Merge branch 'develop' into fetch-outbox

2023-09-11 06:32:04 +00:00
parent 888cd2eb9f 25e030a707
commit df636659e2
271 changed files with 6760 additions and 8577 deletions
--- a/packages/backend/migration/1690569881926-user-2fa-backup-codes.js
+++ b/packages/backend/migration/1690569881926-user-2fa-backup-codes.js
@@ -0,0 +1,11 @@
+export class User2faBackupCodes1690569881926 {
+	name = 'User2faBackupCodes1690569881926'
+
+	async up(queryRunner) {
+		await queryRunner.query(`ALTER TABLE "user_profile" ADD "twoFactorBackupSecret" character varying array`);
+	}
+
+	async down(queryRunner) {
+		await queryRunner.query(`ALTER TABLE "user_profile" DROP COLUMN "twoFactorBackupSecret"`);
+	}
+}
--- a/packages/backend/migration/1691959191872-passkey-support.js
+++ b/packages/backend/migration/1691959191872-passkey-support.js
@@ -0,0 +1,49 @@
+/*
+ * SPDX-FileCopyrightText: syuilo and other misskey contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+export class PasskeySupport1691959191872 {
+	name = 'PasskeySupport1691959191872'
+
+	async up(queryRunner) {
+			await queryRunner.query(`ALTER TABLE "user_security_key" ADD "counter" bigint NOT NULL DEFAULT '0'`);
+			await queryRunner.query(`COMMENT ON COLUMN "user_security_key"."counter" IS 'The number of times the UserSecurityKey was validated.'`);
+			await queryRunner.query(`ALTER TABLE "user_security_key" ADD "credentialDeviceType" character varying(32)`);
+			await queryRunner.query(`COMMENT ON COLUMN "user_security_key"."credentialDeviceType" IS 'The type of Backup Eligibility in authenticator data'`);
+			await queryRunner.query(`ALTER TABLE "user_security_key" ADD "credentialBackedUp" boolean`);
+			await queryRunner.query(`COMMENT ON COLUMN "user_security_key"."credentialBackedUp" IS 'Whether or not the credential has been backed up'`);
+			await queryRunner.query(`ALTER TABLE "user_security_key" ADD "transports" character varying(32) array`);
+			await queryRunner.query(`COMMENT ON COLUMN "user_security_key"."transports" IS 'The type of the credential returned by the browser'`);
+			await queryRunner.query(`COMMENT ON COLUMN "user_security_key"."publicKey" IS 'The public key of the UserSecurityKey, hex-encoded.'`);
+			await queryRunner.query(`COMMENT ON COLUMN "user_security_key"."lastUsed" IS 'Timestamp of the last time the UserSecurityKey was used.'`);
+			await queryRunner.query(`ALTER TABLE "user_security_key" ALTER COLUMN "lastUsed" SET DEFAULT now()`);
+			await queryRunner.query(`UPDATE "user_security_key" SET "id" = REPLACE(REPLACE(REPLACE(REPLACE(ENCODE(DECODE("id", 'hex'), 'base64'), E'\\n', ''), '+', '-'), '/', '_'), '=', ''), "publicKey" = REPLACE(REPLACE(REPLACE(REPLACE(ENCODE(DECODE("publicKey", 'hex'), 'base64'), E'\\n', ''), '+', '-'), '/', '_'), '=', '')`);
+			await queryRunner.query(`ALTER TABLE "attestation_challenge" DROP CONSTRAINT "FK_f1a461a618fa1755692d0e0d592"`);
+			await queryRunner.query(`DROP INDEX "IDX_47efb914aed1f72dd39a306c7b"`);
+			await queryRunner.query(`DROP INDEX "IDX_f1a461a618fa1755692d0e0d59"`);
+			await queryRunner.query(`DROP TABLE "attestation_challenge"`);
+	}
+
+	async down(queryRunner) {
+			await queryRunner.query(`CREATE TABLE "attestation_challenge" ("id" character varying(32) NOT NULL, "userId" character varying(32) NOT NULL, "challenge" character varying(64) NOT NULL, "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL, "registrationChallenge" boolean NOT NULL DEFAULT false, CONSTRAINT "PK_d0ba6786e093f1bcb497572a6b5" PRIMARY KEY ("id", "userId"))`);
+			await queryRunner.query(`CREATE INDEX "IDX_f1a461a618fa1755692d0e0d59" ON "attestation_challenge" ("userId") `);
+			await queryRunner.query(`CREATE INDEX "IDX_47efb914aed1f72dd39a306c7b" ON "attestation_challenge" ("challenge") `);
+			await queryRunner.query(`ALTER TABLE "attestation_challenge" ADD CONSTRAINT "FK_f1a461a618fa1755692d0e0d592" FOREIGN KEY ("userId") REFERENCES "user"("id") ON DELETE CASCADE ON UPDATE NO ACTION`);
+			await queryRunner.query(`COMMENT ON COLUMN "attestation_challenge"."challenge" IS 'Hex-encoded sha256 hash of the challenge.'`);
+			await queryRunner.query(`COMMENT ON COLUMN "attestation_challenge"."createdAt" IS 'The date challenge was created for expiry purposes.'`);
+			await queryRunner.query(`COMMENT ON COLUMN "attestation_challenge"."registrationChallenge" IS 'Indicates that the challenge is only for registration purposes if true to prevent the challenge for being used as authentication.'`);
+			await queryRunner.query(`UPDATE "user_security_key" SET "id" = ENCODE(DECODE(REPLACE(REPLACE("id" || CASE WHEN LENGTH("id") % 4 = 2 THEN '==' WHEN LENGTH("id") % 4 = 3 THEN '=' ELSE '' END, '-', '+'), '_', '/'), 'base64'), 'hex'), "publicKey" = ENCODE(DECODE(REPLACE(REPLACE("publicKey" || CASE WHEN LENGTH("publicKey") % 4 = 2 THEN '==' WHEN LENGTH("publicKey") % 4 = 3 THEN '=' ELSE '' END, '-', '+'), '_', '/'), 'base64'), 'hex')`);
+			await queryRunner.query(`ALTER TABLE "user_security_key" ALTER COLUMN "lastUsed" DROP DEFAULT`);
+			await queryRunner.query(`COMMENT ON COLUMN "user_security_key"."lastUsed" IS 'The date of the last time the UserSecurityKey was successfully validated.'`);
+			await queryRunner.query(`COMMENT ON COLUMN "user_security_key"."publicKey" IS 'Variable-length public key used to verify attestations (hex-encoded).'`);
+			await queryRunner.query(`COMMENT ON COLUMN "user_security_key"."transports" IS 'The type of the credential returned by the browser'`);
+			await queryRunner.query(`ALTER TABLE "user_security_key" DROP COLUMN "transports"`);
+			await queryRunner.query(`COMMENT ON COLUMN "user_security_key"."credentialBackedUp" IS 'Whether or not the credential has been backed up'`);
+			await queryRunner.query(`ALTER TABLE "user_security_key" DROP COLUMN "credentialBackedUp"`);
+			await queryRunner.query(`COMMENT ON COLUMN "user_security_key"."credentialDeviceType" IS 'The type of Backup Eligibility in authenticator data'`);
+			await queryRunner.query(`ALTER TABLE "user_security_key" DROP COLUMN "credentialDeviceType"`);
+			await queryRunner.query(`COMMENT ON COLUMN "user_security_key"."counter" IS 'The number of times the UserSecurityKey was validated.'`);
+			await queryRunner.query(`ALTER TABLE "user_security_key" DROP COLUMN "counter"`);
+	}
+}
--- a/packages/backend/package.json
+++ b/packages/backend/package.json
@@ -56,36 +56,37 @@
 		"utf-8-validate": "^6.0.3"
 	},
 	"dependencies": {
-		"@aws-sdk/client-s3": "3.367.0",
-		"@aws-sdk/lib-storage": "3.367.0",
-		"@aws-sdk/node-http-handler": "3.360.0",
-		"@bull-board/api": "5.7.1",
-		"@bull-board/fastify": "5.7.1",
-		"@bull-board/ui": "5.7.1",
+		"@aws-sdk/client-s3": "3.400.0",
+		"@aws-sdk/lib-storage": "3.400.0",
+		"@aws-sdk/node-http-handler": "3.374.0",
+		"@bull-board/api": "5.8.1",
+		"@bull-board/fastify": "5.8.1",
+		"@bull-board/ui": "5.8.1",
 		"@discordapp/twemoji": "14.1.2",
 		"@fastify/accepts": "4.2.0",
-		"@fastify/cookie": "8.3.0",
+		"@fastify/cookie": "9.0.4",
 		"@fastify/cors": "8.3.0",
 		"@fastify/express": "2.3.0",
 		"@fastify/http-proxy": "9.2.1",
 		"@fastify/multipart": "7.7.3",
-		"@fastify/static": "6.10.2",
+		"@fastify/static": "6.11.0",
 		"@fastify/view": "8.0.0",
-		"@nestjs/common": "10.1.2",
-		"@nestjs/core": "10.1.2",
-		"@nestjs/testing": "10.1.2",
+		"@nestjs/common": "10.2.4",
+		"@nestjs/core": "10.2.4",
+		"@nestjs/testing": "10.2.4",
 		"@peertube/http-signature": "1.7.0",
-		"@sinonjs/fake-timers": "10.3.0",
+		"@simplewebauthn/server": "8.1.1",
+		"@sinonjs/fake-timers": "11.1.0",
 		"@swc/cli": "0.1.62",
-		"@swc/core": "1.3.72",
+		"@swc/core": "1.3.82",
 		"accepts": "1.3.8",
 		"ajv": "8.12.0",
-		"archiver": "5.3.1",
-		"async-mutex": "^0.4.0",
+		"archiver": "6.0.1",
+		"async-mutex": "0.4.0",
 		"bcryptjs": "2.4.3",
 		"blurhash": "2.0.5",
 		"body-parser": "1.20.2",
-		"bullmq": "4.6.3",
+		"bullmq": "4.8.0",
 		"cacheable-lookup": "7.0.0",
 		"cbor": "9.0.1",
 		"chalk": "5.3.0",
@@ -96,7 +97,7 @@
 		"content-disposition": "0.5.4",
 		"date-fns": "2.30.0",
 		"deep-email-validator": "0.1.21",
-		"fastify": "4.21.0",
+		"fastify": "4.22.2",
 		"feed": "4.2.2",
 		"file-type": "18.5.0",
 		"fluent-ffmpeg": "2.1.2",
@@ -112,14 +113,15 @@
 		"js-yaml": "4.1.0",
 		"jsdom": "22.1.0",
 		"json5": "2.2.3",
-		"jsonld": "8.2.0",
+		"jsonld": "8.2.1",
 		"jsrsasign": "10.8.6",
-		"meilisearch": "0.33.0",
+		"meilisearch": "0.34.1",
 		"mfm-js": "0.23.3",
 		"microformats-parser": "1.4.1",
 		"mime-types": "2.1.35",
 		"misskey-js": "workspace:*",
 		"ms": "3.0.0-canary.1",
+		"nanoid": "4.0.2",
 		"nested-property": "4.0.0",
 		"node-fetch": "3.3.2",
 		"nodemailer": "6.9.4",
@@ -130,7 +132,7 @@
 		"os-utils": "0.0.14",
 		"otpauth": "9.1.4",
 		"parse5": "7.1.2",
-		"pg": "8.11.1",
+		"pg": "8.11.3",
 		"pkce-challenge": "4.0.1",
 		"probe-image-size": "7.2.3",
 		"promise-limit": "2.7.0",
@@ -140,84 +142,85 @@
 		"qrcode": "1.5.3",
 		"random-seed": "0.3.0",
 		"ratelimiter": "3.4.1",
-		"re2": "1.20.1",
+		"re2": "1.20.3",
 		"redis-lock": "0.1.4",
 		"reflect-metadata": "0.1.13",
 		"rename": "1.0.4",
 		"rss-parser": "3.13.0",
 		"rxjs": "7.8.1",
 		"sanitize-html": "2.11.0",
-		"sharp": "0.32.4",
+		"sharp": "0.32.5",
 		"sharp-read-bmp": "github:misskey-dev/sharp-read-bmp",
 		"slacc": "0.0.10",
 		"strict-event-emitter-types": "2.0.0",
 		"stringz": "2.1.0",
 		"summaly": "github:misskey-dev/summaly",
-		"systeminformation": "5.18.9",
+		"systeminformation": "5.21.4",
 		"tinycolor2": "1.6.0",
 		"tmp": "0.2.1",
 		"tsc-alias": "1.8.7",
 		"tsconfig-paths": "4.2.0",
 		"twemoji-parser": "14.0.0",
 		"typeorm": "0.3.17",
-		"typescript": "5.1.6",
+		"typescript": "5.2.2",
 		"ulid": "2.3.0",
 		"vary": "1.1.2",
-		"web-push": "3.6.4",
+		"web-push": "3.6.5",
 		"ws": "8.13.0",
 		"xev": "3.0.2"
 	},
 	"devDependencies": {
-		"@jest/globals": "29.6.2",
-		"@swc/jest": "0.2.27",
+		"@jest/globals": "29.6.4",
+		"@simplewebauthn/typescript-types": "8.0.0",
+		"@swc/jest": "0.2.29",
 		"@types/accepts": "1.3.5",
 		"@types/archiver": "5.3.2",
-		"@types/bcryptjs": "2.4.2",
+		"@types/bcryptjs": "2.4.3",
 		"@types/body-parser": "1.19.2",
 		"@types/cbor": "6.0.0",
-		"@types/color-convert": "2.0.0",
-		"@types/content-disposition": "0.5.5",
+		"@types/color-convert": "2.0.1",
+		"@types/content-disposition": "0.5.6",
 		"@types/fluent-ffmpeg": "2.1.21",
 		"@types/http-link-header": "1.0.3",
-		"@types/jest": "29.5.3",
+		"@types/jest": "29.5.4",
 		"@types/js-yaml": "4.0.5",
-		"@types/jsdom": "21.1.1",
+		"@types/jsdom": "21.1.2",
 		"@types/jsonld": "1.5.9",
 		"@types/jsrsasign": "10.5.8",
 		"@types/mime-types": "2.1.1",
 		"@types/ms": "0.7.31",
-		"@types/node": "20.4.5",
+		"@types/node": "20.5.9",
 		"@types/node-fetch": "3.0.3",
 		"@types/nodemailer": "6.4.9",
-		"@types/oauth": "0.9.1",
-		"@types/oauth2orize": "1.11.0",
+		"@types/oauth": "0.9.2",
+		"@types/oauth2orize": "1.11.1",
 		"@types/oauth2orize-pkce": "0.1.0",
 		"@types/pg": "8.10.2",
 		"@types/pug": "2.0.6",
 		"@types/punycode": "2.1.0",
-		"@types/qrcode": "1.5.1",
+		"@types/qrcode": "1.5.2",
 		"@types/random-seed": "0.3.3",
 		"@types/ratelimiter": "3.4.4",
 		"@types/rename": "1.0.4",
 		"@types/sanitize-html": "2.9.0",
-		"@types/semver": "7.5.0",
+		"@types/semver": "7.5.1",
 		"@types/sharp": "0.32.0",
 		"@types/simple-oauth2": "5.0.4",
 		"@types/sinonjs__fake-timers": "8.1.2",
 		"@types/tinycolor2": "1.4.3",
 		"@types/tmp": "0.2.3",
 		"@types/vary": "1.1.0",
-		"@types/web-push": "3.3.2",
+		"@types/web-push": "3.6.0",
 		"@types/ws": "8.5.5",
-		"@typescript-eslint/eslint-plugin": "6.2.0",
-		"@typescript-eslint/parser": "6.2.0",
+		"@typescript-eslint/eslint-plugin": "6.6.0",
+		"@typescript-eslint/parser": "6.6.0",
 		"aws-sdk-client-mock": "3.0.0",
 		"cross-env": "7.0.3",
-		"eslint": "8.46.0",
-		"eslint-plugin-import": "2.28.0",
-		"execa": "7.2.0",
-		"jest": "29.6.2",
-		"jest-mock": "29.6.2",
+		"eslint": "8.48.0",
+		"eslint-plugin-import": "2.28.1",
+		"execa": "8.0.1",
+		"jest": "29.6.4",
+		"jest-mock": "29.6.3",
 		"simple-oauth2": "5.0.0"
 	}
 }
--- a/packages/backend/src/boot/common.ts
+++ b/packages/backend/src/boot/common.ts
@@ -8,7 +8,6 @@ import { ChartManagementService } from '@/core/chart/ChartManagementService.js';
 import { QueueProcessorService } from '@/queue/QueueProcessorService.js';
 import { NestLogger } from '@/NestLogger.js';
 import { QueueProcessorModule } from '@/queue/QueueProcessorModule.js';
-import { JanitorService } from '@/daemons/JanitorService.js';
 import { QueueStatsService } from '@/daemons/QueueStatsService.js';
 import { ServerStatsService } from '@/daemons/ServerStatsService.js';
 import { ServerService } from '@/server/ServerService.js';
@@ -25,7 +24,6 @@ export async function server() {

 	if (process.env.NODE_ENV !== 'test') {
 		app.get(ChartManagementService).start();
-		app.get(JanitorService).start();
 		app.get(QueueStatsService).start();
 		app.get(ServerStatsService).start();
 	}
--- a/packages/backend/src/config.ts
+++ b/packages/backend/src/config.ts
@@ -3,10 +3,6 @@
 * SPDX-License-Identifier: AGPL-3.0-only
 */

-/**
- * Config loader
- */
-
 import * as fs from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, resolve } from 'node:path';
@@ -23,11 +19,9 @@ type RedisOptionsSource = Partial<RedisOptions> & {
 };

 /**
- * ユーザーが設定する必要のある情報
+ * 設定ファイルの型
 */
-export type Source = {
-	repository_url?: string;
-	feedback_url?: string;
+type Source = {
 	url: string;
 	port?: number;
 	socket?: string;
@@ -70,8 +64,6 @@ export type Source = {

 	maxFileSize?: number;

-	accesslog?: string;
-
 	clusterLimit?: number;

 	id: string;
@@ -94,12 +86,63 @@ export type Source = {

 	signToActivityPubGet?: boolean;
 	outboxNotesFetchLimit?: number;
+
+	perChannelMaxNoteCacheCount?: number;
+	perUserNotificationsMaxCount?: number;
+	deactivateAntennaThreshold?: number;
 };

-/**
- * Misskeyが自動的に(ユーザーが設定した情報から推論して)設定する情報
- */
-export type Mixin = {
+export type Config = {
+	url: string;
+	port: number;
+	socket: string | undefined;
+	chmodSocket: string | undefined;
+	disableHsts: boolean | undefined;
+	db: {
+		host: string;
+		port: number;
+		db: string;
+		user: string;
+		pass: string;
+		disableCache?: boolean;
+		extra?: { [x: string]: string };
+	};
+	dbReplications: boolean | undefined;
+	dbSlaves: {
+		host: string;
+		port: number;
+		db: string;
+		user: string;
+		pass: string;
+	}[] | undefined;
+	meilisearch: {
+		host: string;
+		port: string;
+		apiKey: string;
+		ssl?: boolean;
+		index: string;
+		scope?: 'local' | 'global' | string[];
+	} | undefined;
+	proxy: string | undefined;
+	proxySmtp: string | undefined;
+	proxyBypassHosts: string[] | undefined;
+	allowedPrivateNetworks: string[] | undefined;
+	maxFileSize: number | undefined;
+	clusterLimit: number | undefined;
+	id: string;
+	outgoingAddress: string | undefined;
+	outgoingAddressFamily: 'ipv4' | 'ipv6' | 'dual' | undefined;
+	deliverJobConcurrency: number | undefined;
+	inboxJobConcurrency: number | undefined;
+	relashionshipJobConcurrency: number | undefined;
+	deliverJobPerSec: number | undefined;
+	inboxJobPerSec: number | undefined;
+	relashionshipJobPerSec: number | undefined;
+	deliverJobMaxAttempts: number | undefined;
+	inboxJobMaxAttempts: number | undefined;
+	proxyRemoteFiles: boolean | undefined;
+	signToActivityPubGet: boolean | undefined;
+
 	version: string;
 	host: string;
 	hostname: string;
@@ -118,10 +161,11 @@ export type Mixin = {
 	redis: RedisOptions & RedisOptionsSource;
 	redisForPubsub: RedisOptions & RedisOptionsSource;
 	redisForJobQueue: RedisOptions & RedisOptionsSource;
+	perChannelMaxNoteCacheCount: number;
+	perUserNotificationsMaxCount: number;
+	deactivateAntennaThreshold: number;
 };

-export type Config = Source & Mixin;
-
 const _filename = fileURLToPath(import.meta.url);
 const _dirname = dirname(_filename);

@@ -139,7 +183,7 @@ const path = process.env.MISSKEY_CONFIG_YML
 		? resolve(dir, 'test.yml')
 		: resolve(dir, 'default.yml');

-export function loadConfig() {
+export function loadConfig(): Config {
 	const meta = JSON.parse(fs.readFileSync(`${_dirname}/../../../built/meta.json`, 'utf-8'));
 	const clientManifestExists = fs.existsSync(_dirname + '/../../../built/_vite_/manifest.json');
 	const clientManifest = clientManifestExists ?
@@ -147,43 +191,72 @@ export function loadConfig() {
 		: { 'src/_boot_.ts': { file: 'src/_boot_.ts' } };
 	const config = yaml.load(fs.readFileSync(path, 'utf-8')) as Source;

-	const mixin = {} as Mixin;
-
 	const url = tryCreateUrl(config.url);
-
-	config.url = url.origin;
-
-	config.port = config.port ?? parseInt(process.env.PORT ?? '', 10);
-
-	mixin.version = meta.version;
-	mixin.host = url.host;
-	mixin.hostname = url.hostname;
-	mixin.scheme = url.protocol.replace(/:$/, '');
-	mixin.wsScheme = mixin.scheme.replace('http', 'ws');
-	mixin.wsUrl = `${mixin.wsScheme}://${mixin.host}`;
-	mixin.apiUrl = `${mixin.scheme}://${mixin.host}/api`;
-	mixin.authUrl = `${mixin.scheme}://${mixin.host}/auth`;
-	mixin.driveUrl = `${mixin.scheme}://${mixin.host}/files`;
-	mixin.userAgent = `Misskey/${meta.version} (${config.url})`;
-	mixin.clientEntry = clientManifest['src/_boot_.ts'];
-	mixin.clientManifestExists = clientManifestExists;
+	const version = meta.version;
+	const host = url.host;
+	const hostname = url.hostname;
+	const scheme = url.protocol.replace(/:$/, '');
+	const wsScheme = scheme.replace('http', 'ws');

 	const externalMediaProxy = config.mediaProxy ?
 		config.mediaProxy.endsWith('/') ? config.mediaProxy.substring(0, config.mediaProxy.length - 1) : config.mediaProxy
 		: null;
-	const internalMediaProxy = `${mixin.scheme}://${mixin.host}/proxy`;
-	mixin.mediaProxy = externalMediaProxy ?? internalMediaProxy;
-	mixin.externalMediaProxyEnabled = externalMediaProxy !== null && externalMediaProxy !== internalMediaProxy;
+	const internalMediaProxy = `${scheme}://${host}/proxy`;
+	const redis = convertRedisOptions(config.redis, host);

-	mixin.videoThumbnailGenerator = config.videoThumbnailGenerator ?
-		config.videoThumbnailGenerator.endsWith('/') ? config.videoThumbnailGenerator.substring(0, config.videoThumbnailGenerator.length - 1) : config.videoThumbnailGenerator
-		: null;
-
-	mixin.redis = convertRedisOptions(config.redis, mixin.host);
-	mixin.redisForPubsub = config.redisForPubsub ? convertRedisOptions(config.redisForPubsub, mixin.host) : mixin.redis;
-	mixin.redisForJobQueue = config.redisForJobQueue ? convertRedisOptions(config.redisForJobQueue, mixin.host) : mixin.redis;
-
-	return Object.assign(config, mixin);
+	return {
+		version,
+		url: url.origin,
+		port: config.port ?? parseInt(process.env.PORT ?? '', 10),
+		socket: config.socket,
+		chmodSocket: config.chmodSocket,
+		disableHsts: config.disableHsts,
+		host,
+		hostname,
+		scheme,
+		wsScheme,
+		wsUrl: `${wsScheme}://${host}`,
+		apiUrl: `${scheme}://${host}/api`,
+		authUrl: `${scheme}://${host}/auth`,
+		driveUrl: `${scheme}://${host}/files`,
+		db: config.db,
+		dbReplications: config.dbReplications,
+		dbSlaves: config.dbSlaves,
+		meilisearch: config.meilisearch,
+		redis,
+		redisForPubsub: config.redisForPubsub ? convertRedisOptions(config.redisForPubsub, host) : redis,
+		redisForJobQueue: config.redisForJobQueue ? convertRedisOptions(config.redisForJobQueue, host) : redis,
+		id: config.id,
+		proxy: config.proxy,
+		proxySmtp: config.proxySmtp,
+		proxyBypassHosts: config.proxyBypassHosts,
+		allowedPrivateNetworks: config.allowedPrivateNetworks,
+		maxFileSize: config.maxFileSize,
+		clusterLimit: config.clusterLimit,
+		outgoingAddress: config.outgoingAddress,
+		outgoingAddressFamily: config.outgoingAddressFamily,
+		deliverJobConcurrency: config.deliverJobConcurrency,
+		inboxJobConcurrency: config.inboxJobConcurrency,
+		relashionshipJobConcurrency: config.relashionshipJobConcurrency,
+		deliverJobPerSec: config.deliverJobPerSec,
+		inboxJobPerSec: config.inboxJobPerSec,
+		relashionshipJobPerSec: config.relashionshipJobPerSec,
+		deliverJobMaxAttempts: config.deliverJobMaxAttempts,
+		inboxJobMaxAttempts: config.inboxJobMaxAttempts,
+		proxyRemoteFiles: config.proxyRemoteFiles,
+		signToActivityPubGet: config.signToActivityPubGet,
+		mediaProxy: externalMediaProxy ?? internalMediaProxy,
+		externalMediaProxyEnabled: externalMediaProxy !== null && externalMediaProxy !== internalMediaProxy,
+		videoThumbnailGenerator: config.videoThumbnailGenerator ?
+			config.videoThumbnailGenerator.endsWith('/') ? config.videoThumbnailGenerator.substring(0, config.videoThumbnailGenerator.length - 1) : config.videoThumbnailGenerator
+			: null,
+		userAgent: `Misskey/${version} (${config.url})`,
+		clientEntry: clientManifest['src/_boot_.ts'],
+		clientManifestExists: clientManifestExists,
+		perChannelMaxNoteCacheCount: config.perChannelMaxNoteCacheCount ?? 1000,
+		perUserNotificationsMaxCount: config.perUserNotificationsMaxCount ?? 300,
+		deactivateAntennaThreshold: config.deactivateAntennaThreshold ?? (1000 * 60 * 60 * 24 * 7),
+	};
 }

 function tryCreateUrl(url: string) {
--- a/packages/backend/src/core/CoreModule.ts
+++ b/packages/backend/src/core/CoreModule.ts
@@ -43,7 +43,7 @@ import { RelayService } from './RelayService.js';
 import { RoleService } from './RoleService.js';
 import { S3Service } from './S3Service.js';
 import { SignupService } from './SignupService.js';
-import { TwoFactorAuthenticationService } from './TwoFactorAuthenticationService.js';
+import { WebAuthnService } from './WebAuthnService.js';
 import { UserBlockingService } from './UserBlockingService.js';
 import { CacheService } from './CacheService.js';
 import { UserFollowingService } from './UserFollowingService.js';
@@ -168,7 +168,7 @@ const $RelayService: Provider = { provide: 'RelayService', useExisting: RelaySer
 const $RoleService: Provider = { provide: 'RoleService', useExisting: RoleService };
 const $S3Service: Provider = { provide: 'S3Service', useExisting: S3Service };
 const $SignupService: Provider = { provide: 'SignupService', useExisting: SignupService };
-const $TwoFactorAuthenticationService: Provider = { provide: 'TwoFactorAuthenticationService', useExisting: TwoFactorAuthenticationService };
+const $WebAuthnService: Provider = { provide: 'WebAuthnService', useExisting: WebAuthnService };
 const $UserBlockingService: Provider = { provide: 'UserBlockingService', useExisting: UserBlockingService };
 const $CacheService: Provider = { provide: 'CacheService', useExisting: CacheService };
 const $UserFollowingService: Provider = { provide: 'UserFollowingService', useExisting: UserFollowingService };
@@ -296,7 +296,7 @@ const $ApQuestionService: Provider = { provide: 'ApQuestionService', useExisting
 		RoleService,
 		S3Service,
 		SignupService,
-		TwoFactorAuthenticationService,
+		WebAuthnService,
 		UserBlockingService,
 		CacheService,
 		UserFollowingService,
@@ -417,7 +417,7 @@ const $ApQuestionService: Provider = { provide: 'ApQuestionService', useExisting
 		$RoleService,
 		$S3Service,
 		$SignupService,
-		$TwoFactorAuthenticationService,
+		$WebAuthnService,
 		$UserBlockingService,
 		$CacheService,
 		$UserFollowingService,
@@ -539,7 +539,7 @@ const $ApQuestionService: Provider = { provide: 'ApQuestionService', useExisting
 		RoleService,
 		S3Service,
 		SignupService,
-		TwoFactorAuthenticationService,
+		WebAuthnService,
 		UserBlockingService,
 		CacheService,
 		UserFollowingService,
@@ -659,7 +659,7 @@ const $ApQuestionService: Provider = { provide: 'ApQuestionService', useExisting
 		$RoleService,
 		$S3Service,
 		$SignupService,
-		$TwoFactorAuthenticationService,
+		$WebAuthnService,
 		$UserBlockingService,
 		$CacheService,
 		$UserFollowingService,
--- a/packages/backend/src/core/IdService.ts
+++ b/packages/backend/src/core/IdService.ts
@@ -8,6 +8,7 @@ import { ulid } from 'ulid';
 import { DI } from '@/di-symbols.js';
 import type { Config } from '@/config.js';
 import { genAid, parseAid } from '@/misc/id/aid.js';
+import { genAidx, parseAidx } from '@/misc/id/aidx.js';
 import { genMeid, parseMeid } from '@/misc/id/meid.js';
 import { genMeidg, parseMeidg } from '@/misc/id/meidg.js';
 import { genObjectId, parseObjectId } from '@/misc/id/object-id.js';
@@ -31,6 +32,7 @@ export class IdService {

 		switch (this.method) {
 			case 'aid': return genAid(date);
+			case 'aidx': return genAidx(date);
 			case 'meid': return genMeid(date);
 			case 'meidg': return genMeidg(date);
 			case 'ulid': return ulid(date.getTime());
@@ -43,6 +45,7 @@ export class IdService {
 	public parse(id: string): { date: Date; } {
 		switch (this.method) {
 			case 'aid': return parseAid(id);
+			case 'aidx': return parseAidx(id);
 			case 'objectid': return parseObjectId(id);
 			case 'meid': return parseMeid(id);
 			case 'meidg': return parseMeidg(id);
--- a/packages/backend/src/core/MetaService.ts
+++ b/packages/backend/src/core/MetaService.ts
@@ -16,7 +16,7 @@ import type { OnApplicationShutdown } from '@nestjs/common';
@Injectable()
 export class MetaService implements OnApplicationShutdown {
 	private cache: MiMeta | undefined;
-	private intervalId: NodeJS.Timer;
+	private intervalId: NodeJS.Timeout;

 	constructor(
 		@Inject(DI.redisForSub)
--- a/packages/backend/src/core/NoteCreateService.ts
+++ b/packages/backend/src/core/NoteCreateService.ts
@@ -334,7 +334,7 @@ export class NoteCreateService implements OnApplicationShutdown {
 		if (data.channel) {
 			this.redisClient.xadd(
 				`channelTimeline:${data.channel.id}`,
-				'MAXLEN', '~', '1000',
+				'MAXLEN', '~', this.config.perChannelMaxNoteCacheCount.toString(),
 				'*',
 				'note', note.id);
 		}
--- a/packages/backend/src/core/NotificationService.ts
+++ b/packages/backend/src/core/NotificationService.ts
@@ -17,12 +17,16 @@ import { PushNotificationService } from '@/core/PushNotificationService.js';
 import { NotificationEntityService } from '@/core/entities/NotificationEntityService.js';
 import { IdService } from '@/core/IdService.js';
 import { CacheService } from '@/core/CacheService.js';
+import type { Config } from '@/config.js';

@Injectable()
 export class NotificationService implements OnApplicationShutdown {
 	#shutdownController = new AbortController();

 	constructor(
+		@Inject(DI.config)
+		private config: Config,
+
 		@Inject(DI.redis)
 		private redisClient: Redis.Redis,

@@ -96,7 +100,7 @@ export class NotificationService implements OnApplicationShutdown {

 		const redisIdPromise = this.redisClient.xadd(
 			`notificationTimeline:${notifieeId}`,
-			'MAXLEN', '~', '300',
+			'MAXLEN', '~', this.config.perUserNotificationsMaxCount.toString(),
 			'*',
 			'data', JSON.stringify(notification));

--- a/packages/backend/src/core/TwoFactorAuthenticationService.ts
+++ b/packages/backend/src/core/TwoFactorAuthenticationService.ts
@@ -1,446 +0,0 @@
-/*
- * SPDX-FileCopyrightText: syuilo and other misskey contributors
- * SPDX-License-Identifier: AGPL-3.0-only
- */
-
-import * as crypto from 'node:crypto';
-import { Inject, Injectable } from '@nestjs/common';
-import * as jsrsasign from 'jsrsasign';
-import { DI } from '@/di-symbols.js';
-import type { Config } from '@/config.js';
-import { bindThis } from '@/decorators.js';
-
-const ECC_PRELUDE = Buffer.from([0x04]);
-const NULL_BYTE = Buffer.from([0]);
-const PEM_PRELUDE = Buffer.from(
-	'3059301306072a8648ce3d020106082a8648ce3d030107034200',
-	'hex',
-);
-
-// Android Safetynet attestations are signed with this cert:
-const GSR2 = `-----BEGIN CERTIFICATE-----
-MIIDujCCAqKgAwIBAgILBAAAAAABD4Ym5g0wDQYJKoZIhvcNAQEFBQAwTDEgMB4G
-A1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjIxEzARBgNVBAoTCkdsb2JhbFNp
-Z24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDYxMjE1MDgwMDAwWhcNMjExMjE1
-MDgwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMjETMBEG
-A1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZI
-hvcNAQEBBQADggEPADCCAQoCggEBAKbPJA6+Lm8omUVCxKs+IVSbC9N/hHD6ErPL
-v4dfxn+G07IwXNb9rfF73OX4YJYJkhD10FPe+3t+c4isUoh7SqbKSaZeqKeMWhG8
-eoLrvozps6yWJQeXSpkqBy+0Hne/ig+1AnwblrjFuTosvNYSuetZfeLQBoZfXklq
-tTleiDTsvHgMCJiEbKjNS7SgfQx5TfC4LcshytVsW33hoCmEofnTlEnLJGKRILzd
-C9XZzPnqJworc5HGnRusyMvo4KD0L5CLTfuwNhv2GXqF4G3yYROIXJ/gkwpRl4pa
-zq+r1feqCapgvdzZX99yqWATXgAByUr6P6TqBwMhAo6CygPCm48CAwEAAaOBnDCB
-mTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUm+IH
-V2ccHsBqBt5ZtJot39wZhi4wNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5n
-bG9iYWxzaWduLm5ldC9yb290LXIyLmNybDAfBgNVHSMEGDAWgBSb4gdXZxwewGoG
-3lm0mi3f3BmGLjANBgkqhkiG9w0BAQUFAAOCAQEAmYFThxxol4aR7OBKuEQLq4Gs
-J0/WwbgcQ3izDJr86iw8bmEbTUsp9Z8FHSbBuOmDAGJFtqkIk7mpM0sYmsL4h4hO
-291xNBrBVNpGP+DTKqttVCL1OmLNIG+6KYnX3ZHu01yiPqFbQfXf5WRDLenVOavS
-ot+3i9DAgBkcRcAtjOj4LaR0VknFBbVPFd5uRHg5h6h+u/N5GJG79G+dwfCMNYxd
-AfvDbbnvRG15RjF+Cv6pgsH/76tuIMRQyV+dTZsXjAzlAcmgQWpzU/qlULRuJQ/7
-TBj0/VLZjmmx6BEP3ojY+x1J96relc8geMJgEtslQIxq/H5COEBkEveegeGTLg==
-----END CERTIFICATE-----\n`;
-
-function base64URLDecode(source: string) {
-	return Buffer.from(source.replace(/\-/g, '+').replace(/_/g, '/'), 'base64');
-}
-
-function getCertSubject(certificate: string) {
-	const subjectCert = new jsrsasign.X509();
-	subjectCert.readCertPEM(certificate);
-
-	const subjectString = subjectCert.getSubjectString();
-	const subjectFields = subjectString.slice(1).split('/');
-
-	const fields = {} as Record<string, string>;
-	for (const field of subjectFields) {
-		const eqIndex = field.indexOf('=');
-		fields[field.substring(0, eqIndex)] = field.substring(eqIndex + 1);
-	}
-
-	return fields;
-}
-
-function verifyCertificateChain(certificates: string[]) {
-	let valid = true;
-
-	for (let i = 0; i < certificates.length; i++) {
-		const Cert = certificates[i];
-		const certificate = new jsrsasign.X509();
-		certificate.readCertPEM(Cert);
-
-		const CACert = i + 1 >= certificates.length ? Cert : certificates[i + 1];
-
-		const certStruct = jsrsasign.ASN1HEX.getTLVbyList(certificate.hex!, 0, [0]);
-		if (certStruct == null) throw new Error('certStruct is null');
-
-		const algorithm = certificate.getSignatureAlgorithmField();
-		const signatureHex = certificate.getSignatureValueHex();
-
-		// Verify against CA
-		const Signature = new jsrsasign.KJUR.crypto.Signature({ alg: algorithm });
-		Signature.init(CACert);
-		Signature.updateHex(certStruct);
-		valid = valid && !!Signature.verify(signatureHex); // true if CA signed the certificate
-	}
-
-	return valid;
-}
-
-function PEMString(pemBuffer: Buffer, type = 'CERTIFICATE') {
-	if (pemBuffer.length === 65 && pemBuffer[0] === 0x04) {
-		pemBuffer = Buffer.concat([PEM_PRELUDE, pemBuffer], 91);
-		type = 'PUBLIC KEY';
-	}
-	const cert = pemBuffer.toString('base64');
-
-	const keyParts = [];
-	const max = Math.ceil(cert.length / 64);
-	let start = 0;
-	for (let i = 0; i < max; i++) {
-		keyParts.push(cert.substring(start, start + 64));
-		start += 64;
-	}
-
-	return (
-		`-----BEGIN ${type}-----\n` +
-		keyParts.join('\n') +
-		`\n-----END ${type}-----\n`
-	);
-}
-
-@Injectable()
-export class TwoFactorAuthenticationService {
-	constructor(
-		@Inject(DI.config)
-		private config: Config,
-	) {
-	}
-
-	@bindThis
-	public hash(data: Buffer) {
-		return crypto
-			.createHash('sha256')
-			.update(data)
-			.digest();
-	}
-
-	@bindThis
-	public verifySignin({
-		publicKey,
-		authenticatorData,
-		clientDataJSON,
-		clientData,
-		signature,
-		challenge,
-	}: {
-		publicKey: Buffer,
-		authenticatorData: Buffer,
-		clientDataJSON: Buffer,
-		clientData: any,
-		signature: Buffer,
-		challenge: string
-	}) {
-		if (clientData.type !== 'webauthn.get') {
-			throw new Error('type is not webauthn.get');
-		}
-
-		if (this.hash(clientData.challenge).toString('hex') !== challenge) {
-			throw new Error('challenge mismatch');
-		}
-		if (clientData.origin !== this.config.scheme + '://' + this.config.host) {
-			throw new Error('origin mismatch');
-		}
-
-		const verificationData = Buffer.concat(
-			[authenticatorData, this.hash(clientDataJSON)],
-			32 + authenticatorData.length,
-		);
-
-		return crypto
-			.createVerify('SHA256')
-			.update(verificationData)
-			.verify(PEMString(publicKey), signature);
-	}
-
-	@bindThis
-	public getProcedures() {
-		return {
-			none: {
-				verify({ publicKey }: { publicKey: Map<number, Buffer> }) {
-					const negTwo = publicKey.get(-2);
-
-					if (!negTwo || negTwo.length !== 32) {
-						throw new Error('invalid or no -2 key given');
-					}
-					const negThree = publicKey.get(-3);
-					if (!negThree || negThree.length !== 32) {
-						throw new Error('invalid or no -3 key given');
-					}
-
-					const publicKeyU2F = Buffer.concat(
-						[ECC_PRELUDE, negTwo, negThree],
-						1 + 32 + 32,
-					);
-
-					return {
-						publicKey: publicKeyU2F,
-						valid: true,
-					};
-				},
-			},
-			'android-key': {
-				verify({
-					attStmt,
-					authenticatorData,
-					clientDataHash,
-					publicKey,
-					rpIdHash,
-					credentialId,
-				}: {
-					attStmt: any,
-					authenticatorData: Buffer,
-					clientDataHash: Buffer,
-					publicKey: Map<number, any>;
-					rpIdHash: Buffer,
-					credentialId: Buffer,
-				}) {
-					if (attStmt.alg !== -7) {
-						throw new Error('alg mismatch');
-					}
-
-					const verificationData = Buffer.concat([
-						authenticatorData,
-						clientDataHash,
-					]);
-
-					const attCert: Buffer = attStmt.x5c[0];
-
-					const negTwo = publicKey.get(-2);
-
-					if (!negTwo || negTwo.length !== 32) {
-						throw new Error('invalid or no -2 key given');
-					}
-					const negThree = publicKey.get(-3);
-					if (!negThree || negThree.length !== 32) {
-						throw new Error('invalid or no -3 key given');
-					}
-
-					const publicKeyData = Buffer.concat(
-						[ECC_PRELUDE, negTwo, negThree],
-						1 + 32 + 32,
-					);
-
-					if (!attCert.equals(publicKeyData)) {
-						throw new Error('public key mismatch');
-					}
-
-					const isValid = crypto
-						.createVerify('SHA256')
-						.update(verificationData)
-						.verify(PEMString(attCert), attStmt.sig);
-
-					// TODO: Check 'attestationChallenge' field in extension of cert matches hash(clientDataJSON)
-
-					return {
-						valid: isValid,
-						publicKey: publicKeyData,
-					};
-				},
-			},
-			// what a stupid attestation
-			'android-safetynet': {
-				verify: ({
-					attStmt,
-					authenticatorData,
-					clientDataHash,
-					publicKey,
-					rpIdHash,
-					credentialId,
-				}: {
-					attStmt: any,
-					authenticatorData: Buffer,
-					clientDataHash: Buffer,
-					publicKey: Map<number, any>;
-					rpIdHash: Buffer,
-					credentialId: Buffer,
-				}) => {
-					const verificationData = this.hash(
-						Buffer.concat([authenticatorData, clientDataHash]),
-					);
-
-					const jwsParts = attStmt.response.toString('utf-8').split('.');
-
-					const header = JSON.parse(base64URLDecode(jwsParts[0]).toString('utf-8'));
-					const response = JSON.parse(
-						base64URLDecode(jwsParts[1]).toString('utf-8'),
-					);
-					const signature = jwsParts[2];
-
-					if (!verificationData.equals(Buffer.from(response.nonce, 'base64'))) {
-						throw new Error('invalid nonce');
-					}
-
-					const certificateChain = header.x5c
-						.map((key: any) => PEMString(key))
-						.concat([GSR2]);
-
-					if (getCertSubject(certificateChain[0]).CN !== 'attest.android.com') {
-						throw new Error('invalid common name');
-					}
-
-					if (!verifyCertificateChain(certificateChain)) {
-						throw new Error('Invalid certificate chain!');
-					}
-
-					const signatureBase = Buffer.from(
-						jwsParts[0] + '.' + jwsParts[1],
-						'utf-8',
-					);
-
-					const valid = crypto
-						.createVerify('sha256')
-						.update(signatureBase)
-						.verify(certificateChain[0], base64URLDecode(signature));
-
-					const negTwo = publicKey.get(-2);
-
-					if (!negTwo || negTwo.length !== 32) {
-						throw new Error('invalid or no -2 key given');
-					}
-					const negThree = publicKey.get(-3);
-					if (!negThree || negThree.length !== 32) {
-						throw new Error('invalid or no -3 key given');
-					}
-
-					const publicKeyData = Buffer.concat(
-						[ECC_PRELUDE, negTwo, negThree],
-						1 + 32 + 32,
-					);
-					return {
-						valid,
-						publicKey: publicKeyData,
-					};
-				},
-			},
-			packed: {
-				verify({
-					attStmt,
-					authenticatorData,
-					clientDataHash,
-					publicKey,
-					rpIdHash,
-					credentialId,
-				}: {
-					attStmt: any,
-					authenticatorData: Buffer,
-					clientDataHash: Buffer,
-					publicKey: Map<number, any>;
-					rpIdHash: Buffer,
-					credentialId: Buffer,
-				}) {
-					const verificationData = Buffer.concat([
-						authenticatorData,
-						clientDataHash,
-					]);
-
-					if (attStmt.x5c) {
-						const attCert = attStmt.x5c[0];
-
-						const validSignature = crypto
-							.createVerify('SHA256')
-							.update(verificationData)
-							.verify(PEMString(attCert), attStmt.sig);
-
-						const negTwo = publicKey.get(-2);
-
-						if (!negTwo || negTwo.length !== 32) {
-							throw new Error('invalid or no -2 key given');
-						}
-						const negThree = publicKey.get(-3);
-						if (!negThree || negThree.length !== 32) {
-							throw new Error('invalid or no -3 key given');
-						}
-
-						const publicKeyData = Buffer.concat(
-							[ECC_PRELUDE, negTwo, negThree],
-							1 + 32 + 32,
-						);
-
-						return {
-							valid: validSignature,
-							publicKey: publicKeyData,
-						};
-					} else if (attStmt.ecdaaKeyId) {
-						// https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html#ecdaa-verify-operation
-						throw new Error('ECDAA-Verify is not supported');
-					} else {
-						if (attStmt.alg !== -7) throw new Error('alg mismatch');
-
-						throw new Error('self attestation is not supported');
-					}
-				},
-			},
-
-			'fido-u2f': {
-				verify({
-					attStmt,
-					authenticatorData,
-					clientDataHash,
-					publicKey,
-					rpIdHash,
-					credentialId,
-				}: {
-					attStmt: any,
-					authenticatorData: Buffer,
-					clientDataHash: Buffer,
-					publicKey: Map<number, any>,
-					rpIdHash: Buffer,
-					credentialId: Buffer
-				}) {
-					const x5c: Buffer[] = attStmt.x5c;
-					if (x5c.length !== 1) {
-						throw new Error('x5c length does not match expectation');
-					}
-
-					const attCert = x5c[0];
-
-					// TODO: make sure attCert is an Elliptic Curve (EC) public key over the P-256 curve
-
-					const negTwo: Buffer = publicKey.get(-2);
-
-					if (!negTwo || negTwo.length !== 32) {
-						throw new Error('invalid or no -2 key given');
-					}
-					const negThree: Buffer = publicKey.get(-3);
-					if (!negThree || negThree.length !== 32) {
-						throw new Error('invalid or no -3 key given');
-					}
-
-					const publicKeyU2F = Buffer.concat(
-						[ECC_PRELUDE, negTwo, negThree],
-						1 + 32 + 32,
-					);
-
-					const verificationData = Buffer.concat([
-						NULL_BYTE,
-						rpIdHash,
-						clientDataHash,
-						credentialId,
-						publicKeyU2F,
-					]);
-
-					const validSignature = crypto
-						.createVerify('SHA256')
-						.update(verificationData)
-						.verify(PEMString(attCert), attStmt.sig);
-
-					return {
-						valid: validSignature,
-						publicKey: publicKeyU2F,
-					};
-				},
-			},
-		};
-	}
-}
--- a/packages/backend/src/core/WebAuthnService.ts
+++ b/packages/backend/src/core/WebAuthnService.ts
@@ -0,0 +1,252 @@
+/*
+ * SPDX-FileCopyrightText: syuilo and other misskey contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+import { Inject, Injectable } from '@nestjs/common';
+import * as Redis from 'ioredis';
+import {
+	generateAuthenticationOptions,
+	generateRegistrationOptions, verifyAuthenticationResponse,
+	verifyRegistrationResponse,
+} from '@simplewebauthn/server';
+import { AttestationFormat, isoCBOR } from '@simplewebauthn/server/helpers';
+import { DI } from '@/di-symbols.js';
+import type { UserSecurityKeysRepository } from '@/models/index.js';
+import type { Config } from '@/config.js';
+import { bindThis } from '@/decorators.js';
+import { MetaService } from '@/core/MetaService.js';
+import { MiUser } from '@/models/index.js';
+import { IdentifiableError } from '@/misc/identifiable-error.js';
+import type {
+	AuthenticationResponseJSON,
+	AuthenticatorTransportFuture,
+	CredentialDeviceType,
+	PublicKeyCredentialCreationOptionsJSON,
+	PublicKeyCredentialDescriptorFuture,
+	PublicKeyCredentialRequestOptionsJSON,
+	RegistrationResponseJSON,
+} from '@simplewebauthn/typescript-types';
+
+@Injectable()
+export class WebAuthnService {
+	constructor(
+		@Inject(DI.redis)
+		private redisClient: Redis.Redis,
+
+		@Inject(DI.config)
+		private config: Config,
+
+		@Inject(DI.userSecurityKeysRepository)
+		private userSecurityKeysRepository: UserSecurityKeysRepository,
+
+		private metaService: MetaService,
+	) {
+	}
+
+	@bindThis
+	public async getRelyingParty(): Promise<{ origin: string; rpId: string; rpName: string; rpIcon?: string; }> {
+		const instance = await this.metaService.fetch();
+		return {
+			origin: this.config.url,
+			rpId: this.config.host,
+			rpName: instance.name ?? this.config.host,
+			rpIcon: instance.iconUrl ?? undefined,
+		};
+	}
+
+	@bindThis
+	public async initiateRegistration(userId: MiUser['id'], userName: string, userDisplayName?: string): Promise<PublicKeyCredentialCreationOptionsJSON> {
+		const relyingParty = await this.getRelyingParty();
+		const keys = await this.userSecurityKeysRepository.findBy({
+			userId: userId,
+		});
+
+		const registrationOptions = await generateRegistrationOptions({
+			rpName: relyingParty.rpName,
+			rpID: relyingParty.rpId,
+			userID: userId,
+			userName: userName,
+			userDisplayName: userDisplayName,
+			attestationType: 'indirect',
+			excludeCredentials: keys.map(key => (<PublicKeyCredentialDescriptorFuture>{
+				id: Buffer.from(key.id, 'base64url'),
+				type: 'public-key',
+				transports: key.transports ?? undefined,
+			})),
+			authenticatorSelection: {
+				residentKey: 'required',
+				userVerification: 'preferred',
+			},
+		});
+
+		await this.redisClient.setex(`webauthn:challenge:${userId}`, 90, registrationOptions.challenge);
+
+		return registrationOptions;
+	}
+
+	@bindThis
+	public async verifyRegistration(userId: MiUser['id'], response: RegistrationResponseJSON): Promise<{
+		credentialID: Uint8Array;
+		credentialPublicKey: Uint8Array;
+		attestationObject: Uint8Array;
+		fmt: AttestationFormat;
+		counter: number;
+		userVerified: boolean;
+		credentialDeviceType: CredentialDeviceType;
+		credentialBackedUp: boolean;
+		transports?: AuthenticatorTransportFuture[];
+	}> {
+		const challenge = await this.redisClient.get(`webauthn:challenge:${userId}`);
+
+		if (!challenge) {
+			throw new IdentifiableError('7dbfb66c-9216-4e2b-9c27-cef2ac8efb84', 'challenge not found');
+		}
+
+		await this.redisClient.del(`webauthn:challenge:${userId}`);
+
+		const relyingParty = await this.getRelyingParty();
+
+		let verification;
+		try {
+			verification = await verifyRegistrationResponse({
+				response: response,
+				expectedChallenge: challenge,
+				expectedOrigin: relyingParty.origin,
+				expectedRPID: relyingParty.rpId,
+				requireUserVerification: true,
+			});
+		} catch (error) {
+			console.error(error);
+			throw new IdentifiableError('5c1446f8-8ca7-4d31-9f39-656afe9c5d87', 'verification failed');
+		}
+
+		const { verified } = verification;
+
+		if (!verified || !verification.registrationInfo) {
+			throw new IdentifiableError('bb333667-3832-4a80-8bb5-c505be7d710d', 'verification failed');
+		}
+
+		const { registrationInfo } = verification;
+
+		return {
+			credentialID: registrationInfo.credentialID,
+			credentialPublicKey: registrationInfo.credentialPublicKey,
+			attestationObject: registrationInfo.attestationObject,
+			fmt: registrationInfo.fmt,
+			counter: registrationInfo.counter,
+			userVerified: registrationInfo.userVerified,
+			credentialDeviceType: registrationInfo.credentialDeviceType,
+			credentialBackedUp: registrationInfo.credentialBackedUp,
+			transports: response.response.transports,
+		};
+	}
+
+	@bindThis
+	public async initiateAuthentication(userId: MiUser['id']): Promise<PublicKeyCredentialRequestOptionsJSON> {
+		const keys = await this.userSecurityKeysRepository.findBy({
+			userId: userId,
+		});
+
+		if (keys.length === 0) {
+			throw new IdentifiableError('f27fd449-9af4-4841-9249-1f989b9fa4a4', 'no keys found');
+		}
+
+		const authenticationOptions = await generateAuthenticationOptions({
+			allowCredentials: keys.map(key => (<PublicKeyCredentialDescriptorFuture>{
+				id: Buffer.from(key.id, 'base64url'),
+				type: 'public-key',
+				transports: key.transports ?? undefined,
+			})),
+			userVerification: 'preferred',
+		});
+
+		await this.redisClient.setex(`webauthn:challenge:${userId}`, 90, authenticationOptions.challenge);
+
+		return authenticationOptions;
+	}
+
+	@bindThis
+	public async verifyAuthentication(userId: MiUser['id'], response: AuthenticationResponseJSON): Promise<boolean> {
+		const challenge = await this.redisClient.get(`webauthn:challenge:${userId}`);
+
+		if (!challenge) {
+			throw new IdentifiableError('2d16e51c-007b-4edd-afd2-f7dd02c947f6', 'challenge not found');
+		}
+
+		await this.redisClient.del(`webauthn:challenge:${userId}`);
+
+		const key = await this.userSecurityKeysRepository.findOneBy({
+			id: response.id,
+			userId: userId,
+		});
+
+		if (!key) {
+			throw new IdentifiableError('36b96a7d-b547-412d-aeed-2d611cdc8cdc', 'unknown key');
+		}
+
+		// マイグレーション
+		if (key.counter === 0 && key.publicKey.length === 87) {
+			const cert = new Uint8Array(Buffer.from(key.publicKey, 'base64url'));
+			if (cert[0] === 0x04) { // 前の実装ではいつも 0x04 で始まっていた
+				const halfLength = (cert.length - 1) / 2;
+
+				const cborMap = new Map<number, number | ArrayBufferLike>();
+				cborMap.set(1, 2); // kty, EC2
+				cborMap.set(3, -7); // alg, ES256
+				cborMap.set(-1, 1); // crv, P256
+				cborMap.set(-2, cert.slice(1, halfLength + 1)); // x
+				cborMap.set(-3, cert.slice(halfLength + 1)); // y
+
+				const cborPubKey = Buffer.from(isoCBOR.encode(cborMap)).toString('base64url');
+				await this.userSecurityKeysRepository.update({
+					id: response.id,
+					userId: userId,
+				}, {
+					publicKey: cborPubKey,
+				});
+				key.publicKey = cborPubKey;
+			}
+		}
+
+		const relyingParty = await this.getRelyingParty();
+
+		let verification;
+		try {
+			verification = await verifyAuthenticationResponse({
+				response: response,
+				expectedChallenge: challenge,
+				expectedOrigin: relyingParty.origin,
+				expectedRPID: relyingParty.rpId,
+				authenticator: {
+					credentialID: Buffer.from(key.id, 'base64url'),
+					credentialPublicKey: Buffer.from(key.publicKey, 'base64url'),
+					counter: key.counter,
+					transports: key.transports ? key.transports as AuthenticatorTransportFuture[] : undefined,
+				},
+				requireUserVerification: true,
+			});
+		} catch (error) {
+			console.error(error);
+			throw new IdentifiableError('b18c89a7-5b5e-4cec-bb5b-0419f332d430', 'verification failed');
+		}
+
+		const { verified, authenticationInfo } = verification;
+
+		if (!verified) {
+			return false;
+		}
+
+		await this.userSecurityKeysRepository.update({
+			id: response.id,
+			userId: userId,
+		}, {
+			lastUsed: new Date(),
+			counter: authenticationInfo.newCounter,
+			credentialDeviceType: authenticationInfo.credentialDeviceType,
+			credentialBackedUp: authenticationInfo.credentialBackedUp,
+		});
+
+		return verified;
+	}
+}
--- a/packages/backend/src/core/chart/ChartManagementService.ts
+++ b/packages/backend/src/core/chart/ChartManagementService.ts
@@ -23,7 +23,7 @@ import type { OnApplicationShutdown } from '@nestjs/common';
@Injectable()
 export class ChartManagementService implements OnApplicationShutdown {
 	private charts;
-	private saveIntervalId: NodeJS.Timer;
+	private saveIntervalId: NodeJS.Timeout;

 	constructor(
 		private federationChart: FederationChart,
--- a/packages/backend/src/core/entities/UserEntityService.ts
+++ b/packages/backend/src/core/entities/UserEntityService.ts
@@ -434,6 +434,7 @@ export class UserEntityService implements OnModuleInit {
 				preventAiLearning: profile!.preventAiLearning,
 				isExplorable: user.isExplorable,
 				isDeleted: user.isDeleted,
+				twoFactorBackupCodesStock: profile?.twoFactorBackupSecret?.length === 5 ? 'full' : (profile?.twoFactorBackupSecret?.length ?? 0) > 0 ? 'partial' : 'none',
 				hideOnlineStatus: user.hideOnlineStatus,
 				hasUnreadSpecifiedNotes: this.noteUnreadsRepository.count({
 					where: { userId: user.id, isSpecified: true },
--- a/packages/backend/src/daemons/DaemonModule.ts
+++ b/packages/backend/src/daemons/DaemonModule.ts
@@ -6,7 +6,6 @@
 import { Module } from '@nestjs/common';
 import { CoreModule } from '@/core/CoreModule.js';
 import { GlobalModule } from '@/GlobalModule.js';
-import { JanitorService } from './JanitorService.js';
 import { QueueStatsService } from './QueueStatsService.js';
 import { ServerStatsService } from './ServerStatsService.js';

@@ -16,12 +15,10 @@ import { ServerStatsService } from './ServerStatsService.js';
 		CoreModule,
 	],
 	providers: [
-		JanitorService,
 		QueueStatsService,
 		ServerStatsService,
 	],
 	exports: [
-		JanitorService,
 		QueueStatsService,
 		ServerStatsService,
 	],
--- a/packages/backend/src/daemons/JanitorService.ts
+++ b/packages/backend/src/daemons/JanitorService.ts
@@ -1,50 +0,0 @@
-/*
- * SPDX-FileCopyrightText: syuilo and other misskey contributors
- * SPDX-License-Identifier: AGPL-3.0-only
- */
-
-import { Inject, Injectable } from '@nestjs/common';
-import { LessThan } from 'typeorm';
-import { DI } from '@/di-symbols.js';
-import type { AttestationChallengesRepository } from '@/models/index.js';
-import { bindThis } from '@/decorators.js';
-import type { OnApplicationShutdown } from '@nestjs/common';
-
-const interval = 30 * 60 * 1000;
-
-@Injectable()
-export class JanitorService implements OnApplicationShutdown {
-	private intervalId: NodeJS.Timer;
-
-	constructor(
-		@Inject(DI.attestationChallengesRepository)
-		private attestationChallengesRepository: AttestationChallengesRepository,
-	) {
-	}
-
-	/**
-	 * Clean up database occasionally
-	 */
-	@bindThis
-	public start(): void {
-		const tick = async () => {
-			await this.attestationChallengesRepository.delete({
-				createdAt: LessThan(new Date(new Date().getTime() - 5 * 60 * 1000)),
-			});
-		};
-
-		tick();
-
-		this.intervalId = setInterval(tick, interval);
-	}
-
-	@bindThis
-	public dispose(): void {
-		clearInterval(this.intervalId);
-	}
-
-	@bindThis
-	public onApplicationShutdown(signal?: string | undefined): void {
-		this.dispose();
-	}
-}
--- a/packages/backend/src/daemons/QueueStatsService.ts
+++ b/packages/backend/src/daemons/QueueStatsService.ts
@@ -19,7 +19,7 @@ const interval = 10000;

@Injectable()
 export class QueueStatsService implements OnApplicationShutdown {
-	private intervalId: NodeJS.Timer;
+	private intervalId: NodeJS.Timeout;

 	constructor(
 		@Inject(DI.config)
--- a/packages/backend/src/daemons/ServerStatsService.ts
+++ b/packages/backend/src/daemons/ServerStatsService.ts
@@ -20,7 +20,7 @@ const round = (num: number) => Math.round(num * 10) / 10;

@Injectable()
 export class ServerStatsService implements OnApplicationShutdown {
-	private intervalId: NodeJS.Timer | null = null;
+	private intervalId: NodeJS.Timeout | null = null;

 	constructor(
 		private metaService: MetaService,
--- a/packages/backend/src/di-symbols.ts
+++ b/packages/backend/src/di-symbols.ts
@@ -26,7 +26,6 @@ export const DI = {
 	userProfilesRepository: Symbol('userProfilesRepository'),
 	userKeypairsRepository: Symbol('userKeypairsRepository'),
 	userPendingsRepository: Symbol('userPendingsRepository'),
-	attestationChallengesRepository: Symbol('attestationChallengesRepository'),
 	userSecurityKeysRepository: Symbol('userSecurityKeysRepository'),
 	userPublickeysRepository: Symbol('userPublickeysRepository'),
 	userListsRepository: Symbol('userListsRepository'),
--- a/packages/backend/src/misc/cache.ts
+++ b/packages/backend/src/misc/cache.ts
@@ -193,7 +193,7 @@ function nothingToDo<T, V = T>(value: T): V {
 export class MemoryKVCache<T, V = T> {
 	public cache: Map<string, { date: number; value: V; }>;
 	private lifetime: number;
-	private gcIntervalHandle: NodeJS.Timer;
+	private gcIntervalHandle: NodeJS.Timeout;
 	private toMapConverter: (value: T) => V;
 	private fromMapConverter: (cached: V) => T | undefined;

--- a/packages/backend/src/misc/id/aidx.ts
+++ b/packages/backend/src/misc/id/aidx.ts
@@ -0,0 +1,44 @@
+/*
+ * SPDX-FileCopyrightText: syuilo and other misskey contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+// AIDX
+// 長さ8の[2000年1月1日からの経過ミリ秒をbase36でエンコードしたもの] + 長さ4の[個体ID] + 長さ4の[カウンタ]
+// (c) mei23
+// https://misskey.m544.net/notes/71899acdcc9859ec5708ac24
+
+import { customAlphabet } from 'nanoid';
+
+export const aidxRegExp = /^[0-9a-z]{16}$/;
+
+const TIME2000 = 946684800000;
+const TIME_LENGTH = 8;
+const NODE_LENGTH = 4;
+const NOISE_LENGTH = 4;
+
+const nodeId = customAlphabet('0123456789abcdefghijklmnopqrstuvwxyz', NODE_LENGTH)();
+let counter = 0;
+
+function getTime(time: number): string {
+	time = time - TIME2000;
+	if (time < 0) time = 0;
+
+	return time.toString(36).padStart(TIME_LENGTH, '0').slice(-TIME_LENGTH);
+}
+
+function getNoise(): string {
+	return counter.toString(36).padStart(NOISE_LENGTH, '0').slice(-NOISE_LENGTH);
+}
+
+export function genAidx(date: Date): string {
+	const t = date.getTime();
+	if (isNaN(t)) throw new Error('Failed to create AIDX: Invalid Date');
+	counter++;
+	return getTime(t) + nodeId + getNoise();
+}
+
+export function parseAidx(id: string): { date: Date; } {
+	const time = parseInt(id.slice(0, TIME_LENGTH), 36) + TIME2000;
+	return { date: new Date(time) };
+}
--- a/packages/backend/src/models/RepositoryModule.ts
+++ b/packages/backend/src/models/RepositoryModule.ts
@@ -5,7 +5,7 @@

 import { Module } from '@nestjs/common';
 import { DI } from '@/di-symbols.js';
-import { MiAbuseUserReport, MiAccessToken, MiAd, MiAnnouncement, MiAnnouncementRead, MiAntenna, MiApp, MiAttestationChallenge, MiAuthSession, MiBlocking, MiChannel, MiChannelFavorite, MiChannelFollowing, MiClip, MiClipFavorite, MiClipNote, MiDriveFile, MiDriveFolder, MiEmoji, MiFlash, MiFlashLike, MiFollowRequest, MiFollowing, MiGalleryLike, MiGalleryPost, MiHashtag, MiInstance, MiMeta, MiModerationLog, MiMutedNote, MiMuting, MiNote, MiNoteFavorite, MiNoteReaction, MiNoteThreadMuting, MiNoteUnread, MiPage, MiPageLike, MiPasswordResetRequest, MiPoll, MiPollVote, MiPromoNote, MiPromoRead, MiRegistrationTicket, MiRegistryItem, MiRelay, MiRenoteMuting, MiRetentionAggregation, MiRole, MiRoleAssignment, MiSignin, MiSwSubscription, MiUsedUsername, MiUser, MiUserIp, MiUserKeypair, MiUserList, MiUserListFavorite, MiUserListJoining, MiUserMemo, MiUserNotePining, MiUserPending, MiUserProfile, MiUserPublickey, MiUserSecurityKey, MiWebhook } from './index.js';
+import { MiAbuseUserReport, MiAccessToken, MiAd, MiAnnouncement, MiAnnouncementRead, MiAntenna, MiApp, MiAuthSession, MiBlocking, MiChannel, MiChannelFavorite, MiChannelFollowing, MiClip, MiClipFavorite, MiClipNote, MiDriveFile, MiDriveFolder, MiEmoji, MiFlash, MiFlashLike, MiFollowRequest, MiFollowing, MiGalleryLike, MiGalleryPost, MiHashtag, MiInstance, MiMeta, MiModerationLog, MiMutedNote, MiMuting, MiNote, MiNoteFavorite, MiNoteReaction, MiNoteThreadMuting, MiNoteUnread, MiPage, MiPageLike, MiPasswordResetRequest, MiPoll, MiPollVote, MiPromoNote, MiPromoRead, MiRegistrationTicket, MiRegistryItem, MiRelay, MiRenoteMuting, MiRetentionAggregation, MiRole, MiRoleAssignment, MiSignin, MiSwSubscription, MiUsedUsername, MiUser, MiUserIp, MiUserKeypair, MiUserList, MiUserListFavorite, MiUserListJoining, MiUserMemo, MiUserNotePining, MiUserPending, MiUserProfile, MiUserPublickey, MiUserSecurityKey, MiWebhook } from './index.js';
 import type { DataSource } from 'typeorm';
 import type { Provider } from '@nestjs/common';

@@ -93,12 +93,6 @@ const $userPendingsRepository: Provider = {
 	inject: [DI.db],
 };

-const $attestationChallengesRepository: Provider = {
-	provide: DI.attestationChallengesRepository,
-	useFactory: (db: DataSource) => db.getRepository(MiAttestationChallenge),
-	inject: [DI.db],
-};
-
 const $userSecurityKeysRepository: Provider = {
 	provide: DI.userSecurityKeysRepository,
 	useFactory: (db: DataSource) => db.getRepository(MiUserSecurityKey),
@@ -423,7 +417,6 @@ const $userMemosRepository: Provider = {
 		$userProfilesRepository,
 		$userKeypairsRepository,
 		$userPendingsRepository,
-		$attestationChallengesRepository,
 		$userSecurityKeysRepository,
 		$userPublickeysRepository,
 		$userListsRepository,
@@ -491,7 +484,6 @@ const $userMemosRepository: Provider = {
 		$userProfilesRepository,
 		$userKeypairsRepository,
 		$userPendingsRepository,
-		$attestationChallengesRepository,
 		$userSecurityKeysRepository,
 		$userPublickeysRepository,
 		$userListsRepository,
--- a/packages/backend/src/models/entities/AttestationChallenge.ts
+++ b/packages/backend/src/models/entities/AttestationChallenge.ts
@@ -1,51 +0,0 @@
-/*
- * SPDX-FileCopyrightText: syuilo and other misskey contributors
- * SPDX-License-Identifier: AGPL-3.0-only
- */
-
-import { PrimaryColumn, Entity, JoinColumn, Column, ManyToOne, Index } from 'typeorm';
-import { id } from '../id.js';
-import { MiUser } from './User.js';
-
-@Entity('attestation_challenge')
-export class MiAttestationChallenge {
-	@PrimaryColumn(id())
-	public id: string;
-
-	@Index()
-	@PrimaryColumn(id())
-	public userId: MiUser['id'];
-
-	@ManyToOne(type => MiUser, {
-		onDelete: 'CASCADE',
-	})
-	@JoinColumn()
-	public user: MiUser | null;
-
-	@Index()
-	@Column('varchar', {
-		length: 64,
-		comment: 'Hex-encoded sha256 hash of the challenge.',
-	})
-	public challenge: string;
-
-	@Column('timestamp with time zone', {
-		comment: 'The date challenge was created for expiry purposes.',
-	})
-	public createdAt: Date;
-
-	@Column('boolean', {
-		comment:
-			'Indicates that the challenge is only for registration purposes if true to prevent the challenge for being used as authentication.',
-		default: false,
-	})
-	public registrationChallenge: boolean;
-
-	constructor(data: Partial<MiAttestationChallenge>) {
-		if (data == null) return;
-
-		for (const [k, v] of Object.entries(data)) {
-			(this as any)[k] = v;
-		}
-	}
-}
--- a/packages/backend/src/models/entities/Notification.ts
+++ b/packages/backend/src/models/entities/Notification.ts
@@ -33,6 +33,7 @@ export type MiNotification = {
 	 * followRequestAccepted - 自分の送ったフォローリクエストが承認された
 	 * achievementEarned - 実績を獲得
 	 * app - アプリ通知
+	 * test - テスト通知（サーバー側）
 	 */
 	type: typeof notificationTypes[number];

--- a/packages/backend/src/models/entities/UserProfile.ts
+++ b/packages/backend/src/models/entities/UserProfile.ts
@@ -101,6 +101,11 @@ export class MiUserProfile {
 	})
 	public twoFactorSecret: string | null;

+	@Column('varchar', {
+		nullable: true, array: true,
+	})
+	public twoFactorBackupSecret: string[] | null;
+
 	@Column('boolean', {
 		default: false,
 	})
--- a/packages/backend/src/models/entities/UserSecurityKey.ts
+++ b/packages/backend/src/models/entities/UserSecurityKey.ts
@@ -24,25 +24,48 @@ export class MiUserSecurityKey {
 	@JoinColumn()
 	public user: MiUser | null;

-	@Index()
-	@Column('varchar', {
-		comment:
-			'Variable-length public key used to verify attestations (hex-encoded).',
-	})
-	public publicKey: string;
-
-	@Column('timestamp with time zone', {
-		comment:
-			'The date of the last time the UserSecurityKey was successfully validated.',
-	})
-	public lastUsed: Date;
-
 	@Column('varchar', {
 		comment: 'User-defined name for this key',
 		length: 30,
 	})
 	public name: string;

+	@Index()
+	@Column('varchar', {
+		comment: 'The public key of the UserSecurityKey, hex-encoded.',
+	})
+	public publicKey: string;
+
+	@Column('bigint', {
+		comment: 'The number of times the UserSecurityKey was validated.',
+		default: 0,
+	})
+	public counter: number;
+
+	@Column('timestamp with time zone', {
+		comment: 'Timestamp of the last time the UserSecurityKey was used.',
+		default: () => 'now()',
+	})
+	public lastUsed: Date;
+
+	@Column('varchar', {
+		comment: 'The type of Backup Eligibility in authenticator data',
+		length: 32, nullable: true,
+	})
+	public credentialDeviceType: string | null;
+
+	@Column('boolean', {
+		comment: 'Whether or not the credential has been backed up',
+		nullable: true,
+	})
+	public credentialBackedUp: boolean | null;
+
+	@Column('varchar', {
+		comment: 'The type of the credential returned by the browser',
+		length: 32, array: true, nullable: true,
+	})
+	public transports: string[] | null;
+
 	constructor(data: Partial<MiUserSecurityKey>) {
 		if (data == null) return;

--- a/packages/backend/src/models/index.ts
+++ b/packages/backend/src/models/index.ts
@@ -10,7 +10,6 @@ import { MiAnnouncement } from '@/models/entities/Announcement.js';
 import { MiAnnouncementRead } from '@/models/entities/AnnouncementRead.js';
 import { MiAntenna } from '@/models/entities/Antenna.js';
 import { MiApp } from '@/models/entities/App.js';
-import { MiAttestationChallenge } from '@/models/entities/AttestationChallenge.js';
 import { MiAuthSession } from '@/models/entities/AuthSession.js';
 import { MiBlocking } from '@/models/entities/Blocking.js';
 import { MiChannelFollowing } from '@/models/entities/ChannelFollowing.js';
@@ -79,7 +78,6 @@ export {
 	MiAnnouncementRead,
 	MiAntenna,
 	MiApp,
-	MiAttestationChallenge,
 	MiAuthSession,
 	MiBlocking,
 	MiChannelFollowing,
@@ -147,7 +145,6 @@ export type AnnouncementsRepository = Repository<MiAnnouncement>;
 export type AnnouncementReadsRepository = Repository<MiAnnouncementRead>;
 export type AntennasRepository = Repository<MiAntenna>;
 export type AppsRepository = Repository<MiApp>;
-export type AttestationChallengesRepository = Repository<MiAttestationChallenge>;
 export type AuthSessionsRepository = Repository<MiAuthSession>;
 export type BlockingsRepository = Repository<MiBlocking>;
 export type ChannelFollowingsRepository = Repository<MiChannelFollowing>;
--- a/packages/backend/src/models/json-schema/user.ts
+++ b/packages/backend/src/models/json-schema/user.ts
@@ -321,6 +321,11 @@ export const packedMeDetailedOnlySchema = {
 			type: 'boolean',
 			nullable: false, optional: false,
 		},
+		twoFactorBackupCodesStock: {
+			type: 'string',
+			enum: ['full', 'partial', 'none'],
+			nullable: false, optional: false,
+		},
 		hideOnlineStatus: {
 			type: 'boolean',
 			nullable: false, optional: false,
--- a/packages/backend/src/postgres.ts
+++ b/packages/backend/src/postgres.ts
@@ -18,7 +18,6 @@ import { MiAnnouncement } from '@/models/entities/Announcement.js';
 import { MiAnnouncementRead } from '@/models/entities/AnnouncementRead.js';
 import { MiAntenna } from '@/models/entities/Antenna.js';
 import { MiApp } from '@/models/entities/App.js';
-import { MiAttestationChallenge } from '@/models/entities/AttestationChallenge.js';
 import { MiAuthSession } from '@/models/entities/AuthSession.js';
 import { MiBlocking } from '@/models/entities/Blocking.js';
 import { MiChannelFollowing } from '@/models/entities/ChannelFollowing.js';
@@ -143,7 +142,6 @@ export const entities = [
 	MiUserNotePining,
 	MiUserSecurityKey,
 	MiUsedUsername,
-	MiAttestationChallenge,
 	MiFollowing,
 	MiFollowRequest,
 	MiMuting,
--- a/packages/backend/src/queue/processors/CleanProcessorService.ts
+++ b/packages/backend/src/queue/processors/CleanProcessorService.ts
@@ -10,6 +10,7 @@ import type { AntennasRepository, MutedNotesRepository, RoleAssignmentsRepositor
 import type Logger from '@/logger.js';
 import { bindThis } from '@/decorators.js';
 import { IdService } from '@/core/IdService.js';
+import type { Config } from '@/config.js';
 import { QueueLoggerService } from '../QueueLoggerService.js';
 import type * as Bull from 'bullmq';

@@ -18,6 +19,9 @@ export class CleanProcessorService {
 	private logger: Logger;

 	constructor(
+		@Inject(DI.config)
+		private config: Config,
+
 		@Inject(DI.userIpsRepository)
 		private userIpsRepository: UserIpsRepository,

@@ -54,12 +58,14 @@ export class CleanProcessorService {
 			reason: 'word',
 		});

-		// 7日以上使われてないアンテナを停止
-		this.antennasRepository.update({
-			lastUsedAt: LessThan(new Date(Date.now() - (1000 * 60 * 60 * 24 * 7))),
-		}, {
-			isActive: false,
-		});
+		// 使われてないアンテナを停止
+		if (this.config.deactivateAntennaThreshold > 0) {
+			this.antennasRepository.update({
+				lastUsedAt: LessThan(new Date(Date.now() - this.config.deactivateAntennaThreshold)),
+			}, {
+				isActive: false,
+			});
+		}

 		const expiredRoleAssignments = await this.roleAssignmentsRepository.createQueryBuilder('assign')
 			.where('assign.expiresAt IS NOT NULL')
--- a/packages/backend/src/server/NodeinfoServerService.ts
+++ b/packages/backend/src/server/NodeinfoServerService.ts
@@ -35,10 +35,10 @@ export class NodeinfoServerService {

 	@bindThis
 	public getLinks() {
-		return [/* (awaiting release) {
-			rel: 'http://nodeinfo.diaspora.software/ns/schema/2.1',
-			href: config.url + nodeinfo2_1path
-		}, */{
+		return [{
+				rel: 'http://nodeinfo.diaspora.software/ns/schema/2.1',
+				href: this.config.url + nodeinfo2_1path
+			}, {
 				rel: 'http://nodeinfo.diaspora.software/ns/schema/2.0',
 				href: this.config.url + nodeinfo2_0path,
 			}];
@@ -46,7 +46,7 @@ export class NodeinfoServerService {

 	@bindThis
 	public createServer(fastify: FastifyInstance, options: FastifyPluginOptions, done: (err?: Error) => void) {
-		const nodeinfo2 = async () => {
+		const nodeinfo2 = async (version: number) => {
 			const now = Date.now();

 			const notesChart = await this.notesChart.getChart('hour', 1, null);
@@ -73,11 +73,11 @@ export class NodeinfoServerService {

 			const basePolicies = { ...DEFAULT_POLICIES, ...meta.policies };

-			return {
+			// eslint-disable-next-line @typescript-eslint/no-explicit-any
+			const document: any = {
 				software: {
 					name: 'misskey',
 					version: this.config.version,
-					repository: meta.repositoryUrl,
 				},
 				protocols: ['activitypub'],
 				services: {
@@ -114,23 +114,36 @@ export class NodeinfoServerService {
 					themeColor: meta.themeColor ?? '#86b300',
 				},
 			};
+			if (version >= 21) {
+				document.software.repository = meta.repositoryUrl;
+				document.software.homepage = meta.repositoryUrl;
+			}
+			return document;
 		};

 		const cache = new MemorySingleCache<Awaited<ReturnType<typeof nodeinfo2>>>(1000 * 60 * 10);

 		fastify.get(nodeinfo2_1path, async (request, reply) => {
-			const base = await cache.fetch(() => nodeinfo2());
+			const base = await cache.fetch(() => nodeinfo2(21));

-			reply.header('Cache-Control', 'public, max-age=600');
+			reply
+				.type(
+					'application/json; profile="http://nodeinfo.diaspora.software/ns/schema/2.1#"',
+				)
+				.header('Cache-Control', 'public, max-age=600');
 			return { version: '2.1', ...base };
 		});

 		fastify.get(nodeinfo2_0path, async (request, reply) => {
-			const base = await cache.fetch(() => nodeinfo2());
+			const base = await cache.fetch(() => nodeinfo2(20));

 			delete (base as any).software.repository;

-			reply.header('Cache-Control', 'public, max-age=600');
+			reply
+				.type(
+					'application/json; profile="http://nodeinfo.diaspora.software/ns/schema/2.0#"',
+				)
+				.header('Cache-Control', 'public, max-age=600');
 			return { version: '2.0', ...base };
 		});

--- a/packages/backend/src/server/WellKnownServerService.ts
+++ b/packages/backend/src/server/WellKnownServerService.ts
@@ -73,7 +73,7 @@ export class WellKnownServerService {
 		});

 		fastify.get('/.well-known/host-meta.json', async (request, reply) => {
-			reply.header('Content-Type', jrd);
+			reply.header('Content-Type', 'application/json');
 			return {
 				links: [{
 					rel: 'lrdd',
--- a/packages/backend/src/server/api/ApiCallService.ts
+++ b/packages/backend/src/server/api/ApiCallService.ts
@@ -35,7 +35,7 @@ const accessDenied = {
 export class ApiCallService implements OnApplicationShutdown {
 	private logger: Logger;
 	private userIpHistories: Map<MiUser['id'], Set<string>>;
-	private userIpHistoriesClearIntervalId: NodeJS.Timer;
+	private userIpHistoriesClearIntervalId: NodeJS.Timeout;

 	constructor(
 		@Inject(DI.userIpsRepository)
--- a/packages/backend/src/server/api/EndpointsModule.ts
+++ b/packages/backend/src/server/api/EndpointsModule.ts
@@ -283,6 +283,7 @@ import * as ep___notes_unrenote from './endpoints/notes/unrenote.js';
 import * as ep___notes_userListTimeline from './endpoints/notes/user-list-timeline.js';
 import * as ep___notifications_create from './endpoints/notifications/create.js';
 import * as ep___notifications_markAllAsRead from './endpoints/notifications/mark-all-as-read.js';
+import * as ep___notifications_testNotification from './endpoints/notifications/test-notification.js';
 import * as ep___pagePush from './endpoints/page-push.js';
 import * as ep___pages_create from './endpoints/pages/create.js';
 import * as ep___pages_delete from './endpoints/pages/delete.js';
@@ -629,6 +630,7 @@ const $notes_unrenote: Provider = { provide: 'ep:notes/unrenote', useClass: ep__
 const $notes_userListTimeline: Provider = { provide: 'ep:notes/user-list-timeline', useClass: ep___notes_userListTimeline.default };
 const $notifications_create: Provider = { provide: 'ep:notifications/create', useClass: ep___notifications_create.default };
 const $notifications_markAllAsRead: Provider = { provide: 'ep:notifications/mark-all-as-read', useClass: ep___notifications_markAllAsRead.default };
+const $notifications_testNotification: Provider = { provide: 'ep:notifications/test-notification', useClass: ep___notifications_testNotification.default };
 const $pagePush: Provider = { provide: 'ep:page-push', useClass: ep___pagePush.default };
 const $pages_create: Provider = { provide: 'ep:pages/create', useClass: ep___pages_create.default };
 const $pages_delete: Provider = { provide: 'ep:pages/delete', useClass: ep___pages_delete.default };
@@ -979,6 +981,7 @@ const $retention: Provider = { provide: 'ep:retention', useClass: ep___retention
 		$notes_userListTimeline,
 		$notifications_create,
 		$notifications_markAllAsRead,
+		$notifications_testNotification,
 		$pagePush,
 		$pages_create,
 		$pages_delete,
--- a/packages/backend/src/server/api/SigninApiService.ts
+++ b/packages/backend/src/server/api/SigninApiService.ts
@@ -3,22 +3,26 @@
 * SPDX-License-Identifier: AGPL-3.0-only
 */

-import { randomBytes } from 'node:crypto';
 import { Inject, Injectable } from '@nestjs/common';
 import bcrypt from 'bcryptjs';
 import * as OTPAuth from 'otpauth';
 import { IsNull } from 'typeorm';
 import { DI } from '@/di-symbols.js';
-import type { UserSecurityKeysRepository, SigninsRepository, UserProfilesRepository, AttestationChallengesRepository, UsersRepository } from '@/models/index.js';
+import type {
+	SigninsRepository,
+	UserProfilesRepository,
+	UsersRepository,
+} from '@/models/index.js';
 import type { Config } from '@/config.js';
 import { getIpHash } from '@/misc/get-ip-hash.js';
 import type { MiLocalUser } from '@/models/entities/User.js';
 import { IdService } from '@/core/IdService.js';
-import { TwoFactorAuthenticationService } from '@/core/TwoFactorAuthenticationService.js';
 import { bindThis } from '@/decorators.js';
+import { WebAuthnService } from '@/core/WebAuthnService.js';
 import { RateLimiterService } from './RateLimiterService.js';
 import { SigninService } from './SigninService.js';
-import type { FastifyRequest, FastifyReply } from 'fastify';
+import type { AuthenticationResponseJSON } from '@simplewebauthn/typescript-types';
+import type { FastifyReply, FastifyRequest } from 'fastify';

@Injectable()
 export class SigninApiService {
@@ -29,22 +33,16 @@ export class SigninApiService {
 		@Inject(DI.usersRepository)
 		private usersRepository: UsersRepository,

-		@Inject(DI.userSecurityKeysRepository)
-		private userSecurityKeysRepository: UserSecurityKeysRepository,
-
 		@Inject(DI.userProfilesRepository)
 		private userProfilesRepository: UserProfilesRepository,

-		@Inject(DI.attestationChallengesRepository)
-		private attestationChallengesRepository: AttestationChallengesRepository,
-
 		@Inject(DI.signinsRepository)
 		private signinsRepository: SigninsRepository,

 		private idService: IdService,
 		private rateLimiterService: RateLimiterService,
 		private signinService: SigninService,
-		private twoFactorAuthenticationService: TwoFactorAuthenticationService,
+		private webAuthnService: WebAuthnService,
 	) {
 	}

@@ -55,11 +53,7 @@ export class SigninApiService {
 				username: string;
 				password: string;
 				token?: string;
-				signature?: string;
-				authenticatorData?: string;
-				clientDataJSON?: string;
-				credentialId?: string;
-				challengeId?: string;
+				credential?: AuthenticationResponseJSON;
 			};
 		}>,
 		reply: FastifyReply,
@@ -160,6 +154,13 @@ export class SigninApiService {
 				});
 			}

+			if (profile.twoFactorBackupSecret?.includes(token)) {
+				await this.userProfilesRepository.update({ userId: profile.userId }, {
+					twoFactorBackupSecret: profile.twoFactorBackupSecret.filter((secret) => secret !== token),
+				});
+				return this.signinService.signin(request, reply, user);
+			}
+
 			const delta = OTPAuth.TOTP.validate({
 				secret: OTPAuth.Secret.fromBase32(profile.twoFactorSecret!),
 				digits: 6,
@@ -174,64 +175,16 @@ export class SigninApiService {
 			} else {
 				return this.signinService.signin(request, reply, user);
 			}
-		} else if (body.credentialId && body.clientDataJSON && body.authenticatorData && body.signature) {
+		} else if (body.credential) {
 			if (!same && !profile.usePasswordLessLogin) {
 				return await fail(403, {
 					id: '932c904e-9460-45b7-9ce6-7ed33be7eb2c',
 				});
 			}

-			const clientDataJSON = Buffer.from(body.clientDataJSON, 'hex');
-			const clientData = JSON.parse(clientDataJSON.toString('utf-8'));
-			const challenge = await this.attestationChallengesRepository.findOneBy({
-				userId: user.id,
-				id: body.challengeId,
-				registrationChallenge: false,
-				challenge: this.twoFactorAuthenticationService.hash(clientData.challenge).toString('hex'),
-			});
+			const authorized = await this.webAuthnService.verifyAuthentication(user.id, body.credential);

-			if (!challenge) {
-				return await fail(403, {
-					id: '2715a88a-2125-4013-932f-aa6fe72792da',
-				});
-			}
-
-			await this.attestationChallengesRepository.delete({
-				userId: user.id,
-				id: body.challengeId,
-			});
-
-			if (new Date().getTime() - challenge.createdAt.getTime() >= 5 * 60 * 1000) {
-				return await fail(403, {
-					id: '2715a88a-2125-4013-932f-aa6fe72792da',
-				});
-			}
-
-			const securityKey = await this.userSecurityKeysRepository.findOneBy({
-				id: Buffer.from(
-					body.credentialId
-						.replace(/-/g, '+')
-						.replace(/_/g, '/'),
-					'base64',
-				).toString('hex'),
-			});
-
-			if (!securityKey) {
-				return await fail(403, {
-					id: '66269679-aeaf-4474-862b-eb761197e046',
-				});
-			}
-
-			const isValid = this.twoFactorAuthenticationService.verifySignin({
-				publicKey: Buffer.from(securityKey.publicKey, 'hex'),
-				authenticatorData: Buffer.from(body.authenticatorData, 'hex'),
-				clientDataJSON,
-				clientData,
-				signature: Buffer.from(body.signature, 'hex'),
-				challenge: challenge.challenge,
-			});
-
-			if (isValid) {
+			if (authorized) {
 				return this.signinService.signin(request, reply, user);
 			} else {
 				return await fail(403, {
@@ -245,42 +198,11 @@ export class SigninApiService {
 				});
 			}

-			const keys = await this.userSecurityKeysRepository.findBy({
-				userId: user.id,
-			});
-
-			if (keys.length === 0) {
-				return await fail(403, {
-					id: 'f27fd449-9af4-4841-9249-1f989b9fa4a4',
-				});
-			}
-
-			// 32 byte challenge
-			const challenge = randomBytes(32).toString('base64')
-				.replace(/=/g, '')
-				.replace(/\+/g, '-')
-				.replace(/\//g, '_');
-
-			const challengeId = this.idService.genId();
-
-			await this.attestationChallengesRepository.insert({
-				userId: user.id,
-				id: challengeId,
-				challenge: this.twoFactorAuthenticationService.hash(Buffer.from(challenge, 'utf-8')).toString('hex'),
-				createdAt: new Date(),
-				registrationChallenge: false,
-			});
+			const authRequest = await this.webAuthnService.initiateAuthentication(user.id);

 			reply.code(200);
-			return {
-				challenge,
-				challengeId,
-				securityKeys: keys.map(key => ({
-					id: key.id,
-				})),
-			};
+			return authRequest;
 		}
 	// never get here
 	}
 }
-
--- a/packages/backend/src/server/api/endpoints.ts
+++ b/packages/backend/src/server/api/endpoints.ts
@@ -283,6 +283,7 @@ import * as ep___notes_unrenote from './endpoints/notes/unrenote.js';
 import * as ep___notes_userListTimeline from './endpoints/notes/user-list-timeline.js';
 import * as ep___notifications_create from './endpoints/notifications/create.js';
 import * as ep___notifications_markAllAsRead from './endpoints/notifications/mark-all-as-read.js';
+import * as ep___notifications_testNotification from './endpoints/notifications/test-notification.js';
 import * as ep___pagePush from './endpoints/page-push.js';
 import * as ep___pages_create from './endpoints/pages/create.js';
 import * as ep___pages_delete from './endpoints/pages/delete.js';
@@ -627,6 +628,7 @@ const eps = [
 	['notes/user-list-timeline', ep___notes_userListTimeline],
 	['notifications/create', ep___notifications_create],
 	['notifications/mark-all-as-read', ep___notifications_markAllAsRead],
+	['notifications/test-notification', ep___notifications_testNotification],
 	['page-push', ep___pagePush],
 	['pages/create', ep___pages_create],
 	['pages/delete', ep___pages_delete],
--- a/packages/backend/src/server/api/endpoints/i/2fa/done.ts
+++ b/packages/backend/src/server/api/endpoints/i/2fa/done.ts
@@ -54,8 +54,11 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 				throw new Error('not verified');
 			}

+			const backupCodes = Array.from({ length: 5 }, () => new OTPAuth.Secret().base32);
+
 			await this.userProfilesRepository.update(me.id, {
 				twoFactorSecret: profile.twoFactorTempSecret,
+				twoFactorBackupSecret: backupCodes,
 				twoFactorEnabled: true,
 			});

@@ -64,6 +67,10 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 				detail: true,
 				includeSecrets: true,
 			}));
+
+			return {
+				backupCodes: backupCodes,
+			};
 		});
 	}
 }
--- a/packages/backend/src/server/api/endpoints/i/2fa/key-done.ts
+++ b/packages/backend/src/server/api/endpoints/i/2fa/key-done.ts
@@ -3,155 +3,86 @@
 * SPDX-License-Identifier: AGPL-3.0-only
 */

-import { promisify } from 'node:util';
 import bcrypt from 'bcryptjs';
-import cbor from 'cbor';
 import { Inject, Injectable } from '@nestjs/common';
 import { Endpoint } from '@/server/api/endpoint-base.js';
 import { UserEntityService } from '@/core/entities/UserEntityService.js';
-import type { Config } from '@/config.js';
 import { DI } from '@/di-symbols.js';
 import { GlobalEventService } from '@/core/GlobalEventService.js';
-import { TwoFactorAuthenticationService } from '@/core/TwoFactorAuthenticationService.js';
-import type { AttestationChallengesRepository, UserProfilesRepository, UserSecurityKeysRepository } from '@/models/index.js';
-
-const cborDecodeFirst = promisify(cbor.decodeFirst) as any;
+import type { UserProfilesRepository, UserSecurityKeysRepository } from '@/models/index.js';
+import { WebAuthnService } from '@/core/WebAuthnService.js';
+import { ApiError } from '@/server/api/error.js';

 export const meta = {
 	requireCredential: true,

 	secure: true,
+
+	errors: {
+		incorrectPassword: {
+			message: 'Incorrect password.',
+			code: 'INCORRECT_PASSWORD',
+			id: '0d7ec6d2-e652-443e-a7bf-9ee9a0cd77b0',
+		},
+
+		twoFactorNotEnabled: {
+			message: '2fa not enabled.',
+			code: 'TWO_FACTOR_NOT_ENABLED',
+			id: '798d6847-b1ed-4f9c-b1f9-163c42655995',
+		},
+	},
 } as const;

 export const paramDef = {
 	type: 'object',
 	properties: {
-		clientDataJSON: { type: 'string' },
-		attestationObject: { type: 'string' },
 		password: { type: 'string' },
-		challengeId: { type: 'string' },
 		name: { type: 'string', minLength: 1, maxLength: 30 },
+		credential: { type: 'object' },
 	},
-	required: ['clientDataJSON', 'attestationObject', 'password', 'challengeId', 'name'],
+	required: ['password', 'name', 'credential'],
 } as const;

+// eslint-disable-next-line import/no-default-export
@Injectable()
-export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-disable-line import/no-default-export
+export default class extends Endpoint<typeof meta, typeof paramDef> {
 	constructor(
-		@Inject(DI.config)
-		private config: Config,
-
 		@Inject(DI.userProfilesRepository)
 		private userProfilesRepository: UserProfilesRepository,

 		@Inject(DI.userSecurityKeysRepository)
 		private userSecurityKeysRepository: UserSecurityKeysRepository,

-		@Inject(DI.attestationChallengesRepository)
-		private attestationChallengesRepository: AttestationChallengesRepository,
-
+		private webAuthnService: WebAuthnService,
 		private userEntityService: UserEntityService,
 		private globalEventService: GlobalEventService,
-		private twoFactorAuthenticationService: TwoFactorAuthenticationService,
 	) {
 		super(meta, paramDef, async (ps, me) => {
-			const rpIdHashReal = this.twoFactorAuthenticationService.hash(Buffer.from(this.config.hostname, 'utf-8'));
-
 			const profile = await this.userProfilesRepository.findOneByOrFail({ userId: me.id });

 			// Compare password
-			const same = await bcrypt.compare(ps.password, profile.password!);
+			const same = await bcrypt.compare(ps.password, profile.password ?? '');

 			if (!same) {
-				throw new Error('incorrect password');
+				throw new ApiError(meta.errors.incorrectPassword);
 			}

 			if (!profile.twoFactorEnabled) {
-				throw new Error('2fa not enabled');
+				throw new ApiError(meta.errors.twoFactorNotEnabled);
 			}

-			const clientData = JSON.parse(ps.clientDataJSON);
-
-			if (clientData.type !== 'webauthn.create') {
-				throw new Error('not a creation attestation');
-			}
-			if (clientData.origin !== this.config.scheme + '://' + this.config.host) {
-				throw new Error('origin mismatch');
-			}
-
-			const clientDataJSONHash = this.twoFactorAuthenticationService.hash(Buffer.from(ps.clientDataJSON, 'utf-8'));
-
-			const attestation = await cborDecodeFirst(ps.attestationObject);
-
-			const rpIdHash = attestation.authData.slice(0, 32);
-			if (!rpIdHashReal.equals(rpIdHash)) {
-				throw new Error('rpIdHash mismatch');
-			}
-
-			const flags = attestation.authData[32];
-
-			// eslint:disable-next-line:no-bitwise
-			if (!(flags & 1)) {
-				throw new Error('user not present');
-			}
-
-			const authData = Buffer.from(attestation.authData);
-			const credentialIdLength = authData.readUInt16BE(53);
-			const credentialId = authData.slice(55, 55 + credentialIdLength);
-			const publicKeyData = authData.slice(55 + credentialIdLength);
-			const publicKey: Map<number, any> = await cborDecodeFirst(publicKeyData);
-			if (publicKey.get(3) !== -7) {
-				throw new Error('alg mismatch');
-			}
-
-			const procedures = this.twoFactorAuthenticationService.getProcedures();
-
-			if (!(procedures as any)[attestation.fmt]) {
-				throw new Error(`unsupported fmt: ${attestation.fmt}. Supported ones: ${Object.keys(procedures)}`);
-			}
-
-			const verificationData = (procedures as any)[attestation.fmt].verify({
-				attStmt: attestation.attStmt,
-				authenticatorData: authData,
-				clientDataHash: clientDataJSONHash,
-				credentialId,
-				publicKey,
-				rpIdHash,
-			});
-			if (!verificationData.valid) throw new Error('signature invalid');
-
-			const attestationChallenge = await this.attestationChallengesRepository.findOneBy({
-				userId: me.id,
-				id: ps.challengeId,
-				registrationChallenge: true,
-				challenge: this.twoFactorAuthenticationService.hash(clientData.challenge).toString('hex'),
-			});
-
-			if (!attestationChallenge) {
-				throw new Error('non-existent challenge');
-			}
-
-			await this.attestationChallengesRepository.delete({
-				userId: me.id,
-				id: ps.challengeId,
-			});
-
-			// Expired challenge (> 5min old)
-			if (
-				new Date().getTime() - attestationChallenge.createdAt.getTime() >=
-		5 * 60 * 1000
-			) {
-				throw new Error('expired challenge');
-			}
-
-			const credentialIdString = credentialId.toString('hex');
+			const keyInfo = await this.webAuthnService.verifyRegistration(me.id, ps.credential);

+			const credentialId = Buffer.from(keyInfo.credentialID).toString('base64url');
 			await this.userSecurityKeysRepository.insert({
+				id: credentialId,
 				userId: me.id,
-				id: credentialIdString,
-				lastUsed: new Date(),
 				name: ps.name,
-				publicKey: verificationData.publicKey.toString('hex'),
+				publicKey: Buffer.from(keyInfo.credentialPublicKey).toString('base64url'),
+				counter: keyInfo.counter,
+				credentialDeviceType: keyInfo.credentialDeviceType,
+				credentialBackedUp: keyInfo.credentialBackedUp,
+				transports: keyInfo.transports,
 			});

 			// Publish meUpdated event
@@ -161,7 +92,7 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 			}));

 			return {
-				id: credentialIdString,
+				id: credentialId,
 				name: ps.name,
 			};
 		});
--- a/packages/backend/src/server/api/endpoints/i/2fa/register-key.ts
+++ b/packages/backend/src/server/api/endpoints/i/2fa/register-key.ts
@@ -3,22 +3,38 @@
 * SPDX-License-Identifier: AGPL-3.0-only
 */

-import { promisify } from 'node:util';
-import * as crypto from 'node:crypto';
 import bcrypt from 'bcryptjs';
 import { Inject, Injectable } from '@nestjs/common';
 import { Endpoint } from '@/server/api/endpoint-base.js';
-import type { UserProfilesRepository, AttestationChallengesRepository } from '@/models/index.js';
-import { IdService } from '@/core/IdService.js';
-import { TwoFactorAuthenticationService } from '@/core/TwoFactorAuthenticationService.js';
+import type { UserProfilesRepository } from '@/models/index.js';
 import { DI } from '@/di-symbols.js';
-
-const randomBytes = promisify(crypto.randomBytes);
+import { WebAuthnService } from '@/core/WebAuthnService.js';
+import { ApiError } from '@/server/api/error.js';

 export const meta = {
 	requireCredential: true,

 	secure: true,
+
+	errors: {
+		userNotFound: {
+			message: 'User not found.',
+			code: 'USER_NOT_FOUND',
+			id: '652f899f-66d4-490e-993e-6606c8ec04c3',
+		},
+
+		incorrectPassword: {
+			message: 'Incorrect password.',
+			code: 'INCORRECT_PASSWORD',
+			id: '38769596-efe2-4faf-9bec-abbb3f2cd9ba',
+		},
+
+		twoFactorNotEnabled: {
+			message: '2fa not enabled.',
+			code: 'TWO_FACTOR_NOT_ENABLED',
+			id: 'bf32b864-449b-47b8-974e-f9a5468546f1',
+		},
+	},
 } as const;

 export const paramDef = {
@@ -29,53 +45,43 @@ export const paramDef = {
 	required: ['password'],
 } as const;

+// eslint-disable-next-line import/no-default-export
@Injectable()
-export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-disable-line import/no-default-export
+export default class extends Endpoint<typeof meta, typeof paramDef> {
 	constructor(
 		@Inject(DI.userProfilesRepository)
 		private userProfilesRepository: UserProfilesRepository,

-		@Inject(DI.attestationChallengesRepository)
-		private attestationChallengesRepository: AttestationChallengesRepository,
-
-		private idService: IdService,
-		private twoFactorAuthenticationService: TwoFactorAuthenticationService,
+		private webAuthnService: WebAuthnService,
 	) {
 		super(meta, paramDef, async (ps, me) => {
-			const profile = await this.userProfilesRepository.findOneByOrFail({ userId: me.id });
+			const profile = await this.userProfilesRepository.findOne({
+				where: {
+					userId: me.id,
+				},
+				relations: ['user'],
+			});
+
+			if (profile == null) {
+				throw new ApiError(meta.errors.userNotFound);
+			}

 			// Compare password
-			const same = await bcrypt.compare(ps.password, profile.password!);
+			const same = await bcrypt.compare(ps.password, profile.password ?? '');

 			if (!same) {
-				throw new Error('incorrect password');
+				throw new ApiError(meta.errors.incorrectPassword);
 			}

 			if (!profile.twoFactorEnabled) {
-				throw new Error('2fa not enabled');
+				throw new ApiError(meta.errors.twoFactorNotEnabled);
 			}

-			// 32 byte challenge
-			const entropy = await randomBytes(32);
-			const challenge = entropy.toString('base64')
-				.replace(/=/g, '')
-				.replace(/\+/g, '-')
-				.replace(/\//g, '_');
-
-			const challengeId = this.idService.genId();
-
-			await this.attestationChallengesRepository.insert({
-				userId: me.id,
-				id: challengeId,
-				challenge: this.twoFactorAuthenticationService.hash(Buffer.from(challenge, 'utf-8')).toString('hex'),
-				createdAt: new Date(),
-				registrationChallenge: true,
-			});
-
-			return {
-				challengeId,
-				challenge,
-			};
+			return await this.webAuthnService.initiateRegistration(
+				me.id,
+				profile.user?.username ?? me.id,
+				profile.user?.name ?? undefined,
+			);
 		});
 	}
 }
--- a/packages/backend/src/server/api/endpoints/i/2fa/register.ts
+++ b/packages/backend/src/server/api/endpoints/i/2fa/register.ts
@@ -11,11 +11,20 @@ import type { UserProfilesRepository } from '@/models/index.js';
 import { Endpoint } from '@/server/api/endpoint-base.js';
 import { DI } from '@/di-symbols.js';
 import type { Config } from '@/config.js';
+import { ApiError } from '@/server/api/error.js';

 export const meta = {
 	requireCredential: true,

 	secure: true,
+
+	errors: {
+		incorrectPassword: {
+			message: 'Incorrect password.',
+			code: 'INCORRECT_PASSWORD',
+			id: '78d6c839-20c9-4c66-b90a-fc0542168b48',
+		},
+	},
 } as const;

 export const paramDef = {
@@ -39,10 +48,10 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 			const profile = await this.userProfilesRepository.findOneByOrFail({ userId: me.id });

 			// Compare password
-			const same = await bcrypt.compare(ps.password, profile.password!);
+			const same = await bcrypt.compare(ps.password, profile.password ?? '');

 			if (!same) {
-				throw new Error('incorrect password');
+				throw new ApiError(meta.errors.incorrectPassword);
 			}

 			// Generate user's secret key
--- a/packages/backend/src/server/api/endpoints/i/2fa/remove-key.ts
+++ b/packages/backend/src/server/api/endpoints/i/2fa/remove-key.ts
@@ -10,11 +10,20 @@ import type { UserProfilesRepository, UserSecurityKeysRepository } from '@/model
 import { UserEntityService } from '@/core/entities/UserEntityService.js';
 import { GlobalEventService } from '@/core/GlobalEventService.js';
 import { DI } from '@/di-symbols.js';
+import { ApiError } from '@/server/api/error.js';

 export const meta = {
 	requireCredential: true,

 	secure: true,
+
+	errors: {
+		incorrectPassword: {
+			message: 'Incorrect password.',
+			code: 'INCORRECT_PASSWORD',
+			id: '141c598d-a825-44c8-9173-cfb9d92be493',
+		},
+	},
 } as const;

 export const paramDef = {
@@ -42,10 +51,10 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 			const profile = await this.userProfilesRepository.findOneByOrFail({ userId: me.id });

 			// Compare password
-			const same = await bcrypt.compare(ps.password, profile.password!);
+			const same = await bcrypt.compare(ps.password, profile.password ?? '');

 			if (!same) {
-				throw new Error('incorrect password');
+				throw new ApiError(meta.errors.incorrectPassword);
 			}

 			// Make sure we only delete the user's own creds
--- a/packages/backend/src/server/api/endpoints/i/2fa/unregister.ts
+++ b/packages/backend/src/server/api/endpoints/i/2fa/unregister.ts
@@ -10,11 +10,20 @@ import { UserEntityService } from '@/core/entities/UserEntityService.js';
 import type { UserProfilesRepository } from '@/models/index.js';
 import { GlobalEventService } from '@/core/GlobalEventService.js';
 import { DI } from '@/di-symbols.js';
+import { ApiError } from '@/server/api/error.js';

 export const meta = {
 	requireCredential: true,

 	secure: true,
+
+	errors: {
+		incorrectPassword: {
+			message: 'Incorrect password.',
+			code: 'INCORRECT_PASSWORD',
+			id: '7add0395-9901-4098-82f9-4f67af65f775',
+		},
+	},
 } as const;

 export const paramDef = {
@@ -38,14 +47,15 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 			const profile = await this.userProfilesRepository.findOneByOrFail({ userId: me.id });

 			// Compare password
-			const same = await bcrypt.compare(ps.password, profile.password!);
+			const same = await bcrypt.compare(ps.password, profile.password ?? '');

 			if (!same) {
-				throw new Error('incorrect password');
+				throw new ApiError(meta.errors.incorrectPassword);
 			}

 			await this.userProfilesRepository.update(me.id, {
 				twoFactorSecret: null,
+				twoFactorBackupSecret: null,
 				twoFactorEnabled: false,
 				usePasswordLessLogin: false,
 			});
--- a/packages/backend/src/server/api/endpoints/i/2fa/update-key.ts
+++ b/packages/backend/src/server/api/endpoints/i/2fa/update-key.ts
@@ -25,7 +25,7 @@ export const meta = {
 		},

 		accessDenied: {
-			message: 'You do not have edit privilege of the channel.',
+			message: 'You do not have edit privilege of this key.',
 			code: 'ACCESS_DENIED',
 			id: '1fb7cb09-d46a-4fff-b8df-057708cce513',
 		},
--- a/packages/backend/src/server/api/endpoints/i/webhooks/create.ts
+++ b/packages/backend/src/server/api/endpoints/i/webhooks/create.ts
@@ -34,12 +34,12 @@ export const paramDef = {
 	properties: {
 		name: { type: 'string', minLength: 1, maxLength: 100 },
 		url: { type: 'string', minLength: 1, maxLength: 1024 },
-		secret: { type: 'string', minLength: 1, maxLength: 1024 },
+		secret: { type: 'string', maxLength: 1024, default: '' },
 		on: { type: 'array', items: {
 			type: 'string', enum: webhookEventTypes,
 		} },
 	},
-	required: ['name', 'url', 'secret', 'on'],
+	required: ['name', 'url', 'on'],
 } as const;

 // TODO: ロジックをサービスに切り出す
--- a/packages/backend/src/server/api/endpoints/i/webhooks/update.ts
+++ b/packages/backend/src/server/api/endpoints/i/webhooks/update.ts
@@ -34,13 +34,13 @@ export const paramDef = {
 		webhookId: { type: 'string', format: 'misskey:id' },
 		name: { type: 'string', minLength: 1, maxLength: 100 },
 		url: { type: 'string', minLength: 1, maxLength: 1024 },
-		secret: { type: 'string', minLength: 1, maxLength: 1024 },
+		secret: { type: 'string', maxLength: 1024, default: '' },
 		on: { type: 'array', items: {
 			type: 'string', enum: webhookEventTypes,
 		} },
 		active: { type: 'boolean' },
 	},
-	required: ['webhookId', 'name', 'url', 'secret', 'on', 'active'],
+	required: ['webhookId', 'name', 'url', 'on', 'active'],
 } as const;

 // TODO: ロジックをサービスに切り出す
--- a/packages/backend/src/server/api/endpoints/notes/mentions.ts
+++ b/packages/backend/src/server/api/endpoints/notes/mentions.ts
@@ -63,6 +63,8 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 					.where(`'{"${me.id}"}' <@ note.mentions`)
 					.orWhere(`'{"${me.id}"}' <@ note.visibleUserIds`);
 				}))
+				// Avoid scanning primary key index
+				.orderBy('CONCAT(note.id)', 'DESC')
 				.innerJoinAndSelect('note.user', 'user')
 				.leftJoinAndSelect('note.reply', 'reply')
 				.leftJoinAndSelect('note.renote', 'renote')
--- a/packages/backend/src/server/api/endpoints/notes/timeline.ts
+++ b/packages/backend/src/server/api/endpoints/notes/timeline.ts
@@ -69,7 +69,8 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 			//#region Construct query
 			const query = this.queryService.makePaginationQuery(this.notesRepository.createQueryBuilder('note'),
 				ps.sinceId, ps.untilId, ps.sinceDate, ps.untilDate)
-				.andWhere('note.id > :minId', { minId: this.idService.genId(new Date(Date.now() - (1000 * 60 * 60 * 24 * 10))) }) // 10日前まで
+				// パフォーマンス上の利点が無さそう？
+				//.andWhere('note.id > :minId', { minId: this.idService.genId(new Date(Date.now() - (1000 * 60 * 60 * 24 * 10))) }) // 10日前まで
 				.innerJoinAndSelect('note.user', 'user')
 				.leftJoinAndSelect('note.reply', 'reply')
 				.leftJoinAndSelect('note.renote', 'renote')
--- a/packages/backend/src/server/api/endpoints/notifications/test-notification.ts
+++ b/packages/backend/src/server/api/endpoints/notifications/test-notification.ts
@@ -0,0 +1,33 @@
+/*
+ * SPDX-FileCopyrightText: syuilo and other misskey contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+import { Injectable } from '@nestjs/common';
+import { Endpoint } from '@/server/api/endpoint-base.js';
+import { NotificationService } from '@/core/NotificationService.js';
+
+export const meta = {
+	tags: ['notifications'],
+
+	requireCredential: true,
+
+	kind: 'write:notifications',
+} as const;
+
+export const paramDef = {
+	type: 'object',
+	properties: {},
+	required: [],
+} as const;
+
+@Injectable()
+export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-disable-line import/no-default-export
+	constructor(
+		private notificationService: NotificationService,
+	) {
+		super(meta, paramDef, async (ps, user) => {
+			this.notificationService.createNotification(user.id, 'test', {});
+		});
+	}
+}
--- a/packages/backend/src/server/api/endpoints/users/notes.ts
+++ b/packages/backend/src/server/api/endpoints/users/notes.ts
@@ -80,9 +80,15 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 				.innerJoinAndSelect('note.user', 'user')
 				.leftJoinAndSelect('note.reply', 'reply')
 				.leftJoinAndSelect('note.renote', 'renote')
+				.leftJoinAndSelect('note.channel', 'channel')
 				.leftJoinAndSelect('reply.user', 'replyUser')
 				.leftJoinAndSelect('renote.user', 'renoteUser');

+			query.andWhere(new Brackets(qb => {
+				qb.orWhere('note.channelId IS NULL');
+				qb.orWhere('channel.isSensitive = false');
+			}));
+
 			this.queryService.generateVisibilityQuery(query, me);
 			if (me) {
 				this.queryService.generateMutedUserQuery(query, me, user);
--- a/packages/backend/src/server/api/stream/channels/user-list.ts
+++ b/packages/backend/src/server/api/stream/channels/user-list.ts
@@ -19,7 +19,7 @@ class UserListChannel extends Channel {
 	public static requireCredential = false;
 	private listId: string;
 	public listUsers: MiUser['id'][] = [];
-	private listUsersClock: NodeJS.Timer;
+	private listUsersClock: NodeJS.Timeout;

 	constructor(
 		private userListsRepository: UserListsRepository,
--- a/packages/backend/src/server/api/stream/index.ts
+++ b/packages/backend/src/server/api/stream/index.ts
@@ -35,7 +35,7 @@ export default class Connection {
 	public userIdsWhoMeMuting: Set<string> = new Set();
 	public userIdsWhoBlockingMe: Set<string> = new Set();
 	public userIdsWhoMeMutingRenotes: Set<string> = new Set();
-	private fetchIntervalId: NodeJS.Timer | null = null;
+	private fetchIntervalId: NodeJS.Timeout | null = null;

 	constructor(
 		private channelsService: ChannelsService,
--- a/packages/backend/src/server/web/ClientServerService.ts
+++ b/packages/backend/src/server/web/ClientServerService.ts
@@ -37,7 +37,6 @@ import { deepClone } from '@/misc/clone.js';
 import { bindThis } from '@/decorators.js';
 import { FlashEntityService } from '@/core/entities/FlashEntityService.js';
 import { RoleService } from '@/core/RoleService.js';
-import manifest from './manifest.json' assert { type: 'json' };
 import { FeedService } from './FeedService.js';
 import { UrlPreviewService } from './UrlPreviewService.js';
 import { ClientLoggerService } from './ClientLoggerService.js';
@@ -52,6 +51,45 @@ const assets = `${_dirname}/../../../../../built/_frontend_dist_/`;
 const swAssets = `${_dirname}/../../../../../built/_sw_dist_/`;
 const viteOut = `${_dirname}/../../../../../built/_vite_/`;

+const manifest = {
+	'short_name': 'Misskey',
+	'name': 'Misskey',
+	'start_url': '/',
+	'display': 'standalone',
+	'background_color': '#313a42',
+	'theme_color': '#86b300',
+	'icons': [
+		{
+			'src': '/static-assets/icons/192.png',
+			'sizes': '192x192',
+			'type': 'image/png',
+			'purpose': 'maskable',
+		},
+		{
+			'src': '/static-assets/icons/512.png',
+			'sizes': '512x512',
+			'type': 'image/png',
+			'purpose': 'maskable',
+		},
+		{
+			'src': '/static-assets/splash.png',
+			'sizes': '300x300',
+			'type': 'image/png',
+			'purpose': 'any',
+		},
+	],
+	'share_target': {
+		'action': '/share/',
+		'method': 'GET',
+		'enctype': 'application/x-www-form-urlencoded',
+		'params': {
+			'title': 'title',
+			'text': 'text',
+			'url': 'url',
+		},
+	},
+};
+
@Injectable()
 export class ClientServerService {
 	private logger: Logger;
--- a/packages/backend/src/server/web/views/base.pug
+++ b/packages/backend/src/server/web/views/base.pug
@@ -7,15 +7,15 @@ doctype html

 //
 	-
-	  _____ _         _           
-	 |     |_|___ ___| |_ ___ _ _ 
+	  _____ _         _
+	 |     |_|___ ___| |_ ___ _ _
 	 | | | | |_ -|_ -| '_| -_| | |
 	 |_|_|_|_|___|___|_,_|___|_  |
 	                         |___|
 	 Thank you for using Misskey!
 	 If you are reading this message... how about joining the development?
 	 https://github.com/misskey-dev/misskey
-	 
+

 html

@@ -35,7 +35,7 @@ html
 		link(rel='prefetch' href=infoImageUrl)
 		link(rel='prefetch' href=notFoundImageUrl)
 		//- https://github.com/misskey-dev/misskey/issues/9842
-		link(rel='stylesheet' href='/assets/tabler-icons/tabler-icons.min.css?v2.25.0')
+		link(rel='stylesheet' href='/assets/tabler-icons/tabler-icons.min.css?v2.32.0')
 		link(rel='modulepreload' href=`/vite/${clientEntry.file}`)

 		if !config.clientManifestExists
--- a/packages/backend/src/types.ts
+++ b/packages/backend/src/types.ts
@@ -3,7 +3,7 @@
 * SPDX-License-Identifier: AGPL-3.0-only
 */

-export const notificationTypes = ['follow', 'mention', 'reply', 'renote', 'quote', 'reaction', 'pollEnded', 'receiveFollowRequest', 'followRequestAccepted', 'achievementEarned', 'app'] as const;
+export const notificationTypes = ['follow', 'mention', 'reply', 'renote', 'quote', 'reaction', 'pollEnded', 'receiveFollowRequest', 'followRequestAccepted', 'achievementEarned', 'app', 'test'] as const;
 export const obsoleteNotificationTypes = ['pollVote', 'groupInvited'] as const;

 export const noteVisibilities = ['public', 'home', 'followers', 'specified'] as const;
--- a/packages/backend/test/e2e/2fa.ts
+++ b/packages/backend/test/e2e/2fa.ts
@@ -9,8 +9,16 @@ import * as assert from 'assert';
 import * as crypto from 'node:crypto';
 import cbor from 'cbor';
 import * as OTPAuth from 'otpauth';
-import { loadConfig } from '../../src/config.js';
-import { signup, api, post, react, startServer, waitFire } from '../utils.js';
+import { loadConfig } from '@/config.js';
+import { api, signup, startServer } from '../utils.js';
+import type {
+	AuthenticationResponseJSON,
+	AuthenticatorAssertionResponseJSON,
+	AuthenticatorAttestationResponseJSON,
+	PublicKeyCredentialCreationOptionsJSON,
+	PublicKeyCredentialRequestOptionsJSON,
+	RegistrationResponseJSON,
+} from '@simplewebauthn/typescript-types';
 import type { INestApplicationContext } from '@nestjs/common';
 import type * as misskey from 'misskey-js';

@@ -47,21 +55,18 @@ describe('2要素認証', () => {

 	const rpIdHash = (): Buffer => {
 		return crypto.createHash('sha256')
-			.update(Buffer.from(config.hostname, 'utf-8'))
+			.update(Buffer.from(config.host, 'utf-8'))
 			.digest();
 	};

 	const keyDoneParam = (param: {
 		keyName: string,
-		challengeId: string,
-		challenge: string,
 		credentialId: Buffer,
+		creationOptions: PublicKeyCredentialCreationOptionsJSON,
 	}): {
-		attestationObject: string,
-		challengeId: string,
-		clientDataJSON: string,
 		password: string,
 		name: string,
+		credential: RegistrationResponseJSON,
 	} => {
 		// A COSE encoded public key
 		const credentialPublicKey = cbor.encode(new Map<number, unknown>([
@@ -76,7 +81,7 @@ describe('2要素認証', () => {
 		// AuthenticatorAssertionResponse.authenticatorData
 		// https://developer.mozilla.org/en-US/docs/Web/API/AuthenticatorAssertionResponse/authenticatorData
 		const credentialIdLength = Buffer.allocUnsafe(2);
-		credentialIdLength.writeUInt16BE(param.credentialId.length);
+		credentialIdLength.writeUInt16BE(param.credentialId.length, 0);
 		const authData = Buffer.concat([
 			rpIdHash(), // rpIdHash(32)
 			Buffer.from([0x45]), // flags(1)
@@ -88,20 +93,27 @@ describe('2要素認証', () => {
 		]);

 		return {
-			attestationObject: cbor.encode({
-				fmt: 'none',
-				attStmt: {},
-				authData,
-			}).toString('hex'),
-			challengeId: param.challengeId,
-			clientDataJSON: JSON.stringify({
-				type: 'webauthn.create',
-				challenge: param.challenge,
-				origin: config.scheme + '://' + config.host,
-				androidPackageName: 'org.mozilla.firefox',
-			}),
 			password,
 			name: param.keyName,
+			credential: <RegistrationResponseJSON>{
+				id: param.credentialId.toString('base64url'),
+				rawId: param.credentialId.toString('base64url'),
+				response: <AuthenticatorAttestationResponseJSON>{
+					clientDataJSON: Buffer.from(JSON.stringify({
+						type: 'webauthn.create',
+						challenge: param.creationOptions.challenge,
+						origin: config.scheme + '://' + config.host,
+						androidPackageName: 'org.mozilla.firefox',
+					}), 'utf-8').toString('base64url'),
+					attestationObject: cbor.encode({
+						fmt: 'none',
+						attStmt: {},
+						authData,
+					}).toString('base64url'),
+				},
+				clientExtensionResults: {},
+				type: 'public-key',
+			},
 		};
 	};

@@ -121,17 +133,12 @@ describe('2要素認証', () => {

 	const signinWithSecurityKeyParam = (param: {
 		keyName: string,
-		challengeId: string,
-		challenge: string,
 		credentialId: Buffer,
+		requestOptions: PublicKeyCredentialRequestOptionsJSON,
 	}): {
-		authenticatorData: string,
-		credentialId: string,
-		challengeId: string,
-		clientDataJSON: string,
 		username: string,
 		password: string,
-		signature: string,
+		credential: AuthenticationResponseJSON,
 		'g-recaptcha-response'?: string | null,
 		'hcaptcha-response'?: string | null,
 	} => {
@@ -144,10 +151,10 @@ describe('2要素認証', () => {
 		]);
 		const clientDataJSONBuffer = Buffer.from(JSON.stringify({
 			type: 'webauthn.get',
-			challenge: param.challenge,
+			challenge: param.requestOptions.challenge,
 			origin: config.scheme + '://' + config.host,
 			androidPackageName: 'org.mozilla.firefox',
-		}));
+		}), 'utf-8');
 		const hashedclientDataJSON = crypto.createHash('sha256')
 			.update(clientDataJSONBuffer)
 			.digest();
@@ -156,13 +163,19 @@ describe('2要素認証', () => {
 			.update(Buffer.concat([authenticatorData, hashedclientDataJSON]))
 			.sign(privateKey);
 		return {
-			authenticatorData: authenticatorData.toString('hex'),
-			credentialId: param.credentialId.toString('base64'),
-			challengeId: param.challengeId,
-			clientDataJSON: clientDataJSONBuffer.toString('hex'),
 			username,
 			password,
-			signature: signature.toString('hex'),
+			credential: <AuthenticationResponseJSON>{
+				id: param.credentialId.toString('base64url'),
+				rawId: param.credentialId.toString('base64url'),
+				response: <AuthenticatorAssertionResponseJSON>{
+					clientDataJSON: clientDataJSONBuffer.toString('base64url'),
+					authenticatorData: authenticatorData.toString('base64url'),
+					signature: signature.toString('base64url'),
+				},
+				clientExtensionResults: {},
+				type: 'public-key',
+			},
 			'g-recaptcha-response': null,
 			'hcaptcha-response': null,
 		};
@@ -191,7 +204,7 @@ describe('2要素認証', () => {
 		const doneResponse = await api('/i/2fa/done', {
 			token: otpToken(registerResponse.body.secret),
 		}, alice);
-		assert.strictEqual(doneResponse.status, 204);
+		assert.strictEqual(doneResponse.status, 200);

 		const usersShowResponse = await api('/users/show', {
 			username,
@@ -216,25 +229,24 @@ describe('2要素認証', () => {
 		const doneResponse = await api('/i/2fa/done', {
 			token: otpToken(registerResponse.body.secret),
 		}, alice);
-		assert.strictEqual(doneResponse.status, 204);
+		assert.strictEqual(doneResponse.status, 200);

 		const registerKeyResponse = await api('/i/2fa/register-key', {
 			password,
 		}, alice);
 		assert.strictEqual(registerKeyResponse.status, 200);
-		assert.notEqual(registerKeyResponse.body.challengeId, undefined);
+		assert.notEqual(registerKeyResponse.body.rp, undefined);
 		assert.notEqual(registerKeyResponse.body.challenge, undefined);

 		const keyName = 'example-key';
 		const credentialId = crypto.randomBytes(0x41);
 		const keyDoneResponse = await api('/i/2fa/key-done', keyDoneParam({
 			keyName,
-			challengeId: registerKeyResponse.body.challengeId,
-			challenge: registerKeyResponse.body.challenge,
 			credentialId,
+			creationOptions: registerKeyResponse.body,
 		}), alice);
 		assert.strictEqual(keyDoneResponse.status, 200);
-		assert.strictEqual(keyDoneResponse.body.id, credentialId.toString('hex'));
+		assert.strictEqual(keyDoneResponse.body.id, credentialId.toString('base64url'));
 		assert.strictEqual(keyDoneResponse.body.name, keyName);

 		const usersShowResponse = await api('/users/show', {
@@ -248,16 +260,14 @@ describe('2要素認証', () => {
 		});
 		assert.strictEqual(signinResponse.status, 200);
 		assert.strictEqual(signinResponse.body.i, undefined);
-		assert.notEqual(signinResponse.body.challengeId, undefined);
 		assert.notEqual(signinResponse.body.challenge, undefined);
-		assert.notEqual(signinResponse.body.securityKeys, undefined);
-		assert.strictEqual(signinResponse.body.securityKeys[0].id, credentialId.toString('hex'));
+		assert.notEqual(signinResponse.body.allowCredentials, undefined);
+		assert.strictEqual(signinResponse.body.allowCredentials[0].id, credentialId.toString('base64url'));

 		const signinResponse2 = await api('/signin', signinWithSecurityKeyParam({
 			keyName,
-			challengeId: signinResponse.body.challengeId,
-			challenge: signinResponse.body.challenge,
 			credentialId,
+			requestOptions: signinResponse.body,
 		}));
 		assert.strictEqual(signinResponse2.status, 200);
 		assert.notEqual(signinResponse2.body.i, undefined);
@@ -272,7 +282,7 @@ describe('2要素認証', () => {
 		const doneResponse = await api('/i/2fa/done', {
 			token: otpToken(registerResponse.body.secret),
 		}, alice);
-		assert.strictEqual(doneResponse.status, 204);
+		assert.strictEqual(doneResponse.status, 200);

 		const registerKeyResponse = await api('/i/2fa/register-key', {
 			password,
@@ -283,9 +293,8 @@ describe('2要素認証', () => {
 		const credentialId = crypto.randomBytes(0x41);
 		const keyDoneResponse = await api('/i/2fa/key-done', keyDoneParam({
 			keyName,
-			challengeId: registerKeyResponse.body.challengeId,
-			challenge: registerKeyResponse.body.challenge,
 			credentialId,
+			creationOptions: registerKeyResponse.body,
 		}), alice);
 		assert.strictEqual(keyDoneResponse.status, 200);

@@ -310,9 +319,8 @@ describe('2要素認証', () => {
 		const signinResponse2 = await api('/signin', {
 			...signinWithSecurityKeyParam({
 				keyName,
-				challengeId: signinResponse.body.challengeId,
-				challenge: signinResponse.body.challenge,
 				credentialId,
+				requestOptions: signinResponse.body,
 			}),
 			password: '',
 		});
@@ -329,7 +337,7 @@ describe('2要素認証', () => {
 		const doneResponse = await api('/i/2fa/done', {
 			token: otpToken(registerResponse.body.secret),
 		}, alice);
-		assert.strictEqual(doneResponse.status, 204);
+		assert.strictEqual(doneResponse.status, 200);

 		const registerKeyResponse = await api('/i/2fa/register-key', {
 			password,
@@ -340,23 +348,22 @@ describe('2要素認証', () => {
 		const credentialId = crypto.randomBytes(0x41);
 		const keyDoneResponse = await api('/i/2fa/key-done', keyDoneParam({
 			keyName,
-			challengeId: registerKeyResponse.body.challengeId,
-			challenge: registerKeyResponse.body.challenge,
 			credentialId,
+			creationOptions: registerKeyResponse.body,
 		}), alice);
 		assert.strictEqual(keyDoneResponse.status, 200);

 		const renamedKey = 'other-key';
 		const updateKeyResponse = await api('/i/2fa/update-key', {
 			name: renamedKey,
-			credentialId: credentialId.toString('hex'),
+			credentialId: credentialId.toString('base64url'),
 		}, alice);
 		assert.strictEqual(updateKeyResponse.status, 200);

 		const iResponse = await api('/i', {
 		}, alice);
 		assert.strictEqual(iResponse.status, 200);
-		const securityKeys = iResponse.body.securityKeysList.filter(s => s.id === credentialId.toString('hex'));
+		const securityKeys = iResponse.body.securityKeysList.filter((s: { id: string; }) => s.id === credentialId.toString('base64url'));
 		assert.strictEqual(securityKeys.length, 1);
 		assert.strictEqual(securityKeys[0].name, renamedKey);
 		assert.notEqual(securityKeys[0].lastUsed, undefined);
@@ -371,7 +378,7 @@ describe('2要素認証', () => {
 		const doneResponse = await api('/i/2fa/done', {
 			token: otpToken(registerResponse.body.secret),
 		}, alice);
-		assert.strictEqual(doneResponse.status, 204);
+		assert.strictEqual(doneResponse.status, 200);

 		const registerKeyResponse = await api('/i/2fa/register-key', {
 			password,
@@ -382,9 +389,8 @@ describe('2要素認証', () => {
 		const credentialId = crypto.randomBytes(0x41);
 		const keyDoneResponse = await api('/i/2fa/key-done', keyDoneParam({
 			keyName,
-			challengeId: registerKeyResponse.body.challengeId,
-			challenge: registerKeyResponse.body.challenge,
 			credentialId,
+			creationOptions: registerKeyResponse.body,
 		}), alice);
 		assert.strictEqual(keyDoneResponse.status, 200);

@@ -423,7 +429,7 @@ describe('2要素認証', () => {
 		const doneResponse = await api('/i/2fa/done', {
 			token: otpToken(registerResponse.body.secret),
 		}, alice);
-		assert.strictEqual(doneResponse.status, 204);
+		assert.strictEqual(doneResponse.status, 200);

 		const usersShowResponse = await api('/users/show', {
 			username,
--- a/packages/backend/test/e2e/users.ts
+++ b/packages/backend/test/e2e/users.ts
@@ -152,6 +152,7 @@ describe('ユーザー', () => {
 			preventAiLearning: user.preventAiLearning,
 			isExplorable: user.isExplorable,
 			isDeleted: user.isDeleted,
+			twoFactorBackupCodesStock: user.twoFactorBackupCodesStock,
 			hideOnlineStatus: user.hideOnlineStatus,
 			hasUnreadSpecifiedNotes: user.hasUnreadSpecifiedNotes,
 			hasUnreadMentions: user.hasUnreadMentions,
@@ -398,6 +399,7 @@ describe('ユーザー', () => {
 		assert.strictEqual(response.preventAiLearning, true);
 		assert.strictEqual(response.isExplorable, true);
 		assert.strictEqual(response.isDeleted, false);
+		assert.strictEqual(response.twoFactorBackupCodesStock, 'none');
 		assert.strictEqual(response.hideOnlineStatus, false);
 		assert.strictEqual(response.hasUnreadSpecifiedNotes, false);
 		assert.strictEqual(response.hasUnreadMentions, false);
--- a/packages/backend/test/tsconfig.json
+++ b/packages/backend/test/tsconfig.json
@@ -10,8 +10,8 @@
 		"declaration": false,
 		"sourceMap": true,
 		"target": "ES2022",
-		"module": "es2020",
-		"moduleResolution": "node16",
+		"module": "nodenext",
+		"moduleResolution": "nodenext",
 		"allowSyntheticDefaultImports": true,
 		"removeComments": false,
 		"noLib": false,
--- a/packages/backend/test/unit/AnnouncementService.ts
+++ b/packages/backend/test/unit/AnnouncementService.ts
@@ -10,9 +10,9 @@ import { ModuleMocker } from 'jest-mock';
 import { Test } from '@nestjs/testing';
 import { GlobalModule } from '@/GlobalModule.js';
 import { AnnouncementService } from '@/core/AnnouncementService.js';
-import type { Announcement, AnnouncementsRepository, AnnouncementReadsRepository, UsersRepository, User } from '@/models/index.js';
+import type { MiAnnouncement, AnnouncementsRepository, AnnouncementReadsRepository, UsersRepository, MiUser } from '@/models/index.js';
 import { DI } from '@/di-symbols.js';
-import { genAid } from '@/misc/id/aid.js';
+import { genAidx } from '@/misc/id/aidx.js';
 import { CacheService } from '@/core/CacheService.js';
 import { IdService } from '@/core/IdService.js';
 import { GlobalEventService } from '@/core/GlobalEventService.js';
@@ -30,10 +30,10 @@ describe('AnnouncementService', () => {
 	let announcementReadsRepository: AnnouncementReadsRepository;
 	let globalEventService: jest.Mocked<GlobalEventService>;

-	function createUser(data: Partial<User> = {}) {
+	function createUser(data: Partial<MiUser> = {}) {
 		const un = secureRndstr(16);
 		return usersRepository.insert({
-			id: genAid(new Date()),
+			id: genAidx(new Date()),
 			createdAt: new Date(),
 			username: un,
 			usernameLower: un,
@@ -42,9 +42,9 @@ describe('AnnouncementService', () => {
 			.then(x => usersRepository.findOneByOrFail(x.identifiers[0]));
 	}

-	function createAnnouncement(data: Partial<Announcement> = {}) {
+	function createAnnouncement(data: Partial<MiAnnouncement> = {}) {
 		return announcementsRepository.insert({
-			id: genAid(new Date()),
+			id: genAidx(new Date()),
 			createdAt: new Date(),
 			updatedAt: null,
 			title: 'Title',
--- a/packages/backend/test/unit/FetchInstanceMetadataService.ts
+++ b/packages/backend/test/unit/FetchInstanceMetadataService.ts
@@ -6,7 +6,6 @@
 process.env.NODE_ENV = 'test';

 import { jest } from '@jest/globals';
-import { ModuleMocker } from 'jest-mock';
 import { Test } from '@nestjs/testing';
 import { Redis } from 'ioredis';
 import { GlobalModule } from '@/GlobalModule.js';
@@ -18,7 +17,6 @@ import { UtilityService } from '@/core/UtilityService.js';
 import { IdService } from '@/core/IdService.js';
 import { DI } from '@/di-symbols.js';
 import type { TestingModule } from '@nestjs/testing';
-import type { MockFunctionMetadata } from 'jest-mock';

 function mockRedis() {
 	const hash = {};
@@ -35,9 +33,9 @@ describe('FetchInstanceMetadataService', () => {
 	let fetchInstanceMetadataService: jest.Mocked<FetchInstanceMetadataService>;
 	let federatedInstanceService: jest.Mocked<FederatedInstanceService>;
 	let httpRequestService: jest.Mocked<HttpRequestService>;
-	let redisClient: jest.Mocked<Redis.Redis>;
+	let redisClient: jest.Mocked<Redis>;

-	beforeAll(async () => {
+	beforeEach(async () => {
 		app = await Test
 			.createTestingModule({
 				imports: [
@@ -64,11 +62,11 @@ describe('FetchInstanceMetadataService', () => {

 		fetchInstanceMetadataService = app.get<FetchInstanceMetadataService>(FetchInstanceMetadataService);
 		federatedInstanceService = app.get<FederatedInstanceService>(FederatedInstanceService) as jest.Mocked<FederatedInstanceService>;
-		redisClient = app.get<Redis.Redis>(DI.redis) as jest.Mocked<Redis.Redis>;
+		redisClient = app.get<Redis>(DI.redis) as jest.Mocked<Redis>;
 		httpRequestService = app.get<HttpRequestService>(HttpRequestService) as jest.Mocked<HttpRequestService>;
 	});

-	afterAll(async () => {
+	afterEach(async () => {
 		await app.close();
 	});

@@ -85,6 +83,7 @@ describe('FetchInstanceMetadataService', () => {
 		expect(federatedInstanceService.fetch).toHaveBeenCalledTimes(1);
 		expect(httpRequestService.getJson).toHaveBeenCalled();
 	});
+
 	test('Lock and don\'t update', async () => {
 		redisClient.set = mockRedis();
 		const now = Date.now();
@@ -98,6 +97,7 @@ describe('FetchInstanceMetadataService', () => {
 		expect(federatedInstanceService.fetch).toHaveBeenCalledTimes(1);
 		expect(httpRequestService.getJson).toHaveBeenCalledTimes(0);
 	});
+
 	test('Do nothing when lock not acquired', async () => {
 		redisClient.set = mockRedis();
 		federatedInstanceService.fetch.mockReturnValue({ infoUpdatedAt: { getTime: () => now - 10 * 1000 * 60 * 60 * 24 } });
--- a/packages/backend/test/unit/RoleService.ts
+++ b/packages/backend/test/unit/RoleService.ts
@@ -11,10 +11,10 @@ import { Test } from '@nestjs/testing';
 import * as lolex from '@sinonjs/fake-timers';
 import { GlobalModule } from '@/GlobalModule.js';
 import { RoleService } from '@/core/RoleService.js';
-import type { Role, RolesRepository, RoleAssignmentsRepository, UsersRepository, User } from '@/models/index.js';
+import type { MiRole, RolesRepository, RoleAssignmentsRepository, UsersRepository, MiUser } from '@/models/index.js';
 import { DI } from '@/di-symbols.js';
 import { MetaService } from '@/core/MetaService.js';
-import { genAid } from '@/misc/id/aid.js';
+import { genAidx } from '@/misc/id/aidx.js';
 import { CacheService } from '@/core/CacheService.js';
 import { IdService } from '@/core/IdService.js';
 import { GlobalEventService } from '@/core/GlobalEventService.js';
@@ -34,10 +34,10 @@ describe('RoleService', () => {
 	let metaService: jest.Mocked<MetaService>;
 	let clock: lolex.InstalledClock;

-	function createUser(data: Partial<User> = {}) {
+	function createUser(data: Partial<MiUser> = {}) {
 		const un = secureRndstr(16);
 		return usersRepository.insert({
-			id: genAid(new Date()),
+			id: genAidx(new Date()),
 			createdAt: new Date(),
 			username: un,
 			usernameLower: un,
@@ -46,9 +46,9 @@ describe('RoleService', () => {
 			.then(x => usersRepository.findOneByOrFail(x.identifiers[0]));
 	}

-	function createRole(data: Partial<Role> = {}) {
+	function createRole(data: Partial<MiRole> = {}) {
 		return rolesRepository.insert({
-			id: genAid(new Date()),
+			id: genAidx(new Date()),
 			createdAt: new Date(),
 			updatedAt: new Date(),
 			lastUsedAt: new Date(),
@@ -204,7 +204,7 @@ describe('RoleService', () => {
 				createdAt: new Date(Date.now() - (1000 * 60 * 60 * 24 * 365)),
 				followersCount: 10,
 			});
-			const role = await createRole({
+			await createRole({
 				name: 'a',
 				policies: {
 					canManageCustomEmojis: {
--- a/packages/backend/test/unit/S3Service.ts
+++ b/packages/backend/test/unit/S3Service.ts
@@ -10,8 +10,8 @@ import { UploadPartCommand, CompleteMultipartUploadCommand, CreateMultipartUploa
 import { mockClient } from 'aws-sdk-client-mock';
 import { GlobalModule } from '@/GlobalModule.js';
 import { CoreModule } from '@/core/CoreModule.js';
-import { S3Service } from '@/core/S3Service';
-import { Meta } from '@/models';
+import { S3Service } from '@/core/S3Service.js';
+import { MiMeta } from '@/models/index.js';
 import type { TestingModule } from '@nestjs/testing';

 describe('S3Service', () => {
@@ -40,7 +40,7 @@ describe('S3Service', () => {
 		test('upload a file', async () => {
 			s3Mock.on(PutObjectCommand).resolves({});

-			await s3Service.upload({ objectStorageRegion: 'us-east-1' } as Meta, {
+			await s3Service.upload({ objectStorageRegion: 'us-east-1' } as MiMeta, {
 				Bucket: 'fake',
 				Key: 'fake',
 				Body: 'x',
@@ -52,7 +52,7 @@ describe('S3Service', () => {
 			s3Mock.on(UploadPartCommand).resolves({ ETag: '1' });
 			s3Mock.on(CompleteMultipartUploadCommand).resolves({ Bucket: 'fake', Key: 'fake' });

-			await s3Service.upload({} as Meta, {
+			await s3Service.upload({} as MiMeta, {
 				Bucket: 'fake',
 				Key: 'fake',
 				Body: 'x'.repeat(8 * 1024 * 1024 + 1), // デフォルトpartSizeにしている 8 * 1024 * 1024 を越えるサイズ
@@ -62,7 +62,7 @@ describe('S3Service', () => {
 		test('upload a file error', async () => {
 			s3Mock.on(PutObjectCommand).rejects({ name: 'Fake Error' });

-			await expect(s3Service.upload({ objectStorageRegion: 'us-east-1' } as Meta, {
+			await expect(s3Service.upload({ objectStorageRegion: 'us-east-1' } as MiMeta, {
 				Bucket: 'fake',
 				Key: 'fake',
 				Body: 'x',
@@ -72,7 +72,7 @@ describe('S3Service', () => {
 		test('upload a large file error', async () => {
 			s3Mock.on(UploadPartCommand).rejects();

-			await expect(s3Service.upload({} as Meta, {
+			await expect(s3Service.upload({} as MiMeta, {
 				Bucket: 'fake',
 				Key: 'fake',
 				Body: 'x'.repeat(8 * 1024 * 1024 + 1), // デフォルトpartSizeにしている 8 * 1024 * 1024 を越えるサイズ
--- a/packages/backend/test/unit/activitypub.ts
+++ b/packages/backend/test/unit/activitypub.ts
@@ -18,11 +18,11 @@ import { CoreModule } from '@/core/CoreModule.js';
 import { FederatedInstanceService } from '@/core/FederatedInstanceService.js';
 import { LoggerService } from '@/core/LoggerService.js';
 import type { IActivity, IApDocument, IActor, ICollection, IObject, IOrderedCollection, IOrderedCollectionPage, IPost } from '@/core/activitypub/type.js';
-import { Meta, Note } from '@/models/index.js';
+import { MiMeta, MiNote } from '@/models/index.js';
 import { secureRndstr } from '@/misc/secure-rndstr.js';
 import { DownloadService } from '@/core/DownloadService.js';
 import { MetaService } from '@/core/MetaService.js';
-import type { RemoteUser } from '@/models/entities/User.js';
+import type { MiRemoteUser } from '@/models/entities/User.js';
 import { MockResolver } from '../misc/mock-resolver.js';

 const host = 'https://host1.test';
@@ -132,7 +132,7 @@ function createRandomPagedOutbox(actor: NonTransientIActor): NonTransientIOrdere
 async function createRandomRemoteUser(
 	resolver: MockResolver,
 	personService: ApPersonService,
-): Promise<RemoteUser> {
+): Promise<MiRemoteUser> {
 	const actor = createRandomActor();
 	resolver.register(actor.id, actor);

@@ -151,7 +151,7 @@ describe('ActivityPub', () => {
 		cacheRemoteSensitiveFiles: true,
 		blockedHosts: [] as string[],
 		sensitiveWords: [] as string[],
-	} as Meta;
+	} as MiMeta;
 	let meta = metaInitial;

 	beforeAll(async () => {
@@ -166,7 +166,7 @@ describe('ActivityPub', () => {
 				},
 			})
 			.overrideProvider(MetaService).useValue({
-				async fetch(): Promise<Meta> {
+				async fetch(): Promise<MiMeta> {
 					return meta;
 				},
 			}).compile();
@@ -256,7 +256,7 @@ describe('ActivityPub', () => {
 			rendererService.renderAnnounce('hoge', {
 				createdAt: new Date(0),
 				visibility: 'followers',
-			} as Note);
+			} as MiNote);
 		});
 	});

--- a/packages/backend/test/unit/chart.ts
+++ b/packages/backend/test/unit/chart.ts
@@ -18,7 +18,7 @@ import { entity as TestGroupedChartEntity } from '@/core/chart/charts/entities/t
 import { entity as TestUniqueChartEntity } from '@/core/chart/charts/entities/test-unique.js';
 import { entity as TestIntersectionChartEntity } from '@/core/chart/charts/entities/test-intersection.js';
 import { loadConfig } from '@/config.js';
-import type { AppLockService } from '@/core/AppLockService';
+import type { AppLockService } from '@/core/AppLockService.js';
 import Logger from '@/logger.js';

 describe('Chart', () => {
--- a/packages/backend/test/unit/misc/correct-filename.ts
+++ b/packages/backend/test/unit/misc/correct-filename.ts
@@ -6,42 +6,42 @@
 import { correctFilename } from '@/misc/correct-filename.js';

 describe(correctFilename, () => {
-    it('no ext to null', () => {
-        expect(correctFilename('test', null)).toBe('test.unknown');
-    });
-    it('no ext to jpg', () => {
-        expect(correctFilename('test', 'jpg')).toBe('test.jpg');
-    });
-    it('jpg to webp', () => {
-        expect(correctFilename('test.jpg', 'webp')).toBe('test.jpg.webp');
-    });
-    it('jpg to .webp', () => {
-        expect(correctFilename('test.jpg', '.webp')).toBe('test.jpg.webp');
-    });
-    it('jpeg to jpg', () => {
-        expect(correctFilename('test.jpeg', 'jpg')).toBe('test.jpeg');
-    });
-    it('JPEG to jpg', () => {
-        expect(correctFilename('test.JPEG', 'jpg')).toBe('test.JPEG');
-    });
-    it('jpg to jpg', () => {
-        expect(correctFilename('test.jpg', 'jpg')).toBe('test.jpg');
-    });
-    it('JPG to jpg', () => {
-        expect(correctFilename('test.JPG', 'jpg')).toBe('test.JPG');
-    });
-    it('tiff to tif', () => {
-        expect(correctFilename('test.tiff', 'tif')).toBe('test.tiff');
-    });
-    it('skip gz', () => {
-        expect(correctFilename('test.unitypackage', 'gz')).toBe('test.unitypackage');
-    });
-    it('skip text file', () => {
-        expect(correctFilename('test.txt', null)).toBe('test.txt');
-    });
-    it('unknown', () => {
-        expect(correctFilename('test.hoge', null)).toBe('test.hoge');
-    });
+	it('no ext to null', () => {
+		expect(correctFilename('test', null)).toBe('test.unknown');
+	});
+	it('no ext to jpg', () => {
+		expect(correctFilename('test', 'jpg')).toBe('test.jpg');
+	});
+	it('jpg to webp', () => {
+		expect(correctFilename('test.jpg', 'webp')).toBe('test.jpg.webp');
+	});
+	it('jpg to .webp', () => {
+		expect(correctFilename('test.jpg', '.webp')).toBe('test.jpg.webp');
+	});
+	it('jpeg to jpg', () => {
+		expect(correctFilename('test.jpeg', 'jpg')).toBe('test.jpeg');
+	});
+	it('JPEG to jpg', () => {
+		expect(correctFilename('test.JPEG', 'jpg')).toBe('test.JPEG');
+	});
+	it('jpg to jpg', () => {
+		expect(correctFilename('test.jpg', 'jpg')).toBe('test.jpg');
+	});
+	it('JPG to jpg', () => {
+		expect(correctFilename('test.JPG', 'jpg')).toBe('test.JPG');
+	});
+	it('tiff to tif', () => {
+		expect(correctFilename('test.tiff', 'tif')).toBe('test.tiff');
+	});
+	it('skip gz', () => {
+		expect(correctFilename('test.unitypackage', 'gz')).toBe('test.unitypackage');
+	});
+	it('skip text file', () => {
+		expect(correctFilename('test.txt', null)).toBe('test.txt');
+	});
+	it('unknown', () => {
+		expect(correctFilename('test.hoge', null)).toBe('test.hoge');
+	});
 	test('non ascii with space', () => {
 		expect(correctFilename('ファイル 名前', 'jpg')).toBe('ファイル 名前.jpg');
 	});
--- a/packages/backend/test/unit/misc/id.ts
+++ b/packages/backend/test/unit/misc/id.ts
@@ -6,6 +6,7 @@
 import { ulid } from 'ulid';
 import { describe, test, expect } from '@jest/globals';
 import { aidRegExp, genAid, parseAid } from '@/misc/id/aid.js';
+import { aidxRegExp, genAidx, parseAidx } from '@/misc/id/aidx.js';
 import { genMeid, meidRegExp, parseMeid } from '@/misc/id/meid.js';
 import { genMeidg, meidgRegExp, parseMeidg } from '@/misc/id/meidg.js';
 import { genObjectId, objectIdRegExp, parseObjectId } from '@/misc/id/object-id.js';
@@ -19,6 +20,13 @@ describe('misc:id', () => {
 		expect(parseAid(gotAid).date.getTime()).toBe(date.getTime());
 	});

+	test('aidx', () => {
+		const date = new Date();
+		const gotAidx = genAidx(date);
+		expect(gotAidx).toMatch(aidxRegExp);
+		expect(parseAidx(gotAidx).date.getTime()).toBe(date.getTime());
+	});
+
 	test('meid', () => {
 		const date = new Date();
 		const gotMeid = genMeid(date);
--- a/packages/backend/test/utils.ts
+++ b/packages/backend/test/utils.ts
@@ -8,7 +8,7 @@ import { readFile } from 'node:fs/promises';
 import { isAbsolute, basename } from 'node:path';
 import { inspect } from 'node:util';
 import WebSocket, { ClientOptions } from 'ws';
-import fetch, { Blob, File, RequestInit } from 'node-fetch';
+import fetch, { File, RequestInit } from 'node-fetch';
 import { DataSource } from 'typeorm';
 import { JSDOM } from 'jsdom';
 import { DEFAULT_POLICIES } from '@/core/RoleService.js';
--- a/packages/backend/tsconfig.json
+++ b/packages/backend/tsconfig.json
@@ -10,8 +10,8 @@
 		"declaration": false,
 		"sourceMap": false,
 		"target": "ES2022",
-		"module": "ESNext",
-		"moduleResolution": "node16",
+		"module": "nodenext",
+		"moduleResolution": "nodenext",
 		"allowSyntheticDefaultImports": true,
 		"removeComments": false,
 		"noLib": false,
@@ -33,8 +33,9 @@
 			"node"
 		],
 		"typeRoots": [
+			"./src/@types",
 			"./node_modules/@types",
-			"./src/@types"
+			"./node_modules"
 		],
 		"lib": [
 			"esnext"
--- a/packages/frontend/.storybook/changes.ts
+++ b/packages/frontend/.storybook/changes.ts
@@ -1,3 +1,8 @@
+/*
+ * SPDX-FileCopyrightText: syuilo and other misskey contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
 import fs from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
--- a/packages/frontend/.storybook/fakes.ts
+++ b/packages/frontend/.storybook/fakes.ts
@@ -1,3 +1,8 @@
+/*
+ * SPDX-FileCopyrightText: syuilo and other misskey contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
 import type { entities } from 'misskey-js'

 export function abuseUserReport() {
@@ -110,6 +115,7 @@ export function userDetailed(id = 'someuserid', username = 'miskist', host = 'mi
 		publicReactions: false,
 		securityKeys: false,
 		twoFactorEnabled: false,
+		twoFactorBackupCodesStock: 'none',
 		updatedAt: null,
 		uri: null,
 		url: null,
--- a/packages/frontend/.storybook/generate.tsx
+++ b/packages/frontend/.storybook/generate.tsx
@@ -1,3 +1,8 @@
+/*
+ * SPDX-FileCopyrightText: syuilo and other misskey contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
 import { existsSync, readFileSync } from 'node:fs';
 import { writeFile } from 'node:fs/promises';
 import { basename, dirname } from 'node:path/posix';
--- a/packages/frontend/.storybook/main.ts
+++ b/packages/frontend/.storybook/main.ts
@@ -1,3 +1,8 @@
+/*
+ * SPDX-FileCopyrightText: syuilo and other misskey contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
 import { resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import type { StorybookConfig } from '@storybook/vue3-vite';
--- a/packages/frontend/.storybook/manager.ts
+++ b/packages/frontend/.storybook/manager.ts
@@ -1,3 +1,8 @@
+/*
+ * SPDX-FileCopyrightText: syuilo and other misskey contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
 import { addons } from '@storybook/manager-api';
 import { create } from '@storybook/theming/create';

--- a/packages/frontend/.storybook/mocks.ts
+++ b/packages/frontend/.storybook/mocks.ts
@@ -1,3 +1,8 @@
+/*
+ * SPDX-FileCopyrightText: syuilo and other misskey contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
 import { type SharedOptions, rest } from 'msw';

 export const onUnhandledRequest = ((req, print) => {
--- a/packages/frontend/.storybook/preload-locale.ts
+++ b/packages/frontend/.storybook/preload-locale.ts
@@ -1,3 +1,8 @@
+/*
+ * SPDX-FileCopyrightText: syuilo and other misskey contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
 import { writeFile } from 'node:fs/promises';
 import locales from '../../../locales/index.js';

--- a/packages/frontend/.storybook/preload-theme.ts
+++ b/packages/frontend/.storybook/preload-theme.ts
@@ -1,3 +1,8 @@
+/*
+ * SPDX-FileCopyrightText: syuilo and other misskey contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
 import { readFile, writeFile } from 'node:fs/promises';
 import JSON5 from 'json5';

--- a/packages/frontend/.storybook/preview-head.html
+++ b/packages/frontend/.storybook/preview-head.html
@@ -1,6 +1,6 @@
 <link rel="preload" href="https://github.com/misskey-dev/misskey/blob/master/packages/frontend/assets/about-icon.png?raw=true" as="image" type="image/png" crossorigin="anonymous">
 <link rel="preload" href="https://github.com/misskey-dev/misskey/blob/master/packages/frontend/assets/fedi.jpg?raw=true" as="image" type="image/jpeg" crossorigin="anonymous">
-<link rel="stylesheet" href="https://unpkg.com/@tabler/icons-webfont@2.21.0/tabler-icons.min.css">
+<link rel="stylesheet" href="https://unpkg.com/@tabler/icons-webfont@2.32.0/tabler-icons.min.css">
 <link rel="stylesheet" href="https://unpkg.com/@fontsource/m-plus-rounded-1c/index.css">
 <style>
 	html {
--- a/packages/frontend/.storybook/preview.ts
+++ b/packages/frontend/.storybook/preview.ts
@@ -1,3 +1,8 @@
+/*
+ * SPDX-FileCopyrightText: syuilo and other misskey contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
 import { addons } from '@storybook/addons';
 import { FORCE_REMOUNT } from '@storybook/core-events';
 import { type Preview, setup } from '@storybook/vue3';
--- a/packages/frontend/.storybook/tsconfig.json
+++ b/packages/frontend/.storybook/tsconfig.json
@@ -6,6 +6,7 @@
 		"allowUnusedLabels": false,
 		"allowUnreachableCode": false,
 		"exactOptionalPropertyTypes": true,
+		"noEmitOnError": false,
 		"noFallthroughCasesInSwitch": true,
 		"noImplicitOverride": true,
 		"noImplicitReturns": true,
--- a/packages/frontend/package.json
+++ b/packages/frontend/package.json
@@ -5,7 +5,7 @@
 		"watch": "vite",
 		"build": "vite build",
 		"storybook-dev": "nodemon --verbose --watch src --ext \"mdx,ts,vue\" --ignore \"*.stories.ts\" --exec \"pnpm build-storybook-pre && pnpm exec storybook dev -p 6006 --ci\"",
-		"build-storybook-pre": "tsc -p .storybook && node .storybook/generate.js && node .storybook/preload-locale.js && node .storybook/preload-theme.js",
+		"build-storybook-pre": "(tsc -p .storybook || echo done.) && node .storybook/generate.js && node .storybook/preload-locale.js && node .storybook/preload-theme.js",
 		"build-storybook": "pnpm build-storybook-pre && storybook build",
 		"chromatic": "chromatic",
 		"test": "vitest --run",
@@ -16,29 +16,30 @@
 	},
 	"dependencies": {
 		"@discordapp/twemoji": "14.1.2",
+		"@github/webauthn-json": "2.1.1",
 		"@rollup/plugin-alias": "5.0.0",
 		"@rollup/plugin-json": "6.0.0",
 		"@rollup/plugin-replace": "5.0.2",
-		"@rollup/pluginutils": "5.0.2",
+		"@rollup/pluginutils": "5.0.4",
 		"@syuilo/aiscript": "0.15.0",
-		"@tabler/icons-webfont": "2.30.0",
-		"@vitejs/plugin-vue": "4.2.3",
-		"@vue-macros/reactivity-transform": "0.3.16",
+		"@tabler/icons-webfont": "2.32.0",
+		"@vitejs/plugin-vue": "4.3.4",
+		"@vue-macros/reactivity-transform": "0.3.22",
 		"@vue/compiler-sfc": "3.3.4",
 		"astring": "1.8.6",
 		"autosize": "6.0.1",
-		"broadcast-channel": "5.1.0",
+		"broadcast-channel": "5.3.0",
 		"browser-image-resizer": "github:misskey-dev/browser-image-resizer#v2.2.1-misskey.3",
 		"buraha": "0.0.1",
 		"canvas-confetti": "1.6.0",
-		"chart.js": "4.3.2",
+		"chart.js": "4.4.0",
 		"chartjs-adapter-date-fns": "3.0.0",
 		"chartjs-chart-matrix": "2.0.1",
 		"chartjs-plugin-gradient": "0.6.1",
 		"chartjs-plugin-zoom": "2.0.1",
-		"chromatic": "6.19.9",
-		"compare-versions": "6.0.0",
-		"cropperjs": "2.0.0-beta.3",
+		"chromatic": "6.24.1",
+		"compare-versions": "6.1.0",
+		"cropperjs": "2.0.0-beta.4",
 		"date-fns": "2.30.0",
 		"escape-regexp": "0.0.1",
 		"estree-walker": "^3.0.3",
@@ -51,92 +52,88 @@
 		"matter-js": "0.19.0",
 		"mfm-js": "0.23.3",
 		"misskey-js": "workspace:*",
-		"photoswipe": "5.3.8",
+		"photoswipe": "5.3.9",
 		"prismjs": "1.29.0",
 		"punycode": "2.3.0",
 		"querystring": "0.2.1",
-		"rollup": "3.27.0",
+		"rollup": "3.28.1",
 		"s-age": "1.1.2",
 		"sanitize-html": "2.11.0",
-		"sass": "1.64.1",
+		"sass": "1.66.1",
 		"strict-event-emitter-types": "2.0.0",
 		"syuilo-password-strength": "0.0.1",
 		"textarea-caret": "3.1.0",
-		"three": "0.155.0",
+		"three": "0.156.0",
 		"throttle-debounce": "5.0.0",
 		"tinycolor2": "1.6.0",
 		"tsc-alias": "1.8.7",
 		"tsconfig-paths": "4.2.0",
 		"twemoji-parser": "14.0.0",
-		"typescript": "5.1.6",
+		"typescript": "5.2.2",
 		"uuid": "9.0.0",
-		"vanilla-tilt": "1.8.0",
-		"vite": "4.4.7",
+		"vanilla-tilt": "1.8.1",
+		"vite": "4.4.9",
 		"vue": "3.3.4",
 		"vue-prism-editor": "2.0.0-alpha.2",
 		"vuedraggable": "next"
 	},
 	"devDependencies": {
-		"@storybook/addon-actions": "7.0.27",
-		"@storybook/addon-essentials": "7.0.27",
-		"@storybook/addon-interactions": "7.0.27",
-		"@storybook/addon-links": "7.0.27",
-		"@storybook/addon-storysource": "7.0.27",
-		"@storybook/addons": "7.0.27",
-		"@storybook/blocks": "7.0.27",
-		"@storybook/core-events": "7.0.27",
-		"@storybook/jest": "0.1.0",
-		"@storybook/manager-api": "7.0.27",
-		"@storybook/preview-api": "7.0.27",
-		"@storybook/react": "7.0.27",
-		"@storybook/react-vite": "7.0.27",
+		"@storybook/addon-actions": "7.4.0",
+		"@storybook/addon-essentials": "7.4.0",
+		"@storybook/addon-interactions": "7.4.0",
+		"@storybook/addon-links": "7.4.0",
+		"@storybook/addon-storysource": "7.4.0",
+		"@storybook/addons": "7.4.0",
+		"@storybook/blocks": "7.4.0",
+		"@storybook/core-events": "7.4.0",
+		"@storybook/jest": "0.2.2",
+		"@storybook/manager-api": "7.4.0",
+		"@storybook/preview-api": "7.4.0",
+		"@storybook/react": "7.4.0",
+		"@storybook/react-vite": "7.4.0",
 		"@storybook/testing-library": "0.2.0",
-		"@storybook/theming": "7.0.27",
-		"@storybook/types": "7.0.27",
-		"@storybook/vue3": "7.0.27",
-		"@storybook/vue3-vite": "7.0.27",
-		"@testing-library/jest-dom": "5.16.5",
+		"@storybook/theming": "7.4.0",
+		"@storybook/types": "7.4.0",
+		"@storybook/vue3": "7.4.0",
+		"@storybook/vue3-vite": "7.4.0",
 		"@testing-library/vue": "7.0.0",
 		"@types/escape-regexp": "0.0.1",
 		"@types/estree": "1.0.1",
-		"@types/gulp": "4.0.13",
-		"@types/gulp-rename": "2.0.2",
-		"@types/matter-js": "0.18.5",
+		"@types/matter-js": "0.19.0",
 		"@types/micromatch": "4.0.2",
-		"@types/node": "20.4.5",
+		"@types/node": "20.5.9",
 		"@types/punycode": "2.1.0",
 		"@types/sanitize-html": "2.9.0",
-		"@types/testing-library__jest-dom": "5.14.9",
 		"@types/throttle-debounce": "5.0.0",
 		"@types/tinycolor2": "1.4.3",
-		"@types/uuid": "9.0.2",
-		"@types/websocket": "1.0.5",
+		"@types/uuid": "9.0.3",
+		"@types/websocket": "1.0.6",
 		"@types/ws": "8.5.5",
-		"@typescript-eslint/eslint-plugin": "6.2.0",
-		"@typescript-eslint/parser": "6.2.0",
-		"@vitest/coverage-v8": "0.33.0",
+		"@typescript-eslint/eslint-plugin": "6.6.0",
+		"@typescript-eslint/parser": "6.6.0",
+		"@vitest/coverage-v8": "0.34.3",
 		"@vue/runtime-core": "3.3.4",
 		"acorn": "8.10.0",
 		"cross-env": "7.0.3",
-		"cypress": "12.17.2",
-		"eslint": "8.46.0",
-		"eslint-plugin-import": "2.28.0",
-		"eslint-plugin-vue": "9.16.1",
+		"cypress": "13.1.0",
+		"eslint": "8.48.0",
+		"eslint-plugin-import": "2.28.1",
+		"eslint-plugin-vue": "9.17.0",
 		"fast-glob": "3.3.1",
 		"happy-dom": "10.0.3",
 		"micromatch": "4.0.5",
-		"msw": "1.2.3",
+		"msw": "1.3.0",
 		"msw-storybook-addon": "1.8.0",
 		"nodemon": "3.0.1",
-		"prettier": "3.0.0",
+		"prettier": "3.0.3",
 		"react": "18.2.0",
 		"react-dom": "18.2.0",
 		"start-server-and-test": "2.0.0",
-		"storybook": "7.0.27",
+		"storybook": "7.4.0",
 		"storybook-addon-misskey-theme": "github:misskey-dev/storybook-addon-misskey-theme",
 		"summaly": "github:misskey-dev/summaly",
 		"vite-plugin-turbosnap": "1.0.2",
-		"vitest": "0.33.0",
+		"vitest": "0.34.3",
 		"vitest-fetch-mock": "0.2.2",
 		"vue-eslint-parser": "9.3.1",
 		"vue-tsc": "1.8.8"
--- a/packages/frontend/src/account.ts
+++ b/packages/frontend/src/account.ts
@@ -4,7 +4,7 @@
 */

 import { defineAsyncComponent, reactive, ref } from 'vue';
-import * as misskey from 'misskey-js';
+import * as Misskey from 'misskey-js';
 import { showSuspendedDialog } from './scripts/show-suspended-dialog';
 import { i18n } from './i18n';
 import { miLocalStorage } from './local-storage';
@@ -16,7 +16,7 @@ import { unisonReload, reloadChannel } from '@/scripts/unison-reload';

 // TODO: 他のタブと永続化されたstateを同期

-type Account = misskey.entities.MeDetailed;
+type Account = Misskey.entities.MeDetailed;

 const accountData = miLocalStorage.getItem('account');

@@ -211,8 +211,8 @@ export async function login(token: Account['token'], redirect?: string) {
 export async function openAccountMenu(opts: {
 	includeCurrentAccount?: boolean;
 	withExtraOperation: boolean;
-	active?: misskey.entities.UserDetailed['id'];
-	onChoose?: (account: misskey.entities.UserDetailed) => void;
+	active?: Misskey.entities.UserDetailed['id'];
+	onChoose?: (account: Misskey.entities.UserDetailed) => void;
 }, ev: MouseEvent) {
 	if (!$i) return;

@@ -234,7 +234,7 @@ export async function openAccountMenu(opts: {
 		}, 'closed');
 	}

-	async function switchAccount(account: misskey.entities.UserDetailed) {
+	async function switchAccount(account: Misskey.entities.UserDetailed) {
 		const storedAccounts = await getAccounts();
 		const found = storedAccounts.find(x => x.id === account.id);
 		if (found == null) return;
@@ -248,7 +248,7 @@ export async function openAccountMenu(opts: {
 	const storedAccounts = await getAccounts().then(accounts => accounts.filter(x => x.id !== $i.id));
 	const accountsPromise = api('users/show', { userIds: storedAccounts.map(x => x.id) });

-	function createItem(account: misskey.entities.UserDetailed) {
+	function createItem(account: Misskey.entities.UserDetailed) {
 		return {
 			type: 'user' as const,
 			user: account,
--- a/packages/frontend/src/cache.ts
+++ b/packages/frontend/src/cache.ts
@@ -3,10 +3,11 @@
 * SPDX-License-Identifier: AGPL-3.0-only
 */

-import * as misskey from 'misskey-js';
+import * as Misskey from 'misskey-js';
 import { Cache } from '@/scripts/cache';
+import { api } from '@/os';

-export const clipsCache = new Cache<misskey.entities.Clip[]>(Infinity);
-export const rolesCache = new Cache(Infinity);
-export const userListsCache = new Cache<misskey.entities.UserList[]>(Infinity);
-export const antennasCache = new Cache<misskey.entities.Antenna[]>(Infinity);
+export const clipsCache = new Cache<Misskey.entities.Clip[]>(1000 * 60 * 30, () => api('clips/list'));
+export const rolesCache = new Cache(1000 * 60 * 30, () => api('admin/roles/list'));
+export const userListsCache = new Cache<Misskey.entities.UserList[]>(1000 * 60 * 30, () => api('users/lists/list'));
+export const antennasCache = new Cache<Misskey.entities.Antenna[]>(1000 * 60 * 30, () => api('antennas/list'));
--- a/packages/frontend/src/components/MkAccountMoved.vue
+++ b/packages/frontend/src/components/MkAccountMoved.vue
@@ -13,13 +13,13 @@ SPDX-License-Identifier: AGPL-3.0-only

 <script lang="ts" setup>
 import { ref } from 'vue';
-import { UserLite } from 'misskey-js/built/entities';
+import * as Misskey from 'misskey-js';
 import MkMention from './MkMention.vue';
 import { i18n } from '@/i18n';
 import { host as localHost } from '@/config';
 import { api } from '@/os';

-const user = ref<UserLite>();
+const user = ref<Misskey.entities.UserLite>();

 const props = defineProps<{
 	movedTo: string; // user id
--- a/packages/frontend/src/components/MkAchievements.vue
+++ b/packages/frontend/src/components/MkAchievements.vue
@@ -52,14 +52,14 @@ SPDX-License-Identifier: AGPL-3.0-only
 </template>

 <script lang="ts" setup>
-import * as misskey from 'misskey-js';
+import * as Misskey from 'misskey-js';
 import { onMounted } from 'vue';
 import * as os from '@/os';
 import { i18n } from '@/i18n';
 import { ACHIEVEMENT_TYPES, ACHIEVEMENT_BADGES, claimAchievement } from '@/scripts/achievements';

 const props = withDefaults(defineProps<{
-	user: misskey.entities.User;
+	user: Misskey.entities.User;
 	withLocked: boolean;
 	withDescription: boolean;
 }>(), {
--- a/packages/frontend/src/components/MkAnnouncementDialog.vue
+++ b/packages/frontend/src/components/MkAnnouncementDialog.vue
@@ -23,7 +23,7 @@ SPDX-License-Identifier: AGPL-3.0-only

 <script lang="ts" setup>
 import { onMounted, shallowRef } from 'vue';
-import * as misskey from 'misskey-js';
+import * as Misskey from 'misskey-js';
 import * as os from '@/os';
 import MkModal from '@/components/MkModal.vue';
 import MkButton from '@/components/MkButton.vue';
@@ -31,7 +31,7 @@ import { i18n } from '@/i18n';
 import { $i, updateAccount } from '@/account';

 const props = withDefaults(defineProps<{
-	announcement: misskey.entities.Announcement;
+	announcement: Misskey.entities.Announcement;
 }>(), {
 });

--- a/packages/frontend/src/components/MkAsUi.vue
+++ b/packages/frontend/src/components/MkAsUi.vue
@@ -38,6 +38,13 @@ SPDX-License-Identifier: AGPL-3.0-only
 		<option v-for="item in c.items" :key="item.value" :value="item.value">{{ item.text }}</option>
 	</MkSelect>
 	<MkButton v-else-if="c.type === 'postFormButton'" :primary="c.primary" :rounded="c.rounded" :small="size === 'small'" inline @click="openPostForm">{{ c.text }}</MkButton>
+	<div v-else-if="c.type === 'postForm'" :class="$style.postForm">
+		<MkPostForm
+			fixed
+			:instant="true"
+			:initialText="c.form.text"
+		/>
+	</div>
 	<MkFolder v-else-if="c.type === 'folder'" :defaultOpen="c.opened">
 		<template #label>{{ c.title }}</template>
 		<template v-for="child in c.children" :key="child">
@@ -62,6 +69,7 @@ import MkTextarea from '@/components/MkTextarea.vue';
 import MkSelect from '@/components/MkSelect.vue';
 import { AsUiComponent } from '@/scripts/aiscript/ui';
 import MkFolder from '@/components/MkFolder.vue';
+import MkPostForm from '@/components/MkPostForm.vue';

 const props = withDefaults(defineProps<{
 	component: AsUiComponent;
@@ -114,4 +122,9 @@ function openPostForm() {
 .fontMonospace {
 	font-family: Fira code, Fira Mono, Consolas, Menlo, Courier, monospace;
 }
+
+.postForm {
+	background: var(--bg);
+	border-radius: 8px;
+}
 </style>
--- a/packages/frontend/src/components/MkAvatars.vue
+++ b/packages/frontend/src/components/MkAvatars.vue
@@ -14,8 +14,8 @@ SPDX-License-Identifier: AGPL-3.0-only

 <script lang="ts" setup>
 import { onMounted, ref } from 'vue';
+import * as Misskey from 'misskey-js';
 import * as os from '@/os';
-import { UserLite } from 'misskey-js/built/entities';

 const props = withDefaults(defineProps<{
 	userIds: string[];
@@ -24,11 +24,11 @@ const props = withDefaults(defineProps<{
 	limit: Infinity,
 });

-const users = ref<UserLite[]>([]);
+const users = ref<Misskey.entities.UserLite[]>([]);

 onMounted(async () => {
 	users.value = await os.api('users/show', {
 		userIds: props.userIds,
-	}) as unknown as UserLite[];
+	}) as unknown as Misskey.entities.UserLite[];
 });
 </script>
--- a/packages/frontend/src/components/MkCropperDialog.vue
+++ b/packages/frontend/src/components/MkCropperDialog.vue
@@ -32,7 +32,7 @@ SPDX-License-Identifier: AGPL-3.0-only

 <script lang="ts" setup>
 import { onMounted } from 'vue';
-import * as misskey from 'misskey-js';
+import * as Misskey from 'misskey-js';
 import Cropper from 'cropperjs';
 import tinycolor from 'tinycolor2';
 import MkModalWindow from '@/components/MkModalWindow.vue';
@@ -44,13 +44,13 @@ import { i18n } from '@/i18n';
 import { getProxiedImageUrl } from '@/scripts/media-proxy';

 const emit = defineEmits<{
-	(ev: 'ok', cropped: misskey.entities.DriveFile): void;
+	(ev: 'ok', cropped: Misskey.entities.DriveFile): void;
 	(ev: 'cancel'): void;
 	(ev: 'closed'): void;
 }>();

 const props = defineProps<{
-	file: misskey.entities.DriveFile;
+	file: Misskey.entities.DriveFile;
 	aspectRatio: number;
 	uploadFolder?: string | null;
 }>();
@@ -62,7 +62,7 @@ let cropper: Cropper | null = null;
 let loading = $ref(true);

 const ok = async () => {
-	const promise = new Promise<misskey.entities.DriveFile>(async (res) => {
+	const promise = new Promise<Misskey.entities.DriveFile>(async (res) => {
 		const croppedCanvas = await cropper?.getCropperSelection()?.$toCanvas();
 		croppedCanvas?.toBlob(blob => {
 			if (!blob) return;
--- a/packages/frontend/src/components/MkCwButton.vue
+++ b/packages/frontend/src/components/MkCwButton.vue
@@ -12,13 +12,13 @@ SPDX-License-Identifier: AGPL-3.0-only

 <script lang="ts" setup>
 import { computed } from 'vue';
-import * as misskey from 'misskey-js';
+import * as Misskey from 'misskey-js';
 import { concat } from '@/scripts/array';
 import { i18n } from '@/i18n';

 const props = defineProps<{
 	modelValue: boolean;
-	note: misskey.entities.Note;
+	note: Misskey.entities.Note;
 }>();

 const emit = defineEmits<{
--- a/packages/frontend/src/components/MkFileListForAdmin.vue
+++ b/packages/frontend/src/components/MkFileListForAdmin.vue
@@ -9,7 +9,7 @@ SPDX-License-Identifier: AGPL-3.0-only
 		<MkA
 			v-for="file in items"
 			:key="file.id"
-			v-tooltip.mfm="`${file.type}\n${bytes(file.size)}\n${dateString(file.createdAt)}\nby ${file.user ? '@' + Acct.toString(file.user) : 'system'}`"
+			v-tooltip.mfm="`${file.type}\n${bytes(file.size)}\n${dateString(file.createdAt)}\nby ${file.user ? '@' + Misskey.acct.toString(file.user) : 'system'}`"
 			:to="`/admin/file/${file.id}`"
 			class="file _button"
 		>
@@ -37,7 +37,7 @@ SPDX-License-Identifier: AGPL-3.0-only
 </template>

 <script lang="ts" setup>
-import * as Acct from 'misskey-js/built/acct';
+import * as Misskey from 'misskey-js';
 import MkPagination from '@/components/MkPagination.vue';
 import MkDriveFileThumbnail from '@/components/MkDriveFileThumbnail.vue';
 import bytes from '@/filters/bytes';
--- a/packages/frontend/src/components/MkFlashPreview.vue
+++ b/packages/frontend/src/components/MkFlashPreview.vue
@@ -23,7 +23,7 @@ import { } from 'vue';
 import { userName } from '@/filters/user';

 const props = defineProps<{
-	//flash: misskey.entities.Flash;
+	//flash: Misskey.entities.Flash;
 	flash: any;
 }>();
 </script>
--- a/packages/frontend/src/components/MkGalleryPostPreview.vue
+++ b/packages/frontend/src/components/MkGalleryPostPreview.vue
@@ -32,13 +32,13 @@ SPDX-License-Identifier: AGPL-3.0-only
 </template>

 <script lang="ts" setup>
-import * as misskey from 'misskey-js';
+import * as Misskey from 'misskey-js';
 import { computed, ref } from 'vue';
 import ImgWithBlurhash from '@/components/MkImgWithBlurhash.vue';
 import { defaultStore } from '@/store';

 const props = defineProps<{
-	post: misskey.entities.GalleryPost;
+	post: Misskey.entities.GalleryPost;
 }>();

 const hover = ref(false);
--- a/packages/frontend/src/components/MkInstanceCardMini.vue
+++ b/packages/frontend/src/components/MkInstanceCardMini.vue
@@ -15,13 +15,13 @@ SPDX-License-Identifier: AGPL-3.0-only
 </template>

 <script lang="ts" setup>
-import * as misskey from 'misskey-js';
+import * as Misskey from 'misskey-js';
 import MkMiniChart from '@/components/MkMiniChart.vue';
 import * as os from '@/os';
 import { getProxiedImageUrlNullable } from '@/scripts/media-proxy';

 const props = defineProps<{
-	instance: misskey.entities.Instance;
+	instance: Misskey.entities.Instance;
 }>();

 let chartValues = $ref<number[] | null>(null);
--- a/packages/frontend/src/components/MkInviteCode.vue
+++ b/packages/frontend/src/components/MkInviteCode.vue
@@ -59,7 +59,7 @@ SPDX-License-Identifier: AGPL-3.0-only

 <script lang="ts" setup>
 import { computed } from 'vue';
-import * as misskey from 'misskey-js';
+import * as Misskey from 'misskey-js';
 import MkFolder from '@/components/MkFolder.vue';
 import MkButton from '@/components/MkButton.vue';
 import copyToClipboard from '@/scripts/copy-to-clipboard';
@@ -67,7 +67,7 @@ import { i18n } from '@/i18n';
 import * as os from '@/os';

 const props = defineProps<{
-	invite: misskey.entities.Invite;
+	invite: Misskey.entities.Invite;
 	moderator?: boolean;
 }>();

--- a/packages/frontend/src/components/MkMediaBanner.vue
+++ b/packages/frontend/src/components/MkMediaBanner.vue
@@ -34,12 +34,12 @@ SPDX-License-Identifier: AGPL-3.0-only

 <script lang="ts" setup>
 import { onMounted } from 'vue';
-import * as misskey from 'misskey-js';
+import * as Misskey from 'misskey-js';
 import { soundConfigStore } from '@/scripts/sound';
 import { i18n } from '@/i18n';

 const props = withDefaults(defineProps<{
-	media: misskey.entities.DriveFile;
+	media: Misskey.entities.DriveFile;
 }>(), {
 });

--- a/packages/frontend/src/components/MkMediaImage.vue
+++ b/packages/frontend/src/components/MkMediaImage.vue
@@ -5,33 +5,40 @@ SPDX-License-Identifier: AGPL-3.0-only

 <template>
 <div :class="hide ? $style.hidden : $style.visible" :style="darkMode ? '--c: rgb(255 255 255 / 2%);' : '--c: rgb(0 0 0 / 2%);'" @click="onclick">
-	<a
-		:class="$style.imageContainer"
-		:href="image.url"
-		:title="image.name"
+	<component
+		:is="disableImageLink ? 'div' : 'a'"
+		v-bind="disableImageLink ? {
+			title: image.name,
+			class: $style.imageContainer,
+		} : {
+			title: image.name,
+			class: $style.imageContainer,
+			href: image.url,
+			style: 'cursor: zoom-in;'
+		}"
 	>
 		<ImgWithBlurhash
 			:hash="image.blurhash"
 			:src="(defaultStore.state.enableDataSaverMode && hide) ? null : url"
 			:forceBlurhash="hide"
-			:cover="hide"
+			:cover="hide || cover"
 			:alt="image.comment || image.name"
 			:title="image.comment || image.name"
 			:width="image.properties.width"
 			:height="image.properties.height"
 			:style="hide ? 'filter: brightness(0.5);' : null"
 		/>
-	</a>
+	</component>
 	<template v-if="hide">
 		<div :class="$style.hiddenText">
 			<div :class="$style.hiddenTextWrapper">
 				<b v-if="image.isSensitive" style="display: block;"><i class="ti ti-eye-exclamation"></i> {{ i18n.ts.sensitive }}{{ defaultStore.state.enableDataSaverMode ? ` (${i18n.ts.image}${image.size ? ' ' + bytes(image.size) : ''})` : '' }}</b>
 				<b v-else style="display: block;"><i class="ti ti-photo"></i> {{ defaultStore.state.enableDataSaverMode && image.size ? bytes(image.size) : i18n.ts.image }}</b>
-				<span style="display: block;">{{ i18n.ts.clickToShow }}</span>
+				<span v-if="controls" style="display: block;">{{ i18n.ts.clickToShow }}</span>
 			</div>
 		</div>
 	</template>
-	<template v-else>
+	<template v-else-if="controls">
 		<div :class="$style.indicators">
 			<div v-if="['image/gif', 'image/apng'].includes(image.type)" :class="$style.indicator">GIF</div>
 			<div v-if="image.comment" :class="$style.indicator">ALT</div>
@@ -45,7 +52,7 @@ SPDX-License-Identifier: AGPL-3.0-only

 <script lang="ts" setup>
 import { watch } from 'vue';
-import * as misskey from 'misskey-js';
+import * as Misskey from 'misskey-js';
 import { getStaticImageUrl } from '@/scripts/media-proxy';
 import bytes from '@/filters/bytes';
 import ImgWithBlurhash from '@/components/MkImgWithBlurhash.vue';
@@ -54,10 +61,17 @@ import { i18n } from '@/i18n';
 import * as os from '@/os';
 import { iAmModerator } from '@/account';

-const props = defineProps<{
-	image: misskey.entities.DriveFile;
+const props = withDefaults(defineProps<{
+	image: Misskey.entities.DriveFile;
 	raw?: boolean;
-}>();
+	cover?: boolean;
+	disableImageLink?: boolean;
+	controls?: boolean;
+}>(), {
+	cover: false,
+	disableImageLink: false,
+	controls: true,
+});

 let hide = $ref(true);
 let darkMode: boolean = $ref(defaultStore.state.darkMode);
@@ -70,6 +84,9 @@ const url = $computed(() => (props.raw || defaultStore.state.loadRawImages)
 );

 function onclick() {
+	if (!props.controls) {
+		return;
+	}
 	if (hide) {
 		hide = false;
 	}
@@ -117,6 +134,7 @@ function showMenu(ev: MouseEvent) {
 	display: flex;
 	justify-content: center;
 	align-items: center;
+	cursor: pointer;
 }

 .hide {
@@ -167,7 +185,6 @@ function showMenu(ev: MouseEvent) {

 .imageContainer {
 	display: block;
-	cursor: zoom-in;
 	overflow: hidden;
 	width: 100%;
 	height: 100%;
--- a/packages/frontend/src/components/MkMediaList.vue
+++ b/packages/frontend/src/components/MkMediaList.vue
@@ -64,7 +64,7 @@ async function getClientWidthWithCache(targetEl: HTMLElement, containerEl: HTMLE

 <script lang="ts" setup>
 import { onMounted, onUnmounted, shallowRef } from 'vue';
-import * as misskey from 'misskey-js';
+import * as Misskey from 'misskey-js';
 import PhotoSwipeLightbox from 'photoswipe/lightbox';
 import PhotoSwipe from 'photoswipe';
 import 'photoswipe/style.css';
@@ -77,7 +77,7 @@ import { defaultStore } from '@/store';
 import { getScrollContainer, getBodyScrollHeight } from '@/scripts/scroll';

 const props = defineProps<{
-	mediaList: misskey.entities.DriveFile[];
+	mediaList: Misskey.entities.DriveFile[];
 	raw?: boolean;
 }>();

@@ -252,7 +252,7 @@ onUnmounted(() => {
 	lightbox = null;
 });

-const previewable = (file: misskey.entities.DriveFile): boolean => {
+const previewable = (file: Misskey.entities.DriveFile): boolean => {
 	if (file.type === 'image/svg+xml') return true; // svgのwebpublic/thumbnailはpngなのでtrue
 	// FILE_TYPE_BROWSERSAFEに適合しないものはブラウザで表示するのに不適切
 	return (file.type.startsWith('video') || file.type.startsWith('image')) && FILE_TYPE_BROWSERSAFE.includes(file.type);
--- a/packages/frontend/src/components/MkMediaVideo.vue
+++ b/packages/frontend/src/components/MkMediaVideo.vue
@@ -32,13 +32,13 @@ SPDX-License-Identifier: AGPL-3.0-only

 <script lang="ts" setup>
 import { ref } from 'vue';
-import * as misskey from 'misskey-js';
+import * as Misskey from 'misskey-js';
 import bytes from '@/filters/bytes';
 import { defaultStore } from '@/store';
 import { i18n } from '@/i18n';

 const props = defineProps<{
-	video: misskey.entities.DriveFile;
+	video: Misskey.entities.DriveFile;
 }>();

 const hide = ref((defaultStore.state.nsfw === 'force' || defaultStore.state.enableDataSaverMode) ? true : (props.video.isSensitive && defaultStore.state.nsfw !== 'ignore'));
--- a/packages/frontend/src/components/MkNote.vue
+++ b/packages/frontend/src/components/MkNote.vue
@@ -29,7 +29,7 @@ SPDX-License-Identifier: AGPL-3.0-only
 		</I18n>
 		<div :class="$style.renoteInfo">
 			<button ref="renoteTime" :class="$style.renoteTime" class="_button" @click="showRenoteMenu()">
-				<i v-if="isMyRenote" class="ti ti-dots" :class="$style.renoteMenu"></i>
+				<i class="ti ti-dots" :class="$style.renoteMenu"></i>
 				<MkTime :time="note.createdAt"/>
 			</button>
 			<span v-if="note.visibility !== 'public'" style="margin-left: 0.5em;" :title="i18n.ts._visibility[note.visibility]">
@@ -140,7 +140,7 @@ SPDX-License-Identifier: AGPL-3.0-only
 <script lang="ts" setup>
 import { computed, inject, onMounted, ref, shallowRef, Ref, defineAsyncComponent } from 'vue';
 import * as mfm from 'mfm-js';
-import * as misskey from 'misskey-js';
+import * as Misskey from 'misskey-js';
 import MkNoteSub from '@/components/MkNoteSub.vue';
 import MkNoteHeader from '@/components/MkNoteHeader.vue';
 import MkNoteSimple from '@/components/MkNoteSimple.vue';
@@ -161,7 +161,7 @@ import { reactionPicker } from '@/scripts/reaction-picker';
 import { extractUrlFromMfm } from '@/scripts/extract-url-from-mfm';
 import { $i } from '@/account';
 import { i18n } from '@/i18n';
-import { getNoteClipMenu, getNoteMenu } from '@/scripts/get-note-menu';
+import { getAbuseNoteMenu, getCopyNoteLinkMenu, getNoteClipMenu, getNoteMenu } from '@/scripts/get-note-menu';
 import { useNoteCapture } from '@/scripts/use-note-capture';
 import { deepClone } from '@/scripts/clone';
 import { useTooltip } from '@/scripts/use-tooltip';
@@ -173,12 +173,12 @@ import { showMovedDialog } from '@/scripts/show-moved-dialog';
 import { shouldCollapsed } from '@/scripts/collapsed';

 const props = defineProps<{
-	note: misskey.entities.Note;
+	note: Misskey.entities.Note;
 	pinned?: boolean;
 }>();

 const inChannel = inject('inChannel', null);
-const currentClip = inject<Ref<misskey.entities.Clip> | null>('currentClip', null);
+const currentClip = inject<Ref<Misskey.entities.Clip> | null>('currentClip', null);

 let note = $ref(deepClone(props.note));

@@ -206,7 +206,7 @@ const renoteButton = shallowRef<HTMLElement>();
 const renoteTime = shallowRef<HTMLElement>();
 const reactButton = shallowRef<HTMLElement>();
 const clipButton = shallowRef<HTMLElement>();
-let appearNote = $computed(() => isRenote ? note.renote as misskey.entities.Note : note);
+let appearNote = $computed(() => isRenote ? note.renote as Misskey.entities.Note : note);
 const isMyRenote = $i && ($i.id === note.userId);
 const showContent = ref(false);
 const urls = appearNote.text ? extractUrlFromMfm(mfm.parse(appearNote.text)) : null;
@@ -319,9 +319,15 @@ function renote(viaKeyboard = false) {
 			const configuredVisibility = defaultStore.state.rememberNoteVisibility ? defaultStore.state.visibility : defaultStore.state.defaultNoteVisibility;
 			const localOnly = defaultStore.state.rememberNoteVisibility ? defaultStore.state.localOnly : defaultStore.state.defaultNoteLocalOnly;

+			let visibility = appearNote.visibility;
+			visibility = smallerVisibility(visibility, configuredVisibility);
+			if (appearNote.channel?.isSensitive) {
+				visibility = smallerVisibility(visibility, 'home');
+			}
+
 			os.api('notes/create', {
 				localOnly,
-				visibility: smallerVisibility(appearNote.visibility, configuredVisibility),
+				visibility,
 				renoteId: appearNote.id,
 			}).then(() => {
 				os.toast(i18n.ts.renoted);
@@ -425,21 +431,39 @@ async function clip() {
 }

 function showRenoteMenu(viaKeyboard = false): void {
-	if (!isMyRenote) return;
-	pleaseLogin();
-	os.popupMenu([{
-		text: i18n.ts.unrenote,
-		icon: 'ti ti-trash',
-		danger: true,
-		action: () => {
-			os.api('notes/delete', {
-				noteId: note.id,
-			});
-			isDeleted.value = true;
-		},
-	}], renoteTime.value, {
-		viaKeyboard: viaKeyboard,
-	});
+	function getUnrenote(): MenuItem {
+		return {
+			text: i18n.ts.unrenote,
+			icon: 'ti ti-trash',
+			danger: true,
+			action: () => {
+				os.api('notes/delete', {
+					noteId: note.id,
+				});
+				isDeleted.value = true;
+			},
+		};
+	}
+
+	if (isMyRenote) {
+		pleaseLogin();
+		os.popupMenu([
+			getCopyNoteLinkMenu(note, i18n.ts.copyLinkRenote),
+			null,
+			getUnrenote(),
+		], renoteTime.value, {
+			viaKeyboard: viaKeyboard,
+		});
+	} else {
+		os.popupMenu([
+			getCopyNoteLinkMenu(note, i18n.ts.copyLinkRenote),
+			null, 
+			getAbuseNoteMenu(note, i18n.ts.reportAbuseRenote),
+			$i.isModerator || $i.isAdmin ? getUnrenote() : undefined,
+		], renoteTime.value, {
+			viaKeyboard: viaKeyboard,
+		});
+	}
 }

 function focus() {
--- a/packages/frontend/src/components/MkNoteDetailed.vue
+++ b/packages/frontend/src/components/MkNoteDetailed.vue
@@ -141,7 +141,7 @@ SPDX-License-Identifier: AGPL-3.0-only
 <script lang="ts" setup>
 import { computed, inject, onMounted, ref, shallowRef } from 'vue';
 import * as mfm from 'mfm-js';
-import * as misskey from 'misskey-js';
+import * as Misskey from 'misskey-js';
 import MkNoteSub from '@/components/MkNoteSub.vue';
 import MkNoteSimple from '@/components/MkNoteSimple.vue';
 import MkReactionsViewer from '@/components/MkReactionsViewer.vue';
@@ -171,7 +171,7 @@ import MkRippleEffect from '@/components/MkRippleEffect.vue';
 import { showMovedDialog } from '@/scripts/show-moved-dialog';

 const props = defineProps<{
-	note: misskey.entities.Note;
+	note: Misskey.entities.Note;
 }>();

 const inChannel = inject('inChannel', null);
@@ -202,7 +202,7 @@ const renoteButton = shallowRef<HTMLElement>();
 const renoteTime = shallowRef<HTMLElement>();
 const reactButton = shallowRef<HTMLElement>();
 const clipButton = shallowRef<HTMLElement>();
-let appearNote = $computed(() => isRenote ? note.renote as misskey.entities.Note : note);
+let appearNote = $computed(() => isRenote ? note.renote as Misskey.entities.Note : note);
 const isMyRenote = $i && ($i.id === note.userId);
 const showContent = ref(false);
 const isDeleted = ref(false);
@@ -211,8 +211,8 @@ const translation = ref(null);
 const translating = ref(false);
 const urls = appearNote.text ? extractUrlFromMfm(mfm.parse(appearNote.text)) : null;
 const showTicker = (defaultStore.state.instanceTicker === 'always') || (defaultStore.state.instanceTicker === 'remote' && appearNote.user.instance);
-const conversation = ref<misskey.entities.Note[]>([]);
-const replies = ref<misskey.entities.Note[]>([]);
+const conversation = ref<Misskey.entities.Note[]>([]);
+const replies = ref<Misskey.entities.Note[]>([]);
 const canRenote = computed(() => ['public', 'home'].includes(appearNote.visibility) || appearNote.userId === $i.id);

 const keymap = {
--- a/packages/frontend/src/components/MkNoteHeader.vue
+++ b/packages/frontend/src/components/MkNoteHeader.vue
@@ -30,13 +30,13 @@ SPDX-License-Identifier: AGPL-3.0-only

 <script lang="ts" setup>
 import { } from 'vue';
-import * as misskey from 'misskey-js';
+import * as Misskey from 'misskey-js';
 import { i18n } from '@/i18n';
 import { notePage } from '@/filters/note';
 import { userPage } from '@/filters/user';

 defineProps<{
-	note: misskey.entities.Note;
+	note: Misskey.entities.Note;
 }>();
 </script>

--- a/Show More
+++ b/Show More