diff --git a/Cargo.toml b/Cargo.toml
index 3e4da59280..966c02830a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -240,6 +240,7 @@ bool_to_int_with_if = "warn"
 borrow_as_ptr = "warn"
 cfg_not_test = "warn"
 clear_with_drain = "warn"
+type_complexity = "allow"
 cloned_instead_of_copied = "warn"
 collection_is_never_read = "warn"
 dbg_macro = "warn"
diff --git a/apps/frontend/src/components/ui/moderation/ModerationProjectNags.vue b/apps/frontend/src/components/ui/moderation/ModerationProjectNags.vue
index 44a50f083d..33a7dbf92e 100644
--- a/apps/frontend/src/components/ui/moderation/ModerationProjectNags.vue
+++ b/apps/frontend/src/components/ui/moderation/ModerationProjectNags.vue
@@ -24,7 +24,7 @@
 			</div>
 			<div class="input-group">
 				<ButtonStyled circular>
-					<button :class="!collapsed && '[&>svg]:rotate-180'" @click="$emit('toggleCollapsed')">
+					<button :class="{ '[&>svg]:rotate-180': !collapsed }" @click="$emit('toggleCollapsed')">
 						<DropdownIcon class="duration-250 transition-transform ease-in-out" />
 					</button>
 				</ButtonStyled>
diff --git a/apps/frontend/src/components/ui/thread/ThreadView.vue b/apps/frontend/src/components/ui/thread/ThreadView.vue
index a753014aac..0e487bc68d 100644
--- a/apps/frontend/src/components/ui/thread/ThreadView.vue
+++ b/apps/frontend/src/components/ui/thread/ThreadView.vue
@@ -59,7 +59,7 @@
 					</ButtonStyled>
 					<ButtonStyled v-if="visibleQuickReplies.length > 0">
 						<OverflowMenu :options="visibleQuickReplies">
-							Quick Reply
+							Quick reply
 							<ChevronDownIcon />
 						</OverflowMenu>
 					</ButtonStyled>
diff --git a/apps/frontend/src/composables/featureFlags.ts b/apps/frontend/src/composables/featureFlags.ts
index 1becc8b856..c6ffe9eeec 100644
--- a/apps/frontend/src/composables/featureFlags.ts
+++ b/apps/frontend/src/composables/featureFlags.ts
@@ -48,7 +48,6 @@ export const DEFAULT_FEATURE_FLAGS = validateValues({
 	useV1ContentTabAPI: true,
 	labrinthApiCanary: false,
 	dismissedExternalProjectsInfo: false,
-	modpackPermissionsPage: false,
 	showAllBanners: false,
 	alwaysIgnoreErrorBanner: false,
 	showViewProdRouteBanner: false,
diff --git a/apps/frontend/src/locales/en-US/index.json b/apps/frontend/src/locales/en-US/index.json
index 120a9a1ae0..0ec84ff20b 100644
--- a/apps/frontend/src/locales/en-US/index.json
+++ b/apps/frontend/src/locales/en-US/index.json
@@ -3263,9 +3263,6 @@
   "project.moderation.thread.help-center-note.2": {
     "message": "If you need assistance or have additional inquiries, please visit the <help-center-link>Modrinth Help Center</help-center-link> and click the blue bubble to contact support."
   },
-  "project.moderation.thread.moderator-see-user-ui-toggle": {
-    "message": "Show member UI"
-  },
   "project.moderation.thread.private-description": {
     "message": "This is a private conversation thread with the Modrinth moderators. They may message you with issues concerning this project."
   },
@@ -3336,43 +3333,64 @@
     "message": "URL"
   },
   "project.settings.permissions.attention-needed.description.proj-approved": {
-    "message": "Please provide proof that you have permission to redistribute all of the following files and any withheld versions will be automatically published."
+    "message": "Please provide proof that you have permission to redistribute all of the following files. Once completed, withheld versions will be automatically published."
   },
   "project.settings.permissions.attention-needed.description.proj-draft": {
-    "message": "Please provide proof that you have permission to redistribute all of the following files before you can submit your project for review."
+    "message": "Please provide proof that you have permission to redistribute all of the following files before submitting your project for review."
   },
   "project.settings.permissions.attention-needed.title": {
-    "message": "Unknown embedded content"
+    "message": "Unknown external content"
+  },
+  "project.settings.permissions.collapse-all": {
+    "message": "Collapse all"
   },
   "project.settings.permissions.completed.description": {
-    "message": "All external content has attributions provided."
+    "message": "All external content has permission information and attributions have been provided."
   },
   "project.settings.permissions.completed.title": {
-    "message": "Attributions completed!"
+    "message": "Permissions completed!"
   },
   "project.settings.permissions.empty-state.description": {
-    "message": "None of your versions contain external content, so you don't need to worry about obtaining permissions."
+    "message": "None of your project's versions contain external content, so you don't need to worry about obtaining permissions."
   },
   "project.settings.permissions.empty-state.heading": {
     "message": "You're all set!"
   },
+  "project.settings.permissions.expand-all": {
+    "message": "Expand all"
+  },
   "project.settings.permissions.fail.description": {
-    "message": "You don't have permission to redistribute some of the external content you've added. In order to publish on Modrinth, remove the infringing content."
+    "message": "You may not have permission to redistribute some of the external content in your project. In order to publish on Modrinth, please remove this content or provide proof that you do have permission to use it."
   },
   "project.settings.permissions.fail.title": {
     "message": "Some content can't be included"
   },
   "project.settings.permissions.info-banner.description": {
-    "message": "If you include content that isn’t hosted on Modrinth, you need to let us know where it’s from and verify that you have permission to distribute the files. Check out <link>our guide</link> to learn about how to do this properly!"
+    "message": "If you include content that isn’t hosted on Modrinth, you need to let us know where it’s from and verify that you have permission to distribute the files. Check out <link>our guide</link> to learn more and get started!"
   },
   "project.settings.permissions.info-banner.title": {
-    "message": "Learn how attributions work"
+    "message": "Learn about distribution permissions"
   },
   "project.settings.permissions.learn-more": {
     "message": "Learn more"
   },
+  "project.settings.permissions.no-results": {
+    "message": "No external files match your search."
+  },
   "project.settings.permissions.search-placeholder": {
-    "message": "Search {count} {count, plural, one {external project} other {external projects}}..."
+    "message": "Search {count} {count, plural, one {project} other {projects}}..."
+  },
+  "project.settings.permissions.sort.most-files": {
+    "message": "Most files"
+  },
+  "project.settings.permissions.sort.recently-edited": {
+    "message": "Recently edited"
+  },
+  "project.settings.permissions.sort.rejected": {
+    "message": "Rejected"
+  },
+  "project.settings.permissions.sort.status": {
+    "message": "Status"
   },
   "project.settings.title": {
     "message": "Settings"
diff --git a/apps/frontend/src/pages/[type]/[project]/moderation.vue b/apps/frontend/src/pages/[type]/[project]/moderation.vue
index 21d8d4d1d2..23fae21ffb 100644
--- a/apps/frontend/src/pages/[type]/[project]/moderation.vue
+++ b/apps/frontend/src/pages/[type]/[project]/moderation.vue
@@ -72,11 +72,9 @@
 					<h2 id="messages" class="m-0 text-xl font-semibold text-contrast">
 						{{ formatMessage(messages.threadSectionTitle) }}
 					</h2>
-					<div v-if="currentMember?.staffOnly" class="flex items-center gap-2">
+					<div v-if="isStaff(currentMember?.user)" class="flex items-center gap-2">
 						<Toggle id="moderator-see-user-ui-toggle" v-model="moderatorSeeUserUi" small />
-						<label for="moderator-see-user-ui-toggle">
-							{{ formatMessage(messages.moderatorSeeUserUiToggle) }}
-						</label>
+						<label for="moderator-see-user-ui-toggle"> Show member UI </label>
 					</div>
 				</div>
 				<template v-if="userFacingUiVisible">
@@ -151,8 +149,9 @@ import {
 	Toggle,
 	useVIntl,
 } from '@modrinth/ui'
+import { isStaff } from '@modrinth/utils'
 import { useQuery, useQueryClient } from '@tanstack/vue-query'
-import { computed, type Ref, watch } from 'vue'
+import { computed, watch } from 'vue'
 
 import ConversationThread from '~/components/ui/thread/ConversationThread.vue'
 import { getProjectLink, isApproved, isRejected, isUnderReview } from '~/helpers/projects.js'
@@ -160,7 +159,6 @@ import { getProjectLink, isApproved, isRejected, isUnderReview } from '~/helpers
 const { formatMessage } = useVIntl()
 const flags = useFeatureFlags()
 
-type ProjectPageMember = Labrinth.Projects.v3.TeamMember & { staffOnly?: boolean }
 type ModerationAdmonitionSection =
 	| {
 			type: 'paragraph'
@@ -181,10 +179,6 @@ const messages = defineMessages({
 		id: 'project.moderation.thread.title',
 		defaultMessage: 'Moderation messages',
 	},
-	moderatorSeeUserUiToggle: {
-		id: 'project.moderation.thread.moderator-see-user-ui-toggle',
-		defaultMessage: 'Show member UI',
-	},
 	threadPrivateDescription: {
 		id: 'project.moderation.thread.private-description',
 		defaultMessage:
@@ -213,18 +207,10 @@ const messages = defineMessages({
 })
 
 const { addNotification } = injectNotificationManager()
-const {
-	projectV2: project,
-	currentMember: currentMemberRaw,
-	invalidate,
-	allMembers,
-} = injectProjectPageContext()
-const currentMember = currentMemberRaw as Ref<ProjectPageMember | null>
+const { projectV2: project, currentMember, invalidate, allMembers } = injectProjectPageContext()
 
 const canAccess = computed(() => !!currentMember.value)
-const userFacingUiVisible = computed(
-	() => !!currentMember.value && (!currentMember.value.staffOnly || moderatorSeeUserUi.value),
-)
+const userFacingUiVisible = computed(() => !!currentMember.value && moderatorSeeUserUi.value)
 
 const approvedAdmonitionMessage = computed<MessageDescriptor | null>(() => {
 	switch (project.value?.status) {
diff --git a/apps/frontend/src/pages/[type]/[project]/settings.vue b/apps/frontend/src/pages/[type]/[project]/settings.vue
index 45ea37ca34..96b7886fd9 100644
--- a/apps/frontend/src/pages/[type]/[project]/settings.vue
+++ b/apps/frontend/src/pages/[type]/[project]/settings.vue
@@ -17,6 +17,7 @@ import {
 	commonMessages,
 	commonProjectSettingsMessages,
 	injectProjectPageContext,
+	Toggle,
 	useVIntl,
 } from '@modrinth/ui'
 import { isStaff } from '@modrinth/utils'
@@ -47,10 +48,8 @@ const navItems = computed(() => {
 		projectV3.value?.project_types?.some((type) => ['mod', 'modpack'].includes(type)) &&
 		isStaff(currentMember.value?.user)
 
-	const hasPermissionsPage = computed(
-		() =>
-			flags.value.modpackPermissionsPage &&
-			projectV3.value?.project_types?.some((type) => ['modpack'].includes(type)),
+	const hasPermissionsPage = computed(() =>
+		projectV3.value?.project_types?.some((type) => ['modpack'].includes(type)),
 	)
 
 	const items = [
@@ -82,16 +81,16 @@ const navItems = computed(() => {
 			label: formatMessage(commonProjectSettingsMessages.description),
 			icon: AlignLeftIcon,
 		},
-		hasPermissionsPage.value && {
-			link: `/${base}/settings/permissions`,
-			label: formatMessage(commonProjectSettingsMessages.permissions),
-			icon: SignatureIcon,
-		},
 		!isServerProject.value && {
 			link: `/${base}/settings/versions`,
 			label: formatMessage(commonProjectSettingsMessages.versions),
 			icon: VersionIcon,
 		},
+		hasPermissionsPage.value && {
+			link: `/${base}/settings/permissions`,
+			label: formatMessage(commonProjectSettingsMessages.permissions),
+			icon: SignatureIcon,
+		},
 		!isServerProject.value && {
 			link: `/${base}/settings/license`,
 			label: formatMessage(commonProjectSettingsMessages.license),
@@ -144,6 +143,16 @@ watch(route, () => {
 	const scrollY = scroll.y.value
 	setTimeout(() => window.scrollTo(0, scrollY), 10)
 })
+
+const moderatorSeeUserUi = computed<boolean>({
+	get() {
+		return flags.value.showModeratorProjectMemberUi
+	},
+	set(value: boolean) {
+		flags.value.showModeratorProjectMemberUi = value
+		saveFeatureFlags()
+	},
+})
 </script>
 
 <template>
@@ -167,6 +176,10 @@ watch(route, () => {
 		<div class="grid gap-4 lg:grid-cols-[1fr_3fr]">
 			<div>
 				<NavStack :items="navItems" />
+				<div v-if="isStaff(currentMember?.user)" class="mt-4 flex items-center gap-2">
+					<Toggle id="moderator-see-user-ui-toggle" v-model="moderatorSeeUserUi" small />
+					<label for="moderator-see-user-ui-toggle"> Show member UI </label>
+				</div>
 			</div>
 			<div class="min-w-0">
 				<NuxtPage />
diff --git a/apps/frontend/src/pages/[type]/[project]/settings/permissions.vue b/apps/frontend/src/pages/[type]/[project]/settings/permissions.vue
index 2d50a45c5d..60dc51852e 100644
--- a/apps/frontend/src/pages/[type]/[project]/settings/permissions.vue
+++ b/apps/frontend/src/pages/[type]/[project]/settings/permissions.vue
@@ -1,51 +1,255 @@
 <script setup lang="ts">
-import { RightArrowIcon, SearchIcon, SortAscIcon, SortDescIcon } from '@modrinth/assets'
+import type { Labrinth } from '@modrinth/api-client'
+import {
+	ArrowDown10Icon,
+	ArrowDownWideNarrowIcon,
+	ClockArrowDownIcon,
+	FoldVerticalIcon,
+	RightArrowIcon,
+	SearchIcon,
+	UnfoldVerticalIcon,
+} from '@modrinth/assets'
 import {
 	Admonition,
 	ButtonStyled,
 	Combobox,
 	type ComboboxOption,
 	commonMessages,
+	createAttributionGroupTitle,
+	defineMessage,
 	defineMessages,
 	EmptyState,
+	ExternalProjectPermissionsCard,
+	injectModrinthClient,
+	injectProjectPageContext,
 	IntlFormatted,
 	StyledInput,
 	useVIntl,
 } from '@modrinth/ui'
-import ExternalProjectPermissionsCard from '@modrinth/ui/src/components/external_files/ExternalProjectPermissionsCard.vue'
-import { ref } from 'vue'
+import { isStaff } from '@modrinth/utils'
+import { useQuery } from '@tanstack/vue-query'
+import { computed, ref, watch } from 'vue'
 
-const { formatMessage } = useVIntl()
+const auth = await useAuth()
 const flags = useFeatureFlags()
 
-if (!flags.value.modpackPermissionsPage) {
-	throw createError({
-		fatal: true,
-		statusCode: 404,
-	})
-}
+const isModerator = computed(() => {
+	return isStaff(auth.value?.user) && !flags.value.showModeratorProjectMemberUi
+})
+
+const { formatMessage } = useVIntl()
+const { projectV2: project } = injectProjectPageContext()
+const { labrinth } = injectModrinthClient()
+
+type SortType = 'status' | 'most_files' | 'recently_edited' | 'rejected'
 
-const externalFiles = ref([{}])
 const searchQuery = ref('')
-const currentSortType = ref('Oldest')
+const currentSortType = ref<SortType>('status')
+const cardCollapsedById = ref<Record<string, boolean>>({})
+
+const {
+	data: attributionData,
+	error: attributionError,
+	isPending: pending,
+} = useQuery<Labrinth.Attribution.Internal.AttributionGroup[]>({
+	queryKey: ['project-attribution', project.value.id],
+	queryFn: () => labrinth.attribution_internal.listProjectAttribution(project.value.id),
+})
+
+const sortRejectedLabel = defineMessage({
+	id: 'project.settings.permissions.sort.rejected',
+	defaultMessage: 'Rejected',
+})
+
+const sortTypes = computed<ComboboxOption<SortType>[]>(() => {
+	const options: ComboboxOption<SortType>[] = [
+		{
+			value: 'status',
+			label: formatMessage(
+				defineMessage({
+					id: 'project.settings.permissions.sort.status',
+					defaultMessage: 'Status',
+				}),
+			),
+		},
+		{
+			value: 'most_files',
+			label: formatMessage(
+				defineMessage({
+					id: 'project.settings.permissions.sort.most-files',
+					defaultMessage: 'Most files',
+				}),
+			),
+		},
+		{
+			value: 'recently_edited',
+			label: formatMessage(
+				defineMessage({
+					id: 'project.settings.permissions.sort.recently-edited',
+					defaultMessage: 'Recently edited',
+				}),
+			),
+		},
+	]
+	if (hasMixedModerationStatus.value) {
+		options.push({
+			value: 'rejected',
+			label: formatMessage(sortRejectedLabel),
+		})
+	}
+	return options
+})
+
+const currentSortLabel = computed(() => {
+	return sortTypes.value.find((option) => option.value === currentSortType.value)?.label ?? ''
+})
+
+function isAttributed(group: Labrinth.Attribution.Internal.AttributionGroup): boolean {
+	return !!group.attribution && !isNoPermission(group)
+}
+
+function isNoPermission(group: Labrinth.Attribution.Internal.AttributionGroup): boolean {
+	return group.attribution?.kind === 'no_permission'
+}
+
+function isModerationRejected(group: Labrinth.Attribution.Internal.AttributionGroup): boolean {
+	const kind = group.attribution?.moderation_status?.kind
+	return kind === 'bad_proof' || kind === 'not_allowed'
+}
+
+function rejectedSortRank(group: Labrinth.Attribution.Internal.AttributionGroup): number {
+	if (isModerationRejected(group)) {
+		return 0
+	}
+	if (group.attribution?.moderation_status?.kind === 'approved') {
+		return 1
+	}
+	return 2
+}
+
+const hasMixedModerationStatus = computed(() => {
+	const groups = attributionData.value ?? []
+	let hasRejected = false
+	let hasNonRejected = false
+	for (const group of groups) {
+		if (isModerationRejected(group)) {
+			hasRejected = true
+		} else {
+			hasNonRejected = true
+		}
+		if (hasRejected && hasNonRejected) {
+			return true
+		}
+	}
+	return false
+})
+
+watch(hasMixedModerationStatus, (mixed) => {
+	if (!mixed && currentSortType.value === 'rejected') {
+		currentSortType.value = 'status'
+	}
+})
+
+function statusSortRank(group: Labrinth.Attribution.Internal.AttributionGroup): number {
+	if (isNoPermission(group)) {
+		return 0
+	} else if (!group.attribution) {
+		return 1
+	} else if (group.attribution?.kind === 'globally_allowed') {
+		return 3
+	} else {
+		return 2
+	}
+}
+
+function alphabetSortKey(group: Labrinth.Attribution.Internal.AttributionGroup): string {
+	return createAttributionGroupTitle(group, formatMessage)
+}
+
+function compareAlphabetical(
+	a: Labrinth.Attribution.Internal.AttributionGroup,
+	b: Labrinth.Attribution.Internal.AttributionGroup,
+): number {
+	return alphabetSortKey(a).localeCompare(alphabetSortKey(b), undefined, { sensitivity: 'base' })
+}
+
+function attributedTimestamp(group: Labrinth.Attribution.Internal.AttributionGroup): number {
+	if (!group.attributed_at) return Number.NEGATIVE_INFINITY
+	const t = Date.parse(group.attributed_at)
+	return Number.isNaN(t) ? Number.NEGATIVE_INFINITY : t
+}
+
+function groupMatchesPermissionsSearch(
+	group: Labrinth.Attribution.Internal.AttributionGroup,
+	queryTrimmed: string,
+): boolean {
+	const query = queryTrimmed.toLowerCase()
+	if (group.flame_project?.title?.toLowerCase().includes(query)) {
+		return true
+	}
+	return (group.files ?? []).some((file) => file.name.toLowerCase().includes(query))
+}
+
+const filteredGroups = computed(() => {
+	const groups = attributionData.value ?? []
+	const queryTrimmed = searchQuery.value.trim()
+	const filtered = queryTrimmed
+		? groups.filter((group) => groupMatchesPermissionsSearch(group, queryTrimmed))
+		: [...groups]
+	const sortMode = currentSortType.value
+	filtered.sort(compareAlphabetical)
+	filtered.sort((a, b) => {
+		if (sortMode === 'status') {
+			return statusSortRank(a) - statusSortRank(b)
+		}
+		if (sortMode === 'most_files') {
+			const ac = a.files?.length ?? 0
+			const bc = b.files?.length ?? 0
+			return bc - ac
+		}
+		if (sortMode === 'rejected') {
+			return rejectedSortRank(a) - rejectedSortRank(b)
+		}
+		const at = attributedTimestamp(a)
+		const bt = attributedTimestamp(b)
+		return bt - at
+	})
+	return filtered
+})
+
+const totalGroups = computed(() => attributionData.value?.length ?? 0)
+
+const stats = computed(() => {
+	const groups = attributionData.value ?? []
+	let attributed = 0
+	let pending = 0
+	let noPermission = 0
+	for (const group of groups) {
+		if (isNoPermission(group)) {
+			noPermission++
+		} else if (isAttributed(group)) {
+			attributed++
+		} else {
+			pending++
+		}
+	}
+	return { total: groups.length, attributed, pending, noPermission }
+})
+
+const projectIsApproved = computed(() => project.value.status === 'approved')
 
-const sortTypes: ComboboxOption<string>[] = [
-	{ value: 'Oldest', label: 'Oldest' },
-	{ value: 'Newest', label: 'Newest' },
-]
 const messages = defineMessages({
 	searchPlaceholder: {
 		id: 'project.settings.permissions.search-placeholder',
-		defaultMessage:
-			'Search {count} {count, plural, one {external project} other {external projects}}...',
+		defaultMessage: 'Search {count} {count, plural, one {project} other {projects}}...',
 	},
 	infoBannerTitle: {
 		id: 'project.settings.permissions.info-banner.title',
-		defaultMessage: 'Learn how attributions work',
+		defaultMessage: 'Learn about distribution permissions',
 	},
 	infoBannerDescription: {
 		id: 'project.settings.permissions.info-banner.description',
-		defaultMessage: `If you include content that isn’t hosted on Modrinth, you need to let us know where it’s from and verify that you have permission to distribute the files. Check out <link>our guide</link> to learn about how to do this properly!`,
+		defaultMessage: `If you include content that isn’t hosted on Modrinth, you need to let us know where it’s from and verify that you have permission to distribute the files. Check out <link>our guide</link> to learn more and get started!`,
 	},
 	learnMore: {
 		id: 'project.settings.permissions.learn-more',
@@ -57,15 +261,16 @@ const messages = defineMessages({
 	},
 	emptyStateDescription: {
 		id: 'project.settings.permissions.empty-state.description',
-		defaultMessage: `None of your versions contain external content, so you don't need to worry about obtaining permissions.`,
+		defaultMessage: `None of your project's versions contain external content, so you don't need to worry about obtaining permissions.`,
 	},
 	completedTitle: {
 		id: 'project.settings.permissions.completed.title',
-		defaultMessage: `Attributions completed!`,
+		defaultMessage: `Permissions completed!`,
 	},
 	completedDescription: {
 		id: 'project.settings.permissions.completed.description',
-		defaultMessage: 'All external content has attributions provided.',
+		defaultMessage:
+			'All external content has permission information and attributions have been provided.',
 	},
 	failTitle: {
 		id: 'project.settings.permissions.fail.title',
@@ -73,78 +278,144 @@ const messages = defineMessages({
 	},
 	failDescription: {
 		id: 'project.settings.permissions.fail.description',
-		defaultMessage: `You don't have permission to redistribute some of the external content you've added. In order to publish on Modrinth, remove the infringing content.`,
+		defaultMessage: `You may not have permission to redistribute some of the external content in your project. In order to publish on Modrinth, please remove this content or provide proof that you do have permission to use it.`,
 	},
 	attentionNeededTitle: {
 		id: 'project.settings.permissions.attention-needed.title',
-		defaultMessage: `Unknown embedded content`,
+		defaultMessage: `Unknown external content`,
 	},
 	attentionNeededDescriptionApproved: {
 		id: 'project.settings.permissions.attention-needed.description.proj-approved',
-		defaultMessage: `Please provide proof that you have permission to redistribute all of the following files and any withheld versions will be automatically published.`,
+		defaultMessage: `Please provide proof that you have permission to redistribute all of the following files. Once completed, withheld versions will be automatically published.`,
 	},
 	attentionNeededDescriptionDraft: {
 		id: 'project.settings.permissions.attention-needed.description.proj-draft',
-		defaultMessage: `Please provide proof that you have permission to redistribute all of the following files before you can submit your project for review.`,
+		defaultMessage: `Please provide proof that you have permission to redistribute all of the following files before submitting your project for review.`,
+	},
+	noResults: {
+		id: 'project.settings.permissions.no-results',
+		defaultMessage: 'No external files match your search.',
+	},
+	collapseAll: {
+		id: 'project.settings.permissions.collapse-all',
+		defaultMessage: 'Collapse all',
+	},
+	expandAll: {
+		id: 'project.settings.permissions.expand-all',
+		defaultMessage: 'Expand all',
 	},
 })
 
+function defaultCardCollapsed(group: Labrinth.Attribution.Internal.AttributionGroup): boolean {
+	return (
+		(!isModerator.value && !!group.attribution) || group?.attribution?.kind === 'globally_allowed'
+	)
+}
+
+function getCardCollapsed(group: Labrinth.Attribution.Internal.AttributionGroup): boolean {
+	return cardCollapsedById.value[group.id] ?? defaultCardCollapsed(group)
+}
+
+function setCardCollapsed(groupId: string, collapsed: boolean) {
+	cardCollapsedById.value = { ...cardCollapsedById.value, [groupId]: collapsed }
+}
+
+const allCardsCollapsed = computed(() => {
+	const groups = filteredGroups.value
+	if (groups.length === 0) {
+		return true
+	}
+	return groups.every((group) => getCardCollapsed(group))
+})
+
+const expandCollapseAllLabel = computed(() =>
+	formatMessage(allCardsCollapsed.value ? messages.expandAll : messages.collapseAll),
+)
+
+function toggleAllCardsCollapsed() {
+	const collapsed = !allCardsCollapsed.value
+	const next = { ...cardCollapsedById.value }
+	for (const group of filteredGroups.value) {
+		next[group.id] = collapsed
+	}
+	cardCollapsedById.value = next
+}
+
 function dismissInfoBanner() {
 	flags.value.dismissedExternalProjectsInfo = true
 	saveFeatureFlags()
 }
 </script>
 <template>
-	<template v-if="externalFiles.length > 0">
-		<Admonition
-			v-if="!flags.dismissedExternalProjectsInfo"
-			type="info"
-			class="mb-4"
-			:header="formatMessage(messages.infoBannerTitle)"
-			dismissible
-			@dismiss="dismissInfoBanner"
-		>
-			<IntlFormatted :message-id="messages.infoBannerDescription">
-				<template #link="{ children }">
-					<a class="text-link" target="_blank"> <component :is="() => children" /> </a>
-				</template>
-			</IntlFormatted>
-			<template #actions>
-				<div class="flex">
-					<ButtonStyled color="blue">
-						<a> {{ formatMessage(messages.learnMore) }} <RightArrowIcon /> </a>
-					</ButtonStyled>
-				</div>
+	<Admonition
+		v-if="!flags.dismissedExternalProjectsInfo && !isModerator"
+		type="info"
+		class="mb-4"
+		:header="formatMessage(messages.infoBannerTitle)"
+		dismissible
+		@dismiss="dismissInfoBanner"
+	>
+		<IntlFormatted :message-id="messages.infoBannerDescription">
+			<template #link="{ children }">
+				<a class="text-link" target="_blank"> <component :is="() => children" /> </a>
 			</template>
-		</Admonition>
-		<Admonition
-			v-if="true"
-			type="success"
-			class="mb-4"
-			:header="formatMessage(messages.completedTitle)"
-			:body="formatMessage(messages.completedDescription)"
-		/>
-		<Admonition
-			v-if="true"
-			type="warning"
-			class="mb-4"
-			:header="formatMessage(messages.attentionNeededTitle)"
-			:body="formatMessage(messages.attentionNeededDescriptionDraft)"
-		/>
-		<Admonition
-			v-if="true"
-			type="critical"
-			class="mb-4"
-			:header="formatMessage(messages.failTitle)"
-			:body="formatMessage(messages.failDescription)"
-		/>
-		<div class="grid grid-cols-[1fr_auto] gap-2">
+		</IntlFormatted>
+		<template #actions>
+			<div class="flex">
+				<ButtonStyled color="blue">
+					<a> {{ formatMessage(messages.learnMore) }} <RightArrowIcon /> </a>
+				</ButtonStyled>
+			</div>
+		</template>
+	</Admonition>
+	<template v-if="pending">
+		<div class="flex flex-col gap-3">
+			<div
+				v-for="i in 3"
+				:key="i"
+				class="h-[56px] w-full animate-pulse rounded-2xl bg-surface-3"
+			></div>
+		</div>
+	</template>
+	<template v-else-if="totalGroups > 0">
+		<template v-if="!isModerator">
+			<Admonition
+				v-if="stats.pending === 0 && stats.noPermission === 0"
+				type="success"
+				class="mb-4"
+				:header="formatMessage(messages.completedTitle)"
+				:body="formatMessage(messages.completedDescription)"
+			/>
+			<Admonition
+				v-else-if="stats.noPermission > 0"
+				type="critical"
+				class="mb-4"
+				:header="formatMessage(messages.failTitle)"
+				:body="formatMessage(messages.failDescription)"
+			/>
+			<Admonition
+				v-else-if="stats.pending > 0"
+				type="warning"
+				class="mb-4"
+				:header="formatMessage(messages.attentionNeededTitle)"
+				:body="
+					formatMessage(
+						projectIsApproved
+							? messages.attentionNeededDescriptionApproved
+							: messages.attentionNeededDescriptionDraft,
+					)
+				"
+			/>
+		</template>
+		<div class="grid grid-cols-[1fr_auto_auto] gap-2">
 			<StyledInput
 				v-model="searchQuery"
-				type="search"
+				type="text"
+				autocomplete="off"
+				clearable
 				:placeholder="
 					formatMessage(messages.searchPlaceholder, {
-						count: externalFiles.length,
+						count: totalGroups,
 					})
 				"
 				:icon="SearchIcon"
@@ -153,27 +424,68 @@ function dismissInfoBanner() {
 			<div>
 				<Combobox
 					v-model="currentSortType"
-					class="!w-full flex-grow sm:!w-[150px] sm:flex-grow-0 lg:!w-[150px]"
+					class="!w-full flex-grow sm:!w-[220px] sm:flex-grow-0"
 					:options="sortTypes"
 					:placeholder="formatMessage(commonMessages.sortByLabel)"
 				>
 					<template #selected>
 						<span class="flex flex-row gap-2 align-middle font-semibold">
-							<SortAscIcon
-								v-if="currentSortType === 'Oldest'"
+							<ArrowDownWideNarrowIcon
+								v-if="currentSortType === 'status'"
+								class="size-5 flex-shrink-0 text-secondary"
+							/>
+							<ArrowDown10Icon
+								v-else-if="currentSortType === 'most_files'"
+								class="size-5 flex-shrink-0 text-secondary"
+							/>
+							<ClockArrowDownIcon
+								v-else-if="currentSortType === 'recently_edited'"
+								class="size-5 flex-shrink-0 text-secondary"
+							/>
+							<ArrowDownWideNarrowIcon
+								v-else-if="currentSortType === 'rejected'"
 								class="size-5 flex-shrink-0 text-secondary"
 							/>
-							<SortDescIcon v-else class="size-5 flex-shrink-0 text-secondary" />
-							<span class="truncate text-contrast">{{ currentSortType }}</span>
+							<span class="truncate text-contrast">{{ currentSortLabel }}</span>
 						</span>
 					</template>
 				</Combobox>
 			</div>
+			<ButtonStyled>
+				<button type="button" class="!h-[40px]" @click="toggleAllCardsCollapsed">
+					<UnfoldVerticalIcon
+						v-if="allCardsCollapsed"
+						class="size-5 flex-shrink-0 text-secondary"
+					/>
+					<FoldVerticalIcon v-else class="size-5 flex-shrink-0 text-secondary" />
+					{{ expandCollapseAllLabel }}
+				</button>
+			</ButtonStyled>
 		</div>
 		<div class="mt-4 flex flex-col gap-3">
-			<ExternalProjectPermissionsCard title="FTB Library" />
+			<TransitionGroup name="list">
+				<ExternalProjectPermissionsCard
+					v-for="group in filteredGroups"
+					:key="group.id"
+					:collapsed="getCardCollapsed(group)"
+					:project-id="project.id"
+					:group="group"
+					:is-moderator="isModerator"
+					@update:collapsed="setCardCollapsed(group.id, $event)"
+				/>
+				<EmptyState
+					v-if="filteredGroups.length === 0"
+					:heading="formatMessage(messages.noResults)"
+					type="no-search-result"
+				/>
+			</TransitionGroup>
 		</div>
 	</template>
+	<div v-else-if="attributionError">
+		<p v-if="attributionError" class="my-12 text-center text-red">
+			{{ attributionError }}
+		</p>
+	</div>
 	<template v-else>
 		<EmptyState
 			:heading="formatMessage(messages.emptyStateHeading)"
@@ -182,3 +494,18 @@ function dismissInfoBanner() {
 		/>
 	</template>
 </template>
+<style scoped>
+.list-enter-from {
+	opacity: 0;
+	transform: translateY(-10px);
+}
+
+.list-leave-to {
+	opacity: 0;
+	transform: translateY(10px);
+}
+
+.list-move {
+	transition: transform 200ms ease-in-out;
+}
+</style>
diff --git a/apps/frontend/src/pages/[type]/[project]/settings/versions.vue b/apps/frontend/src/pages/[type]/[project]/settings/versions.vue
index 4d1e11ebca..4fe35f27ed 100644
--- a/apps/frontend/src/pages/[type]/[project]/settings/versions.vue
+++ b/apps/frontend/src/pages/[type]/[project]/settings/versions.vue
@@ -14,21 +14,22 @@
 			proceed-label="Delete"
 			@proceed="deleteVersion()"
 		/>
-
 		<Admonition
-			v-if="flags.modpackPermissionsPage && withheldVersions.length > 0"
+			v-if="withheldVersions.length > 0"
 			type="warning"
 			class="mb-4"
 			:header="
 				formatMessage(messages.withheldVersionsWarningTitle, {
 					count: withheldVersions.length,
-					version_name: withheldVersions.length === 1 ? withheldVersions[0] : undefined,
+					version_name:
+						withheldVersions.length === 1 ? withheldVersions[0].version_number : undefined,
 				})
 			"
 			:body="
 				formatMessage(messages.withheldVersionsWarningDescription, {
 					count: withheldVersions.length,
-					version_name: withheldVersions.length === 1 ? withheldVersions[0] : undefined,
+					version_name:
+						withheldVersions.length === 1 ? withheldVersions[0].version_number : undefined,
 				})
 			"
 		>
@@ -454,7 +455,9 @@ async function deleteVersion() {
 	stopLoading()
 }
 
-const withheldVersions = computed(() => ['4.0.0'])
+const withheldVersions = computed(() =>
+	versions.value.filter((x) => x.files_missing_attribution?.length > 0),
+)
 
 const messages = defineMessages({
 	withheldVersionsWarningTitle: {
diff --git a/apps/frontend/src/pages/[type]/[project]/version/[version].vue b/apps/frontend/src/pages/[type]/[project]/version/[version].vue
index 20a4737f86..d80071a87a 100644
--- a/apps/frontend/src/pages/[type]/[project]/version/[version].vue
+++ b/apps/frontend/src/pages/[type]/[project]/version/[version].vue
@@ -136,7 +136,7 @@
 				</ButtonStyled>
 			</div>
 			<div v-else class="input-group mt-2">
-				<ButtonStyled v-if="primaryFile?.url && !currentMember" color="brand">
+				<ButtonStyled v-if="primaryFile?.url" color="brand">
 					<a
 						v-tooltip="primaryFile.filename + ' (' + formatBytes(primaryFile.size) + ')'"
 						:href="decoratedPrimaryFileUrl"
@@ -159,36 +159,44 @@
 						Report
 					</button>
 				</ButtonStyled>
-				<ButtonStyled v-if="currentMember">
-					<button @click="handleOpenEditVersionModal(version.id, project.id, 'metadata')">
-						<BoxIcon aria-hidden="true" />
-						Edit metadata
-					</button>
-				</ButtonStyled>
-				<ButtonStyled v-if="currentMember">
-					<button @click="handleOpenEditVersionModal(version.id, project.id, 'add-details')">
-						<InfoIcon aria-hidden="true" />
-						Edit details
-					</button>
-				</ButtonStyled>
-				<ButtonStyled v-if="currentMember">
-					<button @click="handleOpenEditVersionModal(version.id, project.id, 'add-files')">
-						<FileIcon aria-hidden="true" />
-						Edit files
-					</button>
-				</ButtonStyled>
-				<ButtonStyled>
-					<button
-						v-if="
-							currentMember &&
-							version.loaders.some((x: string) => tags.loaderData.dataPackLoaders.includes(x))
-						"
-						@click="modal_package_mod?.show()"
-					>
-						<BoxIcon aria-hidden="true" />
-						Package as mod
-					</button>
-				</ButtonStyled>
+
+				<template v-if="currentMember">
+					<ButtonStyled v-if="version.files_missing_attribution?.length > 0" color="orange">
+						<nuxt-link :to="`/project/${project.id}/settings/permissions`">
+							Resolve missing permissions
+							<RightArrowIcon aria-hidden="true" />
+						</nuxt-link>
+					</ButtonStyled>
+					<ButtonStyled>
+						<button @click="handleOpenEditVersionModal(version.id, project.id, 'metadata')">
+							<BoxIcon aria-hidden="true" />
+							Edit metadata
+						</button>
+					</ButtonStyled>
+					<ButtonStyled>
+						<button @click="handleOpenEditVersionModal(version.id, project.id, 'add-details')">
+							<InfoIcon aria-hidden="true" />
+							Edit details
+						</button>
+					</ButtonStyled>
+					<ButtonStyled>
+						<button @click="handleOpenEditVersionModal(version.id, project.id, 'add-files')">
+							<FileIcon aria-hidden="true" />
+							Edit files
+						</button>
+					</ButtonStyled>
+					<ButtonStyled>
+						<button
+							v-if="
+								version.loaders.some((x: string) => tags.loaderData.dataPackLoaders.includes(x))
+							"
+							@click="modal_package_mod?.show()"
+						>
+							<BoxIcon aria-hidden="true" />
+							Package as mod
+						</button>
+					</ButtonStyled>
+				</template>
 			</div>
 		</div>
 		<div class="version-page__changelog universal-card">
diff --git a/apps/frontend/src/pages/moderation/external-projects.vue b/apps/frontend/src/pages/moderation/external-projects.vue
index 605bfc9bfc..fde7ff7ef2 100644
--- a/apps/frontend/src/pages/moderation/external-projects.vue
+++ b/apps/frontend/src/pages/moderation/external-projects.vue
@@ -185,7 +185,7 @@ function mapExternalProject(
 		exceptions: project.exceptions,
 		proof: project.proof,
 		flame_project_id: project.flame_project_id,
-		files: project.linked_files,
+		files: project.linked_files ?? [],
 	}
 }
 
diff --git a/apps/frontend/src/pages/report.vue b/apps/frontend/src/pages/report.vue
index 59af8701e6..461ac3fed5 100644
--- a/apps/frontend/src/pages/report.vue
+++ b/apps/frontend/src/pages/report.vue
@@ -284,11 +284,11 @@ import {
 	VersionIcon,
 	XCircleIcon,
 } from '@modrinth/assets'
-import { defineMessage } from '@modrinth/ui'
 import {
 	AutoLink,
 	Avatar,
 	ButtonStyled,
+	defineMessage,
 	defineMessages,
 	formatReportItemType,
 	injectNotificationManager,
diff --git a/apps/labrinth/.sqlx/query-6542c79dffa73e462c527f1bd4ba67e658814d7a788259dc4b3874c54cb5ae57.json b/apps/labrinth/.sqlx/query-03d85f360d4c603688d0662d24caee7b59985adba006fb531beb09f195582277.json
similarity index 86%
rename from apps/labrinth/.sqlx/query-6542c79dffa73e462c527f1bd4ba67e658814d7a788259dc4b3874c54cb5ae57.json
rename to apps/labrinth/.sqlx/query-03d85f360d4c603688d0662d24caee7b59985adba006fb531beb09f195582277.json
index 8668834ed4..d134483d44 100644
--- a/apps/labrinth/.sqlx/query-6542c79dffa73e462c527f1bd4ba67e658814d7a788259dc4b3874c54cb5ae57.json
+++ b/apps/labrinth/.sqlx/query-03d85f360d4c603688d0662d24caee7b59985adba006fb531beb09f195582277.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            mel.id,\n            mel.title,\n            mel.status,\n            mel.link,\n            mel.exceptions,\n            mel.proof,\n            mel.flame_project_id,\n            mel.inserted_at,\n            mel.inserted_by,\n            mel.updated_at,\n            mel.updated_by\n        FROM moderation_external_licenses mel\n        WHERE ($1::text IS NULL OR mel.title ILIKE '%' || $1 || '%')\n          AND ($2::integer IS NULL OR mel.flame_project_id = $2)\n        ORDER BY mel.id\n        ",
+  "query": "\n        SELECT\n            mel.id,\n            mel.title,\n            mel.status,\n            mel.link,\n            mel.exceptions,\n            mel.proof,\n            mel.flame_project_id,\n            mel.inserted_at,\n            mel.inserted_by,\n            mel.updated_at,\n            mel.updated_by\n        FROM moderation_external_licenses mel\n        WHERE mel.flame_project_id = ANY($1)\n        ORDER BY mel.id\n        ",
   "describe": {
     "columns": [
       {
@@ -61,8 +61,7 @@
     ],
     "parameters": {
       "Left": [
-        "Text",
-        "Int4"
+        "Int4Array"
       ]
     },
     "nullable": [
@@ -79,5 +78,5 @@
       true
     ]
   },
-  "hash": "6542c79dffa73e462c527f1bd4ba67e658814d7a788259dc4b3874c54cb5ae57"
+  "hash": "03d85f360d4c603688d0662d24caee7b59985adba006fb531beb09f195582277"
 }
diff --git a/apps/labrinth/.sqlx/query-0b06b60b7169a3f9ee66c7ec26f94982619e95a78ecb2d3ffa55774b098e0531.json b/apps/labrinth/.sqlx/query-0b06b60b7169a3f9ee66c7ec26f94982619e95a78ecb2d3ffa55774b098e0531.json
new file mode 100644
index 0000000000..ab2e4da34a
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-0b06b60b7169a3f9ee66c7ec26f94982619e95a78ecb2d3ffa55774b098e0531.json
@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        select\n            fa.file_id as \"file_id: DBFileId\",\n            f.url,\n            v.mod_id as \"project_id: DBProjectId\"\n        from file_scans fa\n        inner join files f on f.id = fa.file_id\n        inner join versions v on v.id = f.version_id\n        where fa.attributions_scanned_at is null\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "file_id: DBFileId",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "url",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "project_id: DBProjectId",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "0b06b60b7169a3f9ee66c7ec26f94982619e95a78ecb2d3ffa55774b098e0531"
+}
diff --git a/apps/labrinth/.sqlx/query-99749414f92886a904158484661cae8928f78206c1cdf8adb66fde999bbe94d4.json b/apps/labrinth/.sqlx/query-0e9e528a008a9dd24acfabbffcfe8ee4fd48fbae7c6197bfbbf1923e6256658b.json
similarity index 77%
rename from apps/labrinth/.sqlx/query-99749414f92886a904158484661cae8928f78206c1cdf8adb66fde999bbe94d4.json
rename to apps/labrinth/.sqlx/query-0e9e528a008a9dd24acfabbffcfe8ee4fd48fbae7c6197bfbbf1923e6256658b.json
index 890112c0a6..1fb57916d6 100644
--- a/apps/labrinth/.sqlx/query-99749414f92886a904158484661cae8928f78206c1cdf8adb66fde999bbe94d4.json
+++ b/apps/labrinth/.sqlx/query-0e9e528a008a9dd24acfabbffcfe8ee4fd48fbae7c6197bfbbf1923e6256658b.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            mel.id,\n            mel.title,\n            mel.status,\n            mel.link,\n            mel.exceptions,\n            mel.proof,\n            mel.flame_project_id,\n            mel.inserted_at,\n            mel.inserted_by,\n            mel.updated_at,\n            mel.updated_by\n        FROM moderation_external_files mef\n        INNER JOIN moderation_external_licenses mel ON mel.id = mef.external_license_id\n        WHERE mef.sha1 = $1\n        ",
+  "query": "\n        SELECT\n            mel.id,\n            mel.title,\n            mel.status,\n            mel.link,\n            mel.exceptions,\n            mel.proof,\n            mel.flame_project_id,\n            mel.inserted_at,\n            mel.inserted_by,\n            mel.updated_at,\n            mel.updated_by\n        FROM moderation_external_licenses mel\n        WHERE ($1::text IS NULL OR mel.title ILIKE '%' || $1 || '%')\n          AND (\n            ($2::integer IS NULL AND $3::integer[] IS NULL)\n            OR mel.flame_project_id = $2\n            OR mel.flame_project_id = ANY($3)\n          )\n        ORDER BY mel.id\n        ",
   "describe": {
     "columns": [
       {
@@ -61,7 +61,9 @@
     ],
     "parameters": {
       "Left": [
-        "Bytea"
+        "Text",
+        "Int4",
+        "Int4Array"
       ]
     },
     "nullable": [
@@ -78,5 +80,5 @@
       true
     ]
   },
-  "hash": "99749414f92886a904158484661cae8928f78206c1cdf8adb66fde999bbe94d4"
+  "hash": "0e9e528a008a9dd24acfabbffcfe8ee4fd48fbae7c6197bfbbf1923e6256658b"
 }
diff --git a/apps/labrinth/.sqlx/query-148ef260d2db9d31004be8227fba5b18600ad700fd5741553a5db810d08ae382.json b/apps/labrinth/.sqlx/query-148ef260d2db9d31004be8227fba5b18600ad700fd5741553a5db810d08ae382.json
new file mode 100644
index 0000000000..0e5de23c71
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-148ef260d2db9d31004be8227fba5b18600ad700fd5741553a5db810d08ae382.json
@@ -0,0 +1,34 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        select distinct f.version_id as \"version_id: DBVersionId\", f.id as \"file_id: DBFileId\",\n            pag.flame_project\n        from files f\n        inner join attribution_enforced_versions aev on aev.id = f.version_id\n        inner join override_file_sources ofs on ofs.file_id = f.id\n        inner join project_attribution_files paf on paf.sha1 = ofs.sha1\n        inner join project_attribution_groups pag on pag.id = paf.group_id\n        where f.version_id = ANY($1)\n          and (\n            pag.attribution is null\n            or pag.attribution->>'kind' = 'no_permission'\n            or coalesce(\n              pag.attribution->'moderation_status'->>'kind',\n              'approved'\n            ) != 'approved'\n          )\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "version_id: DBVersionId",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "file_id: DBFileId",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "flame_project",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8Array"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "148ef260d2db9d31004be8227fba5b18600ad700fd5741553a5db810d08ae382"
+}
diff --git a/apps/labrinth/.sqlx/query-623881c24c12e77f6fc57669929be55a34800cd2269da29d555959164919c9a3.json b/apps/labrinth/.sqlx/query-16e13baf35118cda943abf259a0e24cfe13436844b7909e6502ec15a249fc856.json
similarity index 56%
rename from apps/labrinth/.sqlx/query-623881c24c12e77f6fc57669929be55a34800cd2269da29d555959164919c9a3.json
rename to apps/labrinth/.sqlx/query-16e13baf35118cda943abf259a0e24cfe13436844b7909e6502ec15a249fc856.json
index 6ad1c4b9b5..d33825a8c3 100644
--- a/apps/labrinth/.sqlx/query-623881c24c12e77f6fc57669929be55a34800cd2269da29d555959164919c9a3.json
+++ b/apps/labrinth/.sqlx/query-16e13baf35118cda943abf259a0e24cfe13436844b7909e6502ec15a249fc856.json
@@ -1,30 +1,35 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n                    SELECT DISTINCT dependent_id as version_id, d.mod_dependency_id as dependency_project_id, d.dependency_id as dependency_version_id, d.dependency_file_name as file_name, d.dependency_type as dependency_type\n                    FROM dependencies d\n                    WHERE dependent_id = ANY($1)\n                    ",
+  "query": "\n                    SELECT DISTINCT d.id as dependency_id, dependent_id as version_id, d.mod_dependency_id as dependency_project_id, d.dependency_id as dependency_version_id, d.dependency_file_name as file_name, d.dependency_type as dependency_type\n                    FROM dependencies d\n                    WHERE dependent_id = ANY($1)\n                    ",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
+        "name": "dependency_id",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 1,
         "name": "version_id",
         "type_info": "Int8"
       },
       {
-        "ordinal": 1,
+        "ordinal": 2,
         "name": "dependency_project_id",
         "type_info": "Int8"
       },
       {
-        "ordinal": 2,
+        "ordinal": 3,
         "name": "dependency_version_id",
         "type_info": "Int8"
       },
       {
-        "ordinal": 3,
+        "ordinal": 4,
         "name": "file_name",
         "type_info": "Varchar"
       },
       {
-        "ordinal": 4,
+        "ordinal": 5,
         "name": "dependency_type",
         "type_info": "Varchar"
       }
@@ -35,6 +40,7 @@
       ]
     },
     "nullable": [
+      false,
       false,
       true,
       true,
@@ -42,5 +48,5 @@
       false
     ]
   },
-  "hash": "623881c24c12e77f6fc57669929be55a34800cd2269da29d555959164919c9a3"
+  "hash": "16e13baf35118cda943abf259a0e24cfe13436844b7909e6502ec15a249fc856"
 }
diff --git a/apps/labrinth/.sqlx/query-1d27a83fb85c4640c3fc88fc6caa8209973ced0f88d8dbecdac349bbe70930a5.json b/apps/labrinth/.sqlx/query-1d27a83fb85c4640c3fc88fc6caa8209973ced0f88d8dbecdac349bbe70930a5.json
new file mode 100644
index 0000000000..928f02a117
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-1d27a83fb85c4640c3fc88fc6caa8209973ced0f88d8dbecdac349bbe70930a5.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                insert into project_attribution_files (group_id, name, sha1, moderation_external_license_id)\n                values ($1, $2, $3, $4)\n                ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Text",
+        "Bytea",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1d27a83fb85c4640c3fc88fc6caa8209973ced0f88d8dbecdac349bbe70930a5"
+}
diff --git a/apps/labrinth/.sqlx/query-1d96df0ac64801641f9af796d482d2964c1acf2d03e15b8f1397340d0c994af6.json b/apps/labrinth/.sqlx/query-1d96df0ac64801641f9af796d482d2964c1acf2d03e15b8f1397340d0c994af6.json
new file mode 100644
index 0000000000..25146596a0
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-1d96df0ac64801641f9af796d482d2964c1acf2d03e15b8f1397340d0c994af6.json
@@ -0,0 +1,46 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tselect\n\t\t\tg.id as \"id: DBAttributionGroupId\",\n\t\t\tg.flame_project,\n\t\t\tg.attribution,\n\t\t\tg.attributed_at,\n\t\t\tg.attributed_by as \"attributed_by: i64\"\n\t\tfrom project_attribution_groups g\n\t\twhere g.project_id = $1\n\t\t",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id: DBAttributionGroupId",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "flame_project",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 2,
+        "name": "attribution",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 3,
+        "name": "attributed_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 4,
+        "name": "attributed_by: i64",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "1d96df0ac64801641f9af796d482d2964c1acf2d03e15b8f1397340d0c994af6"
+}
diff --git a/apps/labrinth/.sqlx/query-25d6977fa2db63f979fbe391f3475445fa92c9bbb5b034531f5e033a18c2a6a3.json b/apps/labrinth/.sqlx/query-25d6977fa2db63f979fbe391f3475445fa92c9bbb5b034531f5e033a18c2a6a3.json
new file mode 100644
index 0000000000..1fbd6879da
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-25d6977fa2db63f979fbe391f3475445fa92c9bbb5b034531f5e033a18c2a6a3.json
@@ -0,0 +1,88 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT\n            mef.sha1 hash,\n            mel.id,\n            mel.title,\n            mel.status,\n            mel.link,\n            mel.exceptions,\n            mel.proof,\n            mel.flame_project_id,\n            mel.inserted_at,\n            mel.inserted_by,\n            mel.updated_at,\n            mel.updated_by\n        FROM moderation_external_files mef\n        INNER JOIN moderation_external_licenses mel ON mel.id = mef.external_license_id\n        WHERE mef.sha1 = ANY($1)\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "hash",
+        "type_info": "Bytea"
+      },
+      {
+        "ordinal": 1,
+        "name": "id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "title",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "status",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "link",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 5,
+        "name": "exceptions",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 6,
+        "name": "proof",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 7,
+        "name": "flame_project_id",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 8,
+        "name": "inserted_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 9,
+        "name": "inserted_by",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 10,
+        "name": "updated_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 11,
+        "name": "updated_by",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "ByteaArray"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      true,
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "25d6977fa2db63f979fbe391f3475445fa92c9bbb5b034531f5e033a18c2a6a3"
+}
diff --git a/apps/labrinth/.sqlx/query-2e6bb84f45c0f8ba7bb9b09bf3def4322f727c7af8bd4be49dc4d7c487b925ed.json b/apps/labrinth/.sqlx/query-2e6bb84f45c0f8ba7bb9b09bf3def4322f727c7af8bd4be49dc4d7c487b925ed.json
new file mode 100644
index 0000000000..2c5ee6ec20
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-2e6bb84f45c0f8ba7bb9b09bf3def4322f727c7af8bd4be49dc4d7c487b925ed.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            insert into project_attribution_files (group_id, name, sha1)\n            select $1, unnest($2::text[]), unnest($3::bytea[])\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "TextArray",
+        "ByteaArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "2e6bb84f45c0f8ba7bb9b09bf3def4322f727c7af8bd4be49dc4d7c487b925ed"
+}
diff --git a/apps/labrinth/.sqlx/query-2f56a06b78a810936a77547ab5890943d6aa3e9143a8e2617d025be960880223.json b/apps/labrinth/.sqlx/query-2f56a06b78a810936a77547ab5890943d6aa3e9143a8e2617d025be960880223.json
new file mode 100644
index 0000000000..202c1c4e6d
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-2f56a06b78a810936a77547ab5890943d6aa3e9143a8e2617d025be960880223.json
@@ -0,0 +1,40 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            SELECT mel.id, mel.flame_project_id, mel.status status, mel.link\n            FROM moderation_external_licenses mel\n            WHERE mel.flame_project_id = ANY($1)\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "flame_project_id",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 2,
+        "name": "status",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "link",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int4Array"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      false,
+      true
+    ]
+  },
+  "hash": "2f56a06b78a810936a77547ab5890943d6aa3e9143a8e2617d025be960880223"
+}
diff --git a/apps/labrinth/.sqlx/query-301959b1ec20a4925f86188bc5e1c0cdd11f0d15004ce9f91fbeefcc3a27f8f4.json b/apps/labrinth/.sqlx/query-301959b1ec20a4925f86188bc5e1c0cdd11f0d15004ce9f91fbeefcc3a27f8f4.json
new file mode 100644
index 0000000000..80c3a445f6
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-301959b1ec20a4925f86188bc5e1c0cdd11f0d15004ce9f91fbeefcc3a27f8f4.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        DELETE FROM project_attribution_groups g\n        WHERE NOT EXISTS (\n            SELECT 1\n            FROM project_attribution_files paf\n            INNER JOIN override_file_sources ofs ON ofs.sha1 = paf.sha1\n            WHERE paf.group_id = g.id\n        )\n        ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "301959b1ec20a4925f86188bc5e1c0cdd11f0d15004ce9f91fbeefcc3a27f8f4"
+}
diff --git a/apps/labrinth/.sqlx/query-424b975139004d2854d9365ef950984dd1a65e333bb80924b5883df5e7d3cad2.json b/apps/labrinth/.sqlx/query-424b975139004d2854d9365ef950984dd1a65e333bb80924b5883df5e7d3cad2.json
new file mode 100644
index 0000000000..c427ada77e
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-424b975139004d2854d9365ef950984dd1a65e333bb80924b5883df5e7d3cad2.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        select id as \"id: DBAttributionGroupId\", flame_project\n        from project_attribution_groups\n        where project_id = $1 and flame_project is not null\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id: DBAttributionGroupId",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "flame_project",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "424b975139004d2854d9365ef950984dd1a65e333bb80924b5883df5e7d3cad2"
+}
diff --git a/apps/labrinth/.sqlx/query-48a83bc9de9bea73eac5c43e71f43fb8a1ac7eb67079d16e3de92f5ff6bf72b8.json b/apps/labrinth/.sqlx/query-48a83bc9de9bea73eac5c43e71f43fb8a1ac7eb67079d16e3de92f5ff6bf72b8.json
new file mode 100644
index 0000000000..dac0ac1f3f
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-48a83bc9de9bea73eac5c43e71f43fb8a1ac7eb67079d16e3de92f5ff6bf72b8.json
@@ -0,0 +1,47 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\t\tselect\n\t\t\t\tpaf.group_id as \"group_id!\",\n\t\t\t\tpaf.name as \"name!\",\n\t\t\t\tconvert_from(paf.sha1, 'UTF8') as \"sha1!\",\n\t\t\t\tpaf.moderation_external_license_id,\n\t\t\t\tcoalesce(array_agg(distinct aev.id) filter (where aev.id is not null), '{}') as \"version_ids!: Vec<i64>\"\n\t\t\tfrom project_attribution_files paf\n\t\t\tleft join override_file_sources ofs on ofs.sha1 = paf.sha1\n\t\t\tleft join files f on f.id = ofs.file_id\n\t\t\tleft join versions v on v.id = f.version_id and v.mod_id = $2\n\t\t\tleft join attribution_enforced_versions aev on aev.id = v.id\n\t\t\twhere paf.group_id = ANY($1)\n\t\t\tgroup by paf.group_id, paf.name, paf.sha1, paf.moderation_external_license_id\n\t\t\t",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "group_id!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "name!",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "sha1!",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "moderation_external_license_id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 4,
+        "name": "version_ids!: Vec<i64>",
+        "type_info": "Int8Array"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8Array",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      null,
+      true,
+      null
+    ]
+  },
+  "hash": "48a83bc9de9bea73eac5c43e71f43fb8a1ac7eb67079d16e3de92f5ff6bf72b8"
+}
diff --git a/apps/labrinth/.sqlx/query-4fb69c674dca723b6b2cb7bea07d51feb43b2714c1cd6a2987a6fe1f10e2579a.json b/apps/labrinth/.sqlx/query-4fb69c674dca723b6b2cb7bea07d51feb43b2714c1cd6a2987a6fe1f10e2579a.json
new file mode 100644
index 0000000000..76174d70dd
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-4fb69c674dca723b6b2cb7bea07d51feb43b2714c1cd6a2987a6fe1f10e2579a.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tupdate project_attribution_files\n\t\tset group_id = $1\n\t\twhere sha1 = $2\n\t\tand group_id in (\n\t\t\tselect id from project_attribution_groups where project_id = $3\n\t\t)\n\t\t",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Bytea",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "4fb69c674dca723b6b2cb7bea07d51feb43b2714c1cd6a2987a6fe1f10e2579a"
+}
diff --git a/apps/labrinth/.sqlx/query-5f7b9d628d3ff0addc12cfaab68d7cbcca08a89aedeb15ce5926ed87ed8a12c6.json b/apps/labrinth/.sqlx/query-5f7b9d628d3ff0addc12cfaab68d7cbcca08a89aedeb15ce5926ed87ed8a12c6.json
new file mode 100644
index 0000000000..e71a423986
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-5f7b9d628d3ff0addc12cfaab68d7cbcca08a89aedeb15ce5926ed87ed8a12c6.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tupdate project_attribution_files\n\t\tset group_id = $1\n\t\twhere sha1 = $2 and group_id = $3\n\t\t",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Bytea",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "5f7b9d628d3ff0addc12cfaab68d7cbcca08a89aedeb15ce5926ed87ed8a12c6"
+}
diff --git a/apps/labrinth/.sqlx/query-5f847946ce63d3773b9a5822971ee7acaafeed018ce0540b2826bd878f213b87.json b/apps/labrinth/.sqlx/query-5f847946ce63d3773b9a5822971ee7acaafeed018ce0540b2826bd878f213b87.json
new file mode 100644
index 0000000000..a219d084e8
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-5f847946ce63d3773b9a5822971ee7acaafeed018ce0540b2826bd878f213b87.json
@@ -0,0 +1,82 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT\n            id,\n            title,\n            status,\n            link,\n            exceptions,\n            proof,\n            flame_project_id,\n            inserted_at,\n            inserted_by,\n            updated_at,\n            updated_by\n        FROM moderation_external_licenses\n        WHERE id = $1\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "title",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "status",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "link",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "exceptions",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 5,
+        "name": "proof",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 6,
+        "name": "flame_project_id",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 7,
+        "name": "inserted_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 8,
+        "name": "inserted_by",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 9,
+        "name": "updated_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 10,
+        "name": "updated_by",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "5f847946ce63d3773b9a5822971ee7acaafeed018ce0540b2826bd878f213b87"
+}
diff --git a/apps/labrinth/.sqlx/query-6320df0491556027ee64fd031797b252c2145ecf179e9ea9a8cedbdc8b7ed622.json b/apps/labrinth/.sqlx/query-6320df0491556027ee64fd031797b252c2145ecf179e9ea9a8cedbdc8b7ed622.json
new file mode 100644
index 0000000000..297814d5ad
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-6320df0491556027ee64fd031797b252c2145ecf179e9ea9a8cedbdc8b7ed622.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tinsert into project_attribution_groups (id, project_id)\n\t\tvalues ($1, $2)\n\t\t",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "6320df0491556027ee64fd031797b252c2145ecf179e9ea9a8cedbdc8b7ed622"
+}
diff --git a/apps/labrinth/.sqlx/query-64c6abc464f2df37372875817ceb67b0e33786fe3dd27c052311356d43b1d601.json b/apps/labrinth/.sqlx/query-64c6abc464f2df37372875817ceb67b0e33786fe3dd27c052311356d43b1d601.json
new file mode 100644
index 0000000000..ee0f3478d5
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-64c6abc464f2df37372875817ceb67b0e33786fe3dd27c052311356d43b1d601.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            INSERT INTO file_scans (file_id)\n            VALUES ($1)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "64c6abc464f2df37372875817ceb67b0e33786fe3dd27c052311356d43b1d601"
+}
diff --git a/apps/labrinth/.sqlx/query-73f7542b4b6738c4baf1e2a3513645c3bf07a960b7b9fac529f23099675ec0cc.json b/apps/labrinth/.sqlx/query-73f7542b4b6738c4baf1e2a3513645c3bf07a960b7b9fac529f23099675ec0cc.json
new file mode 100644
index 0000000000..1aa6170dcc
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-73f7542b4b6738c4baf1e2a3513645c3bf07a960b7b9fac529f23099675ec0cc.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tselect exists(\n\t\t\tselect 1 from project_attribution_groups where id = $1 and project_id = $2\n\t\t) as \"exists!\"\n\t\t",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "73f7542b4b6738c4baf1e2a3513645c3bf07a960b7b9fac529f23099675ec0cc"
+}
diff --git a/apps/labrinth/.sqlx/query-80751dbca09a9dcb469a30fe5b8225e520baf50750a78875f582349610439a55.json b/apps/labrinth/.sqlx/query-80751dbca09a9dcb469a30fe5b8225e520baf50750a78875f582349610439a55.json
new file mode 100644
index 0000000000..b8fc60acc8
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-80751dbca09a9dcb469a30fe5b8225e520baf50750a78875f582349610439a55.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        insert into file_scans (file_id, attributions_scanned_at)\n        values ($1, now())\n        on conflict (file_id) do update set attributions_scanned_at = now()\n        ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "80751dbca09a9dcb469a30fe5b8225e520baf50750a78875f582349610439a55"
+}
diff --git a/apps/labrinth/.sqlx/query-8820a5985291c159c98371c9650092e3eba21c81e3b3386be779978aff30451a.json b/apps/labrinth/.sqlx/query-8820a5985291c159c98371c9650092e3eba21c81e3b3386be779978aff30451a.json
deleted file mode 100644
index 18d5cf1b83..0000000000
--- a/apps/labrinth/.sqlx/query-8820a5985291c159c98371c9650092e3eba21c81e3b3386be779978aff30451a.json
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT DISTINCT ON (dr.id)\n            to_jsonb(dr)\n            || jsonb_build_object(\n                'report_id', dr.id,\n                'file_id', to_base62(f.id),\n                'version_id', to_base62(v.id),\n                'project_id', to_base62(v.mod_id),\n                'file_name', f.filename,\n                'file_size', f.size,\n                'flag_reason', 'delphi',\n                'download_url', f.url,\n                -- TODO: replace with `json_array` in Postgres 16\n                'issues', (\n                    SELECT json_agg(\n                        to_jsonb(dri)\n                        || jsonb_build_object(\n                            -- TODO: replace with `json_array` in Postgres 16\n                            'details', (\n                                SELECT coalesce(jsonb_agg(\n                                    jsonb_build_object(\n                                        'id', didws.id,\n                                        'issue_id', didws.issue_id,\n                                        'key', didws.key,\n                                        'file_path', didws.file_path,\n                                        'decompiled_source', didws.decompiled_source,\n                                        'data', didws.data,\n                                        'severity', didws.severity,\n                                        'status', didws.status\n                                    )\n                                ), '[]'::jsonb)\n                                FROM delphi_issue_details_with_statuses didws\n                                WHERE didws.issue_id = dri.id\n                            )\n                        )\n                    )\n                    FROM delphi_report_issues dri\n                    WHERE\n                        dri.report_id = dr.id\n                        -- see delphi.rs todo comment\n                        AND dri.issue_type != '__dummy'\n                )\n            ) AS \"data!: sqlx::types::Json<FileReport>\"\n        FROM delphi_reports dr\n        INNER JOIN files f ON f.id = dr.file_id\n        INNER JOIN versions v ON v.id = f.version_id\n        WHERE dr.id = $1\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "data!: sqlx::types::Json<FileReport>",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "8820a5985291c159c98371c9650092e3eba21c81e3b3386be779978aff30451a"
-}
diff --git a/apps/labrinth/.sqlx/query-8ffcb0c2bd82eaf64b143745adab359db6fcc448d6306292a7b345277a075883.json b/apps/labrinth/.sqlx/query-8ffcb0c2bd82eaf64b143745adab359db6fcc448d6306292a7b345277a075883.json
new file mode 100644
index 0000000000..3da4278f04
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-8ffcb0c2bd82eaf64b143745adab359db6fcc448d6306292a7b345277a075883.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM project_attribution_groups WHERE id=$1)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "8ffcb0c2bd82eaf64b143745adab359db6fcc448d6306292a7b345277a075883"
+}
diff --git a/apps/labrinth/.sqlx/query-944286604bdef4ee40f79af358d1b68cc93bfd2067619d9cc1d03013f73e5424.json b/apps/labrinth/.sqlx/query-944286604bdef4ee40f79af358d1b68cc93bfd2067619d9cc1d03013f73e5424.json
new file mode 100644
index 0000000000..06e8fd3198
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-944286604bdef4ee40f79af358d1b68cc93bfd2067619d9cc1d03013f73e5424.json
@@ -0,0 +1,82 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\t\t\tselect\n\t\t\t\t\tid,\n\t\t\t\t\ttitle,\n\t\t\t\t\tstatus,\n\t\t\t\t\tlink,\n\t\t\t\t\texceptions,\n\t\t\t\t\tproof,\n\t\t\t\t\tflame_project_id,\n\t\t\t\t\tinserted_at,\n\t\t\t\t\tinserted_by,\n\t\t\t\t\tupdated_at,\n\t\t\t\t\tupdated_by\n\t\t\t\tfrom moderation_external_licenses\n\t\t\t\twhere id = ANY($1)\n\t\t\t\t",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "title",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "status",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "link",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "exceptions",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 5,
+        "name": "proof",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 6,
+        "name": "flame_project_id",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 7,
+        "name": "inserted_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 8,
+        "name": "inserted_by",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 9,
+        "name": "updated_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 10,
+        "name": "updated_by",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8Array"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "944286604bdef4ee40f79af358d1b68cc93bfd2067619d9cc1d03013f73e5424"
+}
diff --git a/apps/labrinth/.sqlx/query-94920d66b27503c84744d41cb2b44dd213bb461596046488eaab0b62b0fe83c5.json b/apps/labrinth/.sqlx/query-94920d66b27503c84744d41cb2b44dd213bb461596046488eaab0b62b0fe83c5.json
new file mode 100644
index 0000000000..7b1815f835
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-94920d66b27503c84744d41cb2b44dd213bb461596046488eaab0b62b0fe83c5.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tupdate project_attribution_groups\n\t\tset attribution = $1, attributed_at = now(), attributed_by = $3\n\t\twhere id = $2\n\t\t",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb",
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "94920d66b27503c84744d41cb2b44dd213bb461596046488eaab0b62b0fe83c5"
+}
diff --git a/apps/labrinth/.sqlx/query-95750cd616b72347fb997c3b02a3d69f13be5993c1fd2e302761089c499fb015.json b/apps/labrinth/.sqlx/query-95750cd616b72347fb997c3b02a3d69f13be5993c1fd2e302761089c499fb015.json
new file mode 100644
index 0000000000..07c051f897
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-95750cd616b72347fb997c3b02a3d69f13be5993c1fd2e302761089c499fb015.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            insert into project_attribution_files (group_id, name, sha1, moderation_external_license_id)\n            values ($1, $2, $3, $4)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Text",
+        "Bytea",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "95750cd616b72347fb997c3b02a3d69f13be5993c1fd2e302761089c499fb015"
+}
diff --git a/apps/labrinth/.sqlx/query-968904f577c2c696c6222e19cc145bce0e845f2ab9f8629b0789a4861bddb4dc.json b/apps/labrinth/.sqlx/query-968904f577c2c696c6222e19cc145bce0e845f2ab9f8629b0789a4861bddb4dc.json
new file mode 100644
index 0000000000..1a588c429d
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-968904f577c2c696c6222e19cc145bce0e845f2ab9f8629b0789a4861bddb4dc.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            update file_scans\n            set attributions_scanned_at = now\n            from unnest($1::bigint[], $2::timestamptz[]) as u(id, now)\n            where file_scans.file_id = u.id\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8Array",
+        "TimestamptzArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "968904f577c2c696c6222e19cc145bce0e845f2ab9f8629b0789a4861bddb4dc"
+}
diff --git a/apps/labrinth/.sqlx/query-b471add519874a6364b7a9cdbfa3a8e6f5a8a1ac9a7bacbce378f7995eb48664.json b/apps/labrinth/.sqlx/query-b471add519874a6364b7a9cdbfa3a8e6f5a8a1ac9a7bacbce378f7995eb48664.json
new file mode 100644
index 0000000000..e4cde72b9a
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-b471add519874a6364b7a9cdbfa3a8e6f5a8a1ac9a7bacbce378f7995eb48664.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            insert into project_attribution_groups (id, project_id)\n            values ($1, $2)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "b471add519874a6364b7a9cdbfa3a8e6f5a8a1ac9a7bacbce378f7995eb48664"
+}
diff --git a/apps/labrinth/.sqlx/query-b782ed64e0df1e83623c8a8e55c00716f5338c85b6dfbb15c3465ff0cec339a7.json b/apps/labrinth/.sqlx/query-b782ed64e0df1e83623c8a8e55c00716f5338c85b6dfbb15c3465ff0cec339a7.json
new file mode 100644
index 0000000000..af1927f767
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-b782ed64e0df1e83623c8a8e55c00716f5338c85b6dfbb15c3465ff0cec339a7.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tselect paf.group_id\n\t\tfrom project_attribution_files paf\n\t\tinner join project_attribution_groups pag on pag.id = paf.group_id\n\t\twhere paf.sha1 = $1 and pag.project_id = $2\n\t\t",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "group_id",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Bytea",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "b782ed64e0df1e83623c8a8e55c00716f5338c85b6dfbb15c3465ff0cec339a7"
+}
diff --git a/apps/labrinth/.sqlx/query-bb7c239e2b424557f260c56c01e15ab8b0ec04d76a55a50888d28e6c5d3948bc.json b/apps/labrinth/.sqlx/query-bb7c239e2b424557f260c56c01e15ab8b0ec04d76a55a50888d28e6c5d3948bc.json
new file mode 100644
index 0000000000..316779bfde
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-bb7c239e2b424557f260c56c01e15ab8b0ec04d76a55a50888d28e6c5d3948bc.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tselect attribution\n\t\tfrom project_attribution_groups\n\t\twhere id = $1\n\t\t",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "attribution",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "bb7c239e2b424557f260c56c01e15ab8b0ec04d76a55a50888d28e6c5d3948bc"
+}
diff --git a/apps/labrinth/.sqlx/query-c39e1f0d820101ac1b19a3849254b03259f38f3de9ddca32e6189a7e015dd853.json b/apps/labrinth/.sqlx/query-c39e1f0d820101ac1b19a3849254b03259f38f3de9ddca32e6189a7e015dd853.json
new file mode 100644
index 0000000000..19a77c556c
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-c39e1f0d820101ac1b19a3849254b03259f38f3de9ddca32e6189a7e015dd853.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            insert into project_attribution_files (group_id, name, sha1)\n            values ($1, $2, $3)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Text",
+        "Bytea"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "c39e1f0d820101ac1b19a3849254b03259f38f3de9ddca32e6189a7e015dd853"
+}
diff --git a/apps/labrinth/.sqlx/query-ce9b408d416b4782ad501e14cb1ff006964818e81855bb299b269ffaa4c3f7fa.json b/apps/labrinth/.sqlx/query-ce9b408d416b4782ad501e14cb1ff006964818e81855bb299b269ffaa4c3f7fa.json
new file mode 100644
index 0000000000..9d4ffdf994
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-ce9b408d416b4782ad501e14cb1ff006964818e81855bb299b269ffaa4c3f7fa.json
@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tselect paf.group_id, paf.name from project_attribution_files paf\n\t\tinner join project_attribution_groups pag on pag.id = paf.group_id\n\t\twhere paf.sha1 = $1 and pag.project_id = $2\n\t\t",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "group_id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "name",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Bytea",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "ce9b408d416b4782ad501e14cb1ff006964818e81855bb299b269ffaa4c3f7fa"
+}
diff --git a/apps/labrinth/.sqlx/query-dac21bfc23fe361a6133e69892224351aefa03f14efec1be31a21441419e19b9.json b/apps/labrinth/.sqlx/query-dac21bfc23fe361a6133e69892224351aefa03f14efec1be31a21441419e19b9.json
new file mode 100644
index 0000000000..8565cb6fbd
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-dac21bfc23fe361a6133e69892224351aefa03f14efec1be31a21441419e19b9.json
@@ -0,0 +1,40 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\t\tselect id, name, version_number, date_published\n\t\t\tfrom versions\n\t\t\twhere id = ANY($1)\n\t\t\torder by date_published desc\n\t\t\t",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "name",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "version_number",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "date_published",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8Array"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "dac21bfc23fe361a6133e69892224351aefa03f14efec1be31a21441419e19b9"
+}
diff --git a/apps/labrinth/.sqlx/query-df7652db8624e291447975b1d9b2151b1627316fbaaea4914607d66869670375.json b/apps/labrinth/.sqlx/query-df7652db8624e291447975b1d9b2151b1627316fbaaea4914607d66869670375.json
new file mode 100644
index 0000000000..2456b3554f
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-df7652db8624e291447975b1d9b2151b1627316fbaaea4914607d66869670375.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            insert into project_attribution_groups (id, project_id, attribution, flame_project)\n            values ($1, $2, $3, $4)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8",
+        "Jsonb",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "df7652db8624e291447975b1d9b2151b1627316fbaaea4914607d66869670375"
+}
diff --git a/apps/labrinth/.sqlx/query-e4b58fe6e5d19ded48ab9e457b4e96fb51c8f74a7532bb9ab2e7a945b95bbe78.json b/apps/labrinth/.sqlx/query-e4b58fe6e5d19ded48ab9e457b4e96fb51c8f74a7532bb9ab2e7a945b95bbe78.json
new file mode 100644
index 0000000000..91a7a9c5c8
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-e4b58fe6e5d19ded48ab9e457b4e96fb51c8f74a7532bb9ab2e7a945b95bbe78.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        select paf.sha1 from project_attribution_files paf\n        inner join project_attribution_groups pag on pag.id = paf.group_id\n        where pag.project_id = $1 and paf.sha1 = ANY($2)\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "sha1",
+        "type_info": "Bytea"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "ByteaArray"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "e4b58fe6e5d19ded48ab9e457b4e96fb51c8f74a7532bb9ab2e7a945b95bbe78"
+}
diff --git a/apps/labrinth/.sqlx/query-e7a0481729efa9cba6140effcdddff1a076eb7269d5b22860db3e3d1a651f6eb.json b/apps/labrinth/.sqlx/query-e7a0481729efa9cba6140effcdddff1a076eb7269d5b22860db3e3d1a651f6eb.json
new file mode 100644
index 0000000000..0b7cf69e9c
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-e7a0481729efa9cba6140effcdddff1a076eb7269d5b22860db3e3d1a651f6eb.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            insert into override_file_sources (sha1, file_id)\n            select unnest($1::bytea[]), $2\n            on conflict do nothing\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "ByteaArray",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e7a0481729efa9cba6140effcdddff1a076eb7269d5b22860db3e3d1a651f6eb"
+}
diff --git a/apps/labrinth/.sqlx/query-ed027c5571c34ff4fd1ac50e96f257b0055c9497d2699927b34829490e7a2529.json b/apps/labrinth/.sqlx/query-ed027c5571c34ff4fd1ac50e96f257b0055c9497d2699927b34829490e7a2529.json
new file mode 100644
index 0000000000..1b14566eb0
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-ed027c5571c34ff4fd1ac50e96f257b0055c9497d2699927b34829490e7a2529.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tdelete from project_attribution_groups g\n\t\twhere not exists (\n\t\t\tselect 1 from project_attribution_files f where f.group_id = g.id\n\t\t)\n\t\t",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "ed027c5571c34ff4fd1ac50e96f257b0055c9497d2699927b34829490e7a2529"
+}
diff --git a/apps/labrinth/.sqlx/query-f453824f96385cccb703848189f25076fd9c1578e417d899d959a19dd9f940c3.json b/apps/labrinth/.sqlx/query-f453824f96385cccb703848189f25076fd9c1578e417d899d959a19dd9f940c3.json
new file mode 100644
index 0000000000..8618a4355c
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-f453824f96385cccb703848189f25076fd9c1578e417d899d959a19dd9f940c3.json
@@ -0,0 +1,40 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        select\n            d.id as \"dependency_id!\",\n            pag.attribution,\n            pag.flame_project,\n            pag.project_id as \"project_id: DBProjectId\"\n        from dependencies d\n        inner join files f on f.version_id = d.dependent_id\n        inner join attribution_enforced_versions aev on aev.id = f.version_id\n        inner join override_file_sources ofs on ofs.file_id = f.id\n        inner join project_attribution_files paf on paf.sha1 = ofs.sha1\n        inner join project_attribution_groups pag on pag.id = paf.group_id\n        where d.dependent_id = ANY($1)\n          and d.dependency_file_name is not null\n          and (\n            pag.flame_project is not null\n            or pag.attribution is not null\n          )\n          and split_part(paf.name, '/', -1) = d.dependency_file_name\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "dependency_id!",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 1,
+        "name": "attribution",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 2,
+        "name": "flame_project",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 3,
+        "name": "project_id: DBProjectId",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8Array"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      true,
+      false
+    ]
+  },
+  "hash": "f453824f96385cccb703848189f25076fd9c1578e417d899d959a19dd9f940c3"
+}
diff --git a/apps/labrinth/.sqlx/query-f9131eb55490b96851ac3760e3199d2fd2dbb3d212cb2b8687dda8ba0fad2a80.json b/apps/labrinth/.sqlx/query-f9131eb55490b96851ac3760e3199d2fd2dbb3d212cb2b8687dda8ba0fad2a80.json
new file mode 100644
index 0000000000..0ccd35ecd7
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-f9131eb55490b96851ac3760e3199d2fd2dbb3d212cb2b8687dda8ba0fad2a80.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                insert into project_attribution_groups (id, project_id, flame_project)\n                values ($1, $2, $3)\n                ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "f9131eb55490b96851ac3760e3199d2fd2dbb3d212cb2b8687dda8ba0fad2a80"
+}
diff --git a/apps/labrinth/.sqlx/query-f9b96c70c83f1bf0112243602843abae6ddc8851fc623ccf0a23f87567763485.json b/apps/labrinth/.sqlx/query-f9b96c70c83f1bf0112243602843abae6ddc8851fc623ccf0a23f87567763485.json
new file mode 100644
index 0000000000..17bdd2c3af
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-f9b96c70c83f1bf0112243602843abae6ddc8851fc623ccf0a23f87567763485.json
@@ -0,0 +1,40 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT encode(mef.sha1, 'escape') sha1, mel.id, mel.status status, mel.link\n        FROM moderation_external_files mef\n        INNER JOIN moderation_external_licenses mel ON mef.external_license_id = mel.id\n        WHERE mef.sha1 = ANY($1)\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "sha1",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 1,
+        "name": "id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "status",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "link",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "ByteaArray"
+      ]
+    },
+    "nullable": [
+      null,
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "f9b96c70c83f1bf0112243602843abae6ddc8851fc623ccf0a23f87567763485"
+}
diff --git a/apps/labrinth/.sqlx/query-fe4ff6ab40fe3dc3d474c0c23c9dba514c66ac30e573fc5f4e44ed7ff360d3d6.json b/apps/labrinth/.sqlx/query-fe4ff6ab40fe3dc3d474c0c23c9dba514c66ac30e573fc5f4e44ed7ff360d3d6.json
new file mode 100644
index 0000000000..99a5a8243f
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-fe4ff6ab40fe3dc3d474c0c23c9dba514c66ac30e573fc5f4e44ed7ff360d3d6.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT DISTINCT ON (dr.id)\n            to_jsonb(dr)\n            || jsonb_build_object(\n                'report_id', dr.id,\n                'file_id', to_base62(f.id),\n                'version_id', to_base62(v.id),\n                'project_id', to_base62(v.mod_id),\n                'file_name', f.filename,\n                'file_size', f.size,\n                'flag_reason', 'delphi',\n                'download_url', f.url,\n                -- TODO: replace with `json_array` in Postgres 16\n\t\t\t\t'issues', (\n\t\t\t\t\tSELECT coalesce(json_agg(\n\t\t\t\t\t\tto_jsonb(dri)\n\t\t\t\t\t\t|| jsonb_build_object(\n\t\t\t\t\t\t\t-- TODO: replace with `json_array` in Postgres 16\n\t\t\t\t\t\t\t'details', (\n\t\t\t\t\t\t\t\tSELECT coalesce(jsonb_agg(\n                                    jsonb_build_object(\n                                        'id', didws.id,\n                                        'issue_id', didws.issue_id,\n                                        'key', didws.key,\n                                        'file_path', didws.file_path,\n                                        'decompiled_source', didws.decompiled_source,\n                                        'data', didws.data,\n                                        'severity', didws.severity,\n                                        'status', didws.status\n                                    )\n                                ), '[]'::jsonb)\n                                FROM delphi_issue_details_with_statuses didws\n                                WHERE didws.issue_id = dri.id\n                            )\n\t\t\t\t\t\t)\n\t\t\t\t\t), '[]'::json)\n\t\t\t\t\tFROM delphi_report_issues dri\n\t\t\t\t\tWHERE\n\t\t\t\t\t\tdri.report_id = dr.id\n                        -- see delphi.rs todo comment\n                        AND dri.issue_type != '__dummy'\n                )\n            ) AS \"data!: sqlx::types::Json<FileReport>\"\n        FROM delphi_reports dr\n        INNER JOIN files f ON f.id = dr.file_id\n        INNER JOIN versions v ON v.id = f.version_id\n        WHERE dr.id = $1\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "data!: sqlx::types::Json<FileReport>",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "fe4ff6ab40fe3dc3d474c0c23c9dba514c66ac30e573fc5f4e44ed7ff360d3d6"
+}
diff --git a/apps/labrinth/AGENTS.md~HEAD b/apps/labrinth/AGENTS.md~HEAD
new file mode 100644
index 0000000000..0b73458d53
--- /dev/null
+++ b/apps/labrinth/AGENTS.md~HEAD
@@ -0,0 +1,34 @@
+# Labrinth
+
+Labrinth is the backend API service for Modrinth, written in Rust.
+
+## Code style
+
+- When writing `sqlx` queries, NEVER use `query` directly. Always prefer using the `query!`, `query_as!`, `query_scalar!` macros.
+
+## Pre-PR Checks
+
+When the user refers to "perform[ing] pre-PR checks", do the following:
+
+- Run `cargo clippy -p labrinth --all-targets` — there must be ZERO warnings, otherwise CI will fail
+- DO NOT run tests unless explicitly requested (they take a long time)
+- Prepare the sqlx cache: cd into `apps/labrinth` and run `cargo sqlx prepare -- --tests`
+	- NEVER run `cargo sqlx prepare --workspace`
+
+## Testing
+
+- Run `cargo test -p labrinth --all-targets` to test your changes — all tests must pass
+
+## Local Services
+
+- Read the root `docker-compose.yml` to see what running services are available while developing
+- Use `docker exec` to access these services
+
+### Clickhouse
+
+- Access: `docker exec labrinth-clickhouse clickhouse-client`
+- Database: `staging_ariadne`
+
+### Postgres
+
+- Access: `docker exec labrinth-postgres psql -U labrinth -d labrinth -c "<query>"`
diff --git a/apps/labrinth/migrations/20260423114534_project_attribution.sql b/apps/labrinth/migrations/20260423114534_project_attribution.sql
new file mode 100644
index 0000000000..805d85d870
--- /dev/null
+++ b/apps/labrinth/migrations/20260423114534_project_attribution.sql
@@ -0,0 +1,33 @@
+create table file_scans (
+	file_id bigint primary key references files(id),
+	-- if a file..
+	-- - does not have a row
+	--   -> was created before attributions system
+	-- - has a row, but `attributions_scanned_at = null`
+	--   -> still needs to be scanned
+	-- - has a row, and `attributions_scanned_at` is not null
+	--   -> attributions have been scanned
+	attributions_scanned_at timestamptz
+);
+
+create table project_attribution_groups (
+	id bigint primary key,
+	project_id bigint not null references mods(id),
+	flame_project jsonb,
+	attribution jsonb,
+	attributed_at timestamptz,
+	attributed_by bigint references users(id)
+);
+create index on project_attribution_groups (project_id);
+
+create table project_attribution_files (
+	group_id bigint not null references project_attribution_groups(id),
+	name text not null,
+	sha1 bytea not null
+);
+
+create table override_file_sources (
+	sha1 bytea not null,
+	file_id bigint not null references files(id),
+	primary key (sha1, file_id)
+);
diff --git a/apps/labrinth/migrations/20260519143157_fix_file_attribution_deletion.sql b/apps/labrinth/migrations/20260519143157_fix_file_attribution_deletion.sql
new file mode 100644
index 0000000000..473dbda6e9
--- /dev/null
+++ b/apps/labrinth/migrations/20260519143157_fix_file_attribution_deletion.sql
@@ -0,0 +1,19 @@
+alter table file_scans
+	drop constraint file_scans_file_id_fkey,
+	add constraint file_scans_file_id_fkey
+		foreign key (file_id) references files(id) on delete cascade;
+
+alter table project_attribution_groups
+	drop constraint project_attribution_groups_project_id_fkey,
+	add constraint project_attribution_groups_project_id_fkey
+		foreign key (project_id) references mods(id) on delete cascade;
+
+alter table project_attribution_files
+	drop constraint project_attribution_files_group_id_fkey,
+	add constraint project_attribution_files_group_id_fkey
+		foreign key (group_id) references project_attribution_groups(id) on delete cascade;
+
+alter table override_file_sources
+	drop constraint override_file_sources_file_id_fkey,
+	add constraint override_file_sources_file_id_fkey
+		foreign key (file_id) references files(id) on delete cascade;
diff --git a/apps/labrinth/migrations/20260521120000_project_attribution_external_license.sql b/apps/labrinth/migrations/20260521120000_project_attribution_external_license.sql
new file mode 100644
index 0000000000..5820106844
--- /dev/null
+++ b/apps/labrinth/migrations/20260521120000_project_attribution_external_license.sql
@@ -0,0 +1,20 @@
+alter table project_attribution_files
+	add column moderation_external_license_id bigint references moderation_external_licenses(id);
+
+create table version_attribution_exemptions (
+	version_id bigint primary key references versions(id) on delete cascade
+);
+
+create view attribution_enforced_versions as
+select v.id
+from versions v
+left join version_attribution_exemptions vae on vae.version_id = v.id
+where vae.version_id is null;
+
+-- grandfathering migration:
+-- insert into version_attribution_exemptions (version_id)
+-- select v.id
+-- from versions v
+-- inner join mods m on m.id = v.mod_id
+-- where m.status in ('approved', 'unlisted', 'archived', 'private', 'scheduled', 'withheld')
+-- on conflict do nothing;
diff --git a/apps/labrinth/src/auth/checks.rs b/apps/labrinth/src/auth/checks.rs
index 329e071042..970f9ab7b2 100644
--- a/apps/labrinth/src/auth/checks.rs
+++ b/apps/labrinth/src/auth/checks.rs
@@ -5,11 +5,39 @@ use crate::database::models::version_item::VersionQueryResult;
 use crate::database::models::{DBCollection, DBOrganization, DBTeamMember};
 use crate::database::redis::RedisPool;
 use crate::database::{DBProject, DBVersion, models};
+use crate::models::ids::FileId;
+use crate::models::projects::{
+    MissingAttributionFile, OverrideSource, Version,
+};
 use crate::models::users::User;
+use crate::queue::file_scan::{
+    get_dependency_attributions, get_files_missing_attribution,
+};
 use crate::routes::ApiError;
 use futures::TryStreamExt;
 use itertools::Itertools;
 
+pub async fn enrich_dependency_attributions(
+    versions: &mut [VersionQueryResult],
+    pool: &PgPool,
+) {
+    let version_ids = versions.iter().map(|v| v.inner.id).collect::<Vec<_>>();
+    let dep_attr = get_dependency_attributions(pool, &version_ids)
+        .await
+        .unwrap_or_default();
+
+    for version in versions {
+        for dep in &mut version.dependencies {
+            if let Some(attr) = dep_attr.get(&dep.id)
+                && (attr.attribution.flame_project.is_some()
+                    || attr.attribution.resolution.is_some())
+            {
+                dep.attribution = Some(attr.attribution.clone());
+            }
+        }
+    }
+}
+
 pub trait ValidateAuthorized {
     fn validate_authorized(
         &self,
@@ -204,7 +232,42 @@ pub async fn filter_visible_versions(
     )
     .await?;
     versions.retain(|x| filtered_version_ids.contains(&x.inner.id));
-    Ok(versions.into_iter().map(|x| x.into()).collect())
+
+    let version_ids: Vec<_> = versions.iter().map(|v| v.inner.id).collect();
+    let missing = get_files_missing_attribution(pool, &version_ids)
+        .await
+        .unwrap_or_default();
+
+    enrich_dependency_attributions(&mut versions, pool).await;
+
+    Ok(versions
+        .into_iter()
+        .map(|v| {
+            let files_missing = missing
+                .get(&v.inner.id)
+                .map(|entries| {
+                    entries
+                        .iter()
+                        .map(|(id, fp)| MissingAttributionFile {
+                            id: FileId(id.0 as u64),
+                            override_source: fp
+                                .as_ref()
+                                .map(|p| OverrideSource::Flame {
+                                    id: p.id,
+                                    title: p.title.clone(),
+                                    url: p.url.clone(),
+                                    icon_url: p.icon_url.clone(),
+                                })
+                                .or(Some(OverrideSource::Unknown)),
+                        })
+                        .collect::<Vec<_>>()
+                })
+                .unwrap_or_default();
+            let mut version = Version::from(v);
+            version.files_missing_attribution = files_missing;
+            version
+        })
+        .collect())
 }
 
 impl ValidateAuthorized for models::DBOAuthClient {
@@ -258,13 +321,20 @@ pub async fn filter_visible_version_ids(
         filter_enlisted_version_ids(versions.clone(), user_option, pool, redis)
             .await?;
 
+    let version_ids: Vec<_> = versions.iter().map(|v| v.id).collect();
+    let withheld_versions = get_files_missing_attribution(pool, &version_ids)
+        .await
+        .unwrap_or_default();
+
     // Return versions that are not hidden, we are a mod of, or we are enlisted on the team of
     for version in versions {
+        let is_withheld = withheld_versions.contains_key(&version.id);
         // We can see the version if:
-        // - it's not hidden and we can see the project
+        // - it's not hidden and we can see the project and it's not withheld for attribution
         // - we are a mod
         // - we are enlisted on the team of the mod
         if (!version.status.is_hidden()
+            && !is_withheld
             && visible_project_ids.contains(&version.project_id))
             || user_option.as_ref().is_some_and(|x| x.role.is_mod())
             || enlisted_version_ids.contains(&version.id)
diff --git a/apps/labrinth/src/background_task.rs b/apps/labrinth/src/background_task.rs
index b44bdfe6cd..1c8c0ecefc 100644
--- a/apps/labrinth/src/background_task.rs
+++ b/apps/labrinth/src/background_task.rs
@@ -1,9 +1,11 @@
 use crate::database;
 use crate::database::PgPool;
 use crate::database::redis::RedisPool;
+use crate::file_hosting::FileHost;
 use crate::queue::analytics::cache::cache_analytics;
 use crate::queue::billing::{index_billing, index_subscriptions};
 use crate::queue::email::EmailQueue;
+use crate::queue::file_scan::scan_all_files;
 use crate::queue::payouts::{
     PayoutsQueue, index_payouts_notifications,
     insert_bank_balances_and_webhook, process_affiliate_payouts,
@@ -34,6 +36,10 @@ pub enum BackgroundTask {
     /// Attempts to ping Minecraft Java servers as if we were a client, to
     /// collect info on if they're online, game version, description, etc.
     PingMinecraftJavaServers,
+    /// Finds files of versions which have not been scanned for attributions
+    /// yet, extracts them to find file overrides, and finds any overrides which
+    /// require attribution from the creator.
+    ScanFiles,
 }
 
 impl BackgroundTask {
@@ -44,6 +50,7 @@ impl BackgroundTask {
         ro_pool: PgPool,
         redis_pool: RedisPool,
         search_backend: web::Data<dyn SearchBackend>,
+        file_host: web::Data<dyn FileHost>,
         clickhouse: clickhouse::Client,
         stripe_client: stripe::Client,
         anrok_client: anrok::Client,
@@ -90,6 +97,7 @@ impl BackgroundTask {
             PingMinecraftJavaServers => {
                 ping_minecraft_java_servers(pool, redis_pool, clickhouse).await
             }
+            ScanFiles => scan_all_files(&pool, &redis_pool, &**file_host).await,
         }
     }
 }
diff --git a/apps/labrinth/src/database/models/ids.rs b/apps/labrinth/src/database/models/ids.rs
index 1ebb09b27d..5e585362a1 100644
--- a/apps/labrinth/src/database/models/ids.rs
+++ b/apps/labrinth/src/database/models/ids.rs
@@ -1,12 +1,13 @@
 use super::DatabaseError;
 use crate::database::PgTransaction;
 use crate::models::ids::{
-    AffiliateCodeId, AnalyticsEventId, CampaignDonationId, ChargeId,
-    CollectionId, FileId, ImageId, NotificationId, OAuthAccessTokenId,
-    OAuthClientAuthorizationId, OAuthClientId, OAuthRedirectUriId,
-    OrganizationId, PatId, PayoutId, ProductId, ProductPriceId, ProjectId,
-    ReportId, SessionId, SharedInstanceId, SharedInstanceVersionId, TeamId,
-    TeamMemberId, ThreadId, ThreadMessageId, UserSubscriptionId, VersionId,
+    AffiliateCodeId, AnalyticsEventId, AttributionGroupId, CampaignDonationId,
+    ChargeId, CollectionId, FileId, ImageId, NotificationId,
+    OAuthAccessTokenId, OAuthClientAuthorizationId, OAuthClientId,
+    OAuthRedirectUriId, OrganizationId, PatId, PayoutId, ProductId,
+    ProductPriceId, ProjectId, ReportId, SessionId, SharedInstanceId,
+    SharedInstanceVersionId, TeamId, TeamMemberId, ThreadId, ThreadMessageId,
+    UserSubscriptionId, VersionId,
 };
 use ariadne::ids::base62_impl::to_base62;
 use ariadne::ids::{UserId, random_base62_rng, random_base62_rng_range};
@@ -172,6 +173,10 @@ db_id_interface!(
     CollectionId,
     generator: generate_collection_id @ "collections",
 );
+db_id_interface!(
+    AttributionGroupId,
+    generator: generate_attribution_group_id @ "project_attribution_groups",
+);
 db_id_interface!(
     FileId,
     generator: generate_file_id @ "files",
diff --git a/apps/labrinth/src/database/models/project_item.rs b/apps/labrinth/src/database/models/project_item.rs
index 904f799e62..9fa9091a9b 100644
--- a/apps/labrinth/src/database/models/project_item.rs
+++ b/apps/labrinth/src/database/models/project_item.rs
@@ -6,6 +6,7 @@ use super::{DBUser, ids::*};
 use crate::database::models::DatabaseError;
 use crate::database::redis::RedisPool;
 use crate::database::{PgTransaction, models};
+use crate::file_hosting::FileHost;
 use crate::models::exp;
 use crate::models::ids::ProjectId;
 use crate::models::projects::{
@@ -187,6 +188,8 @@ impl ProjectBuilder {
     pub async fn insert(
         self,
         transaction: &mut PgTransaction<'_>,
+        redis: &RedisPool,
+        file_host: &dyn FileHost,
         http: &reqwest::Client,
     ) -> Result<DBProjectId, DatabaseError> {
         let project_struct = DBProject {
@@ -235,7 +238,7 @@ impl ProjectBuilder {
 
         for mut version in self.initial_versions {
             version.project_id = self.project_id;
-            version.insert(&mut *transaction, http).await?;
+            version.insert(transaction, redis, file_host, http).await?;
         }
 
         LinkUrl::insert_many_projects(
diff --git a/apps/labrinth/src/database/models/version_item.rs b/apps/labrinth/src/database/models/version_item.rs
index 6ffaf90c7f..f8cec5a651 100644
--- a/apps/labrinth/src/database/models/version_item.rs
+++ b/apps/labrinth/src/database/models/version_item.rs
@@ -6,8 +6,11 @@ use crate::database::models::loader_fields::{
     QueryLoaderField, QueryLoaderFieldEnumValue, QueryVersionField,
 };
 use crate::database::redis::RedisPool;
+use crate::file_hosting::FileHost;
 use crate::models::exp;
+
 use crate::models::projects::{FileType, VersionStatus};
+use crate::queue::file_scan::scan_file;
 use crate::routes::internal::delphi::DelphiRunParameters;
 use chrono::{DateTime, Utc};
 use dashmap::{DashMap, DashSet};
@@ -17,10 +20,31 @@ use serde::{Deserialize, Serialize};
 use std::cmp::Ordering;
 use std::collections::HashMap;
 use std::iter;
+use tracing::error;
 
 pub const VERSIONS_NAMESPACE: &str = "versions";
 const VERSION_FILES_NAMESPACE: &str = "versions_files";
 
+pub async fn cleanup_empty_attribution_groups(
+    transaction: &mut PgTransaction<'_>,
+) -> Result<(), DatabaseError> {
+    sqlx::query!(
+        "
+        DELETE FROM project_attribution_groups g
+        WHERE NOT EXISTS (
+            SELECT 1
+            FROM project_attribution_files paf
+            INNER JOIN override_file_sources ofs ON ofs.sha1 = paf.sha1
+            WHERE paf.group_id = g.id
+        )
+        ",
+    )
+    .execute(&mut *transaction)
+    .await?;
+
+    Ok(())
+}
+
 #[derive(Clone)]
 pub struct VersionBuilder {
     pub version_id: DBVersionId,
@@ -134,7 +158,10 @@ impl VersionFileBuilder {
     pub async fn insert(
         self,
         version_id: DBVersionId,
+        project_id: DBProjectId,
         transaction: &mut PgTransaction<'_>,
+        redis: &RedisPool,
+        file_host: &dyn FileHost,
         http: &reqwest::Client,
     ) -> Result<DBFileId, DatabaseError> {
         let file_id = generate_file_id(&mut *transaction).await?;
@@ -169,6 +196,16 @@ impl VersionFileBuilder {
             .await?;
         }
 
+        sqlx::query!(
+            "
+            INSERT INTO file_scans (file_id)
+            VALUES ($1)
+            ",
+            file_id as DBFileId,
+        )
+        .execute(&mut *transaction)
+        .await?;
+
         if let Err(err) = crate::routes::internal::delphi::run(
             &mut *transaction,
             DelphiRunParameters {
@@ -178,7 +215,20 @@ impl VersionFileBuilder {
         )
         .await
         {
-            tracing::error!("Error submitting new file to Delphi: {err}");
+            error!("Error submitting new file to Delphi: {err:?}");
+        }
+
+        if let Err(err) = scan_file(
+            &mut *transaction,
+            redis,
+            file_host,
+            project_id,
+            file_id,
+            &self.url,
+        )
+        .await
+        {
+            error!("Error scanning new file {file_id:?}: {err:?}");
         }
 
         Ok(file_id)
@@ -195,6 +245,8 @@ impl VersionBuilder {
     pub async fn insert(
         self,
         transaction: &mut PgTransaction<'_>,
+        redis: &RedisPool,
+        file_host: &dyn FileHost,
         http: &reqwest::Client,
     ) -> Result<DBVersionId, DatabaseError> {
         let version = DBVersion {
@@ -236,7 +288,15 @@ impl VersionBuilder {
         } = self;
 
         for file in files {
-            file.insert(version_id, transaction, http).await?;
+            file.insert(
+                version_id,
+                self.project_id,
+                transaction,
+                redis,
+                file_host,
+                http,
+            )
+            .await?;
         }
 
         DependencyBuilder::insert_many(
@@ -426,6 +486,8 @@ impl DBVersion {
         .execute(&mut *transaction)
         .await?;
 
+        cleanup_empty_attribution_groups(transaction).await?;
+
         // Sync dependencies
 
         let project_id = sqlx::query!(
@@ -716,7 +778,7 @@ impl DBVersion {
 
                 let dependencies : DashMap<DBVersionId, Vec<DependencyQueryResult>> = sqlx::query!(
                     "
-                    SELECT DISTINCT dependent_id as version_id, d.mod_dependency_id as dependency_project_id, d.dependency_id as dependency_version_id, d.dependency_file_name as file_name, d.dependency_type as dependency_type
+                    SELECT DISTINCT d.id as dependency_id, dependent_id as version_id, d.mod_dependency_id as dependency_project_id, d.dependency_id as dependency_version_id, d.dependency_file_name as file_name, d.dependency_type as dependency_type
                     FROM dependencies d
                     WHERE dependent_id = ANY($1)
                     ",
@@ -724,10 +786,12 @@ impl DBVersion {
                 ).fetch(&mut exec)
                     .try_fold(DashMap::new(), |acc : DashMap<_,Vec<DependencyQueryResult>>, m| {
                         let dependency = DependencyQueryResult {
+                            id: m.dependency_id,
                             project_id: m.dependency_project_id.map(DBProjectId),
                             version_id: m.dependency_version_id.map(DBVersionId),
                             file_name: m.file_name,
                             dependency_type: m.dependency_type,
+                            attribution: None,
                         };
 
                         acc.entry(DBVersionId(m.version_id))
@@ -862,14 +926,14 @@ impl DBVersion {
             })
     }
 
-    pub async fn get_files_from_hash<'a, 'b, E>(
+    pub async fn get_files_from_hash<'a, E>(
         algorithm: String,
         hashes: &[String],
         executor: E,
         redis: &RedisPool,
     ) -> Result<Vec<DBFile>, DatabaseError>
     where
-        E: crate::database::Executor<'a, Database = sqlx::Postgres> + Copy,
+        E: crate::database::Executor<'a, Database = sqlx::Postgres>,
     {
         let val = redis.get_cached_keys(
             VERSION_FILES_NAMESPACE,
@@ -977,10 +1041,12 @@ pub struct VersionQueryResult {
 
 #[derive(Clone, Deserialize, Serialize, PartialEq, Eq)]
 pub struct DependencyQueryResult {
+    pub id: i32,
     pub project_id: Option<DBProjectId>,
     pub version_id: Option<DBVersionId>,
     pub file_name: Option<String>,
     pub dependency_type: String,
+    pub attribution: Option<crate::models::projects::DependencyAttribution>,
 }
 
 #[derive(Clone, Deserialize, Serialize, PartialEq, Eq)]
diff --git a/apps/labrinth/src/file_hosting/mock.rs b/apps/labrinth/src/file_hosting/mock.rs
index 3e414bd393..8f18da5334 100644
--- a/apps/labrinth/src/file_hosting/mock.rs
+++ b/apps/labrinth/src/file_hosting/mock.rs
@@ -29,9 +29,7 @@ impl FileHost for MockHost {
         file_publicity: FileHostPublicity,
         file_bytes: Bytes,
     ) -> Result<UploadFileData, FileHostingError> {
-        let file_name = urlencoding::decode(file_name)
-            .map_err(|_| FileHostingError::InvalidFilename)?;
-        let path = get_file_path(&file_name, file_publicity);
+        let path = get_file_path(file_name, file_publicity);
         std::fs::create_dir_all(
             path.parent().ok_or(FileHostingError::InvalidFilename)?,
         )?;
@@ -72,6 +70,16 @@ impl FileHost for MockHost {
             file_name: file_name.to_string(),
         })
     }
+
+    async fn read_file(
+        &self,
+        file_name: &str,
+        file_publicity: FileHostPublicity,
+    ) -> Result<Bytes, FileHostingError> {
+        let path = get_file_path(file_name, file_publicity);
+        let data = std::fs::read(&path)?;
+        Ok(Bytes::from(data))
+    }
 }
 
 fn get_file_path(
diff --git a/apps/labrinth/src/file_hosting/mod.rs b/apps/labrinth/src/file_hosting/mod.rs
index 667f4cb21e..29fd25d8cf 100644
--- a/apps/labrinth/src/file_hosting/mod.rs
+++ b/apps/labrinth/src/file_hosting/mod.rs
@@ -45,7 +45,11 @@ pub enum FileHostPublicity {
 }
 
 #[async_trait]
-pub trait FileHost {
+pub trait FileHost: Send + Sync {
+    /// Uploads a file at the exact storage key provided.
+    ///
+    /// Callers must URL-decode keys derived from public URLs before passing
+    /// them here, and URL-encode this key before exposing it in a public URL.
     async fn upload_file(
         &self,
         content_type: &str,
@@ -54,17 +58,35 @@ pub trait FileHost {
         file_bytes: Bytes,
     ) -> Result<UploadFileData, FileHostingError>;
 
+    /// Returns a private URL for the exact storage key provided.
+    ///
+    /// Callers must URL-decode keys derived from public URLs before passing
+    /// them here.
     async fn get_url_for_private_file(
         &self,
         file_name: &str,
         expiry_secs: u32,
     ) -> Result<String, FileHostingError>;
 
+    /// Deletes the file at the exact storage key provided.
+    ///
+    /// Callers must URL-decode keys derived from public URLs before passing
+    /// them here.
     async fn delete_file(
         &self,
         file_name: &str,
         file_publicity: FileHostPublicity,
     ) -> Result<DeleteFileData, FileHostingError>;
+
+    /// Reads the file at the exact storage key provided.
+    ///
+    /// Callers must URL-decode keys derived from public URLs before passing
+    /// them here.
+    async fn read_file(
+        &self,
+        file_name: &str,
+        file_publicity: FileHostPublicity,
+    ) -> Result<Bytes, FileHostingError>;
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
diff --git a/apps/labrinth/src/file_hosting/s3_host.rs b/apps/labrinth/src/file_hosting/s3_host.rs
index 56bd0ef45c..558e4d5086 100644
--- a/apps/labrinth/src/file_hosting/s3_host.rs
+++ b/apps/labrinth/src/file_hosting/s3_host.rs
@@ -169,4 +169,28 @@ impl FileHost for S3Host {
             file_name: file_name.to_string(),
         })
     }
+
+    async fn read_file(
+        &self,
+        file_name: &str,
+        file_publicity: FileHostPublicity,
+    ) -> Result<Bytes, FileHostingError> {
+        let bucket = self.get_bucket(file_publicity);
+
+        let response = bucket
+            .client
+            .get_object()
+            .bucket(bucket.name.as_str())
+            .key(file_name)
+            .send()
+            .await
+            .map_err(|e| s3_error("reading file", e))?;
+
+        Ok(response
+            .body
+            .collect()
+            .await
+            .map_err(|e| s3_error("reading file body", e))?
+            .into_bytes())
+    }
 }
diff --git a/apps/labrinth/src/lib.rs b/apps/labrinth/src/lib.rs
index a97ec86bdc..d9ed7c370f 100644
--- a/apps/labrinth/src/lib.rs
+++ b/apps/labrinth/src/lib.rs
@@ -58,7 +58,7 @@ pub struct LabrinthConfig {
     pub ro_pool: ReadOnlyPgPool,
     pub redis_pool: RedisPool,
     pub clickhouse: Client,
-    pub file_host: Arc<dyn file_hosting::FileHost + Send + Sync>,
+    pub file_host: web::Data<dyn file_hosting::FileHost>,
     pub scheduler: Arc<scheduler::Scheduler>,
     pub ip_salt: Pepper,
     pub search_backend: web::Data<dyn search::SearchBackend>,
@@ -84,7 +84,7 @@ pub fn app_setup(
     redis_pool: RedisPool,
     search_backend: actix_web::web::Data<dyn search::SearchBackend>,
     clickhouse: &mut Client,
-    file_host: Arc<dyn file_hosting::FileHost + Send + Sync>,
+    file_host: web::Data<dyn file_hosting::FileHost>,
     stripe_client: stripe::Client,
     anrok_client: anrok::Client,
     email_queue: EmailQueue,
@@ -344,7 +344,7 @@ pub fn app_config(
     .app_data(web::Data::new(labrinth_config.redis_pool.clone()))
     .app_data(web::Data::new(labrinth_config.pool.clone()))
     .app_data(web::Data::new(labrinth_config.ro_pool.clone()))
-    .app_data(web::Data::new(labrinth_config.file_host.clone()))
+    .app_data(labrinth_config.file_host.clone())
     .app_data(labrinth_config.search_backend.clone())
     .app_data(web::Data::new(labrinth_config.gotenberg_client.clone()))
     .app_data(labrinth_config.http_client.clone())
diff --git a/apps/labrinth/src/main.rs b/apps/labrinth/src/main.rs
index f24a2fb79d..feba395e1a 100644
--- a/apps/labrinth/src/main.rs
+++ b/apps/labrinth/src/main.rs
@@ -2,14 +2,14 @@
 
 use actix_web::dev::Service;
 use actix_web::middleware::from_fn;
-use actix_web::{App, HttpServer};
+use actix_web::{App, HttpServer, web};
 use actix_web_prom::PrometheusMetricsBuilder;
 use clap::Parser;
 
 use labrinth::background_task::BackgroundTask;
 use labrinth::database::redis::RedisPool;
 use labrinth::env::ENV;
-use labrinth::file_hosting::{FileHostKind, S3BucketConfig, S3Host};
+use labrinth::file_hosting::{FileHost, FileHostKind, S3BucketConfig, S3Host};
 use labrinth::queue::email::EmailQueue;
 use labrinth::search;
 use labrinth::util::anrok;
@@ -111,44 +111,38 @@ async fn app() -> std::io::Result<()> {
     let redis_pool = RedisPool::new("");
 
     let storage_backend = ENV.STORAGE_BACKEND;
-    let file_host: Arc<dyn file_hosting::FileHost + Send + Sync> =
-        match storage_backend {
-            FileHostKind::S3 => {
-                let not_empty = |v: &str| -> String {
-                    assert!(!v.is_empty(), "S3 env var is empty");
-                    v.to_string()
-                };
-
-                Arc::new(
-                    S3Host::new(
-                        S3BucketConfig {
-                            name: not_empty(&ENV.S3_PUBLIC_BUCKET_NAME),
-                            uses_path_style: ENV
-                                .S3_PUBLIC_USES_PATH_STYLE_BUCKET,
-                            region: not_empty(&ENV.S3_PUBLIC_REGION),
-                            url: not_empty(&ENV.S3_PUBLIC_URL),
-                            access_token: not_empty(
-                                &ENV.S3_PUBLIC_ACCESS_TOKEN,
-                            ),
-                            secret: not_empty(&ENV.S3_PUBLIC_SECRET),
-                        },
-                        S3BucketConfig {
-                            name: not_empty(&ENV.S3_PRIVATE_BUCKET_NAME),
-                            uses_path_style: ENV
-                                .S3_PRIVATE_USES_PATH_STYLE_BUCKET,
-                            region: not_empty(&ENV.S3_PRIVATE_REGION),
-                            url: not_empty(&ENV.S3_PRIVATE_URL),
-                            access_token: not_empty(
-                                &ENV.S3_PRIVATE_ACCESS_TOKEN,
-                            ),
-                            secret: not_empty(&ENV.S3_PRIVATE_SECRET),
-                        },
-                    )
-                    .unwrap(),
+    let file_host: Arc<dyn FileHost> = match storage_backend {
+        FileHostKind::S3 => {
+            let not_empty = |v: &str| -> String {
+                assert!(!v.is_empty(), "S3 env var is empty");
+                v.to_string()
+            };
+
+            Arc::new(
+                S3Host::new(
+                    S3BucketConfig {
+                        name: not_empty(&ENV.S3_PUBLIC_BUCKET_NAME),
+                        uses_path_style: ENV.S3_PUBLIC_USES_PATH_STYLE_BUCKET,
+                        region: not_empty(&ENV.S3_PUBLIC_REGION),
+                        url: not_empty(&ENV.S3_PUBLIC_URL),
+                        access_token: not_empty(&ENV.S3_PUBLIC_ACCESS_TOKEN),
+                        secret: not_empty(&ENV.S3_PUBLIC_SECRET),
+                    },
+                    S3BucketConfig {
+                        name: not_empty(&ENV.S3_PRIVATE_BUCKET_NAME),
+                        uses_path_style: ENV.S3_PRIVATE_USES_PATH_STYLE_BUCKET,
+                        region: not_empty(&ENV.S3_PRIVATE_REGION),
+                        url: not_empty(&ENV.S3_PRIVATE_URL),
+                        access_token: not_empty(&ENV.S3_PRIVATE_ACCESS_TOKEN),
+                        secret: not_empty(&ENV.S3_PRIVATE_SECRET),
+                    },
                 )
-            }
-            FileHostKind::Local => Arc::new(file_hosting::MockHost::new()),
-        };
+                .unwrap(),
+            )
+        }
+        FileHostKind::Local => Arc::new(file_hosting::MockHost::new()),
+    };
+    let file_host = web::Data::<dyn FileHost>::from(file_host);
 
     info!("Initializing clickhouse connection");
     let mut clickhouse = clickhouse::init_client().await.unwrap();
@@ -174,6 +168,7 @@ async fn app() -> std::io::Result<()> {
             ro_pool.into_inner(),
             redis_pool,
             search_backend,
+            file_host,
             clickhouse,
             stripe_client,
             anrok_client.clone(),
diff --git a/apps/labrinth/src/models/v3/ids.rs b/apps/labrinth/src/models/v3/ids.rs
index d7919fe681..5d23815f4f 100644
--- a/apps/labrinth/src/models/v3/ids.rs
+++ b/apps/labrinth/src/models/v3/ids.rs
@@ -1,5 +1,6 @@
 use ariadne::ids::base62_id;
 
+base62_id!(AttributionGroupId);
 base62_id!(ChargeId);
 base62_id!(CampaignDonationId);
 base62_id!(CollectionId);
diff --git a/apps/labrinth/src/models/v3/projects.rs b/apps/labrinth/src/models/v3/projects.rs
index 92abe3fddb..99436576f5 100644
--- a/apps/labrinth/src/models/v3/projects.rs
+++ b/apps/labrinth/src/models/v3/projects.rs
@@ -12,6 +12,7 @@ use ariadne::ids::UserId;
 use chrono::{DateTime, Utc};
 use itertools::Itertools;
 use serde::{Deserialize, Serialize};
+use url::Url;
 use validator::Validate;
 
 /// A project returned from the API
@@ -645,6 +646,98 @@ impl SideTypesMigrationReviewStatus {
     }
 }
 
+#[derive(Debug, Serialize, Deserialize, Clone, utoipa::ToSchema)]
+pub struct MissingAttributionFile {
+    pub id: FileId,
+    pub override_source: Option<OverrideSource>,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, utoipa::ToSchema)]
+#[serde(tag = "type", rename_all = "snake_case")]
+pub enum OverrideSource {
+    Flame {
+        id: u32,
+        title: String,
+        url: String,
+        icon_url: String,
+    },
+    Unknown,
+}
+
+#[derive(
+    Debug, Serialize, Deserialize, Clone, PartialEq, Eq, utoipa::ToSchema,
+)]
+pub struct FlameProject {
+    pub id: u32,
+    pub title: String,
+    pub url: String,
+    pub icon_url: String,
+}
+
+#[derive(
+    Debug, Serialize, Deserialize, Clone, PartialEq, Eq, utoipa::ToSchema,
+)]
+#[serde(untagged)]
+pub enum AttributionLicense {
+    Spdx(String),
+    Custom { name: String },
+}
+
+#[derive(
+    Debug, Serialize, Deserialize, Clone, PartialEq, Eq, utoipa::ToSchema,
+)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum AttributionResolutionKind {
+    License {
+        license: AttributionLicense,
+        link_to_work: Url,
+    },
+    GloballyAllowed {
+        link_to_work: Url,
+    },
+    MyProject {
+        license: AttributionLicense,
+    },
+    SpecialPermissions {
+        link_to_work: Url,
+    },
+    NoPermission {
+        link_to_work: Option<Url>,
+    },
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, utoipa::ToSchema)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum AttributionModerationStatusKind {
+    NotAllowed,
+    Approved,
+    BadProof,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, utoipa::ToSchema)]
+pub struct AttributionModerationStatus {
+    #[serde(flatten)]
+    pub kind: AttributionModerationStatusKind,
+    #[serde(default)]
+    pub reason: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub moderated_at: Option<DateTime<Utc>>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub moderated_by: Option<UserId>,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, utoipa::ToSchema)]
+pub struct AttributionResolution {
+    #[serde(flatten)]
+    pub kind: AttributionResolutionKind,
+    #[serde(default)]
+    pub moderation_status: Option<AttributionModerationStatus>,
+    #[serde(default)]
+    pub updated_by_moderator: bool,
+    pub notes: String,
+    pub image_urls: Vec<Url>,
+}
+
 /// A specific version of a project
 #[derive(Debug, Serialize, Deserialize, Clone, utoipa::ToSchema)]
 pub struct Version {
@@ -681,6 +774,9 @@ pub struct Version {
 
     /// A list of files available for download for this version.
     pub files: Vec<VersionFile>,
+    /// Files in this version that contain override files not yet attributed.
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub files_missing_attribution: Vec<MissingAttributionFile>,
     /// A list of projects that this version depends on.
     pub dependencies: Vec<Dependency>,
 
@@ -757,6 +853,7 @@ impl From<VersionQueryResult> for Version {
                     dependency_type: DependencyType::from_string(
                         d.dependency_type.as_str(),
                     ),
+                    attribution: d.attribution,
                 })
                 .collect(),
             loaders: data.loaders.into_iter().map(Loader).collect(),
@@ -768,6 +865,7 @@ impl From<VersionQueryResult> for Version {
                 .map(|vf| (vf.field_name, vf.value.serialize_internal()))
                 .collect(),
             components: data.components,
+            files_missing_attribution: Vec::new(),
         }
     }
 }
@@ -899,6 +997,18 @@ pub struct Dependency {
     pub file_name: Option<String>,
     /// The type of the dependency
     pub dependency_type: DependencyType,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub attribution: Option<DependencyAttribution>,
+}
+
+#[derive(
+    Serialize, Deserialize, Clone, Debug, PartialEq, Eq, utoipa::ToSchema,
+)]
+pub struct DependencyAttribution {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub flame_project: Option<FlameProject>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub resolution: Option<AttributionResolutionKind>,
 }
 
 #[derive(
diff --git a/apps/labrinth/src/queue/file_scan.rs b/apps/labrinth/src/queue/file_scan.rs
new file mode 100644
index 0000000000..dc490735e3
--- /dev/null
+++ b/apps/labrinth/src/queue/file_scan.rs
@@ -0,0 +1,1000 @@
+use std::collections::HashMap;
+use std::io::{Cursor, Read};
+
+use chrono::Utc;
+use eyre::{Result, eyre};
+use hex::ToHex;
+use sha1::Digest;
+use tokio::task::spawn_blocking;
+use tracing::{Instrument, info, info_span, warn};
+use zip::ZipArchive;
+
+use crate::database::models::ids::{
+    DBAttributionGroupId, DBProjectId, DBVersionId,
+    generate_attribution_group_id,
+};
+use crate::database::models::moderation_external_item::ExternalLicense;
+use crate::database::models::{DBFileId, DBUserId, DBVersion};
+use crate::database::{PgPool, PgTransaction, redis::RedisPool};
+use crate::env::ENV;
+use crate::file_hosting::{FileHost, FileHostPublicity};
+use crate::models::ids::FileId;
+use crate::models::projects::{
+    AttributionResolution, AttributionResolutionKind, DependencyAttribution,
+    FlameProject,
+};
+use crate::queue::moderation::{
+    ApprovalType, FingerprintResponse, FlameResponse,
+};
+use crate::util::error::Context;
+use crate::util::http::HTTP_CLIENT;
+
+/// Attribution enforcement is version-scoped, not file-hash-scoped.
+///
+/// Versions listed in `version_attribution_exemptions` are legacy public
+/// versions that predate this attribution system. They are not scanned for
+/// attribution requirements and must not cause missing-attribution withholding.
+/// A later non-exempt version can still contain the same override SHA1 and
+/// create attribution groups/files for that SHA1. Because of that, reverse
+/// lookups from override SHA1s to versions must go through the
+/// `attribution_enforced_versions` view so grandfathered versions are ignored
+/// without making the SHA1 itself exempt.
+pub async fn scan_all_files(
+    db: &PgPool,
+    redis: &RedisPool,
+    file_host: &dyn FileHost,
+) -> Result<()> {
+    let mut txn = db.begin().await.wrap_err("beginning transaction")?;
+
+    let files_to_scan = sqlx::query!(
+        r#"
+        select
+            fa.file_id as "file_id: DBFileId",
+            f.url,
+            v.mod_id as "project_id: DBProjectId"
+        from file_scans fa
+        inner join files f on f.id = fa.file_id
+        inner join versions v on v.id = f.version_id
+        where fa.attributions_scanned_at is null
+        "#
+    )
+    .fetch_all(&mut txn)
+    .await
+    .wrap_err("fetching files to scan")?;
+
+    info!("Found {} files to scan", files_to_scan.len());
+
+    let mut scanned_ids = Vec::new();
+
+    for row in files_to_scan {
+        let human_file_id = FileId::from(row.file_id);
+        let span = info_span!("scan", file_id = %human_file_id);
+        async {
+            info!("Scanning file");
+
+            let file_id = row.file_id;
+
+            let overrides = extract_override_files_from_storage(
+                file_host, file_id, &row.url,
+            )
+            .await
+            .wrap_err_with(|| {
+                eyre!("extracting overrides for file {file_id:?}")
+            })?;
+
+            if overrides.is_empty() {
+                info!("Found no overrides");
+            } else {
+                info!("Found {} overrides", overrides.len());
+
+                let resolved = resolve_overrides(&overrides, redis, &mut txn)
+                    .await
+                    .wrap_err_with(|| {
+                        eyre!("resolving overrides for file {file_id:?}")
+                    })?;
+                info!("Resolved: {resolved:#?}");
+
+                persist_attribution_results(
+                    row.project_id,
+                    file_id,
+                    &overrides,
+                    &resolved,
+                    &mut txn,
+                )
+                .await
+                .wrap_err_with(|| {
+                    eyre!("persisting attribution results for file {file_id:?}")
+                })?;
+            }
+
+            scanned_ids.push(file_id.0);
+            eyre::Ok(())
+        }
+        .instrument(span)
+        .await?;
+    }
+
+    if !scanned_ids.is_empty() {
+        let now = Utc::now();
+        sqlx::query!(
+            "
+            update file_scans
+            set attributions_scanned_at = now
+            from unnest($1::bigint[], $2::timestamptz[]) as u(id, now)
+            where file_scans.file_id = u.id
+            ",
+            &scanned_ids,
+            &vec![now; scanned_ids.len()],
+        )
+        .execute(&mut txn)
+        .await
+        .wrap_err("marking files as scanned")?;
+    }
+
+    info!("Marked {} files as scanned", scanned_ids.len());
+
+    txn.commit().await.wrap_err("committing transaction")?;
+
+    Ok(())
+}
+
+pub async fn scan_file(
+    txn: &mut PgTransaction<'_>,
+    redis: &RedisPool,
+    file_host: &dyn FileHost,
+    project_id: DBProjectId,
+    file_id: DBFileId,
+    file_url: &str,
+) -> Result<()> {
+    let overrides =
+        extract_override_files_from_storage(file_host, file_id, file_url)
+            .await
+            .wrap_err_with(|| {
+                eyre!("extracting overrides for file {file_id:?}")
+            })?;
+
+    if !overrides.is_empty() {
+        let resolved = resolve_overrides(&overrides, redis, txn)
+            .await
+            .wrap_err_with(|| {
+                eyre!("resolving overrides for file {file_id:?}")
+            })?;
+
+        persist_attribution_results(
+            project_id, file_id, &overrides, &resolved, txn,
+        )
+        .await
+        .wrap_err_with(|| {
+            eyre!("persisting attribution results for file {file_id:?}")
+        })?;
+    }
+
+    sqlx::query!(
+        "
+        insert into file_scans (file_id, attributions_scanned_at)
+        values ($1, now())
+        on conflict (file_id) do update set attributions_scanned_at = now()
+        ",
+        file_id.0,
+    )
+    .execute(&mut *txn)
+    .await
+    .wrap_err("marking file as scanned")?;
+
+    Ok(())
+}
+
+pub async fn scan_override_files(
+    file_host: &dyn FileHost,
+    file_id: DBFileId,
+    file_url: &str,
+) -> Result<Vec<OverrideFile>> {
+    extract_override_files_from_storage(file_host, file_id, file_url)
+        .await
+        .wrap_err_with(|| eyre!("extracting overrides for file {file_id:?}"))
+}
+
+async fn extract_override_files_from_storage(
+    file_host: &dyn FileHost,
+    file_id: DBFileId,
+    file_url: &str,
+) -> Result<Vec<OverrideFile>> {
+    let key = file_url
+        .strip_prefix(&ENV.CDN_URL)
+        .unwrap_or(file_url)
+        .trim_start_matches('/');
+    let key = urlencoding::decode(key).wrap_err("decoding file URL path")?;
+
+    let file_data = file_host
+        .read_file(&key, FileHostPublicity::Public)
+        .await
+        .wrap_err_with(|| {
+            eyre!("reading file {file_id:?} from storage at {key}")
+        })?;
+
+    spawn_blocking(move || extract_override_files(&file_data))
+        .await
+        .wrap_err("extracting override files")?
+        .wrap_err("extracting override files")
+}
+
+#[derive(Debug)]
+pub struct OverrideFile {
+    pub path: String,
+    pub sha1: String,
+    pub murmur2: u32,
+}
+
+#[derive(Debug)]
+pub enum OverrideResolution {
+    OnModrinth,
+    ExternalLicense {
+        id: i64,
+        status: ApprovalType,
+        link: Option<String>,
+        flame_project: Option<FlameProject>,
+    },
+    Flame(FlameProject),
+    Unknown,
+}
+
+const OVERRIDE_PREFIXES: &[&str] = &[
+    "overrides/mods",
+    "client-overrides/mods",
+    "server-overrides/mods",
+    "overrides/shaderpacks",
+    "client-overrides/shaderpacks",
+    "overrides/resourcepacks",
+    "client-overrides/resourcepacks",
+];
+
+fn extract_override_files(data: &[u8]) -> Result<Vec<OverrideFile>> {
+    let reader = Cursor::new(data);
+    let mut zip =
+        ZipArchive::new(reader).wrap_err("creating zip archive reader")?;
+
+    let mut files = Vec::new();
+
+    for i in 0..zip.len() {
+        let mut file = zip
+            .by_index(i)
+            .wrap_err_with(|| eyre!("reading file {i}"))?;
+        let name = file.name().to_string();
+
+        if file.is_dir() {
+            continue;
+        }
+
+        if !OVERRIDE_PREFIXES
+            .iter()
+            .any(|prefix| name.starts_with(prefix))
+        {
+            continue;
+        }
+
+        if name.matches('/').count() > 2
+            || name.ends_with(".txt")
+            || name.ends_with(".rpo")
+        {
+            continue;
+        }
+
+        let mut contents = Vec::new();
+        file.read_to_end(&mut contents)?;
+
+        let sha1 = sha1::Sha1::digest(&contents).encode_hex::<String>();
+        let murmur = hash_flame_murmur32(contents);
+
+        files.push(OverrideFile {
+            sha1,
+            murmur2: murmur,
+            path: name,
+        });
+    }
+
+    Ok(files)
+}
+
+async fn persist_attribution_results(
+    project_id: DBProjectId,
+    file_id: DBFileId,
+    overrides: &[OverrideFile],
+    resolved: &HashMap<String, OverrideResolution>,
+    txn: &mut PgTransaction<'_>,
+) -> Result<()> {
+    let all_sha1s: Vec<Vec<u8>> = overrides
+        .iter()
+        .map(|f| f.sha1.as_bytes().to_vec())
+        .collect();
+
+    let already_persisted: Vec<Vec<u8>> = sqlx::query_scalar!(
+        "
+        select paf.sha1 from project_attribution_files paf
+        inner join project_attribution_groups pag on pag.id = paf.group_id
+        where pag.project_id = $1 and paf.sha1 = ANY($2)
+        ",
+        project_id as DBProjectId,
+        &all_sha1s,
+    )
+    .fetch_all(&mut *txn)
+    .await
+    .wrap_err("checking existing attribution files")?;
+
+    let mut flame_groups: HashMap<
+        u32,
+        (Vec<&OverrideFile>, Option<&OverrideResolution>),
+    > = HashMap::new();
+    let mut external_license_files: Vec<(
+        &OverrideFile,
+        i64,
+        ApprovalType,
+        Option<String>,
+        Option<FlameProject>,
+    )> = Vec::new();
+    let mut unknown_files: Vec<&OverrideFile> = Vec::new();
+
+    for file in overrides {
+        if already_persisted
+            .iter()
+            .any(|s| s.as_slice() == file.sha1.as_bytes())
+        {
+            continue;
+        }
+
+        match resolved.get(&file.sha1) {
+            Some(OverrideResolution::OnModrinth) => continue,
+            Some(OverrideResolution::ExternalLicense {
+                id,
+                status,
+                link,
+                flame_project,
+            }) => {
+                external_license_files.push((
+                    file,
+                    *id,
+                    *status,
+                    link.clone(),
+                    flame_project.clone(),
+                ));
+            }
+            Some(res @ OverrideResolution::Flame(flame_project)) => {
+                let entry = flame_groups.entry(flame_project.id).or_default();
+                entry.0.push(file);
+                if entry.1.is_none() {
+                    entry.1 = Some(res);
+                }
+            }
+            Some(OverrideResolution::Unknown) | None => {
+                unknown_files.push(file);
+            }
+        }
+    }
+
+    let existing_flame_groups = sqlx::query!(
+        r#"
+        select id as "id: DBAttributionGroupId", flame_project
+        from project_attribution_groups
+        where project_id = $1 and flame_project is not null
+        "#,
+        project_id as DBProjectId,
+    )
+    .fetch_all(&mut *txn)
+    .await
+    .wrap_err("fetching existing flame attribution groups")?;
+
+    let mut existing_flame_group_ids = HashMap::new();
+    for group in existing_flame_groups {
+        if let Some(flame_project) = group
+            .flame_project
+            .and_then(|fp| serde_json::from_value::<FlameProject>(fp).ok())
+        {
+            existing_flame_group_ids.insert(flame_project.id, group.id);
+        }
+    }
+
+    for (file, external_license_id, status, link, flame_project) in
+        external_license_files
+    {
+        if let Some(group_id) = flame_project
+            .as_ref()
+            .and_then(|fp| existing_flame_group_ids.get(&fp.id))
+        {
+            sqlx::query!(
+                "
+                insert into project_attribution_files (group_id, name, sha1, moderation_external_license_id)
+                values ($1, $2, $3, $4)
+                ",
+                *group_id as DBAttributionGroupId,
+                &file.path,
+                &file.sha1.as_bytes().to_vec() as &[u8],
+                external_license_id,
+            )
+            .execute(&mut *txn)
+            .await
+            .wrap_err("inserting external license attribution file into existing flame group")?;
+
+            continue;
+        }
+
+        let attribution = default_external_license_attribution(status, link);
+        let flame_project =
+            flame_project.and_then(|fp| serde_json::to_value(fp).ok());
+        let group_id = generate_attribution_group_id(&mut *txn).await?;
+        sqlx::query!(
+			"
+            insert into project_attribution_groups (id, project_id, attribution, flame_project)
+            values ($1, $2, $3, $4)
+            ",
+			group_id as DBAttributionGroupId,
+			project_id as DBProjectId,
+			attribution,
+			flame_project,
+		)
+        .execute(&mut *txn)
+        .await
+        .wrap_err("inserting external license attribution group")?;
+
+        sqlx::query!(
+            "
+            insert into project_attribution_files (group_id, name, sha1, moderation_external_license_id)
+            values ($1, $2, $3, $4)
+            ",
+            group_id as DBAttributionGroupId,
+            &file.path,
+            &file.sha1.as_bytes().to_vec() as &[u8],
+            external_license_id,
+        )
+        .execute(&mut *txn)
+        .await
+        .wrap_err("inserting external license attribution file")?;
+    }
+
+    for (flame_project_id, (files, resolution)) in &flame_groups {
+        let group_id = if let Some(group_id) =
+            existing_flame_group_ids.get(flame_project_id)
+        {
+            *group_id
+        } else {
+            let fp = resolution
+                .and_then(|r| {
+                    if let OverrideResolution::Flame(flame_project) = r {
+                        Some(serde_json::to_value(flame_project).ok())
+                    } else {
+                        None
+                    }
+                })
+                .flatten();
+
+            let id = generate_attribution_group_id(&mut *txn).await?;
+            sqlx::query!(
+                "
+                insert into project_attribution_groups (id, project_id, flame_project)
+                values ($1, $2, $3)
+                ",
+                id as DBAttributionGroupId,
+                project_id as DBProjectId,
+                fp,
+            )
+            .execute(&mut *txn)
+            .await
+            .wrap_err("inserting attribution group")?;
+            existing_flame_group_ids.insert(*flame_project_id, id);
+            id
+        };
+
+        let names: Vec<String> = files.iter().map(|f| f.path.clone()).collect();
+        let sha1s: Vec<Vec<u8>> =
+            files.iter().map(|f| f.sha1.as_bytes().to_vec()).collect();
+
+        sqlx::query!(
+            "
+            insert into project_attribution_files (group_id, name, sha1)
+            select $1, unnest($2::text[]), unnest($3::bytea[])
+            ",
+            group_id as DBAttributionGroupId,
+            &names,
+            &sha1s,
+        )
+        .execute(&mut *txn)
+        .await
+        .wrap_err("inserting attribution files")?;
+    }
+
+    for file in &unknown_files {
+        let group_id = generate_attribution_group_id(&mut *txn).await?;
+        sqlx::query!(
+            "
+            insert into project_attribution_groups (id, project_id)
+            values ($1, $2)
+            ",
+            group_id as DBAttributionGroupId,
+            project_id as DBProjectId,
+        )
+        .execute(&mut *txn)
+        .await
+        .wrap_err("inserting unknown attribution group")?;
+
+        sqlx::query!(
+            "
+            insert into project_attribution_files (group_id, name, sha1)
+            values ($1, $2, $3)
+            ",
+            group_id as DBAttributionGroupId,
+            &file.path,
+            &file.sha1.as_bytes().to_vec() as &[u8],
+        )
+        .execute(&mut *txn)
+        .await
+        .wrap_err("inserting unknown attribution file")?;
+    }
+
+    if !all_sha1s.is_empty() {
+        sqlx::query!(
+            "
+            insert into override_file_sources (sha1, file_id)
+            select unnest($1::bytea[]), $2
+            on conflict do nothing
+            ",
+            &all_sha1s,
+            file_id as DBFileId,
+        )
+        .execute(&mut *txn)
+        .await
+        .wrap_err("inserting override file sources")?;
+    }
+
+    Ok(())
+}
+
+fn default_external_license_attribution(
+    status: ApprovalType,
+    link: Option<String>,
+) -> Option<serde_json::Value> {
+    match status {
+        ApprovalType::Yes
+        | ApprovalType::WithAttributionAndSource
+        | ApprovalType::WithAttribution => link
+            .and_then(|link| url::Url::parse(&link).ok())
+            .and_then(|link_to_work| {
+                serde_json::to_value(AttributionResolution {
+                    kind: AttributionResolutionKind::GloballyAllowed {
+                        link_to_work,
+                    },
+                    moderation_status: None,
+                    updated_by_moderator: false,
+                    notes: String::new(),
+                    image_urls: Vec::new(),
+                })
+                .ok()
+            }),
+        ApprovalType::No => {
+            let link_to_work =
+                link.and_then(|link| url::Url::parse(&link).ok());
+
+            serde_json::to_value(AttributionResolution {
+                kind: AttributionResolutionKind::NoPermission { link_to_work },
+                moderation_status: None,
+                updated_by_moderator: false,
+                notes: String::new(),
+                image_urls: Vec::new(),
+            })
+            .ok()
+        }
+        ApprovalType::PermanentNo | ApprovalType::Unidentified => None,
+    }
+}
+
+async fn resolve_overrides(
+    overrides: &[OverrideFile],
+    redis: &RedisPool,
+    txn: &mut PgTransaction<'_>,
+) -> Result<HashMap<String, OverrideResolution>> {
+    let mut results: HashMap<String, OverrideResolution> = HashMap::new();
+    let mut remaining: Vec<usize> = (0..overrides.len()).collect();
+
+    if overrides.is_empty() {
+        return Ok(results);
+    }
+
+    let hashes: Vec<String> =
+        overrides.iter().map(|x| x.sha1.clone()).collect();
+    let files = DBVersion::get_files_from_hash(
+        "sha1".to_string(),
+        &hashes,
+        &mut *txn,
+        redis,
+    )
+    .await
+    .wrap_err("fetching files on platform by hash")?;
+
+    let version_ids: Vec<_> = files.iter().map(|x| x.version_id).collect();
+    let versions_data = DBVersion::get_many(&version_ids, &mut *txn, redis)
+        .await
+        .wrap_err("fetching versions")?;
+
+    for file in &files {
+        if !versions_data.iter().any(|v| v.inner.id == file.version_id) {
+            continue;
+        }
+
+        if let Some(hash) = file.hashes.get("sha1")
+            && let Some(pos) =
+                remaining.iter().position(|i| overrides[*i].sha1 == *hash)
+        {
+            let idx = remaining.remove(pos);
+            results.insert(
+                overrides[idx].sha1.clone(),
+                OverrideResolution::OnModrinth,
+            );
+        }
+    }
+
+    if remaining.is_empty() {
+        return Ok(results);
+    }
+
+    let rows = sqlx::query!(
+		"
+        SELECT encode(mef.sha1, 'escape') sha1, mel.id, mel.status status, mel.link
+        FROM moderation_external_files mef
+        INNER JOIN moderation_external_licenses mel ON mef.external_license_id = mel.id
+        WHERE mef.sha1 = ANY($1)
+        ",
+        &remaining
+            .iter()
+            .map(|i| overrides[*i].sha1.as_bytes().to_vec())
+            .collect::<Vec<_>>()
+    )
+    .fetch_all(&mut *txn)
+	.await
+	.wrap_err("fetching external file licenses")?;
+
+    let mut direct_external_licenses = HashMap::new();
+    for row in rows {
+        if let Some(sha1) = row.sha1 {
+            direct_external_licenses.insert(
+                sha1,
+                (
+                    row.id,
+                    ApprovalType::from_string(&row.status)
+                        .unwrap_or(ApprovalType::Unidentified),
+                    row.link,
+                ),
+            );
+        }
+    }
+
+    let fingerprints: Vec<u32> =
+        remaining.iter().map(|i| overrides[*i].murmur2).collect();
+    let res = HTTP_CLIENT
+        .post(format!("{}/v1/fingerprints", ENV.FLAME_ANVIL_URL))
+        .json(&serde_json::json!({
+            "fingerprints": fingerprints
+        }))
+        .send()
+        .await;
+
+    if let Err(e) = &res {
+        warn!("Flame fingerprint request failed: {e}");
+    }
+
+    if let Ok(res) = res {
+        let body = res
+            .text()
+            .await
+            .wrap_err("reading Flame fingerprint response")?;
+
+        let flame_files: Vec<_> =
+            serde_json::from_str::<FlameResponse<FingerprintResponse>>(&body)
+                .ok()
+                .map(|x| {
+                    x.data
+                        .exact_matches
+                        .into_iter()
+                        .map(|m| m.file)
+                        .collect::<Vec<_>>()
+                })
+                .unwrap_or_default();
+
+        let mut flame_matches: Vec<(String, u32)> = Vec::new();
+        for flame_file in &flame_files {
+            if let Some(hash) = flame_file
+                .hashes
+                .iter()
+                .find(|x| x.algo == 1)
+                .map(|x| x.value.clone())
+            {
+                flame_matches.push((hash, flame_file.mod_id));
+            }
+        }
+
+        let project_license_rows = sqlx::query!(
+            "
+            SELECT mel.id, mel.flame_project_id, mel.status status, mel.link
+            FROM moderation_external_licenses mel
+            WHERE mel.flame_project_id = ANY($1)
+            ",
+            &flame_matches.iter().map(|x| x.1 as i32).collect::<Vec<_>>()
+        )
+        .fetch_all(&mut *txn)
+        .await
+        .wrap_err("fetching Flame project licenses")?;
+
+        let mut project_external_licenses = HashMap::new();
+        for row in project_license_rows {
+            if let Some(flame_project_id) = row.flame_project_id {
+                project_external_licenses.insert(
+                    flame_project_id as u32,
+                    (
+                        row.id,
+                        ApprovalType::from_string(&row.status)
+                            .unwrap_or(ApprovalType::Unidentified),
+                        row.link,
+                    ),
+                );
+            }
+        }
+
+        let flame_projects_res = HTTP_CLIENT
+            .post(format!("{}/v1/mods", ENV.FLAME_ANVIL_URL))
+            .json(&serde_json::json!({
+                "modIds": flame_matches.iter().map(|x| x.1).collect::<Vec<_>>()
+            }))
+            .send()
+            .await;
+
+        let flame_projects = match flame_projects_res {
+            Ok(res) => res
+                .text()
+                .await
+                .ok()
+                .and_then(|t| {
+                    serde_json::from_str::<
+                        FlameResponse<
+                            Vec<crate::queue::moderation::FlameProjectResponse>,
+                        >,
+                    >(&t)
+                    .ok()
+                })
+                .map(|x| x.data)
+                .unwrap_or_default(),
+            Err(e) => {
+                warn!("Flame projects request failed: {e}");
+                Vec::new()
+            }
+        };
+
+        let mut insert_hashes = Vec::new();
+        let mut insert_filenames = Vec::new();
+        let mut insert_ids = Vec::new();
+
+        for (sha1, flame_project_id) in &flame_matches {
+            if let Some(remaining_pos) =
+                remaining.iter().position(|i| overrides[*i].sha1 == *sha1)
+            {
+                let idx = remaining.remove(remaining_pos);
+                let project =
+                    flame_projects.iter().find(|p| p.id == *flame_project_id);
+                let flame_project = FlameProject {
+                    id: *flame_project_id,
+                    title: project.map(|p| p.name.clone()).unwrap_or_else(
+                        || format!("Flame project {flame_project_id}"),
+                    ),
+                    url: project
+                        .map(|p| p.links.website_url.clone())
+                        .unwrap_or_default(),
+                    icon_url: project
+                        .map(|p| p.logo.thumbnail_url.clone())
+                        .unwrap_or_default(),
+                };
+
+                if let Some((id, status, link)) =
+                    direct_external_licenses.remove(&overrides[idx].sha1)
+                {
+                    results.insert(
+                        overrides[idx].sha1.clone(),
+                        OverrideResolution::ExternalLicense {
+                            id,
+                            status,
+                            link,
+                            flame_project: Some(flame_project),
+                        },
+                    );
+                } else if let Some((id, status, link)) =
+                    project_external_licenses.get(flame_project_id)
+                {
+                    results.insert(
+                        overrides[idx].sha1.clone(),
+                        OverrideResolution::ExternalLicense {
+                            id: *id,
+                            status: *status,
+                            link: link.clone(),
+                            flame_project: Some(flame_project),
+                        },
+                    );
+
+                    insert_hashes.push(overrides[idx].sha1.as_bytes().to_vec());
+                    insert_filenames.push(Some(overrides[idx].path.clone()));
+                    insert_ids.push(*id);
+                } else {
+                    results.insert(
+                        overrides[idx].sha1.clone(),
+                        OverrideResolution::Flame(flame_project),
+                    );
+                }
+            }
+        }
+
+        if !insert_hashes.is_empty() {
+            ExternalLicense::insert_files(
+                &mut *txn,
+                &insert_hashes,
+                &insert_filenames,
+                &insert_ids,
+                DBUserId(0),
+            )
+            .await
+            .wrap_err("inserting external license files")?;
+        }
+    }
+
+    remaining.retain(|idx| {
+        if let Some((id, status, link)) =
+            direct_external_licenses.remove(&overrides[*idx].sha1)
+        {
+            results.insert(
+                overrides[*idx].sha1.clone(),
+                OverrideResolution::ExternalLicense {
+                    id,
+                    status,
+                    link,
+                    flame_project: None,
+                },
+            );
+            false
+        } else {
+            true
+        }
+    });
+
+    for idx in remaining {
+        results
+            .insert(overrides[idx].sha1.clone(), OverrideResolution::Unknown);
+    }
+
+    Ok(results)
+}
+
+fn hash_flame_murmur32(input: Vec<u8>) -> u32 {
+    murmur2::murmur2(
+        &input
+            .into_iter()
+            .filter(|x| *x != 9 && *x != 10 && *x != 13 && *x != 32)
+            .collect::<Vec<u8>>(),
+        1,
+    )
+}
+
+pub async fn get_files_missing_attribution<'a, E>(
+    exec: E,
+    version_ids: &[DBVersionId],
+) -> Result<
+    std::collections::HashMap<
+        DBVersionId,
+        Vec<(DBFileId, Option<FlameProject>)>,
+    >,
+>
+where
+    E: sqlx::Executor<'a, Database = sqlx::Postgres>,
+{
+    if version_ids.is_empty() {
+        return Ok(std::collections::HashMap::new());
+    }
+
+    let rows = sqlx::query!(
+        r#"
+        select distinct f.version_id as "version_id: DBVersionId", f.id as "file_id: DBFileId",
+            pag.flame_project
+        from files f
+        inner join attribution_enforced_versions aev on aev.id = f.version_id
+        inner join override_file_sources ofs on ofs.file_id = f.id
+        inner join project_attribution_files paf on paf.sha1 = ofs.sha1
+        inner join project_attribution_groups pag on pag.id = paf.group_id
+        where f.version_id = ANY($1)
+          and (
+            pag.attribution is null
+            or pag.attribution->>'kind' = 'no_permission'
+            or coalesce(
+              pag.attribution->'moderation_status'->>'kind',
+              'approved'
+            ) != 'approved'
+          )
+        "#,
+        &version_ids.iter().map(|v| v.0).collect::<Vec<_>>(),
+    )
+    .fetch_all(exec)
+    .await
+    .wrap_err("fetching files missing attribution")?;
+
+    let mut result = std::collections::HashMap::new();
+    for row in rows {
+        let flame_project = row
+            .flame_project
+            .and_then(|v| serde_json::from_value(v).ok());
+        result
+            .entry(row.version_id)
+            .or_insert_with(Vec::new)
+            .push((row.file_id, flame_project));
+    }
+
+    Ok(result)
+}
+
+pub struct DependencyAttributionData {
+    pub attribution: DependencyAttribution,
+}
+
+pub async fn get_dependency_attributions<'a, E>(
+    exec: E,
+    version_ids: &[DBVersionId],
+) -> Result<HashMap<i32, DependencyAttributionData>>
+where
+    E: sqlx::Executor<'a, Database = sqlx::Postgres>,
+{
+    if version_ids.is_empty() {
+        return Ok(HashMap::new());
+    }
+
+    let version_ids_vec: Vec<_> = version_ids.iter().map(|v| v.0).collect();
+
+    let rows = sqlx::query!(
+        r#"
+        select
+            d.id as "dependency_id!",
+            pag.attribution,
+            pag.flame_project,
+            pag.project_id as "project_id: DBProjectId"
+        from dependencies d
+        inner join files f on f.version_id = d.dependent_id
+        inner join attribution_enforced_versions aev on aev.id = f.version_id
+        inner join override_file_sources ofs on ofs.file_id = f.id
+        inner join project_attribution_files paf on paf.sha1 = ofs.sha1
+        inner join project_attribution_groups pag on pag.id = paf.group_id
+        where d.dependent_id = ANY($1)
+          and d.dependency_file_name is not null
+          and (
+            pag.flame_project is not null
+            or pag.attribution is not null
+          )
+          and split_part(paf.name, '/', -1) = d.dependency_file_name
+        "#,
+        &version_ids_vec,
+    )
+    .fetch_all(exec)
+    .await
+    .wrap_err("fetching dependency attributions")?;
+
+    let mut result = HashMap::new();
+    for row in rows {
+        let attribution: Option<AttributionResolution> =
+            row.attribution.and_then(|v| serde_json::from_value(v).ok());
+
+        let flame_project: Option<FlameProject> = row
+            .flame_project
+            .and_then(|v| serde_json::from_value(v).ok());
+
+        let resolution = attribution.map(|a| a.kind);
+
+        result.insert(
+            row.dependency_id,
+            DependencyAttributionData {
+                attribution: DependencyAttribution {
+                    flame_project,
+                    resolution,
+                },
+            },
+        );
+    }
+
+    Ok(result)
+}
diff --git a/apps/labrinth/src/queue/mod.rs b/apps/labrinth/src/queue/mod.rs
index 666670dc0b..0d7dcb273b 100644
--- a/apps/labrinth/src/queue/mod.rs
+++ b/apps/labrinth/src/queue/mod.rs
@@ -1,6 +1,7 @@
 pub mod analytics;
 pub mod billing;
 pub mod email;
+pub mod file_scan;
 pub mod moderation;
 pub mod payouts;
 pub mod server_ping;
diff --git a/apps/labrinth/src/queue/moderation.rs b/apps/labrinth/src/queue/moderation.rs
index 7d852f4eb3..48f55a6c06 100644
--- a/apps/labrinth/src/queue/moderation.rs
+++ b/apps/labrinth/src/queue/moderation.rs
@@ -570,7 +570,7 @@ impl AutomatedModerationQueue {
                                             Vec::new()
                                         } else {
                                             let res = client
-                                                .post(format!("{}v1/mods", ENV.FLAME_ANVIL_URL))
+                                                .post(format!("{}/v1/mods", ENV.FLAME_ANVIL_URL))
                                             .json(&serde_json::json!({
                                                 "modIds": flame_files.iter().map(|x| x.1).collect::<Vec<_>>()
                                             }))
@@ -579,7 +579,7 @@ impl AutomatedModerationQueue {
                                             .text()
                                             .await?;
 
-                                        serde_json::from_str::<FlameResponse<Vec<FlameProject>>>(&res)?.data
+                                        serde_json::from_str::<FlameResponse<Vec<FlameProjectResponse>>>(&res)?.data
                                     };
 
                                     let mut missing_metadata = MissingMetadata {
@@ -823,7 +823,7 @@ pub enum ApprovalType {
 }
 
 impl ApprovalType {
-    fn approved(&self) -> bool {
+    pub fn approved(&self) -> bool {
         match self {
             ApprovalType::Yes => true,
             ApprovalType::WithAttributionAndSource => true,
@@ -896,11 +896,18 @@ pub struct FlameFileHash {
 
 #[derive(Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
-pub struct FlameProject {
+pub struct FlameProjectResponse {
     pub id: u32,
     pub name: String,
     pub slug: String,
     pub links: FlameLinks,
+    pub logo: FlameLogo,
+}
+
+#[derive(Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct FlameLogo {
+    pub thumbnail_url: String,
 }
 
 #[derive(Deserialize, Serialize)]
diff --git a/apps/labrinth/src/routes/internal/attribution.rs b/apps/labrinth/src/routes/internal/attribution.rs
new file mode 100644
index 0000000000..aef91575eb
--- /dev/null
+++ b/apps/labrinth/src/routes/internal/attribution.rs
@@ -0,0 +1,642 @@
+use actix_web::{HttpRequest, get, patch, post, web};
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+use crate::auth::get_user_from_headers;
+use crate::database::PgPool;
+use crate::database::models::ids::{
+    DBAttributionGroupId, DBProjectId, generate_attribution_group_id,
+};
+use crate::database::redis::RedisPool;
+use crate::models::ids::{ProjectId, VersionId};
+use crate::models::pats::Scopes;
+use crate::models::projects::{
+    AttributionModerationStatusKind, AttributionResolution,
+    AttributionResolutionKind, FlameProject,
+};
+use crate::models::users::User;
+use crate::queue::moderation::ApprovalType;
+use crate::queue::session::AuthQueue;
+use crate::routes::ApiError;
+
+pub fn config(cfg: &mut utoipa_actix_web::service_config::ServiceConfig) {
+    cfg.service(list)
+        .service(update_group)
+        .service(assign)
+        .service(split);
+}
+
+#[derive(Serialize)]
+struct AttributionGroupResponse {
+    id: crate::models::ids::AttributionGroupId,
+    flame_project: Option<FlameProject>,
+    attribution: Option<crate::models::projects::AttributionResolution>,
+    attributed_at: Option<chrono::DateTime<chrono::Utc>>,
+    attributed_by: Option<ariadne::ids::UserId>,
+    files: Vec<AttributionFileResponse>,
+    versions: Vec<VersionInfo>,
+}
+
+#[derive(Clone, Serialize)]
+struct VersionInfo {
+    id: VersionId,
+    name: String,
+    version_number: String,
+    date_created: chrono::DateTime<chrono::Utc>,
+}
+
+#[derive(Serialize)]
+struct AttributionFileResponse {
+    name: String,
+    sha1: String,
+    versions: Vec<VersionId>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    moderation_external_license_id: Option<i64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    moderation_external_license: Option<ModerationExternalLicenseResponse>,
+}
+
+#[derive(Clone, Serialize)]
+struct ModerationExternalLicenseResponse {
+    id: i64,
+    title: Option<String>,
+    status: ApprovalType,
+    link: Option<String>,
+    exceptions: Option<String>,
+    proof: Option<String>,
+    flame_project_id: Option<i32>,
+    inserted_at: Option<DateTime<Utc>>,
+    inserted_by: Option<i64>,
+    updated_at: Option<DateTime<Utc>>,
+    updated_by: Option<i64>,
+}
+
+#[utoipa::path]
+#[get("/{project_id}")]
+async fn list(
+    req: HttpRequest,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+    path: web::Path<ProjectId>,
+) -> Result<web::Json<Vec<AttributionGroupResponse>>, ApiError> {
+    let project_id: DBProjectId = path.into_inner().into();
+    let requester_is_mod = get_user_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Scopes::PROJECT_READ,
+    )
+    .await
+    .ok()
+    .is_some_and(|(_, user)| user.role.is_mod());
+
+    let groups = sqlx::query!(
+        r#"
+		select
+			g.id as "id: DBAttributionGroupId",
+			g.flame_project,
+			g.attribution,
+			g.attributed_at,
+			g.attributed_by as "attributed_by: i64"
+		from project_attribution_groups g
+		where g.project_id = $1
+		"#,
+        project_id as DBProjectId,
+    )
+    .fetch_all(pool.as_ref())
+    .await?;
+
+    let group_ids: Vec<i64> = groups.iter().map(|g| g.id.0).collect();
+
+    let files = if group_ids.is_empty() {
+        Vec::new()
+    } else {
+        sqlx::query!(
+            r#"
+			select
+				paf.group_id as "group_id!",
+				paf.name as "name!",
+				convert_from(paf.sha1, 'UTF8') as "sha1!",
+				paf.moderation_external_license_id,
+				coalesce(array_agg(distinct aev.id) filter (where aev.id is not null), '{}') as "version_ids!: Vec<i64>"
+			from project_attribution_files paf
+			left join override_file_sources ofs on ofs.sha1 = paf.sha1
+			left join files f on f.id = ofs.file_id
+			left join versions v on v.id = f.version_id and v.mod_id = $2
+			left join attribution_enforced_versions aev on aev.id = v.id
+			where paf.group_id = ANY($1)
+			group by paf.group_id, paf.name, paf.sha1, paf.moderation_external_license_id
+			"#,
+            &group_ids,
+            project_id as DBProjectId,
+        )
+        .fetch_all(pool.as_ref())
+        .await?
+    };
+
+    let moderation_external_licenses = if requester_is_mod {
+        let mut ids: Vec<i64> = files
+            .iter()
+            .filter_map(|f| f.moderation_external_license_id)
+            .collect();
+        ids.sort_unstable();
+        ids.dedup();
+
+        if ids.is_empty() {
+            std::collections::HashMap::new()
+        } else {
+            sqlx::query!(
+                r#"
+				select
+					id,
+					title,
+					status,
+					link,
+					exceptions,
+					proof,
+					flame_project_id,
+					inserted_at,
+					inserted_by,
+					updated_at,
+					updated_by
+				from moderation_external_licenses
+				where id = ANY($1)
+				"#,
+                &ids,
+            )
+            .fetch_all(pool.as_ref())
+            .await?
+            .into_iter()
+            .map(|row| {
+                (
+                    row.id,
+                    ModerationExternalLicenseResponse {
+                        id: row.id,
+                        title: row.title,
+                        status: ApprovalType::from_string(&row.status)
+                            .unwrap_or(ApprovalType::Unidentified),
+                        link: row.link,
+                        exceptions: row.exceptions,
+                        proof: row.proof,
+                        flame_project_id: row.flame_project_id,
+                        inserted_at: row.inserted_at,
+                        inserted_by: row.inserted_by,
+                        updated_at: row.updated_at,
+                        updated_by: row.updated_by,
+                    },
+                )
+            })
+            .collect()
+        }
+    } else {
+        std::collections::HashMap::new()
+    };
+
+    let mut all_version_ids: Vec<i64> = files
+        .iter()
+        .flat_map(|f| f.version_ids.iter().copied())
+        .collect();
+    all_version_ids.sort_unstable();
+    all_version_ids.dedup();
+
+    let version_infos = if all_version_ids.is_empty() {
+        Vec::new()
+    } else {
+        let rows = sqlx::query!(
+            "
+			select id, name, version_number, date_published
+			from versions
+			where id = ANY($1)
+			order by date_published desc
+			",
+            &all_version_ids,
+        )
+        .fetch_all(pool.as_ref())
+        .await?;
+        rows.into_iter()
+            .map(|v| VersionInfo {
+                id: VersionId(v.id as u64),
+                name: v.name,
+                version_number: v.version_number,
+                date_created: v.date_published,
+            })
+            .collect()
+    };
+    let version_order = version_infos
+        .iter()
+        .enumerate()
+        .map(|(index, version)| (version.id, index))
+        .collect::<std::collections::HashMap<_, _>>();
+
+    let mut result = Vec::new();
+    for group in groups {
+        let group_files: Vec<AttributionFileResponse> = files
+            .iter()
+            .filter(|f| f.group_id == group.id.0)
+            .map(|f| AttributionFileResponse {
+                name: f.name.clone(),
+                sha1: f.sha1.clone(),
+                moderation_external_license_id: if requester_is_mod {
+                    f.moderation_external_license_id
+                } else {
+                    None
+                },
+                moderation_external_license: if requester_is_mod {
+                    f.moderation_external_license_id.and_then(|id| {
+                        moderation_external_licenses.get(&id).cloned()
+                    })
+                } else {
+                    None
+                },
+                versions: {
+                    let mut versions: Vec<_> = f
+                        .version_ids
+                        .iter()
+                        .copied()
+                        .map(|id| VersionId(id as u64))
+                        .collect();
+                    versions.sort_by_key(|id| {
+                        version_order.get(id).copied().unwrap_or(usize::MAX)
+                    });
+                    versions
+                },
+            })
+            .collect();
+        let group_version_ids = group_files
+            .iter()
+            .flat_map(|file| file.versions.iter().copied())
+            .collect::<std::collections::HashSet<_>>();
+        let group_versions = version_infos
+            .iter()
+            .filter(|version| group_version_ids.contains(&version.id))
+            .cloned()
+            .collect();
+
+        let mut attribution = group.attribution.and_then(|v| {
+            serde_json::from_value::<AttributionResolution>(v).ok()
+        });
+        if let Some(moderation_status) = attribution
+                .as_mut()
+                .and_then(|a| a.moderation_status.as_mut())
+            && !requester_is_mod
+        {
+            moderation_status.moderated_at = None;
+            moderation_status.moderated_by = None;
+        }
+        let attributed_by = if attribution
+            .as_ref()
+            .is_some_and(|attribution| attribution.updated_by_moderator)
+            && !requester_is_mod
+        {
+            None
+        } else {
+            group
+                .attributed_by
+                .map(|id| ariadne::ids::UserId(id as u64))
+        };
+
+        result.push(AttributionGroupResponse {
+            id: group.id.into(),
+            flame_project: group
+                .flame_project
+                .and_then(|v| serde_json::from_value(v).ok()),
+            attribution,
+            attributed_at: group.attributed_at,
+            attributed_by,
+            files: group_files,
+            versions: group_versions,
+        });
+    }
+
+    Ok(web::Json(result))
+}
+
+#[derive(Deserialize, utoipa::ToSchema)]
+struct UpdateGroupBody {
+    attribution: AttributionResolution,
+}
+
+#[utoipa::path]
+#[patch("/group/{group_id}")]
+async fn update_group(
+    req: HttpRequest,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+    path: web::Path<i64>,
+    web::Json(body): web::Json<UpdateGroupBody>,
+) -> Result<(), ApiError> {
+    let group_id = path.into_inner();
+    let user = get_user_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Scopes::VERSION_WRITE,
+    )
+    .await?
+    .1;
+
+    if !can_edit_attribution_group(pool.as_ref(), group_id, &user).await? {
+        return Err(ApiError::CustomAuthentication(
+            "This attribution group cannot be edited".to_string(),
+        ));
+    }
+
+    if matches!(
+        body.attribution.kind,
+        AttributionResolutionKind::GloballyAllowed { .. }
+    ) && !user.role.is_mod()
+    {
+        return Err(ApiError::CustomAuthentication(
+            "Only moderators can set globally allowed attributions".to_string(),
+        ));
+    }
+
+    if body.attribution.moderation_status.is_some() && !user.role.is_mod() {
+        return Err(ApiError::CustomAuthentication(
+            "Only moderators can set attribution moderation status".to_string(),
+        ));
+    }
+
+    let mut attribution = body.attribution;
+    attribution.updated_by_moderator = user.role.is_mod();
+    if let Some(moderation_status) = &mut attribution.moderation_status {
+        moderation_status.moderated_at = Some(Utc::now());
+        moderation_status.moderated_by = Some(user.id);
+    }
+
+    let result = sqlx::query!(
+        "
+		update project_attribution_groups
+		set attribution = $1, attributed_at = now(), attributed_by = $3
+		where id = $2
+		",
+        &serde_json::to_value(&attribution).unwrap_or_default(),
+        group_id,
+        user.id.0 as i64,
+    )
+    .execute(pool.as_ref())
+    .await?;
+
+    if result.rows_affected() == 0 {
+        return Err(ApiError::NotFound);
+    }
+
+    Ok(())
+}
+
+#[derive(Deserialize, utoipa::ToSchema)]
+struct AssignBody {
+    sha1: String,
+    target_group_id: i64,
+    project_id: ProjectId,
+}
+
+#[utoipa::path]
+#[post("/assign")]
+async fn assign(
+    req: HttpRequest,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+    web::Json(body): web::Json<AssignBody>,
+) -> Result<(), ApiError> {
+    let user = get_user_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Scopes::VERSION_WRITE,
+    )
+    .await?
+    .1;
+
+    let sha1 = body.sha1.trim().to_lowercase();
+    if hex_to_bytes(&sha1).is_none() {
+        return Err(ApiError::InvalidInput(
+            "invalid sha1 hex string".to_string(),
+        ));
+    }
+    let sha1_bytes = sha1.as_bytes().to_vec();
+    let project_id: DBProjectId = body.project_id.into();
+
+    let source_group_id = sqlx::query_scalar!(
+        "
+		select paf.group_id
+		from project_attribution_files paf
+		inner join project_attribution_groups pag on pag.id = paf.group_id
+		where paf.sha1 = $1 and pag.project_id = $2
+		",
+        &sha1_bytes,
+        project_id as DBProjectId,
+    )
+    .fetch_optional(pool.as_ref())
+    .await?
+    .ok_or(ApiError::NotFound)?;
+
+    let target_group_exists = sqlx::query_scalar!(
+        "
+		select exists(
+			select 1 from project_attribution_groups where id = $1 and project_id = $2
+		) as \"exists!\"
+		",
+        body.target_group_id,
+        project_id as DBProjectId,
+    )
+    .fetch_one(pool.as_ref())
+    .await?;
+
+    if !target_group_exists {
+        return Err(ApiError::NotFound);
+    }
+
+    if !can_edit_attribution_group(pool.as_ref(), source_group_id, &user)
+        .await?
+        || !can_edit_attribution_group(
+            pool.as_ref(),
+            body.target_group_id,
+            &user,
+        )
+        .await?
+    {
+        return Err(ApiError::CustomAuthentication(
+            "This attribution group cannot be edited".to_string(),
+        ));
+    }
+
+    let result = sqlx::query!(
+        "
+		update project_attribution_files
+		set group_id = $1
+		where sha1 = $2
+		and group_id in (
+			select id from project_attribution_groups where project_id = $3
+		)
+		",
+        body.target_group_id,
+        &sha1_bytes,
+        project_id as DBProjectId,
+    )
+    .execute(pool.as_ref())
+    .await?;
+
+    if result.rows_affected() == 0 {
+        return Err(ApiError::NotFound);
+    }
+
+    cleanup_empty_groups(pool.as_ref()).await?;
+
+    Ok(())
+}
+
+#[derive(Deserialize, utoipa::ToSchema)]
+struct SplitBody {
+    sha1: String,
+    project_id: ProjectId,
+}
+
+#[utoipa::path]
+#[post("/split")]
+async fn split(
+    req: HttpRequest,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+    web::Json(body): web::Json<SplitBody>,
+) -> Result<(), ApiError> {
+    let user = get_user_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Scopes::VERSION_WRITE,
+    )
+    .await?
+    .1;
+
+    let sha1 = body.sha1.trim().to_lowercase();
+    if hex_to_bytes(&sha1).is_none() {
+        return Err(ApiError::InvalidInput(
+            "invalid sha1 hex string".to_string(),
+        ));
+    }
+    let sha1_bytes = sha1.as_bytes().to_vec();
+    let project_id: DBProjectId = body.project_id.into();
+
+    let existing = sqlx::query!(
+        "
+		select paf.group_id, paf.name from project_attribution_files paf
+		inner join project_attribution_groups pag on pag.id = paf.group_id
+		where paf.sha1 = $1 and pag.project_id = $2
+		",
+        &sha1_bytes,
+        project_id as DBProjectId,
+    )
+    .fetch_optional(pool.as_ref())
+    .await?;
+
+    let Some(existing) = existing else {
+        return Err(ApiError::NotFound);
+    };
+
+    if !can_edit_attribution_group(pool.as_ref(), existing.group_id, &user)
+        .await?
+    {
+        return Err(ApiError::CustomAuthentication(
+            "This attribution group cannot be edited".to_string(),
+        ));
+    }
+
+    let mut txn = pool.begin().await?;
+
+    let new_group_id = generate_attribution_group_id(&mut txn).await?;
+
+    sqlx::query!(
+        "
+		insert into project_attribution_groups (id, project_id)
+		values ($1, $2)
+		",
+        new_group_id as DBAttributionGroupId,
+        project_id as DBProjectId,
+    )
+    .execute(&mut txn)
+    .await?;
+
+    sqlx::query!(
+        "
+		update project_attribution_files
+		set group_id = $1
+		where sha1 = $2 and group_id = $3
+		",
+        new_group_id as DBAttributionGroupId,
+        &sha1_bytes,
+        existing.group_id,
+    )
+    .execute(&mut txn)
+    .await?;
+
+    txn.commit().await?;
+
+    cleanup_empty_groups(pool.as_ref()).await?;
+
+    Ok(())
+}
+
+async fn can_edit_attribution_group(
+    pool: &PgPool,
+    group_id: i64,
+    user: &User,
+) -> Result<bool, ApiError> {
+    if user.role.is_mod() {
+        return Ok(true);
+    }
+
+    let attribution = sqlx::query_scalar!(
+        "
+		select attribution
+		from project_attribution_groups
+		where id = $1
+		",
+        group_id,
+    )
+    .fetch_optional(pool)
+    .await?
+    .ok_or(ApiError::NotFound)?;
+
+    let attribution: Option<AttributionResolution> =
+        attribution.and_then(|value| serde_json::from_value(value).ok());
+
+    Ok(!matches!(
+        attribution
+            .and_then(|attribution| attribution.moderation_status)
+            .map(|status| status.kind),
+        Some(AttributionModerationStatusKind::NotAllowed)
+    ))
+}
+
+async fn cleanup_empty_groups(pool: &PgPool) -> Result<(), ApiError> {
+    sqlx::query!(
+        "
+		delete from project_attribution_groups g
+		where not exists (
+			select 1 from project_attribution_files f where f.group_id = g.id
+		)
+		",
+    )
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+fn hex_to_bytes(hex: &str) -> Option<Vec<u8>> {
+    if !hex.len().is_multiple_of(2) {
+        return None;
+    }
+    (0..hex.len())
+        .step_by(2)
+        .map(|i| u8::from_str_radix(&hex[i..i + 2], 16).ok())
+        .collect()
+}
diff --git a/apps/labrinth/src/routes/internal/flows.rs b/apps/labrinth/src/routes/internal/flows.rs
index 871c6a5fd0..16d9329196 100644
--- a/apps/labrinth/src/routes/internal/flows.rs
+++ b/apps/labrinth/src/routes/internal/flows.rs
@@ -38,7 +38,6 @@ use reqwest::header::AUTHORIZATION;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::str::FromStr;
-use std::sync::Arc;
 use tracing::info;
 use validator::Validate;
 use zxcvbn::Score;
@@ -83,7 +82,7 @@ impl TempUser {
         provider: AuthProvider,
         transaction: &mut PgTransaction<'_>,
         client: &PgPool,
-        file_host: &Arc<dyn FileHost + Send + Sync>,
+        file_host: &dyn FileHost,
         redis: &RedisPool,
     ) -> Result<crate::database::models::DBUserId, AuthenticationError> {
         if let Some(email) = &self.email
@@ -150,7 +149,7 @@ impl TempUser {
                     ext,
                     Some(96),
                     Some(1.0),
-                    &**file_host,
+                    file_host,
                 )
                 .await;
 
@@ -1173,7 +1172,7 @@ pub async fn auth_callback(
     req: HttpRequest,
     Query(query): Query<HashMap<String, String>>,
     client: Data<PgPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     redis: Data<RedisPool>,
 ) -> Result<HttpResponse, crate::auth::templates::ErrorPage> {
     let state_string = query
@@ -1331,7 +1330,7 @@ pub async fn auth_callback(
                         provider,
                         &mut transaction,
                         &client,
-                        &file_host,
+                        &**file_host,
                         &redis,
                     )
                     .await?
diff --git a/apps/labrinth/src/routes/internal/mod.rs b/apps/labrinth/src/routes/internal/mod.rs
index 2af8ae81f3..94a4b4343d 100644
--- a/apps/labrinth/src/routes/internal/mod.rs
+++ b/apps/labrinth/src/routes/internal/mod.rs
@@ -1,5 +1,6 @@
 pub mod admin;
 pub mod affiliate;
+pub mod attribution;
 pub mod billing;
 pub mod campaign;
 pub mod delphi;
@@ -105,5 +106,10 @@ pub fn utoipa_config(
         utoipa_actix_web::scope("/_internal/server-ping")
             .wrap(default_cors())
             .configure(server_ping::config),
+    )
+    .service(
+        utoipa_actix_web::scope("/_internal/attribution")
+            .wrap(default_cors())
+            .configure(attribution::config),
     );
 }
diff --git a/apps/labrinth/src/routes/internal/moderation/external_license.rs b/apps/labrinth/src/routes/internal/moderation/external_license.rs
index cbcf03b245..6ef567ee34 100644
--- a/apps/labrinth/src/routes/internal/moderation/external_license.rs
+++ b/apps/labrinth/src/routes/internal/moderation/external_license.rs
@@ -5,6 +5,8 @@ use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 
 use crate::database::PgPool;
+use crate::database::models::ids::DBUserId;
+use crate::database::models::moderation_external_item::ExternalLicense;
 use crate::database::redis::RedisPool;
 use crate::models::pats::Scopes;
 use crate::queue::moderation::ApprovalType;
@@ -14,7 +16,11 @@ use crate::{auth::check_is_moderator_from_headers, queue::session::AuthQueue};
 pub fn config(cfg: &mut utoipa_actix_web::service_config::ServiceConfig) {
     cfg.service(search)
         .service(get_by_sha1)
-        .service(update_license);
+        .service(get_by_sha1_bulk)
+        .service(lookup)
+        .service(update_license)
+        .service(add_file)
+        .service(reassign_file);
 }
 
 #[derive(Serialize, Deserialize, utoipa::ToSchema)]
@@ -43,6 +49,26 @@ pub struct LinkedFile {
 pub struct SearchRequest {
     pub title: Option<String>,
     pub flame_id: Option<i32>,
+    pub flame_ids: Option<Vec<i32>>,
+}
+
+#[derive(Deserialize, utoipa::ToSchema)]
+pub struct HashLookupRequest {
+    pub hashes: Vec<String>,
+}
+
+#[derive(Deserialize, utoipa::ToSchema)]
+pub struct ExternalLicenseLookupRequest {
+    #[serde(default)]
+    pub flame_ids: Vec<i32>,
+    #[serde(default)]
+    pub hashes: Vec<String>,
+}
+
+#[derive(Serialize, utoipa::ToSchema)]
+pub struct ExternalLicenseLookupResponse {
+    pub flame_ids: HashMap<i32, Vec<ExternalProject>>,
+    pub hashes: HashMap<String, ExternalProject>,
 }
 
 #[derive(Deserialize, utoipa::ToSchema)]
@@ -55,6 +81,32 @@ pub struct UpdateLicenseRequest {
     pub flame_project_id: Option<i32>,
 }
 
+#[derive(Deserialize, utoipa::ToSchema)]
+pub struct FileLicenseRequest {
+    pub hashes: Vec<String>,
+    pub license_id: LicenseId,
+}
+
+#[derive(Deserialize, utoipa::ToSchema)]
+#[serde(untagged)]
+pub enum LicenseId {
+    Number(i64),
+    String(String),
+}
+
+impl LicenseId {
+    fn parse(self) -> Result<i64, ApiError> {
+        match self {
+            LicenseId::Number(id) => Ok(id),
+            LicenseId::String(id) => id.parse().map_err(|_| {
+                ApiError::InvalidInput(
+                    "license_id must be a valid integer".to_string(),
+                )
+            }),
+        }
+    }
+}
+
 struct LicenseRow {
     id: i64,
     title: Option<String>,
@@ -69,6 +121,38 @@ struct LicenseRow {
     updated_by: Option<i64>,
 }
 
+struct LicenseHashRow {
+    hash: Vec<u8>,
+    id: i64,
+    title: Option<String>,
+    status: String,
+    link: Option<String>,
+    exceptions: Option<String>,
+    proof: Option<String>,
+    flame_project_id: Option<i32>,
+    inserted_at: Option<DateTime<Utc>>,
+    inserted_by: Option<i64>,
+    updated_at: Option<DateTime<Utc>>,
+    updated_by: Option<i64>,
+}
+
+fn normalize_sha1_hashes(hashes: &[String]) -> Result<Vec<String>, ApiError> {
+    hashes
+        .iter()
+        .map(|hash| {
+            let hash = hash.trim().to_lowercase();
+            if hash.len() != 40 || !hash.chars().all(|c| c.is_ascii_hexdigit())
+            {
+                return Err(ApiError::InvalidInput(
+                    "hash must be a valid SHA1 hex string".to_string(),
+                ));
+            }
+
+            Ok(hash)
+        })
+        .collect()
+}
+
 impl LicenseRow {
     fn into_external_project(
         self,
@@ -120,12 +204,131 @@ async fn fetch_linked_files(
             .or_default()
             .push(LinkedFile {
                 name: row.filename,
-                sha1: hex::encode(&row.sha1),
+                sha1: String::from_utf8(row.sha1)
+                    .unwrap_or_else(|err| hex::encode(err.into_bytes())),
             });
     }
     Ok(map)
 }
 
+async fn fetch_by_hashes(
+    pool: &PgPool,
+    hashes: &[String],
+) -> Result<HashMap<String, ExternalProject>, ApiError> {
+    if hashes.is_empty() {
+        return Ok(HashMap::new());
+    }
+
+    let hash_bytes = hashes
+        .iter()
+        .map(|hash| hash.as_bytes().to_vec())
+        .collect::<Vec<_>>();
+
+    let rows = sqlx::query_as!(
+        LicenseHashRow,
+        r#"
+        SELECT
+            mef.sha1 hash,
+            mel.id,
+            mel.title,
+            mel.status,
+            mel.link,
+            mel.exceptions,
+            mel.proof,
+            mel.flame_project_id,
+            mel.inserted_at,
+            mel.inserted_by,
+            mel.updated_at,
+            mel.updated_by
+        FROM moderation_external_files mef
+        INNER JOIN moderation_external_licenses mel ON mel.id = mef.external_license_id
+        WHERE mef.sha1 = ANY($1)
+        "#,
+        &hash_bytes,
+    )
+    .fetch_all(pool)
+    .await?;
+
+    let license_ids = rows.iter().map(|row| row.id).collect::<Vec<_>>();
+    let files_map = fetch_linked_files(pool, &license_ids).await?;
+
+    let mut results = HashMap::new();
+    for row in rows {
+        let hash = String::from_utf8(row.hash)
+            .unwrap_or_else(|err| hex::encode(err.into_bytes()));
+        let linked_files = files_map.get(&row.id).cloned().unwrap_or_default();
+        results.insert(
+            hash,
+            LicenseRow {
+                id: row.id,
+                title: row.title,
+                status: row.status,
+                link: row.link,
+                exceptions: row.exceptions,
+                proof: row.proof,
+                flame_project_id: row.flame_project_id,
+                inserted_at: row.inserted_at,
+                inserted_by: row.inserted_by,
+                updated_at: row.updated_at,
+                updated_by: row.updated_by,
+            }
+            .into_external_project(linked_files),
+        );
+    }
+
+    Ok(results)
+}
+
+async fn fetch_by_flame_ids(
+    pool: &PgPool,
+    flame_ids: &[i32],
+) -> Result<HashMap<i32, Vec<ExternalProject>>, ApiError> {
+    if flame_ids.is_empty() {
+        return Ok(HashMap::new());
+    }
+
+    let rows = sqlx::query_as!(
+        LicenseRow,
+        r#"
+        SELECT
+            mel.id,
+            mel.title,
+            mel.status,
+            mel.link,
+            mel.exceptions,
+            mel.proof,
+            mel.flame_project_id,
+            mel.inserted_at,
+            mel.inserted_by,
+            mel.updated_at,
+            mel.updated_by
+        FROM moderation_external_licenses mel
+        WHERE mel.flame_project_id = ANY($1)
+        ORDER BY mel.id
+        "#,
+        flame_ids,
+    )
+    .fetch_all(pool)
+    .await?;
+
+    let license_ids = rows.iter().map(|row| row.id).collect::<Vec<_>>();
+    let files_map = fetch_linked_files(pool, &license_ids).await?;
+
+    let mut results: HashMap<i32, Vec<ExternalProject>> = HashMap::new();
+    for row in rows {
+        if let Some(flame_project_id) = row.flame_project_id {
+            let linked_files =
+                files_map.get(&row.id).cloned().unwrap_or_default();
+            results
+                .entry(flame_project_id)
+                .or_default()
+                .push(row.into_external_project(linked_files));
+        }
+    }
+
+    Ok(results)
+}
+
 #[utoipa::path]
 #[post("/search")]
 async fn search(
@@ -144,7 +347,8 @@ async fn search(
     )
     .await?;
 
-    let rows = sqlx::query!(
+    let rows = sqlx::query_as!(
+        LicenseRow,
         r#"
         SELECT
             mel.id,
@@ -160,11 +364,16 @@ async fn search(
             mel.updated_by
         FROM moderation_external_licenses mel
         WHERE ($1::text IS NULL OR mel.title ILIKE '%' || $1 || '%')
-          AND ($2::integer IS NULL OR mel.flame_project_id = $2)
+          AND (
+            ($2::integer IS NULL AND $3::integer[] IS NULL)
+            OR mel.flame_project_id = $2
+            OR mel.flame_project_id = ANY($3)
+          )
         ORDER BY mel.id
         "#,
         body.title,
         body.flame_id,
+        body.flame_ids.as_deref(),
     )
     .fetch_all(&**pool)
     .await?;
@@ -177,26 +386,42 @@ async fn search(
         .map(|row| {
             let linked_files =
                 files_map.get(&row.id).cloned().unwrap_or_default();
-            LicenseRow {
-                id: row.id,
-                title: row.title,
-                status: row.status,
-                link: row.link,
-                exceptions: row.exceptions,
-                proof: row.proof,
-                flame_project_id: row.flame_project_id,
-                inserted_at: row.inserted_at,
-                inserted_by: row.inserted_by,
-                updated_at: row.updated_at,
-                updated_by: row.updated_by,
-            }
-            .into_external_project(linked_files)
+            row.into_external_project(linked_files)
         })
         .collect();
 
     Ok(web::Json(results))
 }
 
+#[utoipa::path]
+#[post("/lookup")]
+async fn lookup(
+    req: HttpRequest,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+    body: web::Json<ExternalLicenseLookupRequest>,
+) -> Result<web::Json<ExternalLicenseLookupResponse>, ApiError> {
+    check_is_moderator_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Scopes::PROJECT_READ,
+    )
+    .await?;
+
+    let body = body.into_inner();
+    let hashes = normalize_sha1_hashes(&body.hashes)?;
+    let flame_ids = fetch_by_flame_ids(&pool, &body.flame_ids).await?;
+    let hashes = fetch_by_hashes(&pool, &hashes).await?;
+
+    Ok(web::Json(ExternalLicenseLookupResponse {
+        flame_ids,
+        hashes,
+    }))
+}
+
 #[utoipa::path]
 #[get("/by-sha1/{sha1}")]
 async fn get_by_sha1(
@@ -215,48 +440,145 @@ async fn get_by_sha1(
     )
     .await?;
 
-    let sha1 = path.into_inner().0;
+    let hashes = normalize_sha1_hashes(&[path.into_inner().0])?;
+    let hash = hashes.first().ok_or(ApiError::NotFound)?;
+    let mut results = fetch_by_hashes(&pool, &hashes).await?;
+    let result = results.remove(hash).ok_or(ApiError::NotFound)?;
+
+    Ok(web::Json(result))
+}
+
+#[utoipa::path]
+#[post("/by-sha1")]
+async fn get_by_sha1_bulk(
+    req: HttpRequest,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+    body: web::Json<HashLookupRequest>,
+) -> Result<web::Json<HashMap<String, ExternalProject>>, ApiError> {
+    check_is_moderator_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Scopes::PROJECT_READ,
+    )
+    .await?;
+
+    let hashes = normalize_sha1_hashes(&body.hashes)?;
+    let results = fetch_by_hashes(&pool, &hashes).await?;
+
+    Ok(web::Json(results))
+}
+
+#[utoipa::path]
+#[post("/file")]
+async fn add_file(
+    req: HttpRequest,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+    body: web::Json<FileLicenseRequest>,
+) -> Result<web::Json<ExternalProject>, ApiError> {
+    upsert_file_license(req, pool, redis, session_queue, body).await
+}
+
+#[utoipa::path]
+#[post("/file/reassign")]
+async fn reassign_file(
+    req: HttpRequest,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+    body: web::Json<FileLicenseRequest>,
+) -> Result<web::Json<ExternalProject>, ApiError> {
+    upsert_file_license(req, pool, redis, session_queue, body).await
+}
+
+async fn upsert_file_license(
+    req: HttpRequest,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+    body: web::Json<FileLicenseRequest>,
+) -> Result<web::Json<ExternalProject>, ApiError> {
+    let user = check_is_moderator_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Scopes::PROJECT_READ,
+    )
+    .await?;
+
+    let body = body.into_inner();
+    let license_id = body.license_id.parse()?;
+    if body.hashes.is_empty() {
+        return Err(ApiError::InvalidInput(
+            "hashes must contain at least one SHA1 hex string".to_string(),
+        ));
+    }
+    let hashes = normalize_sha1_hashes(&body.hashes)?;
+    let hash_bytes = hashes
+        .iter()
+        .map(|hash| hash.as_bytes().to_vec())
+        .collect::<Vec<_>>();
+    let filenames = vec![None; hashes.len()];
+    let license_ids = vec![license_id; hashes.len()];
+
+    let mut transaction = pool.begin().await?;
 
-    let row = sqlx::query!(
+    let license = sqlx::query!(
         r#"
         SELECT
-            mel.id,
-            mel.title,
-            mel.status,
-            mel.link,
-            mel.exceptions,
-            mel.proof,
-            mel.flame_project_id,
-            mel.inserted_at,
-            mel.inserted_by,
-            mel.updated_at,
-            mel.updated_by
-        FROM moderation_external_files mef
-        INNER JOIN moderation_external_licenses mel ON mel.id = mef.external_license_id
-        WHERE mef.sha1 = $1
+            id,
+            title,
+            status,
+            link,
+            exceptions,
+            proof,
+            flame_project_id,
+            inserted_at,
+            inserted_by,
+            updated_at,
+            updated_by
+        FROM moderation_external_licenses
+        WHERE id = $1
         "#,
-        sha1.as_bytes().to_vec(),
+        license_id,
     )
-    .fetch_optional(&**pool)
+    .fetch_optional(&mut transaction)
     .await?
     .ok_or(ApiError::NotFound)?;
 
-    let files_map = fetch_linked_files(&pool, &[row.id]).await?;
-    let linked_files = files_map.get(&row.id).cloned().unwrap_or_default();
+    ExternalLicense::insert_files(
+        &mut transaction,
+        &hash_bytes,
+        &filenames,
+        &license_ids,
+        DBUserId(user.id.0 as i64),
+    )
+    .await?;
+
+    transaction.commit().await?;
+
+    let files_map = fetch_linked_files(&pool, &[license_id]).await?;
+    let linked_files = files_map.get(&license_id).cloned().unwrap_or_default();
 
     Ok(web::Json(
         LicenseRow {
-            id: row.id,
-            title: row.title,
-            status: row.status,
-            link: row.link,
-            exceptions: row.exceptions,
-            proof: row.proof,
-            flame_project_id: row.flame_project_id,
-            inserted_at: row.inserted_at,
-            inserted_by: row.inserted_by,
-            updated_at: row.updated_at,
-            updated_by: row.updated_by,
+            id: license.id,
+            title: license.title,
+            status: license.status,
+            link: license.link,
+            exceptions: license.exceptions,
+            proof: license.proof,
+            flame_project_id: license.flame_project_id,
+            inserted_at: license.inserted_at,
+            inserted_by: license.inserted_by,
+            updated_at: license.updated_at,
+            updated_by: license.updated_by,
         }
         .into_external_project(linked_files),
     ))
diff --git a/apps/labrinth/src/routes/internal/moderation/tech_review.rs b/apps/labrinth/src/routes/internal/moderation/tech_review.rs
index d201f081e1..491836e446 100644
--- a/apps/labrinth/src/routes/internal/moderation/tech_review.rs
+++ b/apps/labrinth/src/routes/internal/moderation/tech_review.rs
@@ -289,13 +289,13 @@ async fn get_report(
                 'flag_reason', 'delphi',
                 'download_url', f.url,
                 -- TODO: replace with `json_array` in Postgres 16
-                'issues', (
-                    SELECT json_agg(
-                        to_jsonb(dri)
-                        || jsonb_build_object(
-                            -- TODO: replace with `json_array` in Postgres 16
-                            'details', (
-                                SELECT coalesce(jsonb_agg(
+				'issues', (
+					SELECT coalesce(json_agg(
+						to_jsonb(dri)
+						|| jsonb_build_object(
+							-- TODO: replace with `json_array` in Postgres 16
+							'details', (
+								SELECT coalesce(jsonb_agg(
                                     jsonb_build_object(
                                         'id', didws.id,
                                         'issue_id', didws.issue_id,
@@ -310,11 +310,11 @@ async fn get_report(
                                 FROM delphi_issue_details_with_statuses didws
                                 WHERE didws.issue_id = dri.id
                             )
-                        )
-                    )
-                    FROM delphi_report_issues dri
-                    WHERE
-                        dri.report_id = dr.id
+						)
+					), '[]'::json)
+					FROM delphi_report_issues dri
+					WHERE
+						dri.report_id = dr.id
                         -- see delphi.rs todo comment
                         AND dri.issue_type != '__dummy'
                 )
diff --git a/apps/labrinth/src/routes/v2/project_creation.rs b/apps/labrinth/src/routes/v2/project_creation.rs
index dd14c32bdd..aa8e491229 100644
--- a/apps/labrinth/src/routes/v2/project_creation.rs
+++ b/apps/labrinth/src/routes/v2/project_creation.rs
@@ -20,7 +20,6 @@ use serde::{Deserialize, Serialize};
 use serde_json::json;
 
 use std::collections::HashMap;
-use std::sync::Arc;
 use validator::Validate;
 
 use super::version_creation::InitialVersionData;
@@ -158,7 +157,7 @@ pub async fn project_create(
     payload: Multipart,
     client: Data<PgPool>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     session_queue: Data<AuthQueue>,
     http: Data<HttpClient>,
 ) -> Result<HttpResponse, CreateError> {
diff --git a/apps/labrinth/src/routes/v2/projects.rs b/apps/labrinth/src/routes/v2/projects.rs
index ab24386b8e..46aa924162 100644
--- a/apps/labrinth/src/routes/v2/projects.rs
+++ b/apps/labrinth/src/routes/v2/projects.rs
@@ -18,7 +18,6 @@ use crate::search::{SearchBackend, SearchRequest};
 use actix_web::{HttpRequest, HttpResponse, delete, get, patch, post, web};
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
-use std::sync::Arc;
 use validator::Validate;
 
 pub fn config(cfg: &mut utoipa_actix_web::service_config::ServiceConfig) {
@@ -924,7 +923,7 @@ pub async fn project_icon_edit(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -964,7 +963,7 @@ pub async fn delete_project_icon(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     // Returns NoContent, so no need to convert
@@ -1055,7 +1054,7 @@ pub async fn add_gallery_item(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -1198,7 +1197,7 @@ pub async fn delete_gallery_item(
     web::Query(item): web::Query<GalleryDeleteQuery>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     // Returns NoContent, so no need to convert
diff --git a/apps/labrinth/src/routes/v2/threads.rs b/apps/labrinth/src/routes/v2/threads.rs
index 51145e709e..e04a369cc5 100644
--- a/apps/labrinth/src/routes/v2/threads.rs
+++ b/apps/labrinth/src/routes/v2/threads.rs
@@ -1,5 +1,3 @@
-use std::sync::Arc;
-
 use crate::database::PgPool;
 use crate::database::redis::RedisPool;
 use crate::file_hosting::FileHost;
@@ -169,7 +167,7 @@ pub async fn message_delete(
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
     session_queue: web::Data<AuthQueue>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
 ) -> Result<HttpResponse, ApiError> {
     // Returns NoContent, so we don't need to convert the response
     v3::threads::message_delete(
diff --git a/apps/labrinth/src/routes/v2/users.rs b/apps/labrinth/src/routes/v2/users.rs
index 79f5bc9e6e..961e91dad1 100644
--- a/apps/labrinth/src/routes/v2/users.rs
+++ b/apps/labrinth/src/routes/v2/users.rs
@@ -11,7 +11,6 @@ use crate::queue::session::AuthQueue;
 use crate::routes::{ApiError, v2_reroute, v3};
 use actix_web::{HttpRequest, HttpResponse, delete, get, patch, web};
 use serde::{Deserialize, Serialize};
-use std::sync::Arc;
 use validator::Validate;
 
 pub fn config(cfg: &mut utoipa_actix_web::service_config::ServiceConfig) {
@@ -299,7 +298,7 @@ pub async fn user_icon_edit(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -339,7 +338,7 @@ pub async fn user_icon_delete(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     // Returns NoContent, so we don't need to convert to V2
diff --git a/apps/labrinth/src/routes/v2/version_creation.rs b/apps/labrinth/src/routes/v2/version_creation.rs
index 3a21183ba4..bd37a55a96 100644
--- a/apps/labrinth/src/routes/v2/version_creation.rs
+++ b/apps/labrinth/src/routes/v2/version_creation.rs
@@ -21,7 +21,6 @@ use actix_web::{HttpRequest, HttpResponse, post, web};
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use std::collections::HashMap;
-use std::sync::Arc;
 use validator::Validate;
 
 pub fn default_requested_status() -> VersionStatus {
@@ -99,7 +98,7 @@ pub async fn version_create(
     payload: Multipart,
     client: Data<PgPool>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     session_queue: Data<AuthQueue>,
     moderation_queue: Data<AutomatedModerationQueue>,
     http: Data<HttpClient>,
@@ -327,7 +326,7 @@ pub async fn upload_file_to_version(
     payload: Multipart,
     client: Data<PgPool>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
     http: web::Data<HttpClient>,
 ) -> Result<HttpResponse, CreateError> {
diff --git a/apps/labrinth/src/routes/v3/collections.rs b/apps/labrinth/src/routes/v3/collections.rs
index cbf75477a0..605f857065 100644
--- a/apps/labrinth/src/routes/v3/collections.rs
+++ b/apps/labrinth/src/routes/v3/collections.rs
@@ -25,7 +25,6 @@ use chrono::Utc;
 use eyre::eyre;
 use itertools::Itertools;
 use serde::{Deserialize, Serialize};
-use std::sync::Arc;
 use validator::Validate;
 
 pub fn config(cfg: &mut web::ServiceConfig) {
@@ -390,7 +389,7 @@ pub async fn collection_icon_edit(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     mut payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -423,7 +422,7 @@ pub async fn collection_icon_edit(
         collection_item.icon_url,
         collection_item.raw_icon_url,
         FileHostPublicity::Public,
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -442,7 +441,7 @@ pub async fn collection_icon_edit(
         &ext.ext,
         Some(96),
         Some(1.0),
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -474,7 +473,7 @@ pub async fn delete_collection_icon(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     let user = get_user_from_headers(
@@ -505,7 +504,7 @@ pub async fn delete_collection_icon(
         collection_item.icon_url,
         collection_item.raw_icon_url,
         FileHostPublicity::Public,
-        &***file_host,
+        &**file_host,
     )
     .await?;
     let mut transaction = pool.begin().await?;
diff --git a/apps/labrinth/src/routes/v3/images.rs b/apps/labrinth/src/routes/v3/images.rs
index efeb59a838..d00e03946c 100644
--- a/apps/labrinth/src/routes/v3/images.rs
+++ b/apps/labrinth/src/routes/v3/images.rs
@@ -1,5 +1,3 @@
-use std::sync::Arc;
-
 use super::threads::is_authorized_thread;
 use crate::auth::checks::{is_team_member_project, is_team_member_version};
 use crate::auth::get_user_from_headers;
@@ -41,7 +39,7 @@ pub struct ImageUpload {
 pub async fn images_add(
     req: HttpRequest,
     web::Query(data): web::Query<ImageUpload>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     mut payload: web::Payload,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
@@ -191,7 +189,7 @@ pub async fn images_add(
         &data.ext,
         None,
         None,
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
diff --git a/apps/labrinth/src/routes/v3/oauth_clients.rs b/apps/labrinth/src/routes/v3/oauth_clients.rs
index adcb4e477e..7c16ea141d 100644
--- a/apps/labrinth/src/routes/v3/oauth_clients.rs
+++ b/apps/labrinth/src/routes/v3/oauth_clients.rs
@@ -1,4 +1,4 @@
-use std::{collections::HashSet, fmt::Display, sync::Arc};
+use std::{collections::HashSet, fmt::Display};
 
 use super::ApiError;
 use crate::database::{PgPool, PgTransaction};
@@ -354,7 +354,7 @@ pub async fn oauth_client_icon_edit(
     client_id: web::Path<OAuthClientId>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     mut payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -382,7 +382,7 @@ pub async fn oauth_client_icon_edit(
         client.icon_url.clone(),
         client.raw_icon_url.clone(),
         FileHostPublicity::Public,
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -399,7 +399,7 @@ pub async fn oauth_client_icon_edit(
         &ext.ext,
         Some(96),
         Some(1.0),
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -424,7 +424,7 @@ pub async fn oauth_client_icon_delete(
     client_id: web::Path<OAuthClientId>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     let user = get_user_from_headers(
@@ -450,7 +450,7 @@ pub async fn oauth_client_icon_delete(
         client.icon_url.clone(),
         client.raw_icon_url.clone(),
         FileHostPublicity::Public,
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
diff --git a/apps/labrinth/src/routes/v3/organizations.rs b/apps/labrinth/src/routes/v3/organizations.rs
index 838f47c9a4..a45805eab9 100644
--- a/apps/labrinth/src/routes/v3/organizations.rs
+++ b/apps/labrinth/src/routes/v3/organizations.rs
@@ -1,5 +1,4 @@
 use std::collections::HashMap;
-use std::sync::Arc;
 
 use super::ApiError;
 use crate::auth::checks::is_visible_organization;
@@ -1158,7 +1157,7 @@ pub async fn organization_icon_edit(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     mut payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -1209,7 +1208,7 @@ pub async fn organization_icon_edit(
         organization_item.icon_url,
         organization_item.raw_icon_url,
         FileHostPublicity::Public,
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -1228,7 +1227,7 @@ pub async fn organization_icon_edit(
         &ext.ext,
         Some(96),
         Some(1.0),
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -1264,7 +1263,7 @@ pub async fn delete_organization_icon(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     let user = get_user_from_headers(
@@ -1314,7 +1313,7 @@ pub async fn delete_organization_icon(
         organization_item.icon_url,
         organization_item.raw_icon_url,
         FileHostPublicity::Public,
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
diff --git a/apps/labrinth/src/routes/v3/project_creation.rs b/apps/labrinth/src/routes/v3/project_creation.rs
index 42f1e4624a..32b487b48d 100644
--- a/apps/labrinth/src/routes/v3/project_creation.rs
+++ b/apps/labrinth/src/routes/v3/project_creation.rs
@@ -40,7 +40,6 @@ use itertools::Itertools;
 use rust_decimal::Decimal;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
-use std::sync::Arc;
 use thiserror::Error;
 use validator::Validate;
 
@@ -290,7 +289,7 @@ pub async fn project_create(
     payload: Multipart,
     client: Data<PgPool>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     session_queue: Data<AuthQueue>,
     http: Data<HttpClient>,
 ) -> Result<HttpResponse, CreateError> {
@@ -311,7 +310,7 @@ pub async fn project_create_internal(
     mut payload: Multipart,
     client: Data<PgPool>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     session_queue: Data<AuthQueue>,
     http: Data<HttpClient>,
 ) -> Result<HttpResponse, CreateError> {
@@ -325,7 +324,7 @@ pub async fn project_create_internal(
         req,
         &mut payload,
         &mut transaction,
-        &***file_host,
+        &**file_host,
         &mut uploaded_files,
         &client,
         &redis,
@@ -336,7 +335,7 @@ pub async fn project_create_internal(
     .await;
 
     if result.is_err() {
-        let undo_result = undo_uploads(&***file_host, &uploaded_files).await;
+        let undo_result = undo_uploads(&**file_host, &uploaded_files).await;
         let rollback_result = transaction.rollback().await;
 
         undo_result?;
@@ -360,7 +359,7 @@ pub async fn project_create_with_id(
     mut payload: Multipart,
     client: Data<PgPool>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     session_queue: Data<AuthQueue>,
     http: Data<HttpClient>,
     path: web::Path<(ProjectId,)>,
@@ -374,7 +373,7 @@ pub async fn project_create_with_id(
         req,
         &mut payload,
         &mut transaction,
-        &***file_host,
+        &**file_host,
         &mut uploaded_files,
         &client,
         &redis,
@@ -385,7 +384,7 @@ pub async fn project_create_with_id(
     .await;
 
     if result.is_err() {
-        let undo_result = undo_uploads(&***file_host, &uploaded_files).await;
+        let undo_result = undo_uploads(&**file_host, &uploaded_files).await;
         let rollback_result = transaction.rollback().await;
 
         undo_result?;
@@ -907,7 +906,7 @@ async fn project_create_inner(
         let now = Utc::now();
 
         let id = project_builder_actual
-            .insert(&mut *transaction, http)
+            .insert(&mut *transaction, redis, file_host, http)
             .await?;
         DBUser::clear_project_cache(&[current_user.id.into()], redis).await?;
 
diff --git a/apps/labrinth/src/routes/v3/project_creation/new.rs b/apps/labrinth/src/routes/v3/project_creation/new.rs
index cbfd33971f..976c6d612a 100644
--- a/apps/labrinth/src/routes/v3/project_creation/new.rs
+++ b/apps/labrinth/src/routes/v3/project_creation/new.rs
@@ -16,6 +16,7 @@ use crate::{
         },
         redis::RedisPool,
     },
+    file_hosting::FileHost,
     models::{
         exp::{self, ProjectComponentKind, component::ComponentRelationError},
         ids::ProjectId,
@@ -117,6 +118,7 @@ pub async fn create(
     req: HttpRequest,
     db: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
     http: web::Data<HttpClient>,
     web::Json(create): web::Json<ProjectCreate>,
@@ -305,13 +307,13 @@ pub async fn create(
     };
 
     project_builder
-        .insert(&mut txn, &http)
+        .insert(&mut txn, &redis, &**file_host, &http)
         .await
         .wrap_internal_err("failed to insert project")?;
 
     if let Some(version_builder) = version_builder {
         version_builder
-            .insert(&mut txn, &http)
+            .insert(&mut txn, &redis, &**file_host, &http)
             .await
             .wrap_internal_err("failed to insert initial version")?;
     }
diff --git a/apps/labrinth/src/routes/v3/projects.rs b/apps/labrinth/src/routes/v3/projects.rs
index a40f933057..831fdb423a 100644
--- a/apps/labrinth/src/routes/v3/projects.rs
+++ b/apps/labrinth/src/routes/v3/projects.rs
@@ -1,6 +1,5 @@
 use std::any::type_name;
 use std::collections::HashMap;
-use std::sync::Arc;
 
 use crate::auth::checks::{filter_visible_versions, is_visible_project};
 use crate::auth::{filter_visible_projects, get_user_from_headers};
@@ -1694,7 +1693,7 @@ async fn project_icon_edit(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -1717,7 +1716,7 @@ pub async fn project_icon_edit_internal(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     mut payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -1775,7 +1774,7 @@ pub async fn project_icon_edit_internal(
         project_item.inner.icon_url,
         project_item.inner.raw_icon_url,
         FileHostPublicity::Public,
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -1794,7 +1793,7 @@ pub async fn project_icon_edit_internal(
         &ext.ext,
         Some(96),
         Some(1.0),
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -1833,7 +1832,7 @@ async fn delete_project_icon(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     delete_project_icon_internal(
@@ -1852,7 +1851,7 @@ pub async fn delete_project_icon_internal(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     let user = get_user_from_headers(
@@ -1908,7 +1907,7 @@ pub async fn delete_project_icon_internal(
         project_item.inner.icon_url,
         project_item.inner.raw_icon_url,
         FileHostPublicity::Public,
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -1957,7 +1956,7 @@ pub async fn add_gallery_item(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -1982,7 +1981,7 @@ pub async fn add_gallery_item_internal(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     mut payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -2062,7 +2061,7 @@ pub async fn add_gallery_item_internal(
         &ext.ext,
         Some(350),
         Some(1.0),
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -2334,7 +2333,7 @@ async fn delete_gallery_item(
     web::Query(item): web::Query<GalleryDeleteQuery>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     delete_gallery_item_internal(
@@ -2353,7 +2352,7 @@ pub async fn delete_gallery_item_internal(
     web::Query(item): web::Query<GalleryDeleteQuery>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     let user = get_user_from_headers(
@@ -2429,7 +2428,7 @@ pub async fn delete_gallery_item_internal(
         Some(item.image_url),
         Some(item.raw_image_url),
         FileHostPublicity::Public,
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
diff --git a/apps/labrinth/src/routes/v3/shared_instance_version_creation.rs b/apps/labrinth/src/routes/v3/shared_instance_version_creation.rs
index 657853c258..9fdc289025 100644
--- a/apps/labrinth/src/routes/v3/shared_instance_version_creation.rs
+++ b/apps/labrinth/src/routes/v3/shared_instance_version_creation.rs
@@ -25,7 +25,6 @@ use bytes::BytesMut;
 use chrono::Utc;
 use futures_util::StreamExt;
 use hex::FromHex;
-use std::sync::Arc;
 
 const MAX_FILE_SIZE: usize = 500 * 1024 * 1024;
 const MAX_FILE_SIZE_TEXT: &str = "500 MB";
@@ -44,7 +43,7 @@ pub async fn shared_instance_version_create(
     payload: web::Payload,
     web::Header(ContentLength(content_length)): web::Header<ContentLength>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     info: web::Path<(SharedInstanceId,)>,
     session_queue: Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -63,7 +62,7 @@ pub async fn shared_instance_version_create(
         payload,
         content_length,
         &redis,
-        &***file_host,
+        &**file_host,
         info.into_inner().0.into(),
         &session_queue,
         &mut transaction,
@@ -73,7 +72,7 @@ pub async fn shared_instance_version_create(
 
     if result.is_err() {
         let undo_result = super::project_creation::undo_uploads(
-            &***file_host,
+            &**file_host,
             &uploaded_files,
         )
         .await;
diff --git a/apps/labrinth/src/routes/v3/shared_instances.rs b/apps/labrinth/src/routes/v3/shared_instances.rs
index 260a0ef5e1..3768777029 100644
--- a/apps/labrinth/src/routes/v3/shared_instances.rs
+++ b/apps/labrinth/src/routes/v3/shared_instances.rs
@@ -22,7 +22,6 @@ use actix_web::web::{Data, Redirect};
 use actix_web::{HttpRequest, HttpResponse, web};
 use futures_util::future::try_join_all;
 use serde::Deserialize;
-use std::sync::Arc;
 use validator::Validate;
 
 pub fn config(cfg: &mut web::ServiceConfig) {
@@ -565,7 +564,7 @@ pub async fn shared_instance_version_download(
     req: HttpRequest,
     pool: Data<PgPool>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     info: web::Path<(SharedInstanceVersionId,)>,
     session_queue: Data<AuthQueue>,
 ) -> Result<Redirect, ApiError> {
diff --git a/apps/labrinth/src/routes/v3/threads.rs b/apps/labrinth/src/routes/v3/threads.rs
index 136313cdfe..23ce400feb 100644
--- a/apps/labrinth/src/routes/v3/threads.rs
+++ b/apps/labrinth/src/routes/v3/threads.rs
@@ -1,5 +1,3 @@
-use std::sync::Arc;
-
 use crate::auth::get_user_from_headers;
 use crate::database;
 use crate::database::PgPool;
@@ -599,7 +597,7 @@ pub async fn message_delete(
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
     session_queue: web::Data<AuthQueue>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
 ) -> Result<HttpResponse, ApiError> {
     let user = get_user_from_headers(
         &req,
diff --git a/apps/labrinth/src/routes/v3/users.rs b/apps/labrinth/src/routes/v3/users.rs
index c76e71845a..d90f03ffc1 100644
--- a/apps/labrinth/src/routes/v3/users.rs
+++ b/apps/labrinth/src/routes/v3/users.rs
@@ -1,7 +1,4 @@
-use std::{
-    collections::{HashMap, HashSet},
-    sync::Arc,
-};
+use std::collections::{HashMap, HashSet};
 
 use super::{ApiError, oauth_clients::get_user_clients};
 use crate::database::PgPool;
@@ -812,7 +809,7 @@ pub async fn user_icon_edit(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     mut payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -839,7 +836,7 @@ pub async fn user_icon_edit(
             actual_user.avatar_url,
             actual_user.raw_avatar_url,
             FileHostPublicity::Public,
-            &***file_host,
+            &**file_host,
         )
         .await?;
 
@@ -858,7 +855,7 @@ pub async fn user_icon_edit(
             &ext.ext,
             Some(96),
             Some(1.0),
-            &***file_host,
+            &**file_host,
         )
         .await?;
 
@@ -887,7 +884,7 @@ pub async fn user_icon_delete(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     let user = get_user_from_headers(
@@ -913,7 +910,7 @@ pub async fn user_icon_delete(
             actual_user.avatar_url,
             actual_user.raw_avatar_url,
             FileHostPublicity::Public,
-            &***file_host,
+            &**file_host,
         )
         .await?;
 
diff --git a/apps/labrinth/src/routes/v3/version_creation.rs b/apps/labrinth/src/routes/v3/version_creation.rs
index 58d007ff6d..7e0e8b7afc 100644
--- a/apps/labrinth/src/routes/v3/version_creation.rs
+++ b/apps/labrinth/src/routes/v3/version_creation.rs
@@ -41,7 +41,6 @@ use itertools::Itertools;
 use serde::{Deserialize, Serialize};
 use sha1::Digest;
 use std::collections::{HashMap, HashSet};
-use std::sync::Arc;
 use validator::Validate;
 
 fn default_requested_status() -> VersionStatus {
@@ -110,7 +109,7 @@ pub async fn version_create(
     mut payload: Multipart,
     client: Data<PgPool>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     session_queue: Data<AuthQueue>,
     moderation_queue: web::Data<AutomatedModerationQueue>,
     http: web::Data<HttpClient>,
@@ -123,7 +122,7 @@ pub async fn version_create(
         &mut payload,
         &mut transaction,
         &redis,
-        &***file_host,
+        &**file_host,
         &mut uploaded_files,
         &client,
         &session_queue,
@@ -134,7 +133,7 @@ pub async fn version_create(
 
     if result.is_err() {
         let undo_result = super::project_creation::undo_uploads(
-            &***file_host,
+            &**file_host,
             &uploaded_files,
         )
         .await;
@@ -481,10 +480,11 @@ async fn version_create_inner(
         loaders: version_data.loaders,
         fields: version_data.fields,
         components: exp::VersionQuery::default(),
+        files_missing_attribution: Vec::new(),
     };
 
     let project_id = builder.project_id;
-    builder.insert(transaction, http).await?;
+    builder.insert(transaction, redis, file_host, http).await?;
 
     for image_id in version_data.uploaded_images {
         if let Some(db_image) =
@@ -544,7 +544,7 @@ pub async fn upload_file_to_version(
     mut payload: Multipart,
     client: Data<PgPool>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
     http: web::Data<HttpClient>,
 ) -> Result<HttpResponse, CreateError> {
@@ -559,7 +559,7 @@ pub async fn upload_file_to_version(
         client,
         &mut transaction,
         redis,
-        &***file_host,
+        &**file_host,
         &mut uploaded_files,
         version_id,
         &session_queue,
@@ -569,7 +569,7 @@ pub async fn upload_file_to_version(
 
     if result.is_err() {
         let undo_result = super::project_creation::undo_uploads(
-            &***file_host,
+            &**file_host,
             &uploaded_files,
         )
         .await;
@@ -780,8 +780,18 @@ async fn upload_file_to_version_inner(
             "At least one file must be specified".to_string(),
         ));
     } else {
+        let project_id = version.inner.project_id;
+
         for file in file_builders {
-            file.insert(version_id, &mut *transaction, http).await?;
+            file.insert(
+                version_id,
+                project_id,
+                &mut *transaction,
+                &redis,
+                file_host,
+                http,
+            )
+            .await?;
         }
     }
 
@@ -862,8 +872,10 @@ pub async fn upload_file(
         ));
     }
 
+    let data = data.freeze();
+
     let validation_result = validate_file(
-        data.clone().into(),
+        data.clone(),
         file_extension.to_string(),
         loaders.clone(),
         file_type,
@@ -940,7 +952,6 @@ pub async fn upload_file(
         }
     }
 
-    let data = data.freeze();
     let primary = (validation_result.is_passed()
         && version_files.iter().all(|x| !x.primary)
         && !ignore_primary)
diff --git a/apps/labrinth/src/routes/v3/version_file.rs b/apps/labrinth/src/routes/v3/version_file.rs
index 7723ffdeb8..f182edaed3 100644
--- a/apps/labrinth/src/routes/v3/version_file.rs
+++ b/apps/labrinth/src/routes/v3/version_file.rs
@@ -721,6 +721,11 @@ pub async fn delete_file(
         .execute(&mut transaction)
         .await?;
 
+        database::models::version_item::cleanup_empty_attribution_groups(
+            &mut transaction,
+        )
+        .await?;
+
         delphi::send_tech_review_exit_file_deleted_message_if_exited(
             row.project_id,
             was_in_tech_review,
diff --git a/apps/labrinth/src/routes/v3/versions.rs b/apps/labrinth/src/routes/v3/versions.rs
index 4039be60fd..511a94cb59 100644
--- a/apps/labrinth/src/routes/v3/versions.rs
+++ b/apps/labrinth/src/routes/v3/versions.rs
@@ -2,7 +2,8 @@ use std::collections::HashMap;
 
 use super::ApiError;
 use crate::auth::checks::{
-    filter_visible_versions, is_visible_project, is_visible_version,
+    enrich_dependency_attributions, filter_visible_versions,
+    is_visible_project, is_visible_version,
 };
 use crate::auth::get_user_from_headers;
 use crate::database;
@@ -24,6 +25,7 @@ use crate::models::projects::{
 };
 use crate::models::projects::{Loader, skip_nulls};
 use crate::models::teams::ProjectPermissions;
+use crate::queue::file_scan::get_files_missing_attribution;
 use crate::queue::session::AuthQueue;
 use crate::routes::internal::delphi;
 use crate::search::SearchBackend;
@@ -109,12 +111,42 @@ pub async fn version_project_get_helper(
                 || x.inner.version_number == id.1
         });
 
-        if let Some(version) = version
+        if let Some(mut version) = version
             && is_visible_version(&version.inner, &user_option, &pool, &redis)
                 .await?
         {
-            return Ok(HttpResponse::Ok()
-                .json(models::projects::Version::from(version)));
+            let version_id = version.inner.id;
+            enrich_dependency_attributions(
+                std::slice::from_mut(&mut version),
+                &**pool,
+            )
+            .await;
+            let mut v = models::projects::Version::from(version);
+            let missing = get_files_missing_attribution(&**pool, &[version_id])
+                .await
+                .unwrap_or_default();
+            v.files_missing_attribution = missing
+                 .get(&version_id)
+                 .map(|entries| {
+                     entries
+                         .iter()
+                         .map(|(id, fp)| models::projects::MissingAttributionFile {
+                             id: models::ids::FileId(id.0 as u64),
+                             override_source: fp
+                                 .as_ref()
+                                 .map(|p| models::projects::OverrideSource::Flame {
+                                     id: p.id,
+                                     title: p.title.clone(),
+                                     url: p.url.clone(),
+                                     icon_url: p.icon_url.clone(),
+                                 })
+                                 .or(Some(models::projects::OverrideSource::Unknown)),
+                         })
+                         .collect()
+                 })
+                 .unwrap_or_default();
+
+            return Ok(HttpResponse::Ok().json(v));
         }
     }
 
@@ -204,10 +236,43 @@ pub async fn version_get_helper(
     .map(|x| x.1)
     .ok();
 
-    if let Some(data) = version_data
+    if let Some(mut data) = version_data
         && is_visible_version(&data.inner, &user_option, &pool, &redis).await?
     {
-        return Ok(web::Json(models::projects::Version::from(data)));
+        let version_id = data.inner.id;
+        enrich_dependency_attributions(
+            std::slice::from_mut(&mut data),
+            &**pool,
+        )
+        .await;
+        let mut version = models::projects::Version::from(data);
+        let missing = get_files_missing_attribution(&**pool, &[version_id])
+            .await
+            .unwrap_or_default();
+        version.files_missing_attribution = missing
+            .get(&version_id)
+            .map(|entries| {
+                entries
+                    .iter()
+                    .map(|(id, fp)| models::projects::MissingAttributionFile {
+                        id: models::ids::FileId(id.0 as u64),
+                        override_source: fp
+                            .as_ref()
+                            .map(|p| models::projects::OverrideSource::Flame {
+                                id: p.id,
+                                title: p.title.clone(),
+                                url: p.url.clone(),
+                                icon_url: p.icon_url.clone(),
+                            })
+                            .or(Some(
+                                models::projects::OverrideSource::Unknown,
+                            )),
+                    })
+                    .collect()
+            })
+            .unwrap_or_default();
+
+        return Ok(web::Json(version));
     }
 
     Err(ApiError::NotFound)
diff --git a/apps/labrinth/src/test/mod.rs b/apps/labrinth/src/test/mod.rs
index 0e08524049..3dedaa6b68 100644
--- a/apps/labrinth/src/test/mod.rs
+++ b/apps/labrinth/src/test/mod.rs
@@ -1,10 +1,14 @@
+use std::sync::Arc;
+
+use actix_web::web;
+
 use crate::env::ENV;
+use crate::file_hosting::FileHost;
 use crate::queue::email::EmailQueue;
 use crate::util::anrok;
 use crate::util::gotenberg::GotenbergClient;
 use crate::{LabrinthConfig, file_hosting};
 use crate::{clickhouse, env};
-use std::sync::Arc;
 
 pub mod api_common;
 pub mod api_v2;
@@ -31,8 +35,8 @@ pub async fn setup(db: &database::TemporaryDatabase) -> LabrinthConfig {
     let ro_pool = db.ro_pool.clone();
     let redis_pool = db.redis_pool.clone();
     let search_backend = db.search_backend.clone();
-    let file_host: Arc<dyn file_hosting::FileHost + Send + Sync> =
-        Arc::new(file_hosting::MockHost::new());
+    let file_host: Arc<dyn FileHost> = Arc::new(file_hosting::MockHost::new());
+    let file_host = web::Data::<dyn FileHost>::from(file_host);
     let mut clickhouse = clickhouse::init_client().await.unwrap();
 
     let stripe_client = stripe::Client::new(ENV.STRIPE_API_KEY.clone());
diff --git a/apps/labrinth/src/util/http.rs b/apps/labrinth/src/util/http.rs
index cfa942ef73..621205fe17 100644
--- a/apps/labrinth/src/util/http.rs
+++ b/apps/labrinth/src/util/http.rs
@@ -1,24 +1,23 @@
-use std::time::Duration;
+use std::sync::LazyLock;
 
 use derive_more::Deref;
-use reqwest::header::{HeaderMap, HeaderValue, USER_AGENT};
 
-/// Generic HTTP client used for anywhere you need to send an HTTP request, and
-/// do not care what headers or other parameters are used.
+pub static HTTP_CLIENT: LazyLock<HttpClient> = LazyLock::new(HttpClient::new);
+
 #[derive(Debug, Clone, Deref)]
-pub struct HttpClient(pub reqwest::Client);
+pub struct HttpClient(reqwest::Client);
 
 impl HttpClient {
     pub fn new() -> Self {
         let client = reqwest::Client::builder()
-            .default_headers(HeaderMap::from_iter([(
-                USER_AGENT,
-                HeaderValue::from_static(concat!(
+            .default_headers(reqwest::header::HeaderMap::from_iter([(
+                reqwest::header::USER_AGENT,
+                reqwest::header::HeaderValue::from_static(concat!(
                     "Labrinth/",
                     env!("COMPILATION_DATE")
                 )),
             )]))
-            .timeout(Duration::from_secs(30))
+            .timeout(std::time::Duration::from_secs(30))
             .build()
             .unwrap();
         Self(client)
diff --git a/apps/labrinth/tests/version.rs b/apps/labrinth/tests/version.rs
index 46cf863d9d..5e5a6ecf97 100644
--- a/apps/labrinth/tests/version.rs
+++ b/apps/labrinth/tests/version.rs
@@ -494,7 +494,8 @@ pub async fn test_patch_version() {
                 project_id: Some(*beta_project_id_parsed),
                 version_id: None,
                 file_name: Some("dummy_file_name".to_string()),
-                dependency_type: DependencyType::Required
+                dependency_type: DependencyType::Required,
+                attribution: None,
             }]
         );
         assert_eq!(version.loaders, vec!["forge".to_string()]);
diff --git a/packages/api-client/src/modules/index.ts b/packages/api-client/src/modules/index.ts
index 8416796348..746274db29 100644
--- a/packages/api-client/src/modules/index.ts
+++ b/packages/api-client/src/modules/index.ts
@@ -15,6 +15,7 @@ import { KyrosUploadSessionsV1Module } from './kyros/upload-sessions/v1'
 import { LabrinthVersionsV2Module, LabrinthVersionsV3Module } from './labrinth'
 import { LabrinthAffiliateInternalModule } from './labrinth/affiliate/internal'
 import { LabrinthAnalyticsV3Module } from './labrinth/analytics/v3'
+import { LabrinthAttributionInternalModule } from './labrinth/attribution/internal'
 import { LabrinthAuthInternalModule } from './labrinth/auth/internal'
 import { LabrinthAuthV2Module } from './labrinth/auth/v2'
 import { LabrinthBillingInternalModule } from './labrinth/billing/internal'
@@ -22,6 +23,7 @@ import { LabrinthCampaignInternalModule } from './labrinth/campaign/internal'
 import { LabrinthCollectionsModule } from './labrinth/collections'
 import { LabrinthExternalProjectsInternalModule } from './labrinth/external-projects/internal'
 import { LabrinthGlobalsInternalModule } from './labrinth/globals/internal'
+import { LabrinthImagesV3Module } from './labrinth/images/v3'
 import { LabrinthLimitsV3Module } from './labrinth/limits/v3'
 import { LabrinthModerationInternalModule } from './labrinth/moderation/internal'
 import { LabrinthNotificationsV2Module } from './labrinth/notifications/v2'
@@ -80,11 +82,13 @@ export const MODULE_REGISTRY = {
 	labrinth_analytics_v3: LabrinthAnalyticsV3Module,
 	labrinth_auth_internal: LabrinthAuthInternalModule,
 	labrinth_auth_v2: LabrinthAuthV2Module,
+	labrinth_attribution_internal: LabrinthAttributionInternalModule,
 	labrinth_billing_internal: LabrinthBillingInternalModule,
 	labrinth_campaign_internal: LabrinthCampaignInternalModule,
 	labrinth_collections: LabrinthCollectionsModule,
 	labrinth_external_projects_internal: LabrinthExternalProjectsInternalModule,
 	labrinth_globals_internal: LabrinthGlobalsInternalModule,
+	labrinth_images_v3: LabrinthImagesV3Module,
 	labrinth_moderation_internal: LabrinthModerationInternalModule,
 	labrinth_notifications_v2: LabrinthNotificationsV2Module,
 	labrinth_oauth_internal: LabrinthOAuthInternalModule,
diff --git a/packages/api-client/src/modules/labrinth/attribution/internal.ts b/packages/api-client/src/modules/labrinth/attribution/internal.ts
new file mode 100644
index 0000000000..36773c77e1
--- /dev/null
+++ b/packages/api-client/src/modules/labrinth/attribution/internal.ts
@@ -0,0 +1,103 @@
+import { AbstractModule } from '../../../core/abstract-module'
+import type { Labrinth } from '../types'
+
+const BASE62_CHARS = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
+
+/**
+ * Decode a base62-encoded ID string into a number.
+ * The backend serializes attribution group IDs as base62 strings in responses,
+ * but the assign/update endpoints expect raw integer IDs in their request payloads.
+ */
+function decodeBase62Id(id: string): number {
+	let value = 0
+	for (const char of id) {
+		const digit = BASE62_CHARS.indexOf(char)
+		if (digit < 0) {
+			throw new Error(`Invalid base62 character "${char}" in id "${id}"`)
+		}
+		value = value * 62 + digit
+		if (!Number.isSafeInteger(value)) {
+			throw new Error(`Base62 id "${id}" exceeds safe integer range`)
+		}
+	}
+	return value
+}
+
+export class LabrinthAttributionInternalModule extends AbstractModule {
+	public getModuleID(): string {
+		return 'labrinth_attribution_internal'
+	}
+
+	/**
+	 * List attribution groups for a project
+	 * GET /_internal/attribution/{project_id}
+	 */
+	public async listProjectAttribution(
+		projectId: string,
+	): Promise<Labrinth.Attribution.Internal.AttributionGroup[]> {
+		return this.client.request<Labrinth.Attribution.Internal.AttributionGroup[]>(
+			`/attribution/${projectId}`,
+			{
+				api: 'labrinth',
+				version: 'internal',
+				method: 'GET',
+			},
+		)
+	}
+
+	/**
+	 * Update an attribution group's attribution payload.
+	 * PATCH /_internal/attribution/group/{group_id}
+	 *
+	 * @param groupId - The base62 attribution group id (as returned from listProjectAttribution).
+	 */
+	public async updateGroup(
+		groupId: string,
+		body: Labrinth.Attribution.Internal.UpdateGroupRequest,
+	): Promise<void> {
+		const numericId = decodeBase62Id(groupId)
+		return this.client.request<void>(`/attribution/group/${numericId}`, {
+			api: 'labrinth',
+			version: 'internal',
+			method: 'PATCH',
+			body,
+		})
+	}
+
+	/**
+	 * Reassign a file (by sha1) to another attribution group within the same project.
+	 * POST /_internal/attribution/assign
+	 *
+	 * @param body.target_group_id - The base62 id of the attribution group to assign the file to.
+	 */
+	public async assignFileToGroup(body: {
+		sha1: string
+		target_group_id: string
+		project_id: string
+	}): Promise<void> {
+		const wireBody: Labrinth.Attribution.Internal.AssignRequest = {
+			sha1: body.sha1,
+			target_group_id: decodeBase62Id(body.target_group_id),
+			project_id: body.project_id,
+		}
+		return this.client.request<void>('/attribution/assign', {
+			api: 'labrinth',
+			version: 'internal',
+			method: 'POST',
+			body: wireBody,
+		})
+	}
+
+	/**
+	 * Split a file (by sha1) out of its current attribution group into a new group.
+	 * POST /_internal/attribution/split
+	 */
+	public async splitFile(body: Labrinth.Attribution.Internal.SplitRequest): Promise<void> {
+		return this.client.request<void>('/attribution/split', {
+			api: 'labrinth',
+			version: 'internal',
+			method: 'POST',
+			body,
+		})
+	}
+}
diff --git a/packages/api-client/src/modules/labrinth/external-projects/internal.ts b/packages/api-client/src/modules/labrinth/external-projects/internal.ts
index 4d0e278a02..47b1641156 100644
--- a/packages/api-client/src/modules/labrinth/external-projects/internal.ts
+++ b/packages/api-client/src/modules/labrinth/external-projects/internal.ts
@@ -47,4 +47,33 @@ export class LabrinthExternalProjectsInternalModule extends AbstractModule {
 			},
 		)
 	}
+
+	// TODO: Backend routes don't exist yet
+	public async create(
+		data: Labrinth.ExternalProjects.Internal.CreateExternalLicenseRequest,
+	): Promise<Labrinth.ExternalProjects.Internal.ExternalProject> {
+		return this.client.request<Labrinth.ExternalProjects.Internal.ExternalProject>(
+			'/moderation/external-license',
+			{
+				api: 'labrinth',
+				version: 'internal',
+				method: 'POST',
+				body: data,
+			},
+		)
+	}
+
+	public async addFile(
+		data: Labrinth.ExternalProjects.Internal.AddFileRequest,
+	): Promise<Labrinth.ExternalProjects.Internal.ExternalProject> {
+		return this.client.request<Labrinth.ExternalProjects.Internal.ExternalProject>(
+			'/moderation/external-license/file',
+			{
+				api: 'labrinth',
+				version: 'internal',
+				method: 'POST',
+				body: data,
+			},
+		)
+	}
 }
diff --git a/packages/api-client/src/modules/labrinth/images/v3.ts b/packages/api-client/src/modules/labrinth/images/v3.ts
new file mode 100644
index 0000000000..7613f0debd
--- /dev/null
+++ b/packages/api-client/src/modules/labrinth/images/v3.ts
@@ -0,0 +1,47 @@
+import { AbstractModule } from '../../../core/abstract-module'
+import type { UploadHandle } from '../../../types/upload'
+import type { Labrinth } from '../types'
+
+function buildImageQueryParams(
+	ext: Labrinth.Images.v3.ImageExtension,
+	target: Labrinth.Images.v3.UploadImageParams,
+): Record<string, string> {
+	const params: Record<string, string> = {
+		ext,
+		context: target.context,
+	}
+	switch (target.context) {
+		case 'project':
+			params.project_id = target.project_id
+			break
+		case 'version':
+			params.version_id = target.version_id
+			break
+		case 'thread_message':
+			params.thread_message_id = target.thread_message_id
+			break
+		case 'report':
+			params.report_id = target.report_id
+			break
+	}
+	return params
+}
+
+export class LabrinthImagesV3Module extends AbstractModule {
+	public getModuleID(): string {
+		return 'labrinth_images_v3'
+	}
+
+	public uploadImage(
+		file: File | Blob,
+		ext: Labrinth.Images.v3.ImageExtension,
+		target: Labrinth.Images.v3.UploadImageParams,
+	): UploadHandle<Labrinth.Images.v3.UploadedImage> {
+		return this.client.upload<Labrinth.Images.v3.UploadedImage>('/image', {
+			api: 'labrinth',
+			version: 3,
+			file,
+			params: buildImageQueryParams(ext, target),
+		})
+	}
+}
diff --git a/packages/api-client/src/modules/labrinth/index.ts b/packages/api-client/src/modules/labrinth/index.ts
index 487329fe0e..94d0c38579 100644
--- a/packages/api-client/src/modules/labrinth/index.ts
+++ b/packages/api-client/src/modules/labrinth/index.ts
@@ -1,10 +1,12 @@
 export * from './analytics/v3'
+export * from './attribution/internal'
 export * from './auth/internal'
 export * from './auth/v2'
 export * from './billing/internal'
 export * from './collections'
 export * from './external-projects/internal'
 export * from './globals/internal'
+export * from './images/v3'
 export * from './limits/v3'
 export * from './moderation/internal'
 export * from './notifications/v2'
diff --git a/packages/api-client/src/modules/labrinth/types.ts b/packages/api-client/src/modules/labrinth/types.ts
index ab79ac6f17..f9f098afae 100644
--- a/packages/api-client/src/modules/labrinth/types.ts
+++ b/packages/api-client/src/modules/labrinth/types.ts
@@ -249,6 +249,144 @@ export namespace Labrinth {
 		}
 	}
 
+	export namespace Attribution {
+		export namespace Internal {
+			export type AttributionPermissionKind =
+				| 'license'
+				| 'my_project'
+				| 'special_permissions'
+				| 'globally_allowed'
+				| 'no_permission'
+			export type AttributionResolutionKind = AttributionPermissionKind
+
+			export type AttributionLicense = string | { name: string }
+
+			export type AttributionModerationStatusKind = 'not_allowed' | 'approved' | 'bad_proof'
+
+			export type AttributionModerationStatus = {
+				kind: AttributionModerationStatusKind
+				reason: string
+				moderated_at?: string
+				moderated_by?: string
+			}
+
+			export type AttributionResolutionBase = {
+				notes: string
+				image_urls: string[]
+				moderation_status?: AttributionModerationStatus | null
+				updated_by_moderator: boolean
+			}
+
+			export type AttributionResolution =
+				| (AttributionResolutionBase & {
+						kind: 'license'
+						license: AttributionLicense
+						link_to_work: string
+				  })
+				| (AttributionResolutionBase & {
+						kind: 'my_project'
+						license: AttributionLicense
+				  })
+				| (AttributionResolutionBase & {
+						kind: 'special_permissions'
+						link_to_work: string
+				  })
+				| (AttributionResolutionBase & {
+						kind: 'globally_allowed'
+						link_to_work: string
+				  })
+				| (AttributionResolutionBase & {
+						kind: 'no_permission'
+						link_to_work?: string
+				  })
+
+			export type FlameProject = {
+				id: number
+				title: string
+				url: string
+				icon_url: string
+			}
+
+			export type AttributionFile = {
+				name: string
+				sha1: string
+				versions: string[]
+				moderation_external_license_id?: number
+				moderation_external_license?: ExternalProjects.Internal.ExternalProject
+			}
+
+			export type AttributionVersionInfo = {
+				id: string
+				name: string
+				version_number: string
+				date_created: string
+			}
+
+			export type AttributionGroup = {
+				id: string
+				flame_project: FlameProject | null
+				attribution: AttributionResolution | null
+				attributed_at: string | null
+				attributed_by: string | null
+				files: AttributionFile[]
+				versions: AttributionVersionInfo[]
+			}
+
+			export type UpdateGroupRequest = {
+				attribution: AttributionResolution
+			}
+
+			export type AssignRequest = {
+				sha1: string
+				target_group_id: number
+				project_id: string
+			}
+
+			export type SplitRequest = {
+				sha1: string
+				project_id: string
+			}
+		}
+	}
+
+	export namespace Images {
+		export namespace v3 {
+			/** Extensions accepted by POST /v3/image (Labrinth image pipeline). */
+			export type ImageExtension = 'bmp' | 'gif' | 'jpeg' | 'jpg' | 'png' | 'webp'
+
+			/** `context` query values accepted by POST /v3/image. */
+			export type ImageUploadContext = 'project' | 'version' | 'thread_message' | 'report'
+
+			export type UploadedImage = {
+				id: string
+				url: string
+				size: number
+				created: string
+				owner_id: string
+			} & (
+				| { context: 'project'; project_id: string }
+				| { context: 'version'; version_id: string }
+				| { context: 'thread_message'; thread_message_id: string }
+				| { context: 'report'; report_id: string }
+			)
+
+			export type UploadedImageFor<C extends ImageUploadContext> = Extract<
+				UploadedImage,
+				{ context: C }
+			>
+
+			/**
+			 * Target for POST /v3/image (per-context id query params, plus `context`).
+			 * `ext` is passed as a separate argument on the client module.
+			 */
+			export type UploadImageParams =
+				| { context: 'project'; project_id: string }
+				| { context: 'version'; version_id: string }
+				| { context: 'thread_message'; thread_message_id: string }
+				| { context: 'report'; report_id: string }
+		}
+	}
+
 	export namespace Analytics {
 		export namespace v3 {
 			export type AnalyticsEventId = number
@@ -1135,11 +1273,47 @@ export namespace Labrinth {
 
 		// TODO: consolidate duplicated types between v2 and v3 versions
 		export namespace v3 {
+			export type FlameProject = {
+				id: number
+				title: string
+				url: string
+				icon_url: string
+			}
+
+			export type DependencyAttribution = {
+				flame_project?: FlameProject
+				resolution?: DependencyAttributionResolution
+			}
+
+			export type DependencyAttributionResolution =
+				| {
+						kind: 'license'
+						license: Labrinth.Attribution.Internal.AttributionLicense
+						link_to_work: string
+				  }
+				| {
+						kind: 'globally_allowed'
+						link_to_work: string
+				  }
+				| {
+						kind: 'my_project'
+						license: Labrinth.Attribution.Internal.AttributionLicense
+				  }
+				| {
+						kind: 'special_permissions'
+						link_to_work: string
+				  }
+				| {
+						kind: 'no_permission'
+						link_to_work?: string
+				  }
+
 			export interface Dependency {
 				dependency_type: Labrinth.Versions.v2.DependencyType
 				project_id?: string
 				file_name?: string
 				version_id?: string
+				attribution?: DependencyAttribution
 			}
 
 			export interface GetProjectVersionsParams {
@@ -1199,6 +1373,7 @@ export namespace Labrinth {
 				date_published: string
 				downloads: number
 				files: VersionFile[]
+				files_missing_attribution?: string[]
 				environment?: Labrinth.Projects.v3.Environment
 				mrpack_loaders?: string[]
 
@@ -1788,7 +1963,7 @@ export namespace Labrinth {
 				inserted_by: number | null
 				updated_at: string | null
 				updated_by: number | null
-				linked_files: LinkedFile[]
+				linked_files?: LinkedFile[]
 			}
 
 			export type SearchRequest = {
@@ -1804,6 +1979,20 @@ export namespace Labrinth {
 				proof?: string
 				flame_project_id?: number
 			}
+
+			export type CreateExternalLicenseRequest = {
+				title?: string
+				status: ExternalLicenseStatus
+				link?: string
+				proof?: string
+				flame_project_id?: number
+				files: LinkedFile[]
+			}
+
+			export type AddFileRequest = {
+				hashes: string[]
+				license_id: number
+			}
 		}
 	}
 
diff --git a/packages/assets/generated-icons.ts b/packages/assets/generated-icons.ts
index 6f8549ccb5..12973cb3ef 100644
--- a/packages/assets/generated-icons.ts
+++ b/packages/assets/generated-icons.ts
@@ -11,8 +11,10 @@ import _ArchiveIcon from './icons/archive.svg?component'
 import _ArrowBigRightDashIcon from './icons/arrow-big-right-dash.svg?component'
 import _ArrowBigUpDashIcon from './icons/arrow-big-up-dash.svg?component'
 import _ArrowDownIcon from './icons/arrow-down.svg?component'
+import _ArrowDown10Icon from './icons/arrow-down-1-0.svg?component'
 import _ArrowDownAZIcon from './icons/arrow-down-a-z.svg?component'
 import _ArrowDownLeftIcon from './icons/arrow-down-left.svg?component'
+import _ArrowDownWideNarrowIcon from './icons/arrow-down-wide-narrow.svg?component'
 import _ArrowDownZAIcon from './icons/arrow-down-z-a.svg?component'
 import _ArrowLeftIcon from './icons/arrow-left.svg?component'
 import _ArrowLeftRightIcon from './icons/arrow-left-right.svg?component'
@@ -78,6 +80,7 @@ import _ChevronRightIcon from './icons/chevron-right.svg?component'
 import _ChevronUpIcon from './icons/chevron-up.svg?component'
 import _CircleAlertIcon from './icons/circle-alert.svg?component'
 import _CircleArrowRightIcon from './icons/circle-arrow-right.svg?component'
+import _CircleDashedIcon from './icons/circle-dashed.svg?component'
 import _CircleUserIcon from './icons/circle-user.svg?component'
 import _ClearIcon from './icons/clear.svg?component'
 import _ClientIcon from './icons/client.svg?component'
@@ -120,6 +123,7 @@ import _FilePlusIcon from './icons/file-plus.svg?component'
 import _FileTextIcon from './icons/file-text.svg?component'
 import _FilterIcon from './icons/filter.svg?component'
 import _FilterXIcon from './icons/filter-x.svg?component'
+import _FoldVerticalIcon from './icons/fold-vertical.svg?component'
 import _FolderIcon from './icons/folder.svg?component'
 import _FolderArchiveIcon from './icons/folder-archive.svg?component'
 import _FolderCogIcon from './icons/folder-cog.svg?component'
@@ -244,6 +248,7 @@ import _SortAscIcon from './icons/sort-asc.svg?component'
 import _SortDescIcon from './icons/sort-desc.svg?component'
 import _SparklesIcon from './icons/sparkles.svg?component'
 import _SpinnerIcon from './icons/spinner.svg?component'
+import _SplitIcon from './icons/split.svg?component'
 import _StarIcon from './icons/star.svg?component'
 import _StopCircleIcon from './icons/stop-circle.svg?component'
 import _StoreIcon from './icons/store.svg?component'
@@ -401,6 +406,7 @@ import _TriangleAlertIcon from './icons/triangle-alert.svg?component'
 import _UnderlineIcon from './icons/underline.svg?component'
 import _UndoIcon from './icons/undo.svg?component'
 import _UnfoldHorizontalIcon from './icons/unfold-horizontal.svg?component'
+import _UnfoldVerticalIcon from './icons/unfold-vertical.svg?component'
 import _UnknownIcon from './icons/unknown.svg?component'
 import _UnknownDonationIcon from './icons/unknown-donation.svg?component'
 import _UnlinkIcon from './icons/unlink.svg?component'
@@ -431,8 +437,10 @@ export const ArchiveIcon = _ArchiveIcon
 export const ArrowBigRightDashIcon = _ArrowBigRightDashIcon
 export const ArrowBigUpDashIcon = _ArrowBigUpDashIcon
 export const ArrowDownIcon = _ArrowDownIcon
+export const ArrowDown10Icon = _ArrowDown10Icon
 export const ArrowDownAZIcon = _ArrowDownAZIcon
 export const ArrowDownLeftIcon = _ArrowDownLeftIcon
+export const ArrowDownWideNarrowIcon = _ArrowDownWideNarrowIcon
 export const ArrowDownZAIcon = _ArrowDownZAIcon
 export const ArrowLeftIcon = _ArrowLeftIcon
 export const ArrowLeftRightIcon = _ArrowLeftRightIcon
@@ -498,6 +506,7 @@ export const ChevronRightIcon = _ChevronRightIcon
 export const ChevronUpIcon = _ChevronUpIcon
 export const CircleAlertIcon = _CircleAlertIcon
 export const CircleArrowRightIcon = _CircleArrowRightIcon
+export const CircleDashedIcon = _CircleDashedIcon
 export const CircleUserIcon = _CircleUserIcon
 export const ClearIcon = _ClearIcon
 export const ClientIcon = _ClientIcon
@@ -540,6 +549,7 @@ export const FilePlusIcon = _FilePlusIcon
 export const FileTextIcon = _FileTextIcon
 export const FilterIcon = _FilterIcon
 export const FilterXIcon = _FilterXIcon
+export const FoldVerticalIcon = _FoldVerticalIcon
 export const FolderIcon = _FolderIcon
 export const FolderArchiveIcon = _FolderArchiveIcon
 export const FolderCogIcon = _FolderCogIcon
@@ -664,6 +674,7 @@ export const SortAscIcon = _SortAscIcon
 export const SortDescIcon = _SortDescIcon
 export const SparklesIcon = _SparklesIcon
 export const SpinnerIcon = _SpinnerIcon
+export const SplitIcon = _SplitIcon
 export const StarIcon = _StarIcon
 export const StopCircleIcon = _StopCircleIcon
 export const StoreIcon = _StoreIcon
@@ -821,6 +832,7 @@ export const TriangleAlertIcon = _TriangleAlertIcon
 export const UnderlineIcon = _UnderlineIcon
 export const UndoIcon = _UndoIcon
 export const UnfoldHorizontalIcon = _UnfoldHorizontalIcon
+export const UnfoldVerticalIcon = _UnfoldVerticalIcon
 export const UnknownIcon = _UnknownIcon
 export const UnknownDonationIcon = _UnknownDonationIcon
 export const UnlinkIcon = _UnlinkIcon
diff --git a/packages/assets/icons/arrow-down-1-0.svg b/packages/assets/icons/arrow-down-1-0.svg
new file mode 100644
index 0000000000..fe60477bd4
--- /dev/null
+++ b/packages/assets/icons/arrow-down-1-0.svg
@@ -0,0 +1,19 @@
+<!-- @license lucide-static v0.562.0 - ISC -->
+<svg
+  class="lucide lucide-arrow-down-1-0"
+  xmlns="http://www.w3.org/2000/svg"
+  width="24"
+  height="24"
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+>
+  <path d="m3 16 4 4 4-4" />
+  <path d="M7 20V4" />
+  <path d="M17 10V4h-2" />
+  <path d="M15 10h4" />
+  <rect x="15" y="14" width="4" height="6" ry="2" />
+</svg>
diff --git a/packages/assets/icons/arrow-down-wide-narrow.svg b/packages/assets/icons/arrow-down-wide-narrow.svg
new file mode 100644
index 0000000000..b65dc828d5
--- /dev/null
+++ b/packages/assets/icons/arrow-down-wide-narrow.svg
@@ -0,0 +1,19 @@
+<!-- @license lucide-static v0.562.0 - ISC -->
+<svg
+  class="lucide lucide-arrow-down-wide-narrow"
+  xmlns="http://www.w3.org/2000/svg"
+  width="24"
+  height="24"
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+>
+  <path d="m3 16 4 4 4-4" />
+  <path d="M7 20V4" />
+  <path d="M11 4h10" />
+  <path d="M11 8h7" />
+  <path d="M11 12h4" />
+</svg>
diff --git a/packages/assets/icons/circle-dashed.svg b/packages/assets/icons/circle-dashed.svg
new file mode 100644
index 0000000000..f06ebeda6a
--- /dev/null
+++ b/packages/assets/icons/circle-dashed.svg
@@ -0,0 +1,22 @@
+<!-- @license lucide-static v0.562.0 - ISC -->
+<svg
+  class="lucide lucide-circle-dashed"
+  xmlns="http://www.w3.org/2000/svg"
+  width="24"
+  height="24"
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+>
+  <path d="M10.1 2.182a10 10 0 0 1 3.8 0" />
+  <path d="M13.9 21.818a10 10 0 0 1-3.8 0" />
+  <path d="M17.609 3.721a10 10 0 0 1 2.69 2.7" />
+  <path d="M2.182 13.9a10 10 0 0 1 0-3.8" />
+  <path d="M20.279 17.609a10 10 0 0 1-2.7 2.69" />
+  <path d="M21.818 10.1a10 10 0 0 1 0 3.8" />
+  <path d="M3.721 6.391a10 10 0 0 1 2.7-2.69" />
+  <path d="M6.391 20.279a10 10 0 0 1-2.69-2.7" />
+</svg>
diff --git a/packages/assets/icons/fold-vertical.svg b/packages/assets/icons/fold-vertical.svg
new file mode 100644
index 0000000000..9d8f1bc552
--- /dev/null
+++ b/packages/assets/icons/fold-vertical.svg
@@ -0,0 +1,22 @@
+<!-- @license lucide-static v0.562.0 - ISC -->
+<svg
+  class="lucide lucide-fold-vertical"
+  xmlns="http://www.w3.org/2000/svg"
+  width="24"
+  height="24"
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+>
+  <path d="M12 22v-6" />
+  <path d="M12 8V2" />
+  <path d="M4 12H2" />
+  <path d="M10 12H8" />
+  <path d="M16 12h-2" />
+  <path d="M22 12h-2" />
+  <path d="m15 19-3-3-3 3" />
+  <path d="m15 5-3 3-3-3" />
+</svg>
diff --git a/packages/assets/icons/split.svg b/packages/assets/icons/split.svg
new file mode 100644
index 0000000000..432fc358df
--- /dev/null
+++ b/packages/assets/icons/split.svg
@@ -0,0 +1,18 @@
+<!-- @license lucide-static v0.562.0 - ISC -->
+<svg
+  class="lucide lucide-split"
+  xmlns="http://www.w3.org/2000/svg"
+  width="24"
+  height="24"
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+>
+  <path d="M16 3h5v5" />
+  <path d="M8 3H3v5" />
+  <path d="M12 22v-8.3a4 4 0 0 0-1.172-2.872L3 3" />
+  <path d="m15 9 6-6" />
+</svg>
diff --git a/packages/assets/icons/unfold-vertical.svg b/packages/assets/icons/unfold-vertical.svg
new file mode 100644
index 0000000000..0c5e2feb97
--- /dev/null
+++ b/packages/assets/icons/unfold-vertical.svg
@@ -0,0 +1,22 @@
+<!-- @license lucide-static v0.562.0 - ISC -->
+<svg
+  class="lucide lucide-unfold-vertical"
+  xmlns="http://www.w3.org/2000/svg"
+  width="24"
+  height="24"
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+>
+  <path d="M12 22v-6" />
+  <path d="M12 8V2" />
+  <path d="M4 12H2" />
+  <path d="M10 12H8" />
+  <path d="M16 12h-2" />
+  <path d="M22 12h-2" />
+  <path d="m15 19-3 3-3-3" />
+  <path d="m15 5-3-3-3 3" />
+</svg>
diff --git a/packages/moderation/src/data/attribution-quick-replies.ts b/packages/moderation/src/data/attribution-quick-replies.ts
new file mode 100644
index 0000000000..dc05c9c5a4
--- /dev/null
+++ b/packages/moderation/src/data/attribution-quick-replies.ts
@@ -0,0 +1,15 @@
+import type { QuickReply } from '../types/quick-reply'
+
+export default [
+	{
+		label: '⚠️ Illegitimate Evidence',
+		message: async () =>
+			(await import('./messages/attributions/illegitimate-evidence.md?raw')).default,
+		private: false,
+	},
+	{
+		label: '🚫 Cheats and Hacks',
+		message: async () => (await import('./messages/attributions/cheats-and-hacks.md?raw')).default,
+		private: false,
+	},
+] as ReadonlyArray<QuickReply>
diff --git a/packages/moderation/src/data/checklist.ts b/packages/moderation/src/data/checklist.ts
index 69cd061a54..8b8bb5d689 100644
--- a/packages/moderation/src/data/checklist.ts
+++ b/packages/moderation/src/data/checklist.ts
@@ -1,5 +1,4 @@
 import type { Stage } from '../types/stage'
-import modpackPermissionsStage from './modpack-permissions-stage'
 import categories from './stages/categories'
 import description from './stages/description'
 import environment from './stages/environment/environment'
@@ -7,6 +6,7 @@ import environmentMultiple from './stages/environment/environment-multiple'
 import gallery from './stages/gallery'
 import license from './stages/license'
 import links from './stages/links'
+import permissions from './stages/permissions'
 import postApproval from './stages/post-approval'
 import reupload from './stages/reupload'
 import ruleFollowing from './stages/rule-following'
@@ -28,8 +28,8 @@ export default [
 	gallery,
 	versions,
 	reupload,
+	permissions,
 	ruleFollowing,
-	modpackPermissionsStage,
 	statusAlerts,
 	undefinedProject,
 	postApproval,
diff --git a/packages/moderation/src/data/messages/attributions/cheats-and-hacks.md b/packages/moderation/src/data/messages/attributions/cheats-and-hacks.md
new file mode 100644
index 0000000000..1acda34063
--- /dev/null
+++ b/packages/moderation/src/data/messages/attributions/cheats-and-hacks.md
@@ -0,0 +1 @@
+Modrinth does not permit distributing content that violates rule 3 (no cheats or hacks) in modpacks regardless of permission
diff --git a/packages/moderation/src/data/messages/attributions/illegitimate-evidence.md b/packages/moderation/src/data/messages/attributions/illegitimate-evidence.md
new file mode 100644
index 0000000000..2d85cf783b
--- /dev/null
+++ b/packages/moderation/src/data/messages/attributions/illegitimate-evidence.md
@@ -0,0 +1 @@
+Please only submit legitimate evidence and do not attempt to spam notes with unnecessary information
diff --git a/packages/moderation/src/data/messages/externals-permissions/invalid.md b/packages/moderation/src/data/messages/externals-permissions/invalid.md
new file mode 100644
index 0000000000..15e87e7623
--- /dev/null
+++ b/packages/moderation/src/data/messages/externals-permissions/invalid.md
@@ -0,0 +1,4 @@
+## Proof of Permissions
+
+You may not have the necessary rights or permissions to distribute some of the external content included in your Modpack. </br>
+Per section 4 of %RULES%, we ask that you please complete all steps and address all notes left by moderators if any in your project's %PROJECT_PERMISSIONS_FLINK%.
diff --git a/packages/moderation/src/data/messages/externals-permissions/missing.md b/packages/moderation/src/data/messages/externals-permissions/missing.md
new file mode 100644
index 0000000000..9dc97b32b5
--- /dev/null
+++ b/packages/moderation/src/data/messages/externals-permissions/missing.md
@@ -0,0 +1,3 @@
+## Permissions Incomplete
+
+Per section 4 of %RULES%, we ask that you complete all steps requested in your project's %PROJECT_PERMISSIONS_FLINK%.
diff --git a/packages/moderation/src/data/messages/externals-permissions/prohibited.md b/packages/moderation/src/data/messages/externals-permissions/prohibited.md
new file mode 100644
index 0000000000..1d62230ff8
--- /dev/null
+++ b/packages/moderation/src/data/messages/externals-permissions/prohibited.md
@@ -0,0 +1,6 @@
+## Prohibited External Content
+
+Some external content in your mod was found to be prohibited.</br>
+This means you cannot include these files in your Modpack on Modrinth, likely because it violates one of %RULES%.
+
+Please view your project's %PROJECT_PERMISSIONS_FLINK% for a list of what content must be removed from your pack before distribution on Modrinth.
diff --git a/packages/moderation/src/data/nags/core.ts b/packages/moderation/src/data/nags/core.ts
index d3f67bb769..281eda266d 100644
--- a/packages/moderation/src/data/nags/core.ts
+++ b/packages/moderation/src/data/nags/core.ts
@@ -202,4 +202,33 @@ export const coreNags: Nag[] = [
 			shouldShow: (context: NagContext) => context.currentRoute !== 'type-project-settings-license',
 		},
 	},
+	{
+		id: 'review-permissions',
+		title: defineMessage({
+			id: 'nags.review-permissions.title',
+			defaultMessage: 'Review external permissions',
+		}),
+		description: (context: NagContext) => {
+			const { formatMessage } = useVIntl()
+			return formatMessage(
+				defineMessage({
+					id: 'nags.review-permissions.description',
+					defaultMessage:
+						'Make sure you have provided proof of your permission to distribute any external content in your Modpack.',
+				}),
+			)
+		},
+		status: 'required',
+		shouldShow: (context: NagContext) =>
+			context.versions.some((version) => (version.files_missing_attribution?.length ?? 0) >= 1),
+		link: {
+			path: 'settings/permissions',
+			title: defineMessage({
+				id: 'nags.settings.permissions.title',
+				defaultMessage: 'Visit permissions dashboard',
+			}),
+			shouldShow: (context: NagContext) =>
+				context.currentRoute !== 'type-project-settings-permissions',
+		},
+	},
 ]
diff --git a/packages/moderation/src/data/stages/permissions.ts b/packages/moderation/src/data/stages/permissions.ts
new file mode 100644
index 0000000000..a4a0d80d9a
--- /dev/null
+++ b/packages/moderation/src/data/stages/permissions.ts
@@ -0,0 +1,51 @@
+import { SignatureIcon } from '@modrinth/assets'
+
+import type { Stage } from '../../types/stage'
+
+const permissions: Stage = {
+	title: 'Does this projects external content have any issues?',
+	id: 'permissions',
+	icon: SignatureIcon,
+	guidance_url: 'https://www.notion.so/2e15ee711bf080e4a41df61bbab49892',
+	navigate: '/settings/permissions',
+	actions: [
+		{
+			id: 'invalid-permissions',
+			type: 'button',
+			label: 'Invalid permissions',
+			weight: 2000,
+			suggestedStatus: 'rejected',
+			severity: 'high',
+			shouldShow: (project, projectV3) =>
+				projectV3.project_types?.includes('modpack') && !projectV3?.minecraft_server,
+			message: async () =>
+				(await import('../messages/externals-permissions/invalid.md?raw')).default,
+		},
+		{
+			id: 'prohibited-extrernal-content',
+			type: 'button',
+			label: 'Prohibited externals',
+			weight: 2001,
+			suggestedStatus: 'rejected',
+			severity: 'high',
+			shouldShow: (project, projectV3) =>
+				projectV3.project_types?.includes('modpack') && !projectV3?.minecraft_server,
+			message: async () =>
+				(await import('../messages/externals-permissions/prohibited.md?raw')).default,
+		},
+		{
+			id: 'missing-permissions',
+			type: 'button',
+			label: 'Missing permissions',
+			weight: 2002,
+			suggestedStatus: 'rejected',
+			severity: 'high',
+			shouldShow: (project, projectV3) =>
+				projectV3.project_types?.includes('modpack') && !projectV3?.minecraft_server,
+			message: async () =>
+				(await import('../messages/externals-permissions/missing.md?raw')).default,
+		},
+	],
+}
+
+export default permissions
diff --git a/packages/moderation/src/index.ts b/packages/moderation/src/index.ts
index 2df2ecfe65..80e08ccf02 100644
--- a/packages/moderation/src/index.ts
+++ b/packages/moderation/src/index.ts
@@ -8,6 +8,7 @@ export {
 	type TechReviewContext,
 	default as techReviewQuickReplies,
 } from './data/tech-review-quick-replies'
+export { default as attributionQuickReplies } from './data/attribution-quick-replies'
 export * from './locales'
 export * from './types/actions'
 export * from './types/keybinds'
diff --git a/packages/moderation/src/locales/en-US/index.json b/packages/moderation/src/locales/en-US/index.json
index 26afc85cac..1a08e00384 100644
--- a/packages/moderation/src/locales/en-US/index.json
+++ b/packages/moderation/src/locales/en-US/index.json
@@ -140,6 +140,12 @@
   "nags.multiple-resolution-tags.title": {
     "defaultMessage": "Select correct resolution"
   },
+  "nags.review-permissions.description": {
+    "defaultMessage": "Make sure you have provided proof of your permission to distribute any external content in your Modpack."
+  },
+  "nags.review-permissions.title": {
+    "defaultMessage": "Review external permissions"
+  },
   "nags.select-compatibility.description": {
     "defaultMessage": "Select what versions your server supports, choose a Modpack, or upload your own."
   },
@@ -182,6 +188,9 @@
   "nags.settings.links.title": {
     "defaultMessage": "Visit links settings"
   },
+  "nags.settings.permissions.title": {
+    "defaultMessage": "Visit permissions dashboard"
+  },
   "nags.settings.tags.title": {
     "defaultMessage": "Visit tag settings"
   },
diff --git a/packages/moderation/src/types/nags.ts b/packages/moderation/src/types/nags.ts
index 3b5d49ee9b..c0a63cddd7 100644
--- a/packages/moderation/src/types/nags.ts
+++ b/packages/moderation/src/types/nags.ts
@@ -28,7 +28,7 @@ export interface NagContext {
 	/**
 	 * The versions associated with the project.
 	 */
-	versions: Labrinth.Versions.v2.Version[]
+	versions: Labrinth.Versions.v3.Version[]
 	/**
 	 * The current project member viewing the nag.
 	 */
diff --git a/packages/moderation/src/utils.ts b/packages/moderation/src/utils.ts
index 0a076dd54a..970d0e446c 100644
--- a/packages/moderation/src/utils.ts
+++ b/packages/moderation/src/utils.ts
@@ -382,6 +382,10 @@ export function flattenProjectVariables(
 	vars[`PROJECT_LANGUAGE_SETTINGS`] = `https://modrinth.com/project/${project.id}/settings/server`
 	vars[`PROJECT_LANGUAGE_SETTINGS_FLINK`] =
 		`[Language Settings](https://modrinth.com/project/${project.id}/settings/server)`
+	vars[`PROJECT_PERMISSIONS_LINK`] =
+		`https://modrinth.com/project/${project.id}/settings/permissions`
+	vars[`PROJECT_PERMISSIONS_FLINK`] =
+		`[Permissions dashboard](https://modrinth.com/project/${project.id}/settings/permissions)`
 
 	return vars
 }
diff --git a/packages/ui/src/components/base/Checkbox.vue b/packages/ui/src/components/base/Checkbox.vue
index 4e8fcbd7a4..e7a0c262a4 100644
--- a/packages/ui/src/components/base/Checkbox.vue
+++ b/packages/ui/src/components/base/Checkbox.vue
@@ -1,5 +1,6 @@
 <template>
 	<button
+		type="button"
 		class="group bg-transparent border-none p-0 m-0 flex items-center text-left gap-3 checkbox-outer outline-offset-4 text-contrast"
 		:disabled="disabled"
 		:class="
diff --git a/packages/ui/src/components/base/FileInput.vue b/packages/ui/src/components/base/FileInput.vue
index ff6e765121..9323b1e309 100644
--- a/packages/ui/src/components/base/FileInput.vue
+++ b/packages/ui/src/components/base/FileInput.vue
@@ -96,7 +96,7 @@ label {
 		grid-gap: 0.5rem;
 		background-color: var(--color-button-bg);
 		border-radius: var(--radius-sm);
-		border: dashed 2px var(--color-contrast);
+		border: dashed 2px var(--color-secondary);
 		cursor: pointer;
 		color: var(--color-contrast);
 	}
diff --git a/packages/ui/src/components/external_files/AddFilesToAttributionGroupModal.vue b/packages/ui/src/components/external_files/AddFilesToAttributionGroupModal.vue
new file mode 100644
index 0000000000..7ef1466574
--- /dev/null
+++ b/packages/ui/src/components/external_files/AddFilesToAttributionGroupModal.vue
@@ -0,0 +1,269 @@
+<script setup lang="ts">
+import type { Labrinth } from '@modrinth/api-client'
+import { CheckIcon, PlusIcon, SearchIcon, SpinnerIcon, XIcon } from '@modrinth/assets'
+import { computed, nextTick, ref } from 'vue'
+
+import { ButtonStyled, NewModal, StyledInput } from '#ui/components'
+import { commonMessages } from '#ui/utils'
+
+import { defineMessages, useVIntl } from '../../composables/i18n'
+
+const props = defineProps<{
+	groupId: string
+	pending?: boolean
+}>()
+
+const emit = defineEmits<{
+	(e: 'confirm', sha1s: string[]): void
+}>()
+
+const { formatMessage } = useVIntl()
+
+const messages = defineMessages({
+	defaultGroupTitle: {
+		id: 'external-files.permissions-card.fallback-group-title',
+		defaultMessage: 'Attribution group {id}',
+	},
+	addFilesModalTitle: {
+		id: 'external-files.permissions-card.add-files-modal.title',
+		defaultMessage: 'Add files to this group',
+	},
+	addFilesModalDescription: {
+		id: 'external-files.permissions-card.add-files-modal.description',
+		defaultMessage: 'Select any files that should be moved into this group.',
+	},
+	addFilesModalEmpty: {
+		id: 'external-files.permissions-card.add-files-modal.empty',
+		defaultMessage: 'There are no files in other groups that can be moved here.',
+	},
+	addFilesModalSearchPlaceholder: {
+		id: 'external-files.permissions-card.add-files-modal.search-placeholder',
+		defaultMessage: 'Search files…',
+	},
+	addFilesModalNoSearchResults: {
+		id: 'external-files.permissions-card.add-files-modal.no-search-results',
+		defaultMessage: 'No files match your search.',
+	},
+	addFilesModalConfirm: {
+		id: 'external-files.permissions-card.add-files-modal.confirm',
+		defaultMessage: '{count, plural, one {Add file} other {Add files}}',
+	},
+	addFilesModalSelectedCount: {
+		id: 'external-files.permissions-card.add-files-modal.selected-count',
+		defaultMessage: '{count, plural, one {# file selected} other {# files selected}}',
+	},
+})
+
+type AssignableFileEntry = {
+	sha1: string
+	displayName: string
+	sourceLabel: string
+}
+
+const modalRef = ref<InstanceType<typeof NewModal> | null>(null)
+const assignableEntries = ref<AssignableFileEntry[]>([])
+const searchQuery = ref('')
+const searchInputRef = ref<{ focus: () => void } | null>(null)
+const selectedSha1s = ref<Set<string>>(new Set())
+
+const filteredEntries = computed(() => {
+	const q = searchQuery.value.trim().toLowerCase()
+	if (!q) {
+		return assignableEntries.value
+	}
+	return assignableEntries.value.filter(
+		(e) =>
+			e.displayName.toLowerCase().includes(q) ||
+			e.sourceLabel.toLowerCase().includes(q) ||
+			e.sha1.toLowerCase().includes(q),
+	)
+})
+
+const selectedFileCount = computed(() => selectedSha1s.value.size)
+
+function isFileSelected(sha1: string) {
+	return selectedSha1s.value.has(sha1)
+}
+
+function toggleFileSelection(sha1: string) {
+	const next = new Set(selectedSha1s.value)
+	if (next.has(sha1)) {
+		next.delete(sha1)
+	} else {
+		next.add(sha1)
+	}
+	selectedSha1s.value = next
+}
+
+function clearSelectedFiles() {
+	selectedSha1s.value = new Set()
+}
+
+function focusSearchOnOpen() {
+	nextTick(() => {
+		setTimeout(() => {
+			searchInputRef.value?.focus()
+		}, 75)
+	})
+}
+
+function buildAssignableEntries(
+	groups: Labrinth.Attribution.Internal.AttributionGroup[],
+): AssignableFileEntry[] {
+	const entries: AssignableFileEntry[] = []
+	for (const g of groups) {
+		if (g.id === props.groupId) {
+			continue
+		}
+		const firstName = g.files?.[0]?.name
+		const sourceLabel =
+			g.flame_project?.title ??
+			(firstName ? (firstName.split('/').pop() ?? firstName) : null) ??
+			formatMessage(messages.defaultGroupTitle, { id: g.id })
+		for (const f of g.files ?? []) {
+			const displayName = f.name.split('/').pop() ?? f.name
+			entries.push({ sha1: f.sha1, displayName, sourceLabel })
+		}
+	}
+	entries.sort((a, b) => {
+		const byName = a.displayName.localeCompare(b.displayName)
+		if (byName !== 0) {
+			return byName
+		}
+		return a.sourceLabel.localeCompare(b.sourceLabel)
+	})
+	return entries
+}
+
+function handleConfirm() {
+	if (selectedFileCount.value === 0) {
+		return
+	}
+	emit('confirm', [...selectedSha1s.value])
+	hide()
+}
+
+function show(event: MouseEvent, groups: Labrinth.Attribution.Internal.AttributionGroup[]) {
+	assignableEntries.value = buildAssignableEntries(groups)
+	searchQuery.value = ''
+	clearSelectedFiles()
+	modalRef.value?.show(event)
+}
+
+function hide() {
+	modalRef.value?.hide()
+}
+
+defineExpose({ show, hide })
+</script>
+
+<template>
+	<NewModal
+		ref="modalRef"
+		:header="formatMessage(messages.addFilesModalTitle)"
+		max-width="560px"
+		:disable-close="pending"
+		:on-show="focusSearchOnOpen"
+		:on-hide="clearSelectedFiles"
+		no-padding
+	>
+		<div class="flex flex-col gap-4 p-4 relative">
+			<p class="text-secondary m-0">
+				{{ formatMessage(messages.addFilesModalDescription) }}
+			</p>
+			<StyledInput
+				ref="searchInputRef"
+				v-model="searchQuery"
+				type="text"
+				autocomplete="off"
+				:placeholder="formatMessage(messages.addFilesModalSearchPlaceholder)"
+				:icon="SearchIcon"
+				:disabled="pending"
+				input-class="h-[40px]"
+				class="sticky top-0"
+				clearable
+			/>
+		</div>
+		<div
+			class="flex flex-col gap-2 bg-surface-2 overflow-y-auto overflow-x-hidden border-0 border-y border-solid border-surface-5 max-h-[calc(max(50vh,600px))]"
+		>
+			<div v-if="assignableEntries.length === 0" class="text-secondary text-sm p-4 m-0">
+				{{ formatMessage(messages.addFilesModalEmpty) }}
+			</div>
+			<div v-else-if="filteredEntries.length === 0" class="text-secondary text-sm m-0 p-4">
+				{{ formatMessage(messages.addFilesModalNoSearchResults) }}
+			</div>
+			<ul v-else class="p-0 m-0 list-none">
+				<li
+					v-for="entry in filteredEntries"
+					:key="entry.sha1"
+					:class="
+						isFileSelected(entry.sha1)
+							? 'border-brand bg-surface-4 hover:bg-surface-5'
+							: 'hover:bg-surface-3 even:bg-surface-2.5'
+					"
+				>
+					<button
+						type="button"
+						class="w-full text-left p-3 flex flex-col gap-1 appearance-none bg-transparent 3 transition-colors disabled:opacity-50"
+						:disabled="pending"
+						:aria-pressed="isFileSelected(entry.sha1)"
+						@click="toggleFileSelection(entry.sha1)"
+					>
+						<span class="flex gap-2 font-medium">
+							<span
+								class="size-4 shrink-0 rounded flex items-center justify-center border-[1px] border-solid"
+								:class="
+									isFileSelected(entry.sha1)
+										? 'bg-brand border-button-border text-brand-inverted'
+										: 'bg-surface-2 border-surface-5'
+								"
+							>
+								<CheckIcon
+									v-if="isFileSelected(entry.sha1)"
+									class="size-3"
+									aria-hidden="true"
+									stroke-width="3"
+								/>
+							</span>
+							<span class="flex flex-col gap-1 truncate">
+								<span class="truncate">{{ entry.displayName }}</span>
+								<span
+									v-if="entry.sourceLabel !== entry.displayName"
+									class="text-secondary text-xs truncate"
+									>{{ entry.sourceLabel }}</span
+								>
+							</span>
+						</span>
+					</button>
+				</li>
+			</ul>
+		</div>
+		<template #actions>
+			<div class="flex justify-between items-center gap-3 w-full pt-4">
+				<p v-if="selectedFileCount > 0" class="text-secondary text-sm m-0">
+					{{ formatMessage(messages.addFilesModalSelectedCount, { count: selectedFileCount }) }}
+				</p>
+				<div class="flex gap-2 ml-auto">
+					<ButtonStyled type="outlined">
+						<button type="button" :disabled="pending" @click="hide">
+							<XIcon class="size-4 shrink-0" />
+							{{ formatMessage(commonMessages.cancelButton) }}
+						</button>
+					</ButtonStyled>
+					<ButtonStyled color="brand">
+						<button
+							type="button"
+							:disabled="selectedFileCount === 0 || pending"
+							@click="handleConfirm"
+						>
+							<SpinnerIcon v-if="pending" class="size-4 shrink-0 animate-spin" />
+							<PlusIcon v-else class="size-4 shrink-0" />
+							{{ formatMessage(messages.addFilesModalConfirm, { count: selectedFileCount }) }}
+						</button>
+					</ButtonStyled>
+				</div>
+			</div>
+		</template>
+	</NewModal>
+</template>
diff --git a/packages/ui/src/components/external_files/AddToExistingExternalProjectModal.vue b/packages/ui/src/components/external_files/AddToExistingExternalProjectModal.vue
new file mode 100644
index 0000000000..4abac17e83
--- /dev/null
+++ b/packages/ui/src/components/external_files/AddToExistingExternalProjectModal.vue
@@ -0,0 +1,322 @@
+<script setup lang="ts">
+import type { Labrinth } from '@modrinth/api-client'
+import { PlusIcon, SearchIcon, SpinnerIcon, XIcon } from '@modrinth/assets'
+import { useMutation } from '@tanstack/vue-query'
+import { computed, nextTick, ref, useTemplateRef } from 'vue'
+
+import { Accordion, ButtonStyled, NewModal, StyledInput } from '#ui/components'
+
+import { injectModrinthClient, injectNotificationManager } from '../../providers'
+import AttributionGroupFilePicker from './AttributionGroupFilePicker.vue'
+import {
+	MODERATOR_ATTRIBUTION_KIND_LABELS,
+	moderatorAttributionGroupTitle,
+	parseInitialAttribution,
+} from './external-project-utils'
+import ExternalProjectLookupCard from './ExternalProjectLookupCard.vue'
+import type { ExternalLicenseStatus } from './types.ts'
+
+const props = defineProps<{
+	group: Labrinth.Attribution.Internal.AttributionGroup
+}>()
+
+const emit = defineEmits<{
+	(e: 'success'): void
+}>()
+
+type ExternalProject = {
+	id: number
+	title: string | null
+	status: ExternalLicenseStatus
+	link: string | null
+	exceptions: string | null
+	proof: string | null
+	flame_project_id: number | null
+	files: {
+		sha1: string
+		name: string | null
+	}[]
+}
+
+const client = injectModrinthClient()
+const { addNotification } = injectNotificationManager()
+
+const modalRef = useTemplateRef<InstanceType<typeof NewModal>>('modalRef')
+const searchAccordionRef = useTemplateRef<InstanceType<typeof Accordion>>('searchAccordionRef')
+const filesAccordionRef = useTemplateRef<InstanceType<typeof Accordion>>('filesAccordionRef')
+
+const query = ref('')
+const isLoading = ref(false)
+const hasSearched = ref(false)
+const activeQuery = ref('')
+const externalProjects = ref<ExternalProject[]>([])
+const selectedProjectId = ref<number | null>(null)
+const selectedSha1s = ref<Set<string>>(new Set())
+
+const hasMultipleFiles = computed(() => props.group.files.length > 1)
+
+const groupPreviewTitle = computed(() => moderatorAttributionGroupTitle(props.group))
+
+const attributionKindLabel = computed(() => {
+	const attribution = parseInitialAttribution(props.group.attribution)
+	if (!attribution) {
+		return null
+	}
+	return `Attribution: ${MODERATOR_ATTRIBUTION_KIND_LABELS[attribution.kind]}`
+})
+
+function mapExternalProject(
+	project: Labrinth.ExternalProjects.Internal.ExternalProject,
+): ExternalProject {
+	return {
+		id: project.id,
+		title: project.title,
+		status: project.status,
+		link: project.link,
+		exceptions: project.exceptions,
+		proof: project.proof,
+		flame_project_id: project.flame_project_id,
+		files: project.linked_files ?? [],
+	}
+}
+
+const searchNeedsInput = computed(() => hasSearched.value && activeQuery.value.trim().length < 3)
+
+const addFilesMutation = useMutation({
+	mutationFn: async () => {
+		if (selectedProjectId.value === null) {
+			throw new Error('No external project selected')
+		}
+
+		await client.labrinth.external_projects_internal.addFile({
+			hashes: [...selectedSha1s.value],
+			license_id: selectedProjectId.value,
+		})
+	},
+	onSuccess: async () => {
+		addNotification({
+			type: 'success',
+			title: 'Files added to existing entry',
+		})
+		await nextTick()
+		hide()
+		emit('success')
+	},
+	onError: (error: Error) => {
+		addNotification({
+			type: 'error',
+			title: 'Could not add files to existing entry',
+			text: error.message,
+		})
+	},
+})
+
+const canSubmit = computed(
+	() =>
+		selectedProjectId.value !== null &&
+		selectedSha1s.value.size > 0 &&
+		!addFilesMutation.isPending.value,
+)
+
+function resetForm() {
+	query.value = ''
+	hasSearched.value = false
+	activeQuery.value = ''
+	externalProjects.value = []
+	selectedProjectId.value = null
+	selectedSha1s.value = new Set(props.group.files.map((file) => file.sha1))
+}
+
+function handleSearchPanelOpen() {
+	filesAccordionRef.value?.close()
+}
+
+function handleFilesPanelOpen() {
+	searchAccordionRef.value?.close()
+}
+
+function selectProject(projectId: number) {
+	selectedProjectId.value = projectId
+}
+
+async function executeSearch() {
+	hasSearched.value = true
+	activeQuery.value = query.value
+	externalProjects.value = []
+	selectedProjectId.value = null
+
+	if (activeQuery.value.trim().length < 3) {
+		return
+	}
+
+	isLoading.value = true
+
+	try {
+		const response = await client.labrinth.external_projects_internal.search({
+			title: activeQuery.value.trim(),
+		})
+		externalProjects.value = response.map(mapExternalProject)
+	} catch {
+		externalProjects.value = []
+	} finally {
+		isLoading.value = false
+	}
+}
+
+function handleSubmit() {
+	addFilesMutation.mutate()
+}
+
+function show(event?: MouseEvent) {
+	resetForm()
+	modalRef.value?.show(event)
+}
+
+function hide() {
+	modalRef.value?.hide()
+}
+
+defineExpose({ show, hide })
+</script>
+
+<template>
+	<NewModal
+		ref="modalRef"
+		header="Add to existing entry"
+		max-width="720px"
+		:disable-close="addFilesMutation.isPending.value"
+	>
+		<div class="flex flex-col gap-4 w-[650px]">
+			<div
+				class="rounded-xl bg-surface-3 border border-solid border-surface-5 p-3 flex flex-col gap-1 shrink-0"
+			>
+				<span class="font-semibold text-contrast">{{ groupPreviewTitle }}</span>
+				<span v-if="attributionKindLabel" class="text-secondary text-sm">{{
+					attributionKindLabel
+				}}</span>
+			</div>
+			<Accordion
+				ref="searchAccordionRef"
+				class="w-full bg-surface-4 border border-solid border-surface-5 rounded-2xl overflow-clip"
+				button-class="p-4 w-full border-b border-solid border-b-surface-5 bg-surface-2 -mb-px hover:brightness-[--hover-brightness] group"
+				open-by-default
+				@on-open="handleSearchPanelOpen"
+			>
+				<template #title>
+					<span class="flex items-center gap-3 text-contrast group-active:scale-[0.98]">
+						Select an external project
+					</span>
+				</template>
+				<div class="flex flex-col bg-surface-4 min-h-0">
+					<form
+						class="flex flex-wrap gap-2 shrink-0 p-4 bg-surface-3 border-0 border-b border-solid border-surface-5"
+						@submit.prevent="executeSearch"
+					>
+						<StyledInput
+							v-model="query"
+							:icon="SearchIcon"
+							type="text"
+							autocomplete="off"
+							placeholder="Search external projects…"
+							clearable
+							wrapper-class="flex-1 min-w-[12rem]"
+							:disabled="addFilesMutation.isPending.value"
+						/>
+						<ButtonStyled color="brand">
+							<button type="submit" :disabled="addFilesMutation.isPending.value">
+								<SearchIcon aria-hidden="true" />
+								Search
+							</button>
+						</ButtonStyled>
+					</form>
+					<div
+						class="flex flex-col min-h-0 max-h-[min(50vh,24rem)] overflow-y-auto overflow-x-hidden"
+					>
+						<div
+							v-if="searchNeedsInput || isLoading || externalProjects.length === 0"
+							class="p-8 flex flex-col gap-2 items-center justify-center"
+						>
+							<span class="text-contrast font-semibold">
+								<template v-if="searchNeedsInput"> Enter a search term to get started </template>
+								<template v-else-if="isLoading"> Loading external projects… </template>
+								<template v-else> No projects matched that search </template>
+							</span>
+							<span class="text-secondary text-sm">
+								<template v-if="searchNeedsInput">
+									Type at least 3 characters of a project's title to begin browsing.
+								</template>
+								<template v-else-if="isLoading"> Loading external projects… </template>
+								<template v-else> No projects matched that search </template>
+							</span>
+						</div>
+						<div v-else-if="externalProjects.length > 0" class="flex flex-col gap-3">
+							<ExternalProjectLookupCard
+								v-for="project in externalProjects"
+								:key="project.id"
+								:title="project.title"
+								:state="project.status"
+								:link="project.link"
+								:notes="project.exceptions"
+								:proof="project.proof"
+								:files="project.files"
+								:cf_id="project.flame_project_id"
+								class="mx-4 mt-3"
+							>
+								<template #actions>
+									<ButtonStyled color="brand">
+										<button
+											type="button"
+											:disabled="
+												selectedProjectId === project.id || addFilesMutation.isPending.value
+											"
+											@click="selectProject(project.id)"
+										>
+											{{ selectedProjectId === project.id ? 'Selected' : 'Select' }}
+										</button>
+									</ButtonStyled>
+								</template>
+							</ExternalProjectLookupCard>
+						</div>
+					</div>
+				</div>
+			</Accordion>
+
+			<Accordion
+				v-if="hasMultipleFiles"
+				ref="filesAccordionRef"
+				class="w-full bg-surface-4 border border-solid border-surface-5 rounded-2xl overflow-clip"
+				button-class="p-4 w-full border-b border-solid border-b-surface-5 bg-surface-2 -mb-px hover:brightness-[--hover-brightness] group"
+				@on-open="handleFilesPanelOpen"
+			>
+				<template #title>
+					<span class="flex items-center gap-3 text-contrast group-active:scale-[0.98]">
+						Select files to add
+					</span>
+				</template>
+				<AttributionGroupFilePicker
+					v-model:selected-sha1s="selectedSha1s"
+					:files="group.files"
+					:disabled="addFilesMutation.isPending.value"
+				/>
+			</Accordion>
+			<div class="flex justify-end gap-2 w-full">
+				<ButtonStyled type="outlined">
+					<button type="button" :disabled="addFilesMutation.isPending.value" @click="hide">
+						<XIcon class="size-4 shrink-0" />
+						Cancel
+					</button>
+				</ButtonStyled>
+				<ButtonStyled color="brand">
+					<button type="button" :disabled="!canSubmit" @click="handleSubmit">
+						<SpinnerIcon
+							v-if="addFilesMutation.isPending.value"
+							class="size-4 shrink-0 animate-spin"
+						/>
+						<PlusIcon v-else class="size-4 shrink-0" />
+						Add files to entry
+					</button>
+				</ButtonStyled>
+			</div>
+		</div>
+	</NewModal>
+</template>
diff --git a/packages/ui/src/components/external_files/AddToGlobalPermissionsDatabaseModal.vue b/packages/ui/src/components/external_files/AddToGlobalPermissionsDatabaseModal.vue
new file mode 100644
index 0000000000..a7e21beca7
--- /dev/null
+++ b/packages/ui/src/components/external_files/AddToGlobalPermissionsDatabaseModal.vue
@@ -0,0 +1,233 @@
+<script setup lang="ts">
+import type { Labrinth } from '@modrinth/api-client'
+import { PlusIcon, SpinnerIcon, XIcon } from '@modrinth/assets'
+import { useMutation } from '@tanstack/vue-query'
+import { computed, nextTick, ref, useTemplateRef } from 'vue'
+
+import {
+	Accordion,
+	ButtonStyled,
+	Combobox,
+	type ComboboxOption,
+	NewModal,
+	StyledInput,
+} from '#ui/components'
+
+import { injectModrinthClient, injectNotificationManager } from '../../providers'
+import AttributionGroupFilePicker from './AttributionGroupFilePicker.vue'
+import {
+	attributionKindToDefaultExternalStatus,
+	buildExternalLicenseProofFromAttribution,
+	groupLinkForExternalLicense,
+	moderatorAttributionGroupTitle,
+	parseInitialAttribution,
+} from './external-project-utils'
+import type { ExternalLicenseStatus } from './types.ts'
+
+const props = defineProps<{
+	group: Labrinth.Attribution.Internal.AttributionGroup
+}>()
+
+const emit = defineEmits<{
+	(e: 'success'): void
+}>()
+
+const client = injectModrinthClient()
+const { addNotification } = injectNotificationManager()
+
+const modalRef = useTemplateRef<InstanceType<typeof NewModal>>('modalRef')
+
+const statusOptions: ComboboxOption<ExternalLicenseStatus>[] = [
+	{ value: 'yes', label: 'Yes' },
+	{ value: 'with-attribution-and-source', label: 'With attribution and source' },
+	{ value: 'with-attribution', label: 'With attribution' },
+	{ value: 'no', label: 'No' },
+	{ value: 'permanent-no', label: 'Permanent no' },
+	{ value: 'unidentified', label: 'Unidentified' },
+]
+
+const title = ref('')
+const link = ref('')
+const flameProjectId = ref('')
+const proof = ref('')
+const status = ref<ExternalLicenseStatus | undefined>(undefined)
+const selectedSha1s = ref<Set<string>>(new Set())
+
+const hasMultipleFiles = computed(() => props.group.files.length > 1)
+
+const createMutation = useMutation({
+	mutationFn: async () => {
+		if (!status.value) {
+			throw new Error('Status is required')
+		}
+
+		const parsedFlameProjectId = Number.parseInt(flameProjectId.value.trim(), 10)
+		const files = props.group.files
+			.filter((file) => selectedSha1s.value.has(file.sha1))
+			.map((file) => ({
+				sha1: file.sha1,
+				name: file.name.split('/').pop() ?? file.name,
+			}))
+
+		return client.labrinth.external_projects_internal.create({
+			title: title.value.trim() || undefined,
+			status: status.value,
+			link: link.value.trim() || undefined,
+			proof: proof.value.trim() || undefined,
+			flame_project_id: Number.isFinite(parsedFlameProjectId) ? parsedFlameProjectId : undefined,
+			files,
+		})
+	},
+	onSuccess: async () => {
+		addNotification({
+			type: 'success',
+			title: 'Added to global database',
+		})
+		await nextTick()
+		hide()
+		emit('success')
+	},
+	onError: (error: Error) => {
+		addNotification({
+			type: 'error',
+			title: 'Could not add to global database',
+			text: error.message,
+		})
+	},
+})
+
+const canSubmit = computed(
+	() =>
+		selectedSha1s.value.size > 0 && status.value !== undefined && !createMutation.isPending.value,
+)
+
+function resetForm() {
+	const attribution = parseInitialAttribution(props.group.attribution)
+	title.value = moderatorAttributionGroupTitle(props.group)
+	link.value = groupLinkForExternalLicense(props.group, attribution)
+	flameProjectId.value = props.group.flame_project?.id?.toString() ?? ''
+	proof.value = attribution ? buildExternalLicenseProofFromAttribution(attribution) : ''
+	status.value = attribution ? attributionKindToDefaultExternalStatus(attribution.kind) : undefined
+	selectedSha1s.value = new Set(props.group.files.map((file) => file.sha1))
+}
+
+function handleSubmit() {
+	createMutation.mutate()
+}
+
+function show(event?: MouseEvent) {
+	resetForm()
+	modalRef.value?.show(event)
+}
+
+function hide() {
+	modalRef.value?.hide()
+}
+
+defineExpose({ show, hide })
+</script>
+
+<template>
+	<NewModal
+		ref="modalRef"
+		header="Adding to global permissions database"
+		max-width="640px"
+		:disable-close="createMutation.isPending.value"
+	>
+		<div class="flex flex-col gap-4">
+			<div class="flex flex-col gap-2">
+				<label class="font-semibold text-contrast" for="add-global-title">Title</label>
+				<StyledInput
+					id="add-global-title"
+					v-model="title"
+					type="text"
+					:disabled="createMutation.isPending.value"
+				/>
+			</div>
+			<div class="flex flex-col gap-2">
+				<label class="font-semibold text-contrast" for="add-global-link">Link</label>
+				<StyledInput
+					id="add-global-link"
+					v-model="link"
+					type="text"
+					:disabled="createMutation.isPending.value"
+				/>
+			</div>
+			<div class="grid grid-cols-2 gap-4">
+				<div class="flex flex-col gap-2">
+					<label class="font-semibold text-contrast" for="add-global-flame-id">
+						CurseForge project ID
+					</label>
+					<StyledInput
+						id="add-global-flame-id"
+						v-model="flameProjectId"
+						type="text"
+						placeholder="1234567"
+						input-class="h-[40px]"
+						:disabled="createMutation.isPending.value"
+					/>
+				</div>
+				<div class="flex flex-col gap-2">
+					<label class="font-semibold text-contrast" for="add-global-status">Allowed?</label>
+					<Combobox
+						id="add-global-status"
+						v-model="status"
+						:options="statusOptions"
+						placeholder="Select status"
+						class="!w-full min-w-[18rem]"
+						:disabled="createMutation.isPending.value"
+					/>
+				</div>
+			</div>
+			<div class="flex flex-col gap-2">
+				<label class="font-semibold text-contrast" for="add-global-proof">Proof or notes</label>
+				<StyledInput
+					id="add-global-proof"
+					v-model="proof"
+					type="text"
+					multiline
+					input-class="min-h-[6rem]"
+					resize="vertical"
+					:disabled="createMutation.isPending.value"
+				/>
+			</div>
+			<Accordion
+				v-if="hasMultipleFiles"
+				class="w-full bg-surface-4 border border-solid border-surface-5 rounded-2xl overflow-clip"
+				button-class="p-4 w-full border-b border-solid border-b-surface-5 bg-surface-2 -mb-px hover:brightness-[--hover-brightness] group"
+				open-by-default
+			>
+				<template #title>
+					<span class="flex items-center gap-3 text-contrast group-active:scale-[0.98]">
+						Select files to add
+					</span>
+				</template>
+				<div>
+					<AttributionGroupFilePicker
+						v-model:selected-sha1s="selectedSha1s"
+						:files="group.files"
+						:disabled="createMutation.isPending.value"
+					/>
+				</div>
+			</Accordion>
+			<div class="flex justify-end gap-2 w-full">
+				<ButtonStyled type="outlined">
+					<button type="button" :disabled="createMutation.isPending.value" @click="hide">
+						<XIcon class="size-4 shrink-0" />
+						Cancel
+					</button>
+				</ButtonStyled>
+				<ButtonStyled color="brand">
+					<button type="button" :disabled="!canSubmit" @click="handleSubmit">
+						<SpinnerIcon
+							v-if="createMutation.isPending.value"
+							class="size-4 shrink-0 animate-spin"
+						/>
+						<PlusIcon v-else class="size-4 shrink-0" />
+						Add to global database
+					</button>
+				</ButtonStyled>
+			</div>
+		</div>
+	</NewModal>
+</template>
diff --git a/packages/ui/src/components/external_files/AttributionDisplay.vue b/packages/ui/src/components/external_files/AttributionDisplay.vue
new file mode 100644
index 0000000000..a353f4bd06
--- /dev/null
+++ b/packages/ui/src/components/external_files/AttributionDisplay.vue
@@ -0,0 +1,214 @@
+<script setup lang="ts">
+import type { Labrinth } from '@modrinth/api-client'
+import { CheckCircleIcon, UserRoundIcon } from '@modrinth/assets'
+import { builtinLicenses } from '@modrinth/utils'
+import { computed } from 'vue'
+
+import { IntlFormatted } from '#ui/components'
+import { AutoLink, Avatar } from '#ui/components/base'
+
+import { useFormatDateTime } from '../../composables/format-date-time'
+import { defineMessage, defineMessages, useVIntl } from '../../composables/i18n'
+import {
+	attributionLinkToWork,
+	isCustomAttributionLicense,
+	isHttpUrl,
+	PERMISSION_REASONS,
+} from './external-project-utils'
+
+const props = defineProps<{
+	attribution: Labrinth.Attribution.Internal.AttributionResolution
+	attributedAt?: string | null
+	attributorHref: string | null
+	attributorLabel: string
+	attributorAvatarUrl?: string | null
+}>()
+
+const { formatMessage } = useVIntl()
+const formatDate = useFormatDateTime({ dateStyle: 'long' })
+
+const messages = defineMessages({
+	linkLabel: {
+		id: 'external-files.permissions-card.link-label',
+		defaultMessage: 'Link to work',
+	},
+	notesLabel: {
+		id: 'external-files.permissions-card.notes-label',
+		defaultMessage: 'Notes',
+	},
+	licensedAs: {
+		id: 'external-files.permissions-card.licensed-as',
+		defaultMessage: 'Licensed:',
+	},
+	lastUpdated: {
+		id: 'external-files.permissions-card.last-updated',
+		defaultMessage: 'Last updated on {date} by {user}',
+	},
+	proofImagesLabel: {
+		id: 'external-files.permissions-card.proof-images-label',
+		defaultMessage: 'Proof images',
+	},
+	proofImageThumbnailAlt: {
+		id: 'external-files.permissions-card.proof-image-alt',
+		defaultMessage: 'Proof screenshot {n}',
+	},
+})
+
+const unknownLicenseMessage = defineMessage({
+	id: 'external-files.permissions-card.license.unknown',
+	defaultMessage: 'Unknown',
+})
+
+const notesNoneMessage = defineMessage({
+	id: 'external-files.permissions-card.notes-none',
+	defaultMessage: 'None',
+})
+
+const readViewFields = computed(() => PERMISSION_REASONS[props.attribution.kind]?.fields ?? [])
+
+const licenseReadDisplay = computed(() => {
+	const attr = props.attribution
+	if (attr.kind !== 'license' && attr.kind !== 'my_project') {
+		return null
+	}
+	if (isCustomAttributionLicense(attr.license)) {
+		return { kind: 'custom' as const, value: attr.license.name }
+	}
+	const licenseId = attr.license
+	if (licenseId) {
+		const friendly =
+			builtinLicenses.find((license) => license.short === licenseId)?.friendly ?? licenseId
+		return { kind: 'standard' as const, value: friendly }
+	}
+	return { kind: 'unknown' as const, value: formatMessage(unknownLicenseMessage) }
+})
+
+const linkToWork = computed(() => attributionLinkToWork(props.attribution))
+</script>
+
+<template>
+	<div>
+		<div
+			class="flex flex-col gap-4 rounded-t-2xl p-4 mt-2 bg-surface-3 border border-solid border-surface-4"
+			:class="{ 'rounded-b-2xl': !$slots.footer, 'border-b-0': $slots.footer }"
+		>
+			<div class="flex gap-4">
+				<div class="flex flex-col gap-3 w-full">
+					<div class="flex items-start justify-between gap-3">
+						<span class="text-contrast font-semibold flex items-center gap-2">
+							<CheckCircleIcon
+								v-if="attribution.kind === 'globally_allowed'"
+								class="text-green size-5"
+							/>
+							{{ formatMessage(PERMISSION_REASONS[attribution.kind].label) }}
+						</span>
+					</div>
+					<template v-if="attribution.kind === 'globally_allowed'">
+						<p class="m-0">
+							{{ formatMessage(PERMISSION_REASONS[attribution.kind].description) }}
+						</p>
+					</template>
+					<div class="flex flex-col gap-3">
+						<div class="grid grid-cols-[max-content_1fr] gap-x-4 gap-y-2 items-baseline">
+							<template v-if="attribution.kind === 'license' || attribution.kind === 'my_project'">
+								<span class="text-secondary font-medium">
+									{{ formatMessage(messages.licensedAs) }}
+								</span>
+								<a
+									v-if="
+										licenseReadDisplay?.kind === 'custom' && isHttpUrl(licenseReadDisplay.value)
+									"
+									:href="licenseReadDisplay.value"
+									target="_blank"
+									rel="noopener"
+									class="text-link truncate"
+								>
+									{{ licenseReadDisplay.value }}
+								</a>
+								<span v-else class="text-primary whitespace-pre-wrap break-words">
+									{{ licenseReadDisplay?.value }}
+								</span>
+							</template>
+							<template v-if="readViewFields.includes('link_to_work') && linkToWork">
+								<span class="text-secondary font-medium">
+									{{ formatMessage(messages.linkLabel) }}
+								</span>
+								<a :href="linkToWork" target="_blank" rel="noopener" class="text-link truncate">{{
+									linkToWork
+								}}</a>
+							</template>
+							<template v-if="readViewFields.includes('notes')">
+								<span class="text-secondary font-medium">
+									{{ formatMessage(messages.notesLabel) }}
+								</span>
+								<span class="text-primary whitespace-pre-wrap break-words">
+									{{
+										attribution.notes?.trim() ? attribution.notes : formatMessage(notesNoneMessage)
+									}}
+								</span>
+							</template>
+						</div>
+						<div v-if="attribution.image_urls?.length" class="flex flex-col gap-2">
+							<span class="text-secondary font-medium">
+								{{ formatMessage(messages.proofImagesLabel) }}
+							</span>
+							<div class="flex flex-wrap gap-2">
+								<a
+									v-for="(src, idx) in attribution.image_urls"
+									:key="`${src}-${idx}`"
+									:href="src"
+									target="_blank"
+									rel="noopener"
+									class="block rounded-xl border-[1px] border-solid border-surface-5 overflow-hidden shrink-0"
+								>
+									<img
+										:src="src"
+										:alt="formatMessage(messages.proofImageThumbnailAlt, { n: idx + 1 })"
+										class="max-h-40 max-w-full object-contain"
+									/>
+								</a>
+							</div>
+						</div>
+					</div>
+				</div>
+				<div v-if="$slots.actions">
+					<slot name="actions" />
+				</div>
+			</div>
+
+			<div
+				v-if="attributedAt"
+				class="inline-flex items-center flex-wrap gap-x-2 gap-y-1 pt-3 mt-1 border-0 border-t border-solid border-surface-5"
+			>
+				<IntlFormatted
+					:message-id="messages.lastUpdated"
+					:values="{ date: formatDate(attributedAt) }"
+				>
+					<template #user>
+						<AutoLink
+							:to="attributorHref"
+							class="inline-flex items-center gap-1.5 text-primary font-medium hover:underline max-w-full min-w-0"
+						>
+							<Avatar
+								v-if="attributorAvatarUrl"
+								:src="attributorAvatarUrl"
+								:alt="attributorLabel"
+								size="18px"
+								class="shrink-0"
+								circle
+							/>
+							<UserRoundIcon v-else class="size-4 shrink-0" />
+							<span class="truncate">{{ attributorLabel }}</span>
+						</AutoLink>
+					</template>
+				</IntlFormatted>
+			</div>
+		</div>
+		<div
+			v-if="$slots.footer"
+			class="p-4 border-surface-4 border bg-surface-2 border-solid rounded-b-2xl"
+		>
+			<slot name="footer" />
+		</div>
+	</div>
+</template>
diff --git a/packages/ui/src/components/external_files/AttributionEditor.vue b/packages/ui/src/components/external_files/AttributionEditor.vue
new file mode 100644
index 0000000000..0ce1543493
--- /dev/null
+++ b/packages/ui/src/components/external_files/AttributionEditor.vue
@@ -0,0 +1,637 @@
+<script setup lang="ts">
+import type { Labrinth } from '@modrinth/api-client'
+import {
+	CheckIcon,
+	InfoIcon,
+	IssuesIcon,
+	SaveIcon,
+	SpinnerIcon,
+	TrashIcon,
+	UploadIcon,
+	XIcon,
+} from '@modrinth/assets'
+import { builtinLicenses } from '@modrinth/utils'
+import { useMutation, useQueryClient } from '@tanstack/vue-query'
+import { computed, ref, watch } from 'vue'
+
+import { ButtonStyled, Chips, Combobox, type ComboboxOption, StyledInput } from '#ui/components'
+import { FileInput } from '#ui/components/base'
+import { commonMessages } from '#ui/utils'
+
+import { defineMessage, defineMessages, useVIntl } from '../../composables/i18n'
+import { injectModrinthClient } from '../../providers'
+import {
+	attributionLinkToWork,
+	attributionProofValidationError,
+	CUSTOM_LICENSE_VALUE,
+	isHttpUrl,
+	parseAttributionLicense,
+	parseInitialAttribution,
+	PERMISSION_REASONS,
+	permissionKinds,
+	type ProjectPermissionField,
+} from './external-project-utils'
+
+const props = defineProps<{
+	projectId: string
+	groupId: string
+	attribution?: Labrinth.Attribution.Internal.AttributionResolution | null | undefined
+	flameProjectUrl?: string | null
+	/** Increments when the parent resumes editing so local fields reset */
+	resumeKey: number
+}>()
+
+const emit = defineEmits<{
+	(e: 'saved' | 'updated' | 'cancel'): void
+}>()
+
+const { formatMessage } = useVIntl()
+const client = injectModrinthClient()
+const queryClient = useQueryClient()
+
+const initialAttribution = computed<Labrinth.Attribution.Internal.AttributionResolution | null>(
+	() => parseInitialAttribution(props.attribution),
+)
+
+const isAttributed = computed(() => initialAttribution.value !== null)
+
+const messages = defineMessages({
+	typeLabel: {
+		id: 'external-files.permissions-card.type-label',
+		defaultMessage: 'Permission reason',
+	},
+	licenseLabel: {
+		id: 'external-files.permissions-card.license-label',
+		defaultMessage: 'License',
+	},
+	selectLicenseLabel: {
+		id: 'external-files.permissions-card.select-license-label',
+		defaultMessage: 'Select a license...',
+	},
+	linkLabel: {
+		id: 'external-files.permissions-card.link-label',
+		defaultMessage: 'Link to work',
+	},
+	linkToWorkUrlPlaceholder: {
+		id: 'external-files.permissions-card.link-to-work-url-placeholder',
+		defaultMessage: 'link-to-work',
+	},
+	notesLabel: {
+		id: 'external-files.permissions-card.notes-label',
+		defaultMessage: 'Notes',
+	},
+	optional: {
+		id: 'external-files.permissions-card.input-optional',
+		defaultMessage: '(optional)',
+	},
+	notesPlaceholder: {
+		id: 'external-files.permissions-card.notes-placeholder',
+		defaultMessage: 'Write something here...',
+	},
+	proofWarningTitle: {
+		id: 'external-files.permissions-card.proof-warning.title',
+		defaultMessage: 'Modrinth staff may verify submitted proof',
+	},
+	proofWarningBody: {
+		id: 'external-files.permissions-card.proof-warning.body',
+		defaultMessage:
+			'If you are found to have lied or manipulated the images uploaded, your project and account may be terminated.',
+	},
+	saveAttribution: {
+		id: 'external-files.permissions-card.save',
+		defaultMessage: 'Save attribution',
+	},
+	addAttribution: {
+		id: 'external-files.permissions-card.add',
+		defaultMessage: 'Add attribution',
+	},
+	licenseRequired: {
+		id: 'external-files.permissions-card.error.license-required',
+		defaultMessage: 'Please select a license.',
+	},
+	customLicenseLabel: {
+		id: 'external-files.permissions-card.custom-license-label',
+		defaultMessage: 'Link to license',
+	},
+	linkToLicenseUrlPlaceholder: {
+		id: 'external-files.permissions-card.link-to-license-url-placeholder',
+		defaultMessage: 'link-to-license',
+	},
+	linkInvalidUrl: {
+		id: 'external-files.permissions-card.error.link-invalid-url',
+		defaultMessage: 'Link must be a valid URL.',
+	},
+	proofImagesLabel: {
+		id: 'external-files.permissions-card.proof-images-label',
+		defaultMessage: 'Proof images',
+	},
+	proofImagesUploadPrompt: {
+		id: 'external-files.permissions-card.proof-images-upload-prompt',
+		defaultMessage: 'Drag and drop to upload or click to select an image',
+	},
+	proofImageThumbnailAlt: {
+		id: 'external-files.permissions-card.proof-image-alt',
+		defaultMessage: 'Proof screenshot {n}',
+	},
+	proofImageRemove: {
+		id: 'external-files.permissions-card.proof-image-remove',
+		defaultMessage: 'Remove image',
+	},
+	modrinthLinkToWork: {
+		id: 'external-files.permissions-card.modrinth-link-to-work',
+		defaultMessage: `This appears to be a Modrinth link. If this content is available on Modrinth, your pack was likely exported incorrectly. If you downloaded it from another site, try downloading the Modrinth version instead; sometimes they are not identical files.`,
+	},
+	arrLabel: {
+		id: 'external-files.permissions-card.all-rights-reserved',
+		defaultMessage: `All Rights Reserved/No license`,
+	},
+})
+
+const MAX_PROOF_IMAGE_BYTES = 1_048_576
+
+const selectedKind = ref<Labrinth.Attribution.Internal.AttributionResolutionKind>(
+	initialAttribution.value?.kind ?? 'license',
+)
+
+const licenseIdInput = ref('')
+const customLicenseInput = ref('')
+const linkInput = ref('')
+const notesInput = ref('')
+const inputError = ref<string | null>(null)
+const proofImageUrls = ref<string[]>([])
+
+function extFromImageFile(file: File): Labrinth.Images.v3.ImageExtension | null {
+	const byMime: Partial<Record<string, Labrinth.Images.v3.ImageExtension>> = {
+		'image/png': 'png',
+		'image/gif': 'gif',
+		'image/webp': 'webp',
+		'image/bmp': 'bmp',
+		'image/jpeg': 'jpg',
+	}
+	const mime = byMime[file.type]
+	if (mime) {
+		return mime
+	}
+	const ext = file.name.toLowerCase().split('.').pop()
+	if (ext === 'jpg' || ext === 'jpeg') {
+		return 'jpg'
+	}
+	if (ext === 'png' || ext === 'gif' || ext === 'webp' || ext === 'bmp') {
+		return ext
+	}
+	return null
+}
+
+function resetInputs() {
+	const payload = initialAttribution.value
+	selectedKind.value = payload?.kind ?? 'license'
+	const license =
+		payload && (payload.kind === 'license' || payload.kind === 'my_project')
+			? parseAttributionLicense(payload.license)
+			: { spdx: '', custom: '' }
+	licenseIdInput.value = license.spdx
+	customLicenseInput.value = license.custom
+	const linkFallback = props.flameProjectUrl ?? ''
+	linkInput.value = attributionLinkToWork(payload) ?? linkFallback
+	notesInput.value = payload?.notes ?? ''
+	proofImageUrls.value = payload?.image_urls ?? []
+	inputError.value = null
+}
+
+resetInputs()
+
+watch(licenseIdInput, (value) => {
+	if (value !== CUSTOM_LICENSE_VALUE) {
+		customLicenseInput.value = ''
+	}
+})
+
+watch(
+	() => props.attribution,
+	() => {
+		resetInputs()
+	},
+	{ deep: true },
+)
+
+watch(
+	() => props.resumeKey,
+	() => {
+		resetInputs()
+	},
+)
+
+watch(selectedKind, () => {
+	inputError.value = null
+})
+
+const permissionReasonFields = computed<ProjectPermissionField[]>(() => {
+	return PERMISSION_REASONS[selectedKind.value]?.fields ?? []
+})
+
+const selectedPermissionReason = computed(() => PERMISSION_REASONS[selectedKind.value])
+
+const notesAfterProofImages = computed(() => selectedKind.value === 'special_permissions')
+
+const notesInputRows = computed(() => (notesAfterProofImages.value ? 2 : 3))
+
+const proofImagesShowOptional = computed(
+	() => selectedPermissionReason.value.proofRequirement === null,
+)
+
+const attributionFieldSections = computed(() => {
+	const fields = permissionReasonFields.value
+	const sections: Array<'notes' | 'image_urls'> = []
+	if (fields.includes('notes') && !notesAfterProofImages.value) {
+		sections.push('notes')
+	}
+	if (fields.includes('image_urls')) {
+		sections.push('image_urls')
+	}
+	if (fields.includes('notes') && notesAfterProofImages.value) {
+		sections.push('notes')
+	}
+	return sections
+})
+
+const isCustomLicense = computed(() => licenseIdInput.value === CUSTOM_LICENSE_VALUE)
+
+const licenseOptions = computed<ComboboxOption<string>[]>(() => [
+	...builtinLicenses
+		.filter((license) => license.short !== '')
+		.map((license) => ({
+			value: license.short,
+			label:
+				license.short === 'All-Rights-Reserved' ? formatMessage(messages.arrLabel) : license.short,
+		})),
+	{
+		value: CUSTOM_LICENSE_VALUE,
+		label: formatMessage(
+			defineMessage({
+				id: 'external-files.permissions-card.custom-license-option',
+				defaultMessage: 'Other',
+			}),
+		),
+	},
+])
+
+function buildAttributionLicense(): Labrinth.Attribution.Internal.AttributionLicense | null {
+	const custom = isCustomLicense.value
+	if (!licenseIdInput.value) {
+		inputError.value = formatMessage(messages.licenseRequired)
+		return null
+	}
+	const customLicense = customLicenseInput.value.trim()
+	if (custom && !customLicense) {
+		inputError.value = formatMessage(
+			defineMessage({
+				id: 'external-files.permissions-card.error.custom-license-required',
+				defaultMessage: `Please include a link to your license. If you have none, you should likely select 'All Rights Reserved/No license'`,
+			}),
+		)
+		return null
+	}
+	return custom ? { name: customLicense } : licenseIdInput.value
+}
+
+function buildEditedData(): Labrinth.Attribution.Internal.AttributionResolution | null {
+	inputError.value = null
+	const notes = notesInput.value.trim()
+	const image_urls = [...proofImageUrls.value]
+	const proofError = attributionProofValidationError(
+		selectedPermissionReason.value.proofRequirement,
+		notes,
+		image_urls,
+	)
+	if (proofError) {
+		inputError.value = formatMessage(proofError)
+		return null
+	}
+	switch (selectedKind.value) {
+		case 'license': {
+			const license = buildAttributionLicense()
+			if (!license) {
+				return null
+			}
+			const linkRaw = linkInput.value.trim()
+			if (!linkRaw) {
+				inputError.value = formatMessage(
+					defineMessage({
+						id: 'external-files.permissions-card.error.link-required',
+						defaultMessage: 'Please provide a link.',
+					}),
+				)
+				return null
+			}
+			if (!isHttpUrl(linkRaw)) {
+				inputError.value = formatMessage(messages.linkInvalidUrl)
+				return null
+			}
+			return {
+				kind: 'license',
+				license,
+				link_to_work: linkRaw,
+				notes,
+				image_urls,
+			}
+		}
+		case 'my_project': {
+			const license = buildAttributionLicense()
+			if (!license) {
+				return null
+			}
+			return {
+				kind: 'my_project',
+				license,
+				notes,
+				image_urls,
+			}
+		}
+		case 'special_permissions': {
+			const linkRaw = linkInput.value.trim()
+			if (!linkRaw) {
+				inputError.value = formatMessage(
+					defineMessage({
+						id: 'external-files.permissions-card.error.link-required',
+						defaultMessage: 'Please provide a link.',
+					}),
+				)
+				return null
+			}
+			if (!isHttpUrl(linkRaw)) {
+				inputError.value = formatMessage(messages.linkInvalidUrl)
+				return null
+			}
+			return {
+				kind: 'special_permissions',
+				link_to_work: linkRaw,
+				notes,
+				image_urls,
+			}
+		}
+		case 'no_permission':
+			return {
+				kind: 'no_permission',
+				notes,
+				image_urls,
+			}
+	}
+	return null
+}
+
+const uploadProofImageMutation = useMutation({
+	mutationFn: async (file: File) => {
+		const ext = extFromImageFile(file)
+		if (!ext) {
+			throw new Error(
+				formatMessage(
+					defineMessage({
+						id: 'external-files.permissions-card.error.proof-image-invalid-type',
+						defaultMessage: 'Please upload a PNG, JPEG, GIF, WebP, or BMP image.',
+					}),
+				),
+			)
+		}
+		const result = await client.labrinth.images_v3.uploadImage(file, ext, {
+			context: 'project',
+			project_id: props.projectId,
+		}).promise
+		return result.url
+	},
+	onSuccess(url) {
+		proofImageUrls.value = [...proofImageUrls.value, url]
+	},
+})
+
+function handleProofImagesSelected(files: File[]) {
+	const file = files[0]
+	if (!file) {
+		return
+	}
+	inputError.value = null
+	uploadProofImageMutation.mutate(file)
+}
+
+function removeProofImage(index: number) {
+	proofImageUrls.value = proofImageUrls.value.filter((_, i) => i !== index)
+}
+
+const saveMutation = useMutation({
+	mutationFn: (payload: Labrinth.Attribution.Internal.AttributionResolution) =>
+		client.labrinth.attribution_internal.updateGroup(props.groupId, {
+			attribution: payload,
+		}),
+	onSuccess: async () => {
+		await queryClient.invalidateQueries({ queryKey: ['project-attribution', props.projectId] })
+		emit('updated')
+		emit('saved')
+	},
+})
+
+function handleSave() {
+	const data = buildEditedData()
+	if (!data) {
+		return
+	}
+	saveMutation.mutate(data)
+}
+
+function cancelEditing() {
+	resetInputs()
+	if (isAttributed.value) {
+		emit('cancel')
+	}
+}
+</script>
+
+<template>
+	<div class="flex flex-col gap-3">
+		<span class="text-contrast font-semibold">
+			{{ formatMessage(messages.typeLabel) }}
+		</span>
+		<Chips
+			v-model="selectedKind"
+			:items="permissionKinds.filter((kind) => kind !== 'globally_allowed')"
+			:format-label="(kind) => formatMessage(PERMISSION_REASONS[kind].label)"
+			:capitalize="false"
+		/>
+		<span>{{ formatMessage(PERMISSION_REASONS[selectedKind].description) }}</span>
+		<div v-if="permissionReasonFields.includes('link_to_work')" class="flex flex-col gap-2">
+			<span class="text-contrast font-semibold mt-1">
+				{{ formatMessage(messages.linkLabel) }}
+			</span>
+			<StyledInput
+				v-model="linkInput"
+				type="text"
+				class="max-w-[40rem]"
+				:placeholder="`https://example.com/${formatMessage(messages.linkToWorkUrlPlaceholder)}`"
+			/>
+			<span
+				v-if="
+					linkInput.startsWith('https://modrinth.com/') ||
+					linkInput.startsWith('https://www.modrinth.com/')
+				"
+				class="flex text-orange gap-2 font-medium mt-2"
+			>
+				<IssuesIcon class="shrink-0 mt-0.5" /> {{ formatMessage(messages.modrinthLinkToWork) }}
+			</span>
+		</div>
+		<div v-if="permissionReasonFields.includes('license_id')" class="flex flex-col gap-2">
+			<span class="text-contrast font-semibold mt-1">
+				{{ formatMessage(messages.licenseLabel) }}
+			</span>
+			<Combobox
+				v-model="licenseIdInput"
+				class="max-w-80"
+				:options="licenseOptions"
+				searchable
+				:search-placeholder="formatMessage(messages.selectLicenseLabel)"
+			/>
+		</div>
+		<div
+			v-if="permissionReasonFields.includes('custom_license') && isCustomLicense"
+			class="flex flex-col gap-2"
+		>
+			<span class="text-contrast font-semibold mt-1">
+				{{ formatMessage(messages.customLicenseLabel) }}
+			</span>
+			<StyledInput
+				v-model="customLicenseInput"
+				type="text"
+				class="max-w-[40rem]"
+				:placeholder="`https://example.com/${formatMessage(messages.linkToLicenseUrlPlaceholder)}`"
+			/>
+		</div>
+		<div class="flex flex-col gap-3">
+			<template v-for="section in attributionFieldSections" :key="section">
+				<div v-if="section === 'notes'" class="flex flex-col gap-2">
+					<div class="flex flex-col gap-1 mt-1">
+						<span class="text-contrast font-semibold">
+							{{ formatMessage(selectedPermissionReason.notesLabel ?? messages.notesLabel) }}
+							<span
+								v-if="selectedPermissionReason.notesShowsOptional"
+								class="font-normal text-primary"
+								>{{ formatMessage(messages.optional) }}</span
+							>
+						</span>
+						<span v-if="selectedPermissionReason.notesDescription">{{
+							formatMessage(selectedPermissionReason.notesDescription)
+						}}</span>
+					</div>
+					<StyledInput
+						v-model="notesInput"
+						type="text"
+						resize="both"
+						multiline
+						:rows="notesInputRows"
+						class="max-w-[40rem]"
+						:placeholder="formatMessage(messages.notesPlaceholder)"
+					/>
+				</div>
+				<div v-else-if="section === 'image_urls'" class="flex flex-col gap-2">
+					<div class="flex flex-col gap-2 mt-1">
+						<div class="flex flex-col gap-1 mt-1">
+							<span class="text-contrast font-semibold">
+								{{ formatMessage(messages.proofImagesLabel) }}
+								<span v-if="proofImagesShowOptional" class="font-normal text-primary">{{
+									formatMessage(messages.optional)
+								}}</span>
+							</span>
+							<span v-if="selectedPermissionReason.proofImagesDescription">{{
+								formatMessage(selectedPermissionReason.proofImagesDescription)
+							}}</span>
+						</div>
+						<div v-if="proofImageUrls.length > 0" class="grid grid-cols-2 gap-4">
+							<div
+								v-for="(src, idx) in proofImageUrls"
+								:key="`${src}-${idx}`"
+								class="relative rounded-xl border-[1px] border-solid border-surface-5 overflow-hidden shrink-0"
+							>
+								<img
+									:src="src"
+									:alt="formatMessage(messages.proofImageThumbnailAlt, { n: idx + 1 })"
+									class="flex w-full object-contain bg-surface-3"
+								/>
+								<div class="absolute top-2 right-2">
+									<ButtonStyled circular>
+										<button
+											v-tooltip="formatMessage(messages.proofImageRemove)"
+											type="button"
+											@click="removeProofImage(idx)"
+										>
+											<TrashIcon />
+										</button>
+									</ButtonStyled>
+								</div>
+							</div>
+						</div>
+						<div class="grid grid-cols-2 gap-4">
+							<FileInput
+								accept="image/png,image/jpeg,image/gif,image/webp,image/bmp"
+								:prompt="formatMessage(messages.proofImagesUploadPrompt)"
+								long-style
+								should-always-reset
+								:max-size="MAX_PROOF_IMAGE_BYTES"
+								:disabled="uploadProofImageMutation.isPending.value || saveMutation.isPending.value"
+								class="!bg-surface-3"
+								@change="handleProofImagesSelected"
+							>
+								<UploadIcon class="size-5 shrink-0" />
+							</FileInput>
+						</div>
+						<p v-if="uploadProofImageMutation.isError.value" class="text-red text-sm m-0">
+							{{ String(uploadProofImageMutation.error.value) }}
+						</p>
+					</div>
+				</div>
+			</template>
+		</div>
+		<div
+			v-if="selectedKind === 'my_project' || selectedKind === 'special_permissions'"
+			class="grid grid-cols-[auto_1fr] gap-2"
+		>
+			<div class="flex flex-col items-center">
+				<InfoIcon class="size-5 text-blue" />
+				<div class="w-[2px] flex-grow bg-blue mt-[-1px]"></div>
+			</div>
+			<div class="flex flex-col gap-2">
+				<span class="font-medium leading-[1.25] text-blue">{{
+					formatMessage(messages.proofWarningTitle)
+				}}</span>
+				<span class="text-contrast">{{ formatMessage(messages.proofWarningBody) }}</span>
+			</div>
+		</div>
+
+		<p v-if="inputError" class="text-red m-0">{{ inputError }}</p>
+		<p v-else-if="saveMutation.isError.value" class="text-red m-0">
+			{{ String(saveMutation.error.value) }}
+		</p>
+
+		<hr class="mt-1 bg-surface-5 border-none h-[1px] w-full" />
+		<div class="flex items-center gap-2 justify-end">
+			<ButtonStyled v-if="isAttributed" type="outlined">
+				<button
+					:disabled="saveMutation.isPending.value || uploadProofImageMutation.isPending.value"
+					@click="cancelEditing"
+				>
+					<XIcon /> {{ formatMessage(commonMessages.cancelButton) }}
+				</button>
+			</ButtonStyled>
+			<ButtonStyled color="brand">
+				<button
+					:disabled="saveMutation.isPending.value || uploadProofImageMutation.isPending.value"
+					@click="handleSave"
+				>
+					<template v-if="saveMutation.isPending.value">
+						<SpinnerIcon class="animate-spin" />
+						{{ formatMessage(commonMessages.savingButton) }}
+					</template>
+					<template v-else-if="isAttributed">
+						<SaveIcon /> {{ formatMessage(messages.saveAttribution) }}
+					</template>
+					<template v-else> <CheckIcon /> {{ formatMessage(messages.addAttribution) }} </template>
+				</button>
+			</ButtonStyled>
+		</div>
+	</div>
+</template>
diff --git a/packages/ui/src/components/external_files/AttributionGroupFilePicker.vue b/packages/ui/src/components/external_files/AttributionGroupFilePicker.vue
new file mode 100644
index 0000000000..77a6de72e0
--- /dev/null
+++ b/packages/ui/src/components/external_files/AttributionGroupFilePicker.vue
@@ -0,0 +1,71 @@
+<script setup lang="ts">
+import type { Labrinth } from '@modrinth/api-client'
+import { computed } from 'vue'
+
+import { Checkbox } from '#ui/components'
+
+const props = defineProps<{
+	files: Labrinth.Attribution.Internal.AttributionFile[]
+	disabled?: boolean
+}>()
+
+const selectedSha1s = defineModel<Set<string>>('selectedSha1s', { required: true })
+
+const allSelected = computed(
+	() => props.files.length > 0 && props.files.every((file) => selectedSha1s.value.has(file.sha1)),
+)
+
+const someSelected = computed(
+	() => props.files.some((file) => selectedSha1s.value.has(file.sha1)) && !allSelected.value,
+)
+
+function displayName(file: Labrinth.Attribution.Internal.AttributionFile) {
+	return file.name.split('/').pop() ?? file.name
+}
+
+function setAllSelected(selected: boolean) {
+	const next = new Set(selectedSha1s.value)
+	for (const file of props.files) {
+		if (selected) {
+			next.add(file.sha1)
+		} else {
+			next.delete(file.sha1)
+		}
+	}
+	selectedSha1s.value = next
+}
+
+function toggleFile(sha1: string, selected: boolean) {
+	const next = new Set(selectedSha1s.value)
+	if (selected) {
+		next.add(sha1)
+	} else {
+		next.delete(sha1)
+	}
+	selectedSha1s.value = next
+}
+</script>
+
+<template>
+	<div v-if="files.length > 1" class="flex flex-col gap-2">
+		<Checkbox
+			:model-value="allSelected"
+			:indeterminate="someSelected"
+			label="Select files to add"
+			:disabled="disabled"
+			@update:model-value="setAllSelected"
+		/>
+		<div class="flex flex-col [&>*:nth-child(even)]:bg-surface-3">
+			<Checkbox
+				v-for="file in files"
+				:key="file.sha1"
+				:model-value="selectedSha1s.has(file.sha1)"
+				:label="displayName(file)"
+				:disabled="disabled"
+				class="w-full px-4 py-2 hover:bg-surface-4 text-primary"
+				@update:model-value="(selected) => toggleFile(file.sha1, selected)"
+				@click.stop
+			/>
+		</div>
+	</div>
+</template>
diff --git a/packages/ui/src/components/external_files/AttributionModerationDbBadge.vue b/packages/ui/src/components/external_files/AttributionModerationDbBadge.vue
new file mode 100644
index 0000000000..ca413cce84
--- /dev/null
+++ b/packages/ui/src/components/external_files/AttributionModerationDbBadge.vue
@@ -0,0 +1,70 @@
+<script setup lang="ts">
+import type { Labrinth } from '@modrinth/api-client'
+import { ScaleIcon } from '@modrinth/assets'
+import { sortByIndex } from '@modrinth/utils'
+import { computed } from 'vue'
+
+import { TagItem } from '#ui/components'
+
+import { MODERATION_DB_BADGE } from './external-project-utils'
+
+const props = defineProps<{
+	files?: Labrinth.Attribution.Internal.AttributionGroup['files']
+}>()
+
+const MODERATION_STATUS_PRIORITY: Labrinth.ExternalProjects.Internal.ExternalLicenseStatus[] = [
+	'permanent-no',
+	'no',
+	'yes',
+	'with-attribution',
+	'with-attribution-and-source',
+	'unidentified',
+]
+
+function statusLabel(status: Labrinth.ExternalProjects.Internal.ExternalLicenseStatus): string {
+	return MODERATION_DB_BADGE[status]?.label ?? status
+}
+
+const moderationStatuses = computed<{
+	primary: Labrinth.ExternalProjects.Internal.ExternalLicenseStatus
+	others?: Labrinth.ExternalProjects.Internal.ExternalLicenseStatus[]
+}>(() => {
+	const statuses = (props.files ?? []).map((file) => {
+		const status = file.moderation_external_license?.status
+		if (!status) {
+			return 'unidentified'
+		} else {
+			return status
+		}
+	})
+	const sorted = sortByIndex(MODERATION_STATUS_PRIORITY, [...new Set(statuses)])
+	const primary = sorted[0] ?? 'unidentified'
+	return {
+		primary,
+		...(sorted.length > 1 ? { others: sorted.slice(1) } : {}),
+	}
+})
+
+const otherStatusesTooltip = computed(() => {
+	const others = moderationStatuses.value.others
+	if (!others?.length) {
+		return undefined
+	}
+	return others.map((status) => statusLabel(status)).join(', ')
+})
+</script>
+
+<template>
+	<TagItem
+		v-tooltip="`Other statuses: ${otherStatusesTooltip}`"
+		:style="{ color: MODERATION_DB_BADGE[moderationStatuses.primary]?.color }"
+	>
+		<ScaleIcon class="size-4 shrink-0" />
+		{{ statusLabel(moderationStatuses.primary) }}
+		<span class="text-primary">
+			{{
+				moderationStatuses.others?.length > 0 ? `+ ${moderationStatuses.others?.length} more` : ''
+			}}
+		</span>
+	</TagItem>
+</template>
diff --git a/packages/ui/src/components/external_files/AttributionStatusTag.vue b/packages/ui/src/components/external_files/AttributionStatusTag.vue
new file mode 100644
index 0000000000..e2faa7664c
--- /dev/null
+++ b/packages/ui/src/components/external_files/AttributionStatusTag.vue
@@ -0,0 +1,51 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+
+import { TagItem } from '#ui/components'
+
+import { defineMessage, useVIntl } from '../../composables/i18n'
+
+const props = defineProps<{
+	variant: 'pending' | 'attributed' | 'no_permission'
+}>()
+
+const { formatMessage } = useVIntl()
+
+const badge = computed(() => {
+	switch (props.variant) {
+		case 'no_permission':
+			return {
+				style: { '--_bg-color': 'var(--color-red-bg)', '--_color': 'var(--color-red)' },
+				message: defineMessage({
+					id: 'external-files.permissions-card.badge.no-permission',
+					defaultMessage: 'No permission',
+				}),
+			}
+		case 'attributed':
+			return {
+				style: { '--_bg-color': 'var(--color-green-bg)', '--_color': 'var(--color-green)' },
+				message: defineMessage({
+					id: 'external-files.permissions-card.badge.attributed',
+					defaultMessage: 'Attributed',
+				}),
+			}
+		default:
+			return {
+				style: {
+					'--_bg-color': 'var(--color-orange-bg)',
+					'--_color': 'var(--color-orange)',
+				},
+				message: defineMessage({
+					id: 'external-files.permissions-card.badge.pending',
+					defaultMessage: 'Pending',
+				}),
+			}
+	}
+})
+</script>
+
+<template>
+	<TagItem :style="badge.style">
+		{{ formatMessage(badge.message) }}
+	</TagItem>
+</template>
diff --git a/packages/ui/src/components/external_files/ExternalProjectPermissionsCard.vue b/packages/ui/src/components/external_files/ExternalProjectPermissionsCard.vue
index 965dcfdda5..456b1df4cb 100644
--- a/packages/ui/src/components/external_files/ExternalProjectPermissionsCard.vue
+++ b/packages/ui/src/components/external_files/ExternalProjectPermissionsCard.vue
@@ -1,176 +1,776 @@
 <script setup lang="ts">
-import { ChevronDownIcon, ListBulletedIcon, SaveIcon, VersionIcon, XIcon } from '@modrinth/assets'
-import { ref } from 'vue'
+import type { Labrinth } from '@modrinth/api-client'
+import {
+	CheckCircleIcon,
+	ChevronDownIcon,
+	EditIcon,
+	FileIcon,
+	PlusIcon,
+	ReportIcon,
+	ScaleIcon,
+	SpinnerIcon,
+	VersionIcon,
+	XCircleIcon,
+	XIcon,
+} from '@modrinth/assets'
+import { attributionQuickReplies, type QuickReply } from '@modrinth/moderation'
+import { renderString } from '@modrinth/utils'
+import { useMutation, useQueryClient } from '@tanstack/vue-query'
+import { computed, ref, useTemplateRef, watch } from 'vue'
 
-import { Admonition, ButtonStyled, Chips, Collapsible, Combobox, StyledInput } from '#ui/components'
+import { ButtonStyled, Collapsible, OverflowMenu } from '#ui/components'
+import type { OverflowMenuOption } from '#ui/components/base'
+import { commonMessages } from '#ui/utils'
 
-defineProps<{
-	title: string
+import { defineMessage, defineMessages, useVIntl } from '../../composables/i18n'
+import {
+	injectModrinthClient,
+	injectNotificationManager,
+	injectProjectPageContext,
+} from '../../providers'
+import StyledInput from '../base/StyledInput.vue'
+import AddFilesToAttributionGroupModal from './AddFilesToAttributionGroupModal.vue'
+import AddToExistingExternalProjectModal from './AddToExistingExternalProjectModal.vue'
+import AddToGlobalPermissionsDatabaseModal from './AddToGlobalPermissionsDatabaseModal.vue'
+import AttributionDisplay from './AttributionDisplay.vue'
+import AttributionEditor from './AttributionEditor.vue'
+import AttributionModerationDbBadge from './AttributionModerationDbBadge.vue'
+import AttributionStatusTag from './AttributionStatusTag.vue'
+import {
+	attributionLinkToWork,
+	createAttributionGroupTitle,
+	MODERATION_DB_BADGE,
+	parseInitialAttribution,
+} from './external-project-utils'
+import OriginalPageLink from './OriginalPageLink.vue'
+
+const props = withDefaults(
+	defineProps<{
+		projectId: string
+		group: Labrinth.Attribution.Internal.AttributionGroup
+		isModerator?: boolean
+	}>(),
+	{
+		isModerator: false,
+	},
+)
+
+const collapsedModel = defineModel<boolean>('collapsed')
+
+const collapsed = computed({
+	get: () => collapsedModel.value ?? (!props.isModerator && !!props.group.attribution),
+	set: (value) => {
+		collapsedModel.value = value
+	},
+})
+
+const emit = defineEmits<{
+	(e: 'updated'): void
 }>()
 
-const collapsed = ref(true)
+const addFilesModalRef = useTemplateRef<typeof AddFilesToAttributionGroupModal>('addFilesModalRef')
+const addToGlobalModalRef =
+	useTemplateRef<typeof AddToGlobalPermissionsDatabaseModal>('addToGlobalModalRef')
+const addToExistingModalRef =
+	useTemplateRef<typeof AddToExistingExternalProjectModal>('addToExistingModalRef')
+
+const { formatMessage } = useVIntl()
+const client = injectModrinthClient()
+const queryClient = useQueryClient()
+const { addNotification } = injectNotificationManager()
+const { allMembers } = injectProjectPageContext()
+
+const attributorMember = computed(() => {
+	const userId = props.group.attributed_by
+	if (!userId || !allMembers.value) {
+		return null
+	}
+	return allMembers.value.find((member) => member.user.id === userId) ?? null
+})
+
+const attributorLink = computed(() => {
+	const id = props.group.attributed_by
+	if (!id) {
+		return null
+	}
+	const slug = attributorMember.value?.user?.username ?? id
+	return `/user/${slug}`
+})
+
+const attributorLabel = computed(() => {
+	if (attributorMember.value) {
+		return attributorMember.value.user.username
+	}
+	return props.group.attributed_by ?? 'unknown'
+})
+
+const messages = defineMessages({
+	fileCount: {
+		id: 'external-files.permissions-card.file-count',
+		defaultMessage: '{count, plural, one {# file} other {# files}}',
+	},
+	includedInVersions: {
+		id: 'external-files.permissions-card.included-in-versions',
+		defaultMessage: 'Included in {count, plural, one {# version} other {# versions}}:',
+	},
+	includedFiles: {
+		id: 'external-files.permissions-card.included-files',
+		defaultMessage: 'Included files:',
+	},
+	notUsedInVersions: {
+		id: 'external-files.permissions-card.not-used-in-versions',
+		defaultMessage: 'These files are not currently used by any version.',
+	},
+	splitFile: {
+		id: 'external-files.permissions-card.split-file',
+		defaultMessage: 'Remove from group',
+	},
+	addFilesToGroup: {
+		id: 'external-files.permissions-card.add-files-to-group',
+		defaultMessage: 'Add files...',
+	},
+})
+
+type EditingMode = 'attribution' | 'moderation_review'
+
+const editingMode = ref<EditingMode | null>(null)
+const editorResumeKey = ref(0)
+
+const isEditingAttribution = computed(() => editingMode.value === 'attribution')
+const isEditingModerationReview = computed(() => editingMode.value === 'moderation_review')
+
+const initialAttribution = computed<Labrinth.Attribution.Internal.AttributionResolution | null>(
+	() => parseInitialAttribution(props.group.attribution),
+)
+
+const isAttributed = computed(() => initialAttribution.value !== null)
+const attributionStatusVariant = computed<'pending' | 'attributed' | 'no_permission'>(() => {
+	if (isAttributed.value && props.group.attribution?.kind === 'no_permission') {
+		return 'no_permission'
+	}
+	if (isAttributed.value) {
+		return 'attributed'
+	}
+	return 'pending'
+})
+
+const title = computed(() => createAttributionGroupTitle(props.group, formatMessage))
+const fileCount = computed(() => props.group.files?.length ?? 0)
+
+const containingVersions = computed(() => {
+	const versionIds = new Set<string>()
+	for (const file of props.group.files ?? []) {
+		for (const versionId of file.versions ?? []) {
+			versionIds.add(versionId)
+		}
+	}
+	return props.group.versions?.filter((v) => versionIds.has(v.id))
+})
+
+const pendingSplitSha1 = ref<string | null>(null)
+
+const assignFilesMutation = useMutation({
+	mutationFn: async (sha1s: string[]) => {
+		for (const sha1 of sha1s) {
+			await client.labrinth.attribution_internal.assignFileToGroup({
+				sha1,
+				target_group_id: props.group.id,
+				project_id: props.projectId,
+			})
+		}
+	},
+	onSuccess: async () => {
+		await queryClient.invalidateQueries({ queryKey: ['project-attribution', props.projectId] })
+		emit('updated')
+	},
+	onError: (error: Error) => {
+		addNotification({
+			type: 'error',
+			title: formatMessage(
+				defineMessage({
+					id: 'external-files.permissions-card.assign-files-error.title',
+					defaultMessage: 'Could not add files',
+				}),
+			),
+			text: error.message,
+		})
+	},
+})
+
+const splitFileMutation = useMutation({
+	mutationFn: (sha1: string) =>
+		client.labrinth.attribution_internal.splitFile({
+			sha1,
+			project_id: props.projectId,
+		}),
+	onMutate(sha1) {
+		pendingSplitSha1.value = sha1
+	},
+	onSettled() {
+		pendingSplitSha1.value = null
+	},
+	onSuccess: async () => {
+		await queryClient.invalidateQueries({ queryKey: ['project-attribution', props.projectId] })
+		emit('updated')
+	},
+	onError: (error: Error) => {
+		addNotification({
+			type: 'error',
+			title: formatMessage(
+				defineMessage({
+					id: 'external-files.permissions-card.split-file-error.title',
+					defaultMessage: 'Could not split file',
+				}),
+			),
+			text: error.message,
+		})
+	},
+})
+
+function startEditingAttribution() {
+	editingMode.value = 'attribution'
+	collapsed.value = false
+	editorResumeKey.value += 1
+}
+
+function startEditingModerationReview() {
+	syncReviewReasonInput()
+	editingMode.value = 'moderation_review'
+}
+
+function stopEditing() {
+	editingMode.value = null
+}
+
+function cancelModerationReviewEditing() {
+	syncReviewReasonInput()
+	stopEditing()
+}
+
+function handleEditorUpdated() {
+	emit('updated')
+}
+
+function handleSplitFile(sha1: string) {
+	splitFileMutation.mutate(sha1)
+}
+
+function handleConfirmAddFiles(sha1s: string[]) {
+	assignFilesMutation.mutate(sha1s)
+}
+
+async function handleAddFilesToGroup(event: MouseEvent) {
+	try {
+		const groups = await queryClient.ensureQueryData({
+			queryKey: ['project-attribution', props.projectId],
+			queryFn: () => client.labrinth.attribution_internal.listProjectAttribution(props.projectId),
+		})
+		addFilesModalRef.value?.show(event, groups)
+	} catch (error) {
+		addNotification({
+			type: 'error',
+			title: formatMessage(
+				defineMessage({
+					id: 'external-files.permissions-card.add-files-modal.load-error.title',
+					defaultMessage: 'Could not load files',
+				}),
+			),
+			text: error instanceof Error ? error.message : String(error),
+		})
+	}
+}
+
+async function handleModerationDbUpdated() {
+	await queryClient.invalidateQueries({ queryKey: ['project-attribution', props.projectId] })
+	emit('updated')
+}
+
+function handleAddToGlobalDatabase(event: MouseEvent) {
+	addToGlobalModalRef.value?.show(event)
+}
+
+function handleAddToExistingEntry(event: MouseEvent) {
+	addToExistingModalRef.value?.show(event)
+}
+
+const originalProjectUrl = computed(
+	() => attributionLinkToWork(initialAttribution.value) ?? props.group.flame_project?.url,
+)
+
+const moderationStatusKind = computed(
+	() => props.group.attribution?.moderation_status?.kind ?? null,
+)
+
+const moderationStatusIndicator = computed(() => {
+	if (!moderationStatusKind.value) {
+		return null
+	}
+	switch (moderationStatusKind.value) {
+		case 'approved':
+			return {
+				icon: CheckCircleIcon,
+				class: 'text-green',
+				name: defineMessage({
+					id: 'external-files.permissions-card.attribution.moderation-status.passed',
+					defaultMessage: 'Passed',
+				}),
+			}
+		case 'bad_proof':
+			return {
+				icon: XCircleIcon,
+				class: 'text-red',
+				name: defineMessage({
+					id: 'external-files.permissions-card.attribution.moderation-status.rejected-proof',
+					defaultMessage: 'Proof rejected',
+				}),
+			}
+		case 'not_allowed':
+			return {
+				icon: ReportIcon,
+				class: 'text-red',
+				name: defineMessage({
+					id: 'external-files.permissions-card.attribution.moderation-status.content-not-allowed',
+					defaultMessage: 'Content not allowed',
+				}),
+			}
+	}
+	return null
+})
+
+const reviewReasonInput = ref('')
+
+function syncReviewReasonInput() {
+	reviewReasonInput.value = props.group.attribution?.moderation_status?.reason ?? ''
+}
+
+syncReviewReasonInput()
+
+watch(
+	() => props.group.attribution?.moderation_status,
+	() => {
+		if (!isEditingModerationReview.value) {
+			syncReviewReasonInput()
+		}
+	},
+	{ deep: true },
+)
+
+const pendingModerationStatusKind =
+	ref<Labrinth.Attribution.Internal.AttributionModerationStatusKind | null>(null)
+
+const setModerationStatusMutation = useMutation({
+	mutationFn: (kind: Labrinth.Attribution.Internal.AttributionModerationStatusKind) => {
+		if (!initialAttribution.value) {
+			throw new Error('Attribution is required')
+		}
+		return client.labrinth.attribution_internal.updateGroup(props.group.id, {
+			attribution: {
+				...initialAttribution.value,
+				moderation_status: {
+					kind,
+					reason: reviewReasonInput.value.trim(),
+				},
+			},
+		})
+	},
+	onMutate(kind) {
+		pendingModerationStatusKind.value = kind
+	},
+	onSettled() {
+		pendingModerationStatusKind.value = null
+	},
+	onSuccess: async () => {
+		await queryClient.invalidateQueries({ queryKey: ['project-attribution', props.projectId] })
+		stopEditing()
+		emit('updated')
+	},
+	onError: (error: Error) => {
+		addNotification({
+			type: 'error',
+			title: formatMessage(
+				defineMessage({
+					id: 'external-files.permissions-card.moderation.error.title',
+					defaultMessage: 'Could not save moderation review',
+				}),
+			),
+			text: error.message,
+		})
+	},
+})
+
+function handleSetModerationStatus(
+	kind: Labrinth.Attribution.Internal.AttributionModerationStatusKind,
+) {
+	setModerationStatusMutation.mutate(kind)
+}
+
+async function handleQuickReply(reply: QuickReply) {
+	const message =
+		typeof reply.message === 'function' ? await reply.message(undefined) : reply.message
+	reviewReasonInput.value = message
+}
+
+const visibleQuickReplies = computed<OverflowMenuOption[]>(() => {
+	const replies = attributionQuickReplies
 
-const selectedPermissionsType = ref('My project')
+	if (!replies) return []
+
+	return replies
+		.filter((reply) => {
+			if (reply.shouldShow === undefined) return true
+			return reply.shouldShow(undefined)
+		})
+		.map(
+			(reply) =>
+				({
+					id: reply.label,
+					action: () => handleQuickReply(reply),
+				}) as OverflowMenuOption,
+		)
+})
 </script>
+
 <template>
 	<div
 		class="bg-surface-2 p-0 rounded-2xl flex flex-col border-[1px] border-solid border-surface-5 overflow-hidden"
 	>
-		<div class="flex items-center bg-surface-3">
+		<div class="flex items-center bg-surface-3 gap-3">
 			<button
-				class="flex grow m-0 appearance-none p-4 bg-transparent group transition-all"
+				class="flex grow items-center m-0 appearance-none p-4 bg-transparent group transition-all gap-3 text-left min-w-0 outline-offset-[-3px] rounded-2xl"
+				:class="{
+					'rounded-b-none': !collapsed,
+					'rounded-r-none': group.flame_project?.url || isModerator,
+				}"
 				@click="collapsed = !collapsed"
 			>
-				<span class="flex items-center gap-3 group-active:scale-[0.98]">
-					<ChevronDownIcon
-						class="size-6 text-primary transition-transform duration-300"
-						:class="{ 'rotate-180': !collapsed }"
-					/>
-					<span class="text-contrast font-semibold">{{ title }}</span>
+				<ChevronDownIcon
+					class="size-6 text-primary transition-transform duration-300 shrink-0 mb-auto"
+					:class="{ 'rotate-180': !collapsed }"
+				/>
+				<span class="flex flex-col items-start min-w-0 group-active:scale-[0.98]">
+					<span class="flex items-center gap-2 min-w-0 flex-wrap">
+						<span class="text-contrast truncate font-semibold">{{ title }}</span>
+						<component
+							:is="moderationStatusIndicator.icon"
+							v-if="moderationStatusIndicator"
+							v-tooltip="formatMessage(moderationStatusIndicator.name)"
+							:class="moderationStatusIndicator.class"
+							class="size-5 shrink-0"
+							aria-hidden="true"
+						/>
+						<AttributionStatusTag :variant="attributionStatusVariant" />
+						<OriginalPageLink v-if="originalProjectUrl && isModerator" :href="originalProjectUrl" />
+					</span>
+					<span v-if="fileCount > 1" class="text-secondary text-sm font-normal">
+						{{ formatMessage(messages.fileCount, { count: fileCount }) }}
+					</span>
 				</span>
 			</button>
-			<div class="flex items-center gap-2 m-4 ml-0">
-				<ButtonStyled type="outlined">
-					<button>
-						<ListBulletedIcon />
-						Versions
-					</button>
-				</ButtonStyled>
+			<div class="mr-4 flex items-center gap-2">
+				<AttributionModerationDbBadge v-if="isModerator" :files="group.files" />
+				<OriginalPageLink v-else-if="originalProjectUrl" :href="originalProjectUrl" />
 			</div>
 		</div>
+
 		<Collapsible
 			:collapsed="collapsed"
 			class="border-0 border-solid border-t border-surface-5 rounded-b-2xl"
 		>
-			<div class="flex flex-col gap-2 p-4">
-				<span class="text-contrast font-semibold">Included in versions:</span>
-				<div class="flex flex-wrap gap-2">
-					<template v-for="version in ['4.0.0', '3.5.15', '3.5.14']" :key="version">
-						<div
-							class="px-3 py-2 rounded-xl flex items-center gap-2 border-[1px] border-solid border-surface-5"
+			<div class="flex flex-col gap-3 p-4">
+				<span class="text-contrast font-semibold">
+					{{ formatMessage(messages.includedFiles) }}
+				</span>
+				<div class="grid grid-cols-2 gap-2">
+					<span
+						v-for="file in group.files"
+						:key="file.sha1"
+						class="pl-3 rounded-xl grid grid-cols-[auto_1fr_auto] gap-2 items-start border-[1px] border-solid border-surface-5 bg-surface-2"
+						:style="{
+							'border-color':
+								isModerator && file.moderation_external_license
+									? MODERATION_DB_BADGE[file.moderation_external_license?.status]?.color
+									: undefined,
+							color:
+								isModerator && file.moderation_external_license
+									? MODERATION_DB_BADGE[file.moderation_external_license?.status]?.color
+									: undefined,
+						}"
+					>
+						<FileIcon class="size-4 shrink-0 mt-2.5" />
+						<div class="max-w-[22rem] min-w-0 flex flex-col gap-1 py-2">
+							<span class="truncate">
+								{{ file.name.split('/').pop() }}
+							</span>
+						</div>
+						<div class="flex items-center gap-1 my-auto">
+							<ButtonStyled v-if="group.files.length > 1" circular size="small">
+								<button
+									v-tooltip="formatMessage(messages.splitFile)"
+									class="m-1"
+									:disabled="splitFileMutation.isPending.value"
+									@click="handleSplitFile(file.sha1)"
+								>
+									<SpinnerIcon
+										v-if="splitFileMutation.isPending.value && pendingSplitSha1 === file.sha1"
+										class="size-4 shrink-0 animate-spin"
+									/>
+									<XIcon v-else class="size-4 shrink-0" />
+								</button>
+							</ButtonStyled>
+						</div>
+					</span>
+					<div>
+						<ButtonStyled>
+							<button @click="handleAddFilesToGroup($event)">
+								<PlusIcon class="size-4 shrink-0" /> {{ formatMessage(messages.addFilesToGroup) }}
+							</button>
+						</ButtonStyled>
+					</div>
+				</div>
+				<template v-if="(containingVersions?.length ?? 0) > 0">
+					<span class="text-contrast font-semibold">
+						{{
+							formatMessage(messages.includedInVersions, { count: containingVersions?.length ?? 0 })
+						}}
+					</span>
+					<div class="flex flex-wrap gap-2">
+						<nuxt-link
+							v-for="version in containingVersions"
+							:key="version.id"
+							:to="`/project/${projectId}/version/${version.id}`"
+							target="_blank"
+							class="px-3 py-2 rounded-xl flex items-center gap-2 border-[1px] border-solid border-surface-5 bg-surface-3 hover:bg-surface-4"
 						>
-							<VersionIcon />
-							{{ version }}
+							<VersionIcon class="size-4 shrink-0" />
+							<span class="max-w-[22rem] truncate">
+								{{ version.version_number }}
+							</span>
+						</nuxt-link>
+					</div>
+				</template>
+				<template v-else>
+					<span class="text-secondary text-sm">
+						{{ formatMessage(messages.notUsedInVersions) }}
+					</span>
+				</template>
+
+				<AttributionDisplay
+					v-if="!isEditingAttribution && initialAttribution"
+					:attribution="initialAttribution"
+					:attributed-at="group.attributed_at"
+					:attributor-href="attributorLink"
+					:attributor-label="attributorLabel"
+					:attributor-avatar-url="attributorMember?.user.avatar_url"
+				>
+					<template v-if="group.attribution?.kind !== 'globally_allowed'" #actions>
+						<ButtonStyled>
+							<button @click="startEditingAttribution">
+								<EditIcon /> {{ formatMessage(commonMessages.editButton) }}
+							</button>
+						</ButtonStyled>
+					</template>
+					<template
+						v-if="
+							(isModerator || group.attribution.moderation_status) &&
+							group.attribution.kind !== 'globally_allowed'
+						"
+						#footer
+					>
+						<div class="flex gap-4 flex-wrap">
+							<div>
+								<p
+									class="font-semibold m-0 flex items-center gap-2 mb-3"
+									:class="isModerator ? 'text-orange' : moderationStatusIndicator?.class"
+								>
+									<template v-if="isModerator">
+										<ScaleIcon class="size-5 shrink-0" />
+										Review attribution
+									</template>
+									<template v-else-if="moderationStatusIndicator">
+										<component
+											:is="moderationStatusIndicator.icon"
+											class="size-5 shrink-0"
+											aria-hidden="true"
+										/>
+										{{ formatMessage(moderationStatusIndicator.name) }}
+									</template>
+								</p>
+								<template v-if="isModerator">
+									<template
+										v-if="group.attribution.moderation_status && !isEditingModerationReview"
+									>
+										<div class="grid grid-cols-[auto_1fr] gap-y-3 gap-x-4">
+											<div>Status:</div>
+											<div
+												class="flex items-center gap-1"
+												:class="moderationStatusIndicator ? moderationStatusIndicator.class : ''"
+											>
+												<template v-if="moderationStatusIndicator">
+													<component
+														:is="moderationStatusIndicator.icon"
+														class="size-4 shrink-0"
+														aria-hidden="true"
+													/>
+													{{ formatMessage(moderationStatusIndicator.name) }}
+												</template>
+											</div>
+											<div class="leading-[1.5]">Reason:</div>
+											<div>
+												<div
+													class="markdown-body"
+													v-html="renderString(group.attribution.moderation_status.reason || 'N/A')"
+												/>
+											</div>
+										</div>
+									</template>
+									<template v-else>
+										<StyledInput
+											v-model="reviewReasonInput"
+											multiline
+											placeholder="Explanation of review (optional)"
+										/>
+										<div class="flex items-center gap-2 flex-wrap mt-3">
+											<ButtonStyled v-if="visibleQuickReplies.length > 0">
+												<OverflowMenu :options="visibleQuickReplies">
+													Reply presets
+													<ChevronDownIcon />
+												</OverflowMenu>
+											</ButtonStyled>
+											<ButtonStyled color="green" color-fill="text">
+												<button
+													:disabled="setModerationStatusMutation.isPending.value"
+													@click="handleSetModerationStatus('approved')"
+												>
+													<SpinnerIcon
+														v-if="
+															setModerationStatusMutation.isPending.value &&
+															pendingModerationStatusKind === 'approved'
+														"
+														class="size-4 shrink-0 animate-spin"
+													/>
+													<CheckCircleIcon v-else />
+													Approve
+												</button>
+											</ButtonStyled>
+											<ButtonStyled color="red" color-fill="text">
+												<button
+													:disabled="setModerationStatusMutation.isPending.value"
+													@click="handleSetModerationStatus('bad_proof')"
+												>
+													<SpinnerIcon
+														v-if="
+															setModerationStatusMutation.isPending.value &&
+															pendingModerationStatusKind === 'bad_proof'
+														"
+														class="size-4 shrink-0 animate-spin"
+													/>
+													<XCircleIcon v-else />
+													Reject: Insufficient proof
+												</button>
+											</ButtonStyled>
+											<ButtonStyled color="red" color-fill="text">
+												<button
+													:disabled="setModerationStatusMutation.isPending.value"
+													@click="handleSetModerationStatus('not_allowed')"
+												>
+													<SpinnerIcon
+														v-if="
+															setModerationStatusMutation.isPending.value &&
+															pendingModerationStatusKind === 'not_allowed'
+														"
+														class="size-4 shrink-0 animate-spin"
+													/>
+													<ReportIcon v-else />
+													Reject: Not allowed
+												</button>
+											</ButtonStyled>
+											<ButtonStyled v-if="isEditingModerationReview" type="outlined">
+												<button
+													:disabled="setModerationStatusMutation.isPending.value"
+													@click="cancelModerationReviewEditing"
+												>
+													<XIcon />
+													{{ formatMessage(commonMessages.cancelButton) }}
+												</button>
+											</ButtonStyled>
+										</div>
+										<div class="flex items-center gap-2 flex-wrap mt-3">
+											<ButtonStyled>
+												<button @click="handleAddToGlobalDatabase">
+													<ScaleIcon /> Add files to database...
+												</button>
+											</ButtonStyled>
+											<ButtonStyled>
+												<button @click="handleAddToExistingEntry">
+													<ScaleIcon /> Add to existing entry...
+												</button>
+											</ButtonStyled>
+										</div>
+									</template>
+								</template>
+								<div v-else class="grid grid-cols-[auto_1fr] gap-y-3 gap-x-4">
+									<div class="leading-[1.5]">
+										{{ formatMessage(messages.moderationReasonLabel) }}
+									</div>
+									<div
+										class="markdown-body"
+										v-html="
+											renderString(
+												group.attribution.moderation_status.reason || 'No reason provided',
+											)
+										"
+									/>
+								</div>
+							</div>
+							<div
+								v-if="
+									isModerator && !isEditingModerationReview && group.attribution.moderation_status
+								"
+								class="ml-auto"
+							>
+								<ButtonStyled color="orange">
+									<button @click="startEditingModerationReview">
+										<ScaleIcon />
+										{{ formatMessage(commonMessages.editButton) }}
+									</button>
+								</ButtonStyled>
+							</div>
 						</div>
 					</template>
-				</div>
+				</AttributionDisplay>
+
 				<div
+					v-else
 					class="rounded-2xl p-4 mt-2 border-[1px] border-solid border-surface-5 flex flex-col gap-3"
 				>
-					<span class="text-contrast font-semibold">Type</span>
-					<Chips
-						v-model="selectedPermissionsType"
-						:items="['License', 'My project', 'Special permission', 'No permission']"
+					<AttributionEditor
+						:project-id="projectId"
+						:group-id="group.id"
+						:attribution="group.attribution"
+						:flame-project-url="group.flame_project?.url"
+						:resume-key="editorResumeKey"
+						@updated="handleEditorUpdated"
+						@saved="stopEditing"
+						@cancel="stopEditing"
 					/>
-					<template v-if="selectedPermissionsType === 'License'">
-						<span>The license of this work permits you to redistribute it in your modpack.</span>
-						<span class="text-contrast font-semibold mt-1">License</span>
-						<Combobox
-							class="max-w-80"
-							:options="[{ label: 'MIT', value: 'MIT' }]"
-							:model-value="'MIT'"
-						/>
-						<span class="text-contrast font-semibold mt-1"> Link to work </span>
-						<StyledInput
-							type="text"
-							class="max-w-[30rem]"
-							placeholder="https://example.com/link-to-work"
-						/>
-						<span class="text-contrast font-semibold mt-1">
-							Notes
-							<span class="font-normal text-primary">(optional)</span>
-						</span>
-						<StyledInput
-							type="text"
-							resize="both"
-							multiline
-							class="max-w-[40rem]"
-							placeholder="Write something here..."
-						/>
-					</template>
-					<template v-else-if="selectedPermissionsType === 'My project'">
-						<span>Original work created by you.</span>
-						<span class="text-contrast font-semibold mt-1">License</span>
-						<Combobox
-							class="max-w-80"
-							:options="[{ label: 'MIT', value: 'MIT' }]"
-							:model-value="'MIT'"
-						/>
-						<span class="text-contrast font-semibold mt-1">
-							Notes
-							<span class="font-normal text-primary">(optional)</span>
-						</span>
-						<StyledInput
-							type="text"
-							resize="both"
-							multiline
-							class="max-w-[40rem]"
-							placeholder="Write something here..."
-						/>
-					</template>
-					<template v-else-if="selectedPermissionsType === 'Special permission'">
-						<span>
-							You have obtained special permission to redistribute this work in your modpack.
-						</span>
-						<span class="text-contrast font-semibold mt-1"> Link to work </span>
-						<StyledInput
-							type="text"
-							class="max-w-[30rem]"
-							placeholder="https://example.com/link-to-work"
-						/>
-						<div class="flex flex-col gap-1 mt-1">
-							<span class="text-contrast font-semibold"> Proof and explanation </span>
-							<span>
-								Include screenshots of messages, emails, or replies from the copyright owner showing
-								that they granted you permission to redistribute their work in your modpack.
-							</span>
-						</div>
-						<StyledInput
-							type="text"
-							resize="both"
-							multiline
-							class="max-w-[40rem]"
-							placeholder="Write something here..."
-						/>
-						<Admonition
-							type="warning"
-							header="Modrinth staff may attempt to verify submitted proof"
-						>
-							If you are found to have lied or manipulated the images uploaded, your project and
-							account may be terminated.
-						</Admonition>
-					</template>
-					<template v-else-if="selectedPermissionsType === 'No permission'">
-						<span>You don't have permission to use this work.</span>
-						<span class="text-contrast font-semibold mt-1">
-							Notes
-							<span class="font-normal text-primary">(optional)</span>
-						</span>
-						<StyledInput
-							type="text"
-							resize="both"
-							multiline
-							class="max-w-[40rem]"
-							placeholder="Write something here..."
-						/>
-					</template>
-					<hr class="mt-1 bg-surface-5 border-none h-[1px] w-full" />
-					<div class="flex items-center gap-2 justify-end">
-						<ButtonStyled type="outlined">
-							<button>
-								<XIcon />
-								Cancel
-							</button>
-						</ButtonStyled>
-						<ButtonStyled color="brand">
-							<button>
-								<SaveIcon />
-								Save
-							</button>
-						</ButtonStyled>
-					</div>
 				</div>
 			</div>
 		</Collapsible>
+		<AddFilesToAttributionGroupModal
+			ref="addFilesModalRef"
+			:group-id="group.id"
+			:pending="assignFilesMutation.isPending.value"
+			@confirm="handleConfirmAddFiles"
+		/>
+		<AddToGlobalPermissionsDatabaseModal
+			ref="addToGlobalModalRef"
+			:group="group"
+			@success="handleModerationDbUpdated"
+		/>
+		<AddToExistingExternalProjectModal
+			ref="addToExistingModalRef"
+			:group="group"
+			@success="handleModerationDbUpdated"
+		/>
 	</div>
 </template>
diff --git a/packages/ui/src/components/external_files/OriginalPageLink.vue b/packages/ui/src/components/external_files/OriginalPageLink.vue
new file mode 100644
index 0000000000..dfcc126788
--- /dev/null
+++ b/packages/ui/src/components/external_files/OriginalPageLink.vue
@@ -0,0 +1,27 @@
+<script setup lang="ts">
+import { ExternalIcon } from '@modrinth/assets'
+
+import { defineMessage, useVIntl } from '../../composables/i18n'
+
+defineProps<{
+	href: string
+}>()
+
+const { formatMessage } = useVIntl()
+
+const label = defineMessage({
+	id: 'external-files.permissions-card.original-project-page',
+	defaultMessage: 'Original project',
+})
+</script>
+<template>
+	<a
+		class="text-link flex items-center outline-offset-[4px] rounded-sm truncate"
+		target="_blank"
+		rel="noopener"
+		:href="href"
+	>
+		<span class="truncate">{{ formatMessage(label) }}</span>
+		<ExternalIcon class="size-3 shrink-0 mb-2 ml-1" />
+	</a>
+</template>
diff --git a/packages/ui/src/components/external_files/external-project-utils.ts b/packages/ui/src/components/external_files/external-project-utils.ts
new file mode 100644
index 0000000000..0d2af506ec
--- /dev/null
+++ b/packages/ui/src/components/external_files/external-project-utils.ts
@@ -0,0 +1,361 @@
+import type { Labrinth } from '@modrinth/api-client'
+
+import { defineMessage, type MessageDescriptor } from '../../composables/i18n'
+
+export const permissionKinds: Labrinth.Attribution.Internal.AttributionResolutionKind[] = [
+	'license',
+	'my_project',
+	'special_permissions',
+	'no_permission',
+	'globally_allowed',
+]
+
+/** Combobox value when the user picks a non-SPDX custom license (stored as `{ name }`). */
+export const CUSTOM_LICENSE_VALUE = '__custom__'
+
+export type ProjectPermissionField =
+	| 'license_id'
+	| 'custom_license'
+	| 'link_to_work'
+	| 'notes'
+	| 'image_urls'
+
+export type AttributionProofRequirement = 'explanation_or_images' | 'images' | null
+
+export const PERMISSION_REASONS = {
+	license: {
+		label: defineMessage({
+			id: 'external-files.permissions-card.reason.license',
+			defaultMessage: 'License',
+		}),
+		description: defineMessage({
+			id: 'external-files.permissions-card.reason.license.description',
+			defaultMessage: 'The license of this work permits you to redistribute it in your modpack.',
+		}),
+		notesLabel: defineMessage({
+			id: 'external-files.permissions-card.explanation-label',
+			defaultMessage: 'Explanation',
+		}),
+		notesDescription: null,
+		notesShowsOptional: true,
+		proofImagesDescription: defineMessage({
+			id: 'external-files.permissions-card.reason.license.proof-images-description',
+			defaultMessage: 'Upload supporting documentation related to this license.',
+		}),
+		proofRequirement: null,
+		fields: ['license_id', 'custom_license', 'link_to_work', 'notes', 'image_urls'] as const,
+	},
+	my_project: {
+		label: defineMessage({
+			id: 'external-files.permissions-card.reason.my-project',
+			defaultMessage: 'My project',
+		}),
+		description: defineMessage({
+			id: 'external-files.permissions-card.reason.my-project.description',
+			defaultMessage: 'Original work created by you.',
+		}),
+		notesLabel: defineMessage({
+			id: 'external-files.permissions-card.explanation-label',
+			defaultMessage: 'Explanation',
+		}),
+		notesDescription: defineMessage({
+			id: 'external-files.permissions-card.explanation-description',
+			defaultMessage: 'A short explanation or proof images are required.',
+		}),
+		notesShowsOptional: false,
+		proofImagesDescription: defineMessage({
+			id: 'external-files.permissions-card.reason.my-project.proof-images-description',
+			defaultMessage: 'Upload files that help verify you created this work.',
+		}),
+		proofRequirement: 'explanation_or_images',
+		fields: ['license_id', 'custom_license', 'notes', 'image_urls'] as const,
+	},
+	special_permissions: {
+		label: defineMessage({
+			id: 'external-files.permissions-card.reason.special-permission',
+			defaultMessage: 'Special permission',
+		}),
+		description: defineMessage({
+			id: 'external-files.permissions-card.reason.special-permission.description',
+			defaultMessage:
+				'You have obtained special permission to redistribute this work in your modpack.',
+		}),
+		notesLabel: null,
+		notesDescription: null,
+		notesShowsOptional: true,
+		proofImagesDescription: null,
+		proofRequirement: 'images',
+		fields: ['link_to_work', 'notes', 'image_urls'] as const,
+	},
+	no_permission: {
+		label: defineMessage({
+			id: 'external-files.permissions-card.reason.no-permission',
+			defaultMessage: 'No permission',
+		}),
+		description: defineMessage({
+			id: 'external-files.permissions-card.reason.no-permission.description',
+			defaultMessage: "You don't have permission to use this work.",
+		}),
+		notesLabel: null,
+		notesDescription: null,
+		notesShowsOptional: true,
+		proofImagesDescription: null,
+		proofRequirement: null,
+		fields: ['notes'] as const,
+	},
+	globally_allowed: {
+		label: defineMessage({
+			id: 'external-files.permissions-card.reason.globally-allowed',
+			defaultMessage: 'Automatically attributed',
+		}),
+		description: defineMessage({
+			id: 'external-files.permissions-card.reason.globally-allowed.description',
+			defaultMessage:
+				"We've seen this file before and have prepared an attribution for you. If something seems wrong, please contact Modrinth Support via the Help Center",
+		}),
+		notesLabel: null,
+		notesDescription: null,
+		notesShowsOptional: false,
+		proofImagesDescription: null,
+		proofRequirement: null,
+		fields: ['link_to_work'] as const,
+	},
+} satisfies Record<
+	Labrinth.Attribution.Internal.AttributionResolutionKind,
+	{
+		label: MessageDescriptor
+		description: MessageDescriptor
+		notesLabel: MessageDescriptor | null
+		notesDescription: MessageDescriptor | null
+		notesShowsOptional: boolean
+		proofImagesDescription: MessageDescriptor | null
+		proofRequirement: AttributionProofRequirement
+		fields: ProjectPermissionField[]
+	}
+>
+
+export function isAttributionProofValid(
+	requirement: AttributionProofRequirement,
+	notes: string,
+	imageUrls: readonly string[],
+): boolean {
+	switch (requirement) {
+		case 'explanation_or_images':
+			return notes.trim().length > 0 || imageUrls.length > 0
+		case 'images':
+			return imageUrls.length > 0
+		default:
+			return true
+	}
+}
+
+export function attributionProofValidationError(
+	requirement: AttributionProofRequirement,
+	notes: string,
+	imageUrls: readonly string[],
+): MessageDescriptor | null {
+	if (isAttributionProofValid(requirement, notes, imageUrls)) {
+		return null
+	}
+	switch (requirement) {
+		case 'explanation_or_images':
+			return defineMessage({
+				id: 'external-files.permissions-card.error.explanation-or-images-required',
+				defaultMessage: 'Please provide an explanation or upload at least one proof image.',
+			})
+		case 'images':
+			return defineMessage({
+				id: 'external-files.permissions-card.error.proof-images-required',
+				defaultMessage: 'Please upload at least one proof image.',
+			})
+		default:
+			return null
+	}
+}
+
+export function isHttpUrl(raw: string): boolean {
+	const s = raw.trim()
+	if (!s) return false
+	let parsed: URL
+	try {
+		parsed = new URL(s)
+	} catch {
+		return false
+	}
+	return parsed.protocol === 'http:' || parsed.protocol === 'https:'
+}
+
+export function isCustomAttributionLicense(
+	license: Labrinth.Attribution.Internal.AttributionLicense,
+): license is { name: string } {
+	return typeof license === 'object' && license !== null && 'name' in license
+}
+
+export function parseAttributionLicense(
+	license: Labrinth.Attribution.Internal.AttributionLicense | undefined,
+): {
+	spdx: string
+	custom: string
+} {
+	if (!license) {
+		return { spdx: '', custom: '' }
+	}
+	if (isCustomAttributionLicense(license)) {
+		return { spdx: CUSTOM_LICENSE_VALUE, custom: license.name }
+	}
+	return { spdx: license, custom: '' }
+}
+
+export function attributionLinkToWork(
+	attribution: Labrinth.Attribution.Internal.AttributionResolution | null | undefined,
+): string | undefined {
+	if (!attribution) {
+		return undefined
+	}
+	if (PERMISSION_REASONS[attribution.kind].fields.includes('link_to_work')) {
+		return attribution.link_to_work
+	}
+	return undefined
+}
+
+export function parseInitialAttribution(
+	raw: unknown,
+): Labrinth.Attribution.Internal.AttributionResolution | null {
+	if (!raw || typeof raw !== 'object') {
+		return null
+	}
+	const obj = raw as Record<string, unknown>
+	const kind = obj.kind
+	if (typeof kind !== 'string' || !(permissionKinds as string[]).includes(kind)) {
+		return null
+	}
+	return obj as Labrinth.Attribution.Internal.AttributionResolution
+}
+
+const unnamedMultiAttributionGroupTitle = defineMessage({
+	id: 'external-files.permissions-card.unnamed-multi-group-title',
+	defaultMessage: '{filename} + {count} more',
+})
+
+const fallbackAttributionGroupTitle = defineMessage({
+	id: 'external-files.permissions-card.fallback-group-title',
+	defaultMessage: 'Attribution group {id}',
+})
+
+export function createAttributionGroupTitle(
+	group: Labrinth.Attribution.Internal.AttributionGroup,
+	formatMessage: (descriptor: MessageDescriptor, values?: Record<string, unknown>) => string,
+): string {
+	const fileCount = group.files?.length ?? 0
+	if (group.flame_project?.title) {
+		return group.flame_project.title
+	}
+	const firstFileName = group.files?.[0]?.name ?? group.files?.[0]?.sha1 ?? ''
+	if (firstFileName) {
+		const base = firstFileName.split('/').pop() ?? firstFileName
+		if (fileCount === 1) {
+			return base
+		}
+		return formatMessage(unnamedMultiAttributionGroupTitle, {
+			filename: base,
+			count: fileCount - 1,
+		})
+	}
+	return formatMessage(fallbackAttributionGroupTitle, { id: group.id })
+}
+
+export function moderatorAttributionGroupTitle(
+	group: Labrinth.Attribution.Internal.AttributionGroup,
+): string {
+	const fileCount = group.files?.length ?? 0
+	if (group.flame_project?.title) {
+		return group.flame_project.title
+	}
+	const firstFileName = group.files?.[0]?.name ?? group.files?.[0]?.sha1 ?? ''
+	if (firstFileName) {
+		const base = firstFileName.split('/').pop() ?? firstFileName
+		if (fileCount === 1) {
+			return base
+		}
+		return `${base} + ${fileCount - 1} more`
+	}
+	return `Attribution group ${group.id}`
+}
+
+export const MODERATOR_ATTRIBUTION_KIND_LABELS: Record<
+	Labrinth.Attribution.Internal.AttributionResolutionKind,
+	string
+> = {
+	license: 'License',
+	my_project: 'My project',
+	special_permissions: 'Special permission',
+	no_permission: 'No permission',
+	globally_allowed: 'Automatically attributed',
+}
+
+export type ExternalLicenseStatus = Labrinth.ExternalProjects.Internal.ExternalLicenseStatus
+
+export function attributionKindToDefaultExternalStatus(
+	kind: Labrinth.Attribution.Internal.AttributionResolutionKind,
+): ExternalLicenseStatus | undefined {
+	if (kind === 'no_permission') {
+		return 'no'
+	}
+	if (kind === 'license') {
+		return 'yes'
+	}
+	return undefined
+}
+
+export function buildExternalLicenseProofFromAttribution(
+	attribution: Labrinth.Attribution.Internal.AttributionResolution,
+): string {
+	const parts: string[] = []
+	const notes = attribution.notes?.trim()
+	if (notes) {
+		parts.push(notes)
+	}
+	for (const url of attribution.image_urls ?? []) {
+		parts.push(`![proof image](${url})`)
+	}
+	return parts.join('\n\n')
+}
+
+export function groupLinkForExternalLicense(
+	group: Labrinth.Attribution.Internal.AttributionGroup,
+	attribution: Labrinth.Attribution.Internal.AttributionResolution | null,
+): string {
+	return attributionLinkToWork(attribution) ?? group.flame_project?.url ?? ''
+}
+
+export const MODERATION_DB_BADGE: Record<
+	Labrinth.ExternalProjects.Internal.ExternalLicenseStatus,
+	{
+		color?: string
+		label: string
+	}
+> = {
+	no: {
+		color: 'var(--color-red)',
+		label: 'Restrictive license',
+	},
+	'permanent-no': {
+		color: 'var(--color-purple)',
+		label: 'Prohibited content',
+	},
+	yes: {
+		color: 'var(--color-green)',
+		label: 'Permissive license',
+	},
+	'with-attribution': {
+		color: 'var(--color-green)',
+		label: 'Permissive license',
+	},
+	'with-attribution-and-source': {
+		color: 'var(--color-green)',
+		label: 'Permissive license',
+	},
+	unidentified: {
+		label: 'Unidentified',
+	},
+}
diff --git a/packages/ui/src/components/external_files/index.ts b/packages/ui/src/components/external_files/index.ts
index e0ec715662..fa12eed576 100644
--- a/packages/ui/src/components/external_files/index.ts
+++ b/packages/ui/src/components/external_files/index.ts
@@ -1,3 +1,10 @@
-export { default as ExternalProjectLicenseStateTag } from './ExternalProjectLicenseStateTag.vue'
+export { default as AddFilesToAttributionGroupModal } from './AddFilesToAttributionGroupModal.vue'
+export { default as AddToExistingExternalProjectModal } from './AddToExistingExternalProjectModal.vue'
+export { default as AddToGlobalPermissionsDatabaseModal } from './AddToGlobalPermissionsDatabaseModal.vue'
+export { default as AttributionDisplay } from './AttributionDisplay.vue'
+export { default as AttributionEditor } from './AttributionEditor.vue'
+export { default as AttributionModerationDbBadge } from './AttributionModerationDbBadge.vue'
+export { default as AttributionStatusTag } from './AttributionStatusTag.vue'
 export { default as ExternalProjectLookupCard } from './ExternalProjectLookupCard.vue'
+export { default as ExternalProjectPermissionsCard } from './ExternalProjectPermissionsCard.vue'
 export type { ExternalLicenseStatus } from './types.ts'
diff --git a/packages/ui/src/components/external_files/types.ts b/packages/ui/src/components/external_files/types.ts
index 331d41bf95..f93cf8bc20 100644
--- a/packages/ui/src/components/external_files/types.ts
+++ b/packages/ui/src/components/external_files/types.ts
@@ -1,7 +1,3 @@
-export type ExternalLicenseStatus =
-	| 'yes'
-	| 'with-attribution-and-source'
-	| 'with-attribution'
-	| 'no'
-	| 'permanent-no'
-	| 'unidentified'
+import type { Labrinth } from '@modrinth/api-client'
+
+export type ExternalLicenseStatus = Labrinth.ExternalProjects.Internal.ExternalLicenseStatus
diff --git a/packages/ui/src/components/modal/NewModal.vue b/packages/ui/src/components/modal/NewModal.vue
index b1ff2a89fd..02ca75577b 100644
--- a/packages/ui/src/components/modal/NewModal.vue
+++ b/packages/ui/src/components/modal/NewModal.vue
@@ -123,7 +123,11 @@
 						<slot> You just lost the game.</slot>
 					</div>
 
-					<div v-if="$slots.actions" class="p-4 pt-0">
+					<div
+						v-if="$slots.actions"
+						:class="{ 'pt-4 border-0 border-t border-solid border-surface-5': actionsDivider }"
+						class="p-4 pt-0"
+					>
 						<slot name="actions" />
 					</div>
 				</div>
@@ -178,6 +182,7 @@ const props = withDefaults(
 		width?: string
 		/** Disables all close actions (close button, ESC key, click outside). */
 		disableClose?: boolean
+		actionsDivider?: boolean
 	}>(),
 	{
 		type: true,
@@ -200,6 +205,7 @@ const props = withDefaults(
 		maxWidth: undefined,
 		width: undefined,
 		disableClose: false,
+		actionsDivider: false,
 	},
 )
 
diff --git a/packages/ui/src/components/project/ProjectPageVersions.vue b/packages/ui/src/components/project/ProjectPageVersions.vue
index 5b5131d390..d14405e2bc 100644
--- a/packages/ui/src/components/project/ProjectPageVersions.vue
+++ b/packages/ui/src/components/project/ProjectPageVersions.vue
@@ -116,8 +116,21 @@
 							}"
 							title="`${version.version_number} - ${version.name}`"
 						>
-							<div class="font-bold text-contrast text-ellipsis overflow-hidden">
-								{{ version.version_number }}
+							<div class="flex items-center gap-2">
+								<div class="font-bold text-contrast text-ellipsis overflow-hidden">
+									{{ version.version_number }}
+								</div>
+								<div
+									v-if="version.files_missing_attribution"
+									v-tooltip="`Version withheld due to missing permissions`"
+									class="z-[1]"
+									:style="{
+										'--_bg-color': 'var(--color-orange-bg)',
+										'--_color': 'var(--color-orange)',
+									}"
+								>
+									<TagItem> <CircleAlertIcon /> Withheld</TagItem>
+								</div>
 							</div>
 							<div class="text-xs font-medium text-ellipsis overflow-hidden">
 								{{ version.name }}
@@ -260,7 +273,14 @@
 </template>
 <script setup lang="ts">
 import type { Labrinth } from '@modrinth/api-client'
-import { CalendarIcon, DownloadIcon, getLoaderIcon, PlusIcon, StarIcon } from '@modrinth/assets'
+import {
+	CalendarIcon,
+	CircleAlertIcon,
+	DownloadIcon,
+	getLoaderIcon,
+	PlusIcon,
+	StarIcon,
+} from '@modrinth/assets'
 import {
 	AutoLink,
 	ButtonStyled,
diff --git a/packages/ui/src/locales/en-US/index.json b/packages/ui/src/locales/en-US/index.json
index 16f4663e2e..3192f50cc6 100644
--- a/packages/ui/src/locales/en-US/index.json
+++ b/packages/ui/src/locales/en-US/index.json
@@ -821,6 +821,222 @@
   "creation-flow.title.set-up-server": {
     "defaultMessage": "Set up server"
   },
+  "external-files.permissions-card.add": {
+    "defaultMessage": "Add attribution"
+  },
+  "external-files.permissions-card.add-files-modal.confirm": {
+    "defaultMessage": "{count, plural, one {Add file} other {Add files}}"
+  },
+  "external-files.permissions-card.add-files-modal.description": {
+    "defaultMessage": "Select any files that should be moved into this group."
+  },
+  "external-files.permissions-card.add-files-modal.empty": {
+    "defaultMessage": "There are no files in other groups that can be moved here."
+  },
+  "external-files.permissions-card.add-files-modal.load-error.title": {
+    "defaultMessage": "Could not load files"
+  },
+  "external-files.permissions-card.add-files-modal.no-search-results": {
+    "defaultMessage": "No files match your search."
+  },
+  "external-files.permissions-card.add-files-modal.search-placeholder": {
+    "defaultMessage": "Search files…"
+  },
+  "external-files.permissions-card.add-files-modal.selected-count": {
+    "defaultMessage": "{count, plural, one {# file selected} other {# files selected}}"
+  },
+  "external-files.permissions-card.add-files-modal.title": {
+    "defaultMessage": "Add files to this group"
+  },
+  "external-files.permissions-card.add-files-to-group": {
+    "defaultMessage": "Add files..."
+  },
+  "external-files.permissions-card.all-rights-reserved": {
+    "defaultMessage": "All Rights Reserved/No license"
+  },
+  "external-files.permissions-card.assign-files-error.title": {
+    "defaultMessage": "Could not add files"
+  },
+  "external-files.permissions-card.attribution.moderation-status.content-not-allowed": {
+    "defaultMessage": "Content not allowed"
+  },
+  "external-files.permissions-card.attribution.moderation-status.passed": {
+    "defaultMessage": "Passed"
+  },
+  "external-files.permissions-card.attribution.moderation-status.rejected-proof": {
+    "defaultMessage": "Proof rejected"
+  },
+  "external-files.permissions-card.badge.attributed": {
+    "defaultMessage": "Attributed"
+  },
+  "external-files.permissions-card.badge.no-permission": {
+    "defaultMessage": "No permission"
+  },
+  "external-files.permissions-card.badge.pending": {
+    "defaultMessage": "Pending"
+  },
+  "external-files.permissions-card.custom-license-label": {
+    "defaultMessage": "Link to license"
+  },
+  "external-files.permissions-card.custom-license-option": {
+    "defaultMessage": "Other"
+  },
+  "external-files.permissions-card.error.custom-license-required": {
+    "defaultMessage": "Please include a link to your license. If you have none, you should likely select 'All Rights Reserved/No license'"
+  },
+  "external-files.permissions-card.error.explanation-or-images-required": {
+    "defaultMessage": "Please provide an explanation or upload at least one proof image."
+  },
+  "external-files.permissions-card.error.license-required": {
+    "defaultMessage": "Please select a license."
+  },
+  "external-files.permissions-card.error.link-invalid-url": {
+    "defaultMessage": "Link must be a valid URL."
+  },
+  "external-files.permissions-card.error.link-required": {
+    "defaultMessage": "Please provide a link."
+  },
+  "external-files.permissions-card.error.proof-image-invalid-type": {
+    "defaultMessage": "Please upload a PNG, JPEG, GIF, WebP, or BMP image."
+  },
+  "external-files.permissions-card.error.proof-images-required": {
+    "defaultMessage": "Please upload at least one proof image."
+  },
+  "external-files.permissions-card.explanation-description": {
+    "defaultMessage": "A short explanation or proof images are required."
+  },
+  "external-files.permissions-card.explanation-label": {
+    "defaultMessage": "Explanation"
+  },
+  "external-files.permissions-card.fallback-group-title": {
+    "defaultMessage": "Attribution group {id}"
+  },
+  "external-files.permissions-card.file-count": {
+    "defaultMessage": "{count, plural, one {# file} other {# files}}"
+  },
+  "external-files.permissions-card.included-files": {
+    "defaultMessage": "Included files:"
+  },
+  "external-files.permissions-card.included-in-versions": {
+    "defaultMessage": "Included in {count, plural, one {# version} other {# versions}}:"
+  },
+  "external-files.permissions-card.input-optional": {
+    "defaultMessage": "(optional)"
+  },
+  "external-files.permissions-card.last-updated": {
+    "defaultMessage": "Last updated on {date} by {user}"
+  },
+  "external-files.permissions-card.license-label": {
+    "defaultMessage": "License"
+  },
+  "external-files.permissions-card.license.unknown": {
+    "defaultMessage": "Unknown"
+  },
+  "external-files.permissions-card.licensed-as": {
+    "defaultMessage": "Licensed:"
+  },
+  "external-files.permissions-card.link-label": {
+    "defaultMessage": "Link to work"
+  },
+  "external-files.permissions-card.link-to-license-url-placeholder": {
+    "defaultMessage": "link-to-license"
+  },
+  "external-files.permissions-card.link-to-work-url-placeholder": {
+    "defaultMessage": "link-to-work"
+  },
+  "external-files.permissions-card.moderation.error.title": {
+    "defaultMessage": "Could not save moderation review"
+  },
+  "external-files.permissions-card.modrinth-link-to-work": {
+    "defaultMessage": "This appears to be a Modrinth link. If this content is available on Modrinth, your pack was likely exported incorrectly. If you downloaded it from another site, try downloading the Modrinth version instead; sometimes they are not identical files."
+  },
+  "external-files.permissions-card.not-used-in-versions": {
+    "defaultMessage": "These files are not currently used by any version."
+  },
+  "external-files.permissions-card.notes-label": {
+    "defaultMessage": "Notes"
+  },
+  "external-files.permissions-card.notes-none": {
+    "defaultMessage": "None"
+  },
+  "external-files.permissions-card.notes-placeholder": {
+    "defaultMessage": "Write something here..."
+  },
+  "external-files.permissions-card.original-project-page": {
+    "defaultMessage": "Original project"
+  },
+  "external-files.permissions-card.proof-image-alt": {
+    "defaultMessage": "Proof screenshot {n}"
+  },
+  "external-files.permissions-card.proof-image-remove": {
+    "defaultMessage": "Remove image"
+  },
+  "external-files.permissions-card.proof-images-label": {
+    "defaultMessage": "Proof images"
+  },
+  "external-files.permissions-card.proof-images-upload-prompt": {
+    "defaultMessage": "Drag and drop to upload or click to select an image"
+  },
+  "external-files.permissions-card.proof-warning.body": {
+    "defaultMessage": "If you are found to have lied or manipulated the images uploaded, your project and account may be terminated."
+  },
+  "external-files.permissions-card.proof-warning.title": {
+    "defaultMessage": "Modrinth staff may verify submitted proof"
+  },
+  "external-files.permissions-card.reason.globally-allowed": {
+    "defaultMessage": "Automatically attributed"
+  },
+  "external-files.permissions-card.reason.globally-allowed.description": {
+    "defaultMessage": "We've seen this file before and have prepared an attribution for you. If something seems wrong, please contact Modrinth Support via the Help Center"
+  },
+  "external-files.permissions-card.reason.license": {
+    "defaultMessage": "License"
+  },
+  "external-files.permissions-card.reason.license.description": {
+    "defaultMessage": "The license of this work permits you to redistribute it in your modpack."
+  },
+  "external-files.permissions-card.reason.license.proof-images-description": {
+    "defaultMessage": "Upload supporting documentation related to this license."
+  },
+  "external-files.permissions-card.reason.my-project": {
+    "defaultMessage": "My project"
+  },
+  "external-files.permissions-card.reason.my-project.description": {
+    "defaultMessage": "Original work created by you."
+  },
+  "external-files.permissions-card.reason.my-project.proof-images-description": {
+    "defaultMessage": "Upload files that help verify you created this work."
+  },
+  "external-files.permissions-card.reason.no-permission": {
+    "defaultMessage": "No permission"
+  },
+  "external-files.permissions-card.reason.no-permission.description": {
+    "defaultMessage": "You don't have permission to use this work."
+  },
+  "external-files.permissions-card.reason.special-permission": {
+    "defaultMessage": "Special permission"
+  },
+  "external-files.permissions-card.reason.special-permission.description": {
+    "defaultMessage": "You have obtained special permission to redistribute this work in your modpack."
+  },
+  "external-files.permissions-card.save": {
+    "defaultMessage": "Save attribution"
+  },
+  "external-files.permissions-card.select-license-label": {
+    "defaultMessage": "Select a license..."
+  },
+  "external-files.permissions-card.split-file": {
+    "defaultMessage": "Remove from group"
+  },
+  "external-files.permissions-card.split-file-error.title": {
+    "defaultMessage": "Could not split file"
+  },
+  "external-files.permissions-card.type-label": {
+    "defaultMessage": "Permission reason"
+  },
+  "external-files.permissions-card.unnamed-multi-group-title": {
+    "defaultMessage": "{filename} + {count} more"
+  },
   "external-project-license-status.no": {
     "defaultMessage": "No"
   },
diff --git a/packages/ui/src/utils/index.ts b/packages/ui/src/utils/index.ts
index 7688e567ee..541b999cf9 100644
--- a/packages/ui/src/utils/index.ts
+++ b/packages/ui/src/utils/index.ts
@@ -1,3 +1,4 @@
+export { createAttributionGroupTitle } from '../components/external_files/external-project-utils'
 export * from './auto-icons'
 export * from './common-messages'
 export * from './events'
diff --git a/packages/utils/projects.ts b/packages/utils/projects.ts
index 639e7dfd81..c7f8f2e95d 100644
--- a/packages/utils/projects.ts
+++ b/packages/utils/projects.ts
@@ -1,4 +1,5 @@
 import type { Labrinth } from '@modrinth/api-client'
+import { compareByIndex } from './utils'
 // noinspection JSUnusedGlobalSymbols
 
 export const isApproved = (project) => {
@@ -255,7 +256,7 @@ export function getPrimaryProjectType(project: Labrinth.Projects.v3.Project): Di
 	} else {
 		const sorted = project.project_types
 			.slice()
-			.sort((a, b) => PROJECT_TYPE_PRECEDENCE.indexOf(a) - PROJECT_TYPE_PRECEDENCE.indexOf(b))
+			.sort((a, b) => compareByIndex(PROJECT_TYPE_PRECEDENCE, a, b))
 		if (sorted.length > 0) {
 			return sorted[0]
 		} else {
diff --git a/packages/utils/utils.ts b/packages/utils/utils.ts
index 286c823460..ccc9c4266b 100644
--- a/packages/utils/utils.ts
+++ b/packages/utils/utils.ts
@@ -289,3 +289,33 @@ export function arrayBufferToBase64(buffer: Uint8Array | ArrayBuffer): string {
 }
 export const DEFAULT_CREDIT_EMAIL_MESSAGE =
 	"We're really sorry about the recent issues with your server."
+
+/**
+ * Comparator for sorting values by first occurrence index in {@link order}.
+ * Values absent from {@link order} behave as tied after listed values (`order.length`).
+ */
+export function compareByIndex<T>(order: readonly T[], a: T, b: T): number {
+	const ia = order.indexOf(a)
+	const ib = order.indexOf(b)
+	const ra = ia === -1 ? order.length : ia
+	const rb = ib === -1 ? order.length : ib
+	return ra - rb
+}
+
+/**
+ * Sort {@link items} in place according to {@link order}, returning the same array reference.
+ *
+ * If the array should not be mutated, use {@link sortedByIndex}.
+ */
+export function sortByIndex<T>(order: readonly T[], items: T[]): T[] {
+	items.sort((a, b) => compareByIndex(order, a, b))
+	return items
+}
+
+/**
+ * Creates a sorted copy of {@link items} according to {@link order}.
+ *
+ */
+export function sortedByIndex<T>(order: readonly T[], items: T[]): T[] {
+	return items.slice().sort((a, b) => compareByIndex(order, a, b))
+}