math.Min(count - written, 32 - withinWord);
+                var mask = take == 32 ? uint.MaxValue : (1u << take) - 1u;
+                value |= ((word >> withinWord) & mask) << written;
+                bitOffset += take;
+                written += take;
+            }
+            return true;
+        }
+
+        private static string Sha256Hex(byte[] bytes)
+        {
+            if (bytes == null) return string.Empty;
+            using (var sha = SHA256.Create())
+            {
+                var hash = sha.ComputeHash(bytes);
+                var text = new StringBuilder(hash.Length * 2);
+                for (var i = 0; i < hash.Length; i++) text.Append(hash[i].ToString("x2"));
+                return text.ToString();
+            }
+        }
+
+        private static string CleanText(string value, int maximum)
+        {
+            if (string.IsNullOrEmpty(value)) return string.Empty;
+
+            var clean = new StringBuilder(Math.Min(value.Length, maximum));
+            for (var i = 0; i < value.Length && clean.Length < maximum; i++)
+            {
+                var character = value[i];
+                if (character == '\r' || character == '\n' || character == '\t')
+                    character = ' ';
+                else if (char.IsControl(character))
+                    continue;
+                clean.Append(character);
+            }
+            return clean.ToString().Trim();
+        }
+
+        /// <summary>
+        /// The JSON parser is intentionally small and recursive. A one-megabyte manifest made only
+        /// of '[' characters could otherwise exhaust the thread stack before the parser gets a
+        /// chance to reject it. This preflight understands strings and escapes, which is enough to
+        /// count structural nesting without trying to parse the document twice.
+        /// </summary>
+        private static bool HasReasonableJsonDepth(byte[] utf8)
+        {
+            var depth = 0;
+            var inString = false;
+            var escaped = false;
+
+            for (var i = 0; i < utf8.Length; i++)
+            {
+                var character = (char)utf8[i];
+                if (inString)
+                {
+                    if (escaped) escaped = false;
+                    else if (character == '\\') escaped = true;
+                    else if (character == '"') inString = false;
+                    continue;
+                }
+
+                if (character == '"') inString = true;
+                else if (character == '{' || character == '[')
+                {
+                    if (++depth > 32) return false;
+                }
+                else if (character == '}' || character == ']')
+                {
+                    if (--depth < 0) return false;
+                }
+            }
+
+            return depth == 0 && !inString;
+        }
+
+        // ------------------------------------------------------------------ bytes
+
+        private static void WriteEntry(Stream stream, string name, byte[] payload)
+        {
+            if (payload == null || payload.Length == 0) return;
+
+            var nameBytes = new UTF8Encoding(false).GetBytes(name);
+            WriteUInt16(stream, nameBytes.Length);
+            stream.Write(nameBytes, 0, nameBytes.Length);
+            WriteInt32(stream, payload.Length);
+            stream.Write(payload, 0, payload.Length);
+        }
+
+        private static void WriteUInt16(Stream stream, int value)
+        {
+            stream.WriteByte((byte)(value & 0xFF));
+            stream.WriteByte((byte)((value >> 8) & 0xFF));
+        }
+
+        private static void WriteInt32(Stream stream, int value)
+        {
+            stream.WriteByte((byte)(value & 0xFF));
+            stream.WriteByte((byte)((value >> 8) & 0xFF));
+            stream.WriteByte((byte)((value >> 16) & 0xFF));
+            stream.WriteByte((byte)((value >> 24) & 0xFF));
+        }
+
+        private static int ReadUInt16(byte[] bytes, ref int offset)
+        {
+            var value = bytes[offset] | (bytes[offset + 1] << 8);
+            offset += 2;
+            return value;
+        }
+
+        private static int ReadInt32(byte[] bytes, ref int offset)
+        {
+            var value = bytes[offset]
+                        | (bytes[offset + 1] << 8)
+                        | (bytes[offset + 2] << 16)
+                        | (bytes[offset + 3] << 24);
+            offset += 4;
+            return value;
+        }
+    }
+}
diff --git a/src/SS2Revive_Data/LevelCode.cs b/src/SS2Revive_Data/LevelCode.cs
new file mode 100644
index 0000000..40ade7f
--- /dev/null
+++ b/src/SS2Revive_Data/LevelCode.cs
@@ -0,0 +1,70 @@
+using System;
+
+namespace SS2ReviveData
+{
+    /// <summary>
+    /// The 22-character share code, which the game already speaks at both ends.
+    ///
+    /// This is not something the mod invented. <c>UGCService2</c> ships
+    /// <c>ConvertGUIDStringToURLFriendlyBase64</c> and its inverse, <c>ShareScreenWindow</c> shows the
+    /// result and copies it to the system clipboard, and the terminal's search box feeds anything
+    /// exactly 22 characters long through the inverse before searching - so typing a code into
+    /// Discover has always been a level-id lookup rather than a title match:
+    /// <code>
+    ///   if (_ugcService.ConvertRLFriendlyBase64ToGUIDString(searchTerm, out var serverID)) {
+    ///       list = new List&lt;string&gt; { serverID };
+    ///       searchTerm2 = "";
+    ///   }
+    /// </code>
+    /// That path runs through <c>SearchUGCDatabase</c>, which this mod answers from the local
+    /// library. So a code posted in a chat resolves on any machine that has the level - which is
+    /// what makes a file plus a code a complete sharing story with no server in it.
+    ///
+    /// The encoding is reproduced here rather than called through the game so that the data
+    /// assembly stays free of Unity, and because the original logs the code at error level on every
+    /// successful conversion. It has to stay byte-for-byte identical to the game's: the trailing
+    /// <c>==</c> of the base64 is dropped, and the two URL-unsafe characters are swapped.
+    /// </summary>
+    public static class LevelCode
+    {
+        /// <summary>16 GUID bytes are 24 base64 characters, the last two of which are padding.</summary>
+        public const int Length = 22;
+
+        /// <summary>The code for a level id, or empty if the id is not a GUID.</summary>
+        public static string FromLevelId(string levelId)
+        {
+            if (string.IsNullOrEmpty(levelId)) return string.Empty;
+
+            try
+            {
+                return Convert.ToBase64String(new Guid(levelId).ToByteArray())
+                              .Substring(0, Length)
+                              .Replace("/", "_")
+                              .Replace("+", "-");
+            }
+            catch (Exception)
+            {
+                return string.Empty;
+            }
+        }
+
+        /// <summary>The level id a code names, in the same canonical form the store keys on.</summary>
+        public static bool TryToLevelId(string code, out string levelId)
+        {
+            levelId = string.Empty;
+            if (code == null || code.Length != Length) return false;
+
+            try
+            {
+                var base64 = code.Replace("_", "/").Replace("-", "+") + "==";
+                levelId = new Guid(Convert.FromBase64String(base64)).ToString();
+                return true;
+            }
+            catch (Exception)
+            {
+                levelId = string.Empty;
+                return false;
+            }
+        }
+    }
+}
diff --git a/src/SS2Revive_Data/LocalBackend.cs b/src/SS2Revive_Data/LocalBackend.cs
index 6066058..883f945 100644
--- a/src/SS2Revive_Data/LocalBackend.cs
+++ b/src/SS2Revive_Data/LocalBackend.cs
@@ -264,8 +264,8 @@ private LocalResponse Route(string verb, string path, string body)
             if (isGet && Is(segments, "version"))
             {
                 return LocalResponse.Ok(Json.Object()
-                    .Add("minimumVersion", "1.3.1.276")
-                    .Add("currentVersion", "1.3.1.276"));
+                    .Add("minimumVersion", "1.3.7.3054")
+                    .Add("currentVersion", "1.3.7.3054"));
             }
 
             if (isGet && Is(segments, "status"))
diff --git a/src/SS2Revive_Data/UgcStore.cs b/src/SS2Revive_Data/UgcStore.cs
index 6ba7bcb..902fe61 100644
--- a/src/SS2Revive_Data/UgcStore.cs
+++ b/src/SS2Revive_Data/UgcStore.cs
@@ -89,6 +89,13 @@ public sealed class UgcLevelRecord
         public long UsedTimes;
         public int Rating;
         public int RatingCount;
+        /// <summary>
+        /// True when this level was installed from a bundle rather than authored in this library.
+        /// The game has no equivalent field, but the distinction matters to the client UI: an
+        /// installed level may be updated or removed, while an authored level must never be
+        /// overwritten just because a file arrives with the same id.
+        /// </summary>
+        public bool IsImported;
         public string ThumbnailKey = string.Empty;
         public Json Configurations;
         public Json Validations;
@@ -143,6 +150,7 @@ public Json ToStorage()
                 .Add("usedTimes", UsedTimes)
                 .Add("rating", Rating)
                 .Add("ratingCount", RatingCount)
+                .Add("imported", IsImported)
                 .Add("thumbnailKey", ThumbnailKey)
                 .Add("configurations", Configurations ?? Json.Array())
                 .Add("validations", Validations ?? Json.Array())
@@ -155,14 +163,17 @@ public static UgcLevelRecord FromStorage(Json value)
             var record = new UgcLevelRecord
             {
                 Id = value["id"].AsStringOr(string.Empty),
-                Title = value["title"].AsStringOr(string.Empty),
-                Description = value["description"].AsStringOr(string.Empty),
+                Title = UgcStore.BoundText(value["title"].AsStringOr(string.Empty),
+                                  LevelBundle.MaxTitleCharacters),
+                Description = UgcStore.BoundText(value["description"].AsStringOr(string.Empty),
+                                        LevelBundle.MaxDescriptionCharacters),
                 Status = value["status"].AsStringOr(UgcStore.StatusDraft),
                 CreatedAtMs = value["createdAt"].AsLongOr(0),
                 UpdatedAtMs = value["updatedAt"].AsLongOr(0),
                 UsedTimes = value["usedTimes"].AsLongOr(0),
                 Rating = value["rating"].AsIntOr(0),
                 RatingCount = value["ratingCount"].AsIntOr(0),
+                IsImported = value["imported"].AsBoolOr(false),
                 ThumbnailKey = value["thumbnailKey"].AsStringOr(string.Empty),
                 Configurations = value["configurations"],
                 Validations = value["validations"],
@@ -171,25 +182,43 @@ public static UgcLevelRecord FromStorage(Json value)
             var creators = value["creators"];
             if (creators != null)
             {
-                foreach (var item in creators.Items) record.CreatorIds.Add(item.AsString());
+                foreach (var item in creators.Items)
+                {
+                    if (record.CreatorIds.Count >= LevelBundle.MaxCreators) break;
+                    record.CreatorIds.Add(UgcStore.BoundText(item.AsString(),
+                        LevelBundle.MaxMetadataItemCharacters));
+                }
             }
 
             var tags = value["tags"];
             if (tags != null)
             {
-                foreach (var item in tags.Items) record.Tags.Add(item.AsString());
+                foreach (var item in tags.Items)
+                {
+                    if (record.Tags.Count >= LevelBundle.MaxTags) break;
+                    record.Tags.Add(UgcStore.BoundText(item.AsString(),
+                        LevelBundle.MaxMetadataItemCharacters));
+                }
             }
 
             var contents = value["contents"];
             if (contents != null)
             {
-                foreach (var item in contents.Items) record.Contents.Add(UgcContentRecord.FromStorage(item));
+                foreach (var item in contents.Items)
+                {
+                    if (record.Contents.Count >= 64) break;
+                    record.Contents.Add(UgcContentRecord.FromStorage(item));
+                }
             }
 
             var images = value["images"];
             if (images != null)
             {
-                foreach (var item in images.Items) record.Images.Add(UgcImageRecord.FromStorage(item));
+                foreach (var item in images.Items)
+                {
+                    if (record.Images.Count >= 64) break;
+                    record.Images.Add(UgcImageRecord.FromStorage(item));
+                }
             }
 
             return record;
@@ -210,6 +239,17 @@ public sealed class UgcQuery
         public bool AnyStatus;
     }
 
+    /// <summary>The result of installing a portable level bundle into a library.</summary>
+    public enum UgcInstallOutcome
+    {
+        Added,
+        Updated,
+        Current,
+        Older,
+        Conflict,
+        Failed,
+    }
+
     /// <summary>
     /// The level library, on disk, in place of Bossa's UGC service and its S3 buckets.
     ///
@@ -247,7 +287,7 @@ public sealed class UgcStore
         /// quietly loses its configurations. Files predating this field read as 1, which is what
         /// they are.
         /// </summary>
-        public const int CurrentFormatVersion = 1;
+        public const int CurrentFormatVersion = 2;
 
         /// <summary>Marks a key as ours. The game hands keys it does not understand straight to
         /// S3, so anything we mint has to be recognisable on sight.</summary>
@@ -352,8 +392,14 @@ private static bool Matches(UgcLevelRecord level, UgcQuery query)
             if (string.Equals(level.Status, StatusArchived, StringComparison.OrdinalIgnoreCase))
                 return false;
 
-            if (!string.IsNullOrEmpty(query.CreatorId) && !level.CreatorIds.Contains(query.CreatorId))
+            // Claimed attribution in an imported bundle is display-only. It must never make a
+            // downloaded map appear in the local player's authoring list, even if a hostile
+            // manifest names that player's id as a creator.
+            if (!string.IsNullOrEmpty(query.CreatorId)
+                && (level.IsImported || !level.CreatorIds.Contains(query.CreatorId)))
+            {
                 return false;
+            }
 
             if (!string.IsNullOrEmpty(query.Tag) && !level.Tags.Contains(query.Tag))
                 return false;
@@ -425,6 +471,204 @@ public UgcLevelRecord Create(string title, string description, List<string> crea
             return level;
         }
 
+        /// <summary>
+        /// Takes in a level that was built on somebody else's machine, keeping the id it arrived
+        /// with.
+        ///
+        /// The id is the whole reason this is not just <see cref="Create"/>. A level's id is what
+        /// its share code encodes, so a level that came in under a fresh id would answer to a
+        /// different code than the one its author posted - and the code would then mean something
+        /// different on every machine that imported it, which is the one thing it cannot do.
+        ///
+        /// It arrives published, and credited to whoever made it. Neither is cosmetic: published is
+        /// what puts it in Discover and in the free-for-all pool, and the original creator id is
+        /// what keeps it out of the importer's own Create screen, where editing and re-publishing
+        /// somebody else's level would fork the code.
+        ///
+        /// The id is required to be a GUID by the caller before it gets here, which is also what
+        /// makes it safe to use as a directory name.
+        /// </summary>
+        public UgcLevelRecord Install(UgcLevelRecord prototype, int clientVersion,
+                                      int contentVersion, long exportedAtMs, byte[] content,
+                                      byte[] contentImage, byte[] thumbnail,
+                                      out UgcInstallOutcome outcome, out string error)
+        {
+            outcome = UgcInstallOutcome.Failed;
+            error = null;
+
+            if (prototype == null || content == null || content.Length == 0)
+            {
+                error = "There is nothing to import.";
+                return null;
+            }
+
+            System.Guid parsed;
+            if (string.IsNullOrEmpty(prototype.Id) || !System.Guid.TryParse(prototype.Id, out parsed))
+            {
+                error = "The level does not carry a valid id.";
+                return null;
+            }
+
+            prototype.Id = parsed.ToString();
+
+            lock (_gate)
+            {
+                UgcLevelRecord existing;
+                if (_levels.TryGetValue(prototype.Id, out existing))
+                {
+                    if (!existing.IsImported)
+                    {
+                        outcome = UgcInstallOutcome.Conflict;
+                        error = "A level you authored already uses this id. It was left untouched.";
+                        return existing;
+                    }
+
+                    var latest = existing.LatestContent();
+                    var installedVersion = latest == null ? 0 : latest.ContentVersion;
+                    var incomingVersion = contentVersion > 0 ? contentVersion : 1;
+
+                    if (incomingVersion < installedVersion)
+                    {
+                        outcome = UgcInstallOutcome.Older;
+                        return existing;
+                    }
+
+                    if (incomingVersion == installedVersion)
+                    {
+                        var installedBytes = latest == null ? null : ReadKey(latest.Key);
+                        if (BytesEqual(installedBytes, content))
+                        {
+                            outcome = UgcInstallOutcome.Current;
+                            return existing;
+                        }
+
+                        outcome = UgcInstallOutcome.Conflict;
+                        error = "This file claims the same revision as the installed level but "
+                                + "contains different data. It was left untouched.";
+                        return existing;
+                    }
+
+                    // Stage the whole update on a deep copy. The live record and its persisted
+                    // revision history are not changed until the replacement metadata is durable.
+                    var replacement = UgcLevelRecord.FromStorage(existing.ToStorage());
+                    replacement.Title = prototype.Title ?? string.Empty;
+                    replacement.Description = prototype.Description ?? string.Empty;
+                    replacement.CreatorIds = new List<string>(prototype.CreatorIds ?? new List<string>());
+                    replacement.Tags = new List<string>(prototype.Tags ?? new List<string>());
+                    replacement.Configurations = prototype.Configurations;
+                    replacement.Validations = prototype.Validations;
+                    replacement.Status = StatusPublished;
+                    replacement.IsImported = true;
+
+                    var updated = AddContentLocked(replacement, clientVersion, content, contentImage,
+                                                   false, incomingVersion, exportedAtMs, false);
+                    if (updated == null)
+                    {
+                        error = "The updated level data could not be written to disk.";
+                        return null;
+                    }
+
+                    UgcImageRecord newThumbnail = null;
+                    if (thumbnail != null)
+                        newThumbnail = AddImageLocked(replacement, thumbnail,
+                                                      FirstOr(replacement.CreatorIds), true);
+
+                    // Remove old records from the staged metadata first, but leave their blobs in
+                    // place until that metadata has been committed. A crash can leak an unreferenced
+                    // blob; it must never leave durable metadata pointing at a blob already deleted.
+                    var pruned = PruneContentsLocked(replacement, false);
+
+                    if (!SaveLocked(replacement))
+                    {
+                        DeleteBlob(updated.Key);
+                        DeleteBlob(updated.ImageKey);
+                        if (newThumbnail != null) DeleteBlob(newThumbnail.Key);
+                        outcome = UgcInstallOutcome.Failed;
+                        error = "The updated level metadata could not be saved.";
+                        return null;
+                    }
+
+                    _levels[replacement.Id] = replacement;
+                    for (var i = 0; i < pruned.Count; i++)
+                    {
+                        DeleteBlob(pruned[i].Key);
+                        DeleteBlob(pruned[i].ImageKey);
+                    }
+                    outcome = UgcInstallOutcome.Updated;
+                    return replacement;
+                }
+
+                prototype.Status = StatusPublished;
+                prototype.IsImported = true;
+                if (prototype.CreatedAtMs <= 0) prototype.CreatedAtMs = NowMs();
+                prototype.UpdatedAtMs = NowMs();
+
+                // Whatever the sending machine recorded about how often it was played, and how its
+                // author rated their own level, is theirs and not a fact about this library.
+                prototype.UsedTimes = 0;
+                prototype.Rating = 0;
+                prototype.RatingCount = 0;
+                prototype.ThumbnailKey = string.Empty;
+                prototype.Contents = new List<UgcContentRecord>();
+                prototype.Images = new List<UgcImageRecord>();
+
+                try
+                {
+                    Directory.CreateDirectory(LevelDirectory(prototype.Id));
+                }
+                catch (Exception ex)
+                {
+                    error = "Could not create a folder for it: " + ex.Message;
+                    return null;
+                }
+
+                // Registered before the blobs are written, because WriteBlob resolves keys through
+                // the store root and the record has to be reachable for a later read either way.
+                _levels[prototype.Id] = prototype;
+
+                var incoming = contentVersion > 0 ? contentVersion : 1;
+                if (AddContentLocked(prototype, clientVersion, content, contentImage, false,
+                                     incoming) == null)
+                {
+                    _levels.Remove(prototype.Id);
+                    error = "Its level data could not be written to disk.";
+                    return null;
+                }
+
+                if (thumbnail != null)
+                    AddImageLocked(prototype, thumbnail, FirstOr(prototype.CreatorIds), true);
+
+                if (!SaveLocked(prototype))
+                {
+                    _levels.Remove(prototype.Id);
+                    CleanupFailedInstall(prototype.Id);
+                    outcome = UgcInstallOutcome.Failed;
+                    error = "The level metadata could not be saved.";
+                    return null;
+                }
+                outcome = UgcInstallOutcome.Added;
+                return prototype;
+            }
+        }
+
+        /// <summary>
+        /// Compatibility wrapper for callers that predate version-aware bundle installation.
+        /// New code should use <see cref="Install"/> so re-importing can update in place.
+        /// </summary>
+        public UgcLevelRecord Adopt(UgcLevelRecord prototype, int clientVersion, byte[] content,
+                                    byte[] contentImage, byte[] thumbnail, out string error)
+        {
+            UgcInstallOutcome outcome;
+            var level = Install(prototype, clientVersion, 1, 0, content, contentImage, thumbnail,
+                                out outcome, out error);
+            if (outcome == UgcInstallOutcome.Current)
+            {
+                error = "already-here";
+                return null;
+            }
+            return outcome == UgcInstallOutcome.Added ? level : null;
+        }
+
         public UgcContentRecord AddContent(UgcLevelRecord level, int clientVersion,
                                            byte[] content, byte[] image, bool isAutoSave)
         {
@@ -486,18 +730,38 @@ public bool Delete(string assetId)
             if (string.IsNullOrEmpty(assetId)) return false;
             lock (_gate)
             {
-                if (!_levels.Remove(assetId)) return false;
+                if (!_levels.ContainsKey(assetId)) return false;
 
                 try
                 {
                     var directory = LevelDirectory(assetId);
-                    if (Directory.Exists(directory)) Directory.Delete(directory, true);
+                    if (Directory.Exists(directory))
+                    {
+                        // Renaming inside the same parent is the durable delete. If cleanup is
+                        // interrupted or a file is locked afterwards, Load ignores the tombstone
+                        // and the map does not reappear on the next launch.
+                        var tombstone = Path.Combine(_root, ".deleted-" + assetId + "-"
+                                                    + System.Guid.NewGuid().ToString("N"));
+                        Directory.Move(directory, tombstone);
+                        _levels.Remove(assetId);
+
+                        try { Directory.Delete(tombstone, true); }
+                        catch (Exception cleanup)
+                        {
+                            _warn("Level " + assetId + " was removed, but its tombstone could not "
+                                  + "be cleaned up yet: " + cleanup.Message);
+                        }
+                        return true;
+                    }
+
+                    _levels.Remove(assetId);
+                    return true;
                 }
                 catch (Exception ex)
                 {
                     _warn("Could not delete level folder for " + assetId + ": " + ex.Message);
+                    return false;
                 }
-                return true;
             }
         }
 
@@ -559,16 +823,18 @@ public byte[] ReadKey(string key)
         // -------------------------------------------------------------- internals
 
         private UgcContentRecord AddContentLocked(UgcLevelRecord level, int clientVersion,
-                                                  byte[] content, byte[] image, bool isAutoSave)
+                                                   byte[] content, byte[] image, bool isAutoSave,
+                                                   int contentVersion = 0, long createdAtMs = 0,
+                                                   bool prune = true)
         {
             var id = System.Guid.NewGuid().ToString();
             var record = new UgcContentRecord
             {
                 Id = id,
                 Key = KeyPrefix + level.Id + "/content/" + id + ".bin",
-                CreatedAtMs = NowMs(),
+                CreatedAtMs = createdAtMs > 0 ? createdAtMs : NowMs(),
                 ClientVersion = clientVersion,
-                ContentVersion = level.NextContentVersion(),
+                ContentVersion = contentVersion > 0 ? contentVersion : level.NextContentVersion(),
                 IsAutoSave = isAutoSave,
             };
 
@@ -585,11 +851,28 @@ private UgcContentRecord AddContentLocked(UgcLevelRecord level, int clientVersio
             }
 
             level.Contents.Add(record);
-            PruneContentsLocked(level);
+            if (prune) PruneContentsLocked(level);
             Touch(level);
             return record;
         }
 
+        internal static string BoundText(string value, int maximum)
+        {
+            if (string.IsNullOrEmpty(value)) return string.Empty;
+            return value.Length <= maximum ? value : value.Substring(0, maximum);
+        }
+
+        private static bool BytesEqual(byte[] left, byte[] right)
+        {
+            if (left == null || right == null) return left == right;
+            if (left.Length != right.Length) return false;
+            for (var i = 0; i < left.Length; i++)
+            {
+                if (left[i] != right[i]) return false;
+            }
+            return true;
+        }
+
         private UgcImageRecord AddImageLocked(UgcLevelRecord level, byte[] image, string creatorId, bool isThumbnail)
         {
             var id = System.Guid.NewGuid().ToString();
@@ -621,9 +904,11 @@ private UgcImageRecord AddImageLocked(UgcLevelRecord level, byte[] image, string
         /// half hour of autosaves" means going back to the last time the player pressed save, and a
         /// prune that took that away would be the one deletion nobody could recover from.
         /// </summary>
-        private void PruneContentsLocked(UgcLevelRecord level)
+        private List<UgcContentRecord> PruneContentsLocked(UgcLevelRecord level,
+                                                            bool deleteBlobs = true)
         {
-            if (level.Contents.Count <= MaxContentsPerLevel) return;
+            var removed = new List<UgcContentRecord>();
+            if (level.Contents.Count <= MaxContentsPerLevel) return removed;
 
             var newest = level.LatestContent();
 
@@ -646,9 +931,28 @@ private void PruneContentsLocked(UgcLevelRecord level)
                 var candidate = ordered[i];
                 if (candidate == newest || candidate == newestManual) continue;
 
-                DeleteBlob(candidate.Key);
-                DeleteBlob(candidate.ImageKey);
                 level.Contents.Remove(candidate);
+                removed.Add(candidate);
+                if (deleteBlobs)
+                {
+                    DeleteBlob(candidate.Key);
+                    DeleteBlob(candidate.ImageKey);
+                }
+            }
+
+            return removed;
+        }
+
+        private void CleanupFailedInstall(string levelId)
+        {
+            try
+            {
+                var directory = LevelDirectory(levelId);
+                if (Directory.Exists(directory)) Directory.Delete(directory, true);
+            }
+            catch (Exception ex)
+            {
+                _warn("Could not clean up the failed install for " + levelId + ": " + ex.Message);
             }
         }
 
@@ -657,7 +961,25 @@ private void PruneContentsLocked(UgcLevelRecord level)
         private static string FirstOr(List<string> values) =>
             values != null && values.Count > 0 ? values[0] : string.Empty;
 
-        private string LevelDirectory(string assetId) => Path.Combine(_root, assetId);
+        private string LevelDirectory(string assetId)
+        {
+            System.Guid parsed;
+            if (string.IsNullOrEmpty(assetId) || !System.Guid.TryParse(assetId, out parsed)
+                || !string.Equals(parsed.ToString(), assetId, StringComparison.OrdinalIgnoreCase))
+            {
+                throw new ArgumentException("A level id must be a canonical GUID.", "assetId");
+            }
+
+            var root = Path.GetFullPath(_root);
+            if (!root.EndsWith(Path.DirectorySeparatorChar.ToString(), StringComparison.Ordinal))
+                root += Path.DirectorySeparatorChar;
+
+            var candidate = Path.GetFullPath(Path.Combine(root, parsed.ToString()));
+            if (!candidate.StartsWith(root, StringComparison.OrdinalIgnoreCase))
+                throw new InvalidOperationException("The level folder escapes the library root.");
+
+            return candidate;
+        }
 
         private bool WriteBlob(string key, byte[] data)
         {
@@ -695,7 +1017,7 @@ private void DeleteBlob(string key)
             }
         }
 
-        private void SaveLocked(UgcLevelRecord level)
+        private bool SaveLocked(UgcLevelRecord level)
         {
             var file = Path.Combine(LevelDirectory(level.Id), "asset.json");
             try
@@ -704,10 +1026,12 @@ private void SaveLocked(UgcLevelRecord level)
                 level.ToStorage().Write(builder);
 
                 AtomicFile.WriteAllText(file, builder.ToString(), new UTF8Encoding(false));
+                return true;
             }
             catch (Exception ex)
             {
                 _warn("Could not save level " + level.Id + ": " + ex.Message);
+                return false;
             }
         }
 
@@ -731,7 +1055,20 @@ private void Load()
 
                 try
                 {
-                    var parsed = Json.TryParse(File.ReadAllText(file, Encoding.UTF8));
+                    if (new FileInfo(file).Length > 2 * 1024 * 1024)
+                    {
+                        _warn("Skipping oversized level metadata at " + file);
+                        continue;
+                    }
+
+                    var jsonText = File.ReadAllText(file, Encoding.UTF8);
+                    if (!HasReasonableJsonDepth(jsonText))
+                    {
+                        _warn("Skipping deeply nested level metadata at " + file);
+                        continue;
+                    }
+
+                    var parsed = Json.TryParse(jsonText);
                     if (parsed == null)
                     {
                         _warn("Skipping unreadable level metadata at " + file);
@@ -750,12 +1087,32 @@ private void Load()
                     }
 
                     var level = UgcLevelRecord.FromStorage(parsed);
+                    var folderId = Path.GetFileName(directories[i]);
                     if (string.IsNullOrEmpty(level.Id))
                     {
                         // Recoverable: the folder is named after the asset, so the id is not lost.
-                        level.Id = Path.GetFileName(directories[i]);
+                        level.Id = folderId;
+                    }
+
+                    System.Guid parsedId, parsedFolder;
+                    if (!System.Guid.TryParse(level.Id, out parsedId)
+                        || !System.Guid.TryParse(folderId, out parsedFolder)
+                        || parsedId != parsedFolder)
+                    {
+                        _warn("Skipping the level at " + directories[i]
+                              + ": its id is not the canonical GUID naming its folder.");
+                        continue;
                     }
 
+                    level.Id = parsedId.ToString();
+                    var now = NowMs();
+                    if (level.CreatedAtMs < 0 || level.CreatedAtMs > now + 24L * 60 * 60 * 1000)
+                        level.CreatedAtMs = now;
+                    if (level.UpdatedAtMs < level.CreatedAtMs
+                        || level.UpdatedAtMs > now + 24L * 60 * 60 * 1000)
+                    {
+                        level.UpdatedAtMs = now;
+                    }
                     _levels[level.Id] = level;
                 }
                 catch (Exception ex)
@@ -765,6 +1122,34 @@ private void Load()
             }
         }
 
+        private static bool HasReasonableJsonDepth(string text)
+        {
+            var depth = 0;
+            var quoted = false;
+            var escaped = false;
+            for (var i = 0; i < text.Length; i++)
+            {
+                var c = text[i];
+                if (quoted)
+                {
+                    if (escaped) escaped = false;
+                    else if (c == '\\') escaped = true;
+                    else if (c == '"') quoted = false;
+                    continue;
+                }
+                if (c == '"') quoted = true;
+                else if (c == '{' || c == '[')
+                {
+                    if (++depth > 32) return false;
+                }
+                else if (c == '}' || c == ']')
+                {
+                    if (--depth < 0) return false;
+                }
+            }
+            return depth == 0 && !quoted;
+        }
+
         /// <summary>Formats a count for the log without pulling in a culture-sensitive path.</summary>
         public string Describe() =>
             _levels.Count.ToString(CultureInfo.InvariantCulture) + " level(s) in " + _root;
diff --git a/tests/DataTests/Program.cs b/tests/DataTests/Program.cs
index a3dca74..d108cbf 100644
--- a/tests/DataTests/Program.cs
+++ b/tests/DataTests/Program.cs
@@ -36,6 +36,8 @@ private static int Main(string[] args)
                 RunChallengeRolloverTests(scratch);
                 RunDurabilityTests(scratch);
                 RunUgcStoreTests(scratch);
+                RunLevelSharingTests(scratch);
+                RunCommunityCatalogTests();
             }
             catch (Exception ex)
             {
@@ -939,6 +941,389 @@ private static void RunUgcStoreTests(string scratch)
             Check("deleting it twice is not an error", !reopened.Delete(level.Id));
         }
 
+        // ------------------------------------------------------------ level sharing
+
+        private static void RunLevelSharingTests(string scratch)
+        {
+            Section("share codes");
+
+            // Fixed vector rather than a round trip alone. This encoding has to stay identical to
+            // UGCService2's, because the game's own search box decodes what we encode - and this
+            // particular id produces a '/' in its base64, which is the character that has to become
+            // an underscore.
+            const string knownId = "1a658233-92c5-4b63-87fc-4740c855730b";
+            const string knownCode = "M4JlGsWSY0uH_EdAyFVzCw";
+
+            Check("a level id encodes to the code the game would show",
+                LevelCode.FromLevelId(knownId) == knownCode);
+
+            string decoded;
+            Check("and that code decodes back to the id",
+                LevelCode.TryToLevelId(knownCode, out decoded) && decoded == knownId);
+
+            Check("codes are always 22 characters", LevelCode.FromLevelId(knownId).Length == LevelCode.Length);
+            Check("a code of the wrong length is refused", !LevelCode.TryToLevelId("tooshort", out decoded));
+            Check("22 characters of nonsense is refused",
+                !LevelCode.TryToLevelId("!!!!!!!!!!!!!!!!!!!!!!", out decoded));
+            Check("an id that is not a guid has no code", LevelCode.FromLevelId("not-a-guid") == string.Empty);
+
+            Section("level bundles");
+
+            var root = Path.Combine(scratch, "sharing");
+            var store = new UgcStore(root);
+
+            // Real levels start with the game's file magic, and the reader refuses anything that
+            // does not - so a bundle test that skipped it would be testing the wrong thing.
+            var content = LevelBytes(29, 4096);
+            var image = GameImageBytes(64);
+            var thumbnail = GameImageBytes(128);
+
+            var level = store.Create("Kidney Trouble", "mind the ribs",
+                new List<string> { PlayerA }, new List<string> { "TEAM_COOP" },
+                29, content, image);
+            store.AddImage(level, thumbnail, PlayerA, true);
+
+            string error;
+            var bundle = LevelBundle.FromLevel(level, store.ReadKey, out error);
+            Check("a level packs into a bundle", bundle != null && error == null);
+
+            Check("the bundle's file name carries the code",
+                bundle.SuggestedFileName() == "Kidney Trouble [" + bundle.Code + "]" + LevelBundle.Extension);
+
+            var packed = bundle.Pack();
+            var read = LevelBundle.Unpack(packed, out error);
+
+            Check("a bundle round trips", read != null && error == null);
+            Check("the id survives, which is what keeps the code stable", read.Id == level.Id);
+            Check("the title survives", read.Title == "Kidney Trouble");
+            Check("the description survives", read.Description == "mind the ribs");
+            Check("the creator survives", read.CreatorIds.Contains(PlayerA));
+            Check("tags survive", read.Tags.Contains("TEAM_COOP"));
+            Check("the client version survives", read.ClientVersion == 29);
+            Check("the level data survives byte for byte", BytesEqual(read.Content, content));
+            Check("the screenshot survives", BytesEqual(read.ContentImage, image));
+            Check("the thumbnail survives", BytesEqual(read.Thumbnail, thumbnail));
+            Check("the code is the same on both sides", read.Code == bundle.Code);
+
+            // Everything below is a file that arrived from somebody else.
+            Check("an empty file is refused", LevelBundle.Unpack(new byte[0], out error) == null);
+            Check("a file that is not a bundle is refused",
+                LevelBundle.Unpack(new byte[64], out error) == null);
+
+            var truncated = new byte[packed.Length / 2];
+            Buffer.BlockCopy(packed, 0, truncated, 0, truncated.Length);
+            Check("a half-downloaded bundle is refused", LevelBundle.Unpack(truncated, out error) == null);
+
+            var tampered = (byte[])packed.Clone();
+            var payloadOffset = FindBytes(tampered, content);
+            if (payloadOffset >= 0) tampered[payloadOffset + 32] ^= 0x5A;
+            Check("a bundle whose level bytes do not match its checksum is refused",
+                payloadOffset >= 0 && LevelBundle.Unpack(tampered, out error) == null);
+
+            // The one number in the format that sizes an allocation. A reader that believed it
+            // would try for two gigabytes on a file of a few kilobytes.
+            var lying = OverstatedEntryLength(packed);
+            Check("an entry claiming to be larger than the file is refused",
+                LevelBundle.Unpack(lying, out error) == null);
+
+            var notALevel = new LevelBundle
+            {
+                Id = level.Id,
+                Title = "Nope",
+                Content = new byte[] { 1, 2, 3, 4, 5, 6, 7, 8, 9 },
+            };
+            Check("a bundle whose payload is not a level is refused",
+                LevelBundle.Unpack(notALevel.Pack(), out error) == null);
+
+            var badImages = new LevelBundle
+            {
+                Id = level.Id,
+                Title = "Odd pictures",
+                Content = content,
+                ContentImage = new byte[] { 1, 2, 3, 4, 5, 6, 7, 8 },
+                Thumbnail = new byte[] { 1, 2, 3, 4, 5, 6, 7, 8 },
+            };
+            var cleaned = LevelBundle.Unpack(badImages.Pack(), out error);
+            Check("a bundle with invalid image envelopes still imports", cleaned != null);
+            Check("but the images are dropped rather than passed on",
+                cleaned.ContentImage == null && cleaned.Thumbnail == null);
+            Check("undefined texture formats are refused",
+                !LevelBundle.IsSafeRawGameImage(16, 16, 0, 256)
+                && !LevelBundle.IsSafeRawGameImage(16, 16, 6, 1024)
+                && !LevelBundle.IsSafeRawGameImage(16, 16, 8, 1024));
+            Check("raw image data must contain its declared texture",
+                LevelBundle.IsSafeRawGameImage(16, 16, 4, 1024)
+                && !LevelBundle.IsSafeRawGameImage(2048, 2048, 4, 16));
+
+            Section("importing");
+
+            var receiving = new UgcStore(Path.Combine(scratch, "receiving"));
+
+            var adopted = receiving.Adopt(Prototype(read), read.ClientVersion, read.Content,
+                                          read.ContentImage, read.Thumbnail, out error);
+
+            Check("a bundle imports into an empty library", adopted != null && error == null);
+            Check("it keeps the id it arrived with", adopted.Id == level.Id);
+            Check("so the author's code finds it here too",
+                LevelCode.TryToLevelId(bundle.Code, out decoded) && receiving.Get(decoded) != null);
+            Check("it arrives published, so it shows in Discover",
+                adopted.Status == UgcStore.StatusPublished);
+            Check("it stays credited to whoever built it", adopted.CreatorIds.Contains(PlayerA));
+            Check("its level data is readable through the store",
+                BytesEqual(receiving.ReadKey(adopted.LatestContent().Key), content));
+            Check("it has a thumbnail to show", !string.IsNullOrEmpty(adopted.ThumbnailKey));
+
+            int pages;
+            var found = receiving.Search(new UgcQuery
+            {
+                Status = UgcStore.StatusPublished,
+                Ids = new List<string> { decoded },
+            }, out pages);
+            Check("a code search finds exactly the imported level",
+                found.Count == 1 && found[0].Id == level.Id);
+
+            var mine = receiving.Search(new UgcQuery
+            {
+                Status = UgcStore.StatusPublished,
+                CreatorId = PlayerB,
+            }, out pages);
+            Check("and it is not listed as the importer's own level", mine.Count == 0);
+
+            Check("importing the same level twice says so rather than duplicating it",
+                receiving.Adopt(Prototype(read), 29, content, null, null, out error) == null
+                && error == "already-here");
+
+            var updatedContent = LevelBytes(29, 6144);
+            UgcInstallOutcome outcome;
+            var updated = receiving.Install(Prototype(read), 29, 2, UgcStore.NowMs(),
+                updatedContent, null, null, out outcome, out error);
+            Check("a newer shared revision updates the installed map in place",
+                updated != null && outcome == UgcInstallOutcome.Updated && updated.Id == level.Id);
+            Check("the newer revision replaces what play will load",
+                updated.LatestContent().ContentVersion == 2
+                && BytesEqual(receiving.ReadKey(updated.LatestContent().Key), updatedContent));
+
+            receiving.Install(Prototype(read), 29, 1, UgcStore.NowMs(), content, null, null,
+                              out outcome, out error);
+            Check("an older shared revision is ignored", outcome == UgcInstallOutcome.Older
+                && receiving.Get(level.Id).LatestContent().ContentVersion == 2);
+
+            receiving.Install(Prototype(read), 29, 2, UgcStore.NowMs(), updatedContent, null, null,
+                              out outcome, out error);
+            Check("reinstalling identical current bytes is idempotent",
+                outcome == UgcInstallOutcome.Current);
+
+            var conflictingContent = LevelBytes(29, 7168);
+            receiving.Install(Prototype(read), 29, 2, UgcStore.NowMs(), conflictingContent,
+                              null, null, out outcome, out error);
+            Check("the same revision with different bytes is refused",
+                outcome == UgcInstallOutcome.Conflict && !string.IsNullOrEmpty(error));
+
+            var forged = Prototype(read);
+            forged.Id = "../../../etc/passwd";
+            Check("an id that is not a guid is refused, because it would be a folder name",
+                receiving.Adopt(forged, 29, content, null, null, out error) == null
+                && error != "already-here");
+
+            var reopened = new UgcStore(Path.Combine(scratch, "receiving"));
+            var survived = reopened.Get(level.Id);
+            Check("imported levels survive a restart", survived != null);
+            Check("with their creator intact", survived != null && survived.CreatorIds.Contains(PlayerA));
+
+            Section("level store containment");
+
+            var containmentRoot = Path.Combine(scratch, "containment");
+            var levelsRoot = Path.Combine(containmentRoot, "levels");
+            var folderId = Guid.NewGuid().ToString();
+            var maliciousFolder = Path.Combine(levelsRoot, folderId);
+            var sentinel = Path.Combine(scratch, "sentinel");
+            Directory.CreateDirectory(maliciousFolder);
+            Directory.CreateDirectory(sentinel);
+            File.WriteAllText(Path.Combine(sentinel, "keep.txt"), "keep");
+            File.WriteAllText(Path.Combine(maliciousFolder, "asset.json"),
+                "{\"version\":1,\"id\":\"../../sentinel\",\"title\":\"bad\"}");
+
+            var warnings = new List<string>();
+            var contained = new UgcStore(containmentRoot, warnings.Add);
+            Check("metadata whose id disagrees with its GUID folder is not loaded",
+                contained.Count == 0 && warnings.Count > 0);
+            Check("and cannot turn map deletion into recursive path traversal",
+                File.Exists(Path.Combine(sentinel, "keep.txt")));
+        }
+
+        private static UgcLevelRecord Prototype(LevelBundle bundle) => new UgcLevelRecord
+        {
+            Id = bundle.Id,
+            Title = bundle.Title,
+            Description = bundle.Description,
+            CreatorIds = new List<string>(bundle.CreatorIds),
+            Tags = new List<string>(bundle.Tags),
+            CreatedAtMs = bundle.CreatedAtMs,
+            Configurations = bundle.Configurations,
+            Validations = bundle.Validations,
+        };
+
+        // ------------------------------------------------------ community catalogue
+
+        private static void RunCommunityCatalogTests()
+        {
+            Section("community catalogue");
+            const string id = "1a658233-92c5-4b63-87fc-4740c855730b";
+            var sha = new string('a', 64);
+            var json = "{\"schemaVersion\":1,\"generatedAtUtc\":\"2026-08-08T00:00:00Z\",\"maps\":[{"
+                + "\"id\":\"" + id + "\",\"code\":\"M4JlGsWSY0uH_EdAyFVzCw\","
+                + "\"revision\":3,\"title\":\"Kidney Trouble\",\"description\":\"Safe & curated\","
+                + "\"creatorIds\":[\"" + PlayerA + "\"],\"tags\":[\"TEAM_COOP\"],"
+                + "\"createdAtMs\":100,\"updatedAtMs\":200,\"clientVersion\":29,"
+                + "\"mapFormatVersion\":29,\"minimumReviveVersion\":\"1.1.0\","
+                + "\"sizeBytes\":4096,\"sha256\":\"" + sha + "\","
+                + "\"bundleKey\":\"maps/kidney-r3.ss2level\","
+                + "\"thumbnailSizeBytes\":1024,\"thumbnailSha256\":\"" + sha + "\","
+                + "\"thumbnailKey\":\"thumbs/kidney-r3.bin\","
+                + "\"configurations\":[{\"numberPlayers\":2}],\"validations\":[]}]}";
+
+            CommunityCatalog catalog;
+            string error;
+            Check("a valid API catalogue parses",
+                CommunityCatalog.TryParse(System.Text.Encoding.UTF8.GetBytes(json), out catalog, out error)
+                && catalog.Entries.Count == 1);
+            var extremeDates = json.Replace("\"createdAtMs\":100,\"updatedAtMs\":200",
+                "\"createdAtMs\":9223372036854775807,\"updatedAtMs\":9223372036854775807");
+            CommunityCatalog dated;
+            Check("hostile timestamps are clamped before game DateTime conversion",
+                CommunityCatalog.TryParse(System.Text.Encoding.UTF8.GetBytes(extremeDates),
+                                          out dated, out error)
+                && dated.Entries.Count == 1
+                && dated.Entries[0].CreatedAtMs <= UgcStore.NowMs() + 24L * 60 * 60 * 1000
+                && dated.Entries[0].UpdatedAtMs <= UgcStore.NowMs() + 24L * 60 * 60 * 1000);
+            Check("relative nested object keys are accepted",
+                CommunityCatalog.IsSafeObjectKey("maps/2026/map.ss2level"));
+            Check("absolute and traversal object keys are refused",
+                !CommunityCatalog.IsSafeObjectKey("https://attacker.invalid/map")
+                && !CommunityCatalog.IsSafeObjectKey("../map.ss2level")
+                && !CommunityCatalog.IsSafeObjectKey("maps/%2e%2e/secret"));
+            Check("a catalogue map is filtered by party size",
+                catalog.Search(new UgcQuery { Status = UgcStore.StatusPublished, PartySize = 2 }).Count == 1
+                && catalog.Search(new UgcQuery { Status = UgcStore.StatusPublished, PartySize = 4 }).Count == 0);
+            Check("remote attribution never grants My Levels ownership",
+                catalog.Search(new UgcQuery { AnyStatus = true, CreatorId = PlayerA }).Count == 0);
+            Check("the current map and mod versions are compatible",
+                CommunityCatalog.CompatibilityError(catalog.Entries[0], "1.1.0") == null);
+            catalog.Entries[0].MinimumReviveVersion = "2.0.0";
+            Check("a newer minimum mod version is rejected with a reason",
+                CommunityCatalog.CompatibilityError(catalog.Entries[0], "1.1.0").Contains("Requires"));
+            catalog.Entries[0].MinimumReviveVersion = "1.0.0";
+            catalog.Entries[0].MapFormatVersion = 30;
+            Check("a future map format is rejected with a reason",
+                CommunityCatalog.CompatibilityError(catalog.Entries[0], "1.1.0").Contains("Map format"));
+
+            var extremeTimestamp = json.Replace("1700000000000", "9223372036854775807");
+            Check("catalogue timestamps are clamped before terminal date conversion",
+                CommunityCatalog.TryParse(System.Text.Encoding.UTF8.GetBytes(extremeTimestamp),
+                                          out catalog, out error)
+                && catalog.Entries[0].CreatedAtMs <= UgcStore.NowMs() + 24L * 60 * 60 * 1000
+                && catalog.Entries[0].UpdatedAtMs <= UgcStore.NowMs() + 24L * 60 * 60 * 1000);
+
+            var oversized = new byte[CommunityCatalog.MaxDocumentBytes + 1];
+            Check("an oversized catalogue is refused before JSON parsing",
+                !CommunityCatalog.TryParse(oversized, out catalog, out error));
+            var deep = new string('[', 65) + new string(']', 65);
+            Check("deeply nested JSON is refused before recursive parsing",
+                !CommunityCatalog.TryParse(System.Text.Encoding.UTF8.GetBytes(deep),
+                                           out catalog, out error)
+                && error.Contains("deeply"));
+        }
+
+        /// <summary>Bytes shaped like a level file: the game's magic, a format version, then filler.</summary>
+        private static byte[] LevelBytes(int formatVersion, int length)
+        {
+            var bytes = new byte[length];
+            var magic = new byte[] { 83, 117, 114, 103, 101, 111, 110, 115 };
+            Buffer.BlockCopy(magic, 0, bytes, 0, magic.Length);
+            bytes[8] = (byte)(formatVersion & 0xFF);
+            bytes[9] = (byte)((formatVersion >> 8) & 0xFF);
+            for (var i = 10; i < length; i++) bytes[i] = (byte)(i * 31);
+            return bytes;
+        }
+
+        private static byte[] GameImageBytes(int dataLength)
+        {
+            var bit = 0;
+            var totalBits = 104 + dataLength * 8;
+            var words = new uint[(totalBits + 31) / 32];
+
+            WriteImageBits(words, ref bit, (uint)Math.Max(1, dataLength / 4), 31);
+            WriteImageBits(words, ref bit, 1, 31);
+            WriteImageBits(words, ref bit, 4, 4); // TextureFormat.RGBA32: four bytes per pixel.
+            WriteImageBits(words, ref bit, (uint)dataLength, 31);
+            bit = (bit + 7) & ~7;
+            for (var i = 0; i < dataLength; i++)
+                WriteImageBits(words, ref bit, (uint)(i * 31), 8);
+
+            var bytes = new byte[(bit + 7) / 8];
+            for (var i = 0; i < words.Length; i++)
+            {
+                var offset = i * 4;
+                if (offset < bytes.Length) bytes[offset] = (byte)words[i];
+                if (offset + 1 < bytes.Length) bytes[offset + 1] = (byte)(words[i] >> 8);
+                if (offset + 2 < bytes.Length) bytes[offset + 2] = (byte)(words[i] >> 16);
+                if (offset + 3 < bytes.Length) bytes[offset + 3] = (byte)(words[i] >> 24);
+            }
+            return bytes;
+        }
+
+        private static void WriteImageBits(uint[] words, ref int bitOffset, uint value, int count)
+        {
+            var written = 0;
+            while (written < count)
+            {
+                var word = bitOffset / 32;
+                var within = bitOffset % 32;
+                var take = Math.Min(count - written, 32 - within);
+                var mask = take == 32 ? uint.MaxValue : (1u << take) - 1u;
+                words[word] |= ((value >> written) & mask) << within;
+                written += take;
+                bitOffset += take;
+            }
+        }
+
+        /// <summary>
+        /// Rewrites the first entry's length field to int.MaxValue, leaving everything else alone.
+        /// The layout is magic, version, then name length, name, payload length - so the field sits
+        /// immediately after the first entry's name.
+        /// </summary>
+        private static byte[] OverstatedEntryLength(byte[] packed)
+        {
+            var copy = (byte[])packed.Clone();
+            var offset = 16 + 2;
+            var nameLength = copy[offset] | (copy[offset + 1] << 8);
+            offset += 2 + nameLength;
+
+            copy[offset] = 0xFF;
+            copy[offset + 1] = 0xFF;
+            copy[offset + 2] = 0xFF;
+            copy[offset + 3] = 0x7F;
+            return copy;
+        }
+
+        private static int FindBytes(byte[] haystack, byte[] needle)
+        {
+            if (haystack == null || needle == null || needle.Length == 0
+                || needle.Length > haystack.Length) return -1;
+            for (var i = 0; i <= haystack.Length - needle.Length; i++)
+            {
+                var match = true;
+                for (var j = 0; j < needle.Length; j++)
+                {
+                    if (haystack[i + j] == needle[j]) continue;
+                    match = false;
+                    break;
+                }
+                if (match) return i;
+            }
+            return -1;
+        }
+
         private static bool BytesEqual(byte[] left, byte[] right)
         {
             if (left == null || right == null) return left == right;
diff --git a/tools/Setup/InstallerEngine.cs b/tools/Setup/InstallerEngine.cs
new file mode 100644
index 0000000..a94ba7e
--- /dev/null
+++ b/tools/Setup/InstallerEngine.cs
@@ -0,0 +1,398 @@
+using System.Diagnostics;
+using System.IO.Compression;
+using System.Net.Http.Headers;
+using System.Text;
+using System.Text.Json;
+
+namespace SS2Revive.Setup;
+
+internal static class InstallerEngine
+{
+    internal const string BuildFolderName = "Surgeon Simulator 2 - 1.3.7";
+    private const string AppId = "774791";
+    private const string DepotId = "774793";
+    private const string ManifestId = "5729349529999704019";
+    private const string GameExeName = "Surgeon Simulator 2.exe";
+    private const string BepInExVersion = "5.4.23.2";
+    private const string BepInExUrl =
+        "https://github.com/BepInEx/BepInEx/releases/download/v5.4.23.2/BepInEx_win_x64_5.4.23.2.zip";
+    private const string DepotDownloaderRepo = "SteamRE/DepotDownloader";
+    private const string ModRepo = "macery12/SS2Revive";
+    private const long MaxApiResponseBytes = 2 * 1024 * 1024;
+    private const long MaxArchiveBytes = 256 * 1024 * 1024;
+    private const long MaxExpandedBytes = 768 * 1024 * 1024;
+    private const int MaxArchiveEntries = 10_000;
+    private static readonly HttpClient Http = CreateHttpClient();
+
+    internal sealed record InstallResult(
+        string InstallDirectory,
+        string GameDirectory,
+        string LauncherPath,
+        bool ModInstalled,
+        string? ModVersion,
+        string? ModError);
+
+    private sealed record ReleaseAsset(string Tag, string Name, Uri Url);
+
+    internal static async Task<InstallResult> InstallAsync(
+        string installDirectory,
+        string steamUsername,
+        IProgress<string> progress,
+        CancellationToken cancellationToken)
+    {
+        if (!OperatingSystem.IsWindows())
+            throw new PlatformNotSupportedException("SS2 Revive Setup supports Windows x64 only.");
+        if (string.IsNullOrWhiteSpace(steamUsername))
+            throw new ArgumentException("A Steam login name is required.", nameof(steamUsername));
+        installDirectory = Path.GetFullPath(installDirectory);
+        Directory.CreateDirectory(installDirectory);
+
+        var toolRoot = Path.Combine(installDirectory, "_tools", "DepotDownloader");
+        var toolExe = Path.Combine(toolRoot, "DepotDownloader.exe");
+        if (!File.Exists(toolExe))
+        {
+            progress.Report("Downloading DepotDownloader…");
+            var depotAsset = await GetLatestReleaseAssetAsync(
+                DepotDownloaderRepo,
+                name => name.EndsWith(".zip", StringComparison.OrdinalIgnoreCase)
+                        && name.Contains("windows-x64", StringComparison.OrdinalIgnoreCase),
+                "a Windows x64 DepotDownloader archive",
+                cancellationToken);
+            await InstallZipAsync(depotAsset.Url, toolRoot, ["DepotDownloader.exe"], cancellationToken);
+        }
+
+        progress.Report("Steam sign-in is opening in DepotDownloader…");
+        var exitCode = await RunDepotDownloaderAsync(toolExe, steamUsername, installDirectory, cancellationToken);
+        if (exitCode != 0) throw new InvalidOperationException($"DepotDownloader exited with code {exitCode}.");
+
+        progress.Report("Locating and verifying Surgeon Simulator 2 build 1.3.7…");
+        var gameExe = Directory.EnumerateFiles(installDirectory, GameExeName, SearchOption.AllDirectories)
+            .OrderBy(path => path.Length)
+            .FirstOrDefault();
+        if (gameExe is null)
+            throw new FileNotFoundException($"The download completed, but {GameExeName} was not found.");
+        var gameFolder = Path.GetDirectoryName(gameExe)
+                         ?? throw new InvalidDataException("The game executable has no parent directory.");
+        await File.WriteAllTextAsync(Path.Combine(gameFolder, "steam_appid.txt"), AppId,
+            new UTF8Encoding(false), cancellationToken);
+
+        progress.Report($"Installing BepInEx {BepInExVersion} x64…");
+        await InstallZipAsync(
+            new Uri(BepInExUrl),
+            gameFolder,
+            ["winhttp.dll", Path.Combine("BepInEx", "core", "BepInEx.dll")],
+            cancellationToken);
+
+        var pluginFolder = Path.Combine(gameFolder, "BepInEx", "plugins", "SS2Revive");
+        var modInstalled = false;
+        string? modVersion = null;
+        string? modError = null;
+        progress.Report("Installing the latest published SS2 Revive mod…");
+        try
+        {
+            var modAsset = await GetLatestReleaseAssetAsync(
+                ModRepo,
+                name => name.StartsWith("SS2Revive-", StringComparison.OrdinalIgnoreCase)
+                        && name.EndsWith(".zip", StringComparison.OrdinalIgnoreCase),
+                "an SS2Revive-*.zip mod archive",
+                cancellationToken);
+            await InstallZipAsync(
+                modAsset.Url,
+                pluginFolder,
+                ["SS2Revive.dll", "SS2Revive_Data.dll", Path.Combine("newsfeed", "NewsFeed.json")],
+                cancellationToken);
+            modInstalled = true;
+            modVersion = modAsset.Tag;
+        }
+        catch (Exception exception) when (exception is not OperationCanceledException)
+        {
+            Directory.CreateDirectory(pluginFolder);
+            modError = exception.Message;
+        }
+
+        progress.Report("Creating the build 1.3.7 launcher…");
+        var launcher = Path.Combine(installDirectory, "Launch Surgeon Simulator 2 - 1.3.7.cmd");
+        await File.WriteAllLinesAsync(launcher,
+            ["@echo off", $"cd /d \"{EscapeBatchPath(gameFolder)}\"", $"start \"\" \"{EscapeBatchPath(gameExe)}\""],
+            Encoding.ASCII,
+            cancellationToken);
+        progress.Report("Installation complete.");
+        return new InstallResult(installDirectory, gameFolder, launcher, modInstalled, modVersion, modError);
+    }
+
+    private static async Task<int> RunDepotDownloaderAsync(
+        string executable,
+        string username,
+        string installDirectory,
+        CancellationToken cancellationToken)
+    {
+        var start = new ProcessStartInfo
+        {
+            FileName = executable,
+            WorkingDirectory = Path.GetDirectoryName(executable)!,
+            UseShellExecute = true,
+            WindowStyle = ProcessWindowStyle.Normal,
+        };
+        foreach (var argument in new[]
+                 {
+                     "-app", AppId, "-depot", DepotId, "-manifest", ManifestId,
+                     "-username", username,
+                     "-dir", installDirectory, "-validate",
+                 })
+            start.ArgumentList.Add(argument);
+
+        using var process = Process.Start(start)
+                            ?? throw new InvalidOperationException("DepotDownloader could not be started.");
+        try { await process.WaitForExitAsync(cancellationToken); }
+        catch (OperationCanceledException)
+        {
+            try { process.Kill(entireProcessTree: true); } catch { }
+            throw;
+        }
+        return process.ExitCode;
+    }
+
+    private static async Task<ReleaseAsset> GetLatestReleaseAssetAsync(
+        string repository,
+        Func<string, bool> accepts,
+        string expected,
+        CancellationToken cancellationToken)
+    {
+        using var response = await Http.GetAsync(
+            $"https://api.github.com/repos/{repository}/releases/latest",
+            HttpCompletionOption.ResponseHeadersRead,
+            cancellationToken);
+        response.EnsureSuccessStatusCode();
+        await using var stream = await response.Content.ReadAsStreamAsync(cancellationToken);
+        using var limited = new BoundedReadStream(stream, MaxApiResponseBytes);
+        using var document = await JsonDocument.ParseAsync(limited, cancellationToken: cancellationToken);
+        var root = document.RootElement;
+        var tag = root.GetProperty("tag_name").GetString();
+        if (string.IsNullOrWhiteSpace(tag)) throw new InvalidDataException("GitHub returned a release without a tag.");
+        foreach (var asset in root.GetProperty("assets").EnumerateArray())
+        {
+            var name = asset.GetProperty("name").GetString();
+            var urlText = asset.GetProperty("browser_download_url").GetString();
+            if (name is null || urlText is null || !accepts(name)) continue;
+            var url = new Uri(urlText);
+            if (url.Scheme != Uri.UriSchemeHttps
+                || !url.Host.Equals("github.com", StringComparison.OrdinalIgnoreCase))
+                throw new InvalidDataException("GitHub returned an unexpected asset URL.");
+            return new ReleaseAsset(tag, name, url);
+        }
+        throw new InvalidDataException($"Release {tag} has no {expected}.");
+    }
+
+    private static async Task InstallZipAsync(
+        Uri url,
+        string destination,
+        IReadOnlyList<string> requiredFiles,
+        CancellationToken cancellationToken)
+    {
+        if (url.Scheme != Uri.UriSchemeHttps) throw new InvalidDataException("Downloads must use HTTPS.");
+        var temporaryRoot = Path.Combine(Path.GetTempPath(), "ss2revive-setup-" + Guid.NewGuid().ToString("N"));
+        var archivePath = Path.Combine(temporaryRoot, "download.zip");
+        var extractedPath = Path.Combine(temporaryRoot, "payload");
+        Directory.CreateDirectory(temporaryRoot);
+        try
+        {
+            await DownloadFileAsync(url, archivePath, cancellationToken);
+            ExtractZipPayload(archivePath, extractedPath, requiredFiles);
+            CopyTree(extractedPath, destination);
+        }
+        finally
+        {
+            try { Directory.Delete(temporaryRoot, recursive: true); } catch { }
+        }
+    }
+
+    private static async Task DownloadFileAsync(Uri url, string destination, CancellationToken cancellationToken)
+    {
+        using var response = await Http.GetAsync(url, HttpCompletionOption.ResponseHeadersRead, cancellationToken);
+        response.EnsureSuccessStatusCode();
+        var finalUri = response.RequestMessage?.RequestUri;
+        if (finalUri is null || finalUri.Scheme != Uri.UriSchemeHttps)
+            throw new InvalidDataException("A download redirected away from HTTPS.");
+        if (response.Content.Headers.ContentLength is > MaxArchiveBytes)
+            throw new InvalidDataException("The download is larger than the setup safety limit.");
+        await using var input = await response.Content.ReadAsStreamAsync(cancellationToken);
+        await using var output = new FileStream(destination, FileMode.CreateNew, FileAccess.Write, FileShare.None,
+            128 * 1024, FileOptions.Asynchronous | FileOptions.SequentialScan);
+        var buffer = new byte[128 * 1024];
+        long total = 0;
+        while (true)
+        {
+            var read = await input.ReadAsync(buffer, cancellationToken);
+            if (read == 0) break;
+            total += read;
+            if (total > MaxArchiveBytes) throw new InvalidDataException("The download exceeded the setup safety limit.");
+            await output.WriteAsync(buffer.AsMemory(0, read), cancellationToken);
+        }
+        if (total == 0) throw new InvalidDataException("The downloaded archive is empty.");
+    }
+
+    private static void ExtractZipPayload(string archivePath, string destination, IReadOnlyList<string> requiredFiles)
+    {
+        Directory.CreateDirectory(destination);
+        using var archive = ZipFile.OpenRead(archivePath);
+        if (archive.Entries.Count > MaxArchiveEntries)
+            throw new InvalidDataException("The downloaded archive contains too many entries.");
+        var markerName = Path.GetFileName(requiredFiles[0]);
+        var marker = archive.Entries
+            .Where(entry => entry.Name.Equals(markerName, StringComparison.OrdinalIgnoreCase))
+            .OrderBy(entry => entry.FullName.Length)
+            .FirstOrDefault()
+            ?? throw new InvalidDataException($"{markerName} was not found in the downloaded archive.");
+        var markerPath = marker.FullName.Replace('\\', '/');
+        var slash = markerPath.LastIndexOf('/');
+        var prefix = slash < 0 ? string.Empty : markerPath[..slash];
+        long expanded = 0;
+        foreach (var entry in archive.Entries)
+        {
+            var fullName = entry.FullName.Replace('\\', '/');
+            if (prefix.Length > 0)
+            {
+                if (!fullName.StartsWith(prefix + "/", StringComparison.OrdinalIgnoreCase)) continue;
+                fullName = fullName[(prefix.Length + 1)..];
+            }
+            if (string.IsNullOrEmpty(fullName)) continue;
+            if (fullName.StartsWith('/') || Path.IsPathFullyQualified(fullName)
+                || fullName.Split('/').Any(part => part is ".." or "."))
+                throw new InvalidDataException("The downloaded archive contains an unsafe path.");
+            var unixType = (entry.ExternalAttributes >> 16) & 0xF000;
+            if (unixType == 0xA000) throw new InvalidDataException("The downloaded archive contains a symbolic link.");
+            expanded += entry.Length;
+            if (entry.Length > MaxExpandedBytes || expanded > MaxExpandedBytes)
+                throw new InvalidDataException("The downloaded archive expands beyond the setup safety limit.");
+            var outputPath = Path.GetFullPath(Path.Combine(destination,
+                fullName.Replace('/', Path.DirectorySeparatorChar)));
+            var destinationRoot = Path.GetFullPath(destination) + Path.DirectorySeparatorChar;
+            if (!outputPath.StartsWith(destinationRoot, StringComparison.OrdinalIgnoreCase))
+                throw new InvalidDataException("The downloaded archive escapes its staging directory.");
+            if (string.IsNullOrEmpty(entry.Name))
+            {
+                Directory.CreateDirectory(outputPath);
+                continue;
+            }
+            Directory.CreateDirectory(Path.GetDirectoryName(outputPath)!);
+            entry.ExtractToFile(outputPath, overwrite: true);
+        }
+        foreach (var required in requiredFiles)
+            if (!File.Exists(Path.Combine(destination, required)))
+                throw new InvalidDataException($"The archive is missing required file {required}.");
+    }
+
+    private static void CopyTree(string source, string destination)
+    {
+        Directory.CreateDirectory(destination);
+        foreach (var directory in Directory.EnumerateDirectories(source, "*", SearchOption.AllDirectories))
+            Directory.CreateDirectory(Path.Combine(destination, Path.GetRelativePath(source, directory)));
+        foreach (var file in Directory.EnumerateFiles(source, "*", SearchOption.AllDirectories))
+        {
+            var target = Path.Combine(destination, Path.GetRelativePath(source, file));
+            Directory.CreateDirectory(Path.GetDirectoryName(target)!);
+            File.Copy(file, target, overwrite: true);
+        }
+    }
+
+    private static string EscapeBatchPath(string path) => path.Replace("%", "%%");
+
+    private static HttpClient CreateHttpClient()
+    {
+        var client = new HttpClient(new HttpClientHandler { AllowAutoRedirect = true })
+        {
+            Timeout = TimeSpan.FromMinutes(15),
+        };
+        client.DefaultRequestHeaders.UserAgent.Add(new ProductInfoHeaderValue("SS2Revive-Setup", "1.0"));
+        client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/vnd.github+json"));
+        return client;
+    }
+
+    internal static void RunSelfTest()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "ss2revive-setup-test-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(root);
+        try
+        {
+            var validZip = Path.Combine(root, "valid.zip");
+            using (var zip = ZipFile.Open(validZip, ZipArchiveMode.Create))
+            {
+                WriteEntry(zip, "wrapper/SS2Revive.dll", "plugin");
+                WriteEntry(zip, "wrapper/SS2Revive_Data.dll", "data");
+                WriteEntry(zip, "wrapper/newsfeed/NewsFeed.json", "{}");
+            }
+            var validOutput = Path.Combine(root, "valid-output");
+            ExtractZipPayload(validZip, validOutput,
+                ["SS2Revive.dll", "SS2Revive_Data.dll", Path.Combine("newsfeed", "NewsFeed.json")]);
+            if (File.ReadAllText(Path.Combine(validOutput, "SS2Revive.dll")) != "plugin")
+                throw new InvalidOperationException("Valid archive extraction failed.");
+
+            var unsafeZip = Path.Combine(root, "unsafe.zip");
+            using (var zip = ZipFile.Open(unsafeZip, ZipArchiveMode.Create))
+            {
+                WriteEntry(zip, "SS2Revive.dll", "plugin");
+                WriteEntry(zip, "../escape.txt", "unsafe");
+            }
+            try
+            {
+                ExtractZipPayload(unsafeZip, Path.Combine(root, "unsafe-output"), ["SS2Revive.dll"]);
+                throw new InvalidOperationException("Unsafe archive traversal was accepted.");
+            }
+            catch (InvalidDataException) { }
+            if (File.Exists(Path.Combine(root, "escape.txt")))
+                throw new InvalidOperationException("Unsafe archive traversal wrote outside staging.");
+        }
+        finally
+        {
+            try { Directory.Delete(root, recursive: true); } catch { }
+        }
+    }
+
+    private static void WriteEntry(ZipArchive archive, string path, string value)
+    {
+        var entry = archive.CreateEntry(path);
+        using var writer = new StreamWriter(entry.Open(), new UTF8Encoding(false));
+        writer.Write(value);
+    }
+
+    private sealed class BoundedReadStream(Stream inner, long maximumBytes) : Stream
+    {
+        private long _read;
+        public override bool CanRead => inner.CanRead;
+        public override bool CanSeek => false;
+        public override bool CanWrite => false;
+        public override long Length => throw new NotSupportedException();
+        public override long Position { get => _read; set => throw new NotSupportedException(); }
+        public override void Flush() => throw new NotSupportedException();
+        public override int Read(byte[] buffer, int offset, int count)
+        {
+            var result = inner.Read(buffer, offset, count);
+            Count(result);
+            return result;
+        }
+        public override async ValueTask<int> ReadAsync(Memory<byte> buffer, CancellationToken cancellationToken = default)
+        {
+            var result = await inner.ReadAsync(buffer, cancellationToken);
+            Count(result);
+            return result;
+        }
+        private void Count(int count)
+        {
+            _read += count;
+            if (_read > maximumBytes) throw new InvalidDataException("The GitHub API response exceeded the safety limit.");
+        }
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+        protected override void Dispose(bool disposing)
+        {
+            if (disposing) inner.Dispose();
+            base.Dispose(disposing);
+        }
+        public override async ValueTask DisposeAsync()
+        {
+            await inner.DisposeAsync();
+            GC.SuppressFinalize(this);
+        }
+    }
+}
diff --git a/tools/Setup/Program.cs b/tools/Setup/Program.cs
new file mode 100644
index 0000000..03b0662
--- /dev/null
+++ b/tools/Setup/Program.cs
@@ -0,0 +1,25 @@
+namespace SS2Revive.Setup;
+
+internal static class Program
+{
+    [STAThread]
+    private static int Main(string[] args)
+    {
+        if (args.Any(value => value.Equals("--self-test", StringComparison.OrdinalIgnoreCase)))
+        {
+            try
+            {
+                InstallerEngine.RunSelfTest();
+                return 0;
+            }
+            catch
+            {
+                return 1;
+            }
+        }
+
+        ApplicationConfiguration.Initialize();
+        Application.Run(new SetupForm());
+        return 0;
+    }
+}
diff --git a/tools/Setup/SS2Revive.Setup.csproj b/tools/Setup/SS2Revive.Setup.csproj
new file mode 100644
index 0000000..d4d98ba
--- /dev/null
+++ b/tools/Setup/SS2Revive.Setup.csproj
@@ -0,0 +1,30 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>WinExe</OutputType>
+    <TargetFramework>net8.0-windows</TargetFramework>
+    <UseWindowsForms>true</UseWindowsForms>
+    <RuntimeIdentifier>win-x64</RuntimeIdentifier>
+    <SelfContained>true</SelfContained>
+    <PublishSingleFile>true</PublishSingleFile>
+    <EnableCompressionInSingleFile>true</EnableCompressionInSingleFile>
+    <PublishTrimmed>false</PublishTrimmed>
+    <IncludeNativeLibrariesForSelfExtract>true</IncludeNativeLibrariesForSelfExtract>
+    <DebugType Condition="'$(Configuration)' == 'Release'">None</DebugType>
+    <DebugSymbols Condition="'$(Configuration)' == 'Release'">false</DebugSymbols>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <LangVersion>latest</LangVersion>
+    <AssemblyName>SS2Revive.Setup</AssemblyName>
+    <RootNamespace>SS2Revive.Setup</RootNamespace>
+    <Version>$(SS2ReviveVersion)</Version>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <AssemblyAttribute Include="System.Reflection.AssemblyMetadataAttribute">
+      <_Parameter1>SS2ReviveVersion</_Parameter1>
+      <_Parameter2>$(SS2ReviveVersion)</_Parameter2>
+    </AssemblyAttribute>
+  </ItemGroup>
+
+</Project>
diff --git a/tools/Setup/SetupForm.cs b/tools/Setup/SetupForm.cs
new file mode 100644
index 0000000..9eada47
--- /dev/null
+++ b/tools/Setup/SetupForm.cs
@@ -0,0 +1,322 @@
+using System.Diagnostics;
+
+namespace SS2Revive.Setup;
+
+internal sealed class SetupForm : Form
+{
+    private readonly Panel _startPage = new() { Dock = DockStyle.Fill };
+    private readonly Panel _progressPage = new() { Dock = DockStyle.Fill, Visible = false };
+    private readonly Panel _completePage = new() { Dock = DockStyle.Fill, Visible = false };
+    private readonly TextBox _installPath = new();
+    private readonly TextBox _steamUsername = new();
+    private readonly Label _progressStatus = new();
+    private readonly TextBox _progressLog = new();
+    private readonly Label _completionSummary = new();
+    private readonly Button _installButton = new();
+    private readonly Button _launchButton = new();
+    private readonly Button _openFolderButton = new();
+    private CancellationTokenSource? _cancellation;
+    private InstallerEngine.InstallResult? _result;
+    private bool _installing;
+
+    internal SetupForm()
+    {
+        Text = "SS2 Revive Setup";
+        ClientSize = new Size(720, 470);
+        MinimumSize = new Size(720, 470);
+        MaximizeBox = false;
+        StartPosition = FormStartPosition.CenterScreen;
+        Font = new Font("Segoe UI", 10f);
+        BuildStartPage();
+        BuildProgressPage();
+        BuildCompletePage();
+        Controls.Add(_completePage);
+        Controls.Add(_progressPage);
+        Controls.Add(_startPage);
+        FormClosing += OnFormClosing;
+    }
+
+    private void BuildStartPage()
+    {
+        var title = TitleLabel("Install SS2 Revive");
+        title.Location = new Point(32, 24);
+        _startPage.Controls.Add(title);
+
+        var intro = new Label
+        {
+            AutoSize = false,
+            Location = new Point(35, 72),
+            Size = new Size(650, 52),
+            Text = "Creates a separate Surgeon Simulator 2 build 1.3.7 installation, then adds x64 BepInEx and the latest published SS2 Revive release.",
+        };
+        _startPage.Controls.Add(intro);
+
+        var installLabel = FieldLabel("Install location", 136);
+        _startPage.Controls.Add(installLabel);
+        _installPath.Location = new Point(35, 164);
+        _installPath.Size = new Size(544, 30);
+        _installPath.Text = Path.Combine(
+            Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+            "SS2Revive",
+            InstallerEngine.BuildFolderName);
+        _startPage.Controls.Add(_installPath);
+
+        var browse = new Button
+        {
+            Text = "Browse…",
+            Location = new Point(590, 162),
+            Size = new Size(95, 34),
+        };
+        browse.Click += (_, _) => BrowseForInstallFolder();
+        _startPage.Controls.Add(browse);
+
+        var steamLabel = FieldLabel("Steam login name", 216);
+        _startPage.Controls.Add(steamLabel);
+        _steamUsername.Location = new Point(35, 244);
+        _steamUsername.Size = new Size(650, 30);
+        _startPage.Controls.Add(_steamUsername);
+
+        var credentialNote = new Label
+        {
+            AutoSize = false,
+            Location = new Point(35, 284),
+            Size = new Size(650, 68),
+            ForeColor = Color.FromArgb(80, 80, 80),
+            Text = "Steam must own Surgeon Simulator 2. DepotDownloader opens a separate sign-in window for your password and Steam Guard code. SS2 Revive Setup never reads or stores those credentials.",
+        };
+        _startPage.Controls.Add(credentialNote);
+
+        _installButton.Text = "Install";
+        _installButton.Location = new Point(545, 391);
+        _installButton.Size = new Size(140, 42);
+        _installButton.Click += async (_, _) => await BeginInstallAsync();
+        _startPage.Controls.Add(_installButton);
+
+        var cancel = new Button
+        {
+            Text = "Cancel",
+            Location = new Point(393, 391),
+            Size = new Size(140, 42),
+        };
+        cancel.Click += (_, _) => Close();
+        _startPage.Controls.Add(cancel);
+        AcceptButton = _installButton;
+        CancelButton = cancel;
+    }
+
+    private void BuildProgressPage()
+    {
+        var title = TitleLabel("Installing");
+        title.Location = new Point(32, 24);
+        _progressPage.Controls.Add(title);
+
+        var bar = new ProgressBar
+        {
+            Style = ProgressBarStyle.Marquee,
+            MarqueeAnimationSpeed = 25,
+            Location = new Point(35, 80),
+            Size = new Size(650, 22),
+        };
+        _progressPage.Controls.Add(bar);
+
+        _progressStatus.Location = new Point(35, 117);
+        _progressStatus.Size = new Size(650, 48);
+        _progressStatus.Text = "Preparing setup…";
+        _progressPage.Controls.Add(_progressStatus);
+
+        _progressLog.Location = new Point(35, 170);
+        _progressLog.Size = new Size(650, 205);
+        _progressLog.Multiline = true;
+        _progressLog.ReadOnly = true;
+        _progressLog.ScrollBars = ScrollBars.Vertical;
+        _progressLog.BackColor = SystemColors.Window;
+        _progressPage.Controls.Add(_progressLog);
+
+        var note = new Label
+        {
+            AutoSize = false,
+            Location = new Point(35, 388),
+            Size = new Size(500, 50),
+            ForeColor = Color.FromArgb(80, 80, 80),
+            Text = "Do not close Setup or the DepotDownloader sign-in window while installation is running.",
+        };
+        _progressPage.Controls.Add(note);
+
+        var cancel = new Button
+        {
+            Text = "Cancel",
+            Location = new Point(545, 391),
+            Size = new Size(140, 42),
+        };
+        cancel.Click += (_, _) => _cancellation?.Cancel();
+        _progressPage.Controls.Add(cancel);
+    }
+
+    private void BuildCompletePage()
+    {
+        var title = TitleLabel("Installation complete");
+        title.Location = new Point(32, 24);
+        _completePage.Controls.Add(title);
+
+        _completionSummary.AutoSize = false;
+        _completionSummary.Location = new Point(35, 82);
+        _completionSummary.Size = new Size(650, 235);
+        _completionSummary.Font = new Font(Font.FontFamily, 10.5f);
+        _completePage.Controls.Add(_completionSummary);
+
+        var instructions = new Label
+        {
+            AutoSize = false,
+            Location = new Point(35, 322),
+            Size = new Size(650, 56),
+            Text = "Keep Steam running and signed in. Use the generated launcher—not the normal Steam Play button—to start build 1.3.7.",
+        };
+        _completePage.Controls.Add(instructions);
+
+        _openFolderButton.Text = "Open folder";
+        _openFolderButton.Location = new Point(241, 391);
+        _openFolderButton.Size = new Size(140, 42);
+        _openFolderButton.Click += (_, _) => OpenPath(_result?.InstallDirectory);
+        _completePage.Controls.Add(_openFolderButton);
+
+        _launchButton.Text = "Launch game";
+        _launchButton.Location = new Point(393, 391);
+        _launchButton.Size = new Size(140, 42);
+        _launchButton.Click += (_, _) => OpenPath(_result?.LauncherPath);
+        _completePage.Controls.Add(_launchButton);
+
+        var finish = new Button
+        {
+            Text = "Finish",
+            Location = new Point(545, 391),
+            Size = new Size(140, 42),
+        };
+        finish.Click += (_, _) => Close();
+        _completePage.Controls.Add(finish);
+    }
+
+    private async Task BeginInstallAsync()
+    {
+        var path = _installPath.Text.Trim().Trim('"');
+        var username = _steamUsername.Text.Trim();
+        if (string.IsNullOrWhiteSpace(path) || string.IsNullOrWhiteSpace(username))
+        {
+            MessageBox.Show(this, "Choose an install location and enter your Steam login name.",
+                "Missing information", MessageBoxButtons.OK, MessageBoxIcon.Warning);
+            return;
+        }
+        try { path = Path.GetFullPath(path); }
+        catch (Exception exception)
+        {
+            MessageBox.Show(this, "The install path is invalid: " + exception.Message,
+                "Invalid path", MessageBoxButtons.OK, MessageBoxIcon.Warning);
+            return;
+        }
+
+        _installing = true;
+        _cancellation = new CancellationTokenSource();
+        _startPage.Visible = false;
+        _progressPage.Visible = true;
+        _progressPage.BringToFront();
+        var progress = new Progress<string>(message =>
+        {
+            _progressStatus.Text = message;
+            _progressLog.AppendText(message + Environment.NewLine);
+        });
+
+        try
+        {
+            _result = await InstallerEngine.InstallAsync(path, username, progress, _cancellation.Token);
+            ShowCompletion(_result);
+        }
+        catch (OperationCanceledException)
+        {
+            MessageBox.Show(this, "Installation was cancelled. You can run Setup again to resume and validate the download.",
+                "Cancelled", MessageBoxButtons.OK, MessageBoxIcon.Information);
+            _progressPage.Visible = false;
+            _startPage.Visible = true;
+            _startPage.BringToFront();
+        }
+        catch (Exception exception)
+        {
+            MessageBox.Show(this, exception.Message, "Installation failed",
+                MessageBoxButtons.OK, MessageBoxIcon.Error);
+            _progressPage.Visible = false;
+            _startPage.Visible = true;
+            _startPage.BringToFront();
+        }
+        finally
+        {
+            _installing = false;
+            _cancellation.Dispose();
+            _cancellation = null;
+        }
+    }
+
+    private void ShowCompletion(InstallerEngine.InstallResult result)
+    {
+        _completionSummary.Text =
+            $"Installed to:\r\n{result.InstallDirectory}\r\n\r\n" +
+            $"Launcher:\r\n{result.LauncherPath}\r\n\r\n" +
+            (result.ModInstalled
+                ? $"SS2 Revive mod: Installed successfully ({result.ModVersion})"
+                : $"SS2 Revive mod: Not installed automatically\r\n{result.ModError}");
+        _launchButton.Enabled = File.Exists(result.LauncherPath);
+        _openFolderButton.Enabled = Directory.Exists(result.InstallDirectory);
+        _progressPage.Visible = false;
+        _completePage.Visible = true;
+        _completePage.BringToFront();
+    }
+
+    private void BrowseForInstallFolder()
+    {
+        using var picker = new FolderBrowserDialog
+        {
+            Description = "Choose where the separate Surgeon Simulator 2 build 1.3.7 copy will be installed",
+            UseDescriptionForTitle = true,
+            ShowNewFolderButton = true,
+            SelectedPath = Directory.Exists(_installPath.Text) ? _installPath.Text : string.Empty,
+        };
+        if (picker.ShowDialog(this) == DialogResult.OK)
+            _installPath.Text = Path.Combine(picker.SelectedPath, InstallerEngine.BuildFolderName);
+    }
+
+    private void OnFormClosing(object? sender, FormClosingEventArgs eventArgs)
+    {
+        if (!_installing) return;
+        var result = MessageBox.Show(this, "Cancel the installation and close Setup?",
+            "Installation running", MessageBoxButtons.YesNo, MessageBoxIcon.Warning);
+        if (result != DialogResult.Yes)
+        {
+            eventArgs.Cancel = true;
+            return;
+        }
+        _cancellation?.Cancel();
+    }
+
+    private static void OpenPath(string? path)
+    {
+        if (string.IsNullOrWhiteSpace(path)) return;
+        try { Process.Start(new ProcessStartInfo(path) { UseShellExecute = true }); }
+        catch (Exception exception)
+        {
+            MessageBox.Show("Could not open the requested path: " + exception.Message,
+                "Open failed", MessageBoxButtons.OK, MessageBoxIcon.Error);
+        }
+    }
+
+    private static Label TitleLabel(string text) => new()
+    {
+        Text = text,
+        AutoSize = true,
+        Font = new Font("Segoe UI Semibold", 20f, FontStyle.Bold),
+    };
+
+    private static Label FieldLabel(string text, int top) => new()
+    {
+        Text = text,
+        AutoSize = true,
+        Location = new Point(35, top),
+        Font = new Font("Segoe UI Semibold", 10f, FontStyle.Bold),
+    };
+}