fix(app): react at once when picking a +: autocomplete emoji (#3010 )

perf(gateway): make channel moves cheap in large guilds (#3008 )
fix(app): keep the caret after inserted emoji (#3007 )
2026-10-09 20:22:11 +09:00 · 2026-09-28 12:30:45 +02:00 · 2026-09-28 02:07:47 +02:00 · 2026-09-28 01:56:08 +02:00 · 2026-09-28 01:47:55 +02:00 · 2026-09-28 01:10:52 +02:00
6159 changed files with 745291 additions and 637605 deletions
@@ -1,22 +1,21 @@
-FROM chrislusf/seaweedfs:4.31 AS seaweedfs
+FROM chrislusf/seaweedfs:4.47 AS seaweedfs

-FROM erlang:28.5.0.1
+FROM erlang:28.5.0.6

 ARG USERNAME=vscode
 ARG USER_UID=1000
 ARG USER_GID=1000
-ARG NODE_MAJOR=24
-ARG ELP_VERSION=2026-02-27
-ARG HELM_VERSION=4.2.0
-ARG PNPM_VERSION=10.29.3
-ARG WASM_BINDGEN_VERSION=0.2.122
+ARG NODE_MAJOR=26
+ARG ELP_VERSION=2026-08-10
+ARG PNPM_VERSION=11.27.0
+ARG WASM_BINDGEN_VERSION=0.2.128

 ENV DEBIAN_FRONTEND=noninteractive

 RUN apt-get update \
 	&& apt-get install -y --no-install-recommends \
+		acl \
 		bash \
-		brotli \
 		build-essential \
 		ca-certificates \
 		clang \
@@ -33,6 +32,7 @@ RUN apt-get update \
 		jq \
 		libasound2 \
 		libatk-bridge2.0-0 \
+		libaom-dev \
 		libavcodec-dev \
 		libavfilter-dev \
 		libavformat-dev \
@@ -42,19 +42,25 @@ RUN apt-get update \
 		libfido2-dev \
 		libgbm1 \
 		libgtk-3-0 \
+		libimage-exiftool-perl \
 		libnotify4 \
 		libnss3 \
 		libpipewire-0.3-dev \
 		libpulse-dev \
 		libsecret-1-0 \
 		libudev-dev \
-		libuv1-dev \
 		libcurl4-openssl-dev \
 		libswresample-dev \
 		libswscale-dev \
+		libdav1d-dev \
+		libde265-dev \
+		liblcms2-dev \
 		libvips-dev \
+		libyuv-dev \
 		libwayland-dev \
 		libwebp-dev \
+		nasm \
+		yasm \
 		libssl-dev \
 		libx11-xcb1 \
 		libxcb-dri3-0 \
@@ -71,16 +77,15 @@ RUN apt-get update \
 		ninja-build \
 		openssh-client \
 		pkg-config \
-		protobuf-compiler \
 		python3 \
 		python3-pip \
-		rsync \
+		python3-venv \
 		sudo \
 		rpm \
 		unzip \
-		webp \
 		xz-utils \
 		xdg-utils \
+		zlib1g-dev \
 		zstd \
 	&& rm -rf /var/lib/apt/lists/*

@@ -90,6 +95,7 @@ RUN apt-get update \
 		bat \
 		btop \
 		docker-cli \
+		docker-compose \
 		dnsutils \
 		fd-find \
 		gdb \
@@ -122,24 +128,33 @@ RUN apt-get update \
 	&& ln -sf /usr/bin/batcat /usr/local/bin/bat \
 	&& rm -rf /var/lib/apt/lists/*

-RUN curl -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | bash - \
+RUN curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | bash - \
 	&& apt-get install -y --no-install-recommends nodejs \
 	&& rm -rf /var/lib/apt/lists/* \
-	&& corepack enable
+	&& npm install -g "pnpm@${PNPM_VERSION}" \
+	&& pnpm --version

-RUN ARCH="$(dpkg --print-architecture)" \
-	&& case "$ARCH" in \
-		amd64) HELM_ARCH="amd64" ;; \
-		arm64) HELM_ARCH="arm64" ;; \
-		*) echo "Unsupported architecture for Helm: $ARCH" >&2; exit 1 ;; \
-	esac \
-	&& curl -fsSL "https://get.helm.sh/helm-v${HELM_VERSION}-linux-${HELM_ARCH}.tar.gz" -o /tmp/helm.tgz \
-	&& tar -C /tmp -xzf /tmp/helm.tgz "linux-${HELM_ARCH}/helm" \
-	&& mv "/tmp/linux-${HELM_ARCH}/helm" /usr/local/bin/helm \
-	&& chmod +x /usr/local/bin/helm \
-	&& rm -rf /tmp/helm.tgz "/tmp/linux-${HELM_ARCH}"
+RUN python3 -m pip install --break-system-packages --no-cache-dir awscli

-RUN python3 -m pip install --break-system-packages --no-cache-dir awscli cqlsh
+COPY fluxer_media_proxy/tools/install-native-deps.sh /tmp/fluxer-install-native-deps.sh
+RUN /tmp/fluxer-install-native-deps.sh /usr/local \
+	&& rm /tmp/fluxer-install-native-deps.sh
+
+ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/usr/local/lib64/pkgconfig
+ENV LD_LIBRARY_PATH=/usr/local/lib
+
+RUN printf '%s\n' \
+		'#include <libheif/heif.h>' \
+		'#include <string.h>' \
+		'#if !LIBHEIF_HAVE_VERSION(1, 23, 0)' \
+		'#error the source-built libheif headers must win the include search' \
+		'#endif' \
+		'int main(void) { return strcmp(heif_get_version(), LIBHEIF_VERSION) != 0; }' \
+		>/tmp/fluxer-heif-probe.c \
+	&& cc /tmp/fluxer-heif-probe.c $(pkg-config --cflags --libs libheif) -o /tmp/fluxer-heif-probe \
+	&& /tmp/fluxer-heif-probe \
+	&& [ "$(pkg-config --variable=prefix libheif)" = /usr/local ] \
+	&& rm /tmp/fluxer-heif-probe.c /tmp/fluxer-heif-probe

 COPY tools/fonts/requirements.txt /tmp/fluxer-fonts-requirements.txt
 RUN python3 -m pip install --break-system-packages --no-cache-dir -r /tmp/fluxer-fonts-requirements.txt \
@@ -147,18 +162,13 @@ RUN python3 -m pip install --break-system-packages --no-cache-dir -r /tmp/fluxer
 	&& pyftsubset --help >/dev/null \
 	&& python3 -c "import fontTools, brotli"

-RUN if ! command -v rebar3 >/dev/null 2>&1; then \
-		curl -fsSL https://s3.amazonaws.com/rebar3/rebar3 -o /usr/local/bin/rebar3 \
-		&& chmod +x /usr/local/bin/rebar3; \
-	fi
-
 RUN ARCH="$(dpkg --print-architecture)" \
 	&& case "$ARCH" in \
 		amd64) ELP_ARCH="x86_64" ;; \
 		arm64) ELP_ARCH="aarch64" ;; \
 		*) echo "Unsupported architecture for ELP: $ARCH" >&2; exit 1 ;; \
 	esac \
-	&& curl -fsSL "https://github.com/WhatsApp/erlang-language-platform/releases/download/${ELP_VERSION}/elp-linux-${ELP_ARCH}-unknown-linux-gnu-otp-28.tar.gz" -o /tmp/elp.tgz \
+	&& curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL "https://github.com/WhatsApp/erlang-language-platform/releases/download/${ELP_VERSION}/elp-linux-${ELP_ARCH}-unknown-linux-gnu-otp-28.5.tar.gz" -o /tmp/elp.tgz \
 	&& tar -C /usr/local/bin -xzf /tmp/elp.tgz elp \
 	&& chmod +x /usr/local/bin/elp \
 	&& rm /tmp/elp.tgz
@@ -179,16 +189,10 @@ ENV DOCKER_HOST="unix:///var/run/docker.sock" \
 ENV CC_wasm32_unknown_unknown="clang" \
 	AR_wasm32_unknown_unknown="llvm-ar"

-RUN curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile default --component clippy,rustfmt \
+RUN curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal --component clippy,rustfmt \
 	&& rustup target add wasm32-unknown-unknown \
 	&& cargo install cargo-watch --locked \
-	&& cargo install wasm-bindgen-cli --version "${WASM_BINDGEN_VERSION}" --locked
-
-RUN corepack prepare "pnpm@${PNPM_VERSION}" --activate \
-	&& pnpm --version
-
-RUN sudo apt-get update \
-	&& sudo apt-get install -y --no-install-recommends python3-venv \
-	&& sudo rm -rf /var/lib/apt/lists/*
+	&& cargo install wasm-bindgen-cli --version "${WASM_BINDGEN_VERSION}" --locked \
+	&& rm -rf "/home/${USERNAME}/.cargo/registry" "/home/${USERNAME}/.cargo/git"

 WORKDIR /workspaces/fluxer
@@ -5,20 +5,17 @@
 	"workspaceFolder": "/workspaces/fluxer",
 	"shutdownAction": "stopCompose",
 	"remoteUser": "vscode",
+	"hostRequirements": {
+		"cpus": 4,
+		"memory": "8gb",
+		"storage": "32gb"
+	},
 	"remoteEnv": {
 		"DOCKER_HOST": "unix:///var/run/docker.sock"
 	},
 	"runServices": ["workspace", "postgres", "valkey", "nats", "livekit", "meilisearch", "mailpit"],
-	"forwardPorts": [
-		3000, 8088, 8080, 8771, 8082, 3010, 3020, 8100, 8101, 8102, 8103, 8104, 8105, 8106, 8107, 8108, 8109, 8110, 8111,
-		8112, 8113, 8114, 8115, 8116, 8117, 8118, 8119, 8120, 8121, 8122, 8123, 8124, 8125, 3900, 8888, 9333, 9340, 23646,
-		4222, 7700, 7880, 7900, 9200, 8000
-	],
+	"forwardPorts": [3000, 8088, 8080, 8771, 8082, 8773, 3020, 8333],
 	"portsAttributes": {
-		"8000": {
-			"label": "Zensical docs",
-			"onAutoForward": "openBrowserOnce"
-		},
 		"8088": {
 			"label": "Fluxer dev proxy",
 			"onAutoForward": "notify"
@@ -29,40 +26,23 @@
 		"3020": {
 			"label": "Fluxer admin"
 		},
-		"8100": {
-			"label": "Fluxer Rust service health"
-		},
-		"3900": {
+		"8333": {
 			"label": "SeaweedFS S3"
 		},
-		"8888": {
-			"label": "SeaweedFS filer"
-		},
-		"9333": {
-			"label": "SeaweedFS master"
-		},
-		"9340": {
-			"label": "SeaweedFS volume"
-		},
-		"23646": {
-			"label": "SeaweedFS admin"
-		},
-		"7880": {
-			"label": "LiveKit"
-		},
-		"7700": {
-			"label": "Meilisearch"
-		},
-		"9200": {
-			"label": "Elasticsearch"
+		"8773": {
+			"label": "Fluxer app proxy"
 		}
 	},
-	"postCreateCommand": "sudo chown -R vscode:vscode /workspaces/fluxer/target && find /workspaces/fluxer -maxdepth 4 -type d -name node_modules -prune -exec sudo chown -R vscode:vscode {} + && sudo chown -R vscode:vscode /home/vscode/.local/share/pnpm && cargo run -p fluxer-dev -- bootstrap",
-	"postStartCommand": "bash /workspaces/fluxer/.devcontainer/fix-docker-socket.sh && cargo run -p fluxer-dev -- post-start && bash /workspaces/fluxer/fluxer_docs/serve.sh --daemon",
+	"postCreateCommand": "bash /workspaces/fluxer/.devcontainer/fix-docker-socket.sh && bash /workspaces/fluxer/.devcontainer/fix-workspace-permissions.sh && cargo run -p fluxer-dev -- bootstrap",
+	"postStartCommand": "bash /workspaces/fluxer/.devcontainer/fix-docker-socket.sh && bash /workspaces/fluxer/.devcontainer/fix-workspace-permissions.sh && cargo run -p fluxer-dev -- post-start",
 	"customizations": {
 		"vscode": {
 			"settings": {
-				"editor.defaultFormatter": "biomejs.biome"
+				"editor.defaultFormatter": "biomejs.biome",
+				"erlang.includePaths": ["."],
+				"search.exclude": {
+					"**/_build/default/lib/fluxer_gateway": true
+				}
 			},
 			"extensions": [
 				"biomejs.biome",
@@ -7,15 +7,29 @@ services:
      dockerfile: .devcontainer/Dockerfile
    command: sleep infinity
    init: true
-    env_file:
-      - ../config/env/development.env
    environment:
-      FLUXER_SEARCH_ENGINE: meilisearch
-      FLUXER_SEARCH_URL: http://meilisearch:7700
-      FLUXER_SEARCH_API_KEY: fluxer-dev-meilisearch
-      FLUXER_POSTGRES_HOST: postgres
-      FLUXER_SELF_HOSTED: "true"
      DOCKER_HOST: unix:///var/run/docker.sock
+      pnpm_config_store_dir: /home/vscode/.local/share/pnpm/store
+      FLUXER_PUBLIC_PORT: "${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_PUBLIC_URL: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_API_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api"
+      FLUXER_API_CLIENT_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api"
+      FLUXER_APP_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_GATEWAY_ENDPOINT: "ws://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/gateway"
+      FLUXER_MEDIA_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
+      FLUXER_STATIC_CDN_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_ADMIN_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/admin"
+      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
+      FLUXER_S3_PUBLIC_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_LIVEKIT_URL: "ws://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/livekit"
+      FLUXER_LIVEKIT_INTERNAL_URL: "http://livekit:7880"
+      FLUXER_LIVEKIT_WEBHOOK_URL: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api/webhooks/livekit"
+      FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
+      FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/media"
+      FLUXER_GATEWAY_STATIC_CDN_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      FLUXER_ADMIN_OAUTH_REDIRECT_URI: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/admin/oauth2_callback"
+      FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS: "http://localhost,http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
+      PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api"
    volumes:
      - ..:/workspaces/fluxer:cached
      - type: volume
@@ -236,45 +250,30 @@ services:
        source: ${FLUXER_DOCKER_SOCKET:-/var/run/docker.sock}
        target: /var/run/docker.sock
    ports:
-      - "${FLUXER_DEV_DOCS_PORT:-8000}:8000"
-      - "${FLUXER_DEV_RSPACK_PORT:-3000}:3000"
-      - "${FLUXER_DEV_PROXY_PORT:-8088}:8088"
-      - "${FLUXER_DEV_APP_PROXY_PORT:-8080}:8080"
-      - "${FLUXER_DEV_API_PORT:-8771}:8771"
-      - "${FLUXER_DEV_GATEWAY_PORT:-8082}:8082"
-      - "${FLUXER_DEV_MARKETING_PORT:-3010}:3010"
-      - "${FLUXER_DEV_ADMIN_PORT:-3020}:3020"
-      - "${FLUXER_DEV_RUST_SERVICE_PORTS:-8100-8125}:8100-8125"
-      - "${FLUXER_DEV_SEAWEEDFS_S3_PORT:-3900}:8333"
-      - "${FLUXER_DEV_SEAWEEDFS_FILER_PORT:-8888}:8888"
-      - "${FLUXER_DEV_SEAWEEDFS_MASTER_PORT:-9333}:9333"
-      - "${FLUXER_DEV_SEAWEEDFS_VOLUME_PORT:-9340}:9340"
-      - "${FLUXER_DEV_SEAWEEDFS_ADMIN_PORT:-23646}:23646"
+      - "127.0.0.1:${FLUXER_DEV_RSPACK_PORT:-3000}:3000"
+      - "127.0.0.1:${FLUXER_DEV_PROXY_PORT:-8088}:8088"
+      - "127.0.0.1:${FLUXER_DEV_API_PORT:-8080}:8080"
+      - "127.0.0.1:${FLUXER_DEV_GATEWAY_PORT:-8771}:8771"
+      - "127.0.0.1:${FLUXER_DEV_MEDIA_PROXY_PORT:-8082}:8082"
+      - "127.0.0.1:${FLUXER_DEV_APP_PROXY_PORT:-8773}:8773"
+      - "127.0.0.1:${FLUXER_DEV_ADMIN_PORT:-3020}:3020"
+      - "127.0.0.1:${FLUXER_DEV_SEAWEEDFS_S3_PORT:-3900}:8333"
    depends_on:
-      - postgres
-      - valkey
-      - nats
-      - livekit
-      - meilisearch
-      - mailpit
+      postgres:
+        condition: service_healthy
+      valkey:
+        condition: service_started
+      nats:
+        condition: service_started
+      livekit:
+        condition: service_started
+      meilisearch:
+        condition: service_healthy
+      mailpit:
+        condition: service_started
    extra_hosts:
      - "host.docker.internal:host-gateway"

-  cassandra:
-    image: cassandra:5.0.8
-    profiles:
-      - full
-    environment:
-      CASSANDRA_CLUSTER_NAME: fluxer-dev
-      CASSANDRA_DC: datacenter1
-      CASSANDRA_ENDPOINT_SNITCH: GossipingPropertyFileSnitch
-      HEAP_NEWSIZE: 128M
-      MAX_HEAP_SIZE: 768M
-    volumes:
-      - cassandra-data:/var/lib/cassandra
-    ports:
-      - "${FLUXER_DEV_CASSANDRA_PORT:-9042}:9042"
-
  postgres:
    image: postgres:16-alpine
    environment:
@@ -284,60 +283,62 @@ services:
    volumes:
      - postgres-data:/var/lib/postgresql/data
    ports:
-      - "${FLUXER_DEV_POSTGRES_PORT:-5432}:5432"
+      - "127.0.0.1:${FLUXER_DEV_POSTGRES_PORT:-5432}:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U fluxer -d fluxer"]
+      interval: 2s
+      timeout: 5s
+      retries: 30
+      start_period: 5s

  valkey:
-    image: valkey/valkey:8.1.7-alpine
+    image: valkey/valkey:9.1.2-alpine
    command: ["valkey-server", "--save", "", "--appendonly", "no"]
    ports:
-      - "${FLUXER_DEV_VALKEY_PORT:-6379}:6379"
+      - "127.0.0.1:${FLUXER_DEV_VALKEY_PORT:-6379}:6379"

  nats:
-    image: nats:2.14.2-alpine
+    image: nats:2.14.7-alpine
    command: ["-js", "-sd", "/data", "-m", "8222"]
    volumes:
      - nats-data:/data
    ports:
-      - "${FLUXER_DEV_NATS_PORT:-4222}:4222"
-      - "${FLUXER_DEV_NATS_MONITOR_PORT:-8222}:8222"
+      - "127.0.0.1:${FLUXER_DEV_NATS_PORT:-4222}:4222"
+      - "127.0.0.1:${FLUXER_DEV_NATS_MONITOR_PORT:-8222}:8222"

  livekit:
    image: livekit/livekit-server:v1.12.0
    command: ["--config", "/etc/livekit.yaml", "--bind", "0.0.0.0"]
+    environment:
+      LIVEKIT_RTC_TCP_PORT: "${FLUXER_DEV_LIVEKIT_TCP_PORT:-7881}"
+      LIVEKIT_RTC_UDP_PORT_START: "${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}"
+      LIVEKIT_RTC_UDP_PORT_END: "${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}"
    volumes:
      - ./livekit.yaml:/etc/livekit.yaml:ro
    ports:
-      - "${FLUXER_DEV_LIVEKIT_PORT:-7880}:7880"
-      - "${FLUXER_DEV_LIVEKIT_TCP_PORT:-7881}:7881"
-      - "${FLUXER_DEV_LIVEKIT_UDP_PORTS:-7882-7892}:7882-7892/udp"
-
-  elasticsearch:
-    image: docker.elastic.co/elasticsearch/elasticsearch:9.3.2
-    profiles:
-      - full
-    environment:
-      discovery.type: single-node
-      xpack.security.enabled: "true"
-      xpack.security.http.ssl.enabled: "false"
-      ELASTIC_PASSWORD: fluxer-dev-elasticsearch
-      ES_JAVA_OPTS: "-Xms512m -Xmx512m"
-    volumes:
-      - elasticsearch-data:/usr/share/elasticsearch/data
-    ports:
-      - "${FLUXER_DEV_ELASTICSEARCH_PORT:-9200}:9200"
+      - "127.0.0.1:${FLUXER_DEV_LIVEKIT_PORT:-7880}:7880"
+      - "127.0.0.1:${FLUXER_DEV_LIVEKIT_TCP_PORT:-7881}:${FLUXER_DEV_LIVEKIT_TCP_PORT:-7881}"
+      - "127.0.0.1:${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}:${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}/udp"

  meilisearch:
-    image: getmeili/meilisearch:v1.12
+    image: getmeili/meilisearch:v1.53
    environment:
      MEILI_NO_ANALYTICS: "true"
+      MEILI_UPGRADE_DB: "true"
      MEILI_MASTER_KEY: fluxer-dev-meilisearch
    volumes:
      - meilisearch-data:/meili_data
    ports:
-      - "${FLUXER_DEV_MEILISEARCH_PORT:-7700}:7700"
+      - "127.0.0.1:${FLUXER_DEV_MEILISEARCH_PORT:-7700}:7700"
+    healthcheck:
+      test: ["CMD", "curl", "--fail", "--silent", "http://127.0.0.1:7700/health"]
+      interval: 2s
+      timeout: 5s
+      retries: 30
+      start_period: 5s

  mailpit:
-    image: axllent/mailpit:v1.30
+    image: axllent/mailpit:v1.31
    environment:
      MP_DATABASE: /data/mailpit.db
      MP_MAX_MESSAGES: 5000
@@ -394,9 +395,7 @@ volumes:
  cargo-registry:
  cargo-git:
  rust-target:
-  cassandra-data:
  nats-data:
-  elasticsearch-data:
  meilisearch-data:
  mailpit-data:
  postgres-data:
@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
 # SPDX-License-Identifier: AGPL-3.0-or-later

-set -uo pipefail
+set -euo pipefail

 SOCKET="${DOCKER_SOCKET:-/var/run/docker.sock}"
-USER_NAME="${USER:-vscode}"
+USER_NAME="$(id -un)"

 if [ ! -S "$SOCKET" ]; then
 	echo "fix-docker-socket: no socket at $SOCKET; skipping (Docker-in-devcontainer will not work)"
@@ -16,31 +16,11 @@ if docker version --format '{{.Server.Version}}' >/dev/null 2>&1; then
 	exit 0
 fi

-socket_gid="$(stat -c '%g' "$SOCKET" 2>/dev/null || echo "")"
-if [ -z "$socket_gid" ]; then
-	echo "fix-docker-socket: could not stat $SOCKET; skipping" >&2
-	exit 0
-fi
-
-sudo sh -c '
-	set -e
-	gid="$1"
-	user="$2"
-	socket="$3"
-	if ! getent group "$gid" >/dev/null 2>&1; then
-		groupadd --gid "$gid" docker-host
-	fi
-	group_name="$(getent group "$gid" | cut -d: -f1)"
-	usermod --append --groups "$group_name" "$user"
-	chgrp "$gid" "$socket"
-	chmod g+rw "$socket"
-' sh "$socket_gid" "$USER_NAME" "$SOCKET" || {
-	echo "fix-docker-socket: could not adjust $SOCKET; run docker with sudo" >&2
-	exit 0
-}
+sudo setfacl --modify "user:${USER_NAME}:rw" "$SOCKET"

 if docker version --format '{{.Server.Version}}' >/dev/null 2>&1; then
-	echo "fix-docker-socket: $SOCKET is now usable as $USER_NAME (gid $socket_gid)"
+	echo "fix-docker-socket: $SOCKET is now usable as $USER_NAME"
 else
-	echo "fix-docker-socket: $SOCKET still unreachable as $USER_NAME; run docker with sudo" >&2
+	echo "fix-docker-socket: $SOCKET is still unreachable as $USER_NAME" >&2
+	exit 1
 fi
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+set -euo pipefail
+
+owner="$(id -u):$(id -g)"
+
+repair_tree() {
+	local path="$1"
+	local unwritable
+	if [ ! -d "$path" ]; then
+		echo "fix-workspace-permissions: expected mount is missing: $path" >&2
+		exit 1
+	fi
+	unwritable="$(find "$path" -xdev \( -type d -o -type f \) ! -writable -print -quit 2>/dev/null || true)"
+	if [ ! -w "$path" ] || [ -n "$unwritable" ]; then
+		sudo find "$path" -xdev \( -type d -o -type f \) -exec chown "$owner" {} +
+	fi
+	unwritable="$(find "$path" -xdev \( -type d -o -type f \) ! -writable -print -quit 2>/dev/null || true)"
+	if [ ! -w "$path" ] || [ -n "$unwritable" ]; then
+		echo "fix-workspace-permissions: $path is not writable as $(id -un)" >&2
+		exit 1
+	fi
+}
+
+for path in \
+	/workspaces/fluxer/target \
+	/home/vscode/.cargo/registry \
+	/home/vscode/.cargo/git \
+	/home/vscode/.local \
+	/home/vscode/.local/share/pnpm/store; do
+	repair_tree "$path"
+done
+
+while IFS= read -r -d '' path; do
+	if mountpoint -q "$path"; then
+		repair_tree "$path"
+	fi
+done < <(find /workspaces/fluxer -maxdepth 4 -type d -name node_modules -prune -print0)
@@ -1,11 +1,10 @@
 port: 7880

 keys:
-  devkey: secret
+  devkey: fluxer-livekit-development-secret

 rtc:
  tcp_port: 7881
-  udp_port: 7882-7892
  node_ip: 127.0.0.1
  use_mdns: true
  stun_servers:
@@ -7,10 +7,16 @@ QUICK=0
 SKIP_INSTALL=0
 for arg in "$@"; do
 	case "$arg" in
-		--quick) QUICK=1 ;;
-		--skip-install) SKIP_INSTALL=1 ;;
-		-h|--help) sed -n '2,25p' "$0"; exit 0 ;;
-		*) echo "unknown argument: $arg" >&2; exit 2 ;;
+	--quick) QUICK=1 ;;
+	--skip-install) SKIP_INSTALL=1 ;;
+	-h | --help)
+		sed -n '2,25p' "$0"
+		exit 0
+		;;
+	*)
+		echo "unknown argument: $arg" >&2
+		exit 2
+		;;
 	esac
 done

@@ -64,6 +70,7 @@ stage "app: typecheck" pnpm --filter fluxer_app typecheck
 stage "app: unit tests" pnpm --filter fluxer_app exec vitest run

 if [ "$QUICK" -eq 0 ]; then
+	stage "desktop: typecheck" pnpm --filter fluxer_desktop typecheck
 	stage "app: production build" pnpm --filter fluxer_app build
 fi

@@ -9,7 +9,6 @@
 **/.git/**
 /.github/
 /.pnpm-store/
-/fluxer_marketing

 **/.env
 **/.env.*.local
@@ -29,9 +28,11 @@
 **/node_modules/
 **/target/
 **/test-results.json
-/fluxer_docs/site/
+/fluxer_docs/dist/
+/fluxer_docs/.astro/
 /fluxer_app/.devserver-cache.json
 /fluxer_app/pkgs/libfluxcore/
+/fluxer_app/pkgs/libfluxwebp/
 /fluxer_app/src/features/i18n/locales/*/messages.mjs
 /fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
 /fluxer_app/src/features/theme/styles/generated/
@@ -1,7 +1,2 @@
 /.github/CODEOWNERS @fluxerapp/developers
 /.github/workflows/ @fluxerapp/developers
-/fluxer_marketing @fluxerapp/developers
-/.gitmodules @fluxerapp/developers
-/.github/workflows/dispatch-private-marketing-build.yaml @fluxerapp/developers
-/packages/i18n/marketing/ @fluxerapp/developers
-/scripts/setup-private-marketing.sh @fluxerapp/developers
@@ -89,21 +89,3 @@ Submit translations through [Weblate](https://weblate.fluxer.tools), not through
 All repository activity is governed by the [Code of Conduct](https://github.com/fluxerapp/fluxer/blob/main/.github/CODE_OF_CONDUCT.md).

 Fluxer is distributed under the [GNU Affero General Public License, version 3.0 or later](https://github.com/fluxerapp/fluxer/blob/main/LICENSE). By adding a DCO sign-off, you certify that you have the right to submit the contribution under that licence.
-
-## Private marketing project
-
-The marketing implementation is maintained in a private repository at the `fluxer_marketing` submodule path. The public workspace, bootstrap, checks, and development stack work without initializing it.
-
-Authorized maintainers can initialize only that submodule and install its independent dependencies:
-
-```sh
-./scripts/setup-private-marketing.sh
-pnpm --dir fluxer_marketing install --frozen-lockfile
-cargo metadata --locked --manifest-path fluxer_marketing/Cargo.toml
-```
-
-To run the private marketing service in the local development stack and direct application links to it, add this override to the ignored `config/env/local.env` file:
-
-```sh
-FLUXER_MARKETING_ENDPOINT=http://localhost:8088/marketing
-```
@@ -36,8 +36,7 @@ body:
      label: Build information
      description: >-
        Open User Settings, scroll to the bottom of the left sidebar, and select
-        the build information. Fluxer copies it to the clipboard. On mobile,
-        select the build information at the bottom of the settings list.
+        the build information. Fluxer copies it to the clipboard.
    validations:
      required: true

@@ -1,15 +1,15 @@
 # yaml-language-server: $schema=https://www.schemastore.org/github-issue-config.json
 blank_issues_enabled: false
 contact_links:
+  - name: Mobile client bugs
+    url: https://github.com/fluxerapp/flutter_client#bug-reporting
+    about: Read the reporting instructions for the Fluxer mobile client.
  - name: Account and billing support
    url: https://fluxer.app/help
    about: Find account help and support contact details.
  - name: Feature proposals
    url: https://github.com/orgs/fluxerapp/discussions
    about: Propose a feature in a discussion.
-  - name: Security vulnerabilities
-    url: https://github.com/fluxerapp/fluxer/security/advisories/new
-    about: Submit a private vulnerability report.
  - name: Translations
    url: https://weblate.fluxer.tools
    about: Improve an existing locale or start a new one.
@@ -22,17 +22,15 @@ f:docs:
 f:gateway:
  - changed-files:
    - any-glob-to-any-file: fluxer_gateway/**/*
-f:marketing:
-  - changed-files:
-    - any-glob-to-any-file:
-      - fluxer_marketing
-      - packages/i18n/marketing/**/*
 f:media_proxy:
  - changed-files:
    - any-glob-to-any-file: fluxer_media_proxy/**/*
 f:messages:
  - changed-files:
    - any-glob-to-any-file: fluxer_messages/**/*
+f:push:
+  - changed-files:
+    - any-glob-to-any-file: fluxer_push/**/*
 f:snowflakes:
  - changed-files:
    - any-glob-to-any-file: fluxer_snowflakes/**/*
@@ -58,13 +58,13 @@ jobs:
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: Create token
        id: create-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
@@ -101,25 +101,30 @@ jobs:
          - platform: arm64
            runner: ubuntu-24.04-arm
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
          context: ${{ inputs.context }}
          file: ${{ inputs.dockerfile }}
          push: true
-          provenance: false
+          provenance: mode=min
          platforms: linux/${{ matrix.platform }}
          tags: ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:${{ needs.meta.outputs.build_version }}-${{ matrix.platform }}
          build-args: |
            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
+            SOURCE_SHA=${{ github.sha }}
+            SOURCE_DATE=${{ steps.source.outputs.date }}
            ${{ inputs.extra-build-args }}
          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:buildcache-${{ matrix.platform }}
          cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:buildcache-${{ matrix.platform }},mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
@@ -136,15 +141,15 @@ jobs:
      contents: write
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -185,17 +190,12 @@ jobs:

      - name: Advance moving image tags
        env:
-          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}
-          VERSION: ${{ needs.meta.outputs.build_version }}
          MOVING_TAGS: ${{ inputs.moving-tags }}
-        run: |
-          set -euo pipefail
-          tag_args=()
-          IFS=',' read -ra moving <<< "${MOVING_TAGS}"
-          for raw in "${moving[@]}"; do
-            tag="$(echo "$raw" | xargs)"
-            [ -n "$tag" ] && tag_args+=( "-t" "${IMAGE}:${tag}" )
-          done
-          if (( ${#tag_args[@]} > 0 )); then
-            docker buildx imagetools create "${tag_args[@]}" "${IMAGE}:${VERSION}"
-          fi
+          VERSION: ${{ needs.meta.outputs.build_version }}
+        run: >-
+          tools/ci/run.sh image-set
+          promote
+          --component "${{ inputs.image }}"
+          --build-version "${VERSION}"
+          --registry "ghcr.io/${{ env.GHCR_OWNER }}"
+          --moving-tags "${MOVING_TAGS}"
@@ -15,6 +15,13 @@ permissions:
  contents: write
  packages: write

+concurrency:
+  group: publish-fluxer-app-proxy-self-hosted
+  cancel-in-progress: false
+
+env:
+  GHCR_OWNER: ${{ github.repository_owner }}
+
 jobs:
  approve:
    name: approve build release
@@ -26,13 +33,207 @@ jobs:
      - name: approved
        run: echo "Build release approved."

-  build:
+  meta:
+    name: resolve metadata
    needs: approve
-    uses: ./.github/workflows/_build-image.yaml
-    secrets: inherit
-    with:
-      image: fluxer-app-proxy-self-hosted
-      dockerfile: fluxer_app_proxy/Dockerfile
-      build-version: ${{ inputs['build-version'] }}
-      extra-build-args: |
-        FLUXER_APP_PROXY_TIME_FREEZE_ENABLED=false
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      build_version: ${{ steps.vars.outputs.build_version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - name: set variables
+        id: vars
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step set_metadata
+          --build-version "${{ inputs['build-version'] }}"
+
+  dist:
+    name: build the canonical asset tree
+    needs: meta
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    env:
+      IMAGE_REPO: ghcr.io/${{ github.repository_owner }}/fluxer-app-proxy-self-hosted
+      BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
+      PUBLIC_ASSET_BASE_URL: ""
+      BUNDLE_LOCAL_ASSETS: "true"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - name: prepare docker config
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step prepare_docker_config
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - name: configure ghcr auth
+        env:
+          GHCR_USERNAME: ${{ github.actor }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step configure_ghcr_auth
+
+      - name: build the dist once and publish it as the canonical asset image
+        env:
+          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-dist
+          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-dist,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step build_dist
+
+      - name: generate asset manifest
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step generate_asset_manifest
+
+      - name: verify every manifest asset ships in the image
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_published_assets
+
+  build:
+    name: build ${{ matrix.platform }}
+    needs: [meta, dist]
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 75
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: amd64
+            runner: ubuntu-24.04
+          - platform: arm64
+            runner: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
+        with:
+          context: .
+          file: fluxer_app_proxy/Dockerfile
+          push: true
+          provenance: false
+          platforms: linux/${{ matrix.platform }}
+          tags: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-${{ matrix.platform }}
+          build-args: |
+            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
+            SOURCE_SHA=${{ github.sha }}
+            SOURCE_DATE=${{ steps.source.outputs.date }}
+            APP_ASSETS_REF=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-assets
+            APP_ASSETS_PLATFORM=linux/amd64
+          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-${{ matrix.platform }}
+          cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-${{ matrix.platform }},mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+        env:
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+
+  merge:
+    name: merge multi-arch manifest
+    needs: [meta, build]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: write
+      packages: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: verify cross-architecture asset parity
+        env:
+          APP_PROXY_ASSETS_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-assets
+          APP_PROXY_AMD64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-amd64
+          APP_PROXY_ARM64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-arm64
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_asset_parity
+
+      - name: create and push multi-arch manifest
+        env:
+          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted
+          VERSION: ${{ needs.meta.outputs.build_version }}
+        run: |
+          set -euo pipefail
+          docker buildx imagetools create -t "${IMAGE}:${VERSION}" \
+            "${IMAGE}:${VERSION}-amd64" \
+            "${IMAGE}:${VERSION}-arm64"
+          docker buildx imagetools inspect "${IMAGE}:${VERSION}"
+
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: write
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          SOURCE_SHA: ${{ github.sha }}
+          VERSION: ${{ needs.meta.outputs.build_version }}
+          RELEASE_BASELINE_SHA: ${{ vars.RELEASE_BASELINE_SHA }}
+        run: >-
+          tools/ci/run.sh release
+          publish
+          --component fluxer-app-proxy-self-hosted
+          --build-version "${VERSION}"
+          --source-sha "${SOURCE_SHA}"
+          --previous-sha "${RELEASE_BASELINE_SHA}"
+
+      - name: Advance moving image tags
+        env:
+          VERSION: ${{ needs.meta.outputs.build_version }}
+        run: >-
+          tools/ci/run.sh image-set
+          promote
+          --component fluxer-app-proxy-self-hosted
+          --build-version "${VERSION}"
+          --registry "ghcr.io/${{ env.GHCR_OWNER }}"
+          --moving-tags v1,latest
@@ -43,13 +43,13 @@ jobs:
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: set variables
        id: vars
        run: >-
@@ -57,28 +57,28 @@ jobs:
          --step set_metadata
          --build-version "${{ inputs['build-version'] }}"

-  build:
-    name: build app-proxy (amd64)
+  dist:
+    name: build and publish the canonical asset tree
    needs: meta
    runs-on: ubuntu-24.04
-    timeout-minutes: 45
+    timeout-minutes: 60
    permissions:
      actions: read
      contents: read
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: prepare docker config
        run: >-
          tools/ci/run.sh build-app-proxy
          --step prepare_docker_config
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
      - name: configure ghcr auth
        env:
          GHCR_USERNAME: ${{ github.actor }}
@@ -87,17 +87,17 @@ jobs:
          tools/ci/run.sh build-app-proxy
          --step configure_ghcr_auth

-      - name: build and push image + extract assets
+      - name: build the dist once and publish it as the canonical asset image
        env:
          BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
          PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
-          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64
-          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-dist
+          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-dist,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
          DOCKER_BUILD_SUMMARY: false
          DOCKER_BUILD_RECORD_UPLOAD: false
        run: >-
          tools/ci/run.sh build-app-proxy
-          --step build_and_extract
+          --step build_dist

      - name: generate asset manifest
        run: >-
@@ -114,9 +114,63 @@ jobs:
          tools/ci/run.sh build-app-proxy
          --step upload_assets

+      - name: verify every uploaded asset is readable
+        env:
+          PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_published_assets
+
+  build:
+    name: build app-proxy (amd64)
+    needs: [meta, dist]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - name: prepare docker config
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step prepare_docker_config
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - name: configure ghcr auth
+        env:
+          GHCR_USERNAME: ${{ github.actor }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step configure_ghcr_auth
+
+      - name: build and push image
+        env:
+          BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
+          SOURCE_SHA: ${{ github.sha }}
+          SOURCE_DATE: ${{ steps.source.outputs.date }}
+          PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
+          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64
+          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step build_image
+
  build-arm64:
    name: build app-proxy (arm64)
-    needs: meta
+    needs: [meta, dist]
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 60
    permissions:
@@ -124,16 +178,19 @@ jobs:
      contents: read
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
          context: .
          file: fluxer_app_proxy/Dockerfile
@@ -143,8 +200,10 @@ jobs:
          tags: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-arm64
          build-args: |
            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
-            PUBLIC_ASSET_BASE_URL=https://fluxerstatic.com
-            BUNDLE_LOCAL_ASSETS=false
+            SOURCE_SHA=${{ github.sha }}
+            SOURCE_DATE=${{ steps.source.outputs.date }}
+            APP_ASSETS_REF=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-assets
+            APP_ASSETS_PLATFORM=linux/amd64
          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-arm64
          cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-arm64,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
        env:
@@ -155,24 +214,33 @@ jobs:
    name: merge multi-arch manifest
    needs: [meta, build, build-arm64]
    runs-on: ubuntu-24.04
-    timeout-minutes: 10
+    timeout-minutes: 20
    permissions:
      contents: write
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: verify cross-architecture asset parity
+        env:
+          APP_PROXY_ASSETS_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-assets
+          APP_PROXY_AMD64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}
+          APP_PROXY_ARM64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-arm64
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_asset_parity
+
      - name: fuse amd64 + arm64 into a multi-arch manifest
        env:
          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy
@@ -212,10 +280,11 @@ jobs:

      - name: Advance moving image tags
        env:
-          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy
          VERSION: ${{ needs.meta.outputs.build_version }}
        run: >-
-          docker buildx imagetools create
-          -t "${IMAGE}:v1"
-          -t "${IMAGE}:latest"
-          "${IMAGE}:${VERSION}"
+          tools/ci/run.sh image-set
+          promote
+          --component fluxer-app-proxy
+          --build-version "${VERSION}"
+          --registry "ghcr.io/${{ env.GHCR_OWNER }}"
+          --moving-tags v1,latest
@@ -11,11 +11,6 @@ on:
          - stable
          - canary
        default: stable
-      test_build:
-        description: Stash artifacts under desktop-test/ instead of desktop/ (API will not pick these up as a release).
-        required: false
-        default: false
-        type: boolean
      build_version:
        description: Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation.
        required: false
@@ -32,13 +27,12 @@ permissions:
  actions: read

 concurrency:
-  group: desktop-${{ inputs.channel }}-${{ inputs.test_build && 'test' || 'release' }}
+  group: desktop-${{ inputs.channel }}
  cancel-in-progress: true

 env:
  CHANNEL: ${{ inputs.channel }}
  BUILD_CHANNEL: ${{ inputs.channel == 'canary' && 'canary' || 'stable' }}
-  TEST_BUILD: ${{ inputs.test_build && 'true' || 'false' }}

 jobs:
  meta:
@@ -53,19 +47,17 @@ jobs:
      pub_date: ${{ steps.meta.outputs.pub_date }}
      channel: ${{ steps.meta.outputs.channel }}
      build_channel: ${{ steps.meta.outputs.build_channel }}
-      test_build: ${{ steps.meta.outputs.test_build }}
-      s3_prefix: ${{ steps.meta.outputs.s3_prefix }}
      source_sha: ${{ steps.meta.outputs.source_sha }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: main

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Create token
        id: create-token
@@ -85,7 +77,6 @@ jobs:
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step set_metadata
          --channel "${{ inputs.channel }}"
-          --test-build "${{ inputs.test_build }}"

  matrix:
    name: Resolve build matrix
@@ -98,12 +89,12 @@ jobs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Build platform matrix
        id: set-matrix
@@ -113,7 +104,7 @@ jobs:
          --skip-targets "${{ inputs.skip_targets }}"

  build:
-    name: Build ${{ matrix.platform }} (${{ matrix.arch }}, ${{ matrix.desktop_variant }})
+    name: Build ${{ matrix.platform }} (${{ matrix.arch }})
    needs:
      - meta
      - matrix
@@ -137,41 +128,34 @@ jobs:
      PUBLIC_BUILD_VERSION: ${{ needs.meta.outputs.version }}
      PUB_DATE: ${{ needs.meta.outputs.pub_date }}
      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
-      S3_DESKTOP_PREFIX: ${{ needs.meta.outputs.s3_prefix }}
-      DESKTOP_HANDOFF_PREFIX: _handoff/desktop/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      S3_ENDPOINT: ${{ vars.DOWNLOADS_S3_ENDPOINT }}
-      S3_BUCKET: ${{ vars.DOWNLOADS_S3_BUCKET }}
-      AWS_ACCESS_KEY_ID: ${{ secrets.DOWNLOADS_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
      DESKTOP_PLATFORM: ${{ matrix.platform }}
      DESKTOP_ARCH: ${{ matrix.arch }}
-      DESKTOP_VARIANT: ${{ matrix.desktop_variant }}
      PLATFORM: ${{ matrix.platform }}
      ARCH: ${{ matrix.arch }}
      ELECTRON_ARCH: ${{ matrix.electron_arch }}
    steps:
      - name: Checkout CI helpers
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}
          path: _ci

      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}
          path: source

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Set up Python (Windows)
        if: runner.os == 'Windows'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
-          python-version: "3.13"
+          python-version: "3.14"

      - name: Ensure python3 command (Windows)
        if: runner.os == 'Windows'
@@ -196,14 +180,14 @@ jobs:
          --step set_workdir_unix

      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: 24
+          node-version: 26

-      - name: Set up pnpm via corepack
+      - name: Set up pnpm
        run: >-
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
-          --step setup_pnpm_corepack
+          --step setup_pnpm

      - name: Resolve pnpm store path (Windows)
        if: runner.os == 'Windows'
@@ -247,9 +231,9 @@ jobs:

      - name: Set up Rust toolchain (Unix)
        if: matrix.platform != 'windows'
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: ${{ matrix.platform == 'macos' && 'aarch64-apple-darwin,x86_64-apple-darwin' || (matrix.arch == 'arm64' && 'aarch64-unknown-linux-gnu' || 'x86_64-unknown-linux-gnu') }}

      - name: Install MSVC ARM64 build tools
@@ -260,7 +244,7 @@ jobs:

      - name: Set up MSVC env (Windows)
        if: matrix.platform == 'windows'
-        uses: TheMrMilchmann/setup-msvc-dev@79dac248aac9d0059f86eae9d8b5bfab4e95e97c
+        uses: TheMrMilchmann/setup-msvc-dev@368ef7d1ee4d1171b31d4a7f67f4d954f903f5a9
        with:
          arch: ${{ matrix.arch == 'arm64' && 'amd64_arm64' || 'amd64' }}

@@ -302,9 +286,9 @@ jobs:

      - name: Set up .NET SDK (Windows)
        if: matrix.platform == 'windows'
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
        with:
-          dotnet-version: "8.0.x"
+          dotnet-version: "10.0.x"

      - name: Install Velopack CLI
        if: matrix.platform == 'windows'
@@ -363,7 +347,7 @@ jobs:

      - name: Azure login for Artifact Signing
        if: matrix.platform == 'windows'
-        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -477,6 +461,12 @@ jobs:
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
          --step prepare_artifacts_unix

+      - name: Build AppImage update feed (Linux)
+        if: matrix.platform == 'linux'
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step build_appimage_update_feed
+
      - name: Normalize updater YAML (macOS)
        if: matrix.platform == 'macos'
        run: >-
@@ -495,13 +485,23 @@ jobs:
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
          --step generate_checksums_windows

-      - name: Upload artifacts to S3 handoff
+      - name: Stage build artifacts
+        id: handoff
        run: >-
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
-          --step upload_handoff
+          --step stage_handoff
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: ${{ steps.handoff.outputs.artifact_name }}
+          path: upload_staging
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0

  upload:
-    name: Upload to S3
+    name: Assemble desktop release assets
    if: ${{ !cancelled() && needs.build.result == 'success' }}
    needs:
      - meta
@@ -520,32 +520,26 @@ jobs:
      BUILD_VERSION: ${{ needs.meta.outputs.version }}
      PUBLIC_BUILD_VERSION: ${{ needs.meta.outputs.version }}
      PUB_DATE: ${{ needs.meta.outputs.pub_date }}
-      TEST_BUILD: ${{ needs.meta.outputs.test_build }}
      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
-      S3_DESKTOP_PREFIX: ${{ needs.meta.outputs.s3_prefix }}
-      DESKTOP_HANDOFF_PREFIX: _handoff/desktop/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      S3_ENDPOINT: ${{ vars.DOWNLOADS_S3_ENDPOINT }}
-      S3_BUCKET: ${{ vars.DOWNLOADS_S3_BUCKET }}
      PUBLIC_DL_BASE: https://api.fluxer.app/dl
-      AWS_ACCESS_KEY_ID: ${{ secrets.DOWNLOADS_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

-      - name: Download S3 handoff artifacts
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step download_handoff
+      - name: Download build artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          path: artifacts
+          pattern: fluxer-desktop-${{ needs.meta.outputs.build_channel }}-*

-      - name: Build S3 payload layout (+ manifest.json)
+      - name: Build payload layout (+ manifest.json)
        env:
          VERSION: ${{ needs.meta.outputs.version }}
          PUB_DATE: ${{ needs.meta.outputs.pub_date }}
@@ -553,43 +547,56 @@ jobs:
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step build_payload

-      - name: Upload payload to S3
+      - name: Prepare GitHub release assets
        run: >-
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step upload_payload
+          --step prepare_release_assets
+
+      - name: Upload GitHub release assets
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: fluxer-desktop-release-assets
+          path: release_assets
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0

      - name: Build summary
        run: >-
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step build_summary

-      - name: Cleanup S3 handoff
-        if: ${{ success() }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step cleanup_handoff
-
  publish_release:
    name: Publish GitHub desktop release
-    if: ${{ !cancelled() && needs.upload.result == 'success' && needs.meta.outputs.test_build != 'true' }}
+    if: ${{ !cancelled() && needs.upload.result == 'success' }}
    needs:
      - meta
      - upload
    runs-on: ubuntu-24.04-arm
    environment: desktop-releases
-    timeout-minutes: 10
+    timeout-minutes: 60
    permissions:
      contents: write
+    env:
+      CHANNEL: ${{ needs.meta.outputs.build_channel }}
+      VERSION: ${{ needs.meta.outputs.version }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
+
+      - name: Download GitHub release assets
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: fluxer-desktop-release-assets
+          path: release_assets
+
      - name: Create token
        id: create-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
@@ -614,6 +621,7 @@ jobs:
            --build-version "${VERSION}"
            --source-sha "${SOURCE_SHA}"
            --previous-sha "${RELEASE_BASELINE_SHA}"
+            --asset-dir release_assets
          )
          if [[ "${CHANNEL}" == "canary" ]]; then
            release_args+=(--prerelease)
@@ -33,5 +33,4 @@ jobs:
    with:
      image: fluxer-docs
      dockerfile: fluxer_docs/Dockerfile
-      context: fluxer_docs
      build-version: ${{ inputs['build-version'] }}
@@ -0,0 +1,36 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: build push
+
+on:
+  workflow_dispatch:
+    inputs:
+      build-version:
+        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
+        type: string
+        required: false
+        default: ""
+
+permissions:
+  actions: read
+  contents: write
+  packages: write
+
+jobs:
+  approve:
+    name: approve build release
+    permissions: {}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Build release approved."
+
+  image:
+    needs: approve
+    uses: ./.github/workflows/_build-image.yaml
+    secrets: inherit
+    with:
+      image: fluxer-push
+      dockerfile: fluxer_push/Dockerfile
+      build-version: ${{ inputs['build-version'] }}
@@ -19,22 +19,22 @@ jobs:
    timeout-minutes: 15
    steps:
      - name: Checkout fluxer
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -1,230 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-name: Dispatch private marketing build
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - fluxer_marketing
-      - Cargo.toml
-      - fluxer_common/**
-      - packages/fonts/manifest.json
-      - packages/fonts/NOTICE.md
-      - packages/fonts/LICENSE-IBM-PLEX.txt
-      - packages/fonts/css/locale-fallbacks.css
-      - packages/fonts/files/FluxerSans/**
-      - packages/fonts/files/FluxerMono/**
-      - packages/fonts/marketing/**
-      - packages/i18n/marketing/**
-      - fluxer_static/marketing/branding/**
-      - .github/workflows/dispatch-private-marketing-build.yaml
-
-permissions:
-  actions: read
-  contents: read
-
-concurrency:
-  group: private-marketing-dispatch
-  cancel-in-progress: false
-
-jobs:
-  metadata:
-    name: resolve exact private build metadata
-    if: github.repository == 'fluxerapp/fluxer'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    outputs:
-      parent_sha: ${{ steps.inputs.outputs.parent_sha }}
-      gitlink_sha: ${{ steps.inputs.outputs.gitlink_sha }}
-      build_version: ${{ steps.inputs.outputs.build_version }}
-      correlation_id: ${{ steps.inputs.outputs.correlation_id }}
-    steps:
-      - name: Create token
-        id: create-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
-        with:
-          client-id: ${{ vars.FLUXER_CI_APP_ID }}
-          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
-          owner: fluxerapp
-          repositories: fluxer
-          permission-contents: read
-      - name: Resolve trusted build inputs
-        id: inputs
-        env:
-          EVENT_AFTER: ${{ github.event.after }}
-          GH_TOKEN: ${{ steps.create-token.outputs.token }}
-          PARENT_SHA: ${{ github.sha }}
-          PUBLIC_REPOSITORY: ${{ github.repository }}
-          RUN_ID: ${{ github.run_id }}
-          RUN_ATTEMPT: ${{ github.run_attempt }}
-        run: |
-          set -euo pipefail
-          [[ "$GITHUB_EVENT_NAME" == "push" ]]
-          [[ "$GITHUB_REF" == "refs/heads/main" ]]
-          [[ "$PUBLIC_REPOSITORY" == "fluxerapp/fluxer" ]]
-          [[ "$PARENT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$EVENT_AFTER" == "$PARENT_SHA" ]]
-          [[ "$RUN_ID" =~ ^[1-9][0-9]*$ ]]
-          [[ "$RUN_ATTEMPT" =~ ^[1-9][0-9]*$ ]]
-          (( 10#$RUN_ATTEMPT <= 10 ))
-
-          main_sha="$(gh api "repos/$PUBLIC_REPOSITORY/git/ref/heads/main" --jq .object.sha)"
-          [[ "$main_sha" =~ ^[0-9a-f]{40}$ ]]
-          main_comparison="$(gh api "repos/$PUBLIC_REPOSITORY/compare/$PARENT_SHA...$main_sha")"
-          main_status="$(jq -r .status <<<"$main_comparison")"
-          [[ "$main_status" == "identical" || "$main_status" == "ahead" ]]
-          [[ "$(jq -r .merge_base_commit.sha <<<"$main_comparison")" == "$PARENT_SHA" ]]
-
-          commit="$(gh api "repos/$PUBLIC_REPOSITORY/git/commits/$PARENT_SHA")"
-          [[ "$(jq -r .sha <<<"$commit")" == "$PARENT_SHA" ]]
-          tree_sha="$(jq -r .tree.sha <<<"$commit")"
-          [[ "$tree_sha" =~ ^[0-9a-f]{40}$ ]]
-          entry="$(
-            gh api "repos/$PUBLIC_REPOSITORY/git/trees/$tree_sha" |
-              jq -cer '[.tree[] | select(.path == "fluxer_marketing")] | if length == 1 then .[0] else error("expected exactly one marketing gitlink") end'
-          )"
-          mode="$(jq -r .mode <<<"$entry")"
-          type="$(jq -r .type <<<"$entry")"
-          gitlink_sha="$(jq -r .sha <<<"$entry")"
-          path="$(jq -r .path <<<"$entry")"
-          if [[ "$mode" != "160000" || "$type" != "commit" || "$path" != "fluxer_marketing" || ! "$gitlink_sha" =~ ^[0-9a-f]{40}$ ]]; then
-            echo "::error::Public parent does not contain a valid fluxer_marketing gitlink."
-            exit 1
-          fi
-
-          run="$(gh api "repos/$PUBLIC_REPOSITORY/actions/runs/$RUN_ID")"
-          [[ "$(jq -r .id <<<"$run")" == "$RUN_ID" ]]
-          [[ "$(jq -r .run_attempt <<<"$run")" == "$RUN_ATTEMPT" ]]
-          [[ "$(jq -r .event <<<"$run")" == "push" ]]
-          [[ "$(jq -r .head_sha <<<"$run")" == "$PARENT_SHA" ]]
-          run_created_at="$(jq -r .created_at <<<"$run")"
-          [[ "$run_created_at" =~ ^[1-9][0-9]{3}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]]
-          run_created_epoch="$(date -u -d "$run_created_at" +%s)"
-          [[ "$run_created_epoch" =~ ^[1-9][0-9]*$ ]]
-          build_epoch=$((run_created_epoch + 10#$RUN_ATTEMPT - 1))
-          read -r year month day time_segment <<<"$(date -u -d "@$build_epoch" '+%Y %m %d %H%M%S')"
-          month="$((10#$month))"
-          micro="$((10#$time_segment))"
-          build_version="$year.$month$day.$micro"
-          [[ "$build_version" =~ ^[1-9][0-9]{3}\.[1-9][0-9]{2,3}\.([0-9]|[1-9][0-9]{0,5})$ ]]
-          correlation_id="public-${RUN_ID}-${RUN_ATTEMPT}"
-          [[ "$correlation_id" =~ ^[A-Za-z0-9._:-]{1,64}$ ]]
-          {
-            echo "parent_sha=$PARENT_SHA"
-            echo "gitlink_sha=$gitlink_sha"
-            echo "build_version=$build_version"
-            echo "correlation_id=$correlation_id"
-          } >>"$GITHUB_OUTPUT"
-
-  dispatch:
-    name: dispatch exact private build
-    needs: metadata
-    runs-on: ubuntu-24.04
-    timeout-minutes: 65
-    environment: private-marketing-dispatch
-    permissions: {}
-    steps:
-      - name: Validate trusted build inputs
-        env:
-          DISPATCH_ENABLED: ${{ vars.MARKETING_DISPATCH_ENABLED }}
-          EXPECTED_PARENT_SHA: ${{ github.sha }}
-          EXPECTED_CORRELATION_ID: public-${{ github.run_id }}-${{ github.run_attempt }}
-          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
-          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
-          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
-          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
-        run: |
-          set -euo pipefail
-          [[ "$GITHUB_EVENT_NAME" == "push" ]]
-          [[ "$GITHUB_REF" == "refs/heads/main" ]]
-          [[ "$GITHUB_REPOSITORY" == "fluxerapp/fluxer" ]]
-          [[ "$PARENT_SHA" == "$EXPECTED_PARENT_SHA" ]]
-          [[ "$PARENT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$GITLINK_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$BUILD_VERSION" =~ ^[1-9][0-9]{3}\.[1-9][0-9]{2,3}\.([0-9]|[1-9][0-9]{0,5})$ ]]
-          [[ "$CORRELATION_ID" == "$EXPECTED_CORRELATION_ID" ]]
-          [[ "$CORRELATION_ID" =~ ^[A-Za-z0-9._:-]{1,64}$ ]]
-          if [[ "$DISPATCH_ENABLED" != "true" ]]; then
-            echo "::error::Private marketing dispatch is intentionally disabled until the package cutover guard completes."
-            exit 1
-          fi
-
-      - name: Create private dispatch token
-        id: private-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
-        with:
-          client-id: ${{ vars.FLUXER_CI_APP_ID }}
-          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
-          owner: fluxerapp
-          repositories: marketing
-          permission-actions: write
-
-      - name: Dispatch exact private build
-        env:
-          GH_TOKEN: ${{ steps.private-token.outputs.token }}
-          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
-          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
-          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
-          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
-        run: |
-          set -euo pipefail
-          gh api --method POST repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/dispatches \
-            --field ref=main \
-            --field "inputs[parent_sha]=$PARENT_SHA" \
-            --field "inputs[gitlink_sha]=$GITLINK_SHA" \
-            --field "inputs[build_version]=$BUILD_VERSION" \
-            --field "inputs[correlation_id]=$CORRELATION_ID"
-
-      - name: Wait for private build conclusion
-        env:
-          GH_TOKEN: ${{ steps.private-token.outputs.token }}
-          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
-          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
-          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
-          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
-        run: |
-          set -euo pipefail
-          expected_title="marketing-build correlation=$CORRELATION_ID parent=$PARENT_SHA gitlink=$GITLINK_SHA version=$BUILD_VERSION"
-          deadline=$((SECONDS + 3600))
-          run_id=""
-          while (( SECONDS < deadline )); do
-            runs="$(gh api "repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/runs?event=workflow_dispatch&per_page=100" --jq '[.workflow_runs[] | {id, event, display_title, status, conclusion}]')"
-            matches="$(jq --arg title "$expected_title" '[.[] | select(.event == "workflow_dispatch" and .display_title == $title)]' <<<"$runs")"
-            count="$(jq 'length' <<<"$matches")"
-            if [[ "$count" == "1" ]]; then
-              run_id="$(jq -r '.[0].id' <<<"$matches")"
-              break
-            fi
-            if [[ "$count" != "0" ]]; then
-              echo "::error::Private build correlation matched multiple workflow runs."
-              exit 1
-            fi
-            sleep 10
-          done
-          if [[ -z "$run_id" ]]; then
-            echo "::error::Timed out waiting for the private build dispatch to appear."
-            exit 1
-          fi
-          while (( SECONDS < deadline )); do
-            runs="$(gh api "repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/runs?event=workflow_dispatch&per_page=100" --jq '[.workflow_runs[] | {id, event, display_title, status, conclusion}]')"
-            matches="$(jq --arg title "$expected_title" '[.[] | select(.event == "workflow_dispatch" and .display_title == $title)]' <<<"$runs")"
-            if [[ "$(jq 'length' <<<"$matches")" != "1" || "$(jq -r '.[0].id' <<<"$matches")" != "$run_id" ]]; then
-              echo "::error::Private build correlation is missing or ambiguous."
-              exit 1
-            fi
-            run="$(jq '.[0]' <<<"$matches")"
-            status="$(jq -r '.status' <<<"$run")"
-            conclusion="$(jq -r '.conclusion // empty' <<<"$run")"
-            if [[ "$status" == "completed" ]]; then
-              if [[ "$conclusion" != "success" ]]; then
-                echo "::error::Private marketing build concluded with $conclusion."
-                exit 1
-              fi
-              echo "Private marketing build completed successfully."
-              exit 0
-            fi
-            sleep 15
-          done
-          echo "::error::Timed out waiting for the private marketing build."
-          exit 1
@@ -35,24 +35,24 @@ jobs:
          permission-pull-requests: write

      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          token: ${{ steps.create-token.outputs.token }}
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: "24"
+          node-version: "26"
          cache: "pnpm"

      - name: Install dependencies
@@ -40,7 +40,7 @@ jobs:
          permission-pull-requests: write

      - name: Checkout Weblate branch
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          token: ${{ steps.create-token.outputs.token }}
          ref: ${{ env.WEBLATE_BRANCH }}
@@ -48,17 +48,17 @@ jobs:
          persist-credentials: false

      - name: Set up Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: "24"
+          node-version: "26"
          cache: "pnpm"

      - name: Install dependencies
@@ -77,14 +77,14 @@ jobs:
          GH_TOKEN: ${{ steps.create-token.outputs.token }}
        run: |
          set -euo pipefail
-          if [[ -z "$(git status --porcelain -- fluxer_app/src/features/i18n/locales packages/i18n/marketing packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n)" ]]; then
+          if [[ -z "$(git status --porcelain -- fluxer_app/src/features/i18n/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n)" ]]; then
            echo "No generated catalog changes."
            exit 0
          fi

          git config user.name "fluxer-ci[bot]"
          git config user.email "${{ vars.FLUXER_CI_APP_USER_ID }}+fluxer-ci[bot]@users.noreply.github.com"
-          git add fluxer_app/src/features/i18n/locales packages/i18n/marketing packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
+          git add fluxer_app/src/features/i18n/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
          git commit -m "i18n: compile Weblate catalogs"
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          git push origin "HEAD:$WEBLATE_BRANCH"
@@ -19,7 +19,7 @@ jobs:
          permission-pull-requests: write

      - name: Label pull request
-        uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13
        with:
          repo-token: ${{ steps.create-token.outputs.token }}
          configuration-path: .github/labeller.yaml
@@ -0,0 +1,142 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: release image set
+
+on:
+  workflow_dispatch:
+    inputs:
+      build-version:
+        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
+        type: string
+        required: false
+        default: ""
+      from-tag:
+        description: "Image tag every component is read from (v1 snapshots today's moving tags, a CalVer pins a coordinated build)"
+        type: string
+        required: false
+        default: "v1"
+      component-versions:
+        description: "Per-component overrides, one <image>=<version> entry per line (for example fluxer-api=2026.830.191141)"
+        type: string
+        required: false
+        default: ""
+
+permissions:
+  actions: read
+  contents: write
+  packages: read
+
+concurrency:
+  group: release-image-set
+  cancel-in-progress: false
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  GHCR_OWNER: ${{ github.repository_owner }}
+
+jobs:
+  approve:
+    name: approve image set release
+    permissions: {}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Image set release approved."
+
+  manifest:
+    name: resolve and publish the image set
+    needs: approve
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: write
+      packages: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: write
+          permission-packages: read
+
+      - name: set variables
+        id: vars
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          FLUXER_BUILD_VERSION: ${{ inputs['build-version'] }}
+        run: >-
+          tools/ci/run.sh resolve-calver
+          --github-output
+
+      - name: resolve release image set
+        id: resolve
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          VERSION: ${{ steps.vars.outputs.build_version }}
+          FROM_TAG: ${{ inputs['from-tag'] }}
+          COMPONENT_VERSIONS: ${{ inputs['component-versions'] }}
+        run: |
+          set -euo pipefail
+          args=(
+            image-set resolve
+            --version "${VERSION}"
+            --registry "ghcr.io/${GHCR_OWNER}"
+            --from-tag "${FROM_TAG}"
+            --out-dir release-out
+            --github-output
+          )
+          while IFS= read -r entry; do
+            entry="$(echo "$entry" | xargs)"
+            if [ -n "$entry" ]; then
+              args+=( --component-version "$entry" )
+            fi
+          done <<< "${COMPONENT_VERSIONS}"
+          tools/ci/run.sh "${args[@]}"
+
+      - name: verify release image set
+        env:
+          VERSION: ${{ steps.vars.outputs.build_version }}
+        run: >-
+          tools/ci/run.sh image-set verify
+          --manifest "release-out/fluxer-release-${VERSION}.json"
+
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          VERSION: ${{ steps.vars.outputs.build_version }}
+          BUNDLE_COMMIT: ${{ steps.resolve.outputs.bundle_commit }}
+        run: |
+          set -euo pipefail
+          if [ -z "${BUNDLE_COMMIT}" ]; then
+            echo "image-set resolve reported no bundle commit" >&2
+            exit 1
+          fi
+          gh release create "fluxer-release@${VERSION}" \
+            --repo fluxerapp/fluxer \
+            --target "${BUNDLE_COMMIT}" \
+            --title "fluxer-release ${VERSION}" \
+            --latest=true \
+            --notes "Immutable image set for ${VERSION}. Every image in the set contains ${BUNDLE_COMMIT}, the commit this tag points at, so the bundle here is never newer than the images. Pin with: docker compose -f docker-compose.yml -f fluxer-release-${VERSION}.yml up -d" \
+            "release-out/fluxer-release-${VERSION}.json" \
+            "release-out/fluxer-release-${VERSION}.yml"
@@ -28,12 +28,12 @@ jobs:
      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

      - name: Restore ci helper
@@ -42,7 +42,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -55,16 +55,16 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -83,12 +83,12 @@ jobs:
      PNPM_TEST_WORKSPACE_CONCURRENCY: '2'
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

      - name: Restore ci helper
@@ -97,7 +97,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -105,12 +105,12 @@ jobs:
        run: cargo build --locked --package fluxer-ci

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -123,12 +123,16 @@ jobs:
        with:
          path: |
            fluxer_app/pkgs/libfluxcore
+            fluxer_app/pkgs/libfluxwebp
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'fluxer_app/rust/libfluxwebp/Cargo.toml', 'fluxer_app/rust/libfluxwebp/Cargo.lock',
+            'fluxer_app/rust/libfluxwebp/src/**', 'fluxer_app/rust/libfluxwebp/shim/**',
+            'fluxer_app/rust/libfluxwebp/simd/**',
            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
            'packages/markdown_parser/rust/src/**') }}

@@ -142,56 +146,106 @@ jobs:
        with:
          path: |
            fluxer_app/pkgs/libfluxcore
+            fluxer_app/pkgs/libfluxwebp
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'fluxer_app/rust/libfluxwebp/Cargo.toml', 'fluxer_app/rust/libfluxwebp/Cargo.lock',
+            'fluxer_app/rust/libfluxwebp/src/**', 'fluxer_app/rust/libfluxwebp/shim/**',
+            'fluxer_app/rust/libfluxwebp/simd/**',
            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
            'packages/markdown_parser/rust/src/**') }}

  rust:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 45
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          components: clippy, rustfmt

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Cache cargo
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
        with:
-          workspaces: |
-            . -> target
-            fluxer_desktop/native/rust -> target
-          save-if: ${{ github.ref == 'refs/heads/main' }}
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: rust-${{ runner.os }}-${{ hashFiles('fluxer_media_proxy/tools/install-native-deps.sh') }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            rust-${{ runner.os }}-${{ hashFiles('fluxer_media_proxy/tools/install-native-deps.sh') }}-
+
+      - name: Install cargo-deny
+        run: cargo install cargo-deny --version 0.20.2 --locked
+
+      - name: Check Rust dependencies
+        run: cargo deny --locked check -D warnings
+
+      - name: Check libfluxwebp dependencies
+        run: cargo deny --manifest-path fluxer_app/rust/libfluxwebp/Cargo.toml --config deny.toml --locked check licenses bans sources
+
+      - name: Check desktop native dependencies
+        run: tools/ci/check-desktop-native-workspaces.sh dependencies
+
+      - name: Cache native media dependencies
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: /opt/fluxer-native
+          key: media-native-${{ runner.os }}-${{ hashFiles('fluxer_media_proxy/tools/install-native-deps.sh') }}

      - name: Install native dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
-            pkg-config \
            build-essential \
-            libcurl4-openssl-dev \
-            libvips-dev \
+            binutils \
+            clang \
+            cmake \
+            curl \
+            libaom-dev \
            libavfilter-dev \
+            libclang-dev \
+            libcurl4-openssl-dev \
+            libdav1d-dev \
+            libde265-dev \
+            libfido2-dev \
            libheif-dev \
-            libwebp-dev
+            liblcms2-dev \
+            libpipewire-0.3-dev \
+            libspa-0.2-dev \
+            libssl-dev \
+            libudev-dev \
+            libvips-dev \
+            libwebp-dev \
+            libyuv-dev \
+            meson \
+            nasm \
+            ninja-build \
+            pkg-config \
+            xz-utils \
+            yasm \
+            zlib1g-dev
+          sudo fluxer_media_proxy/tools/install-native-deps.sh /opt/fluxer-native
+          echo "PKG_CONFIG_PATH=/opt/fluxer-native/lib/pkgconfig:/opt/fluxer-native/lib64/pkgconfig" >> "$GITHUB_ENV"
+          echo "LD_LIBRARY_PATH=/opt/fluxer-native/lib:/opt/fluxer-native/lib64" >> "$GITHUB_ENV"
+          echo "/opt/fluxer-native/bin" >> "$GITHUB_PATH"

      - name: Install Node.js dependencies
        run: pnpm --filter fluxer_admin install
@@ -199,17 +253,32 @@ jobs:
      - name: Check formatting
        run: cargo fmt --all -- --check

-      - name: Check formatting (desktop native)
-        run: cargo fmt --manifest-path fluxer_desktop/native/rust/Cargo.toml --all -- --check
+      - name: Check formatting (libfluxwebp)
+        run: cargo fmt --manifest-path fluxer_app/rust/libfluxwebp/Cargo.toml -- --check
+
+      - name: Check formatting (desktop native workspaces)
+        run: tools/ci/check-desktop-native-workspaces.sh fmt

      - name: Clippy (warnings as errors)
-        run: cargo clippy --workspace -- -D warnings
+        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
+
+      - name: Clippy (desktop native workspaces on Linux, warnings as errors)
+        run: tools/ci/check-desktop-native-workspaces.sh clippy
+
+      - name: Verify the source-built ffmpeg CLI is on PATH
+        run: |
+          set -euo pipefail
+          command -v ffmpeg
+          test "$(command -v ffmpeg)" = /opt/fluxer-native/bin/ffmpeg
+          ffmpeg -hide_banner -version

      - name: Run tests
-        run: cargo test --workspace
+        env:
+          FLUXER_REQUIRE_MEDIA_FIXTURES: "1"
+        run: cargo test --workspace --all-features --locked

-      - name: Run desktop native tests
-        run: cargo test --manifest-path fluxer_desktop/native/rust/Cargo.toml
+      - name: Run desktop native workspace tests on Linux
+        run: tools/ci/check-desktop-native-workspaces.sh test

  gateway:
    runs-on: ubuntu-24.04
@@ -218,12 +287,12 @@ jobs:
      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Cache cargo (gateway NIFs)
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
@@ -239,7 +308,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -250,7 +319,7 @@ jobs:
        uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124
        with:
          otp-version: '28'
-          rebar3-version: '3.24.0'
+          rebar3-version: '3.27.0'

      - name: Restore rebar3 dependencies
        id: rebar3-cache
@@ -259,13 +328,16 @@ jobs:
          path: |
            ~/.cache/rebar3
            fluxer_gateway/_build
-            !fluxer_gateway/_build/default/lib/fluxer_gateway
-            !fluxer_gateway/_build/test/lib/fluxer_gateway
+            !fluxer_gateway/_build/default/lib/fluxer_gateway/**
+            !fluxer_gateway/_build/test/lib/fluxer_gateway/**
          key: >-
-            rebar3-${{ runner.os }}-otp28-rebar3.24.0-${{ hashFiles('fluxer_gateway/rebar.lock',
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-${{ hashFiles('fluxer_gateway/rebar.lock',
            'fluxer_gateway/rebar.config') }}
          restore-keys: |
-            rebar3-${{ runner.os }}-otp28-rebar3.24.0-
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-
+
+      - name: Drop restored gateway build output
+        run: rm -rf fluxer_gateway/_build/default/lib/fluxer_gateway fluxer_gateway/_build/test/lib/fluxer_gateway

      - name: Check formatting
        run: |
@@ -290,10 +362,10 @@ jobs:
          path: |
            ~/.cache/rebar3
            fluxer_gateway/_build
-            !fluxer_gateway/_build/default/lib/fluxer_gateway
-            !fluxer_gateway/_build/test/lib/fluxer_gateway
+            !fluxer_gateway/_build/default/lib/fluxer_gateway/**
+            !fluxer_gateway/_build/test/lib/fluxer_gateway/**
          key: >-
-            rebar3-${{ runner.os }}-otp28-rebar3.24.0-${{ hashFiles('fluxer_gateway/rebar.lock',
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-${{ hashFiles('fluxer_gateway/rebar.lock',
            'fluxer_gateway/rebar.config') }}

  knip:
@@ -303,12 +375,12 @@ jobs:
      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

      - name: Restore ci helper
@@ -317,7 +389,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -325,12 +397,12 @@ jobs:
        run: cargo build --locked --package fluxer-ci

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -343,12 +415,16 @@ jobs:
        with:
          path: |
            fluxer_app/pkgs/libfluxcore
+            fluxer_app/pkgs/libfluxwebp
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'fluxer_app/rust/libfluxwebp/Cargo.toml', 'fluxer_app/rust/libfluxwebp/Cargo.lock',
+            'fluxer_app/rust/libfluxwebp/src/**', 'fluxer_app/rust/libfluxwebp/shim/**',
+            'fluxer_app/rust/libfluxwebp/simd/**',
            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
            'packages/markdown_parser/rust/src/**') }}

@@ -362,29 +438,58 @@ jobs:
        with:
          path: |
            fluxer_app/pkgs/libfluxcore
+            fluxer_app/pkgs/libfluxwebp
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
+            'fluxer_app/rust/libfluxwebp/Cargo.toml', 'fluxer_app/rust/libfluxwebp/Cargo.lock',
+            'fluxer_app/rust/libfluxwebp/src/**', 'fluxer_app/rust/libfluxwebp/shim/**',
+            'fluxer_app/rust/libfluxwebp/simd/**',
            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
            'packages/markdown_parser/rust/src/**') }}

+  lint:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
+
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: '26'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Check formatting and lint
+        run: pnpm exec biome ci .
+
+      - name: Lint JSX for browser-translation safety
+        run: pnpm exec eslint . --max-warnings 0
+
  i18n:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -405,17 +510,42 @@ jobs:
            exit 1
          fi

+  docs:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
+
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: '26'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --filter fluxer_docs...
+
+      - name: Verify documentation matches the live API
+        run: pnpm --filter fluxer_docs verify
+
+      - name: Build documentation
+        run: pnpm --filter fluxer_docs build
+
  fonts:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
-          python-version: "3.13"
+          python-version: "3.14"

      - name: Install font tooling
        run: python3 -m pip install -r tools/fonts/requirements.txt
@@ -10,6 +10,7 @@
 /.direnv/
 /.fluxer/
 /.pnpm-store/
+/.vscode/

 **/*.css.d.ts
 **/*.tsbuildinfo
@@ -25,6 +26,7 @@

 /fluxer_app/.devserver-cache.json
 /fluxer_app/pkgs/libfluxcore/
+/fluxer_app/pkgs/libfluxwebp/
 /fluxer_app/src/features/i18n/locales/*/messages.mjs
 /fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
 /fluxer_app/src/features/theme/styles/generated/
@@ -1,4 +0,0 @@
-[submodule "fluxer_marketing"]
-	path = fluxer_marketing
-	url = https://github.com/fluxerapp/marketing.git
-	update = none
@@ -7,9 +7,9 @@ members = [
 	"fluxer_gifs",
 	"fluxer_svc",
 	"fluxer_messages",
+	"fluxer_push",
 	"fluxer_snowflakes",
 	"tools/ci",
-	"tools/content/update-frozen-snapshot",
 	"tools/dev",
 	"tools/i18n_auto",
 	"fluxer_users",
@@ -17,7 +17,6 @@ members = [
 	"packages/markdown_parser/rust",
 ]
 exclude = [
-	"fluxer_marketing",
 	"packages/markdown_parser/rust/fuzz",
 ]
 resolver = "2"
@@ -25,3 +24,8 @@ resolver = "2"
 [workspace.package]
 edition = "2024"
 license = "AGPL-3.0-or-later"
+
+[profile.release]
+lto = "fat"
+codegen-units = 1
+strip = "symbols"
@@ -1,15 +1,3 @@
-> [!CAUTION]
-> As of this writing (15 June 2026), we are working to finalise the API and self-hosting documentation over the next few days.
->
-> We apologise for the brief delay in open-source releases. We paused after spam waves created safety concerns while we built out Fluxer's trust and safety infrastructure. During that same stretch, we have been fixing hundreds of bugs, adding new features, and preparing a much improved audio and video system.
->
-> You can already try that work in the Fluxer Canary client: [download Canary](https://canary.fluxer.app/download) or [open Canary on the web](https://web.canary.fluxer.app). The latest stable client remains out of date for now, but over the coming weeks we are finalising the remaining work needed to stabilise the current latest code out in the open.
-
-> [!NOTE]
-> Learn about the developer behind Fluxer, the goals of the project, the tech stack, and what's coming next.
->
-> [Read the launch blog post](https://blog.fluxer.app/how-i-built-fluxer-a-discord-like-chat-app/) | [View full roadmap](https://blog.fluxer.app/roadmap-2026/)
-
 <p align="center">
  <picture>
    <source media="(prefers-color-scheme: dark)" srcset="./fluxer_static/marketing/branding/logo-white.svg">
@@ -18,18 +6,173 @@
 </p>

 <p align="center">
-  <a href="https://fluxer.app/donate">
-    <img src="https://img.shields.io/badge/Donate-fluxer.app%2Fdonate-brightgreen" alt="Donate" /></a>
+  <a href="https://fluxer.app/download">
+    <img src="https://img.shields.io/badge/Download-fluxer.app-4641D9" alt="Download" /></a>
  <a href="https://docs.fluxer.app">
    <img src="https://img.shields.io/badge/Docs-docs.fluxer.app-blue" alt="Documentation" /></a>
+  <a href="https://fluxer.app/donate">
+    <img src="https://img.shields.io/badge/Donate-fluxer.app%2Fdonate-brightgreen" alt="Donate" /></a>
  <a href="./LICENSE">
    <img src="https://img.shields.io/badge/License-AGPLv3-purple" alt="AGPLv3 License" /></a>
 </p>

+<p align="center">
+  <a href="https://flathub.org/apps/app.fluxer.Fluxer">
+    <img src="https://dl.flathub.org/assets/badges/flathub-badge-en.svg" alt="Get it on Flathub" height="60" /></a>
+</p>
+
 # Fluxer

 Fluxer is a free and open source instant messaging and VoIP chat app built for friends, groups, and communities.

 <p align="center">
-  <img src="./fluxer_static/marketing/screenshots/desktop-readme-1920w.png" alt="Fluxer app showcase" width="900">
+  <img src="./fluxer_static/marketing/screenshots/desktop-readme-1920w.png" alt="Fluxer running side by side on a desktop monitor and a phone" width="640">
 </p>
+
+## Download
+
+| Windows | macOS | Linux | Android | iOS |
+| --- | --- | --- | --- | --- |
+| [Installer (x64)][win-setup-x64] | [Disk image][mac-dmg] | [Flathub][flathub] | [Google Play (beta)][android-play] | [TestFlight][ios-testflight] |
+| [Installer (ARM64)][win-setup-arm64] | | [deb (x64)][linux-deb-x64] | [APK (beta)][android-apk] | |
+| [Portable (x64)][win-portable-x64] | | [deb (ARM64)][linux-deb-arm64] | [Obtainium (beta)][obtainium] | |
+| [Portable (ARM64)][win-portable-arm64] | | [rpm (x64)][linux-rpm-x64] | | |
+| | | [rpm (ARM64)][linux-rpm-arm64] | | |
+| | | [AppImage (x64)][linux-appimage-x64] | | |
+| | | [AppImage (ARM64)][linux-appimage-arm64] | | |
+| | | [tar.gz (x64)][linux-targz-x64] | | |
+| | | [tar.gz (ARM64)][linux-targz-arm64] | | |
+
+The macOS disk image runs on both Apple silicon and Intel. Windows and Linux need the build matching your processor.
+
+On Linux, prefer a repository over a single file so Fluxer updates with the rest of your system.
+
+## Linux package repositories
+
+The package is `fluxer` for stable and `fluxer-canary` for canary. apt and dnf subscribe to one channel per entry file. pacman and Flatpak serve both from one repository.
+
+### Flatpak
+
+Stable is on [Flathub][flathub], the easiest route on most desktops:
+
+```sh
+flatpak install flathub app.fluxer.Fluxer
+```
+
+Flathub has stable only. To use Fluxer's own repository, open [the stable][flatpak-ref] or [the canary][flatpak-canary-ref] reference file and your software manager takes over. Some desktops also accept `flatpak+https://pkgs.fluxer.com/flatpak/fluxer.flatpakref` in the address bar.
+
+From a terminal:
+
+```sh
+flatpak install https://pkgs.fluxer.com/flatpak/fluxer.flatpakref
+```
+
+### Debian and Ubuntu
+
+```sh
+sudo install -d -m 0755 /etc/apt/keyrings
+sudo curl -fsSL -o /etc/apt/keyrings/fluxer-archive-keyring.gpg https://pkgs.fluxer.com/keys/fluxer-archive-keyring.gpg
+sudo curl -fsSL -o /etc/apt/sources.list.d/fluxer.sources https://pkgs.fluxer.com/deb/fluxer.sources
+sudo apt update && sudo apt install fluxer
+```
+
+For canary, use the canary entry file and package.
+
+```sh
+sudo curl -fsSL -o /etc/apt/sources.list.d/fluxer-canary.sources https://pkgs.fluxer.com/deb/fluxer-canary.sources
+sudo apt update && sudo apt install fluxer-canary
+```
+
+A `.deb` installed from a download only updates once its channel's entry is added.
+
+### Fedora and RHEL
+
+```sh
+sudo curl -fsSL -o /etc/yum.repos.d/fluxer.repo https://pkgs.fluxer.com/rpm/fluxer.repo
+sudo dnf install fluxer
+```
+
+For canary, use the canary entry file and package.
+
+```sh
+sudo curl -fsSL -o /etc/yum.repos.d/fluxer-canary.repo https://pkgs.fluxer.com/rpm/fluxer-canary.repo
+sudo dnf install fluxer-canary
+```
+
+RHEL, Rocky, Alma and CentOS Stream need `sudo dnf install epel-release` first, because their base repositories lack `libXScrnSaver`. Fedora does not.
+
+### Arch Linux
+
+The repository is signed, so pacman needs the key once:
+
+```sh
+sudo pacman-key --init
+curl -fsSL -o /tmp/fluxer-archive-keyring.asc https://pkgs.fluxer.com/keys/fluxer-archive-keyring.asc
+sudo pacman-key --add /tmp/fluxer-archive-keyring.asc
+sudo pacman-key --lsign-key 09D01339EE128925F75E675C855C5BDE34D205D2
+```
+
+`--lsign-key` is what makes pacman trust it. Then add the repository:
+
+```sh
+sudo tee -a /etc/pacman.conf >/dev/null <<'REPO'
+
+[fluxer]
+SigLevel = Required TrustedOnly
+Server = https://pkgs.fluxer.com/arch/$repo/os/$arch
+REPO
+sudo pacman -Syu fluxer
+```
+
+Write `$repo` and `$arch` literally. Both are pacman variables, not shell ones, hence the quoted heredoc.
+
+Full setup notes, including canary, are in the [Linux repositories documentation][docs-linux].
+
+## Other ways to run it
+
+- [Open Fluxer in a browser](https://web.fluxer.app), no install needed.
+- [Host your own instance][docs-selfhost] from this repository.
+
+## Documentation
+
+- [Documentation home][docs]
+- [Downloads][docs-downloads]
+- [Self-hosting][docs-selfhost]
+
+## License
+
+The source is licensed under the [AGPL-3.0-or-later](./LICENSE) license.
+
+Fluxer branding, icons, default avatars, badge artwork, screenshots and marketing
+imagery are copyright Fluxer, all rights reserved, as set out in
+[fluxer_static/LICENSE](./fluxer_static/LICENSE). Third-party material keeps its own
+terms, listed in
+[fluxer_static/THIRD_PARTY_LICENSES.md](./fluxer_static/THIRD_PARTY_LICENSES.md).
+
+Public availability of this repository does not grant trademark, brand, or
+endorsement rights.
+
+[win-setup-x64]: https://pkgs.fluxer.com/desktop/stable/win32/x64/latest/setup
+[win-setup-arm64]: https://pkgs.fluxer.com/desktop/stable/win32/arm64/latest/setup
+[win-portable-x64]: https://pkgs.fluxer.com/desktop/stable/win32/x64/latest/portable
+[win-portable-arm64]: https://pkgs.fluxer.com/desktop/stable/win32/arm64/latest/portable
+[mac-dmg]: https://pkgs.fluxer.com/desktop/stable/darwin/arm64/latest/dmg
+[linux-deb-x64]: https://pkgs.fluxer.com/desktop/stable/linux/x64/latest/deb
+[linux-deb-arm64]: https://pkgs.fluxer.com/desktop/stable/linux/arm64/latest/deb
+[linux-rpm-x64]: https://pkgs.fluxer.com/desktop/stable/linux/x64/latest/rpm
+[linux-rpm-arm64]: https://pkgs.fluxer.com/desktop/stable/linux/arm64/latest/rpm
+[linux-appimage-x64]: https://pkgs.fluxer.com/desktop/stable/linux/x64/latest/appimage
+[linux-appimage-arm64]: https://pkgs.fluxer.com/desktop/stable/linux/arm64/latest/appimage
+[linux-targz-x64]: https://pkgs.fluxer.com/desktop/stable/linux/x64/latest/tar_gz
+[linux-targz-arm64]: https://pkgs.fluxer.com/desktop/stable/linux/arm64/latest/tar_gz
+[flatpak-ref]: https://pkgs.fluxer.com/flatpak/fluxer.flatpakref
+[flatpak-canary-ref]: https://pkgs.fluxer.com/flatpak/fluxer-canary.flatpakref
+[flathub]: https://flathub.org/apps/app.fluxer.Fluxer
+[android-play]: https://play.google.com/store/apps/details?id=com.fluxer
+[android-apk]: https://github.com/fluxerapp/flutter_client/releases
+[obtainium]: https://obtainium.imranr.dev/
+[ios-testflight]: https://testflight.apple.com/join/PKZR6pK9
+[docs]: https://docs.fluxer.app
+[docs-downloads]: https://docs.fluxer.app/downloads/overview/
+[docs-linux]: https://docs.fluxer.app/downloads/linux-repositories/
+[docs-selfhost]: https://docs.fluxer.app/operator/get-started/
@@ -20,7 +20,7 @@
 			"bracketSpacing": false,
 			"bracketSameLine": false
 		},
-		"globals": ["React"]
+		"globals": ["React", "__webpack_base_uri__"]
 	},
 	"json": {
 		"formatter": {
@@ -48,7 +48,7 @@
 	"linter": {
 		"enabled": true,
 		"rules": {
-			"recommended": true,
+			"preset": "recommended",
 			"complexity": {
 				"noForEach": "off",
 				"noImportantStyles": "off",
@@ -83,11 +83,23 @@
 					}
 				},
 				"useConst": "error",
+				"noDescendingSpecificity": "off",
 				"noNonNullAssertion": "off",
-				"noParameterAssign": "off"
+				"noParameterAssign": "off",
+				"noRestrictedImports": {
+					"level": "error",
+					"options": {
+						"paths": {
+							"@lingui/react": {
+								"importNames": ["I18nProvider"],
+								"message": "Use AppI18nProvider from @app/features/i18n/components/AppI18nProvider so <Trans> output stays safe under page translation."
+							}
+						}
+					}
+				}
 			},
 			"a11y": {
-				"recommended": true,
+				"preset": "recommended",
 				"useAriaPropsForRole": "error",
 				"useValidAriaRole": "error",
 				"useValidAriaValues": "error",
@@ -115,6 +127,28 @@
 		}
 	},
 	"assist": {"actions": {"source": {"organizeImports": "on"}}},
+	"overrides": [
+		{
+			"includes": ["fluxer_app/src/**/*.tsx"],
+			"plugins": ["./tools/lint/no-adjacent-jsx-text.grit"]
+		},
+		{
+			"includes": ["fluxer_docs/scripts/VerifyDocsCoverage.ts"],
+			"linter": {"rules": {"suspicious": {"noTemplateCurlyInString": "off"}}}
+		},
+		{
+			"includes": [
+				"fluxer_app/src/features/i18n/components/AppI18nProvider.tsx",
+				"fluxer_app/src/features/i18n/components/AppI18nProvider.test.tsx"
+			],
+			"linter": {"rules": {"style": {"noRestrictedImports": "off"}}}
+		},
+		{
+			"includes": ["**/*.astro"],
+			"linter": {"rules": {"correctness": {"noUnusedImports": "off", "noUnusedVariables": "off"}}},
+			"assist": {"actions": {"source": {"organizeImports": "off"}}}
+		}
+	],
 	"vcs": {
 		"enabled": true,
 		"clientKind": "git",
@@ -30,12 +30,6 @@ FLUXER_POSTGRES_PASSWORD=fluxer
 FLUXER_POSTGRES_SSL=false
 FLUXER_POSTGRES_MAX_CONNECTIONS=20
 FLUXER_POSTGRES_KV_TABLE=fluxer_kv
-FLUXER_CASSANDRA_HOSTS=cassandra
-FLUXER_CASSANDRA_PORT=9042
-FLUXER_CASSANDRA_KEYSPACE=fluxer
-FLUXER_CASSANDRA_LOCAL_DC=datacenter1
-FLUXER_CASSANDRA_USERNAME=fluxer
-FLUXER_CASSANDRA_PASSWORD=fluxer
 FLUXER_KV_URL=redis://valkey:6379/0
 FLUXER_NATS_URL=nats://nats:4222
 FLUXER_NATS_JETSTREAM_URL=nats://nats:4222
@@ -49,7 +43,6 @@ FLUXER_SVC_NATS_URL=nats://nats:4222
 FLUXER_SVC_SHARD_COUNT=1
 FLUXER_SVC_CACHE_TTL_MS=30000
 FLUXER_SVC_CACHE_HARD_TTL_MS=600000
-FLUXER_SVC_MAX_CONCURRENT_REQUESTS=64

 FLUXER_S3_ENDPOINT=http://127.0.0.1:8333
 FLUXER_S3_PUBLIC_ENDPOINT=http://localhost:8088
@@ -59,22 +52,21 @@ FLUXER_S3_SECRET_ACCESS_KEY=fluxer-secret
 FLUXER_S3_FORCE_PATH_STYLE=true
 FLUXER_S3_BUCKET_CDN=fluxer
 FLUXER_S3_BUCKET_UPLOADS=fluxer-uploads
-FLUXER_S3_BUCKET_DOWNLOADS=fluxer-downloads
 FLUXER_S3_BUCKET_REPORTS=fluxer-reports
 FLUXER_S3_BUCKET_HARVESTS=fluxer-harvests
 FLUXER_S3_BUCKET_STATIC=fluxer-static

 FLUXER_LIVEKIT_ENABLED=true
 FLUXER_LIVEKIT_URL=ws://localhost:8088/livekit
+FLUXER_LIVEKIT_INTERNAL_URL=http://localhost:7880
 FLUXER_LIVEKIT_API_KEY=devkey
-FLUXER_LIVEKIT_API_SECRET=secret
+FLUXER_LIVEKIT_API_SECRET=fluxer-livekit-development-secret
 FLUXER_LIVEKIT_WEBHOOK_URL=http://localhost:8088/api/webhooks/livekit
 FLUXER_LIVEKIT_DEFAULT_REGION={"id":"local","name":"Local","emoji":"LC","latitude":59.3293,"longitude":18.0686}

 FLUXER_API_PORT=8080
 FLUXER_API_PRESIGNED_ATTACHMENT_UPLOADS_ENABLED=true
 FLUXER_API_WORKER_MODE=all_lanes
-FLUXER_API_WORKER_ENABLE_VOICE_RECONCILIATION=true
 FLUXER_APP_DEV_PORT=3000
 FLUXER_APP_PROXY_PORT=8773
 FLUXER_STATIC_DIR=fluxer_app/dist
@@ -95,18 +87,13 @@ FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES=1048576
 FLUXER_ADMIN_PORT=3020
 FLUXER_ADMIN_BASE_PATH=/admin
 FLUXER_ADMIN_SECRET_KEY_BASE=dev-admin-secret-key-base
-FLUXER_ADMIN_OAUTH_CLIENT_ID=1234567890123456789
 FLUXER_ADMIN_OAUTH_CLIENT_SECRET=dev-admin-oauth-secret
 FLUXER_ADMIN_OAUTH_REDIRECT_URI=http://localhost:8088/admin/oauth2_callback
-FLUXER_MARKETING_PORT=3010
-FLUXER_MARKETING_HOST=0.0.0.0
-FLUXER_MARKETING_BASE_PATH=/marketing
-FLUXER_MARKETING_SECRET_KEY_BASE=dev-marketing-secret-key-base

 FLUXER_SUDO_MODE_SECRET=dev-sudo-secret
 FLUXER_CONNECTION_INITIATION_SECRET=dev-connection-initiation-secret
-FLUXER_VAPID_PUBLIC_KEY=dev-vapid-public-key
-FLUXER_VAPID_PRIVATE_KEY=dev-vapid-private-key
+FLUXER_VAPID_PUBLIC_KEY=BHIbdKs24FdPkOQS7hbeg3adceLS0IqlKsn71ywEe6kbeopeFFiG3lkvJac7BVqkuk7mxwEa555O2FXV3HLt56w
+FLUXER_VAPID_PRIVATE_KEY=cs24JvXSxHiqJQgkJNocJFAdzJpPmpfU9xD-fDpn3tw
 FLUXER_VAPID_EMAIL=dev@localhost
 FLUXER_PASSKEY_RP_NAME='Fluxer Dev'
 FLUXER_PASSKEY_RP_ID=localhost
@@ -142,6 +129,7 @@ PUBLIC_RELEASE_CHANNEL=canary
 PUBLIC_BOOTSTRAP_API_ENDPOINT=/api
 PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT=http://localhost:8088/api
 FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64=Zmx1eGVyLWRldi11cGxvYWQtcmVsYXktc2VjcmV0LTAwMDA=
+FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64=Zmx1eGVyLWRldi1hdHRhY2htZW50LXVybC1zZWNyZXQ=
 AWS_EC2_METADATA_DISABLED=true
 AWS_ACCESS_KEY_ID=fluxer
 AWS_SECRET_ACCESS_KEY=fluxer-secret
@@ -1,13 +1,9 @@
 # cargo-deny configuration for the Fluxer workspace.
 #
-# Applies to the root workspace (Cargo.toml at the repo root) AND to every
-# per-addon crate under fluxer_desktop/native/* (each addon has its own
-# [workspace], so we invoke cargo-deny with --config pointing here).
-#
-# Used by the native desktop security gate in CI.
+# Applies to the root workspace (Cargo.toml at the repo root).

 [graph]
-all-features = false
+all-features = true
 no-default-features = false

 [output]
@@ -44,13 +40,11 @@ allow = [
    "BSD-3-Clause",
    "ISC",
    "MPL-2.0",
-    "Unicode-DFS-2016",
    "Unicode-3.0",
    "Zlib",
    "CC0-1.0",
    "AGPL-3.0-or-later",
    "BSL-1.0",
-    "OpenSSL",
    "CDLA-Permissive-2.0",
 ]
 # Explicitly deny GPL-only / strong-copyleft licenses that don't compose with
@@ -72,21 +66,56 @@ license-files = [
 [bans]
 multiple-versions = "warn"
 wildcards = "deny"
-# Per-addon crates path-depend on ../rust (the shared `fluxer_desktop_native`
-# crate) without a version. cargo-deny flags that as a wildcard; we allow it
-# because path deps can't realistically pin a SemVer range, and this only
-# affects intra-repo workspace links (registry wildcards remain denied).
+# Internal workspace crates use path dependencies without registry versions.
+# Registry wildcards remain denied.
 allow-wildcard-paths = true
 highlight = "all"
 workspace-default-features = "allow"
 external-default-features = "allow"
-# Keep desktop packaging and native addons away from the obsolete libfuse2 stack.
+# Keep workspace artifacts away from the obsolete libfuse2 stack.
 # AppImage packaging must use the static electron-builder runtime instead.
 deny = [
    { crate = "fuse", reason = "libfuse2-based Rust wrapper; use a maintained FUSE3-native crate only if Fluxer ever needs FUSE directly" },
    { crate = "fuse-sys", reason = "libfuse2 FFI crate; Fluxer AppImages must not reintroduce libfuse2 through native Rust dependencies" },
 ]
-skip = []
+skip = [
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older crypto API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older hashbrown API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older HTTP API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older HTTP body API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older WASI API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]+wasi-snapshot-preview1", reason = "transitive dependency requires the legacy WASI API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older Windows API" },
+]
 skip-tree = []

 # ---------------------------------------------------------------------------
@@ -1,7 +1,65 @@
+# Every variable docker-compose.yml reads, uncommented when it has no default and
+# commented with its default when it has one. Compose expands top to bottom, so a
+# line using ${...} must sit below every name it reads.
+
 FLUXER_DOMAIN=chat.example.com
 FLUXER_PUBLIC_SCHEME=https
 FLUXER_PUBLIC_PORT=443
-FLUXER_CADDY_SITE_ADDRESS=chat.example.com
+
+# The address browsers use. FLUXER_HTTP_PORT and FLUXER_HTTPS_PORT below decide
+# which host ports Fluxer binds.
+
+# By default Fluxer binds 80 and 443 and gets its own certificate. Point DNS here.
+# Behind your own reverse proxy, uncomment this instead: Fluxer then serves plain
+# HTTP on 127.0.0.1:8080. Keep the scheme and port above describing the public
+# address, not this one.
+#COMPOSE_FILE=docker-compose.yml:docker-compose.proxy.yml
+
+# Where that plain-HTTP port binds. Use 0.0.0.0:8080 only when the proxy is on
+# another machine, and firewall it to that machine.
+#FLUXER_EDGE_BIND=127.0.0.1:8080
+
+# Which hops may set X-Forwarded-For. The default covers private and loopback
+# addresses. Set your proxy's address if it reaches Fluxer from a public IP.
+#FLUXER_EDGE_TRUSTED_PROXIES=private_ranges
+
+# The origin browsers see, no trailing slash. Set it when browsers reach the
+# instance on a host FLUXER_DOMAIN does not name, and it wins over the three
+# values above. Scheme, host and optional port only. It does not move the
+# published ports.
+#FLUXER_PUBLIC_ORIGIN=https://chat.example.com
+
+# The address the edge listens on inside its container. Both proxy overlays set
+# this themselves, so a value here is ignored under either. Include the scheme.
+#FLUXER_EDGE_SITE_ADDRESS=https://chat.example.com
+
+# The old name for the line above, read only when it is unset.
+#FLUXER_CADDY_SITE_ADDRESS=
+
+# Host ports. Container 80 handles the redirect and the certificate challenge,
+# container 443 the TLS site. FLUXER_HTTPS_PORT moves TCP and UDP together, since
+# HTTP/3 needs both. Both accept a bind address. Give them different host ports.
+#FLUXER_HTTP_PORT=80
+#FLUXER_HTTPS_PORT=443
+#FLUXER_HTTP_PORT=127.0.0.1:80
+#FLUXER_HTTPS_PORT=127.0.0.1:443
+
+# HTTPS on 8443. Host 80 stays published for the certificate challenge, which
+# only ever arrives on public 80 or 443. Serve your own certificate if nothing
+# forwards those.
+#FLUXER_PUBLIC_PORT=8443
+#FLUXER_HTTPS_PORT=8443
+
+# Plain HTTP on 19080. Nothing binds host 80, and the last line parks the idle
+# 443 publish on loopback.
+#FLUXER_PUBLIC_SCHEME=http
+#FLUXER_PUBLIC_PORT=19080
+#FLUXER_HTTP_PORT=19080
+#FLUXER_HTTPS_PORT=127.0.0.1:443
+
+# A tunnel needs no HTTPS publish. tunnel.compose.yml ships beside this file and
+# leaves one loopback HTTP publish. Needs Compose 2.24.4 or newer.
+#COMPOSE_FILE=docker-compose.yml:tunnel.compose.yml

 FLUXER_REGISTRY_OWNER=fluxerapp
 FLUXER_REGISTRY=ghcr.io/${FLUXER_REGISTRY_OWNER}
@@ -9,52 +67,157 @@ FLUXER_IMAGE_TAG=v1

 POSTGRES_PASSWORD=CHANGE_ME
 MEILI_MASTER_KEY=CHANGE_ME
+# Set these to run Postgres or the object store outside the stack. Backing up a
+# store you moved out is yours to arrange, and an upgrade skips it.
+#FLUXER_POSTGRES_HOST=db.example.com
+#FLUXER_POSTGRES_PORT=5432
+#FLUXER_POSTGRES_DATABASE=fluxer
+#FLUXER_POSTGRES_USERNAME=fluxer
+#FLUXER_POSTGRES_SSL=true
+#FLUXER_S3_ENDPOINT=https://s3.eu-central-1.amazonaws.com
+#FLUXER_S3_PUBLIC_ENDPOINT=https://cdn.example.com
+#FLUXER_S3_REGION=eu-central-1
+#FLUXER_S3_FORCE_PATH_STYLE=false
+# Bucket names. The bundled store creates these. An outside store needs them to
+# exist already.
+#FLUXER_S3_BUCKET_CDN=fluxer
+#FLUXER_S3_BUCKET_UPLOADS=fluxer-uploads
+#FLUXER_S3_BUCKET_REPORTS=fluxer-reports
+#FLUXER_S3_BUCKET_HARVESTS=fluxer-harvests
+
+# The other bundled services, pointed elsewhere. Removing a service from the
+# stack belongs in an override file, since an upgrade replaces docker-compose.yml.
+#FLUXER_KV_URL=redis://cache.example.com:6379/0
+#FLUXER_NATS_URL=nats://mq.example.com:4222
+#FLUXER_NATS_JETSTREAM_URL=nats://mq.example.com:4222
+#FLUXER_SVC_NATS_URL=nats://mq.example.com:4222
+#FLUXER_SEARCH_URL=https://search.example.com
+#FLUXER_LIVEKIT_INTERNAL_URL=http://livekit.example.com:7880
+
+# Voice off. The livekit service still runs until an override removes it.
+#FLUXER_LIVEKIT_ENABLED=false
+
+# Optional systems, each off unless configured.
+#FLUXER_SMS_ENABLED=false
+#FLUXER_STRIPE_ENABLED=false
+#FLUXER_NCMEC_ENABLED=false
+#FLUXER_CLAMAV_ENABLED=false
+
+# Outside lookups, off unless turned on. The Tor exit list comes from
+# onionoo.torproject.org and the breached password check asks
+# api.pwnedpasswords.com.
+#FLUXER_TOR_EXIT_LIST_ENABLED=true
+#FLUXER_BREACHED_PASSWORD_CHECK_ENABLED=true
+
+# The client address. Name the header your proxy actually writes, and turn the
+# trust off when nothing sits in front.
+#FLUXER_CLIENT_IP_HEADER_NAME=cf-connecting-ip
+#FLUXER_TRUST_CLIENT_IP_HEADER=true
+
+# How much the services write. trace, debug, info, warn, error or fatal.
+#LOG_LEVEL=debug
+
 FLUXER_S3_ACCESS_KEY=fluxer
 FLUXER_S3_SECRET_KEY=CHANGE_ME

 FLUXER_SUDO_MODE_SECRET=CHANGE_ME
 FLUXER_CONNECTION_INITIATION_SECRET=CHANGE_ME
 FLUXER_GATEWAY_RPC_AUTH_TOKEN=CHANGE_ME
+FLUXER_ERLANG_COOKIE=CHANGE_ME
 FLUXER_MEDIA_PROXY_SECRET_KEY=CHANGE_ME
 FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64=CHANGE_ME
 FLUXER_ADMIN_SECRET_KEY_BASE=CHANGE_ME
 FLUXER_ADMIN_OAUTH_CLIENT_SECRET=CHANGE_ME

+# The token every service sends to NATS. The bundled NATS needs none, so this
+# stays empty unless an override points at an external one.
+#FLUXER_NATS_AUTH_TOKEN=
+
 FLUXER_VAPID_PUBLIC_KEY=CHANGE_ME
 FLUXER_VAPID_PRIVATE_KEY=CHANGE_ME
-FLUXER_VAPID_EMAIL=[email protected]

-# Passkeys follow FLUXER_DOMAIN by default. Set these only if browsers reach the
-# instance on a different host, and note that changing FLUXER_PASSKEY_RP_ID
-# invalidates every passkey already registered against the old value.
+# Defaults to admin@ followed by FLUXER_DOMAIN. Set it if that mailbox does not
+# exist.
+#[email protected]
+
+# Passkeys follow FLUXER_DOMAIN. Set these only if browsers use another host.
+# Changing the RP ID invalidates every passkey registered against the old value.
 #FLUXER_PASSKEY_RP_ID=chat.example.com
 #FLUXER_PASSKEY_RP_NAME=Fluxer
 #FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS=https://chat.example.com
+#FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS=http://chat.example.com:19080

-# Extra Content-Security-Policy sources, appended to the built-in ones. Set these
-# only when a browser must reach an origin the defaults do not cover, such as a
-# voice server hosted on a domain other than FLUXER_DOMAIN. Separate several
-# sources with spaces or commas.
+# Notification jobs the push container holds at once, 1 to 1000000.
+#FLUXER_PUSH_SERVICE_QUEUE_CAPACITY=10000
+# Provider requests the push container sends at once, 1 to 65536.
+#FLUXER_PUSH_SERVICE_SEND_CONCURRENCY=256
+
+
+# Optional media policies, both off by default. See the operator docs.
+#
+# CORS limits which web origins may read media. A request with no Origin is
+# always served. Add https://web.fluxer.app if people use the hosted client.
+#
+# Signatures make an attachment read need a signed URL, so a copied link stops
+# working. Needs a secret from openssl rand -base64 32, first entry signs and
+# every entry verifies.
+#
+# Each mode is off, report or enforce. Start at report. media-proxy reads these
+# at start, so apply with docker compose up -d media-proxy.
+#FLUXER_MEDIA_PROXY_CORS_MODE=enforce
+#FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS=https://chat.example.com,https://web.fluxer.app
+#FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64=
+#FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE=enforce
+
+# Extra Content-Security-Policy sources, appended to the built-in ones. Set one
+# only when a browser must reach an origin the defaults do not cover. Separate
+# several with spaces or commas. The three values below are illustrations.
+#FLUXER_CSP_EXTRA_DEFAULT_SRC=
 #FLUXER_CSP_EXTRA_CONNECT_SRC=wss://livekit.example.com:7881
 #FLUXER_CSP_EXTRA_IMG_SRC=https://cdn.example.com
+#FLUXER_CSP_EXTRA_MEDIA_SRC=
+#FLUXER_CSP_EXTRA_FONT_SRC=
 #FLUXER_CSP_EXTRA_SCRIPT_SRC=https://analytics.example.com
+#FLUXER_CSP_EXTRA_STYLE_SRC=
+#FLUXER_CSP_EXTRA_FRAME_SRC=
+#FLUXER_CSP_EXTRA_WORKER_SRC=
+#FLUXER_CSP_EXTRA_MANIFEST_SRC=

-# Allow the SSO identity provider to resolve to a private or internal address.
-# Off by default: the API refuses to call non-public addresses so a misconfigured
-# provider URL cannot be used to reach internal services. Turn it on only when the
-# provider genuinely lives on your own network, such as split-horizon DNS or a LAN
-# identity provider, and only when you trust everyone who can configure SSO.
+# One report-uri for CSP violation reports. Empty leaves the directive off.
+#FLUXER_CSP_REPORT_URI=
+
+# Let the SSO provider resolve to a private address. Off by default, so a
+# misconfigured provider URL cannot reach internal services. Turn it on only for
+# a provider on your own network.
 #FLUXER_SSO_ALLOW_PRIVATE_ADDRESSES=true

+# These reach both LiveKit and the api. Change them together.
 LIVEKIT_API_KEY=fluxer
 LIVEKIT_API_SECRET=CHANGE_ME

+# The URL browsers use for voice signalling. Built from the public origin plus
+# /livekit. Set it only when LiveKit is served from another host.
+#FLUXER_LIVEKIT_URL=
+
+# Media ports. LiveKit advertises these, so forward the same numbers.
+#FLUXER_LIVEKIT_TCP_PORT=7881
+#FLUXER_LIVEKIT_UDP_PORT=7882
+
+# LiveKit finds its public address over STUN. A host that cannot reach one stops
+# with "could not resolve external IP", so set the address by hand instead, or
+# point STUN elsewhere.
+#FLUXER_LIVEKIT_USE_EXTERNAL_IP=false
+#FLUXER_LIVEKIT_NODE_IP=203.0.113.10
+#FLUXER_LIVEKIT_STUN_PRIMARY=stun.l.google.com:19302
+#FLUXER_LIVEKIT_STUN_SECONDARY=stun1.l.google.com:19302
+
 FLUXER_KLIPY_API_KEY=

 FLUXER_EMAIL_ENABLED=false
 FLUXER_EMAIL_PROVIDER=none
 FLUXER_EMAIL_FROM_EMAIL=[email protected]
 FLUXER_EMAIL_FROM_NAME=Fluxer
+FLUXER_EMAIL_APP_BASE_URL=
 FLUXER_EMAIL_SMTP_HOST=
 FLUXER_EMAIL_SMTP_PORT=587
 FLUXER_EMAIL_SMTP_USERNAME=
@@ -63,4 +226,94 @@ FLUXER_EMAIL_SMTP_SECURE=true

 FLUXER_CAPTCHA_ENABLED=false
 FLUXER_CAPTCHA_PROVIDER=none
+FLUXER_CAPTCHA_HCAPTCHA_SITE_KEY=
+FLUXER_CAPTCHA_HCAPTCHA_SECRET_KEY=
+FLUXER_CAPTCHA_TURNSTILE_SITE_KEY=
+FLUXER_CAPTCHA_TURNSTILE_SECRET_KEY=
 FLUXER_DISCOVERY_ENABLED=true
+
+# Container memory. These are ceilings, not allocations, and the defaults suit a
+# 16 GB host. The reservations bias the kernel away from reclaiming from services
+# whose death takes the instance down. Lower the limits on a smaller host.
+#FLUXER_CADDY_MEMORY_LIMIT=256mb
+#FLUXER_POSTGRES_MEMORY_LIMIT=5gb
+#FLUXER_POSTGRES_MEMORY_RESERVATION=3gb
+#FLUXER_VALKEY_MEMORY_LIMIT=256mb
+#FLUXER_NATS_MEMORY_LIMIT=256mb
+#FLUXER_MEILISEARCH_MEMORY_LIMIT=768mb
+#FLUXER_SEAWEEDFS_MEMORY_LIMIT=2gb
+#FLUXER_SEAWEEDFS_INIT_MEMORY_LIMIT=128mb
+#FLUXER_LIVEKIT_MEMORY_LIMIT=512mb
+#FLUXER_API_MEMORY_LIMIT=2560mb
+#FLUXER_API_MEMORY_RESERVATION=1gb
+#FLUXER_WORKER_MEMORY_LIMIT=2560mb
+#FLUXER_WORKER_MEMORY_RESERVATION=1gb
+#FLUXER_GATEWAY_MEMORY_LIMIT=1gb
+#FLUXER_GATEWAY_MEMORY_RESERVATION=384mb
+#FLUXER_MEDIA_PROXY_MEMORY_LIMIT=512mb
+#FLUXER_PUSH_MEMORY_LIMIT=256mb
+#FLUXER_STATIC_PROXY_MEMORY_LIMIT=256mb
+#FLUXER_APP_PROXY_MEMORY_LIMIT=256mb
+#FLUXER_SNOWFLAKES_MEMORY_LIMIT=128mb
+#FLUXER_SNOWFLAKES_SHARD_MEMORY_LIMIT=256mb
+#FLUXER_USERS_MEMORY_LIMIT=128mb
+#FLUXER_USERS_SHARD_MEMORY_LIMIT=256mb
+#FLUXER_GIFS_MEMORY_LIMIT=128mb
+#FLUXER_GIFS_SHARD_MEMORY_LIMIT=256mb
+#FLUXER_MESSAGES_MEMORY_LIMIT=128mb
+#FLUXER_MESSAGES_SHARD_MEMORY_LIMIT=256mb
+#FLUXER_UNFURL_MEMORY_LIMIT=128mb
+#FLUXER_UNFURL_SHARD_MEMORY_LIMIT=256mb
+#FLUXER_ADMIN_MEMORY_LIMIT=256mb
+
+# Meilisearch indexing memory. Keep it well under the container limit above.
+#FLUXER_MEILISEARCH_MAX_INDEXING_MEMORY=384mb
+
+# SeaweedFS heap ceiling. Go cannot see the container limit, so without this an
+# upload burst gets the container OOM-killed. Keep it near three quarters of
+# FLUXER_SEAWEEDFS_MEMORY_LIMIT and raise both together.
+#FLUXER_SEAWEEDFS_GOMEMLIMIT=1536MiB
+
+# Node sizes its heap from the container limit by default. Leave these unset
+# unless you need to pin it. A heap ceiling above the container limit gets the
+# container OOM-killed instead of reporting a heap error.
+#FLUXER_API_NODE_HEAP_MB=1792
+#FLUXER_WORKER_NODE_HEAP_MB=1792
+
+# Bundled Postgres tuning. Keep it consistent with the memory limit above. This
+# is the server setting, not the per-service pool sizes.
+#FLUXER_POSTGRES_SERVER_MAX_CONNECTIONS=150
+#FLUXER_POSTGRES_SHARED_BUFFERS=512MB
+#FLUXER_POSTGRES_EFFECTIVE_CACHE_SIZE=2GB
+#FLUXER_POSTGRES_WORK_MEM=8MB
+#FLUXER_POSTGRES_MAINTENANCE_WORK_MEM=256MB
+#FLUXER_POSTGRES_AUTOVACUUM_WORK_MEM=128MB
+#FLUXER_POSTGRES_SHM_SIZE=1gb
+
+# The bundled Valkey holds durable state as well as cache, so it runs with an
+# append-only file and with noeviction, which fails an over-limit write instead
+# of dropping queued work. Change the policy only if that state lives elsewhere.
+#FLUXER_VALKEY_MAXMEMORY=192mb
+#FLUXER_VALKEY_MAXMEMORY_POLICY=noeviction
+
+# The gateway derives its scheduler count from the CPU quota, clamped here. One
+# scheduler lets a single blocking operation stall every websocket on the node.
+#FLUXER_ERLANG_SCHEDULERS_MIN=2
+#FLUXER_ERLANG_SCHEDULERS_MAX=16
+
+# In-flight request ceiling for the users and messages routers and their shards.
+# One value replaces the built-in default on all of them, so size it for the
+# busiest. Too low a value rejects requests rather than slowing them, and the api
+# turns that into a 503.
+#FLUXER_SVC_MAX_CONCURRENT_REQUESTS=192
+
+# Named prepared statements need a session that outlives the transaction, so set
+# this to false behind a transaction-pooling connection pooler. The bundled
+# compose talks to Postgres directly, where the default is correct.
+#FLUXER_POSTGRES_PREPARED_STATEMENTS=true
+
+# How long a client may take to send a request. The header timeout covers the
+# request line and headers, the request timeout the whole exchange, and the first
+# is clamped down to the second. Milliseconds, 1000 to 3600000.
+#FLUXER_API_HEADERS_TIMEOUT_MS=30000
+#FLUXER_API_REQUEST_TIMEOUT_MS=120000
@@ -1,12 +1,17 @@
 {
 	servers {
-		trusted_proxies static private_ranges
+		trusted_proxies static {$FLUXER_EDGE_TRUSTED_PROXIES:private_ranges}
+		trusted_proxies_strict
 	}
 }

-{$FLUXER_CADDY_SITE_ADDRESS} {
+{$FLUXER_EDGE_SITE_ADDRESS} {
 	encode zstd gzip

+	handle /_health {
+		respond "OK" 200
+	}
+
 	handle_path /api/* {
 		reverse_proxy api:8080
 	}
@@ -52,7 +57,7 @@
 }

 :8088 {
-	handle_path /api/* {
+	handle /.well-known/fluxer {
 		reverse_proxy api:8080
 	}
 }
@@ -0,0 +1,17 @@
+# Overlay for running Fluxer behind your own reverse proxy.
+#
+#   docker compose -f docker-compose.yml -f docker-compose.proxy.yml up -d
+#
+# Or set this once in .env and keep using plain `docker compose up -d`:
+#
+#   COMPOSE_FILE=docker-compose.yml:docker-compose.proxy.yml
+#
+# Fluxer stops binding 80 and 443 and serves plain HTTP on one port instead.
+# That port already does all internal routing, so the proxy in front needs a
+# single rule: send everything to it. Terminate TLS there.
+services:
+  edge:
+    ports: !override
+      - "${FLUXER_EDGE_BIND:-127.0.0.1:8080}:8080"
+    environment:
+      FLUXER_EDGE_SITE_ADDRESS: ":8080"
@@ -1,54 +1,65 @@
 name: fluxer

+x-fluxer-postgres-env: &fluxer-postgres-env
+  FLUXER_DATABASE_BACKEND: postgres
+  FLUXER_POSTGRES_HOST: ${FLUXER_POSTGRES_HOST:-postgres}
+  FLUXER_POSTGRES_PORT: "${FLUXER_POSTGRES_PORT:-5432}"
+  FLUXER_POSTGRES_DATABASE: ${FLUXER_POSTGRES_DATABASE:-fluxer}
+  FLUXER_POSTGRES_USERNAME: ${FLUXER_POSTGRES_USERNAME:-fluxer}
+  FLUXER_POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+  FLUXER_POSTGRES_SSL: "${FLUXER_POSTGRES_SSL:-false}"
+  FLUXER_POSTGRES_PREPARED_STATEMENTS: ${FLUXER_POSTGRES_PREPARED_STATEMENTS:-true}
+
 x-fluxer-env: &fluxer-env
+  <<: *fluxer-postgres-env
  FLUXER_ENV: production
  NODE_ENV: production
+  LOG_LEVEL: ${LOG_LEVEL:-info}
  FLUXER_SELF_HOSTED: "true"
  FLUXER_BASE_DOMAIN: ${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}
  FLUXER_PUBLIC_SCHEME: ${FLUXER_PUBLIC_SCHEME:-https}
  FLUXER_PUBLIC_PORT: ${FLUXER_PUBLIC_PORT:-443}
-  FLUXER_TRUST_CLIENT_IP_HEADER: "true"
-  FLUXER_CLIENT_IP_HEADER_NAME: x-forwarded-for
+  FLUXER_PUBLIC_ORIGIN: ${FLUXER_PUBLIC_ORIGIN:-}
+  FLUXER_TRUST_CLIENT_IP_HEADER: "${FLUXER_TRUST_CLIENT_IP_HEADER:-true}"
+  FLUXER_CLIENT_IP_HEADER_NAME: ${FLUXER_CLIENT_IP_HEADER_NAME:-x-forwarded-for}
+  FLUXER_API_HEADERS_TIMEOUT_MS: ${FLUXER_API_HEADERS_TIMEOUT_MS:-30000}
+  FLUXER_API_REQUEST_TIMEOUT_MS: ${FLUXER_API_REQUEST_TIMEOUT_MS:-120000}
+  FLUXER_TOR_EXIT_LIST_ENABLED: "${FLUXER_TOR_EXIT_LIST_ENABLED:-false}"
+  FLUXER_BREACHED_PASSWORD_CHECK_ENABLED: "${FLUXER_BREACHED_PASSWORD_CHECK_ENABLED:-false}"

-  FLUXER_DATABASE_BACKEND: postgres
-  FLUXER_POSTGRES_HOST: postgres
-  FLUXER_POSTGRES_PORT: "5432"
-  FLUXER_POSTGRES_DATABASE: fluxer
-  FLUXER_POSTGRES_USERNAME: fluxer
-  FLUXER_POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
-  FLUXER_POSTGRES_SSL: "false"
-
-  FLUXER_KV_URL: redis://valkey:6379/0
-  FLUXER_NATS_URL: nats://nats:4222
-  FLUXER_NATS_JETSTREAM_URL: nats://nats:4222
-  FLUXER_SVC_NATS_URL: nats://nats:4222
+  FLUXER_KV_URL: ${FLUXER_KV_URL:-redis://valkey:6379/0}
+  FLUXER_NATS_URL: ${FLUXER_NATS_URL:-nats://nats:4222}
+  FLUXER_NATS_JETSTREAM_URL: ${FLUXER_NATS_JETSTREAM_URL:-${FLUXER_NATS_URL:-nats://nats:4222}}
+  FLUXER_NATS_AUTH_TOKEN: ${FLUXER_NATS_AUTH_TOKEN:-}
+  FLUXER_SVC_NATS_URL: ${FLUXER_SVC_NATS_URL:-${FLUXER_NATS_URL:-nats://nats:4222}}
  FLUXER_SVC_SHARD_COUNT: "1"

  FLUXER_SEARCH_ENGINE: meilisearch
-  FLUXER_SEARCH_URL: http://meilisearch:7700
+  FLUXER_SEARCH_URL: ${FLUXER_SEARCH_URL:-http://meilisearch:7700}
  FLUXER_SEARCH_API_KEY: ${MEILI_MASTER_KEY:?set MEILI_MASTER_KEY in .env}

-  FLUXER_S3_ENDPOINT: http://seaweedfs:8333
-  FLUXER_S3_PUBLIC_ENDPOINT: http://seaweedfs:8333
-  FLUXER_S3_REGION: us-east-1
+  FLUXER_S3_ENDPOINT: ${FLUXER_S3_ENDPOINT:-http://seaweedfs:8333}
+  FLUXER_S3_PUBLIC_ENDPOINT: ${FLUXER_S3_PUBLIC_ENDPOINT:-${FLUXER_S3_ENDPOINT:-http://seaweedfs:8333}}
+  FLUXER_S3_REGION: ${FLUXER_S3_REGION:-us-east-1}
  FLUXER_S3_ACCESS_KEY_ID: ${FLUXER_S3_ACCESS_KEY:?set FLUXER_S3_ACCESS_KEY in .env}
  FLUXER_S3_SECRET_ACCESS_KEY: ${FLUXER_S3_SECRET_KEY:?set FLUXER_S3_SECRET_KEY in .env}
-  FLUXER_S3_FORCE_PATH_STYLE: "true"
-  FLUXER_S3_BUCKET_CDN: fluxer
-  FLUXER_S3_BUCKET_UPLOADS: fluxer-uploads
-  FLUXER_S3_BUCKET_DOWNLOADS: fluxer-downloads
-  FLUXER_S3_BUCKET_REPORTS: fluxer-reports
-  FLUXER_S3_BUCKET_HARVESTS: fluxer-harvests
-  AWS_ACCESS_KEY_ID: ${FLUXER_S3_ACCESS_KEY:?}
-  AWS_SECRET_ACCESS_KEY: ${FLUXER_S3_SECRET_KEY:?}
-  AWS_DEFAULT_REGION: us-east-1
+  FLUXER_S3_FORCE_PATH_STYLE: "${FLUXER_S3_FORCE_PATH_STYLE:-true}"
+  FLUXER_S3_BUCKET_CDN: ${FLUXER_S3_BUCKET_CDN:-fluxer}
+  FLUXER_S3_BUCKET_UPLOADS: ${FLUXER_S3_BUCKET_UPLOADS:-fluxer-uploads}
+  FLUXER_S3_BUCKET_REPORTS: ${FLUXER_S3_BUCKET_REPORTS:-fluxer-reports}
+  FLUXER_S3_BUCKET_HARVESTS: ${FLUXER_S3_BUCKET_HARVESTS:-fluxer-harvests}
+  AWS_ACCESS_KEY_ID: ${FLUXER_S3_ACCESS_KEY:?set FLUXER_S3_ACCESS_KEY in .env}
+  AWS_SECRET_ACCESS_KEY: ${FLUXER_S3_SECRET_KEY:?set FLUXER_S3_SECRET_KEY in .env}
+  AWS_DEFAULT_REGION: ${FLUXER_S3_REGION:-us-east-1}
  AWS_EC2_METADATA_DISABLED: "true"

-  FLUXER_LIVEKIT_ENABLED: "true"
+  FLUXER_LIVEKIT_ENABLED: "${FLUXER_LIVEKIT_ENABLED:-true}"
  FLUXER_LIVEKIT_API_KEY: ${LIVEKIT_API_KEY:?set LIVEKIT_API_KEY in .env}
  FLUXER_LIVEKIT_API_SECRET: ${LIVEKIT_API_SECRET:?set LIVEKIT_API_SECRET in .env}
+  FLUXER_LIVEKIT_INTERNAL_URL: ${FLUXER_LIVEKIT_INTERNAL_URL:-http://livekit:7880}
  FLUXER_LIVEKIT_WEBHOOK_URL: http://api:8080/webhooks/livekit
  FLUXER_LIVEKIT_DEFAULT_REGION: '{"id":"default","name":"Default","emoji":"🌍","latitude":0,"longitude":0}'
+  FLUXER_LIVEKIT_URL: ${FLUXER_LIVEKIT_URL:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}:${FLUXER_PUBLIC_PORT:-443}}/livekit}

  FLUXER_KLIPY_API_KEY: ${FLUXER_KLIPY_API_KEY:-}

@@ -56,18 +67,23 @@ x-fluxer-env: &fluxer-env
  FLUXER_EMAIL_PROVIDER: ${FLUXER_EMAIL_PROVIDER:-none}
  FLUXER_EMAIL_FROM_EMAIL: ${FLUXER_EMAIL_FROM_EMAIL:-noreply@localhost}
  FLUXER_EMAIL_FROM_NAME: ${FLUXER_EMAIL_FROM_NAME:-Fluxer}
+  FLUXER_EMAIL_APP_BASE_URL: ${FLUXER_EMAIL_APP_BASE_URL:-}
  FLUXER_EMAIL_SMTP_HOST: ${FLUXER_EMAIL_SMTP_HOST:-}
  FLUXER_EMAIL_SMTP_PORT: ${FLUXER_EMAIL_SMTP_PORT:-587}
  FLUXER_EMAIL_SMTP_USERNAME: ${FLUXER_EMAIL_SMTP_USERNAME:-}
  FLUXER_EMAIL_SMTP_PASSWORD: ${FLUXER_EMAIL_SMTP_PASSWORD:-}
  FLUXER_EMAIL_SMTP_SECURE: ${FLUXER_EMAIL_SMTP_SECURE:-true}

-  FLUXER_SMS_ENABLED: "false"
+  FLUXER_SMS_ENABLED: "${FLUXER_SMS_ENABLED:-false}"
  FLUXER_CAPTCHA_ENABLED: ${FLUXER_CAPTCHA_ENABLED:-false}
  FLUXER_CAPTCHA_PROVIDER: ${FLUXER_CAPTCHA_PROVIDER:-none}
-  FLUXER_STRIPE_ENABLED: "false"
-  FLUXER_NCMEC_ENABLED: "false"
-  FLUXER_CLAMAV_ENABLED: "false"
+  FLUXER_CAPTCHA_HCAPTCHA_SITE_KEY: ${FLUXER_CAPTCHA_HCAPTCHA_SITE_KEY:-}
+  FLUXER_CAPTCHA_HCAPTCHA_SECRET_KEY: ${FLUXER_CAPTCHA_HCAPTCHA_SECRET_KEY:-}
+  FLUXER_CAPTCHA_TURNSTILE_SITE_KEY: ${FLUXER_CAPTCHA_TURNSTILE_SITE_KEY:-}
+  FLUXER_CAPTCHA_TURNSTILE_SECRET_KEY: ${FLUXER_CAPTCHA_TURNSTILE_SECRET_KEY:-}
+  FLUXER_STRIPE_ENABLED: "${FLUXER_STRIPE_ENABLED:-false}"
+  FLUXER_NCMEC_ENABLED: "${FLUXER_NCMEC_ENABLED:-false}"
+  FLUXER_CLAMAV_ENABLED: "${FLUXER_CLAMAV_ENABLED:-false}"
  FLUXER_DISCOVERY_ENABLED: ${FLUXER_DISCOVERY_ENABLED:-true}

  FLUXER_SUDO_MODE_SECRET: ${FLUXER_SUDO_MODE_SECRET:?set FLUXER_SUDO_MODE_SECRET in .env}
@@ -78,46 +94,101 @@ x-fluxer-env: &fluxer-env
  FLUXER_VAPID_EMAIL: ${FLUXER_VAPID_EMAIL:-admin@${FLUXER_DOMAIN}}
  FLUXER_PASSKEY_RP_ID: ${FLUXER_PASSKEY_RP_ID:-${FLUXER_DOMAIN}}
  FLUXER_PASSKEY_RP_NAME: ${FLUXER_PASSKEY_RP_NAME:-Fluxer}
-  FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS: ${FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
+  FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS: ${FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}}
  FLUXER_GATEWAY_RPC_AUTH_TOKEN: ${FLUXER_GATEWAY_RPC_AUTH_TOKEN:?set FLUXER_GATEWAY_RPC_AUTH_TOKEN in .env}
  FLUXER_MEDIA_PROXY_SECRET_KEY: ${FLUXER_MEDIA_PROXY_SECRET_KEY:?set FLUXER_MEDIA_PROXY_SECRET_KEY in .env}
  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64:?set FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64 in .env}
+  FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64: ${FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64:-}
  FLUXER_ADMIN_SECRET_KEY_BASE: ${FLUXER_ADMIN_SECRET_KEY_BASE:?set FLUXER_ADMIN_SECRET_KEY_BASE in .env}
  FLUXER_ADMIN_OAUTH_CLIENT_SECRET: ${FLUXER_ADMIN_OAUTH_CLIENT_SECRET:?set FLUXER_ADMIN_OAUTH_CLIENT_SECRET in .env}

  FLUXER_INTERNAL_API_ENDPOINT: http://api:8080
  FLUXER_INTERNAL_GATEWAY_ENDPOINT: http://gateway:8080
  FLUXER_INTERNAL_MEDIA_PROXY_ENDPOINT: http://media-proxy:8080
-  FLUXER_MARKETING_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}
+  FLUXER_MARKETING_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
  FLUXER_MEDIA_PROXY_ENDPOINT: http://media-proxy:8080
-  FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media
-  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media
+  FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media

 x-fluxer-service: &fluxer-service
  restart: unless-stopped
  networks: [fluxer]

+x-fluxer-svc-healthcheck: &fluxer-svc-healthcheck
+  test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/8090 && printf 'GET /_health HTTP/1.0\\r\\n\\r\\n' >&3 && head -n 1 <&3 | grep -q ' 200 '"]
+  interval: 10s
+  timeout: 5s
+  retries: 30
+  start_period: 60s
+  start_interval: 1s
+
 services:
-  caddy:
-    image: caddy:2.10-alpine
+  edge:
+    image: caddy:2.11-alpine
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_CADDY_MEMORY_LIMIT:-256mb}
    restart: unless-stopped
    networks: [fluxer]
    ports:
-      - "80:80"
-      - "443:443"
-      - "443:443/udp"
+      - "${FLUXER_HTTP_PORT:-80}:80"
+      - "${FLUXER_HTTPS_PORT:-443}:443"
+      - "${FLUXER_HTTPS_PORT:-443}:443/udp"
    environment:
-      FLUXER_CADDY_SITE_ADDRESS: ${FLUXER_CADDY_SITE_ADDRESS:?set FLUXER_CADDY_SITE_ADDRESS in .env}
+      FLUXER_EDGE_SITE_ADDRESS: ${FLUXER_EDGE_SITE_ADDRESS:-${FLUXER_CADDY_SITE_ADDRESS:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}}}
+      FLUXER_EDGE_TRUSTED_PROXIES: ${FLUXER_EDGE_TRUSTED_PROXIES:-private_ranges}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
-      - caddy-data:/data
-      - caddy-config:/config
-    depends_on: [api, gateway, media-proxy, static-proxy, admin]
+      - edge-data:/data
+      - edge-config:/config
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:2019/config/"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+    depends_on:
+      api: {condition: service_started}
+      gateway: {condition: service_healthy}
+      media-proxy: {condition: service_started}
+      static-proxy: {condition: service_started}
+      admin: {condition: service_started}

  postgres:
    image: postgres:16-alpine
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_POSTGRES_MEMORY_LIMIT:-5gb}
+        reservations:
+          memory: ${FLUXER_POSTGRES_MEMORY_RESERVATION:-3gb}
    restart: unless-stopped
    networks: [fluxer]
+    command: >
+      postgres
+      -c max_connections=${FLUXER_POSTGRES_SERVER_MAX_CONNECTIONS:-150}
+      -c shared_buffers=${FLUXER_POSTGRES_SHARED_BUFFERS:-512MB}
+      -c effective_cache_size=${FLUXER_POSTGRES_EFFECTIVE_CACHE_SIZE:-2GB}
+      -c work_mem=${FLUXER_POSTGRES_WORK_MEM:-8MB}
+      -c maintenance_work_mem=${FLUXER_POSTGRES_MAINTENANCE_WORK_MEM:-256MB}
+      -c autovacuum_work_mem=${FLUXER_POSTGRES_AUTOVACUUM_WORK_MEM:-128MB}
+      -c random_page_cost=1.1
+      -c effective_io_concurrency=200
+      -c default_statistics_target=200
+      -c jit=off
+      -c min_wal_size=512MB
+      -c max_wal_size=2GB
+      -c checkpoint_completion_target=0.9
+      -c wal_buffers=16MB
+      -c wal_compression=zstd
+      -c bgwriter_delay=50ms
+      -c bgwriter_lru_maxpages=1000
+      -c autovacuum_vacuum_scale_factor=0.05
+      -c autovacuum_analyze_scale_factor=0.02
+      -c autovacuum_vacuum_cost_limit=2000
+      -c track_io_timing=on
+      -c shared_preload_libraries=pg_stat_statements
+    shm_size: ${FLUXER_POSTGRES_SHM_SIZE:-1gb}
    environment:
      POSTGRES_DB: fluxer
      POSTGRES_USER: fluxer
@@ -131,10 +202,18 @@ services:
      retries: 10

  valkey:
-    image: valkey/valkey:8.1-alpine
+    image: valkey/valkey:9.1-alpine
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_VALKEY_MEMORY_LIMIT:-256mb}
    restart: unless-stopped
    networks: [fluxer]
-    command: ["valkey-server", "--save", "", "--appendonly", "no"]
+    command: ["valkey-server", "--appendonly", "yes", "--appendfsync", "everysec", "--dir", "/data",
+              "--maxmemory", "${FLUXER_VALKEY_MAXMEMORY:-192mb}",
+              "--maxmemory-policy", "${FLUXER_VALKEY_MAXMEMORY_POLICY:-noeviction}"]
+    volumes:
+      - valkey-data:/data
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      interval: 10s
@@ -143,41 +222,85 @@ services:

  nats:
    image: nats:2.14-alpine
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_NATS_MEMORY_LIMIT:-256mb}
    restart: unless-stopped
    networks: [fluxer]
    command: ["-js", "-sd", "/data", "-m", "8222"]
    volumes:
      - nats-data:/data
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8222/healthz"]
+      interval: 10s
+      timeout: 5s
+      retries: 10

  meilisearch:
-    image: getmeili/meilisearch:v1.12
+    image: getmeili/meilisearch:v1.53
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_MEILISEARCH_MEMORY_LIMIT:-768mb}
    restart: unless-stopped
    networks: [fluxer]
    environment:
      MEILI_ENV: production
      MEILI_NO_ANALYTICS: "true"
+      MEILI_UPGRADE_DB: "true"
+      MEILI_MAX_INDEXING_MEMORY: ${FLUXER_MEILISEARCH_MAX_INDEXING_MEMORY:-384mb}
      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY:?set MEILI_MASTER_KEY in .env}
    volumes:
      - meilisearch-data:/meili_data
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:7700/health"]
+      interval: 10s
+      timeout: 5s
+      retries: 10

  seaweedfs:
-    image: chrislusf/seaweedfs:4.34
+    image: chrislusf/seaweedfs:4.47
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_SEAWEEDFS_MEMORY_LIMIT:-2gb}
    restart: unless-stopped
    networks: [fluxer]
-    command: ["server", "-s3", "-dir=/data"]
+    environment:
+      GOMEMLIMIT: ${FLUXER_SEAWEEDFS_GOMEMLIMIT:-1536MiB}
+    command: ["server", "-s3", "-dir=/data", "-master.telemetry=false"]
    volumes:
      - seaweedfs-data:/data
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8333/healthz"]
+      interval: 10s
+      timeout: 5s
+      retries: 20
+      start_period: 60s

  seaweedfs-init:
-    image: chrislusf/seaweedfs:4.34
+    image: chrislusf/seaweedfs:4.47
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_SEAWEEDFS_INIT_MEMORY_LIMIT:-128mb}
    networks: [fluxer]
-    depends_on: [seaweedfs]
+    depends_on:
+      seaweedfs: {condition: service_healthy}
    restart: "no"
+    environment:
+      FLUXER_S3_ACCESS_KEY: ${FLUXER_S3_ACCESS_KEY:?set FLUXER_S3_ACCESS_KEY in .env}
+      FLUXER_S3_SECRET_KEY: ${FLUXER_S3_SECRET_KEY:?set FLUXER_S3_SECRET_KEY in .env}
+      FLUXER_S3_BUCKET_CDN: ${FLUXER_S3_BUCKET_CDN:-fluxer}
+      FLUXER_S3_BUCKET_UPLOADS: ${FLUXER_S3_BUCKET_UPLOADS:-fluxer-uploads}
+      FLUXER_S3_BUCKET_REPORTS: ${FLUXER_S3_BUCKET_REPORTS:-fluxer-reports}
+      FLUXER_S3_BUCKET_HARVESTS: ${FLUXER_S3_BUCKET_HARVESTS:-fluxer-harvests}
    entrypoint:
      - /bin/sh
      - -c
      - >
-        buckets="fluxer fluxer-uploads fluxer-downloads fluxer-reports fluxer-harvests";
+        buckets="$$FLUXER_S3_BUCKET_CDN $$FLUXER_S3_BUCKET_UPLOADS $$FLUXER_S3_BUCKET_REPORTS $$FLUXER_S3_BUCKET_HARVESTS";
        missing="$$buckets";
        for attempt in $$(seq 1 60); do
          if ! nc -z seaweedfs 9333 2>/dev/null; then
@@ -190,6 +313,10 @@ services:
            echo "$$listed" | grep -q "^[[:space:]]*$$b[[:space:]]" || missing="$${missing:+$$missing }$$b";
          done;
          if [ -z "$$missing" ]; then
+            if ! echo "s3.configure -user=fluxer -access_key=$$FLUXER_S3_ACCESS_KEY -secret_key=$$FLUXER_S3_SECRET_KEY -actions=Admin,Read,Write,List,Tagging -apply" | timeout 10 weed shell -master=seaweedfs:9333 >/dev/null 2>&1; then
+              echo "seaweedfs-init could not configure the S3 identity" >&2;
+              exit 1;
+            fi;
            echo "buckets ready";
            exit 0;
          fi;
@@ -203,105 +330,212 @@ services:

  livekit:
    image: livekit/livekit-server:v1.12.0
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_LIVEKIT_MEMORY_LIMIT:-512mb}
    restart: unless-stopped
    networks: [fluxer]
-    command: ["--config", "/etc/livekit.yaml"]
    environment:
      LIVEKIT_KEYS: "${LIVEKIT_API_KEY:?set LIVEKIT_API_KEY in .env}: ${LIVEKIT_API_SECRET:?set LIVEKIT_API_SECRET in .env}"
-    volumes:
-      - ./livekit.yaml:/etc/livekit.yaml:ro
+      LIVEKIT_CONFIG: |
+        port: 7880
+        log_level: info
+        rtc:
+          tcp_port: ${FLUXER_LIVEKIT_TCP_PORT:-7881}
+          udp_port: ${FLUXER_LIVEKIT_UDP_PORT:-7882}
+          use_external_ip: ${FLUXER_LIVEKIT_USE_EXTERNAL_IP:-true}
+          node_ip: "${FLUXER_LIVEKIT_NODE_IP:-}"
+          stun_servers:
+            - ${FLUXER_LIVEKIT_STUN_PRIMARY:-stun.l.google.com:19302}
+            - ${FLUXER_LIVEKIT_STUN_SECONDARY:-stun1.l.google.com:19302}
+        webhook:
+          api_key: ${LIVEKIT_API_KEY:?set LIVEKIT_API_KEY in .env}
+          urls:
+            - http://api:8080/webhooks/livekit
    ports:
-      - "${FLUXER_LIVEKIT_TCP_PORT:-7881}:7881"
-      - "${FLUXER_LIVEKIT_UDP_PORT:-7882}:7882/udp"
+      - "${FLUXER_LIVEKIT_TCP_PORT:-7881}:${FLUXER_LIVEKIT_TCP_PORT:-7881}"
+      - "${FLUXER_LIVEKIT_UDP_PORT:-7882}:${FLUXER_LIVEKIT_UDP_PORT:-7882}/udp"
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:7880/"]
+      interval: 10s
+      timeout: 5s
+      retries: 10

  api:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-api:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_API_MEMORY_LIMIT:-2560mb}
+        reservations:
+          memory: ${FLUXER_API_MEMORY_RESERVATION:-1gb}
    environment:
      <<: *fluxer-env
      FLUXER_API_PORT: "8080"
+      NODE_OPTIONS: --enable-source-maps${FLUXER_API_NODE_HEAP_MB:+ --max-old-space-size=$FLUXER_API_NODE_HEAP_MB}
      FLUXER_API_PRESIGNED_ATTACHMENT_UPLOADS_ENABLED: "true"
+      FLUXER_POSTGRES_MAX_CONNECTIONS: "25"
    healthcheck:
      test: ["CMD-SHELL", "node -e \"fetch('http://127.0.0.1:8080/_health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 90s
+      start_interval: 1s
    depends_on:
      postgres: {condition: service_healthy}
      valkey: {condition: service_healthy}
-      nats: {condition: service_started}
-      meilisearch: {condition: service_started}
+      nats: {condition: service_healthy}
+      meilisearch: {condition: service_healthy}
      seaweedfs-init: {condition: service_completed_successfully}
-      gifs: {condition: service_started}
-      gifs-shard: {condition: service_started}
-      snowflakes: {condition: service_started}
-      snowflakes-shard: {condition: service_started}
-      messages: {condition: service_started}
-      messages-shard: {condition: service_started}
-      users: {condition: service_started}
-      users-shard: {condition: service_started}
+      gifs: {condition: service_healthy}
+      gifs-shard: {condition: service_healthy}
+      snowflakes: {condition: service_healthy}
+      snowflakes-shard: {condition: service_healthy}
+      messages: {condition: service_healthy}
+      messages-shard: {condition: service_healthy}
+      users: {condition: service_healthy}
+      users-shard: {condition: service_healthy}

  worker:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-api:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_WORKER_MEMORY_LIMIT:-2560mb}
+        reservations:
+          memory: ${FLUXER_WORKER_MEMORY_RESERVATION:-1gb}
    working_dir: /usr/src/app/fluxer_api
-    command: ["./node_modules/.bin/tsx", "src/WorkerEntrypoint.ts"]
+    command: ["sh", "-c", "if [ -f dist/WorkerEntrypoint.js ]; then exec node dist/WorkerEntrypoint.js; else exec ./node_modules/.bin/tsx src/WorkerEntrypoint.ts; fi"]
    environment:
      <<: *fluxer-env
+      NODE_OPTIONS: --enable-source-maps${FLUXER_WORKER_NODE_HEAP_MB:+ --max-old-space-size=$FLUXER_WORKER_NODE_HEAP_MB}
      FLUXER_API_WORKER_MODE: all_lanes
      FLUXER_API_WORKER_ENABLE_CRON_SCHEDULER: "true"
-      FLUXER_API_WORKER_ENABLE_VOICE_RECONCILIATION: "true"
+      FLUXER_POSTGRES_MAX_CONNECTIONS: "25"
+    healthcheck:
+      test: ["CMD", "node", "-e", "const age=Date.now()-require('node:fs').statSync('/tmp/fluxer-worker-heartbeat').mtimeMs;if(age>30000){console.error('worker heartbeat is '+Math.round(age)+'ms old');process.exit(1)}"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 90s
+      start_interval: 1s
    depends_on:
      postgres: {condition: service_healthy}
      valkey: {condition: service_healthy}
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}
      seaweedfs-init: {condition: service_completed_successfully}
-      snowflakes-shard: {condition: service_started}
-      messages-shard: {condition: service_started}
-      users-shard: {condition: service_started}
+      snowflakes-shard: {condition: service_healthy}
+      messages-shard: {condition: service_healthy}
+      users-shard: {condition: service_healthy}

  gateway:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-gateway:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_GATEWAY_MEMORY_LIMIT:-1gb}
+        reservations:
+          memory: ${FLUXER_GATEWAY_MEMORY_RESERVATION:-384mb}
    environment:
      <<: *fluxer-env
      FLUXER_GATEWAY_PORT: "8080"
-      FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media
-      FLUXER_GATEWAY_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}
+      FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+      FLUXER_GATEWAY_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
      FLUXER_GATEWAY_LOGGER_LEVEL: info
+      FLUXER_ERLANG_COOKIE: ${FLUXER_ERLANG_COOKIE:?set FLUXER_ERLANG_COOKIE in .env}
+      FLUXER_ERLANG_SCHEDULERS_MIN: "${FLUXER_ERLANG_SCHEDULERS_MIN:-2}"
+      FLUXER_ERLANG_SCHEDULERS_MAX: "${FLUXER_ERLANG_SCHEDULERS_MAX:-16}"
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8080/_health/ready"]
+      interval: 10s
+      timeout: 5s
+      retries: 30
+      start_period: 90s
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}
      valkey: {condition: service_healthy}

  media-proxy:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-media-proxy:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_MEDIA_PROXY_MEMORY_LIMIT:-512mb}
    environment:
      <<: *fluxer-env
      FLUXER_MEDIA_PROXY_HOST: 0.0.0.0
      FLUXER_MEDIA_PROXY_PORT: "8080"
      FLUXER_MEDIA_PROXY_MODE: upload
      FLUXER_MEDIA_PROXY_STORAGE_BACKEND: s3
-    healthcheck:
-      disable: true
+      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+      FLUXER_MEDIA_PROXY_CORS_MODE: ${FLUXER_MEDIA_PROXY_CORS_MODE:-off}
+      FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS: ${FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}:${FLUXER_PUBLIC_PORT:-443}}}
+      FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE: ${FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE:-off}
+      FLUXER_S3_READ_SIGNED: "true"
    depends_on:
      seaweedfs-init: {condition: service_completed_successfully}
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}
+
+  push:
+    <<: *fluxer-service
+    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-push:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_PUSH_MEMORY_LIMIT:-256mb}
+    environment:
+      <<: *fluxer-env
+      FLUXER_PUSH_SERVICE_HOST: 0.0.0.0
+      FLUXER_PUSH_SERVICE_PORT: "8126"
+      FLUXER_PUSH_SERVICE_QUEUE_CAPACITY: "${FLUXER_PUSH_SERVICE_QUEUE_CAPACITY:-}"
+      FLUXER_PUSH_SERVICE_SEND_CONCURRENCY: "${FLUXER_PUSH_SERVICE_SEND_CONCURRENCY:-}"
+    healthcheck:
+      test: ["CMD", "/usr/local/bin/fluxer-push", "healthcheck"]
+      interval: 10s
+      timeout: 5s
+      retries: 30
+      start_period: 60s
+      start_interval: 1s
+    depends_on:
+      nats: {condition: service_healthy}
+      api: {condition: service_healthy}

  static-proxy:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-static:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_STATIC_PROXY_MEMORY_LIMIT:-256mb}
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8080/avatars/0.png"]
+      interval: 10s
+      timeout: 5s
+      retries: 10

  app-proxy:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-app-proxy-self-hosted:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_APP_PROXY_MEMORY_LIMIT:-256mb}
    environment:
      FLUXER_APP_PROXY_HOST: 0.0.0.0
      FLUXER_APP_PROXY_PORT: "8080"
-      DISCOVERY_UPSTREAM_URL: http://caddy:8088/api/.well-known/fluxer
+      FLUXER_BASE_DOMAIN: ${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}
+      FLUXER_PUBLIC_SCHEME: ${FLUXER_PUBLIC_SCHEME:-https}
+      FLUXER_PUBLIC_PORT: ${FLUXER_PUBLIC_PORT:-443}
+      FLUXER_PUBLIC_ORIGIN: ${FLUXER_PUBLIC_ORIGIN:-}
+      DISCOVERY_UPSTREAM_URL: http://edge:8088/.well-known/fluxer
      PUBLIC_BOOTSTRAP_API_ENDPOINT: /api
-      PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/api
+      PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/api
      FLUXER_CSP_EXTRA_DEFAULT_SRC: ${FLUXER_CSP_EXTRA_DEFAULT_SRC:-}
      FLUXER_CSP_EXTRA_CONNECT_SRC: ${FLUXER_CSP_EXTRA_CONNECT_SRC:-}
      FLUXER_CSP_EXTRA_IMG_SRC: ${FLUXER_CSP_EXTRA_IMG_SRC:-}
@@ -315,124 +549,202 @@ services:
      FLUXER_CSP_REPORT_URI: ${FLUXER_CSP_REPORT_URI:-}
    depends_on:
      api: {condition: service_healthy}
-      caddy: {condition: service_started}
-      postgres: {condition: service_healthy}
+      edge: {condition: service_healthy}

  snowflakes:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-snowflakes:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_SNOWFLAKES_MEMORY_LIMIT:-128mb}
    environment:
      <<: *fluxer-env
+      FLUXER_SVC_NAME: snowflakes
      FLUXER_SVC_MODE: router
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  snowflakes-shard:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-snowflakes:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_SNOWFLAKES_SHARD_MEMORY_LIMIT:-256mb}
    environment:
      <<: *fluxer-env
+      FLUXER_SVC_NAME: snowflakes
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  users:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-users:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_USERS_MEMORY_LIMIT:-128mb}
    environment:
      <<: *fluxer-env
+      FLUXER_SVC_NAME: users
      FLUXER_SVC_MODE: router
+      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  users-shard:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-users:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_USERS_SHARD_MEMORY_LIMIT:-256mb}
    environment:
      <<: *fluxer-env
+      FLUXER_SVC_NAME: users
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
+      FLUXER_POSTGRES_MAX_CONNECTIONS: "20"
+      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}
      postgres: {condition: service_healthy}

  gifs:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-gifs:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_GIFS_MEMORY_LIMIT:-128mb}
    environment:
      <<: *fluxer-env
      FLUXER_SVC_NAME: gifs
      FLUXER_SVC_MODE: router
-      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media
+      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  gifs-shard:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-gifs:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_GIFS_SHARD_MEMORY_LIMIT:-256mb}
    environment:
      <<: *fluxer-env
      FLUXER_SVC_NAME: gifs
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
-      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media
+      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  messages:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-messages:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_MESSAGES_MEMORY_LIMIT:-128mb}
    environment:
      <<: *fluxer-env
+      FLUXER_SVC_NAME: messages
      FLUXER_SVC_MODE: router
+      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  messages-shard:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-messages:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_MESSAGES_SHARD_MEMORY_LIMIT:-256mb}
    environment:
      <<: *fluxer-env
+      FLUXER_SVC_NAME: messages
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
+      FLUXER_POSTGRES_MAX_CONNECTIONS: "20"
+      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}
      postgres: {condition: service_healthy}

  unfurl:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-unfurl:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_UNFURL_MEMORY_LIMIT:-128mb}
    environment:
      <<: *fluxer-env
+      FLUXER_SVC_NAME: unfurl
      FLUXER_SVC_MODE: router
+      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  unfurl-shard:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-unfurl:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_UNFURL_SHARD_MEMORY_LIMIT:-256mb}
    environment:
      <<: *fluxer-env
+      FLUXER_SVC_NAME: unfurl
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
+      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  admin:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-admin:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_ADMIN_MEMORY_LIMIT:-256mb}
    environment:
      <<: *fluxer-env
      FLUXER_ADMIN_HOST: 0.0.0.0
      FLUXER_ADMIN_PORT: "8080"
      FLUXER_ADMIN_BASE_PATH: /admin
      FLUXER_API_ENDPOINT: http://api:8080
-      FLUXER_ADMIN_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/admin
-      FLUXER_APP_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}
-      FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media
-      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}
-      FLUXER_ADMIN_OAUTH_REDIRECT_URI: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/admin/oauth2_callback
+      FLUXER_ADMIN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/admin
+      FLUXER_APP_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
+      FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
+      FLUXER_ADMIN_OAUTH_REDIRECT_URI: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/admin/oauth2_callback
+    healthcheck:
+      test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/8080 && printf 'GET /_health HTTP/1.0\\r\\n\\r\\n' >&3 && head -n 1 <&3 | grep -q ' 200 '"]
+      interval: 10s
+      timeout: 5s
+      retries: 30
+      start_period: 60s
+      start_interval: 1s
    depends_on:
      api: {condition: service_healthy}

@@ -441,9 +753,10 @@ networks:
    driver: bridge

 volumes:
-  caddy-data:
-  caddy-config:
+  edge-data:
+  edge-config:
  postgres-data:
+  valkey-data:
  nats-data:
  meilisearch-data:
  seaweedfs-data:
@@ -1,15 +0,0 @@
-port: 7880
-log_level: info
-
-rtc:
-  tcp_port: 7881
-  udp_port: 7882
-  use_external_ip: true
-  stun_servers:
-    - stun.l.google.com:19302
-    - stun1.l.google.com:19302
-
-webhook:
-  api_key: fluxer
-  urls:
-    - http://api:8080/webhooks/livekit
@@ -0,0 +1,6 @@
+services:
+  edge:
+    ports: !override
+      - "${FLUXER_HTTP_PORT:-127.0.0.1:80}:80"
+    environment:
+      FLUXER_EDGE_SITE_ADDRESS: ":80"
@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import reactGoogleTranslate from 'eslint-plugin-react-google-translate';
+import tseslint from 'typescript-eslint';
+
+export default [
+	{
+		ignores: [
+			'**/node_modules/**',
+			'**/dist/**',
+			'**/build/**',
+			'**/coverage/**',
+			'**/*.generated.*',
+			'fluxer_app/src/features/i18n/locales/*/messages.mjs',
+		],
+	},
+	{
+		files: ['fluxer_app/src/**/*.tsx'],
+		linterOptions: {
+			reportUnusedDisableDirectives: 'error',
+		},
+		languageOptions: {
+			parser: tseslint.parser,
+			parserOptions: {
+				project: './fluxer_app/tsconfig.json',
+				tsconfigRootDir: import.meta.dirname,
+			},
+		},
+		plugins: {'react-google-translate': reactGoogleTranslate},
+		rules: {
+			'react-google-translate/no-conditional-text-nodes-with-siblings': [
+				'error',
+				{ignoreParents: ['Trans', 'Plural', 'Select', 'SelectOrdinal']},
+			],
+			'react-google-translate/no-return-text-nodes': 'error',
+		},
+	},
+];
@@ -3,36 +3,38 @@ name = "fluxer_admin"
 version = "0.1.0"
 edition.workspace = true
 license.workspace = true
+publish = false
 build = "build.rs"

 [dependencies]
-anyhow = "1.0.102"
+anyhow = "1.0.104"
 axum = { version = "0.8.9", features = ["macros"] }
-base64 = "0.22.1"
+base64 = "0.23.1"
 chrono = { version = "0.4", default-features = false, features = ["serde"] }
-cookie = "0.18.1"
+cookie = "0.18.2"
+fluxer_common = { path = "../fluxer_common" }
 hmac = "0.13.0"
 maud = { version = "0.27.0", features = ["axum"] }
 rand = "0.10"
-regress = "0.11"
-reqwest = { version = "0.13.4", default-features = false, features = ["json", "rustls"] }
-serde = { version = "1.0.228", features = ["derive"] }
-serde_json = "1.0.150"
+regress = "0.12"
+reqwest = { version = "0.13.5", default-features = false, features = ["json", "rustls"] }
+serde = { version = "1.0.229", features = ["derive"] }
+serde_json = "1.0.151"
 sha2 = "0.11.0"
-time = { version = "0.3.47", features = ["formatting", "parsing"] }
-tokio = { version = "1.52.3", features = ["macros", "net", "rt-multi-thread", "signal"] }
+time = { version = "0.3.55", features = ["formatting", "parsing"] }
+tokio = { version = "1.53.1", features = ["macros", "net", "rt-multi-thread", "signal"] }
 tower = { version = "0.5.3", features = ["util"] }
-tower-http = { version = "0.6.11", features = ["compression-gzip", "trace"] }
+tower-http = { version = "0.7.1", features = ["compression-gzip", "trace"] }
 tracing = "0.1.44"
 tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
 url = "2.5"
 urlencoding = "2.1.3"
-progenitor-client = { version = "0.14.0", default-features = false }
+progenitor-client = { version = "0.15.0", default-features = false }

 [build-dependencies]
 openapiv3 = "2.2.0"
-prettyplease = "0.2"
-progenitor = { version = "0.14.0", default-features = false }
+prettyplease = "0.3"
+progenitor = { version = "0.15.0", default-features = false }
 serde_json = "1"
 sha2 = "0.11.0"
-syn = "2"
+syn = "3"
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later

-FROM rust:1-bookworm AS builder
+FROM rust:1-trixie AS builder

 ARG BUILD_VERSION=""
 ARG TARGETARCH
@@ -9,7 +9,7 @@ WORKDIR /usr/src/app

 RUN apt-get update \
 	&& apt-get install -y --no-install-recommends ca-certificates nodejs npm pkg-config \
-	&& npm install -g pnpm@10.29.3 \
+	&& npm install -g pnpm@11.27.0 \
 	&& rm -rf /var/lib/apt/lists/*

 RUN npm install --no-audit --no-fund @tailwindcss/[email protected] [email protected]
@@ -24,6 +24,7 @@ RUN TAILWIND_OXIDE_VERSION="4.2.1" \

 COPY Cargo.lock Cargo.lock
 COPY fluxer_admin fluxer_admin
+COPY fluxer_common fluxer_common
 COPY packages/fonts/manifest.json packages/fonts/manifest.json
 COPY packages/fonts/NOTICE.md packages/fonts/NOTICE.md
 COPY packages/fonts/LICENSE-IBM-PLEX.txt packages/fonts/LICENSE-IBM-PLEX.txt
@@ -31,12 +32,17 @@ COPY packages/fonts/files/FluxerSans packages/fonts/files/FluxerSans
 COPY packages/fonts/files/FluxerMono packages/fonts/files/FluxerMono
 RUN printf '%s\n' \
 	'[workspace]' \
-	'members = ["fluxer_admin"]' \
+	'members = ["fluxer_admin", "fluxer_common"]' \
 	'resolver = "2"' \
 	'' \
 	'[workspace.package]' \
 	'edition = "2024"' \
 	'license = "AGPL-3.0-or-later"' \
+	'' \
+	'[profile.release]' \
+	'lto = "fat"' \
+	'codegen-units = 1' \
+	'strip = "symbols"' \
 	> Cargo.toml

 ENV FLUXER_BUILD_VERSION="${BUILD_VERSION}"
@@ -51,9 +57,23 @@ RUN test "$(ls target/release/build/fluxer_admin-*/out/static/fonts/*.woff2 | wc
 	&& ls target/release/build/fluxer_admin-*/out/static/fonts/fonts.*.css \
 	&& echo "Latin-core fonts bundled successfully"

-FROM debian:bookworm-slim AS runtime
+FROM debian:trixie-slim AS runtime

 ARG BUILD_VERSION=""
+ARG SOURCE_SHA=""
+ARG SOURCE_DATE=""
+
+LABEL org.opencontainers.image.title="fluxer-admin"
+LABEL org.opencontainers.image.description="Fluxer admin console"
+LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
+LABEL org.opencontainers.image.vendor="Fluxer"
+LABEL org.opencontainers.image.url="https://fluxer.app"
+LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
+LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
+LABEL org.opencontainers.image.version="${BUILD_VERSION}"
+LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
+LABEL org.opencontainers.image.created="${SOURCE_DATE}"
+LABEL app.fluxer.build-version="${BUILD_VERSION}"

 WORKDIR /usr/local/bin

@@ -35,25 +35,423 @@ fn generate_admin_api(manifest_dir: &Path, out_dir: &Path) {
    }

    let json_str = fs::read_to_string(&spec_path).expect("failed to read openapi-admin.json");
-    let spec: openapiv3::OpenAPI =
+    let mut spec: openapiv3::OpenAPI =
        serde_json::from_str(&json_str).expect("failed to parse openapi-admin.json");
+    adapt_progenitor_throttled_errors(&mut spec);
+    relax_guild_audit_log_schemas(&mut spec);
+    relax_progenitor_schema_strictness(&mut spec);

    let mut settings = progenitor::GenerationSettings::new();
    settings.with_interface(progenitor::InterfaceStyle::Positional);
+    settings.with_inner_type(
+        "reqwest::header::HeaderMap"
+            .parse()
+            .expect("valid generated client header type"),
+    );

    let mut generator = progenitor::Generator::new(&settings);
    let tokens = generator
        .generate_tokens(&spec)
        .expect("failed to generate admin API client");

-    let content = prettyplease::unparse(
+    let content = relax_required_nullable_fields(&prettyplease::unparse(
        &syn::parse2::<syn::File>(tokens).expect("failed to parse generated tokens"),
-    );
+    ));

    let output_path = out_dir.join("admin_api_generated.rs");
    fs::write(&output_path, content).expect("failed to write generated API code");
 }

+fn adapt_progenitor_throttled_errors(spec: &mut openapiv3::OpenAPI) {
+    let schemas = &spec
+        .components
+        .as_ref()
+        .expect("missing API components")
+        .schemas;
+    let error = serde_json::to_value(schemas.get("Error").expect("missing Error schema"))
+        .expect("failed to inspect Error schema");
+    let mut throttled = serde_json::to_value(
+        schemas
+            .get("ThrottledError")
+            .expect("missing ThrottledError schema"),
+    )
+    .expect("failed to inspect ThrottledError schema");
+    assert_eq!(
+        error["additionalProperties"],
+        serde_json::json!({}),
+        "Progenitor error adaptation requires Error to retain all additional fields"
+    );
+    let properties = throttled["properties"]
+        .as_object_mut()
+        .expect("ThrottledError must be an object schema");
+    assert_eq!(
+        properties
+            .remove("retry_after")
+            .expect("missing retry_after")["type"],
+        "number"
+    );
+    assert_eq!(
+        properties.remove("global").expect("missing global")["type"],
+        "boolean"
+    );
+    assert_eq!(
+        throttled, error,
+        "ThrottledError must extend the common Error schema"
+    );
+
+    for path in spec.paths.paths.values_mut() {
+        let openapiv3::ReferenceOr::Item(path) = path else {
+            panic!("Progenitor error adaptation requires inline API paths");
+        };
+        for operation in [
+            &mut path.get,
+            &mut path.put,
+            &mut path.post,
+            &mut path.delete,
+            &mut path.options,
+            &mut path.head,
+            &mut path.patch,
+            &mut path.trace,
+        ]
+        .into_iter()
+        .flatten()
+        {
+            let Some(response) = operation
+                .responses
+                .responses
+                .get_mut(&openapiv3::StatusCode::Code(429))
+            else {
+                continue;
+            };
+            let openapiv3::ReferenceOr::Item(response) = response else {
+                panic!("Progenitor error adaptation requires inline 429 responses");
+            };
+            let schema = &mut response
+                .content
+                .get_mut("application/json")
+                .expect("429 responses must return JSON")
+                .schema;
+            assert_eq!(
+                schema,
+                &Some(openapiv3::ReferenceOr::ref_(
+                    "#/components/schemas/ThrottledError"
+                )),
+                "Progenitor only supports one error type per operation"
+            );
+            *schema = Some(openapiv3::ReferenceOr::ref_("#/components/schemas/Error"));
+        }
+    }
+}
+
+fn relax_guild_audit_log_schemas(spec: &mut openapiv3::OpenAPI) {
+    let components = spec.components.as_mut().expect("missing API components");
+
+    let entry = object_schema_mut(components, "GuildAuditLogEntryResponse");
+    entry.additional_properties = None;
+    let openapiv3::ReferenceOr::Item(options) = entry
+        .properties
+        .get_mut("options")
+        .expect("GuildAuditLogEntryResponse has no options property")
+    else {
+        panic!("GuildAuditLogEntryResponse options must be an inline schema");
+    };
+    let openapiv3::SchemaKind::Type(openapiv3::Type::Object(options)) = &mut options.schema_kind
+    else {
+        panic!("GuildAuditLogEntryResponse options must be an object schema");
+    };
+    options.additional_properties = None;
+
+    let change = object_schema_mut(components, "AuditLogChangeSchema");
+    change.additional_properties = None;
+    for property in ["old_value", "new_value"] {
+        change.properties.insert(
+            property.to_string(),
+            openapiv3::ReferenceOr::Item(Box::new(openapiv3::Schema {
+                schema_data: openapiv3::SchemaData::default(),
+                schema_kind: openapiv3::SchemaKind::Any(openapiv3::AnySchema::default()),
+            })),
+        );
+    }
+}
+
+fn object_schema_mut<'a>(
+    components: &'a mut openapiv3::Components,
+    name: &str,
+) -> &'a mut openapiv3::ObjectType {
+    let Some(openapiv3::ReferenceOr::Item(schema)) = components.schemas.get_mut(name) else {
+        panic!("missing inline {name} schema");
+    };
+    let openapiv3::SchemaKind::Type(openapiv3::Type::Object(object)) = &mut schema.schema_kind
+    else {
+        panic!("{name} must be an object schema");
+    };
+    object
+}
+
+const MAX_SCHEMA_REFERENCE_DEPTH: usize = 32;
+
+fn relax_required_nullable_fields(generated: &str) -> String {
+    const PRESENCE_CHECK: &str =
+        "#[serde(deserialize_with = \"::std::option::Option::deserialize\")]";
+    generated
+        .lines()
+        .filter(|line| line.trim() != PRESENCE_CHECK)
+        .flat_map(|line| [line, "\n"])
+        .collect()
+}
+
+fn relax_progenitor_schema_strictness(spec: &mut openapiv3::OpenAPI) {
+    let registry = spec.components.clone().unwrap_or_default();
+
+    if let Some(components) = spec.components.as_mut() {
+        for schema in components.schemas.values_mut() {
+            relax_schema_reference(schema, &registry);
+        }
+        for response in components.responses.values_mut() {
+            if let openapiv3::ReferenceOr::Item(response) = response {
+                relax_response(response, &registry);
+            }
+        }
+        for parameter in components.parameters.values_mut() {
+            if let openapiv3::ReferenceOr::Item(parameter) = parameter {
+                relax_parameter(parameter, &registry);
+            }
+        }
+        for request_body in components.request_bodies.values_mut() {
+            if let openapiv3::ReferenceOr::Item(request_body) = request_body {
+                relax_content(&mut request_body.content, &registry);
+            }
+        }
+        for header in components.headers.values_mut() {
+            if let openapiv3::ReferenceOr::Item(header) = header {
+                relax_parameter_format(&mut header.format, &registry);
+            }
+        }
+    }
+
+    for path in spec.paths.paths.values_mut() {
+        let openapiv3::ReferenceOr::Item(path) = path else {
+            continue;
+        };
+        for parameter in &mut path.parameters {
+            if let openapiv3::ReferenceOr::Item(parameter) = parameter {
+                relax_parameter(parameter, &registry);
+            }
+        }
+        for operation in [
+            &mut path.get,
+            &mut path.put,
+            &mut path.post,
+            &mut path.delete,
+            &mut path.options,
+            &mut path.head,
+            &mut path.patch,
+            &mut path.trace,
+        ]
+        .into_iter()
+        .flatten()
+        {
+            for parameter in &mut operation.parameters {
+                if let openapiv3::ReferenceOr::Item(parameter) = parameter {
+                    relax_parameter(parameter, &registry);
+                }
+            }
+            if let Some(openapiv3::ReferenceOr::Item(request_body)) =
+                operation.request_body.as_mut()
+            {
+                relax_content(&mut request_body.content, &registry);
+            }
+            for response in operation
+                .responses
+                .responses
+                .values_mut()
+                .chain(operation.responses.default.iter_mut())
+            {
+                if let openapiv3::ReferenceOr::Item(response) = response {
+                    relax_response(response, &registry);
+                }
+            }
+        }
+    }
+}
+
+fn relax_response(response: &mut openapiv3::Response, registry: &openapiv3::Components) {
+    relax_content(&mut response.content, registry);
+    for header in response.headers.values_mut() {
+        if let openapiv3::ReferenceOr::Item(header) = header {
+            relax_parameter_format(&mut header.format, registry);
+        }
+    }
+}
+
+fn relax_content(content: &mut openapiv3::Content, registry: &openapiv3::Components) {
+    for media_type in content.values_mut() {
+        if let Some(schema) = media_type.schema.as_mut() {
+            relax_schema_reference(schema, registry);
+        }
+    }
+}
+
+fn relax_parameter(parameter: &mut openapiv3::Parameter, registry: &openapiv3::Components) {
+    let format = match parameter {
+        openapiv3::Parameter::Query { parameter_data, .. }
+        | openapiv3::Parameter::Header { parameter_data, .. }
+        | openapiv3::Parameter::Path { parameter_data, .. }
+        | openapiv3::Parameter::Cookie { parameter_data, .. } => &mut parameter_data.format,
+    };
+    relax_parameter_format(format, registry);
+}
+
+fn relax_parameter_format(
+    format: &mut openapiv3::ParameterSchemaOrContent,
+    registry: &openapiv3::Components,
+) {
+    match format {
+        openapiv3::ParameterSchemaOrContent::Schema(schema) => {
+            relax_schema_reference(schema, registry)
+        }
+        openapiv3::ParameterSchemaOrContent::Content(content) => relax_content(content, registry),
+    }
+}
+
+fn relax_schema_reference(
+    schema: &mut openapiv3::ReferenceOr<openapiv3::Schema>,
+    registry: &openapiv3::Components,
+) {
+    if let openapiv3::ReferenceOr::Item(schema) = schema {
+        relax_schema(schema, registry);
+    }
+}
+
+fn relax_boxed_schema_reference(
+    schema: &mut openapiv3::ReferenceOr<Box<openapiv3::Schema>>,
+    registry: &openapiv3::Components,
+) {
+    if let openapiv3::ReferenceOr::Item(schema) = schema {
+        relax_schema(schema, registry);
+    }
+}
+
+fn relax_schema(schema: &mut openapiv3::Schema, registry: &openapiv3::Components) {
+    if flattens_objects_beside_scalars(&schema.schema_kind, registry) {
+        schema.schema_kind = openapiv3::SchemaKind::Any(openapiv3::AnySchema::default());
+        return;
+    }
+    match &mut schema.schema_kind {
+        openapiv3::SchemaKind::Type(openapiv3::Type::Object(object)) => {
+            relax_additional_properties(&mut object.additional_properties, registry);
+            for property in object.properties.values_mut() {
+                relax_boxed_schema_reference(property, registry);
+            }
+        }
+        openapiv3::SchemaKind::Type(openapiv3::Type::Array(array)) => {
+            if let Some(items) = array.items.as_mut() {
+                relax_boxed_schema_reference(items, registry);
+            }
+        }
+        openapiv3::SchemaKind::Type(_) => {}
+        openapiv3::SchemaKind::OneOf { one_of: subschemas }
+        | openapiv3::SchemaKind::AllOf { all_of: subschemas }
+        | openapiv3::SchemaKind::AnyOf { any_of: subschemas } => {
+            for subschema in subschemas {
+                relax_schema_reference(subschema, registry);
+            }
+        }
+        openapiv3::SchemaKind::Not { not } => relax_schema_reference(not, registry),
+        openapiv3::SchemaKind::Any(any) => {
+            relax_additional_properties(&mut any.additional_properties, registry);
+            for property in any.properties.values_mut() {
+                relax_boxed_schema_reference(property, registry);
+            }
+            if let Some(items) = any.items.as_mut() {
+                relax_boxed_schema_reference(items, registry);
+            }
+            for subschema in any
+                .one_of
+                .iter_mut()
+                .chain(any.all_of.iter_mut())
+                .chain(any.any_of.iter_mut())
+            {
+                relax_schema_reference(subschema, registry);
+            }
+            if let Some(not) = any.not.as_mut() {
+                relax_schema_reference(not, registry);
+            }
+        }
+    }
+}
+
+fn relax_additional_properties(
+    additional_properties: &mut Option<openapiv3::AdditionalProperties>,
+    registry: &openapiv3::Components,
+) {
+    match additional_properties {
+        Some(openapiv3::AdditionalProperties::Any(false)) => *additional_properties = None,
+        Some(openapiv3::AdditionalProperties::Schema(schema)) => {
+            relax_schema_reference(schema, registry)
+        }
+        _ => {}
+    }
+}
+
+fn flattens_objects_beside_scalars(
+    schema_kind: &openapiv3::SchemaKind,
+    registry: &openapiv3::Components,
+) -> bool {
+    let subschemas = match schema_kind {
+        openapiv3::SchemaKind::OneOf { one_of } => one_of,
+        openapiv3::SchemaKind::AnyOf { any_of } => any_of,
+        _ => return false,
+    };
+    let mut objects = false;
+    let mut scalars = false;
+    for subschema in subschemas {
+        if resolves_to_object(subschema, registry, MAX_SCHEMA_REFERENCE_DEPTH) {
+            objects = true;
+        } else {
+            scalars = true;
+        }
+    }
+    objects && scalars
+}
+
+fn resolves_to_object(
+    schema: &openapiv3::ReferenceOr<openapiv3::Schema>,
+    registry: &openapiv3::Components,
+    depth: usize,
+) -> bool {
+    let Some(depth) = depth.checked_sub(1) else {
+        return false;
+    };
+    let schema = match schema {
+        openapiv3::ReferenceOr::Reference { reference } => {
+            let Some(target) = reference
+                .strip_prefix("#/components/schemas/")
+                .and_then(|name| registry.schemas.get(name))
+            else {
+                return false;
+            };
+            return resolves_to_object(target, registry, depth);
+        }
+        openapiv3::ReferenceOr::Item(schema) => schema,
+    };
+    match &schema.schema_kind {
+        openapiv3::SchemaKind::Type(openapiv3::Type::Object(_)) => true,
+        openapiv3::SchemaKind::Type(_) => false,
+        openapiv3::SchemaKind::OneOf { one_of: subschemas }
+        | openapiv3::SchemaKind::AllOf { all_of: subschemas }
+        | openapiv3::SchemaKind::AnyOf { any_of: subschemas } => subschemas
+            .iter()
+            .any(|subschema| resolves_to_object(subschema, registry, depth)),
+        openapiv3::SchemaKind::Not { .. } => false,
+        openapiv3::SchemaKind::Any(any) => {
+            any.typ.as_deref() == Some("object")
+                || !any.properties.is_empty()
+                || any.additional_properties.is_some()
+        }
+    }
+}
+
 struct Face {
    css_family: String,
    weight: u64,
@@ -41,11 +41,9 @@ pub const BAN_AVATAR_HASH_REMOVE: &str = "ban:avatar_hash:remove";
 pub const BAN_PROFILE_SUBSTRING_ADD: &str = "ban:profile_substring:add";
 pub const BAN_PROFILE_SUBSTRING_CHECK: &str = "ban:profile_substring:check";
 pub const BAN_PROFILE_SUBSTRING_REMOVE: &str = "ban:profile_substring:remove";
-pub const BILLING_MANAGE_SUBSCRIPTION: &str = "billing:manage_subscription";
-pub const BILLING_REFUND: &str = "billing:refund";
-pub const BILLING_VIEW: &str = "billing:view";
 pub const BULK_ADD_GUILD_MEMBERS: &str = "bulk:add:guild_members";
 pub const BULK_DELETE_USERS: &str = "bulk:delete:users";
+pub const BULK_DELETE_USER_MESSAGES: &str = "bulk:delete:user_messages";
 pub const BULK_UPDATE_GUILD_FEATURES: &str = "bulk:update:guild_features";
 pub const BULK_UPDATE_SUSPICIOUS_ACTIVITY: &str = "bulk:update:suspicious_activity";
 pub const BULK_UPDATE_USER_FLAGS: &str = "bulk:update:user_flags";
@@ -81,7 +79,6 @@ pub const REPORT_RESOLVE: &str = "report:resolve";
 pub const REPORT_VIEW: &str = "report:view";
 pub const REPORT_VIEW_REPORTER_PII: &str = "report:view:reporter_pii";
 pub const SYSTEM_DM_SEND: &str = "system_dm:send";
-pub const SYSTEM_HEAP_SNAPSHOT: &str = "system:heap_snapshot";
 pub const USER_CANCEL_BULK_MESSAGE_DELETION: &str = "user:cancel:bulk_message_deletion";
 pub const USER_DELETE: &str = "user:delete";
 pub const USER_DISABLE_SUSPICIOUS: &str = "user:disable:suspicious";
@@ -124,6 +121,7 @@ pub const ALL_ACLS: &[&str] = &[
    ARCHIVE_TRIGGER_GUILD,
    ARCHIVE_TRIGGER_USER,
    ARCHIVE_VIEW_ALL,
+    ASSET_PURGE,
    AUDIT_LOG_VIEW,
    AUTHENTICATE,
    JOBS_VIEW,
@@ -155,11 +153,9 @@ pub const ALL_ACLS: &[&str] = &[
    BAN_PROFILE_SUBSTRING_ADD,
    BAN_PROFILE_SUBSTRING_CHECK,
    BAN_PROFILE_SUBSTRING_REMOVE,
-    BILLING_MANAGE_SUBSCRIPTION,
-    BILLING_REFUND,
-    BILLING_VIEW,
    BULK_ADD_GUILD_MEMBERS,
    BULK_DELETE_USERS,
+    BULK_DELETE_USER_MESSAGES,
    BULK_UPDATE_GUILD_FEATURES,
    BULK_UPDATE_SUSPICIOUS_ACTIVITY,
    BULK_UPDATE_USER_FLAGS,
@@ -195,7 +191,6 @@ pub const ALL_ACLS: &[&str] = &[
    REPORT_VIEW,
    REPORT_VIEW_REPORTER_PII,
    SYSTEM_DM_SEND,
-    SYSTEM_HEAP_SNAPSHOT,
    USER_CANCEL_BULK_MESSAGE_DELETION,
    USER_DELETE,
    USER_DISABLE_SUSPICIOUS,
@@ -12,7 +12,6 @@ pub struct I32Flag {

 pub mod user_flag_bits {
    pub const STAFF: u64 = 1 << 0;
-    pub const CTP_MEMBER: u64 = 1 << 1;
    pub const PARTNER: u64 = 1 << 2;
    pub const BUG_HUNTER: u64 = 1 << 3;
    pub const FRIENDLY_BOT: u64 = 1 << 4;
@@ -40,10 +39,6 @@ pub const USER_FLAGS: &[U64Flag] = &[
        name: "STAFF",
        value: user_flag_bits::STAFF,
    },
-    U64Flag {
-        name: "CTP_MEMBER",
-        value: user_flag_bits::CTP_MEMBER,
-    },
    U64Flag {
        name: "PARTNER",
        value: user_flag_bits::PARTNER,
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{CreateAdminApiKeyResponse, ListAdminApiKeyEntry};
@@ -12,7 +12,7 @@ impl AdminApiClient {
        acls: &[String],
    ) -> ApiResult<CreateAdminApiKeyResponse> {
        let body = generated_types::CreateAdminApiKeyRequest {
-            acls: acls.to_vec(),
+            acls: parse_acls(acls)?,
            expires_in_days: None,
            name: generated_types::CreateAdminApiKeyRequestName::try_from(name)
                .map_err(|e| ApiError::Parse(e.to_string()))?,
@@ -35,10 +35,20 @@ impl AdminApiClient {
    }

    pub async fn revoke_api_key(&self, key_id: &str) -> ApiResult<()> {
+        let key_id = snowflake(key_id);
        self.generated()
-            .delete_admin_api_key(key_id)
+            .delete_admin_api_key(&key_id)
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
    }
 }
+
+pub(super) fn parse_acls(acls: &[String]) -> ApiResult<Vec<generated_types::AdminAclType>> {
+    acls.iter()
+        .map(|acl| {
+            generated_types::AdminAclType::try_from(acl.as_str())
+                .map_err(|e| ApiError::Parse(e.to_string()))
+        })
+        .collect()
+}
@@ -4,35 +4,36 @@ use super::client::{AdminApiClient, ApiResult};
 use super::types::{Application, ApplicationUpdateResponse, LookupApplicationResponse};
 use serde::Serialize;

-#[derive(Serialize)]
-struct LookupApplicationRequest<'a> {
-    application_id: &'a str,
-}
-
-#[derive(Serialize)]
-struct ListUserApplicationsRequest<'a> {
-    user_id: &'a str,
-}
-
 #[derive(Serialize)]
 struct TransferApplicationOwnershipRequest<'a> {
-    application_id: &'a str,
    new_owner_id: &'a str,
 }

 impl AdminApiClient {
    pub async fn lookup_application(&self, application_id: &str) -> ApiResult<Option<Application>> {
-        let body = LookupApplicationRequest { application_id };
-        let resp: LookupApplicationResponse =
-            self.post_typed("/admin/applications/lookup", &body).await?;
+        let resp: LookupApplicationResponse = self
+            .get(
+                &format!(
+                    "/admin/applications/{}",
+                    urlencoding::encode(application_id)
+                ),
+                None,
+            )
+            .await?;
        Ok(resp.application)
    }

    pub async fn list_user_applications(&self, user_id: &str) -> ApiResult<Vec<Application>> {
-        let body = ListUserApplicationsRequest { user_id };
-        let resp: super::types::ListUserApplicationsResponse = self
-            .post_typed("/admin/applications/list-by-owner", &body)
-            .await?;
+        let query_params = [("owner_id", user_id)];
+        let resp: super::types::ListUserApplicationsResponse =
+            self.get("/admin/applications", Some(&query_params)).await?;
+        Ok(resp.applications)
+    }
+
+    pub async fn list_guild_applications(&self, guild_id: &str) -> ApiResult<Vec<Application>> {
+        let query_params = [("guild_id", guild_id)];
+        let resp: super::types::ListUserApplicationsResponse =
+            self.get("/admin/applications", Some(&query_params)).await?;
        Ok(resp.applications)
    }

@@ -41,11 +42,15 @@ impl AdminApiClient {
        application_id: &str,
        new_owner_id: &str,
    ) -> ApiResult<ApplicationUpdateResponse> {
-        let body = TransferApplicationOwnershipRequest {
-            application_id,
-            new_owner_id,
-        };
-        self.post_typed("/admin/applications/transfer-ownership", &body)
-            .await
+        let body = TransferApplicationOwnershipRequest { new_owner_id };
+        self.patch_typed_with_reason(
+            &format!(
+                "/admin/applications/{}",
+                urlencoding::encode(application_id)
+            ),
+            &body,
+            None,
+        )
+        .await
    }
 }
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{Archive, ArchiveDownloadUrlResponse, ListArchivesResponse};
@@ -11,13 +11,12 @@ impl AdminApiClient {
        user_id: &str,
        include_attachments: bool,
    ) -> ApiResult<Archive> {
-        let body = generated_types::TriggerUserArchiveRequest {
-            include_attachments: include_attachments.then_some(true),
-            user_id: snowflake(user_id),
+        let body = generated_types::AdminArchiveCreateRequest {
+            include_attachments,
        };
        let response = self
            .generated()
-            .trigger_user_archive(&body)
+            .create_admin_user_archive(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -28,13 +27,12 @@ impl AdminApiClient {
        guild_id: &str,
        include_attachments: bool,
    ) -> ApiResult<Archive> {
-        let body = generated_types::TriggerGuildArchiveRequest {
-            guild_id: snowflake(guild_id),
-            include_attachments: include_attachments.then_some(true),
+        let body = generated_types::AdminArchiveCreateRequest {
+            include_attachments,
        };
        let response = self
            .generated()
-            .trigger_guild_archive(&body)
+            .create_admin_guild_archive(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -47,22 +45,31 @@ impl AdminApiClient {
        include_expired: bool,
        requested_by: Option<&str>,
    ) -> ApiResult<ListArchivesResponse> {
-        let body = generated_types::ListArchivesRequest {
-            include_expired: Some(include_expired),
-            limit: None,
-            requested_by: requested_by.map(snowflake),
-            subject_id: subject_id.map(snowflake),
-            subject_type: Some(
-                generated_types::ListArchivesRequestSubjectType::try_from(subject_type)
-                    .map_err(|e| ApiError::Parse(e.to_string()))?,
-            ),
+        let subject_id = subject_id.filter(|id| !id.is_empty());
+        let search_every_subject_type = subject_type == "all" && subject_id.is_some();
+        let subject_types: &[&str] = if search_every_subject_type {
+            &["user", "guild"]
+        } else {
+            std::slice::from_ref(&subject_type)
        };
-        let response = self
-            .generated()
-            .list_archives(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        let mut archives = Vec::new();
+        for &subject_type in subject_types {
+            let query_params = [
+                ("subject_type", subject_type),
+                ("subject_id", subject_id.unwrap_or_default()),
+                ("requested_by", requested_by.unwrap_or_default()),
+                (
+                    "include_expired",
+                    if include_expired { "true" } else { "false" },
+                ),
+            ];
+            match self.get("/admin/archives", Some(&query_params)).await {
+                Ok(ListArchivesResponse { archives: page }) => archives.extend(page),
+                Err(ApiError::Http { status: 403, .. }) if search_every_subject_type => {}
+                Err(error) => return Err(error),
+            }
+        }
+        Ok(ListArchivesResponse { archives })
    }

    pub async fn get_archive_download_url(
@@ -71,15 +78,17 @@ impl AdminApiClient {
        subject_id: &str,
        archive_id: &str,
    ) -> ApiResult<ArchiveDownloadUrlResponse> {
+        let subject_type = generated_types::ArchiveSubjectTypeSchema::try_from(subject_type)
+            .map_err(|e| ApiError::Parse(e.to_string()))?;
        let response = self
            .generated()
-            .get_archive_download_url(subject_type, subject_id, archive_id)
+            .get_admin_archive_download(
+                subject_type,
+                &snowflake(subject_id),
+                &snowflake(archive_id),
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }
 }
-
-fn snowflake(value: &str) -> generated_types::SnowflakeType {
-    generated_types::SnowflakeType::from(value.to_owned())
-}
@@ -1,15 +1,19 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiResult};

 impl AdminApiClient {
-    pub async fn purge_assets(&self, ids: &[String]) -> ApiResult<serde_json::Value> {
+    pub async fn purge_assets(
+        &self,
+        guild_id: &str,
+        ids: &[String],
+    ) -> ApiResult<serde_json::Value> {
        let body = generated_types::PurgeGuildAssetsRequest { ids: ids.to_vec() };
        let response = self
            .generated()
-            .purge_guild_assets(&body)
+            .purge_admin_guild_assets(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -3,8 +3,6 @@
 use crate::api::generated::types as generated_types;

 use super::client::{AdminApiClient, ApiError, ApiResult};
-#[cfg(test)]
-use super::types::AuditLogEntry;
 use super::types::AuditLogsListResponse;

 pub struct SearchAuditLogsParams {
@@ -12,10 +10,11 @@ pub struct SearchAuditLogsParams {
    pub admin_user_id: Option<String>,
    pub target_id: Option<String>,
    pub target_type: Option<String>,
+    pub access: Option<String>,
    pub sort_by: Option<String>,
    pub sort_order: Option<String>,
    pub limit: u32,
-    pub offset: u32,
+    pub offset: u64,
 }

 impl AdminApiClient {
@@ -23,81 +22,66 @@ impl AdminApiClient {
        &self,
        params: &SearchAuditLogsParams,
    ) -> ApiResult<AuditLogsListResponse> {
-        let body = generated_types::SearchAuditLogsRequest {
-            admin_user_id: nonempty_string(params.admin_user_id.as_deref())
-                .map(generated_types::SnowflakeType::from),
-            limit: Some(
-                crate::api::generated::nonzero_u32(params.limit, "limit")
-                    .map_err(ApiError::Parse)?,
+        let access = params
+            .access
+            .as_deref()
+            .map(audit_access)
+            .transpose()?
+            .map(|value| value.to_string());
+        let sort_by = params
+            .sort_by
+            .as_deref()
+            .map(audit_sort_by)
+            .transpose()?
+            .map(|value| value.to_string());
+        let sort_order = params
+            .sort_order
+            .as_deref()
+            .map(audit_sort_order)
+            .transpose()?
+            .map(|value| value.to_string());
+        let limit = params.limit.to_string();
+        let offset = params.offset.to_string();
+        let query_params = [
+            ("q", params.query.as_deref().unwrap_or_default()),
+            (
+                "admin_user_id",
+                params.admin_user_id.as_deref().unwrap_or_default(),
            ),
-            offset: Some(i64::from(params.offset)),
-            query: nonempty_string(params.query.as_deref()),
-            sort_by: params.sort_by.as_deref().map(audit_sort_by).transpose()?,
-            sort_order: params
-                .sort_order
-                .as_deref()
-                .map(audit_sort_order)
-                .transpose()?,
-            target_id: nonempty_string(params.target_id.as_deref()),
-            target_type: nonempty_string(params.target_type.as_deref()),
-        };
-        let body = serde_json::to_value(&body).map_err(|e| ApiError::Parse(e.to_string()))?;
-        self.post("/admin/audit-logs/search", Some(&body)).await
+            (
+                "target_type",
+                params.target_type.as_deref().unwrap_or_default(),
+            ),
+            ("target_id", params.target_id.as_deref().unwrap_or_default()),
+            ("access", access.as_deref().unwrap_or_default()),
+            ("sort_by", sort_by.as_deref().unwrap_or_default()),
+            ("sort_order", sort_order.as_deref().unwrap_or_default()),
+            ("limit", limit.as_str()),
+            ("offset", offset.as_str()),
+        ];
+        self.get("/admin/audit-logs", Some(&query_params)).await
    }
 }

-#[cfg(test)]
-fn audit_logs_response(
-    response: generated_types::AuditLogsListResponseSchema,
-) -> ApiResult<AuditLogsListResponse> {
-    Ok(AuditLogsListResponse {
-        logs: response.logs.into_iter().map(audit_log_entry).collect(),
-        total: crate::api::generated::number_to_u64(response.total, "total")
-            .map_err(ApiError::Parse)?,
-    })
+fn audit_access(value: &str) -> ApiResult<generated_types::ListAdminAuditLogsAccess> {
+    generated_types::ListAdminAuditLogsAccess::try_from(value)
+        .map_err(|e| ApiError::Parse(e.to_string()))
 }

-#[cfg(test)]
-fn audit_log_entry(entry: generated_types::AuditLogsListResponseSchemaLogsItem) -> AuditLogEntry {
-    AuditLogEntry {
-        log_id: String::from(entry.log_id),
-        admin_user_id: String::from(entry.admin_user_id),
-        admin_user: None,
-        action: entry.action,
-        target_id: entry.target_id,
-        target_type: entry.target_type,
-        target_user: None,
-        target_guild: None,
-        target_channel: None,
-        related_users: Default::default(),
-        related_guilds: Default::default(),
-        related_channels: Default::default(),
-        audit_log_reason: entry.audit_log_reason,
-        metadata: entry.metadata,
-        created_at: entry.created_at,
-    }
-}
-
-fn audit_sort_by(value: &str) -> ApiResult<generated_types::SearchAuditLogsRequestSortBy> {
+fn audit_sort_by(value: &str) -> ApiResult<generated_types::ListAdminAuditLogsSortBy> {
    let value = match value {
        "created_at" => "createdAt",
        value => value,
    };
-    generated_types::SearchAuditLogsRequestSortBy::try_from(value)
+    generated_types::ListAdminAuditLogsSortBy::try_from(value)
        .map_err(|e| ApiError::Parse(e.to_string()))
 }

-fn audit_sort_order(value: &str) -> ApiResult<generated_types::SearchAuditLogsRequestSortOrder> {
-    generated_types::SearchAuditLogsRequestSortOrder::try_from(value)
+fn audit_sort_order(value: &str) -> ApiResult<generated_types::ListAdminAuditLogsSortOrder> {
+    generated_types::ListAdminAuditLogsSortOrder::try_from(value)
        .map_err(|e| ApiError::Parse(e.to_string()))
 }

-fn nonempty_string(value: Option<&str>) -> Option<String> {
-    value
-        .filter(|value| !value.is_empty())
-        .map(std::borrow::ToOwned::to_owned)
-}
-
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -112,12 +96,69 @@ mod tests {
        assert_eq!(audit_sort_order("desc").unwrap().to_string(), "desc");
    }

+    #[test]
+    fn accepts_only_known_access_filters() {
+        assert_eq!(audit_access("read").unwrap().to_string(), "read");
+        assert_eq!(audit_access("write").unwrap().to_string(), "write");
+        assert!(audit_access("all").is_err());
+    }
+
    #[test]
    fn rejects_lossy_audit_totals() {
-        let response = generated_types::AuditLogsListResponseSchema {
-            logs: Vec::new(),
-            total: 1.5,
-        };
-        assert!(audit_logs_response(response).is_err());
+        for total in [serde_json::json!(1.5), serde_json::json!(-1)] {
+            let response = serde_json::json!({"logs": [], "total": total});
+            assert!(serde_json::from_value::<AuditLogsListResponse>(response).is_err());
+        }
+    }
+
+    #[test]
+    fn deserializes_audit_fields_without_losing_generated_string_values() {
+        let json = serde_json::json!({
+            "logs": [{
+                "log_id": "123456789012345678",
+                "admin_user_id": "234567890123456789",
+                "admin_user": null,
+                "action": "USER_UPDATE",
+                "access": "write",
+                "target_id": "345678901234567890",
+                "target_type": "user",
+                "target_user": null,
+                "target_guild": null,
+                "target_channel": null,
+                "related_users": {},
+                "related_guilds": {},
+                "related_channels": {},
+                "audit_log_reason": "Account review",
+                "metadata": {"field": "username"},
+                "created_at": "2026-09-11T12:00:00.000Z"
+            }],
+            "total": 1
+        });
+        let generated: generated_types::AuditLogsListResponseSchema =
+            serde_json::from_value(json.clone()).unwrap();
+        assert_eq!(generated.logs[0].action.to_string(), "USER_UPDATE");
+
+        let response: AuditLogsListResponse = serde_json::from_value(json.clone()).unwrap();
+        assert_eq!(response.logs[0].access.as_deref(), Some("write"));
+        assert_eq!(serde_json::to_value(response).unwrap(), json);
+    }
+
+    #[test]
+    fn deserializes_audit_entries_from_an_api_without_access() {
+        let json = serde_json::json!({
+            "logs": [{
+                "log_id": "123456789012345678",
+                "admin_user_id": "234567890123456789",
+                "action": "USER_UPDATE",
+                "target_id": "345678901234567890",
+                "target_type": "user",
+                "audit_log_reason": null,
+                "metadata": {},
+                "created_at": "2026-09-11T12:00:00.000Z"
+            }],
+            "total": 1
+        });
+        let response: AuditLogsListResponse = serde_json::from_value(json).unwrap();
+        assert_eq!(response.logs[0].access, None);
    }
 }
@@ -1,215 +1,174 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{BanAvatarResult, BanCheckResult, BulkBanResult};

 impl AdminApiClient {
-    pub async fn ban_email(&self, email: &str) -> ApiResult<()> {
-        let body = generated_types::BanEmailRequest {
-            email: generated_types::EmailType::from(email.to_owned()),
-        };
-        self.generated()
-            .add_email_ban(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+    pub async fn ban_email(&self, email: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
+        self.create_blocklist_entry(
+            "email",
+            generated_types::AdminBlocklistEntryCreateRequest {
+                subtype_1: Some(generated_types::BanEmailRequest {
+                    email: generated_types::EmailType::from(email.to_owned()),
+                }),
+                ..Default::default()
+            },
+            audit_log_reason,
+        )
+        .await
    }

-    pub async fn unban_email(&self, email: &str) -> ApiResult<()> {
-        let body = generated_types::BanEmailRequest {
-            email: generated_types::EmailType::from(email.to_owned()),
-        };
-        self.generated()
-            .remove_email_ban(&body)
+    pub async fn unban_email(&self, email: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
+        self.delete_blocklist_entry("email", email, None, audit_log_reason)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
    }

    pub async fn check_email_ban(&self, email: &str) -> ApiResult<BanCheckResult> {
-        let body = generated_types::BanEmailRequest {
-            email: generated_types::EmailType::from(email.to_owned()),
-        };
-        let response = self
-            .generated()
-            .check_email_ban_status(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        self.check_blocklist_entry("email", email, None).await
    }

-    pub async fn ban_ip(&self, ip: &str) -> ApiResult<()> {
-        let body = generated_types::BanIpRequest { ip: ip.to_owned() };
-        self.generated()
-            .add_ip_ban(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+    pub async fn ban_ip(&self, ip: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
+        self.create_blocklist_entry(
+            "ip",
+            generated_types::AdminBlocklistEntryCreateRequest {
+                subtype_0: Some(generated_types::BanIpRequest { ip: ip.to_owned() }),
+                ..Default::default()
+            },
+            audit_log_reason,
+        )
+        .await
    }

-    pub async fn unban_ip(&self, ip: &str) -> ApiResult<()> {
-        let body = generated_types::BanIpRequest { ip: ip.to_owned() };
-        self.generated()
-            .remove_ip_ban(&body)
+    pub async fn unban_ip(&self, ip: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
+        self.delete_blocklist_entry("ip", ip, None, audit_log_reason)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
    }

    pub async fn check_ip_ban(&self, ip: &str) -> ApiResult<BanCheckResult> {
-        let body = generated_types::BanIpRequest { ip: ip.to_owned() };
-        let response = self
-            .generated()
-            .check_ip_ban_status(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        self.check_blocklist_entry("ip", ip, None).await
    }

-    pub async fn add_suspicious_email_domain(&self, domain: &str) -> ApiResult<()> {
-        let body = suspicious_email_domain_request(domain)?;
-        self.generated()
-            .add_suspicious_email_domain(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+    pub async fn add_suspicious_email_domain(
+        &self,
+        domain: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.create_blocklist_entry(
+            SUSPICIOUS_EMAIL_DOMAIN_LIST,
+            generated_types::AdminBlocklistEntryCreateRequest {
+                subtype_2: Some(suspicious_email_domain_request(domain)?),
+                ..Default::default()
+            },
+            audit_log_reason,
+        )
+        .await
    }

-    pub async fn remove_suspicious_email_domain(&self, domain: &str) -> ApiResult<()> {
-        let body = suspicious_email_domain_request(domain)?;
-        self.generated()
-            .remove_suspicious_email_domain(&body)
+    pub async fn remove_suspicious_email_domain(
+        &self,
+        domain: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.delete_blocklist_entry(SUSPICIOUS_EMAIL_DOMAIN_LIST, domain, None, audit_log_reason)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
    }

    pub async fn check_suspicious_email_domain(&self, domain: &str) -> ApiResult<BanCheckResult> {
-        let body = suspicious_email_domain_request(domain)?;
-        let response = self
-            .generated()
-            .check_suspicious_email_domain(&body)
+        self.check_blocklist_entry(SUSPICIOUS_EMAIL_DOMAIN_LIST, domain, None)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
    }

-    pub async fn ban_phrase(&self, phrase: &str) -> ApiResult<()> {
-        let body = generated_types::BanPhraseRequest {
-            phrase: phrase.to_owned(),
-        };
-        self.generated()
-            .add_phrase_ban(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+    pub async fn ban_phrase(&self, phrase: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
+        self.create_blocklist_entry(
+            "phrase",
+            generated_types::AdminBlocklistEntryCreateRequest {
+                subtype_3: Some(generated_types::BanPhraseRequest {
+                    phrase: phrase.to_owned(),
+                }),
+                ..Default::default()
+            },
+            audit_log_reason,
+        )
+        .await
    }

-    pub async fn unban_phrase(&self, phrase: &str) -> ApiResult<()> {
-        let body = generated_types::BanPhraseRequest {
-            phrase: phrase.to_owned(),
-        };
-        self.generated()
-            .remove_phrase_ban(&body)
+    pub async fn unban_phrase(
+        &self,
+        phrase: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.delete_blocklist_entry("phrase", phrase, None, audit_log_reason)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
    }

    pub async fn check_phrase_ban(&self, phrase: &str) -> ApiResult<BanCheckResult> {
-        let body = generated_types::BanPhraseRequest {
-            phrase: phrase.to_owned(),
-        };
-        let response = self
-            .generated()
-            .check_phrase_ban_status(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        self.check_blocklist_entry("phrase", phrase, None).await
    }

-    pub async fn ban_url(&self, url: &str) -> ApiResult<()> {
-        let body = generated_types::BanUrlRequest {
-            category: None,
-            notes: None,
-            severity: None,
-            source_url: None,
-            url: url.to_owned(),
-        };
-        self.generated()
-            .add_url_ban(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+    pub async fn ban_url(&self, url: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
+        self.create_blocklist_entry(
+            "url",
+            generated_types::AdminBlocklistEntryCreateRequest {
+                subtype_4: Some(generated_types::BanUrlRequest {
+                    category: None,
+                    notes: None,
+                    severity: None,
+                    source_url: None,
+                    url: url.to_owned(),
+                }),
+                ..Default::default()
+            },
+            audit_log_reason,
+        )
+        .await
    }

-    pub async fn unban_url(&self, url: &str) -> ApiResult<()> {
-        let body = generated_types::UnbanUrlRequest {
-            url: url.to_owned(),
-        };
-        self.generated()
-            .remove_url_ban(&body)
+    pub async fn unban_url(&self, url: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
+        self.delete_blocklist_entry("url", url, None, audit_log_reason)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
    }

    pub async fn check_url_ban(&self, url: &str) -> ApiResult<BanCheckResult> {
-        let body = generated_types::CheckUrlBlocklistRequest {
-            url: url.to_owned(),
-        };
-        let response = self
-            .generated()
-            .check_url_ban_status(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        self.check_blocklist_entry("url", url, None).await
    }

-    pub async fn ban_url_domain(&self, domain: &str, match_subdomains: bool) -> ApiResult<()> {
-        let body = generated_types::BanUrlDomainRequest {
-            category: None,
-            domain: domain.to_owned(),
-            match_subdomains: Some(match_subdomains),
-            notes: None,
-            severity: None,
-            source_url: None,
-        };
-        self.generated()
-            .add_url_domain_ban(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+    pub async fn ban_url_domain(
+        &self,
+        domain: &str,
+        match_subdomains: bool,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.create_blocklist_entry(
+            "url-domain",
+            generated_types::AdminBlocklistEntryCreateRequest {
+                subtype_5: Some(generated_types::BanUrlDomainRequest {
+                    category: None,
+                    domain: domain.to_owned(),
+                    match_subdomains,
+                    notes: None,
+                    severity: None,
+                    source_url: None,
+                }),
+                ..Default::default()
+            },
+            audit_log_reason,
+        )
+        .await
    }

-    pub async fn unban_url_domain(&self, domain: &str) -> ApiResult<()> {
-        let body = generated_types::UnbanUrlDomainRequest {
-            domain: domain.to_owned(),
-        };
-        self.generated()
-            .remove_url_domain_ban(&body)
+    pub async fn unban_url_domain(
+        &self,
+        domain: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.delete_blocklist_entry("url-domain", domain, None, audit_log_reason)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
    }

    pub async fn check_url_domain_ban(&self, domain: &str) -> ApiResult<BanCheckResult> {
-        let body = generated_types::BanUrlDomainRequest {
-            category: None,
-            domain: domain.to_owned(),
-            match_subdomains: None,
-            notes: None,
-            severity: None,
-            source_url: None,
-        };
-        let response = self
-            .generated()
-            .check_url_domain_ban_status(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        self.check_blocklist_entry("url-domain", domain, None).await
    }

    pub async fn ban_file_sha(
@@ -217,16 +176,22 @@ impl AdminApiClient {
        sha256_hex: &str,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<()> {
-        let body = generated_types::BanFileShaRequest {
-            category: None,
-            content_type: None,
-            notes: None,
-            severity: None,
-            sha256_hex: sha256_hex.to_owned(),
-            source_url: None,
-        };
-        self.post_typed_with_reason::<(), _>("/admin/bans/file-sha/add", &body, audit_log_reason)
-            .await
+        self.create_blocklist_entry(
+            "file-sha",
+            generated_types::AdminBlocklistEntryCreateRequest {
+                subtype_6: Some(generated_types::BanFileShaRequest {
+                    category: None,
+                    content_type: None,
+                    notes: None,
+                    severity: None,
+                    sha256_hex: sha256_hex.to_owned(),
+                    source_url: None,
+                }),
+                ..Default::default()
+            },
+            audit_log_reason,
+        )
+        .await
    }

    pub async fn unban_file_sha(
@@ -234,23 +199,13 @@ impl AdminApiClient {
        sha256_hex: &str,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<()> {
-        let body = generated_types::UnbanFileShaRequest {
-            sha256_hex: sha256_hex.to_owned(),
-        };
-        self.post_typed_with_reason::<(), _>("/admin/bans/file-sha/remove", &body, audit_log_reason)
+        self.delete_blocklist_entry("file-sha", sha256_hex, None, audit_log_reason)
            .await
    }

    pub async fn check_file_sha_ban(&self, sha256_hex: &str) -> ApiResult<BanCheckResult> {
-        let body = generated_types::CheckFileShaRequest {
-            sha256_hex: sha256_hex.to_owned(),
-        };
-        let response = self
-            .generated()
-            .check_file_sha_ban_status(&body)
+        self.check_blocklist_entry("file-sha", sha256_hex, None)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
    }

    pub async fn bulk_ban_file_shas(
@@ -261,78 +216,91 @@ impl AdminApiClient {
        let body = generated_types::BulkBanFileShasRequest {
            sha256_list: sha256_list.to_vec(),
        };
-        self.post_typed_with_reason("/admin/bans/file-sha/bulk-add", &body, audit_log_reason)
-            .await
+        self.put_typed_with_reason(
+            "/admin/blocklists/file-sha/entries",
+            &body,
+            audit_log_reason,
+        )
+        .await
    }

-    pub async fn ban_avatar_hash(&self, hash_short: &str) -> ApiResult<()> {
-        let body = generated_types::BanAvatarHashRequest {
-            category: None,
-            hashes: vec![hash_short.to_owned()],
-            notes: None,
-            reason: None,
-            severity: None,
-            source_url: None,
-        };
-        self.generated()
-            .add_avatar_hash_ban(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+    pub async fn ban_avatar_hash(
+        &self,
+        hash_short: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.create_blocklist_entry(
+            "avatar-hash",
+            generated_types::AdminBlocklistEntryCreateRequest {
+                subtype_7: Some(generated_types::BanAvatarHashRequest {
+                    category: None,
+                    hashes: vec![hash_short.to_owned()],
+                    notes: None,
+                    reason: None,
+                    severity: None,
+                    source_url: None,
+                }),
+                ..Default::default()
+            },
+            audit_log_reason,
+        )
+        .await
    }

-    pub async fn unban_avatar_hash(&self, hash_short: &str) -> ApiResult<()> {
-        let body = generated_types::CheckAvatarHashRequest {
-            hashes: vec![hash_short.to_owned()],
-        };
-        self.generated()
-            .remove_avatar_hash_ban(&body)
+    pub async fn unban_avatar_hash(
+        &self,
+        hash_short: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.delete_blocklist_entry("avatar-hash", hash_short, None, audit_log_reason)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
    }

    pub async fn check_avatar_hash_ban(&self, hash_short: &str) -> ApiResult<BanCheckResult> {
-        let body = generated_types::CheckAvatarHashRequest {
-            hashes: vec![hash_short.to_owned()],
-        };
-        let response = self
-            .generated()
-            .check_avatar_hash_ban_status(&body)
+        self.check_blocklist_entry("avatar-hash", hash_short, None)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
    }

    pub async fn ban_user_avatar(&self, user_id: &str) -> ApiResult<BanAvatarResult> {
        let body = generated_types::BanUserAvatarRequest::default();
        let response = self
            .generated()
-            .ban_user_avatar(
-                &generated_types::SnowflakeType::from(user_id.to_owned()),
-                &body,
-            )
+            .ban_admin_user_avatar(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }

-    pub async fn ban_profile_substring(&self, scope: &str, substring: &str) -> ApiResult<()> {
-        let body = profile_substring_request(scope, substring)?;
-        self.generated()
-            .add_profile_substring_ban(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+    pub async fn ban_profile_substring(
+        &self,
+        scope: &str,
+        substring: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.create_blocklist_entry(
+            PROFILE_SUBSTRING_LIST,
+            generated_types::AdminBlocklistEntryCreateRequest {
+                subtype_8: Some(profile_substring_request(scope, substring)?),
+                ..Default::default()
+            },
+            audit_log_reason,
+        )
+        .await
    }

-    pub async fn unban_profile_substring(&self, scope: &str, substring: &str) -> ApiResult<()> {
-        let body = profile_substring_request(scope, substring)?;
-        self.generated()
-            .remove_profile_substring_ban(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+    pub async fn unban_profile_substring(
+        &self,
+        scope: &str,
+        substring: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.delete_blocklist_entry(
+            PROFILE_SUBSTRING_LIST,
+            substring,
+            Some(scope),
+            audit_log_reason,
+        )
+        .await
    }

    pub async fn check_profile_substring_ban(
@@ -340,16 +308,78 @@ impl AdminApiClient {
        scope: &str,
        substring: &str,
    ) -> ApiResult<BanCheckResult> {
-        let body = profile_substring_request(scope, substring)?;
+        self.check_blocklist_entry(PROFILE_SUBSTRING_LIST, substring, Some(scope))
+            .await
+    }
+
+    async fn create_blocklist_entry(
+        &self,
+        list_type: &str,
+        body: generated_types::AdminBlocklistEntryCreateRequest,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        let list_type = blocklist_list_type(list_type)?;
+        self.generated_with_reason(audit_log_reason)?
+            .create_admin_blocklist_entry(list_type, &body)
+            .await
+            .map(drop)
+            .map_err(|error| self.generated_error(error))
+    }
+
+    async fn delete_blocklist_entry(
+        &self,
+        list_type: &str,
+        entry_value: &str,
+        scope: Option<&str>,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        let list_type = blocklist_list_type(list_type)?;
+        let scope = scope.map(blocklist_delete_scope).transpose()?;
+        self.generated_with_reason(audit_log_reason)?
+            .delete_admin_blocklist_entry(list_type, entry_value, scope)
+            .await
+            .map(drop)
+            .map_err(|error| self.generated_error(error))
+    }
+
+    async fn check_blocklist_entry(
+        &self,
+        list_type: &str,
+        entry_value: &str,
+        scope: Option<&str>,
+    ) -> ApiResult<BanCheckResult> {
+        let list_type = blocklist_list_type(list_type)?;
+        let scope = scope.map(blocklist_get_scope).transpose()?;
        let response = self
            .generated()
-            .check_profile_substring_ban_status(&body)
+            .get_admin_blocklist_entry(list_type, entry_value, scope)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }
 }

+const SUSPICIOUS_EMAIL_DOMAIN_LIST: &str = "email-domain-suspicious";
+
+const PROFILE_SUBSTRING_LIST: &str = "profile-substring";
+
+fn blocklist_list_type(list_type: &str) -> ApiResult<generated_types::AdminBlocklistListType> {
+    generated_types::AdminBlocklistListType::try_from(list_type)
+        .map_err(|e| ApiError::Parse(e.to_string()))
+}
+
+fn blocklist_get_scope(scope: &str) -> ApiResult<generated_types::GetAdminBlocklistEntryScope> {
+    generated_types::GetAdminBlocklistEntryScope::try_from(scope)
+        .map_err(|e| ApiError::Parse(e.to_string()))
+}
+
+fn blocklist_delete_scope(
+    scope: &str,
+) -> ApiResult<generated_types::DeleteAdminBlocklistEntryScope> {
+    generated_types::DeleteAdminBlocklistEntryScope::try_from(scope)
+        .map_err(|e| ApiError::Parse(e.to_string()))
+}
+
 fn suspicious_email_domain_request(
    domain: &str,
 ) -> ApiResult<generated_types::SuspiciousEmailDomainRequest> {
@@ -1,154 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-use crate::api::generated::types as generated_types;
-
-use super::client::{AdminApiClient, ApiError, ApiResult};
-use super::types::{
-    BillingOverview, InvoiceListResponse, PaymentListResponse, PaymentMethodListResponse,
-    RefundCancelResponse, SubscriptionResponse,
-};
-
-impl AdminApiClient {
-    pub async fn get_billing_overview(&self, user_id: &str) -> ApiResult<BillingOverview> {
-        let response = self
-            .generated()
-            .admin_billing_overview(user_id)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
-    }
-
-    pub async fn get_user_payments(&self, user_id: &str) -> ApiResult<PaymentListResponse> {
-        let response = self
-            .generated()
-            .admin_billing_list_payments(user_id)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
-    }
-
-    pub async fn get_user_subscription(&self, user_id: &str) -> ApiResult<SubscriptionResponse> {
-        let response = self
-            .generated()
-            .admin_billing_get_subscription(user_id)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
-    }
-
-    pub async fn get_user_payment_methods(
-        &self,
-        user_id: &str,
-    ) -> ApiResult<PaymentMethodListResponse> {
-        let response = self
-            .generated()
-            .admin_billing_list_payment_methods(user_id)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
-    }
-
-    pub async fn get_user_invoices(
-        &self,
-        user_id: &str,
-        limit: u32,
-        starting_after: Option<&str>,
-    ) -> ApiResult<InvoiceListResponse> {
-        let limit_str = limit.to_string();
-        let mut params: Vec<(&str, &str)> = vec![("limit", &limit_str)];
-        if let Some(sa) = starting_after {
-            params.push(("starting_after", sa));
-        }
-        self.get(
-            &format!("/admin/billing/users/{user_id}/invoices"),
-            Some(&params),
-        )
-        .await
-    }
-
-    pub async fn issue_refund(
-        &self,
-        user_id: &str,
-        payment_intent_id: &str,
-        amount_cents: Option<u64>,
-        reason: Option<&str>,
-    ) -> ApiResult<()> {
-        let body = generated_types::AdminBillingRefundRequest {
-            amount_cents: amount_cents
-                .map(|value| crate::api::generated::nonzero_u64(value, "amount_cents"))
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-            payment_intent_id: payment_intent_id.to_owned(),
-            reason: reason
-                .map(generated_types::AdminBillingRefundRequestReason::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-        };
-        self.generated()
-            .admin_billing_refund(user_id, &body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
-    }
-
-    pub async fn refund_policy_cancel_now(
-        &self,
-        user_id: &str,
-        reason: Option<&str>,
-    ) -> ApiResult<RefundCancelResponse> {
-        let body = generated_types::AdminBillingRefundLatestInvoiceCancelRequest {
-            reason: reason
-                .map(generated_types::AdminBillingRefundLatestInvoiceCancelRequestReason::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-        };
-        let response = self
-            .generated()
-            .admin_billing_refund_policy_cancel_now(user_id, &body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
-    }
-
-    pub async fn cancel_subscription(&self, user_id: &str) -> ApiResult<()> {
-        self.generated()
-            .admin_billing_cancel_subscription(user_id)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
-    }
-
-    pub async fn cancel_subscription_immediately(
-        &self,
-        user_id: &str,
-        reason: Option<&str>,
-    ) -> ApiResult<()> {
-        let body = generated_types::AdminBillingCancelImmediatelyRequest {
-            reason: reason
-                .map(generated_types::AdminBillingCancelImmediatelyRequestReason::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-        };
-        self.generated()
-            .admin_billing_cancel_subscription_now(user_id, &body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
-    }
-
-    pub async fn reactivate_subscription(&self, user_id: &str) -> ApiResult<()> {
-        self.generated()
-            .admin_billing_reactivate_subscription(user_id)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
-    }
-
-    pub async fn end_premium_grace_period(&self, user_id: &str) -> ApiResult<()> {
-        self.generated()
-            .admin_billing_end_premium_grace_period(user_id)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
-    }
-}
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::BulkJobResponse;
@@ -13,12 +13,12 @@ impl AdminApiClient {
        remove_flags: &[String],
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
-        let body = generated_types::BulkUpdateUserFlagsRequest {
-            add_flags: user_flags(add_flags),
-            remove_flags: user_flags(remove_flags),
+        let body = generated_types::AdminBulkJobCreateRequest::UpdateUserFlags {
+            add_flags: user_flags(add_flags)?,
+            remove_flags: user_flags(remove_flags)?,
            user_ids: snowflakes(user_ids),
        };
-        self.post_typed_with_reason("/admin/bulk/update-user-flags", &body, audit_log_reason)
+        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
            .await
    }

@@ -29,17 +29,13 @@ impl AdminApiClient {
        remove_flags: &[String],
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
-        let body = generated_types::BulkUpdateSuspiciousActivityFlagsRequest {
+        let body = generated_types::AdminBulkJobCreateRequest::UpdateSuspiciousActivityFlags {
            add_flags: add_flags.to_vec(),
            remove_flags: remove_flags.to_vec(),
            user_ids: snowflakes(user_ids),
        };
-        self.post_typed_with_reason(
-            "/admin/bulk/update-suspicious-activity-flags",
-            &body,
-            audit_log_reason,
-        )
-        .await
+        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
+            .await
    }

    pub async fn bulk_update_guild_features(
@@ -49,12 +45,12 @@ impl AdminApiClient {
        remove_features: &[String],
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
-        let body = generated_types::BulkUpdateGuildFeaturesRequest {
+        let body = generated_types::AdminBulkJobCreateRequest::UpdateGuildFeatures {
            add_features: guild_features(add_features),
            guild_ids: snowflakes(guild_ids),
            remove_features: guild_features(remove_features),
        };
-        self.post_typed_with_reason("/admin/bulk/update-guild-features", &body, audit_log_reason)
+        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
            .await
    }

@@ -64,11 +60,23 @@ impl AdminApiClient {
        user_ids: &[String],
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
-        let body = generated_types::BulkAddGuildMembersRequest {
+        let body = generated_types::AdminBulkJobCreateRequest::AddGuildMembers {
            guild_id: snowflake(guild_id),
            user_ids: snowflakes(user_ids),
        };
-        self.post_typed_with_reason("/admin/bulk/add-guild-members", &body, audit_log_reason)
+        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
+            .await
+    }
+
+    pub async fn bulk_delete_user_messages(
+        &self,
+        user_ids: &[String],
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<BulkJobResponse> {
+        let body = generated_types::AdminBulkJobCreateRequest::DeleteUserMessages {
+            user_ids: snowflakes(user_ids),
+        };
+        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
            .await
    }

@@ -80,41 +88,37 @@ impl AdminApiClient {
        public_reason: Option<&str>,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
-        let body = generated_types::BulkScheduleUserDeletionRequest {
-            days_until_deletion: Some(
-                crate::api::generated::nonzero_u32(days_until_deletion, "days_until_deletion")
-                    .map_err(ApiError::Parse)?,
-            ),
+        let body = generated_types::AdminBulkJobCreateRequest::ScheduleUserDeletion {
+            days_until_deletion: crate::api::generated::nonzero_u32(
+                days_until_deletion,
+                "days_until_deletion",
+            )
+            .map_err(ApiError::Parse)?
+            .into(),
            public_reason: public_reason.map(std::borrow::ToOwned::to_owned),
-            reason_code: i32::try_from(reason_code).map_err(|e| ApiError::Parse(e.to_string()))?,
+            reason_code: crate::api::generated::deletion_reason_code(
+                i32::try_from(reason_code).map_err(|e| ApiError::Parse(e.to_string()))?,
+                "reason_code",
+            )
+            .map_err(ApiError::Parse)?,
            user_ids: snowflakes(user_ids),
        };
-        self.post_typed_with_reason(
-            "/admin/bulk/schedule-user-deletion",
-            &body,
-            audit_log_reason,
-        )
-        .await
+        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
+            .await
    }
 }

-fn snowflake(value: &str) -> generated_types::SnowflakeType {
-    generated_types::SnowflakeType::from(value.to_owned())
-}
-
 fn snowflakes(values: &[String]) -> Vec<generated_types::SnowflakeType> {
-    values
-        .iter()
-        .cloned()
-        .map(generated_types::SnowflakeType::from)
-        .collect()
+    values.iter().map(|value| snowflake(value)).collect()
 }

-fn user_flags(values: &[String]) -> Vec<generated_types::UserFlags> {
+fn user_flags(values: &[String]) -> ApiResult<Vec<generated_types::UserFlags>> {
    values
        .iter()
-        .cloned()
-        .map(generated_types::UserFlags::from)
+        .map(|value| {
+            generated_types::UserFlags::try_from(value.as_str())
+                .map_err(|error| ApiError::Parse(error.to_string()))
+        })
        .collect()
 }

@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use crate::api::generated::GeneratedClient;
 use crate::{config::AdminConfig, session::Session};
+use progenitor_client::ClientInfo;
 use reqwest::header::{AUTHORIZATION, HeaderMap, HeaderName, HeaderValue};
 use reqwest::{Method, RequestBuilder};
 use serde::Serialize;
@@ -34,46 +36,39 @@ impl<T> ApiResultExt<T> for ApiResult<T> {
 }

 pub struct AdminApiClient {
-    http_client: reqwest::Client,
-    generated: crate::api::generated::GeneratedClient,
-    base_url: String,
-    access_token: String,
-    proxy_client_ip_headers: HeaderMap,
+    generated: GeneratedClient,
 }

 impl AdminApiClient {
    pub fn new(http_client: &reqwest::Client, config: &AdminConfig, session: &Session) -> Self {
-        let generated_http_client = build_generated_http_client(config, session);
-        let generated = crate::api::generated::GeneratedClient::new_with_client(
+        let generated = GeneratedClient::new_with_client(
            &config.api_endpoint,
-            generated_http_client,
+            http_client.clone(),
+            build_session_headers(config, session),
        );
-        Self {
-            http_client: http_client.clone(),
-            generated,
-            base_url: config.api_endpoint.clone(),
-            access_token: session.access_token.clone(),
-            proxy_client_ip_headers: build_proxy_client_ip_headers(config),
-        }
+        Self { generated }
    }

    fn build_url(&self, path: &str, query_params: Option<&[(&str, &str)]>) -> String {
-        let base = format!("{}{}", self.base_url, path);
-        match query_params {
-            None => base,
-            Some(params) => {
-                let filtered: Vec<_> = params.iter().filter(|(_, v)| !v.is_empty()).collect();
-                if filtered.is_empty() {
-                    return base;
-                }
-                let query = filtered
-                    .iter()
-                    .map(|(k, v)| format!("{}={}", urlencoding::encode(k), urlencoding::encode(v)))
-                    .collect::<Vec<_>>()
-                    .join("&");
-                format!("{base}?{query}")
-            }
+        let mut url = format!("{}{}", self.generated.baseurl(), path);
+        let query = query_params
+            .unwrap_or_default()
+            .iter()
+            .filter(|(_, value)| !value.is_empty())
+            .map(|(key, value)| {
+                format!(
+                    "{}={}",
+                    urlencoding::encode(key),
+                    urlencoding::encode(value)
+                )
+            })
+            .collect::<Vec<_>>()
+            .join("&");
+        if !query.is_empty() {
+            url.push('?');
+            url.push_str(&query);
        }
+        url
    }

    fn request(
@@ -81,30 +76,26 @@ impl AdminApiClient {
        method: Method,
        path: &str,
        query_params: Option<&[(&str, &str)]>,
-    ) -> RequestBuilder {
-        let url = self.build_url(path, query_params);
-        self.http_client
-            .request(method, &url)
-            .header("Authorization", format!("Bearer {}", self.access_token))
-            .header("Content-Type", "application/json")
-            .headers(self.proxy_client_ip_headers.clone())
-    }
-
-    fn with_audit_log_reason(
-        builder: RequestBuilder,
        audit_log_reason: Option<&str>,
-    ) -> RequestBuilder {
-        match audit_log_reason {
-            Some(reason) => builder.header("X-Audit-Log-Reason", reason),
-            None => builder,
-        }
+    ) -> ApiResult<RequestBuilder> {
+        let url = self.build_url(path, query_params);
+        Ok(self
+            .generated
+            .client()
+            .request(method, &url)
+            .header("Content-Type", "application/json")
+            .headers(self.headers_with_reason(audit_log_reason)?))
    }

-    fn with_json_body(builder: RequestBuilder, body: Option<&serde_json::Value>) -> RequestBuilder {
-        match body {
-            Some(body) => builder.json(body),
-            None => builder,
+    fn headers_with_reason(&self, audit_log_reason: Option<&str>) -> ApiResult<HeaderMap> {
+        let mut headers = self.generated.inner().clone();
+        if let Some(reason) = audit_log_reason {
+            let mut value = HeaderValue::from_str(reason)
+                .map_err(|_| ApiError::Parse("invalid audit log reason header".to_owned()))?;
+            value.set_sensitive(true);
+            headers.insert("x-audit-log-reason", value);
        }
+        Ok(headers)
    }

    async fn send_request(builder: RequestBuilder) -> ApiResult<reqwest::Response> {
@@ -114,13 +105,29 @@ impl AdminApiClient {
            .map_err(|e| ApiError::Network(e.to_string()))
    }

+    async fn send_json<B: Serialize + ?Sized>(
+        &self,
+        method: Method,
+        path: &str,
+        body: Option<&B>,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<reqwest::Response> {
+        let builder = self.request(method, path, None, audit_log_reason)?;
+        let builder = match body {
+            Some(body) => builder.json(body),
+            None => builder,
+        };
+        Self::send_request(builder).await
+    }
+
    pub async fn get<T: DeserializeOwned>(
        &self,
        path: &str,
        query_params: Option<&[(&str, &str)]>,
    ) -> ApiResult<T> {
-        let response = Self::send_request(self.request(Method::GET, path, query_params)).await?;
-        self.parse_response(response).await
+        let response =
+            Self::send_request(self.request(Method::GET, path, query_params, None)?).await?;
+        Self::parse_response(response).await
    }

    pub async fn post<T: DeserializeOwned>(
@@ -149,10 +156,10 @@ impl AdminApiClient {
        T: DeserializeOwned,
        B: Serialize + ?Sized,
    {
-        let builder =
-            Self::with_audit_log_reason(self.request(Method::POST, path, None), audit_log_reason);
-        let response = Self::send_request(builder.json(body)).await?;
-        self.parse_response(response).await
+        let response = self
+            .send_json(Method::POST, path, Some(body), audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
    }

    pub async fn post_with_reason<T: DeserializeOwned>(
@@ -161,10 +168,10 @@ impl AdminApiClient {
        body: Option<&serde_json::Value>,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<T> {
-        let builder =
-            Self::with_audit_log_reason(self.request(Method::POST, path, None), audit_log_reason);
-        let response = Self::send_request(Self::with_json_body(builder, body)).await?;
-        self.parse_response(response).await
+        let response = self
+            .send_json(Method::POST, path, body, audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
    }

    pub async fn post_void(&self, path: &str, body: Option<&serde_json::Value>) -> ApiResult<()> {
@@ -177,9 +184,9 @@ impl AdminApiClient {
        body: Option<&serde_json::Value>,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<()> {
-        let builder =
-            Self::with_audit_log_reason(self.request(Method::POST, path, None), audit_log_reason);
-        let response = Self::send_request(Self::with_json_body(builder, body)).await?;
+        let response = self
+            .send_json(Method::POST, path, body, audit_log_reason)
+            .await?;
        Self::parse_void_response(response).await
    }

@@ -188,36 +195,135 @@ impl AdminApiClient {
        path: &str,
        body: Option<&serde_json::Value>,
    ) -> ApiResult<T> {
-        let builder = Self::with_json_body(self.request(Method::PATCH, path, None), body);
-        let response = Self::send_request(builder).await?;
-        self.parse_response(response).await
+        self.patch_with_reason(path, body, None).await
    }

-    pub async fn delete_void(&self, path: &str, body: Option<&serde_json::Value>) -> ApiResult<()> {
-        let builder = Self::with_json_body(self.request(Method::DELETE, path, None), body);
-        let response = Self::send_request(builder).await?;
+    pub async fn patch_with_reason<T: DeserializeOwned>(
+        &self,
+        path: &str,
+        body: Option<&serde_json::Value>,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<T> {
+        let response = self
+            .send_json(Method::PATCH, path, body, audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
+    }
+
+    pub async fn patch_typed_with_reason<T, B>(
+        &self,
+        path: &str,
+        body: &B,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<T>
+    where
+        T: DeserializeOwned,
+        B: Serialize + ?Sized,
+    {
+        let response = self
+            .send_json(Method::PATCH, path, Some(body), audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
+    }
+
+    pub async fn put_with_reason<T: DeserializeOwned>(
+        &self,
+        path: &str,
+        body: Option<&serde_json::Value>,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<T> {
+        let response = self
+            .send_json(Method::PUT, path, body, audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
+    }
+
+    pub async fn put_typed_with_reason<T, B>(
+        &self,
+        path: &str,
+        body: &B,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<T>
+    where
+        T: DeserializeOwned,
+        B: Serialize + ?Sized,
+    {
+        let response = self
+            .send_json(Method::PUT, path, Some(body), audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
+    }
+
+    pub async fn put_void_with_reason(
+        &self,
+        path: &str,
+        body: Option<&serde_json::Value>,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        let response = self
+            .send_json(Method::PUT, path, body, audit_log_reason)
+            .await?;
        Self::parse_void_response(response).await
    }

-    async fn parse_void_response(response: reqwest::Response) -> ApiResult<()> {
-        if response.status().is_success() {
-            Ok(())
-        } else {
-            let status = response.status().as_u16();
-            let text = response.text().await.map_err(|error| {
-                ApiError::Network(format!("failed to read error response body: {error}"))
-            })?;
-            Err(ApiError::Http {
-                status,
-                message: text,
-            })
-        }
+    pub async fn delete_void(&self, path: &str, body: Option<&serde_json::Value>) -> ApiResult<()> {
+        self.delete_void_with_reason(path, body, None).await
    }

-    pub(crate) fn generated(&self) -> &crate::api::generated::GeneratedClient {
+    pub async fn delete_void_with_reason(
+        &self,
+        path: &str,
+        body: Option<&serde_json::Value>,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        let response = self
+            .send_json(Method::DELETE, path, body, audit_log_reason)
+            .await?;
+        Self::parse_void_response(response).await
+    }
+
+    pub async fn delete_with_reason<T: DeserializeOwned>(
+        &self,
+        path: &str,
+        body: Option<&serde_json::Value>,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<T> {
+        let response = self
+            .send_json(Method::DELETE, path, body, audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
+    }
+
+    async fn parse_void_response(response: reqwest::Response) -> ApiResult<()> {
+        Self::check_response_status(response).await.map(drop)
+    }
+
+    async fn check_response_status(response: reqwest::Response) -> ApiResult<reqwest::Response> {
+        if response.status().is_success() {
+            return Ok(response);
+        }
+        let status = response.status().as_u16();
+        let message = response.text().await.map_err(|error| {
+            ApiError::Network(format!("failed to read error response body: {error}"))
+        })?;
+        Err(ApiError::Http { status, message })
+    }
+
+    pub(crate) fn generated(&self) -> &GeneratedClient {
        &self.generated
    }

+    pub(crate) fn generated_with_reason(
+        &self,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<GeneratedClient> {
+        Ok(GeneratedClient::new_with_client(
+            self.generated.baseurl(),
+            self.generated.client().clone(),
+            self.headers_with_reason(audit_log_reason)?,
+        ))
+    }
+
    pub(crate) fn generated_value<T, U>(&self, value: U) -> ApiResult<T>
    where
        T: DeserializeOwned,
@@ -240,28 +346,16 @@ impl AdminApiClient {
        }
    }

-    async fn parse_response<T: DeserializeOwned>(
-        &self,
-        response: reqwest::Response,
-    ) -> ApiResult<T> {
-        let status = response.status();
-        if status.as_u16() == 204 {
-            return serde_json::from_value(serde_json::Value::Null)
-                .map_err(|e| ApiError::Parse(e.to_string()));
-        }
-        if !status.is_success() {
-            let text = response.text().await.map_err(|error| {
-                ApiError::Network(format!("failed to read error response body: {error}"))
-            })?;
-            return Err(ApiError::Http {
-                status: status.as_u16(),
-                message: text,
-            });
-        }
-        let text = response
-            .text()
-            .await
-            .map_err(|e| ApiError::Network(e.to_string()))?;
+    async fn parse_response<T: DeserializeOwned>(response: reqwest::Response) -> ApiResult<T> {
+        let response = Self::check_response_status(response).await?;
+        let text = if response.status() == reqwest::StatusCode::NO_CONTENT {
+            String::new()
+        } else {
+            response
+                .text()
+                .await
+                .map_err(|e| ApiError::Network(e.to_string()))?
+        };
        if text.is_empty() {
            return serde_json::from_value(serde_json::Value::Null)
                .map_err(|e| ApiError::Parse(e.to_string()));
@@ -270,17 +364,14 @@ impl AdminApiClient {
    }
 }

-fn build_generated_http_client(config: &AdminConfig, session: &Session) -> reqwest::Client {
+fn build_session_headers(config: &AdminConfig, session: &Session) -> HeaderMap {
    let mut headers = HeaderMap::new();
-    let auth_value = HeaderValue::from_str(&format!("Bearer {}", session.access_token))
+    let mut auth_value = HeaderValue::from_str(&format!("Bearer {}", session.access_token))
        .expect("failed to build generated API Authorization header");
+    auth_value.set_sensitive(true);
    headers.insert(AUTHORIZATION, auth_value);
    headers.extend(build_proxy_client_ip_headers(config));
-    reqwest::Client::builder()
-        .user_agent(format!("FluxerAdmin/{} (Rust)", config.build_version))
-        .default_headers(headers)
-        .build()
-        .expect("failed to create generated API HTTP client")
+    headers
 }

 pub(crate) fn with_proxy_client_ip_header(
@@ -330,3 +421,84 @@ impl std::fmt::Display for ApiError {
        }
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::{Value, json};
+
+    fn response(status: u16, body: &'static str) -> reqwest::Response {
+        axum::http::Response::builder()
+            .status(status)
+            .body(body)
+            .expect("valid response")
+            .into()
+    }
+
+    #[tokio::test]
+    async fn parses_successful_json_and_empty_responses() {
+        for (status, body, expected) in [
+            (200, r#"{"value":1}"#, json!({"value": 1})),
+            (201, "[1,2]", json!([1, 2])),
+            (202, "null", Value::Null),
+            (200, "", Value::Null),
+            (204, "ignored body", Value::Null),
+        ] {
+            let actual: Value = AdminApiClient::parse_response(response(status, body))
+                .await
+                .expect("valid response body");
+            assert_eq!(actual, expected, "HTTP {status}: {body}");
+        }
+    }
+
+    #[tokio::test]
+    async fn empty_responses_preserve_null_deserialization_errors() {
+        let expected = serde_json::from_value::<Vec<String>>(Value::Null)
+            .expect_err("null is not a list")
+            .to_string();
+        for (status, body) in [(200, ""), (204, "ignored body")] {
+            let error = AdminApiClient::parse_response::<Vec<String>>(response(status, body))
+                .await
+                .expect_err("missing list");
+            assert_eq!(error.to_string(), format!("parse error: {expected}"));
+        }
+    }
+
+    #[tokio::test]
+    async fn malformed_json_preserves_deserialization_errors() {
+        for body in [" ", "{", "not JSON"] {
+            let expected = serde_json::from_str::<Value>(body)
+                .expect_err("malformed JSON")
+                .to_string();
+            let error = AdminApiClient::parse_response::<Value>(response(200, body))
+                .await
+                .expect_err("malformed response");
+            assert_eq!(error.to_string(), format!("parse error: {expected}"));
+        }
+    }
+
+    #[tokio::test]
+    async fn void_responses_do_not_parse_successful_bodies() {
+        for status in [200, 201, 202, 204] {
+            AdminApiClient::parse_void_response(response(status, "not JSON"))
+                .await
+                .expect("successful void response");
+        }
+    }
+
+    #[tokio::test]
+    async fn typed_and_void_responses_preserve_http_errors() {
+        for status in [302, 400, 403, 404, 500] {
+            for body in ["", "plain error", r#"{"code":"FORBIDDEN"}"#] {
+                let typed = AdminApiClient::parse_response::<Value>(response(status, body))
+                    .await
+                    .map(drop);
+                let empty = AdminApiClient::parse_void_response(response(status, body)).await;
+                for result in [typed, empty] {
+                    let error = result.expect_err("unsuccessful response");
+                    assert_eq!(error.to_string(), format!("HTTP {status}: {body}"));
+                }
+            }
+        }
+    }
+}
@@ -9,24 +9,24 @@ impl AdminApiClient {
    pub async fn generate_gift_codes(
        &self,
        count: u32,
-        duration_type: &str,
+        duration_type: generated_types::GiftCodeDurationTypeSchema,
        duration_quantity: u32,
    ) -> ApiResult<CodesResponse> {
        let body = generated_types::GenerateGiftCodesRequest {
-            count: crate::api::generated::nonzero_u32(count, "count").map_err(ApiError::Parse)?,
+            count: crate::api::generated::nonzero_u32(count, "count")
+                .map_err(ApiError::Parse)?
+                .into(),
            duration_quantity: crate::api::generated::nonzero_u32(
                duration_quantity,
                "duration_quantity",
            )
-            .map_err(ApiError::Parse)?,
-            duration_type: generated_types::GenerateGiftCodesRequestDurationType::try_from(
-                duration_type,
-            )
-            .map_err(|e| ApiError::Parse(e.to_string()))?,
+            .map_err(ApiError::Parse)?
+            .into(),
+            duration_type,
        };
        let response = self
            .generated()
-            .generate_gift_codes(&body)
+            .create_admin_gift_codes(&body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{
@@ -13,11 +13,10 @@ impl AdminApiClient {
    ) -> ApiResult<Vec<DiscoveryPendingApplication>> {
        let response = self
            .generated()
-            .list_pending_discovery_applications()
+            .list_admin_discovery_applications()
            .await
            .map_err(|e| self.generated_error(e))?;
-        response
-            .into_inner()
+        Vec::from(response.into_inner())
            .into_iter()
            .map(pending_discovery_application)
            .collect()
@@ -26,11 +25,10 @@ impl AdminApiClient {
    pub async fn list_discovery_listed_guilds(&self) -> ApiResult<Vec<DiscoveryListedGuild>> {
        let response = self
            .generated()
-            .list_discovery_listed_guilds()
+            .list_admin_discovery_listings()
            .await
            .map_err(|e| self.generated_error(e))?;
-        response
-            .into_inner()
+        Vec::from(response.into_inner())
            .into_iter()
            .map(listed_guild)
            .collect()
@@ -41,16 +39,16 @@ impl AdminApiClient {
        guild_id: &str,
        reason: Option<&str>,
    ) -> ApiResult<DiscoveryApplicationResponse> {
-        let guild_id = generated_types::SnowflakeType::from(guild_id.to_owned());
-        let body = generated_types::DiscoveryAdminReviewRequest {
+        let guild_id = snowflake(guild_id);
+        let body = generated_types::DiscoveryAdminApplicationUpdateRequest::Approved {
            reason: reason
-                .map(generated_types::DiscoveryAdminReviewRequestReason::try_from)
+                .map(generated_types::DiscoveryReviewReason::try_from)
                .transpose()
                .map_err(|e| ApiError::Parse(e.to_string()))?,
        };
        let response = self
            .generated()
-            .approve_discovery_application(&guild_id, &body)
+            .update_admin_discovery_application(&guild_id, &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -61,14 +59,14 @@ impl AdminApiClient {
        guild_id: &str,
        reason: &str,
    ) -> ApiResult<DiscoveryApplicationResponse> {
-        let guild_id = generated_types::SnowflakeType::from(guild_id.to_owned());
-        let body = generated_types::DiscoveryAdminRejectRequest {
-            reason: generated_types::DiscoveryAdminRejectRequestReason::try_from(reason)
+        let guild_id = snowflake(guild_id);
+        let body = generated_types::DiscoveryAdminApplicationUpdateRequest::Rejected {
+            reason: generated_types::DiscoveryRejectionReason::try_from(reason)
                .map_err(|e| ApiError::Parse(e.to_string()))?,
        };
        let response = self
            .generated()
-            .reject_discovery_application(&guild_id, &body)
+            .update_admin_discovery_application(&guild_id, &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -79,14 +77,14 @@ impl AdminApiClient {
        guild_id: &str,
        reason: &str,
    ) -> ApiResult<DiscoveryApplicationResponse> {
-        let guild_id = generated_types::SnowflakeType::from(guild_id.to_owned());
+        let guild_id = snowflake(guild_id);
        let body = generated_types::DiscoveryAdminRemoveRequest {
            reason: generated_types::DiscoveryAdminRemoveRequestReason::try_from(reason)
                .map_err(|e| ApiError::Parse(e.to_string()))?,
        };
        let response = self
            .generated()
-            .remove_from_discovery(&guild_id, &body)
+            .delete_admin_discovery_listing(&guild_id, &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -1,5 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use progenitor_client::{ClientHooks, ClientInfo, Error, OperationInfo};
+use reqwest::header::HeaderMap;
+
 #[allow(
    clippy::all,
    unused_imports,
@@ -16,6 +19,24 @@ pub use inner::types;

 pub use inner::Client as GeneratedClient;

+impl ClientHooks<HeaderMap> for GeneratedClient {
+    async fn pre<E>(
+        &self,
+        request: &mut reqwest::Request,
+        _info: &OperationInfo,
+    ) -> Result<(), Error<E>> {
+        let headers = request.headers_mut();
+        for (name, value) in self.inner() {
+            headers.entry(name.clone()).or_insert_with(|| value.clone());
+        }
+        Ok(())
+    }
+}
+
+pub(crate) fn snowflake(value: &str) -> types::SnowflakeType {
+    types::SnowflakeType::Variant0(value.to_owned())
+}
+
 pub(crate) fn number_to_u64(value: f64, field: &str) -> Result<u64, String> {
    const MAX_SAFE_INTEGER: f64 = 9_007_199_254_740_991.0;
    if !value.is_finite() || value < 0.0 || value.fract() != 0.0 || value > MAX_SAFE_INTEGER {
@@ -32,8 +53,12 @@ pub(crate) fn nonzero_u32(value: u32, field: &str) -> Result<std::num::NonZeroU3
    std::num::NonZeroU32::new(value).ok_or_else(|| format!("{field} must be greater than zero"))
 }

-pub(crate) fn nonzero_u64(value: u64, field: &str) -> Result<std::num::NonZeroU64, String> {
-    std::num::NonZeroU64::new(value).ok_or_else(|| format!("{field} must be greater than zero"))
+pub(crate) fn deletion_reason_code(
+    value: i32,
+    field: &str,
+) -> Result<types::DeletionReasonCode, String> {
+    types::DeletionReasonCode::try_from(value)
+        .map_err(|_| format!("{field} is not a deletion reason code: {value}"))
 }

 #[cfg(test)]
@@ -122,10 +147,10 @@ mod tests {
        let response: SearchGuildsResponse =
            serde_json::from_value(json).expect("failed to deserialize SearchGuildsResponse");

-        assert_eq!(response.total as i64, 1);
+        assert_eq!(response.total, 1.0);
        assert_eq!(response.guilds.len(), 1);
        assert_eq!(response.guilds[0].name, "Test Guild");
-        assert_eq!(response.guilds[0].member_count, 42);
+        assert_eq!(*response.guilds[0].member_count, 42);
    }

    #[test]
@@ -1,16 +1,16 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::snowflake;

 use super::client::{AdminApiClient, ApiResult};
 use super::types::{ListGuildEmojisResponse, ListGuildStickersResponse};

 impl AdminApiClient {
    pub async fn list_guild_emojis(&self, guild_id: &str) -> ApiResult<ListGuildEmojisResponse> {
-        let guild_id = generated_types::SnowflakeType::from(guild_id.to_owned());
+        let guild_id = snowflake(guild_id);
        let response = self
            .generated()
-            .admin_list_guild_emojis(&guild_id)
+            .list_admin_guild_emojis(&guild_id)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -20,10 +20,10 @@ impl AdminApiClient {
        &self,
        guild_id: &str,
    ) -> ApiResult<ListGuildStickersResponse> {
-        let guild_id = generated_types::SnowflakeType::from(guild_id.to_owned());
+        let guild_id = snowflake(guild_id);
        let response = self
            .generated()
-            .admin_list_guild_stickers(&guild_id)
+            .list_admin_guild_stickers(&guild_id)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -1,9 +1,10 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};
 use serde::Deserialize;

 use super::client::{AdminApiClient, ApiError, ApiResult};
+use super::reports::SearchReportsParams;
 use super::types::{
    GuildAuditLogResponse, GuildDetailInfo, GuildInfo, GuildUpdateResponse,
    ListGuildMembersResponse, LookupGuildResponse, SearchGuildsResponse, SearchReportsResponse,
@@ -15,34 +16,21 @@ impl AdminApiClient {
        &self,
        query: &str,
        limit: u32,
-        offset: u32,
+        offset: u64,
    ) -> ApiResult<SearchGuildsResponse> {
-        let body = generated_types::SearchGuildsRequest {
-            limit: Some(
-                crate::api::generated::nonzero_u32(limit, "limit").map_err(ApiError::Parse)?,
-            ),
-            offset: Some(i64::from(offset)),
-            query: Some(query.to_owned()),
-        };
+        let limit = limit.to_string();
+        let offset = offset.to_string();
        let response = self
            .generated()
-            .search_guilds(&body)
+            .list_admin_guilds(Some(limit.as_str()), Some(offset.as_str()), Some(query))
            .await
            .map_err(|e| self.generated_error(e))?;
        search_guilds_response(response.into_inner())
    }

    pub async fn get_guild_by_id(&self, guild_id: &str) -> ApiResult<GuildInfo> {
-        let body = generated_types::LookupGuildRequest {
-            guild_id: snowflake(guild_id),
-        };
-        let response = self
-            .generated()
-            .lookup_guild(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        let resp: LookupGuildResponse = self.generated_value(response.into_inner())?;
-        resp.guild
+        self.lookup_guild(guild_id)
+            .await?
            .map(GuildInfo::from)
            .ok_or_else(|| super::client::ApiError::Http {
                status: 404,
@@ -51,12 +39,9 @@ impl AdminApiClient {
    }

    pub async fn lookup_guild(&self, guild_id: &str) -> ApiResult<Option<GuildDetailInfo>> {
-        let body = generated_types::LookupGuildRequest {
-            guild_id: snowflake(guild_id),
-        };
        let response = self
            .generated()
-            .lookup_guild(&body)
+            .get_admin_guild(&snowflake(guild_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: LookupGuildResponse = self.generated_value(response.into_inner())?;
@@ -69,26 +54,23 @@ impl AdminApiClient {
        add_features: &[String],
        remove_features: &[String],
    ) -> ApiResult<GuildUpdateResponse> {
-        let body = generated_types::UpdateGuildFeaturesRequest {
+        let body = generated_types::UpdateGuildRequest {
            add_features: guild_features(add_features),
-            guild_id: snowflake(guild_id),
            remove_features: guild_features(remove_features),
+            ..Default::default()
        };
        let response = self
            .generated()
-            .update_guild_features(&body)
+            .update_admin_guild(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }

    pub async fn delete_guild(&self, guild_id: &str) -> ApiResult<SuccessResponse> {
-        let body = generated_types::DeleteGuildRequest {
-            guild_id: snowflake(guild_id),
-        };
        let response = self
            .generated()
-            .admin_delete_guild(&body)
+            .delete_admin_guild(&snowflake(guild_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -99,13 +81,13 @@ impl AdminApiClient {
        guild_id: &str,
        new_owner_id: &str,
    ) -> ApiResult<GuildUpdateResponse> {
-        let body = generated_types::TransferGuildOwnershipRequest {
-            guild_id: snowflake(guild_id),
-            new_owner_id: snowflake(new_owner_id),
+        let body = generated_types::UpdateGuildRequest {
+            new_owner_id: Some(snowflake(new_owner_id)),
+            ..Default::default()
        };
        let response = self
            .generated()
-            .admin_transfer_guild_ownership(&body)
+            .update_admin_guild(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -115,45 +97,34 @@ impl AdminApiClient {
        &self,
        guild_id: &str,
        limit: u32,
-        offset: u32,
+        offset: u64,
    ) -> ApiResult<ListGuildMembersResponse> {
-        let body = generated_types::ListGuildMembersRequest {
-            guild_id: snowflake(guild_id),
-            limit: Some(
-                crate::api::generated::nonzero_u32(limit, "limit").map_err(ApiError::Parse)?,
-            ),
-            offset: Some(i64::from(offset)),
-        };
+        let limit = limit.to_string();
+        let offset = offset.to_string();
        let response = self
            .generated()
-            .admin_list_guild_members(&body)
+            .list_admin_guild_members(
+                &snowflake(guild_id),
+                Some(limit.as_str()),
+                Some(offset.as_str()),
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }

    pub async fn ban_guild_member(&self, guild_id: &str, user_id: &str) -> ApiResult<()> {
-        let body = generated_types::BanGuildMemberRequest {
-            ban_duration_seconds: None,
-            delete_message_days: None,
-            guild_id: snowflake(guild_id),
-            reason: None,
-            user_id: snowflake(user_id),
-        };
+        let body = generated_types::BanGuildMemberBody::default();
        self.generated()
-            .admin_ban_guild_member(&body)
+            .ban_admin_guild_member(&snowflake(guild_id), &snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
    }

    pub async fn kick_guild_member(&self, guild_id: &str, user_id: &str) -> ApiResult<()> {
-        let body = generated_types::KickGuildMemberRequest {
-            guild_id: snowflake(guild_id),
-            user_id: snowflake(user_id),
-        };
        self.generated()
-            .kick_guild_member(&body)
+            .kick_admin_guild_member(&snowflake(guild_id), &snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
@@ -165,21 +136,21 @@ impl AdminApiClient {
        limit: Option<u32>,
        before: Option<&str>,
    ) -> ApiResult<GuildAuditLogResponse> {
-        let body = generated_types::ListGuildAuditLogsRequest {
-            action_type: None,
-            after: None,
-            before: before.map(snowflake),
-            guild_id: snowflake(guild_id),
-            limit: limit
-                .map(i32::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?
-                .map(generated_types::Int32Type::from),
-            user_id: None,
-        };
+        let before = before.map(snowflake);
+        let limit = limit
+            .map(i32::try_from)
+            .transpose()
+            .map_err(|e| ApiError::Parse(e.to_string()))?;
        let response = self
            .generated()
-            .list_guild_audit_logs_admin(&body)
+            .list_admin_guild_audit_logs(
+                &snowflake(guild_id),
+                None,
+                None,
+                before.as_ref(),
+                limit,
+                None,
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -188,15 +159,15 @@ impl AdminApiClient {
    pub async fn clear_guild_fields(&self, guild_id: &str, fields: &[String]) -> ApiResult<()> {
        let fields = fields
            .iter()
-            .map(generated_types::ClearGuildFieldsRequestFieldsItem::try_from)
+            .map(|field| generated_types::UpdateGuildRequestFieldsItem::try_from(field.as_str()))
            .collect::<Result<Vec<_>, _>>()
            .map_err(|e| ApiError::Parse(e.to_string()))?;
-        let body = generated_types::ClearGuildFieldsRequest {
+        let body = generated_types::UpdateGuildRequest {
            fields,
-            guild_id: snowflake(guild_id),
+            ..Default::default()
        };
        self.generated()
-            .clear_guild_fields(&body)
+            .update_admin_guild(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
@@ -207,10 +178,10 @@ impl AdminApiClient {
        guild_id: &str,
        settings: &serde_json::Value,
    ) -> ApiResult<GuildUpdateResponse> {
-        let body = guild_settings_request(guild_id, settings)?;
+        let body = guild_settings_request(settings)?;
        let response = self
            .generated()
-            .update_guild_settings(&body)
+            .update_admin_guild(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        guild_update_response(response.into_inner())
@@ -221,13 +192,13 @@ impl AdminApiClient {
        guild_id: &str,
        name: &str,
    ) -> ApiResult<GuildUpdateResponse> {
-        let body = generated_types::UpdateGuildNameRequest {
-            guild_id: snowflake(guild_id),
-            name: name.to_owned(),
+        let body = generated_types::UpdateGuildRequest {
+            name: Some(name.to_owned()),
+            ..Default::default()
        };
        let response = self
            .generated()
-            .update_guild_name(&body)
+            .update_admin_guild(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -238,37 +209,27 @@ impl AdminApiClient {
        guild_id: &str,
        vanity: Option<&str>,
    ) -> ApiResult<GuildUpdateResponse> {
-        let body = generated_types::UpdateGuildVanityRequest {
-            guild_id: snowflake(guild_id),
-            vanity_url_code: vanity.map(std::borrow::ToOwned::to_owned),
-        };
-        let response = self
-            .generated()
-            .update_guild_vanity(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        let body = serde_json::json!({"vanity_url_code": vanity});
+        self.patch(
+            &format!("/admin/guilds/{}", urlencoding::encode(guild_id)),
+            Some(&body),
+        )
+        .await
    }

    pub async fn reload_guild(&self, guild_id: &str) -> ApiResult<SuccessResponse> {
-        let body = generated_types::ReloadGuildRequest {
-            guild_id: snowflake(guild_id),
-        };
        let response = self
            .generated()
-            .reload_guild(&body)
+            .create_admin_guild_reload(&snowflake(guild_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }

    pub async fn shutdown_guild(&self, guild_id: &str) -> ApiResult<SuccessResponse> {
-        let body = generated_types::ShutdownGuildRequest {
-            guild_id: snowflake(guild_id),
-        };
        let response = self
            .generated()
-            .shutdown_guild(&body)
+            .create_admin_guild_shutdown(&snowflake(guild_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -279,13 +240,9 @@ impl AdminApiClient {
        user_id: &str,
        guild_id: &str,
    ) -> ApiResult<SuccessResponse> {
-        let body = generated_types::ForceAddUserToGuildRequest {
-            guild_id: snowflake(guild_id),
-            user_id: snowflake(user_id),
-        };
        let response = self
            .generated()
-            .force_add_user_to_guild(&body)
+            .add_admin_guild_member(&snowflake(guild_id), &snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -295,55 +252,29 @@ impl AdminApiClient {
        &self,
        guild_id: &str,
        limit: u32,
-        offset: u32,
+        offset: u64,
    ) -> ApiResult<SearchReportsResponse> {
-        let body = generated_types::SearchReportsRequest {
-            category: None,
-            guild_context_id: None,
-            limit: Some(
-                crate::api::generated::nonzero_u32(limit, "limit").map_err(ApiError::Parse)?,
-            ),
-            offset: Some(i64::from(offset)),
-            query: None,
-            report_type: None,
-            reported_channel_id: None,
-            reported_guild_id: Some(snowflake(guild_id)),
-            reported_user_id: None,
-            reporter_id: None,
-            resolved_by_admin_id: None,
-            sort_by: None,
-            sort_order: None,
-            status: None,
-        };
-        let response = self
-            .generated()
-            .search_reports(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        let response = response.into_inner();
-        Ok(SearchReportsResponse {
-            reports: self.generated_value(response.reports)?,
-            total: crate::api::generated::number_to_u64(response.total, "total")
-                .map_err(ApiError::Parse)?,
-            offset: crate::api::generated::number_to_u64(response.offset, "offset")
-                .map_err(ApiError::Parse)?,
-            limit: crate::api::generated::number_to_u64(response.limit, "limit")
-                .map_err(ApiError::Parse)?,
+        self.search_reports(&SearchReportsParams {
+            reported_guild_id: Some(guild_id),
+            limit,
+            offset,
+            ..Default::default()
        })
+        .await
    }
 }

 #[derive(Deserialize)]
 struct GuildSettingsPatch {
-    content_warning_level: Option<generated_types::ContentWarningLevel>,
+    content_warning_level: Option<generated_types::ContentWarningLevelInput>,
    content_warning_text: Option<String>,
-    default_message_notifications: Option<generated_types::DefaultMessageNotifications>,
+    default_message_notifications: Option<generated_types::DefaultMessageNotificationsInput>,
    disabled_operations: Option<generated_types::GuildOperations>,
-    explicit_content_filter: Option<generated_types::GuildExplicitContentFilter>,
-    mfa_level: Option<generated_types::GuildMfaLevel>,
+    explicit_content_filter: Option<generated_types::GuildExplicitContentFilterInput>,
+    mfa_level: Option<generated_types::GuildMfaLevelInput>,
    nsfw: Option<bool>,
-    nsfw_level: Option<generated_types::NsfwLevel>,
-    verification_level: Option<generated_types::GuildVerificationLevel>,
+    nsfw_level: Option<generated_types::NsfwLevelInput>,
+    verification_level: Option<generated_types::GuildVerificationLevelInput>,
 }

 fn search_guilds_response(
@@ -371,7 +302,7 @@ fn guild_admin_response(response: generated_types::GuildAdminResponse) -> ApiRes
        owner_global_name: response.owner_global_name,
        owner_discriminator: response.owner_discriminator,
        member_count: crate::api::generated::i64_to_u64(
-            i64::from(response.member_count),
+            i64::from(i32::from(response.member_count)),
            "member_count",
        )
        .map_err(ApiError::Parse)?,
@@ -379,7 +310,7 @@ fn guild_admin_response(response: generated_types::GuildAdminResponse) -> ApiRes
        nsfw_level: response.nsfw_level.map(i32::from),
        nsfw: response.nsfw,
        content_warning_level: response.content_warning_level.map(i32::from),
-        content_warning_text: response.content_warning_text,
+        content_warning_text: response.content_warning_text.map(String::from),
        description: None,
        vanity_url_code: None,
    })
@@ -392,9 +323,9 @@ fn guild_update_response(
    Ok(GuildUpdateResponse {
        guild: GuildInfo {
            id: String::from(guild.id),
-            name: guild.name,
-            icon: guild.icon,
-            banner: guild.banner,
+            name: String::from(guild.name),
+            icon: guild.icon.map(String::from),
+            banner: guild.banner.map(String::from),
            owner_id: String::from(guild.owner_id),
            owner_username: None,
            owner_global_name: None,
@@ -404,11 +335,11 @@ fn guild_update_response(
                "member_count",
            )
            .map_err(ApiError::Parse)?,
-            features: guild.features,
+            features: guild.features.into_iter().map(String::from).collect(),
            nsfw_level: guild.nsfw_level.map(i32::from),
            nsfw: guild.nsfw,
            content_warning_level: guild.content_warning_level.map(i32::from),
-            content_warning_text: guild.content_warning_text,
+            content_warning_text: guild.content_warning_text.map(String::from),
            description: None,
            vanity_url_code: None,
        },
@@ -416,29 +347,24 @@ fn guild_update_response(
 }

 fn guild_settings_request(
-    guild_id: &str,
    settings: &serde_json::Value,
-) -> ApiResult<generated_types::UpdateGuildSettingsRequest> {
+) -> ApiResult<generated_types::UpdateGuildRequest> {
    let patch = serde_json::from_value::<GuildSettingsPatch>(settings.clone())
        .map_err(|e| ApiError::Parse(e.to_string()))?;
-    Ok(generated_types::UpdateGuildSettingsRequest {
+    Ok(generated_types::UpdateGuildRequest {
        content_warning_level: patch.content_warning_level,
        content_warning_text: patch.content_warning_text,
        default_message_notifications: patch.default_message_notifications,
        disabled_operations: patch.disabled_operations,
        explicit_content_filter: patch.explicit_content_filter,
-        guild_id: snowflake(guild_id),
        mfa_level: patch.mfa_level,
        nsfw: patch.nsfw,
        nsfw_level: patch.nsfw_level,
        verification_level: patch.verification_level,
+        ..Default::default()
    })
 }

-fn snowflake(value: &str) -> generated_types::SnowflakeType {
-    generated_types::SnowflakeType::from(value.to_owned())
-}
-
 fn guild_features(values: &[String]) -> Vec<generated_types::GuildFeatureSchema> {
    values
        .iter()
@@ -458,9 +384,8 @@ mod tests {
            "nsfw": true,
            "verification_level": 2,
        });
-        let request = guild_settings_request("123", &settings).unwrap();
+        let request = guild_settings_request(&settings).unwrap();
        let json = serde_json::to_value(request).unwrap();
-        assert_eq!(json["guild_id"], "123");
        assert_eq!(json["disabled_operations"], 5);
        assert_eq!(json["nsfw"], true);
        assert_eq!(json["verification_level"], 2);
@@ -4,19 +4,18 @@ use super::client::{AdminApiClient, ApiResult};
 use super::types::{
    CreateRegistrationUrlRequest, CreateRegistrationUrlResponse, InstanceConfigResponse,
    InstanceConfigUpdateRequest, InstanceEmailSmtpTestRequest, InstanceEmailSmtpTestResponse,
-    PendingRegistrationActionRequest, RegistrationUrlActionRequest,
 };

 impl AdminApiClient {
    pub async fn get_instance_config(&self) -> ApiResult<InstanceConfigResponse> {
-        self.post("/admin/instance-config/get", None).await
+        self.get("/admin/instance/config", None).await
    }

    pub async fn update_instance_config(
        &self,
        update: &InstanceConfigUpdateRequest,
    ) -> ApiResult<InstanceConfigResponse> {
-        self.post_typed("/admin/instance-config/update", update)
+        self.patch_typed_with_reason("/admin/instance/config", update, None)
            .await
    }

@@ -24,7 +23,7 @@ impl AdminApiClient {
        &self,
        request: &InstanceEmailSmtpTestRequest,
    ) -> ApiResult<InstanceEmailSmtpTestResponse> {
-        self.post_typed("/admin/instance-config/integrations/smtp/test", request)
+        self.post_typed("/admin/instance/config/smtp-tests", request)
            .await
    }

@@ -32,40 +31,49 @@ impl AdminApiClient {
        &self,
        request: &CreateRegistrationUrlRequest,
    ) -> ApiResult<CreateRegistrationUrlResponse> {
-        self.post_typed("/admin/instance-config/registration-urls/create", request)
+        self.post_typed("/admin/instance/registration-urls", request)
            .await
    }

    pub async fn revoke_registration_url(&self, id: &str) -> ApiResult<InstanceConfigResponse> {
-        let request = RegistrationUrlActionRequest { id: id.to_owned() };
-        self.post_typed("/admin/instance-config/registration-urls/revoke", &request)
-            .await
+        self.delete_with_reason(
+            &format!(
+                "/admin/instance/registration-urls/{}",
+                urlencoding::encode(id)
+            ),
+            None,
+            None,
+        )
+        .await
    }

    pub async fn approve_pending_registration(
        &self,
        user_id: &str,
    ) -> ApiResult<InstanceConfigResponse> {
-        let request = PendingRegistrationActionRequest {
-            user_id: user_id.to_owned(),
-        };
-        self.post_typed(
-            "/admin/instance-config/pending-registrations/approve",
-            &request,
-        )
-        .await
+        self.decide_pending_registration(user_id, "approved").await
    }

    pub async fn reject_pending_registration(
        &self,
        user_id: &str,
    ) -> ApiResult<InstanceConfigResponse> {
-        let request = PendingRegistrationActionRequest {
-            user_id: user_id.to_owned(),
-        };
-        self.post_typed(
-            "/admin/instance-config/pending-registrations/reject",
-            &request,
+        self.decide_pending_registration(user_id, "rejected").await
+    }
+
+    async fn decide_pending_registration(
+        &self,
+        user_id: &str,
+        status: &str,
+    ) -> ApiResult<InstanceConfigResponse> {
+        let body = serde_json::json!({"status": status});
+        self.patch_with_reason(
+            &format!(
+                "/admin/instance/pending-registrations/{}",
+                urlencoding::encode(user_id)
+            ),
+            Some(&body),
+            None,
        )
        .await
    }
@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::snowflake;

-use super::client::{AdminApiClient, ApiError, ApiResult};
+use super::client::{AdminApiClient, ApiResult};
 use super::types::{ActiveJobsResponse, CancelJobResponse, GetJobResponse, ListJobsResponse};

 pub struct ListJobsParams {
@@ -16,51 +16,32 @@ pub struct ListJobsParams {

 impl AdminApiClient {
    pub async fn list_jobs(&self, params: &ListJobsParams) -> ApiResult<ListJobsResponse> {
-        let cursor = params
-            .cursor
-            .clone()
-            .map(serde_json::from_value::<generated_types::ListJobsRequestCursor>)
-            .transpose()
-            .map_err(|e| ApiError::Parse(e.to_string()))?;
-        let status = params
-            .status
-            .as_deref()
-            .map(generated_types::ListJobsRequestStatus::try_from)
-            .transpose()
-            .map_err(|e| ApiError::Parse(e.to_string()))?;
-        let body = generated_types::ListJobsRequest {
-            cursor,
-            limit: Some(
-                crate::api::generated::nonzero_u32(params.limit, "limit")
-                    .map_err(ApiError::Parse)?,
+        let cursor = params.cursor.as_ref();
+        let cursor_bucket_day = cursor_field(cursor, "bucket_day");
+        let cursor_created_at = cursor_field(cursor, "created_at");
+        let cursor_job_id = cursor_field(cursor, "job_id");
+        let limit = params.limit.to_string();
+        let max_lookback_days = params.max_lookback_days.to_string();
+        let query_params = [
+            ("limit", limit.as_str()),
+            ("cursor_bucket_day", cursor_bucket_day),
+            ("cursor_created_at", cursor_created_at),
+            ("cursor_job_id", cursor_job_id),
+            ("max_lookback_days", max_lookback_days.as_str()),
+            ("status", params.status.as_deref().unwrap_or_default()),
+            ("task_type", params.task_type.as_deref().unwrap_or_default()),
+            (
+                "requested_by_user_id",
+                params.requested_by_user_id.as_deref().unwrap_or_default(),
            ),
-            max_lookback_days: Some(
-                crate::api::generated::nonzero_u32(params.max_lookback_days, "max_lookback_days")
-                    .map_err(ApiError::Parse)?,
-            ),
-            requested_by_user_id: params
-                .requested_by_user_id
-                .as_ref()
-                .cloned()
-                .map(generated_types::SnowflakeType::from),
-            status,
-            task_type: params.task_type.clone(),
-        };
-        let response = self
-            .generated()
-            .list_jobs(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        ];
+        self.get("/admin/jobs", Some(&query_params)).await
    }

    pub async fn get_job(&self, job_id: &str) -> ApiResult<GetJobResponse> {
-        let body = generated_types::GetJobRequest {
-            job_id: generated_types::SnowflakeType::from(job_id.to_owned()),
-        };
        let response = self
            .generated()
-            .get_job(&body)
+            .get_admin_job(&snowflake(job_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -71,19 +52,27 @@ impl AdminApiClient {
        job_id: &str,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<CancelJobResponse> {
-        let body = generated_types::CancelJobRequest {
-            job_id: generated_types::SnowflakeType::from(job_id.to_owned()),
-        };
-        self.post_typed_with_reason("/admin/jobs/cancel", &body, audit_log_reason)
-            .await
+        self.put_with_reason(
+            &format!("/admin/jobs/{}/cancellation", urlencoding::encode(job_id)),
+            None,
+            audit_log_reason,
+        )
+        .await
    }

    pub async fn list_active_jobs(&self) -> ApiResult<ActiveJobsResponse> {
        let response = self
            .generated()
-            .list_active_jobs()
+            .list_admin_active_jobs()
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }
 }
+
+fn cursor_field<'a>(cursor: Option<&'a serde_json::Value>, field: &str) -> &'a str {
+    cursor
+        .and_then(|cursor| cursor.get(field))
+        .and_then(serde_json::Value::as_str)
+        .unwrap_or_default()
+}
@@ -5,14 +5,14 @@ use super::types::{LimitConfigResponse, LimitConfigUpdateRequest};

 impl AdminApiClient {
    pub async fn get_limit_config(&self) -> ApiResult<LimitConfigResponse> {
-        self.post("/admin/limit-config/get", Some(&serde_json::json!({})))
-            .await
+        self.get("/admin/limit-config", None).await
    }

    pub async fn update_limit_config(
        &self,
        request: &LimitConfigUpdateRequest,
    ) -> ApiResult<LimitConfigResponse> {
-        self.post_typed("/admin/limit-config/update", request).await
+        self.put_typed_with_reason("/admin/limit-config", request, None)
+            .await
    }
 }
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{
@@ -16,12 +16,16 @@ impl AdminApiClient {
        message_id: &str,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<()> {
-        let body = generated_types::DeleteMessageRequest {
-            channel_id: snowflake(channel_id),
-            message_id: snowflake(message_id),
-        };
        let _: serde_json::Value = self
-            .post_typed_with_reason("/admin/messages/delete", &body, audit_log_reason)
+            .delete_with_reason(
+                &format!(
+                    "/admin/channels/{}/messages/{}",
+                    urlencoding::encode(channel_id),
+                    urlencoding::encode(message_id)
+                ),
+                None,
+                audit_log_reason,
+            )
            .await?;
        Ok(())
    }
@@ -39,7 +43,8 @@ impl AdminApiClient {
            attachment_id: snowflake(attachment_id),
            channel_id: snowflake(channel_id),
            confirmed_viewed: true,
-            filename: filename.to_owned(),
+            filename: generated_types::ReportAttachmentToNcmecRequestFilename::try_from(filename)
+                .map_err(|e| ApiError::Parse(e.to_string()))?,
            message_id: snowflake(message_id),
            reporter_full_name:
                generated_types::ReportAttachmentToNcmecRequestReporterFullName::try_from(
@@ -50,7 +55,7 @@ impl AdminApiClient {
        };
        let response = self
            .generated()
-            .report_message_attachment_to_ncmec(&body)
+            .create_admin_ncmec_report(&body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -62,17 +67,14 @@ impl AdminApiClient {
        message_id: &str,
        context_limit: u32,
    ) -> ApiResult<LookupMessageResponse> {
-        let body = generated_types::LookupMessageRequest {
-            channel_id: snowflake(channel_id),
-            context_limit: Some(
-                crate::api::generated::nonzero_u32(context_limit, "context_limit")
-                    .map_err(ApiError::Parse)?,
-            ),
-            message_id: snowflake(message_id),
-        };
+        let context_limit = context_limit.to_string();
        let response = self
            .generated()
-            .lookup_message(&body)
+            .get_admin_message(
+                &snowflake(channel_id),
+                &snowflake(message_id),
+                Some(context_limit.as_str()),
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -86,16 +88,13 @@ impl AdminApiClient {
        let entries = entries
            .iter()
            .cloned()
-            .map(serde_json::from_value::<generated_types::MessageShredRequestEntriesItem>)
+            .map(serde_json::from_value::<generated_types::AdminUserMessageShredRequestEntriesItem>)
            .collect::<Result<Vec<_>, _>>()
            .map_err(|e| ApiError::Parse(e.to_string()))?;
-        let body = generated_types::MessageShredRequest {
-            entries,
-            user_id: snowflake(user_id),
-        };
+        let body = generated_types::AdminUserMessageShredRequest { entries };
        let response = self
            .generated()
-            .queue_message_shred(&body)
+            .shred_admin_user_messages(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -106,13 +105,10 @@ impl AdminApiClient {
        user_id: &str,
        dry_run: bool,
    ) -> ApiResult<DeleteAllUserMessagesResponse> {
-        let body = generated_types::DeleteAllUserMessagesRequest {
-            dry_run: Some(dry_run),
-            user_id: snowflake(user_id),
-        };
+        let dry_run = if dry_run { "true" } else { "false" };
        let response = self
            .generated()
-            .delete_all_user_messages(&body)
+            .delete_admin_user_messages(&snowflake(user_id), Some(dry_run))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -122,12 +118,9 @@ impl AdminApiClient {
        &self,
        job_id: &str,
    ) -> ApiResult<MessageShredStatusResponse> {
-        let body = generated_types::MessageShredStatusRequest {
-            job_id: job_id.to_owned(),
-        };
        let response = self
            .generated()
-            .get_message_shred_status(&body)
+            .get_admin_message_shred(&snowflake(job_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -140,18 +133,20 @@ impl AdminApiClient {
        filename: &str,
        context_limit: u32,
    ) -> ApiResult<LookupMessageResponse> {
-        let body = generated_types::LookupMessageByAttachmentRequest {
-            attachment_id: snowflake(attachment_id),
-            channel_id: snowflake(channel_id),
-            context_limit: Some(
-                crate::api::generated::nonzero_u32(context_limit, "context_limit")
-                    .map_err(ApiError::Parse)?,
-            ),
-            filename: filename.to_owned(),
-        };
+        let context_limit = context_limit.to_string();
+        let filename = generated_types::SearchAdminMessagesFilename::try_from(filename)
+            .map_err(|e| ApiError::Parse(e.to_string()))?;
        let response = self
            .generated()
-            .lookup_message_by_attachment(&body)
+            .search_admin_messages(
+                Some(&snowflake(attachment_id)),
+                &snowflake(channel_id),
+                Some(context_limit.as_str()),
+                Some(&filename),
+                None,
+                None,
+                None,
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -164,18 +159,17 @@ impl AdminApiClient {
        after: Option<&str>,
        limit: Option<u32>,
    ) -> ApiResult<BrowseChannelResponse> {
-        let body = generated_types::BrowseChannelRequest {
-            after: after.map(snowflake),
-            before: before.map(snowflake),
-            channel_id: snowflake(channel_id),
-            limit: limit
-                .map(|value| crate::api::generated::nonzero_u32(value, "limit"))
-                .transpose()
-                .map_err(ApiError::Parse)?,
-        };
+        let after = after.map(snowflake);
+        let before = before.map(snowflake);
+        let limit = limit.map(|value| value.to_string());
        let response = self
            .generated()
-            .browse_channel_messages(&body)
+            .list_admin_channel_messages(
+                &snowflake(channel_id),
+                after.as_ref(),
+                before.as_ref(),
+                limit.as_deref(),
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -187,24 +181,20 @@ impl AdminApiClient {
        query: &str,
        limit: Option<u32>,
    ) -> ApiResult<SearchChannelMessagesResponse> {
-        let body = generated_types::SearchChannelMessagesRequest {
-            channel_id: snowflake(channel_id),
-            limit: limit
-                .map(|value| crate::api::generated::nonzero_u32(value, "limit"))
-                .transpose()
-                .map_err(ApiError::Parse)?,
-            query: generated_types::SearchChannelMessagesRequestQuery::try_from(query)
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-        };
+        let limit = limit.map(|value| value.to_string());
        let response = self
            .generated()
-            .search_channel_messages(&body)
+            .search_admin_messages(
+                None,
+                &snowflake(channel_id),
+                None,
+                None,
+                limit.as_deref(),
+                None,
+                Some(query),
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }
 }
-
-fn snowflake(value: &str) -> generated_types::SnowflakeType {
-    generated_types::SnowflakeType::from(value.to_owned())
-}
@@ -8,7 +8,6 @@ pub mod archives;
 pub mod assets;
 pub mod audit;
 pub mod bans;
-pub mod billing;
 pub mod bulk;
 pub mod client;
 pub mod codes;
@@ -1,12 +1,30 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::snowflake;

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{
    ListReportsResponse, ReportEntry, ResolveReportResponse, SearchReportsResponse,
 };

+#[derive(Default)]
+pub struct SearchReportsParams<'a> {
+    pub query: Option<&'a str>,
+    pub status: Option<i32>,
+    pub report_type: Option<i32>,
+    pub category: Option<&'a str>,
+    pub reporter_id: Option<&'a str>,
+    pub reported_user_id: Option<&'a str>,
+    pub reported_guild_id: Option<&'a str>,
+    pub reported_channel_id: Option<&'a str>,
+    pub guild_context_id: Option<&'a str>,
+    pub resolved_by_admin_id: Option<&'a str>,
+    pub sort_by: Option<&'a str>,
+    pub sort_order: Option<&'a str>,
+    pub limit: u32,
+    pub offset: u64,
+}
+
 impl AdminApiClient {
    pub async fn list_reports(
        &self,
@@ -14,28 +32,21 @@ impl AdminApiClient {
        limit: u32,
        offset: Option<u32>,
    ) -> ApiResult<ListReportsResponse> {
-        let body = generated_types::ListReportsRequest {
-            limit: Some(
-                crate::api::generated::nonzero_u32(limit, "limit").map_err(ApiError::Parse)?,
-            ),
-            offset: offset.map(i64::from),
-            status: status
-                .map(generated_types::ReportStatus::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-        };
-        let response = self
-            .generated()
-            .list_reports(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        let status = status.map(report_status).transpose()?.unwrap_or_default();
+        let limit = limit.to_string();
+        let offset = offset.map(|value| value.to_string()).unwrap_or_default();
+        let query_params = [
+            ("status", status),
+            ("limit", limit.as_str()),
+            ("offset", offset.as_str()),
+        ];
+        self.get("/admin/reports", Some(&query_params)).await
    }

    pub async fn get_report(&self, report_id: &str) -> ApiResult<ReportEntry> {
        let response = self
            .generated()
-            .get_report(report_id)
+            .get_admin_report(&snowflake(report_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -47,98 +58,85 @@ impl AdminApiClient {
        public_comment: Option<&str>,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<ResolveReportResponse> {
-        let body = generated_types::ResolveReportRequest {
-            public_comment: public_comment.map(std::borrow::ToOwned::to_owned),
-            report_id: generated_types::SnowflakeType::from(report_id.to_owned()),
-        };
-        self.post_typed_with_reason("/admin/reports/resolve", &body, audit_log_reason)
-            .await
+        let mut body = serde_json::json!({"status": "resolved"});
+        if let Some(public_comment) = public_comment {
+            body["public_comment"] = serde_json::Value::from(public_comment);
+        }
+        self.patch_with_reason(
+            &format!("/admin/reports/{}", urlencoding::encode(report_id)),
+            Some(&body),
+            audit_log_reason,
+        )
+        .await
    }

-    #[allow(clippy::too_many_arguments)]
    pub async fn search_reports(
        &self,
-        query: Option<&str>,
-        status: Option<i32>,
-        report_type: Option<i32>,
-        category: Option<&str>,
-        reporter_id: Option<&str>,
-        reported_user_id: Option<&str>,
-        reported_guild_id: Option<&str>,
-        reported_channel_id: Option<&str>,
-        guild_context_id: Option<&str>,
-        resolved_by_admin_id: Option<&str>,
-        sort_by: Option<&str>,
-        sort_order: Option<&str>,
-        limit: u32,
-        offset: u32,
+        params: &SearchReportsParams<'_>,
    ) -> ApiResult<SearchReportsResponse> {
-        let body = generated_types::SearchReportsRequest {
-            category: nonempty_string(category),
-            guild_context_id: nonempty_snowflake(guild_context_id),
-            limit: Some(
-                crate::api::generated::nonzero_u32(limit, "limit").map_err(ApiError::Parse)?,
+        let status = params
+            .status
+            .map(report_status)
+            .transpose()?
+            .unwrap_or_default();
+        let report_type = params
+            .report_type
+            .map(report_type_name)
+            .transpose()?
+            .unwrap_or_default();
+        let sort_by = params
+            .sort_by
+            .map(report_sort_by)
+            .transpose()?
+            .unwrap_or_default();
+        let limit = params.limit.to_string();
+        let offset = params.offset.to_string();
+        let query_params = [
+            ("q", params.query.unwrap_or_default()),
+            ("status", status),
+            ("report_type", report_type),
+            ("category", params.category.unwrap_or_default()),
+            ("reporter_id", params.reporter_id.unwrap_or_default()),
+            (
+                "reported_user_id",
+                params.reported_user_id.unwrap_or_default(),
            ),
-            offset: Some(i64::from(offset)),
-            query: nonempty_string(query),
-            report_type: report_type
-                .map(generated_types::ReportType::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-            reported_channel_id: nonempty_snowflake(reported_channel_id),
-            reported_guild_id: nonempty_snowflake(reported_guild_id),
-            reported_user_id: nonempty_snowflake(reported_user_id),
-            reporter_id: nonempty_snowflake(reporter_id),
-            resolved_by_admin_id: nonempty_snowflake(resolved_by_admin_id),
-            sort_by: sort_by
-                .map(generated_types::SearchReportsRequestSortBy::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-            sort_order: sort_order
-                .map(generated_types::SearchReportsRequestSortOrder::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-            status: status
-                .map(generated_types::ReportStatus::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-        };
-        let response = self
-            .generated()
-            .search_reports(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        let response = response.into_inner();
-        Ok(SearchReportsResponse {
-            reports: self.generated_value(response.reports)?,
-            total: response.total as u64,
-            offset: response.offset as u64,
-            limit: response.limit as u64,
-        })
+            (
+                "reported_guild_id",
+                params.reported_guild_id.unwrap_or_default(),
+            ),
+            (
+                "reported_channel_id",
+                params.reported_channel_id.unwrap_or_default(),
+            ),
+            (
+                "guild_context_id",
+                params.guild_context_id.unwrap_or_default(),
+            ),
+            (
+                "resolved_by_admin_id",
+                params.resolved_by_admin_id.unwrap_or_default(),
+            ),
+            ("sort_by", sort_by),
+            ("sort_order", params.sort_order.unwrap_or_default()),
+            ("limit", limit.as_str()),
+            ("offset", offset.as_str()),
+        ];
+        self.get("/admin/reports", Some(&query_params)).await
    }

    pub async fn search_reports_by_reporter(
        &self,
        reporter_id: &str,
        limit: u32,
-        offset: u32,
+        offset: u64,
    ) -> ApiResult<SearchReportsResponse> {
-        self.search_reports(
-            None,
-            None,
-            None,
-            None,
-            Some(reporter_id),
-            None,
-            None,
-            None,
-            None,
-            None,
-            None,
-            None,
+        self.search_reports(&SearchReportsParams {
+            reporter_id: Some(reporter_id),
            limit,
            offset,
-        )
+            ..Default::default()
+        })
        .await
    }

@@ -146,34 +144,100 @@ impl AdminApiClient {
        &self,
        reported_user_id: &str,
        limit: u32,
-        offset: u32,
+        offset: u64,
    ) -> ApiResult<SearchReportsResponse> {
-        self.search_reports(
-            None,
-            None,
-            None,
-            None,
-            None,
-            Some(reported_user_id),
-            None,
-            None,
-            None,
-            None,
-            None,
-            None,
+        self.search_reports(&SearchReportsParams {
+            reported_user_id: Some(reported_user_id),
            limit,
            offset,
-        )
+            ..Default::default()
+        })
        .await
    }
 }

-fn nonempty_string(value: Option<&str>) -> Option<String> {
-    value
-        .filter(|value| !value.is_empty())
-        .map(std::borrow::ToOwned::to_owned)
+fn report_status(value: i32) -> ApiResult<&'static str> {
+    match value {
+        0 => Ok("pending"),
+        1 => Ok("resolved"),
+        other => Err(ApiError::Parse(format!("unknown report status: {other}"))),
+    }
 }

-fn nonempty_snowflake(value: Option<&str>) -> Option<generated_types::SnowflakeType> {
-    nonempty_string(value).map(generated_types::SnowflakeType::from)
+fn report_type_name(value: i32) -> ApiResult<&'static str> {
+    match value {
+        0 => Ok("message"),
+        1 => Ok("user"),
+        2 => Ok("guild"),
+        other => Err(ApiError::Parse(format!("unknown report type: {other}"))),
+    }
+}
+
+fn report_sort_by(value: &str) -> ApiResult<&'static str> {
+    match value {
+        "created_at" | "createdAt" => Ok("created_at"),
+        "reported_at" | "reportedAt" => Ok("reported_at"),
+        "resolved_at" | "resolvedAt" => Ok("resolved_at"),
+        other => Err(ApiError::Parse(format!(
+            "unknown report sort field: {other}"
+        ))),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn report_statuses_preserve_the_closed_wire_mapping() {
+        for (value, expected) in [(0, "pending"), (1, "resolved")] {
+            assert_eq!(report_status(value).expect("supported status"), expected);
+        }
+        for value in [-1, 2] {
+            assert_eq!(
+                report_status(value)
+                    .expect_err("unknown status")
+                    .to_string(),
+                format!("parse error: unknown report status: {value}")
+            );
+        }
+    }
+
+    #[test]
+    fn report_types_preserve_the_closed_wire_mapping() {
+        for (value, expected) in [(0, "message"), (1, "user"), (2, "guild")] {
+            assert_eq!(report_type_name(value).expect("supported type"), expected);
+        }
+        for value in [-1, 3] {
+            assert_eq!(
+                report_type_name(value)
+                    .expect_err("unknown type")
+                    .to_string(),
+                format!("parse error: unknown report type: {value}")
+            );
+        }
+    }
+
+    #[test]
+    fn report_sort_fields_accept_only_the_existing_aliases() {
+        for (field, expected) in [
+            ("createdAt", "created_at"),
+            ("created_at", "created_at"),
+            ("reportedAt", "reported_at"),
+            ("reported_at", "reported_at"),
+            ("resolvedAt", "resolved_at"),
+            ("resolved_at", "resolved_at"),
+        ] {
+            assert_eq!(
+                report_sort_by(field).expect("supported sort field"),
+                expected
+            );
+        }
+        assert_eq!(
+            report_sort_by("unknown")
+                .expect_err("unknown sort field")
+                .to_string(),
+            "parse error: unknown report sort field: unknown"
+        );
+    }
 }
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{IndexRefreshStatusResponse, RefreshSearchIndexResponse};
@@ -11,15 +11,16 @@ impl AdminApiClient {
        index_type: &str,
        guild_id: Option<&str>,
    ) -> ApiResult<RefreshSearchIndexResponse> {
+        let index_type =
+            generated_types::CreateAdminSearchIndexRefreshIndexName::try_from(index_type)
+                .map_err(|e| ApiError::Parse(e.to_string()))?;
        let body = generated_types::RefreshSearchIndexRequest {
-            guild_id: guild_id.map(|id| generated_types::SnowflakeType::from(id.to_owned())),
-            index_type: generated_types::RefreshSearchIndexRequestIndexType::try_from(index_type)
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
+            guild_id: guild_id.map(snowflake),
            user_id: None,
        };
        let response = self
            .generated()
-            .refresh_search_index(&body)
+            .create_admin_search_index_refresh(index_type, &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -29,14 +30,90 @@ impl AdminApiClient {
        &self,
        job_id: &str,
    ) -> ApiResult<IndexRefreshStatusResponse> {
-        let body = generated_types::GetIndexRefreshStatusRequest {
-            job_id: job_id.to_owned(),
-        };
        let response = self
            .generated()
-            .get_search_index_refresh_status(&body)
+            .get_admin_search_index_refresh(job_id)
            .await
            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        index_refresh_status(response.into_inner())
+    }
+}
+
+fn index_refresh_status(
+    response: generated_types::IndexRefreshStatusResponse,
+) -> ApiResult<IndexRefreshStatusResponse> {
+    match response {
+        generated_types::IndexRefreshStatusResponse::Variant0 { status } => {
+            Ok(IndexRefreshStatusResponse::NotFound {
+                status: status.to_string(),
+            })
+        }
+        generated_types::IndexRefreshStatusResponse::Variant1 {
+            status,
+            index_type,
+            total,
+            indexed,
+            started_at,
+            completed_at,
+            failed_at,
+            error,
+        } => Ok(IndexRefreshStatusResponse::Progress {
+            status: status.to_string(),
+            index_type: Some(index_type),
+            total: total
+                .map(|value| float_to_u64(value, "total"))
+                .transpose()?,
+            indexed: indexed
+                .map(|value| float_to_u64(value, "indexed"))
+                .transpose()?,
+            started_at,
+            completed_at,
+            failed_at,
+            error,
+        }),
+    }
+}
+
+fn float_to_u64(value: f64, field: &str) -> ApiResult<u64> {
+    crate::api::generated::number_to_u64(value, field).map_err(ApiError::Parse)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn maps_a_running_refresh_to_progress() {
+        let json = r#"{"status":"in_progress","index_type":"users","total":50000,"indexed":1200,"started_at":"2026-09-06T00:00:00Z"}"#;
+        let response: generated_types::IndexRefreshStatusResponse =
+            serde_json::from_str(json).unwrap();
+        match index_refresh_status(response).unwrap() {
+            IndexRefreshStatusResponse::Progress {
+                status,
+                index_type,
+                total,
+                indexed,
+                started_at,
+                ..
+            } => {
+                assert_eq!(status, "in_progress");
+                assert_eq!(index_type.as_deref(), Some("users"));
+                assert_eq!(total, Some(50_000));
+                assert_eq!(indexed, Some(1_200));
+                assert_eq!(started_at.as_deref(), Some("2026-09-06T00:00:00Z"));
+            }
+            other => panic!("expected a progress status, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn maps_a_missing_refresh_to_not_found() {
+        let json = r#"{"status":"not_found"}"#;
+        let response: generated_types::IndexRefreshStatusResponse =
+            serde_json::from_str(json).unwrap();
+        match index_refresh_status(response).unwrap() {
+            IndexRefreshStatusResponse::NotFound { status } => assert_eq!(status, "not_found"),
+            other => panic!("expected a not found status, got {other:?}"),
+        }
    }
 }
@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

-use super::client::{AdminApiClient, ApiError, ApiResult};
+use super::client::{AdminApiClient, ApiResult};
 use super::types::{
    GatewayVoiceStateCountsResponse, GuildMemoryStatsResponse, NodeStatsResponse,
    ReloadAllGuildsResponse,
@@ -10,12 +10,10 @@ use super::types::{

 impl AdminApiClient {
    pub async fn get_guild_memory_stats(&self, limit: u32) -> ApiResult<GuildMemoryStatsResponse> {
-        let body = generated_types::GetProcessMemoryStatsRequest {
-            limit: Some(i32::try_from(limit).map_err(|e| ApiError::Parse(e.to_string()))?),
-        };
+        let limit = limit.to_string();
        let response = self
            .generated()
-            .get_guild_memory_statistics(&body)
+            .get_admin_gateway_memory_stats(Some(limit.as_str()))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -26,15 +24,11 @@ impl AdminApiClient {
        guild_ids: &[String],
    ) -> ApiResult<ReloadAllGuildsResponse> {
        let body = generated_types::ReloadGuildsRequest {
-            guild_ids: guild_ids
-                .iter()
-                .cloned()
-                .map(generated_types::SnowflakeType::from)
-                .collect(),
+            guild_ids: guild_ids.iter().map(|id| snowflake(id)).collect(),
        };
        let response = self
            .generated()
-            .reload_all_specified_guilds(&body)
+            .create_admin_gateway_reload(&body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -43,7 +37,7 @@ impl AdminApiClient {
    pub async fn get_node_stats(&self) -> ApiResult<NodeStatsResponse> {
        let response = self
            .generated()
-            .get_gateway_node_statistics()
+            .get_admin_gateway_stats()
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -54,7 +48,7 @@ impl AdminApiClient {
    ) -> ApiResult<GatewayVoiceStateCountsResponse> {
        let response = self
            .generated()
-            .get_gateway_voice_state_counts()
+            .get_admin_gateway_voice_state_counts()
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::SendSystemDmResponse;
@@ -14,15 +14,11 @@ impl AdminApiClient {
        let body = generated_types::SendSystemDmRequest {
            content: generated_types::SendSystemDmRequestContent::try_from(content)
                .map_err(|e| ApiError::Parse(e.to_string()))?,
-            user_ids: user_ids
-                .iter()
-                .cloned()
-                .map(generated_types::SnowflakeType::from)
-                .collect(),
+            user_ids: user_ids.iter().map(|id| snowflake(id)).collect(),
        };
        let response = self
            .generated()
-            .send_system_dm(&body)
+            .create_admin_system_dm(&body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -9,6 +9,8 @@ pub struct AuditLogEntry {
    #[serde(default)]
    pub admin_user: Option<AuditLogUserSummary>,
    pub action: String,
+    #[serde(default)]
+    pub access: Option<String>,
    pub target_id: String,
    pub target_type: String,
    #[serde(default)]
@@ -1,39 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-use serde::{Deserialize, Serialize};
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct BillingOverview {
-    #[serde(flatten)]
-    pub data: serde_json::Value,
-}
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct PaymentListResponse {
-    #[serde(flatten)]
-    pub data: serde_json::Value,
-}
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct SubscriptionResponse {
-    #[serde(flatten)]
-    pub data: serde_json::Value,
-}
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct PaymentMethodListResponse {
-    #[serde(flatten)]
-    pub data: serde_json::Value,
-}
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct InvoiceListResponse {
-    #[serde(flatten)]
-    pub data: serde_json::Value,
-}
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct RefundCancelResponse {
-    #[serde(flatten)]
-    pub data: serde_json::Value,
-}
@@ -6,8 +6,14 @@ pub fn deserialize_discriminator<'de, D: Deserializer<'de>>(d: D) -> Result<Stri
    let v: serde_json::Value = Deserialize::deserialize(d)?;
    match v {
        serde_json::Value::String(s) => Ok(format!("{:0>4}", s)),
-        serde_json::Value::Number(n) => Ok(format!("{:04}", n.as_u64().unwrap_or(0))),
-        _ => Ok("0000".to_owned()),
+        serde_json::Value::Number(n) => n
+            .as_u64()
+            .map(|value| format!("{value:04}"))
+            .ok_or_else(|| serde::de::Error::custom("expected an unsigned integer discriminator")),
+        serde_json::Value::Null => Ok("0000".to_owned()),
+        _ => Err(serde::de::Error::custom(
+            "expected string or unsigned integer discriminator",
+        )),
    }
 }

@@ -15,7 +21,9 @@ pub fn deserialize_string_or_u64<'de, D: Deserializer<'de>>(d: D) -> Result<u64,
    let v: serde_json::Value = Deserialize::deserialize(d)?;
    match v {
        serde_json::Value::String(s) => s.parse::<u64>().map_err(serde::de::Error::custom),
-        serde_json::Value::Number(n) => Ok(n.as_u64().unwrap_or(0)),
+        serde_json::Value::Number(n) => n
+            .as_u64()
+            .ok_or_else(|| serde::de::Error::custom("expected an unsigned 64-bit integer")),
        serde_json::Value::Null => Ok(0),
        _ => Err(serde::de::Error::custom("expected string or number")),
    }
@@ -2,6 +2,8 @@

 use serde::{Deserialize, Serialize};

+pub use crate::api::generated::types::VoiceNoiseSuppressionBackendSchema as NoiseSuppressionBackend;
+
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct InstanceConfigResponse {
    pub sso: SsoConfigResponse,
@@ -18,6 +20,16 @@ pub struct InstanceConfigResponse {
    pub integrations: InstanceIntegrationsResponse,
    #[serde(default)]
    pub media: InstanceMediaResponse,
+    #[serde(default)]
+    pub voice_noise_suppression: VoiceNoiseSuppressionConfigResponse,
+    #[serde(default)]
+    pub push_relay: PushRelayConfigResponse,
+    #[serde(default)]
+    pub domain_migration: DomainMigrationConfigResponse,
+    #[serde(default)]
+    pub altcha_captcha: AltchaCaptchaConfigResponse,
+    #[serde(default)]
+    pub experiment_delivery: ExperimentDeliveryConfigResponse,
 }

 #[derive(Clone, Debug, Deserialize, Serialize)]
@@ -320,6 +332,8 @@ pub struct AppBrandingConfigResponse {
    pub wordmark_url: Option<String>,
    pub favicon_url: Option<String>,
    pub theme_color: Option<String>,
+    pub status_page_url: Option<String>,
+    pub status_page_incident_history_url: Option<String>,
 }

 impl Default for AppBrandingConfigResponse {
@@ -332,6 +346,8 @@ impl Default for AppBrandingConfigResponse {
            wordmark_url: None,
            favicon_url: None,
            theme_color: None,
+            status_page_url: None,
+            status_page_incident_history_url: None,
        }
    }
 }
@@ -436,6 +452,235 @@ impl VoiceE2eeScope {
    }
 }

+pub const EXPERIMENT_MAX_TARGETED_USERS: usize = 1_000;
+pub const DOMAIN_MIGRATION_DEFAULT_SALT: &str = "domain-migration-v1";
+pub const ALTCHA_CAPTCHA_DEFAULT_SALT: &str = "altcha-captcha-v1";
+pub const ALTCHA_CAPTCHA_COST_RANGE: std::ops::RangeInclusive<u32> = 1_000..=100_000;
+pub const ALTCHA_CAPTCHA_MAX_COUNTER_RANGE: std::ops::RangeInclusive<u32> = 100..=1_000_000;
+pub const VOICE_NS_MAX_GUILD_OVERRIDES: usize = 200;
+
+impl NoiseSuppressionBackend {
+    pub const ALL: [Self; 7] = [
+        Self::None,
+        Self::Standard,
+        Self::Gate,
+        Self::Speex,
+        Self::Rnnoise,
+        Self::Gtcrn,
+        Self::DeepFilter,
+    ];
+
+    pub fn label(&self) -> &'static str {
+        match self {
+            Self::None => "None (pass-through)",
+            Self::Standard => "Standard (WebRTC)",
+            Self::Gate => "Noise gate",
+            Self::Speex => "Speex",
+            Self::Rnnoise => "RNNoise",
+            Self::Gtcrn => "GTCRN",
+            Self::DeepFilter => "DeepFilterNet",
+        }
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct VoiceNoiseSuppressionGuildOverride {
+    pub guild_id: String,
+    pub backend: NoiseSuppressionBackend,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(default)]
+pub struct VoiceNoiseSuppressionConfigResponse {
+    pub enabled: bool,
+    pub config_version: u64,
+    pub default_backend: NoiseSuppressionBackend,
+    pub enabled_backends: Vec<NoiseSuppressionBackend>,
+    pub allow_user_override: bool,
+    pub rollout_basis_points: u32,
+    pub rollout_salt: String,
+    pub included_user_ids: Vec<String>,
+    pub excluded_user_ids: Vec<String>,
+    pub guild_overrides: Vec<VoiceNoiseSuppressionGuildOverride>,
+    pub suppression_strength: u32,
+}
+
+impl Default for VoiceNoiseSuppressionConfigResponse {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            config_version: 0,
+            default_backend: NoiseSuppressionBackend::Standard,
+            enabled_backends: NoiseSuppressionBackend::ALL.to_vec(),
+            allow_user_override: true,
+            rollout_basis_points: 0,
+            rollout_salt: "voice-ns-v1".to_owned(),
+            included_user_ids: Vec::new(),
+            excluded_user_ids: Vec::new(),
+            guild_overrides: Vec::new(),
+            suppression_strength: 80,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Default, Serialize)]
+pub struct VoiceNoiseSuppressionConfigUpdateRequest {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enabled: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub default_backend: Option<NoiseSuppressionBackend>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enabled_backends: Option<Vec<NoiseSuppressionBackend>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub allow_user_override: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub rollout_basis_points: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub rollout_salt: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub included_user_ids: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub excluded_user_ids: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub guild_overrides: Option<Vec<VoiceNoiseSuppressionGuildOverride>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub suppression_strength: Option<u32>,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+#[serde(default)]
+pub struct PushRelayConfigResponse {
+    pub relay_consent_accepted: bool,
+    pub relay_consent_accepted_at: Option<String>,
+    pub relay_consent_accepted_by: Option<String>,
+}
+
+#[derive(Clone, Debug, Default, Serialize)]
+pub struct PushRelayConfigUpdateRequest {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub relay_consent_accepted: Option<bool>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(default)]
+pub struct DomainMigrationConfigResponse {
+    pub enabled: bool,
+    pub config_version: u64,
+    pub rollout_basis_points: u32,
+    pub rollout_salt: String,
+    pub included_user_ids: Vec<String>,
+    pub excluded_user_ids: Vec<String>,
+    pub anonymous_rollout_basis_points: u32,
+    pub standalone_forwarding: bool,
+}
+
+impl Default for DomainMigrationConfigResponse {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            config_version: 0,
+            rollout_basis_points: 0,
+            rollout_salt: DOMAIN_MIGRATION_DEFAULT_SALT.to_owned(),
+            included_user_ids: Vec::new(),
+            excluded_user_ids: Vec::new(),
+            anonymous_rollout_basis_points: 0,
+            standalone_forwarding: false,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Default, Serialize)]
+pub struct DomainMigrationConfigUpdateRequest {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enabled: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub rollout_basis_points: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub rollout_salt: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub included_user_ids: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub excluded_user_ids: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub anonymous_rollout_basis_points: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub standalone_forwarding: Option<bool>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(default)]
+pub struct AltchaCaptchaConfigResponse {
+    pub enabled: bool,
+    pub config_version: u64,
+    pub rollout_basis_points: u32,
+    pub rollout_salt: String,
+    pub included_user_ids: Vec<String>,
+    pub excluded_user_ids: Vec<String>,
+    pub anonymous_enabled: bool,
+    pub cost: u32,
+    pub max_counter: u32,
+}
+
+impl Default for AltchaCaptchaConfigResponse {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            config_version: 0,
+            rollout_basis_points: 0,
+            rollout_salt: ALTCHA_CAPTCHA_DEFAULT_SALT.to_owned(),
+            included_user_ids: Vec::new(),
+            excluded_user_ids: Vec::new(),
+            anonymous_enabled: false,
+            cost: 5_000,
+            max_counter: 10_000,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Default, Serialize)]
+pub struct AltchaCaptchaConfigUpdateRequest {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enabled: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub rollout_basis_points: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub rollout_salt: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub included_user_ids: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub excluded_user_ids: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub anonymous_enabled: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cost: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_counter: Option<u32>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(default)]
+pub struct ExperimentDeliveryConfigResponse {
+    pub poll_interval_seconds: u64,
+    pub poll_jitter_percent: u32,
+}
+
+impl Default for ExperimentDeliveryConfigResponse {
+    fn default() -> Self {
+        Self {
+            poll_interval_seconds: 300,
+            poll_jitter_percent: 15,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Default, Serialize)]
+pub struct ExperimentDeliveryConfigUpdateRequest {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub poll_interval_seconds: Option<u64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub poll_jitter_percent: Option<u32>,
+}
+
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct InstanceRegistrationResponse {
    pub mode: RegistrationMode,
@@ -525,6 +770,16 @@ pub struct InstanceConfigUpdateRequest {
    pub integrations: Option<InstanceIntegrationsUpdateRequest>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub media: Option<InstanceMediaUpdateRequest>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub voice_noise_suppression: Option<VoiceNoiseSuppressionConfigUpdateRequest>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub push_relay: Option<PushRelayConfigUpdateRequest>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub domain_migration: Option<DomainMigrationConfigUpdateRequest>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub altcha_captcha: Option<AltchaCaptchaConfigUpdateRequest>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub experiment_delivery: Option<ExperimentDeliveryConfigUpdateRequest>,
 }

 #[derive(Clone, Debug, Default, Serialize)]
@@ -729,6 +984,10 @@ pub struct AppBrandingConfigUpdateRequest {
    pub favicon_url: Option<Option<String>>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub theme_color: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status_page_url: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status_page_incident_history_url: Option<Option<String>>,
 }

 #[derive(Clone, Debug, Default, Serialize)]
@@ -827,12 +1086,137 @@ pub struct CreateRegistrationUrlResponse {
    pub url: String,
 }

-#[derive(Clone, Debug, Serialize)]
-pub struct RegistrationUrlActionRequest {
-    pub id: String,
-}
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::api::generated::types as generated_types;
+    use serde_json::json;

-#[derive(Clone, Debug, Serialize)]
-pub struct PendingRegistrationActionRequest {
-    pub user_id: String,
+    #[test]
+    fn noise_suppression_backend_choices_use_the_generated_wire_contract() {
+        assert_eq!(
+            serde_json::to_value(NoiseSuppressionBackend::ALL).expect("serializable backends"),
+            json!([
+                "none",
+                "standard",
+                "gate",
+                "speex",
+                "rnnoise",
+                "gtcrn",
+                "deep_filter"
+            ])
+        );
+        assert!(serde_json::from_value::<NoiseSuppressionBackend>(json!("deepfilter")).is_err());
+    }
+
+    #[test]
+    fn default_instance_experiment_config_matches_the_published_contract() {
+        let schema: serde_json::Value =
+            serde_json::from_str(include_str!("../../../openapi-admin.json"))
+                .expect("admin schema");
+        let noise = serde_json::from_value::<VoiceNoiseSuppressionConfigResponse>(json!({}))
+            .expect("default noise config");
+        let domain_migration = serde_json::from_value::<DomainMigrationConfigResponse>(json!({}))
+            .expect("default domain migration config");
+        let altcha_captcha = serde_json::from_value::<AltchaCaptchaConfigResponse>(json!({}))
+            .expect("default altcha captcha config");
+        let delivery = serde_json::from_value::<ExperimentDeliveryConfigResponse>(json!({}))
+            .expect("default delivery config");
+        let noise = serde_json::to_value(noise).expect("serializable noise config");
+        let domain_migration =
+            serde_json::to_value(domain_migration).expect("serializable domain migration config");
+        let altcha_captcha =
+            serde_json::to_value(altcha_captcha).expect("serializable altcha captcha config");
+        let delivery = serde_json::to_value(delivery).expect("serializable delivery config");
+        let generated_noise: generated_types::VoiceNoiseSuppressionConfigResponse =
+            serde_json::from_value(noise.clone()).expect("generated noise config contract");
+        let generated_domain_migration: generated_types::DomainMigrationConfigResponse =
+            serde_json::from_value(domain_migration.clone())
+                .expect("generated domain migration config contract");
+        let generated_altcha_captcha: generated_types::AltchaCaptchaConfigResponse =
+            serde_json::from_value(altcha_captcha.clone())
+                .expect("generated altcha captcha config contract");
+        let generated_delivery: generated_types::ExperimentDeliveryConfigResponse =
+            serde_json::from_value(delivery.clone()).expect("generated delivery config contract");
+        assert_eq!(
+            serde_json::to_value(generated_noise).expect("serializable generated noise config"),
+            noise
+        );
+        assert_eq!(
+            serde_json::to_value(generated_domain_migration)
+                .expect("serializable generated domain migration config"),
+            domain_migration
+        );
+        assert_eq!(
+            serde_json::to_value(generated_altcha_captcha)
+                .expect("serializable generated altcha captcha config"),
+            altcha_captcha
+        );
+        assert_eq!(
+            serde_json::to_value(generated_delivery)
+                .expect("serializable generated delivery config"),
+            delivery
+        );
+        for (name, value) in [
+            ("VoiceNoiseSuppressionConfigResponse", noise),
+            ("DomainMigrationConfigResponse", domain_migration),
+            ("AltchaCaptchaConfigResponse", altcha_captcha),
+            ("ExperimentDeliveryConfigResponse", delivery),
+        ] {
+            for (field, value) in value.as_object().expect("config object") {
+                assert_eq!(
+                    value, &schema["components"]["schemas"][name]["properties"][field]["default"],
+                    "{name}.{field}"
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn noise_suppression_update_preserves_empty_lists_and_omitted_fields() {
+        let update = VoiceNoiseSuppressionConfigUpdateRequest {
+            enabled_backends: Some(Vec::new()),
+            included_user_ids: Some(Vec::new()),
+            excluded_user_ids: Some(Vec::new()),
+            guild_overrides: Some(Vec::new()),
+            ..Default::default()
+        };
+        let value = serde_json::to_value(update).expect("serializable update");
+        serde_json::from_value::<generated_types::VoiceNoiseSuppressionConfigUpdateRequest>(
+            value.clone(),
+        )
+        .expect("generated update contract");
+        assert_eq!(
+            value,
+            json!({"enabled_backends": [], "included_user_ids": [], "excluded_user_ids": [], "guild_overrides": []})
+        );
+        assert_eq!(
+            serde_json::to_value(VoiceNoiseSuppressionConfigUpdateRequest::default())
+                .expect("serializable update"),
+            json!({})
+        );
+    }
+
+    #[test]
+    fn domain_migration_update_preserves_empty_lists_and_omitted_fields() {
+        let update = DomainMigrationConfigUpdateRequest {
+            included_user_ids: Some(Vec::new()),
+            excluded_user_ids: Some(Vec::new()),
+            ..Default::default()
+        };
+        let value = serde_json::to_value(update).expect("serializable update");
+        serde_json::from_value::<generated_types::DomainMigrationConfigUpdateRequest>(
+            value.clone(),
+        )
+        .expect("generated update contract");
+        assert_eq!(
+            value,
+            json!({"included_user_ids": [], "excluded_user_ids": []})
+        );
+        assert_eq!(
+            serde_json::to_value(DomainMigrationConfigUpdateRequest::default())
+                .expect("serializable update"),
+            json!({})
+        );
+    }
 }
@@ -4,7 +4,6 @@ mod admin_api_keys;
 mod applications;
 mod archives;
 mod audit;
-mod billing;
 mod bulk;
 mod codes;
 mod common;
@@ -24,7 +23,6 @@ pub use admin_api_keys::*;
 pub use applications::*;
 pub use archives::*;
 pub use audit::*;
-pub use billing::*;
 pub use bulk::*;
 pub use codes::*;
 pub use common::*;
@@ -28,6 +28,7 @@ pub struct VoiceServer {
    pub latitude: Option<f64>,
    pub longitude: Option<f64>,
    pub is_active: Option<bool>,
+    pub soft_connection_limit: Option<i64>,
    pub vip_only: Option<bool>,
    #[serde(default)]
    pub required_guild_features: Vec<String>,
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{
@@ -15,34 +15,35 @@ impl AdminApiClient {
        email: Option<&str>,
        last_active_ip: Option<&str>,
        limit: u32,
-        offset: u32,
+        offset: u64,
    ) -> ApiResult<SearchUsersResponse> {
-        let body = generated_types::SearchUsersRequest {
-            email: nonempty_string(email),
-            last_active_ip: nonempty_string(last_active_ip),
-            limit: Some(
-                crate::api::generated::nonzero_u32(limit, "limit").map_err(ApiError::Parse)?,
-            ),
-            offset: Some(i64::from(offset)),
-            query: nonempty_string(query),
-        };
+        let limit = limit.to_string();
+        let offset = offset.to_string();
        let response = self
            .generated()
-            .search_users(&body)
+            .list_admin_users(
+                nonempty(email),
+                nonempty(last_active_ip),
+                Some(limit.as_str()),
+                Some(offset.as_str()),
+                nonempty(query),
+                None,
+                None,
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        let response = response.into_inner();
        Ok(SearchUsersResponse {
            users: self.generated_value(response.users)?,
-            total: response.total as u64,
+            total: crate::api::generated::number_to_u64(response.total, "total")
+                .map_err(ApiError::Parse)?,
        })
    }

    pub async fn lookup_user(&self, query: &str) -> ApiResult<Option<AdminUser>> {
-        let body = generated_types::LookupUserRequest::Query(query.to_owned());
        let response = self
            .generated()
-            .lookup_user(&body)
+            .list_admin_users(None, None, None, None, None, Some(query), None)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: LookupUserResponse = self.generated_value(response.into_inner())?;
@@ -53,27 +54,18 @@ impl AdminApiClient {
        if user_ids.is_empty() {
            return Ok(vec![]);
        }
-        let body = generated_types::LookupUserRequest::UserIds(
-            user_ids
-                .iter()
-                .cloned()
-                .map(generated_types::SnowflakeType::from)
-                .collect(),
-        );
-        let response = self
-            .generated()
-            .lookup_user(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        let resp: LookupUserResponse = self.generated_value(response.into_inner())?;
+        let query_params: Vec<(&str, &str)> = user_ids
+            .iter()
+            .map(|user_id| ("user_id", user_id.as_str()))
+            .collect();
+        let resp: LookupUserResponse = self.get("/admin/users", Some(&query_params)).await?;
        Ok(resp.users)
    }

    pub async fn get_user_by_id(&self, user_id: &str) -> ApiResult<AdminUser> {
-        let body = generated_types::LookupUserRequest::Query(user_id.to_owned());
        let response = self
            .generated()
-            .lookup_user(&body)
+            .get_admin_user(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: LookupUserResponse = self.generated_value(response.into_inner())?;
@@ -89,7 +81,7 @@ impl AdminApiClient {
    pub async fn get_current_admin(&self) -> ApiResult<AdminUser> {
        let response = self
            .generated()
-            .get_authenticated_admin_user()
+            .get_current_admin_user()
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: AdminUserMeResponse = self.generated_value(response.into_inner())?;
@@ -102,14 +94,13 @@ impl AdminApiClient {
        add_flags: &[String],
        remove_flags: &[String],
    ) -> ApiResult<AdminUser> {
-        let body = generated_types::UpdateUserFlagsRequest {
-            add_flags: user_flags(add_flags),
-            remove_flags: user_flags(remove_flags),
-            user_id: snowflake(user_id),
+        let body = generated_types::AdminUserFlagsUpdateRequest {
+            add_flags: user_flags(add_flags)?,
+            remove_flags: user_flags(remove_flags)?,
        };
        let response = self
            .generated()
-            .update_user_flags(&body)
+            .update_admin_user_flags(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -124,19 +115,19 @@ impl AdminApiClient {
        after: Option<&str>,
        with_counts: Option<bool>,
    ) -> ApiResult<Vec<GuildInfo>> {
-        let body = generated_types::ListUserGuildsRequest {
-            after: after.map(|id| generated_types::SnowflakeType::from(id.to_owned())),
-            before: before.map(|id| generated_types::SnowflakeType::from(id.to_owned())),
-            limit: Some(
-                crate::api::generated::nonzero_u32(limit.unwrap_or(200), "limit")
-                    .map_err(ApiError::Parse)?,
-            ),
-            user_id: generated_types::SnowflakeType::from(user_id.to_owned()),
-            with_counts: Some(with_counts.unwrap_or(true)),
-        };
+        let after = after.map(snowflake);
+        let before = before.map(snowflake);
+        let limit = limit.unwrap_or(200).to_string();
+        let with_counts = bool_param(with_counts.unwrap_or(true));
        let response = self
            .generated()
-            .list_user_guilds(&body)
+            .list_admin_user_guilds(
+                &snowflake(user_id),
+                after.as_ref(),
+                before.as_ref(),
+                Some(limit.as_str()),
+                Some(with_counts),
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: ListUserGuildsResponse = self.generated_value(response.into_inner())?;
@@ -147,12 +138,9 @@ impl AdminApiClient {
        &self,
        user_id: &str,
    ) -> ApiResult<super::types::ListUserSessionsResponse> {
-        let body = generated_types::ListUserSessionsRequest {
-            user_id: generated_types::SnowflakeType::from(user_id.to_owned()),
-        };
        let response = self
            .generated()
-            .list_user_sessions(&body)
+            .list_admin_user_sessions(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -162,12 +150,9 @@ impl AdminApiClient {
        &self,
        user_id: &str,
    ) -> ApiResult<TerminateSessionsResponse> {
-        let body = generated_types::TerminateSessionsRequest {
-            user_id: snowflake(user_id),
-        };
        let response = self
            .generated()
-            .terminate_user_sessions(&body)
+            .terminate_admin_user_sessions(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -177,12 +162,9 @@ impl AdminApiClient {
        &self,
        user_id: &str,
    ) -> ApiResult<super::types::ListUserRelationshipsResponse> {
-        let body = generated_types::ListUserRelationshipsRequest {
-            user_id: generated_types::SnowflakeType::from(user_id.to_owned()),
-        };
        let response = self
            .generated()
-            .admin_list_user_relationships(&body)
+            .list_admin_user_relationships(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -195,18 +177,18 @@ impl AdminApiClient {
        after: Option<&str>,
        limit: Option<u32>,
    ) -> ApiResult<super::types::ListUserDmChannelsResponse> {
-        let body = generated_types::ListUserDmChannelsRequest {
-            after: after.map(|id| generated_types::SnowflakeType::from(id.to_owned())),
-            before: before.map(|id| generated_types::SnowflakeType::from(id.to_owned())),
-            limit: Some(
-                crate::api::generated::nonzero_u32(limit.unwrap_or(50), "limit")
-                    .map_err(ApiError::Parse)?,
-            ),
-            user_id: generated_types::SnowflakeType::from(user_id.to_owned()),
-        };
+        let after = after.map(snowflake);
+        let before = before.map(snowflake);
+        let limit = limit.unwrap_or(50).to_string();
        let response = self
            .generated()
-            .list_user_dm_channels(&body)
+            .list_admin_user_dm_channels(
+                &snowflake(user_id),
+                after.as_ref(),
+                before.as_ref(),
+                Some(limit.as_str()),
+                Some(generated_types::AdminUserDmChannelType::Dm),
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -216,12 +198,15 @@ impl AdminApiClient {
        &self,
        user_id: &str,
    ) -> ApiResult<super::types::ListUserGroupDmChannelsResponse> {
-        let body = generated_types::ListUserGroupDmChannelsRequest {
-            user_id: generated_types::SnowflakeType::from(user_id.to_owned()),
-        };
        let response = self
            .generated()
-            .list_user_group_dm_channels(&body)
+            .list_admin_user_dm_channels(
+                &snowflake(user_id),
+                None,
+                None,
+                None,
+                Some(generated_types::AdminUserDmChannelType::GroupDm),
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -233,14 +218,13 @@ impl AdminApiClient {
        add_flags: &[i32],
        remove_flags: &[i32],
    ) -> ApiResult<AdminUser> {
-        let body = generated_types::UpdatePremiumFlagsRequest {
+        let body = generated_types::AdminUserPremiumFlagsUpdateRequest {
            add_flags: premium_flags(add_flags),
            remove_flags: premium_flags(remove_flags),
-            user_id: snowflake(user_id),
        };
        let response = self
            .generated()
-            .update_user_premium_flags(&body)
+            .update_admin_user_premium_flags(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -248,13 +232,12 @@ impl AdminApiClient {
    }

    pub async fn update_suspicious_flags(&self, user_id: &str, flags: i32) -> ApiResult<AdminUser> {
-        let body = generated_types::UpdateSuspiciousActivityFlagsRequest {
+        let body = generated_types::AdminUserSuspiciousActivityFlagsRequest {
            flags: generated_types::SuspiciousActivityFlags::from(flags),
-            user_id: snowflake(user_id),
        };
        let response = self
            .generated()
-            .update_suspicious_activity_flags(&body)
+            .update_admin_user_suspicious_activity_flags(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -262,13 +245,12 @@ impl AdminApiClient {
    }

    pub async fn set_user_acls(&self, user_id: &str, acls: &[String]) -> ApiResult<AdminUser> {
-        let body = generated_types::SetUserAclsRequest {
-            acls: acls.to_vec(),
-            user_id: snowflake(user_id),
+        let body = generated_types::AdminUserAclsRequest {
+            acls: super::admin_api_keys::parse_acls(acls)?,
        };
        let response = self
            .generated()
-            .set_user_acls(&body)
+            .set_admin_user_acls(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -276,13 +258,12 @@ impl AdminApiClient {
    }

    pub async fn set_user_traits(&self, user_id: &str, traits: &[String]) -> ApiResult<AdminUser> {
-        let body = generated_types::SetUserTraitsRequest {
+        let body = generated_types::AdminUserTraitsRequest {
            traits: traits.to_vec(),
-            user_id: snowflake(user_id),
        };
        let response = self
            .generated()
-            .set_user_traits(&body)
+            .set_admin_user_traits(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -290,34 +271,25 @@ impl AdminApiClient {
    }

    pub async fn disable_mfa(&self, user_id: &str) -> ApiResult<()> {
-        let body = generated_types::DisableMfaRequest {
-            user_id: snowflake(user_id),
-        };
        self.generated()
-            .disable_user_mfa(&body)
+            .disable_admin_user_mfa(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
    }

    pub async fn resend_verification_email(&self, user_id: &str) -> ApiResult<()> {
-        let body = generated_types::ResendVerificationEmailRequest {
-            user_id: snowflake(user_id),
-        };
        self.generated()
-            .admin_resend_verification_email(&body)
+            .resend_admin_user_verification_email(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
    }

    pub async fn verify_email(&self, user_id: &str) -> ApiResult<AdminUser> {
-        let body = generated_types::VerifyUserEmailRequest {
-            user_id: snowflake(user_id),
-        };
        let response = self
            .generated()
-            .verify_user_email(&body)
+            .verify_admin_user_email(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -329,13 +301,10 @@ impl AdminApiClient {
        user_id: &str,
        has_verified_phone: bool,
    ) -> ApiResult<AdminUser> {
-        let body = generated_types::UpdateHasVerifiedPhoneRequest {
-            has_verified_phone,
-            user_id: snowflake(user_id),
-        };
+        let body = generated_types::AdminUserPhoneVerificationRequest { has_verified_phone };
        let response = self
            .generated()
-            .update_user_has_verified_phone(&body)
+            .update_admin_user_phone_verification(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -349,16 +318,15 @@ impl AdminApiClient {
    ) -> ApiResult<AdminUser> {
        let fields = fields
            .iter()
-            .map(generated_types::ClearUserFieldsRequestFieldsItem::try_from)
+            .map(|field| {
+                generated_types::AdminUserClearFieldsRequestFieldsItem::try_from(field.as_str())
+            })
            .collect::<Result<Vec<_>, _>>()
            .map_err(|e| ApiError::Parse(e.to_string()))?;
-        let body = generated_types::ClearUserFieldsRequest {
-            fields,
-            user_id: snowflake(user_id),
-        };
+        let body = generated_types::AdminUserClearFieldsRequest { fields };
        let response = self
            .generated()
-            .clear_user_fields(&body)
+            .clear_admin_user_profile_fields(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -366,13 +334,10 @@ impl AdminApiClient {
    }

    pub async fn set_bot_status(&self, user_id: &str, is_bot: bool) -> ApiResult<AdminUser> {
-        let body = generated_types::SetUserBotStatusRequest {
-            bot: is_bot,
-            user_id: snowflake(user_id),
-        };
+        let body = generated_types::AdminUserBotStatusRequest { bot: is_bot };
        let response = self
            .generated()
-            .set_user_bot_status(&body)
+            .set_admin_user_bot_status(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -380,13 +345,10 @@ impl AdminApiClient {
    }

    pub async fn set_system_status(&self, user_id: &str, is_system: bool) -> ApiResult<AdminUser> {
-        let body = generated_types::SetUserSystemStatusRequest {
-            system: is_system,
-            user_id: snowflake(user_id),
-        };
+        let body = generated_types::AdminUserSystemStatusRequest { system: is_system };
        let response = self
            .generated()
-            .set_user_system_status(&body)
+            .set_admin_user_system_status(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -399,18 +361,14 @@ impl AdminApiClient {
        username: &str,
        discriminator: Option<&str>,
    ) -> ApiResult<AdminUser> {
-        let body = generated_types::ChangeUsernameRequest {
+        let body = generated_types::AdminUserUsernameUpdateRequest {
            discriminator: discriminator
-                .map(generated_types::DiscriminatorType::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-            user_id: snowflake(user_id),
-            username: generated_types::UsernameType::try_from(username)
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
+                .map(|value| generated_types::DiscriminatorType::String(value.to_owned())),
+            username: generated_types::UsernameType::from(username.to_owned()),
        };
        let response = self
            .generated()
-            .change_user_username(&body)
+            .update_admin_user_username(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -418,13 +376,12 @@ impl AdminApiClient {
    }

    pub async fn change_email(&self, user_id: &str, email: &str) -> ApiResult<AdminUser> {
-        let body = generated_types::ChangeEmailRequest {
+        let body = generated_types::AdminUserEmailUpdateRequest {
            email: generated_types::EmailType::from(email.to_owned()),
-            user_id: snowflake(user_id),
        };
        let response = self
            .generated()
-            .change_user_email(&body)
+            .update_admin_user_email(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -438,25 +395,26 @@ impl AdminApiClient {
        reason: Option<&str>,
        private_reason: Option<&str>,
    ) -> ApiResult<AdminUser> {
-        let body = generated_types::TempBanUserRequest {
+        let body = generated_types::AdminUserBanRequest {
            duration_hours: i32::try_from(duration_hours)
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
+                .map_err(|e| ApiError::Parse(e.to_string()))?
+                .into(),
            reason: reason.map(std::borrow::ToOwned::to_owned),
-            user_id: snowflake(user_id),
        };
        let resp: UserMutationResponse = self
-            .post_typed_with_reason("/admin/users/temp-ban", &body, private_reason)
+            .put_typed_with_reason(
+                &format!("/admin/users/{}/ban", urlencoding::encode(user_id)),
+                &body,
+                private_reason,
+            )
            .await?;
        Ok(resp.user)
    }

    pub async fn unban_user(&self, user_id: &str) -> ApiResult<AdminUser> {
-        let body = generated_types::DisableMfaRequest {
-            user_id: snowflake(user_id),
-        };
        let response = self
            .generated()
-            .unban_user(&body)
+            .unban_admin_user(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -469,32 +427,32 @@ impl AdminApiClient {
        reason_code: i32,
        public_reason: Option<&str>,
        days_until_deletion: u32,
+        audit_log_reason: Option<&str>,
    ) -> ApiResult<AdminUser> {
-        let body = generated_types::ScheduleAccountDeletionRequest {
-            days_until_deletion: Some(
-                crate::api::generated::nonzero_u32(days_until_deletion, "days_until_deletion")
-                    .map_err(ApiError::Parse)?,
-            ),
+        let body = generated_types::AdminUserDeletionScheduleRequest {
+            days_until_deletion: crate::api::generated::nonzero_u32(
+                days_until_deletion,
+                "days_until_deletion",
+            )
+            .map_err(ApiError::Parse)?
+            .into(),
            public_reason: public_reason.map(std::borrow::ToOwned::to_owned),
-            reason_code,
-            user_id: snowflake(user_id),
+            reason_code: crate::api::generated::deletion_reason_code(reason_code, "reason_code")
+                .map_err(ApiError::Parse)?,
        };
        let response = self
-            .generated()
-            .schedule_account_deletion(&body)
+            .generated_with_reason(audit_log_reason)?
+            .schedule_admin_user_deletion(&snowflake(user_id), &body)
            .await
-            .map_err(|e| self.generated_error(e))?;
+            .map_err(|error| self.generated_error(error))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
        Ok(resp.user)
    }

    pub async fn cancel_deletion(&self, user_id: &str) -> ApiResult<AdminUser> {
-        let body = generated_types::DisableMfaRequest {
-            user_id: snowflake(user_id),
-        };
        let response = self
            .generated()
-            .cancel_account_deletion(&body)
+            .cancel_admin_user_deletion(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -502,13 +460,12 @@ impl AdminApiClient {
    }

    pub async fn change_dob(&self, user_id: &str, dob: &str) -> ApiResult<AdminUser> {
-        let body = generated_types::ChangeDobRequest {
+        let body = generated_types::AdminUserDobUpdateRequest {
            date_of_birth: dob.to_owned(),
-            user_id: snowflake(user_id),
        };
        let response = self
            .generated()
-            .change_user_dob(&body)
+            .update_admin_user_date_of_birth(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -516,11 +473,8 @@ impl AdminApiClient {
    }

    pub async fn send_password_reset(&self, user_id: &str) -> ApiResult<()> {
-        let body = generated_types::SendPasswordResetRequest {
-            user_id: snowflake(user_id),
-        };
        self.generated()
-            .send_password_reset(&body)
+            .send_admin_user_password_reset(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
@@ -532,14 +486,10 @@ impl AdminApiClient {
        target_id: &str,
        category: &str,
    ) -> ApiResult<()> {
-        let body = generated_types::RemoveUserRelationshipRequest {
-            category: generated_types::RemoveUserRelationshipRequestCategory::try_from(category)
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-            target_user_id: snowflake(target_id),
-            user_id: snowflake(user_id),
-        };
+        let category = generated_types::RelationshipCategoryEnum::try_from(category)
+            .map_err(|e| ApiError::Parse(e.to_string()))?;
        self.generated()
-            .remove_user_relationship(&body)
+            .remove_admin_user_relationship(&snowflake(user_id), &snowflake(target_id), category)
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
@@ -550,16 +500,11 @@ impl AdminApiClient {
        user_id: &str,
        category: &str,
    ) -> ApiResult<super::types::RemoveRelationshipsResponse> {
-        let body = generated_types::RemoveUserRelationshipsByCategoryRequest {
-            category: generated_types::RemoveUserRelationshipsByCategoryRequestCategory::try_from(
-                category,
-            )
-            .map_err(|e| ApiError::Parse(e.to_string()))?,
-            user_id: snowflake(user_id),
-        };
+        let category = generated_types::RelationshipCategoryEnum::try_from(category)
+            .map_err(|e| ApiError::Parse(e.to_string()))?;
        let response = self
            .generated()
-            .remove_user_relationships_by_category(&body)
+            .clear_admin_user_relationships(&snowflake(user_id), category)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -570,12 +515,8 @@ impl AdminApiClient {
        user_id: &str,
        credential_id: &str,
    ) -> ApiResult<()> {
-        let body = generated_types::DeleteWebAuthnCredentialRequest {
-            credential_id: credential_id.to_owned(),
-            user_id: snowflake(user_id),
-        };
        self.generated()
-            .delete_user_webauthn_credential(&body)
+            .delete_admin_user_webauthn_credential(&snowflake(user_id), credential_id)
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
@@ -586,17 +527,10 @@ impl AdminApiClient {
        user_id: &str,
        limit: Option<u32>,
    ) -> ApiResult<super::types::ListUserChangeLogResponse> {
-        let body = generated_types::ListUserChangeLogRequest {
-            limit: Some(
-                crate::api::generated::nonzero_u32(limit.unwrap_or(50), "limit")
-                    .map_err(ApiError::Parse)?,
-            ),
-            page_token: None,
-            user_id: generated_types::SnowflakeType::from(user_id.to_owned()),
-        };
+        let limit = limit.unwrap_or(50).to_string();
        let response = self
            .generated()
-            .get_user_change_log(&body)
+            .list_admin_user_change_log(&snowflake(user_id), Some(limit.as_str()), None)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -606,24 +540,18 @@ impl AdminApiClient {
        &self,
        user_id: &str,
    ) -> ApiResult<super::types::WebAuthnCredentialListResponse> {
-        let body = generated_types::ListWebAuthnCredentialsRequest {
-            user_id: generated_types::SnowflakeType::from(user_id.to_owned()),
-        };
        let response = self
            .generated()
-            .list_user_webauthn_credentials(&body)
+            .list_admin_user_webauthn_credentials(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }

    pub async fn cancel_bulk_message_deletion(&self, user_id: &str) -> ApiResult<AdminUser> {
-        let body = generated_types::CancelBulkMessageDeletionRequest {
-            user_id: snowflake(user_id),
-        };
        let response = self
            .generated()
-            .admin_cancel_bulk_message_deletion(&body)
+            .cancel_admin_user_message_deletion(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -631,21 +559,21 @@ impl AdminApiClient {
    }
 }

-fn nonempty_string(value: Option<&str>) -> Option<String> {
-    value
-        .filter(|value| !value.is_empty())
-        .map(std::borrow::ToOwned::to_owned)
+fn nonempty(value: Option<&str>) -> Option<&str> {
+    value.filter(|value| !value.is_empty())
 }

-fn snowflake(value: &str) -> generated_types::SnowflakeType {
-    generated_types::SnowflakeType::from(value.to_owned())
+fn bool_param(value: bool) -> &'static str {
+    if value { "true" } else { "false" }
 }

-fn user_flags(values: &[String]) -> Vec<generated_types::UserFlags> {
+fn user_flags(values: &[String]) -> ApiResult<Vec<generated_types::UserFlags>> {
    values
        .iter()
-        .cloned()
-        .map(generated_types::UserFlags::from)
+        .map(|value| {
+            generated_types::UserFlags::try_from(value.as_str())
+                .map_err(|error| ApiError::Parse(error.to_string()))
+        })
        .collect()
 }

@@ -14,12 +14,9 @@ impl AdminApiClient {
        &self,
        include_servers: bool,
    ) -> ApiResult<ListVoiceRegionsResponse> {
-        let body = generated_types::ListVoiceRegionsRequest {
-            include_servers: Some(include_servers),
-        };
        let response = self
            .generated()
-            .list_voice_regions(&body)
+            .list_admin_voice_regions(Some(bool_param(include_servers)))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -30,13 +27,9 @@ impl AdminApiClient {
        id: &str,
        include_servers: bool,
    ) -> ApiResult<GetVoiceRegionResponse> {
-        let body = generated_types::GetVoiceRegionRequest {
-            id: id.to_owned(),
-            include_servers: Some(include_servers),
-        };
        let response = self
            .generated()
-            .get_voice_region(&body)
+            .get_admin_voice_region(id, Some(bool_param(include_servers)))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -51,7 +44,7 @@ impl AdminApiClient {
                .map_err(|e| ApiError::Parse(e.to_string()))?;
        let response = self
            .generated()
-            .create_voice_region(&body)
+            .create_admin_voice_region(&body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -61,34 +54,30 @@ impl AdminApiClient {
        &self,
        params: &serde_json::Value,
    ) -> ApiResult<UpdateVoiceRegionResponse> {
-        let body =
-            serde_json::from_value::<generated_types::UpdateVoiceRegionRequest>(params.clone())
-                .map_err(|e| ApiError::Parse(e.to_string()))?;
-        let response = self
-            .generated()
-            .update_voice_region(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        let region_id = required_field(params, "id")?;
+        let body = voice_request_body(params, &["id"])?;
+        validate_against::<generated_types::UpdateVoiceRegionRequestBody>(&body)?;
+        self.patch_with_reason(
+            &format!("/admin/voice/regions/{}", urlencoding::encode(&region_id)),
+            Some(&body),
+            None,
+        )
+        .await
    }

    pub async fn delete_voice_region(&self, id: &str) -> ApiResult<DeleteVoiceResponse> {
-        let body = generated_types::DeleteVoiceRegionRequest { id: id.to_owned() };
        let response = self
            .generated()
-            .delete_voice_region(&body)
+            .delete_admin_voice_region(id)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }

    pub async fn list_voice_servers(&self, region_id: &str) -> ApiResult<ListVoiceServersResponse> {
-        let body = generated_types::ListVoiceServersRequest {
-            region_id: region_id.to_owned(),
-        };
        let response = self
            .generated()
-            .list_voice_servers(&body)
+            .list_admin_voice_servers(region_id)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -99,13 +88,9 @@ impl AdminApiClient {
        region_id: &str,
        server_id: &str,
    ) -> ApiResult<GetVoiceServerResponse> {
-        let body = generated_types::GetVoiceServerRequest {
-            region_id: region_id.to_owned(),
-            server_id: server_id.to_owned(),
-        };
        let response = self
            .generated()
-            .get_voice_server(&body)
+            .get_admin_voice_server(region_id, server_id)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -115,12 +100,15 @@ impl AdminApiClient {
        &self,
        params: &serde_json::Value,
    ) -> ApiResult<CreateVoiceServerResponse> {
-        let body =
-            serde_json::from_value::<generated_types::CreateVoiceServerRequest>(params.clone())
-                .map_err(|e| ApiError::Parse(e.to_string()))?;
+        let region_id = required_field(params, "region_id")?;
+        paired_coordinates(params)?;
+        let body = serde_json::from_value::<generated_types::CreateVoiceServerRequestBody>(
+            voice_request_body(params, &["region_id"])?,
+        )
+        .map_err(|e| ApiError::Parse(e.to_string()))?;
        let response = self
            .generated()
-            .create_voice_server(&body)
+            .create_admin_voice_server(&region_id, &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -130,15 +118,21 @@ impl AdminApiClient {
        &self,
        params: &serde_json::Value,
    ) -> ApiResult<UpdateVoiceServerResponse> {
-        let body =
-            serde_json::from_value::<generated_types::UpdateVoiceServerRequest>(params.clone())
-                .map_err(|e| ApiError::Parse(e.to_string()))?;
-        let response = self
-            .generated()
-            .update_voice_server(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        let region_id = required_field(params, "region_id")?;
+        let server_id = required_field(params, "server_id")?;
+        paired_coordinates(params)?;
+        let body = voice_request_body(params, &["region_id", "server_id"])?;
+        validate_against::<generated_types::UpdateVoiceServerRequestBody>(&body)?;
+        self.patch_with_reason(
+            &format!(
+                "/admin/voice/regions/{}/servers/{}",
+                urlencoding::encode(&region_id),
+                urlencoding::encode(&server_id)
+            ),
+            Some(&body),
+            None,
+        )
+        .await
    }

    pub async fn delete_voice_server(
@@ -146,15 +140,118 @@ impl AdminApiClient {
        region_id: &str,
        server_id: &str,
    ) -> ApiResult<DeleteVoiceResponse> {
-        let body = generated_types::DeleteVoiceServerRequest {
-            region_id: region_id.to_owned(),
-            server_id: server_id.to_owned(),
-        };
        let response = self
            .generated()
-            .delete_voice_server(&body)
+            .delete_admin_voice_server(region_id, server_id)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }
 }
+
+fn bool_param(value: bool) -> &'static str {
+    if value { "true" } else { "false" }
+}
+
+fn validate_against<T: serde::de::DeserializeOwned>(params: &serde_json::Value) -> ApiResult<()> {
+    serde_json::from_value::<T>(params.clone())
+        .map(drop)
+        .map_err(|e| ApiError::Parse(e.to_string()))
+}
+
+fn voice_request_body(
+    params: &serde_json::Value,
+    path_fields: &[&str],
+) -> ApiResult<serde_json::Value> {
+    let mut body = params
+        .as_object()
+        .ok_or_else(|| ApiError::Parse("voice request body must be an object".to_owned()))?
+        .clone();
+    for field in path_fields {
+        body.remove(*field);
+    }
+    Ok(body.into())
+}
+
+fn paired_coordinates(params: &serde_json::Value) -> ApiResult<()> {
+    let has_coordinate = |field: &str| params.get(field).is_some_and(|value| !value.is_null());
+    if has_coordinate("latitude") == has_coordinate("longitude") {
+        Ok(())
+    } else {
+        Err(ApiError::Parse(
+            "latitude and longitude must both be set or both be left empty".to_owned(),
+        ))
+    }
+}
+
+fn required_field(params: &serde_json::Value, field: &str) -> ApiResult<String> {
+    params
+        .get(field)
+        .and_then(serde_json::Value::as_str)
+        .map(std::borrow::ToOwned::to_owned)
+        .ok_or_else(|| ApiError::Parse(format!("{field} is required")))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn region_update_body_preserves_explicit_restriction_clears() {
+        let expected = json!({
+            "required_guild_features": [],
+            "allowed_guild_ids": [],
+            "allowed_user_ids": [],
+        });
+        let mut params = expected.clone();
+        params["id"] = json!("eu");
+        let body = voice_request_body(&params, &["id"]).expect("region body");
+        validate_against::<generated_types::UpdateVoiceRegionRequestBody>(&body)
+            .expect("valid region body");
+        assert_eq!(body, expected);
+    }
+
+    #[test]
+    fn server_update_body_preserves_clears_and_omitted_restrictions() {
+        for expected in [
+            json!({
+                "required_guild_features": [],
+                "allowed_guild_ids": [],
+                "allowed_user_ids": [],
+                "soft_connection_limit": null,
+                "latitude": null,
+                "longitude": null,
+            }),
+            json!({"is_active": false}),
+        ] {
+            let mut params = expected.clone();
+            params["region_id"] = json!("eu");
+            params["server_id"] = json!("primary");
+            let body =
+                voice_request_body(&params, &["region_id", "server_id"]).expect("server body");
+            validate_against::<generated_types::UpdateVoiceServerRequestBody>(&body)
+                .expect("valid server body");
+            assert_eq!(body, expected);
+        }
+    }
+
+    #[test]
+    fn create_server_body_keeps_the_server_id_and_rejects_missing_fields() {
+        let expected = json!({
+            "server_id": "primary",
+            "endpoint": "wss://voice.example.com",
+            "api_key": "key",
+            "api_secret": "secret",
+        });
+        let mut params = expected.clone();
+        params["region_id"] = json!("eu");
+        let body = voice_request_body(&params, &["region_id"]).expect("server body");
+        validate_against::<generated_types::CreateVoiceServerRequestBody>(&body)
+            .expect("valid server body");
+        assert_eq!(body, expected);
+        assert!(
+            validate_against::<generated_types::CreateVoiceServerRequestBody>(&json!({})).is_err()
+        );
+    }
+}
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use fluxer_common::config::normalize_public_endpoint_from_env;
 use std::env;

 const DEFAULT_ADMIN_OAUTH_CLIENT_ID: &str = "1234567890123456789";
@@ -40,40 +41,47 @@ pub enum RuntimeEnv {
 }

 impl AdminConfig {
-    pub fn from_env() -> Self {
+    pub fn from_env() -> anyhow::Result<Self> {
        let base_path = normalize_base_path(&read_env("FLUXER_ADMIN_BASE_PATH", ""));
-        let admin_endpoint = trim_trailing_slash(&read_env(
+        let admin_endpoint = normalize_public_endpoint_from_env(&trim_trailing_slash(&read_env(
            "FLUXER_ADMIN_ENDPOINT",
            "https://admin.fluxer.app",
-        ));
-        let oauth_redirect_uri = read_env_preferred(
+        )));
+        let oauth_redirect_uri = normalize_public_endpoint_from_env(&read_env_preferred(
            &["FLUXER_ADMIN_OAUTH_REDIRECT_URI"],
            &format!("{admin_endpoint}/oauth2_callback"),
+        ));
+        let secret_key_base = read_env("FLUXER_ADMIN_SECRET_KEY_BASE", "");
+        anyhow::ensure!(
+            !secret_key_base.trim().is_empty(),
+            "FLUXER_ADMIN_SECRET_KEY_BASE is required"
        );

-        Self {
+        Ok(Self {
            env: RuntimeEnv::from_env_value(&read_env("FLUXER_ENV", "development")),
            host: read_env("FLUXER_ADMIN_HOST", "0.0.0.0"),
            port: read_env("FLUXER_ADMIN_PORT", "3020")
                .parse()
                .unwrap_or(3020),
-            secret_key_base: read_env("FLUXER_ADMIN_SECRET_KEY_BASE", "development-admin-secret"),
+            secret_key_base,
            base_path,
            api_endpoint: trim_trailing_slash(&read_env(
                "FLUXER_API_ENDPOINT",
                "https://api.fluxer.app",
            )),
-            media_endpoint: trim_trailing_slash(&read_env(
+            media_endpoint: normalize_public_endpoint_from_env(&trim_trailing_slash(&read_env(
                "FLUXER_MEDIA_ENDPOINT",
                "https://media.fluxer.app",
+            ))),
+            static_cdn_endpoint: normalize_public_endpoint_from_env(&trim_trailing_slash(
+                &read_env("FLUXER_STATIC_CDN_ENDPOINT", ""),
            )),
-            static_cdn_endpoint: trim_trailing_slash(&read_env("FLUXER_STATIC_CDN_ENDPOINT", "")),

            admin_endpoint,
-            web_app_endpoint: trim_trailing_slash(&read_env(
+            web_app_endpoint: normalize_public_endpoint_from_env(&trim_trailing_slash(&read_env(
                "FLUXER_APP_ENDPOINT",
                "https://app.fluxer.app",
-            )),
+            ))),
            kv_url: read_env("FLUXER_KV_URL", ""),
            oauth_client_id: read_env(
                "FLUXER_ADMIN_OAUTH_CLIENT_ID",
@@ -107,7 +115,7 @@ impl AdminConfig {
                .trim()
                .to_ascii_lowercase(),
            },
-        }
+        })
    }

    pub fn is_dev(&self) -> bool {
@@ -117,6 +125,15 @@ impl AdminConfig {
    pub fn is_production(&self) -> bool {
        self.env == RuntimeEnv::Production
    }
+
+    pub fn secure_cookies(&self) -> bool {
+        self.admin_endpoint.starts_with("https://")
+    }
+
+    pub fn admin_origin(&self) -> Option<String> {
+        let origin = url::Url::parse(&self.admin_endpoint).ok()?.origin();
+        origin.is_tuple().then(|| origin.ascii_serialization())
+    }
 }

 impl RuntimeEnv {
@@ -166,6 +183,41 @@ pub(crate) fn read_bool_env(names: &[&str], fallback: bool) -> bool {
 #[cfg(test)]
 mod tests {
    use super::*;
+    use std::sync::Mutex;
+
+    static ENV_LOCK: Mutex<()> = Mutex::new(());
+
+    const MANAGED_ENV: [&str; 11] = [
+        "FLUXER_ENV",
+        "FLUXER_ADMIN_HOST",
+        "FLUXER_ADMIN_PORT",
+        "FLUXER_ADMIN_ENDPOINT",
+        "FLUXER_ADMIN_OAUTH_CLIENT_ID",
+        "FLUXER_ADMIN_OAUTH_REDIRECT_URI",
+        "FLUXER_MASTER_CONFIG",
+        "FLUXER_APP_ENDPOINT",
+        "FLUXER_MEDIA_ENDPOINT",
+        "FLUXER_STATIC_CDN_ENDPOINT",
+        "FLUXER_BASE_DOMAIN",
+    ];
+
+    fn config_from_env(vars: &[(&str, &str)]) -> AdminConfig {
+        let _guard = ENV_LOCK.lock().unwrap();
+        for name in MANAGED_ENV {
+            unsafe { env::remove_var(name) };
+        }
+        unsafe { env::remove_var("FLUXER_PUBLIC_PORT") };
+        unsafe { env::remove_var("FLUXER_PUBLIC_ORIGIN") };
+        unsafe { env::set_var("FLUXER_ADMIN_SECRET_KEY_BASE", "test-secret") };
+        for (name, value) in vars {
+            unsafe { env::set_var(name, value) };
+        }
+        let config = AdminConfig::from_env().expect("config loads with a secret");
+        for (name, _) in vars {
+            unsafe { env::remove_var(name) };
+        }
+        config
+    }

    #[test]
    fn normalize_base_path_strips_trailing_slashes() {
@@ -287,18 +339,7 @@ mod tests {

    #[test]
    fn from_env_uses_defaults() {
-        for var in &[
-            "FLUXER_ENV",
-            "FLUXER_ADMIN_HOST",
-            "FLUXER_ADMIN_PORT",
-            "FLUXER_ADMIN_ENDPOINT",
-            "FLUXER_ADMIN_OAUTH_CLIENT_ID",
-            "FLUXER_ADMIN_OAUTH_REDIRECT_URI",
-            "FLUXER_MASTER_CONFIG",
-        ] {
-            unsafe { env::remove_var(var) };
-        }
-        let config = AdminConfig::from_env();
+        let config = config_from_env(&[]);
        assert_eq!(config.env, RuntimeEnv::Development);
        assert_eq!(config.host, "0.0.0.0");
        assert_eq!(config.port, 3020);
@@ -308,4 +349,77 @@ mod tests {
            "https://admin.fluxer.app/oauth2_callback"
        );
    }
+
+    #[test]
+    fn a_non_default_public_port_reaches_the_public_endpoints() {
+        let config = config_from_env(&[
+            ("FLUXER_BASE_DOMAIN", "fluxer.example"),
+            ("FLUXER_PUBLIC_PORT", "19080"),
+            ("FLUXER_ADMIN_ENDPOINT", "http://fluxer.example/admin"),
+            ("FLUXER_APP_ENDPOINT", "http://fluxer.example"),
+            ("FLUXER_MEDIA_ENDPOINT", "http://fluxer.example/media"),
+            ("FLUXER_STATIC_CDN_ENDPOINT", "https://cdn.example.net"),
+            (
+                "FLUXER_ADMIN_OAUTH_REDIRECT_URI",
+                "http://fluxer.example/admin/oauth2_callback",
+            ),
+        ]);
+
+        assert_eq!(config.admin_endpoint, "http://fluxer.example:19080/admin");
+        assert_eq!(config.media_endpoint, "http://fluxer.example:19080/media");
+        assert_eq!(config.web_app_endpoint, "http://fluxer.example:19080");
+        assert_eq!(config.static_cdn_endpoint, "https://cdn.example.net");
+        assert_eq!(
+            config.oauth_redirect_uri,
+            format!("{}/oauth2_callback", config.admin_endpoint)
+        );
+    }
+
+    #[test]
+    fn a_default_public_port_leaves_the_public_endpoints_alone() {
+        let config = config_from_env(&[
+            ("FLUXER_BASE_DOMAIN", "fluxer.example"),
+            ("FLUXER_PUBLIC_PORT", "443"),
+            ("FLUXER_ADMIN_ENDPOINT", "https://fluxer.example/admin"),
+            ("FLUXER_APP_ENDPOINT", "https://fluxer.example"),
+            ("FLUXER_MEDIA_ENDPOINT", "https://fluxer.example/media"),
+            ("FLUXER_STATIC_CDN_ENDPOINT", "https://fluxer.example"),
+            (
+                "FLUXER_ADMIN_OAUTH_REDIRECT_URI",
+                "https://fluxer.example/admin/oauth2_callback",
+            ),
+        ]);
+
+        assert_eq!(config.admin_endpoint, "https://fluxer.example/admin");
+        assert_eq!(config.media_endpoint, "https://fluxer.example/media");
+        assert_eq!(config.web_app_endpoint, "https://fluxer.example");
+        assert_eq!(config.static_cdn_endpoint, "https://fluxer.example");
+        assert_eq!(
+            config.oauth_redirect_uri,
+            "https://fluxer.example/admin/oauth2_callback"
+        );
+    }
+
+    #[test]
+    fn the_oauth_redirect_uri_matches_the_api_derived_admin_endpoint() {
+        let config = config_from_env(&[
+            ("FLUXER_BASE_DOMAIN", "fluxer.example"),
+            ("FLUXER_PUBLIC_PORT", "19080"),
+            ("FLUXER_ADMIN_ENDPOINT", "http://fluxer.example/admin"),
+            (
+                "FLUXER_ADMIN_OAUTH_REDIRECT_URI",
+                "http://fluxer.example/admin/oauth2_callback",
+            ),
+        ]);
+
+        let api_admin_endpoint = fluxer_common::config::normalize_public_endpoint(
+            "http://fluxer.example/admin",
+            "fluxer.example",
+            Some(19080),
+        );
+        assert_eq!(
+            config.oauth_redirect_uri,
+            format!("{api_admin_endpoint}/oauth2_callback")
+        );
+    }
 }
@@ -14,7 +14,7 @@ async fn main() -> anyhow::Result<()> {
        .with(tracing_subscriber::fmt::layer())
        .init();

-    let config = AdminConfig::from_env();
+    let config = AdminConfig::from_env()?;
    let addr = format!("{}:{}", config.host, config.port);
    let router = build_router(config);

@@ -135,7 +135,7 @@ async fn fetch_admin_user(
    config: &crate::config::AdminConfig,
    session: &Session,
 ) -> AdminFetchResult {
-    let url = format!("{}/admin/users/me", config.api_endpoint);
+    let url = format!("{}/admin/users/@me", config.api_endpoint);
    let response =
        match crate::api::client::with_proxy_client_ip_header(http_client.get(&url), config)
            .header("Authorization", format!("Bearer {}", session.access_token))
@@ -2,24 +2,42 @@

 use axum::{
    body::{Body, to_bytes},
-    extract::Request,
+    extract::{Request, State},
    http::{HeaderValue, Method, StatusCode, header},
    middleware::Next,
    response::{IntoResponse, Response},
 };
-use rand::RngExt;
+
+use crate::middleware::auth::AuthContext;
+use crate::session::{create_csrf_token, verify_csrf_token};
+use crate::state::AppState;

 const CSRF_COOKIE_NAME: &str = "csrf_token";
 pub const CSRF_FORM_FIELD: &str = "_csrf";
 const CSRF_HEADER_NAME: &str = "x-csrf-token";
-const TOKEN_LENGTH: usize = 32;
+const HOST_CSRF_COOKIE_NAME: &str = "__Host-csrf_token";
 const MAX_CSRF_FORM_BYTES: usize = 8 * 1024 * 1024;

 const IGNORED_PATH_SUFFIXES: &[&str] = &["/oauth2_callback", "/auth/start"];

-pub async fn csrf_protection(mut request: Request, next: Next) -> Response {
-    let existing_token = extract_csrf_cookie(&request);
-    let token = existing_token.unwrap_or_else(generate_csrf_token);
+pub async fn csrf_protection(
+    State(state): State<AppState>,
+    mut request: Request,
+    next: Next,
+) -> Response {
+    let config = state.config();
+    let secret = config.secret_key_base.clone();
+    let secure_cookies = config.secure_cookies();
+
+    let user_id = request
+        .extensions()
+        .get::<AuthContext>()
+        .map(|ctx| ctx.session.user_id.clone())
+        .unwrap_or_default();
+
+    let token = extract_csrf_cookie(&request)
+        .filter(|cookie| verify_csrf_token(cookie, &user_id, &secret))
+        .unwrap_or_else(|| create_csrf_token(&user_id, &secret));
    request.extensions_mut().insert(CsrfToken(token.clone()));

    if matches!(
@@ -31,6 +49,9 @@ pub async fn csrf_protection(mut request: Request, next: Next) -> Response {
            .iter()
            .any(|suffix| path.ends_with(suffix));
        if !is_ignored {
+            if !is_same_site_request(&request, config.admin_origin().as_deref()) {
+                return StatusCode::FORBIDDEN.into_response();
+            }
            let header_token = extract_csrf_header(&request);
            let query_token = extract_csrf_from_query(&request);
            let mut submitted = query_token.or(header_token);
@@ -43,40 +64,58 @@ pub async fn csrf_protection(mut request: Request, next: Next) -> Response {
                request = restored_request;
                submitted = body_token;
            }
-            match submitted {
-                Some(ref submitted_token) if submitted_token == &token => {}
-                _ => {
-                    return StatusCode::FORBIDDEN.into_response();
-                }
+            let accepted = submitted.as_deref().is_some_and(|submitted_token| {
+                submitted_token == token && verify_csrf_token(submitted_token, &user_id, &secret)
+            });
+            if !accepted {
+                return StatusCode::FORBIDDEN.into_response();
            }
        }
    }

    let mut response = next.run(request).await;

-    let cookie_value = format!(
-        "{}={}; Path=/; SameSite=Lax; HttpOnly",
-        CSRF_COOKIE_NAME, token
-    );
+    let cookie_name = if secure_cookies {
+        HOST_CSRF_COOKIE_NAME
+    } else {
+        CSRF_COOKIE_NAME
+    };
+    let secure = if secure_cookies { "; Secure" } else { "" };
+    let cookie_value = format!("{cookie_name}={token}; Path=/; SameSite=Lax; HttpOnly{secure}");
    if let Ok(value) = HeaderValue::from_str(&cookie_value) {
        response.headers_mut().append(header::SET_COOKIE, value);
    }
+    if secure_cookies
+        && let Ok(value) = HeaderValue::from_str(&format!(
+            "{CSRF_COOKIE_NAME}=; Path=/; SameSite=Lax; HttpOnly; Max-Age=0"
+        ))
+    {
+        response.headers_mut().append(header::SET_COOKIE, value);
+    }

    response
 }

 fn extract_csrf_cookie(request: &Request) -> Option<String> {
    let cookie_header = request.headers().get(header::COOKIE)?.to_str().ok()?;
+    let mut legacy = None;
    for pair in cookie_header.split(';') {
        let pair = pair.trim();
-        if let Some(value) = pair.strip_prefix("csrf_token=") {
+        if let Some(value) = pair.strip_prefix("__Host-csrf_token=") {
            let trimmed = value.trim();
            if !trimmed.is_empty() {
                return Some(trimmed.to_owned());
            }
+        } else if let Some(value) = pair.strip_prefix("csrf_token=")
+            && legacy.is_none()
+        {
+            let trimmed = value.trim();
+            if !trimmed.is_empty() {
+                legacy = Some(trimmed.to_owned());
+            }
        }
    }
-    None
+    legacy
 }

 fn extract_csrf_header(request: &Request) -> Option<String> {
@@ -127,18 +166,22 @@ async fn extract_csrf_from_form_body(
    Ok((request, token))
 }

-fn generate_csrf_token() -> String {
-    let mut rng = rand::rng();
-    let bytes: [u8; TOKEN_LENGTH] = rng.random();
-    hex_encode(&bytes)
-}
-
-fn hex_encode(bytes: &[u8]) -> String {
-    let mut s = String::with_capacity(bytes.len() * 2);
-    for byte in bytes {
-        s.push_str(&format!("{byte:02x}"));
+fn is_same_site_request(request: &Request, admin_origin: Option<&str>) -> bool {
+    if let Some(site) = request
+        .headers()
+        .get("sec-fetch-site")
+        .and_then(|value| value.to_str().ok())
+    {
+        return matches!(site, "same-origin" | "same-site" | "none");
+    }
+    match request
+        .headers()
+        .get(header::ORIGIN)
+        .and_then(|value| value.to_str().ok())
+    {
+        Some(origin) => admin_origin.is_some_and(|expected| origin == expected),
+        None => true,
    }
-    s
 }

 #[derive(Clone, Debug)]
@@ -155,39 +198,172 @@ pub fn get_csrf_token(request: &Request) -> String {
 #[cfg(test)]
 mod tests {
    use super::*;
+    use crate::config::{AdminConfig, ProxyConfig, RuntimeEnv};
+    use crate::state::AppState;
+    use axum::{Router, middleware::from_fn_with_state, routing::get};
+    use tower::ServiceExt;

-    #[test]
-    fn generate_csrf_token_correct_length() {
-        let token = generate_csrf_token();
-        assert_eq!(
-            token.len(),
-            TOKEN_LENGTH * 2,
-            "token must be {} hex chars",
-            TOKEN_LENGTH * 2
-        );
+    fn state_with_admin_endpoint(admin_endpoint: &str) -> AppState {
+        AppState::new(AdminConfig {
+            env: RuntimeEnv::Production,
+            host: String::new(),
+            port: 3020,
+            secret_key_base: "test-secret".to_owned(),
+            base_path: String::new(),
+            api_endpoint: String::new(),
+            media_endpoint: String::new(),
+            static_cdn_endpoint: String::new(),
+            admin_endpoint: admin_endpoint.to_owned(),
+            web_app_endpoint: String::new(),
+            kv_url: String::new(),
+            oauth_client_id: String::new(),
+            oauth_client_secret: String::new(),
+            oauth_redirect_uri: String::new(),
+            build_version: "test".to_owned(),
+            release_channel: String::new(),
+            self_hosted: false,
+            proxy: ProxyConfig {
+                trust_client_ip_header: false,
+                client_ip_header_name: String::new(),
+            },
+        })
    }

-    #[test]
-    fn generate_csrf_token_is_valid_hex() {
-        let token = generate_csrf_token();
+    async fn csrf_cookies(admin_endpoint: &str) -> Vec<String> {
+        let state = state_with_admin_endpoint(admin_endpoint);
+        let app = Router::new()
+            .route("/", get(|| async { "ok" }))
+            .layer(from_fn_with_state(state, csrf_protection));
+        let response = app
+            .oneshot(Request::builder().uri("/").body(Body::empty()).unwrap())
+            .await
+            .expect("router responds");
+        response
+            .headers()
+            .get_all(header::SET_COOKIE)
+            .iter()
+            .filter_map(|value| value.to_str().ok())
+            .map(|value| value.to_owned())
+            .collect()
+    }
+
+    #[tokio::test]
+    async fn https_admin_endpoint_sets_a_host_prefixed_secure_cookie() {
+        let cookies = csrf_cookies("https://example.com/admin").await;
        assert!(
-            token.chars().all(|c| c.is_ascii_hexdigit()),
-            "token must contain only hex chars: {token}"
+            cookies
+                .iter()
+                .any(|cookie| cookie.starts_with("__Host-csrf_token=")
+                    && cookie.contains("; Secure")),
+            "expected a secure __Host- cookie, got {cookies:?}"
        );
    }

-    #[test]
-    fn generate_csrf_token_is_unique() {
-        let a = generate_csrf_token();
-        let b = generate_csrf_token();
-        assert_ne!(a, b, "consecutive tokens must differ");
+    #[tokio::test]
+    async fn http_admin_endpoint_sets_a_plain_cookie_without_secure() {
+        let cookies = csrf_cookies("http://example.com/admin").await;
+        assert!(
+            cookies
+                .iter()
+                .any(|cookie| cookie.starts_with("csrf_token=") && !cookie.contains("Secure")),
+            "expected a plain csrf_token cookie, got {cookies:?}"
+        );
+        assert!(
+            !cookies.iter().any(|cookie| cookie.contains("__Host-")),
+            "expected no __Host- cookie, got {cookies:?}"
+        );
    }

-    #[test]
-    fn hex_encode_produces_correct_output() {
-        assert_eq!(hex_encode(&[0x00, 0xff, 0x0a]), "00ff0a");
-        assert_eq!(hex_encode(&[]), "");
-        assert_eq!(hex_encode(&[0xde, 0xad]), "dead");
+    async fn action_status(admin_endpoint: &str, origin: &str) -> StatusCode {
+        let state = state_with_admin_endpoint(admin_endpoint);
+        let app = Router::new()
+            .route("/", get(|| async { "ok" }).post(|| async { "ok" }))
+            .layer(from_fn_with_state(state, csrf_protection));
+        let issued = app
+            .clone()
+            .oneshot(Request::builder().uri("/").body(Body::empty()).unwrap())
+            .await
+            .expect("router responds");
+        let cookie = issued
+            .headers()
+            .get_all(header::SET_COOKIE)
+            .iter()
+            .filter_map(|value| value.to_str().ok())
+            .filter_map(|value| value.split(';').next())
+            .find(|pair| pair.contains("csrf_token=") && !pair.ends_with('='))
+            .expect("a csrf cookie is issued")
+            .to_owned();
+        let token = cookie.split_once('=').expect("a cookie value").1.to_owned();
+        let response = app
+            .oneshot(
+                Request::builder()
+                    .method(Method::POST)
+                    .uri("/")
+                    .header(header::COOKIE, cookie.as_str())
+                    .header(header::ORIGIN, origin)
+                    .header(CSRF_HEADER_NAME, token.as_str())
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .expect("router responds");
+        response.status()
+    }
+
+    #[tokio::test]
+    async fn a_matching_origin_passes_the_same_site_check() {
+        let status = action_status(
+            "https://admin.example.test/admin",
+            "https://admin.example.test",
+        )
+        .await;
+        assert_eq!(status, StatusCode::OK);
+    }
+
+    #[tokio::test]
+    async fn a_matching_origin_on_a_non_default_port_passes_the_same_site_check() {
+        let status = action_status(
+            "https://admin.example.test:19080/admin",
+            "https://admin.example.test:19080",
+        )
+        .await;
+        assert_eq!(status, StatusCode::OK);
+    }
+
+    #[tokio::test]
+    async fn a_foreign_origin_fails_the_same_site_check() {
+        let status = action_status(
+            "https://admin.example.test:19080/admin",
+            "https://evil.example.test:19080",
+        )
+        .await;
+        assert_eq!(status, StatusCode::FORBIDDEN);
+    }
+
+    #[tokio::test]
+    async fn another_port_on_the_admin_host_fails_the_same_site_check() {
+        let status = action_status(
+            "https://admin.example.test:19080/admin",
+            "https://admin.example.test",
+        )
+        .await;
+        assert_eq!(status, StatusCode::FORBIDDEN);
+    }
+
+    #[tokio::test]
+    async fn an_unparseable_admin_endpoint_fails_closed() {
+        let status = action_status("not-an-endpoint", "https://admin.example.test").await;
+        assert_eq!(status, StatusCode::FORBIDDEN);
+    }
+
+    #[tokio::test]
+    async fn an_explicit_default_port_matches_a_portless_origin() {
+        let status = action_status(
+            "https://admin.example.test:443/admin",
+            "https://admin.example.test",
+        )
+        .await;
+        assert_eq!(status, StatusCode::OK);
    }

    #[test]
@@ -92,9 +92,9 @@ pub fn clear_flash_cookie(response: &mut Response) {
    }
 }

-pub fn redirect_with_flash(url: &str, flash: FlashData, is_production: bool) -> Response {
+pub fn redirect_with_flash(url: &str, flash: FlashData, secure: bool) -> Response {
    let encoded = serialize_flash(&flash);
-    let secure_flag = if is_production { "; Secure" } else { "" };
+    let secure_flag = if secure { "; Secure" } else { "" };
    let cookie_value = format!(
        "{FLASH_COOKIE_NAME}={encoded}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60{secure_flag}"
    );
@@ -81,7 +81,7 @@ async fn admin_api_keys_post(
        "create" => {
            let name = form.clean("name").unwrap_or_default();
            let acls = form.list_values_any(&["acls[]", "acls"]);
-            return match client.create_api_key(&name, &acls).await {
+            match client.create_api_key(&name, &acls).await {
                Ok(created) => {
                    let keys = client
                        .list_api_keys()
@@ -107,29 +107,38 @@ async fn admin_api_keys_post(
                        is_htmx,
                    )
                }
-            };
-        }
-        "revoke" => {
-            if let Some(key_id) = form.clean("key_id") {
-                let result = client.revoke_api_key(&key_id).await;
-                let flash = match result.log_error("revoke API key") {
-                    Some(_) => FlashData::success("API key revoked."),
-                    None => FlashData::error("Failed to revoke API key"),
-                };
-                return flash::redirect_with_flash(
-                    &format!("{base}/admin-api-keys"),
-                    flash,
-                    config.is_production(),
-                );
            }
        }
-        _ => {}
+        "revoke" => {
+            let Some(key_id) = form.clean("key_id") else {
+                return admin_api_key_flash_response(
+                    config,
+                    FlashData::error("API key ID is required"),
+                    is_htmx,
+                );
+            };
+            let result = client.revoke_api_key(&key_id).await;
+            let flash = match result.log_error("revoke API key") {
+                Some(_) => FlashData::success("API key revoked."),
+                None => FlashData::error("Failed to revoke API key"),
+            };
+            flash::redirect_with_flash(
+                &format!("{base}/admin-api-keys"),
+                flash,
+                config.secure_cookies(),
+            )
+        }
+        "" => admin_api_key_flash_response(
+            config,
+            FlashData::error("API key action is required"),
+            is_htmx,
+        ),
+        _ => admin_api_key_flash_response(
+            config,
+            FlashData::error("Unknown API key action"),
+            is_htmx,
+        ),
    }
-    flash::redirect_with_flash(
-        &format!("{base}/admin-api-keys"),
-        FlashData::success(format!("API key action '{action}' completed.")),
-        config.is_production(),
-    )
 }

 fn admin_api_key_flash_response(
@@ -143,7 +152,7 @@ fn admin_api_key_flash_response(
        flash::redirect_with_flash(
            &format!("{}/admin-api-keys", config.base_path),
            flash_data,
-            config.is_production(),
+            config.secure_cookies(),
        )
    }
 }
@@ -151,7 +151,7 @@ async fn application_detail_post(
            return flash::redirect_with_flash(
                &format!("{base}/applications/{application_id}"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -178,6 +178,6 @@ async fn application_detail_post(
    flash::redirect_with_flash(
        &format!("{base}/applications/{application_id}"),
        flash,
-        config.is_production(),
+        config.secure_cookies(),
    )
 }
@@ -187,7 +187,7 @@ async fn oauth2_callback_finish(

    let session_cookie_value =
        session::create_session(&user.id, &token.access_token, &config.secret_key_base);
-    let secure = if config.is_production() {
+    let secure = if config.secure_cookies() {
        "; Secure"
    } else {
        ""
@@ -348,7 +348,7 @@ fn oauth_callback_page(config: &AdminConfig, code: Option<&str>, state: Option<&
    )
 }

-fn json_string(value: &str) -> String {
+pub(crate) fn json_string(value: &str) -> String {
    serde_json::to_string(value)
        .expect("JSON string serialization cannot fail")
        .replace('<', "\\u003c")
@@ -16,7 +16,7 @@ use axum::{

 use super::ActionQuery;
 use super::bans_actions::{
-    BanFormData, custom_flash, execute_ban, extract_value, flash_response, htmx_flash,
+    BanFormData, custom_flash, execute_ban, extract_value, flash_response, render_inline_flash,
 };

 pub fn router() -> Router<AppState> {
@@ -105,7 +105,7 @@ async fn generic_ban_post(
        form.audit_log_reason.as_deref(),
    )
    .await;
-    flash_response(config, auth, is_htmx, &level, &msg, ban_cfg, csrf_token)
+    flash_response(config, auth, is_htmx, level, &msg, ban_cfg, csrf_token)
 }

 macro_rules! ban_post {
@@ -171,19 +171,22 @@ async fn url_domain_bans_post(
        Query::try_from_uri(request.uri()).unwrap_or(Query(ActionQuery { action: None }));
    let form: BanFormData = match Form::from_request(request, &state).await {
        Ok(Form(f)) => f,
-        Err(_) => return htmx_flash("error", "Invalid form data", &headers),
+        Err(_) => return render_inline_flash("error", "Invalid form data"),
    };
    let is_htmx = htmx::is_htmx_request(&headers);
    let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
    let domain = form.domain.as_deref().unwrap_or("").trim().to_owned();
    if domain.is_empty() {
-        return htmx_flash("error", "Domain is required", &headers);
+        return render_inline_flash("error", "Domain is required");
    }
    let action = aq.action.as_deref().unwrap_or("");
    let (level, msg) = match action {
        "ban" => {
            let m_sub = form.match_subdomains.as_deref() == Some("true");
-            match client.ban_url_domain(&domain, m_sub).await {
+            match client
+                .ban_url_domain(&domain, m_sub, form.audit_log_reason.as_deref())
+                .await
+            {
                Ok(()) => ("success", format!("Domain {domain} banned successfully")),
                Err(error) => {
                    tracing::warn!(%error, domain, "admin API request failed: ban URL domain");
@@ -191,7 +194,10 @@ async fn url_domain_bans_post(
                }
            }
        }
-        "unban" => match client.unban_url_domain(&domain).await {
+        "unban" => match client
+            .unban_url_domain(&domain, form.audit_log_reason.as_deref())
+            .await
+        {
            Ok(()) => ("success", format!("Domain {domain} unbanned")),
            Err(error) => {
                tracing::warn!(%error, domain, "admin API request failed: unban URL domain");
@@ -247,25 +253,31 @@ async fn profile_substring_bans_post(
        Query::try_from_uri(request.uri()).unwrap_or(Query(ActionQuery { action: None }));
    let form: BanFormData = match Form::from_request(request, &state).await {
        Ok(Form(f)) => f,
-        Err(_) => return htmx_flash("error", "Invalid form data", &headers),
+        Err(_) => return render_inline_flash("error", "Invalid form data"),
    };
    let is_htmx = htmx::is_htmx_request(&headers);
    let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
    let scope = form.scope.as_deref().unwrap_or("").trim().to_owned();
    let substring = form.substring.as_deref().unwrap_or("").trim().to_owned();
    if scope.is_empty() || substring.is_empty() {
-        return htmx_flash("error", "Scope and substring required", &headers);
+        return render_inline_flash("error", "Scope and substring required");
    }
    let action = aq.action.as_deref().unwrap_or("");
    let (level, msg) = match action {
-        "ban" => match client.ban_profile_substring(&scope, &substring).await {
+        "ban" => match client
+            .ban_profile_substring(&scope, &substring, form.audit_log_reason.as_deref())
+            .await
+        {
            Ok(()) => ("success", format!("\"{substring}\" banned for {scope}")),
            Err(error) => {
                tracing::warn!(%error, scope, substring, "admin API request failed: ban profile substring");
                ("error", format!("Failed to ban substring for {scope}"))
            }
        },
-        "unban" => match client.unban_profile_substring(&scope, &substring).await {
+        "unban" => match client
+            .unban_profile_substring(&scope, &substring, form.audit_log_reason.as_deref())
+            .await
+        {
            Ok(()) => ("success", format!("\"{substring}\" unbanned for {scope}")),
            Err(error) => {
                tracing::warn!(%error, scope, substring, "admin API request failed: unban profile substring");
@@ -1,17 +1,13 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::client::AdminApiClient;
+use crate::api::client::{AdminApiClient, ApiResult};
 use crate::api::types::{FlashLevel, FlashMessage};
 use crate::middleware::auth::AuthContext;
 use crate::templates;
-use axum::{
-    http::HeaderMap,
-    response::{Html, IntoResponse, Response},
-};
+use axum::response::{Html, IntoResponse, Response};
 use serde::Deserialize;

 #[derive(Deserialize)]
-#[allow(dead_code)]
 pub struct BanFormData {
    #[serde(default)]
    pub ip: Option<String>,
@@ -65,7 +61,7 @@ pub async fn execute_ban(
    bulk_hashes: Option<&str>,
    bulk_sha256_list: Option<&str>,
    audit_log_reason: Option<&str>,
-) -> (String, String) {
+) -> (&'static str, String) {
    if (action == "bulk-ban" || action == "bulk-ban-files") && ban_type == "file-sha-bans" {
        let raw_hashes = if action == "bulk-ban-files" {
            bulk_sha256_list
@@ -75,13 +71,13 @@ pub async fn execute_ban(
        return execute_bulk_ban(client, raw_hashes, audit_log_reason).await;
    }
    if value.is_empty() {
-        return ("error".into(), "Value is required".into());
+        return ("error", "Value is required".into());
    }
    match action {
        "ban" => execute_single_ban(client, ban_type, value, audit_log_reason).await,
        "unban" => execute_single_unban(client, ban_type, value, audit_log_reason).await,
        "check" => execute_check(client, ban_type, value).await,
-        _ => ("error".into(), "Unknown action".into()),
+        _ => ("error", "Unknown action".into()),
    }
 }

@@ -89,7 +85,7 @@ async fn execute_bulk_ban(
    client: &AdminApiClient,
    bulk_hashes: Option<&str>,
    audit_log_reason: Option<&str>,
-) -> (String, String) {
+) -> (&'static str, String) {
    let hashes: Vec<String> = bulk_hashes
        .unwrap_or("")
        .split(|c: char| c.is_whitespace() || c == ',' || c == ';')
@@ -98,18 +94,15 @@ async fn execute_bulk_ban(
        .collect();
    if hashes.is_empty() {
        return (
-            "error".into(),
+            "error",
            "No valid 64-character hex hashes found in input".into(),
        );
    }
    match client.bulk_ban_file_shas(&hashes, audit_log_reason).await {
-        Ok(r) => (
-            "success".into(),
-            format!("Bulk ban job created: {}", r.job_id),
-        ),
+        Ok(r) => ("success", format!("Bulk ban job created: {}", r.job_id)),
        Err(error) => {
            tracing::warn!(%error, "admin API request failed: bulk ban file SHAs");
-            ("error".into(), "Failed to enqueue bulk ban job".into())
+            ("error", "Failed to enqueue bulk ban job".into())
        }
    }
 }
@@ -119,29 +112,26 @@ async fn execute_single_ban(
    ban_type: &str,
    value: &str,
    audit_log_reason: Option<&str>,
-) -> (String, String) {
-    let success = format!("{value} banned successfully");
-    let failure = format!("Failed to ban {value}");
-    match ban_type {
-        "ip-bans" => ban_action_result(client.ban_ip(value).await, success, failure),
-        "email-bans" => ban_action_result(client.ban_email(value).await, success, failure),
-        "suspicious-email-domains" => ban_action_result(
-            client.add_suspicious_email_domain(value).await,
-            success,
-            failure,
-        ),
-        "phrase-bans" => ban_action_result(client.ban_phrase(value).await, success, failure),
-        "url-bans" => ban_action_result(client.ban_url(value).await, success, failure),
-        "file-sha-bans" => ban_action_result(
-            client.ban_file_sha(value, audit_log_reason).await,
-            success,
-            failure,
-        ),
-        "avatar-hash-bans" => {
-            ban_action_result(client.ban_avatar_hash(value).await, success, failure)
+) -> (&'static str, String) {
+    let result = match ban_type {
+        "ip-bans" => client.ban_ip(value, audit_log_reason).await,
+        "email-bans" => client.ban_email(value, audit_log_reason).await,
+        "suspicious-email-domains" => {
+            client
+                .add_suspicious_email_domain(value, audit_log_reason)
+                .await
        }
-        _ => ("error".into(), "Unknown ban type".into()),
-    }
+        "phrase-bans" => client.ban_phrase(value, audit_log_reason).await,
+        "url-bans" => client.ban_url(value, audit_log_reason).await,
+        "file-sha-bans" => client.ban_file_sha(value, audit_log_reason).await,
+        "avatar-hash-bans" => client.ban_avatar_hash(value, audit_log_reason).await,
+        _ => return ("error", "Unknown ban type".into()),
+    };
+    ban_action_result(
+        result,
+        format!("{value} banned successfully"),
+        format!("Failed to ban {value}"),
+    )
 }

 async fn execute_single_unban(
@@ -149,32 +139,33 @@ async fn execute_single_unban(
    ban_type: &str,
    value: &str,
    audit_log_reason: Option<&str>,
-) -> (String, String) {
-    let success = format!("{value} unbanned successfully");
-    let failure = format!("Failed to unban {value}");
-    match ban_type {
-        "ip-bans" => ban_action_result(client.unban_ip(value).await, success, failure),
-        "email-bans" => ban_action_result(client.unban_email(value).await, success, failure),
-        "suspicious-email-domains" => ban_action_result(
-            client.remove_suspicious_email_domain(value).await,
-            success,
-            failure,
-        ),
-        "phrase-bans" => ban_action_result(client.unban_phrase(value).await, success, failure),
-        "url-bans" => ban_action_result(client.unban_url(value).await, success, failure),
-        "file-sha-bans" => ban_action_result(
-            client.unban_file_sha(value, audit_log_reason).await,
-            success,
-            failure,
-        ),
-        "avatar-hash-bans" => {
-            ban_action_result(client.unban_avatar_hash(value).await, success, failure)
+) -> (&'static str, String) {
+    let result = match ban_type {
+        "ip-bans" => client.unban_ip(value, audit_log_reason).await,
+        "email-bans" => client.unban_email(value, audit_log_reason).await,
+        "suspicious-email-domains" => {
+            client
+                .remove_suspicious_email_domain(value, audit_log_reason)
+                .await
        }
-        _ => ("error".into(), "Unknown ban type".into()),
-    }
+        "phrase-bans" => client.unban_phrase(value, audit_log_reason).await,
+        "url-bans" => client.unban_url(value, audit_log_reason).await,
+        "file-sha-bans" => client.unban_file_sha(value, audit_log_reason).await,
+        "avatar-hash-bans" => client.unban_avatar_hash(value, audit_log_reason).await,
+        _ => return ("error", "Unknown ban type".into()),
+    };
+    ban_action_result(
+        result,
+        format!("{value} unbanned successfully"),
+        format!("Failed to unban {value}"),
+    )
 }

-async fn execute_check(client: &AdminApiClient, ban_type: &str, value: &str) -> (String, String) {
+async fn execute_check(
+    client: &AdminApiClient,
+    ban_type: &str,
+    value: &str,
+) -> (&'static str, String) {
    let result = match ban_type {
        "ip-bans" => client.check_ip_ban(value).await,
        "email-bans" => client.check_email_ban(value).await,
@@ -183,28 +174,28 @@ async fn execute_check(client: &AdminApiClient, ban_type: &str, value: &str) ->
        "url-bans" => client.check_url_ban(value).await,
        "file-sha-bans" => client.check_file_sha_ban(value).await,
        "avatar-hash-bans" => client.check_avatar_hash_ban(value).await,
-        _ => return ("error".into(), "Unknown ban type".into()),
+        _ => return ("error", "Unknown ban type".into()),
    };
    match result {
-        Ok(r) if r.banned => ("info".into(), format!("{value} is banned")),
-        Ok(_) => ("info".into(), format!("{value} is NOT banned")),
+        Ok(r) if r.banned => ("info", format!("{value} is banned")),
+        Ok(_) => ("info", format!("{value} is NOT banned")),
        Err(error) => {
            tracing::warn!(%error, ban_type, value, "admin API request failed: check ban status");
-            ("error".into(), "Error checking ban status".into())
+            ("error", "Error checking ban status".into())
        }
    }
 }

-fn ban_action_result<T, E: std::fmt::Display>(
-    result: Result<T, E>,
+fn ban_action_result(
+    result: ApiResult<()>,
    success_message: String,
    error_message: String,
-) -> (String, String) {
+) -> (&'static str, String) {
    match result {
-        Ok(_) => ("success".into(), success_message),
+        Ok(()) => ("success", success_message),
        Err(error) => {
            tracing::warn!(%error, "admin API request failed: ban action");
-            ("error".into(), error_message)
+            ("error", error_message)
        }
    }
 }
@@ -228,11 +219,6 @@ pub fn flash_response(
    }
 }

-pub fn htmx_flash(level: &str, message: &str, headers: &HeaderMap) -> Response {
-    let _ = headers;
-    render_inline_flash(level, message)
-}
-
 pub fn render_inline_flash(level: &str, message: &str) -> Response {
    let (border, bg, text) = match level {
        "success" => ("border-green-300", "bg-green-50", "text-green-800"),
@@ -1,14 +1,14 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

 use crate::{
-    api::client::AdminApiClient,
+    api::{client::AdminApiClient, generated::types::GiftCodeDurationTypeSchema},
    middleware::{
        auth::AuthContext,
        csrf::CsrfToken,
        flash::{self, FlashData},
    },
    state::AppState,
-    templates,
+    templates::{self, pages::gift_codes::MAX_GIFT_CODES},
 };
 use axum::{
    Form, Router,
@@ -28,11 +28,11 @@ struct GiftCodesForm {
    #[serde(default)]
    _csrf: Option<String>,
    #[serde(default)]
-    count: Option<String>,
+    count: Option<u32>,
    #[serde(default)]
-    duration_type: Option<String>,
+    duration_type: Option<GiftCodeDurationTypeSchema>,
    #[serde(default)]
-    duration_quantity: Option<String>,
+    duration_quantity: Option<u32>,
 }

 pub fn router() -> Router<AppState> {
@@ -82,31 +82,27 @@ async fn gift_codes_post(
            return flash::redirect_with_flash(
                &format!("{base}/gift-codes"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
-    let count = form
-        .count
-        .as_deref()
-        .and_then(|s| s.parse::<u32>().ok())
-        .unwrap_or(1)
-        .clamp(1, 100);
-    let dur_type = form.duration_type.as_deref().unwrap_or("month");
-    let dur_qty = form
-        .duration_quantity
-        .as_deref()
-        .and_then(|s| s.parse::<u32>().ok())
-        .unwrap_or(1);
+    let count = form.count.unwrap_or(1).clamp(1, MAX_GIFT_CODES);
+    let duration_type = form
+        .duration_type
+        .unwrap_or(GiftCodeDurationTypeSchema::Months);
+    let duration_quantity = form.duration_quantity.unwrap_or(1);
    let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
-    let is_prod = config.is_production();
-    match client.generate_gift_codes(count, dur_type, dur_qty).await {
+    let secure_cookies = config.secure_cookies();
+    match client
+        .generate_gift_codes(count, duration_type, duration_quantity)
+        .await
+    {
        Ok(result) => {
            let codes = result.codes.join(",");
            flash::redirect_with_flash(
                &format!("{base}/gift-codes?codes={codes}"),
                FlashData::success(format!("{} gift code(s) generated", result.codes.len())),
-                is_prod,
+                secure_cookies,
            )
        }
        Err(error) => {
@@ -114,7 +110,7 @@ async fn gift_codes_post(
            flash::redirect_with_flash(
                &format!("{base}/gift-codes"),
                FlashData::error("Failed to generate gift codes"),
-                is_prod,
+                secure_cookies,
            )
        }
    }
@@ -105,7 +105,7 @@ async fn discovery_approve(
            return flash::redirect_with_flash(
                &format!("{base}/discovery"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -115,7 +115,7 @@ async fn discovery_approve(
            return flash::redirect_with_flash(
                &format!("{base}/discovery"),
                FlashData::error("Guild ID is required"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -131,7 +131,7 @@ async fn discovery_approve(
    flash::redirect_with_flash(
        &format!("{base}/discovery?tab=pending"),
        flash,
-        config.is_production(),
+        config.secure_cookies(),
    )
 }

@@ -149,7 +149,7 @@ async fn discovery_reject(
            return flash::redirect_with_flash(
                &format!("{base}/discovery"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -159,7 +159,7 @@ async fn discovery_reject(
            return flash::redirect_with_flash(
                &format!("{base}/discovery"),
                FlashData::error("Guild ID is required"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -173,7 +173,7 @@ async fn discovery_reject(
    flash::redirect_with_flash(
        &format!("{base}/discovery?tab=pending"),
        flash,
-        config.is_production(),
+        config.secure_cookies(),
    )
 }

@@ -191,7 +191,7 @@ async fn discovery_remove(
            return flash::redirect_with_flash(
                &format!("{base}/discovery"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -201,7 +201,7 @@ async fn discovery_remove(
            return flash::redirect_with_flash(
                &format!("{base}/discovery"),
                FlashData::error("Guild ID is required"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -215,6 +215,6 @@ async fn discovery_remove(
    flash::redirect_with_flash(
        &format!("{base}/discovery?tab=listed"),
        flash,
-        config.is_production(),
+        config.secure_cookies(),
    )
 }
@@ -43,7 +43,7 @@ pub async fn render(
            let page = query.members_page.unwrap_or(0);
            let limit: u32 = 50;
            let resp = client
-                .list_guild_members(guild_id, limit, page * limit)
+                .list_guild_members(guild_id, limit, u64::from(page) * u64::from(limit))
                .await
                .log_error("load guild members")?;
            Some(tabs::members::members_tab(
@@ -57,7 +57,7 @@ pub async fn render(
            let page = query.reports_page.unwrap_or(0);
            let limit: u32 = 25;
            let resp = client
-                .search_reports_by_guild(guild_id, limit, page * limit)
+                .search_reports_by_guild(guild_id, limit, u64::from(page) * u64::from(limit))
                .await
                .log_error("load guild reports")?;
            Some(tabs::reports::reports_tab(
@@ -121,6 +121,7 @@ pub async fn render(
                    admin_user_id: None,
                    target_id: Some(guild_id.to_owned()),
                    target_type: Some("guild".to_owned()),
+                    access: Some("write".to_owned()),
                    sort_by: Some("created_at".to_owned()),
                    sort_order: Some("desc".to_owned()),
                    limit: 50,
@@ -134,7 +135,7 @@ pub async fn render(
                    @if let Some(resp) = resp {
                        @if resp.logs.is_empty() {
                            p class="text-sm text-neutral-500" {
-                                "No admin audit log entries for this guild."
+                                "No admin write actions have been recorded for this guild."
                            }
                        } @else {
                            (table_container(table(maud::html! {
@@ -150,22 +151,6 @@ pub async fn render(
                },
            ))
        }
-        "billing" => {
-            if config.self_hosted || !acl::has_permission(admin_acls, acl::BILLING_VIEW) {
-                return None;
-            }
-            let billing = client
-                .get_billing_overview(guild_id)
-                .await
-                .log_error("load guild billing overview")
-                .map(|b| b.data);
-            Some(tabs::billing::billing_tab(
-                config,
-                guild_id,
-                billing.as_ref(),
-                csrf_token,
-            ))
-        }
        "applications" => {
            if !acl::has_any_permission(
                admin_acls,
@@ -174,7 +159,7 @@ pub async fn render(
                return None;
            }
            let apps = client
-                .list_user_applications(guild_id)
+                .list_guild_applications(guild_id)
                .await
                .map_err(|error| tracing::warn!(%error, guild_id, "admin API request failed: list guild applications"))
                .unwrap_or_default();
@@ -82,23 +82,19 @@ async fn guilds_list(
                }
            }
        }
-        Some((guilds, Some(params.requested_ids.len() as u64), false))
+        Some((guilds, params.requested_ids.len() as u64))
    } else if params.has_search() {
-        let offset = params.page.saturating_mul(params.limit);
+        let offset = u64::from(params.page) * u64::from(params.limit);
        client
            .search_guilds(params.search_query(), params.limit, offset)
            .await
            .log_error("search guilds")
-            .map(|response| {
-                let has_more = u64::from(offset) + (response.guilds.len() as u64) < response.total;
-                (response.guilds, Some(response.total), has_more)
-            })
+            .map(|response| (response.guilds, response.total))
    } else {
        None
    };
    let result_guilds = results.as_ref().map(|result| result.0.as_slice());
-    let total = results.as_ref().and_then(|result| result.1);
-    let has_more = results.as_ref().is_some_and(|result| result.2);
+    let total = results.as_ref().map(|result| result.1);

    let markup = templates::pages::guilds_list::guilds_list_page(
        config,
@@ -106,7 +102,6 @@ async fn guilds_list(
        &params,
        result_guilds,
        total,
-        has_more,
        is_results_fragment,
    );
    Html(markup.into_string()).into_response()
@@ -191,7 +186,7 @@ async fn guild_detail_post(
            return flash::redirect_with_flash(
                &format!("{base}/guilds/{guild_id}"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -203,7 +198,7 @@ async fn guild_detail_post(
    } else {
        format!("{base}/guilds/{guild_id}?tab={tab}")
    };
-    flash::redirect_with_flash(&redirect, flash, config.is_production())
+    flash::redirect_with_flash(&redirect, flash, config.secure_cookies())
 }

 async fn dispatch_guild_action(
@@ -324,8 +319,12 @@ async fn dispatch_guild_action(
                "default_message_notifications",
                "disabled_operations",
            ] {
-                if let Some(v) = form.parse_i64(key) {
-                    settings.insert(key.to_string(), serde_json::json!(v));
+                let value = match form.parse_value::<i64>(key) {
+                    Ok(value) => value,
+                    Err(_) => return FlashData::error(format!("Invalid {key} value")),
+                };
+                if let Some(value) = value {
+                    settings.insert(key.to_string(), serde_json::json!(value));
                }
            }
            if form.contains_key("nsfw_submitted") {
@@ -356,11 +355,12 @@ async fn dispatch_guild_action(
            )
        }
        "update_disabled_operations" => {
-            let disabled_operations = form
-                .list_values_any(&["disabled_operations[]", "disabled_operations"])
-                .iter()
-                .filter_map(|value| value.parse::<i64>().ok())
-                .fold(0_i64, |acc, value| acc | value);
+            let Ok(operations) =
+                form.parse_list_values::<i64>(&["disabled_operations[]", "disabled_operations"])
+            else {
+                return FlashData::error("Invalid disabled operation value");
+            };
+            let disabled_operations = operations.into_iter().fold(0_i64, |acc, value| acc | value);
            let settings = serde_json::json!({
                "disabled_operations": disabled_operations,
            });
@@ -415,7 +415,7 @@ async fn dispatch_guild_action(
                return FlashData::error("Emoji ID is required");
            };
            action_result(
-                client.purge_assets(&[emoji_id]).await,
+                client.purge_assets(guild_id, &[emoji_id]).await,
                "Emoji deleted",
                "Failed to delete emoji",
            )
@@ -425,7 +425,7 @@ async fn dispatch_guild_action(
                return FlashData::error("Sticker ID is required");
            };
            action_result(
-                client.purge_assets(&[sticker_id]).await,
+                client.purge_assets(guild_id, &[sticker_id]).await,
                "Sticker deleted",
                "Failed to delete sticker",
            )
@@ -21,7 +21,6 @@ use axum::{
 use serde::Deserialize;

 #[derive(Deserialize)]
-#[allow(dead_code)]
 struct JobsQuery {
    status: Option<String>,
    task_type: Option<String>,
@@ -187,7 +186,7 @@ async fn job_detail_post(
            return flash::redirect_with_flash(
                &format!("{base}/jobs/{job_id}"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -214,54 +213,41 @@ async fn job_detail_post(
    flash::redirect_with_flash(
        &format!("{base}/jobs/{job_id}"),
        flash,
-        config.is_production(),
+        config.secure_cookies(),
    )
 }

 fn jobs_url(config: &crate::config::AdminConfig, query: &JobsQuery) -> String {
-    let mut params = Vec::new();
-    push_query(&mut params, "status", query.status.as_deref());
-    push_query(&mut params, "task_type", query.task_type.as_deref());
-    push_query(
-        &mut params,
-        "requested_by_user_id",
-        query.requested_by_user_id.as_deref(),
-    );
-    push_query(
-        &mut params,
-        "max_lookback_days",
-        query.max_lookback_days.as_deref(),
-    );
-    push_query(
-        &mut params,
-        "cursor_bucket_day",
-        query.cursor_bucket_day.as_deref(),
-    );
-    push_query(
-        &mut params,
-        "cursor_created_at",
-        query.cursor_created_at.as_deref(),
-    );
-    push_query(&mut params, "cursor_job_id", query.cursor_job_id.as_deref());
-    if params.is_empty() {
-        return format!("{}/jobs", config.base_path);
-    }
-    let query = params
-        .iter()
-        .map(|(key, value)| {
-            format!(
-                "{}={}",
-                urlencoding::encode(key),
-                urlencoding::encode(value)
-            )
-        })
-        .collect::<Vec<_>>()
-        .join("&");
-    format!("{}/jobs?{query}", config.base_path)
-}
-
-fn push_query(params: &mut Vec<(String, String)>, key: &str, value: Option<&str>) {
-    if let Some(value) = value.filter(|value| !value.is_empty()) {
-        params.push((key.to_owned(), value.to_owned()));
+    let query = [
+        ("status", query.status.as_deref()),
+        ("task_type", query.task_type.as_deref()),
+        (
+            "requested_by_user_id",
+            query.requested_by_user_id.as_deref(),
+        ),
+        ("max_lookback_days", query.max_lookback_days.as_deref()),
+        ("cursor_bucket_day", query.cursor_bucket_day.as_deref()),
+        ("cursor_created_at", query.cursor_created_at.as_deref()),
+        ("cursor_job_id", query.cursor_job_id.as_deref()),
+    ]
+    .into_iter()
+    .filter_map(|(key, value)| {
+        value
+            .filter(|value| !value.is_empty())
+            .map(|value| (key, value))
+    })
+    .map(|(key, value)| {
+        format!(
+            "{}={}",
+            urlencoding::encode(key),
+            urlencoding::encode(value)
+        )
+    })
+    .collect::<Vec<_>>()
+    .join("&");
+    if query.is_empty() {
+        format!("{}/jobs", config.base_path)
+    } else {
+        format!("{}/jobs?{query}", config.base_path)
    }
 }
@@ -48,7 +48,7 @@ pub(crate) async fn messages_post(
            return flash::redirect_with_flash(
                &format!("{base}/messages"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -59,53 +59,51 @@ pub(crate) async fn messages_post(
    match action {
        "lookup" => {
            let context_limit = parse_context_limit(form.first("context_limit"));
-            return Redirect::to(&format!(
+            Redirect::to(&format!(
                "{base}/messages?channel_id={}&message_id={}&context_limit={context_limit}",
                encode_opt(&channel_id),
                encode_opt(&message_id)
            ))
-            .into_response();
+            .into_response()
        }
        "lookup-by-attachment" => {
            let attachment_id = form.clean("attachment_id");
            let filename = form.clean("filename");
            let context_limit = parse_context_limit(form.first("context_limit"));
-            return Redirect::to(&format!(
+            Redirect::to(&format!(
                "{base}/messages?channel_id={}&attachment_id={}&filename={}&context_limit={context_limit}",
                encode_opt(&channel_id),
                encode_opt(&attachment_id),
                encode_opt(&filename)
            ))
-            .into_response();
-        }
-        "browse" => {
-            return Redirect::to(&format!(
-                "{base}/messages?channel_id={}",
-                encode_opt(&channel_id)
-            ))
-            .into_response();
+            .into_response()
        }
+        "browse" => Redirect::to(&format!(
+            "{base}/messages?channel_id={}",
+            encode_opt(&channel_id)
+        ))
+        .into_response(),
        "search" => {
            let search = form.clean("search");
-            return Redirect::to(&format!(
+            Redirect::to(&format!(
                "{base}/messages?channel_id={}&search={}",
                encode_opt(&channel_id),
                encode_opt(&search)
            ))
-            .into_response();
+            .into_response()
        }
        "delete" => {
            let (Some(cid), Some(mid)) = (&channel_id, &message_id) else {
                return json_error(StatusCode::BAD_REQUEST, "Missing channel_id or message_id");
            };
            let audit_log_reason = form.clean("audit_log_reason");
-            return match client
+            match client
                .delete_message(cid, mid, audit_log_reason.as_deref())
                .await
            {
                Ok(()) => Json(serde_json::json!({"success": true})).into_response(),
                Err(e) => json_error(StatusCode::BAD_REQUEST, &format!("{e}")),
-            };
+            }
        }
        "report-to-ncmec" => {
            let attachment_id = form.clean("attachment_id");
@@ -131,7 +129,7 @@ pub(crate) async fn messages_post(
                    "Missing required NCMEC report fields",
                );
            }
-            return match client
+            match client
                .report_attachment_to_ncmec(
                    cid,
                    mid,
@@ -144,11 +142,10 @@ pub(crate) async fn messages_post(
            {
                Ok(resp) => Json(resp.data).into_response(),
                Err(e) => json_error(StatusCode::BAD_REQUEST, &format!("{e}")),
-            };
+            }
        }
-        _ => {}
+        _ => Redirect::to(&format!("{base}/messages")).into_response(),
    }
-    Redirect::to(&format!("{base}/messages")).into_response()
 }

 pub(crate) async fn system_dms_post(
@@ -164,7 +161,7 @@ pub(crate) async fn system_dms_post(
            return flash::redirect_with_flash(
                &format!("{base}/system-dms"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -184,7 +181,11 @@ pub(crate) async fn system_dms_post(
    } else {
        FlashData::error("Recipients and content are required")
    };
-    flash::redirect_with_flash(&format!("{base}/system-dms"), flash, config.is_production())
+    flash::redirect_with_flash(
+        &format!("{base}/system-dms"),
+        flash,
+        config.secure_cookies(),
+    )
 }

 pub(crate) async fn bulk_actions_post(
@@ -201,7 +202,7 @@ pub(crate) async fn bulk_actions_post(
            return flash::redirect_with_flash(
                &format!("{base}/bulk-actions"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -247,32 +248,40 @@ pub(crate) async fn bulk_actions_post(
                .bulk_add_guild_members(&guild_id, &user_ids, audit_log_reason.as_deref())
                .await
        }
-        "bulk-schedule-user-deletion" => {
+        "bulk-schedule-user-deletion" | "bulk_delete_users" => {
            let user_ids = form.list_values_any(&["user_ids[]", "user_ids"]);
-            let reason_code = form.parse_u32("reason_code").unwrap_or(2);
-            let days = form.parse_u32("days_until_deletion").unwrap_or(14);
+            let (Ok(reason_code), Ok(days)) = (
+                form.parse_value::<u32>("reason_code"),
+                form.parse_value::<u32>("days_until_deletion"),
+            ) else {
+                return flash::redirect_with_flash(
+                    &format!("{base}/bulk-actions"),
+                    FlashData::error("Invalid deletion reason code or delay"),
+                    config.secure_cookies(),
+                );
+            };
            let public_reason = form.clean("public_reason");
            client
                .bulk_schedule_user_deletion(
                    &user_ids,
-                    reason_code,
-                    days,
+                    reason_code.unwrap_or(2),
+                    days.unwrap_or(14),
                    public_reason.as_deref(),
                    audit_log_reason.as_deref(),
                )
                .await
        }
-        "bulk_delete_users" => {
+        "bulk-delete-user-messages" => {
            let user_ids = form.list_values_any(&["user_ids[]", "user_ids"]);
            client
-                .bulk_schedule_user_deletion(&user_ids, 0, 30, None, audit_log_reason.as_deref())
+                .bulk_delete_user_messages(&user_ids, audit_log_reason.as_deref())
                .await
        }
        _ => {
            return flash::redirect_with_flash(
                &format!("{base}/bulk-actions"),
                FlashData::error("Unknown bulk action"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -284,7 +293,7 @@ pub(crate) async fn bulk_actions_post(
                flash::redirect_with_flash(
                    &format!("{base}/bulk-actions"),
                    FlashData::success("Bulk action submitted"),
-                    config.is_production(),
+                    config.secure_cookies(),
                )
            }
        }
@@ -292,8 +301,8 @@ pub(crate) async fn bulk_actions_post(
            tracing::warn!(%error, action, "admin API request failed: submit bulk action");
            flash::redirect_with_flash(
                &format!("{base}/bulk-actions"),
-                FlashData::error("Failed to submit bulk action"),
-                config.is_production(),
+                FlashData::error(format!("Failed to submit bulk action: {error}")),
+                config.secure_cookies(),
            )
        }
    }
@@ -353,7 +362,7 @@ pub(crate) async fn messages_browse_fragment(
    }
 }

-fn parse_context_limit(value: Option<&str>) -> u32 {
+pub(super) fn parse_context_limit(value: Option<&str>) -> u32 {
    value
        .and_then(|s| s.parse::<u32>().ok())
        .filter(|n| *n > 0)
@@ -399,14 +408,14 @@ pub(crate) async fn archives_download(
        Ok(_) => flash::redirect_with_flash(
            &format!("{base}/archives"),
            FlashData::error("Archive download URL was empty"),
-            config.is_production(),
+            config.secure_cookies(),
        ),
        Err(error) => {
            tracing::warn!(%error, "admin API request failed: get archive download URL");
            flash::redirect_with_flash(
                &format!("{base}/archives"),
                FlashData::error("Failed to create archive download URL"),
-                config.is_production(),
+                config.secure_cookies(),
            )
        }
    }
@@ -16,7 +16,6 @@ use axum::{
 use serde::Deserialize;

 #[derive(Deserialize)]
-#[allow(dead_code)]
 struct MessagesQuery {
    channel_id: Option<String>,
    message_id: Option<String>,
@@ -82,13 +81,7 @@ async fn messages_page(
    let before = query.before.as_deref().filter(|s| !s.is_empty());
    let after = query.after.as_deref().filter(|s| !s.is_empty());
    let search = query.search.as_deref().filter(|s| !s.is_empty());
-    let context_limit = query
-        .context_limit
-        .as_deref()
-        .and_then(|s| s.parse::<u32>().ok())
-        .filter(|n| *n > 0)
-        .unwrap_or(50)
-        .min(100);
+    let context_limit = super::message_actions::parse_context_limit(query.context_limit.as_deref());
    let mut lookup_result = None;
    let mut browse_result = None;
    let mut search_result = None;
@@ -73,7 +73,10 @@ pub fn build_router(config: AdminConfig) -> Router {
        .route("/", get(dashboard))
        .route("/dashboard", get(dashboard))
        .layer(from_fn(middleware::htmx::flash_redirect_to_toast))
-        .layer(from_fn(middleware::csrf::csrf_protection))
+        .layer(from_fn_with_state(
+            state.clone(),
+            middleware::csrf::csrf_protection,
+        ))
        .layer(from_fn(middleware::self_hosted::self_hosted_override))
        .layer(from_fn_with_state(
            state.clone(),
@@ -1,7 +1,11 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

 use crate::{
-    api::client::{AdminApiClient, ApiResultExt},
+    api::{
+        client::{AdminApiClient, ApiResultExt},
+        reports::SearchReportsParams,
+    },
+    config::AdminConfig,
    middleware::{
        auth::AuthContext,
        csrf,
@@ -22,6 +26,8 @@ use axum::{
 };
 use serde::Deserialize;

+const MAX_REPORT_OFFSET: u64 = 10_000;
+
 #[derive(Deserialize)]
 struct ReportsQuery {
    q: Option<String>,
@@ -69,7 +75,15 @@ async fn reports_list(
    let config = state.config();
    let page = query.page.unwrap_or(0);
    let limit = query.limit.unwrap_or(25).clamp(1, 200);
-    let offset = page.saturating_mul(limit);
+    let offset = u64::from(page) * u64::from(limit);
+    if offset > MAX_REPORT_OFFSET {
+        return reports_error_page(
+            config,
+            &auth.0,
+            "That page is out of range. The reports search returns at most the first 10000 reports. Narrow the filters and start again.",
+        );
+    }
+    let search_query = query.q.as_deref().and_then(clean_string);
    let (sort_by, sort_order) = decode_sort(query.sort.as_deref());
    let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
    let status = query.status.as_deref().and_then(|s| s.parse::<i32>().ok());
@@ -78,22 +92,22 @@ async fn reports_list(
        .as_deref()
        .and_then(|s| s.parse::<i32>().ok());
    let reports = client
-        .search_reports(
-            query.q.as_deref(),
+        .search_reports(&SearchReportsParams {
+            query: search_query.as_deref(),
            status,
            report_type,
-            query.category.as_deref(),
-            query.reporter_id.as_deref(),
-            query.reported_user_id.as_deref(),
-            query.reported_guild_id.as_deref(),
-            query.reported_channel_id.as_deref(),
-            query.guild_context_id.as_deref(),
-            query.resolved_by_admin_id.as_deref(),
-            Some(sort_by),
-            Some(sort_order),
+            category: query.category.as_deref(),
+            reporter_id: query.reporter_id.as_deref(),
+            reported_user_id: query.reported_user_id.as_deref(),
+            reported_guild_id: query.reported_guild_id.as_deref(),
+            reported_channel_id: query.reported_channel_id.as_deref(),
+            guild_context_id: query.guild_context_id.as_deref(),
+            resolved_by_admin_id: query.resolved_by_admin_id.as_deref(),
+            sort_by: Some(sort_by),
+            sort_order: Some(sort_order),
            limit,
            offset,
-        )
+        })
        .await
        .log_error("search reports");

@@ -102,7 +116,7 @@ async fn reports_list(
        &auth.0,
        reports.as_ref(),
        &templates::pages::reports_list::ReportFilters {
-            query: query.q.as_deref(),
+            query: search_query.as_deref(),
            status: query.status.as_deref(),
            report_type: query.report_type.as_deref(),
            category: query.category.as_deref(),
@@ -120,6 +134,18 @@ async fn reports_list(
    Html(markup.into_string()).into_response()
 }

+fn reports_error_page(config: &AdminConfig, auth: &AuthContext, message: &str) -> Response {
+    let markup = templates::layout::admin_layout(
+        config,
+        auth,
+        "Reports",
+        "reports",
+        None,
+        templates::components::error_display::error_alert(message),
+    );
+    Html(markup.into_string()).into_response()
+}
+
 async fn report_detail(
    State(state): State<AppState>,
    headers: HeaderMap,
@@ -195,7 +221,7 @@ async fn report_resolve(
            return flash::redirect_with_flash(
                &format!("{base}/reports/{report_id}"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -212,7 +238,7 @@ async fn report_resolve(
            flash::redirect_with_flash(
                &format!("{base}/reports/{report_id}"),
                FlashData::success("Report resolved"),
-                config.is_production(),
+                config.secure_cookies(),
            )
        }
        Err(error) => {
@@ -223,7 +249,7 @@ async fn report_resolve(
            flash::redirect_with_flash(
                &format!("{base}/reports/{report_id}"),
                FlashData::error("Failed to resolve report"),
-                config.is_production(),
+                config.secure_cookies(),
            )
        }
    }
@@ -17,19 +17,18 @@ use serde::Deserialize;
 use super::system_actions;

 #[derive(Deserialize)]
-#[allow(dead_code)]
 struct GatewayQuery {
    leaderboard_limit: Option<String>,
    node_stats: Option<String>,
 }

 #[derive(Deserialize)]
-#[allow(dead_code)]
 struct AuditLogsQuery {
    q: Option<String>,
    admin_user_id: Option<String>,
    target_id: Option<String>,
    target_type: Option<String>,
+    access: Option<String>,
    sort_by: Option<String>,
    sort_order: Option<String>,
    limit: Option<u32>,
@@ -121,6 +120,7 @@ async fn audit_logs_page(
        admin_user_id: query.admin_user_id.as_deref().unwrap_or(""),
        target_id: query.target_id.as_deref().unwrap_or(""),
        target_type: query.target_type.as_deref().unwrap_or(""),
+        access: query.access.as_deref().unwrap_or(""),
        sort_by: query.sort_by.as_deref().unwrap_or("createdAt"),
        sort_order: query.sort_order.as_deref().unwrap_or("desc"),
        limit,
@@ -133,10 +133,11 @@ async fn audit_logs_page(
        admin_user_id: nonempty(params.admin_user_id),
        target_id: nonempty(params.target_id),
        target_type: nonempty(params.target_type),
+        access: nonempty(params.access),
        sort_by: Some(params.sort_by.to_owned()),
        sort_order: Some(params.sort_order.to_owned()),
        limit,
-        offset: current_page * limit,
+        offset: u64::from(current_page) * u64::from(limit),
    };
    let result = client
        .search_audit_logs(&search_params)
@@ -60,7 +60,9 @@ pub async fn dispatch(
                    "Failed to update user flags",
                );
            }
-            let submitted = parse_u64_list(form, &["flags[]", "flags"]);
+            let Ok(submitted) = form.parse_list_values::<u64>(&["flags[]", "flags"]) else {
+                return DispatchOutcome::error("Invalid user flag value");
+            };
            let selected = submitted.iter().copied().collect::<HashSet<_>>();
            let user = match client.get_user_by_id(user_id).await {
                Ok(user) => user,
@@ -89,15 +91,22 @@ pub async fn dispatch(
        }
        "update_premium_flags" => {
            if has_legacy_flag_delta_fields(form) {
-                let add = parse_i32_list(form, &["add_flags[]", "add_flags"]);
-                let remove = parse_i32_list(form, &["remove_flags[]", "remove_flags"]);
+                let Ok(add) = form.parse_list_values::<i32>(&["add_flags[]", "add_flags"]) else {
+                    return DispatchOutcome::error("Invalid premium flag value to add");
+                };
+                let Ok(remove) = form.parse_list_values::<i32>(&["remove_flags[]", "remove_flags"])
+                else {
+                    return DispatchOutcome::error("Invalid premium flag value to remove");
+                };
                return DispatchOutcome::from_result(
                    client.update_premium_flags(user_id, &add, &remove).await,
                    "Premium flags updated successfully",
                    "Failed to update premium flags",
                );
            }
-            let submitted = parse_i32_list(form, &["flags[]", "flags"]);
+            let Ok(submitted) = form.parse_list_values::<i32>(&["flags[]", "flags"]) else {
+                return DispatchOutcome::error("Invalid premium flag value");
+            };
            let selected = submitted.iter().copied().collect::<HashSet<_>>();
            let user = match client.get_user_by_id(user_id).await {
                Ok(user) => user,
@@ -124,9 +133,12 @@ pub async fn dispatch(
            )
        }
        "update_suspicious_flags" => {
-            let flags = parse_i32_list(form, &["suspicious_flags[]", "suspicious_flags"])
-                .into_iter()
-                .fold(0, |acc, flag| acc | flag);
+            let Ok(submitted) =
+                form.parse_list_values::<i32>(&["suspicious_flags[]", "suspicious_flags"])
+            else {
+                return DispatchOutcome::error("Invalid suspicious activity flag value");
+            };
+            let flags = submitted.into_iter().fold(0, |acc, flag| acc | flag);
            DispatchOutcome::from_result(
                client.update_suspicious_flags(user_id, flags).await,
                "Suspicious activity flags updated successfully",
@@ -225,15 +237,19 @@ pub async fn dispatch(
            )
        }
        "temp_ban" => {
-            let dur = form
-                .parse_u32("duration_hours")
-                .or_else(|| form.parse_u32("duration"))
-                .unwrap_or(24);
+            let Ok(duration) = form.parse_value_any::<u32>(&["duration_hours", "duration"]) else {
+                return DispatchOutcome::error("Invalid ban duration");
+            };
            let reason = get("reason");
            let private = get("private_reason");
            DispatchOutcome::from_result(
                client
-                    .temp_ban_user(user_id, dur, reason.as_deref(), private.as_deref())
+                    .temp_ban_user(
+                        user_id,
+                        duration.unwrap_or(24),
+                        reason.as_deref(),
+                        private.as_deref(),
+                    )
                    .await,
                "User temporarily banned successfully",
                "Failed to temporarily ban user",
@@ -249,7 +265,7 @@ pub async fn dispatch(
                return DispatchOutcome::error("IP address is required");
            };
            DispatchOutcome::from_result(
-                client.ban_ip(&ip).await,
+                client.ban_ip(&ip, None).await,
                "IP banned successfully",
                "Failed to ban IP",
            )
@@ -259,18 +275,29 @@ pub async fn dispatch(
                return DispatchOutcome::error("Avatar hash is required");
            };
            DispatchOutcome::from_result(
-                client.ban_avatar_hash(&hash).await,
+                client.ban_avatar_hash(&hash, None).await,
                "Avatar hash banned successfully",
                "Failed to ban avatar hash",
            )
        }
        "schedule_deletion" => {
-            let reason_code = form.parse_i32("reason_code").unwrap_or(0);
+            let Ok(reason_code) = form.parse_value::<i32>("reason_code") else {
+                return DispatchOutcome::error("Invalid deletion reason code");
+            };
            let public_reason = get("public_reason");
-            let days = form.parse_u32("days_until_deletion").unwrap_or(60);
+            let private_reason = get("private_reason");
+            let Ok(days) = form.parse_value_any::<u32>(&["days_until_deletion", "days"]) else {
+                return DispatchOutcome::error("Invalid deletion delay");
+            };
            DispatchOutcome::from_result(
                client
-                    .schedule_deletion(user_id, reason_code, public_reason.as_deref(), days)
+                    .schedule_deletion(
+                        user_id,
+                        reason_code.unwrap_or(0),
+                        public_reason.as_deref(),
+                        days.unwrap_or(60),
+                        private_reason.as_deref(),
+                    )
                    .await,
                "User deletion scheduled successfully",
                "Failed to schedule user deletion",
@@ -399,55 +426,6 @@ pub async fn dispatch(
            "Bulk message deletion cancelled successfully",
            "Failed to cancel bulk message deletion",
        ),
-        "refund_payment" => {
-            let Some(pi) = form.clean("payment_intent_id") else {
-                return DispatchOutcome::error("Payment intent ID is required");
-            };
-            let amt = form.parse_u64("amount_cents");
-            let reason = get("reason");
-            DispatchOutcome::from_result(
-                client
-                    .issue_refund(user_id, &pi, amt, reason.as_deref())
-                    .await,
-                "Refund issued successfully",
-                "Failed to issue refund",
-            )
-        }
-        "refund_policy_cancel_now" => {
-            let reason = get("reason");
-            DispatchOutcome::from_result(
-                client
-                    .refund_policy_cancel_now(user_id, reason.as_deref())
-                    .await,
-                "Refund policy cancellation completed successfully",
-                "Failed to apply refund policy cancellation",
-            )
-        }
-        "cancel_subscription" => DispatchOutcome::from_result(
-            client.cancel_subscription(user_id).await,
-            "Subscription cancelled successfully",
-            "Failed to cancel subscription",
-        ),
-        "cancel_subscription_now" => {
-            let reason = get("reason");
-            DispatchOutcome::from_result(
-                client
-                    .cancel_subscription_immediately(user_id, reason.as_deref())
-                    .await,
-                "Subscription cancelled immediately",
-                "Failed to cancel subscription immediately",
-            )
-        }
-        "reactivate_subscription" => DispatchOutcome::from_result(
-            client.reactivate_subscription(user_id).await,
-            "Subscription reactivated successfully",
-            "Failed to reactivate subscription",
-        ),
-        "end_premium_grace_period" => DispatchOutcome::from_result(
-            client.end_premium_grace_period(user_id).await,
-            "Premium grace period ended successfully",
-            "Failed to end premium grace period",
-        ),
        "message_shred" => {
            let csv = form.first("csv_data").unwrap_or_default();
            match parse_message_shred_csv(csv) {
@@ -490,20 +468,6 @@ fn is_relationship_category(category: &str) -> bool {
    )
 }

-fn parse_u64_list(form: &MultiValueForm, keys: &[&str]) -> Vec<u64> {
-    form.list_values_any(keys)
-        .iter()
-        .filter_map(|value| value.parse().ok())
-        .collect()
-}
-
-fn parse_i32_list(form: &MultiValueForm, keys: &[&str]) -> Vec<i32> {
-    form.list_values_any(keys)
-        .iter()
-        .filter_map(|value| value.parse().ok())
-        .collect()
-}
-
 fn parse_dry_run(value: Option<&str>) -> bool {
    !matches!(value.map(|value| value.trim().to_ascii_lowercase()), Some(value) if value == "false" || value == "0")
 }
--- a/Show More
+++ b/Show More