diff --git a/keyserver/src/creators/message-creator.js b/keyserver/src/creators/message-creator.js
index db71a26ed..072379222 100644
--- a/keyserver/src/creators/message-creator.js
+++ b/keyserver/src/creators/message-creator.js
@@ -1,689 +1,696 @@
 // @flow
 
 import invariant from 'invariant';
 import _pickBy from 'lodash/fp/pickBy.js';
 
 import { permissionLookup } from 'lib/permissions/thread-permissions.js';
 import {
   rawMessageInfoFromMessageData,
   shimUnsupportedRawMessageInfos,
   stripLocalIDs,
 } from 'lib/shared/message-utils.js';
 import { pushTypes } from 'lib/shared/messages/message-spec.js';
 import type { PushType } from 'lib/shared/messages/message-spec.js';
 import { messageSpecs } from 'lib/shared/messages/message-specs.js';
 import { messageTypes } from 'lib/types/message-types-enum.js';
 import {
   messageDataLocalID,
   type MessageData,
   type RawMessageInfo,
 } from 'lib/types/message-types.js';
 import { redisMessageTypes } from 'lib/types/redis-types.js';
 import { threadPermissions } from 'lib/types/thread-permission-types.js';
 import { updateTypes } from 'lib/types/update-types-enum.js';
 import { promiseAll } from 'lib/utils/promises.js';
 
 import createIDs from './id-creator.js';
 import type { UpdatesForCurrentSession } from './update-creator.js';
 import { createUpdates } from './update-creator.js';
 import {
   dbQuery,
   SQL,
   appendSQLArray,
   mergeOrConditions,
 } from '../database/database.js';
 import { processMessagesForSearch } from '../database/search-utils.js';
 import {
   fetchMessageInfoForLocalID,
   fetchMessageInfoByID,
 } from '../fetchers/message-fetchers.js';
 import { fetchOtherSessionsForViewer } from '../fetchers/session-fetchers.js';
 import { fetchServerThreadInfos } from '../fetchers/thread-fetchers.js';
-import type { Device } from '../push/send';
+import type { Device, PushUserInfo } from '../push/send.js';
 import { sendPushNotifs, sendRescindNotifs } from '../push/send.js';
 import { handleAsyncPromise } from '../responders/handlers.js';
 import type { Viewer } from '../session/viewer.js';
 import { earliestFocusedTimeConsideredExpired } from '../shared/focused-times.js';
 import { publisher } from '../socket/redis.js';
 import { creationString } from '../utils/idempotent.js';
 
 type UserThreadInfo = {
   +devices: Map<string, Device>,
   +threadIDs: Set<string>,
   +notFocusedThreadIDs: Set<string>,
   +userNotMemberOfSubthreads: Set<string>,
   +subthreadsCanSetToUnread: Set<string>,
 };
 
 type LatestMessagesPerUser = Map<
   string,
   $ReadOnlyMap<
     string,
     {
       +latestMessage: string,
       +latestReadMessage?: string,
     },
   >,
 >;
 
 type LatestMessages = $ReadOnlyArray<{
   +userID: string,
   +threadID: string,
   +latestMessage: string,
   +latestReadMessage: ?string,
 }>;
 
 // Does not do permission checks! (checkThreadPermission)
 async function createMessages(
   viewer: Viewer,
   messageDatas: $ReadOnlyArray<MessageData>,
   updatesForCurrentSession?: UpdatesForCurrentSession = 'return',
 ): Promise<RawMessageInfo[]> {
   if (messageDatas.length === 0) {
     return [];
   }
 
   const existingMessages = await Promise.all(
     messageDatas.map(messageData =>
       fetchMessageInfoForLocalID(viewer, messageDataLocalID(messageData)),
     ),
   );
 
   const existingMessageInfos: RawMessageInfo[] = [];
   const newMessageDatas: MessageData[] = [];
   for (let i = 0; i < messageDatas.length; i++) {
     const existingMessage = existingMessages[i];
     if (existingMessage) {
       existingMessageInfos.push(existingMessage);
     } else {
       newMessageDatas.push(messageDatas[i]);
     }
   }
   if (newMessageDatas.length === 0) {
     return shimUnsupportedRawMessageInfos(
       existingMessageInfos,
       viewer.platformDetails,
     );
   }
 
   const ids = await createIDs('messages', newMessageDatas.length);
 
   const returnMessageInfos: RawMessageInfo[] = [];
   const subthreadPermissionsToCheck: Set<string> = new Set();
   const messageInsertRows = [];
 
   // Indices in threadsToMessageIndices point to newMessageInfos
   const newMessageInfos: RawMessageInfo[] = [];
   const threadsToMessageIndices: Map<string, number[]> = new Map();
 
   let nextNewMessageIndex = 0;
   for (let i = 0; i < messageDatas.length; i++) {
     const existingMessage = existingMessages[i];
     if (existingMessage) {
       returnMessageInfos.push(existingMessage);
       continue;
     }
 
     const messageData = messageDatas[i];
     const threadID = messageData.threadID;
     const creatorID = messageData.creatorID;
 
     let messageIndices = threadsToMessageIndices.get(threadID);
     if (!messageIndices) {
       messageIndices = [];
       threadsToMessageIndices.set(threadID, messageIndices);
     }
 
     const newMessageIndex = nextNewMessageIndex++;
     messageIndices.push(newMessageIndex);
 
     const serverID = ids[newMessageIndex];
 
     if (messageData.type === messageTypes.CREATE_SUB_THREAD) {
       subthreadPermissionsToCheck.add(messageData.childThreadID);
     }
 
     const content =
       messageSpecs[messageData.type].messageContentForServerDB?.(messageData);
 
     const creation =
       messageData.localID && viewer.hasSessionInfo
         ? creationString(viewer, messageData.localID)
         : null;
 
     let targetMessageID = null;
     if (messageData.targetMessageID) {
       targetMessageID = messageData.targetMessageID;
     } else if (messageData.sourceMessage) {
       targetMessageID = messageData.sourceMessage.id;
     }
 
     messageInsertRows.push([
       serverID,
       threadID,
       creatorID,
       messageData.type,
       content,
       messageData.time,
       creation,
       targetMessageID,
     ]);
     const rawMessageInfo = rawMessageInfoFromMessageData(messageData, serverID);
     newMessageInfos.push(rawMessageInfo); // at newMessageIndex
     returnMessageInfos.push(rawMessageInfo); // at i
   }
 
   const messageInsertQuery = SQL`
     INSERT INTO messages(id, thread, user, type, content, time,
       creation, target_message)
     VALUES ${messageInsertRows}
   `;
   await dbQuery(messageInsertQuery);
 
   const postMessageSendPromise = postMessageSend(
     viewer,
     threadsToMessageIndices,
     subthreadPermissionsToCheck,
     stripLocalIDs(newMessageInfos),
     newMessageDatas,
     updatesForCurrentSession,
   );
   if (!viewer.isScriptViewer) {
     // If we're not being called from a script, then we avoid awaiting
     // postMessageSendPromise below so that we don't delay the response to the
     // user on external services. In that case, we use handleAsyncPromise to
     // make sure any exceptions are caught and logged.
     handleAsyncPromise(postMessageSendPromise);
   }
 
   await Promise.all([
     updateRepliesCount(threadsToMessageIndices, newMessageDatas),
     viewer.isScriptViewer ? postMessageSendPromise : undefined,
   ]);
 
   if (updatesForCurrentSession !== 'return') {
     return [];
   }
 
   return shimUnsupportedRawMessageInfos(
     returnMessageInfos,
     viewer.platformDetails,
   );
 }
 
 async function updateRepliesCount(
   threadsToMessageIndices: Map<string, number[]>,
   newMessageDatas: MessageData[],
 ) {
   const updatedThreads = [];
 
   const updateThreads = SQL`
     UPDATE threads
     SET replies_count = replies_count + (CASE `;
 
   const membershipConditions = [];
   for (const [threadID, messages] of threadsToMessageIndices.entries()) {
     const newRepliesIncrease = messages
       .map(i => newMessageDatas[i].type)
       .filter(type => messageSpecs[type].includedInRepliesCount).length;
     if (newRepliesIncrease === 0) {
       continue;
     }
 
     updateThreads.append(SQL`
       WHEN id = ${threadID} THEN ${newRepliesIncrease}
     `);
     updatedThreads.push(threadID);
 
     const senders = messages.map(i => newMessageDatas[i].creatorID);
     membershipConditions.push(
       SQL`thread = ${threadID} AND user IN (${senders})`,
     );
   }
   updateThreads.append(SQL`
       ELSE 0
       END)
     WHERE id IN (${updatedThreads})
       AND source_message IS NOT NULL
   `);
 
   const updateMemberships = SQL`
     UPDATE memberships
     SET sender = 1
     WHERE sender = 0 
       AND (
   `;
   updateMemberships.append(mergeOrConditions(membershipConditions));
   updateMemberships.append(SQL`
       )
   `);
 
   if (updatedThreads.length > 0) {
     const [{ threadInfos: serverThreadInfos }] = await Promise.all([
       fetchServerThreadInfos({ threadIDs: new Set(updatedThreads) }),
       dbQuery(updateThreads),
       dbQuery(updateMemberships),
     ]);
 
     const time = Date.now();
     const updates = [];
     for (const threadID in serverThreadInfos) {
       for (const member of serverThreadInfos[threadID].members) {
         updates.push({
           userID: member.id,
           time,
           threadID,
           type: updateTypes.UPDATE_THREAD,
         });
       }
     }
     await createUpdates(updates);
   }
 }
 
 // Handles:
 // (1) Sending push notifs
 // (2) Setting threads to unread and generating corresponding UpdateInfos
 // (3) Publishing to Redis so that active sockets pass on new messages
 // (4) Processing messages for search
 async function postMessageSend(
   viewer: Viewer,
   threadsToMessageIndices: Map<string, number[]>,
   subthreadPermissionsToCheck: Set<string>,
   messageInfos: RawMessageInfo[],
   messageDatas: MessageData[],
   updatesForCurrentSession: UpdatesForCurrentSession,
 ) {
   const processForSearch = processMessagesForSearch(messageInfos);
 
   let joinIndex = 0;
   let subthreadSelects = '';
   const subthreadJoins = [];
   for (const subthread of subthreadPermissionsToCheck) {
     const index = joinIndex++;
     subthreadSelects += `
       ,
       stm${index}.permissions AS subthread${subthread}_permissions,
       stm${index}.role AS subthread${subthread}_role
     `;
     const join = SQL`LEFT JOIN memberships `;
     join.append(`stm${index} ON stm${index}.`);
     join.append(SQL`thread = ${subthread} AND `);
     join.append(`stm${index}.user = m.user`);
     subthreadJoins.push(join);
   }
 
   const time = earliestFocusedTimeConsideredExpired();
   const visibleExtractString = `$.${threadPermissions.VISIBLE}.value`;
   const query = SQL`
     SELECT m.user, m.thread, c.platform, c.device_token, c.versions, c.id,
       f.user AS focused_user
   `;
   query.append(subthreadSelects);
   query.append(SQL`
     FROM memberships m
     LEFT JOIN cookies c ON c.user = m.user AND c.device_token IS NOT NULL
     LEFT JOIN focused f ON f.user = m.user AND f.thread = m.thread
       AND f.time > ${time}
   `);
   appendSQLArray(query, subthreadJoins, SQL` `);
   query.append(SQL`
     WHERE (m.role > 0 OR f.user IS NOT NULL) AND
       JSON_EXTRACT(m.permissions, ${visibleExtractString}) IS TRUE AND
       m.thread IN (${[...threadsToMessageIndices.keys()]})
   `);
 
   const perUserInfo = new Map<string, UserThreadInfo>();
   const [result] = await dbQuery(query);
   for (const row of result) {
     const userID = row.user.toString();
     const threadID = row.thread.toString();
     const deviceToken = row.device_token;
     const focusedUser = !!row.focused_user;
     const { platform } = row;
     const versions = JSON.parse(row.versions);
     const cookieID = row.id;
     let thisUserInfo = perUserInfo.get(userID);
     if (!thisUserInfo) {
       thisUserInfo = {
         devices: new Map(),
         threadIDs: new Set(),
         notFocusedThreadIDs: new Set(),
         userNotMemberOfSubthreads: new Set(),
         subthreadsCanSetToUnread: new Set(),
       };
       perUserInfo.set(userID, thisUserInfo);
       // Subthread info will be the same for each subthread, so we only parse
       // it once
       for (const subthread of subthreadPermissionsToCheck) {
         const isSubthreadMember = row[`subthread${subthread}_role`] > 0;
         const rawSubthreadPermissions =
           row[`subthread${subthread}_permissions`];
         const subthreadPermissions = JSON.parse(rawSubthreadPermissions);
         const canSeeSubthread = permissionLookup(
           subthreadPermissions,
           threadPermissions.KNOW_OF,
         );
         if (!canSeeSubthread) {
           continue;
         }
         thisUserInfo.subthreadsCanSetToUnread.add(subthread);
         // Only include the notification from the superthread if there is no
         // notification from the subthread
         if (
           !isSubthreadMember ||
           !permissionLookup(subthreadPermissions, threadPermissions.VISIBLE)
         ) {
           thisUserInfo.userNotMemberOfSubthreads.add(subthread);
         }
       }
     }
     if (deviceToken && cookieID) {
       thisUserInfo.devices.set(deviceToken, {
         platform,
         deviceToken,
         cookieID: cookieID.toString(),
         codeVersion: versions ? versions.codeVersion : null,
         stateVersion: versions ? versions.stateVersion : null,
       });
     }
     thisUserInfo.threadIDs.add(threadID);
     if (!focusedUser) {
       thisUserInfo.notFocusedThreadIDs.add(threadID);
     }
   }
 
-  const messageInfosPerUser = {};
+  const messageInfosPerUser: {
+    [userID: string]: $ReadOnlyArray<RawMessageInfo>,
+  } = {};
   const latestMessagesPerUser: LatestMessagesPerUser = new Map();
-  const userPushInfoPromises = {};
-  const userRescindInfoPromises = {};
+  const userPushInfoPromises: { [string]: Promise<?PushUserInfo> } = {};
+  const userRescindInfoPromises: { [string]: Promise<?PushUserInfo> } = {};
 
   for (const pair of perUserInfo) {
     const [userID, preUserPushInfo] = pair;
 
     const userMessageInfos = [];
     for (const threadID of preUserPushInfo.threadIDs) {
       const messageIndices = threadsToMessageIndices.get(threadID);
       invariant(messageIndices, `indices should exist for thread ${threadID}`);
       for (const messageIndex of messageIndices) {
         const messageInfo = messageInfos[messageIndex];
         userMessageInfos.push(messageInfo);
       }
     }
     if (userMessageInfos.length > 0) {
       messageInfosPerUser[userID] = userMessageInfos;
     }
 
     latestMessagesPerUser.set(
       userID,
       determineLatestMessagesPerThread(
         preUserPushInfo,
         userID,
         threadsToMessageIndices,
         messageInfos,
       ),
     );
 
     const { userNotMemberOfSubthreads } = preUserPushInfo;
     const userDevices = [...preUserPushInfo.devices.values()];
     if (userDevices.length === 0) {
       continue;
     }
 
     const generateNotifUserInfoPromise = async (pushType: PushType) => {
-      const promises = [];
+      const promises: Array<
+        Promise<?{
+          +messageInfo: RawMessageInfo,
+          +messageData: MessageData,
+        }>,
+      > = [];
 
       for (const threadID of preUserPushInfo.notFocusedThreadIDs) {
         const messageIndices = threadsToMessageIndices.get(threadID);
         invariant(
           messageIndices,
           `indices should exist for thread ${threadID}`,
         );
         promises.push(
           ...messageIndices.map(async messageIndex => {
             const messageInfo = messageInfos[messageIndex];
             const { type } = messageInfo;
             if (messageInfo.creatorID === userID) {
               // We never send a user notifs about their own activity
               return undefined;
             }
             const { generatesNotifs } = messageSpecs[type];
             const messageData = messageDatas[messageIndex];
             if (!generatesNotifs) {
               return undefined;
             }
             const doesGenerateNotif = await generatesNotifs(
               messageInfo,
               messageData,
               {
                 notifTargetUserID: userID,
                 userNotMemberOfSubthreads,
                 fetchMessageInfoByID: (messageID: string) =>
                   fetchMessageInfoByID(viewer, messageID),
               },
             );
             return doesGenerateNotif === pushType
               ? { messageInfo, messageData }
               : undefined;
           }),
         );
       }
 
       const messagesToNotify = await Promise.all(promises);
       const filteredMessagesToNotify = messagesToNotify.filter(Boolean);
 
       if (filteredMessagesToNotify.length === 0) {
         return undefined;
       }
 
       return {
         devices: userDevices,
         messageInfos: filteredMessagesToNotify.map(
           ({ messageInfo }) => messageInfo,
         ),
         messageDatas: filteredMessagesToNotify.map(
           ({ messageData }) => messageData,
         ),
       };
     };
 
     const userPushInfoPromise = generateNotifUserInfoPromise(pushTypes.NOTIF);
     const userRescindInfoPromise = generateNotifUserInfoPromise(
       pushTypes.RESCIND,
     );
 
     userPushInfoPromises[userID] = userPushInfoPromise;
     userRescindInfoPromises[userID] = userRescindInfoPromise;
   }
 
   const latestMessages = flattenLatestMessagesPerUser(latestMessagesPerUser);
 
   const [pushInfo, rescindInfo] = await Promise.all([
     promiseAll(userPushInfoPromises),
     promiseAll(userRescindInfoPromises),
     createReadStatusUpdates(latestMessages),
     redisPublish(viewer, messageInfosPerUser, updatesForCurrentSession),
     updateLatestMessages(latestMessages),
     processForSearch,
   ]);
 
   await Promise.all([
     sendPushNotifs(_pickBy(Boolean)(pushInfo)),
     sendRescindNotifs(_pickBy(Boolean)(rescindInfo)),
   ]);
 }
 
 async function redisPublish(
   viewer: Viewer,
   messageInfosPerUser: { [userID: string]: $ReadOnlyArray<RawMessageInfo> },
   updatesForCurrentSession: UpdatesForCurrentSession,
 ) {
   const avoidBroadcastingToCurrentSession =
     viewer.hasSessionInfo && updatesForCurrentSession !== 'broadcast';
   for (const userID in messageInfosPerUser) {
     if (userID === viewer.userID && avoidBroadcastingToCurrentSession) {
       continue;
     }
     const messageInfos = messageInfosPerUser[userID];
     publisher.sendMessage(
       { userID },
       {
         type: redisMessageTypes.NEW_MESSAGES,
         messages: messageInfos,
       },
     );
   }
   const viewerMessageInfos = messageInfosPerUser[viewer.userID];
   if (!viewerMessageInfos || !avoidBroadcastingToCurrentSession) {
     return;
   }
   const sessionIDs = await fetchOtherSessionsForViewer(viewer);
   for (const sessionID of sessionIDs) {
     publisher.sendMessage(
       { userID: viewer.userID, sessionID },
       {
         type: redisMessageTypes.NEW_MESSAGES,
         messages: viewerMessageInfos,
       },
     );
   }
 }
 
 function determineLatestMessagesPerThread(
   preUserPushInfo: UserThreadInfo,
   userID: string,
   threadsToMessageIndices: $ReadOnlyMap<string, $ReadOnlyArray<number>>,
   messageInfos: $ReadOnlyArray<RawMessageInfo>,
 ) {
   const { threadIDs, notFocusedThreadIDs, subthreadsCanSetToUnread } =
     preUserPushInfo;
   const latestMessagesPerThread = new Map();
   for (const threadID of threadIDs) {
     const messageIndices = threadsToMessageIndices.get(threadID);
     invariant(messageIndices, `indices should exist for thread ${threadID}`);
     for (const messageIndex of messageIndices) {
       const messageInfo = messageInfos[messageIndex];
       if (
         messageInfo.type === messageTypes.CREATE_SUB_THREAD &&
         !subthreadsCanSetToUnread.has(messageInfo.childThreadID)
       ) {
         continue;
       }
 
       const messageID = messageInfo.id;
       invariant(
         messageID,
         'message ID should exist in determineLatestMessagesPerThread',
       );
 
       if (
         notFocusedThreadIDs.has(threadID) &&
         messageInfo.creatorID !== userID
       ) {
         latestMessagesPerThread.set(threadID, {
           latestMessage: messageID,
         });
       } else {
         latestMessagesPerThread.set(threadID, {
           latestMessage: messageID,
           latestReadMessage: messageID,
         });
       }
     }
   }
   return latestMessagesPerThread;
 }
 
 function flattenLatestMessagesPerUser(
   latestMessagesPerUser: LatestMessagesPerUser,
 ): LatestMessages {
   const result = [];
   for (const [userID, latestMessagesPerThread] of latestMessagesPerUser) {
     for (const [threadID, latestMessages] of latestMessagesPerThread) {
       result.push({
         userID,
         threadID,
         latestMessage: latestMessages.latestMessage,
         latestReadMessage: latestMessages.latestReadMessage,
       });
     }
   }
   return result;
 }
 
 async function createReadStatusUpdates(latestMessages: LatestMessages) {
   const now = Date.now();
   const readStatusUpdates = latestMessages
     .filter(message => !message.latestReadMessage)
     .map(({ userID, threadID }) => ({
       type: updateTypes.UPDATE_THREAD_READ_STATUS,
       userID,
       time: now,
       threadID,
       unread: true,
     }));
 
   if (readStatusUpdates.length === 0) {
     return;
   }
 
   await createUpdates(readStatusUpdates);
 }
 
 function updateLatestMessages(latestMessages: LatestMessages) {
   if (latestMessages.length === 0) {
     return;
   }
 
   const query = SQL`
     UPDATE memberships
     SET 
   `;
 
   const lastMessageExpression = SQL`
     last_message = GREATEST(last_message, CASE 
   `;
   const lastReadMessageExpression = SQL`
     , last_read_message = GREATEST(last_read_message, CASE 
   `;
   let shouldUpdateLastReadMessage = false;
   for (const {
     userID,
     threadID,
     latestMessage,
     latestReadMessage,
   } of latestMessages) {
     lastMessageExpression.append(SQL`
       WHEN user = ${userID} AND thread = ${threadID} THEN ${latestMessage}
     `);
     if (latestReadMessage) {
       shouldUpdateLastReadMessage = true;
       lastReadMessageExpression.append(SQL`
         WHEN user = ${userID} AND thread = ${threadID} THEN ${latestReadMessage}
       `);
     }
   }
   lastMessageExpression.append(SQL`
     ELSE last_message
     END)
   `);
   lastReadMessageExpression.append(SQL`
     ELSE last_read_message
     END)
   `);
 
   const conditions = latestMessages.map(
     ({ userID, threadID }) => SQL`(user = ${userID} AND thread = ${threadID})`,
   );
 
   query.append(lastMessageExpression);
   if (shouldUpdateLastReadMessage) {
     query.append(lastReadMessageExpression);
   }
   query.append(SQL`WHERE `);
   query.append(mergeOrConditions(conditions));
 
   dbQuery(query);
 }
 
 export default createMessages;
diff --git a/keyserver/src/creators/role-creator.js b/keyserver/src/creators/role-creator.js
index d609afbab..dcfa7159e 100644
--- a/keyserver/src/creators/role-creator.js
+++ b/keyserver/src/creators/role-creator.js
@@ -1,210 +1,210 @@
 // @flow
 
 import { defaultSpecialRoles } from 'lib/permissions/special-roles.js';
 import {
   getRolePermissionBlobs,
   getThreadPermissionBlobFromUserSurfacedPermissions,
 } from 'lib/permissions/thread-permissions.js';
 import { threadHasPermission } from 'lib/shared/thread-utils.js';
 import {
   userSurfacedPermissionsSet,
   threadPermissions,
 } from 'lib/types/thread-permission-types.js';
 import {
   threadTypeIsCommunityRoot,
   type ThreadType,
 } from 'lib/types/thread-types-enum.js';
 import type {
   RoleInfo,
   RoleModificationRequest,
   RoleModificationResult,
 } from 'lib/types/thread-types.js';
 import { updateTypes } from 'lib/types/update-types-enum.js';
 import { ServerError } from 'lib/utils/errors.js';
 
 import createIDs from './id-creator.js';
 import { createUpdates } from './update-creator.js';
 import { dbQuery, SQL } from '../database/database.js';
 import {
   fetchThreadInfos,
   fetchServerThreadInfos,
   rawThreadInfosFromServerThreadInfos,
 } from '../fetchers/thread-fetchers.js';
 import type { Viewer } from '../session/viewer.js';
 import { updateRole } from '../updaters/thread-updaters.js';
 
 type InitialRoles = {
   +default: RoleInfo,
   +creator: RoleInfo,
 };
 async function createInitialRolesForNewThread(
   threadID: string,
   threadType: ThreadType,
 ): Promise<InitialRoles> {
   const rolePermissions = getRolePermissionBlobs(threadType);
   const ids = await createIDs('roles', Object.values(rolePermissions).length);
 
   const time = Date.now();
   const newRows = [];
-  const namesToIDs = {};
+  const namesToIDs: { [string]: string } = {};
   for (const name in rolePermissions) {
     const id = ids.shift();
     namesToIDs[name] = id;
     const permissionsBlob = JSON.stringify(rolePermissions[name]);
     const specialRole = defaultSpecialRoles[name] ?? null;
     newRows.push([id, threadID, name, permissionsBlob, time, specialRole]);
   }
 
   const query = SQL`
     INSERT INTO roles (id, thread, name, 
       permissions, creation_time, special_role)
     VALUES ${newRows}
   `;
   await dbQuery(query);
 
   const defaultRoleInfo = {
     id: namesToIDs.Members,
     name: 'Members',
     permissions: rolePermissions.Members,
     isDefault: true,
   };
   if (!rolePermissions.Admins) {
     return {
       default: defaultRoleInfo,
       creator: defaultRoleInfo,
     };
   }
 
   const adminRoleInfo = {
     id: namesToIDs.Admins,
     name: 'Admins',
     permissions: rolePermissions.Admins,
     isDefault: false,
   };
   return {
     default: defaultRoleInfo,
     creator: adminRoleInfo,
   };
 }
 
 async function modifyRole(
   viewer: Viewer,
   request: RoleModificationRequest,
 ): Promise<RoleModificationResult> {
   const { community, name, permissions } = request;
 
   const { threadInfos } = await fetchThreadInfos(viewer, {
     threadID: community,
   });
   const threadInfo = threadInfos[community];
 
   const hasPermission = threadHasPermission(
     threadInfo,
     threadPermissions.CHANGE_ROLE,
   );
 
   if (!hasPermission) {
     throw new ServerError('invalid_credentials');
   }
 
   if (!threadTypeIsCommunityRoot(threadInfo.type)) {
     throw new ServerError('invalid_parameters');
   }
 
   for (const permission of permissions) {
     if (!userSurfacedPermissionsSet.has(permission)) {
       throw new ServerError('invalid_parameters');
     }
   }
 
   const [id] = await createIDs('roles', 1);
   const time = Date.now();
 
   const permissionsBlob = JSON.stringify(
     getThreadPermissionBlobFromUserSurfacedPermissions(
       permissions,
       threadInfo.type,
     ),
   );
 
   const row = [id, community, name, permissionsBlob, time];
 
   let query = SQL``;
   if (request.action === 'create_role') {
     query = SQL`
       INSERT INTO roles (id, thread, name, permissions, creation_time)
       VALUES (${row})
     `;
 
     await dbQuery(query);
   } else if (request.action === 'edit_role') {
     const { existingRoleID } = request;
 
     query = SQL`
       UPDATE roles
       SET name = ${name}, permissions = ${permissionsBlob}
       WHERE id = ${existingRoleID}
     `;
 
     await dbQuery(query);
 
     // The `updateRole` needs to occur after the role has been updated
     // in the database because it will want the most up to date role info
     // (permissions / name)
     const membersWithRole = threadInfo.members
       .filter(memberInfo => memberInfo.role === existingRoleID)
       .map(memberInfo => memberInfo.id);
 
     if (membersWithRole.length > 0) {
       await updateRole(
         viewer,
         {
           threadID: community,
           role: existingRoleID,
           memberIDs: membersWithRole,
         },
         { silenceNewMessages: true, forcePermissionRecalculation: true },
       );
     }
   }
 
   const fetchServerThreadInfosResult = await fetchServerThreadInfos({
     threadID: community,
   });
   const { threadInfos: serverThreadInfos } = fetchServerThreadInfosResult;
   const serverThreadInfo = serverThreadInfos[community];
 
   if (!serverThreadInfo) {
     throw new ServerError('internal_error');
   }
 
   const updateDatas = [];
   for (const memberInfo of serverThreadInfo.members) {
     updateDatas.push({
       type: updateTypes.UPDATE_THREAD,
       userID: memberInfo.id,
       time,
       threadID: community,
     });
   }
 
   const { viewerUpdates } = await createUpdates(updateDatas, {
     viewer,
     updatesForCurrentSession: 'return',
   });
 
   const { threadInfos: rawThreadInfos } = rawThreadInfosFromServerThreadInfos(
     viewer,
     fetchServerThreadInfosResult,
   );
   const rawThreadInfo = rawThreadInfos[community];
 
   return {
     threadInfo: rawThreadInfo,
     updatesResult: {
       newUpdates: viewerUpdates,
     },
   };
 }
 
 export { createInitialRolesForNewThread, modifyRole };
diff --git a/keyserver/src/creators/thread-creator.js b/keyserver/src/creators/thread-creator.js
index 1764f4a95..a1bc370cd 100644
--- a/keyserver/src/creators/thread-creator.js
+++ b/keyserver/src/creators/thread-creator.js
@@ -1,508 +1,510 @@
 // @flow
 
 import invariant from 'invariant';
 
 import bots from 'lib/facts/bots.js';
 import genesis from 'lib/facts/genesis.js';
 import { getRolePermissionBlobs } from 'lib/permissions/thread-permissions.js';
 import {
   generatePendingThreadColor,
   generateRandomColor,
 } from 'lib/shared/color-utils.js';
 import { isInvalidSidebarSource } from 'lib/shared/message-utils.js';
 import { getThreadTypeParentRequirement } from 'lib/shared/thread-utils.js';
 import type { Shape } from 'lib/types/core.js';
 import { messageTypes } from 'lib/types/message-types-enum.js';
+import type { RawMessageInfo, MessageData } from 'lib/types/message-types.js';
 import { threadPermissions } from 'lib/types/thread-permission-types.js';
 import {
   threadTypes,
   threadTypeIsCommunityRoot,
 } from 'lib/types/thread-types-enum.js';
 import {
   type ServerNewThreadRequest,
   type NewThreadResponse,
 } from 'lib/types/thread-types.js';
+import type { ServerUpdateInfo } from 'lib/types/update-types.js';
 import type { UserInfos } from 'lib/types/user-types.js';
 import { pushAll } from 'lib/utils/array.js';
 import { ServerError } from 'lib/utils/errors.js';
 import { promiseAll } from 'lib/utils/promises.js';
 import { firstLine } from 'lib/utils/string-utils.js';
 
 import createIDs from './id-creator.js';
 import createMessages from './message-creator.js';
 import { createInitialRolesForNewThread } from './role-creator.js';
 import type { UpdatesForCurrentSession } from './update-creator.js';
 import { dbQuery, SQL } from '../database/database.js';
 import {
   fetchLatestEditMessageContentByID,
   fetchMessageInfoByID,
 } from '../fetchers/message-fetchers.js';
 import {
   determineThreadAncestry,
   personalThreadQuery,
 } from '../fetchers/thread-fetchers.js';
 import {
   checkThreadPermission,
   validateCandidateMembers,
 } from '../fetchers/thread-permission-fetchers.js';
 import type { Viewer } from '../session/viewer.js';
 import {
   changeRole,
   recalculateThreadPermissions,
   commitMembershipChangeset,
   getChangesetCommitResultForExistingThread,
   type MembershipChangeset,
 } from '../updaters/thread-permission-updaters.js';
 import { joinThread } from '../updaters/thread-updaters.js';
 import RelationshipChangeset from '../utils/relationship-changeset.js';
 
 const { commbot } = bots;
 
 const privateThreadDescription: string =
   'This is your private chat, ' +
   'where you can set reminders and jot notes in private!';
 
 type CreateThreadOptions = Shape<{
   +forceAddMembers: boolean,
   +updatesForCurrentSession: UpdatesForCurrentSession,
   +silentlyFailMembers: boolean,
 }>;
 
 // If forceAddMembers is set, we will allow the viewer to add random users who
 // they aren't friends with. We will only fail if the viewer is trying to add
 // somebody who they have blocked or has blocked them. On the other hand, if
 // forceAddMembers is not set, we will fail if the viewer tries to add somebody
 // who they aren't friends with and doesn't have a membership row with a
 // nonnegative role for the parent thread.
 async function createThread(
   viewer: Viewer,
   request: ServerNewThreadRequest,
   options?: CreateThreadOptions,
 ): Promise<NewThreadResponse> {
   if (!viewer.loggedIn) {
     throw new ServerError('not_logged_in');
   }
 
   const forceAddMembers = options?.forceAddMembers ?? false;
   const updatesForCurrentSession =
     options?.updatesForCurrentSession ?? 'return';
   const silentlyFailMembers = options?.silentlyFailMembers ?? false;
 
   const threadType = request.type;
   const shouldCreateRelationships =
     forceAddMembers || threadType === threadTypes.PERSONAL;
   let parentThreadID = request.parentThreadID ? request.parentThreadID : null;
   const initialMemberIDsFromRequest =
     request.initialMemberIDs && request.initialMemberIDs.length > 0
       ? [...new Set(request.initialMemberIDs)]
       : null;
   const ghostMemberIDsFromRequest =
     request.ghostMemberIDs && request.ghostMemberIDs.length > 0
       ? [...new Set(request.ghostMemberIDs)]
       : null;
 
   const sourceMessageID = request.sourceMessageID
     ? request.sourceMessageID
     : null;
   invariant(
     threadType !== threadTypes.SIDEBAR || sourceMessageID,
     'sourceMessageID should be set for sidebar',
   );
 
   const parentRequirement = getThreadTypeParentRequirement(threadType);
   if (
     (parentRequirement === 'required' && !parentThreadID) ||
     (parentRequirement === 'disabled' && parentThreadID)
   ) {
     throw new ServerError('invalid_parameters');
   }
 
   if (
     threadType === threadTypes.PERSONAL &&
     request.initialMemberIDs?.length !== 1
   ) {
     throw new ServerError('invalid_parameters');
   }
 
   const requestParentThreadID = parentThreadID;
   const confirmParentPermissionPromise = (async () => {
     if (!requestParentThreadID) {
       return;
     }
     const hasParentPermission = await checkThreadPermission(
       viewer,
       requestParentThreadID,
       threadType === threadTypes.SIDEBAR
         ? threadPermissions.CREATE_SIDEBARS
         : threadPermissions.CREATE_SUBCHANNELS,
     );
     if (!hasParentPermission) {
       throw new ServerError('invalid_credentials');
     }
   })();
 
   // This is a temporary hack until we release actual E2E-encrypted local
   // conversations. For now we are hosting all root threads on Ashoat's
   // keyserver, so we set them to the have the Genesis community as their
   // parent thread.
   if (!parentThreadID && !threadTypeIsCommunityRoot(threadType)) {
     parentThreadID = genesis.id;
   }
 
   const determineThreadAncestryPromise = determineThreadAncestry(
     parentThreadID,
     threadType,
   );
 
   const validateMembersPromise = (async () => {
     const threadAncestry = await determineThreadAncestryPromise;
     const defaultRolePermissions = getRolePermissionBlobs(threadType).Members;
     const { initialMemberIDs, ghostMemberIDs } = await validateCandidateMembers(
       viewer,
       {
         initialMemberIDs: initialMemberIDsFromRequest,
         ghostMemberIDs: ghostMemberIDsFromRequest,
       },
       {
         threadType,
         parentThreadID,
         containingThreadID: threadAncestry.containingThreadID,
         defaultRolePermissions,
       },
       { requireRelationship: !shouldCreateRelationships },
     );
     if (
       !silentlyFailMembers &&
       (Number(initialMemberIDs?.length) <
         Number(initialMemberIDsFromRequest?.length) ||
         Number(ghostMemberIDs?.length) <
           Number(ghostMemberIDsFromRequest?.length))
     ) {
       throw new ServerError('invalid_credentials');
     }
     return { initialMemberIDs, ghostMemberIDs };
   })();
 
   const checkPromises = {};
   checkPromises.confirmParentPermission = confirmParentPermissionPromise;
   checkPromises.threadAncestry = determineThreadAncestryPromise;
   checkPromises.validateMembers = validateMembersPromise;
   if (sourceMessageID) {
     checkPromises.sourceMessage = fetchMessageInfoByID(viewer, sourceMessageID);
   }
   const {
     sourceMessage,
     threadAncestry,
     validateMembers: { initialMemberIDs, ghostMemberIDs },
   } = await promiseAll(checkPromises);
 
   if (sourceMessage && isInvalidSidebarSource(sourceMessage)) {
     throw new ServerError('invalid_parameters');
   }
 
   let { id } = request;
   if (id === null || id === undefined) {
     const ids = await createIDs('threads', 1);
     id = ids[0];
   }
   const newRoles = await createInitialRolesForNewThread(id, threadType);
 
   const name = request.name ? firstLine(request.name) : null;
   const description = request.description ? request.description : null;
   let color = request.color
     ? request.color.toLowerCase()
     : generateRandomColor();
   if (threadType === threadTypes.PERSONAL) {
     color = generatePendingThreadColor([
       ...(request.initialMemberIDs ?? []),
       viewer.id,
     ]);
   }
 
   const time = Date.now();
 
   const row = [
     id,
     threadType,
     name,
     description,
     viewer.userID,
     time,
     color,
     parentThreadID,
     threadAncestry.containingThreadID,
     threadAncestry.community,
     threadAncestry.depth,
     sourceMessageID,
   ];
 
   let existingThreadQuery = null;
   if (threadType === threadTypes.PERSONAL) {
     const otherMemberID = initialMemberIDs?.[0];
     invariant(
       otherMemberID,
       'Other member id should be set for a PERSONAL thread',
     );
     existingThreadQuery = personalThreadQuery(viewer.userID, otherMemberID);
   } else if (sourceMessageID) {
     existingThreadQuery = SQL`
       SELECT t.id
       FROM threads t
       WHERE t.source_message = ${sourceMessageID}
     `;
   }
 
   if (existingThreadQuery) {
     const query = SQL`
       INSERT INTO threads(id, type, name, description, creator, creation_time,
         color, parent_thread_id, containing_thread_id, community, depth,
         source_message)
       SELECT ${row}
       WHERE NOT EXISTS (`;
     query.append(existingThreadQuery).append(SQL`)`);
     const [result] = await dbQuery(query);
 
     if (result.affectedRows === 0) {
       const deleteRoles = SQL`
         DELETE FROM roles
         WHERE id IN (${newRoles.default.id}, ${newRoles.creator.id})
       `;
       const deleteIDs = SQL`
         DELETE FROM ids
         WHERE id IN (${id}, ${newRoles.default.id}, ${newRoles.creator.id})
       `;
       const [[existingThreadResult]] = await Promise.all([
         dbQuery(existingThreadQuery),
         dbQuery(deleteRoles),
         dbQuery(deleteIDs),
       ]);
       invariant(existingThreadResult.length > 0, 'thread should exist');
       const existingThreadID = existingThreadResult[0].id.toString();
 
       invariant(request.calendarQuery, 'calendar query should exist');
       const calendarQuery = {
         ...request.calendarQuery,
         filters: [
           ...request.calendarQuery.filters,
           { type: 'threads', threadIDs: [existingThreadID] },
         ],
       };
 
-      let joinUpdateInfos = [];
+      let joinUpdateInfos: $ReadOnlyArray<ServerUpdateInfo> = [];
       let userInfos: UserInfos = {};
-      let newMessageInfos = [];
+      let newMessageInfos: $ReadOnlyArray<RawMessageInfo> = [];
       if (threadType !== threadTypes.PERSONAL) {
         const joinThreadResult = await joinThread(viewer, {
           threadID: existingThreadID,
           calendarQuery,
         });
         joinUpdateInfos = joinThreadResult.updatesResult.newUpdates;
         userInfos = joinThreadResult.userInfos;
         newMessageInfos = joinThreadResult.rawMessageInfos;
       }
 
       const { viewerUpdates: newUpdates, userInfos: changesetUserInfos } =
         await getChangesetCommitResultForExistingThread(
           viewer,
           existingThreadID,
           joinUpdateInfos,
           { calendarQuery, updatesForCurrentSession },
         );
       userInfos = { ...userInfos, ...changesetUserInfos };
 
       return {
         newThreadID: existingThreadID,
         updatesResult: {
           newUpdates,
         },
         userInfos,
         newMessageInfos,
       };
     }
   } else {
     const query = SQL`
       INSERT INTO threads(id, type, name, description, creator, creation_time,
         color, parent_thread_id, containing_thread_id, community, depth,
         source_message)
       VALUES ${[row]}
     `;
     await dbQuery(query);
   }
 
   const initialMemberPromise: Promise<?MembershipChangeset> = initialMemberIDs
     ? changeRole(id, initialMemberIDs, null, { setNewMembersToUnread: true })
     : Promise.resolve(undefined);
   const ghostMemberPromise: Promise<?MembershipChangeset> = ghostMemberIDs
     ? changeRole(id, ghostMemberIDs, -1)
     : Promise.resolve(undefined);
 
   const [
     creatorChangeset,
     initialMembersChangeset,
     ghostMembersChangeset,
     recalculatePermissionsChangeset,
   ] = await Promise.all([
     changeRole(id, [viewer.userID], newRoles.creator.id),
     initialMemberPromise,
     ghostMemberPromise,
     recalculateThreadPermissions(id),
   ]);
 
   const {
     membershipRows: creatorMembershipRows,
     relationshipChangeset: creatorRelationshipChangeset,
   } = creatorChangeset;
 
   const {
     membershipRows: recalculateMembershipRows,
     relationshipChangeset: recalculateRelationshipChangeset,
   } = recalculatePermissionsChangeset;
 
   const membershipRows = [
     ...creatorMembershipRows,
     ...recalculateMembershipRows,
   ];
   const relationshipChangeset = new RelationshipChangeset();
   relationshipChangeset.addAll(creatorRelationshipChangeset);
   relationshipChangeset.addAll(recalculateRelationshipChangeset);
 
   if (initialMembersChangeset) {
     const {
       membershipRows: initialMembersMembershipRows,
       relationshipChangeset: initialMembersRelationshipChangeset,
     } = initialMembersChangeset;
     pushAll(membershipRows, initialMembersMembershipRows);
     relationshipChangeset.addAll(initialMembersRelationshipChangeset);
   }
   if (ghostMembersChangeset) {
     const {
       membershipRows: ghostMembersMembershipRows,
       relationshipChangeset: ghostMembersRelationshipChangeset,
     } = ghostMembersChangeset;
     pushAll(membershipRows, ghostMembersMembershipRows);
     relationshipChangeset.addAll(ghostMembersRelationshipChangeset);
   }
 
   const changeset = { membershipRows, relationshipChangeset };
   const { viewerUpdates, userInfos } = await commitMembershipChangeset(
     viewer,
     changeset,
     {
       updatesForCurrentSession,
     },
   );
 
   const initialMemberAndCreatorIDs = initialMemberIDs
     ? [...initialMemberIDs, viewer.userID]
     : [viewer.userID];
-  const messageDatas = [];
+  const messageDatas: Array<MessageData> = [];
   if (threadType !== threadTypes.SIDEBAR) {
     messageDatas.push({
       type: messageTypes.CREATE_THREAD,
       threadID: id,
       creatorID: viewer.userID,
       time,
       initialThreadState: {
         type: threadType,
         name,
         parentThreadID,
         color,
         memberIDs: initialMemberAndCreatorIDs,
       },
     });
   } else {
     invariant(parentThreadID, 'parentThreadID should be set for sidebar');
     if (!sourceMessage) {
       throw new ServerError('invalid_parameters');
     }
     invariant(
       sourceMessage.type !== messageTypes.REACTION &&
         sourceMessage.type !== messageTypes.EDIT_MESSAGE &&
         sourceMessage.type !== messageTypes.SIDEBAR_SOURCE &&
         sourceMessage.type !== messageTypes.TOGGLE_PIN,
       'Invalid sidebar source type',
     );
 
     let editedSourceMessage = sourceMessage;
     if (sourceMessageID && sourceMessage.type === messageTypes.TEXT) {
       const editMessageContent = await fetchLatestEditMessageContentByID(
         sourceMessageID,
       );
       if (editMessageContent) {
         editedSourceMessage = {
           ...sourceMessage,
           text: editMessageContent.text,
         };
       }
     }
 
     messageDatas.push(
       {
         type: messageTypes.SIDEBAR_SOURCE,
         threadID: id,
         creatorID: viewer.userID,
         time,
         sourceMessage: editedSourceMessage,
       },
       {
         type: messageTypes.CREATE_SIDEBAR,
         threadID: id,
         creatorID: viewer.userID,
         time,
         sourceMessageAuthorID: sourceMessage.creatorID,
         initialThreadState: {
           name,
           parentThreadID,
           color,
           memberIDs: initialMemberAndCreatorIDs,
         },
       },
     );
   }
 
   if (
     parentThreadID &&
     threadType !== threadTypes.SIDEBAR &&
     (parentThreadID !== genesis.id ||
       threadType === threadTypes.COMMUNITY_OPEN_SUBTHREAD ||
       threadType === threadTypes.COMMUNITY_OPEN_ANNOUNCEMENT_SUBTHREAD)
   ) {
     messageDatas.push({
       type: messageTypes.CREATE_SUB_THREAD,
       threadID: parentThreadID,
       creatorID: viewer.userID,
       time,
       childThreadID: id,
     });
   }
   const newMessageInfos = await createMessages(
     viewer,
     messageDatas,
     updatesForCurrentSession,
   );
 
   return {
     newThreadID: id,
     updatesResult: {
       newUpdates: viewerUpdates,
     },
     userInfos,
     newMessageInfos,
   };
 }
 
 function createPrivateThread(viewer: Viewer): Promise<NewThreadResponse> {
   return createThread(
     viewer,
     {
       type: threadTypes.PRIVATE,
       description: privateThreadDescription,
       ghostMemberIDs: [commbot.userID],
     },
     {
       forceAddMembers: true,
     },
   );
 }
 
 export { createThread, createPrivateThread, privateThreadDescription };
diff --git a/keyserver/src/creators/update-creator.js b/keyserver/src/creators/update-creator.js
index b78235dcd..b961fa20f 100644
--- a/keyserver/src/creators/update-creator.js
+++ b/keyserver/src/creators/update-creator.js
@@ -1,622 +1,624 @@
 // @flow
 
 import invariant from 'invariant';
 
 import { nonThreadCalendarFilters } from 'lib/selectors/calendar-filter-selectors.js';
 import {
   keyForUpdateData,
   keyForUpdateInfo,
   rawUpdateInfoFromUpdateData,
 } from 'lib/shared/update-utils.js';
 import type {
   UpdateInfosRawData,
   UpdateTypes,
 } from 'lib/shared/updates/update-spec.js';
 import { updateSpecs } from 'lib/shared/updates/update-specs.js';
 import {
   type CalendarQuery,
   defaultCalendarQuery,
+  type RawEntryInfo,
 } from 'lib/types/entry-types.js';
 import {
   defaultNumberPerThread,
   type MessageSelectionCriteria,
+  type RawMessageInfo,
 } from 'lib/types/message-types.js';
 import {
   type UpdateTarget,
   redisMessageTypes,
   type NewUpdatesRedisMessage,
 } from 'lib/types/redis-types.js';
 import type { RawThreadInfos } from 'lib/types/thread-types';
 import {
   type ServerUpdateInfo,
   type UpdateData,
   type RawUpdateInfo,
   type CreateUpdatesResult,
 } from 'lib/types/update-types.js';
 import type { UserInfos } from 'lib/types/user-types.js';
 import { promiseAll } from 'lib/utils/promises.js';
 
 import createIDs from './id-creator.js';
 import { dbQuery, SQL, mergeAndConditions } from '../database/database.js';
 import type { SQLStatementType } from '../database/types.js';
 import { deleteUpdatesByConditions } from '../deleters/update-deleters.js';
 import {
   fetchEntryInfos,
   fetchEntryInfosByID,
 } from '../fetchers/entry-fetchers.js';
 import { fetchMessageInfos } from '../fetchers/message-fetchers.js';
 import { fetchThreadInfos } from '../fetchers/thread-fetchers.js';
 import {
   fetchKnownUserInfos,
   fetchCurrentUserInfo,
 } from '../fetchers/user-fetchers.js';
 import type { Viewer } from '../session/viewer.js';
 import { channelNameForUpdateTarget, publisher } from '../socket/redis.js';
 
 export type UpdatesForCurrentSession =
   // This is the default if no Viewer is passed, or if an isSocket Viewer is
   // passed in. We will broadcast to all valid sessions via Redis and return
   // nothing to the caller, relying on the current session's Redis listener to
   // pick up the updates and deliver them asynchronously.
   | 'broadcast'
   // This is the default if a non-isSocket Viewer is passed in. We avoid
   // broadcasting the update to the current session, and instead return the
   // update to the caller, who will handle delivering it to the client.
   | 'return'
   // This means we ignore any updates destined for the current session.
   // Presumably the caller knows what they are doing and has a different way of
   // communicating the relevant information to the client.
   | 'ignore';
 
 type DeleteCondition = {
   +userID: string,
   +target: ?string,
   +types: UpdateTypes,
 };
 
 export type ViewerInfo =
   | {
       viewer: Viewer,
       calendarQuery?: ?CalendarQuery,
       updatesForCurrentSession?: UpdatesForCurrentSession,
     }
   | {
       viewer: Viewer,
       calendarQuery: ?CalendarQuery,
       updatesForCurrentSession?: UpdatesForCurrentSession,
       threadInfos: RawThreadInfos,
     };
 const defaultUpdateCreationResult = { viewerUpdates: [], userInfos: {} };
 const sortFunction = (
   a: UpdateData | ServerUpdateInfo,
   b: UpdateData | ServerUpdateInfo,
 ) => a.time - b.time;
 const deleteUpdatesBatchSize = 500;
 
 // Creates rows in the updates table based on the inputed updateDatas. Returns
 // UpdateInfos pertaining to the provided viewerInfo, as well as related
 // UserInfos. If no viewerInfo is provided, no UpdateInfos will be returned. And
 // the update row won't have an updater column, meaning no session will be
 // excluded from the update.
 async function createUpdates(
   updateDatas: $ReadOnlyArray<UpdateData>,
   passedViewerInfo?: ?ViewerInfo,
 ): Promise<CreateUpdatesResult> {
   if (updateDatas.length === 0) {
     return defaultUpdateCreationResult;
   }
 
   // viewer.session will throw for a script Viewer
   let viewerInfo = passedViewerInfo;
   if (
     viewerInfo &&
     (viewerInfo.viewer.isScriptViewer || !viewerInfo.viewer.loggedIn)
   ) {
     viewerInfo = null;
   }
 
   const sortedUpdateDatas = [...updateDatas].sort(sortFunction);
 
   const filteredUpdateDatas: UpdateData[] = [];
   const keyedUpdateDatas: Map<string, UpdateData[]> = new Map();
   for (const updateData of sortedUpdateDatas) {
     const key = keyForUpdateData(updateData);
     if (!key) {
       filteredUpdateDatas.push(updateData);
       continue;
     }
     const conditionKey = `${updateData.userID}|${key}`;
 
     const deleteCondition = getDeleteCondition(updateData);
     invariant(
       deleteCondition,
       `updateData of type ${updateData.type} has conditionKey ` +
         `${conditionKey} but no deleteCondition`,
     );
 
     const curUpdateDatas = keyedUpdateDatas.get(conditionKey);
     if (!curUpdateDatas) {
       keyedUpdateDatas.set(conditionKey, [updateData]);
       continue;
     }
 
     const filteredCurrent = curUpdateDatas.filter(curUpdateData =>
       filterOnDeleteCondition(curUpdateData, deleteCondition),
     );
     if (filteredCurrent.length === 0) {
       keyedUpdateDatas.set(conditionKey, [updateData]);
       continue;
     }
 
     const isNewUpdateDataFiltered = !filteredCurrent.every(curUpdateData => {
       const curDeleteCondition = getDeleteCondition(curUpdateData);
       invariant(
         curDeleteCondition,
         `updateData of type ${curUpdateData.type} is in keyedUpdateDatas ` +
           "but doesn't have a deleteCondition",
       );
       return filterOnDeleteCondition(updateData, curDeleteCondition);
     });
     if (!isNewUpdateDataFiltered) {
       filteredCurrent.push(updateData);
     }
     keyedUpdateDatas.set(conditionKey, filteredCurrent);
   }
 
   for (const keyUpdateDatas of keyedUpdateDatas.values()) {
     filteredUpdateDatas.push(...keyUpdateDatas);
   }
   const ids = await createIDs('updates', filteredUpdateDatas.length);
 
   let updatesForCurrentSession =
     viewerInfo && viewerInfo.updatesForCurrentSession;
   if (!updatesForCurrentSession && viewerInfo) {
     updatesForCurrentSession = viewerInfo.viewer.isSocket
       ? 'broadcast'
       : 'return';
   } else if (!updatesForCurrentSession) {
     updatesForCurrentSession = 'broadcast';
   }
   const dontBroadcastSession =
     updatesForCurrentSession !== 'broadcast' && viewerInfo
       ? viewerInfo.viewer.session
       : null;
 
   const publishInfos: Map<string, PublishInfo> = new Map();
   const viewerRawUpdateInfos: RawUpdateInfo[] = [];
   const insertRows: (?(number | string))[][] = [];
   const earliestTime: Map<string, number> = new Map();
   for (let i = 0; i < filteredUpdateDatas.length; i++) {
     const updateData = filteredUpdateDatas[i];
 
     const target = getTargetFromUpdateData(updateData);
     const rawUpdateInfo = rawUpdateInfoFromUpdateData(updateData, ids[i]);
 
     if (!target || !dontBroadcastSession || target !== dontBroadcastSession) {
       const updateTarget = target
         ? { userID: updateData.userID, sessionID: target }
         : { userID: updateData.userID };
       const channelName = channelNameForUpdateTarget(updateTarget);
       let publishInfo = publishInfos.get(channelName);
       if (!publishInfo) {
         publishInfo = { updateTarget, rawUpdateInfos: [] };
         publishInfos.set(channelName, publishInfo);
       }
       publishInfo.rawUpdateInfos.push(rawUpdateInfo);
     }
 
     if (
       updatesForCurrentSession === 'return' &&
       viewerInfo &&
       updateData.userID === viewerInfo.viewer.id &&
       (!target || target === viewerInfo.viewer.session)
     ) {
       viewerRawUpdateInfos.push(rawUpdateInfo);
     }
 
     if (viewerInfo && target && viewerInfo.viewer.session === target) {
       // In the case where this update is being created only for the current
       // session, there's no reason to insert a row into the updates table
       continue;
     }
 
     const content =
       updateSpecs[updateData.type].updateContentForServerDB(updateData);
 
     const key = keyForUpdateData(updateData);
     if (key) {
       const conditionKey = `${updateData.userID}|${key}`;
       const currentEarliestTime = earliestTime.get(conditionKey);
       if (!currentEarliestTime || updateData.time < currentEarliestTime) {
         earliestTime.set(conditionKey, updateData.time);
       }
     }
 
     const insertRow = [
       ids[i],
       updateData.userID,
       updateData.type,
       key,
       content,
       updateData.time,
       dontBroadcastSession,
       target,
     ];
     insertRows.push(insertRow);
   }
 
   type DeleteUpdatesConditions = {
     key: string,
     target?: string,
     types?: number[],
     time?: number,
   };
   const usersByConditions: Map<
     string,
     {
       conditions: DeleteUpdatesConditions,
       users: Set<string>,
     },
   > = new Map();
   for (const [conditionKey, keyUpdateDatas] of keyedUpdateDatas) {
     const deleteConditionByTarget: Map<?string, DeleteCondition> = new Map();
     for (const updateData of keyUpdateDatas) {
       const deleteCondition = getDeleteCondition(updateData);
       invariant(
         deleteCondition,
         `updateData of type ${updateData.type} is in keyedUpdateDatas but ` +
           "doesn't have a deleteCondition",
       );
       const { target, types } = deleteCondition;
 
       const existingDeleteCondition = deleteConditionByTarget.get(target);
       if (!existingDeleteCondition) {
         deleteConditionByTarget.set(target, deleteCondition);
         continue;
       }
 
       const existingTypes = existingDeleteCondition.types;
       if (existingTypes === 'all_types') {
         continue;
       } else if (types === 'all_types') {
         deleteConditionByTarget.set(target, deleteCondition);
         continue;
       }
 
       const mergedTypes = new Set([...types, ...existingTypes]);
       deleteConditionByTarget.set(target, {
         ...deleteCondition,
         types: mergedTypes,
       });
     }
 
     for (const deleteCondition of deleteConditionByTarget.values()) {
       const { userID, target, types } = deleteCondition;
       const key = conditionKey.split('|')[1];
       const conditions: DeleteUpdatesConditions = { key };
       if (target) {
         conditions.target = target;
       }
       if (types !== 'all_types') {
         invariant(types.size > 0, 'deleteCondition had empty types set');
         conditions.types = [...types];
       }
       const earliestTimeForCondition = earliestTime.get(conditionKey);
       if (earliestTimeForCondition) {
         conditions.time = earliestTimeForCondition;
       }
 
       const conditionsKey = JSON.stringify(conditions);
       if (!usersByConditions.has(conditionsKey)) {
         usersByConditions.set(conditionsKey, {
           conditions,
           users: new Set(),
         });
       }
       usersByConditions.get(conditionsKey)?.users.add(userID);
     }
   }
 
   const deleteSQLConditions: SQLStatementType[] = [];
   for (const { conditions, users } of usersByConditions.values()) {
     const sqlConditions = [
       SQL`u.user IN (${[...users]})`,
       SQL`u.key = ${conditions.key}`,
     ];
     if (conditions.target) {
       sqlConditions.push(SQL`u.target = ${conditions.target}`);
     }
     if (conditions.types) {
       sqlConditions.push(SQL`u.type IN (${conditions.types})`);
     }
     if (conditions.time) {
       sqlConditions.push(SQL`u.time < ${conditions.time}`);
     }
     deleteSQLConditions.push(mergeAndConditions(sqlConditions));
   }
 
   const promises = {};
 
   if (insertRows.length > 0) {
     const insertQuery = SQL`
       INSERT INTO updates(id, user, type, \`key\`,
         content, time, updater, target)
     `;
     insertQuery.append(SQL`VALUES ${insertRows}`);
     promises.insert = dbQuery(insertQuery);
   }
 
   if (publishInfos.size > 0) {
     promises.redis = redisPublish(publishInfos.values(), dontBroadcastSession);
   }
 
   if (deleteSQLConditions.length > 0) {
     promises.delete = (async () => {
       while (deleteSQLConditions.length > 0) {
         const batch = deleteSQLConditions.splice(0, deleteUpdatesBatchSize);
         await deleteUpdatesByConditions(batch);
       }
     })();
   }
 
   if (viewerRawUpdateInfos.length > 0) {
     invariant(viewerInfo, 'should be set');
     promises.updatesResult = fetchUpdateInfosWithRawUpdateInfos(
       viewerRawUpdateInfos,
       viewerInfo,
     );
   }
 
   const { updatesResult } = await promiseAll(promises);
   if (!updatesResult) {
     return defaultUpdateCreationResult;
   }
   const { updateInfos, userInfos } = updatesResult;
   return { viewerUpdates: updateInfos, userInfos };
 }
 
 export type FetchUpdatesResult = {
   +updateInfos: $ReadOnlyArray<ServerUpdateInfo>,
   +userInfos: UserInfos,
 };
 async function fetchUpdateInfosWithRawUpdateInfos(
   rawUpdateInfos: $ReadOnlyArray<RawUpdateInfo>,
   viewerInfo: ViewerInfo,
 ): Promise<FetchUpdatesResult> {
   const entitiesToFetch = rawUpdateInfos
     .map(info => updateSpecs[info.type].entitiesToFetch?.(info))
     .filter(Boolean);
   const currentUserNeedsFetch = entitiesToFetch.some(
     ({ currentUser }) => currentUser,
   );
   const threadIDsNeedingFetch = viewerInfo.threadInfos
     ? new Set()
     : new Set(entitiesToFetch.map(({ threadID }) => threadID).filter(Boolean));
   const entryIDsNeedingFetch = new Set(
     entitiesToFetch.map(({ entryID }) => entryID).filter(Boolean),
   );
   // entries and messages
   const threadIDsNeedingDetailedFetch = new Set(
     entitiesToFetch
       .map(({ detailedThreadID }) => detailedThreadID)
       .filter(Boolean),
   );
   const userIDsToFetch = new Set(
     entitiesToFetch.map(({ userID }) => userID).filter(Boolean),
   );
 
   const promises = {};
 
   const { viewer } = viewerInfo;
   if (!viewerInfo.threadInfos && threadIDsNeedingFetch.size > 0) {
     promises.threadResult = fetchThreadInfos(viewer, {
       threadIDs: threadIDsNeedingFetch,
     });
   }
 
   let calendarQuery: ?CalendarQuery = viewerInfo.calendarQuery
     ? viewerInfo.calendarQuery
     : null;
   if (!calendarQuery && viewer.hasSessionInfo) {
     // This should only ever happen for "legacy" clients who call in without
     // providing this information. These clients wouldn't know how to deal with
     // the corresponding UpdateInfos anyways, so no reason to be worried.
     calendarQuery = viewer.calendarQuery;
   } else if (!calendarQuery) {
     calendarQuery = defaultCalendarQuery(viewer.platform, viewer.timeZone);
   }
   if (threadIDsNeedingDetailedFetch.size > 0) {
     const threadCursors: { [string]: ?string } = {};
     for (const threadID of threadIDsNeedingDetailedFetch) {
       threadCursors[threadID] = null;
     }
     const messageSelectionCriteria: MessageSelectionCriteria = {
       threadCursors,
     };
     promises.messageInfosResult = fetchMessageInfos(
       viewer,
       messageSelectionCriteria,
       defaultNumberPerThread,
     );
     const threadCalendarQuery = {
       ...calendarQuery,
       filters: [
         ...nonThreadCalendarFilters(calendarQuery.filters),
         { type: 'threads', threadIDs: [...threadIDsNeedingDetailedFetch] },
       ],
     };
     promises.calendarResult = fetchEntryInfos(viewer, [threadCalendarQuery]);
   }
 
   if (entryIDsNeedingFetch.size > 0) {
     promises.entryInfosResult = fetchEntryInfosByID(
       viewer,
       entryIDsNeedingFetch,
     );
   }
 
   if (currentUserNeedsFetch) {
     promises.currentUserInfoResult = (async () => {
       const currentUserInfo = await fetchCurrentUserInfo(viewer);
       invariant(currentUserInfo.anonymous === undefined, 'should be logged in');
       return currentUserInfo;
     })();
   }
 
   if (userIDsToFetch.size > 0) {
     promises.userInfosResult = fetchKnownUserInfos(viewer, [...userIDsToFetch]);
   }
 
   const {
     threadResult,
     messageInfosResult,
     calendarResult,
     entryInfosResult,
     currentUserInfoResult,
     userInfosResult,
   } = await promiseAll(promises);
 
   let threadInfos = {};
   if (viewerInfo.threadInfos) {
     threadInfos = viewerInfo.threadInfos;
   } else if (threadResult) {
     threadInfos = threadResult.threadInfos;
   }
 
   return await updateInfosFromRawUpdateInfos(viewer, rawUpdateInfos, {
     threadInfos,
     messageInfosResult,
     calendarResult,
     entryInfosResult,
     currentUserInfoResult,
     userInfosResult,
   });
 }
 
 async function updateInfosFromRawUpdateInfos(
   viewer: Viewer,
   rawUpdateInfos: $ReadOnlyArray<RawUpdateInfo>,
   rawData: UpdateInfosRawData,
 ): Promise<FetchUpdatesResult> {
   const { messageInfosResult, calendarResult, userInfosResult } = rawData;
 
-  const rawEntryInfosByThreadID = {};
+  const rawEntryInfosByThreadID: { [string]: Array<RawEntryInfo> } = {};
   for (const entryInfo of calendarResult?.rawEntryInfos ?? []) {
     if (!rawEntryInfosByThreadID[entryInfo.threadID]) {
       rawEntryInfosByThreadID[entryInfo.threadID] = [];
     }
     rawEntryInfosByThreadID[entryInfo.threadID].push(entryInfo);
   }
 
-  const rawMessageInfosByThreadID = {};
+  const rawMessageInfosByThreadID: { [string]: Array<RawMessageInfo> } = {};
   for (const messageInfo of messageInfosResult?.rawMessageInfos ?? []) {
     if (!rawMessageInfosByThreadID[messageInfo.threadID]) {
       rawMessageInfosByThreadID[messageInfo.threadID] = [];
     }
     rawMessageInfosByThreadID[messageInfo.threadID].push(messageInfo);
   }
 
   const params = {
     data: rawData,
     rawEntryInfosByThreadID,
     rawMessageInfosByThreadID,
   };
   const updateInfos = rawUpdateInfos
     .map(update =>
       updateSpecs[update.type].updateInfoFromRawInfo(update, params),
     )
     .filter(Boolean);
 
   updateInfos.sort(sortFunction);
 
   // Now we'll attempt to merge UpdateInfos so that we only have one per key
   const updateForKey: Map<string, ServerUpdateInfo> = new Map();
   const mergedUpdates: ServerUpdateInfo[] = [];
   for (const updateInfo of updateInfos) {
     const key = keyForUpdateInfo(updateInfo);
     if (!key) {
       mergedUpdates.push(updateInfo);
       continue;
     }
     const typesOfReplacedUpdatesForMatchingKey =
       updateSpecs[updateInfo.type].typesOfReplacedUpdatesForMatchingKey;
     const currentUpdateInfo = updateForKey.get(key);
     if (
       !currentUpdateInfo ||
       typesOfReplacedUpdatesForMatchingKey === 'all_types' ||
       typesOfReplacedUpdatesForMatchingKey?.has(currentUpdateInfo.type)
     ) {
       updateForKey.set(key, updateInfo);
     }
   }
   for (const [, updateInfo] of updateForKey) {
     mergedUpdates.push(updateInfo);
   }
   mergedUpdates.sort(sortFunction);
 
   return { updateInfos: mergedUpdates, userInfos: userInfosResult ?? {} };
 }
 
 type PublishInfo = {
   updateTarget: UpdateTarget,
   rawUpdateInfos: RawUpdateInfo[],
 };
 async function redisPublish(
   publishInfos: Iterator<PublishInfo>,
   dontBroadcastSession: ?string,
 ): Promise<void> {
   for (const publishInfo of publishInfos) {
     const { updateTarget, rawUpdateInfos } = publishInfo;
     const redisMessage: NewUpdatesRedisMessage = {
       type: redisMessageTypes.NEW_UPDATES,
       updates: rawUpdateInfos,
     };
     if (!updateTarget.sessionID && dontBroadcastSession) {
       redisMessage.ignoreSession = dontBroadcastSession;
     }
     publisher.sendMessage(updateTarget, redisMessage);
   }
 }
 
 function getTargetFromUpdateData(updateData: UpdateData): ?string {
   if (updateData.targetSession) {
     return updateData.targetSession;
   } else if (updateData.targetCookie) {
     return updateData.targetCookie;
   } else {
     return null;
   }
 }
 
 function getDeleteCondition(updateData: UpdateData): ?DeleteCondition {
   const types = updateSpecs[updateData.type].deleteCondition;
   if (!types) {
     return null;
   }
 
   const target = getTargetFromUpdateData(updateData);
   const { userID } = updateData;
   return { userID, target, types };
 }
 
 function filterOnDeleteCondition(
   updateData: UpdateData,
   deleteCondition: DeleteCondition,
 ): boolean {
   invariant(
     updateData.userID === deleteCondition.userID,
     `updateData of type ${updateData.type} being compared to wrong userID`,
   );
   if (deleteCondition.target) {
     const target = getTargetFromUpdateData(updateData);
     if (target !== deleteCondition.target) {
       return true;
     }
   }
   if (deleteCondition.types === 'all_types') {
     return false;
   }
   return !deleteCondition.types.has(updateData.type);
 }
 
 export { createUpdates, fetchUpdateInfosWithRawUpdateInfos };
diff --git a/keyserver/src/fetchers/entry-fetchers.js b/keyserver/src/fetchers/entry-fetchers.js
index d05ff28a0..8ab0eb0ba 100644
--- a/keyserver/src/fetchers/entry-fetchers.js
+++ b/keyserver/src/fetchers/entry-fetchers.js
@@ -1,353 +1,353 @@
 // @flow
 
 import invariant from 'invariant';
 
 import { permissionLookup } from 'lib/permissions/thread-permissions.js';
 import {
   filteredThreadIDs,
   filterExists,
   nonExcludeDeletedCalendarFilters,
 } from 'lib/selectors/calendar-filter-selectors.js';
 import { rawEntryInfoWithinCalendarQuery } from 'lib/shared/entry-utils.js';
 import type {
   CalendarQuery,
   FetchEntryInfosBase,
   DeltaEntryInfosResponse,
   RawEntryInfo,
   RawEntryInfos,
 } from 'lib/types/entry-types.js';
 import { calendarThreadFilterTypes } from 'lib/types/filter-types.js';
 import type { HistoryRevisionInfo } from 'lib/types/history-types.js';
 import { threadPermissions } from 'lib/types/thread-permission-types.js';
 import type { ThreadPermission } from 'lib/types/thread-permission-types.js';
 import { dateString } from 'lib/utils/date-utils.js';
 import { ServerError } from 'lib/utils/errors.js';
 
 import { checkIfThreadIsBlocked } from './thread-permission-fetchers.js';
 import {
   dbQuery,
   SQL,
   mergeAndConditions,
   mergeOrConditions,
 } from '../database/database.js';
 import type { SQLStatementType } from '../database/types.js';
 import type { Viewer } from '../session/viewer.js';
 import { creationString } from '../utils/idempotent.js';
 
 async function fetchEntryInfo(
   viewer: Viewer,
   entryID: string,
 ): Promise<?RawEntryInfo> {
   const results = await fetchEntryInfosByID(viewer, new Set([entryID]));
   return results[entryID] ?? null;
 }
 
 function rawEntryInfoFromRow(row: Object): RawEntryInfo {
   return {
     id: row.id.toString(),
     threadID: row.threadID.toString(),
     text: row.text,
     year: row.year,
     month: row.month,
     day: row.day,
     creationTime: row.creationTime,
     creatorID: row.creatorID.toString(),
     deleted: !!row.deleted,
   };
 }
 
 const visPermissionExtractString = `$.${threadPermissions.VISIBLE}.value`;
 async function fetchEntryInfosByID(
   viewer: Viewer,
   entryIDs: $ReadOnlySet<string>,
 ): Promise<RawEntryInfos> {
   if (entryIDs.size === 0) {
     return {};
   }
   const viewerID = viewer.id;
   const query = SQL`
     SELECT DAY(d.date) AS day, MONTH(d.date) AS month, YEAR(d.date) AS year,
       e.id, e.text, e.creation_time AS creationTime, d.thread AS threadID,
       e.deleted, e.creator AS creatorID
     FROM entries e
     LEFT JOIN days d ON d.id = e.day
     LEFT JOIN memberships m ON m.thread = d.thread AND m.user = ${viewerID}
     WHERE e.id IN (${[...entryIDs]}) AND
       JSON_EXTRACT(m.permissions, ${visPermissionExtractString}) IS TRUE
   `;
   const [result] = await dbQuery(query);
   const entryInfos = {};
   for (const row of result) {
     entryInfos[row.id.toString()] = rawEntryInfoFromRow(row);
   }
   return entryInfos;
 }
 
 function sqlConditionForCalendarQuery(
   calendarQuery: CalendarQuery,
 ): ?SQLStatementType {
   const { filters, startDate, endDate } = calendarQuery;
   const conditions = [];
 
   conditions.push(SQL`d.date BETWEEN ${startDate} AND ${endDate}`);
 
   const filterToThreadIDs = filteredThreadIDs(filters);
   if (filterToThreadIDs && filterToThreadIDs.size > 0) {
     conditions.push(SQL`d.thread IN (${[...filterToThreadIDs]})`);
   } else if (filterToThreadIDs) {
     // Filter to empty set means the result is empty
     return null;
   } else {
     conditions.push(SQL`m.role > 0`);
   }
 
   if (filterExists(filters, calendarThreadFilterTypes.NOT_DELETED)) {
     conditions.push(SQL`e.deleted = 0`);
   }
 
   return mergeAndConditions(conditions);
 }
 
 async function fetchEntryInfos(
   viewer: Viewer,
   calendarQueries: $ReadOnlyArray<CalendarQuery>,
 ): Promise<FetchEntryInfosBase> {
   const queryConditions = calendarQueries
     .map(sqlConditionForCalendarQuery)
     .filter(Boolean);
   if (queryConditions.length === 0) {
     return { rawEntryInfos: [] };
   }
   const queryCondition = mergeOrConditions(queryConditions);
 
   const viewerID = viewer.id;
   const query = SQL`
     SELECT DAY(d.date) AS day, MONTH(d.date) AS month, YEAR(d.date) AS year,
       e.id, e.text, e.creation_time AS creationTime, d.thread AS threadID,
       e.deleted, e.creator AS creatorID
     FROM entries e
     LEFT JOIN days d ON d.id = e.day
     LEFT JOIN memberships m ON m.thread = d.thread AND m.user = ${viewerID}
     WHERE JSON_EXTRACT(m.permissions, ${visPermissionExtractString}) IS TRUE AND
   `;
   query.append(queryCondition);
   query.append(SQL`ORDER BY e.creation_time DESC`);
   const [result] = await dbQuery(query);
 
   const rawEntryInfos = [];
   for (const row of result) {
     rawEntryInfos.push(rawEntryInfoFromRow(row));
   }
   return { rawEntryInfos };
 }
 
 async function checkThreadPermissionForEntry(
   viewer: Viewer,
   entryID: string,
   permission: ThreadPermission,
 ): Promise<boolean> {
   const viewerID = viewer.id;
   const query = SQL`
     SELECT m.permissions, t.id
     FROM entries e
     LEFT JOIN days d ON d.id = e.day
     LEFT JOIN threads t ON t.id = d.thread
     LEFT JOIN memberships m ON m.thread = t.id AND m.user = ${viewerID}
     WHERE e.id = ${entryID}
   `;
   const [result] = await dbQuery(query);
 
   if (result.length === 0) {
     return false;
   }
   const row = result[0];
   if (row.id === null) {
     return false;
   }
   const threadIsBlocked = await checkIfThreadIsBlocked(
     viewer,
     row.id.toString(),
     permission,
   );
   if (threadIsBlocked) {
     return false;
   }
 
   const permissions = JSON.parse(row.permissions);
   return permissionLookup(permissions, permission);
 }
 
 async function fetchEntryRevisionInfo(
   viewer: Viewer,
   entryID: string,
 ): Promise<$ReadOnlyArray<HistoryRevisionInfo>> {
   const hasPermission = await checkThreadPermissionForEntry(
     viewer,
     entryID,
     threadPermissions.VISIBLE,
   );
   if (!hasPermission) {
     throw new ServerError('invalid_credentials');
   }
 
   const query = SQL`
     SELECT r.id, r.author AS authorID, r.text, r.last_update AS lastUpdate,
       r.deleted, d.thread AS threadID, r.entry AS entryID
     FROM revisions r
     LEFT JOIN entries e ON e.id = r.entry
     LEFT JOIN days d ON d.id = e.day
     WHERE r.entry = ${entryID}
     ORDER BY r.last_update DESC
   `;
   const [result] = await dbQuery(query);
 
   const revisions = [];
   for (const row of result) {
     revisions.push({
       id: row.id.toString(),
       authorID: row.authorID.toString(),
       text: row.text,
       lastUpdate: row.lastUpdate,
       deleted: !!row.deleted,
       threadID: row.threadID.toString(),
       entryID: row.entryID.toString(),
     });
   }
   return revisions;
 }
 
 // calendarQueries are the "difference" queries we get from subtracting the old
 // CalendarQuery from the new one. See calendarQueryDifference.
 // oldCalendarQuery is the old CalendarQuery. We make sure none of the returned
 // RawEntryInfos match the old CalendarQuery, so that only the difference is
 // returned.
 async function fetchEntriesForSession(
   viewer: Viewer,
   calendarQueries: $ReadOnlyArray<CalendarQuery>,
   oldCalendarQuery: CalendarQuery,
 ): Promise<DeltaEntryInfosResponse> {
   // If we're not including deleted entries, we will try and set deletedEntryIDs
   // so that the client can catch possibly stale deleted entryInfos
   let filterDeleted = null;
   for (const calendarQuery of calendarQueries) {
     const notDeletedFilterExists = filterExists(
       calendarQuery.filters,
       calendarThreadFilterTypes.NOT_DELETED,
     );
     if (filterDeleted === null) {
       filterDeleted = notDeletedFilterExists;
     } else {
       invariant(
         filterDeleted === notDeletedFilterExists,
         'one of the CalendarQueries returned by calendarQueryDifference has ' +
           'a NOT_DELETED filter but another does not: ' +
           JSON.stringify(calendarQueries),
       );
     }
   }
 
   let calendarQueriesForFetch = calendarQueries;
   if (filterDeleted) {
     // Because in the filterDeleted case we still need the deleted RawEntryInfos
     // in order to construct deletedEntryIDs, we get rid of the NOT_DELETED
     // filters before passing the CalendarQueries to fetchEntryInfos. We will
     // filter out the deleted RawEntryInfos in a later step.
     calendarQueriesForFetch = calendarQueriesForFetch.map(calendarQuery => ({
       ...calendarQuery,
       filters: nonExcludeDeletedCalendarFilters(calendarQuery.filters),
     }));
   }
 
   const { rawEntryInfos } = await fetchEntryInfos(
     viewer,
     calendarQueriesForFetch,
   );
   const entryInfosNotInOldQuery = rawEntryInfos.filter(
     rawEntryInfo =>
       !rawEntryInfoWithinCalendarQuery(rawEntryInfo, oldCalendarQuery),
   );
   let filteredRawEntryInfos = entryInfosNotInOldQuery;
-  let deletedEntryIDs = [];
+  let deletedEntryIDs: $ReadOnlyArray<string> = [];
   if (filterDeleted) {
     filteredRawEntryInfos = entryInfosNotInOldQuery.filter(
       rawEntryInfo => !rawEntryInfo.deleted,
     );
     deletedEntryIDs = entryInfosNotInOldQuery
       .filter(rawEntryInfo => rawEntryInfo.deleted)
       .map(rawEntryInfo => {
         const { id } = rawEntryInfo;
         invariant(
           id !== null && id !== undefined,
           'serverID should be set in fetchEntryInfos result',
         );
         return id;
       });
   }
 
   return {
     rawEntryInfos: filteredRawEntryInfos,
     deletedEntryIDs,
   };
 }
 
 async function fetchEntryInfoForLocalID(
   viewer: Viewer,
   localID: ?string,
 ): Promise<?RawEntryInfo> {
   if (!localID || !viewer.hasSessionInfo) {
     return null;
   }
   const creation = creationString(viewer, localID);
   const viewerID = viewer.id;
   const query = SQL`
     SELECT DAY(d.date) AS day, MONTH(d.date) AS month, YEAR(d.date) AS year,
       e.id, e.text, e.creation_time AS creationTime, d.thread AS threadID,
       e.deleted, e.creator AS creatorID
     FROM entries e
     LEFT JOIN days d ON d.id = e.day
     LEFT JOIN memberships m ON m.thread = d.thread AND m.user = ${viewerID}
     WHERE e.creator = ${viewerID} AND e.creation = ${creation} AND
       JSON_EXTRACT(m.permissions, ${visPermissionExtractString}) IS TRUE
   `;
 
   const [result] = await dbQuery(query);
   if (result.length === 0) {
     return null;
   }
   return rawEntryInfoFromRow(result[0]);
 }
 
 function getSunday(weeksFromLastSunday: number) {
   const date = new Date();
   const today = date.getDate();
   const currentDay = date.getDay();
   const newDate = date.setDate(today - currentDay + 7 * weeksFromLastSunday);
   return new Date(newDate);
 }
 
 async function fetchEntryInfosForThreadThisWeek(
   viewer: Viewer,
   threadID: string,
 ): Promise<$ReadOnlyArray<RawEntryInfo>> {
   const startDate = dateString(getSunday(0));
   const endDate = dateString(getSunday(1));
   const filters = [
     { type: 'not_deleted' },
     { type: 'threads', threadIDs: [threadID] },
   ];
   const { rawEntryInfos } = await fetchEntryInfos(viewer, [
     { startDate, endDate, filters },
   ]);
   return rawEntryInfos;
 }
 
 export {
   fetchEntryInfo,
   fetchEntryInfosByID,
   fetchEntryInfos,
   checkThreadPermissionForEntry,
   fetchEntryRevisionInfo,
   fetchEntriesForSession,
   fetchEntryInfoForLocalID,
   fetchEntryInfosForThreadThisWeek,
 };
diff --git a/keyserver/src/fetchers/message-fetchers.js b/keyserver/src/fetchers/message-fetchers.js
index 0230bb85c..037eb2325 100644
--- a/keyserver/src/fetchers/message-fetchers.js
+++ b/keyserver/src/fetchers/message-fetchers.js
@@ -1,1032 +1,1036 @@
 // @flow
 
 import invariant from 'invariant';
 
 import {
   sortMessageInfoList,
   shimUnsupportedRawMessageInfos,
   isInvalidSidebarSource,
   isUnableToBeRenderedIndependently,
   isInvalidPinSource,
 } from 'lib/shared/message-utils.js';
 import { messageSpecs } from 'lib/shared/messages/message-specs.js';
 import { getNotifCollapseKey } from 'lib/shared/notif-utils.js';
 import { hasMinCodeVersion } from 'lib/shared/version-utils.js';
 import {
   messageTypes,
   type MessageType,
   assertMessageType,
 } from 'lib/types/message-types-enum.js';
 import {
   type RawMessageInfo,
   type RawComposableMessageInfo,
   type RawRobotextMessageInfo,
   type EditMessageContent,
   type MessageSelectionCriteria,
   type MessageTruncationStatus,
   messageTruncationStatus,
   type FetchMessageInfosResult,
   defaultMaxMessageAge,
   type FetchPinnedMessagesRequest,
   type FetchPinnedMessagesResult,
   type SearchMessagesResponse,
+  type MessageTruncationStatuses,
 } from 'lib/types/message-types.js';
 import { defaultNumberPerThread } from 'lib/types/message-types.js';
 import { threadPermissions } from 'lib/types/thread-permission-types.js';
 import { ServerError } from 'lib/utils/errors.js';
 
 import {
   constructMediaFromMediaMessageContentsAndUploadRows,
   imagesFromRow,
 } from './upload-fetchers.js';
 import {
   dbQuery,
   SQL,
   mergeOrConditions,
   mergeAndConditions,
 } from '../database/database.js';
 import { processQueryForSearch } from '../database/search-utils.js';
 import type { SQLStatementType } from '../database/types.js';
 import type { PushInfo } from '../push/send.js';
 import type { Viewer } from '../session/viewer.js';
 import {
   creationString,
   localIDFromCreationString,
 } from '../utils/idempotent.js';
 
 export type CollapsableNotifInfo = {
   collapseKey: ?string,
   existingMessageInfos: RawMessageInfo[],
   newMessageInfos: RawMessageInfo[],
 };
 export type FetchCollapsableNotifsResult = {
   [userID: string]: CollapsableNotifInfo[],
 };
 
 const visibleExtractString = `$.${threadPermissions.VISIBLE}.value`;
 
 // This function doesn't filter RawMessageInfos based on what messageTypes the
 // client supports, since each user can have multiple clients. The caller must
 // handle this filtering.
 async function fetchCollapsableNotifs(
   pushInfo: PushInfo,
 ): Promise<FetchCollapsableNotifsResult> {
   // First, we need to fetch any notifications that should be collapsed
-  const usersToCollapseKeysToInfo = {};
-  const usersToCollapsableNotifInfo = {};
+  const usersToCollapseKeysToInfo: {
+    [string]: { [string]: CollapsableNotifInfo },
+  } = {};
+  const usersToCollapsableNotifInfo: { [string]: Array<CollapsableNotifInfo> } =
+    {};
   for (const userID in pushInfo) {
     usersToCollapseKeysToInfo[userID] = {};
     usersToCollapsableNotifInfo[userID] = [];
     for (let i = 0; i < pushInfo[userID].messageInfos.length; i++) {
       const rawMessageInfo = pushInfo[userID].messageInfos[i];
       const messageData = pushInfo[userID].messageDatas[i];
       const collapseKey = getNotifCollapseKey(rawMessageInfo, messageData);
       if (!collapseKey) {
-        const collapsableNotifInfo = {
+        const collapsableNotifInfo: CollapsableNotifInfo = {
           collapseKey,
           existingMessageInfos: [],
           newMessageInfos: [rawMessageInfo],
         };
         usersToCollapsableNotifInfo[userID].push(collapsableNotifInfo);
         continue;
       }
       if (!usersToCollapseKeysToInfo[userID][collapseKey]) {
-        usersToCollapseKeysToInfo[userID][collapseKey] = {
+        usersToCollapseKeysToInfo[userID][collapseKey] = ({
           collapseKey,
           existingMessageInfos: [],
           newMessageInfos: [],
-        };
+        }: CollapsableNotifInfo);
       }
       usersToCollapseKeysToInfo[userID][collapseKey].newMessageInfos.push(
         rawMessageInfo,
       );
     }
   }
 
   const sqlTuples = [];
   for (const userID in usersToCollapseKeysToInfo) {
     const collapseKeysToInfo = usersToCollapseKeysToInfo[userID];
     for (const collapseKey in collapseKeysToInfo) {
       sqlTuples.push(
         SQL`(n.user = ${userID} AND n.collapse_key = ${collapseKey})`,
       );
     }
   }
 
   if (sqlTuples.length === 0) {
     return usersToCollapsableNotifInfo;
   }
 
   const collapseQuery = SQL`
     SELECT m.id, m.thread AS threadID, m.content, m.time, m.type,
       m.user AS creatorID, m.target_message as targetMessageID,
       stm.permissions AS subthread_permissions, n.user,
       n.collapse_key, up.id AS uploadID, up.type AS uploadType,
       up.secret AS uploadSecret, up.extra AS uploadExtra
     FROM notifications n
     LEFT JOIN messages m ON m.id = n.message
     LEFT JOIN uploads up ON up.container = m.id
     LEFT JOIN memberships mm ON mm.thread = m.thread AND mm.user = n.user
     LEFT JOIN memberships stm
       ON m.type = ${messageTypes.CREATE_SUB_THREAD}
         AND stm.thread = m.content AND stm.user = n.user
     WHERE n.rescinded = 0 AND
       JSON_EXTRACT(mm.permissions, ${visibleExtractString}) IS TRUE AND
   `;
   collapseQuery.append(mergeOrConditions(sqlTuples));
   collapseQuery.append(SQL`ORDER BY m.time DESC, m.id DESC`);
   const [collapseResult] = await dbQuery(collapseQuery);
 
   const rowsByUser = new Map();
   for (const row of collapseResult) {
     const user = row.user.toString();
     const currentRowsForUser = rowsByUser.get(user);
     if (currentRowsForUser) {
       currentRowsForUser.push(row);
     } else {
       rowsByUser.set(user, [row]);
     }
   }
 
   const derivedMessages = await fetchDerivedMessages(collapseResult);
   for (const userRows of rowsByUser.values()) {
     const messages = parseMessageSQLResult(userRows, derivedMessages);
     for (const message of messages) {
       const { rawMessageInfo, rows } = message;
       const [row] = rows;
       const info = usersToCollapseKeysToInfo[row.user][row.collapse_key];
       info.existingMessageInfos.push(rawMessageInfo);
     }
   }
 
   for (const userID in usersToCollapseKeysToInfo) {
     const collapseKeysToInfo = usersToCollapseKeysToInfo[userID];
     for (const collapseKey in collapseKeysToInfo) {
       const info = collapseKeysToInfo[collapseKey];
       usersToCollapsableNotifInfo[userID].push({
         collapseKey: info.collapseKey,
         existingMessageInfos: sortMessageInfoList(info.existingMessageInfos),
         newMessageInfos: sortMessageInfoList(info.newMessageInfos),
       });
     }
   }
 
   return usersToCollapsableNotifInfo;
 }
 
 type MessageSQLResult = $ReadOnlyArray<{
   rawMessageInfo: RawMessageInfo,
   rows: $ReadOnlyArray<Object>,
 }>;
 function parseMessageSQLResult(
   rows: $ReadOnlyArray<Object>,
   derivedMessages: $ReadOnlyMap<
     string,
     RawComposableMessageInfo | RawRobotextMessageInfo,
   >,
   viewer?: Viewer,
 ): MessageSQLResult {
   const rowsByID = new Map();
   for (const row of rows) {
     const id = row.id.toString();
     const currentRowsForID = rowsByID.get(id);
     if (currentRowsForID) {
       currentRowsForID.push(row);
     } else {
       rowsByID.set(id, [row]);
     }
   }
 
   const messages = [];
   for (const messageRows of rowsByID.values()) {
     const rawMessageInfo = rawMessageInfoFromRows(
       messageRows,
       viewer,
       derivedMessages,
     );
     if (rawMessageInfo) {
       messages.push({ rawMessageInfo, rows: messageRows });
     }
   }
 
   return messages;
 }
 
 function assertSingleRow(rows: $ReadOnlyArray<Object>): Object {
   if (rows.length === 0) {
     throw new Error('expected single row, but none present!');
   } else if (rows.length !== 1) {
     const messageIDs = rows.map(row => row.id.toString());
     console.warn(
       `expected single row, but there are multiple! ${messageIDs.join(', ')}`,
     );
   }
   return rows[0];
 }
 
 function mostRecentRowType(rows: $ReadOnlyArray<Object>): MessageType {
   if (rows.length === 0) {
     throw new Error('expected row, but none present!');
   }
   return assertMessageType(rows[0].type);
 }
 
 function rawMessageInfoFromRows(
   rawRows: $ReadOnlyArray<Object>,
   viewer?: Viewer,
   derivedMessages: $ReadOnlyMap<
     string,
     RawComposableMessageInfo | RawRobotextMessageInfo,
   >,
 ): ?RawMessageInfo {
   const rows = rawRows.map(row => ({
     ...row,
     subthread_permissions: JSON.parse(row.subthread_permissions),
   }));
 
   const type = mostRecentRowType(rows);
   const messageSpec = messageSpecs[type];
   const requiresDerivedMessages =
     messageSpec.parseDerivedMessages !== undefined;
 
   if (type === messageTypes.IMAGES || type === messageTypes.MULTIMEDIA) {
     let media;
     if (type === messageTypes.MULTIMEDIA) {
       const mediaMessageContents = JSON.parse(rows[0].content);
       media = constructMediaFromMediaMessageContentsAndUploadRows(
         mediaMessageContents,
         rows,
       );
     } else {
       media = rows.filter(row => row.uploadID).map(imagesFromRow);
     }
     const [row] = rows;
     const localID = localIDFromCreationString(viewer, row.creation);
 
     let rawMessageInfoFromServerDBRowParams = { localID, media };
     if (requiresDerivedMessages) {
       rawMessageInfoFromServerDBRowParams = {
         ...rawMessageInfoFromServerDBRowParams,
         derivedMessages,
       };
     }
 
     invariant(
       messageSpec.rawMessageInfoFromServerDBRow,
       `multimedia message spec should have rawMessageInfoFromServerDBRow`,
     );
     return messageSpec.rawMessageInfoFromServerDBRow(
       row,
       rawMessageInfoFromServerDBRowParams,
     );
   }
 
   const row = assertSingleRow(rows);
   const localID = localIDFromCreationString(viewer, row.creation);
 
   let rawMessageInfoFromServerDBRowParams = { localID };
   if (requiresDerivedMessages) {
     rawMessageInfoFromServerDBRowParams = {
       ...rawMessageInfoFromServerDBRowParams,
       derivedMessages,
     };
   }
 
   invariant(
     messageSpec.rawMessageInfoFromServerDBRow,
     `message spec ${type} should have rawMessageInfoFromServerDBRow`,
   );
   return messageSpec.rawMessageInfoFromServerDBRow(
     row,
     rawMessageInfoFromServerDBRowParams,
   );
 }
 
 async function fetchMessageInfos(
   viewer: Viewer,
   criteria: MessageSelectionCriteria,
   numberPerThread: number,
 ): Promise<FetchMessageInfosResult> {
   const { sqlClause: selectionClause, timeFilterData } =
     parseMessageSelectionCriteria(viewer, criteria);
-  const truncationStatuses = {};
+  const truncationStatuses: MessageTruncationStatuses = {};
 
   const viewerID = viewer.id;
   const query = SQL`
     WITH thread_window AS (
       SELECT m.id, m.thread AS threadID, m.user AS creatorID,
         m.target_message as targetMessageID, m.content, m.time, m.type,
         m.creation, stm.permissions AS subthread_permissions,
         ROW_NUMBER() OVER (
           PARTITION BY threadID ORDER BY m.time DESC, m.id DESC
         ) n
       FROM messages m
       LEFT JOIN memberships mm
         ON mm.thread = m.thread AND mm.user = ${viewerID}
       LEFT JOIN memberships stm ON m.type = ${messageTypes.CREATE_SUB_THREAD}
         AND stm.thread = m.content AND stm.user = ${viewerID}
       WHERE JSON_EXTRACT(mm.permissions, ${visibleExtractString}) IS TRUE AND
   `;
   query.append(selectionClause);
   query.append(SQL`
     )
     SELECT tw.*,
       up.id AS uploadID, up.type AS uploadType, up.secret AS uploadSecret,
       up.extra AS uploadExtra
     FROM thread_window tw
     LEFT JOIN uploads up ON up.container = tw.id
     WHERE tw.n <= ${numberPerThread}
     ORDER BY tw.threadID, tw.time DESC, tw.id DESC
   `);
 
   const [result] = await dbQuery(query);
   const derivedMessages = await fetchDerivedMessages(result, viewer);
   const messages = await parseMessageSQLResult(result, derivedMessages, viewer);
 
   const rawMessageInfos = [];
   const threadToMessageCount = new Map();
   for (const message of messages) {
     const { rawMessageInfo } = message;
     rawMessageInfos.push(rawMessageInfo);
     const { threadID } = rawMessageInfo;
     const currentCountValue = threadToMessageCount.get(threadID);
     const currentCount = currentCountValue ? currentCountValue : 0;
     threadToMessageCount.set(threadID, currentCount + 1);
   }
 
   for (const [threadID, messageCount] of threadToMessageCount) {
     // If we matched the exact amount we limited to, we're probably truncating
     // our result set. By setting TRUNCATED here, we tell the client that the
     // result set might not be continguous with what's already in their
     // MessageStore. More details about TRUNCATED can be found in
     // lib/types/message-types.js
     if (messageCount >= numberPerThread) {
       // We won't set TRUNCATED if a cursor was specified for a given thread,
       // since then the result is guaranteed to be contiguous with what the
       // client has
       if (criteria.threadCursors && criteria.threadCursors[threadID]) {
         truncationStatuses[threadID] = messageTruncationStatus.UNCHANGED;
       } else {
         truncationStatuses[threadID] = messageTruncationStatus.TRUNCATED;
       }
       continue;
     }
     const hasTimeFilter = hasTimeFilterForThread(timeFilterData, threadID);
     if (!hasTimeFilter) {
       // If there is no time filter for a given thread, and there are fewer
       // messages returned than the max we queried for a given thread, we can
       // conclude that our result set includes all messages for that thread
       truncationStatuses[threadID] = messageTruncationStatus.EXHAUSTIVE;
     }
   }
 
   for (const rawMessageInfo of rawMessageInfos) {
     if (messageSpecs[rawMessageInfo.type].startsThread) {
       truncationStatuses[rawMessageInfo.threadID] =
         messageTruncationStatus.EXHAUSTIVE;
     }
   }
 
   for (const threadID in criteria.threadCursors) {
     const truncationStatus = truncationStatuses[threadID];
     if (truncationStatus !== null && truncationStatus !== undefined) {
       continue;
     }
     const hasTimeFilter = hasTimeFilterForThread(timeFilterData, threadID);
     if (!hasTimeFilter) {
       // If there is no time filter for a given thread, and zero messages were
       // returned, we can conclude that this thread has zero messages. This is
       // a case of database corruption that should not be possible, but likely
       // we have some threads like this on prod (either due to some transient
       // issues or due to old buggy code)
       truncationStatuses[threadID] = messageTruncationStatus.EXHAUSTIVE;
     } else {
       // If this thread was explicitly queried for, and we got no results, but
       // we can't conclude that it's EXHAUSTIVE, then we'll set to UNCHANGED.
       truncationStatuses[threadID] = messageTruncationStatus.UNCHANGED;
     }
   }
 
   const shimmedRawMessageInfos = shimUnsupportedRawMessageInfos(
     rawMessageInfos,
     viewer.platformDetails,
   );
 
   return {
     rawMessageInfos: shimmedRawMessageInfos,
     truncationStatuses,
   };
 }
 
 // ESLint doesn't recognize that invariant always throws
 // eslint-disable-next-line consistent-return
 function hasTimeFilterForThread(
   timeFilterData: TimeFilterData,
   threadID: string,
 ) {
   if (timeFilterData.timeFilter === 'ALL') {
     return true;
   } else if (timeFilterData.timeFilter === 'NONE') {
     return false;
   } else if (timeFilterData.timeFilter === 'ALL_EXCEPT_EXCLUDED') {
     return !timeFilterData.excludedFromTimeFilter.has(threadID);
   } else {
     invariant(
       false,
       `unrecognized timeFilter type ${timeFilterData.timeFilter}`,
     );
   }
 }
 
 type TimeFilterData =
   | { +timeFilter: 'ALL' | 'NONE' }
   | {
       +timeFilter: 'ALL_EXCEPT_EXCLUDED',
       +excludedFromTimeFilter: $ReadOnlySet<string>,
     };
 type ParsedMessageSelectionCriteria = {
   +sqlClause: SQLStatementType,
   +timeFilterData: TimeFilterData,
 };
 function parseMessageSelectionCriteria(
   viewer: Viewer,
   criteria: MessageSelectionCriteria,
 ): ParsedMessageSelectionCriteria {
   const minMessageTime = Date.now() - defaultMaxMessageAge;
   const shouldApplyTimeFilter = hasMinCodeVersion(viewer.platformDetails, {
     native: 130,
   });
 
   let globalTimeFilter;
   if (criteria.newerThan) {
     globalTimeFilter = SQL`m.time > ${criteria.newerThan}`;
   } else if (!criteria.threadCursors && shouldApplyTimeFilter) {
     globalTimeFilter = SQL`
       (m.time > ${minMessageTime} OR m.id = mm.last_message)
     `;
   }
 
   const threadConditions = [];
   if (
     criteria.joinedThreads === true &&
     shouldApplyTimeFilter &&
     !globalTimeFilter
   ) {
     threadConditions.push(SQL`
       (mm.role > 0 AND (m.time > ${minMessageTime} OR m.id = mm.last_message))
     `);
   } else if (criteria.joinedThreads === true) {
     threadConditions.push(SQL`mm.role > 0`);
   }
   if (criteria.threadCursors) {
     for (const threadID in criteria.threadCursors) {
       const cursor = criteria.threadCursors[threadID];
       if (cursor) {
         threadConditions.push(
           SQL`(m.thread = ${threadID} AND m.id < ${cursor})`,
         );
       } else {
         threadConditions.push(SQL`m.thread = ${threadID}`);
       }
     }
   }
   if (threadConditions.length === 0) {
     throw new ServerError('internal_error');
   }
   const threadClause = mergeOrConditions(threadConditions);
 
   let timeFilterData;
   if (globalTimeFilter) {
     timeFilterData = { timeFilter: 'ALL' };
   } else if (!shouldApplyTimeFilter) {
     timeFilterData = { timeFilter: 'NONE' };
   } else {
     invariant(
       criteria.threadCursors,
       'ALL_EXCEPT_EXCLUDED should correspond to threadCursors being set',
     );
     const excludedFromTimeFilter = new Set(Object.keys(criteria.threadCursors));
     timeFilterData = {
       timeFilter: 'ALL_EXCEPT_EXCLUDED',
       excludedFromTimeFilter,
     };
   }
 
   const conditions = [globalTimeFilter, threadClause].filter(Boolean);
   const sqlClause = mergeAndConditions(conditions);
 
   return { sqlClause, timeFilterData };
 }
 
 function messageSelectionCriteriaToInitialTruncationStatuses(
   criteria: MessageSelectionCriteria,
   defaultTruncationStatus: MessageTruncationStatus,
 ) {
-  const truncationStatuses = {};
+  const truncationStatuses: MessageTruncationStatuses = {};
   if (criteria.threadCursors) {
     for (const threadID in criteria.threadCursors) {
       truncationStatuses[threadID] = defaultTruncationStatus;
     }
   }
   return truncationStatuses;
 }
 
 async function fetchMessageInfosSince(
   viewer: Viewer,
   criteria: MessageSelectionCriteria,
   maxNumberPerThread: number,
 ): Promise<FetchMessageInfosResult> {
   const { sqlClause: selectionClause } = parseMessageSelectionCriteria(
     viewer,
     criteria,
   );
   const truncationStatuses =
     messageSelectionCriteriaToInitialTruncationStatuses(
       criteria,
       messageTruncationStatus.UNCHANGED,
     );
 
   const viewerID = viewer.id;
   const query = SQL`
     SELECT m.id, m.thread AS threadID, m.content, m.time, m.type,
       m.creation, m.user AS creatorID, m.target_message as targetMessageID,
       stm.permissions AS subthread_permissions, up.id AS uploadID,
       up.type AS uploadType, up.secret AS uploadSecret, up.extra AS uploadExtra
     FROM messages m
     LEFT JOIN uploads up ON up.container = m.id
     LEFT JOIN memberships mm ON mm.thread = m.thread AND mm.user = ${viewerID}
     LEFT JOIN memberships stm ON m.type = ${messageTypes.CREATE_SUB_THREAD}
       AND stm.thread = m.content AND stm.user = ${viewerID}
     WHERE JSON_EXTRACT(mm.permissions, ${visibleExtractString}) IS TRUE AND
   `;
   query.append(selectionClause);
   query.append(SQL`
     ORDER BY m.thread, m.time DESC, m.id DESC
   `);
   const [result] = await dbQuery(query);
   const derivedMessages = await fetchDerivedMessages(result, viewer);
   const messages = await parseMessageSQLResult(result, derivedMessages, viewer);
 
   const rawMessageInfos = [];
   let currentThreadID = null;
   let numMessagesForCurrentThreadID = 0;
   for (const message of messages) {
     const { rawMessageInfo } = message;
     const { threadID } = rawMessageInfo;
     if (threadID !== currentThreadID) {
       currentThreadID = threadID;
       numMessagesForCurrentThreadID = 1;
       truncationStatuses[threadID] = messageTruncationStatus.UNCHANGED;
     } else {
       numMessagesForCurrentThreadID++;
     }
     if (numMessagesForCurrentThreadID <= maxNumberPerThread) {
       if (messageSpecs[rawMessageInfo.type].startsThread) {
         truncationStatuses[threadID] = messageTruncationStatus.EXHAUSTIVE;
       }
       rawMessageInfos.push(rawMessageInfo);
     } else if (numMessagesForCurrentThreadID === maxNumberPerThread + 1) {
       truncationStatuses[threadID] = messageTruncationStatus.TRUNCATED;
     }
   }
 
   const shimmedRawMessageInfos = shimUnsupportedRawMessageInfos(
     rawMessageInfos,
     viewer.platformDetails,
   );
 
   return {
     rawMessageInfos: shimmedRawMessageInfos,
     truncationStatuses,
   };
 }
 
 function getMessageFetchResultFromRedisMessages(
   viewer: Viewer,
   rawMessageInfos: $ReadOnlyArray<RawMessageInfo>,
 ): FetchMessageInfosResult {
-  const truncationStatuses = {};
+  const truncationStatuses: MessageTruncationStatuses = {};
   for (const rawMessageInfo of rawMessageInfos) {
     truncationStatuses[rawMessageInfo.threadID] =
       messageTruncationStatus.UNCHANGED;
   }
   const shimmedRawMessageInfos = shimUnsupportedRawMessageInfos(
     rawMessageInfos,
     viewer.platformDetails,
   );
   return {
     rawMessageInfos: shimmedRawMessageInfos,
     truncationStatuses,
   };
 }
 
 async function fetchMessageInfoForLocalID(
   viewer: Viewer,
   localID: ?string,
 ): Promise<?RawMessageInfo> {
   if (!localID || !viewer.hasSessionInfo) {
     return null;
   }
   const creation = creationString(viewer, localID);
   const viewerID = viewer.id;
   const query = SQL`
     SELECT m.id, m.thread AS threadID, m.content, m.time, m.type, m.creation,
       m.user AS creatorID, m.target_message as targetMessageID,
       stm.permissions AS subthread_permissions, up.id AS uploadID,
       up.type AS uploadType, up.secret AS uploadSecret, up.extra AS uploadExtra
     FROM messages m
     LEFT JOIN uploads up ON up.container = m.id
     LEFT JOIN memberships mm ON mm.thread = m.thread AND mm.user = ${viewerID}
     LEFT JOIN memberships stm ON m.type = ${messageTypes.CREATE_SUB_THREAD}
       AND stm.thread = m.content AND stm.user = ${viewerID}
     WHERE m.user = ${viewerID} AND m.creation = ${creation} AND
       JSON_EXTRACT(mm.permissions, ${visibleExtractString}) IS TRUE
   `;
 
   const [result] = await dbQuery(query);
   if (result.length === 0) {
     return null;
   }
   const derivedMessages = await fetchDerivedMessages(result, viewer);
   return rawMessageInfoFromRows(result, viewer, derivedMessages);
 }
 
 const entryIDExtractString = '$.entryID';
 async function fetchMessageInfoForEntryAction(
   viewer: Viewer,
   messageType: MessageType,
   entryID: string,
   threadID: string,
 ): Promise<?RawMessageInfo> {
   const viewerID = viewer.id;
   const query = SQL`
     SELECT m.id, m.thread AS threadID, m.content, m.time, m.type, m.creation,
       m.user AS creatorID, m.target_message AS targetMessageID,
       NULL AS subthread_permissions, up.id AS uploadID, up.type AS uploadType,
       up.secret AS uploadSecret, up.extra AS uploadExtra
     FROM messages m
     LEFT JOIN uploads up ON up.container = m.id
     LEFT JOIN memberships mm ON mm.thread = m.thread AND mm.user = ${viewerID}
     WHERE m.user = ${viewerID} AND m.thread = ${threadID} AND
       m.type = ${messageType} AND
       JSON_EXTRACT(m.content, ${entryIDExtractString}) = ${entryID} AND
       JSON_EXTRACT(mm.permissions, ${visibleExtractString}) IS TRUE
   `;
 
   const [result] = await dbQuery(query);
   if (result.length === 0) {
     return null;
   }
   const derivedMessages = await fetchDerivedMessages(result, viewer);
   return rawMessageInfoFromRows(result, viewer, derivedMessages);
 }
 
 async function fetchMessageRowsByIDs(messageIDs: $ReadOnlyArray<string>) {
   const query = SQL`
     SELECT m.id, m.thread AS threadID, m.content, m.time, m.type, m.creation,
       m.user AS creatorID, m.target_message as targetMessageID,
       stm.permissions AS subthread_permissions, up.id AS uploadID,
       up.type AS uploadType, up.secret AS uploadSecret, up.extra AS uploadExtra
     FROM messages m
     LEFT JOIN uploads up ON up.container = m.id
     LEFT JOIN memberships stm ON m.type = ${messageTypes.CREATE_SUB_THREAD}
       AND stm.thread = m.content AND stm.user = m.user
     WHERE m.id IN (${messageIDs})
   `;
   const [result] = await dbQuery(query);
   return result;
 }
 
 async function fetchPinnedMessageInfos(
   viewer: Viewer,
   request: FetchPinnedMessagesRequest,
 ): Promise<FetchPinnedMessagesResult> {
   // The only message types that can be pinned are 0, 14, and 15
   // (text, images, and multimedia), so we don't need to worry about
   // an admin pinning a message about creating a secret subchannel. This is
   // why we don't check subthread permissions (as opposed to other queries).
   const messageRowsQuery = SQL`
     SELECT m.id, m.thread AS threadID, m.content, m.time, m.type, m.creation,
       m.user AS creatorID, m.target_message as targetMessageID,
       NULL AS subthread_permissions, u.id AS uploadID,
       u.type AS uploadType, u.secret AS uploadSecret, u.extra AS uploadExtra
     FROM messages m
     LEFT JOIN uploads u ON u.container = m.id
     LEFT JOIN memberships mm ON mm.thread = m.thread AND mm.user = ${viewer.id}
     WHERE m.thread = ${request.threadID} 
       AND m.pinned = 1
       AND JSON_EXTRACT(mm.permissions, ${visibleExtractString}) IS TRUE
     ORDER BY m.pin_time DESC
   `;
   const [messageRows] = await dbQuery(messageRowsQuery);
   if (messageRows.length === 0) {
     return { pinnedMessages: [] };
   }
 
   const pinnedAndRelatedMessages =
     await rawMessageInfoForRowsAndRelatedMessages(messageRows, viewer);
 
   const shimmedPinnedRawMessageInfos = shimUnsupportedRawMessageInfos(
     pinnedAndRelatedMessages,
     viewer.platformDetails,
   );
 
   return {
     pinnedMessages: shimmedPinnedRawMessageInfos,
   };
 }
 
 async function fetchDerivedMessages(
   rows: $ReadOnlyArray<Object>,
   viewer?: Viewer,
 ): Promise<
   $ReadOnlyMap<string, RawComposableMessageInfo | RawRobotextMessageInfo>,
 > {
   const requiredIDs = new Set<string>();
   for (const row of rows) {
     // parseDerivedMessages should be defined for SIDEBAR_SOURCE and TOGGLE_PIN
     const { parseDerivedMessages } = messageSpecs[row.type];
     parseDerivedMessages?.(row, requiredIDs);
   }
 
   const messagesByID = new Map<
     string,
     RawComposableMessageInfo | RawRobotextMessageInfo,
   >();
   if (requiredIDs.size === 0) {
     return messagesByID;
   }
 
   const [result, edits] = await Promise.all([
     fetchMessageRowsByIDs([...requiredIDs]),
     fetchLatestEditMessageContentByIDs([...requiredIDs]),
   ]);
   const messages = await parseMessageSQLResult(result, new Map(), viewer);
 
   for (const message of messages) {
     let { rawMessageInfo } = message;
 
     if (rawMessageInfo.type === messageTypes.SIDEBAR_SOURCE) {
       invariant(
         !isInvalidSidebarSource(rawMessageInfo),
         'SIDEBAR_SOURCE should not point to a ' +
           'SIDEBAR_SOURCE, REACTION, EDIT_MESSAGE or TOGGLE_PIN',
       );
     }
     if (rawMessageInfo.type === messageTypes.TOGGLE_PIN) {
       invariant(
         !isInvalidPinSource(rawMessageInfo),
         'TOGGLE_PIN should not point to a non-composable message type',
       );
     }
 
     if (rawMessageInfo.id) {
       const editedContent = edits.get(rawMessageInfo.id);
       if (editedContent && rawMessageInfo.type === messageTypes.TEXT) {
         rawMessageInfo = {
           ...rawMessageInfo,
           text: editedContent.text,
         };
       }
       invariant(rawMessageInfo.id, 'rawMessageInfo.id should not be null');
       // Flow doesn't refine the types if we don't explicitly invariant on
       // or check against all of the unexpected message types, and that list
       // can both get long and generally defeats the purpose of moving the
       // logic into message specs to have one 'single source of truth'.
       // $FlowFixMe
       messagesByID.set(rawMessageInfo.id, rawMessageInfo);
     }
   }
   return messagesByID;
 }
 
 async function fetchMessageInfoByID(
   viewer?: Viewer,
   messageID: string,
 ): Promise<?RawMessageInfo> {
   const result = await fetchMessageRowsByIDs([messageID]);
   if (result.length === 0) {
     return null;
   }
   const derivedMessages = await fetchDerivedMessages(result, viewer);
   return rawMessageInfoFromRows(result, viewer, derivedMessages);
 }
 
 async function fetchThreadMessagesCount(threadID: string): Promise<number> {
   const query = SQL`
     SELECT COUNT(*) AS count
     FROM messages
     WHERE thread = ${threadID}
   `;
   const [result] = await dbQuery(query);
   return result[0].count;
 }
 
 async function fetchLatestEditMessageContentByIDs(
   messageIDs: $ReadOnlyArray<string>,
 ): Promise<$ReadOnlyMap<string, EditMessageContent>> {
   const latestEditedMessageQuery = SQL`
     SELECT m.id, (
       SELECT m2.content
       FROM messages m2
       WHERE m.id = m2.target_message
         AND m.thread = m2.thread
         AND m2.type = ${messageTypes.EDIT_MESSAGE}
       ORDER BY time DESC, id DESC
       LIMIT 1
     ) content
     FROM messages m
     WHERE m.id IN(${messageIDs})
   `;
 
   const [result] = await dbQuery(latestEditedMessageQuery);
   const latestContentByID = new Map();
   for (const row of result) {
     if (!row.content) {
       continue;
     }
     const content = JSON.parse(row.content);
     latestContentByID.set(row.id.toString(), content);
   }
 
   return latestContentByID;
 }
 
 async function fetchLatestEditMessageContentByID(
   messageID: string,
 ): Promise<?EditMessageContent> {
   const result = await fetchLatestEditMessageContentByIDs([messageID]);
   const content = result.get(messageID);
   return content;
 }
 
 async function fetchRelatedMessages(
   viewer?: Viewer,
   messages: $ReadOnlyMap<
     string,
     RawComposableMessageInfo | RawRobotextMessageInfo,
   >,
 ): Promise<$ReadOnlyArray<RawMessageInfo>> {
   if (messages.size === 0) {
     return [];
   }
   const originalMessageIDs = [...messages.keys()];
 
   const query = SQL`
     SELECT m.id, m.thread AS threadID, m.content, m.time, m.type, m.creation,
       m.user AS creatorID, m.target_message as targetMessageID,
       stm.permissions AS subthread_permissions, up.id AS uploadID,
       up.type AS uploadType, up.secret AS uploadSecret, up.extra AS uploadExtra
     FROM messages m
     LEFT JOIN uploads up ON up.container = m.id
     LEFT JOIN memberships stm ON m.type = ${messageTypes.CREATE_SUB_THREAD}
       AND stm.thread = m.content AND stm.user = m.user
     WHERE m.target_message IN (${originalMessageIDs})
       AND (
         m.type = ${messageTypes.SIDEBAR_SOURCE}
         OR m.type = ${messageTypes.REACTION}
         OR m.type = ${messageTypes.TOGGLE_PIN}
       )
     UNION SELECT m.id, m.thread AS threadID, m.content, m.time, m.type, 
       m.creation, m.user AS creatorID, m.target_message as targetMessageID,
       stm.permissions AS subthread_permissions, up.id AS uploadID,
       up.type AS uploadType, up.secret AS uploadSecret, up.extra AS uploadExtra
     FROM messages m2
     INNER JOIN messages m ON m.id = (
       SELECT m3.id FROM messages m3
       WHERE m3.target_message = m2.id
         AND m3.thread = m2.thread
         AND m3.type = ${messageTypes.EDIT_MESSAGE}
       ORDER BY time DESC, id DESC
       LIMIT 1
     )
     LEFT JOIN uploads up ON up.container = m2.id
     LEFT JOIN memberships stm ON m2.type = ${messageTypes.CREATE_SUB_THREAD}
       AND stm.thread = m2.content AND stm.user = m2.user
     WHERE m2.id IN (${originalMessageIDs})
   `;
 
   const [resultRows] = await dbQuery(query);
 
   if (resultRows.length === 0) {
     return [];
   }
   const SQLResult = await parseMessageSQLResult(resultRows, messages, viewer);
   return SQLResult.map(item => item.rawMessageInfo);
 }
 
 async function rawMessageInfoForRowsAndRelatedMessages(
   rows: $ReadOnlyArray<Object>,
   viewer?: Viewer,
 ): Promise<$ReadOnlyArray<RawMessageInfo>> {
   const parsedResults = await parseMessageSQLResult(rows, new Map(), viewer);
   const rawMessageInfoMap = new Map<
     string,
     RawComposableMessageInfo | RawRobotextMessageInfo,
   >();
   for (const message of parsedResults) {
     const { rawMessageInfo } = message;
     if (isUnableToBeRenderedIndependently(rawMessageInfo)) {
       continue;
     }
     invariant(rawMessageInfo.id, 'rawMessageInfo.id should not be null');
     // Flow fails to refine types correctly since
     // isUnableToBeRenderedIndependently introspects into a message spec
     // instead of directly checking message types. We use "continue" to avoid
     // invalid messages, but Flow doesn't recognize this. The
     // alternative is to check against every message type, but that defeats
     // the purpose of a 'single source of truth.'
     // $FlowFixMe
     rawMessageInfoMap.set(rawMessageInfo.id, rawMessageInfo);
   }
 
   const rawMessageInfos = parsedResults.map(item => item.rawMessageInfo);
   const rawRelatedMessageInfos = await fetchRelatedMessages(
     viewer,
     rawMessageInfoMap,
   );
 
   return [...rawMessageInfos, ...rawRelatedMessageInfos];
 }
 
 const searchMessagesPageSize = defaultNumberPerThread + 1;
 
 async function searchMessagesInSingleChat(
   inputQuery: string,
   threadID: string,
   viewer?: Viewer,
   cursor?: string,
 ): Promise<SearchMessagesResponse> {
   if (inputQuery === '') {
     console.warn('received empty search query');
     return { messages: [], endReached: true };
   }
   const pattern = processQueryForSearch(inputQuery);
 
   if (pattern === '') {
     return {
       endReached: true,
       messages: [],
     };
   }
 
   const query = SQL`
     SELECT m.id, m.thread AS threadID, m.content, m.time, m.type, m.creation,
     m.user AS creatorID, m.target_message as targetMessageID,
     stm.permissions AS subthread_permissions, up.id AS uploadID,
     up.type AS uploadType, up.secret AS uploadSecret, up.extra AS uploadExtra
     FROM message_search s
     LEFT JOIN messages m ON m.id = s.original_message_id
     LEFT JOIN memberships stm ON m.type = ${messageTypes.CREATE_SUB_THREAD}
       AND stm.thread = m.content AND stm.user = m.user
     LEFT JOIN uploads up ON up.container = m.id
     LEFT JOIN messages m2 ON m2.target_message = m.id 
       AND m2.type = ${messageTypes.SIDEBAR_SOURCE} AND m2.thread = ${threadID}
     WHERE MATCH(s.processed_content) AGAINST(${pattern} IN BOOLEAN MODE)
       AND (m.thread = ${threadID} OR m2.id IS NOT NULL)
   `;
 
   if (cursor) {
     query.append(SQL`AND m.id < ${cursor} `);
   }
   query.append(SQL`   
     ORDER BY m.time DESC, m.id DESC
     LIMIT ${searchMessagesPageSize}
   `);
 
   const [results] = await dbQuery(query);
   if (results.length === 0) {
     return { messages: [], endReached: true };
   }
 
   const endReached = results.length < searchMessagesPageSize;
 
   const resultsPage = endReached ? results : results.slice(0, -1);
 
   const rawMessageInfos = await rawMessageInfoForRowsAndRelatedMessages(
     resultsPage,
     viewer,
   );
 
   return {
     messages: shimUnsupportedRawMessageInfos(
       rawMessageInfos,
       viewer?.platformDetails,
     ),
     endReached: endReached,
   };
 }
 
 export {
   fetchCollapsableNotifs,
   fetchMessageInfos,
   fetchMessageInfosSince,
   getMessageFetchResultFromRedisMessages,
   fetchMessageInfoForLocalID,
   fetchMessageInfoForEntryAction,
   fetchMessageInfoByID,
   fetchThreadMessagesCount,
   fetchLatestEditMessageContentByID,
   fetchPinnedMessageInfos,
   searchMessagesInSingleChat,
 };
diff --git a/keyserver/src/fetchers/role-fetchers.js b/keyserver/src/fetchers/role-fetchers.js
index 537f2c90c..ae496d091 100644
--- a/keyserver/src/fetchers/role-fetchers.js
+++ b/keyserver/src/fetchers/role-fetchers.js
@@ -1,29 +1,29 @@
 // @flow
 
 import { specialRoles } from 'lib/permissions/special-roles.js';
 import type { RoleInfo } from 'lib/types/thread-types.js';
 
 import { dbQuery, SQL } from '../database/database.js';
 
 async function fetchRoles(threadID: string): Promise<RoleInfo[]> {
   const query = SQL`
     SELECT id, name, permissions, 
       special_role = ${specialRoles.DEFAULT_ROLE} AS is_default
     FROM roles
     WHERE thread = ${threadID}
   `;
   const [result] = await dbQuery(query);
 
-  const roles = [];
+  const roles: Array<RoleInfo> = [];
   for (const row of result) {
     roles.push({
       id: row.id.toString(),
       name: row.name,
       permissions: JSON.parse(row.permissions),
       isDefault: Boolean(row.is_default),
     });
   }
   return roles;
 }
 
 export { fetchRoles };
diff --git a/keyserver/src/fetchers/thread-fetchers.js b/keyserver/src/fetchers/thread-fetchers.js
index c84d98bc5..a8495986a 100644
--- a/keyserver/src/fetchers/thread-fetchers.js
+++ b/keyserver/src/fetchers/thread-fetchers.js
@@ -1,414 +1,415 @@
 // @flow
 
 import invariant from 'invariant';
 
 import { specialRoles } from 'lib/permissions/special-roles.js';
 import { getAllThreadPermissions } from 'lib/permissions/thread-permissions.js';
 import {
   rawThreadInfoFromServerThreadInfo,
   getContainingThreadID,
   getCommunity,
 } from 'lib/shared/thread-utils.js';
 import { hasMinCodeVersion } from 'lib/shared/version-utils.js';
 import type { AvatarDBContent, ClientAvatar } from 'lib/types/avatar-types.js';
 import type { RawMessageInfo, MessageInfo } from 'lib/types/message-types.js';
 import { threadTypes, type ThreadType } from 'lib/types/thread-types-enum.js';
 import {
   type RawThreadInfos,
   type ServerThreadInfo,
+  type RawThreadInfo,
 } from 'lib/types/thread-types.js';
 import { ServerError } from 'lib/utils/errors.js';
 
 import { getUploadURL, makeUploadURI } from './upload-fetchers.js';
 import { dbQuery, SQL, mergeAndConditions } from '../database/database.js';
 import type { SQLStatementType } from '../database/types.js';
 import type { Viewer } from '../session/viewer.js';
 
 type FetchThreadInfosFilter = $Shape<{
   +accessibleToUserID: string,
   +threadID: string,
   +threadIDs: $ReadOnlySet<string>,
   +parentThreadID: string,
   +sourceMessageID: string,
 }>;
 function constructWhereClause(
   filter: FetchThreadInfosFilter,
 ): SQLStatementType {
   const fromTable = filter.accessibleToUserID ? 'memberships' : 'threads';
 
   const conditions = [];
 
   if (filter.accessibleToUserID) {
     conditions.push(
       SQL`mm.user = ${filter.accessibleToUserID} AND mm.role > -1`,
     );
   }
 
   if (filter.threadID && fromTable === 'memberships') {
     conditions.push(SQL`mm.thread = ${filter.threadID}`);
   } else if (filter.threadID) {
     conditions.push(SQL`t.id = ${filter.threadID}`);
   }
 
   if (filter.threadIDs && fromTable === 'memberships') {
     conditions.push(SQL`mm.thread IN (${[...filter.threadIDs]})`);
   } else if (filter.threadIDs) {
     conditions.push(SQL`t.id IN (${[...filter.threadIDs]})`);
   }
 
   if (filter.parentThreadID) {
     conditions.push(SQL`t.parent_thread_id = ${filter.parentThreadID}`);
   }
 
   if (filter.sourceMessageID) {
     conditions.push(SQL`t.source_message = ${filter.sourceMessageID}`);
   }
 
   if (conditions.length === 0) {
     return SQL``;
   }
 
   const clause = mergeAndConditions(conditions);
   return SQL`WHERE `.append(clause);
 }
 
 type FetchServerThreadInfosResult = {
   +threadInfos: { +[id: string]: ServerThreadInfo },
 };
 
 async function fetchServerThreadInfos(
   filter?: FetchThreadInfosFilter,
 ): Promise<FetchServerThreadInfosResult> {
   if (filter?.threadIDs?.size === 0) {
     return { threadInfos: {} };
   }
 
   let primaryFetchClause;
   if (filter?.accessibleToUserID) {
     primaryFetchClause = SQL`
       FROM memberships mm
       LEFT JOIN threads t ON t.id = mm.thread
     `;
   } else {
     primaryFetchClause = SQL`
       FROM threads t
     `;
   }
 
   const whereClause = filter ? constructWhereClause(filter) : '';
 
   const rolesQuery = SQL`
     SELECT t.id, r.id AS role, r.name, r.permissions,
       r.special_role = ${specialRoles.DEFAULT_ROLE} AS is_default
   `
     .append(primaryFetchClause)
     .append(
       SQL`
       LEFT JOIN roles r ON r.thread = t.id
     `,
     )
     .append(whereClause);
 
   const threadsQuery = SQL`
     SELECT t.id, t.name, t.parent_thread_id, t.containing_thread_id,
       t.community, t.depth, t.color, t.description, t.type, t.creation_time,
       t.source_message, t.replies_count, t.avatar, t.pinned_count, m.user,
       m.role, m.permissions, m.subscription,
       m.last_read_message < m.last_message AS unread, m.sender,
       up.id AS upload_id, up.secret AS upload_secret, up.extra AS upload_extra
   `
     .append(primaryFetchClause)
     .append(
       SQL`
       LEFT JOIN memberships m ON m.thread = t.id AND m.role >= 0
       LEFT JOIN uploads up ON up.container = t.id
     `,
     )
     .append(whereClause)
     .append(SQL` ORDER BY m.user ASC`);
   const [[threadsResult], [rolesResult]] = await Promise.all([
     dbQuery(threadsQuery),
     dbQuery(rolesQuery),
   ]);
 
   const threadInfos = {};
   for (const threadsRow of threadsResult) {
     const threadID = threadsRow.id.toString();
     if (!threadInfos[threadID]) {
       threadInfos[threadID] = {
         id: threadID,
         type: threadsRow.type,
         name: threadsRow.name ? threadsRow.name : '',
         description: threadsRow.description ? threadsRow.description : '',
         color: threadsRow.color,
         creationTime: threadsRow.creation_time,
         parentThreadID: threadsRow.parent_thread_id
           ? threadsRow.parent_thread_id.toString()
           : null,
         containingThreadID: threadsRow.containing_thread_id
           ? threadsRow.containing_thread_id.toString()
           : null,
         depth: threadsRow.depth,
         community: threadsRow.community
           ? threadsRow.community.toString()
           : null,
         members: [],
         roles: {},
         repliesCount: threadsRow.replies_count,
         pinnedCount: threadsRow.pinned_count,
       };
       if (threadsRow.avatar) {
         const avatar: AvatarDBContent = JSON.parse(threadsRow.avatar);
         let clientAvatar: ?ClientAvatar;
         if (
           avatar &&
           avatar.type !== 'image' &&
           avatar.type !== 'encrypted_image'
         ) {
           clientAvatar = avatar;
         } else if (
           avatar &&
           (avatar.type === 'image' || avatar.type === 'encrypted_image') &&
           threadsRow.upload_id &&
           threadsRow.upload_secret
         ) {
           const uploadID = threadsRow.upload_id.toString();
           invariant(
             uploadID === avatar.uploadID,
             `uploadID of upload should match uploadID of image avatar`,
           );
           if (avatar.type === 'encrypted_image' && threadsRow.upload_extra) {
             const uploadExtra = JSON.parse(threadsRow.upload_extra);
             clientAvatar = {
               type: 'encrypted_image',
               blobURI: makeUploadURI(
                 uploadExtra.blobHash,
                 uploadID,
                 threadsRow.upload_secret,
               ),
               encryptionKey: uploadExtra.encryptionKey,
               thumbHash: uploadExtra.thumbHash,
             };
           } else {
             clientAvatar = {
               type: 'image',
               uri: getUploadURL(uploadID, threadsRow.upload_secret),
             };
           }
         }
 
         threadInfos[threadID] = {
           ...threadInfos[threadID],
           avatar: clientAvatar,
         };
       }
     }
     const sourceMessageID = threadsRow.source_message?.toString();
     if (sourceMessageID) {
       threadInfos[threadID].sourceMessageID = sourceMessageID;
     }
     if (threadsRow.user) {
       const userID = threadsRow.user.toString();
       const allPermissions = getAllThreadPermissions(
         JSON.parse(threadsRow.permissions),
         threadID,
       );
       threadInfos[threadID].members.push({
         id: userID,
         permissions: allPermissions,
         role: threadsRow.role ? threadsRow.role.toString() : null,
         subscription: JSON.parse(threadsRow.subscription),
         unread: threadsRow.role ? !!threadsRow.unread : null,
         isSender: !!threadsRow.sender,
       });
     }
   }
 
   for (const rolesRow of rolesResult) {
     const threadID = rolesRow.id.toString();
     if (!rolesRow.role) {
       continue;
     }
     const role = rolesRow.role.toString();
     if (!threadInfos[threadID].roles[role]) {
       threadInfos[threadID].roles[role] = {
         id: role,
         name: rolesRow.name,
         permissions: JSON.parse(rolesRow.permissions),
         isDefault: Boolean(rolesRow.is_default),
       };
     }
   }
 
   return { threadInfos };
 }
 
 type FetchThreadInfosResult = {
   +threadInfos: RawThreadInfos,
 };
 
 async function fetchThreadInfos(
   viewer: Viewer,
   inputFilter?: FetchThreadInfosFilter,
 ): Promise<FetchThreadInfosResult> {
   const filter = {
     accessibleToUserID: viewer.id,
     ...inputFilter,
   };
   const serverResult = await fetchServerThreadInfos(filter);
   return rawThreadInfosFromServerThreadInfos(viewer, serverResult);
 }
 
 function rawThreadInfosFromServerThreadInfos(
   viewer: Viewer,
   serverResult: FetchServerThreadInfosResult,
 ): FetchThreadInfosResult {
   const viewerID = viewer.id;
   const codeVersionBelow209 = !hasMinCodeVersion(viewer.platformDetails, {
     native: 209,
   });
   const codeVersionBelow213 = !hasMinCodeVersion(viewer.platformDetails, {
     native: 213,
   });
   const codeVersionBelow221 = !hasMinCodeVersion(viewer.platformDetails, {
     native: 221,
   });
   const codeVersionBelow283 = !hasMinCodeVersion(viewer.platformDetails, {
     native: 285,
   });
 
-  const threadInfos = {};
+  const threadInfos: { [string]: RawThreadInfo } = {};
   for (const threadID in serverResult.threadInfos) {
     const serverThreadInfo = serverResult.threadInfos[threadID];
     const threadInfo = rawThreadInfoFromServerThreadInfo(
       serverThreadInfo,
       viewerID,
       {
         filterThreadEditAvatarPermission: codeVersionBelow213,
         excludePinInfo: codeVersionBelow209,
         filterManageInviteLinksPermission: codeVersionBelow221,
         filterVoicedInAnnouncementChannelsPermission: codeVersionBelow283,
       },
     );
     if (threadInfo) {
       threadInfos[threadID] = threadInfo;
     }
   }
   return { threadInfos };
 }
 
 async function verifyThreadIDs(
   threadIDs: $ReadOnlyArray<string>,
 ): Promise<$ReadOnlyArray<string>> {
   if (threadIDs.length === 0) {
     return [];
   }
 
   const query = SQL`SELECT id FROM threads WHERE id IN (${threadIDs})`;
   const [result] = await dbQuery(query);
 
   const verified = [];
   for (const row of result) {
     verified.push(row.id.toString());
   }
   return verified;
 }
 
 async function verifyThreadID(threadID: string): Promise<boolean> {
   const result = await verifyThreadIDs([threadID]);
   return result.length !== 0;
 }
 
 type ThreadAncestry = {
   +containingThreadID: ?string,
   +community: ?string,
   +depth: number,
 };
 async function determineThreadAncestry(
   parentThreadID: ?string,
   threadType: ThreadType,
 ): Promise<ThreadAncestry> {
   if (!parentThreadID) {
     return { containingThreadID: null, community: null, depth: 0 };
   }
   const parentThreadInfos = await fetchServerThreadInfos({
     threadID: parentThreadID,
   });
   const parentThreadInfo = parentThreadInfos.threadInfos[parentThreadID];
   if (!parentThreadInfo) {
     throw new ServerError('invalid_parameters');
   }
   const containingThreadID = getContainingThreadID(
     parentThreadInfo,
     threadType,
   );
   const community = getCommunity(parentThreadInfo);
   const depth = parentThreadInfo.depth + 1;
   return { containingThreadID, community, depth };
 }
 
 function personalThreadQuery(
   firstMemberID: string,
   secondMemberID: string,
 ): SQLStatementType {
   return SQL`
     SELECT t.id 
     FROM threads t
     INNER JOIN memberships m1 
       ON m1.thread = t.id AND m1.user = ${firstMemberID}
     INNER JOIN memberships m2
       ON m2.thread = t.id AND m2.user = ${secondMemberID}
     WHERE t.type = ${threadTypes.PERSONAL}
       AND m1.role > 0
       AND m2.role > 0
   `;
 }
 
 async function fetchPersonalThreadID(
   viewerID: string,
   otherMemberID: string,
 ): Promise<?string> {
   const query = personalThreadQuery(viewerID, otherMemberID);
   const [threads] = await dbQuery(query);
   return threads[0]?.id.toString();
 }
 
 async function serverThreadInfoFromMessageInfo(
   message: RawMessageInfo | MessageInfo,
 ): Promise<?ServerThreadInfo> {
   const threadID = message.threadID;
   const threads = await fetchServerThreadInfos({ threadID });
   return threads.threadInfos[threadID];
 }
 
 async function fetchContainedThreadIDs(
   parentThreadID: string,
 ): Promise<Array<string>> {
   const query = SQL`
     WITH RECURSIVE thread_tree AS (
       SELECT id, containing_thread_id
       FROM threads
       WHERE id = ${parentThreadID}
       UNION ALL
       SELECT t.id, t.containing_thread_id
       FROM threads t
       JOIN thread_tree tt ON t.containing_thread_id = tt.id
     )
     SELECT id FROM thread_tree
   `;
   const [result] = await dbQuery(query);
   return result.map(row => row.id.toString());
 }
 
 export {
   fetchServerThreadInfos,
   fetchThreadInfos,
   rawThreadInfosFromServerThreadInfos,
   verifyThreadIDs,
   verifyThreadID,
   determineThreadAncestry,
   personalThreadQuery,
   fetchPersonalThreadID,
   serverThreadInfoFromMessageInfo,
   fetchContainedThreadIDs,
 };
diff --git a/keyserver/src/fetchers/user-fetchers.js b/keyserver/src/fetchers/user-fetchers.js
index 41f87a75a..34839dbb7 100644
--- a/keyserver/src/fetchers/user-fetchers.js
+++ b/keyserver/src/fetchers/user-fetchers.js
@@ -1,496 +1,496 @@
 // @flow
 
 import invariant from 'invariant';
 
 import {
   hasMinCodeVersion,
   FUTURE_CODE_VERSION,
 } from 'lib/shared/version-utils.js';
 import type { AvatarDBContent, ClientAvatar } from 'lib/types/avatar-types.js';
 import {
   undirectedStatus,
   directedStatus,
   userRelationshipStatus,
 } from 'lib/types/relationship-types.js';
 import { threadPermissions } from 'lib/types/thread-permission-types.js';
 import { communityThreadTypes } from 'lib/types/thread-types-enum.js';
 import type {
   UserInfos,
   CurrentUserInfo,
   LoggedInUserInfo,
   GlobalUserInfo,
 } from 'lib/types/user-types.js';
 import { ServerError } from 'lib/utils/errors.js';
 
 import { getUploadURL, makeUploadURI } from './upload-fetchers.js';
 import { dbQuery, SQL } from '../database/database.js';
 import type { Viewer } from '../session/viewer.js';
 
 async function fetchUserInfos(
   userIDs: $ReadOnlyArray<string>,
 ): Promise<{ [id: string]: GlobalUserInfo }> {
   if (userIDs.length <= 0) {
     return {};
   }
 
   const query = SQL`
     SELECT u.id, u.username, u.avatar,
       up.id AS upload_id, up.secret AS upload_secret, up.extra AS upload_extra
     FROM users u
     LEFT JOIN uploads up
       ON up.container = u.id
     WHERE u.id IN (${userIDs})
   `;
   const [result] = await dbQuery(query);
 
-  const userInfos = {};
+  const userInfos: { [id: string]: GlobalUserInfo } = {};
   for (const row of result) {
     const id = row.id.toString();
     const avatar: ?AvatarDBContent = row.avatar ? JSON.parse(row.avatar) : null;
 
     let clientAvatar: ?ClientAvatar;
     if (
       avatar &&
       avatar.type !== 'image' &&
       avatar.type !== 'encrypted_image'
     ) {
       clientAvatar = avatar;
     } else if (
       avatar &&
       (avatar.type === 'image' || avatar.type === 'encrypted_image') &&
       row.upload_id &&
       row.upload_secret
     ) {
       const uploadID = row.upload_id.toString();
       invariant(
         uploadID === avatar.uploadID,
         'uploadID of upload should match uploadID of image avatar',
       );
       if (avatar.type === 'encrypted_image' && row.upload_extra) {
         const uploadExtra = JSON.parse(row.upload_extra);
         clientAvatar = {
           type: 'encrypted_image',
           blobURI: makeUploadURI(
             uploadExtra.blobHash,
             uploadID,
             row.upload_secret,
           ),
           encryptionKey: uploadExtra.encryptionKey,
           thumbHash: uploadExtra.thumbHash,
         };
       } else {
         clientAvatar = {
           type: 'image',
           uri: getUploadURL(uploadID, row.upload_secret),
         };
       }
     }
 
     userInfos[id] = clientAvatar
       ? {
           id,
           username: row.username,
           avatar: clientAvatar,
         }
       : {
           id,
           username: row.username,
         };
   }
 
   for (const userID of userIDs) {
     if (!userInfos[userID]) {
       userInfos[userID] = {
         id: userID,
         username: null,
       };
     }
   }
 
   return userInfos;
 }
 
 async function fetchKnownUserInfos(
   viewer: Viewer,
   userIDs?: $ReadOnlyArray<string>,
 ): Promise<UserInfos> {
   if (!viewer.loggedIn) {
     return {};
   }
   if (userIDs && userIDs.length === 0) {
     return {};
   }
 
   const query = SQL`
     SELECT ru.user1, ru.user2, u.username, u.avatar, ru.status AS undirected_status,
       rd1.status AS user1_directed_status, rd2.status AS user2_directed_status,
       up1.id AS user1_upload_id, up1.secret AS user1_upload_secret, up1.extra AS user1_upload_extra,
       up2.id AS user2_upload_id, up2.secret AS user2_upload_secret, up2.extra AS user2_upload_extra
     FROM relationships_undirected ru
     LEFT JOIN relationships_directed rd1
       ON rd1.user1 = ru.user1 AND rd1.user2 = ru.user2
     LEFT JOIN relationships_directed rd2
       ON rd2.user1 = ru.user2 AND rd2.user2 = ru.user1
     LEFT JOIN users u
       ON u.id != ${viewer.userID} AND (u.id = ru.user1 OR u.id = ru.user2)
     LEFT JOIN uploads up1
       ON up1.container != ${viewer.userID} AND up1.container = ru.user1
     LEFT JOIN uploads up2
       ON up2.container != ${viewer.userID} AND up2.container = ru.user2
   `;
   if (userIDs) {
     query.append(SQL`
       WHERE (ru.user1 = ${viewer.userID} AND ru.user2 IN (${userIDs})) OR
         (ru.user1 IN (${userIDs}) AND ru.user2 = ${viewer.userID})
     `);
   } else {
     query.append(SQL`
       WHERE ru.user1 = ${viewer.userID} OR ru.user2 = ${viewer.userID}
     `);
   }
   query.append(SQL`
     UNION SELECT u.id AS user1, NULL AS user2, u.username, u.avatar,
       CAST(NULL AS UNSIGNED) AS undirected_status,
       CAST(NULL AS UNSIGNED) AS user1_directed_status,
       CAST(NULL AS UNSIGNED) AS user2_directed_status,
       up.id AS user1_upload_id, up.secret AS user1_upload_secret, up.extra AS user1_upload_extra,
       NULL AS user2_upload_id, NULL AS user2_upload_secret, NULL AS user2_upload_extra
     FROM users u
     LEFT JOIN uploads up
       ON up.container = u.id
     WHERE u.id = ${viewer.userID}
   `);
   const [result] = await dbQuery(query);
 
   const userInfos = {};
   for (const row of result) {
     const user1 = row.user1.toString();
     const user2 = row.user2 ? row.user2.toString() : null;
     const id = user1 === viewer.userID && user2 ? user2 : user1;
 
     const avatar: ?AvatarDBContent = row.avatar ? JSON.parse(row.avatar) : null;
 
     let clientAvatar: ?ClientAvatar;
     if (
       avatar &&
       avatar.type !== 'image' &&
       avatar.type !== 'encrypted_image'
     ) {
       clientAvatar = avatar;
     } else if (
       avatar &&
       (avatar.type === 'image' || avatar.type === 'encrypted_image') &&
       row.user1_upload_id &&
       row.user1_upload_secret
     ) {
       const uploadID = row.user1_upload_id.toString();
       invariant(
         uploadID === avatar.uploadID,
         'uploadID of upload should match uploadID of image avatar',
       );
       if (avatar.type === 'encrypted_image' && row.user1_upload_extra) {
         const uploadExtra = JSON.parse(row.user1_upload_extra);
         clientAvatar = {
           type: 'encrypted_image',
           blobURI: makeUploadURI(
             uploadExtra.blobHash,
             uploadID,
             row.user1_upload_secret,
           ),
           encryptionKey: uploadExtra.encryptionKey,
           thumbHash: uploadExtra.thumbHash,
         };
       } else {
         clientAvatar = {
           type: 'image',
           uri: getUploadURL(uploadID, row.user1_upload_secret),
         };
       }
     } else if (
       avatar &&
       (avatar.type === 'image' || avatar.type === 'encrypted_image') &&
       row.user2_upload_id &&
       row.user2_upload_secret
     ) {
       const uploadID = row.user2_upload_id.toString();
       invariant(
         uploadID === avatar.uploadID,
         'uploadID of upload should match uploadID of image avatar',
       );
       if (avatar.type === 'encrypted_image' && row.user2_upload_extra) {
         const uploadExtra = JSON.parse(row.user2_upload_extra);
         clientAvatar = {
           type: 'encrypted_image',
           blobURI: makeUploadURI(
             uploadExtra.blobHash,
             uploadID,
             row.user2_upload_secret,
           ),
           encryptionKey: uploadExtra.encryptionKey,
           thumbHash: uploadExtra.thumbHash,
         };
       } else {
         clientAvatar = {
           type: 'image',
           uri: getUploadURL(uploadID, row.user2_upload_secret),
         };
       }
     }
 
     const userInfo = clientAvatar
       ? {
           id,
           username: row.username,
           avatar: clientAvatar,
         }
       : {
           id,
           username: row.username,
         };
 
     if (!user2) {
       userInfos[id] = userInfo;
       continue;
     }
 
     let viewerDirectedStatus;
     let targetDirectedStatus;
     if (user1 === viewer.userID) {
       viewerDirectedStatus = row.user1_directed_status;
       targetDirectedStatus = row.user2_directed_status;
     } else {
       viewerDirectedStatus = row.user2_directed_status;
       targetDirectedStatus = row.user1_directed_status;
     }
 
     const viewerBlockedTarget = viewerDirectedStatus === directedStatus.BLOCKED;
     const targetBlockedViewer = targetDirectedStatus === directedStatus.BLOCKED;
     const friendshipExists = row.undirected_status === undirectedStatus.FRIEND;
     const viewerRequestedTargetFriendship =
       viewerDirectedStatus === directedStatus.PENDING_FRIEND;
     const targetRequestedViewerFriendship =
       targetDirectedStatus === directedStatus.PENDING_FRIEND;
 
     let relationshipStatus;
     if (viewerBlockedTarget && targetBlockedViewer) {
       relationshipStatus = userRelationshipStatus.BOTH_BLOCKED;
     } else if (targetBlockedViewer) {
       relationshipStatus = userRelationshipStatus.BLOCKED_VIEWER;
     } else if (viewerBlockedTarget) {
       relationshipStatus = userRelationshipStatus.BLOCKED_BY_VIEWER;
     } else if (friendshipExists) {
       relationshipStatus = userRelationshipStatus.FRIEND;
     } else if (targetRequestedViewerFriendship) {
       relationshipStatus = userRelationshipStatus.REQUEST_RECEIVED;
     } else if (viewerRequestedTargetFriendship) {
       relationshipStatus = userRelationshipStatus.REQUEST_SENT;
     }
 
     userInfos[id] = userInfo;
     if (relationshipStatus) {
       userInfos[id].relationshipStatus = relationshipStatus;
     }
 
     if (relationshipStatus && !row.username) {
       console.warn(
         `user ${viewer.userID} has ${relationshipStatus} relationship with ` +
           `anonymous user ${id}`,
       );
     }
   }
 
   return userInfos;
 }
 
 async function verifyUserIDs(
   userIDs: $ReadOnlyArray<string>,
 ): Promise<string[]> {
   if (userIDs.length === 0) {
     return [];
   }
   const query = SQL`SELECT id FROM users WHERE id IN (${userIDs})`;
   const [result] = await dbQuery(query);
   return result.map(row => row.id.toString());
 }
 
 async function verifyUserOrCookieIDs(
   ids: $ReadOnlyArray<string>,
 ): Promise<string[]> {
   if (ids.length === 0) {
     return [];
   }
   const query = SQL`
     SELECT id FROM users WHERE id IN (${ids})
     UNION SELECT id FROM cookies WHERE id IN (${ids})
   `;
   const [result] = await dbQuery(query);
   return result.map(row => row.id.toString());
 }
 
 async function fetchCurrentUserInfo(viewer: Viewer): Promise<CurrentUserInfo> {
   if (!viewer.loggedIn) {
     return ({ anonymous: true }: CurrentUserInfo);
   }
   const currentUserInfo = await fetchLoggedInUserInfo(viewer);
   return currentUserInfo;
 }
 
 async function fetchLoggedInUserInfo(
   viewer: Viewer,
 ): Promise<LoggedInUserInfo> {
   const userQuery = SQL`
     SELECT u.id, u.username, u.avatar,
       up.id AS upload_id, up.secret AS upload_secret, up.extra AS upload_extra
     FROM users u
     LEFT JOIN uploads up
       ON up.container = u.id
     WHERE u.id = ${viewer.userID}
   `;
 
   const settingsQuery = SQL`
     SELECT name, data
     FROM settings
     WHERE user = ${viewer.userID}
   `;
 
   const [[userResult], [settingsResult]] = await Promise.all([
     dbQuery(userQuery),
     dbQuery(settingsQuery),
   ]);
 
   const [userRow] = userResult;
   if (!userRow) {
     throw new ServerError('unknown_error');
   }
 
   const id = userRow.id.toString();
   const { username, upload_id, upload_secret, upload_extra } = userRow;
 
   let loggedInUserInfo: LoggedInUserInfo = {
     id,
     username,
   };
 
   const avatar: ?AvatarDBContent = userRow.avatar
     ? JSON.parse(userRow.avatar)
     : null;
 
   let clientAvatar: ?ClientAvatar;
   if (avatar && avatar.type !== 'image' && avatar.type !== 'encrypted_image') {
     clientAvatar = avatar;
   } else if (
     avatar &&
     (avatar.type === 'image' || avatar.type === 'encrypted_image') &&
     upload_id &&
     upload_secret
   ) {
     const uploadID = upload_id.toString();
     invariant(
       uploadID === avatar.uploadID,
       'uploadID of upload should match uploadID of image avatar',
     );
     if (avatar.type === 'encrypted_image' && upload_extra) {
       const uploadExtra = JSON.parse(upload_extra);
       clientAvatar = {
         type: 'encrypted_image',
         blobURI: makeUploadURI(uploadExtra.blobHash, uploadID, upload_secret),
         encryptionKey: uploadExtra.encryptionKey,
         thumbHash: uploadExtra.thumbHash,
       };
     } else {
       clientAvatar = {
         type: 'image',
         uri: getUploadURL(uploadID, upload_secret),
       };
     }
   }
 
   if (avatar) {
     loggedInUserInfo = { ...loggedInUserInfo, avatar: clientAvatar };
   }
 
   const featureGateSettings = !hasMinCodeVersion(viewer.platformDetails, {
     native: FUTURE_CODE_VERSION,
   });
 
   if (featureGateSettings) {
     return loggedInUserInfo;
   }
 
   const settings = settingsResult.reduce((prev, curr) => {
     prev[curr.name] = curr.data;
     return prev;
   }, {});
   loggedInUserInfo = { ...loggedInUserInfo, settings };
 
   return loggedInUserInfo;
 }
 
 async function fetchAllUserIDs(): Promise<string[]> {
   const query = SQL`SELECT id FROM users`;
   const [result] = await dbQuery(query);
   return result.map(row => row.id.toString());
 }
 
 async function fetchUsername(id: string): Promise<?string> {
   const query = SQL`SELECT username FROM users WHERE id = ${id}`;
   const [result] = await dbQuery(query);
   if (result.length === 0) {
     return null;
   }
   const row = result[0];
   return row.username;
 }
 
 async function fetchAllUsernames(): Promise<string[]> {
   const query = SQL`SELECT username FROM users`;
   const [result] = await dbQuery(query);
   return result.map(row => row.username);
 }
 
 async function fetchKeyserverAdminID(): Promise<?string> {
   const changeRoleExtractString = `$.${threadPermissions.CHANGE_ROLE}`;
   const query = SQL`
     SELECT m.user FROM memberships m
     INNER JOIN roles r ON m.role = r.id
     INNER JOIN threads t ON r.thread = t.id
     WHERE r.name = "Admins" AND 
       t.type IN (${communityThreadTypes}) AND 
       JSON_EXTRACT(r.permissions, ${changeRoleExtractString}) IS TRUE
   `;
   const [result] = await dbQuery(query);
   if (result.length === 0) {
     return null;
   }
   if (result.length > 1) {
     console.warn('more than one community admin found');
   }
 
   return result[0].user;
 }
 
 async function fetchUserIDForEthereumAddress(
   address: string,
 ): Promise<?string> {
   const query = SQL`
     SELECT id
     FROM users
     WHERE LCASE(ethereum_address) = LCASE(${address})
   `;
   const [result] = await dbQuery(query);
   return result.length === 0 ? null : result[0].id.toString();
 }
 
 export {
   fetchUserInfos,
   fetchLoggedInUserInfo,
   verifyUserIDs,
   verifyUserOrCookieIDs,
   fetchCurrentUserInfo,
   fetchAllUserIDs,
   fetchUsername,
   fetchAllUsernames,
   fetchKnownUserInfos,
   fetchKeyserverAdminID,
   fetchUserIDForEthereumAddress,
 };
diff --git a/keyserver/src/push/rescind.js b/keyserver/src/push/rescind.js
index 72206100e..85f3b23a2 100644
--- a/keyserver/src/push/rescind.js
+++ b/keyserver/src/push/rescind.js
@@ -1,353 +1,369 @@
 // @flow
 
 import apn from '@parse/node-apn';
+import type { ResponseFailure } from '@parse/node-apn';
+import type { FirebaseError } from 'firebase-admin';
 import invariant from 'invariant';
 
 import type { PlatformDetails } from 'lib/types/device-types.js';
 import { threadSubscriptions } from 'lib/types/subscription-types.js';
 import { threadPermissions } from 'lib/types/thread-permission-types.js';
 import { promiseAll } from 'lib/utils/promises.js';
 import { tID } from 'lib/utils/validation-utils.js';
 
 import {
   prepareEncryptedAndroidNotificationRescinds,
   prepareEncryptedIOSNotificationRescind,
 } from './crypto.js';
 import { getAPNsNotificationTopic } from './providers.js';
 import type {
   NotificationTargetDevice,
   TargetedAndroidNotification,
   TargetedAPNsNotification,
 } from './types.js';
-import { apnPush, fcmPush } from './utils.js';
+import {
+  apnPush,
+  fcmPush,
+  type APNPushResult,
+  type FCMPushResult,
+} from './utils.js';
 import createIDs from '../creators/id-creator.js';
 import { dbQuery, SQL } from '../database/database.js';
 import type { SQLStatementType } from '../database/types.js';
 import { validateOutput } from '../utils/validation-utils.js';
 
 type ParsedDelivery = {
   +platform: 'ios' | 'macos' | 'android',
   +codeVersion: ?number,
   +stateVersion: ?number,
   +notificationID: string,
   +deviceTokens: $ReadOnlyArray<string>,
 };
 
-type ParsedDeliveries = { +[id: string]: $ReadOnlyArray<ParsedDelivery> };
+type RescindDelivery = {
+  source: 'rescind',
+  rescindedID: string,
+  errors?:
+    | $ReadOnlyArray<FirebaseError | mixed>
+    | $ReadOnlyArray<ResponseFailure>,
+};
 
 async function rescindPushNotifs(
   notifCondition: SQLStatementType,
   inputCountCondition?: SQLStatementType,
 ) {
   const notificationExtractString = `$.${threadSubscriptions.home}`;
   const visPermissionExtractString = `$.${threadPermissions.VISIBLE}.value`;
   const fetchQuery = SQL`
     SELECT n.id, n.user, n.thread, n.message, n.delivery, n.collapse_key, COUNT(
   `;
   fetchQuery.append(inputCountCondition ? inputCountCondition : SQL`m.thread`);
   fetchQuery.append(SQL`
       ) AS unread_count
     FROM notifications n
     LEFT JOIN memberships m ON m.user = n.user 
       AND m.last_message > m.last_read_message 
       AND m.role > 0 
       AND JSON_EXTRACT(subscription, ${notificationExtractString})
       AND JSON_EXTRACT(permissions, ${visPermissionExtractString})
     WHERE n.rescinded = 0 AND
   `);
   fetchQuery.append(notifCondition);
   fetchQuery.append(SQL` GROUP BY n.id, m.user`);
   const [fetchResult] = await dbQuery(fetchQuery);
 
   const allDeviceTokens = new Set();
-  const parsedDeliveries: ParsedDeliveries = {};
+  const parsedDeliveries: { [string]: $ReadOnlyArray<ParsedDelivery> } = {};
 
   for (const row of fetchResult) {
     const rawDelivery = JSON.parse(row.delivery);
     const deliveries = Array.isArray(rawDelivery) ? rawDelivery : [rawDelivery];
     const id = row.id.toString();
 
     const rowParsedDeliveries = [];
 
     for (const delivery of deliveries) {
       if (
         delivery.iosID ||
         delivery.deviceType === 'ios' ||
         delivery.deviceType === 'macos'
       ) {
         const deviceTokens = delivery.iosDeviceTokens ?? delivery.deviceTokens;
         rowParsedDeliveries.push({
           notificationID: delivery.iosID,
           codeVersion: delivery.codeVersion,
           stateVersion: delivery.stateVersion,
           platform: delivery.deviceType ?? 'ios',
           deviceTokens,
         });
         deviceTokens.forEach(deviceToken => allDeviceTokens.add(deviceToken));
       } else if (delivery.androidID || delivery.deviceType === 'android') {
         const deviceTokens =
           delivery.androidDeviceTokens ?? delivery.deviceTokens;
         rowParsedDeliveries.push({
           notificationID: row.collapse_key ? row.collapse_key : id,
           codeVersion: delivery.codeVersion,
           stateVersion: delivery.stateVersion,
           platform: 'android',
           deviceTokens,
         });
         deviceTokens.forEach(deviceToken => allDeviceTokens.add(deviceToken));
       }
     }
     parsedDeliveries[id] = rowParsedDeliveries;
   }
   const deviceTokenToCookieID = await getDeviceTokenToCookieID(allDeviceTokens);
 
-  const deliveryPromises = {};
+  const deliveryPromises: {
+    [string]: Promise<APNPushResult> | Promise<FCMPushResult>,
+  } = {};
   const notifInfo = {};
   const rescindedIDs = [];
 
   for (const row of fetchResult) {
     const id = row.id.toString();
     const threadID = row.thread.toString();
 
     notifInfo[id] = {
       userID: row.user.toString(),
       threadID,
       messageID: row.message.toString(),
     };
 
     for (const delivery of parsedDeliveries[id]) {
       let platformDetails: PlatformDetails = { platform: delivery.platform };
       if (delivery.codeVersion) {
         platformDetails = {
           ...platformDetails,
           codeVersion: delivery.codeVersion,
         };
       }
       if (delivery.stateVersion) {
         platformDetails = {
           ...platformDetails,
           stateVersion: delivery.stateVersion,
         };
       }
 
       if (delivery.platform === 'ios') {
         const devices = delivery.deviceTokens.map(deviceToken => ({
           deviceToken,
           cookieID: deviceTokenToCookieID[deviceToken],
         }));
         const deliveryPromise = (async () => {
           const targetedNotifications = await prepareIOSNotification(
             delivery.notificationID,
             row.unread_count,
             threadID,
             platformDetails,
             devices,
           );
           return await apnPush({
             targetedNotifications,
             platformDetails: {
               platform: 'ios',
               codeVersion: delivery.codeVersion,
             },
           });
         })();
         deliveryPromises[id] = deliveryPromise;
       } else if (delivery.platform === 'android') {
         const devices = delivery.deviceTokens.map(deviceToken => ({
           deviceToken,
           cookieID: deviceTokenToCookieID[deviceToken],
         }));
         const deliveryPromise = (async () => {
           const targetedNotifications = await prepareAndroidNotification(
             delivery.notificationID,
             row.unread_count,
             threadID,
             platformDetails,
             devices,
           );
           return await fcmPush({
             targetedNotifications,
             codeVersion: delivery.codeVersion,
           });
         })();
         deliveryPromises[id] = deliveryPromise;
       }
     }
     rescindedIDs.push(id);
   }
 
   const numRescinds = Object.keys(deliveryPromises).length;
   const promises = [promiseAll(deliveryPromises)];
   if (numRescinds > 0) {
     promises.push(createIDs('notifications', numRescinds));
   }
   if (rescindedIDs.length > 0) {
     const rescindQuery = SQL`
       UPDATE notifications SET rescinded = 1 WHERE id IN (${rescindedIDs})
     `;
     promises.push(dbQuery(rescindQuery));
   }
 
   const [deliveryResults, dbIDs] = await Promise.all(promises);
   const newNotifRows = [];
   if (numRescinds > 0) {
     invariant(dbIDs, 'dbIDs should be set');
     for (const rescindedID in deliveryResults) {
-      const delivery = {};
-      delivery.source = 'rescind';
-      delivery.rescindedID = rescindedID;
+      const delivery: RescindDelivery = {
+        source: 'rescind',
+        rescindedID,
+      };
       const { errors } = deliveryResults[rescindedID];
       if (errors) {
         delivery.errors = errors;
       }
       const dbID = dbIDs.shift();
       const { userID, threadID, messageID } = notifInfo[rescindedID];
       newNotifRows.push([
         dbID,
         userID,
         threadID,
         messageID,
         null,
         JSON.stringify([delivery]),
         1,
       ]);
     }
   }
   if (newNotifRows.length > 0) {
     const insertQuery = SQL`
       INSERT INTO notifications
         (id, user, thread, message, collapse_key, delivery, rescinded)
       VALUES ${newNotifRows}
     `;
     await dbQuery(insertQuery);
   }
 }
 
 async function getDeviceTokenToCookieID(
   deviceTokens: Set<string>,
 ): Promise<{ +[string]: string }> {
   if (deviceTokens.size === 0) {
     return {};
   }
   const deviceTokenToCookieID = {};
   const fetchCookiesQuery = SQL`
     SELECT id, device_token FROM cookies 
     WHERE device_token IN (${[...deviceTokens]})
   `;
   const [fetchResult] = await dbQuery(fetchCookiesQuery);
   for (const row of fetchResult) {
     deviceTokenToCookieID[row.device_token.toString()] = row.id.toString();
   }
   return deviceTokenToCookieID;
 }
 
 async function conditionallyEncryptNotification<T>(
   notification: T,
   codeVersion: ?number,
   devices: $ReadOnlyArray<NotificationTargetDevice>,
   encryptCallback: (
     devices: $ReadOnlyArray<NotificationTargetDevice>,
     notification: T,
     codeVersion?: ?number,
   ) => Promise<
     $ReadOnlyArray<{
       +notification: T,
       +cookieID: string,
       +deviceToken: string,
       +encryptionOrder?: number,
     }>,
   >,
 ): Promise<$ReadOnlyArray<{ +deviceToken: string, +notification: T }>> {
   const shouldBeEncrypted = codeVersion && codeVersion >= 233;
   if (!shouldBeEncrypted) {
     return devices.map(({ deviceToken }) => ({
       notification,
       deviceToken,
     }));
   }
   const notifications = await encryptCallback(
     devices,
     notification,
     codeVersion,
   );
   return notifications.map(({ deviceToken, notification: notif }) => ({
     deviceToken,
     notification: notif,
   }));
 }
 
 async function prepareIOSNotification(
   iosID: string,
   unreadCount: number,
   threadID: string,
   platformDetails: PlatformDetails,
   devices: $ReadOnlyArray<NotificationTargetDevice>,
 ): Promise<$ReadOnlyArray<TargetedAPNsNotification>> {
   threadID = validateOutput(platformDetails, tID, threadID);
   const { codeVersion } = platformDetails;
 
   const notification = new apn.Notification();
   notification.topic = getAPNsNotificationTopic({
     platform: 'ios',
     codeVersion,
   });
 
   if (codeVersion && codeVersion > 198) {
     notification.mutableContent = true;
     notification.pushType = 'alert';
     notification.badge = unreadCount;
   } else {
     notification.priority = 5;
     notification.contentAvailable = true;
     notification.pushType = 'background';
   }
   notification.payload =
     codeVersion && codeVersion > 135
       ? {
           backgroundNotifType: 'CLEAR',
           notificationId: iosID,
           setUnreadStatus: true,
           threadID,
         }
       : {
           managedAps: {
             action: 'CLEAR',
             notificationId: iosID,
           },
         };
   return await conditionallyEncryptNotification(
     notification,
     codeVersion,
     devices,
     prepareEncryptedIOSNotificationRescind,
   );
 }
 
 async function prepareAndroidNotification(
   notifID: string,
   unreadCount: number,
   threadID: string,
   platformDetails: PlatformDetails,
   devices: $ReadOnlyArray<NotificationTargetDevice>,
 ): Promise<$ReadOnlyArray<TargetedAndroidNotification>> {
   threadID = validateOutput(platformDetails, tID, threadID);
   const { codeVersion } = platformDetails;
 
   const notification = {
     data: {
       badge: unreadCount.toString(),
       rescind: 'true',
       rescindID: notifID,
       setUnreadStatus: 'true',
       threadID,
     },
   };
   return await conditionallyEncryptNotification(
     notification,
     codeVersion,
     devices,
     prepareEncryptedAndroidNotificationRescinds,
   );
 }
 
 export { rescindPushNotifs };
diff --git a/keyserver/src/push/send.js b/keyserver/src/push/send.js
index 55ce52fcd..c811761fd 100644
--- a/keyserver/src/push/send.js
+++ b/keyserver/src/push/send.js
@@ -1,1725 +1,1727 @@
 // @flow
 
 import apn from '@parse/node-apn';
 import type { ResponseFailure } from '@parse/node-apn';
 import invariant from 'invariant';
 import _cloneDeep from 'lodash/fp/cloneDeep.js';
 import _flow from 'lodash/fp/flow.js';
 import _groupBy from 'lodash/fp/groupBy.js';
 import _mapValues from 'lodash/fp/mapValues.js';
 import _pickBy from 'lodash/fp/pickBy.js';
 import t from 'tcomb';
 import uuidv4 from 'uuid/v4.js';
 
 import { oldValidUsernameRegex } from 'lib/shared/account-utils.js';
 import { isUserMentioned } from 'lib/shared/mention-utils.js';
 import {
   createMessageInfo,
   sortMessageInfoList,
   shimUnsupportedRawMessageInfos,
 } from 'lib/shared/message-utils.js';
 import { messageSpecs } from 'lib/shared/messages/message-specs.js';
 import { notifTextsForMessageInfo } from 'lib/shared/notif-utils.js';
 import { isStaff } from 'lib/shared/staff-utils.js';
 import {
   rawThreadInfoFromServerThreadInfo,
   threadInfoFromRawThreadInfo,
 } from 'lib/shared/thread-utils.js';
 import { hasMinCodeVersion } from 'lib/shared/version-utils.js';
 import type { Platform, PlatformDetails } from 'lib/types/device-types.js';
 import { messageTypes } from 'lib/types/message-types-enum.js';
 import {
   type RawMessageInfo,
   type MessageData,
 } from 'lib/types/message-types.js';
 import { rawMessageInfoValidator } from 'lib/types/message-types.js';
 import type {
   WNSNotification,
   ResolvedNotifTexts,
 } from 'lib/types/notif-types.js';
 import { resolvedNotifTextsValidator } from 'lib/types/notif-types.js';
 import type { ServerThreadInfo, ThreadInfo } from 'lib/types/thread-types.js';
 import { updateTypes } from 'lib/types/update-types-enum.js';
 import { type GlobalUserInfo } from 'lib/types/user-types.js';
 import { isDev } from 'lib/utils/dev-utils.js';
 import { values } from 'lib/utils/objects.js';
 import { promiseAll } from 'lib/utils/promises.js';
 import { tID, tPlatformDetails, tShape } from 'lib/utils/validation-utils.js';
 
 import {
   prepareEncryptedIOSNotifications,
   prepareEncryptedAndroidNotifications,
   prepareEncryptedWebNotifications,
 } from './crypto.js';
 import { getAPNsNotificationTopic } from './providers.js';
 import { rescindPushNotifs } from './rescind.js';
 import type {
   NotificationTargetDevice,
   TargetedAPNsNotification,
   TargetedAndroidNotification,
   TargetedWebNotification,
   TargetedWNSNotification,
 } from './types.js';
 import {
   apnPush,
   fcmPush,
   getUnreadCounts,
   apnMaxNotificationPayloadByteSize,
   fcmMaxNotificationPayloadByteSize,
   wnsMaxNotificationPayloadByteSize,
   webPush,
   wnsPush,
   type WebPushError,
   type WNSPushError,
 } from './utils.js';
 import createIDs from '../creators/id-creator.js';
 import { createUpdates } from '../creators/update-creator.js';
 import { dbQuery, SQL, mergeOrConditions } from '../database/database.js';
 import type { CollapsableNotifInfo } from '../fetchers/message-fetchers.js';
 import { fetchCollapsableNotifs } from '../fetchers/message-fetchers.js';
 import { fetchServerThreadInfos } from '../fetchers/thread-fetchers.js';
 import { fetchUserInfos } from '../fetchers/user-fetchers.js';
 import type { Viewer } from '../session/viewer.js';
 import { getENSNames } from '../utils/ens-cache.js';
 import { validateOutput } from '../utils/validation-utils.js';
 
 export type Device = {
   +platform: Platform,
   +deviceToken: string,
   +cookieID: string,
   +codeVersion: ?number,
   +stateVersion: ?number,
 };
 
-type PushUserInfo = {
+export type PushUserInfo = {
   +devices: Device[],
   // messageInfos and messageDatas have the same key
   +messageInfos: RawMessageInfo[],
   +messageDatas: MessageData[],
 };
 type Delivery = PushDelivery | { collapsedInto: string };
 type NotificationRow = {
   +dbID: string,
   +userID: string,
   +threadID?: ?string,
   +messageID?: ?string,
   +collapseKey?: ?string,
   +deliveries: Delivery[],
 };
 export type PushInfo = { [userID: string]: PushUserInfo };
 
 async function sendPushNotifs(pushInfo: PushInfo) {
   if (Object.keys(pushInfo).length === 0) {
     return;
   }
 
   const [
     unreadCounts,
     { usersToCollapsableNotifInfo, serverThreadInfos, userInfos },
     dbIDs,
   ] = await Promise.all([
     getUnreadCounts(Object.keys(pushInfo)),
     fetchInfos(pushInfo),
     createDBIDs(pushInfo),
   ]);
 
   const preparePromises: Array<Promise<?$ReadOnlyArray<PreparePushResult>>> =
     [];
   const notifications: Map<string, NotificationRow> = new Map();
   for (const userID in usersToCollapsableNotifInfo) {
     const threadInfos = _flow(
       _mapValues((serverThreadInfo: ServerThreadInfo) => {
         const rawThreadInfo = rawThreadInfoFromServerThreadInfo(
           serverThreadInfo,
           userID,
         );
         if (!rawThreadInfo) {
           return null;
         }
         return threadInfoFromRawThreadInfo(rawThreadInfo, userID, userInfos);
       }),
       _pickBy(threadInfo => threadInfo),
     )(serverThreadInfos);
     for (const notifInfo of usersToCollapsableNotifInfo[userID]) {
       preparePromises.push(
         preparePushNotif({
           notifInfo,
           userID,
           pushUserInfo: pushInfo[userID],
           unreadCount: unreadCounts[userID],
           threadInfos,
           userInfos,
           dbIDs,
           rowsToSave: notifications,
         }),
       );
     }
   }
 
   const prepareResults = await Promise.all(preparePromises);
   const flattenedPrepareResults = prepareResults.filter(Boolean).flat();
 
   const deliveryResults = await deliverPushNotifsInEncryptionOrder(
     flattenedPrepareResults,
   );
   const cleanUpPromise = (async () => {
     if (dbIDs.length === 0) {
       return;
     }
     const query = SQL`DELETE FROM ids WHERE id IN (${dbIDs})`;
     await dbQuery(query);
   })();
 
   await Promise.all([
     cleanUpPromise,
     saveNotifResults(deliveryResults, notifications, true),
   ]);
 }
 
 type PreparePushResult = {
   +platform: Platform,
   +notificationInfo: NotificationInfo,
   +notification:
     | TargetedAPNsNotification
     | TargetedAndroidNotification
     | TargetedWebNotification
     | TargetedWNSNotification,
 };
 
 async function preparePushNotif(input: {
   notifInfo: CollapsableNotifInfo,
   userID: string,
   pushUserInfo: PushUserInfo,
   unreadCount: number,
   threadInfos: { +[threadID: string]: ThreadInfo },
   userInfos: { +[userID: string]: GlobalUserInfo },
   dbIDs: string[], // mutable
   rowsToSave: Map<string, NotificationRow>, // mutable
 }): Promise<?$ReadOnlyArray<PreparePushResult>> {
   const {
     notifInfo,
     userID,
     pushUserInfo,
     unreadCount,
     threadInfos,
     userInfos,
     dbIDs,
     rowsToSave,
   } = input;
 
   const hydrateMessageInfo = (rawMessageInfo: RawMessageInfo) =>
     createMessageInfo(rawMessageInfo, userID, userInfos, threadInfos);
   const newMessageInfos = [];
   const newRawMessageInfos = [];
   for (const newRawMessageInfo of notifInfo.newMessageInfos) {
     const newMessageInfo = hydrateMessageInfo(newRawMessageInfo);
     if (newMessageInfo) {
       newMessageInfos.push(newMessageInfo);
       newRawMessageInfos.push(newRawMessageInfo);
     }
   }
   if (newMessageInfos.length === 0) {
     return null;
   }
   const existingMessageInfos = notifInfo.existingMessageInfos
     .map(hydrateMessageInfo)
     .filter(Boolean);
   const allMessageInfos = sortMessageInfoList([
     ...newMessageInfos,
     ...existingMessageInfos,
   ]);
   const [firstNewMessageInfo, ...remainingNewMessageInfos] = newMessageInfos;
   const { threadID } = firstNewMessageInfo;
 
   const threadInfo = threadInfos[threadID];
   const parentThreadInfo = threadInfo.parentThreadID
     ? threadInfos[threadInfo.parentThreadID]
     : null;
   const updateBadge = threadInfo.currentUser.subscription.home;
   const displayBanner = threadInfo.currentUser.subscription.pushNotifs;
   const username = userInfos[userID] && userInfos[userID].username;
   const userWasMentioned =
     username &&
     threadInfo.currentUser.role &&
     oldValidUsernameRegex.test(username) &&
     newMessageInfos.some(newMessageInfo => {
       const unwrappedMessageInfo =
         newMessageInfo.type === messageTypes.SIDEBAR_SOURCE
           ? newMessageInfo.sourceMessage
           : newMessageInfo;
       return (
         unwrappedMessageInfo.type === messageTypes.TEXT &&
         isUserMentioned(username, unwrappedMessageInfo.text)
       );
     });
   if (!updateBadge && !displayBanner && !userWasMentioned) {
     return null;
   }
   const badgeOnly = !displayBanner && !userWasMentioned;
 
   const notifTargetUserInfo = { id: userID, username };
   const notifTexts = await notifTextsForMessageInfo(
     allMessageInfos,
     threadInfo,
     parentThreadInfo,
     notifTargetUserInfo,
     getENSNames,
   );
   if (!notifTexts) {
     return null;
   }
 
   const dbID = dbIDs.shift();
   invariant(dbID, 'should have sufficient DB IDs');
   const byPlatform = getDevicesByPlatform(pushUserInfo.devices);
   const firstMessageID = firstNewMessageInfo.id;
   invariant(firstMessageID, 'RawMessageInfo.id should be set on server');
   const notificationInfo = {
     source: 'new_message',
     dbID,
     userID,
     threadID,
     messageID: firstMessageID,
     collapseKey: notifInfo.collapseKey,
   };
 
   const preparePromises: Array<Promise<$ReadOnlyArray<PreparePushResult>>> = [];
 
   const iosVersionsToTokens = byPlatform.get('ios');
   if (iosVersionsToTokens) {
     for (const [versionKey, devices] of iosVersionsToTokens) {
       const { codeVersion, stateVersion } = stringToVersionKey(versionKey);
 
       const platformDetails: PlatformDetails = {
         platform: 'ios',
         codeVersion,
         stateVersion,
       };
       const shimmedNewRawMessageInfos = shimUnsupportedRawMessageInfos(
         newRawMessageInfos,
         platformDetails,
       );
       const preparePromise: Promise<$ReadOnlyArray<PreparePushResult>> =
         (async () => {
           const targetedNotifications = await prepareAPNsNotification(
             {
               notifTexts,
               newRawMessageInfos: shimmedNewRawMessageInfos,
               threadID: threadInfo.id,
               collapseKey: notifInfo.collapseKey,
               badgeOnly,
               unreadCount,
               platformDetails,
             },
             devices,
           );
           return targetedNotifications.map(notification => ({
             notification,
             platform: 'ios',
             notificationInfo: {
               ...notificationInfo,
               codeVersion,
               stateVersion,
             },
           }));
         })();
       preparePromises.push(preparePromise);
     }
   }
   const androidVersionsToTokens = byPlatform.get('android');
   if (androidVersionsToTokens) {
     for (const [versionKey, devices] of androidVersionsToTokens) {
       const { codeVersion, stateVersion } = stringToVersionKey(versionKey);
       const platformDetails = {
         platform: 'android',
         codeVersion,
         stateVersion,
       };
       const shimmedNewRawMessageInfos = shimUnsupportedRawMessageInfos(
         newRawMessageInfos,
         platformDetails,
       );
       const preparePromise: Promise<$ReadOnlyArray<PreparePushResult>> =
         (async () => {
           const targetedNotifications = await prepareAndroidNotification(
             {
               notifTexts,
               newRawMessageInfos: shimmedNewRawMessageInfos,
               threadID: threadInfo.id,
               collapseKey: notifInfo.collapseKey,
               badgeOnly,
               unreadCount,
               platformDetails,
               dbID,
             },
             devices,
           );
           return targetedNotifications.map(notification => ({
             notification,
             platform: 'android',
             notificationInfo: {
               ...notificationInfo,
               codeVersion,
               stateVersion,
             },
           }));
         })();
       preparePromises.push(preparePromise);
     }
   }
   const webVersionsToTokens = byPlatform.get('web');
   if (webVersionsToTokens) {
     for (const [versionKey, devices] of webVersionsToTokens) {
       const { codeVersion, stateVersion } = stringToVersionKey(versionKey);
       const platformDetails = {
         platform: 'web',
         codeVersion,
         stateVersion,
       };
 
       const preparePromise: Promise<$ReadOnlyArray<PreparePushResult>> =
         (async () => {
           const targetedNotifications = await prepareWebNotification(
             userID,
             {
               notifTexts,
               threadID: threadInfo.id,
               unreadCount,
               platformDetails,
             },
             devices,
           );
 
           return targetedNotifications.map(notification => ({
             notification,
             platform: 'web',
             notificationInfo: {
               ...notificationInfo,
               codeVersion,
               stateVersion,
             },
           }));
         })();
       preparePromises.push(preparePromise);
     }
   }
   const macosVersionsToTokens = byPlatform.get('macos');
   if (macosVersionsToTokens) {
     for (const [versionKey, devices] of macosVersionsToTokens) {
       const { codeVersion, stateVersion } = stringToVersionKey(versionKey);
       const platformDetails = {
         platform: 'macos',
         codeVersion,
         stateVersion,
       };
       const shimmedNewRawMessageInfos = shimUnsupportedRawMessageInfos(
         newRawMessageInfos,
         platformDetails,
       );
       const preparePromise: Promise<$ReadOnlyArray<PreparePushResult>> =
         (async () => {
           const targetedNotifications = await prepareAPNsNotification(
             {
               notifTexts,
               newRawMessageInfos: shimmedNewRawMessageInfos,
               threadID: threadInfo.id,
               collapseKey: notifInfo.collapseKey,
               badgeOnly,
               unreadCount,
               platformDetails,
             },
             devices,
           );
           return targetedNotifications.map(notification => ({
             notification,
             platform: 'macos',
             notificationInfo: {
               ...notificationInfo,
               codeVersion,
               stateVersion,
             },
           }));
         })();
       preparePromises.push(preparePromise);
     }
   }
   const windowsVersionsToTokens = byPlatform.get('windows');
   if (windowsVersionsToTokens) {
     for (const [versionKey, devices] of windowsVersionsToTokens) {
       const { codeVersion, stateVersion } = stringToVersionKey(versionKey);
       const platformDetails = {
         platform: 'windows',
         codeVersion,
         stateVersion,
       };
 
       const preparePromise: Promise<$ReadOnlyArray<PreparePushResult>> =
         (async () => {
           const notification = await prepareWNSNotification({
             notifTexts,
             threadID: threadInfo.id,
             unreadCount,
             platformDetails,
           });
 
           return devices.map(({ deviceToken }) => ({
             notification: ({
               deviceToken,
               notification,
             }: TargetedWNSNotification),
             platform: 'windows',
             notificationInfo: {
               ...notificationInfo,
               codeVersion,
               stateVersion,
             },
           }));
         })();
       preparePromises.push(preparePromise);
     }
   }
 
   for (const newMessageInfo of remainingNewMessageInfos) {
     const newDBID = dbIDs.shift();
     invariant(newDBID, 'should have sufficient DB IDs');
     const messageID = newMessageInfo.id;
     invariant(messageID, 'RawMessageInfo.id should be set on server');
     rowsToSave.set(newDBID, {
       dbID: newDBID,
       userID,
       threadID: newMessageInfo.threadID,
       messageID,
       collapseKey: notifInfo.collapseKey,
       deliveries: [{ collapsedInto: dbID }],
     });
   }
 
   const prepareResults = await Promise.all(preparePromises);
   return prepareResults.flat();
 }
 
 // For better readability we don't differentiate between
 // encrypted and unencrypted notifs and order them together
 function compareEncryptionOrder(
   pushNotif1: PreparePushResult,
   pushNotif2: PreparePushResult,
 ): number {
   const order1 = pushNotif1.notification.encryptionOrder ?? 0;
   const order2 = pushNotif2.notification.encryptionOrder ?? 0;
   return order1 - order2;
 }
 
 async function deliverPushNotifsInEncryptionOrder(
   preparedPushNotifs: $ReadOnlyArray<PreparePushResult>,
 ): Promise<$ReadOnlyArray<PushResult>> {
   const deliveryPromises: Array<Promise<$ReadOnlyArray<PushResult>>> = [];
 
   const groupedByDevice = _groupBy(
     preparedPushNotif => preparedPushNotif.deviceToken,
   )(preparedPushNotifs);
 
   for (const preparedPushNotifsForDevice of values(groupedByDevice)) {
     const orderedPushNotifsForDevice = preparedPushNotifsForDevice.sort(
       compareEncryptionOrder,
     );
 
     const deviceDeliveryPromise = (async () => {
       const deliveries = [];
       for (const preparedPushNotif of orderedPushNotifsForDevice) {
         const { platform, notification, notificationInfo } = preparedPushNotif;
         let delivery: PushResult;
         if (platform === 'ios' || platform === 'macos') {
           delivery = await sendAPNsNotification(
             platform,
             [notification],
             notificationInfo,
           );
         } else if (platform === 'android') {
           delivery = await sendAndroidNotification(
             [notification],
             notificationInfo,
           );
         } else if (platform === 'web') {
           delivery = await sendWebNotifications(
             [notification],
             notificationInfo,
           );
         } else if (platform === 'windows') {
           delivery = await sendWNSNotification(
             [notification],
             notificationInfo,
           );
         }
         if (delivery) {
           deliveries.push(delivery);
         }
       }
       return deliveries;
     })();
     deliveryPromises.push(deviceDeliveryPromise);
   }
 
   const deliveryResults = await Promise.all(deliveryPromises);
   return deliveryResults.flat();
 }
 
 async function sendRescindNotifs(rescindInfo: PushInfo) {
   if (Object.keys(rescindInfo).length === 0) {
     return;
   }
 
   const usersToCollapsableNotifInfo = await fetchCollapsableNotifs(rescindInfo);
 
   const promises = [];
   for (const userID in usersToCollapsableNotifInfo) {
     for (const notifInfo of usersToCollapsableNotifInfo[userID]) {
       for (const existingMessageInfo of notifInfo.existingMessageInfos) {
         const rescindCondition = SQL`
           n.user = ${userID} AND
           n.thread = ${existingMessageInfo.threadID} AND
           n.message = ${existingMessageInfo.id}
         `;
 
         promises.push(rescindPushNotifs(rescindCondition));
       }
     }
   }
 
   await Promise.all(promises);
 }
 
 // The results in deliveryResults will be combined with the rows
 // in rowsToSave and then written to the notifications table
 async function saveNotifResults(
   deliveryResults: $ReadOnlyArray<PushResult>,
   inputRowsToSave: Map<string, NotificationRow>,
   rescindable: boolean,
 ) {
   const rowsToSave = new Map(inputRowsToSave);
 
   const allInvalidTokens = [];
   for (const deliveryResult of deliveryResults) {
     const { info, delivery, invalidTokens } = deliveryResult;
     const { dbID, userID } = info;
     const curNotifRow = rowsToSave.get(dbID);
     if (curNotifRow) {
       curNotifRow.deliveries.push(delivery);
     } else {
       // Ternary expressions for Flow
       const threadID = info.threadID ? info.threadID : null;
       const messageID = info.messageID ? info.messageID : null;
       const collapseKey = info.collapseKey ? info.collapseKey : null;
       rowsToSave.set(dbID, {
         dbID,
         userID,
         threadID,
         messageID,
         collapseKey,
         deliveries: [delivery],
       });
     }
     if (invalidTokens) {
       allInvalidTokens.push({
         userID,
         tokens: invalidTokens,
       });
     }
   }
 
   const notificationRows = [];
   for (const notification of rowsToSave.values()) {
     notificationRows.push([
       notification.dbID,
       notification.userID,
       notification.threadID,
       notification.messageID,
       notification.collapseKey,
       JSON.stringify(notification.deliveries),
       Number(!rescindable),
     ]);
   }
 
-  const dbPromises = [];
+  const dbPromises: Array<Promise<mixed>> = [];
   if (allInvalidTokens.length > 0) {
     dbPromises.push(removeInvalidTokens(allInvalidTokens));
   }
   if (notificationRows.length > 0) {
     const query = SQL`
       INSERT INTO notifications
         (id, user, thread, message, collapse_key, delivery, rescinded)
       VALUES ${notificationRows}
     `;
     dbPromises.push(dbQuery(query));
   }
   if (dbPromises.length > 0) {
     await Promise.all(dbPromises);
   }
 }
 
 async function fetchInfos(pushInfo: PushInfo) {
   const usersToCollapsableNotifInfo = await fetchCollapsableNotifs(pushInfo);
 
   const threadIDs = new Set();
   const threadWithChangedNamesToMessages = new Map();
   const addThreadIDsFromMessageInfos = (rawMessageInfo: RawMessageInfo) => {
     const threadID = rawMessageInfo.threadID;
     threadIDs.add(threadID);
     const messageSpec = messageSpecs[rawMessageInfo.type];
     if (messageSpec.threadIDs) {
       for (const id of messageSpec.threadIDs(rawMessageInfo)) {
         threadIDs.add(id);
       }
     }
     if (
       rawMessageInfo.type === messageTypes.CHANGE_SETTINGS &&
       rawMessageInfo.field === 'name'
     ) {
       const messages = threadWithChangedNamesToMessages.get(threadID);
       if (messages) {
         messages.push(rawMessageInfo.id);
       } else {
         threadWithChangedNamesToMessages.set(threadID, [rawMessageInfo.id]);
       }
     }
   };
   for (const userID in usersToCollapsableNotifInfo) {
     for (const notifInfo of usersToCollapsableNotifInfo[userID]) {
       for (const rawMessageInfo of notifInfo.existingMessageInfos) {
         addThreadIDsFromMessageInfos(rawMessageInfo);
       }
       for (const rawMessageInfo of notifInfo.newMessageInfos) {
         addThreadIDsFromMessageInfos(rawMessageInfo);
       }
     }
   }
 
   const promises = {};
   // These threadInfos won't have currentUser set
   promises.threadResult = fetchServerThreadInfos({ threadIDs });
   if (threadWithChangedNamesToMessages.size > 0) {
     const typesThatAffectName = [
       messageTypes.CHANGE_SETTINGS,
       messageTypes.CREATE_THREAD,
     ];
     const oldNameQuery = SQL`
       SELECT IF(
         JSON_TYPE(JSON_EXTRACT(m.content, "$.name")) = 'NULL',
         "",
         JSON_UNQUOTE(JSON_EXTRACT(m.content, "$.name"))
       ) AS name, m.thread
       FROM (
         SELECT MAX(id) AS id
         FROM messages
         WHERE type IN (${typesThatAffectName})
           AND JSON_EXTRACT(content, "$.name") IS NOT NULL
           AND`;
     const threadClauses = [];
     for (const [threadID, messages] of threadWithChangedNamesToMessages) {
       threadClauses.push(
         SQL`(thread = ${threadID} AND id NOT IN (${messages}))`,
       );
     }
     oldNameQuery.append(mergeOrConditions(threadClauses));
     oldNameQuery.append(SQL`
         GROUP BY thread
       ) x
       LEFT JOIN messages m ON m.id = x.id
     `);
     promises.oldNames = dbQuery(oldNameQuery);
   }
 
   const { threadResult, oldNames } = await promiseAll(promises);
   const serverThreadInfos = threadResult.threadInfos;
   if (oldNames) {
     const [result] = oldNames;
     for (const row of result) {
       const threadID = row.thread.toString();
       serverThreadInfos[threadID].name = row.name;
     }
   }
 
   const userInfos = await fetchNotifUserInfos(
     serverThreadInfos,
     usersToCollapsableNotifInfo,
   );
 
   return { usersToCollapsableNotifInfo, serverThreadInfos, userInfos };
 }
 
 async function fetchNotifUserInfos(
   serverThreadInfos: { +[threadID: string]: ServerThreadInfo },
   usersToCollapsableNotifInfo: { +[userID: string]: CollapsableNotifInfo[] },
 ) {
   const missingUserIDs = new Set();
 
   for (const threadID in serverThreadInfos) {
     const serverThreadInfo = serverThreadInfos[threadID];
     for (const member of serverThreadInfo.members) {
       missingUserIDs.add(member.id);
     }
   }
 
   const addUserIDsFromMessageInfos = (rawMessageInfo: RawMessageInfo) => {
     missingUserIDs.add(rawMessageInfo.creatorID);
     const userIDs =
       messageSpecs[rawMessageInfo.type].userIDs?.(rawMessageInfo) ?? [];
     for (const userID of userIDs) {
       missingUserIDs.add(userID);
     }
   };
 
   for (const userID in usersToCollapsableNotifInfo) {
     missingUserIDs.add(userID);
     for (const notifInfo of usersToCollapsableNotifInfo[userID]) {
       for (const rawMessageInfo of notifInfo.existingMessageInfos) {
         addUserIDsFromMessageInfos(rawMessageInfo);
       }
       for (const rawMessageInfo of notifInfo.newMessageInfos) {
         addUserIDsFromMessageInfos(rawMessageInfo);
       }
     }
   }
 
   return await fetchUserInfos([...missingUserIDs]);
 }
 
 async function createDBIDs(pushInfo: PushInfo): Promise<string[]> {
   let numIDsNeeded = 0;
   for (const userID in pushInfo) {
     numIDsNeeded += pushInfo[userID].messageInfos.length;
   }
   return await createIDs('notifications', numIDsNeeded);
 }
 
 type VersionKey = { codeVersion: number, stateVersion: number };
 const versionKeyRegex: RegExp = new RegExp(/^-?\d+\|-?\d+$/);
 function versionKeyToString(versionKey: VersionKey): string {
   return `${versionKey.codeVersion}|${versionKey.stateVersion}`;
 }
 
 function stringToVersionKey(versionKeyString: string): VersionKey {
   invariant(
     versionKeyRegex.test(versionKeyString),
     'should pass correct version key string',
   );
   const [codeVersion, stateVersion] = versionKeyString.split('|').map(Number);
   return { codeVersion, stateVersion };
 }
 
 function getDevicesByPlatform(
   devices: $ReadOnlyArray<Device>,
 ): Map<Platform, Map<string, Array<NotificationTargetDevice>>> {
   const byPlatform = new Map();
   for (const device of devices) {
     let innerMap = byPlatform.get(device.platform);
     if (!innerMap) {
       innerMap = new Map();
       byPlatform.set(device.platform, innerMap);
     }
     const codeVersion: number =
       device.codeVersion !== null &&
       device.codeVersion !== undefined &&
       device.platform !== 'windows' &&
       device.platform !== 'macos'
         ? device.codeVersion
         : -1;
     const stateVersion: number = device.stateVersion ?? -1;
 
     const versionKey = versionKeyToString({
       codeVersion,
       stateVersion,
     });
-    let innerMostArray = innerMap.get(versionKey);
-    if (!innerMostArray) {
-      innerMostArray = [];
-      innerMap.set(versionKey, innerMostArray);
+    let innerMostArrayTmp: ?Array<NotificationTargetDevice> =
+      innerMap.get(versionKey);
+    if (!innerMostArrayTmp) {
+      innerMostArrayTmp = [];
+      innerMap.set(versionKey, innerMostArrayTmp);
     }
+    const innerMostArray = innerMostArrayTmp;
 
     innerMostArray.push({
       cookieID: device.cookieID,
       deviceToken: device.deviceToken,
     });
   }
   return byPlatform;
 }
 
 type APNsNotifInputData = {
   +notifTexts: ResolvedNotifTexts,
   +newRawMessageInfos: RawMessageInfo[],
   +threadID: string,
   +collapseKey: ?string,
   +badgeOnly: boolean,
   +unreadCount: number,
   +platformDetails: PlatformDetails,
 };
 const apnsNotifInputDataValidator = tShape<APNsNotifInputData>({
   notifTexts: resolvedNotifTextsValidator,
   newRawMessageInfos: t.list(rawMessageInfoValidator),
   threadID: tID,
   collapseKey: t.maybe(t.String),
   badgeOnly: t.Boolean,
   unreadCount: t.Number,
   platformDetails: tPlatformDetails,
 });
 async function prepareAPNsNotification(
   inputData: APNsNotifInputData,
   devices: $ReadOnlyArray<NotificationTargetDevice>,
 ): Promise<$ReadOnlyArray<TargetedAPNsNotification>> {
   const convertedData = validateOutput(
     inputData.platformDetails,
     apnsNotifInputDataValidator,
     inputData,
   );
   const {
     notifTexts,
     newRawMessageInfos,
     threadID,
     collapseKey,
     badgeOnly,
     unreadCount,
     platformDetails,
   } = convertedData;
 
   const canDecryptNonCollapsibleTextNotifs =
     platformDetails.codeVersion && platformDetails.codeVersion > 222;
 
   const isNonCollapsibleTextNotification =
     newRawMessageInfos.every(
       newRawMessageInfo => newRawMessageInfo.type === messageTypes.TEXT,
     ) && !collapseKey;
 
   const canDecryptAllNotifTypes =
     platformDetails.codeVersion && platformDetails.codeVersion >= 267;
 
   const shouldBeEncrypted =
     platformDetails.platform === 'ios' &&
     (canDecryptAllNotifTypes ||
       (isNonCollapsibleTextNotification && canDecryptNonCollapsibleTextNotifs));
 
   const uniqueID = uuidv4();
   const notification = new apn.Notification();
   notification.topic = getAPNsNotificationTopic(platformDetails);
 
   const { merged, ...rest } = notifTexts;
   // We don't include alert's body on macos because we
   // handle displaying the notification ourselves and
   // we don't want macOS to display it automatically.
   if (!badgeOnly && platformDetails.platform !== 'macos') {
     notification.body = merged;
     notification.sound = 'default';
   }
   notification.payload = {
     ...notification.payload,
     ...rest,
   };
 
   notification.badge = unreadCount;
   notification.threadId = threadID;
   notification.id = uniqueID;
   notification.pushType = 'alert';
   notification.payload.id = uniqueID;
   notification.payload.threadID = threadID;
 
   if (platformDetails.codeVersion && platformDetails.codeVersion > 198) {
     notification.mutableContent = true;
   }
   if (collapseKey && canDecryptAllNotifTypes) {
     notification.payload.collapseID = collapseKey;
   } else if (collapseKey) {
     notification.collapseId = collapseKey;
   }
   const messageInfos = JSON.stringify(newRawMessageInfos);
   // We make a copy before checking notification's length, because calling
   // length compiles the notification and makes it immutable. Further
   // changes to its properties won't be reflected in the final plaintext
   // data that is sent.
   const copyWithMessageInfos = _cloneDeep(notification);
   copyWithMessageInfos.payload = {
     ...copyWithMessageInfos.payload,
     messageInfos,
   };
 
   const notificationSizeValidator = notif =>
     notif.length() <= apnMaxNotificationPayloadByteSize;
 
   if (!shouldBeEncrypted) {
     const notificationToSend = notificationSizeValidator(
       _cloneDeep(copyWithMessageInfos),
     )
       ? copyWithMessageInfos
       : notification;
     return devices.map(({ deviceToken }) => ({
       notification: notificationToSend,
       deviceToken,
     }));
   }
 
   const notifsWithMessageInfos = await prepareEncryptedIOSNotifications(
     devices,
     copyWithMessageInfos,
     platformDetails.codeVersion,
     notificationSizeValidator,
   );
 
   const devicesWithExcessiveSize = notifsWithMessageInfos
     .filter(({ payloadSizeExceeded }) => payloadSizeExceeded)
     .map(({ deviceToken, cookieID }) => ({ deviceToken, cookieID }));
 
   if (devicesWithExcessiveSize.length === 0) {
     return notifsWithMessageInfos.map(
       ({
         notification: notif,
         deviceToken,
         encryptedPayloadHash,
         encryptionOrder,
       }) => ({
         notification: notif,
         deviceToken,
         encryptedPayloadHash,
         encryptionOrder,
       }),
     );
   }
 
   const notifsWithoutMessageInfos = await prepareEncryptedIOSNotifications(
     devicesWithExcessiveSize,
     notification,
     platformDetails.codeVersion,
   );
 
   const targetedNotifsWithMessageInfos = notifsWithMessageInfos
     .filter(({ payloadSizeExceeded }) => !payloadSizeExceeded)
     .map(
       ({
         notification: notif,
         deviceToken,
         encryptedPayloadHash,
         encryptionOrder,
       }) => ({
         notification: notif,
         deviceToken,
         encryptedPayloadHash,
         encryptionOrder,
       }),
     );
 
   const targetedNotifsWithoutMessageInfos = notifsWithoutMessageInfos.map(
     ({
       notification: notif,
       deviceToken,
       encryptedPayloadHash,
       encryptionOrder,
     }) => ({
       notification: notif,
       deviceToken,
       encryptedPayloadHash,
       encryptionOrder,
     }),
   );
 
   return [
     ...targetedNotifsWithMessageInfos,
     ...targetedNotifsWithoutMessageInfos,
   ];
 }
 
 type AndroidNotifInputData = {
   ...APNsNotifInputData,
   +dbID: string,
 };
 const androidNotifInputDataValidator = tShape<AndroidNotifInputData>({
   ...apnsNotifInputDataValidator.meta.props,
   dbID: t.String,
 });
 async function prepareAndroidNotification(
   inputData: AndroidNotifInputData,
   devices: $ReadOnlyArray<NotificationTargetDevice>,
 ): Promise<$ReadOnlyArray<TargetedAndroidNotification>> {
   const convertedData = validateOutput(
     inputData.platformDetails,
     androidNotifInputDataValidator,
     inputData,
   );
   const {
     notifTexts,
     newRawMessageInfos,
     threadID,
     collapseKey,
     badgeOnly,
     unreadCount,
     platformDetails: { codeVersion },
     dbID,
   } = convertedData;
   const canDecryptNonCollapsibleTextNotifs = codeVersion && codeVersion > 228;
 
   const isNonCollapsibleTextNotif =
     newRawMessageInfos.every(
       newRawMessageInfo => newRawMessageInfo.type === messageTypes.TEXT,
     ) && !collapseKey;
 
   const canDecryptAllNotifTypes = codeVersion && codeVersion >= 267;
 
   const shouldBeEncrypted =
     canDecryptAllNotifTypes ||
     (canDecryptNonCollapsibleTextNotifs && isNonCollapsibleTextNotif);
 
   const { merged, ...rest } = notifTexts;
   const notification = {
     data: {
       badge: unreadCount.toString(),
       ...rest,
       threadID,
     },
   };
 
   let notifID;
   if (collapseKey && canDecryptAllNotifTypes) {
     notifID = dbID;
     notification.data = {
       ...notification.data,
       collapseKey,
     };
   } else if (collapseKey) {
     notifID = collapseKey;
   } else {
     notifID = dbID;
   }
 
   // The reason we only include `badgeOnly` for newer clients is because older
   // clients don't know how to parse it. The reason we only include `id` for
   // newer clients is that if the older clients see that field, they assume
   // the notif has a full payload, and then crash when trying to parse it.
   // By skipping `id` we allow old clients to still handle in-app notifs and
   // badge updating.
   if (!badgeOnly || (codeVersion && codeVersion >= 69)) {
     notification.data = {
       ...notification.data,
       id: notifID,
       badgeOnly: badgeOnly ? '1' : '0',
     };
   }
 
   const messageInfos = JSON.stringify(newRawMessageInfos);
   const copyWithMessageInfos = {
     ...notification,
     data: { ...notification.data, messageInfos },
   };
 
   if (!shouldBeEncrypted) {
     const notificationToSend =
       Buffer.byteLength(JSON.stringify(copyWithMessageInfos)) <=
       fcmMaxNotificationPayloadByteSize
         ? copyWithMessageInfos
         : notification;
 
     return devices.map(({ deviceToken }) => ({
       notification: notificationToSend,
       deviceToken,
     }));
   }
 
   const notificationsSizeValidator = notif => {
     const serializedNotif = JSON.stringify(notif);
     return (
       !serializedNotif ||
       Buffer.byteLength(serializedNotif) <= fcmMaxNotificationPayloadByteSize
     );
   };
 
   const notifsWithMessageInfos = await prepareEncryptedAndroidNotifications(
     devices,
     copyWithMessageInfos,
     notificationsSizeValidator,
   );
 
   const devicesWithExcessiveSize = notifsWithMessageInfos
     .filter(({ payloadSizeExceeded }) => payloadSizeExceeded)
     .map(({ cookieID, deviceToken }) => ({ cookieID, deviceToken }));
 
   if (devicesWithExcessiveSize.length === 0) {
     return notifsWithMessageInfos.map(
       ({ notification: notif, deviceToken, encryptionOrder }) => ({
         notification: notif,
         deviceToken,
         encryptionOrder,
       }),
     );
   }
 
   const notifsWithoutMessageInfos = await prepareEncryptedAndroidNotifications(
     devicesWithExcessiveSize,
     notification,
   );
 
   const targetedNotifsWithMessageInfos = notifsWithMessageInfos
     .filter(({ payloadSizeExceeded }) => !payloadSizeExceeded)
     .map(({ notification: notif, deviceToken, encryptionOrder }) => ({
       notification: notif,
       deviceToken,
       encryptionOrder,
     }));
 
   const targetedNotifsWithoutMessageInfos = notifsWithoutMessageInfos.map(
     ({ notification: notif, deviceToken, encryptionOrder }) => ({
       notification: notif,
       deviceToken,
       encryptionOrder,
     }),
   );
 
   return [
     ...targetedNotifsWithMessageInfos,
     ...targetedNotifsWithoutMessageInfos,
   ];
 }
 
 type WebNotifInputData = {
   +notifTexts: ResolvedNotifTexts,
   +threadID: string,
   +unreadCount: number,
   +platformDetails: PlatformDetails,
 };
 const webNotifInputDataValidator = tShape<WebNotifInputData>({
   notifTexts: resolvedNotifTextsValidator,
   threadID: tID,
   unreadCount: t.Number,
   platformDetails: tPlatformDetails,
 });
 async function prepareWebNotification(
   userID: string,
   inputData: WebNotifInputData,
   devices: $ReadOnlyArray<NotificationTargetDevice>,
 ): Promise<$ReadOnlyArray<TargetedWebNotification>> {
   const convertedData = validateOutput(
     inputData.platformDetails,
     webNotifInputDataValidator,
     inputData,
   );
   const { notifTexts, threadID, unreadCount } = convertedData;
   const id = uuidv4();
   const { merged, ...rest } = notifTexts;
   const notification = {
     ...rest,
     unreadCount,
     id,
     threadID,
   };
 
   const isStaffOrDev = isStaff(userID) || isDev;
   const shouldBeEncrypted =
     hasMinCodeVersion(convertedData.platformDetails, {
       web: 43,
     }) && isStaffOrDev;
 
   if (!shouldBeEncrypted) {
     return devices.map(({ deviceToken }) => ({ deviceToken, notification }));
   }
 
   return prepareEncryptedWebNotifications(devices, notification);
 }
 
 type WNSNotifInputData = {
   +notifTexts: ResolvedNotifTexts,
   +threadID: string,
   +unreadCount: number,
   +platformDetails: PlatformDetails,
 };
 const wnsNotifInputDataValidator = tShape<WNSNotifInputData>({
   notifTexts: resolvedNotifTextsValidator,
   threadID: tID,
   unreadCount: t.Number,
   platformDetails: tPlatformDetails,
 });
 async function prepareWNSNotification(
   inputData: WNSNotifInputData,
 ): Promise<WNSNotification> {
   const convertedData = validateOutput(
     inputData.platformDetails,
     wnsNotifInputDataValidator,
     inputData,
   );
   const { notifTexts, threadID, unreadCount } = convertedData;
   const { merged, ...rest } = notifTexts;
   const notification = {
     ...rest,
     unreadCount,
     threadID,
   };
 
   if (
     Buffer.byteLength(JSON.stringify(notification)) >
     wnsMaxNotificationPayloadByteSize
   ) {
     console.warn('WNS notification exceeds size limit');
   }
   return notification;
 }
 
 type NotificationInfo =
   | {
       +source: 'new_message',
       +dbID: string,
       +userID: string,
       +threadID: string,
       +messageID: string,
       +collapseKey: ?string,
       +codeVersion: number,
       +stateVersion: number,
     }
   | {
       +source: 'mark_as_unread' | 'mark_as_read' | 'activity_update',
       +dbID: string,
       +userID: string,
       +codeVersion: number,
       +stateVersion: number,
     };
 
 type APNsDelivery = {
   +source: $PropertyType<NotificationInfo, 'source'>,
   +deviceType: 'ios' | 'macos',
   +iosID: string,
   +deviceTokens: $ReadOnlyArray<string>,
   +codeVersion: number,
   +stateVersion: number,
   +errors?: $ReadOnlyArray<ResponseFailure>,
   +encryptedPayloadHashes?: $ReadOnlyArray<string>,
   +deviceTokensToPayloadHash?: {
     +[deviceToken: string]: string,
   },
 };
 type APNsResult = {
   info: NotificationInfo,
   delivery: APNsDelivery,
   invalidTokens?: $ReadOnlyArray<string>,
 };
 async function sendAPNsNotification(
   platform: 'ios' | 'macos',
   targetedNotifications: $ReadOnlyArray<TargetedAPNsNotification>,
   notificationInfo: NotificationInfo,
 ): Promise<APNsResult> {
   const { source, codeVersion, stateVersion } = notificationInfo;
 
   const response = await apnPush({
     targetedNotifications,
     platformDetails: { platform, codeVersion },
   });
   invariant(
     new Set(targetedNotifications.map(({ notification }) => notification.id))
       .size === 1,
     'Encrypted versions of the same notification must share id value',
   );
   const iosID = targetedNotifications[0].notification.id;
   const deviceTokens = targetedNotifications.map(
     ({ deviceToken }) => deviceToken,
   );
   let delivery: APNsDelivery = {
     source,
     deviceType: platform,
     iosID,
     deviceTokens,
     codeVersion,
     stateVersion,
   };
   if (response.errors) {
     delivery = {
       ...delivery,
       errors: response.errors,
     };
   }
 
-  const deviceTokensToPayloadHash = {};
+  const deviceTokensToPayloadHash: { [string]: string } = {};
   for (const targetedNotification of targetedNotifications) {
     if (targetedNotification.encryptedPayloadHash) {
       deviceTokensToPayloadHash[targetedNotification.deviceToken] =
         targetedNotification.encryptedPayloadHash;
     }
   }
   if (Object.keys(deviceTokensToPayloadHash).length !== 0) {
     delivery = {
       ...delivery,
       deviceTokensToPayloadHash,
     };
   }
 
   const result: APNsResult = {
     info: notificationInfo,
     delivery,
   };
   if (response.invalidTokens) {
     result.invalidTokens = response.invalidTokens;
   }
   return result;
 }
 
 type PushResult = AndroidResult | APNsResult | WebResult | WNSResult;
 type PushDelivery = AndroidDelivery | APNsDelivery | WebDelivery | WNSDelivery;
 type AndroidDelivery = {
   source: $PropertyType<NotificationInfo, 'source'>,
   deviceType: 'android',
   androidIDs: $ReadOnlyArray<string>,
   deviceTokens: $ReadOnlyArray<string>,
   codeVersion: number,
   stateVersion: number,
   errors?: $ReadOnlyArray<Object>,
 };
 type AndroidResult = {
   info: NotificationInfo,
   delivery: AndroidDelivery,
   invalidTokens?: $ReadOnlyArray<string>,
 };
 async function sendAndroidNotification(
   targetedNotifications: $ReadOnlyArray<TargetedAndroidNotification>,
   notificationInfo: NotificationInfo,
 ): Promise<AndroidResult> {
   const collapseKey = notificationInfo.collapseKey
     ? notificationInfo.collapseKey
     : null; // for Flow...
   const { source, codeVersion, stateVersion } = notificationInfo;
   const response = await fcmPush({
     targetedNotifications,
     collapseKey,
     codeVersion,
   });
   const deviceTokens = targetedNotifications.map(
     ({ deviceToken }) => deviceToken,
   );
   const androidIDs = response.fcmIDs ? response.fcmIDs : [];
   const delivery: AndroidDelivery = {
     source,
     deviceType: 'android',
     androidIDs,
     deviceTokens,
     codeVersion,
     stateVersion,
   };
   if (response.errors) {
     delivery.errors = response.errors;
   }
   const result: AndroidResult = {
     info: notificationInfo,
     delivery,
   };
   if (response.invalidTokens) {
     result.invalidTokens = response.invalidTokens;
   }
   return result;
 }
 
 type WebDelivery = {
   +source: $PropertyType<NotificationInfo, 'source'>,
   +deviceType: 'web',
   +deviceTokens: $ReadOnlyArray<string>,
   +codeVersion?: number,
   +stateVersion: number,
   +errors?: $ReadOnlyArray<WebPushError>,
 };
 type WebResult = {
   +info: NotificationInfo,
   +delivery: WebDelivery,
   +invalidTokens?: $ReadOnlyArray<string>,
 };
 async function sendWebNotifications(
   targetedNotifications: $ReadOnlyArray<TargetedWebNotification>,
   notificationInfo: NotificationInfo,
 ): Promise<WebResult> {
   const { source, codeVersion, stateVersion } = notificationInfo;
 
   const response = await webPush(targetedNotifications);
 
   const deviceTokens = targetedNotifications.map(
     ({ deviceToken }) => deviceToken,
   );
   const delivery: WebDelivery = {
     source,
     deviceType: 'web',
     deviceTokens,
     codeVersion,
     errors: response.errors,
     stateVersion,
   };
   const result: WebResult = {
     info: notificationInfo,
     delivery,
     invalidTokens: response.invalidTokens,
   };
   return result;
 }
 
 type WNSDelivery = {
   +source: $PropertyType<NotificationInfo, 'source'>,
   +deviceType: 'windows',
   +wnsIDs: $ReadOnlyArray<string>,
   +deviceTokens: $ReadOnlyArray<string>,
   +codeVersion?: number,
   +stateVersion: number,
   +errors?: $ReadOnlyArray<WNSPushError>,
 };
 type WNSResult = {
   +info: NotificationInfo,
   +delivery: WNSDelivery,
   +invalidTokens?: $ReadOnlyArray<string>,
 };
 async function sendWNSNotification(
   targetedNotifications: $ReadOnlyArray<TargetedWNSNotification>,
   notificationInfo: NotificationInfo,
 ): Promise<WNSResult> {
   const { source, codeVersion, stateVersion } = notificationInfo;
 
   const response = await wnsPush(targetedNotifications);
 
   const deviceTokens = targetedNotifications.map(
     ({ deviceToken }) => deviceToken,
   );
   const wnsIDs = response.wnsIDs ?? [];
   const delivery: WNSDelivery = {
     source,
     deviceType: 'windows',
     wnsIDs,
     deviceTokens,
     codeVersion,
     errors: response.errors,
     stateVersion,
   };
   const result: WNSResult = {
     info: notificationInfo,
     delivery,
     invalidTokens: response.invalidTokens,
   };
   return result;
 }
 
 type InvalidToken = {
   +userID: string,
   +tokens: $ReadOnlyArray<string>,
 };
 async function removeInvalidTokens(
   invalidTokens: $ReadOnlyArray<InvalidToken>,
 ): Promise<void> {
   const sqlTuples = invalidTokens.map(
     invalidTokenUser =>
       SQL`(
       user = ${invalidTokenUser.userID} AND
       device_token IN (${invalidTokenUser.tokens})
     )`,
   );
   const sqlCondition = mergeOrConditions(sqlTuples);
 
   const selectQuery = SQL`
     SELECT id, user, device_token
     FROM cookies
     WHERE
   `;
   selectQuery.append(sqlCondition);
   const [result] = await dbQuery(selectQuery);
 
   const userCookiePairsToInvalidDeviceTokens = new Map();
   for (const row of result) {
     const userCookiePair = `${row.user}|${row.id}`;
     const existing = userCookiePairsToInvalidDeviceTokens.get(userCookiePair);
     if (existing) {
       existing.add(row.device_token);
     } else {
       userCookiePairsToInvalidDeviceTokens.set(
         userCookiePair,
         new Set([row.device_token]),
       );
     }
   }
 
   const time = Date.now();
-  const promises = [];
+  const promises: Array<Promise<mixed>> = [];
   for (const entry of userCookiePairsToInvalidDeviceTokens) {
     const [userCookiePair, deviceTokens] = entry;
     const [userID, cookieID] = userCookiePair.split('|');
     const updateDatas = [...deviceTokens].map(deviceToken => ({
       type: updateTypes.BAD_DEVICE_TOKEN,
       userID,
       time,
       deviceToken,
       targetCookie: cookieID,
     }));
     promises.push(createUpdates(updateDatas));
   }
 
   const updateQuery = SQL`
     UPDATE cookies
     SET device_token = NULL
     WHERE
   `;
   updateQuery.append(sqlCondition);
   promises.push(dbQuery(updateQuery));
 
   await Promise.all(promises);
 }
 
 async function updateBadgeCount(
   viewer: Viewer,
   source: 'mark_as_unread' | 'mark_as_read' | 'activity_update',
 ) {
   const { userID } = viewer;
 
   const deviceTokenQuery = SQL`
     SELECT platform, device_token, versions, id
     FROM cookies
     WHERE user = ${userID}
       AND device_token IS NOT NULL
   `;
   if (viewer.data.cookieID) {
     deviceTokenQuery.append(SQL`AND id != ${viewer.cookieID} `);
   }
   const [unreadCounts, [deviceTokenResult], [dbID]] = await Promise.all([
     getUnreadCounts([userID]),
     dbQuery(deviceTokenQuery),
     createIDs('notifications', 1),
   ]);
   const unreadCount = unreadCounts[userID];
   const devices = deviceTokenResult.map(row => {
     const versions = JSON.parse(row.versions);
     return {
       platform: row.platform,
       cookieID: row.id,
       deviceToken: row.device_token,
       codeVersion: versions?.codeVersion,
       stateVersion: versions?.stateVersion,
     };
   });
   const byPlatform = getDevicesByPlatform(devices);
 
   const preparePromises: Array<Promise<$ReadOnlyArray<PreparePushResult>>> = [];
 
   const iosVersionsToTokens = byPlatform.get('ios');
   if (iosVersionsToTokens) {
     for (const [versionKey, deviceInfos] of iosVersionsToTokens) {
       const { codeVersion, stateVersion } = stringToVersionKey(versionKey);
       const notification = new apn.Notification();
       notification.topic = getAPNsNotificationTopic({
         platform: 'ios',
         codeVersion,
         stateVersion,
       });
       notification.badge = unreadCount;
       notification.pushType = 'alert';
       const preparePromise: Promise<PreparePushResult[]> = (async () => {
         let targetedNotifications: $ReadOnlyArray<TargetedAPNsNotification>;
         if (codeVersion > 222) {
           const notificationsArray = await prepareEncryptedIOSNotifications(
             deviceInfos,
             notification,
             codeVersion,
           );
           targetedNotifications = notificationsArray.map(
             ({ notification: notif, deviceToken, encryptionOrder }) => ({
               notification: notif,
               deviceToken,
               encryptionOrder,
             }),
           );
         } else {
           targetedNotifications = deviceInfos.map(({ deviceToken }) => ({
             notification,
             deviceToken,
           }));
         }
         return targetedNotifications.map(targetedNotification => ({
           notification: targetedNotification,
           platform: 'ios',
           notificationInfo: {
             source,
             dbID,
             userID,
             codeVersion,
             stateVersion,
           },
         }));
       })();
 
       preparePromises.push(preparePromise);
     }
   }
 
   const androidVersionsToTokens = byPlatform.get('android');
   if (androidVersionsToTokens) {
     for (const [versionKey, deviceInfos] of androidVersionsToTokens) {
       const { codeVersion, stateVersion } = stringToVersionKey(versionKey);
       const notificationData =
         codeVersion < 69
           ? { badge: unreadCount.toString() }
           : { badge: unreadCount.toString(), badgeOnly: '1' };
       const notification = { data: notificationData };
       const preparePromise: Promise<PreparePushResult[]> = (async () => {
         let targetedNotifications: $ReadOnlyArray<TargetedAndroidNotification>;
         if (codeVersion > 222) {
           const notificationsArray = await prepareEncryptedAndroidNotifications(
             deviceInfos,
             notification,
           );
           targetedNotifications = notificationsArray.map(
             ({ notification: notif, deviceToken, encryptionOrder }) => ({
               notification: notif,
               deviceToken,
               encryptionOrder,
             }),
           );
         } else {
           targetedNotifications = deviceInfos.map(({ deviceToken }) => ({
             deviceToken,
             notification,
           }));
         }
         return targetedNotifications.map(targetedNotification => ({
           notification: targetedNotification,
           platform: 'android',
           notificationInfo: {
             source,
             dbID,
             userID,
             codeVersion,
             stateVersion,
           },
         }));
       })();
       preparePromises.push(preparePromise);
     }
   }
 
   const macosVersionsToTokens = byPlatform.get('macos');
   if (macosVersionsToTokens) {
     for (const [versionKey, deviceInfos] of macosVersionsToTokens) {
       const { codeVersion, stateVersion } = stringToVersionKey(versionKey);
       const notification = new apn.Notification();
       notification.topic = getAPNsNotificationTopic({
         platform: 'macos',
         codeVersion,
         stateVersion,
       });
       notification.badge = unreadCount;
       notification.pushType = 'alert';
       const preparePromise: Promise<PreparePushResult[]> = (async () => {
         return deviceInfos.map(({ deviceToken }) => ({
           notification: ({
             deviceToken,
             notification,
           }: TargetedAPNsNotification),
           platform: 'macos',
           notificationInfo: {
             source,
             dbID,
             userID,
             codeVersion,
             stateVersion,
           },
         }));
       })();
       preparePromises.push(preparePromise);
     }
   }
 
   const prepareResults = await Promise.all(preparePromises);
   const flattenedPrepareResults = prepareResults.filter(Boolean).flat();
   const deliveryResults = await deliverPushNotifsInEncryptionOrder(
     flattenedPrepareResults,
   );
   await saveNotifResults(deliveryResults, new Map(), false);
 }
 
 export { sendPushNotifs, sendRescindNotifs, updateBadgeCount };
diff --git a/keyserver/src/push/utils.js b/keyserver/src/push/utils.js
index e8fc4be09..177656803 100644
--- a/keyserver/src/push/utils.js
+++ b/keyserver/src/push/utils.js
@@ -1,433 +1,433 @@
 // @flow
 
 import type { ResponseFailure } from '@parse/node-apn';
 import type { FirebaseApp, FirebaseError } from 'firebase-admin';
 import invariant from 'invariant';
 import nodeFetch from 'node-fetch';
 import type { Response } from 'node-fetch';
 import uuid from 'uuid';
 import webpush from 'web-push';
 
 import type { PlatformDetails } from 'lib/types/device-types.js';
 import { threadSubscriptions } from 'lib/types/subscription-types.js';
 import { threadPermissions } from 'lib/types/thread-permission-types.js';
 
 import { encryptBlobPayload } from './crypto.js';
 import {
   getAPNPushProfileForCodeVersion,
   getFCMPushProfileForCodeVersion,
   getAPNProvider,
   getFCMProvider,
   ensureWebPushInitialized,
   getWNSToken,
 } from './providers.js';
 import type {
   TargetedAPNsNotification,
   TargetedAndroidNotification,
   TargetedWebNotification,
   TargetedWNSNotification,
 } from './types.js';
 import { dbQuery, SQL } from '../database/database.js';
 import { upload } from '../services/blob.js';
 
 const fcmTokenInvalidationErrors = new Set([
   'messaging/registration-token-not-registered',
   'messaging/invalid-registration-token',
 ]);
 const fcmMaxNotificationPayloadByteSize = 4000;
 const apnTokenInvalidationErrorCode = 410;
 const apnBadRequestErrorCode = 400;
 const apnBadTokenErrorString = 'BadDeviceToken';
 const apnMaxNotificationPayloadByteSize = 4096;
 const webInvalidTokenErrorCodes = [404, 410];
 const wnsInvalidTokenErrorCodes = [404, 410];
 const wnsMaxNotificationPayloadByteSize = 5000;
 
-type APNPushResult =
+export type APNPushResult =
   | { +success: true }
   | {
       +errors: $ReadOnlyArray<ResponseFailure>,
       +invalidTokens?: $ReadOnlyArray<string>,
     };
 async function apnPush({
   targetedNotifications,
   platformDetails,
 }: {
   +targetedNotifications: $ReadOnlyArray<TargetedAPNsNotification>,
   +platformDetails: PlatformDetails,
 }): Promise<APNPushResult> {
   const pushProfile = getAPNPushProfileForCodeVersion(platformDetails);
   const apnProvider = await getAPNProvider(pushProfile);
   if (!apnProvider && process.env.NODE_ENV === 'development') {
     console.log(`no keyserver/secrets/${pushProfile}.json so ignoring notifs`);
     return { success: true };
   }
   invariant(apnProvider, `keyserver/secrets/${pushProfile}.json should exist`);
 
   const results = await Promise.all(
     targetedNotifications.map(({ notification, deviceToken }) => {
       return apnProvider.send(notification, deviceToken);
     }),
   );
 
   const errors: Array<ResponseFailure> = [];
   for (const result of results) {
     errors.push(...result.failed);
   }
 
   const invalidTokens: Array<string> = [];
   for (const error of errors) {
     /* eslint-disable eqeqeq */
     if (
       error.status == apnTokenInvalidationErrorCode ||
       (error.status == apnBadRequestErrorCode &&
         error.response.reason === apnBadTokenErrorString)
     ) {
       invalidTokens.push(error.device);
     }
     /* eslint-enable eqeqeq */
   }
   if (invalidTokens.length > 0) {
     return { errors, invalidTokens };
   } else if (errors.length > 0) {
     return { errors };
   } else {
     return { success: true };
   }
 }
 
 type WritableFCMPushResult = {
   success?: true,
   fcmIDs?: $ReadOnlyArray<string>,
   errors?: $ReadOnlyArray<FirebaseError | mixed>,
   invalidTokens?: $ReadOnlyArray<string>,
 };
 export type FCMPushResult = $ReadOnly<WritableFCMPushResult>;
 async function fcmPush({
   targetedNotifications,
   collapseKey,
   codeVersion,
 }: {
   +targetedNotifications: $ReadOnlyArray<TargetedAndroidNotification>,
   +codeVersion: ?number,
   +collapseKey?: ?string,
 }): Promise<FCMPushResult> {
   const pushProfile = getFCMPushProfileForCodeVersion(codeVersion);
   const fcmProvider = await getFCMProvider(pushProfile);
   if (!fcmProvider && process.env.NODE_ENV === 'development') {
     console.log(`no keyserver/secrets/${pushProfile}.json so ignoring notifs`);
     return { success: true };
   }
   invariant(fcmProvider, `keyserver/secrets/${pushProfile}.json should exist`);
   const options: Object = {
     priority: 'high',
   };
   if (collapseKey) {
     options.collapseKey = collapseKey;
   }
   // firebase-admin is extremely barebones and has a lot of missing or poorly
   // thought-out functionality. One of the issues is that if you send a
   // multicast messages and one of the device tokens is invalid, the resultant
   // won't explain which of the device tokens is invalid. So we're forced to
   // avoid the multicast functionality and call it once per deviceToken.
   const results = await Promise.all(
     targetedNotifications.map(({ notification, deviceToken }) => {
       return fcmSinglePush(fcmProvider, notification, deviceToken, options);
     }),
   );
 
   const errors = [];
   const ids = [];
   const invalidTokens = [];
   for (let i = 0; i < results.length; i++) {
     const pushResult = results[i];
     for (const error of pushResult.errors) {
       errors.push(error.error);
       const errorCode =
         error.type === 'firebase_error'
           ? error.error.errorInfo.code
           : undefined;
       if (errorCode && fcmTokenInvalidationErrors.has(errorCode)) {
         invalidTokens.push(targetedNotifications[i].deviceToken);
       }
     }
     for (const id of pushResult.fcmIDs) {
       ids.push(id);
     }
   }
 
   const result: WritableFCMPushResult = {};
   if (ids.length > 0) {
     result.fcmIDs = ids;
   }
   if (errors.length > 0) {
     result.errors = errors;
   } else {
     result.success = true;
   }
   if (invalidTokens.length > 0) {
     result.invalidTokens = invalidTokens;
   }
   return result;
 }
 
 type FCMSinglePushError =
   | { +type: 'firebase_error', +error: FirebaseError }
   | { +type: 'exception', +error: mixed };
 type FCMSinglePushResult = {
   +fcmIDs: $ReadOnlyArray<string>,
   +errors: $ReadOnlyArray<FCMSinglePushError>,
 };
 async function fcmSinglePush(
   provider: FirebaseApp,
   notification: Object,
   deviceToken: string,
   options: Object,
 ): Promise<FCMSinglePushResult> {
   try {
     const deliveryResult = await provider
       .messaging()
       .sendToDevice(deviceToken, notification, options);
     const errors = [];
     const ids = [];
     for (const fcmResult of deliveryResult.results) {
       if (fcmResult.error) {
         errors.push({ type: 'firebase_error', error: fcmResult.error });
       } else if (fcmResult.messageId) {
         ids.push(fcmResult.messageId);
       }
     }
     return { fcmIDs: ids, errors };
   } catch (e) {
     return { fcmIDs: [], errors: [{ type: 'exception', error: e }] };
   }
 }
 
 async function getUnreadCounts(
   userIDs: string[],
 ): Promise<{ [userID: string]: number }> {
   const visPermissionExtractString = `$.${threadPermissions.VISIBLE}.value`;
   const notificationExtractString = `$.${threadSubscriptions.home}`;
   const query = SQL`
     SELECT user, COUNT(thread) AS unread_count
     FROM memberships
     WHERE user IN (${userIDs}) AND last_message > last_read_message 
       AND role > 0
       AND JSON_EXTRACT(permissions, ${visPermissionExtractString})
       AND JSON_EXTRACT(subscription, ${notificationExtractString})
     GROUP BY user
   `;
   const [result] = await dbQuery(query);
   const usersToUnreadCounts: { [string]: number } = {};
   for (const row of result) {
     usersToUnreadCounts[row.user.toString()] = row.unread_count;
   }
   for (const userID of userIDs) {
     if (usersToUnreadCounts[userID] === undefined) {
       usersToUnreadCounts[userID] = 0;
     }
   }
   return usersToUnreadCounts;
 }
 
 export type WebPushError = {
   +statusCode: number,
   +headers: { +[string]: string },
   +body: string,
 };
 type WritableWebPushResult = {
   success?: true,
   errors?: $ReadOnlyArray<WebPushError>,
   invalidTokens?: $ReadOnlyArray<string>,
 };
 type WebPushResult = $ReadOnly<WritableWebPushResult>;
 type WebPushAttempt = {
   +error?: WebPushError,
 };
 async function webPush(
   targetedNotifications: $ReadOnlyArray<TargetedWebNotification>,
 ): Promise<WebPushResult> {
   await ensureWebPushInitialized();
 
   const pushResults: $ReadOnlyArray<WebPushAttempt> = await Promise.all(
     targetedNotifications.map(
       async ({ notification, deviceToken: deviceTokenString }) => {
         const deviceToken: PushSubscriptionJSON = JSON.parse(deviceTokenString);
         const notificationString = JSON.stringify(notification);
         try {
           await webpush.sendNotification(deviceToken, notificationString);
         } catch (error) {
           return ({ error }: WebPushAttempt);
         }
         return {};
       },
     ),
   );
 
   const errors = [];
   const invalidTokens = [];
   const deviceTokens = targetedNotifications.map(
     ({ deviceToken }) => deviceToken,
   );
   for (let i = 0; i < pushResults.length; i++) {
     const pushResult = pushResults[i];
     const { error } = pushResult;
     if (error) {
       errors.push(error);
       if (webInvalidTokenErrorCodes.includes(error.statusCode)) {
         invalidTokens.push(deviceTokens[i]);
       }
     }
   }
 
   const result: WritableWebPushResult = {};
   if (errors.length > 0) {
     result.errors = errors;
   } else {
     result.success = true;
   }
   if (invalidTokens.length > 0) {
     result.invalidTokens = invalidTokens;
   }
   return result;
 }
 
 export type WNSPushError = any | string | Response;
 type WritableWNSPushResult = {
   success?: true,
   wnsIDs?: $ReadOnlyArray<string>,
   errors?: $ReadOnlyArray<WNSPushError>,
   invalidTokens?: $ReadOnlyArray<string>,
 };
 type WNSPushResult = $ReadOnly<WritableWNSPushResult>;
 async function wnsPush(
   targetedNotifications: $ReadOnlyArray<TargetedWNSNotification>,
 ): Promise<WNSPushResult> {
   const token = await getWNSToken();
   if (!token && process.env.NODE_ENV === 'development') {
     console.log(`no keyserver/secrets/wns_config.json so ignoring notifs`);
     return { success: true };
   }
   invariant(token, `keyserver/secrets/wns_config.json should exist`);
 
   const pushResults = targetedNotifications.map(async targetedNotification => {
     const notificationString = JSON.stringify(
       targetedNotification.notification,
     );
 
     try {
       return await wnsSinglePush(
         token,
         notificationString,
         targetedNotification.deviceToken,
       );
     } catch (error) {
       return { error };
     }
   });
 
   const errors = [];
   const notifIDs = [];
   const invalidTokens = [];
   const deviceTokens = targetedNotifications.map(
     ({ deviceToken }) => deviceToken,
   );
   for (let i = 0; i < pushResults.length; i++) {
     const pushResult = await pushResults[i];
     if (pushResult.error) {
       errors.push(pushResult.error);
       if (
         pushResult.error === 'invalidDomain' ||
         wnsInvalidTokenErrorCodes.includes(pushResult.error?.status)
       ) {
         invalidTokens.push(deviceTokens[i]);
       }
     } else {
       notifIDs.push(pushResult.wnsID);
     }
   }
 
   const result: WritableWNSPushResult = {};
   if (notifIDs.length > 0) {
     result.wnsIDs = notifIDs;
   }
   if (errors.length > 0) {
     result.errors = errors;
   } else {
     result.success = true;
   }
   if (invalidTokens.length > 0) {
     result.invalidTokens = invalidTokens;
   }
   return result;
 }
 
 async function wnsSinglePush(token: string, notification: string, url: string) {
   const parsedURL = new URL(url);
   const domain = parsedURL.hostname.split('.').slice(-3);
   if (
     domain[0] !== 'notify' ||
     domain[1] !== 'windows' ||
     domain[2] !== 'com'
   ) {
     return { error: 'invalidDomain' };
   }
 
   try {
     const result = await nodeFetch(url, {
       method: 'POST',
       headers: {
         'Content-Type': 'application/octet-stream',
         'X-WNS-Type': 'wns/raw',
         'Authorization': `Bearer ${token}`,
       },
       body: notification,
     });
 
     if (!result.ok) {
       return { error: result };
     }
 
     const wnsID = result.headers.get('X-WNS-MSG-ID');
     invariant(wnsID, 'Missing WNS ID');
 
     return { wnsID };
   } catch (err) {
     return { error: err };
   }
 }
 
 async function blobServiceUpload(payload: string): Promise<
   | {
       +blobHash: string,
       +encryptionKey: string,
     }
   | { +blobUploadError: string },
 > {
   const blobHolder = uuid.v4();
   try {
     const { encryptionKey, encryptedPayload, encryptedPayloadHash } =
       await encryptBlobPayload(payload);
     await upload(encryptedPayload, encryptedPayloadHash, blobHolder);
     return {
       blobHash: encryptedPayloadHash,
       encryptionKey,
     };
   } catch (e) {
     return {
       blobUploadError: e.message,
     };
   }
 }
 
 export {
   apnPush,
   blobServiceUpload,
   fcmPush,
   webPush,
   wnsPush,
   getUnreadCounts,
   apnMaxNotificationPayloadByteSize,
   fcmMaxNotificationPayloadByteSize,
   wnsMaxNotificationPayloadByteSize,
 };
diff --git a/keyserver/src/responders/landing-handler.js b/keyserver/src/responders/landing-handler.js
index b4ea270c3..d27428a39 100644
--- a/keyserver/src/responders/landing-handler.js
+++ b/keyserver/src/responders/landing-handler.js
@@ -1,222 +1,222 @@
 // @flow
 
 import html from 'common-tags/lib/html/index.js';
 import type { $Response, $Request } from 'express';
 import fs from 'fs';
 import * as React from 'react';
 // eslint-disable-next-line import/extensions
 import ReactDOMServer from 'react-dom/server';
 import { promisify } from 'util';
 
 import {
   isValidPrimaryIdentityPublicKey,
   isValidSIWENonce,
 } from 'lib/utils/siwe-utils.js';
 
 import { getMessageForException } from './utils.js';
 import { type LandingSSRProps } from '../landing/landing-ssr.react.js';
 import { waitForStream } from '../utils/json-stream.js';
 import { getAndAssertLandingURLFacts } from '../utils/urls.js';
 
 async function landingHandler(req: $Request, res: $Response) {
   try {
     await landingResponder(req, res);
   } catch (e) {
     console.warn(e);
     if (!res.headersSent) {
       res.status(500).send(getMessageForException(e));
     }
   }
 }
 
 const access = promisify(fs.access);
 const readFile = promisify(fs.readFile);
 
 const googleFontsURL =
   'https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@500&family=IBM+Plex+Sans:wght@400;500&display=swap';
 const iaDuoFontsURL = 'fonts/duo.css';
 const localFontsURL = 'fonts/local-fonts.css';
 async function getDevFontURLs(): Promise<$ReadOnlyArray<string>> {
   try {
     await access(localFontsURL);
     return [localFontsURL, iaDuoFontsURL];
   } catch {
     return [googleFontsURL, iaDuoFontsURL];
   }
 }
 
 type AssetInfo = {
   +jsURL: string,
   +fontURLs: $ReadOnlyArray<string>,
   +cssInclude: string,
 };
 let assetInfo: ?AssetInfo = null;
 async function getAssetInfo() {
   if (assetInfo) {
     return assetInfo;
   }
   if (process.env.NODE_ENV === 'development') {
     const fontURLs = await getDevFontURLs();
-    assetInfo = {
+    assetInfo = ({
       jsURL: 'http://localhost:8082/dev.build.js',
       fontURLs,
       cssInclude: '',
-    };
+    }: AssetInfo);
     return assetInfo;
   }
   try {
     const manifestString = await readFile(
       '../landing/dist/manifest.json',
       'utf8',
     );
     const manifest = JSON.parse(manifestString);
-    assetInfo = {
+    assetInfo = ({
       jsURL: `compiled/${manifest['browser.js']}`,
       fontURLs: [googleFontsURL, iaDuoFontsURL],
       cssInclude: html`
         <link
           rel="stylesheet"
           type="text/css"
           href="compiled/${manifest['browser.css']}"
         />
       `,
-    };
+    }: AssetInfo);
     return assetInfo;
   } catch {
     throw new Error(
       'Could not load manifest.json for landing build. ' +
         'Did you forget to run `yarn dev` in the landing folder?',
     );
   }
 }
 
 type LandingApp = React.ComponentType<LandingSSRProps>;
 let webpackCompiledRootComponent: ?LandingApp = null;
 async function getWebpackCompiledRootComponentForSSR() {
   if (webpackCompiledRootComponent) {
     return webpackCompiledRootComponent;
   }
   try {
     // $FlowFixMe landing/dist doesn't always exist
     const webpackBuild = await import('landing/dist/landing.build.cjs');
     webpackCompiledRootComponent = webpackBuild.landing.default;
     return webpackCompiledRootComponent;
   } catch {
     throw new Error(
       'Could not load landing.build.cjs. ' +
         'Did you forget to run `yarn dev` in the landing folder?',
     );
   }
 }
 
 const { renderToNodeStream } = ReactDOMServer;
 
 async function landingResponder(req: $Request, res: $Response) {
   const siweNonce = req.header('siwe-nonce');
   if (
     siweNonce !== null &&
     siweNonce !== undefined &&
     !isValidSIWENonce(siweNonce)
   ) {
     res.status(400).send({
       message: 'Invalid nonce in siwe-nonce header.',
     });
     return;
   }
   const siwePrimaryIdentityPublicKey = req.header(
     'siwe-primary-identity-public-key',
   );
   if (
     siwePrimaryIdentityPublicKey !== null &&
     siwePrimaryIdentityPublicKey !== undefined &&
     !isValidPrimaryIdentityPublicKey(siwePrimaryIdentityPublicKey)
   ) {
     res.status(400).send({
       message:
         'Invalid primary identity public key in siwe-primary-identity-public-key header.',
     });
     return;
   }
 
   const [{ jsURL, fontURLs, cssInclude }, LandingSSR] = await Promise.all([
     getAssetInfo(),
     getWebpackCompiledRootComponentForSSR(),
   ]);
 
   const fontsInclude = fontURLs
     .map(url => `<link rel="stylesheet" type="text/css" href="${url}" />`)
     .join('');
 
   const urlFacts = getAndAssertLandingURLFacts();
   const { basePath } = urlFacts;
 
   // prettier-ignore
   res.write(html`
     <!DOCTYPE html>
     <html lang="en">
       <head>
         <meta charset="utf-8" />
         <meta name="viewport" content="width=device-width" />
         <meta property="og:url" content="https://comm.app/" />
         <meta property="og:title" content="Comm" />
         <meta property="og:description" content="Crypto-native messaging based on federated keyservers" />
         <meta property="og:image" content="https://comm.app/landing-favicon-32x32.png" />
         <meta property="og:image:alt" content="Comm logo" />
         <meta name="twitter:card" content="summary" />
         <meta name="twitter:site" content="@CommDotApp" />
         <title>Comm</title>
         <base href="${basePath}" />
         ${fontsInclude}
         ${cssInclude}
         <link
           rel="apple-touch-icon"
           sizes="180x180"
           href="apple-touch-icon.png"
         />
         <link
           rel="icon"
           type="image/png"
           sizes="32x32"
           href="landing-favicon-32x32.png"
         />
         <link
           rel="icon"
           type="image/png"
           sizes="16x16"
           href="landing-favicon-16x16.png"
         />
       </head>
       <body>
         <div id="react-root">
   `);
 
   // We remove trailing slash for `react-router`
   const routerBasename = basePath.replace(/\/$/, '');
   const clientPath = routerBasename + req.url;
   const reactStream = renderToNodeStream(
     <LandingSSR
       url={clientPath}
       basename={routerBasename}
       siweNonce={siweNonce}
       siwePrimaryIdentityPublicKey={siwePrimaryIdentityPublicKey}
     />,
   );
   reactStream.pipe(res, { end: false });
   await waitForStream(reactStream);
 
   const siweNonceString = siweNonce ? `"${siweNonce}"` : 'null';
   const siwePrimaryIdentityPublicKeyString = siwePrimaryIdentityPublicKey
     ? `"${siwePrimaryIdentityPublicKey}"`
     : 'null';
   // prettier-ignore
   res.end(html`</div>
         <script>var routerBasename = "${routerBasename}";</script>
         <script>var siweNonce = ${siweNonceString};</script>
         <script>var siwePrimaryIdentityPublicKey = ${siwePrimaryIdentityPublicKeyString};</script>
         <script src="${jsURL}"></script>
       </body>
     </html>
   `);
 }
 
 export default landingHandler;
diff --git a/keyserver/src/responders/redux-state-responders.js b/keyserver/src/responders/redux-state-responders.js
index d3b967881..072e90685 100644
--- a/keyserver/src/responders/redux-state-responders.js
+++ b/keyserver/src/responders/redux-state-responders.js
@@ -1,356 +1,363 @@
 // @flow
 
 import _keyBy from 'lodash/fp/keyBy.js';
 import t, { type TInterface } from 'tcomb';
 
 import { baseLegalPolicies } from 'lib/facts/policies.js';
 import { daysToEntriesFromEntryInfos } from 'lib/reducers/entry-reducer.js';
 import { freshMessageStore } from 'lib/reducers/message-reducer.js';
 import { mostRecentlyReadThread } from 'lib/selectors/thread-selectors.js';
 import { mostRecentMessageTimestamp } from 'lib/shared/message-utils.js';
 import {
   threadHasPermission,
   threadIsPending,
   parsePendingThreadID,
   createPendingThread,
 } from 'lib/shared/thread-utils.js';
 import { canUseDatabaseOnWeb } from 'lib/shared/web-database.js';
 import { entryStoreValidator } from 'lib/types/entry-types.js';
 import { defaultCalendarFilters } from 'lib/types/filter-types.js';
-import { inviteLinksStoreValidator } from 'lib/types/link-types.js';
+import {
+  inviteLinksStoreValidator,
+  type CommunityLinks,
+} from 'lib/types/link-types.js';
 import {
   defaultNumberPerThread,
   messageStoreValidator,
 } from 'lib/types/message-types.js';
 import { threadPermissions } from 'lib/types/thread-permission-types.js';
 import { threadTypes } from 'lib/types/thread-types-enum.js';
 import { threadStoreValidator } from 'lib/types/thread-types.js';
 import {
   currentUserInfoValidator,
   userInfosValidator,
+  type GlobalAccountUserInfo,
 } from 'lib/types/user-types.js';
 import { currentDateInTimeZone } from 'lib/utils/date-utils.js';
 import { ServerError } from 'lib/utils/errors.js';
 import { promiseAll } from 'lib/utils/promises.js';
 import { urlInfoValidator } from 'lib/utils/url-utils.js';
 import { tShape, ashoatKeyserverID } from 'lib/utils/validation-utils.js';
 import { navInfoValidator } from 'web/types/nav-types.js';
 import type {
   InitialReduxStateResponse,
   InitialKeyserverInfo,
   InitialReduxStateRequest,
   ExcludedData,
 } from 'web/types/redux-types.js';
 import { navInfoFromURL } from 'web/url-utils.js';
 
 import { fetchEntryInfos } from '../fetchers/entry-fetchers.js';
 import { fetchPrimaryInviteLinks } from '../fetchers/link-fetchers.js';
 import { fetchMessageInfos } from '../fetchers/message-fetchers.js';
 import { hasAnyNotAcknowledgedPolicies } from '../fetchers/policy-acknowledgment-fetchers.js';
 import { fetchThreadInfos } from '../fetchers/thread-fetchers.js';
 import {
   fetchCurrentUserInfo,
   fetchKnownUserInfos,
   fetchUserInfos,
 } from '../fetchers/user-fetchers.js';
 import { getWebPushConfig } from '../push/providers.js';
 import { setNewSession } from '../session/cookies.js';
 import { Viewer } from '../session/viewer.js';
 
 const excludedDataValidator: TInterface<ExcludedData> = tShape<ExcludedData>({
   threadStore: t.maybe(t.Bool),
 });
 
 export const initialReduxStateRequestValidator: TInterface<InitialReduxStateRequest> =
   tShape<InitialReduxStateRequest>({
     urlInfo: urlInfoValidator,
     excludedData: excludedDataValidator,
   });
 
 const initialKeyserverInfoValidator = tShape<InitialKeyserverInfo>({
   sessionID: t.maybe(t.String),
   updatesCurrentAsOf: t.Number,
 });
 
 export const initialReduxStateValidator: TInterface<InitialReduxStateResponse> =
   tShape<InitialReduxStateResponse>({
     navInfo: navInfoValidator,
     currentUserInfo: currentUserInfoValidator,
     entryStore: entryStoreValidator,
     threadStore: threadStoreValidator,
     userInfos: userInfosValidator,
     messageStore: messageStoreValidator,
     pushApiPublicKey: t.maybe(t.String),
     commServicesAccessToken: t.Nil,
     inviteLinksStore: inviteLinksStoreValidator,
     keyserverInfo: initialKeyserverInfoValidator,
   });
 
 async function getInitialReduxStateResponder(
   viewer: Viewer,
   request: InitialReduxStateRequest,
 ): Promise<InitialReduxStateResponse> {
   const { urlInfo, excludedData } = request;
   const useDatabase = viewer.loggedIn && canUseDatabaseOnWeb(viewer.userID);
 
   const hasNotAcknowledgedPoliciesPromise = hasAnyNotAcknowledgedPolicies(
     viewer.id,
     baseLegalPolicies,
   );
 
   const initialNavInfoPromise = (async () => {
     try {
       let backupInfo = {
         now: currentDateInTimeZone(viewer.timeZone),
       };
       // Some user ids in selectedUserList might not exist in the userInfos
       // (e.g. they were included in the results of the user search endpoint)
       // Because of that we keep their userInfos inside the navInfo.
       if (urlInfo.selectedUserList) {
         const fetchedUserInfos = await fetchUserInfos(urlInfo.selectedUserList);
-        const userInfos = {};
+        const userInfos: { [string]: GlobalAccountUserInfo } = {};
         for (const userID in fetchedUserInfos) {
           const userInfo = fetchedUserInfos[userID];
           if (userInfo.username) {
-            userInfos[userID] = userInfo;
+            userInfos[userID] = {
+              ...userInfo,
+              username: userInfo.username,
+            };
           }
         }
         backupInfo = { userInfos, ...backupInfo };
       }
       return navInfoFromURL(urlInfo, backupInfo);
     } catch (e) {
       throw new ServerError(e.message);
     }
   })();
 
   const calendarQueryPromise = (async () => {
     const initialNavInfo = await initialNavInfoPromise;
     return {
       startDate: initialNavInfo.startDate,
       endDate: initialNavInfo.endDate,
       filters: defaultCalendarFilters,
     };
   })();
   const messageSelectionCriteria = { joinedThreads: true };
   const initialTime = Date.now();
 
   const threadInfoPromise = fetchThreadInfos(viewer);
   const messageInfoPromise = fetchMessageInfos(
     viewer,
     messageSelectionCriteria,
     defaultNumberPerThread,
   );
   const entryInfoPromise = (async () => {
     const calendarQuery = await calendarQueryPromise;
     return await fetchEntryInfos(viewer, [calendarQuery]);
   })();
   const currentUserInfoPromise = fetchCurrentUserInfo(viewer);
   const userInfoPromise = fetchKnownUserInfos(viewer);
 
   const sessionIDPromise = (async () => {
     const calendarQuery = await calendarQueryPromise;
     if (viewer.loggedIn) {
       await setNewSession(viewer, calendarQuery, initialTime);
     }
     return viewer.sessionID;
   })();
 
   const threadStorePromise = (async () => {
     if (excludedData.threadStore && useDatabase) {
       return { threadInfos: {} };
     }
     const [{ threadInfos }, hasNotAcknowledgedPolicies] = await Promise.all([
       threadInfoPromise,
       hasNotAcknowledgedPoliciesPromise,
     ]);
     return { threadInfos: hasNotAcknowledgedPolicies ? {} : threadInfos };
   })();
   const messageStorePromise = (async () => {
     const [
       { threadInfos },
       { rawMessageInfos, truncationStatuses },
       hasNotAcknowledgedPolicies,
     ] = await Promise.all([
       threadInfoPromise,
       messageInfoPromise,
       hasNotAcknowledgedPoliciesPromise,
     ]);
     if (hasNotAcknowledgedPolicies) {
       return {
         messages: {},
         threads: {},
         local: {},
         currentAsOf: { [ashoatKeyserverID]: 0 },
       };
     }
     const { messageStore: freshStore } = freshMessageStore(
       rawMessageInfos,
       truncationStatuses,
       {
         [ashoatKeyserverID]: mostRecentMessageTimestamp(
           rawMessageInfos,
           initialTime,
         ),
       },
       threadInfos,
     );
     return freshStore;
   })();
   const entryStorePromise = (async () => {
     const [{ rawEntryInfos }, hasNotAcknowledgedPolicies] = await Promise.all([
       entryInfoPromise,
       hasNotAcknowledgedPoliciesPromise,
     ]);
     if (hasNotAcknowledgedPolicies) {
       return {
         entryInfos: {},
         daysToEntries: {},
         lastUserInteractionCalendar: 0,
       };
     }
     return {
       entryInfos: _keyBy('id')(rawEntryInfos),
       daysToEntries: daysToEntriesFromEntryInfos(rawEntryInfos),
       lastUserInteractionCalendar: initialTime,
     };
   })();
   const userInfosPromise = (async () => {
     const [userInfos, hasNotAcknowledgedPolicies] = await Promise.all([
       userInfoPromise,
       hasNotAcknowledgedPoliciesPromise,
     ]);
     return hasNotAcknowledgedPolicies ? {} : userInfos;
   })();
 
   const navInfoPromise = (async () => {
     const [
       { threadInfos },
       messageStore,
       currentUserInfo,
       userInfos,
       finalNavInfo,
     ] = await Promise.all([
       threadInfoPromise,
       messageStorePromise,
       currentUserInfoPromise,
       userInfosPromise,
       initialNavInfoPromise,
     ]);
 
     const requestedActiveChatThreadID = finalNavInfo.activeChatThreadID;
     if (
       requestedActiveChatThreadID &&
       !threadIsPending(requestedActiveChatThreadID) &&
       !threadHasPermission(
         threadInfos[requestedActiveChatThreadID],
         threadPermissions.VISIBLE,
       )
     ) {
       finalNavInfo.activeChatThreadID = null;
     }
 
     if (!finalNavInfo.activeChatThreadID) {
       const mostRecentThread = mostRecentlyReadThread(
         messageStore,
         threadInfos,
       );
       if (mostRecentThread) {
         finalNavInfo.activeChatThreadID = mostRecentThread;
       }
     }
 
     if (
       finalNavInfo.activeChatThreadID &&
       threadIsPending(finalNavInfo.activeChatThreadID) &&
       finalNavInfo.pendingThread?.id !== finalNavInfo.activeChatThreadID
     ) {
       const pendingThreadData = parsePendingThreadID(
         finalNavInfo.activeChatThreadID,
       );
       if (
         pendingThreadData &&
         pendingThreadData.threadType !== threadTypes.SIDEBAR &&
         currentUserInfo.id
       ) {
         const members = [...pendingThreadData.memberIDs, currentUserInfo.id]
           .map(id => {
             const userInfo = userInfos[id];
             if (!userInfo || !userInfo.username) {
               return undefined;
             }
             const { username } = userInfo;
             return { id, username };
           })
           .filter(Boolean);
         const newPendingThread = createPendingThread({
           viewerID: currentUserInfo.id,
           threadType: pendingThreadData.threadType,
           members,
         });
         finalNavInfo.activeChatThreadID = newPendingThread.id;
         finalNavInfo.pendingThread = newPendingThread;
       }
     }
 
     return finalNavInfo;
   })();
   const currentAsOfPromise = (async () => {
     const hasNotAcknowledgedPolicies = await hasNotAcknowledgedPoliciesPromise;
     return hasNotAcknowledgedPolicies ? 0 : initialTime;
   })();
 
   const pushApiPublicKeyPromise = (async () => {
     const pushConfig = await getWebPushConfig();
     if (!pushConfig) {
       if (process.env.NODE_ENV !== 'development') {
         console.warn('keyserver/secrets/web_push_config.json should exist');
       }
       return null;
     }
     return pushConfig.publicKey;
   })();
 
   const inviteLinksStorePromise = (async () => {
     const primaryInviteLinks = await fetchPrimaryInviteLinks(viewer);
-    const links = {};
+    const links: { [string]: CommunityLinks } = {};
     for (const link of primaryInviteLinks) {
       if (link.primary) {
         links[link.communityID] = {
           primaryLink: link,
         };
       }
     }
     return {
       links,
     };
   })();
 
   const keyserverInfoPromise = (async () => {
     const { sessionID, updatesCurrentAsOf } = await promiseAll({
       sessionID: sessionIDPromise,
       updatesCurrentAsOf: currentAsOfPromise,
     });
 
     return {
       sessionID,
       updatesCurrentAsOf,
     };
   })();
 
   const initialReduxState: InitialReduxStateResponse = await promiseAll({
     navInfo: navInfoPromise,
     currentUserInfo: currentUserInfoPromise,
     entryStore: entryStorePromise,
     threadStore: threadStorePromise,
     userInfos: userInfosPromise,
     messageStore: messageStorePromise,
     pushApiPublicKey: pushApiPublicKeyPromise,
     commServicesAccessToken: null,
     inviteLinksStore: inviteLinksStorePromise,
     keyserverInfo: keyserverInfoPromise,
   });
 
   return initialReduxState;
 }
 
 export { getInitialReduxStateResponder };
diff --git a/keyserver/src/responders/user-responders.js b/keyserver/src/responders/user-responders.js
index 76d245980..d48afefbb 100644
--- a/keyserver/src/responders/user-responders.js
+++ b/keyserver/src/responders/user-responders.js
@@ -1,763 +1,763 @@
 // @flow
 
 import type { Utility as OlmUtility } from '@commapp/olm';
 import invariant from 'invariant';
 import { ErrorTypes, SiweMessage } from 'siwe';
 import t, { type TInterface, type TUnion } from 'tcomb';
 import bcrypt from 'twin-bcrypt';
 
 import {
   baseLegalPolicies,
   policies,
   policyTypeValidator,
 } from 'lib/facts/policies.js';
 import { hasMinCodeVersion } from 'lib/shared/version-utils.js';
 import type {
   ResetPasswordRequest,
   LogOutResponse,
   RegisterResponse,
   RegisterRequest,
   LogInResponse,
   LogInRequest,
   UpdatePasswordRequest,
   UpdateUserSettingsRequest,
   PolicyAcknowledgmentRequest,
   ClaimUsernameResponse,
 } from 'lib/types/account-types.js';
 import {
   userSettingsTypes,
   notificationTypeValues,
   logInActionSources,
 } from 'lib/types/account-types.js';
 import {
   type ClientAvatar,
   clientAvatarValidator,
   type UpdateUserAvatarResponse,
   type UpdateUserAvatarRequest,
 } from 'lib/types/avatar-types.js';
 import type {
   ReservedUsernameMessage,
   IdentityKeysBlob,
   SignedIdentityKeysBlob,
 } from 'lib/types/crypto-types.js';
 import {
   type CalendarQuery,
   rawEntryInfoValidator,
 } from 'lib/types/entry-types.js';
 import {
   defaultNumberPerThread,
   rawMessageInfoValidator,
   messageTruncationStatusesValidator,
 } from 'lib/types/message-types.js';
 import type {
   SIWEAuthRequest,
   SIWEMessage,
   SIWESocialProof,
 } from 'lib/types/siwe-types.js';
 import {
   type SubscriptionUpdateRequest,
   type SubscriptionUpdateResponse,
   threadSubscriptionValidator,
 } from 'lib/types/subscription-types.js';
 import { rawThreadInfoValidator } from 'lib/types/thread-types.js';
 import { createUpdatesResultValidator } from 'lib/types/update-types.js';
 import {
   type PasswordUpdate,
   loggedOutUserInfoValidator,
   loggedInUserInfoValidator,
   userInfoValidator,
 } from 'lib/types/user-types.js';
 import {
   identityKeysBlobValidator,
   signedIdentityKeysBlobValidator,
 } from 'lib/utils/crypto-utils.js';
 import { ServerError } from 'lib/utils/errors.js';
 import { values } from 'lib/utils/objects.js';
 import { promiseAll } from 'lib/utils/promises.js';
 import {
   getPublicKeyFromSIWEStatement,
   isValidSIWEMessage,
   isValidSIWEStatementWithPublicKey,
   primaryIdentityPublicKeyRegex,
 } from 'lib/utils/siwe-utils.js';
 import {
   tShape,
   tPlatformDetails,
   tPassword,
   tEmail,
   tOldValidUsername,
   tRegex,
   tID,
 } from 'lib/utils/validation-utils.js';
 
 import {
   entryQueryInputValidator,
   newEntryQueryInputValidator,
   normalizeCalendarQuery,
   verifyCalendarQueryThreadIDs,
 } from './entry-responders.js';
 import {
   createAccount,
   processSIWEAccountCreation,
 } from '../creators/account-creator.js';
 import { createOlmSession } from '../creators/olm-session-creator.js';
 import { dbQuery, SQL } from '../database/database.js';
 import { deleteAccount } from '../deleters/account-deleters.js';
 import { deleteCookie } from '../deleters/cookie-deleters.js';
 import { checkAndInvalidateSIWENonceEntry } from '../deleters/siwe-nonce-deleters.js';
 import { fetchEntryInfos } from '../fetchers/entry-fetchers.js';
 import { fetchMessageInfos } from '../fetchers/message-fetchers.js';
 import { fetchNotAcknowledgedPolicies } from '../fetchers/policy-acknowledgment-fetchers.js';
 import { fetchThreadInfos } from '../fetchers/thread-fetchers.js';
 import {
   fetchKnownUserInfos,
   fetchLoggedInUserInfo,
   fetchUserIDForEthereumAddress,
   fetchUsername,
 } from '../fetchers/user-fetchers.js';
 import {
   createNewAnonymousCookie,
   createNewUserCookie,
   setNewSession,
 } from '../session/cookies.js';
 import type { Viewer } from '../session/viewer.js';
 import {
   accountUpdater,
   checkAndSendVerificationEmail,
   checkAndSendPasswordResetEmail,
   updatePassword,
   updateUserSettings,
   updateUserAvatar,
 } from '../updaters/account-updaters.js';
 import { fetchOlmAccount } from '../updaters/olm-account-updater.js';
 import { userSubscriptionUpdater } from '../updaters/user-subscription-updaters.js';
 import { viewerAcknowledgmentUpdater } from '../updaters/viewer-acknowledgment-updater.js';
 import { getOlmUtility } from '../utils/olm-utils.js';
 
 export const subscriptionUpdateRequestInputValidator: TInterface<SubscriptionUpdateRequest> =
   tShape<SubscriptionUpdateRequest>({
     threadID: tID,
     updatedFields: tShape({
       pushNotifs: t.maybe(t.Boolean),
       home: t.maybe(t.Boolean),
     }),
   });
 
 export const subscriptionUpdateResponseValidator: TInterface<SubscriptionUpdateResponse> =
   tShape<SubscriptionUpdateResponse>({
     threadSubscription: threadSubscriptionValidator,
   });
 
 async function userSubscriptionUpdateResponder(
   viewer: Viewer,
   request: SubscriptionUpdateRequest,
 ): Promise<SubscriptionUpdateResponse> {
   const threadSubscription = await userSubscriptionUpdater(viewer, request);
   return {
     threadSubscription,
   };
 }
 
 export const accountUpdateInputValidator: TInterface<PasswordUpdate> =
   tShape<PasswordUpdate>({
     updatedFields: tShape({
       email: t.maybe(tEmail),
       password: t.maybe(tPassword),
     }),
     currentPassword: tPassword,
   });
 
 async function passwordUpdateResponder(
   viewer: Viewer,
   request: PasswordUpdate,
 ): Promise<void> {
   await accountUpdater(viewer, request);
 }
 
 async function sendVerificationEmailResponder(viewer: Viewer): Promise<void> {
   await checkAndSendVerificationEmail(viewer);
 }
 
 export const resetPasswordRequestInputValidator: TInterface<ResetPasswordRequest> =
   tShape<ResetPasswordRequest>({
     usernameOrEmail: t.union([tEmail, tOldValidUsername]),
   });
 
 async function sendPasswordResetEmailResponder(
   viewer: Viewer,
   request: ResetPasswordRequest,
 ): Promise<void> {
   await checkAndSendPasswordResetEmail(request);
 }
 
 export const logOutResponseValidator: TInterface<LogOutResponse> =
   tShape<LogOutResponse>({
     currentUserInfo: loggedOutUserInfoValidator,
   });
 
 async function logOutResponder(viewer: Viewer): Promise<LogOutResponse> {
   if (viewer.loggedIn) {
     const [anonymousViewerData] = await Promise.all([
       createNewAnonymousCookie({
         platformDetails: viewer.platformDetails,
         deviceToken: viewer.deviceToken,
       }),
       deleteCookie(viewer.cookieID),
     ]);
     viewer.setNewCookie(anonymousViewerData);
   }
   return {
     currentUserInfo: {
       anonymous: true,
     },
   };
 }
 
 async function accountDeletionResponder(
   viewer: Viewer,
 ): Promise<LogOutResponse> {
   const result = await deleteAccount(viewer);
   invariant(result, 'deleteAccount should return result if handed request');
   return result;
 }
 
 const deviceTokenUpdateRequestInputValidator = tShape({
   deviceType: t.maybe(t.enums.of(['ios', 'android'])),
   deviceToken: t.String,
 });
 
 export const registerRequestInputValidator: TInterface<RegisterRequest> =
   tShape<RegisterRequest>({
     username: t.String,
     email: t.maybe(tEmail),
     password: tPassword,
     calendarQuery: t.maybe(newEntryQueryInputValidator),
     deviceTokenUpdateRequest: t.maybe(deviceTokenUpdateRequestInputValidator),
     platformDetails: tPlatformDetails,
     // We include `primaryIdentityPublicKey` to avoid breaking
     // old clients, but we no longer do anything with it.
     primaryIdentityPublicKey: t.maybe(tRegex(primaryIdentityPublicKeyRegex)),
     signedIdentityKeysBlob: t.maybe(signedIdentityKeysBlobValidator),
     initialNotificationsEncryptedMessage: t.maybe(t.String),
   });
 
 export const registerResponseValidator: TInterface<RegisterResponse> =
   tShape<RegisterResponse>({
     id: t.String,
     rawMessageInfos: t.list(rawMessageInfoValidator),
     currentUserInfo: loggedInUserInfoValidator,
     cookieChange: tShape({
       threadInfos: t.dict(tID, rawThreadInfoValidator),
       userInfos: t.list(userInfoValidator),
     }),
   });
 
 async function accountCreationResponder(
   viewer: Viewer,
   request: RegisterRequest,
 ): Promise<RegisterResponse> {
   const { signedIdentityKeysBlob } = request;
   if (signedIdentityKeysBlob) {
     const identityKeys: IdentityKeysBlob = JSON.parse(
       signedIdentityKeysBlob.payload,
     );
     if (!identityKeysBlobValidator.is(identityKeys)) {
       throw new ServerError('invalid_identity_keys_blob');
     }
 
     const olmUtil: OlmUtility = getOlmUtility();
     try {
       olmUtil.ed25519_verify(
         identityKeys.primaryIdentityPublicKeys.ed25519,
         signedIdentityKeysBlob.payload,
         signedIdentityKeysBlob.signature,
       );
     } catch (e) {
       throw new ServerError('invalid_signature');
     }
   }
   return await createAccount(viewer, request);
 }
 
 type ProcessSuccessfulLoginParams = {
   +viewer: Viewer,
   +input: any,
   +userID: string,
   +calendarQuery: ?CalendarQuery,
   +socialProof?: ?SIWESocialProof,
   +signedIdentityKeysBlob?: ?SignedIdentityKeysBlob,
   +initialNotificationsEncryptedMessage?: string,
 };
 
 async function processSuccessfulLogin(
   params: ProcessSuccessfulLoginParams,
 ): Promise<LogInResponse> {
   const {
     viewer,
     input,
     userID,
     calendarQuery,
     socialProof,
     signedIdentityKeysBlob,
     initialNotificationsEncryptedMessage,
   } = params;
 
   const request: LogInRequest = input;
   const newServerTime = Date.now();
   const deviceToken = request.deviceTokenUpdateRequest
     ? request.deviceTokenUpdateRequest.deviceToken
     : viewer.deviceToken;
   const [userViewerData, notAcknowledgedPolicies] = await Promise.all([
     createNewUserCookie(userID, {
       platformDetails: request.platformDetails,
       deviceToken,
       socialProof,
       signedIdentityKeysBlob,
     }),
     fetchNotAcknowledgedPolicies(userID, baseLegalPolicies),
     deleteCookie(viewer.cookieID),
   ]);
   viewer.setNewCookie(userViewerData);
 
   if (
     notAcknowledgedPolicies.length &&
     hasMinCodeVersion(viewer.platformDetails, { native: 181 })
   ) {
     const currentUserInfo = await fetchLoggedInUserInfo(viewer);
     return {
       notAcknowledgedPolicies,
       currentUserInfo: currentUserInfo,
       rawMessageInfos: [],
       truncationStatuses: {},
       userInfos: [],
       rawEntryInfos: [],
       serverTime: 0,
       cookieChange: {
         threadInfos: {},
         userInfos: [],
       },
     };
   }
 
   if (calendarQuery) {
     await setNewSession(viewer, calendarQuery, newServerTime);
   }
   const olmSessionPromise = (async () => {
     if (
       userViewerData.cookieID &&
       initialNotificationsEncryptedMessage &&
       signedIdentityKeysBlob
     ) {
       await createOlmSession(
         initialNotificationsEncryptedMessage,
         'notifications',
         userViewerData.cookieID,
       );
     }
   })();
 
-  const threadCursors = {};
+  const threadCursors: { [string]: null } = {};
   for (const watchedThreadID of request.watchedIDs) {
     threadCursors[watchedThreadID] = null;
   }
   const messageSelectionCriteria = { threadCursors, joinedThreads: true };
 
   const [
     threadsResult,
     messagesResult,
     entriesResult,
     userInfos,
     currentUserInfo,
   ] = await Promise.all([
     fetchThreadInfos(viewer),
     fetchMessageInfos(viewer, messageSelectionCriteria, defaultNumberPerThread),
     calendarQuery ? fetchEntryInfos(viewer, [calendarQuery]) : undefined,
     fetchKnownUserInfos(viewer),
     fetchLoggedInUserInfo(viewer),
     olmSessionPromise,
   ]);
 
   const rawEntryInfos = entriesResult ? entriesResult.rawEntryInfos : null;
   const response: LogInResponse = {
     currentUserInfo,
     rawMessageInfos: messagesResult.rawMessageInfos,
     truncationStatuses: messagesResult.truncationStatuses,
     serverTime: newServerTime,
     userInfos: values(userInfos),
     cookieChange: {
       threadInfos: threadsResult.threadInfos,
       userInfos: [],
     },
   };
   if (rawEntryInfos) {
     return {
       ...response,
       rawEntryInfos,
     };
   }
   return response;
 }
 
 export const logInRequestInputValidator: TInterface<LogInRequest> =
   tShape<LogInRequest>({
     username: t.maybe(t.String),
     usernameOrEmail: t.maybe(t.union([tEmail, tOldValidUsername])),
     password: tPassword,
     watchedIDs: t.list(tID),
     calendarQuery: t.maybe(entryQueryInputValidator),
     deviceTokenUpdateRequest: t.maybe(deviceTokenUpdateRequestInputValidator),
     platformDetails: tPlatformDetails,
     source: t.maybe(t.enums.of(values(logInActionSources))),
     // We include `primaryIdentityPublicKey` to avoid breaking
     // old clients, but we no longer do anything with it.
     primaryIdentityPublicKey: t.maybe(tRegex(primaryIdentityPublicKeyRegex)),
     signedIdentityKeysBlob: t.maybe(signedIdentityKeysBlobValidator),
     initialNotificationsEncryptedMessage: t.maybe(t.String),
   });
 
 export const logInResponseValidator: TInterface<LogInResponse> =
   tShape<LogInResponse>({
     currentUserInfo: loggedInUserInfoValidator,
     rawMessageInfos: t.list(rawMessageInfoValidator),
     truncationStatuses: messageTruncationStatusesValidator,
     userInfos: t.list(userInfoValidator),
     rawEntryInfos: t.maybe(t.list(rawEntryInfoValidator)),
     serverTime: t.Number,
     cookieChange: tShape({
       threadInfos: t.dict(tID, rawThreadInfoValidator),
       userInfos: t.list(userInfoValidator),
     }),
     notAcknowledgedPolicies: t.maybe(t.list(policyTypeValidator)),
   });
 
 async function logInResponder(
   viewer: Viewer,
   request: LogInRequest,
 ): Promise<LogInResponse> {
   let identityKeys: ?IdentityKeysBlob;
   const { signedIdentityKeysBlob, initialNotificationsEncryptedMessage } =
     request;
   if (signedIdentityKeysBlob) {
     identityKeys = JSON.parse(signedIdentityKeysBlob.payload);
 
     const olmUtil: OlmUtility = getOlmUtility();
     try {
       olmUtil.ed25519_verify(
         identityKeys.primaryIdentityPublicKeys.ed25519,
         signedIdentityKeysBlob.payload,
         signedIdentityKeysBlob.signature,
       );
     } catch (e) {
       throw new ServerError('invalid_signature');
     }
   }
 
   const calendarQuery = request.calendarQuery
     ? normalizeCalendarQuery(request.calendarQuery)
     : null;
   const promises = {};
   if (calendarQuery) {
     promises.verifyCalendarQueryThreadIDs =
       verifyCalendarQueryThreadIDs(calendarQuery);
   }
   const username = request.username ?? request.usernameOrEmail;
   if (!username) {
     if (hasMinCodeVersion(viewer.platformDetails, { native: 150 })) {
       throw new ServerError('invalid_credentials');
     } else {
       throw new ServerError('invalid_parameters');
     }
   }
   const userQuery = SQL`
     SELECT id, hash, username
     FROM users
     WHERE LCASE(username) = LCASE(${username})
   `;
   promises.userQuery = dbQuery(userQuery);
   const {
     userQuery: [userResult],
   } = await promiseAll(promises);
 
   if (userResult.length === 0) {
     if (hasMinCodeVersion(viewer.platformDetails, { native: 150 })) {
       throw new ServerError('invalid_credentials');
     } else {
       throw new ServerError('invalid_parameters');
     }
   }
 
   const userRow = userResult[0];
 
   if (!userRow.hash || !bcrypt.compareSync(request.password, userRow.hash)) {
     throw new ServerError('invalid_credentials');
   }
 
   const id = userRow.id.toString();
 
   return await processSuccessfulLogin({
     viewer,
     input: request,
     userID: id,
     calendarQuery,
     signedIdentityKeysBlob,
     initialNotificationsEncryptedMessage,
   });
 }
 
 export const siweAuthRequestInputValidator: TInterface<SIWEAuthRequest> =
   tShape<SIWEAuthRequest>({
     signature: t.String,
     message: t.String,
     calendarQuery: entryQueryInputValidator,
     deviceTokenUpdateRequest: t.maybe(deviceTokenUpdateRequestInputValidator),
     platformDetails: tPlatformDetails,
     watchedIDs: t.list(tID),
     signedIdentityKeysBlob: t.maybe(signedIdentityKeysBlobValidator),
     initialNotificationsEncryptedMessage: t.maybe(t.String),
     doNotRegister: t.maybe(t.Boolean),
   });
 
 async function siweAuthResponder(
   viewer: Viewer,
   request: SIWEAuthRequest,
 ): Promise<LogInResponse> {
   const {
     message,
     signature,
     deviceTokenUpdateRequest,
     platformDetails,
     signedIdentityKeysBlob,
     initialNotificationsEncryptedMessage,
     doNotRegister,
   } = request;
   const calendarQuery = normalizeCalendarQuery(request.calendarQuery);
 
   // 1. Ensure that `message` is a well formed Comm SIWE Auth message.
   const siweMessage: SIWEMessage = new SiweMessage(message);
   if (!isValidSIWEMessage(siweMessage)) {
     throw new ServerError('invalid_parameters');
   }
 
   // 2. Ensure that the `nonce` exists in the `siwe_nonces` table
   //    AND hasn't expired. If those conditions are met, delete the entry to
   //    ensure that the same `nonce` can't be re-used in a future request.
   const wasNonceCheckedAndInvalidated = await checkAndInvalidateSIWENonceEntry(
     siweMessage.nonce,
   );
   if (!wasNonceCheckedAndInvalidated) {
     throw new ServerError('invalid_parameters');
   }
 
   // 3. Validate SIWEMessage signature and handle possible errors.
   try {
     await siweMessage.validate(signature);
   } catch (error) {
     if (error === ErrorTypes.EXPIRED_MESSAGE) {
       // Thrown when the `expirationTime` is present and in the past.
       throw new ServerError('expired_message');
     } else if (error === ErrorTypes.INVALID_SIGNATURE) {
       // Thrown when the `validate()` function can't verify the message.
       throw new ServerError('invalid_signature');
     } else if (error === ErrorTypes.MALFORMED_SESSION) {
       // Thrown when some required field is missing.
       throw new ServerError('malformed_session');
     } else {
       throw new ServerError('unknown_error');
     }
   }
 
   // 4. Pull `primaryIdentityPublicKey` out from SIWEMessage `statement`.
   //    We expect it to be included for BOTH native and web clients.
   const { statement } = siweMessage;
   const primaryIdentityPublicKey =
     statement && isValidSIWEStatementWithPublicKey(statement)
       ? getPublicKeyFromSIWEStatement(statement)
       : null;
   if (!primaryIdentityPublicKey) {
     throw new ServerError('invalid_siwe_statement_public_key');
   }
 
   // 5. Verify `signedIdentityKeysBlob.payload` with included `signature`
   //    if `signedIdentityKeysBlob` was included in the `SIWEAuthRequest`.
   let identityKeys: ?IdentityKeysBlob;
   if (signedIdentityKeysBlob) {
     identityKeys = JSON.parse(signedIdentityKeysBlob.payload);
     if (!identityKeysBlobValidator.is(identityKeys)) {
       throw new ServerError('invalid_identity_keys_blob');
     }
 
     const olmUtil: OlmUtility = getOlmUtility();
     try {
       olmUtil.ed25519_verify(
         identityKeys.primaryIdentityPublicKeys.ed25519,
         signedIdentityKeysBlob.payload,
         signedIdentityKeysBlob.signature,
       );
     } catch (e) {
       throw new ServerError('invalid_signature');
     }
   }
 
   // 6. Ensure that `primaryIdentityPublicKeys.ed25519` matches SIWE
   //    statement `primaryIdentityPublicKey` if `identityKeys` exists.
   if (
     identityKeys &&
     identityKeys.primaryIdentityPublicKeys.ed25519 !== primaryIdentityPublicKey
   ) {
     throw new ServerError('primary_public_key_mismatch');
   }
 
   // 7. Construct `SIWESocialProof` object with the stringified
   //    SIWEMessage and the corresponding signature.
   const socialProof: SIWESocialProof = {
     siweMessage: siweMessage.toMessage(),
     siweMessageSignature: signature,
   };
 
   // 8. Create account with call to `processSIWEAccountCreation(...)`
   //    if address does not correspond to an existing user.
   let userID = await fetchUserIDForEthereumAddress(siweMessage.address);
   if (!userID && doNotRegister) {
     throw new ServerError('account_does_not_exist');
   } else if (!userID) {
     const siweAccountCreationRequest = {
       address: siweMessage.address,
       calendarQuery,
       deviceTokenUpdateRequest,
       platformDetails,
       socialProof,
     };
     userID = await processSIWEAccountCreation(
       viewer,
       siweAccountCreationRequest,
     );
   }
 
   // 9. Complete login with call to `processSuccessfulLogin(...)`.
   return await processSuccessfulLogin({
     viewer,
     input: request,
     userID,
     calendarQuery,
     socialProof,
     signedIdentityKeysBlob,
     initialNotificationsEncryptedMessage,
   });
 }
 
 export const updatePasswordRequestInputValidator: TInterface<UpdatePasswordRequest> =
   tShape<UpdatePasswordRequest>({
     code: t.String,
     password: tPassword,
     watchedIDs: t.list(tID),
     calendarQuery: t.maybe(entryQueryInputValidator),
     deviceTokenUpdateRequest: t.maybe(deviceTokenUpdateRequestInputValidator),
     platformDetails: tPlatformDetails,
   });
 
 async function oldPasswordUpdateResponder(
   viewer: Viewer,
   request: UpdatePasswordRequest,
 ): Promise<LogInResponse> {
   if (request.calendarQuery) {
     request.calendarQuery = normalizeCalendarQuery(request.calendarQuery);
   }
   return await updatePassword(viewer, request);
 }
 
 export const updateUserSettingsInputValidator: TInterface<UpdateUserSettingsRequest> =
   tShape<UpdateUserSettingsRequest>({
     name: t.irreducible(
       userSettingsTypes.DEFAULT_NOTIFICATIONS,
       x => x === userSettingsTypes.DEFAULT_NOTIFICATIONS,
     ),
     data: t.enums.of(notificationTypeValues),
   });
 
 async function updateUserSettingsResponder(
   viewer: Viewer,
   request: UpdateUserSettingsRequest,
 ): Promise<void> {
   await updateUserSettings(viewer, request);
 }
 
 export const policyAcknowledgmentRequestInputValidator: TInterface<PolicyAcknowledgmentRequest> =
   tShape<PolicyAcknowledgmentRequest>({
     policy: t.maybe(t.enums.of(policies)),
   });
 
 async function policyAcknowledgmentResponder(
   viewer: Viewer,
   request: PolicyAcknowledgmentRequest,
 ): Promise<void> {
   await viewerAcknowledgmentUpdater(viewer, request.policy);
 }
 
 export const updateUserAvatarResponseValidator: TInterface<UpdateUserAvatarResponse> =
   tShape<UpdateUserAvatarResponse>({
     updates: createUpdatesResultValidator,
   });
 
 export const updateUserAvatarResponderValidator: TUnion<
   ?ClientAvatar | UpdateUserAvatarResponse,
 > = t.union([
   t.maybe(clientAvatarValidator),
   updateUserAvatarResponseValidator,
 ]);
 
 async function updateUserAvatarResponder(
   viewer: Viewer,
   request: UpdateUserAvatarRequest,
 ): Promise<?ClientAvatar | UpdateUserAvatarResponse> {
   return await updateUserAvatar(viewer, request);
 }
 
 export const claimUsernameResponseValidator: TInterface<ClaimUsernameResponse> =
   tShape<ClaimUsernameResponse>({
     message: t.String,
     signature: t.String,
   });
 
 async function claimUsernameResponder(
   viewer: Viewer,
 ): Promise<ClaimUsernameResponse> {
   const [username, accountInfo] = await Promise.all([
     fetchUsername(viewer.userID),
     fetchOlmAccount('content'),
   ]);
 
   if (!username) {
     throw new ServerError('invalid_credentials');
   }
 
   const issuedAt = new Date().toISOString();
   const reservedUsernameMessage: ReservedUsernameMessage = {
     statement: 'This user is the owner of the following username and user ID',
     payload: {
       username,
       userID: viewer.userID,
     },
     issuedAt,
   };
   const message = JSON.stringify(reservedUsernameMessage);
   const signature = accountInfo.account.sign(message);
 
   return { message, signature };
 }
 
 export {
   userSubscriptionUpdateResponder,
   passwordUpdateResponder,
   sendVerificationEmailResponder,
   sendPasswordResetEmailResponder,
   logOutResponder,
   accountDeletionResponder,
   accountCreationResponder,
   logInResponder,
   siweAuthResponder,
   oldPasswordUpdateResponder,
   updateUserSettingsResponder,
   policyAcknowledgmentResponder,
   updateUserAvatarResponder,
   claimUsernameResponder,
 };
diff --git a/keyserver/src/scripts/generate-converter-from-validator.js b/keyserver/src/scripts/generate-converter-from-validator.js
index 0c2c75e61..da1416cfd 100644
--- a/keyserver/src/scripts/generate-converter-from-validator.js
+++ b/keyserver/src/scripts/generate-converter-from-validator.js
@@ -1,234 +1,234 @@
 // @flow
 
 import t, { type TInterface, type TType } from 'tcomb';
 
 import {
   nativeMediaSelectionValidator,
   mediaValidator,
 } from 'lib/types/media-types.js';
 import { threadPermissionInfoValidator } from 'lib/types/thread-permission-types.js';
 import { rawThreadInfoValidator } from 'lib/types/thread-types.js';
 import { ashoatKeyserverID, tID } from 'lib/utils/validation-utils.js';
 
 import { main } from './utils.js';
 
 function getDiscriminatorFieldForUnionValidator(validator: TType<mixed>) {
   if (validator === threadPermissionInfoValidator) {
     return 'value';
   }
   if (validator === nativeMediaSelectionValidator) {
     return 'step';
   }
   return 'type';
 }
 
 function flattenInnerUnionValidators<T>(
   innerValidators: $ReadOnlyArray<TType<T>>,
 ): TInterface<{ +[string]: mixed }>[] {
-  let result = [];
+  let result: TInterface<{ +[string]: mixed }>[] = [];
   for (const innerValidator of innerValidators) {
     if (innerValidator.meta.kind === 'interface') {
       // In flow, union refinement only works if every variant has a key
       // that is a literal. In this case we don't get a refinement of
       // `innerValidator` because we are checking value of the inner
       // `meta` object.
       const recastValidator: TInterface<{ +[string]: mixed }> =
         (innerValidator: any);
       result.push(recastValidator);
     } else if (innerValidator.meta.kind === 'union') {
       result = [
         ...result,
         ...flattenInnerUnionValidators(innerValidator.meta.types),
       ];
     } else if ([t.String, t.Number, t.Boolean].includes(innerValidator)) {
       // We don't need to handle literal types because they can't be
       // converted
     } else {
       throw new Error(
         `Validator not supported in union: ${innerValidator.displayName}`,
       );
     }
   }
   return result;
 }
 
 // MediaValidator is special cased because of flow issues
 function getConverterForMediaValidator(inputName: string) {
   return `(${inputName}.type === 'photo'
   ? { ...${inputName}, id: '256|' + ${inputName}.id }
   : ${inputName}.type === 'video'
   ? {
       ...${inputName},
       id: '256|' + ${inputName}.id,
       thumbnailID: '256|' + ${inputName}.thumbnailID,
     }
   : ${inputName}.type === 'encrypted_photo'
   ? ({ ...${inputName}, id: '256|' + ${inputName}.id }: any)
   : ${inputName}.type === 'encrypted_video'
   ? ({
       ...${inputName},
       id: '256|' + ${inputName}.id,
       thumbnailID: '256|' + ${inputName}.thumbnailID,
     }: any)
   : ${inputName})`;
 }
 
 // `null` is returned if there is no conversion needed in T or any
 // of it's inner types
 function generateConverterFromValidator<T, C>(
   validator: TType<T>,
   inputName: string,
   validatorToBeConverted: TType<C>,
   conversionExpressionString: (inputName: string) => string,
 ): ?string {
   if (validator === validatorToBeConverted) {
     return `(${conversionExpressionString(inputName)})`;
   } else if (validator === mediaValidator) {
     return getConverterForMediaValidator(inputName);
   }
 
   if (validator.meta.kind === 'maybe') {
     const inner = generateConverterFromValidator(
       validator.meta.type,
       inputName,
       validatorToBeConverted,
       conversionExpressionString,
     );
     if (!inner) {
       return null;
     }
     return `((${inputName} !== null && ${inputName} !== undefined) ? (${inner}) : (${inputName}))`;
   }
   if (validator.meta.kind === 'subtype') {
     return generateConverterFromValidator(
       validator.meta.type,
       inputName,
       validatorToBeConverted,
       conversionExpressionString,
     );
   }
   if (validator.meta.kind === 'interface') {
     // In flow, union refinement only works if every variant has a key
     // that is a literal. In this case we don't get a refinement of `validator`
     // because we are checking value of the inner `meta` object.
     const recastValidator: TInterface<{ +[string]: mixed }> = (validator: any);
     const fieldConverters = [];
     for (const key in recastValidator.meta.props) {
       const inner = generateConverterFromValidator(
         recastValidator.meta.props[key],
         `${inputName}.${key}`,
         validatorToBeConverted,
         conversionExpressionString,
       );
       if (inner) {
         fieldConverters.push(`${key}:${inner}`);
       }
     }
     if (fieldConverters.length === 0) {
       return null;
     }
 
     return `({...${inputName}, ${fieldConverters.join(',')}})`;
   }
   if (validator.meta.kind === 'union') {
     const innerValidators = flattenInnerUnionValidators(validator.meta.types);
 
     const variantConverters = [];
     for (const innerValidator of innerValidators) {
       const discriminatorField =
         getDiscriminatorFieldForUnionValidator(validator);
       const discriminatorValidator =
         innerValidator.meta.props[discriminatorField];
 
       if (!discriminatorValidator) {
         throw new Error(
           'Union should have a discriminator ' + validator.displayName,
         );
       }
 
       const discriminatorValue = discriminatorValidator.meta.name;
 
       const inner = generateConverterFromValidator(
         innerValidator,
         inputName,
         validatorToBeConverted,
         conversionExpressionString,
       );
 
       if (inner) {
         variantConverters.push(
           `(${inputName}.${discriminatorField} === ${discriminatorValue}) ? (${inner})`,
         );
       }
     }
     if (variantConverters.length === 0) {
       return null;
     }
     variantConverters.push(`(${inputName})`);
     return `(${variantConverters.join(':')})`;
   }
   if (validator.meta.kind === 'list') {
     const inner = generateConverterFromValidator(
       validator.meta.type,
       'elem',
       validatorToBeConverted,
       conversionExpressionString,
     );
     if (!inner) {
       return inputName;
     }
     return `(${inputName}.map(elem => ${inner}))`;
   }
   if (validator.meta.kind === 'dict') {
     const domainValidator = validator.meta.domain;
     const codomainValidator = validator.meta.codomain;
 
     let domainConverter = null;
     if (domainValidator === validatorToBeConverted) {
       domainConverter = conversionExpressionString('key');
     }
 
     let codomainConverter = generateConverterFromValidator(
       codomainValidator,
       'value',
       validatorToBeConverted,
       conversionExpressionString,
     );
 
     if (!domainConverter && !codomainConverter) {
       return null;
     }
 
     domainConverter = domainConverter ?? 'key';
     codomainConverter = codomainConverter ?? 'value';
 
     return `(Object.fromEntries(
           entries(${inputName}).map(
             ([key, value]) => [${domainConverter}, ${codomainConverter}]
           )
         ))`;
   }
 
   return null;
 }
 
 // Input arguments:
 const validator = rawThreadInfoValidator;
 const typeName = 'RawThreadInfo';
 const validatorToBeConverted = tID;
 const conversionExpressionString = inputName =>
   `'${ashoatKeyserverID}|' + ${inputName}`;
 main([
   async () => {
     console.log(
       `export function convert${typeName}ToNewIDSchema(input: ${typeName}): ${typeName} { return`,
       generateConverterFromValidator(
         validator,
         'input',
         validatorToBeConverted,
         conversionExpressionString,
       ) ?? 'input',
       ';}',
     );
   },
 ]);
diff --git a/keyserver/src/scripts/merge-users.js b/keyserver/src/scripts/merge-users.js
index 6b47f2372..83beaea78 100644
--- a/keyserver/src/scripts/merge-users.js
+++ b/keyserver/src/scripts/merge-users.js
@@ -1,195 +1,196 @@
 // @flow
 
 import type { Shape } from 'lib/types/core.js';
 import type { ServerThreadInfo } from 'lib/types/thread-types.js';
 import { updateTypes } from 'lib/types/update-types-enum.js';
 import { type UpdateData } from 'lib/types/update-types.js';
 
 import { endScript } from './utils.js';
 import { createUpdates } from '../creators/update-creator.js';
 import { dbQuery, SQL } from '../database/database.js';
 import type { SQLStatementType } from '../database/types.js';
 import { deleteAccount } from '../deleters/account-deleters.js';
 import { fetchServerThreadInfos } from '../fetchers/thread-fetchers.js';
 import { createScriptViewer } from '../session/scripts.js';
 import {
   changeRole,
   commitMembershipChangeset,
+  type MembershipRow,
 } from '../updaters/thread-permission-updaters.js';
 import RelationshipChangeset from '../utils/relationship-changeset.js';
 
 async function main() {
   try {
     await mergeUsers('7147', '15972', { username: true, password: true });
     endScript();
   } catch (e) {
     endScript();
     console.warn(e);
   }
 }
 
 type ReplaceUserInfo = Shape<{
   +username: boolean,
   +password: boolean,
 }>;
 async function mergeUsers(
   fromUserID: string,
   toUserID: string,
   replaceUserInfo?: ReplaceUserInfo,
 ) {
-  let updateUserRowQuery = null;
-  let updateDatas = [];
+  let updateUserRowQuery: ?SQLStatementType = null;
+  let updateDatas: UpdateData[] = [];
   if (replaceUserInfo) {
     const replaceUserResult = await replaceUser(
       fromUserID,
       toUserID,
       replaceUserInfo,
     );
     ({ sql: updateUserRowQuery, updateDatas } = replaceUserResult);
   }
 
   const usersGettingUpdate = new Set();
   const usersNeedingUpdate = new Set();
   const needUserInfoUpdate = replaceUserInfo && replaceUserInfo.username;
   const setGettingUpdate = (threadInfo: ServerThreadInfo) => {
     if (!needUserInfoUpdate) {
       return;
     }
     for (const { id } of threadInfo.members) {
       usersGettingUpdate.add(id);
       usersNeedingUpdate.delete(id);
     }
   };
   const setNeedingUpdate = (threadInfo: ServerThreadInfo) => {
     if (!needUserInfoUpdate) {
       return;
     }
     for (const { id } of threadInfo.members) {
       if (!usersGettingUpdate.has(id)) {
         usersNeedingUpdate.add(id);
       }
     }
   };
 
   const newThreadRolePairs = [];
   const { threadInfos } = await fetchServerThreadInfos();
   for (const threadID in threadInfos) {
     const threadInfo = threadInfos[threadID];
     const fromUserExistingMember = threadInfo.members.find(
       memberInfo => memberInfo.id === fromUserID,
     );
     if (!fromUserExistingMember) {
       setNeedingUpdate(threadInfo);
       continue;
     }
     const { role } = fromUserExistingMember;
     if (!role) {
       // Only transfer explicit memberships
       setNeedingUpdate(threadInfo);
       continue;
     }
     const toUserExistingMember = threadInfo.members.find(
       memberInfo => memberInfo.id === toUserID,
     );
     if (!toUserExistingMember || !toUserExistingMember.role) {
       setGettingUpdate(threadInfo);
       newThreadRolePairs.push([threadID, role]);
     } else {
       setNeedingUpdate(threadInfo);
     }
   }
 
   const fromViewer = createScriptViewer(fromUserID);
   await deleteAccount(fromViewer);
 
   if (updateUserRowQuery) {
     await dbQuery(updateUserRowQuery);
   }
 
   const time = Date.now();
   for (const userID of usersNeedingUpdate) {
     updateDatas.push({
       type: updateTypes.UPDATE_USER,
       userID,
       time,
       updatedUserID: toUserID,
     });
   }
   await createUpdates(updateDatas);
 
   const changesets = await Promise.all(
     newThreadRolePairs.map(([threadID, role]) =>
       changeRole(threadID, [toUserID], role),
     ),
   );
-  const membershipRows = [];
+  const membershipRows: Array<MembershipRow> = [];
   const relationshipChangeset = new RelationshipChangeset();
   for (const currentChangeset of changesets) {
     const {
       membershipRows: currentMembershipRows,
       relationshipChangeset: currentRelationshipChangeset,
     } = currentChangeset;
     membershipRows.push(...currentMembershipRows);
     relationshipChangeset.addAll(currentRelationshipChangeset);
   }
   if (membershipRows.length > 0 || relationshipChangeset.getRowCount() > 0) {
     const toViewer = createScriptViewer(toUserID);
     const changeset = { membershipRows, relationshipChangeset };
     await commitMembershipChangeset(toViewer, changeset);
   }
 }
 
 type ReplaceUserResult = {
   sql: ?SQLStatementType,
   updateDatas: UpdateData[],
 };
 async function replaceUser(
   fromUserID: string,
   toUserID: string,
   replaceUserInfo: ReplaceUserInfo,
 ): Promise<ReplaceUserResult> {
   if (Object.keys(replaceUserInfo).length === 0) {
     return {
       sql: null,
       updateDatas: [],
     };
   }
 
   const fromUserQuery = SQL`
     SELECT username, hash
     FROM users
     WHERE id = ${fromUserID}
   `;
   const [fromUserResult] = await dbQuery(fromUserQuery);
   const [firstResult] = fromUserResult;
   if (!firstResult) {
     throw new Error(`couldn't fetch fromUserID ${fromUserID}`);
   }
 
-  const changedFields = {};
+  const changedFields: { [string]: string } = {};
   if (replaceUserInfo.username) {
     changedFields.username = firstResult.username;
   }
   if (replaceUserInfo.password) {
     changedFields.hash = firstResult.hash;
   }
 
   const updateUserRowQuery = SQL`
     UPDATE users SET ${changedFields} WHERE id = ${toUserID}
   `;
 
-  const updateDatas = [];
+  const updateDatas: UpdateData[] = [];
   if (replaceUserInfo.username) {
     updateDatas.push({
       type: updateTypes.UPDATE_CURRENT_USER,
       userID: toUserID,
       time: Date.now(),
     });
   }
   return {
     sql: updateUserRowQuery,
     updateDatas,
   };
 }
 
 main();
diff --git a/keyserver/src/search/users.js b/keyserver/src/search/users.js
index cd5d42183..382148b58 100644
--- a/keyserver/src/search/users.js
+++ b/keyserver/src/search/users.js
@@ -1,47 +1,47 @@
 // @flow
 
 import type { UserSearchRequest } from 'lib/types/search-types.js';
 import type { GlobalAccountUserInfo } from 'lib/types/user-types.js';
 
 import { dbQuery, SQL } from '../database/database.js';
 
 async function searchForUsers(
   query: UserSearchRequest,
 ): Promise<GlobalAccountUserInfo[]> {
   const sqlQuery = SQL`SELECT id, username FROM users `;
   const prefix = query.prefix;
   if (prefix) {
     sqlQuery.append(SQL`WHERE LOWER(username) LIKE LOWER(${prefix + '%'}) `);
   }
   sqlQuery.append(SQL`LIMIT 20`);
 
   const [result] = await dbQuery(sqlQuery);
 
-  const userInfos = [];
+  const userInfos: GlobalAccountUserInfo[] = [];
   for (const row of result) {
     userInfos.push({
       id: row.id.toString(),
       username: row.username,
     });
   }
   return userInfos;
 }
 
 async function searchForUser(
   usernameQuery: string,
 ): Promise<?GlobalAccountUserInfo> {
   const query = SQL`
     SELECT id, username
     FROM users
     WHERE LOWER(username) = LOWER(${usernameQuery})
   `;
   const [result] = await dbQuery(query);
 
   if (result.length === 0) {
     return null;
   }
   const { id, username } = result[0];
   return { id, username };
 }
 
 export { searchForUsers, searchForUser };
diff --git a/keyserver/src/session/cookies.js b/keyserver/src/session/cookies.js
index ef66550fe..012bd4844 100644
--- a/keyserver/src/session/cookies.js
+++ b/keyserver/src/session/cookies.js
@@ -1,789 +1,789 @@
 // @flow
 
 import crypto from 'crypto';
 import type { $Response, $Request } from 'express';
 import invariant from 'invariant';
 import url from 'url';
 
 import { isStaff } from 'lib/shared/staff-utils.js';
 import { hasMinCodeVersion } from 'lib/shared/version-utils.js';
 import type { Shape } from 'lib/types/core.js';
 import type { SignedIdentityKeysBlob } from 'lib/types/crypto-types.js';
 import type { Platform, PlatformDetails } from 'lib/types/device-types.js';
 import type { CalendarQuery } from 'lib/types/entry-types.js';
 import {
   type ServerSessionChange,
   cookieLifetime,
   cookieTypes,
   sessionIdentifierTypes,
   type SessionIdentifierType,
 } from 'lib/types/session-types.js';
 import type { SIWESocialProof } from 'lib/types/siwe-types.js';
 import type { InitialClientSocketMessage } from 'lib/types/socket-types.js';
 import type { UserInfo } from 'lib/types/user-types.js';
 import { isDev } from 'lib/utils/dev-utils.js';
 import { values } from 'lib/utils/objects.js';
 
 import {
   isBcryptHash,
   getCookieHash,
   verifyCookieHash,
 } from './cookie-hash.js';
 import { Viewer } from './viewer.js';
 import type { AnonymousViewerData, UserViewerData } from './viewer.js';
 import createIDs from '../creators/id-creator.js';
 import { createSession } from '../creators/session-creator.js';
 import { dbQuery, SQL } from '../database/database.js';
 import { deleteCookie } from '../deleters/cookie-deleters.js';
 import { handleAsyncPromise } from '../responders/handlers.js';
 import { clearDeviceToken } from '../updaters/device-token-updaters.js';
 import { assertSecureRequest } from '../utils/security-utils.js';
 import {
   type AppURLFacts,
   getAppURLFactsFromRequestURL,
 } from '../utils/urls.js';
 
 function cookieIsExpired(lastUsed: number) {
   return lastUsed + cookieLifetime <= Date.now();
 }
 
 type SessionParameterInfo = {
   isSocket: boolean,
   sessionID: ?string,
   sessionIdentifierType: SessionIdentifierType,
   ipAddress: string,
   userAgent: ?string,
 };
 
 type FetchViewerResult =
   | { +type: 'valid', +viewer: Viewer }
   | InvalidFetchViewerResult;
 
 type InvalidFetchViewerResult =
   | {
       +type: 'nonexistant',
       +cookieName: ?string,
       +sessionParameterInfo: SessionParameterInfo,
     }
   | {
       +type: 'invalidated',
       +cookieName: string,
       +cookieID: string,
       +sessionParameterInfo: SessionParameterInfo,
       +platformDetails: ?PlatformDetails,
       +deviceToken: ?string,
     };
 
 async function fetchUserViewer(
   cookie: string,
   sessionParameterInfo: SessionParameterInfo,
 ): Promise<FetchViewerResult> {
   const [cookieID, cookiePassword] = cookie.split(':');
   if (!cookieID || !cookiePassword) {
     return {
       type: 'nonexistant',
       cookieName: cookieTypes.USER,
       sessionParameterInfo,
     };
   }
 
   const query = SQL`
     SELECT hash, user, last_used, platform, device_token, versions
     FROM cookies
     WHERE id = ${cookieID} AND user IS NOT NULL
   `;
   const [[result], allSessionInfo] = await Promise.all([
     dbQuery(query),
     fetchSessionInfo(sessionParameterInfo, cookieID),
   ]);
   if (result.length === 0) {
     return {
       type: 'nonexistant',
       cookieName: cookieTypes.USER,
       sessionParameterInfo,
     };
   }
 
   let sessionID = null,
     sessionInfo = null;
   if (allSessionInfo) {
     ({ sessionID, ...sessionInfo } = allSessionInfo);
   }
 
   const cookieRow = result[0];
   let platformDetails = null;
   if (cookieRow.versions) {
     const versions = JSON.parse(cookieRow.versions);
     platformDetails = {
       platform: cookieRow.platform,
       codeVersion: versions.codeVersion,
       stateVersion: versions.stateVersion,
     };
   } else {
     platformDetails = { platform: cookieRow.platform };
   }
   const deviceToken = cookieRow.device_token;
   const cookieHash = cookieRow.hash;
 
   if (
     !verifyCookieHash(cookiePassword, cookieHash) ||
     cookieIsExpired(cookieRow.last_used)
   ) {
     return {
       type: 'invalidated',
       cookieName: cookieTypes.USER,
       cookieID,
       sessionParameterInfo,
       platformDetails,
       deviceToken,
     };
   }
   const userID = cookieRow.user.toString();
   const viewer = new Viewer({
     isSocket: sessionParameterInfo.isSocket,
     loggedIn: true,
     id: userID,
     platformDetails,
     deviceToken,
     userID,
     cookieID,
     cookiePassword,
     cookieHash,
     sessionIdentifierType: sessionParameterInfo.sessionIdentifierType,
     sessionID,
     sessionInfo,
     isScriptViewer: false,
     ipAddress: sessionParameterInfo.ipAddress,
     userAgent: sessionParameterInfo.userAgent,
   });
   return { type: 'valid', viewer };
 }
 
 async function fetchAnonymousViewer(
   cookie: string,
   sessionParameterInfo: SessionParameterInfo,
 ): Promise<FetchViewerResult> {
   const [cookieID, cookiePassword] = cookie.split(':');
   if (!cookieID || !cookiePassword) {
     return {
       type: 'nonexistant',
       cookieName: cookieTypes.ANONYMOUS,
       sessionParameterInfo,
     };
   }
 
   const query = SQL`
     SELECT last_used, hash, platform, device_token, versions
     FROM cookies
     WHERE id = ${cookieID} AND user IS NULL
   `;
   const [[result], allSessionInfo] = await Promise.all([
     dbQuery(query),
     fetchSessionInfo(sessionParameterInfo, cookieID),
   ]);
   if (result.length === 0) {
     return {
       type: 'nonexistant',
       cookieName: cookieTypes.ANONYMOUS,
       sessionParameterInfo,
     };
   }
 
   let sessionID = null,
     sessionInfo = null;
   if (allSessionInfo) {
     ({ sessionID, ...sessionInfo } = allSessionInfo);
   }
 
   const cookieRow = result[0];
   let platformDetails = null;
   if (cookieRow.platform && cookieRow.versions) {
     const versions = JSON.parse(cookieRow.versions);
     platformDetails = {
       platform: cookieRow.platform,
       codeVersion: versions.codeVersion,
       stateVersion: versions.stateVersion,
     };
   } else if (cookieRow.platform) {
     platformDetails = { platform: cookieRow.platform };
   }
   const deviceToken = cookieRow.device_token;
   const cookieHash = cookieRow.hash;
 
   if (
     !verifyCookieHash(cookiePassword, cookieHash) ||
     cookieIsExpired(cookieRow.last_used)
   ) {
     return {
       type: 'invalidated',
       cookieName: cookieTypes.ANONYMOUS,
       cookieID,
       sessionParameterInfo,
       platformDetails,
       deviceToken,
     };
   }
   const viewer = new Viewer({
     isSocket: sessionParameterInfo.isSocket,
     loggedIn: false,
     id: cookieID,
     platformDetails,
     deviceToken,
     cookieID,
     cookiePassword,
     cookieHash,
     sessionIdentifierType: sessionParameterInfo.sessionIdentifierType,
     sessionID,
     sessionInfo,
     isScriptViewer: false,
     ipAddress: sessionParameterInfo.ipAddress,
     userAgent: sessionParameterInfo.userAgent,
   });
   return { type: 'valid', viewer };
 }
 
 type SessionInfo = {
   +sessionID: ?string,
   +lastValidated: number,
   +lastUpdate: number,
   +calendarQuery: CalendarQuery,
 };
 async function fetchSessionInfo(
   sessionParameterInfo: SessionParameterInfo,
   cookieID: string,
 ): Promise<?SessionInfo> {
   const { sessionID } = sessionParameterInfo;
   const session = sessionID !== undefined ? sessionID : cookieID;
   if (!session) {
     return null;
   }
   const query = SQL`
     SELECT query, last_validated, last_update
     FROM sessions
     WHERE id = ${session} AND cookie = ${cookieID}
   `;
   const [result] = await dbQuery(query);
   if (result.length === 0) {
     return null;
   }
   return {
     sessionID,
     lastValidated: result[0].last_validated,
     lastUpdate: result[0].last_update,
     calendarQuery: JSON.parse(result[0].query),
   };
 }
 
 async function fetchViewerFromRequestBody(
   body: mixed,
   sessionParameterInfo: SessionParameterInfo,
 ): Promise<FetchViewerResult> {
   if (!body || typeof body !== 'object') {
     return {
       type: 'nonexistant',
       cookieName: null,
       sessionParameterInfo,
     };
   }
   const cookiePair = body.cookie;
   if (cookiePair === null || cookiePair === '') {
     return {
       type: 'nonexistant',
       cookieName: null,
       sessionParameterInfo,
     };
   }
   if (!cookiePair || typeof cookiePair !== 'string') {
     return {
       type: 'nonexistant',
       cookieName: null,
       sessionParameterInfo,
     };
   }
   const [type, cookie] = cookiePair.split('=');
   if (type === cookieTypes.USER && cookie) {
     return await fetchUserViewer(cookie, sessionParameterInfo);
   } else if (type === cookieTypes.ANONYMOUS && cookie) {
     return await fetchAnonymousViewer(cookie, sessionParameterInfo);
   }
   return {
     type: 'nonexistant',
     cookieName: null,
     sessionParameterInfo,
   };
 }
 
 function getRequestIPAddress(req: $Request) {
   const { proxy } = getAppURLFactsFromRequestURL(req.originalUrl);
   let ipAddress;
   if (proxy === 'none') {
     ipAddress = req.socket.remoteAddress;
   } else if (proxy === 'apache') {
     ipAddress = req.get('X-Forwarded-For');
   }
   invariant(ipAddress, 'could not determine requesting IP address');
   return ipAddress;
 }
 
 function getSessionParameterInfoFromRequestBody(
   req: $Request,
 ): SessionParameterInfo {
   const body = (req.body: any);
   let sessionID =
     body.sessionID !== undefined || req.method !== 'GET'
       ? body.sessionID
       : null;
   if (sessionID === '') {
     sessionID = null;
   }
   const sessionIdentifierType =
     req.method === 'GET' || sessionID !== undefined
       ? sessionIdentifierTypes.BODY_SESSION_ID
       : sessionIdentifierTypes.COOKIE_ID;
   return {
     isSocket: false,
     sessionID,
     sessionIdentifierType,
     ipAddress: getRequestIPAddress(req),
     userAgent: req.get('User-Agent'),
   };
 }
 
 async function fetchViewerForJSONRequest(req: $Request): Promise<Viewer> {
   assertSecureRequest(req);
   const sessionParameterInfo = getSessionParameterInfoFromRequestBody(req);
   const result = await fetchViewerFromRequestBody(
     req.body,
     sessionParameterInfo,
   );
   return await handleFetchViewerResult(result);
 }
 
 async function fetchViewerForSocket(
   req: $Request,
   clientMessage: InitialClientSocketMessage,
 ): Promise<Viewer> {
   assertSecureRequest(req);
   const { sessionIdentification } = clientMessage.payload;
   const { sessionID } = sessionIdentification;
   const sessionParameterInfo = {
     isSocket: true,
     sessionID,
     sessionIdentifierType:
       sessionID !== undefined
         ? sessionIdentifierTypes.BODY_SESSION_ID
         : sessionIdentifierTypes.COOKIE_ID,
     ipAddress: getRequestIPAddress(req),
     userAgent: req.get('User-Agent'),
   };
 
   const result = await fetchViewerFromRequestBody(
     clientMessage.payload.sessionIdentification,
     sessionParameterInfo,
   );
   if (result.type === 'valid') {
     return result.viewer;
   }
 
   const anonymousViewerDataPromise: Promise<AnonymousViewerData> =
     (async () => {
       const platformDetails =
         result.type === 'invalidated' ? result.platformDetails : null;
       const deviceToken =
         result.type === 'invalidated' ? result.deviceToken : null;
       return await createNewAnonymousCookie({
         platformDetails,
         deviceToken,
       });
     })();
   const deleteCookiePromise = (async () => {
     if (result.type === 'invalidated') {
       await deleteCookie(result.cookieID);
     }
   })();
   const [anonymousViewerData] = await Promise.all([
     anonymousViewerDataPromise,
     deleteCookiePromise,
   ]);
 
   return createViewerForInvalidFetchViewerResult(result, anonymousViewerData);
 }
 
 async function handleFetchViewerResult(
   result: FetchViewerResult,
   inputPlatformDetails?: PlatformDetails,
 ) {
   if (result.type === 'valid') {
     return result.viewer;
   }
 
-  let platformDetails = inputPlatformDetails;
+  let platformDetails: ?PlatformDetails = inputPlatformDetails;
   if (!platformDetails && result.type === 'invalidated') {
     platformDetails = result.platformDetails;
   }
   const deviceToken = result.type === 'invalidated' ? result.deviceToken : null;
 
   const [anonymousViewerData] = await Promise.all([
     createNewAnonymousCookie({ platformDetails, deviceToken }),
     result.type === 'invalidated' ? deleteCookie(result.cookieID) : null,
   ]);
 
   return createViewerForInvalidFetchViewerResult(result, anonymousViewerData);
 }
 
 function createViewerForInvalidFetchViewerResult(
   result: InvalidFetchViewerResult,
   anonymousViewerData: AnonymousViewerData,
 ): Viewer {
   const viewer = new Viewer({
     ...anonymousViewerData,
     sessionIdentifierType: result.sessionParameterInfo.sessionIdentifierType,
     isSocket: result.sessionParameterInfo.isSocket,
     ipAddress: result.sessionParameterInfo.ipAddress,
     userAgent: result.sessionParameterInfo.userAgent,
   });
   viewer.sessionChanged = true;
 
   // If cookieName is falsey, that tells us that there was no cookie specified
   // in the request, which means we can't be invalidating anything.
   if (result.cookieName) {
     viewer.cookieInvalidated = true;
     viewer.initialCookieName = result.cookieName;
   }
 
   return viewer;
 }
 
 function addSessionChangeInfoToResult(
   viewer: Viewer,
   res: $Response,
   result: Object,
 ) {
   let threadInfos = {},
     userInfos = {};
   if (result.cookieChange) {
     ({ threadInfos, userInfos } = result.cookieChange);
   }
   let sessionChange;
   if (viewer.cookieInvalidated) {
     sessionChange = ({
       cookieInvalidated: true,
       threadInfos,
       userInfos: (values(userInfos).map(a => a): UserInfo[]),
       currentUserInfo: {
         anonymous: true,
       },
     }: ServerSessionChange);
   } else {
     sessionChange = ({
       cookieInvalidated: false,
       threadInfos,
       userInfos: (values(userInfos).map(a => a): UserInfo[]),
     }: ServerSessionChange);
   }
   sessionChange.cookie = viewer.cookiePairString;
   if (viewer.sessionIdentifierType === sessionIdentifierTypes.BODY_SESSION_ID) {
     sessionChange.sessionID = viewer.sessionID ? viewer.sessionID : null;
   }
   result.cookieChange = sessionChange;
 }
 
 type AnonymousCookieCreationParams = Shape<{
   +platformDetails: ?PlatformDetails,
   +deviceToken: ?string,
 }>;
 const defaultPlatformDetails = {};
 
 // The result of this function should not be passed directly to the Viewer
 // constructor. Instead, it should be passed to viewer.setNewCookie. There are
 // several fields on AnonymousViewerData that are not set by this function:
 // sessionIdentifierType, ipAddress, and userAgent. These parameters all depend
 // on the initial request. If the result of this function is passed to the
 // Viewer constructor directly, the resultant Viewer object will throw whenever
 // anybody attempts to access the relevant properties.
 async function createNewAnonymousCookie(
   params: AnonymousCookieCreationParams,
 ): Promise<AnonymousViewerData> {
   const { platformDetails, deviceToken } = params;
   const { platform, ...versions } = platformDetails || defaultPlatformDetails;
   const versionsString =
     Object.keys(versions).length > 0 ? JSON.stringify(versions) : null;
 
   const time = Date.now();
   const cookiePassword = crypto.randomBytes(32).toString('hex');
   const cookieHash = getCookieHash(cookiePassword);
   const [[id]] = await Promise.all([
     createIDs('cookies', 1),
     deviceToken ? clearDeviceToken(deviceToken) : undefined,
   ]);
 
   const cookieRow = [
     id,
     cookieHash,
     null,
     platform,
     time,
     time,
     deviceToken,
     versionsString,
   ];
   const query = SQL`
     INSERT INTO cookies(id, hash, user, platform, creation_time, last_used,
       device_token, versions)
     VALUES ${[cookieRow]}
   `;
   await dbQuery(query);
   return {
     loggedIn: false,
     id,
     platformDetails,
     deviceToken,
     cookieID: id,
     cookiePassword,
     cookieHash,
     sessionID: undefined,
     sessionInfo: null,
     cookieInsertedThisRequest: true,
     isScriptViewer: false,
   };
 }
 
 type UserCookieCreationParams = {
   +platformDetails: PlatformDetails,
   +deviceToken?: ?string,
   +socialProof?: ?SIWESocialProof,
   +signedIdentityKeysBlob?: ?SignedIdentityKeysBlob,
 };
 
 // The result of this function should never be passed directly to the Viewer
 // constructor. Instead, it should be passed to viewer.setNewCookie. There are
 // several fields on UserViewerData that are not set by this function:
 // sessionID, sessionIdentifierType, and ipAddress. These parameters all depend
 // on the initial request. If the result of this function is passed to the
 // Viewer constructor directly, the resultant Viewer object will throw whenever
 // anybody attempts to access the relevant properties.
 async function createNewUserCookie(
   userID: string,
   params: UserCookieCreationParams,
 ): Promise<UserViewerData> {
   const { platformDetails, deviceToken, socialProof, signedIdentityKeysBlob } =
     params;
   const { platform, ...versions } = platformDetails || defaultPlatformDetails;
   const versionsString =
     Object.keys(versions).length > 0 ? JSON.stringify(versions) : null;
 
   const time = Date.now();
   const cookiePassword = crypto.randomBytes(32).toString('hex');
   const cookieHash = getCookieHash(cookiePassword);
   const [[cookieID]] = await Promise.all([
     createIDs('cookies', 1),
     deviceToken ? clearDeviceToken(deviceToken) : undefined,
   ]);
 
   const cookieRow = [
     cookieID,
     cookieHash,
     userID,
     platform,
     time,
     time,
     deviceToken,
     versionsString,
     JSON.stringify(socialProof),
     signedIdentityKeysBlob ? JSON.stringify(signedIdentityKeysBlob) : null,
   ];
   const query = SQL`
     INSERT INTO cookies(id, hash, user, platform, creation_time, last_used,
       device_token, versions, social_proof, signed_identity_keys)
     VALUES ${[cookieRow]}
   `;
   await dbQuery(query);
   return {
     loggedIn: true,
     id: userID,
     platformDetails,
     deviceToken,
     userID,
     cookieID,
     sessionID: undefined,
     sessionInfo: null,
     cookiePassword,
     cookieHash,
     cookieInsertedThisRequest: true,
     isScriptViewer: false,
   };
 }
 
 // This gets called after createNewUserCookie and from websiteResponder. If the
 // Viewer's sessionIdentifierType is COOKIE_ID then the cookieID is used as the
 // session identifier; otherwise, a new ID is created for the session.
 async function setNewSession(
   viewer: Viewer,
   calendarQuery: CalendarQuery,
   initialLastUpdate: number,
 ): Promise<void> {
   if (viewer.sessionIdentifierType !== sessionIdentifierTypes.COOKIE_ID) {
     const [sessionID] = await createIDs('sessions', 1);
     viewer.setSessionID(sessionID);
   }
   await createSession(viewer, calendarQuery, initialLastUpdate);
 }
 
 async function updateCookie(viewer: Viewer) {
   const time = Date.now();
   const { cookieID, cookieHash, cookiePassword } = viewer;
 
-  const updateObj = {};
+  const updateObj: { [string]: string | number } = {};
   updateObj.last_used = time;
   if (isBcryptHash(cookieHash)) {
     updateObj.hash = getCookieHash(cookiePassword);
   }
   const query = SQL`
     UPDATE cookies SET ${updateObj} WHERE id = ${cookieID}
   `;
   await dbQuery(query);
 }
 
 function addCookieToJSONResponse(
   viewer: Viewer,
   res: $Response,
   result: Object,
   expectCookieInvalidation: boolean,
 ) {
   if (expectCookieInvalidation) {
     viewer.cookieInvalidated = false;
   }
   if (!viewer.getData().cookieInsertedThisRequest) {
     handleAsyncPromise(updateCookie(viewer));
   }
   if (viewer.sessionChanged) {
     addSessionChangeInfoToResult(viewer, res, result);
   }
 }
 
 function addCookieToHomeResponse(
   req: $Request,
   res: $Response,
   appURLFacts: AppURLFacts,
 ) {
   const { user, anonymous } = req.cookies;
   if (user) {
     res.cookie(cookieTypes.USER, user, getCookieOptions(appURLFacts));
   }
   if (anonymous) {
     res.cookie(cookieTypes.ANONYMOUS, anonymous, getCookieOptions(appURLFacts));
   }
 }
 
 function getCookieOptions(appURLFacts: AppURLFacts) {
   const { baseDomain, basePath, https } = appURLFacts;
   const domainAsURL = new url.URL(baseDomain);
   return {
     domain: domainAsURL.hostname,
     path: basePath,
     httpOnly: false,
     secure: https,
     maxAge: cookieLifetime,
     sameSite: 'Strict',
   };
 }
 
 async function setCookieSignedIdentityKeysBlob(
   cookieID: string,
   signedIdentityKeysBlob: SignedIdentityKeysBlob,
 ) {
   const signedIdentityKeysStr = JSON.stringify(signedIdentityKeysBlob);
   const query = SQL`
     UPDATE cookies 
     SET signed_identity_keys = ${signedIdentityKeysStr}
     WHERE id = ${cookieID}
   `;
   await dbQuery(query);
 }
 
 // Returns `true` if row with `id = cookieID` exists AND
 // `signed_identity_keys` is `NULL`. Otherwise, returns `false`.
 async function isCookieMissingSignedIdentityKeysBlob(
   cookieID: string,
 ): Promise<boolean> {
   const query = SQL`
     SELECT signed_identity_keys
     FROM cookies 
     WHERE id = ${cookieID}
   `;
   const [queryResult] = await dbQuery(query);
   return (
     queryResult.length === 1 && queryResult[0].signed_identity_keys === null
   );
 }
 
 async function isCookieMissingOlmNotificationsSession(
   viewer: Viewer,
 ): Promise<boolean> {
   const isStaffOrDev = isStaff(viewer.userID) || isDev;
   if (
     !viewer.platformDetails ||
     (viewer.platformDetails.platform !== 'ios' &&
       viewer.platformDetails.platform !== 'android' &&
       !(viewer.platformDetails.platform === 'web' && isStaffOrDev)) ||
     !hasMinCodeVersion(viewer.platformDetails, {
       native: 222,
       web: 43,
     })
   ) {
     return false;
   }
   const query = SQL`
     SELECT COUNT(*) AS count
     FROM olm_sessions
     WHERE cookie_id = ${viewer.cookieID} AND is_content = FALSE
   `;
   const [queryResult] = await dbQuery(query);
   return queryResult[0].count === 0;
 }
 
 async function setCookiePlatform(
   viewer: Viewer,
   platform: Platform,
 ): Promise<void> {
   const newPlatformDetails = { ...viewer.platformDetails, platform };
   viewer.setPlatformDetails(newPlatformDetails);
   const query = SQL`
     UPDATE cookies
     SET platform = ${platform}
     WHERE id = ${viewer.cookieID}
   `;
   await dbQuery(query);
 }
 
 async function setCookiePlatformDetails(
   viewer: Viewer,
   platformDetails: PlatformDetails,
 ): Promise<void> {
   viewer.setPlatformDetails(platformDetails);
   const { platform, ...versions } = platformDetails;
   const versionsString =
     Object.keys(versions).length > 0 ? JSON.stringify(versions) : null;
   const query = SQL`
     UPDATE cookies
     SET platform = ${platform}, versions = ${versionsString}
     WHERE id = ${viewer.cookieID}
   `;
   await dbQuery(query);
 }
 
 export {
   fetchViewerForJSONRequest,
   fetchViewerForSocket,
   createNewAnonymousCookie,
   createNewUserCookie,
   setNewSession,
   updateCookie,
   addCookieToJSONResponse,
   addCookieToHomeResponse,
   setCookieSignedIdentityKeysBlob,
   isCookieMissingSignedIdentityKeysBlob,
   setCookiePlatform,
   setCookiePlatformDetails,
   isCookieMissingOlmNotificationsSession,
 };
diff --git a/keyserver/src/socket/socket.js b/keyserver/src/socket/socket.js
index 032153e4a..773858d27 100644
--- a/keyserver/src/socket/socket.js
+++ b/keyserver/src/socket/socket.js
@@ -1,885 +1,885 @@
 // @flow
 
 import type { $Request } from 'express';
 import invariant from 'invariant';
 import _debounce from 'lodash/debounce.js';
 import t from 'tcomb';
 import type { TUnion } from 'tcomb';
 import WebSocket from 'ws';
 
 import { baseLegalPolicies } from 'lib/facts/policies.js';
 import { mostRecentMessageTimestamp } from 'lib/shared/message-utils.js';
 import { isStaff } from 'lib/shared/staff-utils.js';
 import {
   serverRequestSocketTimeout,
   serverResponseTimeout,
 } from 'lib/shared/timeouts.js';
 import { mostRecentUpdateTimestamp } from 'lib/shared/update-utils.js';
 import { hasMinCodeVersion } from 'lib/shared/version-utils.js';
 import type { Shape } from 'lib/types/core.js';
 import { endpointIsSocketSafe } from 'lib/types/endpoints.js';
 import type { RawEntryInfo } from 'lib/types/entry-types.js';
 import { defaultNumberPerThread } from 'lib/types/message-types.js';
 import { redisMessageTypes, type RedisMessage } from 'lib/types/redis-types.js';
 import { serverRequestTypes } from 'lib/types/request-types.js';
 import {
   sessionCheckFrequency,
   stateCheckInactivityActivationInterval,
 } from 'lib/types/session-types.js';
 import {
   type ClientSocketMessage,
   type InitialClientSocketMessage,
   type ResponsesClientSocketMessage,
   type ServerStateSyncFullSocketPayload,
   type ServerServerSocketMessage,
   type ErrorServerSocketMessage,
   type AuthErrorServerSocketMessage,
   type PingClientSocketMessage,
   type AckUpdatesClientSocketMessage,
   type APIRequestClientSocketMessage,
   clientSocketMessageTypes,
   stateSyncPayloadTypes,
   serverSocketMessageTypes,
   serverServerSocketMessageValidator,
 } from 'lib/types/socket-types.js';
 import type { RawThreadInfos } from 'lib/types/thread-types.js';
 import type { UserInfo, CurrentUserInfo } from 'lib/types/user-types.js';
 import { ServerError } from 'lib/utils/errors.js';
 import { values } from 'lib/utils/objects.js';
 import { promiseAll } from 'lib/utils/promises.js';
 import SequentialPromiseResolver from 'lib/utils/sequential-promise-resolver.js';
 import sleep from 'lib/utils/sleep.js';
 import { tShape, tCookie } from 'lib/utils/validation-utils.js';
 
 import { RedisSubscriber } from './redis.js';
 import {
   clientResponseInputValidator,
   processClientResponses,
   initializeSession,
   checkState,
 } from './session-utils.js';
 import { fetchUpdateInfosWithRawUpdateInfos } from '../creators/update-creator.js';
 import { deleteActivityForViewerSession } from '../deleters/activity-deleters.js';
 import { deleteCookie } from '../deleters/cookie-deleters.js';
 import { deleteUpdatesBeforeTimeTargetingSession } from '../deleters/update-deleters.js';
 import { jsonEndpoints } from '../endpoints.js';
 import {
   fetchMessageInfosSince,
   getMessageFetchResultFromRedisMessages,
 } from '../fetchers/message-fetchers.js';
 import { fetchUpdateInfos } from '../fetchers/update-fetchers.js';
 import {
   newEntryQueryInputValidator,
   verifyCalendarQueryThreadIDs,
 } from '../responders/entry-responders.js';
 import { handleAsyncPromise } from '../responders/handlers.js';
 import {
   fetchViewerForSocket,
   updateCookie,
   isCookieMissingSignedIdentityKeysBlob,
   isCookieMissingOlmNotificationsSession,
   createNewAnonymousCookie,
 } from '../session/cookies.js';
 import { Viewer } from '../session/viewer.js';
 import type { AnonymousViewerData } from '../session/viewer.js';
 import { serverStateSyncSpecs } from '../shared/state-sync/state-sync-specs.js';
 import { commitSessionUpdate } from '../updaters/session-updaters.js';
 import { compressMessage } from '../utils/compress.js';
 import { assertSecureRequest } from '../utils/security-utils.js';
 import {
   checkInputValidator,
   checkClientSupported,
   policiesValidator,
   validateOutput,
 } from '../utils/validation-utils.js';
 
 const clientSocketMessageInputValidator: TUnion<ClientSocketMessage> = t.union([
   tShape({
     type: t.irreducible(
       'clientSocketMessageTypes.INITIAL',
       x => x === clientSocketMessageTypes.INITIAL,
     ),
     id: t.Number,
     payload: tShape({
       sessionIdentification: tShape({
         cookie: t.maybe(tCookie),
         sessionID: t.maybe(t.String),
       }),
       sessionState: tShape({
         calendarQuery: newEntryQueryInputValidator,
         messagesCurrentAsOf: t.Number,
         updatesCurrentAsOf: t.Number,
         watchedIDs: t.list(t.String),
       }),
       clientResponses: t.list(clientResponseInputValidator),
     }),
   }),
   tShape({
     type: t.irreducible(
       'clientSocketMessageTypes.RESPONSES',
       x => x === clientSocketMessageTypes.RESPONSES,
     ),
     id: t.Number,
     payload: tShape({
       clientResponses: t.list(clientResponseInputValidator),
     }),
   }),
   tShape({
     type: t.irreducible(
       'clientSocketMessageTypes.PING',
       x => x === clientSocketMessageTypes.PING,
     ),
     id: t.Number,
   }),
   tShape({
     type: t.irreducible(
       'clientSocketMessageTypes.ACK_UPDATES',
       x => x === clientSocketMessageTypes.ACK_UPDATES,
     ),
     id: t.Number,
     payload: tShape({
       currentAsOf: t.Number,
     }),
   }),
   tShape({
     type: t.irreducible(
       'clientSocketMessageTypes.API_REQUEST',
       x => x === clientSocketMessageTypes.API_REQUEST,
     ),
     id: t.Number,
     payload: tShape({
       endpoint: t.String,
       input: t.maybe(t.Object),
     }),
   }),
 ]);
 
 function onConnection(ws: WebSocket, req: $Request) {
   assertSecureRequest(req);
   new Socket(ws, req);
 }
 
 type StateCheckConditions = {
   activityRecentlyOccurred: boolean,
   stateCheckOngoing: boolean,
 };
 
 const minVersionsForCompression = {
   native: 265,
   web: 30,
 };
 
 class Socket {
   ws: WebSocket;
   httpRequest: $Request;
   viewer: ?Viewer;
   redis: ?RedisSubscriber;
   redisPromiseResolver: SequentialPromiseResolver<ServerServerSocketMessage>;
 
   stateCheckConditions: StateCheckConditions = {
     activityRecentlyOccurred: true,
     stateCheckOngoing: false,
   };
   stateCheckTimeoutID: ?TimeoutID;
 
   constructor(ws: WebSocket, httpRequest: $Request) {
     this.ws = ws;
     this.httpRequest = httpRequest;
     ws.on('message', this.onMessage);
     ws.on('close', this.onClose);
     this.resetTimeout();
     this.redisPromiseResolver = new SequentialPromiseResolver(this.sendMessage);
   }
 
   onMessage = async (
     messageString: string | Buffer | ArrayBuffer | Array<Buffer>,
   ) => {
     invariant(typeof messageString === 'string', 'message should be string');
     let clientSocketMessage: ?ClientSocketMessage;
     try {
       this.resetTimeout();
       const messageObject = JSON.parse(messageString);
       clientSocketMessage = checkInputValidator(
         clientSocketMessageInputValidator,
         messageObject,
       );
       if (clientSocketMessage.type === clientSocketMessageTypes.INITIAL) {
         if (this.viewer) {
           // This indicates that the user sent multiple INITIAL messages.
           throw new ServerError('socket_already_initialized');
         }
         this.viewer = await fetchViewerForSocket(
           this.httpRequest,
           clientSocketMessage,
         );
       }
       const { viewer } = this;
       if (!viewer) {
         // This indicates a non-INITIAL message was sent by the client before
         // the INITIAL message.
         throw new ServerError('socket_uninitialized');
       }
       if (viewer.sessionChanged) {
         // This indicates that the cookie was invalid, and we've assigned a new
         // anonymous one.
         throw new ServerError('socket_deauthorized');
       }
       if (!viewer.loggedIn) {
         // This indicates that the specified cookie was an anonymous one.
         throw new ServerError('not_logged_in');
       }
       await checkClientSupported(
         viewer,
         clientSocketMessageInputValidator,
         clientSocketMessage,
       );
       await policiesValidator(viewer, baseLegalPolicies);
 
       const serverResponses = await this.handleClientSocketMessage(
         clientSocketMessage,
       );
       if (!this.redis) {
         this.redis = new RedisSubscriber(
           { userID: viewer.userID, sessionID: viewer.session },
           this.onRedisMessage,
         );
       }
       if (viewer.sessionChanged) {
         // This indicates that something has caused the session to change, which
         // shouldn't happen from inside a WebSocket since we can't handle cookie
         // invalidation.
         throw new ServerError('session_mutated_from_socket');
       }
       if (clientSocketMessage.type !== clientSocketMessageTypes.PING) {
         handleAsyncPromise(updateCookie(viewer));
       }
       for (const response of serverResponses) {
         // Normally it's an anti-pattern to await in sequence like this. But in
         // this case, we have a requirement that this array of serverResponses
         // is delivered in order. See here:
         // https://github.com/CommE2E/comm/blob/101eb34481deb49c609bfd2c785f375886e52666/keyserver/src/socket/socket.js#L566-L568
         await this.sendMessage(response);
       }
       if (clientSocketMessage.type === clientSocketMessageTypes.INITIAL) {
         this.onSuccessfulConnection();
       }
     } catch (error) {
       console.warn(error);
       if (!(error instanceof ServerError)) {
         const errorMessage: ErrorServerSocketMessage = {
           type: serverSocketMessageTypes.ERROR,
           message: error.message,
         };
         const responseTo = clientSocketMessage ? clientSocketMessage.id : null;
         if (responseTo !== null) {
           errorMessage.responseTo = responseTo;
         }
         this.markActivityOccurred();
         await this.sendMessage(errorMessage);
         return;
       }
       invariant(clientSocketMessage, 'should be set');
       const responseTo = clientSocketMessage.id;
       if (error.message === 'socket_deauthorized') {
         invariant(this.viewer, 'should be set');
         const authErrorMessage: AuthErrorServerSocketMessage = {
           type: serverSocketMessageTypes.AUTH_ERROR,
           responseTo,
           message: error.message,
           sessionChange: {
             cookie: this.viewer.cookiePairString,
             currentUserInfo: {
               anonymous: true,
             },
           },
         };
 
         await this.sendMessage(authErrorMessage);
         this.ws.close(4100, error.message);
         return;
       } else if (error.message === 'client_version_unsupported') {
         const { viewer } = this;
         invariant(viewer, 'should be set');
 
         const anonymousViewerDataPromise: Promise<AnonymousViewerData> =
           createNewAnonymousCookie({
             platformDetails: error.platformDetails,
             deviceToken: viewer.deviceToken,
           });
         const deleteCookiePromise = deleteCookie(viewer.cookieID);
         const [anonymousViewerData] = await Promise.all([
           anonymousViewerDataPromise,
           deleteCookiePromise,
         ]);
 
         // It is normally not safe to pass the result of
         // createNewAnonymousCookie to the Viewer constructor. That is because
         // createNewAnonymousCookie leaves several fields of
         // AnonymousViewerData unset, and consequently Viewer will throw when
         // access is attempted. It is only safe here because we can guarantee
         // that only cookiePairString and cookieID are accessed on anonViewer
         // below.
         const anonViewer = new Viewer(anonymousViewerData);
         const authErrorMessage: AuthErrorServerSocketMessage = {
           type: serverSocketMessageTypes.AUTH_ERROR,
           responseTo,
           message: error.message,
           sessionChange: {
             cookie: anonViewer.cookiePairString,
             currentUserInfo: {
               anonymous: true,
             },
           },
         };
         await this.sendMessage(authErrorMessage);
         this.ws.close(4101, error.message);
         return;
       }
       if (error.payload) {
         await this.sendMessage({
           type: serverSocketMessageTypes.ERROR,
           responseTo,
           message: error.message,
           payload: error.payload,
         });
       } else {
         await this.sendMessage({
           type: serverSocketMessageTypes.ERROR,
           responseTo,
           message: error.message,
         });
       }
       if (error.message === 'not_logged_in') {
         this.ws.close(4102, error.message);
       } else if (error.message === 'session_mutated_from_socket') {
         this.ws.close(4103, error.message);
       } else {
         this.markActivityOccurred();
       }
     }
   };
 
   onClose = async () => {
     this.clearStateCheckTimeout();
     this.resetTimeout.cancel();
     this.debouncedAfterActivity.cancel();
     if (this.viewer && this.viewer.hasSessionInfo) {
       await deleteActivityForViewerSession(this.viewer);
     }
     if (this.redis) {
       this.redis.quit();
       this.redis = null;
     }
   };
 
   sendMessage = async (message: ServerServerSocketMessage) => {
     invariant(
       this.ws.readyState > 0,
       "shouldn't send message until connection established",
     );
     if (this.ws.readyState !== 1) {
       return;
     }
 
     const { viewer } = this;
     const validatedMessage = validateOutput(
       viewer?.platformDetails,
       serverServerSocketMessageValidator,
       message,
     );
     const stringMessage = JSON.stringify(validatedMessage);
 
     if (
       !viewer?.platformDetails ||
       !hasMinCodeVersion(viewer.platformDetails, minVersionsForCompression) ||
       !isStaff(viewer.id)
     ) {
       this.ws.send(stringMessage);
       return;
     }
 
     const compressionResult = await compressMessage(stringMessage);
 
     if (this.ws.readyState !== 1) {
       return;
     }
 
     if (!compressionResult.compressed) {
       this.ws.send(stringMessage);
       return;
     }
 
     const compressedMessage = {
       type: serverSocketMessageTypes.COMPRESSED_MESSAGE,
       payload: compressionResult.result,
     };
 
     const validatedCompressedMessage = validateOutput(
       viewer?.platformDetails,
       serverServerSocketMessageValidator,
       compressedMessage,
     );
     const stringCompressedMessage = JSON.stringify(validatedCompressedMessage);
     this.ws.send(stringCompressedMessage);
   };
 
   async handleClientSocketMessage(
     message: ClientSocketMessage,
   ): Promise<ServerServerSocketMessage[]> {
     const resultPromise = (async () => {
       if (message.type === clientSocketMessageTypes.INITIAL) {
         this.markActivityOccurred();
         return await this.handleInitialClientSocketMessage(message);
       } else if (message.type === clientSocketMessageTypes.RESPONSES) {
         this.markActivityOccurred();
         return await this.handleResponsesClientSocketMessage(message);
       } else if (message.type === clientSocketMessageTypes.PING) {
         return this.handlePingClientSocketMessage(message);
       } else if (message.type === clientSocketMessageTypes.ACK_UPDATES) {
         this.markActivityOccurred();
         return await this.handleAckUpdatesClientSocketMessage(message);
       } else if (message.type === clientSocketMessageTypes.API_REQUEST) {
         this.markActivityOccurred();
         return await this.handleAPIRequestClientSocketMessage(message);
       }
       return [];
     })();
     const timeoutPromise = (async () => {
       await sleep(serverResponseTimeout);
       throw new ServerError('socket_response_timeout');
     })();
     return await Promise.race([resultPromise, timeoutPromise]);
   }
 
   async handleInitialClientSocketMessage(
     message: InitialClientSocketMessage,
   ): Promise<ServerServerSocketMessage[]> {
     const { viewer } = this;
     invariant(viewer, 'should be set');
 
-    const responses = [];
+    const responses: Array<ServerServerSocketMessage> = [];
 
     const { sessionState, clientResponses } = message.payload;
     const {
       calendarQuery,
       updatesCurrentAsOf: oldUpdatesCurrentAsOf,
       messagesCurrentAsOf: oldMessagesCurrentAsOf,
       watchedIDs,
     } = sessionState;
     await verifyCalendarQueryThreadIDs(calendarQuery);
 
     const sessionInitializationResult = await initializeSession(
       viewer,
       calendarQuery,
       oldUpdatesCurrentAsOf,
     );
 
-    const threadCursors = {};
+    const threadCursors: { [string]: null } = {};
     for (const watchedThreadID of watchedIDs) {
       threadCursors[watchedThreadID] = null;
     }
     const messageSelectionCriteria = {
       threadCursors,
       joinedThreads: true,
       newerThan: oldMessagesCurrentAsOf,
     };
     const [fetchMessagesResult, { serverRequests, activityUpdateResult }] =
       await Promise.all([
         fetchMessageInfosSince(
           viewer,
           messageSelectionCriteria,
           defaultNumberPerThread,
         ),
         processClientResponses(viewer, clientResponses),
       ]);
     const messagesResult = {
       rawMessageInfos: fetchMessagesResult.rawMessageInfos,
       truncationStatuses: fetchMessagesResult.truncationStatuses,
       currentAsOf: mostRecentMessageTimestamp(
         fetchMessagesResult.rawMessageInfos,
         oldMessagesCurrentAsOf,
       ),
     };
 
     const isCookieMissingSignedIdentityKeysBlobPromise =
       isCookieMissingSignedIdentityKeysBlob(viewer.cookieID);
 
     const isCookieMissingOlmNotificationsSessionPromise =
       isCookieMissingOlmNotificationsSession(viewer);
 
     if (!sessionInitializationResult.sessionContinued) {
       const promises: { +[string]: Promise<mixed> } = Object.fromEntries(
         values(serverStateSyncSpecs).map(spec => [
           spec.hashKey,
           spec.fetchFullSocketSyncPayload(viewer, [calendarQuery]),
         ]),
       );
       // We have a type error here because Flow doesn't know spec.hashKey
       const castPromises: {
         +threadInfos: Promise<RawThreadInfos>,
         +currentUserInfo: Promise<CurrentUserInfo>,
         +entryInfos: Promise<$ReadOnlyArray<RawEntryInfo>>,
         +userInfos: Promise<$ReadOnlyArray<UserInfo>>,
       } = (promises: any);
       const results = await promiseAll(castPromises);
       const payload: ServerStateSyncFullSocketPayload = {
         type: stateSyncPayloadTypes.FULL,
         messagesResult,
         threadInfos: results.threadInfos,
         currentUserInfo: results.currentUserInfo,
         rawEntryInfos: results.entryInfos,
         userInfos: results.userInfos,
         updatesCurrentAsOf: oldUpdatesCurrentAsOf,
       };
       if (viewer.sessionChanged) {
         // If initializeSession encounters,
         // sessionIdentifierTypes.BODY_SESSION_ID but the session
         // is unspecified or expired,
         // it will set a new sessionID and specify viewer.sessionChanged
         const { sessionID } = viewer;
         invariant(
           sessionID !== null && sessionID !== undefined,
           'should be set',
         );
         payload.sessionID = sessionID;
         viewer.sessionChanged = false;
       }
       responses.push({
         type: serverSocketMessageTypes.STATE_SYNC,
         responseTo: message.id,
         payload,
       });
     } else {
       const { sessionUpdate, deltaEntryInfoResult } =
         sessionInitializationResult;
 
       const promises = {};
       promises.deleteExpiredUpdates = deleteUpdatesBeforeTimeTargetingSession(
         viewer,
         oldUpdatesCurrentAsOf,
       );
       promises.fetchUpdateResult = fetchUpdateInfos(
         viewer,
         oldUpdatesCurrentAsOf,
         calendarQuery,
       );
       promises.sessionUpdate = commitSessionUpdate(viewer, sessionUpdate);
       const { fetchUpdateResult } = await promiseAll(promises);
 
       const { updateInfos, userInfos } = fetchUpdateResult;
       const newUpdatesCurrentAsOf = mostRecentUpdateTimestamp(
         [...updateInfos],
         oldUpdatesCurrentAsOf,
       );
       const updatesResult = {
         newUpdates: updateInfos,
         currentAsOf: newUpdatesCurrentAsOf,
       };
 
       responses.push({
         type: serverSocketMessageTypes.STATE_SYNC,
         responseTo: message.id,
         payload: {
           type: stateSyncPayloadTypes.INCREMENTAL,
           messagesResult,
           updatesResult,
           deltaEntryInfos: deltaEntryInfoResult.rawEntryInfos,
           deletedEntryIDs: deltaEntryInfoResult.deletedEntryIDs,
           userInfos: values(userInfos),
         },
       });
     }
 
     const [signedIdentityKeysBlobMissing, olmNotificationsSessionMissing] =
       await Promise.all([
         isCookieMissingSignedIdentityKeysBlobPromise,
         isCookieMissingOlmNotificationsSessionPromise,
       ]);
 
     if (signedIdentityKeysBlobMissing) {
       serverRequests.push({
         type: serverRequestTypes.SIGNED_IDENTITY_KEYS_BLOB,
       });
     }
 
     if (olmNotificationsSessionMissing) {
       serverRequests.push({
         type: serverRequestTypes.INITIAL_NOTIFICATIONS_ENCRYPTED_MESSAGE,
       });
     }
 
     if (serverRequests.length > 0 || clientResponses.length > 0) {
       // We send this message first since the STATE_SYNC triggers the client's
       // connection status to shift to "connected", and we want to make sure the
       // client responses are cleared from Redux before that happens
       responses.unshift({
         type: serverSocketMessageTypes.REQUESTS,
         responseTo: message.id,
         payload: { serverRequests },
       });
     }
 
     if (activityUpdateResult) {
       // Same reason for unshifting as above
       responses.unshift({
         type: serverSocketMessageTypes.ACTIVITY_UPDATE_RESPONSE,
         responseTo: message.id,
         payload: activityUpdateResult,
       });
     }
 
     return responses;
   }
 
   async handleResponsesClientSocketMessage(
     message: ResponsesClientSocketMessage,
   ): Promise<ServerServerSocketMessage[]> {
     const { viewer } = this;
     invariant(viewer, 'should be set');
 
     const { clientResponses } = message.payload;
     const { stateCheckStatus } = await processClientResponses(
       viewer,
       clientResponses,
     );
 
     const serverRequests = [];
     if (stateCheckStatus && stateCheckStatus.status !== 'state_check') {
       const { sessionUpdate, checkStateRequest } = await checkState(
         viewer,
         stateCheckStatus,
       );
       if (sessionUpdate) {
         await commitSessionUpdate(viewer, sessionUpdate);
         this.setStateCheckConditions({ stateCheckOngoing: false });
       }
       if (checkStateRequest) {
         serverRequests.push(checkStateRequest);
       }
     }
 
     // We send a response message regardless of whether we have any requests,
     // since we need to ack the client's responses
     return [
       {
         type: serverSocketMessageTypes.REQUESTS,
         responseTo: message.id,
         payload: { serverRequests },
       },
     ];
   }
 
   handlePingClientSocketMessage(
     message: PingClientSocketMessage,
   ): ServerServerSocketMessage[] {
     return [
       {
         type: serverSocketMessageTypes.PONG,
         responseTo: message.id,
       },
     ];
   }
 
   async handleAckUpdatesClientSocketMessage(
     message: AckUpdatesClientSocketMessage,
   ): Promise<ServerServerSocketMessage[]> {
     const { viewer } = this;
     invariant(viewer, 'should be set');
     const { currentAsOf } = message.payload;
     await Promise.all([
       deleteUpdatesBeforeTimeTargetingSession(viewer, currentAsOf),
       commitSessionUpdate(viewer, { lastUpdate: currentAsOf }),
     ]);
     return [];
   }
 
   async handleAPIRequestClientSocketMessage(
     message: APIRequestClientSocketMessage,
   ): Promise<ServerServerSocketMessage[]> {
     if (!endpointIsSocketSafe(message.payload.endpoint)) {
       throw new ServerError('endpoint_unsafe_for_socket');
     }
     const { viewer } = this;
     invariant(viewer, 'should be set');
     const responder = jsonEndpoints[message.payload.endpoint];
     await policiesValidator(viewer, responder.requiredPolicies);
     const response = await responder.responder(viewer, message.payload.input);
     return [
       {
         type: serverSocketMessageTypes.API_RESPONSE,
         responseTo: message.id,
         payload: response,
       },
     ];
   }
 
   onRedisMessage = async (message: RedisMessage) => {
     try {
       await this.processRedisMessage(message);
     } catch (e) {
       console.warn(e);
     }
   };
 
   async processRedisMessage(message: RedisMessage) {
     if (message.type === redisMessageTypes.START_SUBSCRIPTION) {
       this.ws.terminate();
     } else if (message.type === redisMessageTypes.NEW_UPDATES) {
       const { viewer } = this;
       invariant(viewer, 'should be set');
       if (message.ignoreSession && message.ignoreSession === viewer.session) {
         return;
       }
       const rawUpdateInfos = message.updates;
       this.redisPromiseResolver.add(
         (async () => {
           const { updateInfos, userInfos } =
             await fetchUpdateInfosWithRawUpdateInfos(rawUpdateInfos, {
               viewer,
             });
           if (updateInfos.length === 0) {
             console.warn(
               'could not get any UpdateInfos from redisMessageTypes.NEW_UPDATES',
             );
             return null;
           }
           this.markActivityOccurred();
           return {
             type: serverSocketMessageTypes.UPDATES,
             payload: {
               updatesResult: {
                 currentAsOf: mostRecentUpdateTimestamp([...updateInfos], 0),
                 newUpdates: updateInfos,
               },
               userInfos: values(userInfos),
             },
           };
         })(),
       );
     } else if (message.type === redisMessageTypes.NEW_MESSAGES) {
       const { viewer } = this;
       invariant(viewer, 'should be set');
       const rawMessageInfos = message.messages;
       const messageFetchResult = getMessageFetchResultFromRedisMessages(
         viewer,
         rawMessageInfos,
       );
       if (messageFetchResult.rawMessageInfos.length === 0) {
         console.warn(
           'could not get any rawMessageInfos from ' +
             'redisMessageTypes.NEW_MESSAGES',
         );
         return;
       }
       this.redisPromiseResolver.add(
         (async () => {
           this.markActivityOccurred();
           return {
             type: serverSocketMessageTypes.MESSAGES,
             payload: {
               messagesResult: {
                 rawMessageInfos: messageFetchResult.rawMessageInfos,
                 truncationStatuses: messageFetchResult.truncationStatuses,
                 currentAsOf: mostRecentMessageTimestamp(
                   messageFetchResult.rawMessageInfos,
                   0,
                 ),
               },
             },
           };
         })(),
       );
     }
   }
 
   onSuccessfulConnection() {
     if (this.ws.readyState !== 1) {
       return;
     }
     this.handleStateCheckConditionsUpdate();
   }
 
   // The Socket will timeout by calling this.ws.terminate()
   // serverRequestSocketTimeout milliseconds after the last
   // time resetTimeout is called
   resetTimeout = _debounce(
     () => this.ws.terminate(),
     serverRequestSocketTimeout,
   );
 
   debouncedAfterActivity = _debounce(
     () => this.setStateCheckConditions({ activityRecentlyOccurred: false }),
     stateCheckInactivityActivationInterval,
   );
 
   markActivityOccurred = () => {
     if (this.ws.readyState !== 1) {
       return;
     }
     this.setStateCheckConditions({ activityRecentlyOccurred: true });
     this.debouncedAfterActivity();
   };
 
   clearStateCheckTimeout() {
     const { stateCheckTimeoutID } = this;
     if (stateCheckTimeoutID) {
       clearTimeout(stateCheckTimeoutID);
       this.stateCheckTimeoutID = null;
     }
   }
 
   setStateCheckConditions(newConditions: Shape<StateCheckConditions>) {
     this.stateCheckConditions = {
       ...this.stateCheckConditions,
       ...newConditions,
     };
     this.handleStateCheckConditionsUpdate();
   }
 
   get stateCheckCanStart() {
     return Object.values(this.stateCheckConditions).every(cond => !cond);
   }
 
   handleStateCheckConditionsUpdate() {
     if (!this.stateCheckCanStart) {
       this.clearStateCheckTimeout();
       return;
     }
     if (this.stateCheckTimeoutID) {
       return;
     }
     const { viewer } = this;
     if (!viewer) {
       return;
     }
     const timeUntilStateCheck =
       viewer.sessionLastValidated + sessionCheckFrequency - Date.now();
     if (timeUntilStateCheck <= 0) {
       this.initiateStateCheck();
     } else {
       this.stateCheckTimeoutID = setTimeout(
         this.initiateStateCheck,
         timeUntilStateCheck,
       );
     }
   }
 
   initiateStateCheck = async () => {
     this.setStateCheckConditions({ stateCheckOngoing: true });
 
     const { viewer } = this;
     invariant(viewer, 'should be set');
 
     const { checkStateRequest } = await checkState(viewer, {
       status: 'state_check',
     });
     invariant(checkStateRequest, 'should be set');
 
     await this.sendMessage({
       type: serverSocketMessageTypes.REQUESTS,
       payload: { serverRequests: [checkStateRequest] },
     });
   };
 }
 
 export { onConnection };
diff --git a/keyserver/src/updaters/device-token-updaters.js b/keyserver/src/updaters/device-token-updaters.js
index 71ec2af1b..fc4a2a3d9 100644
--- a/keyserver/src/updaters/device-token-updaters.js
+++ b/keyserver/src/updaters/device-token-updaters.js
@@ -1,49 +1,49 @@
 // @flow
 
 import { type DeviceTokenUpdateRequest } from 'lib/types/device-types.js';
 import { ServerError } from 'lib/utils/errors.js';
 
 import { dbQuery, SQL } from '../database/database.js';
 import type { Viewer } from '../session/viewer.js';
 
 async function deviceTokenUpdater(
   viewer: Viewer,
   update: DeviceTokenUpdateRequest,
 ): Promise<void> {
   const deviceType = update.platformDetails?.platform ?? update.deviceType;
   if (deviceType === undefined) {
     throw new ServerError('invalid_parameters');
   }
   const { deviceToken } = update;
 
   viewer.setDeviceToken(deviceToken);
   if (deviceToken) {
     await clearDeviceToken(deviceToken);
   }
 
-  const setColumns = {};
+  const setColumns: { [string]: ?string } = {};
   setColumns.device_token = deviceToken;
   setColumns.platform = deviceType;
   if (update.platformDetails) {
     const { platform, ...versions } = update.platformDetails;
     if (Object.keys(versions).length > 0) {
       setColumns.versions = JSON.stringify(versions);
     }
   }
 
   const query = SQL`
     UPDATE cookies SET ${setColumns} WHERE id = ${viewer.cookieID}
   `;
   await dbQuery(query);
 }
 
 async function clearDeviceToken(deviceToken: string): Promise<void> {
   const query = SQL`
     UPDATE cookies
     SET device_token = NULL
     WHERE device_token = ${deviceToken}
   `;
   await dbQuery(query);
 }
 
 export { deviceTokenUpdater, clearDeviceToken };
diff --git a/keyserver/src/updaters/olm-session-updater.js b/keyserver/src/updaters/olm-session-updater.js
index 9d6233fba..3d9a897c1 100644
--- a/keyserver/src/updaters/olm-session-updater.js
+++ b/keyserver/src/updaters/olm-session-updater.js
@@ -1,99 +1,99 @@
 // @flow
 
 import type { EncryptResult } from '@commapp/olm';
 
 import { ServerError } from 'lib/utils/errors.js';
 import sleep from 'lib/utils/sleep.js';
 
 import { fetchOlmAccount } from './olm-account-updater.js';
 import { SQL, dbQuery } from '../database/database.js';
 import { unpickleOlmSession } from '../utils/olm-utils.js';
 
 const maxOlmSessionUpdateAttemptTime = 30000;
 const olmSessionUpdateRetryDelay = 50;
 
 type OlmEncryptionResult = {
   +encryptedMessages: { +[string]: EncryptResult },
   +dbPersistConditionViolated?: boolean,
   +encryptionOrder?: number,
 };
 
 async function encryptAndUpdateOlmSession(
   cookieID: string,
   olmSessionType: 'content' | 'notifications',
   messagesToEncrypt: $ReadOnly<{ [string]: string }>,
   dbPersistCondition?: ({ +[string]: EncryptResult }) => boolean,
 ): Promise<OlmEncryptionResult> {
   const isContent = olmSessionType === 'content';
   const { picklingKey } = await fetchOlmAccount(olmSessionType);
   const olmUpdateAttemptStartTime = Date.now();
 
   while (
     Date.now() - olmUpdateAttemptStartTime <
     maxOlmSessionUpdateAttemptTime
   ) {
     const [olmSessionResult] = await dbQuery(
       SQL`
         SELECT version, pickled_olm_session 
         FROM olm_sessions
         WHERE cookie_id = ${cookieID} AND is_content = ${isContent}
       `,
     );
 
     if (olmSessionResult.length === 0) {
       throw new ServerError('missing_olm_session');
     }
 
     const [{ version, pickled_olm_session: pickledSession }] = olmSessionResult;
     const session = await unpickleOlmSession(pickledSession, picklingKey);
 
-    const encryptedMessages = {};
+    const encryptedMessages: { [string]: EncryptResult } = {};
     for (const messageName in messagesToEncrypt) {
       encryptedMessages[messageName] = session.encrypt(
         messagesToEncrypt[messageName],
       );
     }
 
     if (dbPersistCondition && !dbPersistCondition(encryptedMessages)) {
       return { encryptedMessages, dbPersistConditionViolated: true };
     }
 
     const updatedSession = session.pickle(picklingKey);
 
     const [transactionResult] = await dbQuery(
       SQL`
         START TRANSACTION;
 
         SELECT version INTO @currentVersion
         FROM olm_sessions 
         WHERE cookie_id = ${cookieID} AND is_content = ${isContent}
         FOR UPDATE;
 
         UPDATE olm_sessions
         SET 
           pickled_olm_session = ${updatedSession}, 
           version = ${version} + 1
         WHERE version = ${version} AND is_content = ${isContent} 
           AND cookie_id = ${cookieID};
         
         COMMIT;
 
         SELECT @currentVersion AS versionOnUpdateAttempt;
       `,
       { multipleStatements: true },
     );
 
     const selectResult = transactionResult.pop();
     const [{ versionOnUpdateAttempt }] = selectResult;
 
     if (version === versionOnUpdateAttempt) {
       return { encryptedMessages, encryptionOrder: version };
     }
 
     await sleep(olmSessionUpdateRetryDelay);
   }
 
   throw new ServerError('max_olm_account_update_retry_exceeded');
 }
 
 export { encryptAndUpdateOlmSession };
diff --git a/keyserver/src/updaters/relationship-updaters.js b/keyserver/src/updaters/relationship-updaters.js
index d98f7b71c..72bfa2efc 100644
--- a/keyserver/src/updaters/relationship-updaters.js
+++ b/keyserver/src/updaters/relationship-updaters.js
@@ -1,369 +1,371 @@
 // @flow
 
 import invariant from 'invariant';
 
 import { sortIDs } from 'lib/shared/relationship-utils.js';
 import { messageTypes } from 'lib/types/message-types-enum.js';
 import {
   type RelationshipRequest,
   type RelationshipErrors,
   type UndirectedRelationshipRow,
   relationshipActions,
   undirectedStatus,
   directedStatus,
 } from 'lib/types/relationship-types.js';
 import { threadTypes } from 'lib/types/thread-types-enum.js';
 import type { NewThreadResponse } from 'lib/types/thread-types.js';
 import { updateTypes } from 'lib/types/update-types-enum.js';
 import { type UpdateData } from 'lib/types/update-types.js';
 import { cartesianProduct } from 'lib/utils/array.js';
 import { ServerError } from 'lib/utils/errors.js';
 import { promiseAll } from 'lib/utils/promises.js';
 
 import createMessages from '../creators/message-creator.js';
 import { createThread } from '../creators/thread-creator.js';
 import { createUpdates } from '../creators/update-creator.js';
 import { dbQuery, SQL, mergeOrConditions } from '../database/database.js';
 import { fetchFriendRequestRelationshipOperations } from '../fetchers/relationship-fetchers.js';
 import { fetchUserInfos } from '../fetchers/user-fetchers.js';
 import type { Viewer } from '../session/viewer.js';
 
 async function updateRelationships(
   viewer: Viewer,
   request: RelationshipRequest,
 ): Promise<RelationshipErrors> {
   const { action } = request;
 
   if (!viewer.loggedIn) {
     throw new ServerError('not_logged_in');
   }
 
   const uniqueUserIDs = [...new Set(request.userIDs)];
   const users = await fetchUserInfos(uniqueUserIDs);
 
-  let errors = {};
+  let errors: RelationshipErrors = {};
   const userIDs: string[] = [];
   for (const userID of uniqueUserIDs) {
     if (userID === viewer.userID || !users[userID].username) {
       const acc = errors.invalid_user || [];
       errors.invalid_user = [...acc, userID];
     } else {
       userIDs.push(userID);
     }
   }
   if (!userIDs.length) {
     return Object.freeze({ ...errors });
   }
 
   const updateIDs = [];
   if (action === relationshipActions.FRIEND) {
     // We have to create personal threads before setting the relationship
     // status. By doing that we make sure that failed thread creation is
     // reported to the caller and can be repeated - there should be only
     // one PERSONAL thread per a pair of users and we can safely call it
     // repeatedly.
     const threadIDPerUser = await createPersonalThreads(viewer, request);
     const { userRelationshipOperations, errors: friendRequestErrors } =
       await fetchFriendRequestRelationshipOperations(viewer, userIDs);
     errors = { ...errors, ...friendRequestErrors };
 
     const undirectedInsertRows = [];
     const directedInsertRows = [];
     const directedDeleteIDs = [];
     const messageDatas = [];
     const now = Date.now();
     for (const userID in userRelationshipOperations) {
       const operations = userRelationshipOperations[userID];
       const ids = sortIDs(viewer.userID, userID);
 
       if (operations.length) {
         updateIDs.push(userID);
       }
 
       for (const operation of operations) {
         if (operation === 'delete_directed') {
           directedDeleteIDs.push(userID);
         } else if (operation === 'friend') {
           const [user1, user2] = ids;
           const status = undirectedStatus.FRIEND;
           undirectedInsertRows.push({ user1, user2, status });
           messageDatas.push({
             type: messageTypes.UPDATE_RELATIONSHIP,
             threadID: threadIDPerUser[userID],
             creatorID: viewer.userID,
             targetID: userID,
             time: now,
             operation: 'request_accepted',
           });
         } else if (operation === 'pending_friend') {
           const status = directedStatus.PENDING_FRIEND;
           directedInsertRows.push([viewer.userID, userID, status]);
           messageDatas.push({
             type: messageTypes.UPDATE_RELATIONSHIP,
             threadID: threadIDPerUser[userID],
             creatorID: viewer.userID,
             targetID: userID,
             time: now,
             operation: 'request_sent',
           });
         } else if (operation === 'know_of') {
           const [user1, user2] = ids;
           const status = undirectedStatus.KNOW_OF;
           undirectedInsertRows.push({ user1, user2, status });
         } else {
           invariant(false, `unexpected relationship operation ${operation}`);
         }
       }
     }
 
-    const promises = [updateUndirectedRelationships(undirectedInsertRows)];
+    const promises: Array<Promise<mixed>> = [
+      updateUndirectedRelationships(undirectedInsertRows),
+    ];
     if (directedInsertRows.length) {
       const directedInsertQuery = SQL`
         INSERT INTO relationships_directed (user1, user2, status)
         VALUES ${directedInsertRows}
         ON DUPLICATE KEY UPDATE status = VALUE(status)
       `;
       promises.push(dbQuery(directedInsertQuery));
     }
     if (directedDeleteIDs.length) {
       const directedDeleteQuery = SQL`
         DELETE FROM relationships_directed
         WHERE 
           (user1 = ${viewer.userID} AND user2 IN (${directedDeleteIDs})) OR
           (status = ${directedStatus.PENDING_FRIEND} AND 
             user1 IN (${directedDeleteIDs}) AND user2 = ${viewer.userID})
       `;
       promises.push(dbQuery(directedDeleteQuery));
     }
     if (messageDatas.length > 0) {
       promises.push(createMessages(viewer, messageDatas, 'broadcast'));
     }
 
     await Promise.all(promises);
   } else if (action === relationshipActions.UNFRIEND) {
     updateIDs.push(...userIDs);
 
     const updateRows = userIDs.map(userID => {
       const [user1, user2] = sortIDs(viewer.userID, userID);
       return { user1, user2, status: undirectedStatus.KNOW_OF };
     });
 
     const deleteQuery = SQL`
       DELETE FROM relationships_directed
       WHERE 
         status = ${directedStatus.PENDING_FRIEND} AND 
         (user1 = ${viewer.userID} AND user2 IN (${userIDs}) OR 
           user1 IN (${userIDs}) AND user2 = ${viewer.userID})
     `;
 
     await Promise.all([
       updateUndirectedRelationships(updateRows, false),
       dbQuery(deleteQuery),
     ]);
   } else if (action === relationshipActions.BLOCK) {
     updateIDs.push(...userIDs);
 
     const directedRows = [];
     const undirectedRows = [];
     for (const userID of userIDs) {
       directedRows.push([viewer.userID, userID, directedStatus.BLOCKED]);
       const [user1, user2] = sortIDs(viewer.userID, userID);
       undirectedRows.push({ user1, user2, status: undirectedStatus.KNOW_OF });
     }
 
     const directedInsertQuery = SQL`
       INSERT INTO relationships_directed (user1, user2, status)
       VALUES ${directedRows}
       ON DUPLICATE KEY UPDATE status = VALUE(status)
     `;
     const directedDeleteQuery = SQL`
       DELETE FROM relationships_directed
       WHERE status = ${directedStatus.PENDING_FRIEND} AND 
         user1 IN (${userIDs}) AND user2 = ${viewer.userID}
     `;
 
     await Promise.all([
       dbQuery(directedInsertQuery),
       dbQuery(directedDeleteQuery),
       updateUndirectedRelationships(undirectedRows, false),
     ]);
   } else if (action === relationshipActions.UNBLOCK) {
     updateIDs.push(...userIDs);
 
     const query = SQL`
       DELETE FROM relationships_directed
       WHERE status = ${directedStatus.BLOCKED} AND 
         user1 = ${viewer.userID} AND user2 IN (${userIDs})
     `;
     await dbQuery(query);
   } else {
     invariant(false, `action ${action} is invalid or not supported currently`);
   }
 
   await createUpdates(
     updateDatasForUserPairs(cartesianProduct([viewer.userID], updateIDs)),
   );
 
   return Object.freeze({ ...errors });
 }
 
 function updateDatasForUserPairs(
   userPairs: $ReadOnlyArray<[string, string]>,
 ): UpdateData[] {
   const time = Date.now();
-  const updateDatas = [];
+  const updateDatas: Array<UpdateData> = [];
   for (const [user1, user2] of userPairs) {
     updateDatas.push({
       type: updateTypes.UPDATE_USER,
       userID: user1,
       time,
       updatedUserID: user2,
     });
     updateDatas.push({
       type: updateTypes.UPDATE_USER,
       userID: user2,
       time,
       updatedUserID: user1,
     });
   }
   return updateDatas;
 }
 
 async function updateUndirectedRelationships(
   changeset: UndirectedRelationshipRow[],
   greatest: boolean = true,
 ) {
   if (!changeset.length) {
     return;
   }
 
   const rows = changeset.map(row => [row.user1, row.user2, row.status]);
   const query = SQL`
     INSERT INTO relationships_undirected (user1, user2, status)
     VALUES ${rows}
   `;
   if (greatest) {
     query.append(
       SQL`ON DUPLICATE KEY UPDATE status = GREATEST(status, VALUE(status))`,
     );
   } else {
     query.append(SQL`ON DUPLICATE KEY UPDATE status = VALUE(status)`);
   }
   await dbQuery(query);
 }
 
 async function updateChangedUndirectedRelationships(
   changeset: UndirectedRelationshipRow[],
 ): Promise<UpdateData[]> {
   if (changeset.length === 0) {
     return [];
   }
 
   const user2ByUser1: Map<string, Set<string>> = new Map();
   for (const { user1, user2 } of changeset) {
     if (!user2ByUser1.has(user1)) {
       user2ByUser1.set(user1, new Set());
     }
     user2ByUser1.get(user1)?.add(user2);
   }
 
   const selectQuery = SQL`
     SELECT user1, user2, status
     FROM relationships_undirected
     WHERE
   `;
   const conditions = [];
   for (const [user1, users] of user2ByUser1) {
     conditions.push(SQL`(user1 = ${user1} AND user2 IN (${[...users]}))`);
   }
   selectQuery.append(mergeOrConditions(conditions));
 
   const [result] = await dbQuery(selectQuery);
   const existingStatuses = new Map();
   for (const row of result) {
     existingStatuses.set(`${row.user1}|${row.user2}`, row.status);
   }
 
   const insertRows = [];
   for (const row of changeset) {
     const existingStatus = existingStatuses.get(`${row.user1}|${row.user2}`);
     if (!existingStatus || existingStatus < row.status) {
       insertRows.push([row.user1, row.user2, row.status]);
     }
   }
   if (insertRows.length === 0) {
     return [];
   }
   const insertQuery = SQL`
     INSERT INTO relationships_undirected (user1, user2, status)
     VALUES ${insertRows}
     ON DUPLICATE KEY UPDATE status = GREATEST(status, VALUE(status))
   `;
   await dbQuery(insertQuery);
 
   return updateDatasForUserPairs(
     insertRows.map(([user1, user2]) => [user1, user2]),
   );
 }
 
 async function createPersonalThreads(
   viewer: Viewer,
   request: RelationshipRequest,
 ) {
   invariant(
     request.action === relationshipActions.FRIEND,
     'We should only create a PERSONAL threads when sending a FRIEND request, ' +
       `but we tried to do that for ${request.action}`,
   );
 
-  const threadIDPerUser = {};
+  const threadIDPerUser: { [string]: string } = {};
 
   const personalThreadsQuery = SQL`
     SELECT t.id AS threadID, m2.user AS user2
     FROM threads t
     INNER JOIN memberships m1
       ON m1.thread = t.id AND m1.user = ${viewer.userID}
     INNER JOIN memberships m2
       ON m2.thread = t.id AND m2.user IN (${request.userIDs})
     WHERE t.type = ${threadTypes.PERSONAL}
       AND m1.role > 0
       AND m2.role > 0
   `;
   const [personalThreadsResult] = await dbQuery(personalThreadsQuery);
 
   for (const row of personalThreadsResult) {
     const user2 = row.user2.toString();
     threadIDPerUser[user2] = row.threadID.toString();
   }
 
   const threadCreationPromises: { [string]: Promise<NewThreadResponse> } = {};
   for (const userID of request.userIDs) {
     if (threadIDPerUser[userID]) {
       continue;
     }
     threadCreationPromises[userID] = createThread(
       viewer,
       {
         type: threadTypes.PERSONAL,
         initialMemberIDs: [userID],
       },
       { forceAddMembers: true, updatesForCurrentSession: 'broadcast' },
     );
   }
 
   const personalThreadPerUser = await promiseAll(threadCreationPromises);
 
   for (const userID in personalThreadPerUser) {
     const newThread = personalThreadPerUser[userID];
     threadIDPerUser[userID] = newThread.newThreadID;
   }
 
   return threadIDPerUser;
 }
 
 export {
   updateRelationships,
   updateDatasForUserPairs,
   updateUndirectedRelationships,
   updateChangedUndirectedRelationships,
 };
diff --git a/keyserver/src/updaters/role-updaters.js b/keyserver/src/updaters/role-updaters.js
index a0aaeb0af..5b5b03c8e 100644
--- a/keyserver/src/updaters/role-updaters.js
+++ b/keyserver/src/updaters/role-updaters.js
@@ -1,115 +1,116 @@
 // @flow
 
 import invariant from 'invariant';
 import _isEqual from 'lodash/fp/isEqual.js';
 
 import { getRolePermissionBlobs } from 'lib/permissions/thread-permissions.js';
+import type { ThreadRolePermissionsBlob } from 'lib/types/thread-permission-types.js';
 import type { ThreadType } from 'lib/types/thread-types-enum.js';
 
 import createIDs from '../creators/id-creator.js';
 import { dbQuery, SQL } from '../database/database.js';
 import { fetchRoles } from '../fetchers/role-fetchers.js';
 import type { Viewer } from '../session/viewer.js';
 
 async function updateRoles(
   viewer: Viewer,
   threadID: string,
   threadType: ThreadType,
 ): Promise<void> {
   const currentRoles = await fetchRoles(threadID);
 
-  const currentRolePermissions = {};
-  const currentRoleIDs = {};
+  const currentRolePermissions: { [string]: ThreadRolePermissionsBlob } = {};
+  const currentRoleIDs: { [string]: string } = {};
   for (const roleInfo of currentRoles) {
     currentRolePermissions[roleInfo.name] = roleInfo.permissions;
     currentRoleIDs[roleInfo.name] = roleInfo.id;
   }
 
   const rolePermissions = getRolePermissionBlobs(threadType);
   if (_isEqual(rolePermissions)(currentRolePermissions)) {
     return;
   }
 
   const promises = [];
 
   if (rolePermissions.Admins && !currentRolePermissions.Admins) {
     const [id] = await createIDs('roles', 1);
     const newRow = [
       id,
       threadID,
       'Admins',
       JSON.stringify(rolePermissions.Admins),
       Date.now(),
     ];
     const insertQuery = SQL`
       INSERT INTO roles (id, thread, name, permissions, creation_time)
       VALUES ${[newRow]}
     `;
     promises.push(dbQuery(insertQuery));
     const setAdminQuery = SQL`
       UPDATE memberships
       SET role = ${id}
       WHERE thread = ${threadID}
         AND user = ${viewer.userID}
         AND role > 0
     `;
     promises.push(dbQuery(setAdminQuery));
   } else if (!rolePermissions.Admins && currentRolePermissions.Admins) {
     invariant(
       currentRoleIDs.Admins && currentRoleIDs.Members,
       'ids should exist for both Admins and Members roles',
     );
     const id = currentRoleIDs.Admins;
     const deleteQuery = SQL`
       DELETE r, i
       FROM roles r
       LEFT JOIN ids i ON i.id = r.id
       WHERE r.id = ${id}
     `;
     promises.push(dbQuery(deleteQuery));
     const updateMembershipsQuery = SQL`
       UPDATE memberships
       SET role = ${currentRoleIDs.Members}
       WHERE thread = ${threadID}
         AND role > 0
     `;
     promises.push(dbQuery(updateMembershipsQuery));
   }
 
-  const updatePermissions = {};
+  const updatePermissions: { [string]: ThreadRolePermissionsBlob } = {};
   for (const name in currentRoleIDs) {
     const currentPermissions = currentRolePermissions[name];
     const permissions = rolePermissions[name];
     if (
       !permissions ||
       !currentPermissions ||
       _isEqual(permissions)(currentPermissions)
     ) {
       continue;
     }
     const id = currentRoleIDs[name];
     updatePermissions[id] = permissions;
   }
   if (Object.values(updatePermissions).length > 0) {
     const updateQuery = SQL`
       UPDATE roles
       SET permissions = CASE id
     `;
     for (const id in updatePermissions) {
       const permissionsBlob = JSON.stringify(updatePermissions[id]);
       updateQuery.append(SQL`
         WHEN ${id} THEN ${permissionsBlob}
       `);
     }
     updateQuery.append(SQL`
         ELSE permissions
       END
       WHERE thread = ${threadID}
     `);
     promises.push(dbQuery(updateQuery));
   }
 
   await Promise.all(promises);
 }
 
 export { updateRoles };
diff --git a/keyserver/src/updaters/session-updaters.js b/keyserver/src/updaters/session-updaters.js
index eca119ab1..84a376471 100644
--- a/keyserver/src/updaters/session-updaters.js
+++ b/keyserver/src/updaters/session-updaters.js
@@ -1,53 +1,53 @@
 // @flow
 
 import type { Shape } from 'lib/types/core.js';
 import type { CalendarQuery } from 'lib/types/entry-types.js';
 
 import { dbQuery, SQL } from '../database/database.js';
 import type { Viewer } from '../session/viewer.js';
 
 export type SessionUpdate = Shape<{
   +query: CalendarQuery,
   +lastUpdate: number,
   +lastValidated: number,
 }>;
 async function commitSessionUpdate(
   viewer: Viewer,
   sessionUpdate: SessionUpdate,
 ): Promise<void> {
-  const sqlUpdate = {};
+  const sqlUpdate: { [string]: string | number } = {};
   if (sessionUpdate.query) {
     sqlUpdate.query = JSON.stringify(sessionUpdate.query);
   }
   const { lastUpdate, lastValidated } = sessionUpdate;
   if (lastUpdate !== null && lastUpdate !== undefined) {
     sqlUpdate.last_update = lastUpdate;
   }
   if (lastValidated !== null && lastValidated !== undefined) {
     sqlUpdate.last_validated = lastValidated;
   }
   if (Object.keys(sqlUpdate).length === 0) {
     return;
   }
 
   viewer.setSessionInfo({
     lastUpdate: sessionUpdate.lastUpdate
       ? sessionUpdate.lastUpdate
       : viewer.sessionLastUpdated,
     lastValidated: sessionUpdate.lastValidated
       ? sessionUpdate.lastValidated
       : viewer.sessionLastValidated,
     calendarQuery: sessionUpdate.query
       ? sessionUpdate.query
       : viewer.calendarQuery,
   });
 
   const query = SQL`
     UPDATE sessions
     SET ${sqlUpdate}
     WHERE id = ${viewer.session}
   `;
   await dbQuery(query);
 }
 
 export { commitSessionUpdate };
diff --git a/keyserver/src/updaters/thread-permission-updaters.js b/keyserver/src/updaters/thread-permission-updaters.js
index 8a6523adf..6fbac2085 100644
--- a/keyserver/src/updaters/thread-permission-updaters.js
+++ b/keyserver/src/updaters/thread-permission-updaters.js
@@ -1,1382 +1,1399 @@
 // @flow
 
 import invariant from 'invariant';
 import _isEqual from 'lodash/fp/isEqual.js';
 
 import bots from 'lib/facts/bots.js';
 import genesis from 'lib/facts/genesis.js';
 import { specialRoles } from 'lib/permissions/special-roles.js';
 import {
   makePermissionsBlob,
   makePermissionsForChildrenBlob,
   getRoleForPermissions,
 } from 'lib/permissions/thread-permissions.js';
 import type { CalendarQuery } from 'lib/types/entry-types.js';
 import { messageTypes } from 'lib/types/message-types-enum.js';
 import type {
   ThreadPermissionsBlob,
   ThreadRolePermissionsBlob,
 } from 'lib/types/thread-permission-types.js';
 import { threadPermissions } from 'lib/types/thread-permission-types.js';
 import {
   type ThreadType,
   assertThreadType,
 } from 'lib/types/thread-types-enum.js';
 import { updateTypes } from 'lib/types/update-types-enum.js';
 import {
   type ServerUpdateInfo,
   type CreateUpdatesResult,
+  type UpdateData,
 } from 'lib/types/update-types.js';
 import { pushAll } from 'lib/utils/array.js';
 import { ServerError } from 'lib/utils/errors.js';
 
 import { updateChangedUndirectedRelationships } from './relationship-updaters.js';
 import {
   createUpdates,
   type UpdatesForCurrentSession,
 } from '../creators/update-creator.js';
 import { dbQuery, SQL } from '../database/database.js';
 import {
   fetchServerThreadInfos,
   rawThreadInfosFromServerThreadInfos,
 } from '../fetchers/thread-fetchers.js';
 import { rescindPushNotifs } from '../push/rescind.js';
 import { createScriptViewer } from '../session/scripts.js';
 import type { Viewer } from '../session/viewer.js';
 import { updateRoles } from '../updaters/role-updaters.js';
 import DepthQueue from '../utils/depth-queue.js';
 import RelationshipChangeset from '../utils/relationship-changeset.js';
 
 export type MembershipRowToSave = {
   +operation: 'save',
   +intent: 'join' | 'leave' | 'none',
   +userID: string,
   +threadID: string,
   +userNeedsFullThreadDetails: boolean,
   +permissions: ?ThreadPermissionsBlob,
   +permissionsForChildren: ?ThreadPermissionsBlob,
   // null role represents by "0"
   +role: string,
   +oldRole: string,
   +unread?: boolean,
 };
 type MembershipRowToDelete = {
   +operation: 'delete',
   +intent: 'join' | 'leave' | 'none',
   +userID: string,
   +threadID: string,
   +oldRole: string,
 };
-type MembershipRow = MembershipRowToSave | MembershipRowToDelete;
+export type MembershipRow = MembershipRowToSave | MembershipRowToDelete;
 export type MembershipChangeset = {
   +membershipRows: MembershipRow[],
   +relationshipChangeset: RelationshipChangeset,
 };
 
 // 0 role means to remove the user from the thread
 // null role means to set the user to the default role
 // string role means to set the user to the role with that ID
 // -1 role means to set the user as a "ghost" (former member)
 type ChangeRoleOptions = {
   +setNewMembersToUnread?: boolean,
   +forcePermissionRecalculation?: boolean,
 };
 type ChangeRoleMemberInfo = {
   permissionsFromParent?: ?ThreadPermissionsBlob,
   memberOfContainingThread?: boolean,
 };
 async function changeRole(
   threadID: string,
   userIDs: $ReadOnlyArray<string>,
   role: string | -1 | 0 | null,
   options?: ChangeRoleOptions,
 ): Promise<MembershipChangeset> {
   const intent = role === -1 || role === 0 ? 'leave' : 'join';
   const setNewMembersToUnread =
     options?.setNewMembersToUnread && intent === 'join';
   const forcePermissionRecalculation = options?.forcePermissionRecalculation;
 
   if (userIDs.length === 0) {
     return {
       membershipRows: [],
       relationshipChangeset: new RelationshipChangeset(),
     };
   }
 
   const membershipQuery = SQL`
     SELECT user, role, permissions, permissions_for_children
     FROM memberships
     WHERE thread = ${threadID}
   `;
   const parentMembershipQuery = SQL`
     SELECT pm.user, pm.permissions_for_children AS permissions_from_parent
     FROM threads t
     INNER JOIN memberships pm ON pm.thread = t.parent_thread_id
     WHERE t.id = ${threadID} AND
       (pm.user IN (${userIDs}) OR t.parent_thread_id != ${genesis.id})
   `;
   const containingMembershipQuery = SQL`
     SELECT cm.user, cm.role AS containing_role
     FROM threads t
     INNER JOIN memberships cm ON cm.thread = t.containing_thread_id
     WHERE t.id = ${threadID} AND cm.user IN (${userIDs})
   `;
   const [
     [membershipResults],
     [parentMembershipResults],
     containingMembershipResults,
     roleThreadResult,
   ] = await Promise.all([
     dbQuery(membershipQuery),
     dbQuery(parentMembershipQuery),
     (async () => {
       if (intent === 'leave') {
         // Membership in the container only needs to be checked for members
         return [];
       }
       const [result] = await dbQuery(containingMembershipQuery);
       return result;
     })(),
     changeRoleThreadQuery(threadID, role),
   ]);
 
   const {
     roleColumnValue: intendedRole,
     threadType,
     parentThreadID,
     hasContainingThreadID,
     rolePermissions: intendedRolePermissions,
     depth,
   } = roleThreadResult;
 
   const existingMembershipInfo = new Map();
   for (const row of membershipResults) {
     const userID = row.user.toString();
     existingMembershipInfo.set(userID, {
       oldRole: row.role.toString(),
       oldPermissions: JSON.parse(row.permissions),
       oldPermissionsForChildren: JSON.parse(row.permissions_for_children),
     });
   }
 
   const ancestorMembershipInfo: Map<string, ChangeRoleMemberInfo> = new Map();
   for (const row of parentMembershipResults) {
     const userID = row.user.toString();
     if (!userIDs.includes(userID)) {
       continue;
     }
     ancestorMembershipInfo.set(userID, {
       permissionsFromParent: JSON.parse(row.permissions_from_parent),
     });
   }
   for (const row of containingMembershipResults) {
     const userID = row.user.toString();
     const ancestorMembership = ancestorMembershipInfo.get(userID);
     const memberOfContainingThread = row.containing_role > 0;
     if (ancestorMembership) {
       ancestorMembership.memberOfContainingThread = memberOfContainingThread;
     } else {
       ancestorMembershipInfo.set(userID, {
         memberOfContainingThread,
       });
     }
   }
 
   const relationshipChangeset = new RelationshipChangeset();
   const existingMemberIDs = [...existingMembershipInfo.keys()];
   if (threadID !== genesis.id) {
     relationshipChangeset.setAllRelationshipsExist(existingMemberIDs);
   }
   const parentMemberIDs = parentMembershipResults.map(row =>
     row.user.toString(),
   );
   if (parentThreadID && parentThreadID !== genesis.id) {
     relationshipChangeset.setAllRelationshipsExist(parentMemberIDs);
   }
 
-  const membershipRows = [];
+  const membershipRows: Array<MembershipRow> = [];
   const toUpdateDescendants = new Map();
   for (const userID of userIDs) {
     const existingMembership = existingMembershipInfo.get(userID);
     const oldRole = existingMembership?.oldRole ?? '-1';
     const oldPermissions = existingMembership?.oldPermissions ?? null;
     const oldPermissionsForChildren =
       existingMembership?.oldPermissionsForChildren ?? null;
 
     if (
       existingMembership &&
       oldRole === intendedRole &&
       !forcePermissionRecalculation
     ) {
       // If the old role is the same as the new one, we have nothing to update
       continue;
     } else if (Number(oldRole) > 0 && role === null) {
       // In the case where we're just trying to add somebody to a thread, if
       // they already have a role with a nonzero role then we don't need to do
       // anything
       continue;
     }
 
     let permissionsFromParent = null;
     let memberOfContainingThread = false;
     const ancestorMembership = ancestorMembershipInfo.get(userID);
     if (ancestorMembership) {
       permissionsFromParent = ancestorMembership.permissionsFromParent;
       memberOfContainingThread = ancestorMembership.memberOfContainingThread;
     }
     if (!hasContainingThreadID) {
       memberOfContainingThread = true;
     }
 
     const rolePermissions = memberOfContainingThread
       ? intendedRolePermissions
       : null;
     const targetRole = memberOfContainingThread ? intendedRole : '-1';
 
     const permissions = makePermissionsBlob(
       rolePermissions,
       permissionsFromParent,
       threadID,
       threadType,
     );
     const permissionsForChildren = makePermissionsForChildrenBlob(permissions);
     const newRole = getRoleForPermissions(targetRole, permissions);
     const userBecameMember = Number(oldRole) <= 0 && Number(newRole) > 0;
     const userLostMembership = Number(oldRole) > 0 && Number(newRole) <= 0;
 
     if (
       (intent === 'join' && Number(newRole) <= 0) ||
       (intent === 'leave' && Number(newRole) > 0)
     ) {
       throw new ServerError('invalid_parameters');
     } else if (intendedRole !== newRole) {
       console.warn(
         `changeRole called for role=${intendedRole}, but ended up setting ` +
           `role=${newRole} for userID ${userID} and threadID ${threadID}, ` +
           'probably because KNOW_OF permission was unexpectedly present or ' +
           'missing',
       );
     }
     if (
       existingMembership &&
       _isEqual(permissions)(oldPermissions) &&
       oldRole === newRole
     ) {
       // This thread and all of its descendants need no updates for this user,
       // since the corresponding memberships row is unchanged by this operation
       continue;
     }
 
     if (permissions) {
       membershipRows.push({
         operation: 'save',
         intent,
         userID,
         threadID,
         userNeedsFullThreadDetails: userBecameMember,
         permissions,
         permissionsForChildren,
         role: newRole,
         oldRole,
         unread: userBecameMember && setNewMembersToUnread,
       });
     } else {
       membershipRows.push({
         operation: 'delete',
         intent,
         userID,
         threadID,
         oldRole,
       });
     }
 
     if (permissions && !existingMembership && threadID !== genesis.id) {
       relationshipChangeset.setRelationshipsNeeded(userID, existingMemberIDs);
     }
 
     if (
       userLostMembership ||
       !_isEqual(permissionsForChildren)(oldPermissionsForChildren)
     ) {
       toUpdateDescendants.set(userID, {
         userIsMember: Number(newRole) > 0,
         permissionsForChildren,
       });
     }
   }
 
   if (toUpdateDescendants.size > 0) {
     const {
       membershipRows: descendantMembershipRows,
       relationshipChangeset: descendantRelationshipChangeset,
     } = await updateDescendantPermissions({
       threadID,
       depth,
       changesByUser: toUpdateDescendants,
     });
     pushAll(membershipRows, descendantMembershipRows);
     relationshipChangeset.addAll(descendantRelationshipChangeset);
   }
 
   return { membershipRows, relationshipChangeset };
 }
 
 type RoleThreadResult = {
   +roleColumnValue: string,
   +depth: number,
   +threadType: ThreadType,
   +parentThreadID: ?string,
   +hasContainingThreadID: boolean,
   +rolePermissions: ?ThreadRolePermissionsBlob,
 };
 async function changeRoleThreadQuery(
   threadID: string,
   role: string | -1 | 0 | null,
 ): Promise<RoleThreadResult> {
   if (role === 0 || role === -1) {
     const query = SQL`
       SELECT type, depth, parent_thread_id, containing_thread_id
       FROM threads
       WHERE id = ${threadID}
     `;
     const [result] = await dbQuery(query);
     if (result.length === 0) {
       throw new ServerError('internal_error');
     }
     const row = result[0];
     return {
       roleColumnValue: role.toString(),
       depth: row.depth,
       threadType: assertThreadType(row.type),
       parentThreadID: row.parent_thread_id
         ? row.parent_thread_id.toString()
         : null,
       hasContainingThreadID: row.containing_thread_id !== null,
       rolePermissions: null,
     };
   } else if (role !== null) {
     const query = SQL`
       SELECT t.type, t.depth, t.parent_thread_id, t.containing_thread_id,
         r.permissions
       FROM threads t
       INNER JOIN roles r ON r.thread = t.id AND r.id = ${role}
       WHERE t.id = ${threadID}
     `;
     const [result] = await dbQuery(query);
     if (result.length === 0) {
       throw new ServerError('internal_error');
     }
     const row = result[0];
     return {
       roleColumnValue: role,
       depth: row.depth,
       threadType: assertThreadType(row.type),
       parentThreadID: row.parent_thread_id
         ? row.parent_thread_id.toString()
         : null,
       hasContainingThreadID: row.containing_thread_id !== null,
       rolePermissions: JSON.parse(row.permissions),
     };
   } else {
     const query = SQL`
       SELECT t.type, t.depth, t.parent_thread_id, t.containing_thread_id,
         r.permissions, r.id
       FROM threads t
       INNER JOIN roles r ON r.thread = t.id 
         AND r.special_role = ${specialRoles.DEFAULT_ROLE}
       WHERE t.id = ${threadID}
     `;
     const [result] = await dbQuery(query);
     if (result.length === 0) {
       throw new ServerError('internal_error');
     }
     const row = result[0];
     return {
       roleColumnValue: row.id.toString(),
       depth: row.depth,
       threadType: assertThreadType(row.type),
       parentThreadID: row.parent_thread_id
         ? row.parent_thread_id.toString()
         : null,
       hasContainingThreadID: row.containing_thread_id !== null,
       rolePermissions: JSON.parse(row.permissions),
     };
   }
 }
 
 type ChangedAncestor = {
   +threadID: string,
   +depth: number,
   +changesByUser: Map<string, AncestorChanges>,
 };
 type AncestorChanges = {
   +userIsMember: boolean,
   +permissionsForChildren: ?ThreadPermissionsBlob,
 };
 async function updateDescendantPermissions(
   initialChangedAncestor: ChangedAncestor,
 ): Promise<MembershipChangeset> {
-  const membershipRows = [];
+  const membershipRows: Array<MembershipRow> = [];
   const relationshipChangeset = new RelationshipChangeset();
 
   const initialDescendants = await fetchDescendantsForUpdate([
     initialChangedAncestor,
   ]);
 
   const depthQueue = new DepthQueue(
     getDescendantDepth,
     getDescendantKey,
     mergeDescendants,
   );
   depthQueue.addInfos(initialDescendants);
 
   let descendants;
   while ((descendants = depthQueue.getNextDepth())) {
     const descendantsAsAncestors = [];
     for (const descendant of descendants) {
       const { threadID, threadType, depth, users } = descendant;
 
       const existingMembers = [...users.entries()];
       const existingMemberIDs = existingMembers
         .filter(([, { curRole }]) => curRole)
         .map(([userID]) => userID);
       if (threadID !== genesis.id) {
         relationshipChangeset.setAllRelationshipsExist(existingMemberIDs);
       }
 
       const usersForNextLayer = new Map();
       for (const [userID, user] of users) {
         const {
           curRolePermissions,
           curPermissionsFromParent,
           curMemberOfContainingThread,
           nextMemberOfContainingThread,
           nextPermissionsFromParent,
           potentiallyNeedsUpdate,
         } = user;
         const existingMembership = !!user.curRole;
         const curRole = user.curRole ?? '-1';
         const curPermissions = user.curPermissions ?? null;
         const curPermissionsForChildren =
           user.curPermissionsForChildren ?? null;
 
         if (!potentiallyNeedsUpdate) {
           continue;
         }
 
         const permissionsFromParent =
           nextPermissionsFromParent === undefined
             ? curPermissionsFromParent
             : nextPermissionsFromParent;
         const memberOfContainingThread =
           nextMemberOfContainingThread === undefined
             ? curMemberOfContainingThread
             : nextMemberOfContainingThread;
         const targetRole = memberOfContainingThread ? curRole : '-1';
         const rolePermissions = memberOfContainingThread
           ? curRolePermissions
           : null;
 
         const permissions = makePermissionsBlob(
           rolePermissions,
           permissionsFromParent,
           threadID,
           threadType,
         );
         const permissionsForChildren =
           makePermissionsForChildrenBlob(permissions);
         const newRole = getRoleForPermissions(targetRole, permissions);
         const userLostMembership = Number(curRole) > 0 && Number(newRole) <= 0;
 
         if (_isEqual(permissions)(curPermissions) && curRole === newRole) {
           // This thread and all of its descendants need no updates for this
           // user, since the corresponding memberships row is unchanged by this
           // operation
           continue;
         }
 
         if (permissions) {
           membershipRows.push({
             operation: 'save',
             intent: 'none',
             userID,
             threadID,
             userNeedsFullThreadDetails: false,
             permissions,
             permissionsForChildren,
             role: newRole,
             oldRole: curRole,
           });
         } else {
           membershipRows.push({
             operation: 'delete',
             intent: 'none',
             userID,
             threadID,
             oldRole: curRole,
           });
         }
 
         if (permissions && !existingMembership && threadID !== genesis.id) {
           // If there was no membership row before, and we are creating one,
           // we'll need to make sure the new member has a relationship row with
           // each existing member. We expect that whoever called us already
           // generated memberships row for the new members, will will lead
           // saveMemberships to generate relationships rows between those new
           // users.
           relationshipChangeset.setRelationshipsNeeded(
             userID,
             existingMemberIDs,
           );
         }
 
         if (
           userLostMembership ||
           !_isEqual(permissionsForChildren)(curPermissionsForChildren)
         ) {
           usersForNextLayer.set(userID, {
             userIsMember: Number(newRole) > 0,
             permissionsForChildren,
           });
         }
       }
       if (usersForNextLayer.size > 0) {
         descendantsAsAncestors.push({
           threadID,
           depth,
           changesByUser: usersForNextLayer,
         });
       }
     }
 
     const nextDescendants = await fetchDescendantsForUpdate(
       descendantsAsAncestors,
     );
     depthQueue.addInfos(nextDescendants);
   }
   return { membershipRows, relationshipChangeset };
 }
 
 type DescendantUserInfo = $Shape<{
   curRole?: string,
   curRolePermissions?: ?ThreadRolePermissionsBlob,
   curPermissions?: ?ThreadPermissionsBlob,
   curPermissionsForChildren?: ?ThreadPermissionsBlob,
   curPermissionsFromParent?: ?ThreadPermissionsBlob,
   curMemberOfContainingThread?: boolean,
   nextPermissionsFromParent?: ?ThreadPermissionsBlob,
   nextMemberOfContainingThread?: boolean,
   potentiallyNeedsUpdate?: boolean,
 }>;
 type DescendantInfo = {
   +threadID: string,
   +parentThreadID: string,
   +containingThreadID: string,
   +threadType: ThreadType,
   +depth: number,
   +users: Map<string, DescendantUserInfo>,
 };
 const fetchDescendantsBatchSize = 10;
 async function fetchDescendantsForUpdate(
   ancestors: $ReadOnlyArray<ChangedAncestor>,
 ): Promise<DescendantInfo[]> {
   const threadIDs = ancestors.map(ancestor => ancestor.threadID);
 
-  const rows = [];
+  const rows: Array<{
+    +id: number,
+    +user: number,
+    +type: number,
+    +depth: number,
+    +parent_thread_id: number,
+    +containing_thread_id: number,
+    +role_permissions: string,
+    +permissions: string,
+    +permissions_for_children: string,
+    +role: number,
+    +permissions_from_parent: string | null,
+    +containing_role: ?number,
+  }> = [];
   while (threadIDs.length > 0) {
     const batch = threadIDs.splice(0, fetchDescendantsBatchSize);
     const query = SQL`
       SELECT t.id, m.user, t.type, t.depth, t.parent_thread_id,
         t.containing_thread_id, r.permissions AS role_permissions, m.permissions,
         m.permissions_for_children, m.role,
         pm.permissions_for_children AS permissions_from_parent,
         cm.role AS containing_role
       FROM threads t
       INNER JOIN memberships m ON m.thread = t.id
       LEFT JOIN memberships pm
         ON pm.thread = t.parent_thread_id AND pm.user = m.user
       LEFT JOIN memberships cm
         ON cm.thread = t.containing_thread_id AND cm.user = m.user
       LEFT JOIN roles r ON r.id = m.role
       WHERE t.parent_thread_id IN (${batch})
         OR t.containing_thread_id IN (${batch})
     `;
     const [results] = await dbQuery(query);
     pushAll(rows, results);
   }
 
   const descendantThreadInfos: Map<string, DescendantInfo> = new Map();
   for (const row of rows) {
     const descendantThreadID = row.id.toString();
     if (!descendantThreadInfos.has(descendantThreadID)) {
       descendantThreadInfos.set(descendantThreadID, {
         threadID: descendantThreadID,
         parentThreadID: row.parent_thread_id.toString(),
         containingThreadID: row.containing_thread_id.toString(),
         threadType: assertThreadType(row.type),
         depth: row.depth,
         users: new Map(),
       });
     }
     const descendantThreadInfo = descendantThreadInfos.get(descendantThreadID);
     invariant(
       descendantThreadInfo,
       `value should exist for key ${descendantThreadID}`,
     );
     const userID = row.user.toString();
     descendantThreadInfo.users.set(userID, {
       curRole: row.role.toString(),
       curRolePermissions: JSON.parse(row.role_permissions),
       curPermissions: JSON.parse(row.permissions),
       curPermissionsForChildren: JSON.parse(row.permissions_for_children),
-      curPermissionsFromParent: JSON.parse(row.permissions_from_parent),
-      curMemberOfContainingThread: row.containing_role > 0,
+      curPermissionsFromParent: row.permissions_from_parent
+        ? JSON.parse(row.permissions_from_parent)
+        : null,
+      curMemberOfContainingThread:
+        !!row.containing_role && row.containing_role > 0,
     });
   }
 
   for (const ancestor of ancestors) {
     const { threadID, changesByUser } = ancestor;
     for (const [userID, changes] of changesByUser) {
       for (const descendantThreadInfo of descendantThreadInfos.values()) {
         const { users, parentThreadID, containingThreadID } =
           descendantThreadInfo;
         if (threadID !== parentThreadID && threadID !== containingThreadID) {
           continue;
         }
-        let user = users.get(userID);
+        let user: ?DescendantUserInfo = users.get(userID);
         if (!user) {
-          user = {};
+          user = ({}: DescendantUserInfo);
           users.set(userID, user);
         }
         if (threadID === parentThreadID) {
           user.nextPermissionsFromParent = changes.permissionsForChildren;
           user.potentiallyNeedsUpdate = true;
         }
         if (threadID === containingThreadID) {
           user.nextMemberOfContainingThread = changes.userIsMember;
           if (!user.nextMemberOfContainingThread) {
             user.potentiallyNeedsUpdate = true;
           }
         }
       }
     }
   }
 
   return [...descendantThreadInfos.values()];
 }
 
 function getDescendantDepth(descendant: DescendantInfo): number {
   return descendant.depth;
 }
 function getDescendantKey(descendant: DescendantInfo): string {
   return descendant.threadID;
 }
 function mergeDescendants(
   a: DescendantInfo,
   b: DescendantInfo,
 ): DescendantInfo {
   const { users: usersA, ...restA } = a;
   const { users: usersB, ...restB } = b;
   if (!_isEqual(restA)(restB)) {
     console.warn(
       `inconsistent descendantInfos ${JSON.stringify(restA)}, ` +
         JSON.stringify(restB),
     );
     throw new ServerError('internal_error');
   }
 
   const newUsers = new Map(usersA);
   for (const [userID, userFromB] of usersB) {
     const userFromA = newUsers.get(userID);
     if (!userFromA) {
       newUsers.set(userID, userFromB);
     } else {
       newUsers.set(userID, { ...userFromA, ...userFromB });
     }
   }
 
   return { ...a, users: newUsers };
 }
 
 type RecalculatePermissionsMemberInfo = {
   role?: ?string,
   permissions?: ?ThreadPermissionsBlob,
   permissionsForChildren?: ?ThreadPermissionsBlob,
   rolePermissions?: ?ThreadRolePermissionsBlob,
   memberOfContainingThread?: boolean,
   permissionsFromParent?: ?ThreadPermissionsBlob,
 };
 async function recalculateThreadPermissions(
   threadID: string,
 ): Promise<MembershipChangeset> {
   const threadQuery = SQL`
     SELECT type, depth, parent_thread_id, containing_thread_id
     FROM threads
     WHERE id = ${threadID}
   `;
   const membershipQuery = SQL`
     SELECT m.user, m.role, m.permissions, m.permissions_for_children,
       r.permissions AS role_permissions, cm.role AS containing_role
     FROM threads t
     INNER JOIN memberships m ON m.thread = t.id
     LEFT JOIN roles r ON r.id = m.role
     LEFT JOIN memberships cm
       ON cm.user = m.user AND cm.thread = t.containing_thread_id
     WHERE t.id = ${threadID}
   `;
   const parentMembershipQuery = SQL`
     SELECT pm.user, pm.permissions_for_children AS permissions_from_parent
     FROM threads t
     INNER JOIN memberships pm ON pm.thread = t.parent_thread_id
     WHERE t.id = ${threadID}
   `;
   const [[threadResults], [membershipResults], [parentMembershipResults]] =
     await Promise.all([
       dbQuery(threadQuery),
       dbQuery(membershipQuery),
       dbQuery(parentMembershipQuery),
     ]);
 
   if (threadResults.length !== 1) {
     throw new ServerError('internal_error');
   }
   const [threadResult] = threadResults;
   const threadType = assertThreadType(threadResult.type);
   const depth = threadResult.depth;
   const hasContainingThreadID = threadResult.containing_thread_id !== null;
   const parentThreadID = threadResult.parent_thread_id?.toString();
 
   const membershipInfo: Map<string, RecalculatePermissionsMemberInfo> =
     new Map();
   for (const row of membershipResults) {
     const userID = row.user.toString();
     membershipInfo.set(userID, {
       role: row.role.toString(),
       permissions: JSON.parse(row.permissions),
       permissionsForChildren: JSON.parse(row.permissions_for_children),
       rolePermissions: JSON.parse(row.role_permissions),
       memberOfContainingThread: !!(
         row.containing_role && row.containing_role > 0
       ),
     });
   }
   for (const row of parentMembershipResults) {
     const userID = row.user.toString();
     const permissionsFromParent = JSON.parse(row.permissions_from_parent);
     const membership = membershipInfo.get(userID);
     if (membership) {
       membership.permissionsFromParent = permissionsFromParent;
     } else {
       membershipInfo.set(userID, {
         permissionsFromParent: permissionsFromParent,
       });
     }
   }
 
   const relationshipChangeset = new RelationshipChangeset();
   const existingMemberIDs = membershipResults.map(row => row.user.toString());
   if (threadID !== genesis.id) {
     relationshipChangeset.setAllRelationshipsExist(existingMemberIDs);
   }
   const parentMemberIDs = parentMembershipResults.map(row =>
     row.user.toString(),
   );
   if (parentThreadID && parentThreadID !== genesis.id) {
     relationshipChangeset.setAllRelationshipsExist(parentMemberIDs);
   }
 
-  const membershipRows = [];
+  const membershipRows: Array<MembershipRow> = [];
   const toUpdateDescendants = new Map();
   for (const [userID, membership] of membershipInfo) {
     const { rolePermissions: intendedRolePermissions, permissionsFromParent } =
       membership;
     const oldPermissions = membership?.permissions ?? null;
     const oldPermissionsForChildren =
       membership?.permissionsForChildren ?? null;
 
     const existingMembership = membership.role !== undefined;
     const oldRole = membership.role ?? '-1';
     const memberOfContainingThread = hasContainingThreadID
       ? !!membership.memberOfContainingThread
       : true;
     const targetRole = memberOfContainingThread ? oldRole : '-1';
     const rolePermissions = memberOfContainingThread
       ? intendedRolePermissions
       : null;
 
     const permissions = makePermissionsBlob(
       rolePermissions,
       permissionsFromParent,
       threadID,
       threadType,
     );
     const permissionsForChildren = makePermissionsForChildrenBlob(permissions);
     const newRole = getRoleForPermissions(targetRole, permissions);
     const userLostMembership = Number(oldRole) > 0 && Number(newRole) <= 0;
 
     if (_isEqual(permissions)(oldPermissions) && oldRole === newRole) {
       // This thread and all of its descendants need no updates for this user,
       // since the corresponding memberships row is unchanged by this operation
       continue;
     }
 
     if (permissions) {
       membershipRows.push({
         operation: 'save',
         intent: 'none',
         userID,
         threadID,
         userNeedsFullThreadDetails: false,
         permissions,
         permissionsForChildren,
         role: newRole,
         oldRole,
       });
     } else {
       membershipRows.push({
         operation: 'delete',
         intent: 'none',
         userID,
         threadID,
         oldRole,
       });
     }
 
     if (permissions && !existingMembership && threadID !== genesis.id) {
       // If there was no membership row before, and we are creating one,
       // we'll need to make sure the new member has a relationship row with
       // each existing member. We handle guaranteeing that new members have
       // relationship rows with each other in saveMemberships.
       relationshipChangeset.setRelationshipsNeeded(userID, existingMemberIDs);
     }
 
     if (
       userLostMembership ||
       !_isEqual(permissionsForChildren)(oldPermissionsForChildren)
     ) {
       toUpdateDescendants.set(userID, {
         userIsMember: Number(newRole) > 0,
         permissionsForChildren,
       });
     }
   }
 
   if (toUpdateDescendants.size > 0) {
     const {
       membershipRows: descendantMembershipRows,
       relationshipChangeset: descendantRelationshipChangeset,
     } = await updateDescendantPermissions({
       threadID,
       depth,
       changesByUser: toUpdateDescendants,
     });
     pushAll(membershipRows, descendantMembershipRows);
     relationshipChangeset.addAll(descendantRelationshipChangeset);
   }
 
   return { membershipRows, relationshipChangeset };
 }
 
 const defaultSubscriptionString = JSON.stringify({
   home: false,
   pushNotifs: false,
 });
 const joinSubscriptionString = JSON.stringify({ home: true, pushNotifs: true });
 
 const membershipInsertBatchSize = 50;
 
 const visibleExtractString = `$.${threadPermissions.VISIBLE}.value`;
 
 async function saveMemberships({
   toSave,
   updateMembershipsLastMessage,
 }: {
   toSave: $ReadOnlyArray<MembershipRowToSave>,
   updateMembershipsLastMessage: boolean,
 }) {
   if (toSave.length === 0) {
     return;
   }
 
   const time = Date.now();
   const insertRows = [];
   for (const rowToSave of toSave) {
     insertRows.push([
       rowToSave.userID,
       rowToSave.threadID,
       rowToSave.role,
       time,
       rowToSave.intent === 'join'
         ? joinSubscriptionString
         : defaultSubscriptionString,
       rowToSave.permissions ? JSON.stringify(rowToSave.permissions) : null,
       rowToSave.permissionsForChildren
         ? JSON.stringify(rowToSave.permissionsForChildren)
         : null,
       rowToSave.unread ? 1 : 0,
       0,
     ]);
   }
 
   // Logic below will only update an existing membership row's `subscription`
   // column if the user is either joining or leaving the thread. That means
   // there's no way to use this function to update a user's subscription without
   // also making them join or leave the thread. The reason we do this is because
   // we need to specify a value for `subscription` here, as it's a non-null
   // column and this is an INSERT, but we don't want to require people to have
   // to know the current `subscription` when they're just using this function to
   // update the permissions of an existing membership row.
   while (insertRows.length > 0) {
     const batch = insertRows.splice(0, membershipInsertBatchSize);
     const query = SQL`
       INSERT INTO memberships (user, thread, role, creation_time, subscription,
         permissions, permissions_for_children, last_message, last_read_message)
       VALUES ${batch}
       ON DUPLICATE KEY UPDATE
         subscription = IF(
           (role <= 0 AND VALUE(role) > 0)
             OR (role > 0 AND VALUE(role) <= 0),
           VALUE(subscription),
           subscription
         ),
         role = VALUE(role),
         permissions = VALUE(permissions),
         permissions_for_children = VALUE(permissions_for_children)
     `;
     await dbQuery(query);
   }
 
   if (!updateMembershipsLastMessage) {
     return;
   }
 
   const joinRows = toSave
     .filter(row => row.intent === 'join')
     .map(row => [row.userID, row.threadID, row.unread]);
 
   if (joinRows.length === 0) {
     return;
   }
 
   const joinedUserThreadPairs = joinRows.map(([user, thread]) => [
     user,
     thread,
   ]);
 
   const unreadUserThreadPairs = joinRows
     .filter(([, , unread]) => !!unread)
     .map(([user, thread]) => [user, thread]);
 
   let lastReadMessageExpression;
   if (unreadUserThreadPairs.length === 0) {
     lastReadMessageExpression = SQL`
       GREATEST(COALESCE(all_users_query.message, 0), 
         COALESCE(last_subthread_message_for_user_query.message, 0))
     `;
   } else {
     lastReadMessageExpression = SQL`
       (CASE 
         WHEN ((mm.user, mm.thread) in (${unreadUserThreadPairs})) THEN 0
         ELSE GREATEST(COALESCE(all_users_query.message, 0), 
           COALESCE(last_subthread_message_for_user_query.message, 0))
       END)
     `;
   }
 
   // We join two subqueries with the memberships table:
   // - the first subquery calculates the oldest non-CREATE_SUB_THREAD
   //   message, which is the same for all users
   // - the second subquery calculates the oldest CREATE_SUB_THREAD messages,
   //   which can be different for each user because of visibility permissions
   // Then we set the `last_message` column to the greater value of the two.
   // For `last_read_message` we do the same but only if the user should have
   // the "unread" status set for this thread.
   const query = SQL`
     UPDATE memberships mm
     LEFT JOIN (
       SELECT thread, MAX(id) AS message
       FROM messages
       WHERE type != ${messageTypes.CREATE_SUB_THREAD}
       GROUP BY thread 
     ) all_users_query ON mm.thread = all_users_query.thread
     LEFT JOIN (
       SELECT m.thread, stm.user, MAX(m.id) AS message 
       FROM messages m
       LEFT JOIN memberships stm ON m.type = ${messageTypes.CREATE_SUB_THREAD}
         AND stm.thread = m.content
       WHERE JSON_EXTRACT(stm.permissions, ${visibleExtractString}) IS TRUE
       GROUP BY m.thread, stm.user
     ) last_subthread_message_for_user_query 
     ON mm.thread = last_subthread_message_for_user_query.thread 
       AND mm.user = last_subthread_message_for_user_query.user
     SET
       mm.last_message = GREATEST(COALESCE(all_users_query.message, 0), 
         COALESCE(last_subthread_message_for_user_query.message, 0)),
       mm.last_read_message =
   `;
   query.append(lastReadMessageExpression);
   query.append(SQL`WHERE (mm.user, mm.thread) IN (${joinedUserThreadPairs});`);
 
   await dbQuery(query);
 }
 
 async function deleteMemberships(
   toDelete: $ReadOnlyArray<MembershipRowToDelete>,
 ) {
   if (toDelete.length === 0) {
     return;
   }
 
   const time = Date.now();
   const insertRows = toDelete.map(rowToDelete => [
     rowToDelete.userID,
     rowToDelete.threadID,
     -1,
     time,
     defaultSubscriptionString,
     null,
     null,
     0,
     0,
   ]);
 
   while (insertRows.length > 0) {
     const batch = insertRows.splice(0, membershipInsertBatchSize);
     const query = SQL`
       INSERT INTO memberships (user, thread, role, creation_time, subscription,
         permissions, permissions_for_children, last_message, last_read_message)
       VALUES ${batch}
       ON DUPLICATE KEY UPDATE
         role = -1,
         permissions = NULL,
         permissions_for_children = NULL,
         subscription = ${defaultSubscriptionString},
         last_message = 0,
         last_read_message = 0
     `;
     await dbQuery(query);
   }
 }
 
 const emptyCommitMembershipChangesetConfig = Object.freeze({});
 
 // Specify non-empty changedThreadIDs to force updates to be generated for those
 // threads, presumably for reasons not covered in the changeset. calendarQuery
 // only needs to be specified if a JOIN_THREAD update will be generated for the
 // viewer, in which case it's necessary for knowing the set of entries to fetch.
 type ChangesetCommitResult = {
   ...CreateUpdatesResult,
 };
 async function commitMembershipChangeset(
   viewer: Viewer,
   changeset: MembershipChangeset,
   {
     changedThreadIDs = new Set(),
     calendarQuery,
     updatesForCurrentSession = 'return',
     updateMembershipsLastMessage = false,
   }: {
     +changedThreadIDs?: Set<string>,
     +calendarQuery?: ?CalendarQuery,
     +updatesForCurrentSession?: UpdatesForCurrentSession,
     +updateMembershipsLastMessage?: boolean,
   } = emptyCommitMembershipChangesetConfig,
 ): Promise<ChangesetCommitResult> {
   if (!viewer.loggedIn) {
     throw new ServerError('not_logged_in');
   }
   const { membershipRows, relationshipChangeset } = changeset;
 
   const membershipRowMap = new Map();
   for (const row of membershipRows) {
     const { userID, threadID } = row;
     changedThreadIDs.add(threadID);
 
     const pairString = `${userID}|${threadID}`;
     const existing = membershipRowMap.get(pairString);
     invariant(
       !existing || existing.intent === 'none' || row.intent === 'none',
       `multiple intents provided for ${pairString}`,
     );
     if (!existing || existing.intent === 'none') {
       membershipRowMap.set(pairString, row);
     }
   }
 
   const toSave = [],
     toDelete = [],
     toRescindPushNotifs = [];
   for (const row of membershipRowMap.values()) {
     if (
       row.operation === 'delete' ||
       (row.operation === 'save' && Number(row.role) <= 0)
     ) {
       const { userID, threadID } = row;
       toRescindPushNotifs.push({ userID, threadID });
     }
     if (row.operation === 'delete') {
       toDelete.push(row);
     } else {
       toSave.push(row);
     }
   }
 
   const threadsToSavedUsers = new Map();
   for (const row of membershipRowMap.values()) {
     const { userID, threadID } = row;
     let savedUsers = threadsToSavedUsers.get(threadID);
     if (!savedUsers) {
       savedUsers = [];
       threadsToSavedUsers.set(threadID, savedUsers);
     }
     savedUsers.push(userID);
   }
   for (const [threadID, savedUsers] of threadsToSavedUsers) {
     if (threadID !== genesis.id) {
       relationshipChangeset.setAllRelationshipsNeeded(savedUsers);
     }
   }
   const relationshipRows = relationshipChangeset.getRows();
 
   const [updateDatas] = await Promise.all([
     updateChangedUndirectedRelationships(relationshipRows),
     saveMemberships({ toSave, updateMembershipsLastMessage }),
     deleteMemberships(toDelete),
     rescindPushNotifsForMemberDeletion(toRescindPushNotifs),
   ]);
 
   const serverThreadInfoFetchResult = await fetchServerThreadInfos({
     threadIDs: changedThreadIDs,
   });
   const { threadInfos: serverThreadInfos } = serverThreadInfoFetchResult;
 
   const time = Date.now();
   for (const changedThreadID of changedThreadIDs) {
     const serverThreadInfo = serverThreadInfos[changedThreadID];
     for (const memberInfo of serverThreadInfo.members) {
       const pairString = `${memberInfo.id}|${serverThreadInfo.id}`;
       const membershipRow = membershipRowMap.get(pairString);
       if (membershipRow) {
         continue;
       }
       updateDatas.push({
         type: updateTypes.UPDATE_THREAD,
         userID: memberInfo.id,
         time,
         threadID: changedThreadID,
       });
     }
   }
 
   for (const row of membershipRowMap.values()) {
     const { userID, threadID } = row;
     if (row.operation === 'delete' || row.role === '-1') {
       if (row.oldRole !== '-1') {
         updateDatas.push({
           type: updateTypes.DELETE_THREAD,
           userID,
           time,
           threadID,
         });
       }
     } else if (row.userNeedsFullThreadDetails) {
       updateDatas.push({
         type: updateTypes.JOIN_THREAD,
         userID,
         time,
         threadID,
       });
     } else {
       updateDatas.push({
         type: updateTypes.UPDATE_THREAD,
         userID,
         time,
         threadID,
       });
     }
   }
 
   const threadInfoFetchResult = rawThreadInfosFromServerThreadInfos(
     viewer,
     serverThreadInfoFetchResult,
   );
   const { viewerUpdates, userInfos } = await createUpdates(updateDatas, {
     viewer,
     calendarQuery,
     ...threadInfoFetchResult,
     updatesForCurrentSession,
   });
 
   return {
     userInfos,
     viewerUpdates,
   };
 }
 
 const emptyGetChangesetCommitResultConfig = Object.freeze({});
 
 // When the user tries to create a new thread, it's possible for the client to
 // fail the creation even if a row gets added to the threads table. This may
 // occur due to a timeout (on either the client or server side), or due to some
 // error in the server code following the INSERT operation. Handling the error
 // scenario is more challenging since it would require detecting which set of
 // operations failed so we could retry them. As a result, this code is geared at
 // only handling the timeout scenario.
 async function getChangesetCommitResultForExistingThread(
   viewer: Viewer,
   threadID: string,
   otherUpdates: $ReadOnlyArray<ServerUpdateInfo>,
   {
     calendarQuery,
     updatesForCurrentSession = 'return',
   }: {
     +calendarQuery?: ?CalendarQuery,
     +updatesForCurrentSession?: UpdatesForCurrentSession,
   } = emptyGetChangesetCommitResultConfig,
 ): Promise<CreateUpdatesResult> {
   for (const update of otherUpdates) {
     if (
       update.type === updateTypes.JOIN_THREAD &&
       update.threadInfo.id === threadID
     ) {
       // If the JOIN_THREAD is already there we can expect
       // the appropriate UPDATE_USERs to be covered as well
       return { viewerUpdates: otherUpdates, userInfos: {} };
     }
   }
 
   const time = Date.now();
-  const updateDatas = [
+  const updateDatas: Array<UpdateData> = [
     {
       type: updateTypes.JOIN_THREAD,
       userID: viewer.userID,
       time,
       threadID,
       targetSession: viewer.session,
     },
   ];
 
   // To figure out what UserInfos might be missing, we consider the worst case:
   // the same client previously attempted to create a thread with a non-friend
   // they found via search results, but the request timed out. In this scenario
   // the viewer might never have received the UPDATE_USER that would add that
   // UserInfo to their UserStore, but the server assumed the client had gotten
   // it because createUpdates was called with UpdatesForCurrentSession=return.
   // For completeness here we query for the full list of memberships rows in the
   // thread. We can't use fetchServerThreadInfos because it skips role=-1 rows
   const membershipsQuery = SQL`
     SELECT user
     FROM memberships
     WHERE thread = ${threadID} AND user != ${viewer.userID}
   `;
   const [results] = await dbQuery(membershipsQuery);
   for (const row of results) {
     updateDatas.push({
       type: updateTypes.UPDATE_USER,
       userID: viewer.userID,
       time,
       updatedUserID: row.user.toString(),
       targetSession: viewer.session,
     });
   }
 
   const { viewerUpdates, userInfos } = await createUpdates(updateDatas, {
     viewer,
     calendarQuery,
     updatesForCurrentSession,
   });
   return { viewerUpdates: [...otherUpdates, ...viewerUpdates], userInfos };
 }
 
 const rescindPushNotifsBatchSize = 3;
 async function rescindPushNotifsForMemberDeletion(
   toRescindPushNotifs: $ReadOnlyArray<{ +userID: string, +threadID: string }>,
 ): Promise<void> {
   const queue = [...toRescindPushNotifs];
   while (queue.length > 0) {
     const batch = queue.splice(0, rescindPushNotifsBatchSize);
     await Promise.all(
       batch.map(({ userID, threadID }) =>
         rescindPushNotifs(
           SQL`n.thread = ${threadID} AND n.user = ${userID}`,
           SQL`IF(m.thread = ${threadID}, NULL, m.thread)`,
         ),
       ),
     );
   }
 }
 
 // Deprecated - use updateRolesAndPermissionsForAllThreads instead
 async function DEPRECATED_recalculateAllThreadPermissions() {
   const getAllThreads = SQL`SELECT id FROM threads`;
   const [result] = await dbQuery(getAllThreads);
 
   // We handle each thread one-by-one to avoid a situation where a permission
   // calculation for a child thread, done during a call to
   // recalculateThreadPermissions for the parent thread, can be incorrectly
   // overriden by a call to recalculateThreadPermissions for the child thread.
   // If the changeset resulting from the parent call isn't committed before the
   // calculation is done for the child, the calculation done for the child can
   // be incorrect.
   const viewer = createScriptViewer(bots.commbot.userID);
   for (const row of result) {
     const threadID = row.id.toString();
     const changeset = await recalculateThreadPermissions(threadID);
     await commitMembershipChangeset(viewer, changeset);
   }
 }
 
 async function updateRolesAndPermissionsForAllThreads() {
   const batchSize = 10;
   const fetchThreads = SQL`SELECT id, type, depth FROM threads`;
   const [result] = await dbQuery(fetchThreads);
   const allThreads = result.map(row => {
     return {
       id: row.id.toString(),
       type: assertThreadType(row.type),
       depth: row.depth,
     };
   });
 
   const viewer = createScriptViewer(bots.commbot.userID);
 
   const maxDepth = Math.max(...allThreads.map(row => row.depth));
 
   for (let depth = 0; depth <= maxDepth; depth++) {
     const threads = allThreads.filter(row => row.depth === depth);
     console.log(`recalculating permissions for threads with depth ${depth}`);
     while (threads.length > 0) {
       const batch = threads.splice(0, batchSize);
-      const membershipRows = [];
+      const membershipRows: Array<MembershipRow> = [];
       const relationshipChangeset = new RelationshipChangeset();
       await Promise.all(
         batch.map(async thread => {
           console.log(`updating roles for ${thread.id}`);
           await updateRoles(viewer, thread.id, thread.type);
           console.log(`recalculating permissions for ${thread.id}`);
           const {
             membershipRows: threadMembershipRows,
             relationshipChangeset: threadRelationshipChangeset,
           } = await recalculateThreadPermissions(thread.id);
           membershipRows.push(...threadMembershipRows);
           relationshipChangeset.addAll(threadRelationshipChangeset);
         }),
       );
       console.log(`committing batch ${JSON.stringify(batch)}`);
       await commitMembershipChangeset(viewer, {
         membershipRows,
         relationshipChangeset,
       });
     }
   }
 }
 
 export {
   changeRole,
   recalculateThreadPermissions,
   getChangesetCommitResultForExistingThread,
   saveMemberships,
   commitMembershipChangeset,
   DEPRECATED_recalculateAllThreadPermissions,
   updateRolesAndPermissionsForAllThreads,
 };
diff --git a/keyserver/src/updaters/thread-updaters.js b/keyserver/src/updaters/thread-updaters.js
index 2e567cf0b..2527fbbf4 100644
--- a/keyserver/src/updaters/thread-updaters.js
+++ b/keyserver/src/updaters/thread-updaters.js
@@ -1,973 +1,975 @@
 // @flow
 
 import { specialRoles } from 'lib/permissions/special-roles.js';
 import { getRolePermissionBlobs } from 'lib/permissions/thread-permissions.js';
 import { filteredThreadIDs } from 'lib/selectors/calendar-filter-selectors.js';
 import { getPinnedContentFromMessage } from 'lib/shared/message-utils.js';
 import {
   threadHasAdminRole,
   roleIsAdminRole,
   viewerIsMember,
   getThreadTypeParentRequirement,
 } from 'lib/shared/thread-utils.js';
 import type { Shape } from 'lib/types/core.js';
 import { messageTypes } from 'lib/types/message-types-enum.js';
+import type { RawMessageInfo, MessageData } from 'lib/types/message-types.js';
 import { threadPermissions } from 'lib/types/thread-permission-types.js';
 import { threadTypes } from 'lib/types/thread-types-enum.js';
 import {
   type RoleChangeRequest,
   type ChangeThreadSettingsResult,
   type RemoveMembersRequest,
   type LeaveThreadRequest,
   type LeaveThreadResult,
   type UpdateThreadRequest,
   type ServerThreadJoinRequest,
   type ThreadJoinResult,
   type ToggleMessagePinRequest,
   type ToggleMessagePinResult,
 } from 'lib/types/thread-types.js';
 import { updateTypes } from 'lib/types/update-types-enum.js';
 import { ServerError } from 'lib/utils/errors.js';
 import { promiseAll } from 'lib/utils/promises.js';
 import { firstLine } from 'lib/utils/string-utils.js';
 import { canToggleMessagePin } from 'lib/utils/toggle-pin-utils.js';
 import { validChatNameRegex } from 'lib/utils/validation-utils.js';
 
 import { reportLinkUsage } from './link-updaters.js';
 import { updateRoles } from './role-updaters.js';
 import {
   changeRole,
   recalculateThreadPermissions,
   commitMembershipChangeset,
+  type MembershipRow,
 } from './thread-permission-updaters.js';
 import createMessages from '../creators/message-creator.js';
 import { createUpdates } from '../creators/update-creator.js';
 import { dbQuery, SQL } from '../database/database.js';
 import { checkIfInviteLinkIsValid } from '../fetchers/link-fetchers.js';
 import { fetchMessageInfoByID } from '../fetchers/message-fetchers.js';
 import {
   fetchThreadInfos,
   fetchServerThreadInfos,
   determineThreadAncestry,
   rawThreadInfosFromServerThreadInfos,
 } from '../fetchers/thread-fetchers.js';
 import {
   checkThreadPermission,
   viewerIsMember as fetchViewerIsMember,
   checkThread,
   validateCandidateMembers,
 } from '../fetchers/thread-permission-fetchers.js';
 import {
   verifyUserIDs,
   verifyUserOrCookieIDs,
 } from '../fetchers/user-fetchers.js';
 import { handleAsyncPromise } from '../responders/handlers.js';
 import type { Viewer } from '../session/viewer.js';
 import RelationshipChangeset from '../utils/relationship-changeset.js';
 
 type UpdateRoleOptions = {
   +silenceNewMessages?: boolean,
   +forcePermissionRecalculation?: boolean,
 };
 async function updateRole(
   viewer: Viewer,
   request: RoleChangeRequest,
   options?: UpdateRoleOptions,
 ): Promise<ChangeThreadSettingsResult> {
   const silenceNewMessages = options?.silenceNewMessages;
   const forcePermissionRecalculation = options?.forcePermissionRecalculation;
 
   if (!viewer.loggedIn) {
     throw new ServerError('not_logged_in');
   }
 
   const [memberIDs, hasPermission, fetchThreadResult] = await Promise.all([
     verifyUserIDs(request.memberIDs),
     checkThreadPermission(
       viewer,
       request.threadID,
       threadPermissions.CHANGE_ROLE,
     ),
     fetchThreadInfos(viewer, { threadID: request.threadID }),
   ]);
   if (memberIDs.length === 0) {
     throw new ServerError('invalid_parameters');
   }
   if (!hasPermission) {
     throw new ServerError('invalid_credentials');
   }
 
   const threadInfo = fetchThreadResult.threadInfos[request.threadID];
   if (!threadInfo) {
     throw new ServerError('invalid_parameters');
   }
 
   const adminRoleID = Object.keys(threadInfo.roles).find(
     roleID => threadInfo.roles[roleID].name === 'Admins',
   );
 
   // Ensure that there will always still be at least one admin in a community
   if (adminRoleID) {
     const memberRoles = memberIDs.map(
       memberID =>
         threadInfo.members.find(member => member.id === memberID)?.role,
     );
 
     const communityAdminsCount = threadInfo.members.filter(
       member => member.role === adminRoleID,
     ).length;
 
     const changedAdminsCount = memberRoles.filter(
       memberRole => memberRole === adminRoleID,
     ).length;
 
     if (changedAdminsCount >= communityAdminsCount) {
       throw new ServerError('invalid_parameters');
     }
   }
 
   const query = SQL`
     SELECT user, role
     FROM memberships
     WHERE user IN (${memberIDs})
       AND thread = ${request.threadID}
   `;
   const [result] = await dbQuery(query);
 
   let nonMemberUser = false;
   let numResults = 0;
   for (const row of result) {
     if (row.role <= 0) {
       nonMemberUser = true;
       break;
     }
     numResults++;
   }
   if (nonMemberUser || numResults < memberIDs.length) {
     throw new ServerError('invalid_parameters');
   }
 
   const changeset = await changeRole(
     request.threadID,
     memberIDs,
     request.role,
     {
       forcePermissionRecalculation: !!forcePermissionRecalculation,
     },
   );
 
   const { viewerUpdates } = await commitMembershipChangeset(
     viewer,
     changeset,
     forcePermissionRecalculation
       ? { changedThreadIDs: new Set([request.threadID]) }
       : undefined,
   );
 
-  let newMessageInfos = [];
+  let newMessageInfos: Array<RawMessageInfo> = [];
   if (!silenceNewMessages) {
     const messageData = {
       type: messageTypes.CHANGE_ROLE,
       threadID: request.threadID,
       creatorID: viewer.userID,
       time: Date.now(),
       userIDs: memberIDs,
       newRole: request.role,
       roleName: threadInfo.roles[request.role].name,
     };
     newMessageInfos = await createMessages(viewer, [messageData]);
   }
 
   return { updatesResult: { newUpdates: viewerUpdates }, newMessageInfos };
 }
 
 async function removeMembers(
   viewer: Viewer,
   request: RemoveMembersRequest,
 ): Promise<ChangeThreadSettingsResult> {
   const viewerID = viewer.userID;
   if (request.memberIDs.includes(viewerID)) {
     throw new ServerError('invalid_parameters');
   }
 
   const [memberIDs, hasPermission] = await Promise.all([
     verifyUserOrCookieIDs(request.memberIDs),
     checkThreadPermission(
       viewer,
       request.threadID,
       threadPermissions.REMOVE_MEMBERS,
     ),
   ]);
   if (memberIDs.length === 0) {
     throw new ServerError('invalid_parameters');
   }
   if (!hasPermission) {
     throw new ServerError('invalid_credentials');
   }
 
   const query = SQL`
     SELECT m.user, m.role, r.id AS default_role
     FROM memberships m
     LEFT JOIN roles r ON r.special_role = ${specialRoles.DEFAULT_ROLE}
       AND r.thread = ${request.threadID}
     WHERE m.user IN (${memberIDs})
       AND m.thread = ${request.threadID}
   `;
   const [result] = await dbQuery(query);
 
   let nonDefaultRoleUser = false;
   const actualMemberIDs = [];
   for (const row of result) {
     if (row.role <= 0) {
       continue;
     }
     actualMemberIDs.push(row.user.toString());
     if (row.role !== row.default_role) {
       nonDefaultRoleUser = true;
     }
   }
 
   if (nonDefaultRoleUser) {
     const hasChangeRolePermission = await checkThreadPermission(
       viewer,
       request.threadID,
       threadPermissions.CHANGE_ROLE,
     );
     if (!hasChangeRolePermission) {
       throw new ServerError('invalid_credentials');
     }
   }
 
   const changeset = await changeRole(request.threadID, actualMemberIDs, 0);
   const { viewerUpdates } = await commitMembershipChangeset(viewer, changeset);
 
   const newMessageInfos = await (async () => {
     if (actualMemberIDs.length === 0) {
       return [];
     }
     const messageData = {
       type: messageTypes.REMOVE_MEMBERS,
       threadID: request.threadID,
       creatorID: viewerID,
       time: Date.now(),
       removedUserIDs: actualMemberIDs,
     };
     return await createMessages(viewer, [messageData]);
   })();
 
   return { updatesResult: { newUpdates: viewerUpdates }, newMessageInfos };
 }
 
 async function leaveThread(
   viewer: Viewer,
   request: LeaveThreadRequest,
 ): Promise<LeaveThreadResult> {
   if (!viewer.loggedIn) {
     throw new ServerError('not_logged_in');
   }
 
   const [fetchThreadResult, hasPermission] = await Promise.all([
     fetchThreadInfos(viewer, { threadID: request.threadID }),
     checkThreadPermission(
       viewer,
       request.threadID,
       threadPermissions.LEAVE_THREAD,
     ),
   ]);
 
   const threadInfo = fetchThreadResult.threadInfos[request.threadID];
 
   if (!viewerIsMember(threadInfo)) {
     return {
       updatesResult: { newUpdates: [] },
     };
   }
 
   if (!hasPermission) {
     throw new ServerError('invalid_parameters');
   }
 
   const viewerID = viewer.userID;
   if (threadHasAdminRole(threadInfo)) {
     let otherUsersExist = false;
     let otherAdminsExist = false;
     for (const member of threadInfo.members) {
       const role = member.role;
       if (!role || member.id === viewerID) {
         continue;
       }
       otherUsersExist = true;
       if (roleIsAdminRole(threadInfo.roles[role])) {
         otherAdminsExist = true;
         break;
       }
     }
     if (otherUsersExist && !otherAdminsExist) {
       throw new ServerError('invalid_parameters');
     }
   }
 
   const changeset = await changeRole(request.threadID, [viewerID], 0);
   const { viewerUpdates } = await commitMembershipChangeset(viewer, changeset);
 
   const messageData = {
     type: messageTypes.LEAVE_THREAD,
     threadID: request.threadID,
     creatorID: viewerID,
     time: Date.now(),
   };
   await createMessages(viewer, [messageData]);
 
   return { updatesResult: { newUpdates: viewerUpdates } };
 }
 
 type UpdateThreadOptions = Shape<{
   +forceAddMembers: boolean,
   +forceUpdateRoot: boolean,
   +silenceMessages: boolean,
   +ignorePermissions: boolean,
 }>;
 
 async function updateThread(
   viewer: Viewer,
   request: UpdateThreadRequest,
   options?: UpdateThreadOptions,
 ): Promise<ChangeThreadSettingsResult> {
   if (!viewer.loggedIn) {
     throw new ServerError('not_logged_in');
   }
   const forceAddMembers = options?.forceAddMembers ?? false;
   const forceUpdateRoot = options?.forceUpdateRoot ?? false;
   const silenceMessages = options?.silenceMessages ?? false;
   const ignorePermissions =
     (options?.ignorePermissions && viewer.isScriptViewer) ?? false;
   const validationPromises = {};
 
-  const changedFields = {};
-  const sqlUpdate = {};
+  const changedFields: { [string]: string | number } = {};
+  const sqlUpdate: { [string]: ?string | number } = {};
   const untrimmedName = request.changes.name;
   if (untrimmedName !== undefined && untrimmedName !== null) {
     const name = firstLine(untrimmedName);
     if (name.search(validChatNameRegex) === -1) {
       throw new ServerError('invalid_chat_name');
     }
     changedFields.name = name;
     sqlUpdate.name = name ?? null;
   }
   const { description } = request.changes;
   if (description !== undefined && description !== null) {
     changedFields.description = description;
     sqlUpdate.description = description ?? null;
   }
   if (request.changes.color) {
     const color = request.changes.color.toLowerCase();
     changedFields.color = color;
     sqlUpdate.color = color;
   }
   const { parentThreadID } = request.changes;
   if (parentThreadID !== undefined) {
     // TODO some sort of message when this changes
     sqlUpdate.parent_thread_id = parentThreadID;
   }
 
   const { avatar } = request.changes;
   if (avatar) {
     changedFields.avatar =
       avatar.type !== 'remove' ? JSON.stringify(avatar) : '';
     sqlUpdate.avatar = avatar.type !== 'remove' ? JSON.stringify(avatar) : null;
   }
 
   const threadType = request.changes.type;
   if (threadType !== null && threadType !== undefined) {
     changedFields.type = threadType;
     sqlUpdate.type = threadType;
   }
 
   if (
     !ignorePermissions &&
     threadType !== null &&
     threadType !== undefined &&
     threadType !== threadTypes.COMMUNITY_OPEN_SUBTHREAD &&
     threadType !== threadTypes.COMMUNITY_SECRET_SUBTHREAD
   ) {
     throw new ServerError('invalid_parameters');
   }
 
   const newMemberIDs =
     request.changes.newMemberIDs && request.changes.newMemberIDs.length > 0
       ? [...new Set(request.changes.newMemberIDs)]
       : null;
 
   if (
     Object.keys(sqlUpdate).length === 0 &&
     !newMemberIDs &&
     !forceUpdateRoot
   ) {
     throw new ServerError('invalid_parameters');
   }
 
   validationPromises.serverThreadInfos = fetchServerThreadInfos({
     threadID: request.threadID,
   });
 
   validationPromises.hasNecessaryPermissions = (async () => {
     if (ignorePermissions) {
       return;
     }
     const checks = [];
     if (sqlUpdate.name !== undefined) {
       checks.push({
         check: 'permission',
         permission: threadPermissions.EDIT_THREAD_NAME,
       });
     }
     if (sqlUpdate.description !== undefined) {
       checks.push({
         check: 'permission',
         permission: threadPermissions.EDIT_THREAD_DESCRIPTION,
       });
     }
     if (sqlUpdate.color !== undefined) {
       checks.push({
         check: 'permission',
         permission: threadPermissions.EDIT_THREAD_COLOR,
       });
     }
     if (sqlUpdate.avatar !== undefined) {
       checks.push({
         check: 'permission',
         permission: threadPermissions.EDIT_THREAD_AVATAR,
       });
     }
     if (parentThreadID !== undefined || sqlUpdate.type !== undefined) {
       checks.push({
         check: 'permission',
         permission: threadPermissions.EDIT_PERMISSIONS,
       });
     }
     if (newMemberIDs) {
       checks.push({
         check: 'permission',
         permission: threadPermissions.ADD_MEMBERS,
       });
     }
     const hasNecessaryPermissions = await checkThread(
       viewer,
       request.threadID,
       checks,
     );
     if (!hasNecessaryPermissions) {
       throw new ServerError('invalid_credentials');
     }
   })();
 
   const { serverThreadInfos } = await promiseAll(validationPromises);
 
   const serverThreadInfo = serverThreadInfos.threadInfos[request.threadID];
   if (!serverThreadInfo) {
     throw new ServerError('internal_error');
   }
 
   // Threads with source message should be visible to everyone, but we can't
   // guarantee it for COMMUNITY_SECRET_SUBTHREAD threads so we forbid it for
   // now. In the future, if we want to support this, we would need to unlink the
   // source message.
   if (
     threadType !== null &&
     threadType !== undefined &&
     threadType !== threadTypes.SIDEBAR &&
     threadType !== threadTypes.COMMUNITY_OPEN_SUBTHREAD &&
     serverThreadInfo.sourceMessageID
   ) {
     throw new ServerError('invalid_parameters');
   }
 
   // You can't change the parent thread of a current or former SIDEBAR
   if (parentThreadID !== undefined && serverThreadInfo.sourceMessageID) {
     throw new ServerError('invalid_parameters');
   }
 
   const oldThreadType = serverThreadInfo.type;
   const oldParentThreadID = serverThreadInfo.parentThreadID;
   const oldContainingThreadID = serverThreadInfo.containingThreadID;
   const oldCommunity = serverThreadInfo.community;
   const oldDepth = serverThreadInfo.depth;
 
   const nextThreadType =
     threadType !== null && threadType !== undefined
       ? threadType
       : oldThreadType;
   let nextParentThreadID =
     parentThreadID !== undefined ? parentThreadID : oldParentThreadID;
 
   // Does the new thread type preclude a parent?
   if (
     threadType !== undefined &&
     threadType !== null &&
     getThreadTypeParentRequirement(threadType) === 'disabled' &&
     nextParentThreadID !== null
   ) {
     nextParentThreadID = null;
     sqlUpdate.parent_thread_id = null;
   }
 
   // Does the new thread type require a parent?
   if (
     threadType !== undefined &&
     threadType !== null &&
     getThreadTypeParentRequirement(threadType) === 'required' &&
     nextParentThreadID === null
   ) {
     throw new ServerError('no_parent_thread_specified');
   }
 
   const determineThreadAncestryPromise = determineThreadAncestry(
     nextParentThreadID,
     nextThreadType,
   );
 
   const confirmParentPermissionPromise = (async () => {
     if (ignorePermissions || !nextParentThreadID) {
       return;
     }
     if (
       nextParentThreadID === oldParentThreadID &&
       (nextThreadType === threadTypes.SIDEBAR) ===
         (oldThreadType === threadTypes.SIDEBAR)
     ) {
       return;
     }
     const hasParentPermission = await checkThreadPermission(
       viewer,
       nextParentThreadID,
       nextThreadType === threadTypes.SIDEBAR
         ? threadPermissions.CREATE_SIDEBARS
         : threadPermissions.CREATE_SUBCHANNELS,
     );
     if (!hasParentPermission) {
       throw new ServerError('invalid_parameters');
     }
   })();
 
   const rolesNeedUpdate = forceUpdateRoot || nextThreadType !== oldThreadType;
 
   const validateNewMembersPromise = (async () => {
     if (!newMemberIDs || ignorePermissions) {
       return;
     }
 
     const defaultRolePermissionsPromise = (async () => {
       let rolePermissions;
       if (!rolesNeedUpdate) {
         const rolePermissionsQuery = SQL`
           SELECT r.permissions
           FROM threads t
           LEFT JOIN roles r ON r.special_role = ${specialRoles.DEFAULT_ROLE} 
             AND r.thread = ${request.threadID}
           WHERE t.id = ${request.threadID}
         `;
         const [result] = await dbQuery(rolePermissionsQuery);
         if (result.length > 0) {
           rolePermissions = JSON.parse(result[0].permissions);
         }
       }
       if (!rolePermissions) {
         rolePermissions = getRolePermissionBlobs(nextThreadType).Members;
       }
       return rolePermissions;
     })();
 
     const [defaultRolePermissions, nextThreadAncestry] = await Promise.all([
       defaultRolePermissionsPromise,
       determineThreadAncestryPromise,
     ]);
 
     const { newMemberIDs: validatedIDs } = await validateCandidateMembers(
       viewer,
       { newMemberIDs },
       {
         threadType: nextThreadType,
         parentThreadID: nextParentThreadID,
         containingThreadID: nextThreadAncestry.containingThreadID,
         defaultRolePermissions,
       },
       { requireRelationship: !forceAddMembers },
     );
     if (
       validatedIDs &&
       Number(validatedIDs?.length) < Number(newMemberIDs?.length)
     ) {
       throw new ServerError('invalid_credentials');
     }
   })();
 
   const { nextThreadAncestry } = await promiseAll({
     nextThreadAncestry: determineThreadAncestryPromise,
     confirmParentPermissionPromise,
     validateNewMembersPromise,
   });
   if (nextThreadAncestry.containingThreadID !== oldContainingThreadID) {
     sqlUpdate.containing_thread_id = nextThreadAncestry.containingThreadID;
   }
   if (nextThreadAncestry.community !== oldCommunity) {
     if (!ignorePermissions) {
       throw new ServerError('invalid_parameters');
     }
     sqlUpdate.community = nextThreadAncestry.community;
   }
   if (nextThreadAncestry.depth !== oldDepth) {
     sqlUpdate.depth = nextThreadAncestry.depth;
   }
 
   const updateQueryPromise = (async () => {
     if (Object.keys(sqlUpdate).length === 0) {
       return;
     }
 
     const { avatar: avatarUpdate, ...nonAvatarUpdates } = sqlUpdate;
     const updatePromises = [];
 
     if (Object.keys(nonAvatarUpdates).length > 0) {
       const nonAvatarUpdateQuery = SQL`
         UPDATE threads
         SET ${nonAvatarUpdates}
         WHERE id = ${request.threadID}
       `;
       updatePromises.push(dbQuery(nonAvatarUpdateQuery));
     }
 
     if (avatarUpdate !== undefined) {
       const avatarUploadID =
         avatar && (avatar.type === 'image' || avatar.type === 'encrypted_image')
           ? avatar.uploadID
           : null;
 
       const avatarUpdateQuery = SQL`
         START TRANSACTION;
 
         UPDATE uploads
         SET container = NULL
         WHERE container = ${request.threadID}
           AND (
             ${avatarUploadID} IS NULL
             OR EXISTS (
               SELECT 1
               FROM uploads
               WHERE id = ${avatarUploadID}
                 AND ${avatarUploadID} IS NOT NULL
                 AND uploader = ${viewer.userID}
                 AND container IS NULL
                 AND thread IS NULL
              )
           );
 
         UPDATE uploads
         SET container = ${request.threadID}
         WHERE id = ${avatarUploadID}
           AND ${avatarUploadID} IS NOT NULL
           AND uploader = ${viewer.userID}
           AND container IS NULL
           AND thread IS NULL;
 
         UPDATE threads
         SET avatar = ${avatarUpdate}
         WHERE id = ${request.threadID}
           AND (
             ${avatarUploadID} IS NULL
             OR EXISTS (
               SELECT 1
               FROM uploads
               WHERE id = ${avatarUploadID}
                 AND ${avatarUploadID} IS NOT NULL
                 AND uploader = ${viewer.userID}
                 AND container = ${request.threadID}
                 AND thread IS NULL
             )
           );
 
         COMMIT;
       `;
 
       updatePromises.push(
         dbQuery(avatarUpdateQuery, { multipleStatements: true }),
       );
     }
 
     await Promise.all(updatePromises);
   })();
 
   const updateRolesPromise = (async () => {
     if (rolesNeedUpdate) {
       await updateRoles(viewer, request.threadID, nextThreadType);
     }
   })();
 
   const intermediatePromises = {};
   intermediatePromises.updateQuery = updateQueryPromise;
   intermediatePromises.updateRoles = updateRolesPromise;
 
   if (newMemberIDs) {
     intermediatePromises.addMembersChangeset = (async () => {
       await Promise.all([updateQueryPromise, updateRolesPromise]);
       return await changeRole(request.threadID, newMemberIDs, null, {
         setNewMembersToUnread: true,
       });
     })();
   }
 
   const threadRootChanged =
     rolesNeedUpdate || nextParentThreadID !== oldParentThreadID;
   if (threadRootChanged) {
     intermediatePromises.recalculatePermissionsChangeset = (async () => {
       await Promise.all([updateQueryPromise, updateRolesPromise]);
       return await recalculateThreadPermissions(request.threadID);
     })();
   }
 
   const { addMembersChangeset, recalculatePermissionsChangeset } =
     await promiseAll(intermediatePromises);
 
-  const membershipRows = [];
+  const membershipRows: Array<MembershipRow> = [];
   const relationshipChangeset = new RelationshipChangeset();
   if (recalculatePermissionsChangeset) {
     const {
       membershipRows: recalculateMembershipRows,
       relationshipChangeset: recalculateRelationshipChangeset,
     } = recalculatePermissionsChangeset;
     membershipRows.push(...recalculateMembershipRows);
     relationshipChangeset.addAll(recalculateRelationshipChangeset);
   }
   let addedMemberIDs;
   if (addMembersChangeset) {
     const {
       membershipRows: addMembersMembershipRows,
       relationshipChangeset: addMembersRelationshipChangeset,
     } = addMembersChangeset;
     addedMemberIDs = addMembersMembershipRows
       .filter(
         row =>
           row.operation === 'save' &&
           row.threadID === request.threadID &&
           Number(row.role) > 0,
       )
       .map(row => row.userID);
     membershipRows.push(...addMembersMembershipRows);
     relationshipChangeset.addAll(addMembersRelationshipChangeset);
   }
 
   const changeset = { membershipRows, relationshipChangeset };
   const { viewerUpdates } = await commitMembershipChangeset(viewer, changeset, {
     // This forces an update for this thread,
     // regardless of whether any membership rows are changed
     changedThreadIDs:
       Object.keys(sqlUpdate).length > 0
         ? new Set([request.threadID])
         : new Set(),
     // last_message will be updated automatically if we send a message,
     // so we only need to handle it here when we silence new messages
     updateMembershipsLastMessage: silenceMessages,
   });
 
-  let newMessageInfos = [];
+  let newMessageInfos: Array<RawMessageInfo> = [];
   if (!silenceMessages) {
     const time = Date.now();
-    const messageDatas = [];
+    const messageDatas: Array<MessageData> = [];
     for (const fieldName in changedFields) {
       const newValue = changedFields[fieldName];
       messageDatas.push({
         type: messageTypes.CHANGE_SETTINGS,
         threadID: request.threadID,
         creatorID: viewer.userID,
         time,
         field: fieldName,
         value: newValue,
       });
     }
     if (addedMemberIDs && addedMemberIDs.length > 0) {
       messageDatas.push({
         type: messageTypes.ADD_MEMBERS,
         threadID: request.threadID,
         creatorID: viewer.userID,
         time,
         addedUserIDs: addedMemberIDs,
       });
     }
     newMessageInfos = await createMessages(viewer, messageDatas);
   }
 
   return { updatesResult: { newUpdates: viewerUpdates }, newMessageInfos };
 }
 
 async function joinThread(
   viewer: Viewer,
   request: ServerThreadJoinRequest,
 ): Promise<ThreadJoinResult> {
   if (!viewer.loggedIn) {
     throw new ServerError('not_logged_in');
   }
 
   const permissionCheck = request.inviteLinkSecret
     ? checkIfInviteLinkIsValid(request.inviteLinkSecret, request.threadID)
     : checkThreadPermission(
         viewer,
         request.threadID,
         threadPermissions.JOIN_THREAD,
       );
   const [isMember, hasPermission] = await Promise.all([
     fetchViewerIsMember(viewer, request.threadID),
     permissionCheck,
   ]);
   if (!hasPermission) {
     throw new ServerError('invalid_parameters');
   }
 
   const { calendarQuery } = request;
   if (isMember) {
     const response: ThreadJoinResult = {
       rawMessageInfos: [],
       truncationStatuses: {},
       userInfos: {},
       updatesResult: {
         newUpdates: [],
       },
     };
     return response;
   }
 
   if (calendarQuery) {
     const threadFilterIDs = filteredThreadIDs(calendarQuery.filters);
     if (
       !threadFilterIDs ||
       threadFilterIDs.size !== 1 ||
       threadFilterIDs.values().next().value !== request.threadID
     ) {
       throw new ServerError('invalid_parameters');
     }
   }
 
   const changeset = await changeRole(request.threadID, [viewer.userID], null);
 
   const membershipResult = await commitMembershipChangeset(viewer, changeset, {
     calendarQuery,
   });
 
   if (request.inviteLinkSecret) {
     handleAsyncPromise(reportLinkUsage(request.inviteLinkSecret));
   }
 
   const messageData = {
     type: messageTypes.JOIN_THREAD,
     threadID: request.threadID,
     creatorID: viewer.userID,
     time: Date.now(),
   };
   const newMessages = await createMessages(viewer, [messageData]);
 
   return {
     rawMessageInfos: newMessages,
     truncationStatuses: {},
     userInfos: membershipResult.userInfos,
     updatesResult: {
       newUpdates: membershipResult.viewerUpdates,
     },
   };
 }
 
 async function toggleMessagePinForThread(
   viewer: Viewer,
   request: ToggleMessagePinRequest,
 ): Promise<ToggleMessagePinResult> {
   const { messageID, action } = request;
 
   const targetMessage = await fetchMessageInfoByID(viewer, messageID);
   if (!targetMessage) {
     throw new ServerError('invalid_parameters');
   }
 
   const { threadID } = targetMessage;
   const fetchServerThreadInfosResult = await fetchServerThreadInfos({
     threadID,
   });
   const { threadInfos: rawThreadInfos } = rawThreadInfosFromServerThreadInfos(
     viewer,
     fetchServerThreadInfosResult,
   );
   const rawThreadInfo = rawThreadInfos[threadID];
 
   const canTogglePin = canToggleMessagePin(targetMessage, rawThreadInfo);
   if (!canTogglePin) {
     throw new ServerError('invalid_parameters');
   }
 
   const pinnedValue = action === 'pin' ? 1 : 0;
   const pinTimeValue = action === 'pin' ? Date.now() : null;
   const pinnedCountValue = action === 'pin' ? 1 : -1;
 
   const query = SQL`
     UPDATE messages AS m, threads AS t
     SET m.pinned = ${pinnedValue},
       m.pin_time = ${pinTimeValue},
       t.pinned_count = t.pinned_count + ${pinnedCountValue}
     WHERE m.id = ${messageID}
       AND m.thread = ${threadID}
       AND t.id = ${threadID}
       AND m.pinned != ${pinnedValue}
   `;
 
   const [result] = await dbQuery(query);
 
   if (result.affectedRows === 0) {
     return {
       newMessageInfos: [],
       threadID,
     };
   }
 
   const createMessagesAsync = async () => {
     const messageData = {
       type: messageTypes.TOGGLE_PIN,
       threadID,
       targetMessageID: messageID,
       action,
       pinnedContent: getPinnedContentFromMessage(targetMessage),
       creatorID: viewer.userID,
       time: Date.now(),
     };
     const newMessageInfos = await createMessages(viewer, [messageData]);
     return newMessageInfos;
   };
 
   const createUpdatesAsync = async () => {
     const { threadInfos: serverThreadInfos } = fetchServerThreadInfosResult;
     const time = Date.now();
     const updates = [];
     for (const member of serverThreadInfos[threadID].members) {
       updates.push({
         userID: member.id,
         time,
         threadID,
         type: updateTypes.UPDATE_THREAD,
       });
     }
     await createUpdates(updates);
   };
 
   const [newMessageInfos] = await Promise.all([
     createMessagesAsync(),
     createUpdatesAsync(),
   ]);
 
   return {
     newMessageInfos,
     threadID,
   };
 }
 
 export {
   updateRole,
   removeMembers,
   leaveThread,
   updateThread,
   joinThread,
   toggleMessagePinForThread,
 };
diff --git a/keyserver/src/updaters/user-subscription-updaters.js b/keyserver/src/updaters/user-subscription-updaters.js
index 3be9186d4..868140fc0 100644
--- a/keyserver/src/updaters/user-subscription-updaters.js
+++ b/keyserver/src/updaters/user-subscription-updaters.js
@@ -1,62 +1,62 @@
 // @flow
 
 import { viewerIsMember } from 'lib/shared/thread-utils.js';
 import type {
   ThreadSubscription,
   SubscriptionUpdateRequest,
 } from 'lib/types/subscription-types.js';
 import { updateTypes } from 'lib/types/update-types-enum.js';
 import { ServerError } from 'lib/utils/errors.js';
 
 import { createUpdates } from '../creators/update-creator.js';
 import { dbQuery, SQL } from '../database/database.js';
 import { fetchThreadInfos } from '../fetchers/thread-fetchers.js';
 import type { Viewer } from '../session/viewer.js';
 
 async function userSubscriptionUpdater(
   viewer: Viewer,
   update: SubscriptionUpdateRequest,
 ): Promise<ThreadSubscription> {
   if (!viewer.loggedIn) {
     throw new ServerError('not_logged_in');
   }
 
   const { threadInfos } = await fetchThreadInfos(viewer, {
     threadID: update.threadID,
   });
   const threadInfo = threadInfos[update.threadID];
   if (!viewerIsMember(threadInfo)) {
     throw new ServerError('not_member');
   }
 
-  const promises = [];
+  const promises: Array<Promise<mixed>> = [];
 
   const newSubscription = {
     ...threadInfo.currentUser.subscription,
     ...update.updatedFields,
   };
   const saveQuery = SQL`
     UPDATE memberships
     SET subscription = ${JSON.stringify(newSubscription)}
     WHERE user = ${viewer.userID} AND thread = ${update.threadID}
   `;
   promises.push(dbQuery(saveQuery));
 
   const time = Date.now();
   const updateDatas = [
     {
       type: updateTypes.UPDATE_THREAD,
       userID: viewer.userID,
       time,
       threadID: update.threadID,
     },
   ];
   promises.push(
     createUpdates(updateDatas, { viewer, updatesForCurrentSession: 'ignore' }),
   );
 
   await Promise.all(promises);
   return newSubscription;
 }
 
 export { userSubscriptionUpdater };
diff --git a/keyserver/src/utils/validation-utils.test.js b/keyserver/src/utils/validation-utils.test.js
index 244e5c6e2..3ccc72360 100644
--- a/keyserver/src/utils/validation-utils.test.js
+++ b/keyserver/src/utils/validation-utils.test.js
@@ -1,74 +1,74 @@
 // @flow
 
 import t from 'tcomb';
 
 import { tPassword, tShape } from 'lib/utils/validation-utils.js';
 
 import { sanitizeInput, redactedString } from './validation-utils.js';
 
 describe('sanitization', () => {
   it('should redact a string', () => {
     expect(sanitizeInput(tPassword, 'password')).toStrictEqual(redactedString);
   });
 
   it('should redact a string inside an object', () => {
     const validator = tShape({ password: tPassword });
     const object = { password: 'password' };
     const redacted = { password: redactedString };
     expect(sanitizeInput(validator, object)).toStrictEqual(redacted);
   });
 
   it('should redact an optional string', () => {
     const validator = tShape({ password: t.maybe(tPassword) });
     const object = { password: 'password' };
     const redacted = { password: redactedString };
     expect(sanitizeInput(validator, object)).toStrictEqual(redacted);
   });
 
   it('should redact a string in optional object', () => {
     const validator = tShape({ obj: t.maybe(tShape({ password: tPassword })) });
     const object = { obj: { password: 'password' } };
     const redacted = { obj: { password: redactedString } };
     expect(sanitizeInput(validator, object)).toStrictEqual(redacted);
   });
 
   it('should redact a string array', () => {
     const validator = tShape({ passwords: t.list(tPassword) });
     const object = { passwords: ['password', 'password'] };
     const redacted = { passwords: [redactedString, redactedString] };
     expect(sanitizeInput(validator, object)).toStrictEqual(redacted);
   });
 
   it('should redact a string inside a dict', () => {
     const validator = tShape({ passwords: t.dict(t.String, tPassword) });
     const object = { passwords: { a: 'password', b: 'password' } };
     const redacted = { passwords: { a: redactedString, b: redactedString } };
     expect(sanitizeInput(validator, object)).toStrictEqual(redacted);
   });
 
   it('should redact password dict key', () => {
     const validator = tShape({ passwords: t.dict(tPassword, t.Bool) });
     const object = { passwords: { password1: true, password2: false } };
-    const redacted = { passwords: {} };
+    const redacted: { +passwords: { [string]: mixed } } = { passwords: {} };
     redacted.passwords[redactedString] = false;
     expect(sanitizeInput(validator, object)).toStrictEqual(redacted);
   });
 
   it('should redact a string inside a union', () => {
     const validator = tShape({
       password: t.union([tPassword, t.String, t.Bool]),
     });
     const object = { password: 'password' };
     const redacted = { password: redactedString };
     expect(sanitizeInput(validator, object)).toStrictEqual(redacted);
   });
 
   it('should redact a string inside an object array', () => {
     const validator = tShape({
       passwords: t.list(tShape({ password: tPassword })),
     });
     const object = { passwords: [{ password: 'password' }] };
     const redacted = { passwords: [{ password: redactedString }] };
     expect(sanitizeInput(validator, object)).toStrictEqual(redacted);
   });
 });