diff --git a/apps/frontend/.env. b/apps/frontend/.env.
new file mode 100644
index 0000000000..29aad1d10a
--- /dev/null
+++ b/apps/frontend/.env.
@@ -0,0 +1,4 @@
+BASE_URL=http://127.0.0.1:8000/v2/
+BROWSER_BASE_URL=http://127.0.0.1:8000/v2/
+PYRO_BASE_URL=https://staging-archon.modrinth.com
+PROD_OVERRIDE=true
diff --git a/apps/frontend/src/components/ui/moderation/ModerationProjectNags.vue b/apps/frontend/src/components/ui/moderation/ModerationProjectNags.vue
index 44a50f083d..33a7dbf92e 100644
--- a/apps/frontend/src/components/ui/moderation/ModerationProjectNags.vue
+++ b/apps/frontend/src/components/ui/moderation/ModerationProjectNags.vue
@@ -24,7 +24,7 @@
 			</div>
 			<div class="input-group">
 				<ButtonStyled circular>
-					<button :class="!collapsed && '[&>svg]:rotate-180'" @click="$emit('toggleCollapsed')">
+					<button :class="{ '[&>svg]:rotate-180': !collapsed }" @click="$emit('toggleCollapsed')">
 						<DropdownIcon class="duration-250 transition-transform ease-in-out" />
 					</button>
 				</ButtonStyled>
diff --git a/apps/frontend/src/composables/featureFlags.ts b/apps/frontend/src/composables/featureFlags.ts
index 1becc8b856..c6ffe9eeec 100644
--- a/apps/frontend/src/composables/featureFlags.ts
+++ b/apps/frontend/src/composables/featureFlags.ts
@@ -48,7 +48,6 @@ export const DEFAULT_FEATURE_FLAGS = validateValues({
 	useV1ContentTabAPI: true,
 	labrinthApiCanary: false,
 	dismissedExternalProjectsInfo: false,
-	modpackPermissionsPage: false,
 	showAllBanners: false,
 	alwaysIgnoreErrorBanner: false,
 	showViewProdRouteBanner: false,
diff --git a/apps/frontend/src/locales/en-US/index.json b/apps/frontend/src/locales/en-US/index.json
index ae6e2336a8..76c53c40f3 100644
--- a/apps/frontend/src/locales/en-US/index.json
+++ b/apps/frontend/src/locales/en-US/index.json
@@ -2888,9 +2888,21 @@
   "project.settings.permissions.learn-more": {
     "message": "Learn more"
   },
+  "project.settings.permissions.no-results": {
+    "message": "No external projects match your search."
+  },
   "project.settings.permissions.search-placeholder": {
     "message": "Search {count} {count, plural, one {external project} other {external projects}}..."
   },
+  "project.settings.permissions.sort.most-files": {
+    "message": "Most files"
+  },
+  "project.settings.permissions.sort.recently-edited": {
+    "message": "Recently edited"
+  },
+  "project.settings.permissions.sort.status": {
+    "message": "Status"
+  },
   "project.settings.title": {
     "message": "Settings"
   },
diff --git a/apps/frontend/src/pages/[type]/[project]/settings.vue b/apps/frontend/src/pages/[type]/[project]/settings.vue
index 45ea37ca34..5a37f4a228 100644
--- a/apps/frontend/src/pages/[type]/[project]/settings.vue
+++ b/apps/frontend/src/pages/[type]/[project]/settings.vue
@@ -47,10 +47,8 @@ const navItems = computed(() => {
 		projectV3.value?.project_types?.some((type) => ['mod', 'modpack'].includes(type)) &&
 		isStaff(currentMember.value?.user)
 
-	const hasPermissionsPage = computed(
-		() =>
-			flags.value.modpackPermissionsPage &&
-			projectV3.value?.project_types?.some((type) => ['modpack'].includes(type)),
+	const hasPermissionsPage = computed(() =>
+		projectV3.value?.project_types?.some((type) => ['modpack'].includes(type)),
 	)
 
 	const items = [
@@ -82,16 +80,16 @@ const navItems = computed(() => {
 			label: formatMessage(commonProjectSettingsMessages.description),
 			icon: AlignLeftIcon,
 		},
-		hasPermissionsPage.value && {
-			link: `/${base}/settings/permissions`,
-			label: formatMessage(commonProjectSettingsMessages.permissions),
-			icon: SignatureIcon,
-		},
 		!isServerProject.value && {
 			link: `/${base}/settings/versions`,
 			label: formatMessage(commonProjectSettingsMessages.versions),
 			icon: VersionIcon,
 		},
+		hasPermissionsPage.value && {
+			link: `/${base}/settings/permissions`,
+			label: formatMessage(commonProjectSettingsMessages.permissions),
+			icon: SignatureIcon,
+		},
 		!isServerProject.value && {
 			link: `/${base}/settings/license`,
 			label: formatMessage(commonProjectSettingsMessages.license),
diff --git a/apps/frontend/src/pages/[type]/[project]/settings/permissions.vue b/apps/frontend/src/pages/[type]/[project]/settings/permissions.vue
index 2d50a45c5d..58bb1e34a1 100644
--- a/apps/frontend/src/pages/[type]/[project]/settings/permissions.vue
+++ b/apps/frontend/src/pages/[type]/[project]/settings/permissions.vue
@@ -1,38 +1,168 @@
 <script setup lang="ts">
-import { RightArrowIcon, SearchIcon, SortAscIcon, SortDescIcon } from '@modrinth/assets'
+import type { Labrinth } from '@modrinth/api-client'
+import {
+	CircleDashedIcon,
+	FileIcon,
+	HistoryIcon,
+	RightArrowIcon,
+	SearchIcon,
+} from '@modrinth/assets'
 import {
 	Admonition,
 	ButtonStyled,
 	Combobox,
 	type ComboboxOption,
 	commonMessages,
+	defineMessage,
 	defineMessages,
 	EmptyState,
+	ExternalProjectPermissionsCard,
+	injectModrinthClient,
+	injectProjectPageContext,
 	IntlFormatted,
 	StyledInput,
 	useVIntl,
 } from '@modrinth/ui'
-import ExternalProjectPermissionsCard from '@modrinth/ui/src/components/external_files/ExternalProjectPermissionsCard.vue'
-import { ref } from 'vue'
+import { useQuery } from '@tanstack/vue-query'
+import { computed, ref } from 'vue'
 
 const { formatMessage } = useVIntl()
 const flags = useFeatureFlags()
+const { projectV2: project } = injectProjectPageContext()
+const { labrinth } = injectModrinthClient()
 
-if (!flags.value.modpackPermissionsPage) {
-	throw createError({
-		fatal: true,
-		statusCode: 404,
-	})
-}
+type SortType = 'status' | 'most_files' | 'recently_edited'
 
-const externalFiles = ref([{}])
 const searchQuery = ref('')
-const currentSortType = ref('Oldest')
+const currentSortType = ref<SortType>('status')
+
+const {
+	data: attributionData,
+	error: attributionError,
+	isPending: pending,
+} = useQuery<Labrinth.Attribution.Internal.AttributionGroup[]>({
+	queryKey: ['project-attribution', project.value.id],
+	queryFn: () => labrinth.attribution_internal.listProjectAttribution(project.value.id),
+})
+
+const sortTypes = computed<ComboboxOption<SortType>[]>(() => [
+	{
+		value: 'status',
+		label: formatMessage(
+			defineMessage({
+				id: 'project.settings.permissions.sort.status',
+				defaultMessage: 'Status',
+			}),
+		),
+	},
+	{
+		value: 'most_files',
+		label: formatMessage(
+			defineMessage({
+				id: 'project.settings.permissions.sort.most-files',
+				defaultMessage: 'Most files',
+			}),
+		),
+	},
+	{
+		value: 'recently_edited',
+		label: formatMessage(
+			defineMessage({
+				id: 'project.settings.permissions.sort.recently-edited',
+				defaultMessage: 'Recently edited',
+			}),
+		),
+	},
+])
+
+const currentSortLabel = computed(() => {
+	return sortTypes.value.find((option) => option.value === currentSortType.value)?.label ?? ''
+})
+
+function isAttributed(group: Labrinth.Attribution.Internal.AttributionGroup): boolean {
+	return group.attribution !== null && group.attribution !== undefined
+}
+
+function isNoPermission(group: Labrinth.Attribution.Internal.AttributionGroup): boolean {
+	return group.attribution?.kind === 'no_permission'
+}
+
+function isPendingGroup(group: Labrinth.Attribution.Internal.AttributionGroup): boolean {
+	return !isNoPermission(group) && !isAttributed(group)
+}
+
+function statusSortRank(group: Labrinth.Attribution.Internal.AttributionGroup): number {
+	if (isNoPermission(group)) return 0
+	if (isPendingGroup(group)) return 1
+	return 2
+}
+
+function alphabetSortKey(group: Labrinth.Attribution.Internal.AttributionGroup): string {
+	const title = group.flame_project?.title?.trim()
+	return title && title.length > 0 ? title : group.id
+}
+
+function compareAlphabetical(
+	a: Labrinth.Attribution.Internal.AttributionGroup,
+	b: Labrinth.Attribution.Internal.AttributionGroup,
+): number {
+	return alphabetSortKey(a).localeCompare(alphabetSortKey(b), undefined, { sensitivity: 'base' })
+}
+
+function attributedTimestamp(group: Labrinth.Attribution.Internal.AttributionGroup): number {
+	if (!group.attributed_at) return Number.NEGATIVE_INFINITY
+	const t = Date.parse(group.attributed_at)
+	return Number.isNaN(t) ? Number.NEGATIVE_INFINITY : t
+}
+
+const filteredGroups = computed(() => {
+	const groups = attributionData.value ?? []
+	const query = searchQuery.value.trim().toLowerCase()
+	const filtered = query
+		? groups.filter((group) => {
+				if (group.flame_project?.title?.toLowerCase().includes(query)) return true
+				return (group.files ?? []).some((file) => file.name.toLowerCase().includes(query))
+			})
+		: [...groups]
+	const sortMode = currentSortType.value
+	filtered.sort(compareAlphabetical)
+	filtered.sort((a, b) => {
+		if (sortMode === 'status') {
+			return statusSortRank(a) - statusSortRank(b)
+		}
+		if (sortMode === 'most_files') {
+			const ac = a.files?.length ?? 0
+			const bc = b.files?.length ?? 0
+			return bc - ac
+		}
+		const at = attributedTimestamp(a)
+		const bt = attributedTimestamp(b)
+		return bt - at
+	})
+	return filtered
+})
+
+const totalGroups = computed(() => attributionData.value?.length ?? 0)
+
+const stats = computed(() => {
+	const groups = attributionData.value ?? []
+	let attributed = 0
+	let pending = 0
+	let noPermission = 0
+	for (const group of groups) {
+		if (isNoPermission(group)) {
+			noPermission++
+		} else if (isAttributed(group)) {
+			attributed++
+		} else {
+			pending++
+		}
+	}
+	return { total: groups.length, attributed, pending, noPermission }
+})
+
+const projectIsApproved = computed(() => project.value.status === 'approved')
 
-const sortTypes: ComboboxOption<string>[] = [
-	{ value: 'Oldest', label: 'Oldest' },
-	{ value: 'Newest', label: 'Newest' },
-]
 const messages = defineMessages({
 	searchPlaceholder: {
 		id: 'project.settings.permissions.search-placeholder',
@@ -87,6 +217,10 @@ const messages = defineMessages({
 		id: 'project.settings.permissions.attention-needed.description.proj-draft',
 		defaultMessage: `Please provide proof that you have permission to redistribute all of the following files before you can submit your project for review.`,
 	},
+	noResults: {
+		id: 'project.settings.permissions.no-results',
+		defaultMessage: 'No external projects match your search.',
+	},
 })
 
 function dismissInfoBanner() {
@@ -95,56 +229,73 @@ function dismissInfoBanner() {
 }
 </script>
 <template>
-	<template v-if="externalFiles.length > 0">
-		<Admonition
-			v-if="!flags.dismissedExternalProjectsInfo"
-			type="info"
-			class="mb-4"
-			:header="formatMessage(messages.infoBannerTitle)"
-			dismissible
-			@dismiss="dismissInfoBanner"
-		>
-			<IntlFormatted :message-id="messages.infoBannerDescription">
-				<template #link="{ children }">
-					<a class="text-link" target="_blank"> <component :is="() => children" /> </a>
-				</template>
-			</IntlFormatted>
-			<template #actions>
-				<div class="flex">
-					<ButtonStyled color="blue">
-						<a> {{ formatMessage(messages.learnMore) }} <RightArrowIcon /> </a>
-					</ButtonStyled>
-				</div>
+	<Admonition
+		v-if="!flags.dismissedExternalProjectsInfo"
+		type="info"
+		class="mb-4"
+		:header="formatMessage(messages.infoBannerTitle)"
+		dismissible
+		@dismiss="dismissInfoBanner"
+	>
+		<IntlFormatted :message-id="messages.infoBannerDescription">
+			<template #link="{ children }">
+				<a class="text-link" target="_blank"> <component :is="() => children" /> </a>
 			</template>
-		</Admonition>
+		</IntlFormatted>
+		<template #actions>
+			<div class="flex">
+				<ButtonStyled color="blue">
+					<a> {{ formatMessage(messages.learnMore) }} <RightArrowIcon /> </a>
+				</ButtonStyled>
+			</div>
+		</template>
+	</Admonition>
+	<template v-if="pending">
+		<div class="flex flex-col gap-3">
+			<div
+				v-for="i in 3"
+				:key="i"
+				class="h-[56px] w-full animate-pulse rounded-2xl bg-surface-3"
+			></div>
+		</div>
+	</template>
+	<template v-else-if="totalGroups > 0">
 		<Admonition
-			v-if="true"
+			v-if="stats.pending === 0 && stats.noPermission === 0"
 			type="success"
 			class="mb-4"
 			:header="formatMessage(messages.completedTitle)"
 			:body="formatMessage(messages.completedDescription)"
 		/>
 		<Admonition
-			v-if="true"
-			type="warning"
-			class="mb-4"
-			:header="formatMessage(messages.attentionNeededTitle)"
-			:body="formatMessage(messages.attentionNeededDescriptionDraft)"
-		/>
-		<Admonition
-			v-if="true"
+			v-else-if="stats.noPermission > 0"
 			type="critical"
 			class="mb-4"
 			:header="formatMessage(messages.failTitle)"
 			:body="formatMessage(messages.failDescription)"
 		/>
+		<Admonition
+			v-else-if="stats.pending > 0"
+			type="warning"
+			class="mb-4"
+			:header="formatMessage(messages.attentionNeededTitle)"
+			:body="
+				formatMessage(
+					projectIsApproved
+						? messages.attentionNeededDescriptionApproved
+						: messages.attentionNeededDescriptionDraft,
+				)
+			"
+		/>
 		<div class="grid grid-cols-[1fr_auto] gap-2">
 			<StyledInput
 				v-model="searchQuery"
-				type="search"
+				type="text"
+				autocomplete="off"
+				clearable
 				:placeholder="
 					formatMessage(messages.searchPlaceholder, {
-						count: externalFiles.length,
+						count: totalGroups,
 					})
 				"
 				:icon="SearchIcon"
@@ -153,27 +304,51 @@ function dismissInfoBanner() {
 			<div>
 				<Combobox
 					v-model="currentSortType"
-					class="!w-full flex-grow sm:!w-[150px] sm:flex-grow-0 lg:!w-[150px]"
+					class="!w-full flex-grow sm:!w-[220px] sm:flex-grow-0"
 					:options="sortTypes"
 					:placeholder="formatMessage(commonMessages.sortByLabel)"
 				>
 					<template #selected>
 						<span class="flex flex-row gap-2 align-middle font-semibold">
-							<SortAscIcon
-								v-if="currentSortType === 'Oldest'"
+							<CircleDashedIcon
+								v-if="currentSortType === 'status'"
+								class="size-5 flex-shrink-0 text-secondary"
+							/>
+							<FileIcon
+								v-else-if="currentSortType === 'most_files'"
 								class="size-5 flex-shrink-0 text-secondary"
 							/>
-							<SortDescIcon v-else class="size-5 flex-shrink-0 text-secondary" />
-							<span class="truncate text-contrast">{{ currentSortType }}</span>
+							<HistoryIcon
+								v-else-if="currentSortType === 'recently_edited'"
+								class="size-5 flex-shrink-0 text-secondary"
+							/>
+							<span class="truncate text-contrast">{{ currentSortLabel }}</span>
 						</span>
 					</template>
 				</Combobox>
 			</div>
 		</div>
 		<div class="mt-4 flex flex-col gap-3">
-			<ExternalProjectPermissionsCard title="FTB Library" />
+			<TransitionGroup name="list">
+				<ExternalProjectPermissionsCard
+					v-for="group in filteredGroups"
+					:key="group.id"
+					:project-id="project.id"
+					:group="group"
+				/>
+				<EmptyState
+					v-if="filteredGroups.length === 0"
+					:heading="formatMessage(messages.noResults)"
+					type="no-search-result"
+				/>
+			</TransitionGroup>
 		</div>
 	</template>
+	<div v-else-if="attributionError">
+		<p v-if="attributionError" class="my-12 text-center text-red">
+			{{ attributionError }}
+		</p>
+	</div>
 	<template v-else>
 		<EmptyState
 			:heading="formatMessage(messages.emptyStateHeading)"
@@ -182,3 +357,18 @@ function dismissInfoBanner() {
 		/>
 	</template>
 </template>
+<style scoped>
+.list-enter-from {
+	opacity: 0;
+	transform: translateY(-10px);
+}
+
+.list-leave-to {
+	opacity: 0;
+	transform: translateY(10px);
+}
+
+.list-move {
+	transition: transform 200ms ease-in-out;
+}
+</style>
diff --git a/apps/frontend/src/pages/[type]/[project]/settings/versions.vue b/apps/frontend/src/pages/[type]/[project]/settings/versions.vue
index 4d1e11ebca..4fe35f27ed 100644
--- a/apps/frontend/src/pages/[type]/[project]/settings/versions.vue
+++ b/apps/frontend/src/pages/[type]/[project]/settings/versions.vue
@@ -14,21 +14,22 @@
 			proceed-label="Delete"
 			@proceed="deleteVersion()"
 		/>
-
 		<Admonition
-			v-if="flags.modpackPermissionsPage && withheldVersions.length > 0"
+			v-if="withheldVersions.length > 0"
 			type="warning"
 			class="mb-4"
 			:header="
 				formatMessage(messages.withheldVersionsWarningTitle, {
 					count: withheldVersions.length,
-					version_name: withheldVersions.length === 1 ? withheldVersions[0] : undefined,
+					version_name:
+						withheldVersions.length === 1 ? withheldVersions[0].version_number : undefined,
 				})
 			"
 			:body="
 				formatMessage(messages.withheldVersionsWarningDescription, {
 					count: withheldVersions.length,
-					version_name: withheldVersions.length === 1 ? withheldVersions[0] : undefined,
+					version_name:
+						withheldVersions.length === 1 ? withheldVersions[0].version_number : undefined,
 				})
 			"
 		>
@@ -454,7 +455,9 @@ async function deleteVersion() {
 	stopLoading()
 }
 
-const withheldVersions = computed(() => ['4.0.0'])
+const withheldVersions = computed(() =>
+	versions.value.filter((x) => x.files_missing_attribution?.length > 0),
+)
 
 const messages = defineMessages({
 	withheldVersionsWarningTitle: {
diff --git a/apps/frontend/src/pages/report.vue b/apps/frontend/src/pages/report.vue
index 83ae37da89..738d16a2a5 100644
--- a/apps/frontend/src/pages/report.vue
+++ b/apps/frontend/src/pages/report.vue
@@ -280,11 +280,11 @@ import {
 	VersionIcon,
 	XCircleIcon,
 } from '@modrinth/assets'
-import { defineMessage } from '@modrinth/ui'
 import {
 	AutoLink,
 	Avatar,
 	ButtonStyled,
+	defineMessage,
 	defineMessages,
 	injectNotificationManager,
 	IntlFormatted,
diff --git a/apps/frontend/src/pages/settings/pats.vue b/apps/frontend/src/pages/settings/pats.vue
index cc74abfba5..9e888de6d0 100644
--- a/apps/frontend/src/pages/settings/pats.vue
+++ b/apps/frontend/src/pages/settings/pats.vue
@@ -62,7 +62,7 @@
 					<label for="pat-expires">
 						<span class="font-semibold">{{ formatMessage(createModalMessages.expiresLabel) }}</span>
 					</label>
-					<DatePicker id="pat-expires" show-today v-model="expires" wrapper-class="w-full" />
+					<DatePicker id="pat-expires" v-model="expires" show-today wrapper-class="w-full" />
 				</div>
 
 				<div class="ml-auto mt-4 flex gap-2">
diff --git a/apps/labrinth/.sqlx/query-0b06b60b7169a3f9ee66c7ec26f94982619e95a78ecb2d3ffa55774b098e0531.json b/apps/labrinth/.sqlx/query-0b06b60b7169a3f9ee66c7ec26f94982619e95a78ecb2d3ffa55774b098e0531.json
new file mode 100644
index 0000000000..ab2e4da34a
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-0b06b60b7169a3f9ee66c7ec26f94982619e95a78ecb2d3ffa55774b098e0531.json
@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        select\n            fa.file_id as \"file_id: DBFileId\",\n            f.url,\n            v.mod_id as \"project_id: DBProjectId\"\n        from file_scans fa\n        inner join files f on f.id = fa.file_id\n        inner join versions v on v.id = f.version_id\n        where fa.attributions_scanned_at is null\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "file_id: DBFileId",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "url",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "project_id: DBProjectId",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "0b06b60b7169a3f9ee66c7ec26f94982619e95a78ecb2d3ffa55774b098e0531"
+}
diff --git a/apps/labrinth/.sqlx/query-1d96df0ac64801641f9af796d482d2964c1acf2d03e15b8f1397340d0c994af6.json b/apps/labrinth/.sqlx/query-1d96df0ac64801641f9af796d482d2964c1acf2d03e15b8f1397340d0c994af6.json
new file mode 100644
index 0000000000..25146596a0
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-1d96df0ac64801641f9af796d482d2964c1acf2d03e15b8f1397340d0c994af6.json
@@ -0,0 +1,46 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tselect\n\t\t\tg.id as \"id: DBAttributionGroupId\",\n\t\t\tg.flame_project,\n\t\t\tg.attribution,\n\t\t\tg.attributed_at,\n\t\t\tg.attributed_by as \"attributed_by: i64\"\n\t\tfrom project_attribution_groups g\n\t\twhere g.project_id = $1\n\t\t",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id: DBAttributionGroupId",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "flame_project",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 2,
+        "name": "attribution",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 3,
+        "name": "attributed_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 4,
+        "name": "attributed_by: i64",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "1d96df0ac64801641f9af796d482d2964c1acf2d03e15b8f1397340d0c994af6"
+}
diff --git a/apps/labrinth/.sqlx/query-2e6bb84f45c0f8ba7bb9b09bf3def4322f727c7af8bd4be49dc4d7c487b925ed.json b/apps/labrinth/.sqlx/query-2e6bb84f45c0f8ba7bb9b09bf3def4322f727c7af8bd4be49dc4d7c487b925ed.json
new file mode 100644
index 0000000000..2c5ee6ec20
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-2e6bb84f45c0f8ba7bb9b09bf3def4322f727c7af8bd4be49dc4d7c487b925ed.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            insert into project_attribution_files (group_id, name, sha1)\n            select $1, unnest($2::text[]), unnest($3::bytea[])\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "TextArray",
+        "ByteaArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "2e6bb84f45c0f8ba7bb9b09bf3def4322f727c7af8bd4be49dc4d7c487b925ed"
+}
diff --git a/apps/labrinth/.sqlx/query-2f56a06b78a810936a77547ab5890943d6aa3e9143a8e2617d025be960880223.json b/apps/labrinth/.sqlx/query-2f56a06b78a810936a77547ab5890943d6aa3e9143a8e2617d025be960880223.json
new file mode 100644
index 0000000000..202c1c4e6d
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-2f56a06b78a810936a77547ab5890943d6aa3e9143a8e2617d025be960880223.json
@@ -0,0 +1,40 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            SELECT mel.id, mel.flame_project_id, mel.status status, mel.link\n            FROM moderation_external_licenses mel\n            WHERE mel.flame_project_id = ANY($1)\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "flame_project_id",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 2,
+        "name": "status",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "link",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int4Array"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      false,
+      true
+    ]
+  },
+  "hash": "2f56a06b78a810936a77547ab5890943d6aa3e9143a8e2617d025be960880223"
+}
diff --git a/apps/labrinth/.sqlx/query-301959b1ec20a4925f86188bc5e1c0cdd11f0d15004ce9f91fbeefcc3a27f8f4.json b/apps/labrinth/.sqlx/query-301959b1ec20a4925f86188bc5e1c0cdd11f0d15004ce9f91fbeefcc3a27f8f4.json
new file mode 100644
index 0000000000..80c3a445f6
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-301959b1ec20a4925f86188bc5e1c0cdd11f0d15004ce9f91fbeefcc3a27f8f4.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        DELETE FROM project_attribution_groups g\n        WHERE NOT EXISTS (\n            SELECT 1\n            FROM project_attribution_files paf\n            INNER JOIN override_file_sources ofs ON ofs.sha1 = paf.sha1\n            WHERE paf.group_id = g.id\n        )\n        ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "301959b1ec20a4925f86188bc5e1c0cdd11f0d15004ce9f91fbeefcc3a27f8f4"
+}
diff --git a/apps/labrinth/.sqlx/query-424b975139004d2854d9365ef950984dd1a65e333bb80924b5883df5e7d3cad2.json b/apps/labrinth/.sqlx/query-424b975139004d2854d9365ef950984dd1a65e333bb80924b5883df5e7d3cad2.json
new file mode 100644
index 0000000000..c427ada77e
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-424b975139004d2854d9365ef950984dd1a65e333bb80924b5883df5e7d3cad2.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        select id as \"id: DBAttributionGroupId\", flame_project\n        from project_attribution_groups\n        where project_id = $1 and flame_project is not null\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id: DBAttributionGroupId",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "flame_project",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "424b975139004d2854d9365ef950984dd1a65e333bb80924b5883df5e7d3cad2"
+}
diff --git a/apps/labrinth/.sqlx/query-46e1f1512ff148b532fb382b51b6a5a4a81d3e8bc17886c75bc574cd5662c49f.json b/apps/labrinth/.sqlx/query-46e1f1512ff148b532fb382b51b6a5a4a81d3e8bc17886c75bc574cd5662c49f.json
new file mode 100644
index 0000000000..721cea8be6
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-46e1f1512ff148b532fb382b51b6a5a4a81d3e8bc17886c75bc574cd5662c49f.json
@@ -0,0 +1,46 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        select\n            d.dependent_id as \"version_id: DBVersionId\",\n            d.dependency_file_name as \"file_name!\",\n            pag.attribution,\n            pag.flame_project,\n            pag.project_id as \"project_id: DBProjectId\"\n        from dependencies d\n        inner join files f on f.version_id = d.dependent_id\n        inner join attribution_enforced_versions aev on aev.id = f.version_id\n        inner join override_file_sources ofs on ofs.file_id = f.id\n        inner join project_attribution_files paf on paf.sha1 = ofs.sha1\n        inner join project_attribution_groups pag on pag.id = paf.group_id\n        where d.dependent_id = ANY($1)\n          and d.dependency_file_name is not null\n          and pag.attribution is not null\n          and pag.attribution->>'kind' not in ('no_permission')\n          and (\n            pag.attribution->'moderation_status' is null\n            or pag.attribution->'moderation_status'->>'kind' = 'approved'\n          )\n          and split_part(paf.name, '/', -1) = d.dependency_file_name\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "version_id: DBVersionId",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "file_name!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "attribution",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 3,
+        "name": "flame_project",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 4,
+        "name": "project_id: DBProjectId",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8Array"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      true,
+      true,
+      false
+    ]
+  },
+  "hash": "46e1f1512ff148b532fb382b51b6a5a4a81d3e8bc17886c75bc574cd5662c49f"
+}
diff --git a/apps/labrinth/.sqlx/query-4fb69c674dca723b6b2cb7bea07d51feb43b2714c1cd6a2987a6fe1f10e2579a.json b/apps/labrinth/.sqlx/query-4fb69c674dca723b6b2cb7bea07d51feb43b2714c1cd6a2987a6fe1f10e2579a.json
new file mode 100644
index 0000000000..76174d70dd
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-4fb69c674dca723b6b2cb7bea07d51feb43b2714c1cd6a2987a6fe1f10e2579a.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tupdate project_attribution_files\n\t\tset group_id = $1\n\t\twhere sha1 = $2\n\t\tand group_id in (\n\t\t\tselect id from project_attribution_groups where project_id = $3\n\t\t)\n\t\t",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Bytea",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "4fb69c674dca723b6b2cb7bea07d51feb43b2714c1cd6a2987a6fe1f10e2579a"
+}
diff --git a/apps/labrinth/.sqlx/query-5f7b9d628d3ff0addc12cfaab68d7cbcca08a89aedeb15ce5926ed87ed8a12c6.json b/apps/labrinth/.sqlx/query-5f7b9d628d3ff0addc12cfaab68d7cbcca08a89aedeb15ce5926ed87ed8a12c6.json
new file mode 100644
index 0000000000..e71a423986
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-5f7b9d628d3ff0addc12cfaab68d7cbcca08a89aedeb15ce5926ed87ed8a12c6.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tupdate project_attribution_files\n\t\tset group_id = $1\n\t\twhere sha1 = $2 and group_id = $3\n\t\t",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Bytea",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "5f7b9d628d3ff0addc12cfaab68d7cbcca08a89aedeb15ce5926ed87ed8a12c6"
+}
diff --git a/apps/labrinth/.sqlx/query-5f847946ce63d3773b9a5822971ee7acaafeed018ce0540b2826bd878f213b87.json b/apps/labrinth/.sqlx/query-5f847946ce63d3773b9a5822971ee7acaafeed018ce0540b2826bd878f213b87.json
new file mode 100644
index 0000000000..a219d084e8
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-5f847946ce63d3773b9a5822971ee7acaafeed018ce0540b2826bd878f213b87.json
@@ -0,0 +1,82 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT\n            id,\n            title,\n            status,\n            link,\n            exceptions,\n            proof,\n            flame_project_id,\n            inserted_at,\n            inserted_by,\n            updated_at,\n            updated_by\n        FROM moderation_external_licenses\n        WHERE id = $1\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "title",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "status",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "link",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "exceptions",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 5,
+        "name": "proof",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 6,
+        "name": "flame_project_id",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 7,
+        "name": "inserted_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 8,
+        "name": "inserted_by",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 9,
+        "name": "updated_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 10,
+        "name": "updated_by",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "5f847946ce63d3773b9a5822971ee7acaafeed018ce0540b2826bd878f213b87"
+}
diff --git a/apps/labrinth/.sqlx/query-6320df0491556027ee64fd031797b252c2145ecf179e9ea9a8cedbdc8b7ed622.json b/apps/labrinth/.sqlx/query-6320df0491556027ee64fd031797b252c2145ecf179e9ea9a8cedbdc8b7ed622.json
new file mode 100644
index 0000000000..297814d5ad
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-6320df0491556027ee64fd031797b252c2145ecf179e9ea9a8cedbdc8b7ed622.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tinsert into project_attribution_groups (id, project_id)\n\t\tvalues ($1, $2)\n\t\t",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "6320df0491556027ee64fd031797b252c2145ecf179e9ea9a8cedbdc8b7ed622"
+}
diff --git a/apps/labrinth/.sqlx/query-64c6abc464f2df37372875817ceb67b0e33786fe3dd27c052311356d43b1d601.json b/apps/labrinth/.sqlx/query-64c6abc464f2df37372875817ceb67b0e33786fe3dd27c052311356d43b1d601.json
new file mode 100644
index 0000000000..ee0f3478d5
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-64c6abc464f2df37372875817ceb67b0e33786fe3dd27c052311356d43b1d601.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            INSERT INTO file_scans (file_id)\n            VALUES ($1)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "64c6abc464f2df37372875817ceb67b0e33786fe3dd27c052311356d43b1d601"
+}
diff --git a/apps/labrinth/.sqlx/query-73f7542b4b6738c4baf1e2a3513645c3bf07a960b7b9fac529f23099675ec0cc.json b/apps/labrinth/.sqlx/query-73f7542b4b6738c4baf1e2a3513645c3bf07a960b7b9fac529f23099675ec0cc.json
new file mode 100644
index 0000000000..1aa6170dcc
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-73f7542b4b6738c4baf1e2a3513645c3bf07a960b7b9fac529f23099675ec0cc.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tselect exists(\n\t\t\tselect 1 from project_attribution_groups where id = $1 and project_id = $2\n\t\t) as \"exists!\"\n\t\t",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "73f7542b4b6738c4baf1e2a3513645c3bf07a960b7b9fac529f23099675ec0cc"
+}
diff --git a/apps/labrinth/.sqlx/query-80751dbca09a9dcb469a30fe5b8225e520baf50750a78875f582349610439a55.json b/apps/labrinth/.sqlx/query-80751dbca09a9dcb469a30fe5b8225e520baf50750a78875f582349610439a55.json
new file mode 100644
index 0000000000..b8fc60acc8
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-80751dbca09a9dcb469a30fe5b8225e520baf50750a78875f582349610439a55.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        insert into file_scans (file_id, attributions_scanned_at)\n        values ($1, now())\n        on conflict (file_id) do update set attributions_scanned_at = now()\n        ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "80751dbca09a9dcb469a30fe5b8225e520baf50750a78875f582349610439a55"
+}
diff --git a/apps/labrinth/.sqlx/query-8820a5985291c159c98371c9650092e3eba21c81e3b3386be779978aff30451a.json b/apps/labrinth/.sqlx/query-8820a5985291c159c98371c9650092e3eba21c81e3b3386be779978aff30451a.json
deleted file mode 100644
index 18d5cf1b83..0000000000
--- a/apps/labrinth/.sqlx/query-8820a5985291c159c98371c9650092e3eba21c81e3b3386be779978aff30451a.json
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT DISTINCT ON (dr.id)\n            to_jsonb(dr)\n            || jsonb_build_object(\n                'report_id', dr.id,\n                'file_id', to_base62(f.id),\n                'version_id', to_base62(v.id),\n                'project_id', to_base62(v.mod_id),\n                'file_name', f.filename,\n                'file_size', f.size,\n                'flag_reason', 'delphi',\n                'download_url', f.url,\n                -- TODO: replace with `json_array` in Postgres 16\n                'issues', (\n                    SELECT json_agg(\n                        to_jsonb(dri)\n                        || jsonb_build_object(\n                            -- TODO: replace with `json_array` in Postgres 16\n                            'details', (\n                                SELECT coalesce(jsonb_agg(\n                                    jsonb_build_object(\n                                        'id', didws.id,\n                                        'issue_id', didws.issue_id,\n                                        'key', didws.key,\n                                        'file_path', didws.file_path,\n                                        'decompiled_source', didws.decompiled_source,\n                                        'data', didws.data,\n                                        'severity', didws.severity,\n                                        'status', didws.status\n                                    )\n                                ), '[]'::jsonb)\n                                FROM delphi_issue_details_with_statuses didws\n                                WHERE didws.issue_id = dri.id\n                            )\n                        )\n                    )\n                    FROM delphi_report_issues dri\n                    WHERE\n                        dri.report_id = dr.id\n                        -- see delphi.rs todo comment\n                        AND dri.issue_type != '__dummy'\n                )\n            ) AS \"data!: sqlx::types::Json<FileReport>\"\n        FROM delphi_reports dr\n        INNER JOIN files f ON f.id = dr.file_id\n        INNER JOIN versions v ON v.id = f.version_id\n        WHERE dr.id = $1\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "data!: sqlx::types::Json<FileReport>",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "8820a5985291c159c98371c9650092e3eba21c81e3b3386be779978aff30451a"
-}
diff --git a/apps/labrinth/.sqlx/query-8ffcb0c2bd82eaf64b143745adab359db6fcc448d6306292a7b345277a075883.json b/apps/labrinth/.sqlx/query-8ffcb0c2bd82eaf64b143745adab359db6fcc448d6306292a7b345277a075883.json
new file mode 100644
index 0000000000..3da4278f04
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-8ffcb0c2bd82eaf64b143745adab359db6fcc448d6306292a7b345277a075883.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM project_attribution_groups WHERE id=$1)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "8ffcb0c2bd82eaf64b143745adab359db6fcc448d6306292a7b345277a075883"
+}
diff --git a/apps/labrinth/.sqlx/query-944286604bdef4ee40f79af358d1b68cc93bfd2067619d9cc1d03013f73e5424.json b/apps/labrinth/.sqlx/query-944286604bdef4ee40f79af358d1b68cc93bfd2067619d9cc1d03013f73e5424.json
new file mode 100644
index 0000000000..06e8fd3198
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-944286604bdef4ee40f79af358d1b68cc93bfd2067619d9cc1d03013f73e5424.json
@@ -0,0 +1,82 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\t\t\tselect\n\t\t\t\t\tid,\n\t\t\t\t\ttitle,\n\t\t\t\t\tstatus,\n\t\t\t\t\tlink,\n\t\t\t\t\texceptions,\n\t\t\t\t\tproof,\n\t\t\t\t\tflame_project_id,\n\t\t\t\t\tinserted_at,\n\t\t\t\t\tinserted_by,\n\t\t\t\t\tupdated_at,\n\t\t\t\t\tupdated_by\n\t\t\t\tfrom moderation_external_licenses\n\t\t\t\twhere id = ANY($1)\n\t\t\t\t",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "title",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "status",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "link",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "exceptions",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 5,
+        "name": "proof",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 6,
+        "name": "flame_project_id",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 7,
+        "name": "inserted_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 8,
+        "name": "inserted_by",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 9,
+        "name": "updated_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 10,
+        "name": "updated_by",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8Array"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      false,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "944286604bdef4ee40f79af358d1b68cc93bfd2067619d9cc1d03013f73e5424"
+}
diff --git a/apps/labrinth/.sqlx/query-94920d66b27503c84744d41cb2b44dd213bb461596046488eaab0b62b0fe83c5.json b/apps/labrinth/.sqlx/query-94920d66b27503c84744d41cb2b44dd213bb461596046488eaab0b62b0fe83c5.json
new file mode 100644
index 0000000000..7b1815f835
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-94920d66b27503c84744d41cb2b44dd213bb461596046488eaab0b62b0fe83c5.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tupdate project_attribution_groups\n\t\tset attribution = $1, attributed_at = now(), attributed_by = $3\n\t\twhere id = $2\n\t\t",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb",
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "94920d66b27503c84744d41cb2b44dd213bb461596046488eaab0b62b0fe83c5"
+}
diff --git a/apps/labrinth/.sqlx/query-95750cd616b72347fb997c3b02a3d69f13be5993c1fd2e302761089c499fb015.json b/apps/labrinth/.sqlx/query-95750cd616b72347fb997c3b02a3d69f13be5993c1fd2e302761089c499fb015.json
new file mode 100644
index 0000000000..07c051f897
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-95750cd616b72347fb997c3b02a3d69f13be5993c1fd2e302761089c499fb015.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            insert into project_attribution_files (group_id, name, sha1, moderation_external_license_id)\n            values ($1, $2, $3, $4)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Text",
+        "Bytea",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "95750cd616b72347fb997c3b02a3d69f13be5993c1fd2e302761089c499fb015"
+}
diff --git a/apps/labrinth/.sqlx/query-968904f577c2c696c6222e19cc145bce0e845f2ab9f8629b0789a4861bddb4dc.json b/apps/labrinth/.sqlx/query-968904f577c2c696c6222e19cc145bce0e845f2ab9f8629b0789a4861bddb4dc.json
new file mode 100644
index 0000000000..1a588c429d
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-968904f577c2c696c6222e19cc145bce0e845f2ab9f8629b0789a4861bddb4dc.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            update file_scans\n            set attributions_scanned_at = now\n            from unnest($1::bigint[], $2::timestamptz[]) as u(id, now)\n            where file_scans.file_id = u.id\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8Array",
+        "TimestamptzArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "968904f577c2c696c6222e19cc145bce0e845f2ab9f8629b0789a4861bddb4dc"
+}
diff --git a/apps/labrinth/.sqlx/query-b471add519874a6364b7a9cdbfa3a8e6f5a8a1ac9a7bacbce378f7995eb48664.json b/apps/labrinth/.sqlx/query-b471add519874a6364b7a9cdbfa3a8e6f5a8a1ac9a7bacbce378f7995eb48664.json
new file mode 100644
index 0000000000..e4cde72b9a
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-b471add519874a6364b7a9cdbfa3a8e6f5a8a1ac9a7bacbce378f7995eb48664.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            insert into project_attribution_groups (id, project_id)\n            values ($1, $2)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "b471add519874a6364b7a9cdbfa3a8e6f5a8a1ac9a7bacbce378f7995eb48664"
+}
diff --git a/apps/labrinth/.sqlx/query-b782ed64e0df1e83623c8a8e55c00716f5338c85b6dfbb15c3465ff0cec339a7.json b/apps/labrinth/.sqlx/query-b782ed64e0df1e83623c8a8e55c00716f5338c85b6dfbb15c3465ff0cec339a7.json
new file mode 100644
index 0000000000..af1927f767
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-b782ed64e0df1e83623c8a8e55c00716f5338c85b6dfbb15c3465ff0cec339a7.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tselect paf.group_id\n\t\tfrom project_attribution_files paf\n\t\tinner join project_attribution_groups pag on pag.id = paf.group_id\n\t\twhere paf.sha1 = $1 and pag.project_id = $2\n\t\t",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "group_id",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Bytea",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "b782ed64e0df1e83623c8a8e55c00716f5338c85b6dfbb15c3465ff0cec339a7"
+}
diff --git a/apps/labrinth/.sqlx/query-bb7c239e2b424557f260c56c01e15ab8b0ec04d76a55a50888d28e6c5d3948bc.json b/apps/labrinth/.sqlx/query-bb7c239e2b424557f260c56c01e15ab8b0ec04d76a55a50888d28e6c5d3948bc.json
new file mode 100644
index 0000000000..316779bfde
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-bb7c239e2b424557f260c56c01e15ab8b0ec04d76a55a50888d28e6c5d3948bc.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tselect attribution\n\t\tfrom project_attribution_groups\n\t\twhere id = $1\n\t\t",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "attribution",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "bb7c239e2b424557f260c56c01e15ab8b0ec04d76a55a50888d28e6c5d3948bc"
+}
diff --git a/apps/labrinth/.sqlx/query-c39e1f0d820101ac1b19a3849254b03259f38f3de9ddca32e6189a7e015dd853.json b/apps/labrinth/.sqlx/query-c39e1f0d820101ac1b19a3849254b03259f38f3de9ddca32e6189a7e015dd853.json
new file mode 100644
index 0000000000..19a77c556c
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-c39e1f0d820101ac1b19a3849254b03259f38f3de9ddca32e6189a7e015dd853.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            insert into project_attribution_files (group_id, name, sha1)\n            values ($1, $2, $3)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Text",
+        "Bytea"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "c39e1f0d820101ac1b19a3849254b03259f38f3de9ddca32e6189a7e015dd853"
+}
diff --git a/apps/labrinth/.sqlx/query-ce9b408d416b4782ad501e14cb1ff006964818e81855bb299b269ffaa4c3f7fa.json b/apps/labrinth/.sqlx/query-ce9b408d416b4782ad501e14cb1ff006964818e81855bb299b269ffaa4c3f7fa.json
new file mode 100644
index 0000000000..9d4ffdf994
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-ce9b408d416b4782ad501e14cb1ff006964818e81855bb299b269ffaa4c3f7fa.json
@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tselect paf.group_id, paf.name from project_attribution_files paf\n\t\tinner join project_attribution_groups pag on pag.id = paf.group_id\n\t\twhere paf.sha1 = $1 and pag.project_id = $2\n\t\t",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "group_id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "name",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Bytea",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "ce9b408d416b4782ad501e14cb1ff006964818e81855bb299b269ffaa4c3f7fa"
+}
diff --git a/apps/labrinth/.sqlx/query-d9cd479a00fa1bdef23ad3ed781e0ab992b0305f07d5194a9166e5babb1dd44a.json b/apps/labrinth/.sqlx/query-d9cd479a00fa1bdef23ad3ed781e0ab992b0305f07d5194a9166e5babb1dd44a.json
new file mode 100644
index 0000000000..fe31b3371b
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-d9cd479a00fa1bdef23ad3ed781e0ab992b0305f07d5194a9166e5babb1dd44a.json
@@ -0,0 +1,34 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        select distinct f.version_id as \"version_id: DBVersionId\", f.id as \"file_id: DBFileId\",\n            pag.flame_project\n        from files f\n        inner join attribution_enforced_versions aev on aev.id = f.version_id\n        inner join override_file_sources ofs on ofs.file_id = f.id\n        inner join project_attribution_files paf on paf.sha1 = ofs.sha1\n        inner join project_attribution_groups pag on pag.id = paf.group_id\n        where f.version_id = ANY($1)\n          and (\n            pag.attribution is null\n            or pag.attribution->>'kind' = 'no_permission'\n            or (\n              pag.attribution->'moderation_status' is not null\n              and pag.attribution->'moderation_status'->>'kind' != 'approved'\n            )\n          )\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "version_id: DBVersionId",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "file_id: DBFileId",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "flame_project",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8Array"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "d9cd479a00fa1bdef23ad3ed781e0ab992b0305f07d5194a9166e5babb1dd44a"
+}
diff --git a/apps/labrinth/.sqlx/query-dac21bfc23fe361a6133e69892224351aefa03f14efec1be31a21441419e19b9.json b/apps/labrinth/.sqlx/query-dac21bfc23fe361a6133e69892224351aefa03f14efec1be31a21441419e19b9.json
new file mode 100644
index 0000000000..8565cb6fbd
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-dac21bfc23fe361a6133e69892224351aefa03f14efec1be31a21441419e19b9.json
@@ -0,0 +1,40 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\t\tselect id, name, version_number, date_published\n\t\t\tfrom versions\n\t\t\twhere id = ANY($1)\n\t\t\torder by date_published desc\n\t\t\t",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "name",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "version_number",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "date_published",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8Array"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "dac21bfc23fe361a6133e69892224351aefa03f14efec1be31a21441419e19b9"
+}
diff --git a/apps/labrinth/.sqlx/query-e4b58fe6e5d19ded48ab9e457b4e96fb51c8f74a7532bb9ab2e7a945b95bbe78.json b/apps/labrinth/.sqlx/query-e4b58fe6e5d19ded48ab9e457b4e96fb51c8f74a7532bb9ab2e7a945b95bbe78.json
new file mode 100644
index 0000000000..91a7a9c5c8
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-e4b58fe6e5d19ded48ab9e457b4e96fb51c8f74a7532bb9ab2e7a945b95bbe78.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        select paf.sha1 from project_attribution_files paf\n        inner join project_attribution_groups pag on pag.id = paf.group_id\n        where pag.project_id = $1 and paf.sha1 = ANY($2)\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "sha1",
+        "type_info": "Bytea"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "ByteaArray"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "e4b58fe6e5d19ded48ab9e457b4e96fb51c8f74a7532bb9ab2e7a945b95bbe78"
+}
diff --git a/apps/labrinth/.sqlx/query-e7a0481729efa9cba6140effcdddff1a076eb7269d5b22860db3e3d1a651f6eb.json b/apps/labrinth/.sqlx/query-e7a0481729efa9cba6140effcdddff1a076eb7269d5b22860db3e3d1a651f6eb.json
new file mode 100644
index 0000000000..0b7cf69e9c
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-e7a0481729efa9cba6140effcdddff1a076eb7269d5b22860db3e3d1a651f6eb.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            insert into override_file_sources (sha1, file_id)\n            select unnest($1::bytea[]), $2\n            on conflict do nothing\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "ByteaArray",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e7a0481729efa9cba6140effcdddff1a076eb7269d5b22860db3e3d1a651f6eb"
+}
diff --git a/apps/labrinth/.sqlx/query-ed027c5571c34ff4fd1ac50e96f257b0055c9497d2699927b34829490e7a2529.json b/apps/labrinth/.sqlx/query-ed027c5571c34ff4fd1ac50e96f257b0055c9497d2699927b34829490e7a2529.json
new file mode 100644
index 0000000000..1b14566eb0
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-ed027c5571c34ff4fd1ac50e96f257b0055c9497d2699927b34829490e7a2529.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n\t\tdelete from project_attribution_groups g\n\t\twhere not exists (\n\t\t\tselect 1 from project_attribution_files f where f.group_id = g.id\n\t\t)\n\t\t",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "ed027c5571c34ff4fd1ac50e96f257b0055c9497d2699927b34829490e7a2529"
+}
diff --git a/apps/labrinth/.sqlx/query-f58df544f30e2a958aebf39b561c1a09401d705c07806e696eb4f37db33a5cba.json b/apps/labrinth/.sqlx/query-f58df544f30e2a958aebf39b561c1a09401d705c07806e696eb4f37db33a5cba.json
new file mode 100644
index 0000000000..e7dc2431b7
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-f58df544f30e2a958aebf39b561c1a09401d705c07806e696eb4f37db33a5cba.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            insert into project_attribution_groups (id, project_id, attribution)\n            values ($1, $2, $3)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "f58df544f30e2a958aebf39b561c1a09401d705c07806e696eb4f37db33a5cba"
+}
diff --git a/apps/labrinth/.sqlx/query-f9131eb55490b96851ac3760e3199d2fd2dbb3d212cb2b8687dda8ba0fad2a80.json b/apps/labrinth/.sqlx/query-f9131eb55490b96851ac3760e3199d2fd2dbb3d212cb2b8687dda8ba0fad2a80.json
new file mode 100644
index 0000000000..0ccd35ecd7
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-f9131eb55490b96851ac3760e3199d2fd2dbb3d212cb2b8687dda8ba0fad2a80.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                insert into project_attribution_groups (id, project_id, flame_project)\n                values ($1, $2, $3)\n                ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "f9131eb55490b96851ac3760e3199d2fd2dbb3d212cb2b8687dda8ba0fad2a80"
+}
diff --git a/apps/labrinth/.sqlx/query-f9b96c70c83f1bf0112243602843abae6ddc8851fc623ccf0a23f87567763485.json b/apps/labrinth/.sqlx/query-f9b96c70c83f1bf0112243602843abae6ddc8851fc623ccf0a23f87567763485.json
new file mode 100644
index 0000000000..17bdd2c3af
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-f9b96c70c83f1bf0112243602843abae6ddc8851fc623ccf0a23f87567763485.json
@@ -0,0 +1,40 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT encode(mef.sha1, 'escape') sha1, mel.id, mel.status status, mel.link\n        FROM moderation_external_files mef\n        INNER JOIN moderation_external_licenses mel ON mef.external_license_id = mel.id\n        WHERE mef.sha1 = ANY($1)\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "sha1",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 1,
+        "name": "id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "status",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "link",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "ByteaArray"
+      ]
+    },
+    "nullable": [
+      null,
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "f9b96c70c83f1bf0112243602843abae6ddc8851fc623ccf0a23f87567763485"
+}
diff --git a/apps/labrinth/.sqlx/query-fe4ff6ab40fe3dc3d474c0c23c9dba514c66ac30e573fc5f4e44ed7ff360d3d6.json b/apps/labrinth/.sqlx/query-fe4ff6ab40fe3dc3d474c0c23c9dba514c66ac30e573fc5f4e44ed7ff360d3d6.json
new file mode 100644
index 0000000000..99a5a8243f
--- /dev/null
+++ b/apps/labrinth/.sqlx/query-fe4ff6ab40fe3dc3d474c0c23c9dba514c66ac30e573fc5f4e44ed7ff360d3d6.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT DISTINCT ON (dr.id)\n            to_jsonb(dr)\n            || jsonb_build_object(\n                'report_id', dr.id,\n                'file_id', to_base62(f.id),\n                'version_id', to_base62(v.id),\n                'project_id', to_base62(v.mod_id),\n                'file_name', f.filename,\n                'file_size', f.size,\n                'flag_reason', 'delphi',\n                'download_url', f.url,\n                -- TODO: replace with `json_array` in Postgres 16\n\t\t\t\t'issues', (\n\t\t\t\t\tSELECT coalesce(json_agg(\n\t\t\t\t\t\tto_jsonb(dri)\n\t\t\t\t\t\t|| jsonb_build_object(\n\t\t\t\t\t\t\t-- TODO: replace with `json_array` in Postgres 16\n\t\t\t\t\t\t\t'details', (\n\t\t\t\t\t\t\t\tSELECT coalesce(jsonb_agg(\n                                    jsonb_build_object(\n                                        'id', didws.id,\n                                        'issue_id', didws.issue_id,\n                                        'key', didws.key,\n                                        'file_path', didws.file_path,\n                                        'decompiled_source', didws.decompiled_source,\n                                        'data', didws.data,\n                                        'severity', didws.severity,\n                                        'status', didws.status\n                                    )\n                                ), '[]'::jsonb)\n                                FROM delphi_issue_details_with_statuses didws\n                                WHERE didws.issue_id = dri.id\n                            )\n\t\t\t\t\t\t)\n\t\t\t\t\t), '[]'::json)\n\t\t\t\t\tFROM delphi_report_issues dri\n\t\t\t\t\tWHERE\n\t\t\t\t\t\tdri.report_id = dr.id\n                        -- see delphi.rs todo comment\n                        AND dri.issue_type != '__dummy'\n                )\n            ) AS \"data!: sqlx::types::Json<FileReport>\"\n        FROM delphi_reports dr\n        INNER JOIN files f ON f.id = dr.file_id\n        INNER JOIN versions v ON v.id = f.version_id\n        WHERE dr.id = $1\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "data!: sqlx::types::Json<FileReport>",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "fe4ff6ab40fe3dc3d474c0c23c9dba514c66ac30e573fc5f4e44ed7ff360d3d6"
+}
diff --git a/apps/labrinth/AGENTS.md~HEAD b/apps/labrinth/AGENTS.md~HEAD
new file mode 100644
index 0000000000..0b73458d53
--- /dev/null
+++ b/apps/labrinth/AGENTS.md~HEAD
@@ -0,0 +1,34 @@
+# Labrinth
+
+Labrinth is the backend API service for Modrinth, written in Rust.
+
+## Code style
+
+- When writing `sqlx` queries, NEVER use `query` directly. Always prefer using the `query!`, `query_as!`, `query_scalar!` macros.
+
+## Pre-PR Checks
+
+When the user refers to "perform[ing] pre-PR checks", do the following:
+
+- Run `cargo clippy -p labrinth --all-targets` — there must be ZERO warnings, otherwise CI will fail
+- DO NOT run tests unless explicitly requested (they take a long time)
+- Prepare the sqlx cache: cd into `apps/labrinth` and run `cargo sqlx prepare -- --tests`
+	- NEVER run `cargo sqlx prepare --workspace`
+
+## Testing
+
+- Run `cargo test -p labrinth --all-targets` to test your changes — all tests must pass
+
+## Local Services
+
+- Read the root `docker-compose.yml` to see what running services are available while developing
+- Use `docker exec` to access these services
+
+### Clickhouse
+
+- Access: `docker exec labrinth-clickhouse clickhouse-client`
+- Database: `staging_ariadne`
+
+### Postgres
+
+- Access: `docker exec labrinth-postgres psql -U labrinth -d labrinth -c "<query>"`
diff --git a/apps/labrinth/migrations/20260423114534_project_attribution.sql b/apps/labrinth/migrations/20260423114534_project_attribution.sql
new file mode 100644
index 0000000000..805d85d870
--- /dev/null
+++ b/apps/labrinth/migrations/20260423114534_project_attribution.sql
@@ -0,0 +1,33 @@
+create table file_scans (
+	file_id bigint primary key references files(id),
+	-- if a file..
+	-- - does not have a row
+	--   -> was created before attributions system
+	-- - has a row, but `attributions_scanned_at = null`
+	--   -> still needs to be scanned
+	-- - has a row, and `attributions_scanned_at` is not null
+	--   -> attributions have been scanned
+	attributions_scanned_at timestamptz
+);
+
+create table project_attribution_groups (
+	id bigint primary key,
+	project_id bigint not null references mods(id),
+	flame_project jsonb,
+	attribution jsonb,
+	attributed_at timestamptz,
+	attributed_by bigint references users(id)
+);
+create index on project_attribution_groups (project_id);
+
+create table project_attribution_files (
+	group_id bigint not null references project_attribution_groups(id),
+	name text not null,
+	sha1 bytea not null
+);
+
+create table override_file_sources (
+	sha1 bytea not null,
+	file_id bigint not null references files(id),
+	primary key (sha1, file_id)
+);
diff --git a/apps/labrinth/migrations/20260519143157_fix_file_attribution_deletion.sql b/apps/labrinth/migrations/20260519143157_fix_file_attribution_deletion.sql
new file mode 100644
index 0000000000..473dbda6e9
--- /dev/null
+++ b/apps/labrinth/migrations/20260519143157_fix_file_attribution_deletion.sql
@@ -0,0 +1,19 @@
+alter table file_scans
+	drop constraint file_scans_file_id_fkey,
+	add constraint file_scans_file_id_fkey
+		foreign key (file_id) references files(id) on delete cascade;
+
+alter table project_attribution_groups
+	drop constraint project_attribution_groups_project_id_fkey,
+	add constraint project_attribution_groups_project_id_fkey
+		foreign key (project_id) references mods(id) on delete cascade;
+
+alter table project_attribution_files
+	drop constraint project_attribution_files_group_id_fkey,
+	add constraint project_attribution_files_group_id_fkey
+		foreign key (group_id) references project_attribution_groups(id) on delete cascade;
+
+alter table override_file_sources
+	drop constraint override_file_sources_file_id_fkey,
+	add constraint override_file_sources_file_id_fkey
+		foreign key (file_id) references files(id) on delete cascade;
diff --git a/apps/labrinth/migrations/20260521120000_project_attribution_external_license.sql b/apps/labrinth/migrations/20260521120000_project_attribution_external_license.sql
new file mode 100644
index 0000000000..5820106844
--- /dev/null
+++ b/apps/labrinth/migrations/20260521120000_project_attribution_external_license.sql
@@ -0,0 +1,20 @@
+alter table project_attribution_files
+	add column moderation_external_license_id bigint references moderation_external_licenses(id);
+
+create table version_attribution_exemptions (
+	version_id bigint primary key references versions(id) on delete cascade
+);
+
+create view attribution_enforced_versions as
+select v.id
+from versions v
+left join version_attribution_exemptions vae on vae.version_id = v.id
+where vae.version_id is null;
+
+-- grandfathering migration:
+-- insert into version_attribution_exemptions (version_id)
+-- select v.id
+-- from versions v
+-- inner join mods m on m.id = v.mod_id
+-- where m.status in ('approved', 'unlisted', 'archived', 'private', 'scheduled', 'withheld')
+-- on conflict do nothing;
diff --git a/apps/labrinth/src/auth/checks.rs b/apps/labrinth/src/auth/checks.rs
index 329e071042..f8a2bc24a8 100644
--- a/apps/labrinth/src/auth/checks.rs
+++ b/apps/labrinth/src/auth/checks.rs
@@ -5,11 +5,49 @@ use crate::database::models::version_item::VersionQueryResult;
 use crate::database::models::{DBCollection, DBOrganization, DBTeamMember};
 use crate::database::redis::RedisPool;
 use crate::database::{DBProject, DBVersion, models};
+use crate::models::ids::FileId;
+use crate::models::projects::{
+    DependencyAttribution, MissingAttributionFile, OverrideSource, Version,
+};
 use crate::models::users::User;
+use crate::queue::file_scan::{
+    DependencyAttributionData, get_dependency_attributions,
+    get_files_missing_attribution,
+};
 use crate::routes::ApiError;
 use futures::TryStreamExt;
 use itertools::Itertools;
 
+pub fn enrich_dependency_attributions(
+    version: &mut Version,
+    dep_attr: &std::collections::HashMap<
+        (database::models::ids::DBVersionId, String),
+        DependencyAttributionData,
+    >,
+) {
+    let version_id = database::models::ids::DBVersionId(version.id.0 as i64);
+    for dep in &mut version.dependencies {
+        if let Some(file_name) = &dep.file_name
+            && let Some(attr) = dep_attr.get(&(version_id, file_name.clone()))
+        {
+            let attribution = DependencyAttribution {
+                link: attr.link.clone().and_then(|u| u.parse().ok()),
+                icon_url: attr.icon_url.clone().and_then(|u| u.parse().ok()),
+                license: attr
+                    .license
+                    .clone()
+                    .and_then(|v| serde_json::from_value(v).ok()),
+            };
+            if attribution.link.is_some()
+                || attribution.icon_url.is_some()
+                || attribution.license.is_some()
+            {
+                dep.attribution = Some(attribution);
+            }
+        }
+    }
+}
+
 pub trait ValidateAuthorized {
     fn validate_authorized(
         &self,
@@ -204,7 +242,45 @@ pub async fn filter_visible_versions(
     )
     .await?;
     versions.retain(|x| filtered_version_ids.contains(&x.inner.id));
-    Ok(versions.into_iter().map(|x| x.into()).collect())
+
+    let version_ids: Vec<_> = versions.iter().map(|v| v.inner.id).collect();
+    let missing = get_files_missing_attribution(pool, &version_ids)
+        .await
+        .unwrap_or_default();
+
+    let dep_attr = get_dependency_attributions(pool, &version_ids)
+        .await
+        .unwrap_or_default();
+
+    Ok(versions
+        .into_iter()
+        .map(|v| {
+            let files_missing = missing
+                .get(&v.inner.id)
+                .map(|entries| {
+                    entries
+                        .iter()
+                        .map(|(id, fp)| MissingAttributionFile {
+                            id: FileId(id.0 as u64),
+                            override_source: fp
+                                .as_ref()
+                                .map(|p| OverrideSource::Flame {
+                                    id: p.id,
+                                    title: p.title.clone(),
+                                    url: p.url.clone(),
+                                    icon_url: p.icon_url.clone(),
+                                })
+                                .or(Some(OverrideSource::Unknown)),
+                        })
+                        .collect::<Vec<_>>()
+                })
+                .unwrap_or_default();
+            let mut version = Version::from(v);
+            version.files_missing_attribution = files_missing;
+            enrich_dependency_attributions(&mut version, &dep_attr);
+            version
+        })
+        .collect())
 }
 
 impl ValidateAuthorized for models::DBOAuthClient {
@@ -258,13 +334,20 @@ pub async fn filter_visible_version_ids(
         filter_enlisted_version_ids(versions.clone(), user_option, pool, redis)
             .await?;
 
+    let version_ids: Vec<_> = versions.iter().map(|v| v.id).collect();
+    let withheld_versions = get_files_missing_attribution(pool, &version_ids)
+        .await
+        .unwrap_or_default();
+
     // Return versions that are not hidden, we are a mod of, or we are enlisted on the team of
     for version in versions {
+        let is_withheld = withheld_versions.contains_key(&version.id);
         // We can see the version if:
-        // - it's not hidden and we can see the project
+        // - it's not hidden and we can see the project and it's not withheld for attribution
         // - we are a mod
         // - we are enlisted on the team of the mod
         if (!version.status.is_hidden()
+            && !is_withheld
             && visible_project_ids.contains(&version.project_id))
             || user_option.as_ref().is_some_and(|x| x.role.is_mod())
             || enlisted_version_ids.contains(&version.id)
diff --git a/apps/labrinth/src/background_task.rs b/apps/labrinth/src/background_task.rs
index b44bdfe6cd..1c8c0ecefc 100644
--- a/apps/labrinth/src/background_task.rs
+++ b/apps/labrinth/src/background_task.rs
@@ -1,9 +1,11 @@
 use crate::database;
 use crate::database::PgPool;
 use crate::database::redis::RedisPool;
+use crate::file_hosting::FileHost;
 use crate::queue::analytics::cache::cache_analytics;
 use crate::queue::billing::{index_billing, index_subscriptions};
 use crate::queue::email::EmailQueue;
+use crate::queue::file_scan::scan_all_files;
 use crate::queue::payouts::{
     PayoutsQueue, index_payouts_notifications,
     insert_bank_balances_and_webhook, process_affiliate_payouts,
@@ -34,6 +36,10 @@ pub enum BackgroundTask {
     /// Attempts to ping Minecraft Java servers as if we were a client, to
     /// collect info on if they're online, game version, description, etc.
     PingMinecraftJavaServers,
+    /// Finds files of versions which have not been scanned for attributions
+    /// yet, extracts them to find file overrides, and finds any overrides which
+    /// require attribution from the creator.
+    ScanFiles,
 }
 
 impl BackgroundTask {
@@ -44,6 +50,7 @@ impl BackgroundTask {
         ro_pool: PgPool,
         redis_pool: RedisPool,
         search_backend: web::Data<dyn SearchBackend>,
+        file_host: web::Data<dyn FileHost>,
         clickhouse: clickhouse::Client,
         stripe_client: stripe::Client,
         anrok_client: anrok::Client,
@@ -90,6 +97,7 @@ impl BackgroundTask {
             PingMinecraftJavaServers => {
                 ping_minecraft_java_servers(pool, redis_pool, clickhouse).await
             }
+            ScanFiles => scan_all_files(&pool, &redis_pool, &**file_host).await,
         }
     }
 }
diff --git a/apps/labrinth/src/database/models/ids.rs b/apps/labrinth/src/database/models/ids.rs
index d88c601805..2bfc859d1e 100644
--- a/apps/labrinth/src/database/models/ids.rs
+++ b/apps/labrinth/src/database/models/ids.rs
@@ -1,12 +1,12 @@
 use super::DatabaseError;
 use crate::database::PgTransaction;
 use crate::models::ids::{
-    AffiliateCodeId, AnalyticsEventId, ChargeId, CollectionId, FileId, ImageId,
-    NotificationId, OAuthAccessTokenId, OAuthClientAuthorizationId,
-    OAuthClientId, OAuthRedirectUriId, OrganizationId, PatId, PayoutId,
-    ProductId, ProductPriceId, ProjectId, ReportId, SessionId,
-    SharedInstanceId, SharedInstanceVersionId, TeamId, TeamMemberId, ThreadId,
-    ThreadMessageId, UserSubscriptionId, VersionId,
+    AffiliateCodeId, AnalyticsEventId, AttributionGroupId, ChargeId,
+    CollectionId, FileId, ImageId, NotificationId, OAuthAccessTokenId,
+    OAuthClientAuthorizationId, OAuthClientId, OAuthRedirectUriId,
+    OrganizationId, PatId, PayoutId, ProductId, ProductPriceId, ProjectId,
+    ReportId, SessionId, SharedInstanceId, SharedInstanceVersionId, TeamId,
+    TeamMemberId, ThreadId, ThreadMessageId, UserSubscriptionId, VersionId,
 };
 use ariadne::ids::base62_impl::to_base62;
 use ariadne::ids::{UserId, random_base62_rng, random_base62_rng_range};
@@ -168,6 +168,10 @@ db_id_interface!(
     CollectionId,
     generator: generate_collection_id @ "collections",
 );
+db_id_interface!(
+    AttributionGroupId,
+    generator: generate_attribution_group_id @ "project_attribution_groups",
+);
 db_id_interface!(
     FileId,
     generator: generate_file_id @ "files",
diff --git a/apps/labrinth/src/database/models/project_item.rs b/apps/labrinth/src/database/models/project_item.rs
index 904f799e62..9fa9091a9b 100644
--- a/apps/labrinth/src/database/models/project_item.rs
+++ b/apps/labrinth/src/database/models/project_item.rs
@@ -6,6 +6,7 @@ use super::{DBUser, ids::*};
 use crate::database::models::DatabaseError;
 use crate::database::redis::RedisPool;
 use crate::database::{PgTransaction, models};
+use crate::file_hosting::FileHost;
 use crate::models::exp;
 use crate::models::ids::ProjectId;
 use crate::models::projects::{
@@ -187,6 +188,8 @@ impl ProjectBuilder {
     pub async fn insert(
         self,
         transaction: &mut PgTransaction<'_>,
+        redis: &RedisPool,
+        file_host: &dyn FileHost,
         http: &reqwest::Client,
     ) -> Result<DBProjectId, DatabaseError> {
         let project_struct = DBProject {
@@ -235,7 +238,7 @@ impl ProjectBuilder {
 
         for mut version in self.initial_versions {
             version.project_id = self.project_id;
-            version.insert(&mut *transaction, http).await?;
+            version.insert(transaction, redis, file_host, http).await?;
         }
 
         LinkUrl::insert_many_projects(
diff --git a/apps/labrinth/src/database/models/version_item.rs b/apps/labrinth/src/database/models/version_item.rs
index 6ffaf90c7f..7f8458d211 100644
--- a/apps/labrinth/src/database/models/version_item.rs
+++ b/apps/labrinth/src/database/models/version_item.rs
@@ -6,8 +6,11 @@ use crate::database::models::loader_fields::{
     QueryLoaderField, QueryLoaderFieldEnumValue, QueryVersionField,
 };
 use crate::database::redis::RedisPool;
+use crate::file_hosting::FileHost;
 use crate::models::exp;
+
 use crate::models::projects::{FileType, VersionStatus};
+use crate::queue::file_scan::scan_file;
 use crate::routes::internal::delphi::DelphiRunParameters;
 use chrono::{DateTime, Utc};
 use dashmap::{DashMap, DashSet};
@@ -17,10 +20,31 @@ use serde::{Deserialize, Serialize};
 use std::cmp::Ordering;
 use std::collections::HashMap;
 use std::iter;
+use tracing::error;
 
 pub const VERSIONS_NAMESPACE: &str = "versions";
 const VERSION_FILES_NAMESPACE: &str = "versions_files";
 
+pub async fn cleanup_empty_attribution_groups(
+    transaction: &mut PgTransaction<'_>,
+) -> Result<(), DatabaseError> {
+    sqlx::query!(
+        "
+        DELETE FROM project_attribution_groups g
+        WHERE NOT EXISTS (
+            SELECT 1
+            FROM project_attribution_files paf
+            INNER JOIN override_file_sources ofs ON ofs.sha1 = paf.sha1
+            WHERE paf.group_id = g.id
+        )
+        ",
+    )
+    .execute(&mut *transaction)
+    .await?;
+
+    Ok(())
+}
+
 #[derive(Clone)]
 pub struct VersionBuilder {
     pub version_id: DBVersionId,
@@ -134,7 +158,10 @@ impl VersionFileBuilder {
     pub async fn insert(
         self,
         version_id: DBVersionId,
+        project_id: DBProjectId,
         transaction: &mut PgTransaction<'_>,
+        redis: &RedisPool,
+        file_host: &dyn FileHost,
         http: &reqwest::Client,
     ) -> Result<DBFileId, DatabaseError> {
         let file_id = generate_file_id(&mut *transaction).await?;
@@ -169,6 +196,16 @@ impl VersionFileBuilder {
             .await?;
         }
 
+        sqlx::query!(
+            "
+            INSERT INTO file_scans (file_id)
+            VALUES ($1)
+            ",
+            file_id as DBFileId,
+        )
+        .execute(&mut *transaction)
+        .await?;
+
         if let Err(err) = crate::routes::internal::delphi::run(
             &mut *transaction,
             DelphiRunParameters {
@@ -178,7 +215,20 @@ impl VersionFileBuilder {
         )
         .await
         {
-            tracing::error!("Error submitting new file to Delphi: {err}");
+            error!("Error submitting new file to Delphi: {err:?}");
+        }
+
+        if let Err(err) = scan_file(
+            &mut *transaction,
+            redis,
+            file_host,
+            project_id,
+            file_id,
+            &self.url,
+        )
+        .await
+        {
+            error!("Error scanning new file {file_id:?}: {err:?}");
         }
 
         Ok(file_id)
@@ -195,6 +245,8 @@ impl VersionBuilder {
     pub async fn insert(
         self,
         transaction: &mut PgTransaction<'_>,
+        redis: &RedisPool,
+        file_host: &dyn FileHost,
         http: &reqwest::Client,
     ) -> Result<DBVersionId, DatabaseError> {
         let version = DBVersion {
@@ -236,7 +288,15 @@ impl VersionBuilder {
         } = self;
 
         for file in files {
-            file.insert(version_id, transaction, http).await?;
+            file.insert(
+                version_id,
+                self.project_id,
+                transaction,
+                redis,
+                file_host,
+                http,
+            )
+            .await?;
         }
 
         DependencyBuilder::insert_many(
@@ -426,6 +486,8 @@ impl DBVersion {
         .execute(&mut *transaction)
         .await?;
 
+        cleanup_empty_attribution_groups(transaction).await?;
+
         // Sync dependencies
 
         let project_id = sqlx::query!(
@@ -862,14 +924,14 @@ impl DBVersion {
             })
     }
 
-    pub async fn get_files_from_hash<'a, 'b, E>(
+    pub async fn get_files_from_hash<'a, E>(
         algorithm: String,
         hashes: &[String],
         executor: E,
         redis: &RedisPool,
     ) -> Result<Vec<DBFile>, DatabaseError>
     where
-        E: crate::database::Executor<'a, Database = sqlx::Postgres> + Copy,
+        E: crate::database::Executor<'a, Database = sqlx::Postgres>,
     {
         let val = redis.get_cached_keys(
             VERSION_FILES_NAMESPACE,
diff --git a/apps/labrinth/src/file_hosting/mock.rs b/apps/labrinth/src/file_hosting/mock.rs
index 3e414bd393..8f18da5334 100644
--- a/apps/labrinth/src/file_hosting/mock.rs
+++ b/apps/labrinth/src/file_hosting/mock.rs
@@ -29,9 +29,7 @@ impl FileHost for MockHost {
         file_publicity: FileHostPublicity,
         file_bytes: Bytes,
     ) -> Result<UploadFileData, FileHostingError> {
-        let file_name = urlencoding::decode(file_name)
-            .map_err(|_| FileHostingError::InvalidFilename)?;
-        let path = get_file_path(&file_name, file_publicity);
+        let path = get_file_path(file_name, file_publicity);
         std::fs::create_dir_all(
             path.parent().ok_or(FileHostingError::InvalidFilename)?,
         )?;
@@ -72,6 +70,16 @@ impl FileHost for MockHost {
             file_name: file_name.to_string(),
         })
     }
+
+    async fn read_file(
+        &self,
+        file_name: &str,
+        file_publicity: FileHostPublicity,
+    ) -> Result<Bytes, FileHostingError> {
+        let path = get_file_path(file_name, file_publicity);
+        let data = std::fs::read(&path)?;
+        Ok(Bytes::from(data))
+    }
 }
 
 fn get_file_path(
diff --git a/apps/labrinth/src/file_hosting/mod.rs b/apps/labrinth/src/file_hosting/mod.rs
index 667f4cb21e..29fd25d8cf 100644
--- a/apps/labrinth/src/file_hosting/mod.rs
+++ b/apps/labrinth/src/file_hosting/mod.rs
@@ -45,7 +45,11 @@ pub enum FileHostPublicity {
 }
 
 #[async_trait]
-pub trait FileHost {
+pub trait FileHost: Send + Sync {
+    /// Uploads a file at the exact storage key provided.
+    ///
+    /// Callers must URL-decode keys derived from public URLs before passing
+    /// them here, and URL-encode this key before exposing it in a public URL.
     async fn upload_file(
         &self,
         content_type: &str,
@@ -54,17 +58,35 @@ pub trait FileHost {
         file_bytes: Bytes,
     ) -> Result<UploadFileData, FileHostingError>;
 
+    /// Returns a private URL for the exact storage key provided.
+    ///
+    /// Callers must URL-decode keys derived from public URLs before passing
+    /// them here.
     async fn get_url_for_private_file(
         &self,
         file_name: &str,
         expiry_secs: u32,
     ) -> Result<String, FileHostingError>;
 
+    /// Deletes the file at the exact storage key provided.
+    ///
+    /// Callers must URL-decode keys derived from public URLs before passing
+    /// them here.
     async fn delete_file(
         &self,
         file_name: &str,
         file_publicity: FileHostPublicity,
     ) -> Result<DeleteFileData, FileHostingError>;
+
+    /// Reads the file at the exact storage key provided.
+    ///
+    /// Callers must URL-decode keys derived from public URLs before passing
+    /// them here.
+    async fn read_file(
+        &self,
+        file_name: &str,
+        file_publicity: FileHostPublicity,
+    ) -> Result<Bytes, FileHostingError>;
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
diff --git a/apps/labrinth/src/file_hosting/s3_host.rs b/apps/labrinth/src/file_hosting/s3_host.rs
index 56bd0ef45c..558e4d5086 100644
--- a/apps/labrinth/src/file_hosting/s3_host.rs
+++ b/apps/labrinth/src/file_hosting/s3_host.rs
@@ -169,4 +169,28 @@ impl FileHost for S3Host {
             file_name: file_name.to_string(),
         })
     }
+
+    async fn read_file(
+        &self,
+        file_name: &str,
+        file_publicity: FileHostPublicity,
+    ) -> Result<Bytes, FileHostingError> {
+        let bucket = self.get_bucket(file_publicity);
+
+        let response = bucket
+            .client
+            .get_object()
+            .bucket(bucket.name.as_str())
+            .key(file_name)
+            .send()
+            .await
+            .map_err(|e| s3_error("reading file", e))?;
+
+        Ok(response
+            .body
+            .collect()
+            .await
+            .map_err(|e| s3_error("reading file body", e))?
+            .into_bytes())
+    }
 }
diff --git a/apps/labrinth/src/lib.rs b/apps/labrinth/src/lib.rs
index 15363ed09b..d1c4b30fa4 100644
--- a/apps/labrinth/src/lib.rs
+++ b/apps/labrinth/src/lib.rs
@@ -57,7 +57,7 @@ pub struct LabrinthConfig {
     pub ro_pool: ReadOnlyPgPool,
     pub redis_pool: RedisPool,
     pub clickhouse: Client,
-    pub file_host: Arc<dyn file_hosting::FileHost + Send + Sync>,
+    pub file_host: web::Data<dyn file_hosting::FileHost>,
     pub scheduler: Arc<scheduler::Scheduler>,
     pub ip_salt: Pepper,
     pub search_backend: web::Data<dyn search::SearchBackend>,
@@ -82,7 +82,7 @@ pub fn app_setup(
     redis_pool: RedisPool,
     search_backend: actix_web::web::Data<dyn search::SearchBackend>,
     clickhouse: &mut Client,
-    file_host: Arc<dyn file_hosting::FileHost + Send + Sync>,
+    file_host: web::Data<dyn file_hosting::FileHost>,
     stripe_client: stripe::Client,
     anrok_client: anrok::Client,
     email_queue: EmailQueue,
@@ -339,7 +339,7 @@ pub fn app_config(
     .app_data(web::Data::new(labrinth_config.redis_pool.clone()))
     .app_data(web::Data::new(labrinth_config.pool.clone()))
     .app_data(web::Data::new(labrinth_config.ro_pool.clone()))
-    .app_data(web::Data::new(labrinth_config.file_host.clone()))
+    .app_data(labrinth_config.file_host.clone())
     .app_data(labrinth_config.search_backend.clone())
     .app_data(web::Data::new(labrinth_config.gotenberg_client.clone()))
     .app_data(labrinth_config.http_client.clone())
diff --git a/apps/labrinth/src/main.rs b/apps/labrinth/src/main.rs
index f24a2fb79d..feba395e1a 100644
--- a/apps/labrinth/src/main.rs
+++ b/apps/labrinth/src/main.rs
@@ -2,14 +2,14 @@
 
 use actix_web::dev::Service;
 use actix_web::middleware::from_fn;
-use actix_web::{App, HttpServer};
+use actix_web::{App, HttpServer, web};
 use actix_web_prom::PrometheusMetricsBuilder;
 use clap::Parser;
 
 use labrinth::background_task::BackgroundTask;
 use labrinth::database::redis::RedisPool;
 use labrinth::env::ENV;
-use labrinth::file_hosting::{FileHostKind, S3BucketConfig, S3Host};
+use labrinth::file_hosting::{FileHost, FileHostKind, S3BucketConfig, S3Host};
 use labrinth::queue::email::EmailQueue;
 use labrinth::search;
 use labrinth::util::anrok;
@@ -111,44 +111,38 @@ async fn app() -> std::io::Result<()> {
     let redis_pool = RedisPool::new("");
 
     let storage_backend = ENV.STORAGE_BACKEND;
-    let file_host: Arc<dyn file_hosting::FileHost + Send + Sync> =
-        match storage_backend {
-            FileHostKind::S3 => {
-                let not_empty = |v: &str| -> String {
-                    assert!(!v.is_empty(), "S3 env var is empty");
-                    v.to_string()
-                };
-
-                Arc::new(
-                    S3Host::new(
-                        S3BucketConfig {
-                            name: not_empty(&ENV.S3_PUBLIC_BUCKET_NAME),
-                            uses_path_style: ENV
-                                .S3_PUBLIC_USES_PATH_STYLE_BUCKET,
-                            region: not_empty(&ENV.S3_PUBLIC_REGION),
-                            url: not_empty(&ENV.S3_PUBLIC_URL),
-                            access_token: not_empty(
-                                &ENV.S3_PUBLIC_ACCESS_TOKEN,
-                            ),
-                            secret: not_empty(&ENV.S3_PUBLIC_SECRET),
-                        },
-                        S3BucketConfig {
-                            name: not_empty(&ENV.S3_PRIVATE_BUCKET_NAME),
-                            uses_path_style: ENV
-                                .S3_PRIVATE_USES_PATH_STYLE_BUCKET,
-                            region: not_empty(&ENV.S3_PRIVATE_REGION),
-                            url: not_empty(&ENV.S3_PRIVATE_URL),
-                            access_token: not_empty(
-                                &ENV.S3_PRIVATE_ACCESS_TOKEN,
-                            ),
-                            secret: not_empty(&ENV.S3_PRIVATE_SECRET),
-                        },
-                    )
-                    .unwrap(),
+    let file_host: Arc<dyn FileHost> = match storage_backend {
+        FileHostKind::S3 => {
+            let not_empty = |v: &str| -> String {
+                assert!(!v.is_empty(), "S3 env var is empty");
+                v.to_string()
+            };
+
+            Arc::new(
+                S3Host::new(
+                    S3BucketConfig {
+                        name: not_empty(&ENV.S3_PUBLIC_BUCKET_NAME),
+                        uses_path_style: ENV.S3_PUBLIC_USES_PATH_STYLE_BUCKET,
+                        region: not_empty(&ENV.S3_PUBLIC_REGION),
+                        url: not_empty(&ENV.S3_PUBLIC_URL),
+                        access_token: not_empty(&ENV.S3_PUBLIC_ACCESS_TOKEN),
+                        secret: not_empty(&ENV.S3_PUBLIC_SECRET),
+                    },
+                    S3BucketConfig {
+                        name: not_empty(&ENV.S3_PRIVATE_BUCKET_NAME),
+                        uses_path_style: ENV.S3_PRIVATE_USES_PATH_STYLE_BUCKET,
+                        region: not_empty(&ENV.S3_PRIVATE_REGION),
+                        url: not_empty(&ENV.S3_PRIVATE_URL),
+                        access_token: not_empty(&ENV.S3_PRIVATE_ACCESS_TOKEN),
+                        secret: not_empty(&ENV.S3_PRIVATE_SECRET),
+                    },
                 )
-            }
-            FileHostKind::Local => Arc::new(file_hosting::MockHost::new()),
-        };
+                .unwrap(),
+            )
+        }
+        FileHostKind::Local => Arc::new(file_hosting::MockHost::new()),
+    };
+    let file_host = web::Data::<dyn FileHost>::from(file_host);
 
     info!("Initializing clickhouse connection");
     let mut clickhouse = clickhouse::init_client().await.unwrap();
@@ -174,6 +168,7 @@ async fn app() -> std::io::Result<()> {
             ro_pool.into_inner(),
             redis_pool,
             search_backend,
+            file_host,
             clickhouse,
             stripe_client,
             anrok_client.clone(),
diff --git a/apps/labrinth/src/models/v3/ids.rs b/apps/labrinth/src/models/v3/ids.rs
index 519c0d4765..82ef1bd2d8 100644
--- a/apps/labrinth/src/models/v3/ids.rs
+++ b/apps/labrinth/src/models/v3/ids.rs
@@ -1,5 +1,6 @@
 use ariadne::ids::base62_id;
 
+base62_id!(AttributionGroupId);
 base62_id!(ChargeId);
 base62_id!(CollectionId);
 base62_id!(FileId);
diff --git a/apps/labrinth/src/models/v3/projects.rs b/apps/labrinth/src/models/v3/projects.rs
index 92abe3fddb..64e754eb75 100644
--- a/apps/labrinth/src/models/v3/projects.rs
+++ b/apps/labrinth/src/models/v3/projects.rs
@@ -645,6 +645,78 @@ impl SideTypesMigrationReviewStatus {
     }
 }
 
+#[derive(Debug, Serialize, Deserialize, Clone, utoipa::ToSchema)]
+pub struct MissingAttributionFile {
+    pub id: FileId,
+    pub override_source: Option<OverrideSource>,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, utoipa::ToSchema)]
+#[serde(tag = "type", rename_all = "snake_case")]
+pub enum OverrideSource {
+    Flame {
+        id: u32,
+        title: String,
+        url: String,
+        icon_url: String,
+    },
+    Unknown,
+}
+
+#[derive(
+    Debug, Serialize, Deserialize, Clone, PartialEq, Eq, utoipa::ToSchema,
+)]
+#[serde(untagged)]
+pub enum AttributionLicense {
+    Spdx(String),
+    Custom { name: String },
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, utoipa::ToSchema)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum AttributionResolutionKind {
+    License {
+        license: AttributionLicense,
+        link_to_work: url::Url,
+    },
+    GloballyAllowed {
+        link_to_work: url::Url,
+    },
+    MyProject {
+        license: AttributionLicense,
+    },
+    SpecialPermissions {
+        link_to_work: url::Url,
+    },
+    NoPermission,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, utoipa::ToSchema)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum AttributionModerationStatusKind {
+    NotAllowed,
+    Approved,
+    BadProof,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, utoipa::ToSchema)]
+pub struct AttributionModerationStatus {
+    #[serde(flatten)]
+    pub kind: AttributionModerationStatusKind,
+    #[serde(default)]
+    pub reason: String,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone, utoipa::ToSchema)]
+pub struct AttributionResolution {
+    #[serde(flatten)]
+    pub kind: AttributionResolutionKind,
+    #[serde(default)]
+    pub moderation_status: Option<AttributionModerationStatus>,
+    pub notes: String,
+    pub image_urls: Vec<url::Url>,
+}
+
 /// A specific version of a project
 #[derive(Debug, Serialize, Deserialize, Clone, utoipa::ToSchema)]
 pub struct Version {
@@ -681,6 +753,9 @@ pub struct Version {
 
     /// A list of files available for download for this version.
     pub files: Vec<VersionFile>,
+    /// Files in this version that contain override files not yet attributed.
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub files_missing_attribution: Vec<MissingAttributionFile>,
     /// A list of projects that this version depends on.
     pub dependencies: Vec<Dependency>,
 
@@ -757,6 +832,7 @@ impl From<VersionQueryResult> for Version {
                     dependency_type: DependencyType::from_string(
                         d.dependency_type.as_str(),
                     ),
+                    attribution: None,
                 })
                 .collect(),
             loaders: data.loaders.into_iter().map(Loader).collect(),
@@ -768,6 +844,7 @@ impl From<VersionQueryResult> for Version {
                 .map(|vf| (vf.field_name, vf.value.serialize_internal()))
                 .collect(),
             components: data.components,
+            files_missing_attribution: Vec::new(),
         }
     }
 }
@@ -899,6 +976,20 @@ pub struct Dependency {
     pub file_name: Option<String>,
     /// The type of the dependency
     pub dependency_type: DependencyType,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub attribution: Option<DependencyAttribution>,
+}
+
+#[derive(
+    Serialize, Deserialize, Clone, Debug, PartialEq, Eq, utoipa::ToSchema,
+)]
+pub struct DependencyAttribution {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub link: Option<url::Url>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub icon_url: Option<url::Url>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub license: Option<AttributionLicense>,
 }
 
 #[derive(
diff --git a/apps/labrinth/src/queue/file_scan.rs b/apps/labrinth/src/queue/file_scan.rs
new file mode 100644
index 0000000000..8f21869c87
--- /dev/null
+++ b/apps/labrinth/src/queue/file_scan.rs
@@ -0,0 +1,982 @@
+use std::collections::HashMap;
+use std::io::{Cursor, Read};
+
+use chrono::Utc;
+use eyre::{Result, eyre};
+use hex::ToHex;
+use sha1::Digest;
+use tokio::task::spawn_blocking;
+use tracing::{Instrument, info, info_span, warn};
+use zip::ZipArchive;
+
+use crate::database::models::ids::{
+    DBAttributionGroupId, DBProjectId, DBVersionId,
+    generate_attribution_group_id,
+};
+use crate::database::models::moderation_external_item::ExternalLicense;
+use crate::database::models::{DBFileId, DBUserId, DBVersion};
+use crate::database::{PgPool, PgTransaction, redis::RedisPool};
+use crate::env::ENV;
+use crate::file_hosting::{FileHost, FileHostPublicity};
+use crate::models::ids::FileId;
+use crate::models::projects::{
+    AttributionResolution, AttributionResolutionKind,
+};
+use crate::queue::moderation::{
+    ApprovalType, FingerprintResponse, FlameProject, FlameResponse,
+};
+use crate::routes::internal::attribution::FlameProject as AttributionFlameProject;
+use crate::util::error::Context;
+use crate::util::http::HTTP_CLIENT;
+
+/// Attribution enforcement is version-scoped, not file-hash-scoped.
+///
+/// Versions listed in `version_attribution_exemptions` are legacy public
+/// versions that predate this attribution system. They are not scanned for
+/// attribution requirements and must not cause missing-attribution withholding.
+/// A later non-exempt version can still contain the same override SHA1 and
+/// create attribution groups/files for that SHA1. Because of that, reverse
+/// lookups from override SHA1s to versions must go through the
+/// `attribution_enforced_versions` view so grandfathered versions are ignored
+/// without making the SHA1 itself exempt.
+pub async fn scan_all_files(
+    db: &PgPool,
+    redis: &RedisPool,
+    file_host: &dyn FileHost,
+) -> Result<()> {
+    let mut txn = db.begin().await.wrap_err("beginning transaction")?;
+
+    let files_to_scan = sqlx::query!(
+        r#"
+        select
+            fa.file_id as "file_id: DBFileId",
+            f.url,
+            v.mod_id as "project_id: DBProjectId"
+        from file_scans fa
+        inner join files f on f.id = fa.file_id
+        inner join versions v on v.id = f.version_id
+        where fa.attributions_scanned_at is null
+        "#
+    )
+    .fetch_all(&mut txn)
+    .await
+    .wrap_err("fetching files to scan")?;
+
+    info!("Found {} files to scan", files_to_scan.len());
+
+    let mut scanned_ids = Vec::new();
+
+    for row in files_to_scan {
+        let human_file_id = FileId::from(row.file_id);
+        let span = info_span!("scan", file_id = %human_file_id);
+        async {
+            info!("Scanning file");
+
+            let file_id = row.file_id;
+
+            let overrides = extract_override_files_from_storage(
+                file_host, file_id, &row.url,
+            )
+            .await
+            .wrap_err_with(|| {
+                eyre!("extracting overrides for file {file_id:?}")
+            })?;
+
+            if overrides.is_empty() {
+                info!("Found no overrides");
+            } else {
+                info!("Found {} overrides", overrides.len());
+
+                let resolved = resolve_overrides(&overrides, redis, &mut txn)
+                    .await
+                    .wrap_err_with(|| {
+                        eyre!("resolving overrides for file {file_id:?}")
+                    })?;
+                info!("Resolved: {resolved:#?}");
+
+                persist_attribution_results(
+                    row.project_id,
+                    file_id,
+                    &overrides,
+                    &resolved,
+                    &mut txn,
+                )
+                .await
+                .wrap_err_with(|| {
+                    eyre!("persisting attribution results for file {file_id:?}")
+                })?;
+            }
+
+            scanned_ids.push(file_id.0);
+            eyre::Ok(())
+        }
+        .instrument(span)
+        .await?;
+    }
+
+    if !scanned_ids.is_empty() {
+        let now = Utc::now();
+        sqlx::query!(
+            "
+            update file_scans
+            set attributions_scanned_at = now
+            from unnest($1::bigint[], $2::timestamptz[]) as u(id, now)
+            where file_scans.file_id = u.id
+            ",
+            &scanned_ids,
+            &vec![now; scanned_ids.len()],
+        )
+        .execute(&mut txn)
+        .await
+        .wrap_err("marking files as scanned")?;
+    }
+
+    info!("Marked {} files as scanned", scanned_ids.len());
+
+    txn.commit().await.wrap_err("committing transaction")?;
+
+    Ok(())
+}
+
+pub async fn scan_file(
+    txn: &mut PgTransaction<'_>,
+    redis: &RedisPool,
+    file_host: &dyn FileHost,
+    project_id: DBProjectId,
+    file_id: DBFileId,
+    file_url: &str,
+) -> Result<()> {
+    let overrides =
+        extract_override_files_from_storage(file_host, file_id, file_url)
+            .await
+            .wrap_err_with(|| {
+                eyre!("extracting overrides for file {file_id:?}")
+            })?;
+
+    if !overrides.is_empty() {
+        let resolved = resolve_overrides(&overrides, redis, txn)
+            .await
+            .wrap_err_with(|| {
+                eyre!("resolving overrides for file {file_id:?}")
+            })?;
+
+        persist_attribution_results(
+            project_id, file_id, &overrides, &resolved, txn,
+        )
+        .await
+        .wrap_err_with(|| {
+            eyre!("persisting attribution results for file {file_id:?}")
+        })?;
+    }
+
+    sqlx::query!(
+        "
+        insert into file_scans (file_id, attributions_scanned_at)
+        values ($1, now())
+        on conflict (file_id) do update set attributions_scanned_at = now()
+        ",
+        file_id.0,
+    )
+    .execute(&mut *txn)
+    .await
+    .wrap_err("marking file as scanned")?;
+
+    Ok(())
+}
+
+pub async fn scan_override_files(
+    file_host: &dyn FileHost,
+    file_id: DBFileId,
+    file_url: &str,
+) -> Result<Vec<OverrideFile>> {
+    extract_override_files_from_storage(file_host, file_id, file_url)
+        .await
+        .wrap_err_with(|| eyre!("extracting overrides for file {file_id:?}"))
+}
+
+async fn extract_override_files_from_storage(
+    file_host: &dyn FileHost,
+    file_id: DBFileId,
+    file_url: &str,
+) -> Result<Vec<OverrideFile>> {
+    let key = file_url
+        .strip_prefix(&ENV.CDN_URL)
+        .unwrap_or(file_url)
+        .trim_start_matches('/');
+    let key = urlencoding::decode(key).wrap_err("decoding file URL path")?;
+
+    let file_data = file_host
+        .read_file(&key, FileHostPublicity::Public)
+        .await
+        .wrap_err_with(|| {
+            eyre!("reading file {file_id:?} from storage at {key}")
+        })?;
+
+    spawn_blocking(move || extract_override_files(&file_data))
+        .await
+        .wrap_err("extracting override files")?
+        .wrap_err("extracting override files")
+}
+
+#[derive(Debug)]
+pub struct OverrideFile {
+    pub path: String,
+    pub sha1: String,
+    pub murmur2: u32,
+}
+
+#[derive(Debug)]
+pub enum OverrideResolution {
+    OnModrinth,
+    ExternalLicense {
+        id: i64,
+        status: ApprovalType,
+        link: Option<String>,
+    },
+    Flame {
+        project_id: u32,
+        title: String,
+        url: String,
+        icon_url: String,
+    },
+    Unknown,
+}
+
+const OVERRIDE_PREFIXES: &[&str] = &[
+    "overrides/mods",
+    "client-overrides/mods",
+    "server-overrides/mods",
+    "overrides/shaderpacks",
+    "client-overrides/shaderpacks",
+    "overrides/resourcepacks",
+    "client-overrides/resourcepacks",
+];
+
+fn extract_override_files(data: &[u8]) -> Result<Vec<OverrideFile>> {
+    let reader = Cursor::new(data);
+    let mut zip =
+        ZipArchive::new(reader).wrap_err("creating zip archive reader")?;
+
+    let mut files = Vec::new();
+
+    for i in 0..zip.len() {
+        let mut file = zip
+            .by_index(i)
+            .wrap_err_with(|| eyre!("reading file {i}"))?;
+        let name = file.name().to_string();
+
+        if file.is_dir() {
+            continue;
+        }
+
+        if !OVERRIDE_PREFIXES
+            .iter()
+            .any(|prefix| name.starts_with(prefix))
+        {
+            continue;
+        }
+
+        if name.matches('/').count() > 2
+            || name.ends_with(".txt")
+            || name.ends_with(".rpo")
+        {
+            continue;
+        }
+
+        let mut contents = Vec::new();
+        file.read_to_end(&mut contents)?;
+
+        let sha1 = sha1::Sha1::digest(&contents).encode_hex::<String>();
+        let murmur = hash_flame_murmur32(contents);
+
+        files.push(OverrideFile {
+            sha1,
+            murmur2: murmur,
+            path: name,
+        });
+    }
+
+    Ok(files)
+}
+
+async fn persist_attribution_results(
+    project_id: DBProjectId,
+    file_id: DBFileId,
+    overrides: &[OverrideFile],
+    resolved: &HashMap<String, OverrideResolution>,
+    txn: &mut PgTransaction<'_>,
+) -> Result<()> {
+    let all_sha1s: Vec<Vec<u8>> = overrides
+        .iter()
+        .map(|f| f.sha1.as_bytes().to_vec())
+        .collect();
+
+    let already_persisted: Vec<Vec<u8>> = sqlx::query_scalar!(
+        "
+        select paf.sha1 from project_attribution_files paf
+        inner join project_attribution_groups pag on pag.id = paf.group_id
+        where pag.project_id = $1 and paf.sha1 = ANY($2)
+        ",
+        project_id as DBProjectId,
+        &all_sha1s,
+    )
+    .fetch_all(&mut *txn)
+    .await
+    .wrap_err("checking existing attribution files")?;
+
+    let mut flame_groups: HashMap<
+        u32,
+        (Vec<&OverrideFile>, Option<&OverrideResolution>),
+    > = HashMap::new();
+    let mut external_license_files: Vec<(
+        &OverrideFile,
+        i64,
+        ApprovalType,
+        Option<String>,
+    )> = Vec::new();
+    let mut unknown_files: Vec<&OverrideFile> = Vec::new();
+
+    for file in overrides {
+        if already_persisted
+            .iter()
+            .any(|s| s.as_slice() == file.sha1.as_bytes())
+        {
+            continue;
+        }
+
+        match resolved.get(&file.sha1) {
+            Some(OverrideResolution::OnModrinth) => continue,
+            Some(OverrideResolution::ExternalLicense { id, status, link }) => {
+                external_license_files.push((file, *id, *status, link.clone()));
+            }
+            Some(
+                res @ OverrideResolution::Flame {
+                    project_id: fp_id, ..
+                },
+            ) => {
+                let entry = flame_groups.entry(*fp_id).or_default();
+                entry.0.push(file);
+                if entry.1.is_none() {
+                    entry.1 = Some(res);
+                }
+            }
+            Some(OverrideResolution::Unknown) | None => {
+                unknown_files.push(file);
+            }
+        }
+    }
+
+    for (file, external_license_id, status, link) in external_license_files {
+        let attribution = default_external_license_attribution(status, link);
+        let group_id = generate_attribution_group_id(&mut *txn).await?;
+        sqlx::query!(
+            "
+            insert into project_attribution_groups (id, project_id, attribution)
+            values ($1, $2, $3)
+            ",
+            group_id as DBAttributionGroupId,
+            project_id as DBProjectId,
+            attribution,
+        )
+        .execute(&mut *txn)
+        .await
+        .wrap_err("inserting external license attribution group")?;
+
+        sqlx::query!(
+            "
+            insert into project_attribution_files (group_id, name, sha1, moderation_external_license_id)
+            values ($1, $2, $3, $4)
+            ",
+            group_id as DBAttributionGroupId,
+            &file.path,
+            &file.sha1.as_bytes().to_vec() as &[u8],
+            external_license_id,
+        )
+        .execute(&mut *txn)
+        .await
+        .wrap_err("inserting external license attribution file")?;
+    }
+
+    let existing_flame_groups = sqlx::query!(
+        r#"
+        select id as "id: DBAttributionGroupId", flame_project
+        from project_attribution_groups
+        where project_id = $1 and flame_project is not null
+        "#,
+        project_id as DBProjectId,
+    )
+    .fetch_all(&mut *txn)
+    .await
+    .wrap_err("fetching existing flame attribution groups")?;
+
+    for (flame_project_id, (files, resolution)) in &flame_groups {
+        let existing = existing_flame_groups.iter().find(|g| {
+            g.flame_project
+                .as_ref()
+                .and_then(|fp| {
+                    serde_json::from_value::<AttributionFlameProject>(
+                        fp.clone(),
+                    )
+                    .ok()
+                })
+                .is_some_and(|fp| fp.id == *flame_project_id)
+        });
+
+        let group_id = if let Some(group) = existing {
+            group.id
+        } else {
+            let fp = resolution
+                .and_then(|r| {
+                    if let OverrideResolution::Flame {
+                        project_id,
+                        title,
+                        url,
+                        icon_url,
+                    } = r
+                    {
+                        Some(
+                            serde_json::to_value(AttributionFlameProject {
+                                id: *project_id,
+                                title: title.clone(),
+                                url: url.clone(),
+                                icon_url: icon_url.clone(),
+                            })
+                            .ok(),
+                        )
+                    } else {
+                        None
+                    }
+                })
+                .flatten();
+
+            let id = generate_attribution_group_id(&mut *txn).await?;
+            sqlx::query!(
+                "
+                insert into project_attribution_groups (id, project_id, flame_project)
+                values ($1, $2, $3)
+                ",
+                id as DBAttributionGroupId,
+                project_id as DBProjectId,
+                fp,
+            )
+            .execute(&mut *txn)
+            .await
+            .wrap_err("inserting attribution group")?;
+            id
+        };
+
+        let names: Vec<String> = files.iter().map(|f| f.path.clone()).collect();
+        let sha1s: Vec<Vec<u8>> =
+            files.iter().map(|f| f.sha1.as_bytes().to_vec()).collect();
+
+        sqlx::query!(
+            "
+            insert into project_attribution_files (group_id, name, sha1)
+            select $1, unnest($2::text[]), unnest($3::bytea[])
+            ",
+            group_id as DBAttributionGroupId,
+            &names,
+            &sha1s,
+        )
+        .execute(&mut *txn)
+        .await
+        .wrap_err("inserting attribution files")?;
+    }
+
+    for file in &unknown_files {
+        let group_id = generate_attribution_group_id(&mut *txn).await?;
+        sqlx::query!(
+            "
+            insert into project_attribution_groups (id, project_id)
+            values ($1, $2)
+            ",
+            group_id as DBAttributionGroupId,
+            project_id as DBProjectId,
+        )
+        .execute(&mut *txn)
+        .await
+        .wrap_err("inserting unknown attribution group")?;
+
+        sqlx::query!(
+            "
+            insert into project_attribution_files (group_id, name, sha1)
+            values ($1, $2, $3)
+            ",
+            group_id as DBAttributionGroupId,
+            &file.path,
+            &file.sha1.as_bytes().to_vec() as &[u8],
+        )
+        .execute(&mut *txn)
+        .await
+        .wrap_err("inserting unknown attribution file")?;
+    }
+
+    if !all_sha1s.is_empty() {
+        sqlx::query!(
+            "
+            insert into override_file_sources (sha1, file_id)
+            select unnest($1::bytea[]), $2
+            on conflict do nothing
+            ",
+            &all_sha1s,
+            file_id as DBFileId,
+        )
+        .execute(&mut *txn)
+        .await
+        .wrap_err("inserting override file sources")?;
+    }
+
+    Ok(())
+}
+
+fn default_external_license_attribution(
+    status: ApprovalType,
+    link: Option<String>,
+) -> Option<serde_json::Value> {
+    match status {
+        ApprovalType::Yes
+        | ApprovalType::WithAttributionAndSource
+        | ApprovalType::WithAttribution => link
+            .and_then(|link| url::Url::parse(&link).ok())
+            .and_then(|link_to_work| {
+                serde_json::to_value(AttributionResolution {
+                    kind: AttributionResolutionKind::GloballyAllowed {
+                        link_to_work,
+                    },
+                    moderation_status: None,
+                    notes: String::new(),
+                    image_urls: Vec::new(),
+                })
+                .ok()
+            }),
+        ApprovalType::No => serde_json::to_value(AttributionResolution {
+            kind: AttributionResolutionKind::NoPermission,
+            moderation_status: None,
+            notes: String::new(),
+            image_urls: Vec::new(),
+        })
+        .ok(),
+        ApprovalType::PermanentNo | ApprovalType::Unidentified => None,
+    }
+}
+
+async fn resolve_overrides(
+    overrides: &[OverrideFile],
+    redis: &RedisPool,
+    txn: &mut PgTransaction<'_>,
+) -> Result<HashMap<String, OverrideResolution>> {
+    let mut results: HashMap<String, OverrideResolution> = HashMap::new();
+    let mut remaining: Vec<usize> = (0..overrides.len()).collect();
+
+    if overrides.is_empty() {
+        return Ok(results);
+    }
+
+    let hashes: Vec<String> =
+        overrides.iter().map(|x| x.sha1.clone()).collect();
+    let files = DBVersion::get_files_from_hash(
+        "sha1".to_string(),
+        &hashes,
+        &mut *txn,
+        redis,
+    )
+    .await
+    .wrap_err("fetching files on platform by hash")?;
+
+    let version_ids: Vec<_> = files.iter().map(|x| x.version_id).collect();
+    let versions_data = DBVersion::get_many(&version_ids, &mut *txn, redis)
+        .await
+        .wrap_err("fetching versions")?;
+
+    for file in &files {
+        if !versions_data.iter().any(|v| v.inner.id == file.version_id) {
+            continue;
+        }
+
+        if let Some(hash) = file.hashes.get("sha1")
+            && let Some(pos) =
+                remaining.iter().position(|i| overrides[*i].sha1 == *hash)
+        {
+            let idx = remaining.remove(pos);
+            results.insert(
+                overrides[idx].sha1.clone(),
+                OverrideResolution::OnModrinth,
+            );
+        }
+    }
+
+    if remaining.is_empty() {
+        return Ok(results);
+    }
+
+    let rows = sqlx::query!(
+        "
+        SELECT encode(mef.sha1, 'escape') sha1, mel.id, mel.status status, mel.link
+        FROM moderation_external_files mef
+        INNER JOIN moderation_external_licenses mel ON mef.external_license_id = mel.id
+        WHERE mef.sha1 = ANY($1)
+        ",
+        &remaining
+            .iter()
+            .map(|i| overrides[*i].sha1.as_bytes().to_vec())
+            .collect::<Vec<_>>()
+    )
+    .fetch_all(&mut *txn)
+    .await
+    .wrap_err("fetching external file licenses")?;
+
+    for row in rows {
+        if let Some(sha1) = row.sha1
+            && let Some(pos) =
+                remaining.iter().position(|i| overrides[*i].sha1 == sha1)
+        {
+            let idx = remaining.remove(pos);
+            results.insert(
+                overrides[idx].sha1.clone(),
+                OverrideResolution::ExternalLicense {
+                    id: row.id,
+                    status: ApprovalType::from_string(&row.status)
+                        .unwrap_or(ApprovalType::Unidentified),
+                    link: row.link,
+                },
+            );
+        }
+    }
+
+    if remaining.is_empty() {
+        return Ok(results);
+    }
+
+    let fingerprints: Vec<u32> =
+        remaining.iter().map(|i| overrides[*i].murmur2).collect();
+    let res = HTTP_CLIENT
+        .post(format!("{}/v1/fingerprints", ENV.FLAME_ANVIL_URL))
+        .json(&serde_json::json!({
+            "fingerprints": fingerprints
+        }))
+        .send()
+        .await;
+
+    if let Err(e) = &res {
+        warn!("Flame fingerprint request failed: {e}");
+    }
+
+    if let Ok(res) = res {
+        let body = res
+            .text()
+            .await
+            .wrap_err("reading Flame fingerprint response")?;
+
+        let flame_files: Vec<_> =
+            serde_json::from_str::<FlameResponse<FingerprintResponse>>(&body)
+                .ok()
+                .map(|x| {
+                    x.data
+                        .exact_matches
+                        .into_iter()
+                        .map(|m| m.file)
+                        .collect::<Vec<_>>()
+                })
+                .unwrap_or_default();
+
+        let mut flame_matches: Vec<(String, u32)> = Vec::new();
+        for flame_file in &flame_files {
+            if let Some(hash) = flame_file
+                .hashes
+                .iter()
+                .find(|x| x.algo == 1)
+                .map(|x| x.value.clone())
+            {
+                flame_matches.push((hash, flame_file.mod_id));
+            }
+        }
+
+        let rows = sqlx::query!(
+            "
+            SELECT mel.id, mel.flame_project_id, mel.status status, mel.link
+            FROM moderation_external_licenses mel
+            WHERE mel.flame_project_id = ANY($1)
+            ",
+            &flame_matches.iter().map(|x| x.1 as i32).collect::<Vec<_>>()
+        )
+        .fetch_all(&mut *txn)
+        .await
+        .wrap_err("fetching Flame project licenses")?;
+
+        let mut insert_hashes = Vec::new();
+        let mut insert_filenames = Vec::new();
+        let mut insert_ids = Vec::new();
+
+        for row in &rows {
+            if let Some((curse_idx, (hash, _))) = flame_matches
+                .iter()
+                .enumerate()
+                .find(|(_, x)| Some(x.1 as i32) == row.flame_project_id)
+                && let Some(remaining_pos) =
+                    remaining.iter().position(|i| overrides[*i].sha1 == *hash)
+            {
+                let idx = remaining.remove(remaining_pos);
+
+                results.insert(
+                    overrides[idx].sha1.clone(),
+                    OverrideResolution::ExternalLicense {
+                        id: row.id,
+                        status: ApprovalType::from_string(&row.status)
+                            .unwrap_or(ApprovalType::Unidentified),
+                        link: row.link.clone(),
+                    },
+                );
+
+                insert_hashes.push(overrides[idx].sha1.as_bytes().to_vec());
+                insert_filenames.push(Some(overrides[idx].path.clone()));
+                insert_ids.push(row.id);
+
+                flame_matches.remove(curse_idx);
+            }
+        }
+
+        if !insert_hashes.is_empty() {
+            ExternalLicense::insert_files(
+                &mut *txn,
+                &insert_hashes,
+                &insert_filenames,
+                &insert_ids,
+                DBUserId(0),
+            )
+            .await
+            .wrap_err("inserting external license files")?;
+        }
+
+        if !flame_matches.is_empty() {
+            let flame_projects_res = HTTP_CLIENT
+                .post(format!("{}/v1/mods", ENV.FLAME_ANVIL_URL))
+                .json(&serde_json::json!({
+                    "modIds": flame_matches.iter().map(|x| x.1).collect::<Vec<_>>()
+                }))
+                .send()
+                .await;
+
+            let flame_projects = match flame_projects_res {
+                Ok(res) => res
+                    .text()
+                    .await
+                    .ok()
+                    .and_then(|t| {
+                        serde_json::from_str::<
+                                FlameResponse<Vec<FlameProject>>,
+                            >(&t)
+                            .ok()
+                    })
+                    .map(|x| x.data)
+                    .unwrap_or_default(),
+                Err(e) => {
+                    warn!("Flame projects request failed: {e}");
+                    Vec::new()
+                }
+            };
+
+            for (sha1, flame_project_id) in &flame_matches {
+                if let Some(pos) =
+                    remaining.iter().position(|i| overrides[*i].sha1 == *sha1)
+                {
+                    let idx = remaining.remove(pos);
+
+                    let project = flame_projects
+                        .iter()
+                        .find(|p| p.id == *flame_project_id);
+
+                    results.insert(
+                        overrides[idx].sha1.clone(),
+                        OverrideResolution::Flame {
+                            project_id: *flame_project_id,
+                            title: project
+                                .map(|p| p.name.clone())
+                                .unwrap_or_else(|| {
+                                    format!("Flame project {flame_project_id}")
+                                }),
+                            url: project
+                                .map(|p| p.links.website_url.clone())
+                                .unwrap_or_default(),
+                            icon_url: project
+                                .map(|p| p.logo.thumbnail_url.clone())
+                                .unwrap_or_default(),
+                        },
+                    );
+                }
+            }
+        }
+    }
+
+    for idx in remaining {
+        results
+            .insert(overrides[idx].sha1.clone(), OverrideResolution::Unknown);
+    }
+
+    Ok(results)
+}
+
+fn hash_flame_murmur32(input: Vec<u8>) -> u32 {
+    murmur2::murmur2(
+        &input
+            .into_iter()
+            .filter(|x| *x != 9 && *x != 10 && *x != 13 && *x != 32)
+            .collect::<Vec<u8>>(),
+        1,
+    )
+}
+
+pub async fn get_files_missing_attribution<'a, E>(
+    exec: E,
+    version_ids: &[DBVersionId],
+) -> Result<
+    std::collections::HashMap<
+        DBVersionId,
+        Vec<(DBFileId, Option<AttributionFlameProject>)>,
+    >,
+>
+where
+    E: sqlx::Executor<'a, Database = sqlx::Postgres>,
+{
+    if version_ids.is_empty() {
+        return Ok(std::collections::HashMap::new());
+    }
+
+    let rows = sqlx::query!(
+        r#"
+        select distinct f.version_id as "version_id: DBVersionId", f.id as "file_id: DBFileId",
+            pag.flame_project
+        from files f
+        inner join attribution_enforced_versions aev on aev.id = f.version_id
+        inner join override_file_sources ofs on ofs.file_id = f.id
+        inner join project_attribution_files paf on paf.sha1 = ofs.sha1
+        inner join project_attribution_groups pag on pag.id = paf.group_id
+        where f.version_id = ANY($1)
+          and (
+            pag.attribution is null
+            or pag.attribution->>'kind' = 'no_permission'
+            or (
+              pag.attribution->'moderation_status' is not null
+              and pag.attribution->'moderation_status'->>'kind' != 'approved'
+            )
+          )
+        "#,
+        &version_ids.iter().map(|v| v.0).collect::<Vec<_>>(),
+    )
+    .fetch_all(exec)
+    .await
+    .wrap_err("fetching files missing attribution")?;
+
+    let mut result = std::collections::HashMap::new();
+    for row in rows {
+        let flame_project = row
+            .flame_project
+            .and_then(|v| serde_json::from_value(v).ok());
+        result
+            .entry(row.version_id)
+            .or_insert_with(Vec::new)
+            .push((row.file_id, flame_project));
+    }
+
+    Ok(result)
+}
+
+pub struct DependencyAttributionData {
+    pub link: Option<String>,
+    pub icon_url: Option<String>,
+    pub license: Option<serde_json::Value>,
+}
+
+pub async fn get_dependency_attributions<'a, E>(
+    exec: E,
+    version_ids: &[DBVersionId],
+) -> Result<HashMap<(DBVersionId, String), DependencyAttributionData>>
+where
+    E: sqlx::Executor<'a, Database = sqlx::Postgres>,
+{
+    if version_ids.is_empty() {
+        return Ok(HashMap::new());
+    }
+
+    let version_ids_vec: Vec<_> = version_ids.iter().map(|v| v.0).collect();
+
+    let rows = sqlx::query!(
+        r#"
+        select
+            d.dependent_id as "version_id: DBVersionId",
+            d.dependency_file_name as "file_name!",
+            pag.attribution,
+            pag.flame_project,
+            pag.project_id as "project_id: DBProjectId"
+        from dependencies d
+        inner join files f on f.version_id = d.dependent_id
+        inner join attribution_enforced_versions aev on aev.id = f.version_id
+        inner join override_file_sources ofs on ofs.file_id = f.id
+        inner join project_attribution_files paf on paf.sha1 = ofs.sha1
+        inner join project_attribution_groups pag on pag.id = paf.group_id
+        where d.dependent_id = ANY($1)
+          and d.dependency_file_name is not null
+          and pag.attribution is not null
+          and pag.attribution->>'kind' not in ('no_permission')
+          and (
+            pag.attribution->'moderation_status' is null
+            or pag.attribution->'moderation_status'->>'kind' = 'approved'
+          )
+          and split_part(paf.name, '/', -1) = d.dependency_file_name
+        "#,
+        &version_ids_vec,
+    )
+    .fetch_all(exec)
+    .await
+    .wrap_err("fetching dependency attributions")?;
+
+    let mut result = HashMap::new();
+    for row in rows {
+        let file_name = row.file_name;
+
+        let attribution: Option<AttributionResolution> =
+            row.attribution.and_then(|v| serde_json::from_value(v).ok());
+
+        let flame_project: Option<AttributionFlameProject> = row
+            .flame_project
+            .and_then(|v| serde_json::from_value(v).ok());
+
+        let link = attribution
+            .as_ref()
+            .and_then(|a| match &a.kind {
+                AttributionResolutionKind::License { link_to_work, .. } => {
+                    Some(link_to_work.to_string())
+                }
+                AttributionResolutionKind::GloballyAllowed { link_to_work } => {
+                    Some(link_to_work.to_string())
+                }
+                AttributionResolutionKind::SpecialPermissions {
+                    link_to_work,
+                } => Some(link_to_work.to_string()),
+                _ => None,
+            })
+            .or(flame_project.as_ref().map(|fp| fp.url.clone()));
+
+        let icon_url = flame_project.as_ref().map(|fp| fp.icon_url.clone());
+
+        let license = attribution
+            .as_ref()
+            .and_then(|a| match &a.kind {
+                AttributionResolutionKind::License { license, .. } => {
+                    Some(serde_json::to_value(license).ok())
+                }
+                _ => None,
+            })
+            .flatten();
+
+        result.insert(
+            (row.version_id, file_name),
+            DependencyAttributionData {
+                link,
+                icon_url,
+                license,
+            },
+        );
+    }
+
+    Ok(result)
+}
diff --git a/apps/labrinth/src/queue/mod.rs b/apps/labrinth/src/queue/mod.rs
index 666670dc0b..0d7dcb273b 100644
--- a/apps/labrinth/src/queue/mod.rs
+++ b/apps/labrinth/src/queue/mod.rs
@@ -1,6 +1,7 @@
 pub mod analytics;
 pub mod billing;
 pub mod email;
+pub mod file_scan;
 pub mod moderation;
 pub mod payouts;
 pub mod server_ping;
diff --git a/apps/labrinth/src/queue/moderation.rs b/apps/labrinth/src/queue/moderation.rs
index 7d852f4eb3..1914f80359 100644
--- a/apps/labrinth/src/queue/moderation.rs
+++ b/apps/labrinth/src/queue/moderation.rs
@@ -570,7 +570,7 @@ impl AutomatedModerationQueue {
                                             Vec::new()
                                         } else {
                                             let res = client
-                                                .post(format!("{}v1/mods", ENV.FLAME_ANVIL_URL))
+                                                .post(format!("{}/v1/mods", ENV.FLAME_ANVIL_URL))
                                             .json(&serde_json::json!({
                                                 "modIds": flame_files.iter().map(|x| x.1).collect::<Vec<_>>()
                                             }))
@@ -823,7 +823,7 @@ pub enum ApprovalType {
 }
 
 impl ApprovalType {
-    fn approved(&self) -> bool {
+    pub fn approved(&self) -> bool {
         match self {
             ApprovalType::Yes => true,
             ApprovalType::WithAttributionAndSource => true,
@@ -901,6 +901,13 @@ pub struct FlameProject {
     pub name: String,
     pub slug: String,
     pub links: FlameLinks,
+    pub logo: FlameLogo,
+}
+
+#[derive(Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct FlameLogo {
+    pub thumbnail_url: String,
 }
 
 #[derive(Deserialize, Serialize)]
diff --git a/apps/labrinth/src/routes/internal/attribution.rs b/apps/labrinth/src/routes/internal/attribution.rs
new file mode 100644
index 0000000000..4e7fb5558d
--- /dev/null
+++ b/apps/labrinth/src/routes/internal/attribution.rs
@@ -0,0 +1,606 @@
+use actix_web::{HttpRequest, get, patch, post, web};
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use sqlx::Row;
+
+use crate::auth::get_user_from_headers;
+use crate::database::PgPool;
+use crate::database::models::ids::{
+    DBAttributionGroupId, DBProjectId, generate_attribution_group_id,
+};
+use crate::database::redis::RedisPool;
+use crate::models::ids::{ProjectId, VersionId};
+use crate::models::pats::Scopes;
+use crate::models::projects::{
+    AttributionModerationStatusKind, AttributionResolution,
+    AttributionResolutionKind,
+};
+use crate::models::users::User;
+use crate::queue::moderation::ApprovalType;
+use crate::queue::session::AuthQueue;
+use crate::routes::ApiError;
+
+pub fn config(cfg: &mut utoipa_actix_web::service_config::ServiceConfig) {
+    cfg.service(list)
+        .service(update_group)
+        .service(assign)
+        .service(split);
+}
+
+#[derive(Clone, Serialize, Deserialize)]
+pub struct FlameProject {
+    pub id: u32,
+    pub title: String,
+    pub url: String,
+    pub icon_url: String,
+}
+
+#[derive(Serialize)]
+struct AttributionGroupResponse {
+    id: crate::models::ids::AttributionGroupId,
+    flame_project: Option<FlameProject>,
+    attribution: Option<crate::models::projects::AttributionResolution>,
+    attributed_at: Option<chrono::DateTime<chrono::Utc>>,
+    attributed_by: Option<ariadne::ids::UserId>,
+    files: Vec<AttributionFileResponse>,
+    versions: Vec<VersionInfo>,
+}
+
+#[derive(Clone, Serialize)]
+struct VersionInfo {
+    id: VersionId,
+    name: String,
+    version_number: String,
+    date_created: chrono::DateTime<chrono::Utc>,
+}
+
+#[derive(Serialize)]
+struct AttributionFileResponse {
+    name: String,
+    sha1: String,
+    versions: Vec<VersionId>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    moderation_external_license_id: Option<i64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    moderation_external_license: Option<ModerationExternalLicenseResponse>,
+}
+
+#[derive(Clone, Serialize)]
+struct ModerationExternalLicenseResponse {
+    id: i64,
+    title: Option<String>,
+    status: ApprovalType,
+    link: Option<String>,
+    exceptions: Option<String>,
+    proof: Option<String>,
+    flame_project_id: Option<i32>,
+    inserted_at: Option<DateTime<Utc>>,
+    inserted_by: Option<i64>,
+    updated_at: Option<DateTime<Utc>>,
+    updated_by: Option<i64>,
+}
+
+#[utoipa::path]
+#[get("{project_id}")]
+async fn list(
+    req: HttpRequest,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+    path: web::Path<ProjectId>,
+) -> Result<web::Json<Vec<AttributionGroupResponse>>, ApiError> {
+    let project_id: DBProjectId = path.into_inner().into();
+    let show_moderation_external_license_ids = get_user_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Scopes::PROJECT_READ,
+    )
+    .await
+    .ok()
+    .is_some_and(|(_, user)| user.role.is_mod());
+
+    let groups = sqlx::query!(
+        r#"
+		select
+			g.id as "id: DBAttributionGroupId",
+			g.flame_project,
+			g.attribution,
+			g.attributed_at,
+			g.attributed_by as "attributed_by: i64"
+		from project_attribution_groups g
+		where g.project_id = $1
+		"#,
+        project_id as DBProjectId,
+    )
+    .fetch_all(pool.as_ref())
+    .await?;
+
+    let group_ids: Vec<i64> = groups.iter().map(|g| g.id.0).collect();
+
+    let files = if group_ids.is_empty() {
+        Vec::new()
+    } else {
+        sqlx::query(
+            "
+			select paf.group_id, paf.name, convert_from(paf.sha1, 'UTF8') as sha1, paf.moderation_external_license_id,
+				coalesce(array_agg(distinct aev.id) filter (where aev.id is not null), '{}') as version_ids
+			from project_attribution_files paf
+			left join override_file_sources ofs on ofs.sha1 = paf.sha1
+			left join files f on f.id = ofs.file_id
+			left join attribution_enforced_versions aev on aev.id = f.version_id
+			where paf.group_id = ANY($1)
+			group by paf.group_id, paf.name, paf.sha1, paf.moderation_external_license_id
+			",
+        )
+        .bind(&group_ids)
+        .fetch_all(pool.as_ref())
+        .await?
+    };
+
+    let moderation_external_licenses = if show_moderation_external_license_ids {
+        let mut ids: Vec<i64> = files
+            .iter()
+            .filter_map(|f| f.get("moderation_external_license_id"))
+            .collect();
+        ids.sort_unstable();
+        ids.dedup();
+
+        if ids.is_empty() {
+            std::collections::HashMap::new()
+        } else {
+            sqlx::query!(
+                r#"
+				select
+					id,
+					title,
+					status,
+					link,
+					exceptions,
+					proof,
+					flame_project_id,
+					inserted_at,
+					inserted_by,
+					updated_at,
+					updated_by
+				from moderation_external_licenses
+				where id = ANY($1)
+				"#,
+                &ids,
+            )
+            .fetch_all(pool.as_ref())
+            .await?
+            .into_iter()
+            .map(|row| {
+                (
+                    row.id,
+                    ModerationExternalLicenseResponse {
+                        id: row.id,
+                        title: row.title,
+                        status: ApprovalType::from_string(&row.status)
+                            .unwrap_or(ApprovalType::Unidentified),
+                        link: row.link,
+                        exceptions: row.exceptions,
+                        proof: row.proof,
+                        flame_project_id: row.flame_project_id,
+                        inserted_at: row.inserted_at,
+                        inserted_by: row.inserted_by,
+                        updated_at: row.updated_at,
+                        updated_by: row.updated_by,
+                    },
+                )
+            })
+            .collect()
+        }
+    } else {
+        std::collections::HashMap::new()
+    };
+
+    let mut all_version_ids: Vec<i64> = files
+        .iter()
+        .flat_map(|f| f.get::<Vec<i64>, _>("version_ids"))
+        .collect();
+    all_version_ids.sort_unstable();
+    all_version_ids.dedup();
+
+    let version_infos = if all_version_ids.is_empty() {
+        Vec::new()
+    } else {
+        let rows = sqlx::query!(
+            "
+			select id, name, version_number, date_published
+			from versions
+			where id = ANY($1)
+			order by date_published desc
+			",
+            &all_version_ids,
+        )
+        .fetch_all(pool.as_ref())
+        .await?;
+        rows.into_iter()
+            .map(|v| VersionInfo {
+                id: VersionId(v.id as u64),
+                name: v.name,
+                version_number: v.version_number,
+                date_created: v.date_published,
+            })
+            .collect()
+    };
+    let version_order = version_infos
+        .iter()
+        .enumerate()
+        .map(|(index, version)| (version.id, index))
+        .collect::<std::collections::HashMap<_, _>>();
+
+    let mut result = Vec::new();
+    for group in groups {
+        let group_files: Vec<AttributionFileResponse> = files
+            .iter()
+            .filter(|f| f.get::<i64, _>("group_id") == group.id.0)
+            .map(|f| AttributionFileResponse {
+                name: f.get("name"),
+                sha1: f.get("sha1"),
+                moderation_external_license_id:
+                    if show_moderation_external_license_ids {
+                        f.get("moderation_external_license_id")
+                    } else {
+                        None
+                    },
+                moderation_external_license:
+                    if show_moderation_external_license_ids {
+                        f.get::<Option<i64>, _>(
+                            "moderation_external_license_id",
+                        )
+                        .and_then(|id| {
+                            moderation_external_licenses.get(&id).cloned()
+                        })
+                    } else {
+                        None
+                    },
+                versions: {
+                    let mut versions: Vec<_> = f
+                        .get::<Vec<i64>, _>("version_ids")
+                        .into_iter()
+                        .map(|id| VersionId(id as u64))
+                        .collect();
+                    versions.sort_by_key(|id| {
+                        version_order.get(id).copied().unwrap_or(usize::MAX)
+                    });
+                    versions
+                },
+            })
+            .collect();
+
+        result.push(AttributionGroupResponse {
+            id: group.id.into(),
+            flame_project: group
+                .flame_project
+                .and_then(|v| serde_json::from_value(v).ok()),
+            attribution: group
+                .attribution
+                .and_then(|v| serde_json::from_value(v).ok()),
+            attributed_at: group.attributed_at,
+            attributed_by: group
+                .attributed_by
+                .map(|id| ariadne::ids::UserId(id as u64)),
+            files: group_files,
+            versions: version_infos.clone(),
+        });
+    }
+
+    Ok(web::Json(result))
+}
+
+#[derive(Deserialize, utoipa::ToSchema)]
+struct UpdateGroupBody {
+    attribution: AttributionResolution,
+}
+
+#[utoipa::path]
+#[patch("group/{group_id}")]
+async fn update_group(
+    req: HttpRequest,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+    path: web::Path<i64>,
+    web::Json(body): web::Json<UpdateGroupBody>,
+) -> Result<(), ApiError> {
+    let group_id = path.into_inner();
+    let user = get_user_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Scopes::VERSION_WRITE,
+    )
+    .await?
+    .1;
+
+    if !can_edit_attribution_group(pool.as_ref(), group_id, &user).await? {
+        return Err(ApiError::CustomAuthentication(
+            "This attribution group cannot be edited".to_string(),
+        ));
+    }
+
+    if matches!(
+        body.attribution.kind,
+        AttributionResolutionKind::GloballyAllowed { .. }
+    ) && !user.role.is_mod()
+    {
+        return Err(ApiError::CustomAuthentication(
+            "Only moderators can set globally allowed attributions".to_string(),
+        ));
+    }
+
+    if body.attribution.moderation_status.is_some() && !user.role.is_mod() {
+        return Err(ApiError::CustomAuthentication(
+            "Only moderators can set attribution moderation status".to_string(),
+        ));
+    }
+
+    let result = sqlx::query!(
+        "
+		update project_attribution_groups
+		set attribution = $1, attributed_at = now(), attributed_by = $3
+		where id = $2
+		",
+        &serde_json::to_value(&body.attribution).unwrap_or_default(),
+        group_id,
+        user.id.0 as i64,
+    )
+    .execute(pool.as_ref())
+    .await?;
+
+    if result.rows_affected() == 0 {
+        return Err(ApiError::NotFound);
+    }
+
+    Ok(())
+}
+
+#[derive(Deserialize, utoipa::ToSchema)]
+struct AssignBody {
+    sha1: String,
+    target_group_id: i64,
+    project_id: ProjectId,
+}
+
+#[utoipa::path]
+#[post("assign")]
+async fn assign(
+    req: HttpRequest,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+    web::Json(body): web::Json<AssignBody>,
+) -> Result<(), ApiError> {
+    let user = get_user_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Scopes::VERSION_WRITE,
+    )
+    .await?
+    .1;
+
+    let sha1_bytes = hex_to_bytes(&body.sha1).ok_or_else(|| {
+        ApiError::InvalidInput("invalid sha1 hex string".to_string())
+    })?;
+    let project_id: DBProjectId = body.project_id.into();
+
+    let source_group_id = sqlx::query_scalar!(
+        "
+		select paf.group_id
+		from project_attribution_files paf
+		inner join project_attribution_groups pag on pag.id = paf.group_id
+		where paf.sha1 = $1 and pag.project_id = $2
+		",
+        &sha1_bytes,
+        project_id as DBProjectId,
+    )
+    .fetch_optional(pool.as_ref())
+    .await?
+    .ok_or(ApiError::NotFound)?;
+
+    let target_group_exists = sqlx::query_scalar!(
+        "
+		select exists(
+			select 1 from project_attribution_groups where id = $1 and project_id = $2
+		) as \"exists!\"
+		",
+        body.target_group_id,
+        project_id as DBProjectId,
+    )
+    .fetch_one(pool.as_ref())
+    .await?;
+
+    if !target_group_exists {
+        return Err(ApiError::NotFound);
+    }
+
+    if !can_edit_attribution_group(pool.as_ref(), source_group_id, &user)
+        .await?
+        || !can_edit_attribution_group(
+            pool.as_ref(),
+            body.target_group_id,
+            &user,
+        )
+        .await?
+    {
+        return Err(ApiError::CustomAuthentication(
+            "This attribution group cannot be edited".to_string(),
+        ));
+    }
+
+    let result = sqlx::query!(
+        "
+		update project_attribution_files
+		set group_id = $1
+		where sha1 = $2
+		and group_id in (
+			select id from project_attribution_groups where project_id = $3
+		)
+		",
+        body.target_group_id,
+        &sha1_bytes,
+        project_id as DBProjectId,
+    )
+    .execute(pool.as_ref())
+    .await?;
+
+    if result.rows_affected() == 0 {
+        return Err(ApiError::NotFound);
+    }
+
+    cleanup_empty_groups(pool.as_ref()).await?;
+
+    Ok(())
+}
+
+#[derive(Deserialize, utoipa::ToSchema)]
+struct SplitBody {
+    sha1: String,
+    project_id: ProjectId,
+}
+
+#[utoipa::path]
+#[post("split")]
+async fn split(
+    req: HttpRequest,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+    web::Json(body): web::Json<SplitBody>,
+) -> Result<(), ApiError> {
+    let user = get_user_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Scopes::VERSION_WRITE,
+    )
+    .await?
+    .1;
+
+    let sha1_bytes = hex_to_bytes(&body.sha1).ok_or_else(|| {
+        ApiError::InvalidInput("invalid sha1 hex string".to_string())
+    })?;
+    let project_id: DBProjectId = body.project_id.into();
+
+    let existing = sqlx::query!(
+        "
+		select paf.group_id, paf.name from project_attribution_files paf
+		inner join project_attribution_groups pag on pag.id = paf.group_id
+		where paf.sha1 = $1 and pag.project_id = $2
+		",
+        &sha1_bytes,
+        project_id as DBProjectId,
+    )
+    .fetch_optional(pool.as_ref())
+    .await?;
+
+    let Some(existing) = existing else {
+        return Err(ApiError::NotFound);
+    };
+
+    if !can_edit_attribution_group(pool.as_ref(), existing.group_id, &user)
+        .await?
+    {
+        return Err(ApiError::CustomAuthentication(
+            "This attribution group cannot be edited".to_string(),
+        ));
+    }
+
+    let mut txn = pool.begin().await?;
+
+    let new_group_id = generate_attribution_group_id(&mut txn).await?;
+
+    sqlx::query!(
+        "
+		insert into project_attribution_groups (id, project_id)
+		values ($1, $2)
+		",
+        new_group_id as DBAttributionGroupId,
+        project_id as DBProjectId,
+    )
+    .execute(&mut txn)
+    .await?;
+
+    sqlx::query!(
+        "
+		update project_attribution_files
+		set group_id = $1
+		where sha1 = $2 and group_id = $3
+		",
+        new_group_id as DBAttributionGroupId,
+        &sha1_bytes,
+        existing.group_id,
+    )
+    .execute(&mut txn)
+    .await?;
+
+    txn.commit().await?;
+
+    cleanup_empty_groups(pool.as_ref()).await?;
+
+    Ok(())
+}
+
+async fn can_edit_attribution_group(
+    pool: &PgPool,
+    group_id: i64,
+    user: &User,
+) -> Result<bool, ApiError> {
+    if user.role.is_mod() {
+        return Ok(true);
+    }
+
+    let attribution = sqlx::query_scalar!(
+        "
+		select attribution
+		from project_attribution_groups
+		where id = $1
+		",
+        group_id,
+    )
+    .fetch_optional(pool)
+    .await?
+    .ok_or(ApiError::NotFound)?;
+
+    let attribution: Option<AttributionResolution> =
+        attribution.and_then(|value| serde_json::from_value(value).ok());
+
+    Ok(!matches!(
+        attribution
+            .and_then(|attribution| attribution.moderation_status)
+            .map(|status| status.kind),
+        Some(AttributionModerationStatusKind::NotAllowed)
+    ))
+}
+
+async fn cleanup_empty_groups(pool: &PgPool) -> Result<(), ApiError> {
+    sqlx::query!(
+        "
+		delete from project_attribution_groups g
+		where not exists (
+			select 1 from project_attribution_files f where f.group_id = g.id
+		)
+		",
+    )
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+fn hex_to_bytes(hex: &str) -> Option<Vec<u8>> {
+    if !hex.len().is_multiple_of(2) {
+        return None;
+    }
+    (0..hex.len())
+        .step_by(2)
+        .map(|i| u8::from_str_radix(&hex[i..i + 2], 16).ok())
+        .collect()
+}
diff --git a/apps/labrinth/src/routes/internal/flows.rs b/apps/labrinth/src/routes/internal/flows.rs
index c6b41ba62e..7efa56bc54 100644
--- a/apps/labrinth/src/routes/internal/flows.rs
+++ b/apps/labrinth/src/routes/internal/flows.rs
@@ -38,7 +38,6 @@ use reqwest::header::AUTHORIZATION;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::str::FromStr;
-use std::sync::Arc;
 use tracing::info;
 use validator::Validate;
 use zxcvbn::Score;
@@ -83,7 +82,7 @@ impl TempUser {
         provider: AuthProvider,
         transaction: &mut PgTransaction<'_>,
         client: &PgPool,
-        file_host: &Arc<dyn FileHost + Send + Sync>,
+        file_host: &dyn FileHost,
         redis: &RedisPool,
     ) -> Result<crate::database::models::DBUserId, AuthenticationError> {
         if let Some(email) = &self.email
@@ -150,7 +149,7 @@ impl TempUser {
                     ext,
                     Some(96),
                     Some(1.0),
-                    &**file_host,
+                    file_host,
                 )
                 .await;
 
@@ -1172,7 +1171,7 @@ pub async fn auth_callback(
     req: HttpRequest,
     Query(query): Query<HashMap<String, String>>,
     client: Data<PgPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     redis: Data<RedisPool>,
 ) -> Result<HttpResponse, crate::auth::templates::ErrorPage> {
     let state_string = query
@@ -1330,7 +1329,7 @@ pub async fn auth_callback(
                         provider,
                         &mut transaction,
                         &client,
-                        &file_host,
+                        &**file_host,
                         &redis,
                     )
                     .await?
diff --git a/apps/labrinth/src/routes/internal/mod.rs b/apps/labrinth/src/routes/internal/mod.rs
index eac882c339..94d612d73b 100644
--- a/apps/labrinth/src/routes/internal/mod.rs
+++ b/apps/labrinth/src/routes/internal/mod.rs
@@ -1,5 +1,6 @@
 pub mod admin;
 pub mod affiliate;
+pub mod attribution;
 pub mod billing;
 pub mod delphi;
 pub mod external_notifications;
@@ -99,5 +100,10 @@ pub fn utoipa_config(
         utoipa_actix_web::scope("/_internal/server-ping")
             .wrap(default_cors())
             .configure(server_ping::config),
+    )
+    .service(
+        utoipa_actix_web::scope("/_internal/attribution")
+            .wrap(default_cors())
+            .configure(attribution::config),
     );
 }
diff --git a/apps/labrinth/src/routes/internal/moderation/external_license.rs b/apps/labrinth/src/routes/internal/moderation/external_license.rs
index cbcf03b245..e283e72616 100644
--- a/apps/labrinth/src/routes/internal/moderation/external_license.rs
+++ b/apps/labrinth/src/routes/internal/moderation/external_license.rs
@@ -5,6 +5,8 @@ use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 
 use crate::database::PgPool;
+use crate::database::models::ids::DBUserId;
+use crate::database::models::moderation_external_item::ExternalLicense;
 use crate::database::redis::RedisPool;
 use crate::models::pats::Scopes;
 use crate::queue::moderation::ApprovalType;
@@ -14,7 +16,11 @@ use crate::{auth::check_is_moderator_from_headers, queue::session::AuthQueue};
 pub fn config(cfg: &mut utoipa_actix_web::service_config::ServiceConfig) {
     cfg.service(search)
         .service(get_by_sha1)
-        .service(update_license);
+        .service(get_by_sha1_bulk)
+        .service(lookup)
+        .service(update_license)
+        .service(add_file)
+        .service(reassign_file);
 }
 
 #[derive(Serialize, Deserialize, utoipa::ToSchema)]
@@ -43,6 +49,26 @@ pub struct LinkedFile {
 pub struct SearchRequest {
     pub title: Option<String>,
     pub flame_id: Option<i32>,
+    pub flame_ids: Option<Vec<i32>>,
+}
+
+#[derive(Deserialize, utoipa::ToSchema)]
+pub struct HashLookupRequest {
+    pub hashes: Vec<String>,
+}
+
+#[derive(Deserialize, utoipa::ToSchema)]
+pub struct ExternalLicenseLookupRequest {
+    #[serde(default)]
+    pub flame_ids: Vec<i32>,
+    #[serde(default)]
+    pub hashes: Vec<String>,
+}
+
+#[derive(Serialize, utoipa::ToSchema)]
+pub struct ExternalLicenseLookupResponse {
+    pub flame_ids: HashMap<i32, Vec<ExternalProject>>,
+    pub hashes: HashMap<String, ExternalProject>,
 }
 
 #[derive(Deserialize, utoipa::ToSchema)]
@@ -55,6 +81,32 @@ pub struct UpdateLicenseRequest {
     pub flame_project_id: Option<i32>,
 }
 
+#[derive(Deserialize, utoipa::ToSchema)]
+pub struct FileLicenseRequest {
+    pub hash: String,
+    pub license_id: LicenseId,
+}
+
+#[derive(Deserialize, utoipa::ToSchema)]
+#[serde(untagged)]
+pub enum LicenseId {
+    Number(i64),
+    String(String),
+}
+
+impl LicenseId {
+    fn parse(self) -> Result<i64, ApiError> {
+        match self {
+            LicenseId::Number(id) => Ok(id),
+            LicenseId::String(id) => id.parse().map_err(|_| {
+                ApiError::InvalidInput(
+                    "license_id must be a valid integer".to_string(),
+                )
+            }),
+        }
+    }
+}
+
 struct LicenseRow {
     id: i64,
     title: Option<String>,
@@ -69,6 +121,38 @@ struct LicenseRow {
     updated_by: Option<i64>,
 }
 
+struct LicenseHashRow {
+    hash: Vec<u8>,
+    id: i64,
+    title: Option<String>,
+    status: String,
+    link: Option<String>,
+    exceptions: Option<String>,
+    proof: Option<String>,
+    flame_project_id: Option<i32>,
+    inserted_at: Option<DateTime<Utc>>,
+    inserted_by: Option<i64>,
+    updated_at: Option<DateTime<Utc>>,
+    updated_by: Option<i64>,
+}
+
+fn normalize_sha1_hashes(hashes: &[String]) -> Result<Vec<String>, ApiError> {
+    hashes
+        .iter()
+        .map(|hash| {
+            let hash = hash.trim().to_lowercase();
+            if hash.len() != 40 || !hash.chars().all(|c| c.is_ascii_hexdigit())
+            {
+                return Err(ApiError::InvalidInput(
+                    "hash must be a valid SHA1 hex string".to_string(),
+                ));
+            }
+
+            Ok(hash)
+        })
+        .collect()
+}
+
 impl LicenseRow {
     fn into_external_project(
         self,
@@ -120,12 +204,131 @@ async fn fetch_linked_files(
             .or_default()
             .push(LinkedFile {
                 name: row.filename,
-                sha1: hex::encode(&row.sha1),
+                sha1: String::from_utf8(row.sha1)
+                    .unwrap_or_else(|err| hex::encode(err.into_bytes())),
             });
     }
     Ok(map)
 }
 
+async fn fetch_by_hashes(
+    pool: &PgPool,
+    hashes: &[String],
+) -> Result<HashMap<String, ExternalProject>, ApiError> {
+    if hashes.is_empty() {
+        return Ok(HashMap::new());
+    }
+
+    let hash_bytes = hashes
+        .iter()
+        .map(|hash| hash.as_bytes().to_vec())
+        .collect::<Vec<_>>();
+
+    let rows = sqlx::query_as!(
+        LicenseHashRow,
+        r#"
+        SELECT
+            mef.sha1 hash,
+            mel.id,
+            mel.title,
+            mel.status,
+            mel.link,
+            mel.exceptions,
+            mel.proof,
+            mel.flame_project_id,
+            mel.inserted_at,
+            mel.inserted_by,
+            mel.updated_at,
+            mel.updated_by
+        FROM moderation_external_files mef
+        INNER JOIN moderation_external_licenses mel ON mel.id = mef.external_license_id
+        WHERE mef.sha1 = ANY($1)
+        "#,
+        &hash_bytes,
+    )
+    .fetch_all(pool)
+    .await?;
+
+    let license_ids = rows.iter().map(|row| row.id).collect::<Vec<_>>();
+    let files_map = fetch_linked_files(pool, &license_ids).await?;
+
+    let mut results = HashMap::new();
+    for row in rows {
+        let hash = String::from_utf8(row.hash)
+            .unwrap_or_else(|err| hex::encode(err.into_bytes()));
+        let linked_files = files_map.get(&row.id).cloned().unwrap_or_default();
+        results.insert(
+            hash,
+            LicenseRow {
+                id: row.id,
+                title: row.title,
+                status: row.status,
+                link: row.link,
+                exceptions: row.exceptions,
+                proof: row.proof,
+                flame_project_id: row.flame_project_id,
+                inserted_at: row.inserted_at,
+                inserted_by: row.inserted_by,
+                updated_at: row.updated_at,
+                updated_by: row.updated_by,
+            }
+            .into_external_project(linked_files),
+        );
+    }
+
+    Ok(results)
+}
+
+async fn fetch_by_flame_ids(
+    pool: &PgPool,
+    flame_ids: &[i32],
+) -> Result<HashMap<i32, Vec<ExternalProject>>, ApiError> {
+    if flame_ids.is_empty() {
+        return Ok(HashMap::new());
+    }
+
+    let rows = sqlx::query_as!(
+        LicenseRow,
+        r#"
+        SELECT
+            mel.id,
+            mel.title,
+            mel.status,
+            mel.link,
+            mel.exceptions,
+            mel.proof,
+            mel.flame_project_id,
+            mel.inserted_at,
+            mel.inserted_by,
+            mel.updated_at,
+            mel.updated_by
+        FROM moderation_external_licenses mel
+        WHERE mel.flame_project_id = ANY($1)
+        ORDER BY mel.id
+        "#,
+        flame_ids,
+    )
+    .fetch_all(pool)
+    .await?;
+
+    let license_ids = rows.iter().map(|row| row.id).collect::<Vec<_>>();
+    let files_map = fetch_linked_files(pool, &license_ids).await?;
+
+    let mut results: HashMap<i32, Vec<ExternalProject>> = HashMap::new();
+    for row in rows {
+        if let Some(flame_project_id) = row.flame_project_id {
+            let linked_files =
+                files_map.get(&row.id).cloned().unwrap_or_default();
+            results
+                .entry(flame_project_id)
+                .or_default()
+                .push(row.into_external_project(linked_files));
+        }
+    }
+
+    Ok(results)
+}
+
 #[utoipa::path]
 #[post("/search")]
 async fn search(
@@ -144,7 +347,8 @@ async fn search(
     )
     .await?;
 
-    let rows = sqlx::query!(
+    let rows = sqlx::query_as!(
+        LicenseRow,
         r#"
         SELECT
             mel.id,
@@ -160,11 +364,16 @@ async fn search(
             mel.updated_by
         FROM moderation_external_licenses mel
         WHERE ($1::text IS NULL OR mel.title ILIKE '%' || $1 || '%')
-          AND ($2::integer IS NULL OR mel.flame_project_id = $2)
+          AND (
+            ($2::integer IS NULL AND $3::integer[] IS NULL)
+            OR mel.flame_project_id = $2
+            OR mel.flame_project_id = ANY($3)
+          )
         ORDER BY mel.id
         "#,
         body.title,
         body.flame_id,
+        body.flame_ids.as_deref(),
     )
     .fetch_all(&**pool)
     .await?;
@@ -177,26 +386,42 @@ async fn search(
         .map(|row| {
             let linked_files =
                 files_map.get(&row.id).cloned().unwrap_or_default();
-            LicenseRow {
-                id: row.id,
-                title: row.title,
-                status: row.status,
-                link: row.link,
-                exceptions: row.exceptions,
-                proof: row.proof,
-                flame_project_id: row.flame_project_id,
-                inserted_at: row.inserted_at,
-                inserted_by: row.inserted_by,
-                updated_at: row.updated_at,
-                updated_by: row.updated_by,
-            }
-            .into_external_project(linked_files)
+            row.into_external_project(linked_files)
         })
         .collect();
 
     Ok(web::Json(results))
 }
 
+#[utoipa::path]
+#[post("/lookup")]
+async fn lookup(
+    req: HttpRequest,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+    body: web::Json<ExternalLicenseLookupRequest>,
+) -> Result<web::Json<ExternalLicenseLookupResponse>, ApiError> {
+    check_is_moderator_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Scopes::PROJECT_READ,
+    )
+    .await?;
+
+    let body = body.into_inner();
+    let hashes = normalize_sha1_hashes(&body.hashes)?;
+    let flame_ids = fetch_by_flame_ids(&pool, &body.flame_ids).await?;
+    let hashes = fetch_by_hashes(&pool, &hashes).await?;
+
+    Ok(web::Json(ExternalLicenseLookupResponse {
+        flame_ids,
+        hashes,
+    }))
+}
+
 #[utoipa::path]
 #[get("/by-sha1/{sha1}")]
 async fn get_by_sha1(
@@ -215,48 +440,139 @@ async fn get_by_sha1(
     )
     .await?;
 
-    let sha1 = path.into_inner().0;
+    let hashes = normalize_sha1_hashes(&[path.into_inner().0])?;
+    let hash = hashes.first().ok_or(ApiError::NotFound)?;
+    let mut results = fetch_by_hashes(&pool, &hashes).await?;
+    let result = results.remove(hash).ok_or(ApiError::NotFound)?;
+
+    Ok(web::Json(result))
+}
+
+#[utoipa::path]
+#[post("/by-sha1")]
+async fn get_by_sha1_bulk(
+    req: HttpRequest,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+    body: web::Json<HashLookupRequest>,
+) -> Result<web::Json<HashMap<String, ExternalProject>>, ApiError> {
+    check_is_moderator_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Scopes::PROJECT_READ,
+    )
+    .await?;
+
+    let hashes = normalize_sha1_hashes(&body.hashes)?;
+    let results = fetch_by_hashes(&pool, &hashes).await?;
+
+    Ok(web::Json(results))
+}
+
+#[utoipa::path]
+#[post("/file")]
+async fn add_file(
+    req: HttpRequest,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+    body: web::Json<FileLicenseRequest>,
+) -> Result<web::Json<ExternalProject>, ApiError> {
+    upsert_file_license(req, pool, redis, session_queue, body).await
+}
+
+#[utoipa::path]
+#[post("/file/reassign")]
+async fn reassign_file(
+    req: HttpRequest,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+    body: web::Json<FileLicenseRequest>,
+) -> Result<web::Json<ExternalProject>, ApiError> {
+    upsert_file_license(req, pool, redis, session_queue, body).await
+}
+
+async fn upsert_file_license(
+    req: HttpRequest,
+    pool: web::Data<PgPool>,
+    redis: web::Data<RedisPool>,
+    session_queue: web::Data<AuthQueue>,
+    body: web::Json<FileLicenseRequest>,
+) -> Result<web::Json<ExternalProject>, ApiError> {
+    let user = check_is_moderator_from_headers(
+        &req,
+        &**pool,
+        &redis,
+        &session_queue,
+        Scopes::PROJECT_READ,
+    )
+    .await?;
+
+    let body = body.into_inner();
+    let license_id = body.license_id.parse()?;
+    let hash = body.hash.trim();
+    if hash.len() != 40 || !hash.chars().all(|c| c.is_ascii_hexdigit()) {
+        return Err(ApiError::InvalidInput(
+            "hash must be a valid SHA1 hex string".to_string(),
+        ));
+    }
+
+    let mut transaction = pool.begin().await?;
 
-    let row = sqlx::query!(
+    let license = sqlx::query!(
         r#"
         SELECT
-            mel.id,
-            mel.title,
-            mel.status,
-            mel.link,
-            mel.exceptions,
-            mel.proof,
-            mel.flame_project_id,
-            mel.inserted_at,
-            mel.inserted_by,
-            mel.updated_at,
-            mel.updated_by
-        FROM moderation_external_files mef
-        INNER JOIN moderation_external_licenses mel ON mel.id = mef.external_license_id
-        WHERE mef.sha1 = $1
+            id,
+            title,
+            status,
+            link,
+            exceptions,
+            proof,
+            flame_project_id,
+            inserted_at,
+            inserted_by,
+            updated_at,
+            updated_by
+        FROM moderation_external_licenses
+        WHERE id = $1
         "#,
-        sha1.as_bytes().to_vec(),
+        license_id,
     )
-    .fetch_optional(&**pool)
+    .fetch_optional(&mut transaction)
     .await?
     .ok_or(ApiError::NotFound)?;
 
-    let files_map = fetch_linked_files(&pool, &[row.id]).await?;
-    let linked_files = files_map.get(&row.id).cloned().unwrap_or_default();
+    ExternalLicense::insert_files(
+        &mut transaction,
+        &[hash.as_bytes().to_vec()],
+        &[None],
+        &[license_id],
+        DBUserId(user.id.0 as i64),
+    )
+    .await?;
+
+    transaction.commit().await?;
+
+    let files_map = fetch_linked_files(&pool, &[license_id]).await?;
+    let linked_files = files_map.get(&license_id).cloned().unwrap_or_default();
 
     Ok(web::Json(
         LicenseRow {
-            id: row.id,
-            title: row.title,
-            status: row.status,
-            link: row.link,
-            exceptions: row.exceptions,
-            proof: row.proof,
-            flame_project_id: row.flame_project_id,
-            inserted_at: row.inserted_at,
-            inserted_by: row.inserted_by,
-            updated_at: row.updated_at,
-            updated_by: row.updated_by,
+            id: license.id,
+            title: license.title,
+            status: license.status,
+            link: license.link,
+            exceptions: license.exceptions,
+            proof: license.proof,
+            flame_project_id: license.flame_project_id,
+            inserted_at: license.inserted_at,
+            inserted_by: license.inserted_by,
+            updated_at: license.updated_at,
+            updated_by: license.updated_by,
         }
         .into_external_project(linked_files),
     ))
diff --git a/apps/labrinth/src/routes/internal/moderation/tech_review.rs b/apps/labrinth/src/routes/internal/moderation/tech_review.rs
index d201f081e1..491836e446 100644
--- a/apps/labrinth/src/routes/internal/moderation/tech_review.rs
+++ b/apps/labrinth/src/routes/internal/moderation/tech_review.rs
@@ -289,13 +289,13 @@ async fn get_report(
                 'flag_reason', 'delphi',
                 'download_url', f.url,
                 -- TODO: replace with `json_array` in Postgres 16
-                'issues', (
-                    SELECT json_agg(
-                        to_jsonb(dri)
-                        || jsonb_build_object(
-                            -- TODO: replace with `json_array` in Postgres 16
-                            'details', (
-                                SELECT coalesce(jsonb_agg(
+				'issues', (
+					SELECT coalesce(json_agg(
+						to_jsonb(dri)
+						|| jsonb_build_object(
+							-- TODO: replace with `json_array` in Postgres 16
+							'details', (
+								SELECT coalesce(jsonb_agg(
                                     jsonb_build_object(
                                         'id', didws.id,
                                         'issue_id', didws.issue_id,
@@ -310,11 +310,11 @@ async fn get_report(
                                 FROM delphi_issue_details_with_statuses didws
                                 WHERE didws.issue_id = dri.id
                             )
-                        )
-                    )
-                    FROM delphi_report_issues dri
-                    WHERE
-                        dri.report_id = dr.id
+						)
+					), '[]'::json)
+					FROM delphi_report_issues dri
+					WHERE
+						dri.report_id = dr.id
                         -- see delphi.rs todo comment
                         AND dri.issue_type != '__dummy'
                 )
diff --git a/apps/labrinth/src/routes/v2/project_creation.rs b/apps/labrinth/src/routes/v2/project_creation.rs
index dd14c32bdd..aa8e491229 100644
--- a/apps/labrinth/src/routes/v2/project_creation.rs
+++ b/apps/labrinth/src/routes/v2/project_creation.rs
@@ -20,7 +20,6 @@ use serde::{Deserialize, Serialize};
 use serde_json::json;
 
 use std::collections::HashMap;
-use std::sync::Arc;
 use validator::Validate;
 
 use super::version_creation::InitialVersionData;
@@ -158,7 +157,7 @@ pub async fn project_create(
     payload: Multipart,
     client: Data<PgPool>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     session_queue: Data<AuthQueue>,
     http: Data<HttpClient>,
 ) -> Result<HttpResponse, CreateError> {
diff --git a/apps/labrinth/src/routes/v2/projects.rs b/apps/labrinth/src/routes/v2/projects.rs
index ab24386b8e..46aa924162 100644
--- a/apps/labrinth/src/routes/v2/projects.rs
+++ b/apps/labrinth/src/routes/v2/projects.rs
@@ -18,7 +18,6 @@ use crate::search::{SearchBackend, SearchRequest};
 use actix_web::{HttpRequest, HttpResponse, delete, get, patch, post, web};
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
-use std::sync::Arc;
 use validator::Validate;
 
 pub fn config(cfg: &mut utoipa_actix_web::service_config::ServiceConfig) {
@@ -924,7 +923,7 @@ pub async fn project_icon_edit(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -964,7 +963,7 @@ pub async fn delete_project_icon(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     // Returns NoContent, so no need to convert
@@ -1055,7 +1054,7 @@ pub async fn add_gallery_item(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -1198,7 +1197,7 @@ pub async fn delete_gallery_item(
     web::Query(item): web::Query<GalleryDeleteQuery>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     // Returns NoContent, so no need to convert
diff --git a/apps/labrinth/src/routes/v2/threads.rs b/apps/labrinth/src/routes/v2/threads.rs
index 51145e709e..e04a369cc5 100644
--- a/apps/labrinth/src/routes/v2/threads.rs
+++ b/apps/labrinth/src/routes/v2/threads.rs
@@ -1,5 +1,3 @@
-use std::sync::Arc;
-
 use crate::database::PgPool;
 use crate::database::redis::RedisPool;
 use crate::file_hosting::FileHost;
@@ -169,7 +167,7 @@ pub async fn message_delete(
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
     session_queue: web::Data<AuthQueue>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
 ) -> Result<HttpResponse, ApiError> {
     // Returns NoContent, so we don't need to convert the response
     v3::threads::message_delete(
diff --git a/apps/labrinth/src/routes/v2/users.rs b/apps/labrinth/src/routes/v2/users.rs
index 79f5bc9e6e..961e91dad1 100644
--- a/apps/labrinth/src/routes/v2/users.rs
+++ b/apps/labrinth/src/routes/v2/users.rs
@@ -11,7 +11,6 @@ use crate::queue::session::AuthQueue;
 use crate::routes::{ApiError, v2_reroute, v3};
 use actix_web::{HttpRequest, HttpResponse, delete, get, patch, web};
 use serde::{Deserialize, Serialize};
-use std::sync::Arc;
 use validator::Validate;
 
 pub fn config(cfg: &mut utoipa_actix_web::service_config::ServiceConfig) {
@@ -299,7 +298,7 @@ pub async fn user_icon_edit(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -339,7 +338,7 @@ pub async fn user_icon_delete(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     // Returns NoContent, so we don't need to convert to V2
diff --git a/apps/labrinth/src/routes/v2/version_creation.rs b/apps/labrinth/src/routes/v2/version_creation.rs
index 3a21183ba4..bd37a55a96 100644
--- a/apps/labrinth/src/routes/v2/version_creation.rs
+++ b/apps/labrinth/src/routes/v2/version_creation.rs
@@ -21,7 +21,6 @@ use actix_web::{HttpRequest, HttpResponse, post, web};
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use std::collections::HashMap;
-use std::sync::Arc;
 use validator::Validate;
 
 pub fn default_requested_status() -> VersionStatus {
@@ -99,7 +98,7 @@ pub async fn version_create(
     payload: Multipart,
     client: Data<PgPool>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     session_queue: Data<AuthQueue>,
     moderation_queue: Data<AutomatedModerationQueue>,
     http: Data<HttpClient>,
@@ -327,7 +326,7 @@ pub async fn upload_file_to_version(
     payload: Multipart,
     client: Data<PgPool>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
     http: web::Data<HttpClient>,
 ) -> Result<HttpResponse, CreateError> {
diff --git a/apps/labrinth/src/routes/v3/collections.rs b/apps/labrinth/src/routes/v3/collections.rs
index cbf75477a0..605f857065 100644
--- a/apps/labrinth/src/routes/v3/collections.rs
+++ b/apps/labrinth/src/routes/v3/collections.rs
@@ -25,7 +25,6 @@ use chrono::Utc;
 use eyre::eyre;
 use itertools::Itertools;
 use serde::{Deserialize, Serialize};
-use std::sync::Arc;
 use validator::Validate;
 
 pub fn config(cfg: &mut web::ServiceConfig) {
@@ -390,7 +389,7 @@ pub async fn collection_icon_edit(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     mut payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -423,7 +422,7 @@ pub async fn collection_icon_edit(
         collection_item.icon_url,
         collection_item.raw_icon_url,
         FileHostPublicity::Public,
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -442,7 +441,7 @@ pub async fn collection_icon_edit(
         &ext.ext,
         Some(96),
         Some(1.0),
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -474,7 +473,7 @@ pub async fn delete_collection_icon(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     let user = get_user_from_headers(
@@ -505,7 +504,7 @@ pub async fn delete_collection_icon(
         collection_item.icon_url,
         collection_item.raw_icon_url,
         FileHostPublicity::Public,
-        &***file_host,
+        &**file_host,
     )
     .await?;
     let mut transaction = pool.begin().await?;
diff --git a/apps/labrinth/src/routes/v3/images.rs b/apps/labrinth/src/routes/v3/images.rs
index efeb59a838..d00e03946c 100644
--- a/apps/labrinth/src/routes/v3/images.rs
+++ b/apps/labrinth/src/routes/v3/images.rs
@@ -1,5 +1,3 @@
-use std::sync::Arc;
-
 use super::threads::is_authorized_thread;
 use crate::auth::checks::{is_team_member_project, is_team_member_version};
 use crate::auth::get_user_from_headers;
@@ -41,7 +39,7 @@ pub struct ImageUpload {
 pub async fn images_add(
     req: HttpRequest,
     web::Query(data): web::Query<ImageUpload>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     mut payload: web::Payload,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
@@ -191,7 +189,7 @@ pub async fn images_add(
         &data.ext,
         None,
         None,
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
diff --git a/apps/labrinth/src/routes/v3/oauth_clients.rs b/apps/labrinth/src/routes/v3/oauth_clients.rs
index adcb4e477e..7c16ea141d 100644
--- a/apps/labrinth/src/routes/v3/oauth_clients.rs
+++ b/apps/labrinth/src/routes/v3/oauth_clients.rs
@@ -1,4 +1,4 @@
-use std::{collections::HashSet, fmt::Display, sync::Arc};
+use std::{collections::HashSet, fmt::Display};
 
 use super::ApiError;
 use crate::database::{PgPool, PgTransaction};
@@ -354,7 +354,7 @@ pub async fn oauth_client_icon_edit(
     client_id: web::Path<OAuthClientId>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     mut payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -382,7 +382,7 @@ pub async fn oauth_client_icon_edit(
         client.icon_url.clone(),
         client.raw_icon_url.clone(),
         FileHostPublicity::Public,
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -399,7 +399,7 @@ pub async fn oauth_client_icon_edit(
         &ext.ext,
         Some(96),
         Some(1.0),
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -424,7 +424,7 @@ pub async fn oauth_client_icon_delete(
     client_id: web::Path<OAuthClientId>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     let user = get_user_from_headers(
@@ -450,7 +450,7 @@ pub async fn oauth_client_icon_delete(
         client.icon_url.clone(),
         client.raw_icon_url.clone(),
         FileHostPublicity::Public,
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
diff --git a/apps/labrinth/src/routes/v3/organizations.rs b/apps/labrinth/src/routes/v3/organizations.rs
index 838f47c9a4..a45805eab9 100644
--- a/apps/labrinth/src/routes/v3/organizations.rs
+++ b/apps/labrinth/src/routes/v3/organizations.rs
@@ -1,5 +1,4 @@
 use std::collections::HashMap;
-use std::sync::Arc;
 
 use super::ApiError;
 use crate::auth::checks::is_visible_organization;
@@ -1158,7 +1157,7 @@ pub async fn organization_icon_edit(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     mut payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -1209,7 +1208,7 @@ pub async fn organization_icon_edit(
         organization_item.icon_url,
         organization_item.raw_icon_url,
         FileHostPublicity::Public,
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -1228,7 +1227,7 @@ pub async fn organization_icon_edit(
         &ext.ext,
         Some(96),
         Some(1.0),
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -1264,7 +1263,7 @@ pub async fn delete_organization_icon(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     let user = get_user_from_headers(
@@ -1314,7 +1313,7 @@ pub async fn delete_organization_icon(
         organization_item.icon_url,
         organization_item.raw_icon_url,
         FileHostPublicity::Public,
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
diff --git a/apps/labrinth/src/routes/v3/project_creation.rs b/apps/labrinth/src/routes/v3/project_creation.rs
index 42f1e4624a..32b487b48d 100644
--- a/apps/labrinth/src/routes/v3/project_creation.rs
+++ b/apps/labrinth/src/routes/v3/project_creation.rs
@@ -40,7 +40,6 @@ use itertools::Itertools;
 use rust_decimal::Decimal;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
-use std::sync::Arc;
 use thiserror::Error;
 use validator::Validate;
 
@@ -290,7 +289,7 @@ pub async fn project_create(
     payload: Multipart,
     client: Data<PgPool>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     session_queue: Data<AuthQueue>,
     http: Data<HttpClient>,
 ) -> Result<HttpResponse, CreateError> {
@@ -311,7 +310,7 @@ pub async fn project_create_internal(
     mut payload: Multipart,
     client: Data<PgPool>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     session_queue: Data<AuthQueue>,
     http: Data<HttpClient>,
 ) -> Result<HttpResponse, CreateError> {
@@ -325,7 +324,7 @@ pub async fn project_create_internal(
         req,
         &mut payload,
         &mut transaction,
-        &***file_host,
+        &**file_host,
         &mut uploaded_files,
         &client,
         &redis,
@@ -336,7 +335,7 @@ pub async fn project_create_internal(
     .await;
 
     if result.is_err() {
-        let undo_result = undo_uploads(&***file_host, &uploaded_files).await;
+        let undo_result = undo_uploads(&**file_host, &uploaded_files).await;
         let rollback_result = transaction.rollback().await;
 
         undo_result?;
@@ -360,7 +359,7 @@ pub async fn project_create_with_id(
     mut payload: Multipart,
     client: Data<PgPool>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     session_queue: Data<AuthQueue>,
     http: Data<HttpClient>,
     path: web::Path<(ProjectId,)>,
@@ -374,7 +373,7 @@ pub async fn project_create_with_id(
         req,
         &mut payload,
         &mut transaction,
-        &***file_host,
+        &**file_host,
         &mut uploaded_files,
         &client,
         &redis,
@@ -385,7 +384,7 @@ pub async fn project_create_with_id(
     .await;
 
     if result.is_err() {
-        let undo_result = undo_uploads(&***file_host, &uploaded_files).await;
+        let undo_result = undo_uploads(&**file_host, &uploaded_files).await;
         let rollback_result = transaction.rollback().await;
 
         undo_result?;
@@ -907,7 +906,7 @@ async fn project_create_inner(
         let now = Utc::now();
 
         let id = project_builder_actual
-            .insert(&mut *transaction, http)
+            .insert(&mut *transaction, redis, file_host, http)
             .await?;
         DBUser::clear_project_cache(&[current_user.id.into()], redis).await?;
 
diff --git a/apps/labrinth/src/routes/v3/project_creation/new.rs b/apps/labrinth/src/routes/v3/project_creation/new.rs
index cbfd33971f..976c6d612a 100644
--- a/apps/labrinth/src/routes/v3/project_creation/new.rs
+++ b/apps/labrinth/src/routes/v3/project_creation/new.rs
@@ -16,6 +16,7 @@ use crate::{
         },
         redis::RedisPool,
     },
+    file_hosting::FileHost,
     models::{
         exp::{self, ProjectComponentKind, component::ComponentRelationError},
         ids::ProjectId,
@@ -117,6 +118,7 @@ pub async fn create(
     req: HttpRequest,
     db: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
     http: web::Data<HttpClient>,
     web::Json(create): web::Json<ProjectCreate>,
@@ -305,13 +307,13 @@ pub async fn create(
     };
 
     project_builder
-        .insert(&mut txn, &http)
+        .insert(&mut txn, &redis, &**file_host, &http)
         .await
         .wrap_internal_err("failed to insert project")?;
 
     if let Some(version_builder) = version_builder {
         version_builder
-            .insert(&mut txn, &http)
+            .insert(&mut txn, &redis, &**file_host, &http)
             .await
             .wrap_internal_err("failed to insert initial version")?;
     }
diff --git a/apps/labrinth/src/routes/v3/projects.rs b/apps/labrinth/src/routes/v3/projects.rs
index a40f933057..831fdb423a 100644
--- a/apps/labrinth/src/routes/v3/projects.rs
+++ b/apps/labrinth/src/routes/v3/projects.rs
@@ -1,6 +1,5 @@
 use std::any::type_name;
 use std::collections::HashMap;
-use std::sync::Arc;
 
 use crate::auth::checks::{filter_visible_versions, is_visible_project};
 use crate::auth::{filter_visible_projects, get_user_from_headers};
@@ -1694,7 +1693,7 @@ async fn project_icon_edit(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -1717,7 +1716,7 @@ pub async fn project_icon_edit_internal(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     mut payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -1775,7 +1774,7 @@ pub async fn project_icon_edit_internal(
         project_item.inner.icon_url,
         project_item.inner.raw_icon_url,
         FileHostPublicity::Public,
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -1794,7 +1793,7 @@ pub async fn project_icon_edit_internal(
         &ext.ext,
         Some(96),
         Some(1.0),
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -1833,7 +1832,7 @@ async fn delete_project_icon(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     delete_project_icon_internal(
@@ -1852,7 +1851,7 @@ pub async fn delete_project_icon_internal(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     let user = get_user_from_headers(
@@ -1908,7 +1907,7 @@ pub async fn delete_project_icon_internal(
         project_item.inner.icon_url,
         project_item.inner.raw_icon_url,
         FileHostPublicity::Public,
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -1957,7 +1956,7 @@ pub async fn add_gallery_item(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -1982,7 +1981,7 @@ pub async fn add_gallery_item_internal(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     mut payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -2062,7 +2061,7 @@ pub async fn add_gallery_item_internal(
         &ext.ext,
         Some(350),
         Some(1.0),
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
@@ -2334,7 +2333,7 @@ async fn delete_gallery_item(
     web::Query(item): web::Query<GalleryDeleteQuery>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     delete_gallery_item_internal(
@@ -2353,7 +2352,7 @@ pub async fn delete_gallery_item_internal(
     web::Query(item): web::Query<GalleryDeleteQuery>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     let user = get_user_from_headers(
@@ -2429,7 +2428,7 @@ pub async fn delete_gallery_item_internal(
         Some(item.image_url),
         Some(item.raw_image_url),
         FileHostPublicity::Public,
-        &***file_host,
+        &**file_host,
     )
     .await?;
 
diff --git a/apps/labrinth/src/routes/v3/shared_instance_version_creation.rs b/apps/labrinth/src/routes/v3/shared_instance_version_creation.rs
index 657853c258..9fdc289025 100644
--- a/apps/labrinth/src/routes/v3/shared_instance_version_creation.rs
+++ b/apps/labrinth/src/routes/v3/shared_instance_version_creation.rs
@@ -25,7 +25,6 @@ use bytes::BytesMut;
 use chrono::Utc;
 use futures_util::StreamExt;
 use hex::FromHex;
-use std::sync::Arc;
 
 const MAX_FILE_SIZE: usize = 500 * 1024 * 1024;
 const MAX_FILE_SIZE_TEXT: &str = "500 MB";
@@ -44,7 +43,7 @@ pub async fn shared_instance_version_create(
     payload: web::Payload,
     web::Header(ContentLength(content_length)): web::Header<ContentLength>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     info: web::Path<(SharedInstanceId,)>,
     session_queue: Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -63,7 +62,7 @@ pub async fn shared_instance_version_create(
         payload,
         content_length,
         &redis,
-        &***file_host,
+        &**file_host,
         info.into_inner().0.into(),
         &session_queue,
         &mut transaction,
@@ -73,7 +72,7 @@ pub async fn shared_instance_version_create(
 
     if result.is_err() {
         let undo_result = super::project_creation::undo_uploads(
-            &***file_host,
+            &**file_host,
             &uploaded_files,
         )
         .await;
diff --git a/apps/labrinth/src/routes/v3/shared_instances.rs b/apps/labrinth/src/routes/v3/shared_instances.rs
index 260a0ef5e1..3768777029 100644
--- a/apps/labrinth/src/routes/v3/shared_instances.rs
+++ b/apps/labrinth/src/routes/v3/shared_instances.rs
@@ -22,7 +22,6 @@ use actix_web::web::{Data, Redirect};
 use actix_web::{HttpRequest, HttpResponse, web};
 use futures_util::future::try_join_all;
 use serde::Deserialize;
-use std::sync::Arc;
 use validator::Validate;
 
 pub fn config(cfg: &mut web::ServiceConfig) {
@@ -565,7 +564,7 @@ pub async fn shared_instance_version_download(
     req: HttpRequest,
     pool: Data<PgPool>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     info: web::Path<(SharedInstanceVersionId,)>,
     session_queue: Data<AuthQueue>,
 ) -> Result<Redirect, ApiError> {
diff --git a/apps/labrinth/src/routes/v3/threads.rs b/apps/labrinth/src/routes/v3/threads.rs
index 136313cdfe..23ce400feb 100644
--- a/apps/labrinth/src/routes/v3/threads.rs
+++ b/apps/labrinth/src/routes/v3/threads.rs
@@ -1,5 +1,3 @@
-use std::sync::Arc;
-
 use crate::auth::get_user_from_headers;
 use crate::database;
 use crate::database::PgPool;
@@ -599,7 +597,7 @@ pub async fn message_delete(
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
     session_queue: web::Data<AuthQueue>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
 ) -> Result<HttpResponse, ApiError> {
     let user = get_user_from_headers(
         &req,
diff --git a/apps/labrinth/src/routes/v3/users.rs b/apps/labrinth/src/routes/v3/users.rs
index c93d1b5336..6974303e7f 100644
--- a/apps/labrinth/src/routes/v3/users.rs
+++ b/apps/labrinth/src/routes/v3/users.rs
@@ -1,4 +1,4 @@
-use std::{collections::HashMap, sync::Arc};
+use std::collections::HashMap;
 
 use super::{ApiError, oauth_clients::get_user_clients};
 use crate::database::PgPool;
@@ -671,7 +671,7 @@ pub async fn user_icon_edit(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     mut payload: web::Payload,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
@@ -698,7 +698,7 @@ pub async fn user_icon_edit(
             actual_user.avatar_url,
             actual_user.raw_avatar_url,
             FileHostPublicity::Public,
-            &***file_host,
+            &**file_host,
         )
         .await?;
 
@@ -717,7 +717,7 @@ pub async fn user_icon_edit(
             &ext.ext,
             Some(96),
             Some(1.0),
-            &***file_host,
+            &**file_host,
         )
         .await?;
 
@@ -746,7 +746,7 @@ pub async fn user_icon_delete(
     info: web::Path<(String,)>,
     pool: web::Data<PgPool>,
     redis: web::Data<RedisPool>,
-    file_host: web::Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: web::Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
 ) -> Result<HttpResponse, ApiError> {
     let user = get_user_from_headers(
@@ -772,7 +772,7 @@ pub async fn user_icon_delete(
             actual_user.avatar_url,
             actual_user.raw_avatar_url,
             FileHostPublicity::Public,
-            &***file_host,
+            &**file_host,
         )
         .await?;
 
diff --git a/apps/labrinth/src/routes/v3/version_creation.rs b/apps/labrinth/src/routes/v3/version_creation.rs
index 58d007ff6d..7e0e8b7afc 100644
--- a/apps/labrinth/src/routes/v3/version_creation.rs
+++ b/apps/labrinth/src/routes/v3/version_creation.rs
@@ -41,7 +41,6 @@ use itertools::Itertools;
 use serde::{Deserialize, Serialize};
 use sha1::Digest;
 use std::collections::{HashMap, HashSet};
-use std::sync::Arc;
 use validator::Validate;
 
 fn default_requested_status() -> VersionStatus {
@@ -110,7 +109,7 @@ pub async fn version_create(
     mut payload: Multipart,
     client: Data<PgPool>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     session_queue: Data<AuthQueue>,
     moderation_queue: web::Data<AutomatedModerationQueue>,
     http: web::Data<HttpClient>,
@@ -123,7 +122,7 @@ pub async fn version_create(
         &mut payload,
         &mut transaction,
         &redis,
-        &***file_host,
+        &**file_host,
         &mut uploaded_files,
         &client,
         &session_queue,
@@ -134,7 +133,7 @@ pub async fn version_create(
 
     if result.is_err() {
         let undo_result = super::project_creation::undo_uploads(
-            &***file_host,
+            &**file_host,
             &uploaded_files,
         )
         .await;
@@ -481,10 +480,11 @@ async fn version_create_inner(
         loaders: version_data.loaders,
         fields: version_data.fields,
         components: exp::VersionQuery::default(),
+        files_missing_attribution: Vec::new(),
     };
 
     let project_id = builder.project_id;
-    builder.insert(transaction, http).await?;
+    builder.insert(transaction, redis, file_host, http).await?;
 
     for image_id in version_data.uploaded_images {
         if let Some(db_image) =
@@ -544,7 +544,7 @@ pub async fn upload_file_to_version(
     mut payload: Multipart,
     client: Data<PgPool>,
     redis: Data<RedisPool>,
-    file_host: Data<Arc<dyn FileHost + Send + Sync>>,
+    file_host: Data<dyn FileHost>,
     session_queue: web::Data<AuthQueue>,
     http: web::Data<HttpClient>,
 ) -> Result<HttpResponse, CreateError> {
@@ -559,7 +559,7 @@ pub async fn upload_file_to_version(
         client,
         &mut transaction,
         redis,
-        &***file_host,
+        &**file_host,
         &mut uploaded_files,
         version_id,
         &session_queue,
@@ -569,7 +569,7 @@ pub async fn upload_file_to_version(
 
     if result.is_err() {
         let undo_result = super::project_creation::undo_uploads(
-            &***file_host,
+            &**file_host,
             &uploaded_files,
         )
         .await;
@@ -780,8 +780,18 @@ async fn upload_file_to_version_inner(
             "At least one file must be specified".to_string(),
         ));
     } else {
+        let project_id = version.inner.project_id;
+
         for file in file_builders {
-            file.insert(version_id, &mut *transaction, http).await?;
+            file.insert(
+                version_id,
+                project_id,
+                &mut *transaction,
+                &redis,
+                file_host,
+                http,
+            )
+            .await?;
         }
     }
 
@@ -862,8 +872,10 @@ pub async fn upload_file(
         ));
     }
 
+    let data = data.freeze();
+
     let validation_result = validate_file(
-        data.clone().into(),
+        data.clone(),
         file_extension.to_string(),
         loaders.clone(),
         file_type,
@@ -940,7 +952,6 @@ pub async fn upload_file(
         }
     }
 
-    let data = data.freeze();
     let primary = (validation_result.is_passed()
         && version_files.iter().all(|x| !x.primary)
         && !ignore_primary)
diff --git a/apps/labrinth/src/routes/v3/version_file.rs b/apps/labrinth/src/routes/v3/version_file.rs
index 7723ffdeb8..f182edaed3 100644
--- a/apps/labrinth/src/routes/v3/version_file.rs
+++ b/apps/labrinth/src/routes/v3/version_file.rs
@@ -721,6 +721,11 @@ pub async fn delete_file(
         .execute(&mut transaction)
         .await?;
 
+        database::models::version_item::cleanup_empty_attribution_groups(
+            &mut transaction,
+        )
+        .await?;
+
         delphi::send_tech_review_exit_file_deleted_message_if_exited(
             row.project_id,
             was_in_tech_review,
diff --git a/apps/labrinth/src/routes/v3/versions.rs b/apps/labrinth/src/routes/v3/versions.rs
index 4039be60fd..6b6cada022 100644
--- a/apps/labrinth/src/routes/v3/versions.rs
+++ b/apps/labrinth/src/routes/v3/versions.rs
@@ -2,7 +2,8 @@ use std::collections::HashMap;
 
 use super::ApiError;
 use crate::auth::checks::{
-    filter_visible_versions, is_visible_project, is_visible_version,
+    enrich_dependency_attributions, filter_visible_versions,
+    is_visible_project, is_visible_version,
 };
 use crate::auth::get_user_from_headers;
 use crate::database;
@@ -24,6 +25,9 @@ use crate::models::projects::{
 };
 use crate::models::projects::{Loader, skip_nulls};
 use crate::models::teams::ProjectPermissions;
+use crate::queue::file_scan::{
+    get_dependency_attributions, get_files_missing_attribution,
+};
 use crate::queue::session::AuthQueue;
 use crate::routes::internal::delphi;
 use crate::search::SearchBackend;
@@ -113,8 +117,38 @@ pub async fn version_project_get_helper(
             && is_visible_version(&version.inner, &user_option, &pool, &redis)
                 .await?
         {
-            return Ok(HttpResponse::Ok()
-                .json(models::projects::Version::from(version)));
+            let version_id = version.inner.id;
+            let mut v = models::projects::Version::from(version);
+            let missing = get_files_missing_attribution(&**pool, &[version_id])
+                .await
+                .unwrap_or_default();
+            v.files_missing_attribution = missing
+                 .get(&version_id)
+                 .map(|entries| {
+                     entries
+                         .iter()
+                         .map(|(id, fp)| models::projects::MissingAttributionFile {
+                             id: models::ids::FileId(id.0 as u64),
+                             override_source: fp
+                                 .as_ref()
+                                 .map(|p| models::projects::OverrideSource::Flame {
+                                     id: p.id,
+                                     title: p.title.clone(),
+                                     url: p.url.clone(),
+                                     icon_url: p.icon_url.clone(),
+                                 })
+                                 .or(Some(models::projects::OverrideSource::Unknown)),
+                         })
+                         .collect()
+                 })
+                 .unwrap_or_default();
+
+            let dep_attr = get_dependency_attributions(&**pool, &[version_id])
+                .await
+                .unwrap_or_default();
+            enrich_dependency_attributions(&mut v, &dep_attr);
+
+            return Ok(HttpResponse::Ok().json(v));
         }
     }
 
@@ -207,7 +241,40 @@ pub async fn version_get_helper(
     if let Some(data) = version_data
         && is_visible_version(&data.inner, &user_option, &pool, &redis).await?
     {
-        return Ok(web::Json(models::projects::Version::from(data)));
+        let version_id = data.inner.id;
+        let mut version = models::projects::Version::from(data);
+        let missing = get_files_missing_attribution(&**pool, &[version_id])
+            .await
+            .unwrap_or_default();
+        version.files_missing_attribution = missing
+            .get(&version_id)
+            .map(|entries| {
+                entries
+                    .iter()
+                    .map(|(id, fp)| models::projects::MissingAttributionFile {
+                        id: models::ids::FileId(id.0 as u64),
+                        override_source: fp
+                            .as_ref()
+                            .map(|p| models::projects::OverrideSource::Flame {
+                                id: p.id,
+                                title: p.title.clone(),
+                                url: p.url.clone(),
+                                icon_url: p.icon_url.clone(),
+                            })
+                            .or(Some(
+                                models::projects::OverrideSource::Unknown,
+                            )),
+                    })
+                    .collect()
+            })
+            .unwrap_or_default();
+
+        let dep_attr = get_dependency_attributions(&**pool, &[version_id])
+            .await
+            .unwrap_or_default();
+        enrich_dependency_attributions(&mut version, &dep_attr);
+
+        return Ok(web::Json(version));
     }
 
     Err(ApiError::NotFound)
diff --git a/apps/labrinth/src/test/mod.rs b/apps/labrinth/src/test/mod.rs
index 0e08524049..3dedaa6b68 100644
--- a/apps/labrinth/src/test/mod.rs
+++ b/apps/labrinth/src/test/mod.rs
@@ -1,10 +1,14 @@
+use std::sync::Arc;
+
+use actix_web::web;
+
 use crate::env::ENV;
+use crate::file_hosting::FileHost;
 use crate::queue::email::EmailQueue;
 use crate::util::anrok;
 use crate::util::gotenberg::GotenbergClient;
 use crate::{LabrinthConfig, file_hosting};
 use crate::{clickhouse, env};
-use std::sync::Arc;
 
 pub mod api_common;
 pub mod api_v2;
@@ -31,8 +35,8 @@ pub async fn setup(db: &database::TemporaryDatabase) -> LabrinthConfig {
     let ro_pool = db.ro_pool.clone();
     let redis_pool = db.redis_pool.clone();
     let search_backend = db.search_backend.clone();
-    let file_host: Arc<dyn file_hosting::FileHost + Send + Sync> =
-        Arc::new(file_hosting::MockHost::new());
+    let file_host: Arc<dyn FileHost> = Arc::new(file_hosting::MockHost::new());
+    let file_host = web::Data::<dyn FileHost>::from(file_host);
     let mut clickhouse = clickhouse::init_client().await.unwrap();
 
     let stripe_client = stripe::Client::new(ENV.STRIPE_API_KEY.clone());
diff --git a/apps/labrinth/src/util/http.rs b/apps/labrinth/src/util/http.rs
index cfa942ef73..621205fe17 100644
--- a/apps/labrinth/src/util/http.rs
+++ b/apps/labrinth/src/util/http.rs
@@ -1,24 +1,23 @@
-use std::time::Duration;
+use std::sync::LazyLock;
 
 use derive_more::Deref;
-use reqwest::header::{HeaderMap, HeaderValue, USER_AGENT};
 
-/// Generic HTTP client used for anywhere you need to send an HTTP request, and
-/// do not care what headers or other parameters are used.
+pub static HTTP_CLIENT: LazyLock<HttpClient> = LazyLock::new(HttpClient::new);
+
 #[derive(Debug, Clone, Deref)]
-pub struct HttpClient(pub reqwest::Client);
+pub struct HttpClient(reqwest::Client);
 
 impl HttpClient {
     pub fn new() -> Self {
         let client = reqwest::Client::builder()
-            .default_headers(HeaderMap::from_iter([(
-                USER_AGENT,
-                HeaderValue::from_static(concat!(
+            .default_headers(reqwest::header::HeaderMap::from_iter([(
+                reqwest::header::USER_AGENT,
+                reqwest::header::HeaderValue::from_static(concat!(
                     "Labrinth/",
                     env!("COMPILATION_DATE")
                 )),
             )]))
-            .timeout(Duration::from_secs(30))
+            .timeout(std::time::Duration::from_secs(30))
             .build()
             .unwrap();
         Self(client)
diff --git a/apps/labrinth/tests/version.rs b/apps/labrinth/tests/version.rs
index 46cf863d9d..5e5a6ecf97 100644
--- a/apps/labrinth/tests/version.rs
+++ b/apps/labrinth/tests/version.rs
@@ -494,7 +494,8 @@ pub async fn test_patch_version() {
                 project_id: Some(*beta_project_id_parsed),
                 version_id: None,
                 file_name: Some("dummy_file_name".to_string()),
-                dependency_type: DependencyType::Required
+                dependency_type: DependencyType::Required,
+                attribution: None,
             }]
         );
         assert_eq!(version.loaders, vec!["forge".to_string()]);
diff --git a/packages/api-client/src/modules/index.ts b/packages/api-client/src/modules/index.ts
index 7219d12e55..a7ccb4ddf7 100644
--- a/packages/api-client/src/modules/index.ts
+++ b/packages/api-client/src/modules/index.ts
@@ -13,12 +13,14 @@ import { KyrosFilesV0Module } from './kyros/files/v0'
 import { KyrosLogsV1Module } from './kyros/logs/v1'
 import { LabrinthVersionsV2Module, LabrinthVersionsV3Module } from './labrinth'
 import { LabrinthAffiliateInternalModule } from './labrinth/affiliate/internal'
+import { LabrinthAttributionInternalModule } from './labrinth/attribution/internal'
 import { LabrinthAuthInternalModule } from './labrinth/auth/internal'
 import { LabrinthAuthV2Module } from './labrinth/auth/v2'
 import { LabrinthBillingInternalModule } from './labrinth/billing/internal'
 import { LabrinthCollectionsModule } from './labrinth/collections'
 import { LabrinthExternalProjectsInternalModule } from './labrinth/external-projects/internal'
 import { LabrinthGlobalsInternalModule } from './labrinth/globals/internal'
+import { LabrinthImagesV3Module } from './labrinth/images/v3'
 import { LabrinthLimitsV3Module } from './labrinth/limits/v3'
 import { LabrinthModerationInternalModule } from './labrinth/moderation/internal'
 import { LabrinthNotificationsV2Module } from './labrinth/notifications/v2'
@@ -74,10 +76,12 @@ export const MODULE_REGISTRY = {
 	labrinth_affiliate_internal: LabrinthAffiliateInternalModule,
 	labrinth_auth_internal: LabrinthAuthInternalModule,
 	labrinth_auth_v2: LabrinthAuthV2Module,
+	labrinth_attribution_internal: LabrinthAttributionInternalModule,
 	labrinth_billing_internal: LabrinthBillingInternalModule,
 	labrinth_collections: LabrinthCollectionsModule,
 	labrinth_external_projects_internal: LabrinthExternalProjectsInternalModule,
 	labrinth_globals_internal: LabrinthGlobalsInternalModule,
+	labrinth_images_v3: LabrinthImagesV3Module,
 	labrinth_moderation_internal: LabrinthModerationInternalModule,
 	labrinth_notifications_v2: LabrinthNotificationsV2Module,
 	labrinth_oauth_internal: LabrinthOAuthInternalModule,
diff --git a/packages/api-client/src/modules/labrinth/attribution/internal.ts b/packages/api-client/src/modules/labrinth/attribution/internal.ts
new file mode 100644
index 0000000000..36773c77e1
--- /dev/null
+++ b/packages/api-client/src/modules/labrinth/attribution/internal.ts
@@ -0,0 +1,103 @@
+import { AbstractModule } from '../../../core/abstract-module'
+import type { Labrinth } from '../types'
+
+const BASE62_CHARS = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
+
+/**
+ * Decode a base62-encoded ID string into a number.
+ * The backend serializes attribution group IDs as base62 strings in responses,
+ * but the assign/update endpoints expect raw integer IDs in their request payloads.
+ */
+function decodeBase62Id(id: string): number {
+	let value = 0
+	for (const char of id) {
+		const digit = BASE62_CHARS.indexOf(char)
+		if (digit < 0) {
+			throw new Error(`Invalid base62 character "${char}" in id "${id}"`)
+		}
+		value = value * 62 + digit
+		if (!Number.isSafeInteger(value)) {
+			throw new Error(`Base62 id "${id}" exceeds safe integer range`)
+		}
+	}
+	return value
+}
+
+export class LabrinthAttributionInternalModule extends AbstractModule {
+	public getModuleID(): string {
+		return 'labrinth_attribution_internal'
+	}
+
+	/**
+	 * List attribution groups for a project
+	 * GET /_internal/attribution/{project_id}
+	 */
+	public async listProjectAttribution(
+		projectId: string,
+	): Promise<Labrinth.Attribution.Internal.AttributionGroup[]> {
+		return this.client.request<Labrinth.Attribution.Internal.AttributionGroup[]>(
+			`/attribution/${projectId}`,
+			{
+				api: 'labrinth',
+				version: 'internal',
+				method: 'GET',
+			},
+		)
+	}
+
+	/**
+	 * Update an attribution group's attribution payload.
+	 * PATCH /_internal/attribution/group/{group_id}
+	 *
+	 * @param groupId - The base62 attribution group id (as returned from listProjectAttribution).
+	 */
+	public async updateGroup(
+		groupId: string,
+		body: Labrinth.Attribution.Internal.UpdateGroupRequest,
+	): Promise<void> {
+		const numericId = decodeBase62Id(groupId)
+		return this.client.request<void>(`/attribution/group/${numericId}`, {
+			api: 'labrinth',
+			version: 'internal',
+			method: 'PATCH',
+			body,
+		})
+	}
+
+	/**
+	 * Reassign a file (by sha1) to another attribution group within the same project.
+	 * POST /_internal/attribution/assign
+	 *
+	 * @param body.target_group_id - The base62 id of the attribution group to assign the file to.
+	 */
+	public async assignFileToGroup(body: {
+		sha1: string
+		target_group_id: string
+		project_id: string
+	}): Promise<void> {
+		const wireBody: Labrinth.Attribution.Internal.AssignRequest = {
+			sha1: body.sha1,
+			target_group_id: decodeBase62Id(body.target_group_id),
+			project_id: body.project_id,
+		}
+		return this.client.request<void>('/attribution/assign', {
+			api: 'labrinth',
+			version: 'internal',
+			method: 'POST',
+			body: wireBody,
+		})
+	}
+
+	/**
+	 * Split a file (by sha1) out of its current attribution group into a new group.
+	 * POST /_internal/attribution/split
+	 */
+	public async splitFile(body: Labrinth.Attribution.Internal.SplitRequest): Promise<void> {
+		return this.client.request<void>('/attribution/split', {
+			api: 'labrinth',
+			version: 'internal',
+			method: 'POST',
+			body,
+		})
+	}
+}
diff --git a/packages/api-client/src/modules/labrinth/images/v3.ts b/packages/api-client/src/modules/labrinth/images/v3.ts
new file mode 100644
index 0000000000..7613f0debd
--- /dev/null
+++ b/packages/api-client/src/modules/labrinth/images/v3.ts
@@ -0,0 +1,47 @@
+import { AbstractModule } from '../../../core/abstract-module'
+import type { UploadHandle } from '../../../types/upload'
+import type { Labrinth } from '../types'
+
+function buildImageQueryParams(
+	ext: Labrinth.Images.v3.ImageExtension,
+	target: Labrinth.Images.v3.UploadImageParams,
+): Record<string, string> {
+	const params: Record<string, string> = {
+		ext,
+		context: target.context,
+	}
+	switch (target.context) {
+		case 'project':
+			params.project_id = target.project_id
+			break
+		case 'version':
+			params.version_id = target.version_id
+			break
+		case 'thread_message':
+			params.thread_message_id = target.thread_message_id
+			break
+		case 'report':
+			params.report_id = target.report_id
+			break
+	}
+	return params
+}
+
+export class LabrinthImagesV3Module extends AbstractModule {
+	public getModuleID(): string {
+		return 'labrinth_images_v3'
+	}
+
+	public uploadImage(
+		file: File | Blob,
+		ext: Labrinth.Images.v3.ImageExtension,
+		target: Labrinth.Images.v3.UploadImageParams,
+	): UploadHandle<Labrinth.Images.v3.UploadedImage> {
+		return this.client.upload<Labrinth.Images.v3.UploadedImage>('/image', {
+			api: 'labrinth',
+			version: 3,
+			file,
+			params: buildImageQueryParams(ext, target),
+		})
+	}
+}
diff --git a/packages/api-client/src/modules/labrinth/index.ts b/packages/api-client/src/modules/labrinth/index.ts
index 883bac31d7..f48412a40a 100644
--- a/packages/api-client/src/modules/labrinth/index.ts
+++ b/packages/api-client/src/modules/labrinth/index.ts
@@ -1,9 +1,11 @@
+export * from './attribution/internal'
 export * from './auth/internal'
 export * from './auth/v2'
 export * from './billing/internal'
 export * from './collections'
 export * from './external-projects/internal'
 export * from './globals/internal'
+export * from './images/v3'
 export * from './limits/v3'
 export * from './moderation/internal'
 export * from './notifications/v2'
diff --git a/packages/api-client/src/modules/labrinth/types.ts b/packages/api-client/src/modules/labrinth/types.ts
index 098e46d19f..64a807f83b 100644
--- a/packages/api-client/src/modules/labrinth/types.ts
+++ b/packages/api-client/src/modules/labrinth/types.ts
@@ -238,6 +238,142 @@ export namespace Labrinth {
 		}
 	}
 
+	export namespace Attribution {
+		export namespace Internal {
+			export type AttributionPermissionKind =
+				| 'license'
+				| 'my_project'
+				| 'special_permissions'
+				| 'globally_allowed'
+				| 'no_permission'
+			export type AttributionResolutionKind = AttributionPermissionKind
+
+			export type AttributionLicense =
+				| string
+				| { name: string }
+
+			export type AttributionModerationStatusKind = 'not_allowed' | 'approved' | 'bad_proof'
+
+			export type AttributionModerationStatus = {
+				kind: AttributionModerationStatusKind
+				reason: string
+			}
+
+			export type AttributionResolutionBase = {
+				notes: string
+				image_urls: string[]
+				moderation_status: AttributionModerationStatus | null
+			}
+
+			export type AttributionResolution =
+				| (AttributionResolutionBase & {
+						kind: 'license'
+						license: AttributionLicense
+						link_to_work: string
+				  })
+				| (AttributionResolutionBase & {
+						kind: 'my_project'
+						license: AttributionLicense
+				  })
+				| (AttributionResolutionBase & {
+						kind: 'special_permissions'
+						link_to_work: string
+				  })
+				| (AttributionResolutionBase & {
+						kind: 'globally_allowed'
+						link_to_work: string
+				  })
+				| (AttributionResolutionBase & {
+						kind: 'no_permission'
+				  })
+
+			export type FlameProject = {
+				id: number
+				title: string
+				url: string
+				icon_url: string
+			}
+
+			export type AttributionFile = {
+				name: string
+				sha1: string
+				versions: string[]
+				moderation_external_license_id?: number
+				moderation_external_license?: ExternalProjects.Internal.ExternalProject
+			}
+
+			export type AttributionVersionInfo = {
+				id: string
+				name: string
+				version_number: string
+				date_created: string
+			}
+
+			export type AttributionGroup = {
+				id: string
+				flame_project: FlameProject | null
+				attribution: AttributionResolution | null
+				attributed_at: string | null
+				attributed_by: string | null
+				files: AttributionFile[]
+				versions: AttributionVersionInfo[]
+			}
+
+			export type UpdateGroupRequest = {
+				attribution: AttributionResolution
+			}
+
+			export type AssignRequest = {
+				sha1: string
+				target_group_id: number
+				project_id: string
+			}
+
+			export type SplitRequest = {
+				sha1: string
+				project_id: string
+			}
+		}
+	}
+
+	export namespace Images {
+		export namespace v3 {
+			/** Extensions accepted by POST /v3/image (Labrinth image pipeline). */
+			export type ImageExtension = 'bmp' | 'gif' | 'jpeg' | 'jpg' | 'png' | 'webp'
+
+			/** `context` query values accepted by POST /v3/image. */
+			export type ImageUploadContext = 'project' | 'version' | 'thread_message' | 'report'
+
+			export type UploadedImage = {
+				id: string
+				url: string
+				size: number
+				created: string
+				owner_id: string
+			} & (
+				| { context: 'project'; project_id: string }
+				| { context: 'version'; version_id: string }
+				| { context: 'thread_message'; thread_message_id: string }
+				| { context: 'report'; report_id: string }
+			)
+
+			export type UploadedImageFor<C extends ImageUploadContext> = Extract<
+				UploadedImage,
+				{ context: C }
+			>
+
+			/**
+			 * Target for POST /v3/image (per-context id query params, plus `context`).
+			 * `ext` is passed as a separate argument on the client module.
+			 */
+			export type UploadImageParams =
+				| { context: 'project'; project_id: string }
+				| { context: 'version'; version_id: string }
+				| { context: 'thread_message'; thread_message_id: string }
+				| { context: 'report'; report_id: string }
+		}
+	}
+
 	export namespace Auth {
 		export namespace Internal {
 			export type SubscriptionStatus = {
@@ -931,6 +1067,7 @@ export namespace Labrinth {
 				date_published: string
 				downloads: number
 				files: VersionFile[]
+				files_missing_attribution?: string[]
 				environment?: Labrinth.Projects.v3.Environment
 				mrpack_loaders?: string[]
 
diff --git a/packages/assets/generated-icons.ts b/packages/assets/generated-icons.ts
index c5cb8747fe..876a370e86 100644
--- a/packages/assets/generated-icons.ts
+++ b/packages/assets/generated-icons.ts
@@ -55,6 +55,7 @@ import _ChevronRightIcon from './icons/chevron-right.svg?component'
 import _ChevronUpIcon from './icons/chevron-up.svg?component'
 import _CircleAlertIcon from './icons/circle-alert.svg?component'
 import _CircleArrowRightIcon from './icons/circle-arrow-right.svg?component'
+import _CircleDashedIcon from './icons/circle-dashed.svg?component'
 import _CircleUserIcon from './icons/circle-user.svg?component'
 import _ClearIcon from './icons/clear.svg?component'
 import _ClientIcon from './icons/client.svg?component'
@@ -219,6 +220,7 @@ import _SortAscIcon from './icons/sort-asc.svg?component'
 import _SortDescIcon from './icons/sort-desc.svg?component'
 import _SparklesIcon from './icons/sparkles.svg?component'
 import _SpinnerIcon from './icons/spinner.svg?component'
+import _SplitIcon from './icons/split.svg?component'
 import _StarIcon from './icons/star.svg?component'
 import _StopCircleIcon from './icons/stop-circle.svg?component'
 import _StoreIcon from './icons/store.svg?component'
@@ -447,6 +449,7 @@ export const ChevronRightIcon = _ChevronRightIcon
 export const ChevronUpIcon = _ChevronUpIcon
 export const CircleAlertIcon = _CircleAlertIcon
 export const CircleArrowRightIcon = _CircleArrowRightIcon
+export const CircleDashedIcon = _CircleDashedIcon
 export const CircleUserIcon = _CircleUserIcon
 export const ClearIcon = _ClearIcon
 export const ClientIcon = _ClientIcon
@@ -611,6 +614,7 @@ export const SortAscIcon = _SortAscIcon
 export const SortDescIcon = _SortDescIcon
 export const SparklesIcon = _SparklesIcon
 export const SpinnerIcon = _SpinnerIcon
+export const SplitIcon = _SplitIcon
 export const StarIcon = _StarIcon
 export const StopCircleIcon = _StopCircleIcon
 export const StoreIcon = _StoreIcon
diff --git a/packages/assets/icons/circle-dashed.svg b/packages/assets/icons/circle-dashed.svg
new file mode 100644
index 0000000000..f06ebeda6a
--- /dev/null
+++ b/packages/assets/icons/circle-dashed.svg
@@ -0,0 +1,22 @@
+<!-- @license lucide-static v0.562.0 - ISC -->
+<svg
+  class="lucide lucide-circle-dashed"
+  xmlns="http://www.w3.org/2000/svg"
+  width="24"
+  height="24"
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+>
+  <path d="M10.1 2.182a10 10 0 0 1 3.8 0" />
+  <path d="M13.9 21.818a10 10 0 0 1-3.8 0" />
+  <path d="M17.609 3.721a10 10 0 0 1 2.69 2.7" />
+  <path d="M2.182 13.9a10 10 0 0 1 0-3.8" />
+  <path d="M20.279 17.609a10 10 0 0 1-2.7 2.69" />
+  <path d="M21.818 10.1a10 10 0 0 1 0 3.8" />
+  <path d="M3.721 6.391a10 10 0 0 1 2.7-2.69" />
+  <path d="M6.391 20.279a10 10 0 0 1-2.69-2.7" />
+</svg>
diff --git a/packages/assets/icons/split.svg b/packages/assets/icons/split.svg
new file mode 100644
index 0000000000..432fc358df
--- /dev/null
+++ b/packages/assets/icons/split.svg
@@ -0,0 +1,18 @@
+<!-- @license lucide-static v0.562.0 - ISC -->
+<svg
+  class="lucide lucide-split"
+  xmlns="http://www.w3.org/2000/svg"
+  width="24"
+  height="24"
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+>
+  <path d="M16 3h5v5" />
+  <path d="M8 3H3v5" />
+  <path d="M12 22v-8.3a4 4 0 0 0-1.172-2.872L3 3" />
+  <path d="m15 9 6-6" />
+</svg>
diff --git a/packages/ui/src/components/base/FileInput.vue b/packages/ui/src/components/base/FileInput.vue
index ff6e765121..9323b1e309 100644
--- a/packages/ui/src/components/base/FileInput.vue
+++ b/packages/ui/src/components/base/FileInput.vue
@@ -96,7 +96,7 @@ label {
 		grid-gap: 0.5rem;
 		background-color: var(--color-button-bg);
 		border-radius: var(--radius-sm);
-		border: dashed 2px var(--color-contrast);
+		border: dashed 2px var(--color-secondary);
 		cursor: pointer;
 		color: var(--color-contrast);
 	}
diff --git a/packages/ui/src/components/external_files/ExternalProjectAddFilesToGroupModal.vue b/packages/ui/src/components/external_files/ExternalProjectAddFilesToGroupModal.vue
new file mode 100644
index 0000000000..7ef1466574
--- /dev/null
+++ b/packages/ui/src/components/external_files/ExternalProjectAddFilesToGroupModal.vue
@@ -0,0 +1,269 @@
+<script setup lang="ts">
+import type { Labrinth } from '@modrinth/api-client'
+import { CheckIcon, PlusIcon, SearchIcon, SpinnerIcon, XIcon } from '@modrinth/assets'
+import { computed, nextTick, ref } from 'vue'
+
+import { ButtonStyled, NewModal, StyledInput } from '#ui/components'
+import { commonMessages } from '#ui/utils'
+
+import { defineMessages, useVIntl } from '../../composables/i18n'
+
+const props = defineProps<{
+	groupId: string
+	pending?: boolean
+}>()
+
+const emit = defineEmits<{
+	(e: 'confirm', sha1s: string[]): void
+}>()
+
+const { formatMessage } = useVIntl()
+
+const messages = defineMessages({
+	defaultGroupTitle: {
+		id: 'external-files.permissions-card.fallback-group-title',
+		defaultMessage: 'Attribution group {id}',
+	},
+	addFilesModalTitle: {
+		id: 'external-files.permissions-card.add-files-modal.title',
+		defaultMessage: 'Add files to this group',
+	},
+	addFilesModalDescription: {
+		id: 'external-files.permissions-card.add-files-modal.description',
+		defaultMessage: 'Select any files that should be moved into this group.',
+	},
+	addFilesModalEmpty: {
+		id: 'external-files.permissions-card.add-files-modal.empty',
+		defaultMessage: 'There are no files in other groups that can be moved here.',
+	},
+	addFilesModalSearchPlaceholder: {
+		id: 'external-files.permissions-card.add-files-modal.search-placeholder',
+		defaultMessage: 'Search files…',
+	},
+	addFilesModalNoSearchResults: {
+		id: 'external-files.permissions-card.add-files-modal.no-search-results',
+		defaultMessage: 'No files match your search.',
+	},
+	addFilesModalConfirm: {
+		id: 'external-files.permissions-card.add-files-modal.confirm',
+		defaultMessage: '{count, plural, one {Add file} other {Add files}}',
+	},
+	addFilesModalSelectedCount: {
+		id: 'external-files.permissions-card.add-files-modal.selected-count',
+		defaultMessage: '{count, plural, one {# file selected} other {# files selected}}',
+	},
+})
+
+type AssignableFileEntry = {
+	sha1: string
+	displayName: string
+	sourceLabel: string
+}
+
+const modalRef = ref<InstanceType<typeof NewModal> | null>(null)
+const assignableEntries = ref<AssignableFileEntry[]>([])
+const searchQuery = ref('')
+const searchInputRef = ref<{ focus: () => void } | null>(null)
+const selectedSha1s = ref<Set<string>>(new Set())
+
+const filteredEntries = computed(() => {
+	const q = searchQuery.value.trim().toLowerCase()
+	if (!q) {
+		return assignableEntries.value
+	}
+	return assignableEntries.value.filter(
+		(e) =>
+			e.displayName.toLowerCase().includes(q) ||
+			e.sourceLabel.toLowerCase().includes(q) ||
+			e.sha1.toLowerCase().includes(q),
+	)
+})
+
+const selectedFileCount = computed(() => selectedSha1s.value.size)
+
+function isFileSelected(sha1: string) {
+	return selectedSha1s.value.has(sha1)
+}
+
+function toggleFileSelection(sha1: string) {
+	const next = new Set(selectedSha1s.value)
+	if (next.has(sha1)) {
+		next.delete(sha1)
+	} else {
+		next.add(sha1)
+	}
+	selectedSha1s.value = next
+}
+
+function clearSelectedFiles() {
+	selectedSha1s.value = new Set()
+}
+
+function focusSearchOnOpen() {
+	nextTick(() => {
+		setTimeout(() => {
+			searchInputRef.value?.focus()
+		}, 75)
+	})
+}
+
+function buildAssignableEntries(
+	groups: Labrinth.Attribution.Internal.AttributionGroup[],
+): AssignableFileEntry[] {
+	const entries: AssignableFileEntry[] = []
+	for (const g of groups) {
+		if (g.id === props.groupId) {
+			continue
+		}
+		const firstName = g.files?.[0]?.name
+		const sourceLabel =
+			g.flame_project?.title ??
+			(firstName ? (firstName.split('/').pop() ?? firstName) : null) ??
+			formatMessage(messages.defaultGroupTitle, { id: g.id })
+		for (const f of g.files ?? []) {
+			const displayName = f.name.split('/').pop() ?? f.name
+			entries.push({ sha1: f.sha1, displayName, sourceLabel })
+		}
+	}
+	entries.sort((a, b) => {
+		const byName = a.displayName.localeCompare(b.displayName)
+		if (byName !== 0) {
+			return byName
+		}
+		return a.sourceLabel.localeCompare(b.sourceLabel)
+	})
+	return entries
+}
+
+function handleConfirm() {
+	if (selectedFileCount.value === 0) {
+		return
+	}
+	emit('confirm', [...selectedSha1s.value])
+	hide()
+}
+
+function show(event: MouseEvent, groups: Labrinth.Attribution.Internal.AttributionGroup[]) {
+	assignableEntries.value = buildAssignableEntries(groups)
+	searchQuery.value = ''
+	clearSelectedFiles()
+	modalRef.value?.show(event)
+}
+
+function hide() {
+	modalRef.value?.hide()
+}
+
+defineExpose({ show, hide })
+</script>
+
+<template>
+	<NewModal
+		ref="modalRef"
+		:header="formatMessage(messages.addFilesModalTitle)"
+		max-width="560px"
+		:disable-close="pending"
+		:on-show="focusSearchOnOpen"
+		:on-hide="clearSelectedFiles"
+		no-padding
+	>
+		<div class="flex flex-col gap-4 p-4 relative">
+			<p class="text-secondary m-0">
+				{{ formatMessage(messages.addFilesModalDescription) }}
+			</p>
+			<StyledInput
+				ref="searchInputRef"
+				v-model="searchQuery"
+				type="text"
+				autocomplete="off"
+				:placeholder="formatMessage(messages.addFilesModalSearchPlaceholder)"
+				:icon="SearchIcon"
+				:disabled="pending"
+				input-class="h-[40px]"
+				class="sticky top-0"
+				clearable
+			/>
+		</div>
+		<div
+			class="flex flex-col gap-2 bg-surface-2 overflow-y-auto overflow-x-hidden border-0 border-y border-solid border-surface-5 max-h-[calc(max(50vh,600px))]"
+		>
+			<div v-if="assignableEntries.length === 0" class="text-secondary text-sm p-4 m-0">
+				{{ formatMessage(messages.addFilesModalEmpty) }}
+			</div>
+			<div v-else-if="filteredEntries.length === 0" class="text-secondary text-sm m-0 p-4">
+				{{ formatMessage(messages.addFilesModalNoSearchResults) }}
+			</div>
+			<ul v-else class="p-0 m-0 list-none">
+				<li
+					v-for="entry in filteredEntries"
+					:key="entry.sha1"
+					:class="
+						isFileSelected(entry.sha1)
+							? 'border-brand bg-surface-4 hover:bg-surface-5'
+							: 'hover:bg-surface-3 even:bg-surface-2.5'
+					"
+				>
+					<button
+						type="button"
+						class="w-full text-left p-3 flex flex-col gap-1 appearance-none bg-transparent 3 transition-colors disabled:opacity-50"
+						:disabled="pending"
+						:aria-pressed="isFileSelected(entry.sha1)"
+						@click="toggleFileSelection(entry.sha1)"
+					>
+						<span class="flex gap-2 font-medium">
+							<span
+								class="size-4 shrink-0 rounded flex items-center justify-center border-[1px] border-solid"
+								:class="
+									isFileSelected(entry.sha1)
+										? 'bg-brand border-button-border text-brand-inverted'
+										: 'bg-surface-2 border-surface-5'
+								"
+							>
+								<CheckIcon
+									v-if="isFileSelected(entry.sha1)"
+									class="size-3"
+									aria-hidden="true"
+									stroke-width="3"
+								/>
+							</span>
+							<span class="flex flex-col gap-1 truncate">
+								<span class="truncate">{{ entry.displayName }}</span>
+								<span
+									v-if="entry.sourceLabel !== entry.displayName"
+									class="text-secondary text-xs truncate"
+									>{{ entry.sourceLabel }}</span
+								>
+							</span>
+						</span>
+					</button>
+				</li>
+			</ul>
+		</div>
+		<template #actions>
+			<div class="flex justify-between items-center gap-3 w-full pt-4">
+				<p v-if="selectedFileCount > 0" class="text-secondary text-sm m-0">
+					{{ formatMessage(messages.addFilesModalSelectedCount, { count: selectedFileCount }) }}
+				</p>
+				<div class="flex gap-2 ml-auto">
+					<ButtonStyled type="outlined">
+						<button type="button" :disabled="pending" @click="hide">
+							<XIcon class="size-4 shrink-0" />
+							{{ formatMessage(commonMessages.cancelButton) }}
+						</button>
+					</ButtonStyled>
+					<ButtonStyled color="brand">
+						<button
+							type="button"
+							:disabled="selectedFileCount === 0 || pending"
+							@click="handleConfirm"
+						>
+							<SpinnerIcon v-if="pending" class="size-4 shrink-0 animate-spin" />
+							<PlusIcon v-else class="size-4 shrink-0" />
+							{{ formatMessage(messages.addFilesModalConfirm, { count: selectedFileCount }) }}
+						</button>
+					</ButtonStyled>
+				</div>
+			</div>
+		</template>
+	</NewModal>
+</template>
diff --git a/packages/ui/src/components/external_files/ExternalProjectPermissionsCard.vue b/packages/ui/src/components/external_files/ExternalProjectPermissionsCard.vue
index 965dcfdda5..f88f46e42e 100644
--- a/packages/ui/src/components/external_files/ExternalProjectPermissionsCard.vue
+++ b/packages/ui/src/components/external_files/ExternalProjectPermissionsCard.vue
@@ -1,176 +1,1225 @@
 <script setup lang="ts">
-import { ChevronDownIcon, ListBulletedIcon, SaveIcon, VersionIcon, XIcon } from '@modrinth/assets'
-import { ref } from 'vue'
+import type { Labrinth } from '@modrinth/api-client'
+import {
+	CheckIcon,
+	ChevronDownIcon,
+	EditIcon,
+	ExternalIcon,
+	FileIcon,
+	PlusIcon,
+	SaveIcon,
+	SpinnerIcon,
+	TrashIcon,
+	UploadIcon,
+	UserRoundIcon,
+	VersionIcon,
+	XIcon,
+} from '@modrinth/assets'
+import { builtinLicenses } from '@modrinth/utils'
+import { useMutation, useQueryClient } from '@tanstack/vue-query'
+import { computed, ref, watch } from 'vue'
 
-import { Admonition, ButtonStyled, Chips, Collapsible, Combobox, StyledInput } from '#ui/components'
+import {
+	Admonition,
+	ButtonStyled,
+	Chips,
+	Collapsible,
+	Combobox,
+	type ComboboxOption,
+	IntlFormatted,
+	StyledInput,
+	TagItem,
+} from '#ui/components'
+import { Avatar, FileInput } from '#ui/components/base'
+import { commonMessages } from '#ui/utils'
 
-defineProps<{
-	title: string
+import { useFormatDateTime } from '../../composables/format-date-time'
+import {
+	defineMessage,
+	defineMessages,
+	type MessageDescriptor,
+	useVIntl,
+} from '../../composables/i18n'
+import {
+	injectModrinthClient,
+	injectNotificationManager,
+	injectProjectPageContext,
+} from '../../providers'
+import ExternalProjectAddFilesToGroupModal from './ExternalProjectAddFilesToGroupModal.vue'
+
+const props = defineProps<{
+	projectId: string
+	group: Labrinth.Attribution.Internal.AttributionGroup
+}>()
+
+const emit = defineEmits<{
+	(e: 'updated'): void
 }>()
 
+const { formatMessage } = useVIntl()
+const formatDate = useFormatDateTime({ dateStyle: 'long' })
+const client = injectModrinthClient()
+const queryClient = useQueryClient()
+const { addNotification } = injectNotificationManager()
+const { allMembers } = injectProjectPageContext()
+
+const attributorMember = computed(() => {
+	const userId = props.group.attributed_by
+	if (!userId || !allMembers.value) {
+		return null
+	}
+	return allMembers.value.find((member) => member.user.id === userId) ?? null
+})
+
+const attributorLink = computed(() => {
+	const id = props.group.attributed_by
+	if (!id) return null
+	if (attributorMember.value) return `/user/${attributorMember.value.user.username}`
+	return `/user/${id}`
+})
+
+const attributorLabel = computed(() => {
+	if (attributorMember.value) return attributorMember.value.user.username
+	return props.group.attributed_by ?? ''
+})
+
+const messages = defineMessages({
+	pendingBadge: {
+		id: 'external-files.permissions-card.badge.pending',
+		defaultMessage: 'Pending',
+	},
+	attributedBadge: {
+		id: 'external-files.permissions-card.badge.attributed',
+		defaultMessage: 'Attributed',
+	},
+	noPermissionBadge: {
+		id: 'external-files.permissions-card.badge.no-permission',
+		defaultMessage: 'No permission',
+	},
+	fileCount: {
+		id: 'external-files.permissions-card.file-count',
+		defaultMessage: '{count, plural, one {# file} other {# files}}',
+	},
+	includedInVersions: {
+		id: 'external-files.permissions-card.included-in-versions',
+		defaultMessage: 'Included in {count, plural, one {# version} other {# versions}}:',
+	},
+	includedFiles: {
+		id: 'external-files.permissions-card.included-files',
+		defaultMessage: 'Included files:',
+	},
+	notUsedInVersions: {
+		id: 'external-files.permissions-card.not-used-in-versions',
+		defaultMessage: 'These files are not currently used by any version.',
+	},
+	typeLabel: {
+		id: 'external-files.permissions-card.type-label',
+		defaultMessage: 'Permission reason',
+	},
+	licenseLabel: {
+		id: 'external-files.permissions-card.license-label',
+		defaultMessage: 'License',
+	},
+	selectLicenseLabel: {
+		id: 'external-files.permissions-card.select-license-label',
+		defaultMessage: 'Select a license...',
+	},
+	licensedAs: {
+		id: 'external-files.permissions-card.licensed-as',
+		defaultMessage: 'Licensed:',
+	},
+	linkLabel: {
+		id: 'external-files.permissions-card.link-label',
+		defaultMessage: 'Link to work',
+	},
+	linkToWorkUrlPlaceholder: {
+		id: 'external-files.permissions-card.link-to-work-url-placeholder',
+		defaultMessage: 'link-to-work',
+	},
+	notesLabel: {
+		id: 'external-files.permissions-card.notes-label',
+		defaultMessage: 'Notes',
+	},
+	optional: {
+		id: 'external-files.permissions-card.input-optional',
+		defaultMessage: '(optional)',
+	},
+	notesPlaceholder: {
+		id: 'external-files.permissions-card.notes-placeholder',
+		defaultMessage: 'Write something here...',
+	},
+	proofLabel: {
+		id: 'external-files.permissions-card.proof-label',
+		defaultMessage: 'Proof and explanation',
+	},
+	proofWarningTitle: {
+		id: 'external-files.permissions-card.proof-warning.title',
+		defaultMessage: 'Modrinth staff may verify submitted proof',
+	},
+	proofWarningBody: {
+		id: 'external-files.permissions-card.proof-warning.body',
+		defaultMessage: `If you are found to have lied or manipulated the images uploaded, your project and account may be terminated.`,
+	},
+	saveAttribution: {
+		id: 'external-files.permissions-card.save',
+		defaultMessage: 'Save attribution',
+	},
+	addAttribution: {
+		id: 'external-files.permissions-card.add',
+		defaultMessage: 'Add attribution',
+	},
+	lastUpdated: {
+		id: 'external-files.permissions-card.last-updated',
+		defaultMessage: 'Last updated on {date} by {user}',
+	},
+	licenseRequired: {
+		id: 'external-files.permissions-card.error.license-required',
+		defaultMessage: 'Please select a license.',
+	},
+	customLicenseLabel: {
+		id: 'external-files.permissions-card.custom-license-label',
+		defaultMessage: 'Link to license',
+	},
+	linkToLicenseUrlPlaceholder: {
+		id: 'external-files.permissions-card.link-to-license-url-placeholder',
+		defaultMessage: 'link-to-license',
+	},
+	linkInvalidUrl: {
+		id: 'external-files.permissions-card.error.link-invalid-url',
+		defaultMessage: 'Link must be a valid URL.',
+	},
+	proofImagesLabel: {
+		id: 'external-files.permissions-card.proof-images-label',
+		defaultMessage: 'Proof images',
+	},
+	proofImagesUploadPrompt: {
+		id: 'external-files.permissions-card.proof-images-upload-prompt',
+		defaultMessage: 'Drag and drop to upload or click to select an image',
+	},
+	proofImageThumbnailAlt: {
+		id: 'external-files.permissions-card.proof-image-alt',
+		defaultMessage: 'Proof screenshot {n}',
+	},
+	proofImageRemove: {
+		id: 'external-files.permissions-card.proof-image-remove',
+		defaultMessage: 'Remove image',
+	},
+	splitFile: {
+		id: 'external-files.permissions-card.split-file',
+		defaultMessage: 'Remove from group',
+	},
+	addFilesToGroup: {
+		id: 'external-files.permissions-card.add-files-to-group',
+		defaultMessage: 'Add files...',
+	},
+	originalProjectPage: {
+		id: 'external-files.permissions-card.original-project-page',
+		defaultMessage: 'Original project',
+	},
+})
+
 const collapsed = ref(true)
 
-const selectedPermissionsType = ref('My project')
+const MAX_PROOF_IMAGE_BYTES = 1_048_576
+
+const isAttributed = computed(
+	() => props.group.attribution !== null && props.group.attribution !== undefined,
+)
+const fileCount = computed(() => props.group.files?.length ?? 0)
+
+function isValidUrl(raw: string): boolean {
+	const s = raw.trim()
+	if (!s) return false
+	let parsed: URL
+	try {
+		parsed = new URL(s)
+	} catch {
+		return false
+	}
+	return parsed.protocol === 'http:' || parsed.protocol === 'https:'
+}
+
+const effectiveTitle = computed(() => {
+	if (props.group.flame_project?.title) {
+		return props.group.flame_project.title
+	}
+	const firstFileName = props.group.files[0]?.name ?? props.group.files[0]?.sha1 ?? ''
+	if (firstFileName) {
+		const base = firstFileName.split('/').pop() ?? firstFileName
+		if (fileCount.value === 1) {
+			return base
+		}
+		return formatMessage(
+			defineMessage({
+				id: 'external-files.permissions-card.unnamed-multi-group-title',
+				defaultMessage: '{filename} + {count} more',
+			}),
+			{ filename: base, count: fileCount.value - 1 },
+		)
+	}
+	return formatMessage(
+		defineMessage({
+			id: 'external-files.permissions-card.fallback-group-title',
+			defaultMessage: 'Attribution group {id}',
+		}),
+		{ id: props.group.id },
+	)
+})
+
+const containingVersions = computed(() => {
+	const versionIds = new Set<string>()
+	for (const file of props.group.files ?? []) {
+		for (const versionId of file.versions ?? []) {
+			versionIds.add(versionId)
+		}
+	}
+	return props.group.versions?.filter((v) => versionIds.has(v.id))
+})
+
+const permissionKinds: Labrinth.Attribution.Internal.AttributionResolutionKind[] = [
+	'license',
+	'my_project',
+	'special_permissions',
+	'no_permission',
+]
+
+function isCustomAttributionLicense(
+	license: Labrinth.Attribution.Internal.AttributionLicense,
+): license is { name: string } {
+	return typeof license === 'object' && license !== null && 'name' in license
+}
+
+function parseAttributionLicense(
+	license: Labrinth.Attribution.Internal.AttributionLicense | undefined,
+): {
+	spdx: string
+	custom: string
+} {
+	if (!license) {
+		return { spdx: '', custom: '' }
+	}
+	if (isCustomAttributionLicense(license)) {
+		return { spdx: CUSTOM_LICENSE_VALUE, custom: license.name }
+	}
+	return { spdx: license, custom: '' }
+}
+
+function attributionLinkToWork(
+	attribution: Labrinth.Attribution.Internal.AttributionResolution | null | undefined,
+): string | undefined {
+	if (!attribution) {
+		return undefined
+	}
+	if (attribution.kind === 'license' || attribution.kind === 'special_permissions') {
+		return attribution.link_to_work
+	}
+	return undefined
+}
+
+const initialAttribution = computed<Labrinth.Attribution.Internal.AttributionResolution | null>(
+	() => {
+		const raw = props.group.attribution
+		if (!raw || typeof raw !== 'object') {
+			return null
+		}
+		const obj = raw as Record<string, unknown>
+		const kind = obj.kind
+		if (typeof kind !== 'string' || !(permissionKinds as string[]).includes(kind)) {
+			return null
+		}
+		return obj as Labrinth.Attribution.Internal.AttributionResolution
+	},
+)
+
+const editing = ref(!isAttributed.value)
+const selectedKind = ref<Labrinth.Attribution.Internal.AttributionResolutionKind>(
+	initialAttribution.value?.kind ?? 'license',
+)
+
+/** Combobox value when the user picks a non-SPDX custom license (stored as `{ name }`). */
+const CUSTOM_LICENSE_VALUE = '__custom__'
+
+const licenseIdInput = ref('')
+const customLicenseInput = ref('')
+const linkInput = ref('')
+const notesInput = ref('')
+const inputError = ref<string | null>(null)
+const proofImageUrls = ref<string[]>([])
+
+function extFromImageFile(file: File): Labrinth.Images.v3.ImageExtension | null {
+	const byMime: Partial<Record<string, Labrinth.Images.v3.ImageExtension>> = {
+		'image/png': 'png',
+		'image/gif': 'gif',
+		'image/webp': 'webp',
+		'image/bmp': 'bmp',
+		'image/jpeg': 'jpg',
+	}
+	const mime = byMime[file.type]
+	if (mime) {
+		return mime
+	}
+	const ext = file.name.toLowerCase().split('.').pop()
+	if (ext === 'jpg' || ext === 'jpeg') {
+		return 'jpg'
+	}
+	if (ext === 'png' || ext === 'gif' || ext === 'webp' || ext === 'bmp') {
+		return ext
+	}
+	return null
+}
+
+function resetInputs() {
+	const payload = initialAttribution.value
+	selectedKind.value = payload?.kind ?? 'license'
+	const license =
+		payload && (payload.kind === 'license' || payload.kind === 'my_project')
+			? parseAttributionLicense(payload.license)
+			: { spdx: '', custom: '' }
+	licenseIdInput.value = license.spdx
+	customLicenseInput.value = license.custom
+	const linkFallback = props.group.flame_project?.url ?? ''
+	linkInput.value = attributionLinkToWork(payload) ?? linkFallback
+	notesInput.value = payload?.notes ?? ''
+	proofImageUrls.value = payload?.image_urls ?? []
+	inputError.value = null
+}
+
+resetInputs()
+
+watch(licenseIdInput, (value) => {
+	if (value !== CUSTOM_LICENSE_VALUE) {
+		customLicenseInput.value = ''
+	}
+})
+
+watch(
+	() => props.group.attribution,
+	() => {
+		resetInputs()
+	},
+	{ deep: true },
+)
+
+type ProjectPermissionField =
+	| 'license_id'
+	| 'custom_license'
+	| 'link_to_work'
+	| 'notes'
+	| 'image_urls'
+
+const PERMISSION_REASONS = {
+	license: {
+		label: defineMessage({
+			id: 'external-files.permissions-card.reason.license',
+			defaultMessage: 'License',
+		}),
+		description: defineMessage({
+			id: 'external-files.permissions-card.license.description',
+			defaultMessage: 'The license of this work permits you to redistribute it in your modpack.',
+		}),
+		proofImagesDescription: defineMessage({
+			id: 'external-files.permissions-card.proof-images-description.license',
+			defaultMessage: 'Upload supporting documentation related to this license.',
+		}),
+		proofImagesOptional: true,
+		fields: ['license_id', 'custom_license', 'link_to_work', 'notes', 'image_urls'] as const,
+	},
+	my_project: {
+		label: defineMessage({
+			id: 'external-files.permissions-card.reason.my-project',
+			defaultMessage: 'My project',
+		}),
+		description: defineMessage({
+			id: 'external-files.permissions-card.my-project.description',
+			defaultMessage: 'Original work created by you.',
+		}),
+		proofImagesDescription: defineMessage({
+			id: 'external-files.permissions-card.proof-images-description.my-project',
+			defaultMessage: 'Upload files that help verify you created this work.',
+		}),
+		proofImagesOptional: true,
+		fields: ['license_id', 'custom_license', 'notes', 'image_urls'] as const,
+	},
+	special_permissions: {
+		label: defineMessage({
+			id: 'external-files.permissions-card.reason.special-permission',
+			defaultMessage: 'Special permission',
+		}),
+		description: defineMessage({
+			id: 'external-files.permissions-card.special-permission.description',
+			defaultMessage:
+				'You have obtained special permission to redistribute this work in your modpack.',
+		}),
+		proofImagesDescription: defineMessage({
+			id: 'external-files.permissions-card.proof-description',
+			defaultMessage:
+				'Include screenshots of messages, emails, or replies from the copyright owner showing that they granted you permission to redistribute their work in your modpack.',
+		}),
+		proofImagesOptional: false,
+		fields: ['link_to_work', 'notes', 'image_urls'] as const,
+	},
+	no_permission: {
+		label: defineMessage({
+			id: 'external-files.permissions-card.reason.no-permission',
+			defaultMessage: 'No permission',
+		}),
+		description: defineMessage({
+			id: 'external-files.permissions-card.no-permission.description',
+			defaultMessage: "You don't have permission to use this work.",
+		}),
+		proofImagesDescription: null,
+		proofImagesOptional: null,
+		fields: ['notes'] as const,
+	},
+} satisfies Record<
+	Labrinth.Attribution.Internal.AttributionResolutionKind,
+	{
+		label: MessageDescriptor
+		description: MessageDescriptor
+		proofImagesDescription: MessageDescriptor | null
+		proofImagesOptional: boolean | null
+		fields: ProjectPermissionField[]
+	}
+>
+
+const permissionReasonFields = computed<ProjectPermissionField[]>(() => {
+	return PERMISSION_REASONS[selectedKind.value]?.fields ?? []
+})
+
+const readViewFields = computed<ProjectPermissionField[]>(() => {
+	const kind = initialAttribution.value?.kind
+	if (!kind) return []
+	return PERMISSION_REASONS[kind]?.fields ?? []
+})
+
+const unknownLicenseMessage = defineMessage({
+	id: 'external-files.permissions-card.license.unknown',
+	defaultMessage: 'Unknown',
+})
+
+const notesNoneMessage = defineMessage({
+	id: 'external-files.permissions-card.notes-none',
+	defaultMessage: 'None',
+})
+
+const isCustomLicense = computed(() => licenseIdInput.value === CUSTOM_LICENSE_VALUE)
+
+const licenseOptions = computed<ComboboxOption<string>[]>(() => [
+	...builtinLicenses
+		.filter((license) => license.short !== '' && license.short !== 'All-Rights-Reserved')
+		.map((license) => ({
+			value: license.short,
+			label: license.short,
+		})),
+	{
+		value: CUSTOM_LICENSE_VALUE,
+		label: formatMessage(
+			defineMessage({
+				id: 'external-files.permissions-card.custom-license-option',
+				defaultMessage: 'Other',
+			}),
+		),
+	},
+])
+
+const licenseReadDisplay = computed(() => {
+	const attr = initialAttribution.value
+	if (!attr || (attr.kind !== 'license' && attr.kind !== 'my_project')) {
+		return null
+	}
+	if (isCustomAttributionLicense(attr.license)) {
+		return { kind: 'custom' as const, value: attr.license.name }
+	}
+	const licenseId = attr.license
+	if (licenseId) {
+		const friendly =
+			builtinLicenses.find((license) => license.short === licenseId)?.friendly ?? licenseId
+		return { kind: 'standard' as const, value: friendly }
+	}
+	return { kind: 'unknown' as const, value: formatMessage(unknownLicenseMessage) }
+})
+
+function buildAttributionLicense(): Labrinth.Attribution.Internal.AttributionLicense | null {
+	const custom = isCustomLicense.value
+	if (!licenseIdInput.value) {
+		inputError.value = formatMessage(messages.licenseRequired)
+		return null
+	}
+	const customLicense = customLicenseInput.value.trim()
+	if (custom && !customLicense) {
+		inputError.value = formatMessage(
+			defineMessage({
+				id: 'external-files.permissions-card.error.custom-license-required',
+				defaultMessage: 'Please describe the custom license.',
+			}),
+		)
+		return null
+	}
+	return custom ? { name: customLicense } : licenseIdInput.value
+}
+
+function buildEditedData(): Labrinth.Attribution.Internal.AttributionResolution | null {
+	inputError.value = null
+	const notes = notesInput.value.trim()
+	const image_urls = [...proofImageUrls.value]
+	switch (selectedKind.value) {
+		case 'license': {
+			const license = buildAttributionLicense()
+			if (!license) {
+				return null
+			}
+			const linkRaw = linkInput.value.trim()
+			if (!linkRaw) {
+				inputError.value = formatMessage(
+					defineMessage({
+						id: 'external-files.permissions-card.error.link-required',
+						defaultMessage: 'Please provide a link.',
+					}),
+				)
+				return null
+			}
+			if (!isValidUrl(linkRaw)) {
+				inputError.value = formatMessage(messages.linkInvalidUrl)
+				return null
+			}
+			return {
+				kind: 'license',
+				license,
+				link_to_work: linkRaw,
+				notes,
+				image_urls,
+			}
+		}
+		case 'my_project': {
+			const license = buildAttributionLicense()
+			if (!license) {
+				return null
+			}
+			return {
+				kind: 'my_project',
+				license,
+				notes,
+				image_urls,
+			}
+		}
+		case 'special_permissions': {
+			const linkRaw = linkInput.value.trim()
+			if (!linkRaw) {
+				inputError.value = formatMessage(
+					defineMessage({
+						id: 'external-files.permissions-card.error.link-required',
+						defaultMessage: 'Please provide a link.',
+					}),
+				)
+				return null
+			}
+			if (!isValidUrl(linkRaw)) {
+				inputError.value = formatMessage(messages.linkInvalidUrl)
+				return null
+			}
+			return {
+				kind: 'special_permissions',
+				link_to_work: linkRaw,
+				notes,
+				image_urls,
+			}
+		}
+		case 'no_permission':
+			return {
+				kind: 'no_permission',
+				notes,
+				image_urls,
+			}
+	}
+}
+
+const uploadProofImageMutation = useMutation({
+	mutationFn: async (file: File) => {
+		const ext = extFromImageFile(file)
+		if (!ext) {
+			throw new Error(
+				formatMessage(
+					defineMessage({
+						id: 'external-files.permissions-card.error.proof-image-invalid-type',
+						defaultMessage: 'Please upload a PNG, JPEG, GIF, WebP, or BMP image.',
+					}),
+				),
+			)
+		}
+		const result = await client.labrinth.images_v3.uploadImage(file, ext, {
+			context: 'project',
+			project_id: props.projectId,
+		}).promise
+		return result.url
+	},
+	onSuccess(url) {
+		proofImageUrls.value = [...proofImageUrls.value, url]
+	},
+})
+
+function handleProofImagesSelected(files: File[]) {
+	const file = files[0]
+	if (!file) {
+		return
+	}
+	inputError.value = null
+	uploadProofImageMutation.mutate(file)
+}
+
+function removeProofImage(index: number) {
+	proofImageUrls.value = proofImageUrls.value.filter((_, i) => i !== index)
+}
+
+const addFilesModalRef = ref<InstanceType<typeof ExternalProjectAddFilesToGroupModal> | null>(null)
+const pendingSplitSha1 = ref<string | null>(null)
+
+const assignFilesMutation = useMutation({
+	mutationFn: async (sha1s: string[]) => {
+		for (const sha1 of sha1s) {
+			await client.labrinth.attribution_internal.assignFileToGroup({
+				sha1,
+				target_group_id: props.group.id,
+				project_id: props.projectId,
+			})
+		}
+	},
+	onSuccess: async () => {
+		await queryClient.invalidateQueries({ queryKey: ['project-attribution', props.projectId] })
+		emit('updated')
+	},
+	onError: (error: Error) => {
+		addNotification({
+			type: 'error',
+			title: formatMessage(
+				defineMessage({
+					id: 'external-files.permissions-card.assign-files-error.title',
+					defaultMessage: 'Could not add files',
+				}),
+			),
+			text: error.message,
+		})
+	},
+})
+
+const splitFileMutation = useMutation({
+	mutationFn: (sha1: string) =>
+		client.labrinth.attribution_internal.splitFile({
+			sha1,
+			project_id: props.projectId,
+		}),
+	onMutate(sha1) {
+		pendingSplitSha1.value = sha1
+	},
+	onSettled() {
+		pendingSplitSha1.value = null
+	},
+	onSuccess: async () => {
+		await queryClient.invalidateQueries({ queryKey: ['project-attribution', props.projectId] })
+		emit('updated')
+	},
+	onError: (error: Error) => {
+		addNotification({
+			type: 'error',
+			title: formatMessage(
+				defineMessage({
+					id: 'external-files.permissions-card.split-file-error.title',
+					defaultMessage: 'Could not split file',
+				}),
+			),
+			text: error.message,
+		})
+	},
+})
+
+const saveMutation = useMutation({
+	mutationFn: (payload: Labrinth.Attribution.Internal.AttributionResolution) =>
+		client.labrinth.attribution_internal.updateGroup(props.group.id, {
+			attribution: payload,
+		}),
+	onSuccess: async () => {
+		await queryClient.invalidateQueries({ queryKey: ['project-attribution', props.projectId] })
+		editing.value = false
+		emit('updated')
+	},
+})
+
+function handleSave() {
+	const data = buildEditedData()
+	if (!data) {
+		return
+	}
+	saveMutation.mutate(data)
+}
+
+function cancelEditing() {
+	resetInputs()
+	if (isAttributed.value) {
+		editing.value = false
+	}
+}
+
+function startEditing() {
+	editing.value = true
+	collapsed.value = false
+	resetInputs()
+}
+
+function handleSplitFile(sha1: string) {
+	splitFileMutation.mutate(sha1)
+}
+
+function handleConfirmAddFiles(sha1s: string[]) {
+	assignFilesMutation.mutate(sha1s)
+}
+
+async function handleAddFilesToGroup(event: MouseEvent) {
+	try {
+		const groups = await queryClient.ensureQueryData({
+			queryKey: ['project-attribution', props.projectId],
+			queryFn: () => client.labrinth.attribution_internal.listProjectAttribution(props.projectId),
+		})
+		addFilesModalRef.value?.show(event, groups)
+	} catch (error) {
+		addNotification({
+			type: 'error',
+			title: formatMessage(
+				defineMessage({
+					id: 'external-files.permissions-card.add-files-modal.load-error.title',
+					defaultMessage: 'Could not load files',
+				}),
+			),
+			text: error instanceof Error ? error.message : String(error),
+		})
+	}
+}
 </script>
+
 <template>
 	<div
 		class="bg-surface-2 p-0 rounded-2xl flex flex-col border-[1px] border-solid border-surface-5 overflow-hidden"
 	>
-		<div class="flex items-center bg-surface-3">
+		<div class="flex items-center bg-surface-3 gap-3">
 			<button
-				class="flex grow m-0 appearance-none p-4 bg-transparent group transition-all"
+				class="flex grow items-center m-0 appearance-none p-4 bg-transparent group transition-all gap-3 text-left min-w-0 outline-offset-[-3px] rounded-2xl"
+				:class="{ 'rounded-b-none': !collapsed, 'rounded-r-none': group.flame_project?.url }"
 				@click="collapsed = !collapsed"
 			>
-				<span class="flex items-center gap-3 group-active:scale-[0.98]">
-					<ChevronDownIcon
-						class="size-6 text-primary transition-transform duration-300"
-						:class="{ 'rotate-180': !collapsed }"
-					/>
-					<span class="text-contrast font-semibold">{{ title }}</span>
+				<ChevronDownIcon
+					class="size-6 text-primary transition-transform duration-300 shrink-0 mb-auto"
+					:class="{ 'rotate-180': !collapsed }"
+				/>
+				<span class="flex flex-col items-start min-w-0 group-active:scale-[0.98]">
+					<span class="flex items-center gap-2 text-contrast font-semibold min-w-0">
+						<span class="truncate">{{ effectiveTitle }}</span>
+						<TagItem
+							v-if="isAttributed && group.attribution?.kind === 'no_permission'"
+							:style="{ '--_bg-color': 'var(--color-red-bg)', '--_color': 'var(--color-red)' }"
+						>
+							{{ formatMessage(messages.noPermissionBadge) }}
+						</TagItem>
+						<TagItem
+							v-else-if="isAttributed"
+							:style="{ '--_bg-color': 'var(--color-green-bg)', '--_color': 'var(--color-green)' }"
+						>
+							{{ formatMessage(messages.attributedBadge) }}
+						</TagItem>
+						<TagItem
+							v-else
+							:style="{
+								'--_bg-color': 'var(--color-orange-bg)',
+								'--_color': 'var(--color-orange)',
+							}"
+						>
+							{{ formatMessage(messages.pendingBadge) }}
+						</TagItem>
+					</span>
+					<span v-if="fileCount > 1" class="text-secondary text-sm font-normal">
+						{{ formatMessage(messages.fileCount, { count: fileCount }) }}
+					</span>
 				</span>
 			</button>
-			<div class="flex items-center gap-2 m-4 ml-0">
-				<ButtonStyled type="outlined">
-					<button>
-						<ListBulletedIcon />
-						Versions
-					</button>
-				</ButtonStyled>
-			</div>
+			<a
+				v-if="!!group.flame_project?.url || !!attributionLinkToWork(initialAttribution)"
+				:href="attributionLinkToWork(initialAttribution) ?? group.flame_project?.url"
+				target="_blank"
+				rel="noopener"
+				class="text-link flex items-center mr-4 outline-offset-[4px] rounded-sm"
+			>
+				{{ formatMessage(messages.originalProjectPage) }}
+				<ExternalIcon class="size-3 shrink-0 mb-2 ml-1" />
+			</a>
 		</div>
+
 		<Collapsible
 			:collapsed="collapsed"
 			class="border-0 border-solid border-t border-surface-5 rounded-b-2xl"
 		>
-			<div class="flex flex-col gap-2 p-4">
-				<span class="text-contrast font-semibold">Included in versions:</span>
-				<div class="flex flex-wrap gap-2">
-					<template v-for="version in ['4.0.0', '3.5.15', '3.5.14']" :key="version">
-						<div
-							class="px-3 py-2 rounded-xl flex items-center gap-2 border-[1px] border-solid border-surface-5"
+			<div class="flex flex-col gap-3 p-4">
+				<span class="text-contrast font-semibold">
+					{{ formatMessage(messages.includedFiles) }}
+				</span>
+				<div class="grid grid-cols-2 gap-2">
+					<span
+						v-for="file in group.files"
+						:key="file.sha1"
+						class="pl-3 rounded-xl grid grid-cols-[auto_1fr_auto] items-center gap-2 border-[1px] border-solid border-surface-5 bg-surface-2"
+					>
+						<FileIcon class="size-4 shrink-0 my-2" />
+						<span class="max-w-[22rem] truncate my-2">
+							{{ file.name.split('/').pop() }}
+						</span>
+						<ButtonStyled v-if="group.files.length > 1" circular size="small">
+							<button
+								v-tooltip="formatMessage(messages.splitFile)"
+								class="m-1"
+								type="button"
+								:disabled="splitFileMutation.isPending.value"
+								@click="handleSplitFile(file.sha1)"
+							>
+								<SpinnerIcon
+									v-if="splitFileMutation.isPending.value && pendingSplitSha1 === file.sha1"
+									class="size-4 shrink-0 animate-spin"
+								/>
+								<XIcon v-else class="size-4 shrink-0" />
+							</button>
+						</ButtonStyled>
+					</span>
+					<div>
+						<ButtonStyled>
+							<button type="button" @click="handleAddFilesToGroup($event)">
+								<PlusIcon class="size-4 shrink-0" /> {{ formatMessage(messages.addFilesToGroup) }}
+							</button>
+						</ButtonStyled>
+					</div>
+				</div>
+				<template v-if="containingVersions.length > 0">
+					<span class="text-contrast font-semibold">
+						{{ formatMessage(messages.includedInVersions, { count: containingVersions.length }) }}
+					</span>
+					<div class="flex flex-wrap gap-2">
+						<nuxt-link
+							v-for="version in containingVersions"
+							:key="version.id"
+							:to="`/project/${projectId}/version/${version.id}`"
+							target="_blank"
+							class="px-3 py-2 rounded-xl flex items-center gap-2 border-[1px] border-solid border-surface-5 bg-surface-3"
 						>
-							<VersionIcon />
-							{{ version }}
+							<VersionIcon class="size-4 shrink-0" />
+							<span class="max-w-[22rem] truncate">
+								{{ version.version_number }}
+							</span>
+						</nuxt-link>
+					</div>
+				</template>
+				<template v-else>
+					<span class="text-secondary text-sm">
+						{{ formatMessage(messages.notUsedInVersions) }}
+					</span>
+				</template>
+
+				<div
+					v-if="!editing && initialAttribution"
+					class="flex gap-4 flex-col rounded-2xl p-4 mt-2 bg-surface-3"
+				>
+					<div class="flex gap-4">
+						<div class="flex flex-col gap-3 w-full">
+							<div class="flex items-start justify-between gap-3">
+								<span class="text-contrast font-semibold">
+									{{ formatMessage(PERMISSION_REASONS[initialAttribution.kind].label) }}
+								</span>
+							</div>
+							<div class="flex flex-col gap-3">
+								<div class="grid grid-cols-[max-content_1fr] gap-x-4 gap-y-2 items-baseline">
+									<template
+										v-if="
+											initialAttribution.kind === 'license' ||
+											initialAttribution.kind === 'my_project'
+										"
+									>
+										<span class="text-secondary font-medium">
+											{{ formatMessage(messages.licensedAs) }}
+										</span>
+										<a
+											v-if="
+												licenseReadDisplay?.kind === 'custom' &&
+												isValidUrl(licenseReadDisplay.value)
+											"
+											:href="licenseReadDisplay.value"
+											target="_blank"
+											rel="noopener"
+											class="text-link truncate"
+										>
+											{{ licenseReadDisplay.value }}
+										</a>
+										<span v-else class="text-primary whitespace-pre-wrap break-words">
+											{{ licenseReadDisplay?.value }}
+										</span>
+									</template>
+									<template
+										v-if="
+											readViewFields.includes('link_to_work') &&
+											attributionLinkToWork(initialAttribution)
+										"
+									>
+										<span class="text-secondary font-medium">
+											{{ formatMessage(messages.linkLabel) }}
+										</span>
+										<a
+											:href="attributionLinkToWork(initialAttribution)"
+											target="_blank"
+											rel="noopener"
+											class="text-link truncate"
+										>
+											{{ attributionLinkToWork(initialAttribution) }}
+										</a>
+									</template>
+									<template v-if="readViewFields.includes('notes')">
+										<span class="text-secondary font-medium">
+											{{ formatMessage(messages.notesLabel) }}
+										</span>
+										<span class="text-primary whitespace-pre-wrap break-words">
+											{{
+												initialAttribution.notes?.trim()
+													? initialAttribution.notes
+													: formatMessage(notesNoneMessage)
+											}}
+										</span>
+									</template>
+								</div>
+								<div v-if="initialAttribution.image_urls?.length" class="flex flex-col gap-2">
+									<span class="text-secondary font-medium">
+										{{ formatMessage(messages.proofImagesLabel) }}
+									</span>
+									<div class="flex flex-wrap gap-2">
+										<a
+											v-for="(src, idx) in initialAttribution.image_urls"
+											:key="`${src}-${idx}`"
+											:href="src"
+											target="_blank"
+											rel="noopener"
+											class="block rounded-xl border-[1px] border-solid border-surface-5 overflow-hidden shrink-0"
+										>
+											<img
+												:src="src"
+												:alt="formatMessage(messages.proofImageThumbnailAlt, { n: idx + 1 })"
+												class="max-h-40 max-w-full object-contain"
+											/>
+										</a>
+									</div>
+								</div>
+							</div>
 						</div>
-					</template>
+						<div>
+							<ButtonStyled>
+								<button @click="startEditing">
+									<EditIcon /> {{ formatMessage(commonMessages.editButton) }}
+								</button>
+							</ButtonStyled>
+						</div>
+					</div>
+
+					<div
+						v-if="group.attributed_at"
+						class="inline-flex items-center flex-wrap gap-x-2 gap-y-1 pt-3 mt-1 border-0 border-t border-solid border-surface-5"
+					>
+						<IntlFormatted
+							:message-id="messages.lastUpdated"
+							:values="{ date: formatDate(group.attributed_at) }"
+						>
+							<template #user>
+								<nuxt-link
+									:to="attributorLink"
+									class="inline-flex items-center gap-1.5 text-primary font-medium hover:underline max-w-full min-w-0"
+								>
+									<Avatar
+										v-if="attributorMember"
+										:src="attributorMember.user.avatar_url"
+										:alt="attributorMember.user.username"
+										size="1rem"
+										class="shrink-0"
+									/>
+									<UserRoundIcon v-else class="size-4 shrink-0" />
+									<span class="truncate">{{ attributorLabel }}</span>
+								</nuxt-link>
+							</template>
+						</IntlFormatted>
+					</div>
 				</div>
+
 				<div
+					v-else
 					class="rounded-2xl p-4 mt-2 border-[1px] border-solid border-surface-5 flex flex-col gap-3"
 				>
-					<span class="text-contrast font-semibold">Type</span>
+					<span class="text-contrast font-semibold">
+						{{ formatMessage(messages.typeLabel) }}
+					</span>
 					<Chips
-						v-model="selectedPermissionsType"
-						:items="['License', 'My project', 'Special permission', 'No permission']"
+						v-model="selectedKind"
+						:items="permissionKinds"
+						:format-label="(kind) => formatMessage(PERMISSION_REASONS[kind].label)"
+						:capitalize="false"
 					/>
-					<template v-if="selectedPermissionsType === 'License'">
-						<span>The license of this work permits you to redistribute it in your modpack.</span>
-						<span class="text-contrast font-semibold mt-1">License</span>
-						<Combobox
-							class="max-w-80"
-							:options="[{ label: 'MIT', value: 'MIT' }]"
-							:model-value="'MIT'"
-						/>
-						<span class="text-contrast font-semibold mt-1"> Link to work </span>
-						<StyledInput
-							type="text"
-							class="max-w-[30rem]"
-							placeholder="https://example.com/link-to-work"
-						/>
+					<span>{{ formatMessage(PERMISSION_REASONS[selectedKind].description) }}</span>
+					<div v-if="permissionReasonFields.includes('link_to_work')" class="flex flex-col gap-2">
 						<span class="text-contrast font-semibold mt-1">
-							Notes
-							<span class="font-normal text-primary">(optional)</span>
+							{{ formatMessage(messages.linkLabel) }}
 						</span>
 						<StyledInput
+							v-model="linkInput"
 							type="text"
-							resize="both"
-							multiline
 							class="max-w-[40rem]"
-							placeholder="Write something here..."
+							:placeholder="`https://example.com/${formatMessage(messages.linkToWorkUrlPlaceholder)}`"
 						/>
-					</template>
-					<template v-else-if="selectedPermissionsType === 'My project'">
-						<span>Original work created by you.</span>
-						<span class="text-contrast font-semibold mt-1">License</span>
+					</div>
+					<div v-if="permissionReasonFields.includes('license_id')" class="flex flex-col gap-2">
+						<span class="text-contrast font-semibold mt-1">
+							{{ formatMessage(messages.licenseLabel) }}
+						</span>
 						<Combobox
+							v-model="licenseIdInput"
 							class="max-w-80"
-							:options="[{ label: 'MIT', value: 'MIT' }]"
-							:model-value="'MIT'"
+							:options="licenseOptions"
+							searchable
+							:search-placeholder="formatMessage(messages.selectLicenseLabel)"
 						/>
+					</div>
+					<div
+						v-if="permissionReasonFields.includes('custom_license') && isCustomLicense"
+						class="flex flex-col gap-2"
+					>
 						<span class="text-contrast font-semibold mt-1">
-							Notes
-							<span class="font-normal text-primary">(optional)</span>
+							{{ formatMessage(messages.customLicenseLabel) }}
 						</span>
 						<StyledInput
+							v-model="customLicenseInput"
 							type="text"
-							resize="both"
-							multiline
 							class="max-w-[40rem]"
-							placeholder="Write something here..."
-						/>
-					</template>
-					<template v-else-if="selectedPermissionsType === 'Special permission'">
-						<span>
-							You have obtained special permission to redistribute this work in your modpack.
-						</span>
-						<span class="text-contrast font-semibold mt-1"> Link to work </span>
-						<StyledInput
-							type="text"
-							class="max-w-[30rem]"
-							placeholder="https://example.com/link-to-work"
+							:placeholder="`https://example.com/${formatMessage(messages.linkToLicenseUrlPlaceholder)}`"
 						/>
-						<div class="flex flex-col gap-1 mt-1">
-							<span class="text-contrast font-semibold"> Proof and explanation </span>
-							<span>
-								Include screenshots of messages, emails, or replies from the copyright owner showing
-								that they granted you permission to redistribute their work in your modpack.
-							</span>
-						</div>
-						<StyledInput
-							type="text"
-							resize="both"
-							multiline
-							class="max-w-[40rem]"
-							placeholder="Write something here..."
-						/>
-						<Admonition
-							type="warning"
-							header="Modrinth staff may attempt to verify submitted proof"
-						>
-							If you are found to have lied or manipulated the images uploaded, your project and
-							account may be terminated.
-						</Admonition>
-					</template>
-					<template v-else-if="selectedPermissionsType === 'No permission'">
-						<span>You don't have permission to use this work.</span>
+					</div>
+					<div v-if="permissionReasonFields.includes('notes')" class="flex flex-col gap-2">
 						<span class="text-contrast font-semibold mt-1">
-							Notes
-							<span class="font-normal text-primary">(optional)</span>
+							{{ formatMessage(messages.notesLabel) }}
+							<span class="font-normal text-primary">{{ formatMessage(messages.optional) }}</span>
 						</span>
 						<StyledInput
+							v-model="notesInput"
 							type="text"
 							resize="both"
 							multiline
 							class="max-w-[40rem]"
-							placeholder="Write something here..."
+							:placeholder="formatMessage(messages.notesPlaceholder)"
 						/>
-					</template>
+					</div>
+					<div v-if="permissionReasonFields.includes('image_urls')" class="flex flex-col gap-2">
+						<div class="flex flex-col gap-2 mt-1">
+							<div class="flex flex-col gap-1 mt-1">
+								<span class="text-contrast font-semibold">
+									{{ formatMessage(messages.proofImagesLabel) }}
+									<span
+										v-if="!!PERMISSION_REASONS[selectedKind].proofImagesOptional"
+										class="font-normal text-primary"
+										>{{ formatMessage(messages.optional) }}</span
+									>
+								</span>
+								<span v-if="PERMISSION_REASONS[selectedKind].proofImagesDescription">{{
+									formatMessage(PERMISSION_REASONS[selectedKind].proofImagesDescription!)
+								}}</span>
+							</div>
+							<div v-if="proofImageUrls.length > 0" class="grid grid-cols-2 gap-4">
+								<div
+									v-for="(src, idx) in proofImageUrls"
+									:key="`${src}-${idx}`"
+									class="relative rounded-xl border-[1px] border-solid border-surface-5 overflow-hidden shrink-0"
+								>
+									<img
+										:src="src"
+										:alt="formatMessage(messages.proofImageThumbnailAlt, { n: idx + 1 })"
+										class="flex w-full object-contain bg-surface-3"
+									/>
+									<div class="absolute top-2 right-2">
+										<ButtonStyled circular>
+											<button
+												v-tooltip="formatMessage(messages.proofImageRemove)"
+												type="button"
+												@click="removeProofImage(idx)"
+											>
+												<TrashIcon />
+											</button>
+										</ButtonStyled>
+									</div>
+								</div>
+							</div>
+							<div class="grid grid-cols-2 gap-4 mt-2">
+								<FileInput
+									accept="image/png,image/jpeg,image/gif,image/webp,image/bmp"
+									:prompt="formatMessage(messages.proofImagesUploadPrompt)"
+									long-style
+									should-always-reset
+									:max-size="MAX_PROOF_IMAGE_BYTES"
+									:disabled="
+										uploadProofImageMutation.isPending.value || saveMutation.isPending.value
+									"
+									class="!bg-surface-3"
+									@change="handleProofImagesSelected"
+								>
+									<UploadIcon class="size-5 shrink-0" />
+								</FileInput>
+							</div>
+							<p v-if="uploadProofImageMutation.isError.value" class="text-red text-sm m-0">
+								{{ String(uploadProofImageMutation.error.value) }}
+							</p>
+						</div>
+					</div>
+					<Admonition
+						v-if="selectedKind === 'special_permissions'"
+						type="warning"
+						:header="formatMessage(messages.proofWarningTitle)"
+						:body="formatMessage(messages.proofWarningBody)"
+					/>
+
+					<p v-if="inputError" class="text-red text-sm m-0">{{ inputError }}</p>
+					<p v-else-if="saveMutation.isError.value" class="text-red text-sm m-0">
+						{{ String(saveMutation.error.value) }}
+					</p>
+
 					<hr class="mt-1 bg-surface-5 border-none h-[1px] w-full" />
 					<div class="flex items-center gap-2 justify-end">
-						<ButtonStyled type="outlined">
-							<button>
-								<XIcon />
-								Cancel
+						<ButtonStyled v-if="editing && isAttributed" type="outlined">
+							<button
+								:disabled="saveMutation.isPending.value || uploadProofImageMutation.isPending.value"
+								@click="cancelEditing"
+							>
+								<XIcon /> {{ formatMessage(commonMessages.cancelButton) }}
 							</button>
 						</ButtonStyled>
 						<ButtonStyled color="brand">
-							<button>
-								<SaveIcon />
-								Save
+							<button
+								:disabled="saveMutation.isPending.value || uploadProofImageMutation.isPending.value"
+								@click="handleSave"
+							>
+								<template v-if="saveMutation.isPending.value">
+									<SpinnerIcon class="animate-spin" />
+									{{ formatMessage(commonMessages.savingButton) }}
+								</template>
+								<template v-else-if="isAttributed">
+									<SaveIcon /> {{ formatMessage(messages.saveAttribution) }}
+								</template>
+								<template v-else>
+									<CheckIcon /> {{ formatMessage(messages.addAttribution) }}
+								</template>
 							</button>
 						</ButtonStyled>
 					</div>
 				</div>
 			</div>
 		</Collapsible>
+
+		<ExternalProjectAddFilesToGroupModal
+			ref="addFilesModalRef"
+			:group-id="group.id"
+			:pending="assignFilesMutation.isPending.value"
+			@confirm="handleConfirmAddFiles"
+		/>
 	</div>
 </template>
diff --git a/packages/ui/src/components/external_files/index.ts b/packages/ui/src/components/external_files/index.ts
index e0ec715662..a4b3da1d0d 100644
--- a/packages/ui/src/components/external_files/index.ts
+++ b/packages/ui/src/components/external_files/index.ts
@@ -1,3 +1,3 @@
 export { default as ExternalProjectLicenseStateTag } from './ExternalProjectLicenseStateTag.vue'
 export { default as ExternalProjectLookupCard } from './ExternalProjectLookupCard.vue'
-export type { ExternalLicenseStatus } from './types.ts'
+export { default as ExternalProjectPermissionsCard } from './ExternalProjectPermissionsCard.vue'
diff --git a/packages/ui/src/components/external_files/types.ts b/packages/ui/src/components/external_files/types.ts
deleted file mode 100644
index 331d41bf95..0000000000
--- a/packages/ui/src/components/external_files/types.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-export type ExternalLicenseStatus =
-	| 'yes'
-	| 'with-attribution-and-source'
-	| 'with-attribution'
-	| 'no'
-	| 'permanent-no'
-	| 'unidentified'
diff --git a/packages/ui/src/components/modal/NewModal.vue b/packages/ui/src/components/modal/NewModal.vue
index 43dbc255c5..26197c96e0 100644
--- a/packages/ui/src/components/modal/NewModal.vue
+++ b/packages/ui/src/components/modal/NewModal.vue
@@ -120,7 +120,11 @@
 						<slot> You just lost the game.</slot>
 					</div>
 
-					<div v-if="$slots.actions" class="p-4 pt-0">
+					<div
+						v-if="$slots.actions"
+						:class="{ 'pt-4 border-0 border-t border-solid border-surface-5': actionsDivider }"
+						class="p-4 pt-0"
+					>
 						<slot name="actions" />
 					</div>
 				</div>
@@ -175,6 +179,7 @@ const props = withDefaults(
 		width?: string
 		/** Disables all close actions (close button, ESC key, click outside). */
 		disableClose?: boolean
+		actionsDivider?: boolean
 	}>(),
 	{
 		type: true,
@@ -197,6 +202,7 @@ const props = withDefaults(
 		maxWidth: undefined,
 		width: undefined,
 		disableClose: false,
+		actionsDivider: false,
 	},
 )
 
diff --git a/packages/ui/src/components/project/ProjectPageVersions.vue b/packages/ui/src/components/project/ProjectPageVersions.vue
index 5b5131d390..d14405e2bc 100644
--- a/packages/ui/src/components/project/ProjectPageVersions.vue
+++ b/packages/ui/src/components/project/ProjectPageVersions.vue
@@ -116,8 +116,21 @@
 							}"
 							title="`${version.version_number} - ${version.name}`"
 						>
-							<div class="font-bold text-contrast text-ellipsis overflow-hidden">
-								{{ version.version_number }}
+							<div class="flex items-center gap-2">
+								<div class="font-bold text-contrast text-ellipsis overflow-hidden">
+									{{ version.version_number }}
+								</div>
+								<div
+									v-if="version.files_missing_attribution"
+									v-tooltip="`Version withheld due to missing permissions`"
+									class="z-[1]"
+									:style="{
+										'--_bg-color': 'var(--color-orange-bg)',
+										'--_color': 'var(--color-orange)',
+									}"
+								>
+									<TagItem> <CircleAlertIcon /> Withheld</TagItem>
+								</div>
 							</div>
 							<div class="text-xs font-medium text-ellipsis overflow-hidden">
 								{{ version.name }}
@@ -260,7 +273,14 @@
 </template>
 <script setup lang="ts">
 import type { Labrinth } from '@modrinth/api-client'
-import { CalendarIcon, DownloadIcon, getLoaderIcon, PlusIcon, StarIcon } from '@modrinth/assets'
+import {
+	CalendarIcon,
+	CircleAlertIcon,
+	DownloadIcon,
+	getLoaderIcon,
+	PlusIcon,
+	StarIcon,
+} from '@modrinth/assets'
 import {
 	AutoLink,
 	ButtonStyled,
diff --git a/packages/ui/src/locales/en-US/index.json b/packages/ui/src/locales/en-US/index.json
index 5dfe375f43..5a87af99a1 100644
--- a/packages/ui/src/locales/en-US/index.json
+++ b/packages/ui/src/locales/en-US/index.json
@@ -806,6 +806,192 @@
   "creation-flow.title.set-up-server": {
     "defaultMessage": "Set up server"
   },
+  "external-files.permissions-card.add": {
+    "defaultMessage": "Add attribution"
+  },
+  "external-files.permissions-card.add-files-modal.confirm": {
+    "defaultMessage": "{count, plural, one {Add file} other {Add files}}"
+  },
+  "external-files.permissions-card.add-files-modal.description": {
+    "defaultMessage": "Select any files that should be moved into this group."
+  },
+  "external-files.permissions-card.add-files-modal.empty": {
+    "defaultMessage": "There are no files in other groups that can be moved here."
+  },
+  "external-files.permissions-card.add-files-modal.load-error.title": {
+    "defaultMessage": "Could not load files"
+  },
+  "external-files.permissions-card.add-files-modal.no-search-results": {
+    "defaultMessage": "No files match your search."
+  },
+  "external-files.permissions-card.add-files-modal.search-placeholder": {
+    "defaultMessage": "Search files…"
+  },
+  "external-files.permissions-card.add-files-modal.selected-count": {
+    "defaultMessage": "{count, plural, one {# file selected} other {# files selected}}"
+  },
+  "external-files.permissions-card.add-files-modal.title": {
+    "defaultMessage": "Add files to this group"
+  },
+  "external-files.permissions-card.add-files-to-group": {
+    "defaultMessage": "Add files..."
+  },
+  "external-files.permissions-card.assign-files-error.title": {
+    "defaultMessage": "Could not add files"
+  },
+  "external-files.permissions-card.badge.attributed": {
+    "defaultMessage": "Attributed"
+  },
+  "external-files.permissions-card.badge.no-permission": {
+    "defaultMessage": "No permission"
+  },
+  "external-files.permissions-card.badge.pending": {
+    "defaultMessage": "Pending"
+  },
+  "external-files.permissions-card.custom-license-label": {
+    "defaultMessage": "Link to license"
+  },
+  "external-files.permissions-card.custom-license-option": {
+    "defaultMessage": "Other"
+  },
+  "external-files.permissions-card.error.custom-license-required": {
+    "defaultMessage": "Please describe the custom license."
+  },
+  "external-files.permissions-card.error.license-required": {
+    "defaultMessage": "Please select a license."
+  },
+  "external-files.permissions-card.error.link-invalid-url": {
+    "defaultMessage": "Link must be a valid URL."
+  },
+  "external-files.permissions-card.error.link-required": {
+    "defaultMessage": "Please provide a link."
+  },
+  "external-files.permissions-card.error.proof-image-invalid-type": {
+    "defaultMessage": "Please upload a PNG, JPEG, GIF, WebP, or BMP image."
+  },
+  "external-files.permissions-card.fallback-group-title": {
+    "defaultMessage": "Attribution group {id}"
+  },
+  "external-files.permissions-card.file-count": {
+    "defaultMessage": "{count, plural, one {# file} other {# files}}"
+  },
+  "external-files.permissions-card.included-files": {
+    "defaultMessage": "Included files:"
+  },
+  "external-files.permissions-card.included-in-versions": {
+    "defaultMessage": "Included in {count, plural, one {# version} other {# versions}}:"
+  },
+  "external-files.permissions-card.input-optional": {
+    "defaultMessage": "(optional)"
+  },
+  "external-files.permissions-card.last-updated": {
+    "defaultMessage": "Last updated on {date} by {user}"
+  },
+  "external-files.permissions-card.license-label": {
+    "defaultMessage": "License"
+  },
+  "external-files.permissions-card.license.description": {
+    "defaultMessage": "The license of this work permits you to redistribute it in your modpack."
+  },
+  "external-files.permissions-card.license.unknown": {
+    "defaultMessage": "Unknown"
+  },
+  "external-files.permissions-card.licensed-as": {
+    "defaultMessage": "Licensed:"
+  },
+  "external-files.permissions-card.link-label": {
+    "defaultMessage": "Link to work"
+  },
+  "external-files.permissions-card.link-to-license-url-placeholder": {
+    "defaultMessage": "link-to-license"
+  },
+  "external-files.permissions-card.link-to-work-url-placeholder": {
+    "defaultMessage": "link-to-work"
+  },
+  "external-files.permissions-card.my-project.description": {
+    "defaultMessage": "Original work created by you."
+  },
+  "external-files.permissions-card.no-permission.description": {
+    "defaultMessage": "You don't have permission to use this work."
+  },
+  "external-files.permissions-card.not-used-in-versions": {
+    "defaultMessage": "These files are not currently used by any version."
+  },
+  "external-files.permissions-card.notes-label": {
+    "defaultMessage": "Notes"
+  },
+  "external-files.permissions-card.notes-none": {
+    "defaultMessage": "None"
+  },
+  "external-files.permissions-card.notes-placeholder": {
+    "defaultMessage": "Write something here..."
+  },
+  "external-files.permissions-card.original-project-page": {
+    "defaultMessage": "Original project"
+  },
+  "external-files.permissions-card.proof-description": {
+    "defaultMessage": "Include screenshots of messages, emails, or replies from the copyright owner showing that they granted you permission to redistribute their work in your modpack."
+  },
+  "external-files.permissions-card.proof-image-alt": {
+    "defaultMessage": "Proof screenshot {n}"
+  },
+  "external-files.permissions-card.proof-image-remove": {
+    "defaultMessage": "Remove image"
+  },
+  "external-files.permissions-card.proof-images-description.license": {
+    "defaultMessage": "Upload supporting documentation related to this license."
+  },
+  "external-files.permissions-card.proof-images-description.my-project": {
+    "defaultMessage": "Upload files that help verify you created this work."
+  },
+  "external-files.permissions-card.proof-images-label": {
+    "defaultMessage": "Proof images"
+  },
+  "external-files.permissions-card.proof-images-upload-prompt": {
+    "defaultMessage": "Drag and drop to upload or click to select an image"
+  },
+  "external-files.permissions-card.proof-label": {
+    "defaultMessage": "Proof and explanation"
+  },
+  "external-files.permissions-card.proof-warning.body": {
+    "defaultMessage": "If you are found to have lied or manipulated the images uploaded, your project and account may be terminated."
+  },
+  "external-files.permissions-card.proof-warning.title": {
+    "defaultMessage": "Modrinth staff may verify submitted proof"
+  },
+  "external-files.permissions-card.reason.license": {
+    "defaultMessage": "License"
+  },
+  "external-files.permissions-card.reason.my-project": {
+    "defaultMessage": "My project"
+  },
+  "external-files.permissions-card.reason.no-permission": {
+    "defaultMessage": "No permission"
+  },
+  "external-files.permissions-card.reason.special-permission": {
+    "defaultMessage": "Special permission"
+  },
+  "external-files.permissions-card.save": {
+    "defaultMessage": "Save attribution"
+  },
+  "external-files.permissions-card.select-license-label": {
+    "defaultMessage": "Select a license..."
+  },
+  "external-files.permissions-card.special-permission.description": {
+    "defaultMessage": "You have obtained special permission to redistribute this work in your modpack."
+  },
+  "external-files.permissions-card.split-file": {
+    "defaultMessage": "Remove from group"
+  },
+  "external-files.permissions-card.split-file-error.title": {
+    "defaultMessage": "Could not split file"
+  },
+  "external-files.permissions-card.type-label": {
+    "defaultMessage": "Permission reason"
+  },
+  "external-files.permissions-card.unnamed-multi-group-title": {
+    "defaultMessage": "{filename} + {count} more"
+  },
   "external-project-license-status.no": {
     "defaultMessage": "No"
   },