feat(auth): make passkey two-factor authentication opt-in (#2857 )

refactor(app-proxy): remove the stable time freeze (#2856 )
docs(downloads): one pacman repository holds both channels (#2855 )
2026-10-08 03:32:27 +09:00 · 2026-09-20 05:06:50 +02:00 · 2026-09-20 04:02:47 +02:00 · 2026-09-20 02:50:08 +02:00 · 2026-09-20 01:24:43 +02:00 · 2026-09-20 01:20:30 +02:00
5828 changed files with 675028 additions and 612206 deletions
@@ -1,14 +1,14 @@
-FROM chrislusf/seaweedfs:4.31 AS seaweedfs
+FROM chrislusf/seaweedfs:4.47 AS seaweedfs

-FROM erlang:28.5.0.1
+FROM erlang:28.5.0.6

 ARG USERNAME=vscode
 ARG USER_UID=1000
 ARG USER_GID=1000
-ARG NODE_MAJOR=24
-ARG ELP_VERSION=2026-02-27
-ARG PNPM_VERSION=10.29.3
-ARG WASM_BINDGEN_VERSION=0.2.122
+ARG NODE_MAJOR=26
+ARG ELP_VERSION=2026-08-10
+ARG PNPM_VERSION=12.4.2
+ARG WASM_BINDGEN_VERSION=0.2.128

 ENV DEBIAN_FRONTEND=noninteractive

@@ -32,6 +32,7 @@ RUN apt-get update \
 		jq \
 		libasound2 \
 		libatk-bridge2.0-0 \
+		libaom-dev \
 		libavcodec-dev \
 		libavfilter-dev \
 		libavformat-dev \
@@ -51,9 +52,15 @@ RUN apt-get update \
 		libcurl4-openssl-dev \
 		libswresample-dev \
 		libswscale-dev \
+		libdav1d-dev \
+		libde265-dev \
+		liblcms2-dev \
 		libvips-dev \
+		libyuv-dev \
 		libwayland-dev \
 		libwebp-dev \
+		nasm \
+		yasm \
 		libssl-dev \
 		libx11-xcb1 \
 		libxcb-dri3-0 \
@@ -78,6 +85,7 @@ RUN apt-get update \
 		unzip \
 		xz-utils \
 		xdg-utils \
+		zlib1g-dev \
 		zstd \
 	&& rm -rf /var/lib/apt/lists/*

@@ -123,10 +131,31 @@ RUN apt-get update \
 RUN curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | bash - \
 	&& apt-get install -y --no-install-recommends nodejs \
 	&& rm -rf /var/lib/apt/lists/* \
-	&& corepack enable
+	&& npm install -g "pnpm@${PNPM_VERSION}" \
+	&& pnpm --version

 RUN python3 -m pip install --break-system-packages --no-cache-dir awscli

+COPY fluxer_media_proxy/tools/install-native-deps.sh /tmp/fluxer-install-native-deps.sh
+RUN /tmp/fluxer-install-native-deps.sh /usr/local \
+	&& rm /tmp/fluxer-install-native-deps.sh
+
+ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/usr/local/lib64/pkgconfig
+ENV LD_LIBRARY_PATH=/usr/local/lib
+
+RUN printf '%s\n' \
+		'#include <libheif/heif.h>' \
+		'#include <string.h>' \
+		'#if !LIBHEIF_HAVE_VERSION(1, 23, 0)' \
+		'#error the source-built libheif headers must win the include search' \
+		'#endif' \
+		'int main(void) { return strcmp(heif_get_version(), LIBHEIF_VERSION) != 0; }' \
+		>/tmp/fluxer-heif-probe.c \
+	&& cc /tmp/fluxer-heif-probe.c $(pkg-config --cflags --libs libheif) -o /tmp/fluxer-heif-probe \
+	&& /tmp/fluxer-heif-probe \
+	&& [ "$(pkg-config --variable=prefix libheif)" = /usr/local ] \
+	&& rm /tmp/fluxer-heif-probe.c /tmp/fluxer-heif-probe
+
 COPY tools/fonts/requirements.txt /tmp/fluxer-fonts-requirements.txt
 RUN python3 -m pip install --break-system-packages --no-cache-dir -r /tmp/fluxer-fonts-requirements.txt \
 	&& rm /tmp/fluxer-fonts-requirements.txt \
@@ -139,7 +168,7 @@ RUN ARCH="$(dpkg --print-architecture)" \
 		arm64) ELP_ARCH="aarch64" ;; \
 		*) echo "Unsupported architecture for ELP: $ARCH" >&2; exit 1 ;; \
 	esac \
-	&& curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL "https://github.com/WhatsApp/erlang-language-platform/releases/download/${ELP_VERSION}/elp-linux-${ELP_ARCH}-unknown-linux-gnu-otp-28.tar.gz" -o /tmp/elp.tgz \
+	&& curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL "https://github.com/WhatsApp/erlang-language-platform/releases/download/${ELP_VERSION}/elp-linux-${ELP_ARCH}-unknown-linux-gnu-otp-28.5.tar.gz" -o /tmp/elp.tgz \
 	&& tar -C /usr/local/bin -xzf /tmp/elp.tgz elp \
 	&& chmod +x /usr/local/bin/elp \
 	&& rm /tmp/elp.tgz
@@ -166,7 +195,4 @@ RUN curl --retry 5 --retry-delay 2 --retry-all-errors -fsSL https://sh.rustup.rs
 	&& cargo install wasm-bindgen-cli --version "${WASM_BINDGEN_VERSION}" --locked \
 	&& rm -rf "/home/${USERNAME}/.cargo/registry" "/home/${USERNAME}/.cargo/git"

-RUN corepack prepare "pnpm@${PNPM_VERSION}" --activate \
-	&& pnpm --version
-
 WORKDIR /workspaces/fluxer
@@ -14,7 +14,7 @@
 		"DOCKER_HOST": "unix:///var/run/docker.sock"
 	},
 	"runServices": ["workspace", "postgres", "valkey", "nats", "livekit", "meilisearch", "mailpit"],
-	"forwardPorts": [3000, 8088, 8080, 8771, 8082, 8773, 3010, 3020, 8333],
+	"forwardPorts": [3000, 8088, 8080, 8771, 8082, 8773, 3020, 8333],
 	"portsAttributes": {
 		"8088": {
 			"label": "Fluxer dev proxy",
@@ -1,3 +1,5 @@
+name: fluxer-dev
+
 services:
  workspace:
    build:
@@ -7,7 +9,7 @@ services:
    init: true
    environment:
      DOCKER_HOST: unix:///var/run/docker.sock
-      npm_config_store_dir: /home/vscode/.local/share/pnpm/store
+      pnpm_config_store_dir: /home/vscode/.local/share/pnpm/store
      FLUXER_PUBLIC_PORT: "${FLUXER_DEV_PROXY_PORT:-8088}"
      FLUXER_PUBLIC_URL: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}"
      FLUXER_API_ENDPOINT: "http://localhost:${FLUXER_DEV_PROXY_PORT:-8088}/api"
@@ -241,7 +243,6 @@ services:
        volume:
          nocopy: true
      - pnpm-store:/home/vscode/.local/share/pnpm/store
-      - docs-venv:/workspaces/fluxer/fluxer_docs/.venv
      - cargo-registry:/home/vscode/.cargo/registry
      - cargo-git:/home/vscode/.cargo/git
      - rust-target:/workspaces/fluxer/target
@@ -255,7 +256,6 @@ services:
      - "127.0.0.1:${FLUXER_DEV_GATEWAY_PORT:-8771}:8771"
      - "127.0.0.1:${FLUXER_DEV_MEDIA_PROXY_PORT:-8082}:8082"
      - "127.0.0.1:${FLUXER_DEV_APP_PROXY_PORT:-8773}:8773"
-      - "127.0.0.1:${FLUXER_DEV_MARKETING_PORT:-3010}:3010"
      - "127.0.0.1:${FLUXER_DEV_ADMIN_PORT:-3020}:3020"
      - "127.0.0.1:${FLUXER_DEV_SEAWEEDFS_S3_PORT:-3900}:8333"
    depends_on:
@@ -292,13 +292,13 @@ services:
      start_period: 5s

  valkey:
-    image: valkey/valkey:8.1.7-alpine
+    image: valkey/valkey:9.1.2-alpine
    command: ["valkey-server", "--save", "", "--appendonly", "no"]
    ports:
      - "127.0.0.1:${FLUXER_DEV_VALKEY_PORT:-6379}:6379"

  nats:
-    image: nats:2.14.2-alpine
+    image: nats:2.14.7-alpine
    command: ["-js", "-sd", "/data", "-m", "8222"]
    volumes:
      - nats-data:/data
@@ -321,9 +321,10 @@ services:
      - "127.0.0.1:${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}:${FLUXER_DEV_LIVEKIT_UDP_PORT:-7882}/udp"

  meilisearch:
-    image: getmeili/meilisearch:v1.12
+    image: getmeili/meilisearch:v1.53
    environment:
      MEILI_NO_ANALYTICS: "true"
+      MEILI_UPGRADE_DB: "true"
      MEILI_MASTER_KEY: fluxer-dev-meilisearch
    volumes:
      - meilisearch-data:/meili_data
@@ -337,7 +338,7 @@ services:
      start_period: 5s

  mailpit:
-    image: axllent/mailpit:v1.30
+    image: axllent/mailpit:v1.31
    environment:
      MP_DATABASE: /data/mailpit.db
      MP_MAX_MESSAGES: 5000
@@ -349,7 +350,6 @@ services:

 volumes:
  pnpm-store:
-  docs-venv:
  root-node-modules:
  fluxer-api-node-modules:
  fluxer-app-node-modules:
@@ -28,8 +28,7 @@ for path in \
 	/home/vscode/.cargo/registry \
 	/home/vscode/.cargo/git \
 	/home/vscode/.local \
-	/home/vscode/.local/share/pnpm/store \
-	/workspaces/fluxer/fluxer_docs/.venv; do
+	/home/vscode/.local/share/pnpm/store; do
 	repair_tree "$path"
 done

@@ -7,10 +7,16 @@ QUICK=0
 SKIP_INSTALL=0
 for arg in "$@"; do
 	case "$arg" in
-		--quick) QUICK=1 ;;
-		--skip-install) SKIP_INSTALL=1 ;;
-		-h|--help) sed -n '2,25p' "$0"; exit 0 ;;
-		*) echo "unknown argument: $arg" >&2; exit 2 ;;
+	--quick) QUICK=1 ;;
+	--skip-install) SKIP_INSTALL=1 ;;
+	-h | --help)
+		sed -n '2,25p' "$0"
+		exit 0
+		;;
+	*)
+		echo "unknown argument: $arg" >&2
+		exit 2
+		;;
 	esac
 done

@@ -64,6 +70,7 @@ stage "app: typecheck" pnpm --filter fluxer_app typecheck
 stage "app: unit tests" pnpm --filter fluxer_app exec vitest run

 if [ "$QUICK" -eq 0 ]; then
+	stage "desktop: typecheck" pnpm --filter fluxer_desktop typecheck
 	stage "app: production build" pnpm --filter fluxer_app build
 fi

@@ -9,7 +9,6 @@
 **/.git/**
 /.github/
 /.pnpm-store/
-/fluxer_marketing

 **/.env
 **/.env.*.local
@@ -29,7 +28,8 @@
 **/node_modules/
 **/target/
 **/test-results.json
-/fluxer_docs/site/
+/fluxer_docs/dist/
+/fluxer_docs/.astro/
 /fluxer_app/.devserver-cache.json
 /fluxer_app/pkgs/libfluxcore/
 /fluxer_app/src/features/i18n/locales/*/messages.mjs
@@ -1,7 +1,2 @@
 /.github/CODEOWNERS @fluxerapp/developers
 /.github/workflows/ @fluxerapp/developers
-/fluxer_marketing @fluxerapp/developers
-/.gitmodules @fluxerapp/developers
-/.github/workflows/dispatch-private-marketing-build.yaml @fluxerapp/developers
-/packages/i18n/marketing/ @fluxerapp/developers
-/scripts/setup-private-marketing.sh @fluxerapp/developers
@@ -89,21 +89,3 @@ Submit translations through [Weblate](https://weblate.fluxer.tools), not through
 All repository activity is governed by the [Code of Conduct](https://github.com/fluxerapp/fluxer/blob/main/.github/CODE_OF_CONDUCT.md).

 Fluxer is distributed under the [GNU Affero General Public License, version 3.0 or later](https://github.com/fluxerapp/fluxer/blob/main/LICENSE). By adding a DCO sign-off, you certify that you have the right to submit the contribution under that licence.
-
-## Private marketing project
-
-The marketing implementation is maintained in a private repository at the `fluxer_marketing` submodule path. The public workspace, bootstrap, checks, and development stack work without initializing it.
-
-Authorized maintainers can initialize only that submodule and install its independent dependencies:
-
-```sh
-./scripts/setup-private-marketing.sh
-pnpm --dir fluxer_marketing install --frozen-lockfile
-cargo metadata --locked --manifest-path fluxer_marketing/Cargo.toml
-```
-
-To run the private marketing service in the local development stack and direct application links to it, add this override to the ignored `config/env/local.env` file:
-
-```sh
-FLUXER_MARKETING_ENDPOINT=http://localhost:8088/marketing
-```
@@ -36,8 +36,7 @@ body:
      label: Build information
      description: >-
        Open User Settings, scroll to the bottom of the left sidebar, and select
-        the build information. Fluxer copies it to the clipboard. On mobile,
-        select the build information at the bottom of the settings list.
+        the build information. Fluxer copies it to the clipboard.
    validations:
      required: true

@@ -1,15 +1,15 @@
 # yaml-language-server: $schema=https://www.schemastore.org/github-issue-config.json
 blank_issues_enabled: false
 contact_links:
+  - name: Mobile client bugs
+    url: https://github.com/fluxerapp/flutter_client#bug-reporting
+    about: Read the reporting instructions for the Fluxer mobile client.
  - name: Account and billing support
    url: https://fluxer.app/help
    about: Find account help and support contact details.
  - name: Feature proposals
    url: https://github.com/orgs/fluxerapp/discussions
    about: Propose a feature in a discussion.
-  - name: Security vulnerabilities
-    url: https://github.com/fluxerapp/fluxer/security/advisories/new
-    about: Submit a private vulnerability report.
  - name: Translations
    url: https://weblate.fluxer.tools
    about: Improve an existing locale or start a new one.
@@ -22,11 +22,6 @@ f:docs:
 f:gateway:
  - changed-files:
    - any-glob-to-any-file: fluxer_gateway/**/*
-f:marketing:
-  - changed-files:
-    - any-glob-to-any-file:
-      - fluxer_marketing
-      - packages/i18n/marketing/**/*
 f:media_proxy:
  - changed-files:
    - any-glob-to-any-file: fluxer_media_proxy/**/*
@@ -58,13 +58,13 @@ jobs:
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: Create token
        id: create-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
@@ -101,25 +101,30 @@ jobs:
          - platform: arm64
            runner: ubuntu-24.04-arm
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
          context: ${{ inputs.context }}
          file: ${{ inputs.dockerfile }}
          push: true
-          provenance: false
+          provenance: mode=min
          platforms: linux/${{ matrix.platform }}
          tags: ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:${{ needs.meta.outputs.build_version }}-${{ matrix.platform }}
          build-args: |
            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
+            SOURCE_SHA=${{ github.sha }}
+            SOURCE_DATE=${{ steps.source.outputs.date }}
            ${{ inputs.extra-build-args }}
          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:buildcache-${{ matrix.platform }}
          cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}:buildcache-${{ matrix.platform }},mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
@@ -136,15 +141,15 @@ jobs:
      contents: write
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -185,17 +190,12 @@ jobs:

      - name: Advance moving image tags
        env:
-          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/${{ inputs.image }}
-          VERSION: ${{ needs.meta.outputs.build_version }}
          MOVING_TAGS: ${{ inputs.moving-tags }}
-        run: |
-          set -euo pipefail
-          tag_args=()
-          IFS=',' read -ra moving <<< "${MOVING_TAGS}"
-          for raw in "${moving[@]}"; do
-            tag="$(echo "$raw" | xargs)"
-            [ -n "$tag" ] && tag_args+=( "-t" "${IMAGE}:${tag}" )
-          done
-          if (( ${#tag_args[@]} > 0 )); then
-            docker buildx imagetools create "${tag_args[@]}" "${IMAGE}:${VERSION}"
-          fi
+          VERSION: ${{ needs.meta.outputs.build_version }}
+        run: >-
+          tools/ci/run.sh image-set
+          promote
+          --component "${{ inputs.image }}"
+          --build-version "${VERSION}"
+          --registry "ghcr.io/${{ env.GHCR_OWNER }}"
+          --moving-tags "${MOVING_TAGS}"
@@ -15,6 +15,13 @@ permissions:
  contents: write
  packages: write

+concurrency:
+  group: publish-fluxer-app-proxy-self-hosted
+  cancel-in-progress: false
+
+env:
+  GHCR_OWNER: ${{ github.repository_owner }}
+
 jobs:
  approve:
    name: approve build release
@@ -26,13 +33,207 @@ jobs:
      - name: approved
        run: echo "Build release approved."

-  build:
+  meta:
+    name: resolve metadata
    needs: approve
-    uses: ./.github/workflows/_build-image.yaml
-    secrets: inherit
-    with:
-      image: fluxer-app-proxy-self-hosted
-      dockerfile: fluxer_app_proxy/Dockerfile
-      build-version: ${{ inputs['build-version'] }}
-      extra-build-args: |
-        FLUXER_APP_PROXY_TIME_FREEZE_ENABLED=false
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      build_version: ${{ steps.vars.outputs.build_version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - name: set variables
+        id: vars
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step set_metadata
+          --build-version "${{ inputs['build-version'] }}"
+
+  dist:
+    name: build the canonical asset tree
+    needs: meta
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    env:
+      IMAGE_REPO: ghcr.io/${{ github.repository_owner }}/fluxer-app-proxy-self-hosted
+      BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
+      PUBLIC_ASSET_BASE_URL: ""
+      BUNDLE_LOCAL_ASSETS: "true"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - name: prepare docker config
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step prepare_docker_config
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - name: configure ghcr auth
+        env:
+          GHCR_USERNAME: ${{ github.actor }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step configure_ghcr_auth
+
+      - name: build the dist once and publish it as the canonical asset image
+        env:
+          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-dist
+          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-dist,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step build_dist
+
+      - name: generate asset manifest
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step generate_asset_manifest
+
+      - name: verify every manifest asset ships in the image
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_published_assets
+
+  build:
+    name: build ${{ matrix.platform }}
+    needs: [meta, dist]
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 75
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: amd64
+            runner: ubuntu-24.04
+          - platform: arm64
+            runner: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
+        with:
+          context: .
+          file: fluxer_app_proxy/Dockerfile
+          push: true
+          provenance: false
+          platforms: linux/${{ matrix.platform }}
+          tags: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-${{ matrix.platform }}
+          build-args: |
+            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
+            SOURCE_SHA=${{ github.sha }}
+            SOURCE_DATE=${{ steps.source.outputs.date }}
+            APP_ASSETS_REF=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-assets
+            APP_ASSETS_PLATFORM=linux/amd64
+          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-${{ matrix.platform }}
+          cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:buildcache-${{ matrix.platform }},mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+        env:
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+
+  merge:
+    name: merge multi-arch manifest
+    needs: [meta, build]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: write
+      packages: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: verify cross-architecture asset parity
+        env:
+          APP_PROXY_ASSETS_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-assets
+          APP_PROXY_AMD64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-amd64
+          APP_PROXY_ARM64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted:${{ needs.meta.outputs.build_version }}-arm64
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_asset_parity
+
+      - name: create and push multi-arch manifest
+        env:
+          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy-self-hosted
+          VERSION: ${{ needs.meta.outputs.build_version }}
+        run: |
+          set -euo pipefail
+          docker buildx imagetools create -t "${IMAGE}:${VERSION}" \
+            "${IMAGE}:${VERSION}-amd64" \
+            "${IMAGE}:${VERSION}-arm64"
+          docker buildx imagetools inspect "${IMAGE}:${VERSION}"
+
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: write
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          SOURCE_SHA: ${{ github.sha }}
+          VERSION: ${{ needs.meta.outputs.build_version }}
+          RELEASE_BASELINE_SHA: ${{ vars.RELEASE_BASELINE_SHA }}
+        run: >-
+          tools/ci/run.sh release
+          publish
+          --component fluxer-app-proxy-self-hosted
+          --build-version "${VERSION}"
+          --source-sha "${SOURCE_SHA}"
+          --previous-sha "${RELEASE_BASELINE_SHA}"
+
+      - name: Advance moving image tags
+        env:
+          VERSION: ${{ needs.meta.outputs.build_version }}
+        run: >-
+          tools/ci/run.sh image-set
+          promote
+          --component fluxer-app-proxy-self-hosted
+          --build-version "${VERSION}"
+          --registry "ghcr.io/${{ env.GHCR_OWNER }}"
+          --moving-tags v1,latest
@@ -43,13 +43,13 @@ jobs:
    outputs:
      build_version: ${{ steps.vars.outputs.build_version }}
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: set variables
        id: vars
        run: >-
@@ -57,28 +57,28 @@ jobs:
          --step set_metadata
          --build-version "${{ inputs['build-version'] }}"

-  build:
-    name: build app-proxy (amd64)
+  dist:
+    name: build and publish the canonical asset tree
    needs: meta
    runs-on: ubuntu-24.04
-    timeout-minutes: 45
+    timeout-minutes: 60
    permissions:
      actions: read
      contents: read
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
      - name: prepare docker config
        run: >-
          tools/ci/run.sh build-app-proxy
          --step prepare_docker_config
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
      - name: configure ghcr auth
        env:
          GHCR_USERNAME: ${{ github.actor }}
@@ -87,17 +87,17 @@ jobs:
          tools/ci/run.sh build-app-proxy
          --step configure_ghcr_auth

-      - name: build and push image + extract assets
+      - name: build the dist once and publish it as the canonical asset image
        env:
          BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
          PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
-          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64
-          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-dist
+          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-dist,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
          DOCKER_BUILD_SUMMARY: false
          DOCKER_BUILD_RECORD_UPLOAD: false
        run: >-
          tools/ci/run.sh build-app-proxy
-          --step build_and_extract
+          --step build_dist

      - name: generate asset manifest
        run: >-
@@ -114,9 +114,63 @@ jobs:
          tools/ci/run.sh build-app-proxy
          --step upload_assets

+      - name: verify every uploaded asset is readable
+        env:
+          PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_published_assets
+
+  build:
+    name: build app-proxy (amd64)
+    needs: [meta, dist]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - name: prepare docker config
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step prepare_docker_config
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - name: configure ghcr auth
+        env:
+          GHCR_USERNAME: ${{ github.actor }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step configure_ghcr_auth
+
+      - name: build and push image
+        env:
+          BUILD_VERSION: ${{ needs.meta.outputs.build_version }}
+          SOURCE_SHA: ${{ github.sha }}
+          SOURCE_DATE: ${{ steps.source.outputs.date }}
+          PUBLIC_ASSET_BASE_URL: https://fluxerstatic.com
+          CACHE_FROM: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64
+          CACHE_TO: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-amd64,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step build_image
+
  build-arm64:
    name: build app-proxy (arm64)
-    needs: meta
+    needs: [meta, dist]
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 60
    permissions:
@@ -124,16 +178,19 @@ jobs:
      contents: read
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+      - name: resolve source date
+        id: source
+        run: echo "date=$(TZ=UTC git log -1 --no-show-signature --pretty=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
        with:
          context: .
          file: fluxer_app_proxy/Dockerfile
@@ -143,8 +200,10 @@ jobs:
          tags: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-arm64
          build-args: |
            BUILD_VERSION=${{ needs.meta.outputs.build_version }}
-            PUBLIC_ASSET_BASE_URL=https://fluxerstatic.com
-            BUNDLE_LOCAL_ASSETS=false
+            SOURCE_SHA=${{ github.sha }}
+            SOURCE_DATE=${{ steps.source.outputs.date }}
+            APP_ASSETS_REF=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-assets
+            APP_ASSETS_PLATFORM=linux/amd64
          cache-from: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-arm64
          cache-to: type=registry,ref=ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:buildcache-arm64,mode=max,image-manifest=true,oci-mediatypes=true,ignore-error=true
        env:
@@ -155,24 +214,33 @@ jobs:
    name: merge multi-arch manifest
    needs: [meta, build, build-arm64]
    runs-on: ubuntu-24.04
-    timeout-minutes: 10
+    timeout-minutes: 20
    permissions:
      contents: write
      packages: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        env:
          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: verify cross-architecture asset parity
+        env:
+          APP_PROXY_ASSETS_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-assets
+          APP_PROXY_AMD64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}
+          APP_PROXY_ARM64_REF: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy:${{ needs.meta.outputs.build_version }}-arm64
+        run: >-
+          tools/ci/run.sh build-app-proxy
+          --step verify_asset_parity
+
      - name: fuse amd64 + arm64 into a multi-arch manifest
        env:
          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy
@@ -212,10 +280,11 @@ jobs:

      - name: Advance moving image tags
        env:
-          IMAGE: ghcr.io/${{ env.GHCR_OWNER }}/fluxer-app-proxy
          VERSION: ${{ needs.meta.outputs.build_version }}
        run: >-
-          docker buildx imagetools create
-          -t "${IMAGE}:v1"
-          -t "${IMAGE}:latest"
-          "${IMAGE}:${VERSION}"
+          tools/ci/run.sh image-set
+          promote
+          --component fluxer-app-proxy
+          --build-version "${VERSION}"
+          --registry "ghcr.io/${{ env.GHCR_OWNER }}"
+          --moving-tags v1,latest
@@ -11,11 +11,6 @@ on:
          - stable
          - canary
        default: stable
-      test_build:
-        description: Stash artifacts under desktop-test/ instead of desktop/ (API will not pick these up as a release).
-        required: false
-        default: false
-        type: boolean
      build_version:
        description: Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation.
        required: false
@@ -32,13 +27,12 @@ permissions:
  actions: read

 concurrency:
-  group: desktop-${{ inputs.channel }}-${{ inputs.test_build && 'test' || 'release' }}
+  group: desktop-${{ inputs.channel }}
  cancel-in-progress: true

 env:
  CHANNEL: ${{ inputs.channel }}
  BUILD_CHANNEL: ${{ inputs.channel == 'canary' && 'canary' || 'stable' }}
-  TEST_BUILD: ${{ inputs.test_build && 'true' || 'false' }}

 jobs:
  meta:
@@ -53,19 +47,17 @@ jobs:
      pub_date: ${{ steps.meta.outputs.pub_date }}
      channel: ${{ steps.meta.outputs.channel }}
      build_channel: ${{ steps.meta.outputs.build_channel }}
-      test_build: ${{ steps.meta.outputs.test_build }}
-      s3_prefix: ${{ steps.meta.outputs.s3_prefix }}
      source_sha: ${{ steps.meta.outputs.source_sha }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: main

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Create token
        id: create-token
@@ -85,7 +77,6 @@ jobs:
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step set_metadata
          --channel "${{ inputs.channel }}"
-          --test-build "${{ inputs.test_build }}"

  matrix:
    name: Resolve build matrix
@@ -98,12 +89,12 @@ jobs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Build platform matrix
        id: set-matrix
@@ -113,7 +104,7 @@ jobs:
          --skip-targets "${{ inputs.skip_targets }}"

  build:
-    name: Build ${{ matrix.platform }} (${{ matrix.arch }}, ${{ matrix.desktop_variant }})
+    name: Build ${{ matrix.platform }} (${{ matrix.arch }})
    needs:
      - meta
      - matrix
@@ -137,41 +128,34 @@ jobs:
      PUBLIC_BUILD_VERSION: ${{ needs.meta.outputs.version }}
      PUB_DATE: ${{ needs.meta.outputs.pub_date }}
      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
-      S3_DESKTOP_PREFIX: ${{ needs.meta.outputs.s3_prefix }}
-      DESKTOP_HANDOFF_PREFIX: _handoff/desktop/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      S3_ENDPOINT: ${{ vars.DOWNLOADS_S3_ENDPOINT }}
-      S3_BUCKET: ${{ vars.DOWNLOADS_S3_BUCKET }}
-      AWS_ACCESS_KEY_ID: ${{ secrets.DOWNLOADS_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
      DESKTOP_PLATFORM: ${{ matrix.platform }}
      DESKTOP_ARCH: ${{ matrix.arch }}
-      DESKTOP_VARIANT: ${{ matrix.desktop_variant }}
      PLATFORM: ${{ matrix.platform }}
      ARCH: ${{ matrix.arch }}
      ELECTRON_ARCH: ${{ matrix.electron_arch }}
    steps:
      - name: Checkout CI helpers
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}
          path: _ci

      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}
          path: source

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Set up Python (Windows)
        if: runner.os == 'Windows'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
-          python-version: "3.13"
+          python-version: "3.14"

      - name: Ensure python3 command (Windows)
        if: runner.os == 'Windows'
@@ -196,14 +180,14 @@ jobs:
          --step set_workdir_unix

      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: 24
+          node-version: 26

-      - name: Set up pnpm via corepack
+      - name: Set up pnpm
        run: >-
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
-          --step setup_pnpm_corepack
+          --step setup_pnpm

      - name: Resolve pnpm store path (Windows)
        if: runner.os == 'Windows'
@@ -247,9 +231,9 @@ jobs:

      - name: Set up Rust toolchain (Unix)
        if: matrix.platform != 'windows'
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: ${{ matrix.platform == 'macos' && 'aarch64-apple-darwin,x86_64-apple-darwin' || (matrix.arch == 'arm64' && 'aarch64-unknown-linux-gnu' || 'x86_64-unknown-linux-gnu') }}

      - name: Install MSVC ARM64 build tools
@@ -260,7 +244,7 @@ jobs:

      - name: Set up MSVC env (Windows)
        if: matrix.platform == 'windows'
-        uses: TheMrMilchmann/setup-msvc-dev@79dac248aac9d0059f86eae9d8b5bfab4e95e97c
+        uses: TheMrMilchmann/setup-msvc-dev@368ef7d1ee4d1171b31d4a7f67f4d954f903f5a9
        with:
          arch: ${{ matrix.arch == 'arm64' && 'amd64_arm64' || 'amd64' }}

@@ -302,9 +286,9 @@ jobs:

      - name: Set up .NET SDK (Windows)
        if: matrix.platform == 'windows'
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
        with:
-          dotnet-version: "8.0.x"
+          dotnet-version: "10.0.x"

      - name: Install Velopack CLI
        if: matrix.platform == 'windows'
@@ -363,7 +347,7 @@ jobs:

      - name: Azure login for Artifact Signing
        if: matrix.platform == 'windows'
-        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -477,6 +461,12 @@ jobs:
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
          --step prepare_artifacts_unix

+      - name: Build AppImage update feed (Linux)
+        if: matrix.platform == 'linux'
+        run: >-
+          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
+          --step build_appimage_update_feed
+
      - name: Normalize updater YAML (macOS)
        if: matrix.platform == 'macos'
        run: >-
@@ -495,13 +485,23 @@ jobs:
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
          --step generate_checksums_windows

-      - name: Upload artifacts to S3 handoff
+      - name: Stage build artifacts
+        id: handoff
        run: >-
          cargo run --locked --quiet --manifest-path ${{ github.workspace }}/_ci/tools/ci/Cargo.toml -- build-desktop
-          --step upload_handoff
+          --step stage_handoff
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: ${{ steps.handoff.outputs.artifact_name }}
+          path: upload_staging
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0

  upload:
-    name: Upload to S3
+    name: Assemble desktop release assets
    if: ${{ !cancelled() && needs.build.result == 'success' }}
    needs:
      - meta
@@ -520,33 +520,26 @@ jobs:
      BUILD_VERSION: ${{ needs.meta.outputs.version }}
      PUBLIC_BUILD_VERSION: ${{ needs.meta.outputs.version }}
      PUB_DATE: ${{ needs.meta.outputs.pub_date }}
-      TEST_BUILD: ${{ needs.meta.outputs.test_build }}
      SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
-      S3_DESKTOP_PREFIX: ${{ needs.meta.outputs.s3_prefix }}
-      DESKTOP_HANDOFF_PREFIX: _handoff/desktop/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      DESKTOP_RELEASE_ASSETS_PREFIX: _handoff/desktop-release-assets/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      S3_ENDPOINT: ${{ vars.DOWNLOADS_S3_ENDPOINT }}
-      S3_BUCKET: ${{ vars.DOWNLOADS_S3_BUCKET }}
      PUBLIC_DL_BASE: https://api.fluxer.app/dl
-      AWS_ACCESS_KEY_ID: ${{ secrets.DOWNLOADS_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

-      - name: Download S3 handoff artifacts
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step download_handoff
+      - name: Download build artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          path: artifacts
+          pattern: fluxer-desktop-${{ needs.meta.outputs.build_channel }}-*

-      - name: Build S3 payload layout (+ manifest.json)
+      - name: Build payload layout (+ manifest.json)
        env:
          VERSION: ${{ needs.meta.outputs.version }}
          PUB_DATE: ${{ needs.meta.outputs.pub_date }}
@@ -555,42 +548,27 @@ jobs:
          --step build_payload

      - name: Prepare GitHub release assets
-        if: needs.meta.outputs.test_build != 'true'
        run: >-
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step prepare_release_assets

-      - name: Publish GitHub release descriptor
-        if: needs.meta.outputs.test_build != 'true'
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step publish_release_descriptor
-
-      - name: Upload payload to S3
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step upload_payload
-
-      - name: Upload GitHub release asset handoff
-        if: needs.meta.outputs.test_build != 'true'
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step upload_release_assets
+      - name: Upload GitHub release assets
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: fluxer-desktop-release-assets
+          path: release_assets
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0

      - name: Build summary
        run: >-
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
          --step build_summary

-      - name: Cleanup S3 handoff
-        if: ${{ success() }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step cleanup_handoff
-
  publish_release:
    name: Publish GitHub desktop release
-    if: ${{ !cancelled() && needs.upload.result == 'success' && needs.meta.outputs.test_build != 'true' }}
+    if: ${{ !cancelled() && needs.upload.result == 'success' }}
    needs:
      - meta
      - upload
@@ -602,26 +580,22 @@ jobs:
    env:
      CHANNEL: ${{ needs.meta.outputs.build_channel }}
      VERSION: ${{ needs.meta.outputs.version }}
-      DESKTOP_RELEASE_ASSETS_PREFIX: _handoff/desktop-release-assets/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
-      S3_ENDPOINT: ${{ vars.DOWNLOADS_S3_ENDPOINT }}
-      S3_BUCKET: ${{ vars.DOWNLOADS_S3_BUCKET }}
-      AWS_ACCESS_KEY_ID: ${{ secrets.DOWNLOADS_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.DOWNLOADS_AWS_SECRET_ACCESS_KEY || secrets.AWS_SECRET_ACCESS_KEY }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ needs.meta.outputs.source_sha }}

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Download GitHub release assets
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step download_release_assets
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: fluxer-desktop-release-assets
+          path: release_assets

      - name: Create token
        id: create-token
@@ -653,10 +627,3 @@ jobs:
            release_args+=(--prerelease)
          fi
          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- "${release_args[@]}"
-
-      - name: Publish GitHub release readiness marker
-        env:
-          SOURCE_SHA: ${{ needs.meta.outputs.source_sha }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
-          --step publish_release_marker
@@ -33,5 +33,4 @@ jobs:
    with:
      image: fluxer-docs
      dockerfile: fluxer_docs/Dockerfile
-      context: fluxer_docs
      build-version: ${{ inputs['build-version'] }}
@@ -19,22 +19,22 @@ jobs:
    timeout-minutes: 15
    steps:
      - name: Checkout fluxer
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -1,230 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-name: Dispatch private marketing build
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - fluxer_marketing
-      - Cargo.toml
-      - fluxer_common/**
-      - packages/fonts/manifest.json
-      - packages/fonts/NOTICE.md
-      - packages/fonts/LICENSE-IBM-PLEX.txt
-      - packages/fonts/css/locale-fallbacks.css
-      - packages/fonts/files/FluxerSans/**
-      - packages/fonts/files/FluxerMono/**
-      - packages/fonts/marketing/**
-      - packages/i18n/marketing/**
-      - fluxer_static/marketing/branding/**
-      - .github/workflows/dispatch-private-marketing-build.yaml
-
-permissions:
-  actions: read
-  contents: read
-
-concurrency:
-  group: private-marketing-dispatch
-  cancel-in-progress: false
-
-jobs:
-  metadata:
-    name: resolve exact private build metadata
-    if: github.repository == 'fluxerapp/fluxer'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    outputs:
-      parent_sha: ${{ steps.inputs.outputs.parent_sha }}
-      gitlink_sha: ${{ steps.inputs.outputs.gitlink_sha }}
-      build_version: ${{ steps.inputs.outputs.build_version }}
-      correlation_id: ${{ steps.inputs.outputs.correlation_id }}
-    steps:
-      - name: Create token
-        id: create-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
-        with:
-          client-id: ${{ vars.FLUXER_CI_APP_ID }}
-          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
-          owner: fluxerapp
-          repositories: fluxer
-          permission-contents: read
-      - name: Resolve trusted build inputs
-        id: inputs
-        env:
-          EVENT_AFTER: ${{ github.event.after }}
-          GH_TOKEN: ${{ steps.create-token.outputs.token }}
-          PARENT_SHA: ${{ github.sha }}
-          PUBLIC_REPOSITORY: ${{ github.repository }}
-          RUN_ID: ${{ github.run_id }}
-          RUN_ATTEMPT: ${{ github.run_attempt }}
-        run: |
-          set -euo pipefail
-          [[ "$GITHUB_EVENT_NAME" == "push" ]]
-          [[ "$GITHUB_REF" == "refs/heads/main" ]]
-          [[ "$PUBLIC_REPOSITORY" == "fluxerapp/fluxer" ]]
-          [[ "$PARENT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$EVENT_AFTER" == "$PARENT_SHA" ]]
-          [[ "$RUN_ID" =~ ^[1-9][0-9]*$ ]]
-          [[ "$RUN_ATTEMPT" =~ ^[1-9][0-9]*$ ]]
-          (( 10#$RUN_ATTEMPT <= 10 ))
-
-          main_sha="$(gh api "repos/$PUBLIC_REPOSITORY/git/ref/heads/main" --jq .object.sha)"
-          [[ "$main_sha" =~ ^[0-9a-f]{40}$ ]]
-          main_comparison="$(gh api "repos/$PUBLIC_REPOSITORY/compare/$PARENT_SHA...$main_sha")"
-          main_status="$(jq -r .status <<<"$main_comparison")"
-          [[ "$main_status" == "identical" || "$main_status" == "ahead" ]]
-          [[ "$(jq -r .merge_base_commit.sha <<<"$main_comparison")" == "$PARENT_SHA" ]]
-
-          commit="$(gh api "repos/$PUBLIC_REPOSITORY/git/commits/$PARENT_SHA")"
-          [[ "$(jq -r .sha <<<"$commit")" == "$PARENT_SHA" ]]
-          tree_sha="$(jq -r .tree.sha <<<"$commit")"
-          [[ "$tree_sha" =~ ^[0-9a-f]{40}$ ]]
-          entry="$(
-            gh api "repos/$PUBLIC_REPOSITORY/git/trees/$tree_sha" |
-              jq -cer '[.tree[] | select(.path == "fluxer_marketing")] | if length == 1 then .[0] else error("expected exactly one marketing gitlink") end'
-          )"
-          mode="$(jq -r .mode <<<"$entry")"
-          type="$(jq -r .type <<<"$entry")"
-          gitlink_sha="$(jq -r .sha <<<"$entry")"
-          path="$(jq -r .path <<<"$entry")"
-          if [[ "$mode" != "160000" || "$type" != "commit" || "$path" != "fluxer_marketing" || ! "$gitlink_sha" =~ ^[0-9a-f]{40}$ ]]; then
-            echo "::error::Public parent does not contain a valid fluxer_marketing gitlink."
-            exit 1
-          fi
-
-          run="$(gh api "repos/$PUBLIC_REPOSITORY/actions/runs/$RUN_ID")"
-          [[ "$(jq -r .id <<<"$run")" == "$RUN_ID" ]]
-          [[ "$(jq -r .run_attempt <<<"$run")" == "$RUN_ATTEMPT" ]]
-          [[ "$(jq -r .event <<<"$run")" == "push" ]]
-          [[ "$(jq -r .head_sha <<<"$run")" == "$PARENT_SHA" ]]
-          run_created_at="$(jq -r .created_at <<<"$run")"
-          [[ "$run_created_at" =~ ^[1-9][0-9]{3}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]]
-          run_created_epoch="$(date -u -d "$run_created_at" +%s)"
-          [[ "$run_created_epoch" =~ ^[1-9][0-9]*$ ]]
-          build_epoch=$((run_created_epoch + 10#$RUN_ATTEMPT - 1))
-          read -r year month day time_segment <<<"$(date -u -d "@$build_epoch" '+%Y %m %d %H%M%S')"
-          month="$((10#$month))"
-          micro="$((10#$time_segment))"
-          build_version="$year.$month$day.$micro"
-          [[ "$build_version" =~ ^[1-9][0-9]{3}\.[1-9][0-9]{2,3}\.([0-9]|[1-9][0-9]{0,5})$ ]]
-          correlation_id="public-${RUN_ID}-${RUN_ATTEMPT}"
-          [[ "$correlation_id" =~ ^[A-Za-z0-9._:-]{1,64}$ ]]
-          {
-            echo "parent_sha=$PARENT_SHA"
-            echo "gitlink_sha=$gitlink_sha"
-            echo "build_version=$build_version"
-            echo "correlation_id=$correlation_id"
-          } >>"$GITHUB_OUTPUT"
-
-  dispatch:
-    name: dispatch exact private build
-    needs: metadata
-    runs-on: ubuntu-24.04
-    timeout-minutes: 65
-    environment: private-marketing-dispatch
-    permissions: {}
-    steps:
-      - name: Validate trusted build inputs
-        env:
-          DISPATCH_ENABLED: ${{ vars.MARKETING_DISPATCH_ENABLED }}
-          EXPECTED_PARENT_SHA: ${{ github.sha }}
-          EXPECTED_CORRELATION_ID: public-${{ github.run_id }}-${{ github.run_attempt }}
-          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
-          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
-          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
-          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
-        run: |
-          set -euo pipefail
-          [[ "$GITHUB_EVENT_NAME" == "push" ]]
-          [[ "$GITHUB_REF" == "refs/heads/main" ]]
-          [[ "$GITHUB_REPOSITORY" == "fluxerapp/fluxer" ]]
-          [[ "$PARENT_SHA" == "$EXPECTED_PARENT_SHA" ]]
-          [[ "$PARENT_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$GITLINK_SHA" =~ ^[0-9a-f]{40}$ ]]
-          [[ "$BUILD_VERSION" =~ ^[1-9][0-9]{3}\.[1-9][0-9]{2,3}\.([0-9]|[1-9][0-9]{0,5})$ ]]
-          [[ "$CORRELATION_ID" == "$EXPECTED_CORRELATION_ID" ]]
-          [[ "$CORRELATION_ID" =~ ^[A-Za-z0-9._:-]{1,64}$ ]]
-          if [[ "$DISPATCH_ENABLED" != "true" ]]; then
-            echo "::error::Private marketing dispatch is intentionally disabled until the package cutover guard completes."
-            exit 1
-          fi
-
-      - name: Create private dispatch token
-        id: private-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
-        with:
-          client-id: ${{ vars.FLUXER_CI_APP_ID }}
-          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
-          owner: fluxerapp
-          repositories: marketing
-          permission-actions: write
-
-      - name: Dispatch exact private build
-        env:
-          GH_TOKEN: ${{ steps.private-token.outputs.token }}
-          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
-          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
-          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
-          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
-        run: |
-          set -euo pipefail
-          gh api --method POST repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/dispatches \
-            --field ref=main \
-            --field "inputs[parent_sha]=$PARENT_SHA" \
-            --field "inputs[gitlink_sha]=$GITLINK_SHA" \
-            --field "inputs[build_version]=$BUILD_VERSION" \
-            --field "inputs[correlation_id]=$CORRELATION_ID"
-
-      - name: Wait for private build conclusion
-        env:
-          GH_TOKEN: ${{ steps.private-token.outputs.token }}
-          PARENT_SHA: ${{ needs.metadata.outputs.parent_sha }}
-          GITLINK_SHA: ${{ needs.metadata.outputs.gitlink_sha }}
-          BUILD_VERSION: ${{ needs.metadata.outputs.build_version }}
-          CORRELATION_ID: ${{ needs.metadata.outputs.correlation_id }}
-        run: |
-          set -euo pipefail
-          expected_title="marketing-build correlation=$CORRELATION_ID parent=$PARENT_SHA gitlink=$GITLINK_SHA version=$BUILD_VERSION"
-          deadline=$((SECONDS + 3600))
-          run_id=""
-          while (( SECONDS < deadline )); do
-            runs="$(gh api "repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/runs?event=workflow_dispatch&per_page=100" --jq '[.workflow_runs[] | {id, event, display_title, status, conclusion}]')"
-            matches="$(jq --arg title "$expected_title" '[.[] | select(.event == "workflow_dispatch" and .display_title == $title)]' <<<"$runs")"
-            count="$(jq 'length' <<<"$matches")"
-            if [[ "$count" == "1" ]]; then
-              run_id="$(jq -r '.[0].id' <<<"$matches")"
-              break
-            fi
-            if [[ "$count" != "0" ]]; then
-              echo "::error::Private build correlation matched multiple workflow runs."
-              exit 1
-            fi
-            sleep 10
-          done
-          if [[ -z "$run_id" ]]; then
-            echo "::error::Timed out waiting for the private build dispatch to appear."
-            exit 1
-          fi
-          while (( SECONDS < deadline )); do
-            runs="$(gh api "repos/fluxerapp/marketing/actions/workflows/build-marketing.yaml/runs?event=workflow_dispatch&per_page=100" --jq '[.workflow_runs[] | {id, event, display_title, status, conclusion}]')"
-            matches="$(jq --arg title "$expected_title" '[.[] | select(.event == "workflow_dispatch" and .display_title == $title)]' <<<"$runs")"
-            if [[ "$(jq 'length' <<<"$matches")" != "1" || "$(jq -r '.[0].id' <<<"$matches")" != "$run_id" ]]; then
-              echo "::error::Private build correlation is missing or ambiguous."
-              exit 1
-            fi
-            run="$(jq '.[0]' <<<"$matches")"
-            status="$(jq -r '.status' <<<"$run")"
-            conclusion="$(jq -r '.conclusion // empty' <<<"$run")"
-            if [[ "$status" == "completed" ]]; then
-              if [[ "$conclusion" != "success" ]]; then
-                echo "::error::Private marketing build concluded with $conclusion."
-                exit 1
-              fi
-              echo "Private marketing build completed successfully."
-              exit 0
-            fi
-            sleep 15
-          done
-          echo "::error::Timed out waiting for the private marketing build."
-          exit 1
@@ -35,24 +35,24 @@ jobs:
          permission-pull-requests: write

      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          token: ${{ steps.create-token.outputs.token }}
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: "24"
+          node-version: "26"
          cache: "pnpm"

      - name: Install dependencies
@@ -40,7 +40,7 @@ jobs:
          permission-pull-requests: write

      - name: Checkout Weblate branch
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          token: ${{ steps.create-token.outputs.token }}
          ref: ${{ env.WEBLATE_BRANCH }}
@@ -48,17 +48,17 @@ jobs:
          persist-credentials: false

      - name: Set up Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: "24"
+          node-version: "26"
          cache: "pnpm"

      - name: Install dependencies
@@ -77,14 +77,14 @@ jobs:
          GH_TOKEN: ${{ steps.create-token.outputs.token }}
        run: |
          set -euo pipefail
-          if [[ -z "$(git status --porcelain -- fluxer_app/src/features/i18n/locales packages/i18n/marketing packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n)" ]]; then
+          if [[ -z "$(git status --porcelain -- fluxer_app/src/features/i18n/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n)" ]]; then
            echo "No generated catalog changes."
            exit 0
          fi

          git config user.name "fluxer-ci[bot]"
          git config user.email "${{ vars.FLUXER_CI_APP_USER_ID }}+fluxer-ci[bot]@users.noreply.github.com"
-          git add fluxer_app/src/features/i18n/locales packages/i18n/marketing packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
+          git add fluxer_app/src/features/i18n/locales packages/errors/src/i18n fluxer_api/pkgs/email/src/email_i18n fluxer_api/src/api/content_i18n
          git commit -m "i18n: compile Weblate catalogs"
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          git push origin "HEAD:$WEBLATE_BRANCH"
@@ -19,7 +19,7 @@ jobs:
          permission-pull-requests: write

      - name: Label pull request
-        uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13
        with:
          repo-token: ${{ steps.create-token.outputs.token }}
          configuration-path: .github/labeller.yaml
@@ -0,0 +1,142 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: release image set
+
+on:
+  workflow_dispatch:
+    inputs:
+      build-version:
+        description: "Explicit Fluxer CalVer build version (YYYY.MDD.MICRO, UTC HHMMSS without leading zeroes) to use instead of automatic UTC clock allocation"
+        type: string
+        required: false
+        default: ""
+      from-tag:
+        description: "Image tag every component is read from (v1 snapshots today's moving tags, a CalVer pins a coordinated build)"
+        type: string
+        required: false
+        default: "v1"
+      component-versions:
+        description: "Per-component overrides, one <image>=<version> entry per line (for example fluxer-api=2026.830.191141)"
+        type: string
+        required: false
+        default: ""
+
+permissions:
+  actions: read
+  contents: write
+  packages: read
+
+concurrency:
+  group: release-image-set
+  cancel-in-progress: false
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  GHCR_OWNER: ${{ github.repository_owner }}
+
+jobs:
+  approve:
+    name: approve image set release
+    permissions: {}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Image set release approved."
+
+  manifest:
+    name: resolve and publish the image set
+    needs: approve
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: write
+      packages: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        env:
+          GIT_CONFIG_GLOBAL: ${{ runner.temp }}/gitconfig
+      - name: Set up Rust toolchain (CI helpers)
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
+        with:
+          toolchain: "1.98.1"
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - name: Create token
+        id: create-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ vars.FLUXER_CI_APP_ID }}
+          private-key: ${{ secrets.FLUXER_CI_APP_KEY }}
+          owner: fluxerapp
+          repositories: fluxer
+          permission-contents: write
+          permission-packages: read
+
+      - name: set variables
+        id: vars
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          FLUXER_BUILD_VERSION: ${{ inputs['build-version'] }}
+        run: >-
+          tools/ci/run.sh resolve-calver
+          --github-output
+
+      - name: resolve release image set
+        id: resolve
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          VERSION: ${{ steps.vars.outputs.build_version }}
+          FROM_TAG: ${{ inputs['from-tag'] }}
+          COMPONENT_VERSIONS: ${{ inputs['component-versions'] }}
+        run: |
+          set -euo pipefail
+          args=(
+            image-set resolve
+            --version "${VERSION}"
+            --registry "ghcr.io/${GHCR_OWNER}"
+            --from-tag "${FROM_TAG}"
+            --out-dir release-out
+            --github-output
+          )
+          while IFS= read -r entry; do
+            entry="$(echo "$entry" | xargs)"
+            if [ -n "$entry" ]; then
+              args+=( --component-version "$entry" )
+            fi
+          done <<< "${COMPONENT_VERSIONS}"
+          tools/ci/run.sh "${args[@]}"
+
+      - name: verify release image set
+        env:
+          VERSION: ${{ steps.vars.outputs.build_version }}
+        run: >-
+          tools/ci/run.sh image-set verify
+          --manifest "release-out/fluxer-release-${VERSION}.json"
+
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ steps.create-token.outputs.token }}
+          VERSION: ${{ steps.vars.outputs.build_version }}
+          BUNDLE_COMMIT: ${{ steps.resolve.outputs.bundle_commit }}
+        run: |
+          set -euo pipefail
+          if [ -z "${BUNDLE_COMMIT}" ]; then
+            echo "image-set resolve reported no bundle commit" >&2
+            exit 1
+          fi
+          gh release create "fluxer-release@${VERSION}" \
+            --repo fluxerapp/fluxer \
+            --target "${BUNDLE_COMMIT}" \
+            --title "fluxer-release ${VERSION}" \
+            --latest=true \
+            --notes "Immutable image set for ${VERSION}. Every image in the set contains ${BUNDLE_COMMIT}, the commit this tag points at, so the bundle here is never newer than the images. Pin with: docker compose -f docker-compose.yml -f fluxer-release-${VERSION}.yml up -d" \
+            "release-out/fluxer-release-${VERSION}.json" \
+            "release-out/fluxer-release-${VERSION}.yml"
@@ -28,12 +28,12 @@ jobs:
      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

      - name: Restore ci helper
@@ -42,7 +42,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -55,16 +55,16 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -83,12 +83,12 @@ jobs:
      PNPM_TEST_WORKSPACE_CONCURRENCY: '2'
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

      - name: Restore ci helper
@@ -97,7 +97,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -105,12 +105,12 @@ jobs:
        run: cargo build --locked --package fluxer-ci

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -125,7 +125,7 @@ jobs:
            fluxer_app/pkgs/libfluxcore
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
@@ -144,7 +144,7 @@ jobs:
            fluxer_app/pkgs/libfluxcore
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
@@ -152,46 +152,89 @@ jobs:
            'packages/markdown_parser/rust/src/**') }}

  rust:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 45
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          components: clippy, rustfmt

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Cache cargo
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
        with:
-          workspaces: |
-            . -> target
-            fluxer_desktop/native/rust -> target
-          save-if: ${{ github.ref == 'refs/heads/main' }}
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: rust-${{ runner.os }}-${{ hashFiles('fluxer_media_proxy/tools/install-native-deps.sh') }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            rust-${{ runner.os }}-${{ hashFiles('fluxer_media_proxy/tools/install-native-deps.sh') }}-
+
+      - name: Install cargo-deny
+        run: cargo install cargo-deny --version 0.20.2 --locked
+
+      - name: Check Rust dependencies
+        run: cargo deny --locked check -D warnings
+
+      - name: Check desktop native dependencies
+        run: tools/ci/check-desktop-native-workspaces.sh dependencies
+
+      - name: Cache native media dependencies
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: /opt/fluxer-native
+          key: media-native-${{ runner.os }}-${{ hashFiles('fluxer_media_proxy/tools/install-native-deps.sh') }}

      - name: Install native dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
-            pkg-config \
            build-essential \
-            libcurl4-openssl-dev \
-            libvips-dev \
+            binutils \
+            clang \
+            cmake \
+            curl \
+            libaom-dev \
            libavfilter-dev \
+            libclang-dev \
+            libcurl4-openssl-dev \
+            libdav1d-dev \
+            libde265-dev \
+            libfido2-dev \
            libheif-dev \
-            libwebp-dev
+            liblcms2-dev \
+            libpipewire-0.3-dev \
+            libspa-0.2-dev \
+            libssl-dev \
+            libudev-dev \
+            libvips-dev \
+            libwebp-dev \
+            libyuv-dev \
+            meson \
+            nasm \
+            ninja-build \
+            pkg-config \
+            xz-utils \
+            yasm \
+            zlib1g-dev
+          sudo fluxer_media_proxy/tools/install-native-deps.sh /opt/fluxer-native
+          echo "PKG_CONFIG_PATH=/opt/fluxer-native/lib/pkgconfig:/opt/fluxer-native/lib64/pkgconfig" >> "$GITHUB_ENV"
+          echo "LD_LIBRARY_PATH=/opt/fluxer-native/lib:/opt/fluxer-native/lib64" >> "$GITHUB_ENV"
+          echo "/opt/fluxer-native/bin" >> "$GITHUB_PATH"

      - name: Install Node.js dependencies
        run: pnpm --filter fluxer_admin install
@@ -199,17 +242,29 @@ jobs:
      - name: Check formatting
        run: cargo fmt --all -- --check

-      - name: Check formatting (desktop native)
-        run: cargo fmt --manifest-path fluxer_desktop/native/rust/Cargo.toml --all -- --check
+      - name: Check formatting (desktop native workspaces)
+        run: tools/ci/check-desktop-native-workspaces.sh fmt

      - name: Clippy (warnings as errors)
-        run: cargo clippy --workspace -- -D warnings
+        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
+
+      - name: Clippy (desktop native workspaces on Linux, warnings as errors)
+        run: tools/ci/check-desktop-native-workspaces.sh clippy
+
+      - name: Verify the source-built ffmpeg CLI is on PATH
+        run: |
+          set -euo pipefail
+          command -v ffmpeg
+          test "$(command -v ffmpeg)" = /opt/fluxer-native/bin/ffmpeg
+          ffmpeg -hide_banner -version

      - name: Run tests
-        run: cargo test --workspace
+        env:
+          FLUXER_REQUIRE_MEDIA_FIXTURES: "1"
+        run: cargo test --workspace --all-features --locked

-      - name: Run desktop native tests
-        run: cargo test --manifest-path fluxer_desktop/native/rust/Cargo.toml
+      - name: Run desktop native workspace tests on Linux
+        run: tools/ci/check-desktop-native-workspaces.sh test

  gateway:
    runs-on: ubuntu-24.04
@@ -218,12 +273,12 @@ jobs:
      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"

      - name: Cache cargo (gateway NIFs)
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
@@ -239,7 +294,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -250,7 +305,7 @@ jobs:
        uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124
        with:
          otp-version: '28'
-          rebar3-version: '3.24.0'
+          rebar3-version: '3.27.0'

      - name: Restore rebar3 dependencies
        id: rebar3-cache
@@ -259,13 +314,13 @@ jobs:
          path: |
            ~/.cache/rebar3
            fluxer_gateway/_build
-            !fluxer_gateway/_build/default/lib/fluxer_gateway
-            !fluxer_gateway/_build/test/lib/fluxer_gateway
+            !fluxer_gateway/_build/default/lib/fluxer_gateway/**
+            !fluxer_gateway/_build/test/lib/fluxer_gateway/**
          key: >-
-            rebar3-${{ runner.os }}-otp28-rebar3.24.0-${{ hashFiles('fluxer_gateway/rebar.lock',
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-${{ hashFiles('fluxer_gateway/rebar.lock',
            'fluxer_gateway/rebar.config') }}
          restore-keys: |
-            rebar3-${{ runner.os }}-otp28-rebar3.24.0-
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-

      - name: Check formatting
        run: |
@@ -290,10 +345,10 @@ jobs:
          path: |
            ~/.cache/rebar3
            fluxer_gateway/_build
-            !fluxer_gateway/_build/default/lib/fluxer_gateway
-            !fluxer_gateway/_build/test/lib/fluxer_gateway
+            !fluxer_gateway/_build/default/lib/fluxer_gateway/**
+            !fluxer_gateway/_build/test/lib/fluxer_gateway/**
          key: >-
-            rebar3-${{ runner.os }}-otp28-rebar3.24.0-${{ hashFiles('fluxer_gateway/rebar.lock',
+            rebar3-${{ runner.os }}-otp28-rebar3.27.0-${{ hashFiles('fluxer_gateway/rebar.lock',
            'fluxer_gateway/rebar.config') }}

  knip:
@@ -303,12 +358,12 @@ jobs:
      FLUXER_CI_BIN: ${{ github.workspace }}/target/debug/fluxer-ci
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Rust toolchain (CI helpers)
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de
        with:
-          toolchain: "1.93.0"
+          toolchain: "1.98.1"
          targets: wasm32-unknown-unknown

      - name: Restore ci helper
@@ -317,7 +372,7 @@ jobs:
        with:
          path: target/debug/fluxer-ci
          key: >-
-            fluxer-ci-bin-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'Cargo.toml',
+            fluxer-ci-bin-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'Cargo.toml',
            'tools/ci/Cargo.toml', 'tools/ci/src/**', 'tools/ci/templates/**') }}

      - name: Build ci helper
@@ -325,12 +380,12 @@ jobs:
        run: cargo build --locked --package fluxer-ci

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -345,7 +400,7 @@ jobs:
            fluxer_app/pkgs/libfluxcore
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
@@ -364,27 +419,52 @@ jobs:
            fluxer_app/pkgs/libfluxcore
            fluxer_app/src/features/messaging/utils/markdown/parser/MarkdownParserWasmBytes.ts
          key: >-
-            app-wasm-${{ runner.os }}-1.93.0-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
+            app-wasm-${{ runner.os }}-1.98.1-${{ hashFiles('Cargo.lock', 'tools/ci/src/app_wasm.rs',
            'tools/ci/templates/libfluxcore_wrapper.js', 'tools/ci/templates/libfluxcore_wrapper.d.ts',
            'fluxer_app/rust/libfluxcore/Cargo.toml', 'fluxer_app/rust/libfluxcore/Cargo.lock',
            'fluxer_app/rust/libfluxcore/.cargo/config.toml', 'fluxer_app/rust/libfluxcore/src/**',
            'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
            'packages/markdown_parser/rust/src/**') }}

+  lint:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
+
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: '26'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Check formatting and lint
+        run: pnpm exec biome ci .
+
+      - name: Lint JSX for browser-translation safety
+        run: pnpm exec eslint . --max-warnings 0
+
  i18n:
    runs-on: ubuntu-24.04
    timeout-minutes: 25
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Install pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413

      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
-          node-version: '24'
+          node-version: '26'
          cache: 'pnpm'

      - name: Install dependencies
@@ -405,17 +485,42 @@ jobs:
            exit 1
          fi

+  docs:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413
+
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: '26'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile --filter fluxer_docs...
+
+      - name: Verify documentation matches the live API
+        run: pnpm --filter fluxer_docs verify
+
+      - name: Build documentation
+        run: pnpm --filter fluxer_docs build
+
  fonts:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
-          python-version: "3.13"
+          python-version: "3.14"

      - name: Install font tooling
        run: python3 -m pip install -r tools/fonts/requirements.txt
@@ -1,4 +0,0 @@
-[submodule "fluxer_marketing"]
-	path = fluxer_marketing
-	url = https://github.com/fluxerapp/marketing.git
-	update = none
@@ -9,7 +9,6 @@ members = [
 	"fluxer_messages",
 	"fluxer_snowflakes",
 	"tools/ci",
-	"tools/content/update-frozen-snapshot",
 	"tools/dev",
 	"tools/i18n_auto",
 	"fluxer_users",
@@ -17,7 +16,6 @@ members = [
 	"packages/markdown_parser/rust",
 ]
 exclude = [
-	"fluxer_marketing",
 	"packages/markdown_parser/rust/fuzz",
 ]
 resolver = "2"
@@ -25,3 +23,8 @@ resolver = "2"
 [workspace.package]
 edition = "2024"
 license = "AGPL-3.0-or-later"
+
+[profile.release]
+lto = "fat"
+codegen-units = 1
+strip = "symbols"
@@ -20,7 +20,7 @@
 			"bracketSpacing": false,
 			"bracketSameLine": false
 		},
-		"globals": ["React"]
+		"globals": ["React", "__webpack_base_uri__"]
 	},
 	"json": {
 		"formatter": {
@@ -48,7 +48,7 @@
 	"linter": {
 		"enabled": true,
 		"rules": {
-			"recommended": true,
+			"preset": "recommended",
 			"complexity": {
 				"noForEach": "off",
 				"noImportantStyles": "off",
@@ -83,11 +83,23 @@
 					}
 				},
 				"useConst": "error",
+				"noDescendingSpecificity": "off",
 				"noNonNullAssertion": "off",
-				"noParameterAssign": "off"
+				"noParameterAssign": "off",
+				"noRestrictedImports": {
+					"level": "error",
+					"options": {
+						"paths": {
+							"@lingui/react": {
+								"importNames": ["I18nProvider"],
+								"message": "Use AppI18nProvider from @app/features/i18n/components/AppI18nProvider so <Trans> output stays safe under page translation."
+							}
+						}
+					}
+				}
 			},
 			"a11y": {
-				"recommended": true,
+				"preset": "recommended",
 				"useAriaPropsForRole": "error",
 				"useValidAriaRole": "error",
 				"useValidAriaValues": "error",
@@ -115,6 +127,28 @@
 		}
 	},
 	"assist": {"actions": {"source": {"organizeImports": "on"}}},
+	"overrides": [
+		{
+			"includes": ["fluxer_app/src/**/*.tsx"],
+			"plugins": ["./tools/lint/no-adjacent-jsx-text.grit"]
+		},
+		{
+			"includes": ["fluxer_docs/scripts/VerifyDocsCoverage.ts"],
+			"linter": {"rules": {"suspicious": {"noTemplateCurlyInString": "off"}}}
+		},
+		{
+			"includes": [
+				"fluxer_app/src/features/i18n/components/AppI18nProvider.tsx",
+				"fluxer_app/src/features/i18n/components/AppI18nProvider.test.tsx"
+			],
+			"linter": {"rules": {"style": {"noRestrictedImports": "off"}}}
+		},
+		{
+			"includes": ["**/*.astro"],
+			"linter": {"rules": {"correctness": {"noUnusedImports": "off", "noUnusedVariables": "off"}}},
+			"assist": {"actions": {"source": {"organizeImports": "off"}}}
+		}
+	],
 	"vcs": {
 		"enabled": true,
 		"clientKind": "git",
@@ -43,7 +43,6 @@ FLUXER_SVC_NATS_URL=nats://nats:4222
 FLUXER_SVC_SHARD_COUNT=1
 FLUXER_SVC_CACHE_TTL_MS=30000
 FLUXER_SVC_CACHE_HARD_TTL_MS=600000
-FLUXER_SVC_MAX_CONCURRENT_REQUESTS=64

 FLUXER_S3_ENDPOINT=http://127.0.0.1:8333
 FLUXER_S3_PUBLIC_ENDPOINT=http://localhost:8088
@@ -53,7 +52,6 @@ FLUXER_S3_SECRET_ACCESS_KEY=fluxer-secret
 FLUXER_S3_FORCE_PATH_STYLE=true
 FLUXER_S3_BUCKET_CDN=fluxer
 FLUXER_S3_BUCKET_UPLOADS=fluxer-uploads
-FLUXER_S3_BUCKET_DOWNLOADS=fluxer-downloads
 FLUXER_S3_BUCKET_REPORTS=fluxer-reports
 FLUXER_S3_BUCKET_HARVESTS=fluxer-harvests
 FLUXER_S3_BUCKET_STATIC=fluxer-static
@@ -69,7 +67,6 @@ FLUXER_LIVEKIT_DEFAULT_REGION={"id":"local","name":"Local","emoji":"LC","latitud
 FLUXER_API_PORT=8080
 FLUXER_API_PRESIGNED_ATTACHMENT_UPLOADS_ENABLED=true
 FLUXER_API_WORKER_MODE=all_lanes
-FLUXER_API_WORKER_ENABLE_VOICE_RECONCILIATION=true
 FLUXER_APP_DEV_PORT=3000
 FLUXER_APP_PROXY_PORT=8773
 FLUXER_STATIC_DIR=fluxer_app/dist
@@ -90,18 +87,13 @@ FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES=1048576
 FLUXER_ADMIN_PORT=3020
 FLUXER_ADMIN_BASE_PATH=/admin
 FLUXER_ADMIN_SECRET_KEY_BASE=dev-admin-secret-key-base
-FLUXER_ADMIN_OAUTH_CLIENT_ID=1234567890123456789
 FLUXER_ADMIN_OAUTH_CLIENT_SECRET=dev-admin-oauth-secret
 FLUXER_ADMIN_OAUTH_REDIRECT_URI=http://localhost:8088/admin/oauth2_callback
-FLUXER_MARKETING_PORT=3010
-FLUXER_MARKETING_HOST=0.0.0.0
-FLUXER_MARKETING_BASE_PATH=/marketing
-FLUXER_MARKETING_SECRET_KEY_BASE=dev-marketing-secret-key-base

 FLUXER_SUDO_MODE_SECRET=dev-sudo-secret
 FLUXER_CONNECTION_INITIATION_SECRET=dev-connection-initiation-secret
-FLUXER_VAPID_PUBLIC_KEY=dev-vapid-public-key
-FLUXER_VAPID_PRIVATE_KEY=dev-vapid-private-key
+FLUXER_VAPID_PUBLIC_KEY=BHIbdKs24FdPkOQS7hbeg3adceLS0IqlKsn71ywEe6kbeopeFFiG3lkvJac7BVqkuk7mxwEa555O2FXV3HLt56w
+FLUXER_VAPID_PRIVATE_KEY=cs24JvXSxHiqJQgkJNocJFAdzJpPmpfU9xD-fDpn3tw
 FLUXER_VAPID_EMAIL=dev@localhost
 FLUXER_PASSKEY_RP_NAME='Fluxer Dev'
 FLUXER_PASSKEY_RP_ID=localhost
@@ -137,6 +129,7 @@ PUBLIC_RELEASE_CHANNEL=canary
 PUBLIC_BOOTSTRAP_API_ENDPOINT=/api
 PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT=http://localhost:8088/api
 FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64=Zmx1eGVyLWRldi11cGxvYWQtcmVsYXktc2VjcmV0LTAwMDA=
+FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64=Zmx1eGVyLWRldi1hdHRhY2htZW50LXVybC1zZWNyZXQ=
 AWS_EC2_METADATA_DISABLED=true
 AWS_ACCESS_KEY_ID=fluxer
 AWS_SECRET_ACCESS_KEY=fluxer-secret
@@ -1,13 +1,9 @@
 # cargo-deny configuration for the Fluxer workspace.
 #
-# Applies to the root workspace (Cargo.toml at the repo root) AND to every
-# per-addon crate under fluxer_desktop/native/* (each addon has its own
-# [workspace], so we invoke cargo-deny with --config pointing here).
-#
-# Used by the native desktop security gate in CI.
+# Applies to the root workspace (Cargo.toml at the repo root).

 [graph]
-all-features = false
+all-features = true
 no-default-features = false

 [output]
@@ -44,13 +40,11 @@ allow = [
    "BSD-3-Clause",
    "ISC",
    "MPL-2.0",
-    "Unicode-DFS-2016",
    "Unicode-3.0",
    "Zlib",
    "CC0-1.0",
    "AGPL-3.0-or-later",
    "BSL-1.0",
-    "OpenSSL",
    "CDLA-Permissive-2.0",
 ]
 # Explicitly deny GPL-only / strong-copyleft licenses that don't compose with
@@ -72,21 +66,56 @@ license-files = [
 [bans]
 multiple-versions = "warn"
 wildcards = "deny"
-# Per-addon crates path-depend on ../rust (the shared `fluxer_desktop_native`
-# crate) without a version. cargo-deny flags that as a wildcard; we allow it
-# because path deps can't realistically pin a SemVer range, and this only
-# affects intra-repo workspace links (registry wildcards remain denied).
+# Internal workspace crates use path dependencies without registry versions.
+# Registry wildcards remain denied.
 allow-wildcard-paths = true
 highlight = "all"
 workspace-default-features = "allow"
 external-default-features = "allow"
-# Keep desktop packaging and native addons away from the obsolete libfuse2 stack.
+# Keep workspace artifacts away from the obsolete libfuse2 stack.
 # AppImage packaging must use the static electron-builder runtime instead.
 deny = [
    { crate = "fuse", reason = "libfuse2-based Rust wrapper; use a maintained FUSE3-native crate only if Fluxer ever needs FUSE directly" },
    { crate = "fuse-sys", reason = "libfuse2 FFI crate; Fluxer AppImages must not reintroduce libfuse2 through native Rust dependencies" },
 ]
-skip = []
+skip = [
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older crypto API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older hashbrown API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older HTTP API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older HTTP body API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older WASI API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the prior randomness API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older digest API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]+wasi-snapshot-preview1", reason = "transitive dependency requires the legacy WASI API" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older release line" },
+    { crate = "[email protected]", reason = "transitive dependency requires the older Windows API" },
+]
 skip-tree = []

 # ---------------------------------------------------------------------------
@@ -1,7 +1,65 @@
+# Every variable docker-compose.yml reads, uncommented when it has no default and
+# commented with its default when it has one. Compose expands top to bottom, so a
+# line using ${...} must sit below every name it reads.
+
 FLUXER_DOMAIN=chat.example.com
 FLUXER_PUBLIC_SCHEME=https
 FLUXER_PUBLIC_PORT=443
-FLUXER_CADDY_SITE_ADDRESS=chat.example.com
+
+# The address browsers use. FLUXER_HTTP_PORT and FLUXER_HTTPS_PORT below decide
+# which host ports Fluxer binds.
+
+# By default Fluxer binds 80 and 443 and gets its own certificate. Point DNS here.
+# Behind your own reverse proxy, uncomment this instead: Fluxer then serves plain
+# HTTP on 127.0.0.1:8080. Keep the scheme and port above describing the public
+# address, not this one.
+#COMPOSE_FILE=docker-compose.yml:docker-compose.proxy.yml
+
+# Where that plain-HTTP port binds. Use 0.0.0.0:8080 only when the proxy is on
+# another machine, and firewall it to that machine.
+#FLUXER_EDGE_BIND=127.0.0.1:8080
+
+# Which hops may set X-Forwarded-For. The default covers private and loopback
+# addresses. Set your proxy's address if it reaches Fluxer from a public IP.
+#FLUXER_EDGE_TRUSTED_PROXIES=private_ranges
+
+# The origin browsers see, no trailing slash. Set it when browsers reach the
+# instance on a host FLUXER_DOMAIN does not name, and it wins over the three
+# values above. Scheme, host and optional port only. It does not move the
+# published ports.
+#FLUXER_PUBLIC_ORIGIN=https://chat.example.com
+
+# The address the edge listens on inside its container. Both proxy overlays set
+# this themselves, so a value here is ignored under either. Include the scheme.
+#FLUXER_EDGE_SITE_ADDRESS=https://chat.example.com
+
+# The old name for the line above, read only when it is unset.
+#FLUXER_CADDY_SITE_ADDRESS=
+
+# Host ports. Container 80 handles the redirect and the certificate challenge,
+# container 443 the TLS site. FLUXER_HTTPS_PORT moves TCP and UDP together, since
+# HTTP/3 needs both. Both accept a bind address. Give them different host ports.
+#FLUXER_HTTP_PORT=80
+#FLUXER_HTTPS_PORT=443
+#FLUXER_HTTP_PORT=127.0.0.1:80
+#FLUXER_HTTPS_PORT=127.0.0.1:443
+
+# HTTPS on 8443. Host 80 stays published for the certificate challenge, which
+# only ever arrives on public 80 or 443. Serve your own certificate if nothing
+# forwards those.
+#FLUXER_PUBLIC_PORT=8443
+#FLUXER_HTTPS_PORT=8443
+
+# Plain HTTP on 19080. Nothing binds host 80, and the last line parks the idle
+# 443 publish on loopback.
+#FLUXER_PUBLIC_SCHEME=http
+#FLUXER_PUBLIC_PORT=19080
+#FLUXER_HTTP_PORT=19080
+#FLUXER_HTTPS_PORT=127.0.0.1:443
+
+# A tunnel needs no HTTPS publish. tunnel.compose.yml ships beside this file and
+# leaves one loopback HTTP publish. Needs Compose 2.24.4 or newer.
+#COMPOSE_FILE=docker-compose.yml:tunnel.compose.yml

 FLUXER_REGISTRY_OWNER=fluxerapp
 FLUXER_REGISTRY=ghcr.io/${FLUXER_REGISTRY_OWNER}
@@ -9,46 +67,144 @@ FLUXER_IMAGE_TAG=v1

 POSTGRES_PASSWORD=CHANGE_ME
 MEILI_MASTER_KEY=CHANGE_ME
+# Set these to run Postgres or the object store outside the stack. Backing up a
+# store you moved out is yours to arrange, and an upgrade skips it.
+#FLUXER_POSTGRES_HOST=db.example.com
+#FLUXER_POSTGRES_PORT=5432
+#FLUXER_POSTGRES_DATABASE=fluxer
+#FLUXER_POSTGRES_USERNAME=fluxer
+#FLUXER_POSTGRES_SSL=true
+#FLUXER_S3_ENDPOINT=https://s3.eu-central-1.amazonaws.com
+#FLUXER_S3_PUBLIC_ENDPOINT=https://cdn.example.com
+#FLUXER_S3_REGION=eu-central-1
+#FLUXER_S3_FORCE_PATH_STYLE=false
+# Bucket names. The bundled store creates these. An outside store needs them to
+# exist already.
+#FLUXER_S3_BUCKET_CDN=fluxer
+#FLUXER_S3_BUCKET_UPLOADS=fluxer-uploads
+#FLUXER_S3_BUCKET_REPORTS=fluxer-reports
+#FLUXER_S3_BUCKET_HARVESTS=fluxer-harvests
+
+# The other bundled services, pointed elsewhere. Removing a service from the
+# stack belongs in an override file, since an upgrade replaces docker-compose.yml.
+#FLUXER_KV_URL=redis://cache.example.com:6379/0
+#FLUXER_NATS_URL=nats://mq.example.com:4222
+#FLUXER_NATS_JETSTREAM_URL=nats://mq.example.com:4222
+#FLUXER_SVC_NATS_URL=nats://mq.example.com:4222
+#FLUXER_SEARCH_URL=https://search.example.com
+#FLUXER_LIVEKIT_INTERNAL_URL=http://livekit.example.com:7880
+
+# Voice off. The livekit service still runs until an override removes it.
+#FLUXER_LIVEKIT_ENABLED=false
+
+# Optional systems, each off unless configured.
+#FLUXER_SMS_ENABLED=false
+#FLUXER_STRIPE_ENABLED=false
+#FLUXER_NCMEC_ENABLED=false
+#FLUXER_CLAMAV_ENABLED=false
+
+# Outside lookups, off unless turned on. The Tor exit list comes from
+# onionoo.torproject.org and the breached password check asks
+# api.pwnedpasswords.com.
+#FLUXER_TOR_EXIT_LIST_ENABLED=true
+#FLUXER_BREACHED_PASSWORD_CHECK_ENABLED=true
+
+# The client address. Name the header your proxy actually writes, and turn the
+# trust off when nothing sits in front.
+#FLUXER_CLIENT_IP_HEADER_NAME=cf-connecting-ip
+#FLUXER_TRUST_CLIENT_IP_HEADER=true
+
+# How much the services write. trace, debug, info, warn, error or fatal.
+#LOG_LEVEL=debug
+
 FLUXER_S3_ACCESS_KEY=fluxer
 FLUXER_S3_SECRET_KEY=CHANGE_ME

 FLUXER_SUDO_MODE_SECRET=CHANGE_ME
 FLUXER_CONNECTION_INITIATION_SECRET=CHANGE_ME
 FLUXER_GATEWAY_RPC_AUTH_TOKEN=CHANGE_ME
+FLUXER_ERLANG_COOKIE=CHANGE_ME
 FLUXER_MEDIA_PROXY_SECRET_KEY=CHANGE_ME
 FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64=CHANGE_ME
 FLUXER_ADMIN_SECRET_KEY_BASE=CHANGE_ME
 FLUXER_ADMIN_OAUTH_CLIENT_SECRET=CHANGE_ME

+# The token every service sends to NATS. The bundled NATS needs none, so this
+# stays empty unless an override points at an external one.
+#FLUXER_NATS_AUTH_TOKEN=
+
 FLUXER_VAPID_PUBLIC_KEY=CHANGE_ME
 FLUXER_VAPID_PRIVATE_KEY=CHANGE_ME
-FLUXER_VAPID_EMAIL=[email protected]

-# Passkeys follow FLUXER_DOMAIN by default. Set these only if browsers reach the
-# instance on a different host, and note that changing FLUXER_PASSKEY_RP_ID
-# invalidates every passkey already registered against the old value.
+# Defaults to admin@ followed by FLUXER_DOMAIN. Set it if that mailbox does not
+# exist.
+#[email protected]
+
+# Passkeys follow FLUXER_DOMAIN. Set these only if browsers use another host.
+# Changing the RP ID invalidates every passkey registered against the old value.
 #FLUXER_PASSKEY_RP_ID=chat.example.com
 #FLUXER_PASSKEY_RP_NAME=Fluxer
 #FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS=https://chat.example.com
+#FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS=http://chat.example.com:19080

-# Extra Content-Security-Policy sources, appended to the built-in ones. Set these
-# only when a browser must reach an origin the defaults do not cover, such as a
-# voice server hosted on a domain other than FLUXER_DOMAIN. Separate several
-# sources with spaces or commas.
+# Optional media policies, both off by default. See the operator docs.
+#
+# CORS limits which web origins may read media. A request with no Origin is
+# always served. Add https://web.fluxer.app if people use the hosted client.
+#
+# Signatures make an attachment read need a signed URL, so a copied link stops
+# working. Needs a secret from openssl rand -base64 32, first entry signs and
+# every entry verifies.
+#
+# Each mode is off, report or enforce. Start at report. media-proxy reads these
+# at start, so apply with docker compose up -d media-proxy.
+#FLUXER_MEDIA_PROXY_CORS_MODE=enforce
+#FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS=https://chat.example.com,https://web.fluxer.app
+#FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64=
+#FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE=enforce
+
+# Extra Content-Security-Policy sources, appended to the built-in ones. Set one
+# only when a browser must reach an origin the defaults do not cover. Separate
+# several with spaces or commas. The three values below are illustrations.
+#FLUXER_CSP_EXTRA_DEFAULT_SRC=
 #FLUXER_CSP_EXTRA_CONNECT_SRC=wss://livekit.example.com:7881
 #FLUXER_CSP_EXTRA_IMG_SRC=https://cdn.example.com
+#FLUXER_CSP_EXTRA_MEDIA_SRC=
+#FLUXER_CSP_EXTRA_FONT_SRC=
 #FLUXER_CSP_EXTRA_SCRIPT_SRC=https://analytics.example.com
+#FLUXER_CSP_EXTRA_STYLE_SRC=
+#FLUXER_CSP_EXTRA_FRAME_SRC=
+#FLUXER_CSP_EXTRA_WORKER_SRC=
+#FLUXER_CSP_EXTRA_MANIFEST_SRC=

-# Allow the SSO identity provider to resolve to a private or internal address.
-# Off by default: the API refuses to call non-public addresses so a misconfigured
-# provider URL cannot be used to reach internal services. Turn it on only when the
-# provider genuinely lives on your own network, such as split-horizon DNS or a LAN
-# identity provider, and only when you trust everyone who can configure SSO.
+# One report-uri for CSP violation reports. Empty leaves the directive off.
+#FLUXER_CSP_REPORT_URI=
+
+# Let the SSO provider resolve to a private address. Off by default, so a
+# misconfigured provider URL cannot reach internal services. Turn it on only for
+# a provider on your own network.
 #FLUXER_SSO_ALLOW_PRIVATE_ADDRESSES=true

+# These reach both LiveKit and the api. Change them together.
 LIVEKIT_API_KEY=fluxer
 LIVEKIT_API_SECRET=CHANGE_ME

+# The URL browsers use for voice signalling. Built from the public origin plus
+# /livekit. Set it only when LiveKit is served from another host.
+#FLUXER_LIVEKIT_URL=
+
+# Media ports. LiveKit advertises these, so forward the same numbers.
+#FLUXER_LIVEKIT_TCP_PORT=7881
+#FLUXER_LIVEKIT_UDP_PORT=7882
+
+# LiveKit finds its public address over STUN. A host that cannot reach one stops
+# with "could not resolve external IP", so set the address by hand instead, or
+# point STUN elsewhere.
+#FLUXER_LIVEKIT_USE_EXTERNAL_IP=false
+#FLUXER_LIVEKIT_NODE_IP=203.0.113.10
+#FLUXER_LIVEKIT_STUN_PRIMARY=stun.l.google.com:19302
+#FLUXER_LIVEKIT_STUN_SECONDARY=stun1.l.google.com:19302
+
 FLUXER_KLIPY_API_KEY=

 FLUXER_EMAIL_ENABLED=false
@@ -64,4 +220,92 @@ FLUXER_EMAIL_SMTP_SECURE=true

 FLUXER_CAPTCHA_ENABLED=false
 FLUXER_CAPTCHA_PROVIDER=none
+FLUXER_CAPTCHA_HCAPTCHA_SITE_KEY=
+FLUXER_CAPTCHA_HCAPTCHA_SECRET_KEY=
+FLUXER_CAPTCHA_TURNSTILE_SITE_KEY=
+FLUXER_CAPTCHA_TURNSTILE_SECRET_KEY=
 FLUXER_DISCOVERY_ENABLED=true
+
+# Container memory. These are ceilings, not allocations, and the defaults suit a
+# 16 GB host. The reservations bias the kernel away from reclaiming from services
+# whose death takes the instance down. Lower the limits on a smaller host.
+#FLUXER_CADDY_MEMORY_LIMIT=256mb
+#FLUXER_POSTGRES_MEMORY_LIMIT=5gb
+#FLUXER_POSTGRES_MEMORY_RESERVATION=3gb
+#FLUXER_VALKEY_MEMORY_LIMIT=256mb
+#FLUXER_NATS_MEMORY_LIMIT=256mb
+#FLUXER_MEILISEARCH_MEMORY_LIMIT=768mb
+#FLUXER_SEAWEEDFS_MEMORY_LIMIT=2gb
+#FLUXER_SEAWEEDFS_INIT_MEMORY_LIMIT=128mb
+#FLUXER_LIVEKIT_MEMORY_LIMIT=512mb
+#FLUXER_API_MEMORY_LIMIT=2560mb
+#FLUXER_API_MEMORY_RESERVATION=1gb
+#FLUXER_WORKER_MEMORY_LIMIT=2560mb
+#FLUXER_WORKER_MEMORY_RESERVATION=1gb
+#FLUXER_GATEWAY_MEMORY_LIMIT=1gb
+#FLUXER_GATEWAY_MEMORY_RESERVATION=384mb
+#FLUXER_MEDIA_PROXY_MEMORY_LIMIT=512mb
+#FLUXER_STATIC_PROXY_MEMORY_LIMIT=256mb
+#FLUXER_APP_PROXY_MEMORY_LIMIT=256mb
+#FLUXER_SNOWFLAKES_MEMORY_LIMIT=128mb
+#FLUXER_SNOWFLAKES_SHARD_MEMORY_LIMIT=256mb
+#FLUXER_USERS_MEMORY_LIMIT=128mb
+#FLUXER_USERS_SHARD_MEMORY_LIMIT=256mb
+#FLUXER_GIFS_MEMORY_LIMIT=128mb
+#FLUXER_GIFS_SHARD_MEMORY_LIMIT=256mb
+#FLUXER_MESSAGES_MEMORY_LIMIT=128mb
+#FLUXER_MESSAGES_SHARD_MEMORY_LIMIT=256mb
+#FLUXER_UNFURL_MEMORY_LIMIT=128mb
+#FLUXER_UNFURL_SHARD_MEMORY_LIMIT=256mb
+#FLUXER_ADMIN_MEMORY_LIMIT=256mb
+
+# Meilisearch indexing memory. Keep it well under the container limit above.
+#FLUXER_MEILISEARCH_MAX_INDEXING_MEMORY=384mb
+
+# SeaweedFS heap ceiling. Go cannot see the container limit, so without this an
+# upload burst gets the container OOM-killed. Keep it near three quarters of
+# FLUXER_SEAWEEDFS_MEMORY_LIMIT and raise both together.
+#FLUXER_SEAWEEDFS_GOMEMLIMIT=1536MiB
+
+# Node sizes its heap from the container limit by default. Leave these unset
+# unless you need to pin it. A heap ceiling above the container limit gets the
+# container OOM-killed instead of reporting a heap error.
+#FLUXER_API_NODE_HEAP_MB=1792
+#FLUXER_WORKER_NODE_HEAP_MB=1792
+
+# Bundled Postgres tuning. Keep it consistent with the memory limit above. This
+# is the server setting, not the per-service pool sizes.
+#FLUXER_POSTGRES_SERVER_MAX_CONNECTIONS=150
+#FLUXER_POSTGRES_SHARED_BUFFERS=512MB
+#FLUXER_POSTGRES_EFFECTIVE_CACHE_SIZE=2GB
+#FLUXER_POSTGRES_WORK_MEM=8MB
+#FLUXER_POSTGRES_MAINTENANCE_WORK_MEM=256MB
+#FLUXER_POSTGRES_AUTOVACUUM_WORK_MEM=128MB
+
+# The bundled Valkey holds durable state as well as cache, so it runs with an
+# append-only file and with noeviction, which fails an over-limit write instead
+# of dropping queued work. Change the policy only if that state lives elsewhere.
+#FLUXER_VALKEY_MAXMEMORY=192mb
+#FLUXER_VALKEY_MAXMEMORY_POLICY=noeviction
+
+# The gateway derives its scheduler count from the CPU quota, clamped here. One
+# scheduler lets a single blocking operation stall every websocket on the node.
+#FLUXER_ERLANG_SCHEDULERS_MIN=2
+#FLUXER_ERLANG_SCHEDULERS_MAX=16
+
+# In-flight request ceiling for the users and messages routers and their shards.
+# One value replaces the built-in default on all of them, so size it for the
+# busiest. Too low a value rejects requests rather than slowing them, and the api
+# turns that into a 503.
+#FLUXER_SVC_MAX_CONCURRENT_REQUESTS=192
+
+# Named prepared statements need a session that outlives the transaction, so set
+# this to false behind a transaction-pooling connection pooler. The bundled
+# compose talks to Postgres directly, where the default is correct.
+#FLUXER_POSTGRES_PREPARED_STATEMENTS=true
+
+# How long a client may take to send a request. The header timeout covers the
+# request line and headers, the request timeout the whole exchange, and the first
+# is clamped down to the second. Milliseconds, 1000 to 3600000.
+#FLUXER_API_HEADERS_TIMEOUT_MS=30000
+#FLUXER_API_REQUEST_TIMEOUT_MS=120000
@@ -1,12 +1,17 @@
 {
 	servers {
-		trusted_proxies static private_ranges
+		trusted_proxies static {$FLUXER_EDGE_TRUSTED_PROXIES:private_ranges}
+		trusted_proxies_strict
 	}
 }

-{$FLUXER_CADDY_SITE_ADDRESS} {
+{$FLUXER_EDGE_SITE_ADDRESS} {
 	encode zstd gzip

+	handle /_health {
+		respond "OK" 200
+	}
+
 	handle_path /api/* {
 		reverse_proxy api:8080
 	}
@@ -52,7 +57,7 @@
 }

 :8088 {
-	handle_path /api/* {
+	handle /.well-known/fluxer {
 		reverse_proxy api:8080
 	}
 }
@@ -0,0 +1,17 @@
+# Overlay for running Fluxer behind your own reverse proxy.
+#
+#   docker compose -f docker-compose.yml -f docker-compose.proxy.yml up -d
+#
+# Or set this once in .env and keep using plain `docker compose up -d`:
+#
+#   COMPOSE_FILE=docker-compose.yml:docker-compose.proxy.yml
+#
+# Fluxer stops binding 80 and 443 and serves plain HTTP on one port instead.
+# That port already does all internal routing, so the proxy in front needs a
+# single rule: send everything to it. Terminate TLS there.
+services:
+  edge:
+    ports: !override
+      - "${FLUXER_EDGE_BIND:-127.0.0.1:8080}:8080"
+    environment:
+      FLUXER_EDGE_SITE_ADDRESS: ":8080"
@@ -1,55 +1,65 @@
 name: fluxer

+x-fluxer-postgres-env: &fluxer-postgres-env
+  FLUXER_DATABASE_BACKEND: postgres
+  FLUXER_POSTGRES_HOST: ${FLUXER_POSTGRES_HOST:-postgres}
+  FLUXER_POSTGRES_PORT: "${FLUXER_POSTGRES_PORT:-5432}"
+  FLUXER_POSTGRES_DATABASE: ${FLUXER_POSTGRES_DATABASE:-fluxer}
+  FLUXER_POSTGRES_USERNAME: ${FLUXER_POSTGRES_USERNAME:-fluxer}
+  FLUXER_POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+  FLUXER_POSTGRES_SSL: "${FLUXER_POSTGRES_SSL:-false}"
+  FLUXER_POSTGRES_PREPARED_STATEMENTS: ${FLUXER_POSTGRES_PREPARED_STATEMENTS:-true}
+
 x-fluxer-env: &fluxer-env
+  <<: *fluxer-postgres-env
  FLUXER_ENV: production
  NODE_ENV: production
+  LOG_LEVEL: ${LOG_LEVEL:-info}
  FLUXER_SELF_HOSTED: "true"
  FLUXER_BASE_DOMAIN: ${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}
  FLUXER_PUBLIC_SCHEME: ${FLUXER_PUBLIC_SCHEME:-https}
  FLUXER_PUBLIC_PORT: ${FLUXER_PUBLIC_PORT:-443}
-  FLUXER_TRUST_CLIENT_IP_HEADER: "true"
-  FLUXER_CLIENT_IP_HEADER_NAME: x-forwarded-for
+  FLUXER_PUBLIC_ORIGIN: ${FLUXER_PUBLIC_ORIGIN:-}
+  FLUXER_TRUST_CLIENT_IP_HEADER: "${FLUXER_TRUST_CLIENT_IP_HEADER:-true}"
+  FLUXER_CLIENT_IP_HEADER_NAME: ${FLUXER_CLIENT_IP_HEADER_NAME:-x-forwarded-for}
+  FLUXER_API_HEADERS_TIMEOUT_MS: ${FLUXER_API_HEADERS_TIMEOUT_MS:-30000}
+  FLUXER_API_REQUEST_TIMEOUT_MS: ${FLUXER_API_REQUEST_TIMEOUT_MS:-120000}
+  FLUXER_TOR_EXIT_LIST_ENABLED: "${FLUXER_TOR_EXIT_LIST_ENABLED:-false}"
+  FLUXER_BREACHED_PASSWORD_CHECK_ENABLED: "${FLUXER_BREACHED_PASSWORD_CHECK_ENABLED:-false}"

-  FLUXER_DATABASE_BACKEND: postgres
-  FLUXER_POSTGRES_HOST: postgres
-  FLUXER_POSTGRES_PORT: "5432"
-  FLUXER_POSTGRES_DATABASE: fluxer
-  FLUXER_POSTGRES_USERNAME: fluxer
-  FLUXER_POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
-  FLUXER_POSTGRES_SSL: "false"
-
-  FLUXER_KV_URL: redis://valkey:6379/0
-  FLUXER_NATS_URL: nats://nats:4222
-  FLUXER_NATS_JETSTREAM_URL: nats://nats:4222
-  FLUXER_SVC_NATS_URL: nats://nats:4222
+  FLUXER_KV_URL: ${FLUXER_KV_URL:-redis://valkey:6379/0}
+  FLUXER_NATS_URL: ${FLUXER_NATS_URL:-nats://nats:4222}
+  FLUXER_NATS_JETSTREAM_URL: ${FLUXER_NATS_JETSTREAM_URL:-${FLUXER_NATS_URL:-nats://nats:4222}}
+  FLUXER_NATS_AUTH_TOKEN: ${FLUXER_NATS_AUTH_TOKEN:-}
+  FLUXER_SVC_NATS_URL: ${FLUXER_SVC_NATS_URL:-${FLUXER_NATS_URL:-nats://nats:4222}}
  FLUXER_SVC_SHARD_COUNT: "1"

  FLUXER_SEARCH_ENGINE: meilisearch
-  FLUXER_SEARCH_URL: http://meilisearch:7700
+  FLUXER_SEARCH_URL: ${FLUXER_SEARCH_URL:-http://meilisearch:7700}
  FLUXER_SEARCH_API_KEY: ${MEILI_MASTER_KEY:?set MEILI_MASTER_KEY in .env}

-  FLUXER_S3_ENDPOINT: http://seaweedfs:8333
-  FLUXER_S3_PUBLIC_ENDPOINT: http://seaweedfs:8333
-  FLUXER_S3_REGION: us-east-1
+  FLUXER_S3_ENDPOINT: ${FLUXER_S3_ENDPOINT:-http://seaweedfs:8333}
+  FLUXER_S3_PUBLIC_ENDPOINT: ${FLUXER_S3_PUBLIC_ENDPOINT:-${FLUXER_S3_ENDPOINT:-http://seaweedfs:8333}}
+  FLUXER_S3_REGION: ${FLUXER_S3_REGION:-us-east-1}
  FLUXER_S3_ACCESS_KEY_ID: ${FLUXER_S3_ACCESS_KEY:?set FLUXER_S3_ACCESS_KEY in .env}
  FLUXER_S3_SECRET_ACCESS_KEY: ${FLUXER_S3_SECRET_KEY:?set FLUXER_S3_SECRET_KEY in .env}
-  FLUXER_S3_FORCE_PATH_STYLE: "true"
-  FLUXER_S3_BUCKET_CDN: fluxer
-  FLUXER_S3_BUCKET_UPLOADS: fluxer-uploads
-  FLUXER_S3_BUCKET_DOWNLOADS: fluxer-downloads
-  FLUXER_S3_BUCKET_REPORTS: fluxer-reports
-  FLUXER_S3_BUCKET_HARVESTS: fluxer-harvests
-  AWS_ACCESS_KEY_ID: ${FLUXER_S3_ACCESS_KEY:?}
-  AWS_SECRET_ACCESS_KEY: ${FLUXER_S3_SECRET_KEY:?}
-  AWS_DEFAULT_REGION: us-east-1
+  FLUXER_S3_FORCE_PATH_STYLE: "${FLUXER_S3_FORCE_PATH_STYLE:-true}"
+  FLUXER_S3_BUCKET_CDN: ${FLUXER_S3_BUCKET_CDN:-fluxer}
+  FLUXER_S3_BUCKET_UPLOADS: ${FLUXER_S3_BUCKET_UPLOADS:-fluxer-uploads}
+  FLUXER_S3_BUCKET_REPORTS: ${FLUXER_S3_BUCKET_REPORTS:-fluxer-reports}
+  FLUXER_S3_BUCKET_HARVESTS: ${FLUXER_S3_BUCKET_HARVESTS:-fluxer-harvests}
+  AWS_ACCESS_KEY_ID: ${FLUXER_S3_ACCESS_KEY:?set FLUXER_S3_ACCESS_KEY in .env}
+  AWS_SECRET_ACCESS_KEY: ${FLUXER_S3_SECRET_KEY:?set FLUXER_S3_SECRET_KEY in .env}
+  AWS_DEFAULT_REGION: ${FLUXER_S3_REGION:-us-east-1}
  AWS_EC2_METADATA_DISABLED: "true"

-  FLUXER_LIVEKIT_ENABLED: "true"
+  FLUXER_LIVEKIT_ENABLED: "${FLUXER_LIVEKIT_ENABLED:-true}"
  FLUXER_LIVEKIT_API_KEY: ${LIVEKIT_API_KEY:?set LIVEKIT_API_KEY in .env}
  FLUXER_LIVEKIT_API_SECRET: ${LIVEKIT_API_SECRET:?set LIVEKIT_API_SECRET in .env}
-  FLUXER_LIVEKIT_INTERNAL_URL: http://livekit:7880
+  FLUXER_LIVEKIT_INTERNAL_URL: ${FLUXER_LIVEKIT_INTERNAL_URL:-http://livekit:7880}
  FLUXER_LIVEKIT_WEBHOOK_URL: http://api:8080/webhooks/livekit
  FLUXER_LIVEKIT_DEFAULT_REGION: '{"id":"default","name":"Default","emoji":"🌍","latitude":0,"longitude":0}'
+  FLUXER_LIVEKIT_URL: ${FLUXER_LIVEKIT_URL:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}:${FLUXER_PUBLIC_PORT:-443}}/livekit}

  FLUXER_KLIPY_API_KEY: ${FLUXER_KLIPY_API_KEY:-}

@@ -64,12 +74,16 @@ x-fluxer-env: &fluxer-env
  FLUXER_EMAIL_SMTP_PASSWORD: ${FLUXER_EMAIL_SMTP_PASSWORD:-}
  FLUXER_EMAIL_SMTP_SECURE: ${FLUXER_EMAIL_SMTP_SECURE:-true}

-  FLUXER_SMS_ENABLED: "false"
+  FLUXER_SMS_ENABLED: "${FLUXER_SMS_ENABLED:-false}"
  FLUXER_CAPTCHA_ENABLED: ${FLUXER_CAPTCHA_ENABLED:-false}
  FLUXER_CAPTCHA_PROVIDER: ${FLUXER_CAPTCHA_PROVIDER:-none}
-  FLUXER_STRIPE_ENABLED: "false"
-  FLUXER_NCMEC_ENABLED: "false"
-  FLUXER_CLAMAV_ENABLED: "false"
+  FLUXER_CAPTCHA_HCAPTCHA_SITE_KEY: ${FLUXER_CAPTCHA_HCAPTCHA_SITE_KEY:-}
+  FLUXER_CAPTCHA_HCAPTCHA_SECRET_KEY: ${FLUXER_CAPTCHA_HCAPTCHA_SECRET_KEY:-}
+  FLUXER_CAPTCHA_TURNSTILE_SITE_KEY: ${FLUXER_CAPTCHA_TURNSTILE_SITE_KEY:-}
+  FLUXER_CAPTCHA_TURNSTILE_SECRET_KEY: ${FLUXER_CAPTCHA_TURNSTILE_SECRET_KEY:-}
+  FLUXER_STRIPE_ENABLED: "${FLUXER_STRIPE_ENABLED:-false}"
+  FLUXER_NCMEC_ENABLED: "${FLUXER_NCMEC_ENABLED:-false}"
+  FLUXER_CLAMAV_ENABLED: "${FLUXER_CLAMAV_ENABLED:-false}"
  FLUXER_DISCOVERY_ENABLED: ${FLUXER_DISCOVERY_ENABLED:-true}

  FLUXER_SUDO_MODE_SECRET: ${FLUXER_SUDO_MODE_SECRET:?set FLUXER_SUDO_MODE_SECRET in .env}
@@ -80,46 +94,101 @@ x-fluxer-env: &fluxer-env
  FLUXER_VAPID_EMAIL: ${FLUXER_VAPID_EMAIL:-admin@${FLUXER_DOMAIN}}
  FLUXER_PASSKEY_RP_ID: ${FLUXER_PASSKEY_RP_ID:-${FLUXER_DOMAIN}}
  FLUXER_PASSKEY_RP_NAME: ${FLUXER_PASSKEY_RP_NAME:-Fluxer}
-  FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS: ${FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
+  FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS: ${FLUXER_PASSKEY_ADDITIONAL_ALLOWED_ORIGINS:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}}
  FLUXER_GATEWAY_RPC_AUTH_TOKEN: ${FLUXER_GATEWAY_RPC_AUTH_TOKEN:?set FLUXER_GATEWAY_RPC_AUTH_TOKEN in .env}
  FLUXER_MEDIA_PROXY_SECRET_KEY: ${FLUXER_MEDIA_PROXY_SECRET_KEY:?set FLUXER_MEDIA_PROXY_SECRET_KEY in .env}
  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64: ${FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64:?set FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64 in .env}
+  FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64: ${FLUXER_MEDIA_PROXY_ATTACHMENT_URL_SECRETS_BASE64:-}
  FLUXER_ADMIN_SECRET_KEY_BASE: ${FLUXER_ADMIN_SECRET_KEY_BASE:?set FLUXER_ADMIN_SECRET_KEY_BASE in .env}
  FLUXER_ADMIN_OAUTH_CLIENT_SECRET: ${FLUXER_ADMIN_OAUTH_CLIENT_SECRET:?set FLUXER_ADMIN_OAUTH_CLIENT_SECRET in .env}

  FLUXER_INTERNAL_API_ENDPOINT: http://api:8080
  FLUXER_INTERNAL_GATEWAY_ENDPOINT: http://gateway:8080
  FLUXER_INTERNAL_MEDIA_PROXY_ENDPOINT: http://media-proxy:8080
-  FLUXER_MARKETING_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}
+  FLUXER_MARKETING_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
  FLUXER_MEDIA_PROXY_ENDPOINT: http://media-proxy:8080
-  FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media
-  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media
+  FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+  FLUXER_MEDIA_PROXY_UPLOAD_RELAY_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media

 x-fluxer-service: &fluxer-service
  restart: unless-stopped
  networks: [fluxer]

+x-fluxer-svc-healthcheck: &fluxer-svc-healthcheck
+  test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/8090 && printf 'GET /_health HTTP/1.0\\r\\n\\r\\n' >&3 && head -n 1 <&3 | grep -q ' 200 '"]
+  interval: 10s
+  timeout: 5s
+  retries: 30
+  start_period: 60s
+  start_interval: 1s
+
 services:
-  caddy:
-    image: caddy:2.10-alpine
+  edge:
+    image: caddy:2.11-alpine
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_CADDY_MEMORY_LIMIT:-256mb}
    restart: unless-stopped
    networks: [fluxer]
    ports:
-      - "80:80"
-      - "443:443"
-      - "443:443/udp"
+      - "${FLUXER_HTTP_PORT:-80}:80"
+      - "${FLUXER_HTTPS_PORT:-443}:443"
+      - "${FLUXER_HTTPS_PORT:-443}:443/udp"
    environment:
-      FLUXER_CADDY_SITE_ADDRESS: ${FLUXER_CADDY_SITE_ADDRESS:?set FLUXER_CADDY_SITE_ADDRESS in .env}
+      FLUXER_EDGE_SITE_ADDRESS: ${FLUXER_EDGE_SITE_ADDRESS:-${FLUXER_CADDY_SITE_ADDRESS:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}}}
+      FLUXER_EDGE_TRUSTED_PROXIES: ${FLUXER_EDGE_TRUSTED_PROXIES:-private_ranges}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
-      - caddy-data:/data
-      - caddy-config:/config
-    depends_on: [api, gateway, media-proxy, static-proxy, admin]
+      - edge-data:/data
+      - edge-config:/config
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:2019/config/"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+    depends_on:
+      api: {condition: service_started}
+      gateway: {condition: service_healthy}
+      media-proxy: {condition: service_started}
+      static-proxy: {condition: service_started}
+      admin: {condition: service_started}

  postgres:
    image: postgres:16-alpine
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_POSTGRES_MEMORY_LIMIT:-5gb}
+        reservations:
+          memory: ${FLUXER_POSTGRES_MEMORY_RESERVATION:-3gb}
    restart: unless-stopped
    networks: [fluxer]
+    command: >
+      postgres
+      -c max_connections=${FLUXER_POSTGRES_SERVER_MAX_CONNECTIONS:-150}
+      -c shared_buffers=${FLUXER_POSTGRES_SHARED_BUFFERS:-512MB}
+      -c effective_cache_size=${FLUXER_POSTGRES_EFFECTIVE_CACHE_SIZE:-2GB}
+      -c work_mem=${FLUXER_POSTGRES_WORK_MEM:-8MB}
+      -c maintenance_work_mem=${FLUXER_POSTGRES_MAINTENANCE_WORK_MEM:-256MB}
+      -c autovacuum_work_mem=${FLUXER_POSTGRES_AUTOVACUUM_WORK_MEM:-128MB}
+      -c random_page_cost=1.1
+      -c effective_io_concurrency=200
+      -c default_statistics_target=200
+      -c jit=off
+      -c min_wal_size=512MB
+      -c max_wal_size=2GB
+      -c checkpoint_completion_target=0.9
+      -c wal_buffers=16MB
+      -c wal_compression=zstd
+      -c bgwriter_delay=50ms
+      -c bgwriter_lru_maxpages=1000
+      -c autovacuum_vacuum_scale_factor=0.05
+      -c autovacuum_analyze_scale_factor=0.02
+      -c autovacuum_vacuum_cost_limit=2000
+      -c track_io_timing=on
+      -c shared_preload_libraries=pg_stat_statements
+    shm_size: 256mb
    environment:
      POSTGRES_DB: fluxer
      POSTGRES_USER: fluxer
@@ -133,10 +202,18 @@ services:
      retries: 10

  valkey:
-    image: valkey/valkey:8.1-alpine
+    image: valkey/valkey:9.1-alpine
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_VALKEY_MEMORY_LIMIT:-256mb}
    restart: unless-stopped
    networks: [fluxer]
-    command: ["valkey-server", "--save", "", "--appendonly", "no"]
+    command: ["valkey-server", "--appendonly", "yes", "--appendfsync", "everysec", "--dir", "/data",
+              "--maxmemory", "${FLUXER_VALKEY_MAXMEMORY:-192mb}",
+              "--maxmemory-policy", "${FLUXER_VALKEY_MAXMEMORY_POLICY:-noeviction}"]
+    volumes:
+      - valkey-data:/data
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      interval: 10s
@@ -145,41 +222,85 @@ services:

  nats:
    image: nats:2.14-alpine
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_NATS_MEMORY_LIMIT:-256mb}
    restart: unless-stopped
    networks: [fluxer]
    command: ["-js", "-sd", "/data", "-m", "8222"]
    volumes:
      - nats-data:/data
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8222/healthz"]
+      interval: 10s
+      timeout: 5s
+      retries: 10

  meilisearch:
-    image: getmeili/meilisearch:v1.12
+    image: getmeili/meilisearch:v1.53
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_MEILISEARCH_MEMORY_LIMIT:-768mb}
    restart: unless-stopped
    networks: [fluxer]
    environment:
      MEILI_ENV: production
      MEILI_NO_ANALYTICS: "true"
+      MEILI_UPGRADE_DB: "true"
+      MEILI_MAX_INDEXING_MEMORY: ${FLUXER_MEILISEARCH_MAX_INDEXING_MEMORY:-384mb}
      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY:?set MEILI_MASTER_KEY in .env}
    volumes:
      - meilisearch-data:/meili_data
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:7700/health"]
+      interval: 10s
+      timeout: 5s
+      retries: 10

  seaweedfs:
-    image: chrislusf/seaweedfs:4.34
+    image: chrislusf/seaweedfs:4.47
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_SEAWEEDFS_MEMORY_LIMIT:-2gb}
    restart: unless-stopped
    networks: [fluxer]
-    command: ["server", "-s3", "-dir=/data"]
+    environment:
+      GOMEMLIMIT: ${FLUXER_SEAWEEDFS_GOMEMLIMIT:-1536MiB}
+    command: ["server", "-s3", "-dir=/data", "-master.telemetry=false"]
    volumes:
      - seaweedfs-data:/data
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8333/healthz"]
+      interval: 10s
+      timeout: 5s
+      retries: 20
+      start_period: 60s

  seaweedfs-init:
-    image: chrislusf/seaweedfs:4.34
+    image: chrislusf/seaweedfs:4.47
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_SEAWEEDFS_INIT_MEMORY_LIMIT:-128mb}
    networks: [fluxer]
-    depends_on: [seaweedfs]
+    depends_on:
+      seaweedfs: {condition: service_healthy}
    restart: "no"
+    environment:
+      FLUXER_S3_ACCESS_KEY: ${FLUXER_S3_ACCESS_KEY:?set FLUXER_S3_ACCESS_KEY in .env}
+      FLUXER_S3_SECRET_KEY: ${FLUXER_S3_SECRET_KEY:?set FLUXER_S3_SECRET_KEY in .env}
+      FLUXER_S3_BUCKET_CDN: ${FLUXER_S3_BUCKET_CDN:-fluxer}
+      FLUXER_S3_BUCKET_UPLOADS: ${FLUXER_S3_BUCKET_UPLOADS:-fluxer-uploads}
+      FLUXER_S3_BUCKET_REPORTS: ${FLUXER_S3_BUCKET_REPORTS:-fluxer-reports}
+      FLUXER_S3_BUCKET_HARVESTS: ${FLUXER_S3_BUCKET_HARVESTS:-fluxer-harvests}
    entrypoint:
      - /bin/sh
      - -c
      - >
-        buckets="fluxer fluxer-uploads fluxer-downloads fluxer-reports fluxer-harvests";
+        buckets="$$FLUXER_S3_BUCKET_CDN $$FLUXER_S3_BUCKET_UPLOADS $$FLUXER_S3_BUCKET_REPORTS $$FLUXER_S3_BUCKET_HARVESTS";
        missing="$$buckets";
        for attempt in $$(seq 1 60); do
          if ! nc -z seaweedfs 9333 2>/dev/null; then
@@ -192,6 +313,10 @@ services:
            echo "$$listed" | grep -q "^[[:space:]]*$$b[[:space:]]" || missing="$${missing:+$$missing }$$b";
          done;
          if [ -z "$$missing" ]; then
+            if ! echo "s3.configure -user=fluxer -access_key=$$FLUXER_S3_ACCESS_KEY -secret_key=$$FLUXER_S3_SECRET_KEY -actions=Admin,Read,Write,List,Tagging -apply" | timeout 10 weed shell -master=seaweedfs:9333 >/dev/null 2>&1; then
+              echo "seaweedfs-init could not configure the S3 identity" >&2;
+              exit 1;
+            fi;
            echo "buckets ready";
            exit 0;
          fi;
@@ -205,105 +330,188 @@ services:

  livekit:
    image: livekit/livekit-server:v1.12.0
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_LIVEKIT_MEMORY_LIMIT:-512mb}
    restart: unless-stopped
    networks: [fluxer]
-    command: ["--config", "/etc/livekit.yaml"]
    environment:
      LIVEKIT_KEYS: "${LIVEKIT_API_KEY:?set LIVEKIT_API_KEY in .env}: ${LIVEKIT_API_SECRET:?set LIVEKIT_API_SECRET in .env}"
-    volumes:
-      - ./livekit.yaml:/etc/livekit.yaml:ro
+      LIVEKIT_CONFIG: |
+        port: 7880
+        log_level: info
+        rtc:
+          tcp_port: ${FLUXER_LIVEKIT_TCP_PORT:-7881}
+          udp_port: ${FLUXER_LIVEKIT_UDP_PORT:-7882}
+          use_external_ip: ${FLUXER_LIVEKIT_USE_EXTERNAL_IP:-true}
+          node_ip: "${FLUXER_LIVEKIT_NODE_IP:-}"
+          stun_servers:
+            - ${FLUXER_LIVEKIT_STUN_PRIMARY:-stun.l.google.com:19302}
+            - ${FLUXER_LIVEKIT_STUN_SECONDARY:-stun1.l.google.com:19302}
+        webhook:
+          api_key: ${LIVEKIT_API_KEY:?set LIVEKIT_API_KEY in .env}
+          urls:
+            - http://api:8080/webhooks/livekit
    ports:
-      - "${FLUXER_LIVEKIT_TCP_PORT:-7881}:7881"
-      - "${FLUXER_LIVEKIT_UDP_PORT:-7882}:7882/udp"
+      - "${FLUXER_LIVEKIT_TCP_PORT:-7881}:${FLUXER_LIVEKIT_TCP_PORT:-7881}"
+      - "${FLUXER_LIVEKIT_UDP_PORT:-7882}:${FLUXER_LIVEKIT_UDP_PORT:-7882}/udp"
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:7880/"]
+      interval: 10s
+      timeout: 5s
+      retries: 10

  api:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-api:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_API_MEMORY_LIMIT:-2560mb}
+        reservations:
+          memory: ${FLUXER_API_MEMORY_RESERVATION:-1gb}
    environment:
      <<: *fluxer-env
      FLUXER_API_PORT: "8080"
+      NODE_OPTIONS: --enable-source-maps${FLUXER_API_NODE_HEAP_MB:+ --max-old-space-size=$FLUXER_API_NODE_HEAP_MB}
      FLUXER_API_PRESIGNED_ATTACHMENT_UPLOADS_ENABLED: "true"
+      FLUXER_POSTGRES_MAX_CONNECTIONS: "25"
    healthcheck:
      test: ["CMD-SHELL", "node -e \"fetch('http://127.0.0.1:8080/_health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 90s
+      start_interval: 1s
    depends_on:
      postgres: {condition: service_healthy}
      valkey: {condition: service_healthy}
-      nats: {condition: service_started}
-      meilisearch: {condition: service_started}
+      nats: {condition: service_healthy}
+      meilisearch: {condition: service_healthy}
      seaweedfs-init: {condition: service_completed_successfully}
-      gifs: {condition: service_started}
-      gifs-shard: {condition: service_started}
-      snowflakes: {condition: service_started}
-      snowflakes-shard: {condition: service_started}
-      messages: {condition: service_started}
-      messages-shard: {condition: service_started}
-      users: {condition: service_started}
-      users-shard: {condition: service_started}
+      gifs: {condition: service_healthy}
+      gifs-shard: {condition: service_healthy}
+      snowflakes: {condition: service_healthy}
+      snowflakes-shard: {condition: service_healthy}
+      messages: {condition: service_healthy}
+      messages-shard: {condition: service_healthy}
+      users: {condition: service_healthy}
+      users-shard: {condition: service_healthy}

  worker:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-api:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_WORKER_MEMORY_LIMIT:-2560mb}
+        reservations:
+          memory: ${FLUXER_WORKER_MEMORY_RESERVATION:-1gb}
    working_dir: /usr/src/app/fluxer_api
-    command: ["./node_modules/.bin/tsx", "src/WorkerEntrypoint.ts"]
+    command: ["sh", "-c", "if [ -f dist/WorkerEntrypoint.js ]; then exec node dist/WorkerEntrypoint.js; else exec ./node_modules/.bin/tsx src/WorkerEntrypoint.ts; fi"]
    environment:
      <<: *fluxer-env
+      NODE_OPTIONS: --enable-source-maps${FLUXER_WORKER_NODE_HEAP_MB:+ --max-old-space-size=$FLUXER_WORKER_NODE_HEAP_MB}
      FLUXER_API_WORKER_MODE: all_lanes
      FLUXER_API_WORKER_ENABLE_CRON_SCHEDULER: "true"
-      FLUXER_API_WORKER_ENABLE_VOICE_RECONCILIATION: "true"
+      FLUXER_POSTGRES_MAX_CONNECTIONS: "25"
+    healthcheck:
+      test: ["CMD", "node", "-e", "const age=Date.now()-require('node:fs').statSync('/tmp/fluxer-worker-heartbeat').mtimeMs;if(age>30000){console.error('worker heartbeat is '+Math.round(age)+'ms old');process.exit(1)}"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 90s
+      start_interval: 1s
    depends_on:
      postgres: {condition: service_healthy}
      valkey: {condition: service_healthy}
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}
      seaweedfs-init: {condition: service_completed_successfully}
-      snowflakes-shard: {condition: service_started}
-      messages-shard: {condition: service_started}
-      users-shard: {condition: service_started}
+      snowflakes-shard: {condition: service_healthy}
+      messages-shard: {condition: service_healthy}
+      users-shard: {condition: service_healthy}

  gateway:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-gateway:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_GATEWAY_MEMORY_LIMIT:-1gb}
+        reservations:
+          memory: ${FLUXER_GATEWAY_MEMORY_RESERVATION:-384mb}
    environment:
      <<: *fluxer-env
      FLUXER_GATEWAY_PORT: "8080"
-      FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media
-      FLUXER_GATEWAY_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}
+      FLUXER_GATEWAY_MEDIA_PROXY_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+      FLUXER_GATEWAY_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
      FLUXER_GATEWAY_LOGGER_LEVEL: info
+      FLUXER_ERLANG_COOKIE: ${FLUXER_ERLANG_COOKIE:?set FLUXER_ERLANG_COOKIE in .env}
+      FLUXER_ERLANG_SCHEDULERS_MIN: "${FLUXER_ERLANG_SCHEDULERS_MIN:-2}"
+      FLUXER_ERLANG_SCHEDULERS_MAX: "${FLUXER_ERLANG_SCHEDULERS_MAX:-16}"
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8080/_health/ready"]
+      interval: 10s
+      timeout: 5s
+      retries: 30
+      start_period: 90s
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}
      valkey: {condition: service_healthy}

  media-proxy:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-media-proxy:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_MEDIA_PROXY_MEMORY_LIMIT:-512mb}
    environment:
      <<: *fluxer-env
      FLUXER_MEDIA_PROXY_HOST: 0.0.0.0
      FLUXER_MEDIA_PROXY_PORT: "8080"
      FLUXER_MEDIA_PROXY_MODE: upload
      FLUXER_MEDIA_PROXY_STORAGE_BACKEND: s3
-    healthcheck:
-      disable: true
+      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+      FLUXER_MEDIA_PROXY_CORS_MODE: ${FLUXER_MEDIA_PROXY_CORS_MODE:-off}
+      FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS: ${FLUXER_MEDIA_PROXY_CORS_ALLOWED_ORIGINS:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}:${FLUXER_PUBLIC_PORT:-443}}}
+      FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE: ${FLUXER_MEDIA_PROXY_ATTACHMENT_SIGNATURE_MODE:-off}
+      FLUXER_S3_READ_SIGNED: "true"
    depends_on:
      seaweedfs-init: {condition: service_completed_successfully}
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  static-proxy:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-static:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_STATIC_PROXY_MEMORY_LIMIT:-256mb}
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8080/avatars/0.png"]
+      interval: 10s
+      timeout: 5s
+      retries: 10

  app-proxy:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-app-proxy-self-hosted:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_APP_PROXY_MEMORY_LIMIT:-256mb}
    environment:
      FLUXER_APP_PROXY_HOST: 0.0.0.0
      FLUXER_APP_PROXY_PORT: "8080"
-      DISCOVERY_UPSTREAM_URL: http://caddy:8088/api/.well-known/fluxer
+      FLUXER_BASE_DOMAIN: ${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}
+      FLUXER_PUBLIC_SCHEME: ${FLUXER_PUBLIC_SCHEME:-https}
+      FLUXER_PUBLIC_PORT: ${FLUXER_PUBLIC_PORT:-443}
+      FLUXER_PUBLIC_ORIGIN: ${FLUXER_PUBLIC_ORIGIN:-}
+      DISCOVERY_UPSTREAM_URL: http://edge:8088/.well-known/fluxer
      PUBLIC_BOOTSTRAP_API_ENDPOINT: /api
-      PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/api
+      PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/api
      FLUXER_CSP_EXTRA_DEFAULT_SRC: ${FLUXER_CSP_EXTRA_DEFAULT_SRC:-}
      FLUXER_CSP_EXTRA_CONNECT_SRC: ${FLUXER_CSP_EXTRA_CONNECT_SRC:-}
      FLUXER_CSP_EXTRA_IMG_SRC: ${FLUXER_CSP_EXTRA_IMG_SRC:-}
@@ -317,124 +525,202 @@ services:
      FLUXER_CSP_REPORT_URI: ${FLUXER_CSP_REPORT_URI:-}
    depends_on:
      api: {condition: service_healthy}
-      caddy: {condition: service_started}
-      postgres: {condition: service_healthy}
+      edge: {condition: service_healthy}

  snowflakes:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-snowflakes:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_SNOWFLAKES_MEMORY_LIMIT:-128mb}
    environment:
      <<: *fluxer-env
+      FLUXER_SVC_NAME: snowflakes
      FLUXER_SVC_MODE: router
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  snowflakes-shard:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-snowflakes:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_SNOWFLAKES_SHARD_MEMORY_LIMIT:-256mb}
    environment:
      <<: *fluxer-env
+      FLUXER_SVC_NAME: snowflakes
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  users:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-users:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_USERS_MEMORY_LIMIT:-128mb}
    environment:
      <<: *fluxer-env
+      FLUXER_SVC_NAME: users
      FLUXER_SVC_MODE: router
+      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  users-shard:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-users:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_USERS_SHARD_MEMORY_LIMIT:-256mb}
    environment:
      <<: *fluxer-env
+      FLUXER_SVC_NAME: users
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
+      FLUXER_POSTGRES_MAX_CONNECTIONS: "20"
+      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}
      postgres: {condition: service_healthy}

  gifs:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-gifs:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_GIFS_MEMORY_LIMIT:-128mb}
    environment:
      <<: *fluxer-env
      FLUXER_SVC_NAME: gifs
      FLUXER_SVC_MODE: router
-      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media
+      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  gifs-shard:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-gifs:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_GIFS_SHARD_MEMORY_LIMIT:-256mb}
    environment:
      <<: *fluxer-env
      FLUXER_SVC_NAME: gifs
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
-      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media
+      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  messages:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-messages:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_MESSAGES_MEMORY_LIMIT:-128mb}
    environment:
      <<: *fluxer-env
+      FLUXER_SVC_NAME: messages
      FLUXER_SVC_MODE: router
+      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  messages-shard:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-messages:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_MESSAGES_SHARD_MEMORY_LIMIT:-256mb}
    environment:
      <<: *fluxer-env
+      FLUXER_SVC_NAME: messages
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
+      FLUXER_POSTGRES_MAX_CONNECTIONS: "20"
+      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}
      postgres: {condition: service_healthy}

  unfurl:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-unfurl:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_UNFURL_MEMORY_LIMIT:-128mb}
    environment:
      <<: *fluxer-env
+      FLUXER_SVC_NAME: unfurl
      FLUXER_SVC_MODE: router
+      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  unfurl-shard:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-unfurl:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_UNFURL_SHARD_MEMORY_LIMIT:-256mb}
    environment:
      <<: *fluxer-env
+      FLUXER_SVC_NAME: unfurl
      FLUXER_SVC_MODE: shard
      FLUXER_SVC_SHARD_ID: "0"
+      FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
+    healthcheck: *fluxer-svc-healthcheck
    depends_on:
-      nats: {condition: service_started}
+      nats: {condition: service_healthy}

  admin:
    <<: *fluxer-service
    image: ${FLUXER_REGISTRY:-ghcr.io/${FLUXER_REGISTRY_OWNER:-fluxerapp}}/fluxer-admin:${FLUXER_IMAGE_TAG:-v1}
+    deploy:
+      resources:
+        limits:
+          memory: ${FLUXER_ADMIN_MEMORY_LIMIT:-256mb}
    environment:
      <<: *fluxer-env
      FLUXER_ADMIN_HOST: 0.0.0.0
      FLUXER_ADMIN_PORT: "8080"
      FLUXER_ADMIN_BASE_PATH: /admin
      FLUXER_API_ENDPOINT: http://api:8080
-      FLUXER_ADMIN_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/admin
-      FLUXER_APP_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}
-      FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/media
-      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}
-      FLUXER_ADMIN_OAUTH_REDIRECT_URI: ${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}/admin/oauth2_callback
+      FLUXER_ADMIN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/admin
+      FLUXER_APP_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
+      FLUXER_MEDIA_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/media
+      FLUXER_STATIC_CDN_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}
+      FLUXER_ADMIN_OAUTH_REDIRECT_URI: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/admin/oauth2_callback
+    healthcheck:
+      test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/8080 && printf 'GET /_health HTTP/1.0\\r\\n\\r\\n' >&3 && head -n 1 <&3 | grep -q ' 200 '"]
+      interval: 10s
+      timeout: 5s
+      retries: 30
+      start_period: 60s
+      start_interval: 1s
    depends_on:
      api: {condition: service_healthy}

@@ -443,9 +729,10 @@ networks:
    driver: bridge

 volumes:
-  caddy-data:
-  caddy-config:
+  edge-data:
+  edge-config:
  postgres-data:
+  valkey-data:
  nats-data:
  meilisearch-data:
  seaweedfs-data:
@@ -1,15 +0,0 @@
-port: 7880
-log_level: info
-
-rtc:
-  tcp_port: 7881
-  udp_port: 7882
-  use_external_ip: true
-  stun_servers:
-    - stun.l.google.com:19302
-    - stun1.l.google.com:19302
-
-webhook:
-  api_key: fluxer
-  urls:
-    - http://api:8080/webhooks/livekit
@@ -0,0 +1,6 @@
+services:
+  edge:
+    ports: !override
+      - "${FLUXER_HTTP_PORT:-127.0.0.1:80}:80"
+    environment:
+      FLUXER_EDGE_SITE_ADDRESS: ":80"
@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import reactGoogleTranslate from 'eslint-plugin-react-google-translate';
+import tseslint from 'typescript-eslint';
+
+export default [
+	{
+		ignores: [
+			'**/node_modules/**',
+			'**/dist/**',
+			'**/build/**',
+			'**/coverage/**',
+			'**/*.generated.*',
+			'fluxer_app/src/features/i18n/locales/*/messages.mjs',
+		],
+	},
+	{
+		files: ['fluxer_app/src/**/*.tsx'],
+		linterOptions: {
+			reportUnusedDisableDirectives: 'error',
+		},
+		languageOptions: {
+			parser: tseslint.parser,
+			parserOptions: {
+				project: './fluxer_app/tsconfig.json',
+				tsconfigRootDir: import.meta.dirname,
+			},
+		},
+		plugins: {'react-google-translate': reactGoogleTranslate},
+		rules: {
+			'react-google-translate/no-conditional-text-nodes-with-siblings': [
+				'error',
+				{ignoreParents: ['Trans', 'Plural', 'Select', 'SelectOrdinal']},
+			],
+			'react-google-translate/no-return-text-nodes': 'error',
+		},
+	},
+];
@@ -3,36 +3,38 @@ name = "fluxer_admin"
 version = "0.1.0"
 edition.workspace = true
 license.workspace = true
+publish = false
 build = "build.rs"

 [dependencies]
-anyhow = "1.0.102"
+anyhow = "1.0.104"
 axum = { version = "0.8.9", features = ["macros"] }
-base64 = "0.22.1"
+base64 = "0.23.1"
 chrono = { version = "0.4", default-features = false, features = ["serde"] }
-cookie = "0.18.1"
+cookie = "0.18.2"
+fluxer_common = { path = "../fluxer_common" }
 hmac = "0.13.0"
 maud = { version = "0.27.0", features = ["axum"] }
 rand = "0.10"
-regress = "0.11"
-reqwest = { version = "0.13.4", default-features = false, features = ["json", "rustls"] }
-serde = { version = "1.0.228", features = ["derive"] }
-serde_json = "1.0.150"
+regress = "0.12"
+reqwest = { version = "0.13.5", default-features = false, features = ["json", "rustls"] }
+serde = { version = "1.0.229", features = ["derive"] }
+serde_json = "1.0.151"
 sha2 = "0.11.0"
-time = { version = "0.3.47", features = ["formatting", "parsing"] }
-tokio = { version = "1.52.3", features = ["macros", "net", "rt-multi-thread", "signal"] }
+time = { version = "0.3.55", features = ["formatting", "parsing"] }
+tokio = { version = "1.53.1", features = ["macros", "net", "rt-multi-thread", "signal"] }
 tower = { version = "0.5.3", features = ["util"] }
-tower-http = { version = "0.6.11", features = ["compression-gzip", "trace"] }
+tower-http = { version = "0.7.1", features = ["compression-gzip", "trace"] }
 tracing = "0.1.44"
 tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
 url = "2.5"
 urlencoding = "2.1.3"
-progenitor-client = { version = "0.14.0", default-features = false }
+progenitor-client = { version = "0.15.0", default-features = false }

 [build-dependencies]
 openapiv3 = "2.2.0"
-prettyplease = "0.2"
-progenitor = { version = "0.14.0", default-features = false }
+prettyplease = "0.3"
+progenitor = { version = "0.15.0", default-features = false }
 serde_json = "1"
 sha2 = "0.11.0"
-syn = "2"
+syn = "3"
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later

-FROM rust:1-bookworm AS builder
+FROM rust:1-trixie AS builder

 ARG BUILD_VERSION=""
 ARG TARGETARCH
@@ -9,7 +9,7 @@ WORKDIR /usr/src/app

 RUN apt-get update \
 	&& apt-get install -y --no-install-recommends ca-certificates nodejs npm pkg-config \
-	&& npm install -g pnpm@10.29.3 \
+	&& npm install -g pnpm@12.4.2 \
 	&& rm -rf /var/lib/apt/lists/*

 RUN npm install --no-audit --no-fund @tailwindcss/[email protected] [email protected]
@@ -24,6 +24,7 @@ RUN TAILWIND_OXIDE_VERSION="4.2.1" \

 COPY Cargo.lock Cargo.lock
 COPY fluxer_admin fluxer_admin
+COPY fluxer_common fluxer_common
 COPY packages/fonts/manifest.json packages/fonts/manifest.json
 COPY packages/fonts/NOTICE.md packages/fonts/NOTICE.md
 COPY packages/fonts/LICENSE-IBM-PLEX.txt packages/fonts/LICENSE-IBM-PLEX.txt
@@ -31,12 +32,17 @@ COPY packages/fonts/files/FluxerSans packages/fonts/files/FluxerSans
 COPY packages/fonts/files/FluxerMono packages/fonts/files/FluxerMono
 RUN printf '%s\n' \
 	'[workspace]' \
-	'members = ["fluxer_admin"]' \
+	'members = ["fluxer_admin", "fluxer_common"]' \
 	'resolver = "2"' \
 	'' \
 	'[workspace.package]' \
 	'edition = "2024"' \
 	'license = "AGPL-3.0-or-later"' \
+	'' \
+	'[profile.release]' \
+	'lto = "fat"' \
+	'codegen-units = 1' \
+	'strip = "symbols"' \
 	> Cargo.toml

 ENV FLUXER_BUILD_VERSION="${BUILD_VERSION}"
@@ -51,9 +57,23 @@ RUN test "$(ls target/release/build/fluxer_admin-*/out/static/fonts/*.woff2 | wc
 	&& ls target/release/build/fluxer_admin-*/out/static/fonts/fonts.*.css \
 	&& echo "Latin-core fonts bundled successfully"

-FROM debian:bookworm-slim AS runtime
+FROM debian:trixie-slim AS runtime

 ARG BUILD_VERSION=""
+ARG SOURCE_SHA=""
+ARG SOURCE_DATE=""
+
+LABEL org.opencontainers.image.title="fluxer-admin"
+LABEL org.opencontainers.image.description="Fluxer admin console"
+LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
+LABEL org.opencontainers.image.vendor="Fluxer"
+LABEL org.opencontainers.image.url="https://fluxer.app"
+LABEL org.opencontainers.image.documentation="https://docs.fluxer.app"
+LABEL org.opencontainers.image.source="https://github.com/fluxerapp/fluxer"
+LABEL org.opencontainers.image.version="${BUILD_VERSION}"
+LABEL org.opencontainers.image.revision="${SOURCE_SHA}"
+LABEL org.opencontainers.image.created="${SOURCE_DATE}"
+LABEL app.fluxer.build-version="${BUILD_VERSION}"

 WORKDIR /usr/local/bin

@@ -35,25 +35,423 @@ fn generate_admin_api(manifest_dir: &Path, out_dir: &Path) {
    }

    let json_str = fs::read_to_string(&spec_path).expect("failed to read openapi-admin.json");
-    let spec: openapiv3::OpenAPI =
+    let mut spec: openapiv3::OpenAPI =
        serde_json::from_str(&json_str).expect("failed to parse openapi-admin.json");
+    adapt_progenitor_throttled_errors(&mut spec);
+    relax_guild_audit_log_schemas(&mut spec);
+    relax_progenitor_schema_strictness(&mut spec);

    let mut settings = progenitor::GenerationSettings::new();
    settings.with_interface(progenitor::InterfaceStyle::Positional);
+    settings.with_inner_type(
+        "reqwest::header::HeaderMap"
+            .parse()
+            .expect("valid generated client header type"),
+    );

    let mut generator = progenitor::Generator::new(&settings);
    let tokens = generator
        .generate_tokens(&spec)
        .expect("failed to generate admin API client");

-    let content = prettyplease::unparse(
+    let content = relax_required_nullable_fields(&prettyplease::unparse(
        &syn::parse2::<syn::File>(tokens).expect("failed to parse generated tokens"),
-    );
+    ));

    let output_path = out_dir.join("admin_api_generated.rs");
    fs::write(&output_path, content).expect("failed to write generated API code");
 }

+fn adapt_progenitor_throttled_errors(spec: &mut openapiv3::OpenAPI) {
+    let schemas = &spec
+        .components
+        .as_ref()
+        .expect("missing API components")
+        .schemas;
+    let error = serde_json::to_value(schemas.get("Error").expect("missing Error schema"))
+        .expect("failed to inspect Error schema");
+    let mut throttled = serde_json::to_value(
+        schemas
+            .get("ThrottledError")
+            .expect("missing ThrottledError schema"),
+    )
+    .expect("failed to inspect ThrottledError schema");
+    assert_eq!(
+        error["additionalProperties"],
+        serde_json::json!({}),
+        "Progenitor error adaptation requires Error to retain all additional fields"
+    );
+    let properties = throttled["properties"]
+        .as_object_mut()
+        .expect("ThrottledError must be an object schema");
+    assert_eq!(
+        properties
+            .remove("retry_after")
+            .expect("missing retry_after")["type"],
+        "number"
+    );
+    assert_eq!(
+        properties.remove("global").expect("missing global")["type"],
+        "boolean"
+    );
+    assert_eq!(
+        throttled, error,
+        "ThrottledError must extend the common Error schema"
+    );
+
+    for path in spec.paths.paths.values_mut() {
+        let openapiv3::ReferenceOr::Item(path) = path else {
+            panic!("Progenitor error adaptation requires inline API paths");
+        };
+        for operation in [
+            &mut path.get,
+            &mut path.put,
+            &mut path.post,
+            &mut path.delete,
+            &mut path.options,
+            &mut path.head,
+            &mut path.patch,
+            &mut path.trace,
+        ]
+        .into_iter()
+        .flatten()
+        {
+            let Some(response) = operation
+                .responses
+                .responses
+                .get_mut(&openapiv3::StatusCode::Code(429))
+            else {
+                continue;
+            };
+            let openapiv3::ReferenceOr::Item(response) = response else {
+                panic!("Progenitor error adaptation requires inline 429 responses");
+            };
+            let schema = &mut response
+                .content
+                .get_mut("application/json")
+                .expect("429 responses must return JSON")
+                .schema;
+            assert_eq!(
+                schema,
+                &Some(openapiv3::ReferenceOr::ref_(
+                    "#/components/schemas/ThrottledError"
+                )),
+                "Progenitor only supports one error type per operation"
+            );
+            *schema = Some(openapiv3::ReferenceOr::ref_("#/components/schemas/Error"));
+        }
+    }
+}
+
+fn relax_guild_audit_log_schemas(spec: &mut openapiv3::OpenAPI) {
+    let components = spec.components.as_mut().expect("missing API components");
+
+    let entry = object_schema_mut(components, "GuildAuditLogEntryResponse");
+    entry.additional_properties = None;
+    let openapiv3::ReferenceOr::Item(options) = entry
+        .properties
+        .get_mut("options")
+        .expect("GuildAuditLogEntryResponse has no options property")
+    else {
+        panic!("GuildAuditLogEntryResponse options must be an inline schema");
+    };
+    let openapiv3::SchemaKind::Type(openapiv3::Type::Object(options)) = &mut options.schema_kind
+    else {
+        panic!("GuildAuditLogEntryResponse options must be an object schema");
+    };
+    options.additional_properties = None;
+
+    let change = object_schema_mut(components, "AuditLogChangeSchema");
+    change.additional_properties = None;
+    for property in ["old_value", "new_value"] {
+        change.properties.insert(
+            property.to_string(),
+            openapiv3::ReferenceOr::Item(Box::new(openapiv3::Schema {
+                schema_data: openapiv3::SchemaData::default(),
+                schema_kind: openapiv3::SchemaKind::Any(openapiv3::AnySchema::default()),
+            })),
+        );
+    }
+}
+
+fn object_schema_mut<'a>(
+    components: &'a mut openapiv3::Components,
+    name: &str,
+) -> &'a mut openapiv3::ObjectType {
+    let Some(openapiv3::ReferenceOr::Item(schema)) = components.schemas.get_mut(name) else {
+        panic!("missing inline {name} schema");
+    };
+    let openapiv3::SchemaKind::Type(openapiv3::Type::Object(object)) = &mut schema.schema_kind
+    else {
+        panic!("{name} must be an object schema");
+    };
+    object
+}
+
+const MAX_SCHEMA_REFERENCE_DEPTH: usize = 32;
+
+fn relax_required_nullable_fields(generated: &str) -> String {
+    const PRESENCE_CHECK: &str =
+        "#[serde(deserialize_with = \"::std::option::Option::deserialize\")]";
+    generated
+        .lines()
+        .filter(|line| line.trim() != PRESENCE_CHECK)
+        .flat_map(|line| [line, "\n"])
+        .collect()
+}
+
+fn relax_progenitor_schema_strictness(spec: &mut openapiv3::OpenAPI) {
+    let registry = spec.components.clone().unwrap_or_default();
+
+    if let Some(components) = spec.components.as_mut() {
+        for schema in components.schemas.values_mut() {
+            relax_schema_reference(schema, &registry);
+        }
+        for response in components.responses.values_mut() {
+            if let openapiv3::ReferenceOr::Item(response) = response {
+                relax_response(response, &registry);
+            }
+        }
+        for parameter in components.parameters.values_mut() {
+            if let openapiv3::ReferenceOr::Item(parameter) = parameter {
+                relax_parameter(parameter, &registry);
+            }
+        }
+        for request_body in components.request_bodies.values_mut() {
+            if let openapiv3::ReferenceOr::Item(request_body) = request_body {
+                relax_content(&mut request_body.content, &registry);
+            }
+        }
+        for header in components.headers.values_mut() {
+            if let openapiv3::ReferenceOr::Item(header) = header {
+                relax_parameter_format(&mut header.format, &registry);
+            }
+        }
+    }
+
+    for path in spec.paths.paths.values_mut() {
+        let openapiv3::ReferenceOr::Item(path) = path else {
+            continue;
+        };
+        for parameter in &mut path.parameters {
+            if let openapiv3::ReferenceOr::Item(parameter) = parameter {
+                relax_parameter(parameter, &registry);
+            }
+        }
+        for operation in [
+            &mut path.get,
+            &mut path.put,
+            &mut path.post,
+            &mut path.delete,
+            &mut path.options,
+            &mut path.head,
+            &mut path.patch,
+            &mut path.trace,
+        ]
+        .into_iter()
+        .flatten()
+        {
+            for parameter in &mut operation.parameters {
+                if let openapiv3::ReferenceOr::Item(parameter) = parameter {
+                    relax_parameter(parameter, &registry);
+                }
+            }
+            if let Some(openapiv3::ReferenceOr::Item(request_body)) =
+                operation.request_body.as_mut()
+            {
+                relax_content(&mut request_body.content, &registry);
+            }
+            for response in operation
+                .responses
+                .responses
+                .values_mut()
+                .chain(operation.responses.default.iter_mut())
+            {
+                if let openapiv3::ReferenceOr::Item(response) = response {
+                    relax_response(response, &registry);
+                }
+            }
+        }
+    }
+}
+
+fn relax_response(response: &mut openapiv3::Response, registry: &openapiv3::Components) {
+    relax_content(&mut response.content, registry);
+    for header in response.headers.values_mut() {
+        if let openapiv3::ReferenceOr::Item(header) = header {
+            relax_parameter_format(&mut header.format, registry);
+        }
+    }
+}
+
+fn relax_content(content: &mut openapiv3::Content, registry: &openapiv3::Components) {
+    for media_type in content.values_mut() {
+        if let Some(schema) = media_type.schema.as_mut() {
+            relax_schema_reference(schema, registry);
+        }
+    }
+}
+
+fn relax_parameter(parameter: &mut openapiv3::Parameter, registry: &openapiv3::Components) {
+    let format = match parameter {
+        openapiv3::Parameter::Query { parameter_data, .. }
+        | openapiv3::Parameter::Header { parameter_data, .. }
+        | openapiv3::Parameter::Path { parameter_data, .. }
+        | openapiv3::Parameter::Cookie { parameter_data, .. } => &mut parameter_data.format,
+    };
+    relax_parameter_format(format, registry);
+}
+
+fn relax_parameter_format(
+    format: &mut openapiv3::ParameterSchemaOrContent,
+    registry: &openapiv3::Components,
+) {
+    match format {
+        openapiv3::ParameterSchemaOrContent::Schema(schema) => {
+            relax_schema_reference(schema, registry)
+        }
+        openapiv3::ParameterSchemaOrContent::Content(content) => relax_content(content, registry),
+    }
+}
+
+fn relax_schema_reference(
+    schema: &mut openapiv3::ReferenceOr<openapiv3::Schema>,
+    registry: &openapiv3::Components,
+) {
+    if let openapiv3::ReferenceOr::Item(schema) = schema {
+        relax_schema(schema, registry);
+    }
+}
+
+fn relax_boxed_schema_reference(
+    schema: &mut openapiv3::ReferenceOr<Box<openapiv3::Schema>>,
+    registry: &openapiv3::Components,
+) {
+    if let openapiv3::ReferenceOr::Item(schema) = schema {
+        relax_schema(schema, registry);
+    }
+}
+
+fn relax_schema(schema: &mut openapiv3::Schema, registry: &openapiv3::Components) {
+    if flattens_objects_beside_scalars(&schema.schema_kind, registry) {
+        schema.schema_kind = openapiv3::SchemaKind::Any(openapiv3::AnySchema::default());
+        return;
+    }
+    match &mut schema.schema_kind {
+        openapiv3::SchemaKind::Type(openapiv3::Type::Object(object)) => {
+            relax_additional_properties(&mut object.additional_properties, registry);
+            for property in object.properties.values_mut() {
+                relax_boxed_schema_reference(property, registry);
+            }
+        }
+        openapiv3::SchemaKind::Type(openapiv3::Type::Array(array)) => {
+            if let Some(items) = array.items.as_mut() {
+                relax_boxed_schema_reference(items, registry);
+            }
+        }
+        openapiv3::SchemaKind::Type(_) => {}
+        openapiv3::SchemaKind::OneOf { one_of: subschemas }
+        | openapiv3::SchemaKind::AllOf { all_of: subschemas }
+        | openapiv3::SchemaKind::AnyOf { any_of: subschemas } => {
+            for subschema in subschemas {
+                relax_schema_reference(subschema, registry);
+            }
+        }
+        openapiv3::SchemaKind::Not { not } => relax_schema_reference(not, registry),
+        openapiv3::SchemaKind::Any(any) => {
+            relax_additional_properties(&mut any.additional_properties, registry);
+            for property in any.properties.values_mut() {
+                relax_boxed_schema_reference(property, registry);
+            }
+            if let Some(items) = any.items.as_mut() {
+                relax_boxed_schema_reference(items, registry);
+            }
+            for subschema in any
+                .one_of
+                .iter_mut()
+                .chain(any.all_of.iter_mut())
+                .chain(any.any_of.iter_mut())
+            {
+                relax_schema_reference(subschema, registry);
+            }
+            if let Some(not) = any.not.as_mut() {
+                relax_schema_reference(not, registry);
+            }
+        }
+    }
+}
+
+fn relax_additional_properties(
+    additional_properties: &mut Option<openapiv3::AdditionalProperties>,
+    registry: &openapiv3::Components,
+) {
+    match additional_properties {
+        Some(openapiv3::AdditionalProperties::Any(false)) => *additional_properties = None,
+        Some(openapiv3::AdditionalProperties::Schema(schema)) => {
+            relax_schema_reference(schema, registry)
+        }
+        _ => {}
+    }
+}
+
+fn flattens_objects_beside_scalars(
+    schema_kind: &openapiv3::SchemaKind,
+    registry: &openapiv3::Components,
+) -> bool {
+    let subschemas = match schema_kind {
+        openapiv3::SchemaKind::OneOf { one_of } => one_of,
+        openapiv3::SchemaKind::AnyOf { any_of } => any_of,
+        _ => return false,
+    };
+    let mut objects = false;
+    let mut scalars = false;
+    for subschema in subschemas {
+        if resolves_to_object(subschema, registry, MAX_SCHEMA_REFERENCE_DEPTH) {
+            objects = true;
+        } else {
+            scalars = true;
+        }
+    }
+    objects && scalars
+}
+
+fn resolves_to_object(
+    schema: &openapiv3::ReferenceOr<openapiv3::Schema>,
+    registry: &openapiv3::Components,
+    depth: usize,
+) -> bool {
+    let Some(depth) = depth.checked_sub(1) else {
+        return false;
+    };
+    let schema = match schema {
+        openapiv3::ReferenceOr::Reference { reference } => {
+            let Some(target) = reference
+                .strip_prefix("#/components/schemas/")
+                .and_then(|name| registry.schemas.get(name))
+            else {
+                return false;
+            };
+            return resolves_to_object(target, registry, depth);
+        }
+        openapiv3::ReferenceOr::Item(schema) => schema,
+    };
+    match &schema.schema_kind {
+        openapiv3::SchemaKind::Type(openapiv3::Type::Object(_)) => true,
+        openapiv3::SchemaKind::Type(_) => false,
+        openapiv3::SchemaKind::OneOf { one_of: subschemas }
+        | openapiv3::SchemaKind::AllOf { all_of: subschemas }
+        | openapiv3::SchemaKind::AnyOf { any_of: subschemas } => subschemas
+            .iter()
+            .any(|subschema| resolves_to_object(subschema, registry, depth)),
+        openapiv3::SchemaKind::Not { .. } => false,
+        openapiv3::SchemaKind::Any(any) => {
+            any.typ.as_deref() == Some("object")
+                || !any.properties.is_empty()
+                || any.additional_properties.is_some()
+        }
+    }
+}
+
 struct Face {
    css_family: String,
    weight: u64,
@@ -41,11 +41,9 @@ pub const BAN_AVATAR_HASH_REMOVE: &str = "ban:avatar_hash:remove";
 pub const BAN_PROFILE_SUBSTRING_ADD: &str = "ban:profile_substring:add";
 pub const BAN_PROFILE_SUBSTRING_CHECK: &str = "ban:profile_substring:check";
 pub const BAN_PROFILE_SUBSTRING_REMOVE: &str = "ban:profile_substring:remove";
-pub const BILLING_MANAGE_SUBSCRIPTION: &str = "billing:manage_subscription";
-pub const BILLING_REFUND: &str = "billing:refund";
-pub const BILLING_VIEW: &str = "billing:view";
 pub const BULK_ADD_GUILD_MEMBERS: &str = "bulk:add:guild_members";
 pub const BULK_DELETE_USERS: &str = "bulk:delete:users";
+pub const BULK_DELETE_USER_MESSAGES: &str = "bulk:delete:user_messages";
 pub const BULK_UPDATE_GUILD_FEATURES: &str = "bulk:update:guild_features";
 pub const BULK_UPDATE_SUSPICIOUS_ACTIVITY: &str = "bulk:update:suspicious_activity";
 pub const BULK_UPDATE_USER_FLAGS: &str = "bulk:update:user_flags";
@@ -81,7 +79,6 @@ pub const REPORT_RESOLVE: &str = "report:resolve";
 pub const REPORT_VIEW: &str = "report:view";
 pub const REPORT_VIEW_REPORTER_PII: &str = "report:view:reporter_pii";
 pub const SYSTEM_DM_SEND: &str = "system_dm:send";
-pub const SYSTEM_HEAP_SNAPSHOT: &str = "system:heap_snapshot";
 pub const USER_CANCEL_BULK_MESSAGE_DELETION: &str = "user:cancel:bulk_message_deletion";
 pub const USER_DELETE: &str = "user:delete";
 pub const USER_DISABLE_SUSPICIOUS: &str = "user:disable:suspicious";
@@ -124,6 +121,7 @@ pub const ALL_ACLS: &[&str] = &[
    ARCHIVE_TRIGGER_GUILD,
    ARCHIVE_TRIGGER_USER,
    ARCHIVE_VIEW_ALL,
+    ASSET_PURGE,
    AUDIT_LOG_VIEW,
    AUTHENTICATE,
    JOBS_VIEW,
@@ -155,11 +153,9 @@ pub const ALL_ACLS: &[&str] = &[
    BAN_PROFILE_SUBSTRING_ADD,
    BAN_PROFILE_SUBSTRING_CHECK,
    BAN_PROFILE_SUBSTRING_REMOVE,
-    BILLING_MANAGE_SUBSCRIPTION,
-    BILLING_REFUND,
-    BILLING_VIEW,
    BULK_ADD_GUILD_MEMBERS,
    BULK_DELETE_USERS,
+    BULK_DELETE_USER_MESSAGES,
    BULK_UPDATE_GUILD_FEATURES,
    BULK_UPDATE_SUSPICIOUS_ACTIVITY,
    BULK_UPDATE_USER_FLAGS,
@@ -195,7 +191,6 @@ pub const ALL_ACLS: &[&str] = &[
    REPORT_VIEW,
    REPORT_VIEW_REPORTER_PII,
    SYSTEM_DM_SEND,
-    SYSTEM_HEAP_SNAPSHOT,
    USER_CANCEL_BULK_MESSAGE_DELETION,
    USER_DELETE,
    USER_DISABLE_SUSPICIOUS,
@@ -12,7 +12,6 @@ pub struct I32Flag {

 pub mod user_flag_bits {
    pub const STAFF: u64 = 1 << 0;
-    pub const CTP_MEMBER: u64 = 1 << 1;
    pub const PARTNER: u64 = 1 << 2;
    pub const BUG_HUNTER: u64 = 1 << 3;
    pub const FRIENDLY_BOT: u64 = 1 << 4;
@@ -40,10 +39,6 @@ pub const USER_FLAGS: &[U64Flag] = &[
        name: "STAFF",
        value: user_flag_bits::STAFF,
    },
-    U64Flag {
-        name: "CTP_MEMBER",
-        value: user_flag_bits::CTP_MEMBER,
-    },
    U64Flag {
        name: "PARTNER",
        value: user_flag_bits::PARTNER,
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{CreateAdminApiKeyResponse, ListAdminApiKeyEntry};
@@ -12,7 +12,7 @@ impl AdminApiClient {
        acls: &[String],
    ) -> ApiResult<CreateAdminApiKeyResponse> {
        let body = generated_types::CreateAdminApiKeyRequest {
-            acls: acls.to_vec(),
+            acls: parse_acls(acls)?,
            expires_in_days: None,
            name: generated_types::CreateAdminApiKeyRequestName::try_from(name)
                .map_err(|e| ApiError::Parse(e.to_string()))?,
@@ -35,10 +35,20 @@ impl AdminApiClient {
    }

    pub async fn revoke_api_key(&self, key_id: &str) -> ApiResult<()> {
+        let key_id = snowflake(key_id);
        self.generated()
-            .delete_admin_api_key(key_id)
+            .delete_admin_api_key(&key_id)
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
    }
 }
+
+pub(super) fn parse_acls(acls: &[String]) -> ApiResult<Vec<generated_types::AdminAclType>> {
+    acls.iter()
+        .map(|acl| {
+            generated_types::AdminAclType::try_from(acl.as_str())
+                .map_err(|e| ApiError::Parse(e.to_string()))
+        })
+        .collect()
+}
@@ -4,35 +4,36 @@ use super::client::{AdminApiClient, ApiResult};
 use super::types::{Application, ApplicationUpdateResponse, LookupApplicationResponse};
 use serde::Serialize;

-#[derive(Serialize)]
-struct LookupApplicationRequest<'a> {
-    application_id: &'a str,
-}
-
-#[derive(Serialize)]
-struct ListUserApplicationsRequest<'a> {
-    user_id: &'a str,
-}
-
 #[derive(Serialize)]
 struct TransferApplicationOwnershipRequest<'a> {
-    application_id: &'a str,
    new_owner_id: &'a str,
 }

 impl AdminApiClient {
    pub async fn lookup_application(&self, application_id: &str) -> ApiResult<Option<Application>> {
-        let body = LookupApplicationRequest { application_id };
-        let resp: LookupApplicationResponse =
-            self.post_typed("/admin/applications/lookup", &body).await?;
+        let resp: LookupApplicationResponse = self
+            .get(
+                &format!(
+                    "/admin/applications/{}",
+                    urlencoding::encode(application_id)
+                ),
+                None,
+            )
+            .await?;
        Ok(resp.application)
    }

    pub async fn list_user_applications(&self, user_id: &str) -> ApiResult<Vec<Application>> {
-        let body = ListUserApplicationsRequest { user_id };
-        let resp: super::types::ListUserApplicationsResponse = self
-            .post_typed("/admin/applications/list-by-owner", &body)
-            .await?;
+        let query_params = [("owner_id", user_id)];
+        let resp: super::types::ListUserApplicationsResponse =
+            self.get("/admin/applications", Some(&query_params)).await?;
+        Ok(resp.applications)
+    }
+
+    pub async fn list_guild_applications(&self, guild_id: &str) -> ApiResult<Vec<Application>> {
+        let query_params = [("guild_id", guild_id)];
+        let resp: super::types::ListUserApplicationsResponse =
+            self.get("/admin/applications", Some(&query_params)).await?;
        Ok(resp.applications)
    }

@@ -41,11 +42,15 @@ impl AdminApiClient {
        application_id: &str,
        new_owner_id: &str,
    ) -> ApiResult<ApplicationUpdateResponse> {
-        let body = TransferApplicationOwnershipRequest {
-            application_id,
-            new_owner_id,
-        };
-        self.post_typed("/admin/applications/transfer-ownership", &body)
-            .await
+        let body = TransferApplicationOwnershipRequest { new_owner_id };
+        self.patch_typed_with_reason(
+            &format!(
+                "/admin/applications/{}",
+                urlencoding::encode(application_id)
+            ),
+            &body,
+            None,
+        )
+        .await
    }
 }
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{Archive, ArchiveDownloadUrlResponse, ListArchivesResponse};
@@ -11,13 +11,12 @@ impl AdminApiClient {
        user_id: &str,
        include_attachments: bool,
    ) -> ApiResult<Archive> {
-        let body = generated_types::TriggerUserArchiveRequest {
-            include_attachments: include_attachments.then_some(true),
-            user_id: snowflake(user_id),
+        let body = generated_types::AdminArchiveCreateRequest {
+            include_attachments,
        };
        let response = self
            .generated()
-            .trigger_user_archive(&body)
+            .create_admin_user_archive(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -28,13 +27,12 @@ impl AdminApiClient {
        guild_id: &str,
        include_attachments: bool,
    ) -> ApiResult<Archive> {
-        let body = generated_types::TriggerGuildArchiveRequest {
-            guild_id: snowflake(guild_id),
-            include_attachments: include_attachments.then_some(true),
+        let body = generated_types::AdminArchiveCreateRequest {
+            include_attachments,
        };
        let response = self
            .generated()
-            .trigger_guild_archive(&body)
+            .create_admin_guild_archive(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -47,22 +45,31 @@ impl AdminApiClient {
        include_expired: bool,
        requested_by: Option<&str>,
    ) -> ApiResult<ListArchivesResponse> {
-        let body = generated_types::ListArchivesRequest {
-            include_expired: Some(include_expired),
-            limit: None,
-            requested_by: requested_by.map(snowflake),
-            subject_id: subject_id.map(snowflake),
-            subject_type: Some(
-                generated_types::ListArchivesRequestSubjectType::try_from(subject_type)
-                    .map_err(|e| ApiError::Parse(e.to_string()))?,
-            ),
+        let subject_id = subject_id.filter(|id| !id.is_empty());
+        let search_every_subject_type = subject_type == "all" && subject_id.is_some();
+        let subject_types: &[&str] = if search_every_subject_type {
+            &["user", "guild"]
+        } else {
+            std::slice::from_ref(&subject_type)
        };
-        let response = self
-            .generated()
-            .list_archives(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        let mut archives = Vec::new();
+        for &subject_type in subject_types {
+            let query_params = [
+                ("subject_type", subject_type),
+                ("subject_id", subject_id.unwrap_or_default()),
+                ("requested_by", requested_by.unwrap_or_default()),
+                (
+                    "include_expired",
+                    if include_expired { "true" } else { "false" },
+                ),
+            ];
+            match self.get("/admin/archives", Some(&query_params)).await {
+                Ok(ListArchivesResponse { archives: page }) => archives.extend(page),
+                Err(ApiError::Http { status: 403, .. }) if search_every_subject_type => {}
+                Err(error) => return Err(error),
+            }
+        }
+        Ok(ListArchivesResponse { archives })
    }

    pub async fn get_archive_download_url(
@@ -71,15 +78,17 @@ impl AdminApiClient {
        subject_id: &str,
        archive_id: &str,
    ) -> ApiResult<ArchiveDownloadUrlResponse> {
+        let subject_type = generated_types::ArchiveSubjectTypeSchema::try_from(subject_type)
+            .map_err(|e| ApiError::Parse(e.to_string()))?;
        let response = self
            .generated()
-            .get_archive_download_url(subject_type, subject_id, archive_id)
+            .get_admin_archive_download(
+                subject_type,
+                &snowflake(subject_id),
+                &snowflake(archive_id),
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }
 }
-
-fn snowflake(value: &str) -> generated_types::SnowflakeType {
-    generated_types::SnowflakeType::from(value.to_owned())
-}
@@ -1,15 +1,19 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiResult};

 impl AdminApiClient {
-    pub async fn purge_assets(&self, ids: &[String]) -> ApiResult<serde_json::Value> {
+    pub async fn purge_assets(
+        &self,
+        guild_id: &str,
+        ids: &[String],
+    ) -> ApiResult<serde_json::Value> {
        let body = generated_types::PurgeGuildAssetsRequest { ids: ids.to_vec() };
        let response = self
            .generated()
-            .purge_guild_assets(&body)
+            .purge_admin_guild_assets(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -3,8 +3,6 @@
 use crate::api::generated::types as generated_types;

 use super::client::{AdminApiClient, ApiError, ApiResult};
-#[cfg(test)]
-use super::types::AuditLogEntry;
 use super::types::AuditLogsListResponse;

 pub struct SearchAuditLogsParams {
@@ -12,10 +10,11 @@ pub struct SearchAuditLogsParams {
    pub admin_user_id: Option<String>,
    pub target_id: Option<String>,
    pub target_type: Option<String>,
+    pub access: Option<String>,
    pub sort_by: Option<String>,
    pub sort_order: Option<String>,
    pub limit: u32,
-    pub offset: u32,
+    pub offset: u64,
 }

 impl AdminApiClient {
@@ -23,81 +22,66 @@ impl AdminApiClient {
        &self,
        params: &SearchAuditLogsParams,
    ) -> ApiResult<AuditLogsListResponse> {
-        let body = generated_types::SearchAuditLogsRequest {
-            admin_user_id: nonempty_string(params.admin_user_id.as_deref())
-                .map(generated_types::SnowflakeType::from),
-            limit: Some(
-                crate::api::generated::nonzero_u32(params.limit, "limit")
-                    .map_err(ApiError::Parse)?,
+        let access = params
+            .access
+            .as_deref()
+            .map(audit_access)
+            .transpose()?
+            .map(|value| value.to_string());
+        let sort_by = params
+            .sort_by
+            .as_deref()
+            .map(audit_sort_by)
+            .transpose()?
+            .map(|value| value.to_string());
+        let sort_order = params
+            .sort_order
+            .as_deref()
+            .map(audit_sort_order)
+            .transpose()?
+            .map(|value| value.to_string());
+        let limit = params.limit.to_string();
+        let offset = params.offset.to_string();
+        let query_params = [
+            ("q", params.query.as_deref().unwrap_or_default()),
+            (
+                "admin_user_id",
+                params.admin_user_id.as_deref().unwrap_or_default(),
            ),
-            offset: Some(i64::from(params.offset)),
-            query: nonempty_string(params.query.as_deref()),
-            sort_by: params.sort_by.as_deref().map(audit_sort_by).transpose()?,
-            sort_order: params
-                .sort_order
-                .as_deref()
-                .map(audit_sort_order)
-                .transpose()?,
-            target_id: nonempty_string(params.target_id.as_deref()),
-            target_type: nonempty_string(params.target_type.as_deref()),
-        };
-        let body = serde_json::to_value(&body).map_err(|e| ApiError::Parse(e.to_string()))?;
-        self.post("/admin/audit-logs/search", Some(&body)).await
+            (
+                "target_type",
+                params.target_type.as_deref().unwrap_or_default(),
+            ),
+            ("target_id", params.target_id.as_deref().unwrap_or_default()),
+            ("access", access.as_deref().unwrap_or_default()),
+            ("sort_by", sort_by.as_deref().unwrap_or_default()),
+            ("sort_order", sort_order.as_deref().unwrap_or_default()),
+            ("limit", limit.as_str()),
+            ("offset", offset.as_str()),
+        ];
+        self.get("/admin/audit-logs", Some(&query_params)).await
    }
 }

-#[cfg(test)]
-fn audit_logs_response(
-    response: generated_types::AuditLogsListResponseSchema,
-) -> ApiResult<AuditLogsListResponse> {
-    Ok(AuditLogsListResponse {
-        logs: response.logs.into_iter().map(audit_log_entry).collect(),
-        total: crate::api::generated::number_to_u64(response.total, "total")
-            .map_err(ApiError::Parse)?,
-    })
+fn audit_access(value: &str) -> ApiResult<generated_types::ListAdminAuditLogsAccess> {
+    generated_types::ListAdminAuditLogsAccess::try_from(value)
+        .map_err(|e| ApiError::Parse(e.to_string()))
 }

-#[cfg(test)]
-fn audit_log_entry(entry: generated_types::AuditLogsListResponseSchemaLogsItem) -> AuditLogEntry {
-    AuditLogEntry {
-        log_id: String::from(entry.log_id),
-        admin_user_id: String::from(entry.admin_user_id),
-        admin_user: None,
-        action: entry.action,
-        target_id: entry.target_id,
-        target_type: entry.target_type,
-        target_user: None,
-        target_guild: None,
-        target_channel: None,
-        related_users: Default::default(),
-        related_guilds: Default::default(),
-        related_channels: Default::default(),
-        audit_log_reason: entry.audit_log_reason,
-        metadata: entry.metadata,
-        created_at: entry.created_at,
-    }
-}
-
-fn audit_sort_by(value: &str) -> ApiResult<generated_types::SearchAuditLogsRequestSortBy> {
+fn audit_sort_by(value: &str) -> ApiResult<generated_types::ListAdminAuditLogsSortBy> {
    let value = match value {
        "created_at" => "createdAt",
        value => value,
    };
-    generated_types::SearchAuditLogsRequestSortBy::try_from(value)
+    generated_types::ListAdminAuditLogsSortBy::try_from(value)
        .map_err(|e| ApiError::Parse(e.to_string()))
 }

-fn audit_sort_order(value: &str) -> ApiResult<generated_types::SearchAuditLogsRequestSortOrder> {
-    generated_types::SearchAuditLogsRequestSortOrder::try_from(value)
+fn audit_sort_order(value: &str) -> ApiResult<generated_types::ListAdminAuditLogsSortOrder> {
+    generated_types::ListAdminAuditLogsSortOrder::try_from(value)
        .map_err(|e| ApiError::Parse(e.to_string()))
 }

-fn nonempty_string(value: Option<&str>) -> Option<String> {
-    value
-        .filter(|value| !value.is_empty())
-        .map(std::borrow::ToOwned::to_owned)
-}
-
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -112,12 +96,69 @@ mod tests {
        assert_eq!(audit_sort_order("desc").unwrap().to_string(), "desc");
    }

+    #[test]
+    fn accepts_only_known_access_filters() {
+        assert_eq!(audit_access("read").unwrap().to_string(), "read");
+        assert_eq!(audit_access("write").unwrap().to_string(), "write");
+        assert!(audit_access("all").is_err());
+    }
+
    #[test]
    fn rejects_lossy_audit_totals() {
-        let response = generated_types::AuditLogsListResponseSchema {
-            logs: Vec::new(),
-            total: 1.5,
-        };
-        assert!(audit_logs_response(response).is_err());
+        for total in [serde_json::json!(1.5), serde_json::json!(-1)] {
+            let response = serde_json::json!({"logs": [], "total": total});
+            assert!(serde_json::from_value::<AuditLogsListResponse>(response).is_err());
+        }
+    }
+
+    #[test]
+    fn deserializes_audit_fields_without_losing_generated_string_values() {
+        let json = serde_json::json!({
+            "logs": [{
+                "log_id": "123456789012345678",
+                "admin_user_id": "234567890123456789",
+                "admin_user": null,
+                "action": "USER_UPDATE",
+                "access": "write",
+                "target_id": "345678901234567890",
+                "target_type": "user",
+                "target_user": null,
+                "target_guild": null,
+                "target_channel": null,
+                "related_users": {},
+                "related_guilds": {},
+                "related_channels": {},
+                "audit_log_reason": "Account review",
+                "metadata": {"field": "username"},
+                "created_at": "2026-09-11T12:00:00.000Z"
+            }],
+            "total": 1
+        });
+        let generated: generated_types::AuditLogsListResponseSchema =
+            serde_json::from_value(json.clone()).unwrap();
+        assert_eq!(generated.logs[0].action.to_string(), "USER_UPDATE");
+
+        let response: AuditLogsListResponse = serde_json::from_value(json.clone()).unwrap();
+        assert_eq!(response.logs[0].access.as_deref(), Some("write"));
+        assert_eq!(serde_json::to_value(response).unwrap(), json);
+    }
+
+    #[test]
+    fn deserializes_audit_entries_from_an_api_without_access() {
+        let json = serde_json::json!({
+            "logs": [{
+                "log_id": "123456789012345678",
+                "admin_user_id": "234567890123456789",
+                "action": "USER_UPDATE",
+                "target_id": "345678901234567890",
+                "target_type": "user",
+                "audit_log_reason": null,
+                "metadata": {},
+                "created_at": "2026-09-11T12:00:00.000Z"
+            }],
+            "total": 1
+        });
+        let response: AuditLogsListResponse = serde_json::from_value(json).unwrap();
+        assert_eq!(response.logs[0].access, None);
    }
 }
@@ -1,215 +1,174 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{BanAvatarResult, BanCheckResult, BulkBanResult};

 impl AdminApiClient {
-    pub async fn ban_email(&self, email: &str) -> ApiResult<()> {
-        let body = generated_types::BanEmailRequest {
-            email: generated_types::EmailType::from(email.to_owned()),
-        };
-        self.generated()
-            .add_email_ban(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+    pub async fn ban_email(&self, email: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
+        self.create_blocklist_entry(
+            "email",
+            generated_types::AdminBlocklistEntryCreateRequest {
+                subtype_1: Some(generated_types::BanEmailRequest {
+                    email: generated_types::EmailType::from(email.to_owned()),
+                }),
+                ..Default::default()
+            },
+            audit_log_reason,
+        )
+        .await
    }

-    pub async fn unban_email(&self, email: &str) -> ApiResult<()> {
-        let body = generated_types::BanEmailRequest {
-            email: generated_types::EmailType::from(email.to_owned()),
-        };
-        self.generated()
-            .remove_email_ban(&body)
+    pub async fn unban_email(&self, email: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
+        self.delete_blocklist_entry("email", email, None, audit_log_reason)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
    }

    pub async fn check_email_ban(&self, email: &str) -> ApiResult<BanCheckResult> {
-        let body = generated_types::BanEmailRequest {
-            email: generated_types::EmailType::from(email.to_owned()),
-        };
-        let response = self
-            .generated()
-            .check_email_ban_status(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        self.check_blocklist_entry("email", email, None).await
    }

-    pub async fn ban_ip(&self, ip: &str) -> ApiResult<()> {
-        let body = generated_types::BanIpRequest { ip: ip.to_owned() };
-        self.generated()
-            .add_ip_ban(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+    pub async fn ban_ip(&self, ip: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
+        self.create_blocklist_entry(
+            "ip",
+            generated_types::AdminBlocklistEntryCreateRequest {
+                subtype_0: Some(generated_types::BanIpRequest { ip: ip.to_owned() }),
+                ..Default::default()
+            },
+            audit_log_reason,
+        )
+        .await
    }

-    pub async fn unban_ip(&self, ip: &str) -> ApiResult<()> {
-        let body = generated_types::BanIpRequest { ip: ip.to_owned() };
-        self.generated()
-            .remove_ip_ban(&body)
+    pub async fn unban_ip(&self, ip: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
+        self.delete_blocklist_entry("ip", ip, None, audit_log_reason)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
    }

    pub async fn check_ip_ban(&self, ip: &str) -> ApiResult<BanCheckResult> {
-        let body = generated_types::BanIpRequest { ip: ip.to_owned() };
-        let response = self
-            .generated()
-            .check_ip_ban_status(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        self.check_blocklist_entry("ip", ip, None).await
    }

-    pub async fn add_suspicious_email_domain(&self, domain: &str) -> ApiResult<()> {
-        let body = suspicious_email_domain_request(domain)?;
-        self.generated()
-            .add_suspicious_email_domain(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+    pub async fn add_suspicious_email_domain(
+        &self,
+        domain: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.create_blocklist_entry(
+            SUSPICIOUS_EMAIL_DOMAIN_LIST,
+            generated_types::AdminBlocklistEntryCreateRequest {
+                subtype_2: Some(suspicious_email_domain_request(domain)?),
+                ..Default::default()
+            },
+            audit_log_reason,
+        )
+        .await
    }

-    pub async fn remove_suspicious_email_domain(&self, domain: &str) -> ApiResult<()> {
-        let body = suspicious_email_domain_request(domain)?;
-        self.generated()
-            .remove_suspicious_email_domain(&body)
+    pub async fn remove_suspicious_email_domain(
+        &self,
+        domain: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.delete_blocklist_entry(SUSPICIOUS_EMAIL_DOMAIN_LIST, domain, None, audit_log_reason)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
    }

    pub async fn check_suspicious_email_domain(&self, domain: &str) -> ApiResult<BanCheckResult> {
-        let body = suspicious_email_domain_request(domain)?;
-        let response = self
-            .generated()
-            .check_suspicious_email_domain(&body)
+        self.check_blocklist_entry(SUSPICIOUS_EMAIL_DOMAIN_LIST, domain, None)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
    }

-    pub async fn ban_phrase(&self, phrase: &str) -> ApiResult<()> {
-        let body = generated_types::BanPhraseRequest {
-            phrase: phrase.to_owned(),
-        };
-        self.generated()
-            .add_phrase_ban(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+    pub async fn ban_phrase(&self, phrase: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
+        self.create_blocklist_entry(
+            "phrase",
+            generated_types::AdminBlocklistEntryCreateRequest {
+                subtype_3: Some(generated_types::BanPhraseRequest {
+                    phrase: phrase.to_owned(),
+                }),
+                ..Default::default()
+            },
+            audit_log_reason,
+        )
+        .await
    }

-    pub async fn unban_phrase(&self, phrase: &str) -> ApiResult<()> {
-        let body = generated_types::BanPhraseRequest {
-            phrase: phrase.to_owned(),
-        };
-        self.generated()
-            .remove_phrase_ban(&body)
+    pub async fn unban_phrase(
+        &self,
+        phrase: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.delete_blocklist_entry("phrase", phrase, None, audit_log_reason)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
    }

    pub async fn check_phrase_ban(&self, phrase: &str) -> ApiResult<BanCheckResult> {
-        let body = generated_types::BanPhraseRequest {
-            phrase: phrase.to_owned(),
-        };
-        let response = self
-            .generated()
-            .check_phrase_ban_status(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        self.check_blocklist_entry("phrase", phrase, None).await
    }

-    pub async fn ban_url(&self, url: &str) -> ApiResult<()> {
-        let body = generated_types::BanUrlRequest {
-            category: None,
-            notes: None,
-            severity: None,
-            source_url: None,
-            url: url.to_owned(),
-        };
-        self.generated()
-            .add_url_ban(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+    pub async fn ban_url(&self, url: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
+        self.create_blocklist_entry(
+            "url",
+            generated_types::AdminBlocklistEntryCreateRequest {
+                subtype_4: Some(generated_types::BanUrlRequest {
+                    category: None,
+                    notes: None,
+                    severity: None,
+                    source_url: None,
+                    url: url.to_owned(),
+                }),
+                ..Default::default()
+            },
+            audit_log_reason,
+        )
+        .await
    }

-    pub async fn unban_url(&self, url: &str) -> ApiResult<()> {
-        let body = generated_types::UnbanUrlRequest {
-            url: url.to_owned(),
-        };
-        self.generated()
-            .remove_url_ban(&body)
+    pub async fn unban_url(&self, url: &str, audit_log_reason: Option<&str>) -> ApiResult<()> {
+        self.delete_blocklist_entry("url", url, None, audit_log_reason)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
    }

    pub async fn check_url_ban(&self, url: &str) -> ApiResult<BanCheckResult> {
-        let body = generated_types::CheckUrlBlocklistRequest {
-            url: url.to_owned(),
-        };
-        let response = self
-            .generated()
-            .check_url_ban_status(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        self.check_blocklist_entry("url", url, None).await
    }

-    pub async fn ban_url_domain(&self, domain: &str, match_subdomains: bool) -> ApiResult<()> {
-        let body = generated_types::BanUrlDomainRequest {
-            category: None,
-            domain: domain.to_owned(),
-            match_subdomains: Some(match_subdomains),
-            notes: None,
-            severity: None,
-            source_url: None,
-        };
-        self.generated()
-            .add_url_domain_ban(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+    pub async fn ban_url_domain(
+        &self,
+        domain: &str,
+        match_subdomains: bool,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.create_blocklist_entry(
+            "url-domain",
+            generated_types::AdminBlocklistEntryCreateRequest {
+                subtype_5: Some(generated_types::BanUrlDomainRequest {
+                    category: None,
+                    domain: domain.to_owned(),
+                    match_subdomains,
+                    notes: None,
+                    severity: None,
+                    source_url: None,
+                }),
+                ..Default::default()
+            },
+            audit_log_reason,
+        )
+        .await
    }

-    pub async fn unban_url_domain(&self, domain: &str) -> ApiResult<()> {
-        let body = generated_types::UnbanUrlDomainRequest {
-            domain: domain.to_owned(),
-        };
-        self.generated()
-            .remove_url_domain_ban(&body)
+    pub async fn unban_url_domain(
+        &self,
+        domain: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.delete_blocklist_entry("url-domain", domain, None, audit_log_reason)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
    }

    pub async fn check_url_domain_ban(&self, domain: &str) -> ApiResult<BanCheckResult> {
-        let body = generated_types::BanUrlDomainRequest {
-            category: None,
-            domain: domain.to_owned(),
-            match_subdomains: None,
-            notes: None,
-            severity: None,
-            source_url: None,
-        };
-        let response = self
-            .generated()
-            .check_url_domain_ban_status(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        self.check_blocklist_entry("url-domain", domain, None).await
    }

    pub async fn ban_file_sha(
@@ -217,16 +176,22 @@ impl AdminApiClient {
        sha256_hex: &str,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<()> {
-        let body = generated_types::BanFileShaRequest {
-            category: None,
-            content_type: None,
-            notes: None,
-            severity: None,
-            sha256_hex: sha256_hex.to_owned(),
-            source_url: None,
-        };
-        self.post_typed_with_reason::<(), _>("/admin/bans/file-sha/add", &body, audit_log_reason)
-            .await
+        self.create_blocklist_entry(
+            "file-sha",
+            generated_types::AdminBlocklistEntryCreateRequest {
+                subtype_6: Some(generated_types::BanFileShaRequest {
+                    category: None,
+                    content_type: None,
+                    notes: None,
+                    severity: None,
+                    sha256_hex: sha256_hex.to_owned(),
+                    source_url: None,
+                }),
+                ..Default::default()
+            },
+            audit_log_reason,
+        )
+        .await
    }

    pub async fn unban_file_sha(
@@ -234,23 +199,13 @@ impl AdminApiClient {
        sha256_hex: &str,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<()> {
-        let body = generated_types::UnbanFileShaRequest {
-            sha256_hex: sha256_hex.to_owned(),
-        };
-        self.post_typed_with_reason::<(), _>("/admin/bans/file-sha/remove", &body, audit_log_reason)
+        self.delete_blocklist_entry("file-sha", sha256_hex, None, audit_log_reason)
            .await
    }

    pub async fn check_file_sha_ban(&self, sha256_hex: &str) -> ApiResult<BanCheckResult> {
-        let body = generated_types::CheckFileShaRequest {
-            sha256_hex: sha256_hex.to_owned(),
-        };
-        let response = self
-            .generated()
-            .check_file_sha_ban_status(&body)
+        self.check_blocklist_entry("file-sha", sha256_hex, None)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
    }

    pub async fn bulk_ban_file_shas(
@@ -261,78 +216,91 @@ impl AdminApiClient {
        let body = generated_types::BulkBanFileShasRequest {
            sha256_list: sha256_list.to_vec(),
        };
-        self.post_typed_with_reason("/admin/bans/file-sha/bulk-add", &body, audit_log_reason)
-            .await
+        self.put_typed_with_reason(
+            "/admin/blocklists/file-sha/entries",
+            &body,
+            audit_log_reason,
+        )
+        .await
    }

-    pub async fn ban_avatar_hash(&self, hash_short: &str) -> ApiResult<()> {
-        let body = generated_types::BanAvatarHashRequest {
-            category: None,
-            hashes: vec![hash_short.to_owned()],
-            notes: None,
-            reason: None,
-            severity: None,
-            source_url: None,
-        };
-        self.generated()
-            .add_avatar_hash_ban(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+    pub async fn ban_avatar_hash(
+        &self,
+        hash_short: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.create_blocklist_entry(
+            "avatar-hash",
+            generated_types::AdminBlocklistEntryCreateRequest {
+                subtype_7: Some(generated_types::BanAvatarHashRequest {
+                    category: None,
+                    hashes: vec![hash_short.to_owned()],
+                    notes: None,
+                    reason: None,
+                    severity: None,
+                    source_url: None,
+                }),
+                ..Default::default()
+            },
+            audit_log_reason,
+        )
+        .await
    }

-    pub async fn unban_avatar_hash(&self, hash_short: &str) -> ApiResult<()> {
-        let body = generated_types::CheckAvatarHashRequest {
-            hashes: vec![hash_short.to_owned()],
-        };
-        self.generated()
-            .remove_avatar_hash_ban(&body)
+    pub async fn unban_avatar_hash(
+        &self,
+        hash_short: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.delete_blocklist_entry("avatar-hash", hash_short, None, audit_log_reason)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
    }

    pub async fn check_avatar_hash_ban(&self, hash_short: &str) -> ApiResult<BanCheckResult> {
-        let body = generated_types::CheckAvatarHashRequest {
-            hashes: vec![hash_short.to_owned()],
-        };
-        let response = self
-            .generated()
-            .check_avatar_hash_ban_status(&body)
+        self.check_blocklist_entry("avatar-hash", hash_short, None)
            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
    }

    pub async fn ban_user_avatar(&self, user_id: &str) -> ApiResult<BanAvatarResult> {
        let body = generated_types::BanUserAvatarRequest::default();
        let response = self
            .generated()
-            .ban_user_avatar(
-                &generated_types::SnowflakeType::from(user_id.to_owned()),
-                &body,
-            )
+            .ban_admin_user_avatar(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }

-    pub async fn ban_profile_substring(&self, scope: &str, substring: &str) -> ApiResult<()> {
-        let body = profile_substring_request(scope, substring)?;
-        self.generated()
-            .add_profile_substring_ban(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+    pub async fn ban_profile_substring(
+        &self,
+        scope: &str,
+        substring: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.create_blocklist_entry(
+            PROFILE_SUBSTRING_LIST,
+            generated_types::AdminBlocklistEntryCreateRequest {
+                subtype_8: Some(profile_substring_request(scope, substring)?),
+                ..Default::default()
+            },
+            audit_log_reason,
+        )
+        .await
    }

-    pub async fn unban_profile_substring(&self, scope: &str, substring: &str) -> ApiResult<()> {
-        let body = profile_substring_request(scope, substring)?;
-        self.generated()
-            .remove_profile_substring_ban(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
+    pub async fn unban_profile_substring(
+        &self,
+        scope: &str,
+        substring: &str,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        self.delete_blocklist_entry(
+            PROFILE_SUBSTRING_LIST,
+            substring,
+            Some(scope),
+            audit_log_reason,
+        )
+        .await
    }

    pub async fn check_profile_substring_ban(
@@ -340,16 +308,78 @@ impl AdminApiClient {
        scope: &str,
        substring: &str,
    ) -> ApiResult<BanCheckResult> {
-        let body = profile_substring_request(scope, substring)?;
+        self.check_blocklist_entry(PROFILE_SUBSTRING_LIST, substring, Some(scope))
+            .await
+    }
+
+    async fn create_blocklist_entry(
+        &self,
+        list_type: &str,
+        body: generated_types::AdminBlocklistEntryCreateRequest,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        let list_type = blocklist_list_type(list_type)?;
+        self.generated_with_reason(audit_log_reason)?
+            .create_admin_blocklist_entry(list_type, &body)
+            .await
+            .map(drop)
+            .map_err(|error| self.generated_error(error))
+    }
+
+    async fn delete_blocklist_entry(
+        &self,
+        list_type: &str,
+        entry_value: &str,
+        scope: Option<&str>,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        let list_type = blocklist_list_type(list_type)?;
+        let scope = scope.map(blocklist_delete_scope).transpose()?;
+        self.generated_with_reason(audit_log_reason)?
+            .delete_admin_blocklist_entry(list_type, entry_value, scope)
+            .await
+            .map(drop)
+            .map_err(|error| self.generated_error(error))
+    }
+
+    async fn check_blocklist_entry(
+        &self,
+        list_type: &str,
+        entry_value: &str,
+        scope: Option<&str>,
+    ) -> ApiResult<BanCheckResult> {
+        let list_type = blocklist_list_type(list_type)?;
+        let scope = scope.map(blocklist_get_scope).transpose()?;
        let response = self
            .generated()
-            .check_profile_substring_ban_status(&body)
+            .get_admin_blocklist_entry(list_type, entry_value, scope)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }
 }

+const SUSPICIOUS_EMAIL_DOMAIN_LIST: &str = "email-domain-suspicious";
+
+const PROFILE_SUBSTRING_LIST: &str = "profile-substring";
+
+fn blocklist_list_type(list_type: &str) -> ApiResult<generated_types::AdminBlocklistListType> {
+    generated_types::AdminBlocklistListType::try_from(list_type)
+        .map_err(|e| ApiError::Parse(e.to_string()))
+}
+
+fn blocklist_get_scope(scope: &str) -> ApiResult<generated_types::GetAdminBlocklistEntryScope> {
+    generated_types::GetAdminBlocklistEntryScope::try_from(scope)
+        .map_err(|e| ApiError::Parse(e.to_string()))
+}
+
+fn blocklist_delete_scope(
+    scope: &str,
+) -> ApiResult<generated_types::DeleteAdminBlocklistEntryScope> {
+    generated_types::DeleteAdminBlocklistEntryScope::try_from(scope)
+        .map_err(|e| ApiError::Parse(e.to_string()))
+}
+
 fn suspicious_email_domain_request(
    domain: &str,
 ) -> ApiResult<generated_types::SuspiciousEmailDomainRequest> {
@@ -1,154 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-use crate::api::generated::types as generated_types;
-
-use super::client::{AdminApiClient, ApiError, ApiResult};
-use super::types::{
-    BillingOverview, InvoiceListResponse, PaymentListResponse, PaymentMethodListResponse,
-    RefundCancelResponse, SubscriptionResponse,
-};
-
-impl AdminApiClient {
-    pub async fn get_billing_overview(&self, user_id: &str) -> ApiResult<BillingOverview> {
-        let response = self
-            .generated()
-            .admin_billing_overview(user_id)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
-    }
-
-    pub async fn get_user_payments(&self, user_id: &str) -> ApiResult<PaymentListResponse> {
-        let response = self
-            .generated()
-            .admin_billing_list_payments(user_id)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
-    }
-
-    pub async fn get_user_subscription(&self, user_id: &str) -> ApiResult<SubscriptionResponse> {
-        let response = self
-            .generated()
-            .admin_billing_get_subscription(user_id)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
-    }
-
-    pub async fn get_user_payment_methods(
-        &self,
-        user_id: &str,
-    ) -> ApiResult<PaymentMethodListResponse> {
-        let response = self
-            .generated()
-            .admin_billing_list_payment_methods(user_id)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
-    }
-
-    pub async fn get_user_invoices(
-        &self,
-        user_id: &str,
-        limit: u32,
-        starting_after: Option<&str>,
-    ) -> ApiResult<InvoiceListResponse> {
-        let limit_str = limit.to_string();
-        let mut params: Vec<(&str, &str)> = vec![("limit", &limit_str)];
-        if let Some(sa) = starting_after {
-            params.push(("starting_after", sa));
-        }
-        self.get(
-            &format!("/admin/billing/users/{user_id}/invoices"),
-            Some(&params),
-        )
-        .await
-    }
-
-    pub async fn issue_refund(
-        &self,
-        user_id: &str,
-        payment_intent_id: &str,
-        amount_cents: Option<u64>,
-        reason: Option<&str>,
-    ) -> ApiResult<()> {
-        let body = generated_types::AdminBillingRefundRequest {
-            amount_cents: amount_cents
-                .map(|value| crate::api::generated::nonzero_u64(value, "amount_cents"))
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-            payment_intent_id: payment_intent_id.to_owned(),
-            reason: reason
-                .map(generated_types::AdminBillingRefundRequestReason::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-        };
-        self.generated()
-            .admin_billing_refund(user_id, &body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
-    }
-
-    pub async fn refund_policy_cancel_now(
-        &self,
-        user_id: &str,
-        reason: Option<&str>,
-    ) -> ApiResult<RefundCancelResponse> {
-        let body = generated_types::AdminBillingRefundLatestInvoiceCancelRequest {
-            reason: reason
-                .map(generated_types::AdminBillingRefundLatestInvoiceCancelRequestReason::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-        };
-        let response = self
-            .generated()
-            .admin_billing_refund_policy_cancel_now(user_id, &body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
-    }
-
-    pub async fn cancel_subscription(&self, user_id: &str) -> ApiResult<()> {
-        self.generated()
-            .admin_billing_cancel_subscription(user_id)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
-    }
-
-    pub async fn cancel_subscription_immediately(
-        &self,
-        user_id: &str,
-        reason: Option<&str>,
-    ) -> ApiResult<()> {
-        let body = generated_types::AdminBillingCancelImmediatelyRequest {
-            reason: reason
-                .map(generated_types::AdminBillingCancelImmediatelyRequestReason::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-        };
-        self.generated()
-            .admin_billing_cancel_subscription_now(user_id, &body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
-    }
-
-    pub async fn reactivate_subscription(&self, user_id: &str) -> ApiResult<()> {
-        self.generated()
-            .admin_billing_reactivate_subscription(user_id)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
-    }
-
-    pub async fn end_premium_grace_period(&self, user_id: &str) -> ApiResult<()> {
-        self.generated()
-            .admin_billing_end_premium_grace_period(user_id)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        Ok(())
-    }
-}
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::BulkJobResponse;
@@ -13,12 +13,12 @@ impl AdminApiClient {
        remove_flags: &[String],
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
-        let body = generated_types::BulkUpdateUserFlagsRequest {
-            add_flags: user_flags(add_flags),
-            remove_flags: user_flags(remove_flags),
+        let body = generated_types::AdminBulkJobCreateRequest::UpdateUserFlags {
+            add_flags: user_flags(add_flags)?,
+            remove_flags: user_flags(remove_flags)?,
            user_ids: snowflakes(user_ids),
        };
-        self.post_typed_with_reason("/admin/bulk/update-user-flags", &body, audit_log_reason)
+        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
            .await
    }

@@ -29,17 +29,13 @@ impl AdminApiClient {
        remove_flags: &[String],
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
-        let body = generated_types::BulkUpdateSuspiciousActivityFlagsRequest {
+        let body = generated_types::AdminBulkJobCreateRequest::UpdateSuspiciousActivityFlags {
            add_flags: add_flags.to_vec(),
            remove_flags: remove_flags.to_vec(),
            user_ids: snowflakes(user_ids),
        };
-        self.post_typed_with_reason(
-            "/admin/bulk/update-suspicious-activity-flags",
-            &body,
-            audit_log_reason,
-        )
-        .await
+        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
+            .await
    }

    pub async fn bulk_update_guild_features(
@@ -49,12 +45,12 @@ impl AdminApiClient {
        remove_features: &[String],
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
-        let body = generated_types::BulkUpdateGuildFeaturesRequest {
+        let body = generated_types::AdminBulkJobCreateRequest::UpdateGuildFeatures {
            add_features: guild_features(add_features),
            guild_ids: snowflakes(guild_ids),
            remove_features: guild_features(remove_features),
        };
-        self.post_typed_with_reason("/admin/bulk/update-guild-features", &body, audit_log_reason)
+        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
            .await
    }

@@ -64,11 +60,23 @@ impl AdminApiClient {
        user_ids: &[String],
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
-        let body = generated_types::BulkAddGuildMembersRequest {
+        let body = generated_types::AdminBulkJobCreateRequest::AddGuildMembers {
            guild_id: snowflake(guild_id),
            user_ids: snowflakes(user_ids),
        };
-        self.post_typed_with_reason("/admin/bulk/add-guild-members", &body, audit_log_reason)
+        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
+            .await
+    }
+
+    pub async fn bulk_delete_user_messages(
+        &self,
+        user_ids: &[String],
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<BulkJobResponse> {
+        let body = generated_types::AdminBulkJobCreateRequest::DeleteUserMessages {
+            user_ids: snowflakes(user_ids),
+        };
+        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
            .await
    }

@@ -80,41 +88,37 @@ impl AdminApiClient {
        public_reason: Option<&str>,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<BulkJobResponse> {
-        let body = generated_types::BulkScheduleUserDeletionRequest {
-            days_until_deletion: Some(
-                crate::api::generated::nonzero_u32(days_until_deletion, "days_until_deletion")
-                    .map_err(ApiError::Parse)?,
-            ),
+        let body = generated_types::AdminBulkJobCreateRequest::ScheduleUserDeletion {
+            days_until_deletion: crate::api::generated::nonzero_u32(
+                days_until_deletion,
+                "days_until_deletion",
+            )
+            .map_err(ApiError::Parse)?
+            .into(),
            public_reason: public_reason.map(std::borrow::ToOwned::to_owned),
-            reason_code: i32::try_from(reason_code).map_err(|e| ApiError::Parse(e.to_string()))?,
+            reason_code: crate::api::generated::deletion_reason_code(
+                i32::try_from(reason_code).map_err(|e| ApiError::Parse(e.to_string()))?,
+                "reason_code",
+            )
+            .map_err(ApiError::Parse)?,
            user_ids: snowflakes(user_ids),
        };
-        self.post_typed_with_reason(
-            "/admin/bulk/schedule-user-deletion",
-            &body,
-            audit_log_reason,
-        )
-        .await
+        self.post_typed_with_reason("/admin/bulk-jobs", &body, audit_log_reason)
+            .await
    }
 }

-fn snowflake(value: &str) -> generated_types::SnowflakeType {
-    generated_types::SnowflakeType::from(value.to_owned())
-}
-
 fn snowflakes(values: &[String]) -> Vec<generated_types::SnowflakeType> {
-    values
-        .iter()
-        .cloned()
-        .map(generated_types::SnowflakeType::from)
-        .collect()
+    values.iter().map(|value| snowflake(value)).collect()
 }

-fn user_flags(values: &[String]) -> Vec<generated_types::UserFlags> {
+fn user_flags(values: &[String]) -> ApiResult<Vec<generated_types::UserFlags>> {
    values
        .iter()
-        .cloned()
-        .map(generated_types::UserFlags::from)
+        .map(|value| {
+            generated_types::UserFlags::try_from(value.as_str())
+                .map_err(|error| ApiError::Parse(error.to_string()))
+        })
        .collect()
 }

@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use crate::api::generated::GeneratedClient;
 use crate::{config::AdminConfig, session::Session};
+use progenitor_client::ClientInfo;
 use reqwest::header::{AUTHORIZATION, HeaderMap, HeaderName, HeaderValue};
 use reqwest::{Method, RequestBuilder};
 use serde::Serialize;
@@ -34,46 +36,39 @@ impl<T> ApiResultExt<T> for ApiResult<T> {
 }

 pub struct AdminApiClient {
-    http_client: reqwest::Client,
-    generated: crate::api::generated::GeneratedClient,
-    base_url: String,
-    access_token: String,
-    proxy_client_ip_headers: HeaderMap,
+    generated: GeneratedClient,
 }

 impl AdminApiClient {
    pub fn new(http_client: &reqwest::Client, config: &AdminConfig, session: &Session) -> Self {
-        let generated_http_client = build_generated_http_client(config, session);
-        let generated = crate::api::generated::GeneratedClient::new_with_client(
+        let generated = GeneratedClient::new_with_client(
            &config.api_endpoint,
-            generated_http_client,
+            http_client.clone(),
+            build_session_headers(config, session),
        );
-        Self {
-            http_client: http_client.clone(),
-            generated,
-            base_url: config.api_endpoint.clone(),
-            access_token: session.access_token.clone(),
-            proxy_client_ip_headers: build_proxy_client_ip_headers(config),
-        }
+        Self { generated }
    }

    fn build_url(&self, path: &str, query_params: Option<&[(&str, &str)]>) -> String {
-        let base = format!("{}{}", self.base_url, path);
-        match query_params {
-            None => base,
-            Some(params) => {
-                let filtered: Vec<_> = params.iter().filter(|(_, v)| !v.is_empty()).collect();
-                if filtered.is_empty() {
-                    return base;
-                }
-                let query = filtered
-                    .iter()
-                    .map(|(k, v)| format!("{}={}", urlencoding::encode(k), urlencoding::encode(v)))
-                    .collect::<Vec<_>>()
-                    .join("&");
-                format!("{base}?{query}")
-            }
+        let mut url = format!("{}{}", self.generated.baseurl(), path);
+        let query = query_params
+            .unwrap_or_default()
+            .iter()
+            .filter(|(_, value)| !value.is_empty())
+            .map(|(key, value)| {
+                format!(
+                    "{}={}",
+                    urlencoding::encode(key),
+                    urlencoding::encode(value)
+                )
+            })
+            .collect::<Vec<_>>()
+            .join("&");
+        if !query.is_empty() {
+            url.push('?');
+            url.push_str(&query);
        }
+        url
    }

    fn request(
@@ -81,30 +76,26 @@ impl AdminApiClient {
        method: Method,
        path: &str,
        query_params: Option<&[(&str, &str)]>,
-    ) -> RequestBuilder {
-        let url = self.build_url(path, query_params);
-        self.http_client
-            .request(method, &url)
-            .header("Authorization", format!("Bearer {}", self.access_token))
-            .header("Content-Type", "application/json")
-            .headers(self.proxy_client_ip_headers.clone())
-    }
-
-    fn with_audit_log_reason(
-        builder: RequestBuilder,
        audit_log_reason: Option<&str>,
-    ) -> RequestBuilder {
-        match audit_log_reason {
-            Some(reason) => builder.header("X-Audit-Log-Reason", reason),
-            None => builder,
-        }
+    ) -> ApiResult<RequestBuilder> {
+        let url = self.build_url(path, query_params);
+        Ok(self
+            .generated
+            .client()
+            .request(method, &url)
+            .header("Content-Type", "application/json")
+            .headers(self.headers_with_reason(audit_log_reason)?))
    }

-    fn with_json_body(builder: RequestBuilder, body: Option<&serde_json::Value>) -> RequestBuilder {
-        match body {
-            Some(body) => builder.json(body),
-            None => builder,
+    fn headers_with_reason(&self, audit_log_reason: Option<&str>) -> ApiResult<HeaderMap> {
+        let mut headers = self.generated.inner().clone();
+        if let Some(reason) = audit_log_reason {
+            let mut value = HeaderValue::from_str(reason)
+                .map_err(|_| ApiError::Parse("invalid audit log reason header".to_owned()))?;
+            value.set_sensitive(true);
+            headers.insert("x-audit-log-reason", value);
        }
+        Ok(headers)
    }

    async fn send_request(builder: RequestBuilder) -> ApiResult<reqwest::Response> {
@@ -114,13 +105,29 @@ impl AdminApiClient {
            .map_err(|e| ApiError::Network(e.to_string()))
    }

+    async fn send_json<B: Serialize + ?Sized>(
+        &self,
+        method: Method,
+        path: &str,
+        body: Option<&B>,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<reqwest::Response> {
+        let builder = self.request(method, path, None, audit_log_reason)?;
+        let builder = match body {
+            Some(body) => builder.json(body),
+            None => builder,
+        };
+        Self::send_request(builder).await
+    }
+
    pub async fn get<T: DeserializeOwned>(
        &self,
        path: &str,
        query_params: Option<&[(&str, &str)]>,
    ) -> ApiResult<T> {
-        let response = Self::send_request(self.request(Method::GET, path, query_params)).await?;
-        self.parse_response(response).await
+        let response =
+            Self::send_request(self.request(Method::GET, path, query_params, None)?).await?;
+        Self::parse_response(response).await
    }

    pub async fn post<T: DeserializeOwned>(
@@ -149,10 +156,10 @@ impl AdminApiClient {
        T: DeserializeOwned,
        B: Serialize + ?Sized,
    {
-        let builder =
-            Self::with_audit_log_reason(self.request(Method::POST, path, None), audit_log_reason);
-        let response = Self::send_request(builder.json(body)).await?;
-        self.parse_response(response).await
+        let response = self
+            .send_json(Method::POST, path, Some(body), audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
    }

    pub async fn post_with_reason<T: DeserializeOwned>(
@@ -161,10 +168,10 @@ impl AdminApiClient {
        body: Option<&serde_json::Value>,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<T> {
-        let builder =
-            Self::with_audit_log_reason(self.request(Method::POST, path, None), audit_log_reason);
-        let response = Self::send_request(Self::with_json_body(builder, body)).await?;
-        self.parse_response(response).await
+        let response = self
+            .send_json(Method::POST, path, body, audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
    }

    pub async fn post_void(&self, path: &str, body: Option<&serde_json::Value>) -> ApiResult<()> {
@@ -177,9 +184,9 @@ impl AdminApiClient {
        body: Option<&serde_json::Value>,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<()> {
-        let builder =
-            Self::with_audit_log_reason(self.request(Method::POST, path, None), audit_log_reason);
-        let response = Self::send_request(Self::with_json_body(builder, body)).await?;
+        let response = self
+            .send_json(Method::POST, path, body, audit_log_reason)
+            .await?;
        Self::parse_void_response(response).await
    }

@@ -188,36 +195,135 @@ impl AdminApiClient {
        path: &str,
        body: Option<&serde_json::Value>,
    ) -> ApiResult<T> {
-        let builder = Self::with_json_body(self.request(Method::PATCH, path, None), body);
-        let response = Self::send_request(builder).await?;
-        self.parse_response(response).await
+        self.patch_with_reason(path, body, None).await
    }

-    pub async fn delete_void(&self, path: &str, body: Option<&serde_json::Value>) -> ApiResult<()> {
-        let builder = Self::with_json_body(self.request(Method::DELETE, path, None), body);
-        let response = Self::send_request(builder).await?;
+    pub async fn patch_with_reason<T: DeserializeOwned>(
+        &self,
+        path: &str,
+        body: Option<&serde_json::Value>,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<T> {
+        let response = self
+            .send_json(Method::PATCH, path, body, audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
+    }
+
+    pub async fn patch_typed_with_reason<T, B>(
+        &self,
+        path: &str,
+        body: &B,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<T>
+    where
+        T: DeserializeOwned,
+        B: Serialize + ?Sized,
+    {
+        let response = self
+            .send_json(Method::PATCH, path, Some(body), audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
+    }
+
+    pub async fn put_with_reason<T: DeserializeOwned>(
+        &self,
+        path: &str,
+        body: Option<&serde_json::Value>,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<T> {
+        let response = self
+            .send_json(Method::PUT, path, body, audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
+    }
+
+    pub async fn put_typed_with_reason<T, B>(
+        &self,
+        path: &str,
+        body: &B,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<T>
+    where
+        T: DeserializeOwned,
+        B: Serialize + ?Sized,
+    {
+        let response = self
+            .send_json(Method::PUT, path, Some(body), audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
+    }
+
+    pub async fn put_void_with_reason(
+        &self,
+        path: &str,
+        body: Option<&serde_json::Value>,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        let response = self
+            .send_json(Method::PUT, path, body, audit_log_reason)
+            .await?;
        Self::parse_void_response(response).await
    }

-    async fn parse_void_response(response: reqwest::Response) -> ApiResult<()> {
-        if response.status().is_success() {
-            Ok(())
-        } else {
-            let status = response.status().as_u16();
-            let text = response.text().await.map_err(|error| {
-                ApiError::Network(format!("failed to read error response body: {error}"))
-            })?;
-            Err(ApiError::Http {
-                status,
-                message: text,
-            })
-        }
+    pub async fn delete_void(&self, path: &str, body: Option<&serde_json::Value>) -> ApiResult<()> {
+        self.delete_void_with_reason(path, body, None).await
    }

-    pub(crate) fn generated(&self) -> &crate::api::generated::GeneratedClient {
+    pub async fn delete_void_with_reason(
+        &self,
+        path: &str,
+        body: Option<&serde_json::Value>,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<()> {
+        let response = self
+            .send_json(Method::DELETE, path, body, audit_log_reason)
+            .await?;
+        Self::parse_void_response(response).await
+    }
+
+    pub async fn delete_with_reason<T: DeserializeOwned>(
+        &self,
+        path: &str,
+        body: Option<&serde_json::Value>,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<T> {
+        let response = self
+            .send_json(Method::DELETE, path, body, audit_log_reason)
+            .await?;
+        Self::parse_response(response).await
+    }
+
+    async fn parse_void_response(response: reqwest::Response) -> ApiResult<()> {
+        Self::check_response_status(response).await.map(drop)
+    }
+
+    async fn check_response_status(response: reqwest::Response) -> ApiResult<reqwest::Response> {
+        if response.status().is_success() {
+            return Ok(response);
+        }
+        let status = response.status().as_u16();
+        let message = response.text().await.map_err(|error| {
+            ApiError::Network(format!("failed to read error response body: {error}"))
+        })?;
+        Err(ApiError::Http { status, message })
+    }
+
+    pub(crate) fn generated(&self) -> &GeneratedClient {
        &self.generated
    }

+    pub(crate) fn generated_with_reason(
+        &self,
+        audit_log_reason: Option<&str>,
+    ) -> ApiResult<GeneratedClient> {
+        Ok(GeneratedClient::new_with_client(
+            self.generated.baseurl(),
+            self.generated.client().clone(),
+            self.headers_with_reason(audit_log_reason)?,
+        ))
+    }
+
    pub(crate) fn generated_value<T, U>(&self, value: U) -> ApiResult<T>
    where
        T: DeserializeOwned,
@@ -240,28 +346,16 @@ impl AdminApiClient {
        }
    }

-    async fn parse_response<T: DeserializeOwned>(
-        &self,
-        response: reqwest::Response,
-    ) -> ApiResult<T> {
-        let status = response.status();
-        if status.as_u16() == 204 {
-            return serde_json::from_value(serde_json::Value::Null)
-                .map_err(|e| ApiError::Parse(e.to_string()));
-        }
-        if !status.is_success() {
-            let text = response.text().await.map_err(|error| {
-                ApiError::Network(format!("failed to read error response body: {error}"))
-            })?;
-            return Err(ApiError::Http {
-                status: status.as_u16(),
-                message: text,
-            });
-        }
-        let text = response
-            .text()
-            .await
-            .map_err(|e| ApiError::Network(e.to_string()))?;
+    async fn parse_response<T: DeserializeOwned>(response: reqwest::Response) -> ApiResult<T> {
+        let response = Self::check_response_status(response).await?;
+        let text = if response.status() == reqwest::StatusCode::NO_CONTENT {
+            String::new()
+        } else {
+            response
+                .text()
+                .await
+                .map_err(|e| ApiError::Network(e.to_string()))?
+        };
        if text.is_empty() {
            return serde_json::from_value(serde_json::Value::Null)
                .map_err(|e| ApiError::Parse(e.to_string()));
@@ -270,17 +364,14 @@ impl AdminApiClient {
    }
 }

-fn build_generated_http_client(config: &AdminConfig, session: &Session) -> reqwest::Client {
+fn build_session_headers(config: &AdminConfig, session: &Session) -> HeaderMap {
    let mut headers = HeaderMap::new();
-    let auth_value = HeaderValue::from_str(&format!("Bearer {}", session.access_token))
+    let mut auth_value = HeaderValue::from_str(&format!("Bearer {}", session.access_token))
        .expect("failed to build generated API Authorization header");
+    auth_value.set_sensitive(true);
    headers.insert(AUTHORIZATION, auth_value);
    headers.extend(build_proxy_client_ip_headers(config));
-    reqwest::Client::builder()
-        .user_agent(format!("FluxerAdmin/{} (Rust)", config.build_version))
-        .default_headers(headers)
-        .build()
-        .expect("failed to create generated API HTTP client")
+    headers
 }

 pub(crate) fn with_proxy_client_ip_header(
@@ -330,3 +421,84 @@ impl std::fmt::Display for ApiError {
        }
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::{Value, json};
+
+    fn response(status: u16, body: &'static str) -> reqwest::Response {
+        axum::http::Response::builder()
+            .status(status)
+            .body(body)
+            .expect("valid response")
+            .into()
+    }
+
+    #[tokio::test]
+    async fn parses_successful_json_and_empty_responses() {
+        for (status, body, expected) in [
+            (200, r#"{"value":1}"#, json!({"value": 1})),
+            (201, "[1,2]", json!([1, 2])),
+            (202, "null", Value::Null),
+            (200, "", Value::Null),
+            (204, "ignored body", Value::Null),
+        ] {
+            let actual: Value = AdminApiClient::parse_response(response(status, body))
+                .await
+                .expect("valid response body");
+            assert_eq!(actual, expected, "HTTP {status}: {body}");
+        }
+    }
+
+    #[tokio::test]
+    async fn empty_responses_preserve_null_deserialization_errors() {
+        let expected = serde_json::from_value::<Vec<String>>(Value::Null)
+            .expect_err("null is not a list")
+            .to_string();
+        for (status, body) in [(200, ""), (204, "ignored body")] {
+            let error = AdminApiClient::parse_response::<Vec<String>>(response(status, body))
+                .await
+                .expect_err("missing list");
+            assert_eq!(error.to_string(), format!("parse error: {expected}"));
+        }
+    }
+
+    #[tokio::test]
+    async fn malformed_json_preserves_deserialization_errors() {
+        for body in [" ", "{", "not JSON"] {
+            let expected = serde_json::from_str::<Value>(body)
+                .expect_err("malformed JSON")
+                .to_string();
+            let error = AdminApiClient::parse_response::<Value>(response(200, body))
+                .await
+                .expect_err("malformed response");
+            assert_eq!(error.to_string(), format!("parse error: {expected}"));
+        }
+    }
+
+    #[tokio::test]
+    async fn void_responses_do_not_parse_successful_bodies() {
+        for status in [200, 201, 202, 204] {
+            AdminApiClient::parse_void_response(response(status, "not JSON"))
+                .await
+                .expect("successful void response");
+        }
+    }
+
+    #[tokio::test]
+    async fn typed_and_void_responses_preserve_http_errors() {
+        for status in [302, 400, 403, 404, 500] {
+            for body in ["", "plain error", r#"{"code":"FORBIDDEN"}"#] {
+                let typed = AdminApiClient::parse_response::<Value>(response(status, body))
+                    .await
+                    .map(drop);
+                let empty = AdminApiClient::parse_void_response(response(status, body)).await;
+                for result in [typed, empty] {
+                    let error = result.expect_err("unsuccessful response");
+                    assert_eq!(error.to_string(), format!("HTTP {status}: {body}"));
+                }
+            }
+        }
+    }
+}
@@ -9,24 +9,24 @@ impl AdminApiClient {
    pub async fn generate_gift_codes(
        &self,
        count: u32,
-        duration_type: &str,
+        duration_type: generated_types::GiftCodeDurationTypeSchema,
        duration_quantity: u32,
    ) -> ApiResult<CodesResponse> {
        let body = generated_types::GenerateGiftCodesRequest {
-            count: crate::api::generated::nonzero_u32(count, "count").map_err(ApiError::Parse)?,
+            count: crate::api::generated::nonzero_u32(count, "count")
+                .map_err(ApiError::Parse)?
+                .into(),
            duration_quantity: crate::api::generated::nonzero_u32(
                duration_quantity,
                "duration_quantity",
            )
-            .map_err(ApiError::Parse)?,
-            duration_type: generated_types::GenerateGiftCodesRequestDurationType::try_from(
-                duration_type,
-            )
-            .map_err(|e| ApiError::Parse(e.to_string()))?,
+            .map_err(ApiError::Parse)?
+            .into(),
+            duration_type,
        };
        let response = self
            .generated()
-            .generate_gift_codes(&body)
+            .create_admin_gift_codes(&body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{
@@ -13,11 +13,10 @@ impl AdminApiClient {
    ) -> ApiResult<Vec<DiscoveryPendingApplication>> {
        let response = self
            .generated()
-            .list_pending_discovery_applications()
+            .list_admin_discovery_applications()
            .await
            .map_err(|e| self.generated_error(e))?;
-        response
-            .into_inner()
+        Vec::from(response.into_inner())
            .into_iter()
            .map(pending_discovery_application)
            .collect()
@@ -26,11 +25,10 @@ impl AdminApiClient {
    pub async fn list_discovery_listed_guilds(&self) -> ApiResult<Vec<DiscoveryListedGuild>> {
        let response = self
            .generated()
-            .list_discovery_listed_guilds()
+            .list_admin_discovery_listings()
            .await
            .map_err(|e| self.generated_error(e))?;
-        response
-            .into_inner()
+        Vec::from(response.into_inner())
            .into_iter()
            .map(listed_guild)
            .collect()
@@ -41,16 +39,16 @@ impl AdminApiClient {
        guild_id: &str,
        reason: Option<&str>,
    ) -> ApiResult<DiscoveryApplicationResponse> {
-        let guild_id = generated_types::SnowflakeType::from(guild_id.to_owned());
-        let body = generated_types::DiscoveryAdminReviewRequest {
+        let guild_id = snowflake(guild_id);
+        let body = generated_types::DiscoveryAdminApplicationUpdateRequest::Approved {
            reason: reason
-                .map(generated_types::DiscoveryAdminReviewRequestReason::try_from)
+                .map(generated_types::DiscoveryReviewReason::try_from)
                .transpose()
                .map_err(|e| ApiError::Parse(e.to_string()))?,
        };
        let response = self
            .generated()
-            .approve_discovery_application(&guild_id, &body)
+            .update_admin_discovery_application(&guild_id, &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -61,14 +59,14 @@ impl AdminApiClient {
        guild_id: &str,
        reason: &str,
    ) -> ApiResult<DiscoveryApplicationResponse> {
-        let guild_id = generated_types::SnowflakeType::from(guild_id.to_owned());
-        let body = generated_types::DiscoveryAdminRejectRequest {
-            reason: generated_types::DiscoveryAdminRejectRequestReason::try_from(reason)
+        let guild_id = snowflake(guild_id);
+        let body = generated_types::DiscoveryAdminApplicationUpdateRequest::Rejected {
+            reason: generated_types::DiscoveryRejectionReason::try_from(reason)
                .map_err(|e| ApiError::Parse(e.to_string()))?,
        };
        let response = self
            .generated()
-            .reject_discovery_application(&guild_id, &body)
+            .update_admin_discovery_application(&guild_id, &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -79,14 +77,14 @@ impl AdminApiClient {
        guild_id: &str,
        reason: &str,
    ) -> ApiResult<DiscoveryApplicationResponse> {
-        let guild_id = generated_types::SnowflakeType::from(guild_id.to_owned());
+        let guild_id = snowflake(guild_id);
        let body = generated_types::DiscoveryAdminRemoveRequest {
            reason: generated_types::DiscoveryAdminRemoveRequestReason::try_from(reason)
                .map_err(|e| ApiError::Parse(e.to_string()))?,
        };
        let response = self
            .generated()
-            .remove_from_discovery(&guild_id, &body)
+            .delete_admin_discovery_listing(&guild_id, &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -1,5 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use progenitor_client::{ClientHooks, ClientInfo, Error, OperationInfo};
+use reqwest::header::HeaderMap;
+
 #[allow(
    clippy::all,
    unused_imports,
@@ -16,6 +19,24 @@ pub use inner::types;

 pub use inner::Client as GeneratedClient;

+impl ClientHooks<HeaderMap> for GeneratedClient {
+    async fn pre<E>(
+        &self,
+        request: &mut reqwest::Request,
+        _info: &OperationInfo,
+    ) -> Result<(), Error<E>> {
+        let headers = request.headers_mut();
+        for (name, value) in self.inner() {
+            headers.entry(name.clone()).or_insert_with(|| value.clone());
+        }
+        Ok(())
+    }
+}
+
+pub(crate) fn snowflake(value: &str) -> types::SnowflakeType {
+    types::SnowflakeType::Variant0(value.to_owned())
+}
+
 pub(crate) fn number_to_u64(value: f64, field: &str) -> Result<u64, String> {
    const MAX_SAFE_INTEGER: f64 = 9_007_199_254_740_991.0;
    if !value.is_finite() || value < 0.0 || value.fract() != 0.0 || value > MAX_SAFE_INTEGER {
@@ -32,8 +53,12 @@ pub(crate) fn nonzero_u32(value: u32, field: &str) -> Result<std::num::NonZeroU3
    std::num::NonZeroU32::new(value).ok_or_else(|| format!("{field} must be greater than zero"))
 }

-pub(crate) fn nonzero_u64(value: u64, field: &str) -> Result<std::num::NonZeroU64, String> {
-    std::num::NonZeroU64::new(value).ok_or_else(|| format!("{field} must be greater than zero"))
+pub(crate) fn deletion_reason_code(
+    value: i32,
+    field: &str,
+) -> Result<types::DeletionReasonCode, String> {
+    types::DeletionReasonCode::try_from(value)
+        .map_err(|_| format!("{field} is not a deletion reason code: {value}"))
 }

 #[cfg(test)]
@@ -122,10 +147,10 @@ mod tests {
        let response: SearchGuildsResponse =
            serde_json::from_value(json).expect("failed to deserialize SearchGuildsResponse");

-        assert_eq!(response.total as i64, 1);
+        assert_eq!(response.total, 1.0);
        assert_eq!(response.guilds.len(), 1);
        assert_eq!(response.guilds[0].name, "Test Guild");
-        assert_eq!(response.guilds[0].member_count, 42);
+        assert_eq!(*response.guilds[0].member_count, 42);
    }

    #[test]
@@ -1,16 +1,16 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::snowflake;

 use super::client::{AdminApiClient, ApiResult};
 use super::types::{ListGuildEmojisResponse, ListGuildStickersResponse};

 impl AdminApiClient {
    pub async fn list_guild_emojis(&self, guild_id: &str) -> ApiResult<ListGuildEmojisResponse> {
-        let guild_id = generated_types::SnowflakeType::from(guild_id.to_owned());
+        let guild_id = snowflake(guild_id);
        let response = self
            .generated()
-            .admin_list_guild_emojis(&guild_id)
+            .list_admin_guild_emojis(&guild_id)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -20,10 +20,10 @@ impl AdminApiClient {
        &self,
        guild_id: &str,
    ) -> ApiResult<ListGuildStickersResponse> {
-        let guild_id = generated_types::SnowflakeType::from(guild_id.to_owned());
+        let guild_id = snowflake(guild_id);
        let response = self
            .generated()
-            .admin_list_guild_stickers(&guild_id)
+            .list_admin_guild_stickers(&guild_id)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -1,9 +1,10 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};
 use serde::Deserialize;

 use super::client::{AdminApiClient, ApiError, ApiResult};
+use super::reports::SearchReportsParams;
 use super::types::{
    GuildAuditLogResponse, GuildDetailInfo, GuildInfo, GuildUpdateResponse,
    ListGuildMembersResponse, LookupGuildResponse, SearchGuildsResponse, SearchReportsResponse,
@@ -15,34 +16,21 @@ impl AdminApiClient {
        &self,
        query: &str,
        limit: u32,
-        offset: u32,
+        offset: u64,
    ) -> ApiResult<SearchGuildsResponse> {
-        let body = generated_types::SearchGuildsRequest {
-            limit: Some(
-                crate::api::generated::nonzero_u32(limit, "limit").map_err(ApiError::Parse)?,
-            ),
-            offset: Some(i64::from(offset)),
-            query: Some(query.to_owned()),
-        };
+        let limit = limit.to_string();
+        let offset = offset.to_string();
        let response = self
            .generated()
-            .search_guilds(&body)
+            .list_admin_guilds(Some(limit.as_str()), Some(offset.as_str()), Some(query))
            .await
            .map_err(|e| self.generated_error(e))?;
        search_guilds_response(response.into_inner())
    }

    pub async fn get_guild_by_id(&self, guild_id: &str) -> ApiResult<GuildInfo> {
-        let body = generated_types::LookupGuildRequest {
-            guild_id: snowflake(guild_id),
-        };
-        let response = self
-            .generated()
-            .lookup_guild(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        let resp: LookupGuildResponse = self.generated_value(response.into_inner())?;
-        resp.guild
+        self.lookup_guild(guild_id)
+            .await?
            .map(GuildInfo::from)
            .ok_or_else(|| super::client::ApiError::Http {
                status: 404,
@@ -51,12 +39,9 @@ impl AdminApiClient {
    }

    pub async fn lookup_guild(&self, guild_id: &str) -> ApiResult<Option<GuildDetailInfo>> {
-        let body = generated_types::LookupGuildRequest {
-            guild_id: snowflake(guild_id),
-        };
        let response = self
            .generated()
-            .lookup_guild(&body)
+            .get_admin_guild(&snowflake(guild_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: LookupGuildResponse = self.generated_value(response.into_inner())?;
@@ -69,26 +54,23 @@ impl AdminApiClient {
        add_features: &[String],
        remove_features: &[String],
    ) -> ApiResult<GuildUpdateResponse> {
-        let body = generated_types::UpdateGuildFeaturesRequest {
+        let body = generated_types::UpdateGuildRequest {
            add_features: guild_features(add_features),
-            guild_id: snowflake(guild_id),
            remove_features: guild_features(remove_features),
+            ..Default::default()
        };
        let response = self
            .generated()
-            .update_guild_features(&body)
+            .update_admin_guild(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }

    pub async fn delete_guild(&self, guild_id: &str) -> ApiResult<SuccessResponse> {
-        let body = generated_types::DeleteGuildRequest {
-            guild_id: snowflake(guild_id),
-        };
        let response = self
            .generated()
-            .admin_delete_guild(&body)
+            .delete_admin_guild(&snowflake(guild_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -99,13 +81,13 @@ impl AdminApiClient {
        guild_id: &str,
        new_owner_id: &str,
    ) -> ApiResult<GuildUpdateResponse> {
-        let body = generated_types::TransferGuildOwnershipRequest {
-            guild_id: snowflake(guild_id),
-            new_owner_id: snowflake(new_owner_id),
+        let body = generated_types::UpdateGuildRequest {
+            new_owner_id: Some(snowflake(new_owner_id)),
+            ..Default::default()
        };
        let response = self
            .generated()
-            .admin_transfer_guild_ownership(&body)
+            .update_admin_guild(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -115,45 +97,34 @@ impl AdminApiClient {
        &self,
        guild_id: &str,
        limit: u32,
-        offset: u32,
+        offset: u64,
    ) -> ApiResult<ListGuildMembersResponse> {
-        let body = generated_types::ListGuildMembersRequest {
-            guild_id: snowflake(guild_id),
-            limit: Some(
-                crate::api::generated::nonzero_u32(limit, "limit").map_err(ApiError::Parse)?,
-            ),
-            offset: Some(i64::from(offset)),
-        };
+        let limit = limit.to_string();
+        let offset = offset.to_string();
        let response = self
            .generated()
-            .admin_list_guild_members(&body)
+            .list_admin_guild_members(
+                &snowflake(guild_id),
+                Some(limit.as_str()),
+                Some(offset.as_str()),
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }

    pub async fn ban_guild_member(&self, guild_id: &str, user_id: &str) -> ApiResult<()> {
-        let body = generated_types::BanGuildMemberRequest {
-            ban_duration_seconds: None,
-            delete_message_days: None,
-            guild_id: snowflake(guild_id),
-            reason: None,
-            user_id: snowflake(user_id),
-        };
+        let body = generated_types::BanGuildMemberBody::default();
        self.generated()
-            .admin_ban_guild_member(&body)
+            .ban_admin_guild_member(&snowflake(guild_id), &snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
    }

    pub async fn kick_guild_member(&self, guild_id: &str, user_id: &str) -> ApiResult<()> {
-        let body = generated_types::KickGuildMemberRequest {
-            guild_id: snowflake(guild_id),
-            user_id: snowflake(user_id),
-        };
        self.generated()
-            .kick_guild_member(&body)
+            .kick_admin_guild_member(&snowflake(guild_id), &snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
@@ -165,21 +136,21 @@ impl AdminApiClient {
        limit: Option<u32>,
        before: Option<&str>,
    ) -> ApiResult<GuildAuditLogResponse> {
-        let body = generated_types::ListGuildAuditLogsRequest {
-            action_type: None,
-            after: None,
-            before: before.map(snowflake),
-            guild_id: snowflake(guild_id),
-            limit: limit
-                .map(i32::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?
-                .map(generated_types::Int32Type::from),
-            user_id: None,
-        };
+        let before = before.map(snowflake);
+        let limit = limit
+            .map(i32::try_from)
+            .transpose()
+            .map_err(|e| ApiError::Parse(e.to_string()))?;
        let response = self
            .generated()
-            .list_guild_audit_logs_admin(&body)
+            .list_admin_guild_audit_logs(
+                &snowflake(guild_id),
+                None,
+                None,
+                before.as_ref(),
+                limit,
+                None,
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -188,15 +159,15 @@ impl AdminApiClient {
    pub async fn clear_guild_fields(&self, guild_id: &str, fields: &[String]) -> ApiResult<()> {
        let fields = fields
            .iter()
-            .map(generated_types::ClearGuildFieldsRequestFieldsItem::try_from)
+            .map(|field| generated_types::UpdateGuildRequestFieldsItem::try_from(field.as_str()))
            .collect::<Result<Vec<_>, _>>()
            .map_err(|e| ApiError::Parse(e.to_string()))?;
-        let body = generated_types::ClearGuildFieldsRequest {
+        let body = generated_types::UpdateGuildRequest {
            fields,
-            guild_id: snowflake(guild_id),
+            ..Default::default()
        };
        self.generated()
-            .clear_guild_fields(&body)
+            .update_admin_guild(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
@@ -207,10 +178,10 @@ impl AdminApiClient {
        guild_id: &str,
        settings: &serde_json::Value,
    ) -> ApiResult<GuildUpdateResponse> {
-        let body = guild_settings_request(guild_id, settings)?;
+        let body = guild_settings_request(settings)?;
        let response = self
            .generated()
-            .update_guild_settings(&body)
+            .update_admin_guild(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        guild_update_response(response.into_inner())
@@ -221,13 +192,13 @@ impl AdminApiClient {
        guild_id: &str,
        name: &str,
    ) -> ApiResult<GuildUpdateResponse> {
-        let body = generated_types::UpdateGuildNameRequest {
-            guild_id: snowflake(guild_id),
-            name: name.to_owned(),
+        let body = generated_types::UpdateGuildRequest {
+            name: Some(name.to_owned()),
+            ..Default::default()
        };
        let response = self
            .generated()
-            .update_guild_name(&body)
+            .update_admin_guild(&snowflake(guild_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -238,37 +209,27 @@ impl AdminApiClient {
        guild_id: &str,
        vanity: Option<&str>,
    ) -> ApiResult<GuildUpdateResponse> {
-        let body = generated_types::UpdateGuildVanityRequest {
-            guild_id: snowflake(guild_id),
-            vanity_url_code: vanity.map(std::borrow::ToOwned::to_owned),
-        };
-        let response = self
-            .generated()
-            .update_guild_vanity(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        let body = serde_json::json!({"vanity_url_code": vanity});
+        self.patch(
+            &format!("/admin/guilds/{}", urlencoding::encode(guild_id)),
+            Some(&body),
+        )
+        .await
    }

    pub async fn reload_guild(&self, guild_id: &str) -> ApiResult<SuccessResponse> {
-        let body = generated_types::ReloadGuildRequest {
-            guild_id: snowflake(guild_id),
-        };
        let response = self
            .generated()
-            .reload_guild(&body)
+            .create_admin_guild_reload(&snowflake(guild_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }

    pub async fn shutdown_guild(&self, guild_id: &str) -> ApiResult<SuccessResponse> {
-        let body = generated_types::ShutdownGuildRequest {
-            guild_id: snowflake(guild_id),
-        };
        let response = self
            .generated()
-            .shutdown_guild(&body)
+            .create_admin_guild_shutdown(&snowflake(guild_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -279,13 +240,9 @@ impl AdminApiClient {
        user_id: &str,
        guild_id: &str,
    ) -> ApiResult<SuccessResponse> {
-        let body = generated_types::ForceAddUserToGuildRequest {
-            guild_id: snowflake(guild_id),
-            user_id: snowflake(user_id),
-        };
        let response = self
            .generated()
-            .force_add_user_to_guild(&body)
+            .add_admin_guild_member(&snowflake(guild_id), &snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -295,55 +252,29 @@ impl AdminApiClient {
        &self,
        guild_id: &str,
        limit: u32,
-        offset: u32,
+        offset: u64,
    ) -> ApiResult<SearchReportsResponse> {
-        let body = generated_types::SearchReportsRequest {
-            category: None,
-            guild_context_id: None,
-            limit: Some(
-                crate::api::generated::nonzero_u32(limit, "limit").map_err(ApiError::Parse)?,
-            ),
-            offset: Some(i64::from(offset)),
-            query: None,
-            report_type: None,
-            reported_channel_id: None,
-            reported_guild_id: Some(snowflake(guild_id)),
-            reported_user_id: None,
-            reporter_id: None,
-            resolved_by_admin_id: None,
-            sort_by: None,
-            sort_order: None,
-            status: None,
-        };
-        let response = self
-            .generated()
-            .search_reports(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        let response = response.into_inner();
-        Ok(SearchReportsResponse {
-            reports: self.generated_value(response.reports)?,
-            total: crate::api::generated::number_to_u64(response.total, "total")
-                .map_err(ApiError::Parse)?,
-            offset: crate::api::generated::number_to_u64(response.offset, "offset")
-                .map_err(ApiError::Parse)?,
-            limit: crate::api::generated::number_to_u64(response.limit, "limit")
-                .map_err(ApiError::Parse)?,
+        self.search_reports(&SearchReportsParams {
+            reported_guild_id: Some(guild_id),
+            limit,
+            offset,
+            ..Default::default()
        })
+        .await
    }
 }

 #[derive(Deserialize)]
 struct GuildSettingsPatch {
-    content_warning_level: Option<generated_types::ContentWarningLevel>,
+    content_warning_level: Option<generated_types::ContentWarningLevelInput>,
    content_warning_text: Option<String>,
-    default_message_notifications: Option<generated_types::DefaultMessageNotifications>,
+    default_message_notifications: Option<generated_types::DefaultMessageNotificationsInput>,
    disabled_operations: Option<generated_types::GuildOperations>,
-    explicit_content_filter: Option<generated_types::GuildExplicitContentFilter>,
-    mfa_level: Option<generated_types::GuildMfaLevel>,
+    explicit_content_filter: Option<generated_types::GuildExplicitContentFilterInput>,
+    mfa_level: Option<generated_types::GuildMfaLevelInput>,
    nsfw: Option<bool>,
-    nsfw_level: Option<generated_types::NsfwLevel>,
-    verification_level: Option<generated_types::GuildVerificationLevel>,
+    nsfw_level: Option<generated_types::NsfwLevelInput>,
+    verification_level: Option<generated_types::GuildVerificationLevelInput>,
 }

 fn search_guilds_response(
@@ -371,7 +302,7 @@ fn guild_admin_response(response: generated_types::GuildAdminResponse) -> ApiRes
        owner_global_name: response.owner_global_name,
        owner_discriminator: response.owner_discriminator,
        member_count: crate::api::generated::i64_to_u64(
-            i64::from(response.member_count),
+            i64::from(i32::from(response.member_count)),
            "member_count",
        )
        .map_err(ApiError::Parse)?,
@@ -379,7 +310,7 @@ fn guild_admin_response(response: generated_types::GuildAdminResponse) -> ApiRes
        nsfw_level: response.nsfw_level.map(i32::from),
        nsfw: response.nsfw,
        content_warning_level: response.content_warning_level.map(i32::from),
-        content_warning_text: response.content_warning_text,
+        content_warning_text: response.content_warning_text.map(String::from),
        description: None,
        vanity_url_code: None,
    })
@@ -392,9 +323,9 @@ fn guild_update_response(
    Ok(GuildUpdateResponse {
        guild: GuildInfo {
            id: String::from(guild.id),
-            name: guild.name,
-            icon: guild.icon,
-            banner: guild.banner,
+            name: String::from(guild.name),
+            icon: guild.icon.map(String::from),
+            banner: guild.banner.map(String::from),
            owner_id: String::from(guild.owner_id),
            owner_username: None,
            owner_global_name: None,
@@ -404,11 +335,11 @@ fn guild_update_response(
                "member_count",
            )
            .map_err(ApiError::Parse)?,
-            features: guild.features,
+            features: guild.features.into_iter().map(String::from).collect(),
            nsfw_level: guild.nsfw_level.map(i32::from),
            nsfw: guild.nsfw,
            content_warning_level: guild.content_warning_level.map(i32::from),
-            content_warning_text: guild.content_warning_text,
+            content_warning_text: guild.content_warning_text.map(String::from),
            description: None,
            vanity_url_code: None,
        },
@@ -416,29 +347,24 @@ fn guild_update_response(
 }

 fn guild_settings_request(
-    guild_id: &str,
    settings: &serde_json::Value,
-) -> ApiResult<generated_types::UpdateGuildSettingsRequest> {
+) -> ApiResult<generated_types::UpdateGuildRequest> {
    let patch = serde_json::from_value::<GuildSettingsPatch>(settings.clone())
        .map_err(|e| ApiError::Parse(e.to_string()))?;
-    Ok(generated_types::UpdateGuildSettingsRequest {
+    Ok(generated_types::UpdateGuildRequest {
        content_warning_level: patch.content_warning_level,
        content_warning_text: patch.content_warning_text,
        default_message_notifications: patch.default_message_notifications,
        disabled_operations: patch.disabled_operations,
        explicit_content_filter: patch.explicit_content_filter,
-        guild_id: snowflake(guild_id),
        mfa_level: patch.mfa_level,
        nsfw: patch.nsfw,
        nsfw_level: patch.nsfw_level,
        verification_level: patch.verification_level,
+        ..Default::default()
    })
 }

-fn snowflake(value: &str) -> generated_types::SnowflakeType {
-    generated_types::SnowflakeType::from(value.to_owned())
-}
-
 fn guild_features(values: &[String]) -> Vec<generated_types::GuildFeatureSchema> {
    values
        .iter()
@@ -458,9 +384,8 @@ mod tests {
            "nsfw": true,
            "verification_level": 2,
        });
-        let request = guild_settings_request("123", &settings).unwrap();
+        let request = guild_settings_request(&settings).unwrap();
        let json = serde_json::to_value(request).unwrap();
-        assert_eq!(json["guild_id"], "123");
        assert_eq!(json["disabled_operations"], 5);
        assert_eq!(json["nsfw"], true);
        assert_eq!(json["verification_level"], 2);
@@ -4,19 +4,18 @@ use super::client::{AdminApiClient, ApiResult};
 use super::types::{
    CreateRegistrationUrlRequest, CreateRegistrationUrlResponse, InstanceConfigResponse,
    InstanceConfigUpdateRequest, InstanceEmailSmtpTestRequest, InstanceEmailSmtpTestResponse,
-    PendingRegistrationActionRequest, RegistrationUrlActionRequest,
 };

 impl AdminApiClient {
    pub async fn get_instance_config(&self) -> ApiResult<InstanceConfigResponse> {
-        self.post("/admin/instance-config/get", None).await
+        self.get("/admin/instance/config", None).await
    }

    pub async fn update_instance_config(
        &self,
        update: &InstanceConfigUpdateRequest,
    ) -> ApiResult<InstanceConfigResponse> {
-        self.post_typed("/admin/instance-config/update", update)
+        self.patch_typed_with_reason("/admin/instance/config", update, None)
            .await
    }

@@ -24,7 +23,7 @@ impl AdminApiClient {
        &self,
        request: &InstanceEmailSmtpTestRequest,
    ) -> ApiResult<InstanceEmailSmtpTestResponse> {
-        self.post_typed("/admin/instance-config/integrations/smtp/test", request)
+        self.post_typed("/admin/instance/config/smtp-tests", request)
            .await
    }

@@ -32,40 +31,49 @@ impl AdminApiClient {
        &self,
        request: &CreateRegistrationUrlRequest,
    ) -> ApiResult<CreateRegistrationUrlResponse> {
-        self.post_typed("/admin/instance-config/registration-urls/create", request)
+        self.post_typed("/admin/instance/registration-urls", request)
            .await
    }

    pub async fn revoke_registration_url(&self, id: &str) -> ApiResult<InstanceConfigResponse> {
-        let request = RegistrationUrlActionRequest { id: id.to_owned() };
-        self.post_typed("/admin/instance-config/registration-urls/revoke", &request)
-            .await
+        self.delete_with_reason(
+            &format!(
+                "/admin/instance/registration-urls/{}",
+                urlencoding::encode(id)
+            ),
+            None,
+            None,
+        )
+        .await
    }

    pub async fn approve_pending_registration(
        &self,
        user_id: &str,
    ) -> ApiResult<InstanceConfigResponse> {
-        let request = PendingRegistrationActionRequest {
-            user_id: user_id.to_owned(),
-        };
-        self.post_typed(
-            "/admin/instance-config/pending-registrations/approve",
-            &request,
-        )
-        .await
+        self.decide_pending_registration(user_id, "approved").await
    }

    pub async fn reject_pending_registration(
        &self,
        user_id: &str,
    ) -> ApiResult<InstanceConfigResponse> {
-        let request = PendingRegistrationActionRequest {
-            user_id: user_id.to_owned(),
-        };
-        self.post_typed(
-            "/admin/instance-config/pending-registrations/reject",
-            &request,
+        self.decide_pending_registration(user_id, "rejected").await
+    }
+
+    async fn decide_pending_registration(
+        &self,
+        user_id: &str,
+        status: &str,
+    ) -> ApiResult<InstanceConfigResponse> {
+        let body = serde_json::json!({"status": status});
+        self.patch_with_reason(
+            &format!(
+                "/admin/instance/pending-registrations/{}",
+                urlencoding::encode(user_id)
+            ),
+            Some(&body),
+            None,
        )
        .await
    }
@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::snowflake;

-use super::client::{AdminApiClient, ApiError, ApiResult};
+use super::client::{AdminApiClient, ApiResult};
 use super::types::{ActiveJobsResponse, CancelJobResponse, GetJobResponse, ListJobsResponse};

 pub struct ListJobsParams {
@@ -16,51 +16,32 @@ pub struct ListJobsParams {

 impl AdminApiClient {
    pub async fn list_jobs(&self, params: &ListJobsParams) -> ApiResult<ListJobsResponse> {
-        let cursor = params
-            .cursor
-            .clone()
-            .map(serde_json::from_value::<generated_types::ListJobsRequestCursor>)
-            .transpose()
-            .map_err(|e| ApiError::Parse(e.to_string()))?;
-        let status = params
-            .status
-            .as_deref()
-            .map(generated_types::ListJobsRequestStatus::try_from)
-            .transpose()
-            .map_err(|e| ApiError::Parse(e.to_string()))?;
-        let body = generated_types::ListJobsRequest {
-            cursor,
-            limit: Some(
-                crate::api::generated::nonzero_u32(params.limit, "limit")
-                    .map_err(ApiError::Parse)?,
+        let cursor = params.cursor.as_ref();
+        let cursor_bucket_day = cursor_field(cursor, "bucket_day");
+        let cursor_created_at = cursor_field(cursor, "created_at");
+        let cursor_job_id = cursor_field(cursor, "job_id");
+        let limit = params.limit.to_string();
+        let max_lookback_days = params.max_lookback_days.to_string();
+        let query_params = [
+            ("limit", limit.as_str()),
+            ("cursor_bucket_day", cursor_bucket_day),
+            ("cursor_created_at", cursor_created_at),
+            ("cursor_job_id", cursor_job_id),
+            ("max_lookback_days", max_lookback_days.as_str()),
+            ("status", params.status.as_deref().unwrap_or_default()),
+            ("task_type", params.task_type.as_deref().unwrap_or_default()),
+            (
+                "requested_by_user_id",
+                params.requested_by_user_id.as_deref().unwrap_or_default(),
            ),
-            max_lookback_days: Some(
-                crate::api::generated::nonzero_u32(params.max_lookback_days, "max_lookback_days")
-                    .map_err(ApiError::Parse)?,
-            ),
-            requested_by_user_id: params
-                .requested_by_user_id
-                .as_ref()
-                .cloned()
-                .map(generated_types::SnowflakeType::from),
-            status,
-            task_type: params.task_type.clone(),
-        };
-        let response = self
-            .generated()
-            .list_jobs(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        ];
+        self.get("/admin/jobs", Some(&query_params)).await
    }

    pub async fn get_job(&self, job_id: &str) -> ApiResult<GetJobResponse> {
-        let body = generated_types::GetJobRequest {
-            job_id: generated_types::SnowflakeType::from(job_id.to_owned()),
-        };
        let response = self
            .generated()
-            .get_job(&body)
+            .get_admin_job(&snowflake(job_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -71,19 +52,27 @@ impl AdminApiClient {
        job_id: &str,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<CancelJobResponse> {
-        let body = generated_types::CancelJobRequest {
-            job_id: generated_types::SnowflakeType::from(job_id.to_owned()),
-        };
-        self.post_typed_with_reason("/admin/jobs/cancel", &body, audit_log_reason)
-            .await
+        self.put_with_reason(
+            &format!("/admin/jobs/{}/cancellation", urlencoding::encode(job_id)),
+            None,
+            audit_log_reason,
+        )
+        .await
    }

    pub async fn list_active_jobs(&self) -> ApiResult<ActiveJobsResponse> {
        let response = self
            .generated()
-            .list_active_jobs()
+            .list_admin_active_jobs()
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }
 }
+
+fn cursor_field<'a>(cursor: Option<&'a serde_json::Value>, field: &str) -> &'a str {
+    cursor
+        .and_then(|cursor| cursor.get(field))
+        .and_then(serde_json::Value::as_str)
+        .unwrap_or_default()
+}
@@ -5,14 +5,14 @@ use super::types::{LimitConfigResponse, LimitConfigUpdateRequest};

 impl AdminApiClient {
    pub async fn get_limit_config(&self) -> ApiResult<LimitConfigResponse> {
-        self.post("/admin/limit-config/get", Some(&serde_json::json!({})))
-            .await
+        self.get("/admin/limit-config", None).await
    }

    pub async fn update_limit_config(
        &self,
        request: &LimitConfigUpdateRequest,
    ) -> ApiResult<LimitConfigResponse> {
-        self.post_typed("/admin/limit-config/update", request).await
+        self.put_typed_with_reason("/admin/limit-config", request, None)
+            .await
    }
 }
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{
@@ -16,12 +16,16 @@ impl AdminApiClient {
        message_id: &str,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<()> {
-        let body = generated_types::DeleteMessageRequest {
-            channel_id: snowflake(channel_id),
-            message_id: snowflake(message_id),
-        };
        let _: serde_json::Value = self
-            .post_typed_with_reason("/admin/messages/delete", &body, audit_log_reason)
+            .delete_with_reason(
+                &format!(
+                    "/admin/channels/{}/messages/{}",
+                    urlencoding::encode(channel_id),
+                    urlencoding::encode(message_id)
+                ),
+                None,
+                audit_log_reason,
+            )
            .await?;
        Ok(())
    }
@@ -39,7 +43,8 @@ impl AdminApiClient {
            attachment_id: snowflake(attachment_id),
            channel_id: snowflake(channel_id),
            confirmed_viewed: true,
-            filename: filename.to_owned(),
+            filename: generated_types::ReportAttachmentToNcmecRequestFilename::try_from(filename)
+                .map_err(|e| ApiError::Parse(e.to_string()))?,
            message_id: snowflake(message_id),
            reporter_full_name:
                generated_types::ReportAttachmentToNcmecRequestReporterFullName::try_from(
@@ -50,7 +55,7 @@ impl AdminApiClient {
        };
        let response = self
            .generated()
-            .report_message_attachment_to_ncmec(&body)
+            .create_admin_ncmec_report(&body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -62,17 +67,14 @@ impl AdminApiClient {
        message_id: &str,
        context_limit: u32,
    ) -> ApiResult<LookupMessageResponse> {
-        let body = generated_types::LookupMessageRequest {
-            channel_id: snowflake(channel_id),
-            context_limit: Some(
-                crate::api::generated::nonzero_u32(context_limit, "context_limit")
-                    .map_err(ApiError::Parse)?,
-            ),
-            message_id: snowflake(message_id),
-        };
+        let context_limit = context_limit.to_string();
        let response = self
            .generated()
-            .lookup_message(&body)
+            .get_admin_message(
+                &snowflake(channel_id),
+                &snowflake(message_id),
+                Some(context_limit.as_str()),
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -86,16 +88,13 @@ impl AdminApiClient {
        let entries = entries
            .iter()
            .cloned()
-            .map(serde_json::from_value::<generated_types::MessageShredRequestEntriesItem>)
+            .map(serde_json::from_value::<generated_types::AdminUserMessageShredRequestEntriesItem>)
            .collect::<Result<Vec<_>, _>>()
            .map_err(|e| ApiError::Parse(e.to_string()))?;
-        let body = generated_types::MessageShredRequest {
-            entries,
-            user_id: snowflake(user_id),
-        };
+        let body = generated_types::AdminUserMessageShredRequest { entries };
        let response = self
            .generated()
-            .queue_message_shred(&body)
+            .shred_admin_user_messages(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -106,13 +105,10 @@ impl AdminApiClient {
        user_id: &str,
        dry_run: bool,
    ) -> ApiResult<DeleteAllUserMessagesResponse> {
-        let body = generated_types::DeleteAllUserMessagesRequest {
-            dry_run: Some(dry_run),
-            user_id: snowflake(user_id),
-        };
+        let dry_run = if dry_run { "true" } else { "false" };
        let response = self
            .generated()
-            .delete_all_user_messages(&body)
+            .delete_admin_user_messages(&snowflake(user_id), Some(dry_run))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -122,12 +118,9 @@ impl AdminApiClient {
        &self,
        job_id: &str,
    ) -> ApiResult<MessageShredStatusResponse> {
-        let body = generated_types::MessageShredStatusRequest {
-            job_id: job_id.to_owned(),
-        };
        let response = self
            .generated()
-            .get_message_shred_status(&body)
+            .get_admin_message_shred(&snowflake(job_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -140,18 +133,20 @@ impl AdminApiClient {
        filename: &str,
        context_limit: u32,
    ) -> ApiResult<LookupMessageResponse> {
-        let body = generated_types::LookupMessageByAttachmentRequest {
-            attachment_id: snowflake(attachment_id),
-            channel_id: snowflake(channel_id),
-            context_limit: Some(
-                crate::api::generated::nonzero_u32(context_limit, "context_limit")
-                    .map_err(ApiError::Parse)?,
-            ),
-            filename: filename.to_owned(),
-        };
+        let context_limit = context_limit.to_string();
+        let filename = generated_types::SearchAdminMessagesFilename::try_from(filename)
+            .map_err(|e| ApiError::Parse(e.to_string()))?;
        let response = self
            .generated()
-            .lookup_message_by_attachment(&body)
+            .search_admin_messages(
+                Some(&snowflake(attachment_id)),
+                &snowflake(channel_id),
+                Some(context_limit.as_str()),
+                Some(&filename),
+                None,
+                None,
+                None,
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -164,18 +159,17 @@ impl AdminApiClient {
        after: Option<&str>,
        limit: Option<u32>,
    ) -> ApiResult<BrowseChannelResponse> {
-        let body = generated_types::BrowseChannelRequest {
-            after: after.map(snowflake),
-            before: before.map(snowflake),
-            channel_id: snowflake(channel_id),
-            limit: limit
-                .map(|value| crate::api::generated::nonzero_u32(value, "limit"))
-                .transpose()
-                .map_err(ApiError::Parse)?,
-        };
+        let after = after.map(snowflake);
+        let before = before.map(snowflake);
+        let limit = limit.map(|value| value.to_string());
        let response = self
            .generated()
-            .browse_channel_messages(&body)
+            .list_admin_channel_messages(
+                &snowflake(channel_id),
+                after.as_ref(),
+                before.as_ref(),
+                limit.as_deref(),
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -187,24 +181,20 @@ impl AdminApiClient {
        query: &str,
        limit: Option<u32>,
    ) -> ApiResult<SearchChannelMessagesResponse> {
-        let body = generated_types::SearchChannelMessagesRequest {
-            channel_id: snowflake(channel_id),
-            limit: limit
-                .map(|value| crate::api::generated::nonzero_u32(value, "limit"))
-                .transpose()
-                .map_err(ApiError::Parse)?,
-            query: generated_types::SearchChannelMessagesRequestQuery::try_from(query)
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-        };
+        let limit = limit.map(|value| value.to_string());
        let response = self
            .generated()
-            .search_channel_messages(&body)
+            .search_admin_messages(
+                None,
+                &snowflake(channel_id),
+                None,
+                None,
+                limit.as_deref(),
+                None,
+                Some(query),
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }
 }
-
-fn snowflake(value: &str) -> generated_types::SnowflakeType {
-    generated_types::SnowflakeType::from(value.to_owned())
-}
@@ -8,7 +8,6 @@ pub mod archives;
 pub mod assets;
 pub mod audit;
 pub mod bans;
-pub mod billing;
 pub mod bulk;
 pub mod client;
 pub mod codes;
@@ -1,12 +1,30 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::snowflake;

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{
    ListReportsResponse, ReportEntry, ResolveReportResponse, SearchReportsResponse,
 };

+#[derive(Default)]
+pub struct SearchReportsParams<'a> {
+    pub query: Option<&'a str>,
+    pub status: Option<i32>,
+    pub report_type: Option<i32>,
+    pub category: Option<&'a str>,
+    pub reporter_id: Option<&'a str>,
+    pub reported_user_id: Option<&'a str>,
+    pub reported_guild_id: Option<&'a str>,
+    pub reported_channel_id: Option<&'a str>,
+    pub guild_context_id: Option<&'a str>,
+    pub resolved_by_admin_id: Option<&'a str>,
+    pub sort_by: Option<&'a str>,
+    pub sort_order: Option<&'a str>,
+    pub limit: u32,
+    pub offset: u64,
+}
+
 impl AdminApiClient {
    pub async fn list_reports(
        &self,
@@ -14,28 +32,21 @@ impl AdminApiClient {
        limit: u32,
        offset: Option<u32>,
    ) -> ApiResult<ListReportsResponse> {
-        let body = generated_types::ListReportsRequest {
-            limit: Some(
-                crate::api::generated::nonzero_u32(limit, "limit").map_err(ApiError::Parse)?,
-            ),
-            offset: offset.map(i64::from),
-            status: status
-                .map(generated_types::ReportStatus::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-        };
-        let response = self
-            .generated()
-            .list_reports(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        let status = status.map(report_status).transpose()?.unwrap_or_default();
+        let limit = limit.to_string();
+        let offset = offset.map(|value| value.to_string()).unwrap_or_default();
+        let query_params = [
+            ("status", status),
+            ("limit", limit.as_str()),
+            ("offset", offset.as_str()),
+        ];
+        self.get("/admin/reports", Some(&query_params)).await
    }

    pub async fn get_report(&self, report_id: &str) -> ApiResult<ReportEntry> {
        let response = self
            .generated()
-            .get_report(report_id)
+            .get_admin_report(&snowflake(report_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -47,98 +58,85 @@ impl AdminApiClient {
        public_comment: Option<&str>,
        audit_log_reason: Option<&str>,
    ) -> ApiResult<ResolveReportResponse> {
-        let body = generated_types::ResolveReportRequest {
-            public_comment: public_comment.map(std::borrow::ToOwned::to_owned),
-            report_id: generated_types::SnowflakeType::from(report_id.to_owned()),
-        };
-        self.post_typed_with_reason("/admin/reports/resolve", &body, audit_log_reason)
-            .await
+        let mut body = serde_json::json!({"status": "resolved"});
+        if let Some(public_comment) = public_comment {
+            body["public_comment"] = serde_json::Value::from(public_comment);
+        }
+        self.patch_with_reason(
+            &format!("/admin/reports/{}", urlencoding::encode(report_id)),
+            Some(&body),
+            audit_log_reason,
+        )
+        .await
    }

-    #[allow(clippy::too_many_arguments)]
    pub async fn search_reports(
        &self,
-        query: Option<&str>,
-        status: Option<i32>,
-        report_type: Option<i32>,
-        category: Option<&str>,
-        reporter_id: Option<&str>,
-        reported_user_id: Option<&str>,
-        reported_guild_id: Option<&str>,
-        reported_channel_id: Option<&str>,
-        guild_context_id: Option<&str>,
-        resolved_by_admin_id: Option<&str>,
-        sort_by: Option<&str>,
-        sort_order: Option<&str>,
-        limit: u32,
-        offset: u32,
+        params: &SearchReportsParams<'_>,
    ) -> ApiResult<SearchReportsResponse> {
-        let body = generated_types::SearchReportsRequest {
-            category: nonempty_string(category),
-            guild_context_id: nonempty_snowflake(guild_context_id),
-            limit: Some(
-                crate::api::generated::nonzero_u32(limit, "limit").map_err(ApiError::Parse)?,
+        let status = params
+            .status
+            .map(report_status)
+            .transpose()?
+            .unwrap_or_default();
+        let report_type = params
+            .report_type
+            .map(report_type_name)
+            .transpose()?
+            .unwrap_or_default();
+        let sort_by = params
+            .sort_by
+            .map(report_sort_by)
+            .transpose()?
+            .unwrap_or_default();
+        let limit = params.limit.to_string();
+        let offset = params.offset.to_string();
+        let query_params = [
+            ("q", params.query.unwrap_or_default()),
+            ("status", status),
+            ("report_type", report_type),
+            ("category", params.category.unwrap_or_default()),
+            ("reporter_id", params.reporter_id.unwrap_or_default()),
+            (
+                "reported_user_id",
+                params.reported_user_id.unwrap_or_default(),
            ),
-            offset: Some(i64::from(offset)),
-            query: nonempty_string(query),
-            report_type: report_type
-                .map(generated_types::ReportType::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-            reported_channel_id: nonempty_snowflake(reported_channel_id),
-            reported_guild_id: nonempty_snowflake(reported_guild_id),
-            reported_user_id: nonempty_snowflake(reported_user_id),
-            reporter_id: nonempty_snowflake(reporter_id),
-            resolved_by_admin_id: nonempty_snowflake(resolved_by_admin_id),
-            sort_by: sort_by
-                .map(generated_types::SearchReportsRequestSortBy::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-            sort_order: sort_order
-                .map(generated_types::SearchReportsRequestSortOrder::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-            status: status
-                .map(generated_types::ReportStatus::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-        };
-        let response = self
-            .generated()
-            .search_reports(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        let response = response.into_inner();
-        Ok(SearchReportsResponse {
-            reports: self.generated_value(response.reports)?,
-            total: response.total as u64,
-            offset: response.offset as u64,
-            limit: response.limit as u64,
-        })
+            (
+                "reported_guild_id",
+                params.reported_guild_id.unwrap_or_default(),
+            ),
+            (
+                "reported_channel_id",
+                params.reported_channel_id.unwrap_or_default(),
+            ),
+            (
+                "guild_context_id",
+                params.guild_context_id.unwrap_or_default(),
+            ),
+            (
+                "resolved_by_admin_id",
+                params.resolved_by_admin_id.unwrap_or_default(),
+            ),
+            ("sort_by", sort_by),
+            ("sort_order", params.sort_order.unwrap_or_default()),
+            ("limit", limit.as_str()),
+            ("offset", offset.as_str()),
+        ];
+        self.get("/admin/reports", Some(&query_params)).await
    }

    pub async fn search_reports_by_reporter(
        &self,
        reporter_id: &str,
        limit: u32,
-        offset: u32,
+        offset: u64,
    ) -> ApiResult<SearchReportsResponse> {
-        self.search_reports(
-            None,
-            None,
-            None,
-            None,
-            Some(reporter_id),
-            None,
-            None,
-            None,
-            None,
-            None,
-            None,
-            None,
+        self.search_reports(&SearchReportsParams {
+            reporter_id: Some(reporter_id),
            limit,
            offset,
-        )
+            ..Default::default()
+        })
        .await
    }

@@ -146,34 +144,100 @@ impl AdminApiClient {
        &self,
        reported_user_id: &str,
        limit: u32,
-        offset: u32,
+        offset: u64,
    ) -> ApiResult<SearchReportsResponse> {
-        self.search_reports(
-            None,
-            None,
-            None,
-            None,
-            None,
-            Some(reported_user_id),
-            None,
-            None,
-            None,
-            None,
-            None,
-            None,
+        self.search_reports(&SearchReportsParams {
+            reported_user_id: Some(reported_user_id),
            limit,
            offset,
-        )
+            ..Default::default()
+        })
        .await
    }
 }

-fn nonempty_string(value: Option<&str>) -> Option<String> {
-    value
-        .filter(|value| !value.is_empty())
-        .map(std::borrow::ToOwned::to_owned)
+fn report_status(value: i32) -> ApiResult<&'static str> {
+    match value {
+        0 => Ok("pending"),
+        1 => Ok("resolved"),
+        other => Err(ApiError::Parse(format!("unknown report status: {other}"))),
+    }
 }

-fn nonempty_snowflake(value: Option<&str>) -> Option<generated_types::SnowflakeType> {
-    nonempty_string(value).map(generated_types::SnowflakeType::from)
+fn report_type_name(value: i32) -> ApiResult<&'static str> {
+    match value {
+        0 => Ok("message"),
+        1 => Ok("user"),
+        2 => Ok("guild"),
+        other => Err(ApiError::Parse(format!("unknown report type: {other}"))),
+    }
+}
+
+fn report_sort_by(value: &str) -> ApiResult<&'static str> {
+    match value {
+        "created_at" | "createdAt" => Ok("created_at"),
+        "reported_at" | "reportedAt" => Ok("reported_at"),
+        "resolved_at" | "resolvedAt" => Ok("resolved_at"),
+        other => Err(ApiError::Parse(format!(
+            "unknown report sort field: {other}"
+        ))),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn report_statuses_preserve_the_closed_wire_mapping() {
+        for (value, expected) in [(0, "pending"), (1, "resolved")] {
+            assert_eq!(report_status(value).expect("supported status"), expected);
+        }
+        for value in [-1, 2] {
+            assert_eq!(
+                report_status(value)
+                    .expect_err("unknown status")
+                    .to_string(),
+                format!("parse error: unknown report status: {value}")
+            );
+        }
+    }
+
+    #[test]
+    fn report_types_preserve_the_closed_wire_mapping() {
+        for (value, expected) in [(0, "message"), (1, "user"), (2, "guild")] {
+            assert_eq!(report_type_name(value).expect("supported type"), expected);
+        }
+        for value in [-1, 3] {
+            assert_eq!(
+                report_type_name(value)
+                    .expect_err("unknown type")
+                    .to_string(),
+                format!("parse error: unknown report type: {value}")
+            );
+        }
+    }
+
+    #[test]
+    fn report_sort_fields_accept_only_the_existing_aliases() {
+        for (field, expected) in [
+            ("createdAt", "created_at"),
+            ("created_at", "created_at"),
+            ("reportedAt", "reported_at"),
+            ("reported_at", "reported_at"),
+            ("resolvedAt", "resolved_at"),
+            ("resolved_at", "resolved_at"),
+        ] {
+            assert_eq!(
+                report_sort_by(field).expect("supported sort field"),
+                expected
+            );
+        }
+        assert_eq!(
+            report_sort_by("unknown")
+                .expect_err("unknown sort field")
+                .to_string(),
+            "parse error: unknown report sort field: unknown"
+        );
+    }
 }
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{IndexRefreshStatusResponse, RefreshSearchIndexResponse};
@@ -11,15 +11,16 @@ impl AdminApiClient {
        index_type: &str,
        guild_id: Option<&str>,
    ) -> ApiResult<RefreshSearchIndexResponse> {
+        let index_type =
+            generated_types::CreateAdminSearchIndexRefreshIndexName::try_from(index_type)
+                .map_err(|e| ApiError::Parse(e.to_string()))?;
        let body = generated_types::RefreshSearchIndexRequest {
-            guild_id: guild_id.map(|id| generated_types::SnowflakeType::from(id.to_owned())),
-            index_type: generated_types::RefreshSearchIndexRequestIndexType::try_from(index_type)
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
+            guild_id: guild_id.map(snowflake),
            user_id: None,
        };
        let response = self
            .generated()
-            .refresh_search_index(&body)
+            .create_admin_search_index_refresh(index_type, &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -29,14 +30,90 @@ impl AdminApiClient {
        &self,
        job_id: &str,
    ) -> ApiResult<IndexRefreshStatusResponse> {
-        let body = generated_types::GetIndexRefreshStatusRequest {
-            job_id: job_id.to_owned(),
-        };
        let response = self
            .generated()
-            .get_search_index_refresh_status(&body)
+            .get_admin_search_index_refresh(job_id)
            .await
            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        index_refresh_status(response.into_inner())
+    }
+}
+
+fn index_refresh_status(
+    response: generated_types::IndexRefreshStatusResponse,
+) -> ApiResult<IndexRefreshStatusResponse> {
+    match response {
+        generated_types::IndexRefreshStatusResponse::Variant0 { status } => {
+            Ok(IndexRefreshStatusResponse::NotFound {
+                status: status.to_string(),
+            })
+        }
+        generated_types::IndexRefreshStatusResponse::Variant1 {
+            status,
+            index_type,
+            total,
+            indexed,
+            started_at,
+            completed_at,
+            failed_at,
+            error,
+        } => Ok(IndexRefreshStatusResponse::Progress {
+            status: status.to_string(),
+            index_type: Some(index_type),
+            total: total
+                .map(|value| float_to_u64(value, "total"))
+                .transpose()?,
+            indexed: indexed
+                .map(|value| float_to_u64(value, "indexed"))
+                .transpose()?,
+            started_at,
+            completed_at,
+            failed_at,
+            error,
+        }),
+    }
+}
+
+fn float_to_u64(value: f64, field: &str) -> ApiResult<u64> {
+    crate::api::generated::number_to_u64(value, field).map_err(ApiError::Parse)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn maps_a_running_refresh_to_progress() {
+        let json = r#"{"status":"in_progress","index_type":"users","total":50000,"indexed":1200,"started_at":"2026-09-06T00:00:00Z"}"#;
+        let response: generated_types::IndexRefreshStatusResponse =
+            serde_json::from_str(json).unwrap();
+        match index_refresh_status(response).unwrap() {
+            IndexRefreshStatusResponse::Progress {
+                status,
+                index_type,
+                total,
+                indexed,
+                started_at,
+                ..
+            } => {
+                assert_eq!(status, "in_progress");
+                assert_eq!(index_type.as_deref(), Some("users"));
+                assert_eq!(total, Some(50_000));
+                assert_eq!(indexed, Some(1_200));
+                assert_eq!(started_at.as_deref(), Some("2026-09-06T00:00:00Z"));
+            }
+            other => panic!("expected a progress status, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn maps_a_missing_refresh_to_not_found() {
+        let json = r#"{"status":"not_found"}"#;
+        let response: generated_types::IndexRefreshStatusResponse =
+            serde_json::from_str(json).unwrap();
+        match index_refresh_status(response).unwrap() {
+            IndexRefreshStatusResponse::NotFound { status } => assert_eq!(status, "not_found"),
+            other => panic!("expected a not found status, got {other:?}"),
+        }
    }
 }
@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

-use super::client::{AdminApiClient, ApiError, ApiResult};
+use super::client::{AdminApiClient, ApiResult};
 use super::types::{
    GatewayVoiceStateCountsResponse, GuildMemoryStatsResponse, NodeStatsResponse,
    ReloadAllGuildsResponse,
@@ -10,12 +10,10 @@ use super::types::{

 impl AdminApiClient {
    pub async fn get_guild_memory_stats(&self, limit: u32) -> ApiResult<GuildMemoryStatsResponse> {
-        let body = generated_types::GetProcessMemoryStatsRequest {
-            limit: Some(i32::try_from(limit).map_err(|e| ApiError::Parse(e.to_string()))?),
-        };
+        let limit = limit.to_string();
        let response = self
            .generated()
-            .get_guild_memory_statistics(&body)
+            .get_admin_gateway_memory_stats(Some(limit.as_str()))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -26,15 +24,11 @@ impl AdminApiClient {
        guild_ids: &[String],
    ) -> ApiResult<ReloadAllGuildsResponse> {
        let body = generated_types::ReloadGuildsRequest {
-            guild_ids: guild_ids
-                .iter()
-                .cloned()
-                .map(generated_types::SnowflakeType::from)
-                .collect(),
+            guild_ids: guild_ids.iter().map(|id| snowflake(id)).collect(),
        };
        let response = self
            .generated()
-            .reload_all_specified_guilds(&body)
+            .create_admin_gateway_reload(&body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -43,7 +37,7 @@ impl AdminApiClient {
    pub async fn get_node_stats(&self) -> ApiResult<NodeStatsResponse> {
        let response = self
            .generated()
-            .get_gateway_node_statistics()
+            .get_admin_gateway_stats()
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -54,7 +48,7 @@ impl AdminApiClient {
    ) -> ApiResult<GatewayVoiceStateCountsResponse> {
        let response = self
            .generated()
-            .get_gateway_voice_state_counts()
+            .get_admin_gateway_voice_state_counts()
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::SendSystemDmResponse;
@@ -14,15 +14,11 @@ impl AdminApiClient {
        let body = generated_types::SendSystemDmRequest {
            content: generated_types::SendSystemDmRequestContent::try_from(content)
                .map_err(|e| ApiError::Parse(e.to_string()))?,
-            user_ids: user_ids
-                .iter()
-                .cloned()
-                .map(generated_types::SnowflakeType::from)
-                .collect(),
+            user_ids: user_ids.iter().map(|id| snowflake(id)).collect(),
        };
        let response = self
            .generated()
-            .send_system_dm(&body)
+            .create_admin_system_dm(&body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -9,6 +9,8 @@ pub struct AuditLogEntry {
    #[serde(default)]
    pub admin_user: Option<AuditLogUserSummary>,
    pub action: String,
+    #[serde(default)]
+    pub access: Option<String>,
    pub target_id: String,
    pub target_type: String,
    #[serde(default)]
@@ -1,39 +0,0 @@
-// SPDX-License-Identifier: AGPL-3.0-or-later
-
-use serde::{Deserialize, Serialize};
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct BillingOverview {
-    #[serde(flatten)]
-    pub data: serde_json::Value,
-}
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct PaymentListResponse {
-    #[serde(flatten)]
-    pub data: serde_json::Value,
-}
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct SubscriptionResponse {
-    #[serde(flatten)]
-    pub data: serde_json::Value,
-}
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct PaymentMethodListResponse {
-    #[serde(flatten)]
-    pub data: serde_json::Value,
-}
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct InvoiceListResponse {
-    #[serde(flatten)]
-    pub data: serde_json::Value,
-}
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct RefundCancelResponse {
-    #[serde(flatten)]
-    pub data: serde_json::Value,
-}
@@ -6,8 +6,14 @@ pub fn deserialize_discriminator<'de, D: Deserializer<'de>>(d: D) -> Result<Stri
    let v: serde_json::Value = Deserialize::deserialize(d)?;
    match v {
        serde_json::Value::String(s) => Ok(format!("{:0>4}", s)),
-        serde_json::Value::Number(n) => Ok(format!("{:04}", n.as_u64().unwrap_or(0))),
-        _ => Ok("0000".to_owned()),
+        serde_json::Value::Number(n) => n
+            .as_u64()
+            .map(|value| format!("{value:04}"))
+            .ok_or_else(|| serde::de::Error::custom("expected an unsigned integer discriminator")),
+        serde_json::Value::Null => Ok("0000".to_owned()),
+        _ => Err(serde::de::Error::custom(
+            "expected string or unsigned integer discriminator",
+        )),
    }
 }

@@ -15,7 +21,9 @@ pub fn deserialize_string_or_u64<'de, D: Deserializer<'de>>(d: D) -> Result<u64,
    let v: serde_json::Value = Deserialize::deserialize(d)?;
    match v {
        serde_json::Value::String(s) => s.parse::<u64>().map_err(serde::de::Error::custom),
-        serde_json::Value::Number(n) => Ok(n.as_u64().unwrap_or(0)),
+        serde_json::Value::Number(n) => n
+            .as_u64()
+            .ok_or_else(|| serde::de::Error::custom("expected an unsigned 64-bit integer")),
        serde_json::Value::Null => Ok(0),
        _ => Err(serde::de::Error::custom("expected string or number")),
    }
@@ -2,6 +2,8 @@

 use serde::{Deserialize, Serialize};

+pub use crate::api::generated::types::VoiceNoiseSuppressionBackendSchema as NoiseSuppressionBackend;
+
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct InstanceConfigResponse {
    pub sso: SsoConfigResponse,
@@ -18,6 +20,10 @@ pub struct InstanceConfigResponse {
    pub integrations: InstanceIntegrationsResponse,
    #[serde(default)]
    pub media: InstanceMediaResponse,
+    #[serde(default)]
+    pub voice_noise_suppression: VoiceNoiseSuppressionConfigResponse,
+    #[serde(default)]
+    pub experiment_delivery: ExperimentDeliveryConfigResponse,
 }

 #[derive(Clone, Debug, Deserialize, Serialize)]
@@ -320,6 +326,8 @@ pub struct AppBrandingConfigResponse {
    pub wordmark_url: Option<String>,
    pub favicon_url: Option<String>,
    pub theme_color: Option<String>,
+    pub status_page_url: Option<String>,
+    pub status_page_incident_history_url: Option<String>,
 }

 impl Default for AppBrandingConfigResponse {
@@ -332,6 +340,8 @@ impl Default for AppBrandingConfigResponse {
            wordmark_url: None,
            favicon_url: None,
            theme_color: None,
+            status_page_url: None,
+            status_page_incident_history_url: None,
        }
    }
 }
@@ -436,6 +446,121 @@ impl VoiceE2eeScope {
    }
 }

+pub const VOICE_NS_MAX_TARGETED_USERS: usize = 1_000;
+pub const VOICE_NS_MAX_GUILD_OVERRIDES: usize = 200;
+
+impl NoiseSuppressionBackend {
+    pub const ALL: [Self; 7] = [
+        Self::None,
+        Self::Standard,
+        Self::Gate,
+        Self::Speex,
+        Self::Rnnoise,
+        Self::Gtcrn,
+        Self::DeepFilter,
+    ];
+
+    pub fn label(&self) -> &'static str {
+        match self {
+            Self::None => "None (pass-through)",
+            Self::Standard => "Standard (WebRTC)",
+            Self::Gate => "Noise gate",
+            Self::Speex => "Speex",
+            Self::Rnnoise => "RNNoise",
+            Self::Gtcrn => "GTCRN",
+            Self::DeepFilter => "DeepFilterNet",
+        }
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct VoiceNoiseSuppressionGuildOverride {
+    pub guild_id: String,
+    pub backend: NoiseSuppressionBackend,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(default)]
+pub struct VoiceNoiseSuppressionConfigResponse {
+    pub enabled: bool,
+    pub config_version: u64,
+    pub default_backend: NoiseSuppressionBackend,
+    pub enabled_backends: Vec<NoiseSuppressionBackend>,
+    pub allow_user_override: bool,
+    pub rollout_basis_points: u32,
+    pub rollout_salt: String,
+    pub included_user_ids: Vec<String>,
+    pub excluded_user_ids: Vec<String>,
+    pub guild_overrides: Vec<VoiceNoiseSuppressionGuildOverride>,
+    pub suppression_strength: u32,
+}
+
+impl Default for VoiceNoiseSuppressionConfigResponse {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            config_version: 0,
+            default_backend: NoiseSuppressionBackend::Standard,
+            enabled_backends: NoiseSuppressionBackend::ALL.to_vec(),
+            allow_user_override: true,
+            rollout_basis_points: 0,
+            rollout_salt: "voice-ns-v1".to_owned(),
+            included_user_ids: Vec::new(),
+            excluded_user_ids: Vec::new(),
+            guild_overrides: Vec::new(),
+            suppression_strength: 80,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Default, Serialize)]
+pub struct VoiceNoiseSuppressionConfigUpdateRequest {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enabled: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub default_backend: Option<NoiseSuppressionBackend>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enabled_backends: Option<Vec<NoiseSuppressionBackend>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub allow_user_override: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub rollout_basis_points: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub rollout_salt: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub included_user_ids: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub excluded_user_ids: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub guild_overrides: Option<Vec<VoiceNoiseSuppressionGuildOverride>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub suppression_strength: Option<u32>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(default)]
+pub struct ExperimentDeliveryConfigResponse {
+    pub poll_interval_seconds: u64,
+    pub poll_jitter_percent: u32,
+}
+
+impl Default for ExperimentDeliveryConfigResponse {
+    fn default() -> Self {
+        Self {
+            poll_interval_seconds: 300,
+            poll_jitter_percent: 15,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Default, Serialize)]
+pub struct ExperimentDeliveryConfigUpdateRequest {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub poll_interval_seconds: Option<u64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub poll_jitter_percent: Option<u32>,
+}
+
 #[derive(Clone, Debug, Deserialize, Serialize)]
 pub struct InstanceRegistrationResponse {
    pub mode: RegistrationMode,
@@ -525,6 +650,10 @@ pub struct InstanceConfigUpdateRequest {
    pub integrations: Option<InstanceIntegrationsUpdateRequest>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub media: Option<InstanceMediaUpdateRequest>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub voice_noise_suppression: Option<VoiceNoiseSuppressionConfigUpdateRequest>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub experiment_delivery: Option<ExperimentDeliveryConfigUpdateRequest>,
 }

 #[derive(Clone, Debug, Default, Serialize)]
@@ -729,6 +858,10 @@ pub struct AppBrandingConfigUpdateRequest {
    pub favicon_url: Option<Option<String>>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub theme_color: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status_page_url: Option<Option<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status_page_incident_history_url: Option<Option<String>>,
 }

 #[derive(Clone, Debug, Default, Serialize)]
@@ -827,12 +960,88 @@ pub struct CreateRegistrationUrlResponse {
    pub url: String,
 }

-#[derive(Clone, Debug, Serialize)]
-pub struct RegistrationUrlActionRequest {
-    pub id: String,
-}
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::api::generated::types as generated_types;
+    use serde_json::json;

-#[derive(Clone, Debug, Serialize)]
-pub struct PendingRegistrationActionRequest {
-    pub user_id: String,
+    #[test]
+    fn noise_suppression_backend_choices_use_the_generated_wire_contract() {
+        assert_eq!(
+            serde_json::to_value(NoiseSuppressionBackend::ALL).expect("serializable backends"),
+            json!([
+                "none",
+                "standard",
+                "gate",
+                "speex",
+                "rnnoise",
+                "gtcrn",
+                "deep_filter"
+            ])
+        );
+        assert!(serde_json::from_value::<NoiseSuppressionBackend>(json!("deepfilter")).is_err());
+    }
+
+    #[test]
+    fn default_instance_experiment_config_matches_the_published_contract() {
+        let schema: serde_json::Value =
+            serde_json::from_str(include_str!("../../../openapi-admin.json"))
+                .expect("admin schema");
+        let noise = serde_json::from_value::<VoiceNoiseSuppressionConfigResponse>(json!({}))
+            .expect("default noise config");
+        let delivery = serde_json::from_value::<ExperimentDeliveryConfigResponse>(json!({}))
+            .expect("default delivery config");
+        let noise = serde_json::to_value(noise).expect("serializable noise config");
+        let delivery = serde_json::to_value(delivery).expect("serializable delivery config");
+        let generated_noise: generated_types::VoiceNoiseSuppressionConfigResponse =
+            serde_json::from_value(noise.clone()).expect("generated noise config contract");
+        let generated_delivery: generated_types::ExperimentDeliveryConfigResponse =
+            serde_json::from_value(delivery.clone()).expect("generated delivery config contract");
+        assert_eq!(
+            serde_json::to_value(generated_noise).expect("serializable generated noise config"),
+            noise
+        );
+        assert_eq!(
+            serde_json::to_value(generated_delivery)
+                .expect("serializable generated delivery config"),
+            delivery
+        );
+        for (name, value) in [
+            ("VoiceNoiseSuppressionConfigResponse", noise),
+            ("ExperimentDeliveryConfigResponse", delivery),
+        ] {
+            for (field, value) in value.as_object().expect("config object") {
+                assert_eq!(
+                    value, &schema["components"]["schemas"][name]["properties"][field]["default"],
+                    "{name}.{field}"
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn noise_suppression_update_preserves_empty_lists_and_omitted_fields() {
+        let update = VoiceNoiseSuppressionConfigUpdateRequest {
+            enabled_backends: Some(Vec::new()),
+            included_user_ids: Some(Vec::new()),
+            excluded_user_ids: Some(Vec::new()),
+            guild_overrides: Some(Vec::new()),
+            ..Default::default()
+        };
+        let value = serde_json::to_value(update).expect("serializable update");
+        serde_json::from_value::<generated_types::VoiceNoiseSuppressionConfigUpdateRequest>(
+            value.clone(),
+        )
+        .expect("generated update contract");
+        assert_eq!(
+            value,
+            json!({"enabled_backends": [], "included_user_ids": [], "excluded_user_ids": [], "guild_overrides": []})
+        );
+        assert_eq!(
+            serde_json::to_value(VoiceNoiseSuppressionConfigUpdateRequest::default())
+                .expect("serializable update"),
+            json!({})
+        );
+    }
 }
@@ -4,7 +4,6 @@ mod admin_api_keys;
 mod applications;
 mod archives;
 mod audit;
-mod billing;
 mod bulk;
 mod codes;
 mod common;
@@ -24,7 +23,6 @@ pub use admin_api_keys::*;
 pub use applications::*;
 pub use archives::*;
 pub use audit::*;
-pub use billing::*;
 pub use bulk::*;
 pub use codes::*;
 pub use common::*;
@@ -28,6 +28,7 @@ pub struct VoiceServer {
    pub latitude: Option<f64>,
    pub longitude: Option<f64>,
    pub is_active: Option<bool>,
+    pub soft_connection_limit: Option<i64>,
    pub vip_only: Option<bool>,
    #[serde(default)]
    pub required_guild_features: Vec<String>,
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::generated::types as generated_types;
+use crate::api::generated::{snowflake, types as generated_types};

 use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{
@@ -15,34 +15,35 @@ impl AdminApiClient {
        email: Option<&str>,
        last_active_ip: Option<&str>,
        limit: u32,
-        offset: u32,
+        offset: u64,
    ) -> ApiResult<SearchUsersResponse> {
-        let body = generated_types::SearchUsersRequest {
-            email: nonempty_string(email),
-            last_active_ip: nonempty_string(last_active_ip),
-            limit: Some(
-                crate::api::generated::nonzero_u32(limit, "limit").map_err(ApiError::Parse)?,
-            ),
-            offset: Some(i64::from(offset)),
-            query: nonempty_string(query),
-        };
+        let limit = limit.to_string();
+        let offset = offset.to_string();
        let response = self
            .generated()
-            .search_users(&body)
+            .list_admin_users(
+                nonempty(email),
+                nonempty(last_active_ip),
+                Some(limit.as_str()),
+                Some(offset.as_str()),
+                nonempty(query),
+                None,
+                None,
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        let response = response.into_inner();
        Ok(SearchUsersResponse {
            users: self.generated_value(response.users)?,
-            total: response.total as u64,
+            total: crate::api::generated::number_to_u64(response.total, "total")
+                .map_err(ApiError::Parse)?,
        })
    }

    pub async fn lookup_user(&self, query: &str) -> ApiResult<Option<AdminUser>> {
-        let body = generated_types::LookupUserRequest::Query(query.to_owned());
        let response = self
            .generated()
-            .lookup_user(&body)
+            .list_admin_users(None, None, None, None, None, Some(query), None)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: LookupUserResponse = self.generated_value(response.into_inner())?;
@@ -53,27 +54,18 @@ impl AdminApiClient {
        if user_ids.is_empty() {
            return Ok(vec![]);
        }
-        let body = generated_types::LookupUserRequest::UserIds(
-            user_ids
-                .iter()
-                .cloned()
-                .map(generated_types::SnowflakeType::from)
-                .collect(),
-        );
-        let response = self
-            .generated()
-            .lookup_user(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        let resp: LookupUserResponse = self.generated_value(response.into_inner())?;
+        let query_params: Vec<(&str, &str)> = user_ids
+            .iter()
+            .map(|user_id| ("user_id", user_id.as_str()))
+            .collect();
+        let resp: LookupUserResponse = self.get("/admin/users", Some(&query_params)).await?;
        Ok(resp.users)
    }

    pub async fn get_user_by_id(&self, user_id: &str) -> ApiResult<AdminUser> {
-        let body = generated_types::LookupUserRequest::Query(user_id.to_owned());
        let response = self
            .generated()
-            .lookup_user(&body)
+            .get_admin_user(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: LookupUserResponse = self.generated_value(response.into_inner())?;
@@ -89,7 +81,7 @@ impl AdminApiClient {
    pub async fn get_current_admin(&self) -> ApiResult<AdminUser> {
        let response = self
            .generated()
-            .get_authenticated_admin_user()
+            .get_current_admin_user()
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: AdminUserMeResponse = self.generated_value(response.into_inner())?;
@@ -102,14 +94,13 @@ impl AdminApiClient {
        add_flags: &[String],
        remove_flags: &[String],
    ) -> ApiResult<AdminUser> {
-        let body = generated_types::UpdateUserFlagsRequest {
-            add_flags: user_flags(add_flags),
-            remove_flags: user_flags(remove_flags),
-            user_id: snowflake(user_id),
+        let body = generated_types::AdminUserFlagsUpdateRequest {
+            add_flags: user_flags(add_flags)?,
+            remove_flags: user_flags(remove_flags)?,
        };
        let response = self
            .generated()
-            .update_user_flags(&body)
+            .update_admin_user_flags(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -124,19 +115,19 @@ impl AdminApiClient {
        after: Option<&str>,
        with_counts: Option<bool>,
    ) -> ApiResult<Vec<GuildInfo>> {
-        let body = generated_types::ListUserGuildsRequest {
-            after: after.map(|id| generated_types::SnowflakeType::from(id.to_owned())),
-            before: before.map(|id| generated_types::SnowflakeType::from(id.to_owned())),
-            limit: Some(
-                crate::api::generated::nonzero_u32(limit.unwrap_or(200), "limit")
-                    .map_err(ApiError::Parse)?,
-            ),
-            user_id: generated_types::SnowflakeType::from(user_id.to_owned()),
-            with_counts: Some(with_counts.unwrap_or(true)),
-        };
+        let after = after.map(snowflake);
+        let before = before.map(snowflake);
+        let limit = limit.unwrap_or(200).to_string();
+        let with_counts = bool_param(with_counts.unwrap_or(true));
        let response = self
            .generated()
-            .list_user_guilds(&body)
+            .list_admin_user_guilds(
+                &snowflake(user_id),
+                after.as_ref(),
+                before.as_ref(),
+                Some(limit.as_str()),
+                Some(with_counts),
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: ListUserGuildsResponse = self.generated_value(response.into_inner())?;
@@ -147,12 +138,9 @@ impl AdminApiClient {
        &self,
        user_id: &str,
    ) -> ApiResult<super::types::ListUserSessionsResponse> {
-        let body = generated_types::ListUserSessionsRequest {
-            user_id: generated_types::SnowflakeType::from(user_id.to_owned()),
-        };
        let response = self
            .generated()
-            .list_user_sessions(&body)
+            .list_admin_user_sessions(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -162,12 +150,9 @@ impl AdminApiClient {
        &self,
        user_id: &str,
    ) -> ApiResult<TerminateSessionsResponse> {
-        let body = generated_types::TerminateSessionsRequest {
-            user_id: snowflake(user_id),
-        };
        let response = self
            .generated()
-            .terminate_user_sessions(&body)
+            .terminate_admin_user_sessions(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -177,12 +162,9 @@ impl AdminApiClient {
        &self,
        user_id: &str,
    ) -> ApiResult<super::types::ListUserRelationshipsResponse> {
-        let body = generated_types::ListUserRelationshipsRequest {
-            user_id: generated_types::SnowflakeType::from(user_id.to_owned()),
-        };
        let response = self
            .generated()
-            .admin_list_user_relationships(&body)
+            .list_admin_user_relationships(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -195,18 +177,18 @@ impl AdminApiClient {
        after: Option<&str>,
        limit: Option<u32>,
    ) -> ApiResult<super::types::ListUserDmChannelsResponse> {
-        let body = generated_types::ListUserDmChannelsRequest {
-            after: after.map(|id| generated_types::SnowflakeType::from(id.to_owned())),
-            before: before.map(|id| generated_types::SnowflakeType::from(id.to_owned())),
-            limit: Some(
-                crate::api::generated::nonzero_u32(limit.unwrap_or(50), "limit")
-                    .map_err(ApiError::Parse)?,
-            ),
-            user_id: generated_types::SnowflakeType::from(user_id.to_owned()),
-        };
+        let after = after.map(snowflake);
+        let before = before.map(snowflake);
+        let limit = limit.unwrap_or(50).to_string();
        let response = self
            .generated()
-            .list_user_dm_channels(&body)
+            .list_admin_user_dm_channels(
+                &snowflake(user_id),
+                after.as_ref(),
+                before.as_ref(),
+                Some(limit.as_str()),
+                Some(generated_types::AdminUserDmChannelType::Dm),
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -216,12 +198,15 @@ impl AdminApiClient {
        &self,
        user_id: &str,
    ) -> ApiResult<super::types::ListUserGroupDmChannelsResponse> {
-        let body = generated_types::ListUserGroupDmChannelsRequest {
-            user_id: generated_types::SnowflakeType::from(user_id.to_owned()),
-        };
        let response = self
            .generated()
-            .list_user_group_dm_channels(&body)
+            .list_admin_user_dm_channels(
+                &snowflake(user_id),
+                None,
+                None,
+                None,
+                Some(generated_types::AdminUserDmChannelType::GroupDm),
+            )
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -233,14 +218,13 @@ impl AdminApiClient {
        add_flags: &[i32],
        remove_flags: &[i32],
    ) -> ApiResult<AdminUser> {
-        let body = generated_types::UpdatePremiumFlagsRequest {
+        let body = generated_types::AdminUserPremiumFlagsUpdateRequest {
            add_flags: premium_flags(add_flags),
            remove_flags: premium_flags(remove_flags),
-            user_id: snowflake(user_id),
        };
        let response = self
            .generated()
-            .update_user_premium_flags(&body)
+            .update_admin_user_premium_flags(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -248,13 +232,12 @@ impl AdminApiClient {
    }

    pub async fn update_suspicious_flags(&self, user_id: &str, flags: i32) -> ApiResult<AdminUser> {
-        let body = generated_types::UpdateSuspiciousActivityFlagsRequest {
+        let body = generated_types::AdminUserSuspiciousActivityFlagsRequest {
            flags: generated_types::SuspiciousActivityFlags::from(flags),
-            user_id: snowflake(user_id),
        };
        let response = self
            .generated()
-            .update_suspicious_activity_flags(&body)
+            .update_admin_user_suspicious_activity_flags(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -262,13 +245,12 @@ impl AdminApiClient {
    }

    pub async fn set_user_acls(&self, user_id: &str, acls: &[String]) -> ApiResult<AdminUser> {
-        let body = generated_types::SetUserAclsRequest {
-            acls: acls.to_vec(),
-            user_id: snowflake(user_id),
+        let body = generated_types::AdminUserAclsRequest {
+            acls: super::admin_api_keys::parse_acls(acls)?,
        };
        let response = self
            .generated()
-            .set_user_acls(&body)
+            .set_admin_user_acls(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -276,13 +258,12 @@ impl AdminApiClient {
    }

    pub async fn set_user_traits(&self, user_id: &str, traits: &[String]) -> ApiResult<AdminUser> {
-        let body = generated_types::SetUserTraitsRequest {
+        let body = generated_types::AdminUserTraitsRequest {
            traits: traits.to_vec(),
-            user_id: snowflake(user_id),
        };
        let response = self
            .generated()
-            .set_user_traits(&body)
+            .set_admin_user_traits(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -290,34 +271,25 @@ impl AdminApiClient {
    }

    pub async fn disable_mfa(&self, user_id: &str) -> ApiResult<()> {
-        let body = generated_types::DisableMfaRequest {
-            user_id: snowflake(user_id),
-        };
        self.generated()
-            .disable_user_mfa(&body)
+            .disable_admin_user_mfa(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
    }

    pub async fn resend_verification_email(&self, user_id: &str) -> ApiResult<()> {
-        let body = generated_types::ResendVerificationEmailRequest {
-            user_id: snowflake(user_id),
-        };
        self.generated()
-            .admin_resend_verification_email(&body)
+            .resend_admin_user_verification_email(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
    }

    pub async fn verify_email(&self, user_id: &str) -> ApiResult<AdminUser> {
-        let body = generated_types::VerifyUserEmailRequest {
-            user_id: snowflake(user_id),
-        };
        let response = self
            .generated()
-            .verify_user_email(&body)
+            .verify_admin_user_email(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -329,13 +301,10 @@ impl AdminApiClient {
        user_id: &str,
        has_verified_phone: bool,
    ) -> ApiResult<AdminUser> {
-        let body = generated_types::UpdateHasVerifiedPhoneRequest {
-            has_verified_phone,
-            user_id: snowflake(user_id),
-        };
+        let body = generated_types::AdminUserPhoneVerificationRequest { has_verified_phone };
        let response = self
            .generated()
-            .update_user_has_verified_phone(&body)
+            .update_admin_user_phone_verification(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -349,16 +318,15 @@ impl AdminApiClient {
    ) -> ApiResult<AdminUser> {
        let fields = fields
            .iter()
-            .map(generated_types::ClearUserFieldsRequestFieldsItem::try_from)
+            .map(|field| {
+                generated_types::AdminUserClearFieldsRequestFieldsItem::try_from(field.as_str())
+            })
            .collect::<Result<Vec<_>, _>>()
            .map_err(|e| ApiError::Parse(e.to_string()))?;
-        let body = generated_types::ClearUserFieldsRequest {
-            fields,
-            user_id: snowflake(user_id),
-        };
+        let body = generated_types::AdminUserClearFieldsRequest { fields };
        let response = self
            .generated()
-            .clear_user_fields(&body)
+            .clear_admin_user_profile_fields(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -366,13 +334,10 @@ impl AdminApiClient {
    }

    pub async fn set_bot_status(&self, user_id: &str, is_bot: bool) -> ApiResult<AdminUser> {
-        let body = generated_types::SetUserBotStatusRequest {
-            bot: is_bot,
-            user_id: snowflake(user_id),
-        };
+        let body = generated_types::AdminUserBotStatusRequest { bot: is_bot };
        let response = self
            .generated()
-            .set_user_bot_status(&body)
+            .set_admin_user_bot_status(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -380,13 +345,10 @@ impl AdminApiClient {
    }

    pub async fn set_system_status(&self, user_id: &str, is_system: bool) -> ApiResult<AdminUser> {
-        let body = generated_types::SetUserSystemStatusRequest {
-            system: is_system,
-            user_id: snowflake(user_id),
-        };
+        let body = generated_types::AdminUserSystemStatusRequest { system: is_system };
        let response = self
            .generated()
-            .set_user_system_status(&body)
+            .set_admin_user_system_status(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -399,18 +361,14 @@ impl AdminApiClient {
        username: &str,
        discriminator: Option<&str>,
    ) -> ApiResult<AdminUser> {
-        let body = generated_types::ChangeUsernameRequest {
+        let body = generated_types::AdminUserUsernameUpdateRequest {
            discriminator: discriminator
-                .map(generated_types::DiscriminatorType::try_from)
-                .transpose()
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-            user_id: snowflake(user_id),
-            username: generated_types::UsernameType::try_from(username)
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
+                .map(|value| generated_types::DiscriminatorType::String(value.to_owned())),
+            username: generated_types::UsernameType::from(username.to_owned()),
        };
        let response = self
            .generated()
-            .change_user_username(&body)
+            .update_admin_user_username(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -418,13 +376,12 @@ impl AdminApiClient {
    }

    pub async fn change_email(&self, user_id: &str, email: &str) -> ApiResult<AdminUser> {
-        let body = generated_types::ChangeEmailRequest {
+        let body = generated_types::AdminUserEmailUpdateRequest {
            email: generated_types::EmailType::from(email.to_owned()),
-            user_id: snowflake(user_id),
        };
        let response = self
            .generated()
-            .change_user_email(&body)
+            .update_admin_user_email(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -438,25 +395,26 @@ impl AdminApiClient {
        reason: Option<&str>,
        private_reason: Option<&str>,
    ) -> ApiResult<AdminUser> {
-        let body = generated_types::TempBanUserRequest {
+        let body = generated_types::AdminUserBanRequest {
            duration_hours: i32::try_from(duration_hours)
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
+                .map_err(|e| ApiError::Parse(e.to_string()))?
+                .into(),
            reason: reason.map(std::borrow::ToOwned::to_owned),
-            user_id: snowflake(user_id),
        };
        let resp: UserMutationResponse = self
-            .post_typed_with_reason("/admin/users/temp-ban", &body, private_reason)
+            .put_typed_with_reason(
+                &format!("/admin/users/{}/ban", urlencoding::encode(user_id)),
+                &body,
+                private_reason,
+            )
            .await?;
        Ok(resp.user)
    }

    pub async fn unban_user(&self, user_id: &str) -> ApiResult<AdminUser> {
-        let body = generated_types::DisableMfaRequest {
-            user_id: snowflake(user_id),
-        };
        let response = self
            .generated()
-            .unban_user(&body)
+            .unban_admin_user(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -469,32 +427,32 @@ impl AdminApiClient {
        reason_code: i32,
        public_reason: Option<&str>,
        days_until_deletion: u32,
+        audit_log_reason: Option<&str>,
    ) -> ApiResult<AdminUser> {
-        let body = generated_types::ScheduleAccountDeletionRequest {
-            days_until_deletion: Some(
-                crate::api::generated::nonzero_u32(days_until_deletion, "days_until_deletion")
-                    .map_err(ApiError::Parse)?,
-            ),
+        let body = generated_types::AdminUserDeletionScheduleRequest {
+            days_until_deletion: crate::api::generated::nonzero_u32(
+                days_until_deletion,
+                "days_until_deletion",
+            )
+            .map_err(ApiError::Parse)?
+            .into(),
            public_reason: public_reason.map(std::borrow::ToOwned::to_owned),
-            reason_code,
-            user_id: snowflake(user_id),
+            reason_code: crate::api::generated::deletion_reason_code(reason_code, "reason_code")
+                .map_err(ApiError::Parse)?,
        };
        let response = self
-            .generated()
-            .schedule_account_deletion(&body)
+            .generated_with_reason(audit_log_reason)?
+            .schedule_admin_user_deletion(&snowflake(user_id), &body)
            .await
-            .map_err(|e| self.generated_error(e))?;
+            .map_err(|error| self.generated_error(error))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
        Ok(resp.user)
    }

    pub async fn cancel_deletion(&self, user_id: &str) -> ApiResult<AdminUser> {
-        let body = generated_types::DisableMfaRequest {
-            user_id: snowflake(user_id),
-        };
        let response = self
            .generated()
-            .cancel_account_deletion(&body)
+            .cancel_admin_user_deletion(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -502,13 +460,12 @@ impl AdminApiClient {
    }

    pub async fn change_dob(&self, user_id: &str, dob: &str) -> ApiResult<AdminUser> {
-        let body = generated_types::ChangeDobRequest {
+        let body = generated_types::AdminUserDobUpdateRequest {
            date_of_birth: dob.to_owned(),
-            user_id: snowflake(user_id),
        };
        let response = self
            .generated()
-            .change_user_dob(&body)
+            .update_admin_user_date_of_birth(&snowflake(user_id), &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -516,11 +473,8 @@ impl AdminApiClient {
    }

    pub async fn send_password_reset(&self, user_id: &str) -> ApiResult<()> {
-        let body = generated_types::SendPasswordResetRequest {
-            user_id: snowflake(user_id),
-        };
        self.generated()
-            .send_password_reset(&body)
+            .send_admin_user_password_reset(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
@@ -532,14 +486,10 @@ impl AdminApiClient {
        target_id: &str,
        category: &str,
    ) -> ApiResult<()> {
-        let body = generated_types::RemoveUserRelationshipRequest {
-            category: generated_types::RemoveUserRelationshipRequestCategory::try_from(category)
-                .map_err(|e| ApiError::Parse(e.to_string()))?,
-            target_user_id: snowflake(target_id),
-            user_id: snowflake(user_id),
-        };
+        let category = generated_types::RelationshipCategoryEnum::try_from(category)
+            .map_err(|e| ApiError::Parse(e.to_string()))?;
        self.generated()
-            .remove_user_relationship(&body)
+            .remove_admin_user_relationship(&snowflake(user_id), &snowflake(target_id), category)
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
@@ -550,16 +500,11 @@ impl AdminApiClient {
        user_id: &str,
        category: &str,
    ) -> ApiResult<super::types::RemoveRelationshipsResponse> {
-        let body = generated_types::RemoveUserRelationshipsByCategoryRequest {
-            category: generated_types::RemoveUserRelationshipsByCategoryRequestCategory::try_from(
-                category,
-            )
-            .map_err(|e| ApiError::Parse(e.to_string()))?,
-            user_id: snowflake(user_id),
-        };
+        let category = generated_types::RelationshipCategoryEnum::try_from(category)
+            .map_err(|e| ApiError::Parse(e.to_string()))?;
        let response = self
            .generated()
-            .remove_user_relationships_by_category(&body)
+            .clear_admin_user_relationships(&snowflake(user_id), category)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -570,12 +515,8 @@ impl AdminApiClient {
        user_id: &str,
        credential_id: &str,
    ) -> ApiResult<()> {
-        let body = generated_types::DeleteWebAuthnCredentialRequest {
-            credential_id: credential_id.to_owned(),
-            user_id: snowflake(user_id),
-        };
        self.generated()
-            .delete_user_webauthn_credential(&body)
+            .delete_admin_user_webauthn_credential(&snowflake(user_id), credential_id)
            .await
            .map_err(|e| self.generated_error(e))?;
        Ok(())
@@ -586,17 +527,10 @@ impl AdminApiClient {
        user_id: &str,
        limit: Option<u32>,
    ) -> ApiResult<super::types::ListUserChangeLogResponse> {
-        let body = generated_types::ListUserChangeLogRequest {
-            limit: Some(
-                crate::api::generated::nonzero_u32(limit.unwrap_or(50), "limit")
-                    .map_err(ApiError::Parse)?,
-            ),
-            page_token: None,
-            user_id: generated_types::SnowflakeType::from(user_id.to_owned()),
-        };
+        let limit = limit.unwrap_or(50).to_string();
        let response = self
            .generated()
-            .get_user_change_log(&body)
+            .list_admin_user_change_log(&snowflake(user_id), Some(limit.as_str()), None)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -606,24 +540,18 @@ impl AdminApiClient {
        &self,
        user_id: &str,
    ) -> ApiResult<super::types::WebAuthnCredentialListResponse> {
-        let body = generated_types::ListWebAuthnCredentialsRequest {
-            user_id: generated_types::SnowflakeType::from(user_id.to_owned()),
-        };
        let response = self
            .generated()
-            .list_user_webauthn_credentials(&body)
+            .list_admin_user_webauthn_credentials(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }

    pub async fn cancel_bulk_message_deletion(&self, user_id: &str) -> ApiResult<AdminUser> {
-        let body = generated_types::CancelBulkMessageDeletionRequest {
-            user_id: snowflake(user_id),
-        };
        let response = self
            .generated()
-            .admin_cancel_bulk_message_deletion(&body)
+            .cancel_admin_user_message_deletion(&snowflake(user_id))
            .await
            .map_err(|e| self.generated_error(e))?;
        let resp: UserMutationResponse = self.generated_value(response.into_inner())?;
@@ -631,21 +559,21 @@ impl AdminApiClient {
    }
 }

-fn nonempty_string(value: Option<&str>) -> Option<String> {
-    value
-        .filter(|value| !value.is_empty())
-        .map(std::borrow::ToOwned::to_owned)
+fn nonempty(value: Option<&str>) -> Option<&str> {
+    value.filter(|value| !value.is_empty())
 }

-fn snowflake(value: &str) -> generated_types::SnowflakeType {
-    generated_types::SnowflakeType::from(value.to_owned())
+fn bool_param(value: bool) -> &'static str {
+    if value { "true" } else { "false" }
 }

-fn user_flags(values: &[String]) -> Vec<generated_types::UserFlags> {
+fn user_flags(values: &[String]) -> ApiResult<Vec<generated_types::UserFlags>> {
    values
        .iter()
-        .cloned()
-        .map(generated_types::UserFlags::from)
+        .map(|value| {
+            generated_types::UserFlags::try_from(value.as_str())
+                .map_err(|error| ApiError::Parse(error.to_string()))
+        })
        .collect()
 }

@@ -14,12 +14,9 @@ impl AdminApiClient {
        &self,
        include_servers: bool,
    ) -> ApiResult<ListVoiceRegionsResponse> {
-        let body = generated_types::ListVoiceRegionsRequest {
-            include_servers: Some(include_servers),
-        };
        let response = self
            .generated()
-            .list_voice_regions(&body)
+            .list_admin_voice_regions(Some(bool_param(include_servers)))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -30,13 +27,9 @@ impl AdminApiClient {
        id: &str,
        include_servers: bool,
    ) -> ApiResult<GetVoiceRegionResponse> {
-        let body = generated_types::GetVoiceRegionRequest {
-            id: id.to_owned(),
-            include_servers: Some(include_servers),
-        };
        let response = self
            .generated()
-            .get_voice_region(&body)
+            .get_admin_voice_region(id, Some(bool_param(include_servers)))
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -51,7 +44,7 @@ impl AdminApiClient {
                .map_err(|e| ApiError::Parse(e.to_string()))?;
        let response = self
            .generated()
-            .create_voice_region(&body)
+            .create_admin_voice_region(&body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -61,34 +54,30 @@ impl AdminApiClient {
        &self,
        params: &serde_json::Value,
    ) -> ApiResult<UpdateVoiceRegionResponse> {
-        let body =
-            serde_json::from_value::<generated_types::UpdateVoiceRegionRequest>(params.clone())
-                .map_err(|e| ApiError::Parse(e.to_string()))?;
-        let response = self
-            .generated()
-            .update_voice_region(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        let region_id = required_field(params, "id")?;
+        let body = voice_request_body(params, &["id"])?;
+        validate_against::<generated_types::UpdateVoiceRegionRequestBody>(&body)?;
+        self.patch_with_reason(
+            &format!("/admin/voice/regions/{}", urlencoding::encode(&region_id)),
+            Some(&body),
+            None,
+        )
+        .await
    }

    pub async fn delete_voice_region(&self, id: &str) -> ApiResult<DeleteVoiceResponse> {
-        let body = generated_types::DeleteVoiceRegionRequest { id: id.to_owned() };
        let response = self
            .generated()
-            .delete_voice_region(&body)
+            .delete_admin_voice_region(id)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }

    pub async fn list_voice_servers(&self, region_id: &str) -> ApiResult<ListVoiceServersResponse> {
-        let body = generated_types::ListVoiceServersRequest {
-            region_id: region_id.to_owned(),
-        };
        let response = self
            .generated()
-            .list_voice_servers(&body)
+            .list_admin_voice_servers(region_id)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -99,13 +88,9 @@ impl AdminApiClient {
        region_id: &str,
        server_id: &str,
    ) -> ApiResult<GetVoiceServerResponse> {
-        let body = generated_types::GetVoiceServerRequest {
-            region_id: region_id.to_owned(),
-            server_id: server_id.to_owned(),
-        };
        let response = self
            .generated()
-            .get_voice_server(&body)
+            .get_admin_voice_server(region_id, server_id)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -115,12 +100,15 @@ impl AdminApiClient {
        &self,
        params: &serde_json::Value,
    ) -> ApiResult<CreateVoiceServerResponse> {
-        let body =
-            serde_json::from_value::<generated_types::CreateVoiceServerRequest>(params.clone())
-                .map_err(|e| ApiError::Parse(e.to_string()))?;
+        let region_id = required_field(params, "region_id")?;
+        paired_coordinates(params)?;
+        let body = serde_json::from_value::<generated_types::CreateVoiceServerRequestBody>(
+            voice_request_body(params, &["region_id"])?,
+        )
+        .map_err(|e| ApiError::Parse(e.to_string()))?;
        let response = self
            .generated()
-            .create_voice_server(&body)
+            .create_admin_voice_server(&region_id, &body)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
@@ -130,15 +118,21 @@ impl AdminApiClient {
        &self,
        params: &serde_json::Value,
    ) -> ApiResult<UpdateVoiceServerResponse> {
-        let body =
-            serde_json::from_value::<generated_types::UpdateVoiceServerRequest>(params.clone())
-                .map_err(|e| ApiError::Parse(e.to_string()))?;
-        let response = self
-            .generated()
-            .update_voice_server(&body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        let region_id = required_field(params, "region_id")?;
+        let server_id = required_field(params, "server_id")?;
+        paired_coordinates(params)?;
+        let body = voice_request_body(params, &["region_id", "server_id"])?;
+        validate_against::<generated_types::UpdateVoiceServerRequestBody>(&body)?;
+        self.patch_with_reason(
+            &format!(
+                "/admin/voice/regions/{}/servers/{}",
+                urlencoding::encode(&region_id),
+                urlencoding::encode(&server_id)
+            ),
+            Some(&body),
+            None,
+        )
+        .await
    }

    pub async fn delete_voice_server(
@@ -146,15 +140,118 @@ impl AdminApiClient {
        region_id: &str,
        server_id: &str,
    ) -> ApiResult<DeleteVoiceResponse> {
-        let body = generated_types::DeleteVoiceServerRequest {
-            region_id: region_id.to_owned(),
-            server_id: server_id.to_owned(),
-        };
        let response = self
            .generated()
-            .delete_voice_server(&body)
+            .delete_admin_voice_server(region_id, server_id)
            .await
            .map_err(|e| self.generated_error(e))?;
        self.generated_value(response.into_inner())
    }
 }
+
+fn bool_param(value: bool) -> &'static str {
+    if value { "true" } else { "false" }
+}
+
+fn validate_against<T: serde::de::DeserializeOwned>(params: &serde_json::Value) -> ApiResult<()> {
+    serde_json::from_value::<T>(params.clone())
+        .map(drop)
+        .map_err(|e| ApiError::Parse(e.to_string()))
+}
+
+fn voice_request_body(
+    params: &serde_json::Value,
+    path_fields: &[&str],
+) -> ApiResult<serde_json::Value> {
+    let mut body = params
+        .as_object()
+        .ok_or_else(|| ApiError::Parse("voice request body must be an object".to_owned()))?
+        .clone();
+    for field in path_fields {
+        body.remove(*field);
+    }
+    Ok(body.into())
+}
+
+fn paired_coordinates(params: &serde_json::Value) -> ApiResult<()> {
+    let has_coordinate = |field: &str| params.get(field).is_some_and(|value| !value.is_null());
+    if has_coordinate("latitude") == has_coordinate("longitude") {
+        Ok(())
+    } else {
+        Err(ApiError::Parse(
+            "latitude and longitude must both be set or both be left empty".to_owned(),
+        ))
+    }
+}
+
+fn required_field(params: &serde_json::Value, field: &str) -> ApiResult<String> {
+    params
+        .get(field)
+        .and_then(serde_json::Value::as_str)
+        .map(std::borrow::ToOwned::to_owned)
+        .ok_or_else(|| ApiError::Parse(format!("{field} is required")))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn region_update_body_preserves_explicit_restriction_clears() {
+        let expected = json!({
+            "required_guild_features": [],
+            "allowed_guild_ids": [],
+            "allowed_user_ids": [],
+        });
+        let mut params = expected.clone();
+        params["id"] = json!("eu");
+        let body = voice_request_body(&params, &["id"]).expect("region body");
+        validate_against::<generated_types::UpdateVoiceRegionRequestBody>(&body)
+            .expect("valid region body");
+        assert_eq!(body, expected);
+    }
+
+    #[test]
+    fn server_update_body_preserves_clears_and_omitted_restrictions() {
+        for expected in [
+            json!({
+                "required_guild_features": [],
+                "allowed_guild_ids": [],
+                "allowed_user_ids": [],
+                "soft_connection_limit": null,
+                "latitude": null,
+                "longitude": null,
+            }),
+            json!({"is_active": false}),
+        ] {
+            let mut params = expected.clone();
+            params["region_id"] = json!("eu");
+            params["server_id"] = json!("primary");
+            let body =
+                voice_request_body(&params, &["region_id", "server_id"]).expect("server body");
+            validate_against::<generated_types::UpdateVoiceServerRequestBody>(&body)
+                .expect("valid server body");
+            assert_eq!(body, expected);
+        }
+    }
+
+    #[test]
+    fn create_server_body_keeps_the_server_id_and_rejects_missing_fields() {
+        let expected = json!({
+            "server_id": "primary",
+            "endpoint": "wss://voice.example.com",
+            "api_key": "key",
+            "api_secret": "secret",
+        });
+        let mut params = expected.clone();
+        params["region_id"] = json!("eu");
+        let body = voice_request_body(&params, &["region_id"]).expect("server body");
+        validate_against::<generated_types::CreateVoiceServerRequestBody>(&body)
+            .expect("valid server body");
+        assert_eq!(body, expected);
+        assert!(
+            validate_against::<generated_types::CreateVoiceServerRequestBody>(&json!({})).is_err()
+        );
+    }
+}
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

+use fluxer_common::config::normalize_public_endpoint_from_env;
 use std::env;

 const DEFAULT_ADMIN_OAUTH_CLIENT_ID: &str = "1234567890123456789";
@@ -40,40 +41,47 @@ pub enum RuntimeEnv {
 }

 impl AdminConfig {
-    pub fn from_env() -> Self {
+    pub fn from_env() -> anyhow::Result<Self> {
        let base_path = normalize_base_path(&read_env("FLUXER_ADMIN_BASE_PATH", ""));
-        let admin_endpoint = trim_trailing_slash(&read_env(
+        let admin_endpoint = normalize_public_endpoint_from_env(&trim_trailing_slash(&read_env(
            "FLUXER_ADMIN_ENDPOINT",
            "https://admin.fluxer.app",
-        ));
-        let oauth_redirect_uri = read_env_preferred(
+        )));
+        let oauth_redirect_uri = normalize_public_endpoint_from_env(&read_env_preferred(
            &["FLUXER_ADMIN_OAUTH_REDIRECT_URI"],
            &format!("{admin_endpoint}/oauth2_callback"),
+        ));
+        let secret_key_base = read_env("FLUXER_ADMIN_SECRET_KEY_BASE", "");
+        anyhow::ensure!(
+            !secret_key_base.trim().is_empty(),
+            "FLUXER_ADMIN_SECRET_KEY_BASE is required"
        );

-        Self {
+        Ok(Self {
            env: RuntimeEnv::from_env_value(&read_env("FLUXER_ENV", "development")),
            host: read_env("FLUXER_ADMIN_HOST", "0.0.0.0"),
            port: read_env("FLUXER_ADMIN_PORT", "3020")
                .parse()
                .unwrap_or(3020),
-            secret_key_base: read_env("FLUXER_ADMIN_SECRET_KEY_BASE", "development-admin-secret"),
+            secret_key_base,
            base_path,
            api_endpoint: trim_trailing_slash(&read_env(
                "FLUXER_API_ENDPOINT",
                "https://api.fluxer.app",
            )),
-            media_endpoint: trim_trailing_slash(&read_env(
+            media_endpoint: normalize_public_endpoint_from_env(&trim_trailing_slash(&read_env(
                "FLUXER_MEDIA_ENDPOINT",
                "https://media.fluxer.app",
+            ))),
+            static_cdn_endpoint: normalize_public_endpoint_from_env(&trim_trailing_slash(
+                &read_env("FLUXER_STATIC_CDN_ENDPOINT", ""),
            )),
-            static_cdn_endpoint: trim_trailing_slash(&read_env("FLUXER_STATIC_CDN_ENDPOINT", "")),

            admin_endpoint,
-            web_app_endpoint: trim_trailing_slash(&read_env(
+            web_app_endpoint: normalize_public_endpoint_from_env(&trim_trailing_slash(&read_env(
                "FLUXER_APP_ENDPOINT",
                "https://app.fluxer.app",
-            )),
+            ))),
            kv_url: read_env("FLUXER_KV_URL", ""),
            oauth_client_id: read_env(
                "FLUXER_ADMIN_OAUTH_CLIENT_ID",
@@ -107,7 +115,7 @@ impl AdminConfig {
                .trim()
                .to_ascii_lowercase(),
            },
-        }
+        })
    }

    pub fn is_dev(&self) -> bool {
@@ -117,6 +125,15 @@ impl AdminConfig {
    pub fn is_production(&self) -> bool {
        self.env == RuntimeEnv::Production
    }
+
+    pub fn secure_cookies(&self) -> bool {
+        self.admin_endpoint.starts_with("https://")
+    }
+
+    pub fn admin_origin(&self) -> Option<String> {
+        let origin = url::Url::parse(&self.admin_endpoint).ok()?.origin();
+        origin.is_tuple().then(|| origin.ascii_serialization())
+    }
 }

 impl RuntimeEnv {
@@ -166,6 +183,41 @@ pub(crate) fn read_bool_env(names: &[&str], fallback: bool) -> bool {
 #[cfg(test)]
 mod tests {
    use super::*;
+    use std::sync::Mutex;
+
+    static ENV_LOCK: Mutex<()> = Mutex::new(());
+
+    const MANAGED_ENV: [&str; 11] = [
+        "FLUXER_ENV",
+        "FLUXER_ADMIN_HOST",
+        "FLUXER_ADMIN_PORT",
+        "FLUXER_ADMIN_ENDPOINT",
+        "FLUXER_ADMIN_OAUTH_CLIENT_ID",
+        "FLUXER_ADMIN_OAUTH_REDIRECT_URI",
+        "FLUXER_MASTER_CONFIG",
+        "FLUXER_APP_ENDPOINT",
+        "FLUXER_MEDIA_ENDPOINT",
+        "FLUXER_STATIC_CDN_ENDPOINT",
+        "FLUXER_BASE_DOMAIN",
+    ];
+
+    fn config_from_env(vars: &[(&str, &str)]) -> AdminConfig {
+        let _guard = ENV_LOCK.lock().unwrap();
+        for name in MANAGED_ENV {
+            unsafe { env::remove_var(name) };
+        }
+        unsafe { env::remove_var("FLUXER_PUBLIC_PORT") };
+        unsafe { env::remove_var("FLUXER_PUBLIC_ORIGIN") };
+        unsafe { env::set_var("FLUXER_ADMIN_SECRET_KEY_BASE", "test-secret") };
+        for (name, value) in vars {
+            unsafe { env::set_var(name, value) };
+        }
+        let config = AdminConfig::from_env().expect("config loads with a secret");
+        for (name, _) in vars {
+            unsafe { env::remove_var(name) };
+        }
+        config
+    }

    #[test]
    fn normalize_base_path_strips_trailing_slashes() {
@@ -287,18 +339,7 @@ mod tests {

    #[test]
    fn from_env_uses_defaults() {
-        for var in &[
-            "FLUXER_ENV",
-            "FLUXER_ADMIN_HOST",
-            "FLUXER_ADMIN_PORT",
-            "FLUXER_ADMIN_ENDPOINT",
-            "FLUXER_ADMIN_OAUTH_CLIENT_ID",
-            "FLUXER_ADMIN_OAUTH_REDIRECT_URI",
-            "FLUXER_MASTER_CONFIG",
-        ] {
-            unsafe { env::remove_var(var) };
-        }
-        let config = AdminConfig::from_env();
+        let config = config_from_env(&[]);
        assert_eq!(config.env, RuntimeEnv::Development);
        assert_eq!(config.host, "0.0.0.0");
        assert_eq!(config.port, 3020);
@@ -308,4 +349,77 @@ mod tests {
            "https://admin.fluxer.app/oauth2_callback"
        );
    }
+
+    #[test]
+    fn a_non_default_public_port_reaches_the_public_endpoints() {
+        let config = config_from_env(&[
+            ("FLUXER_BASE_DOMAIN", "fluxer.example"),
+            ("FLUXER_PUBLIC_PORT", "19080"),
+            ("FLUXER_ADMIN_ENDPOINT", "http://fluxer.example/admin"),
+            ("FLUXER_APP_ENDPOINT", "http://fluxer.example"),
+            ("FLUXER_MEDIA_ENDPOINT", "http://fluxer.example/media"),
+            ("FLUXER_STATIC_CDN_ENDPOINT", "https://cdn.example.net"),
+            (
+                "FLUXER_ADMIN_OAUTH_REDIRECT_URI",
+                "http://fluxer.example/admin/oauth2_callback",
+            ),
+        ]);
+
+        assert_eq!(config.admin_endpoint, "http://fluxer.example:19080/admin");
+        assert_eq!(config.media_endpoint, "http://fluxer.example:19080/media");
+        assert_eq!(config.web_app_endpoint, "http://fluxer.example:19080");
+        assert_eq!(config.static_cdn_endpoint, "https://cdn.example.net");
+        assert_eq!(
+            config.oauth_redirect_uri,
+            format!("{}/oauth2_callback", config.admin_endpoint)
+        );
+    }
+
+    #[test]
+    fn a_default_public_port_leaves_the_public_endpoints_alone() {
+        let config = config_from_env(&[
+            ("FLUXER_BASE_DOMAIN", "fluxer.example"),
+            ("FLUXER_PUBLIC_PORT", "443"),
+            ("FLUXER_ADMIN_ENDPOINT", "https://fluxer.example/admin"),
+            ("FLUXER_APP_ENDPOINT", "https://fluxer.example"),
+            ("FLUXER_MEDIA_ENDPOINT", "https://fluxer.example/media"),
+            ("FLUXER_STATIC_CDN_ENDPOINT", "https://fluxer.example"),
+            (
+                "FLUXER_ADMIN_OAUTH_REDIRECT_URI",
+                "https://fluxer.example/admin/oauth2_callback",
+            ),
+        ]);
+
+        assert_eq!(config.admin_endpoint, "https://fluxer.example/admin");
+        assert_eq!(config.media_endpoint, "https://fluxer.example/media");
+        assert_eq!(config.web_app_endpoint, "https://fluxer.example");
+        assert_eq!(config.static_cdn_endpoint, "https://fluxer.example");
+        assert_eq!(
+            config.oauth_redirect_uri,
+            "https://fluxer.example/admin/oauth2_callback"
+        );
+    }
+
+    #[test]
+    fn the_oauth_redirect_uri_matches_the_api_derived_admin_endpoint() {
+        let config = config_from_env(&[
+            ("FLUXER_BASE_DOMAIN", "fluxer.example"),
+            ("FLUXER_PUBLIC_PORT", "19080"),
+            ("FLUXER_ADMIN_ENDPOINT", "http://fluxer.example/admin"),
+            (
+                "FLUXER_ADMIN_OAUTH_REDIRECT_URI",
+                "http://fluxer.example/admin/oauth2_callback",
+            ),
+        ]);
+
+        let api_admin_endpoint = fluxer_common::config::normalize_public_endpoint(
+            "http://fluxer.example/admin",
+            "fluxer.example",
+            Some(19080),
+        );
+        assert_eq!(
+            config.oauth_redirect_uri,
+            format!("{api_admin_endpoint}/oauth2_callback")
+        );
+    }
 }
@@ -14,7 +14,7 @@ async fn main() -> anyhow::Result<()> {
        .with(tracing_subscriber::fmt::layer())
        .init();

-    let config = AdminConfig::from_env();
+    let config = AdminConfig::from_env()?;
    let addr = format!("{}:{}", config.host, config.port);
    let router = build_router(config);

@@ -135,7 +135,7 @@ async fn fetch_admin_user(
    config: &crate::config::AdminConfig,
    session: &Session,
 ) -> AdminFetchResult {
-    let url = format!("{}/admin/users/me", config.api_endpoint);
+    let url = format!("{}/admin/users/@me", config.api_endpoint);
    let response =
        match crate::api::client::with_proxy_client_ip_header(http_client.get(&url), config)
            .header("Authorization", format!("Bearer {}", session.access_token))
@@ -2,24 +2,42 @@

 use axum::{
    body::{Body, to_bytes},
-    extract::Request,
+    extract::{Request, State},
    http::{HeaderValue, Method, StatusCode, header},
    middleware::Next,
    response::{IntoResponse, Response},
 };
-use rand::RngExt;
+
+use crate::middleware::auth::AuthContext;
+use crate::session::{create_csrf_token, verify_csrf_token};
+use crate::state::AppState;

 const CSRF_COOKIE_NAME: &str = "csrf_token";
 pub const CSRF_FORM_FIELD: &str = "_csrf";
 const CSRF_HEADER_NAME: &str = "x-csrf-token";
-const TOKEN_LENGTH: usize = 32;
+const HOST_CSRF_COOKIE_NAME: &str = "__Host-csrf_token";
 const MAX_CSRF_FORM_BYTES: usize = 8 * 1024 * 1024;

 const IGNORED_PATH_SUFFIXES: &[&str] = &["/oauth2_callback", "/auth/start"];

-pub async fn csrf_protection(mut request: Request, next: Next) -> Response {
-    let existing_token = extract_csrf_cookie(&request);
-    let token = existing_token.unwrap_or_else(generate_csrf_token);
+pub async fn csrf_protection(
+    State(state): State<AppState>,
+    mut request: Request,
+    next: Next,
+) -> Response {
+    let config = state.config();
+    let secret = config.secret_key_base.clone();
+    let secure_cookies = config.secure_cookies();
+
+    let user_id = request
+        .extensions()
+        .get::<AuthContext>()
+        .map(|ctx| ctx.session.user_id.clone())
+        .unwrap_or_default();
+
+    let token = extract_csrf_cookie(&request)
+        .filter(|cookie| verify_csrf_token(cookie, &user_id, &secret))
+        .unwrap_or_else(|| create_csrf_token(&user_id, &secret));
    request.extensions_mut().insert(CsrfToken(token.clone()));

    if matches!(
@@ -31,6 +49,9 @@ pub async fn csrf_protection(mut request: Request, next: Next) -> Response {
            .iter()
            .any(|suffix| path.ends_with(suffix));
        if !is_ignored {
+            if !is_same_site_request(&request, config.admin_origin().as_deref()) {
+                return StatusCode::FORBIDDEN.into_response();
+            }
            let header_token = extract_csrf_header(&request);
            let query_token = extract_csrf_from_query(&request);
            let mut submitted = query_token.or(header_token);
@@ -43,40 +64,58 @@ pub async fn csrf_protection(mut request: Request, next: Next) -> Response {
                request = restored_request;
                submitted = body_token;
            }
-            match submitted {
-                Some(ref submitted_token) if submitted_token == &token => {}
-                _ => {
-                    return StatusCode::FORBIDDEN.into_response();
-                }
+            let accepted = submitted.as_deref().is_some_and(|submitted_token| {
+                submitted_token == token && verify_csrf_token(submitted_token, &user_id, &secret)
+            });
+            if !accepted {
+                return StatusCode::FORBIDDEN.into_response();
            }
        }
    }

    let mut response = next.run(request).await;

-    let cookie_value = format!(
-        "{}={}; Path=/; SameSite=Lax; HttpOnly",
-        CSRF_COOKIE_NAME, token
-    );
+    let cookie_name = if secure_cookies {
+        HOST_CSRF_COOKIE_NAME
+    } else {
+        CSRF_COOKIE_NAME
+    };
+    let secure = if secure_cookies { "; Secure" } else { "" };
+    let cookie_value = format!("{cookie_name}={token}; Path=/; SameSite=Lax; HttpOnly{secure}");
    if let Ok(value) = HeaderValue::from_str(&cookie_value) {
        response.headers_mut().append(header::SET_COOKIE, value);
    }
+    if secure_cookies
+        && let Ok(value) = HeaderValue::from_str(&format!(
+            "{CSRF_COOKIE_NAME}=; Path=/; SameSite=Lax; HttpOnly; Max-Age=0"
+        ))
+    {
+        response.headers_mut().append(header::SET_COOKIE, value);
+    }

    response
 }

 fn extract_csrf_cookie(request: &Request) -> Option<String> {
    let cookie_header = request.headers().get(header::COOKIE)?.to_str().ok()?;
+    let mut legacy = None;
    for pair in cookie_header.split(';') {
        let pair = pair.trim();
-        if let Some(value) = pair.strip_prefix("csrf_token=") {
+        if let Some(value) = pair.strip_prefix("__Host-csrf_token=") {
            let trimmed = value.trim();
            if !trimmed.is_empty() {
                return Some(trimmed.to_owned());
            }
+        } else if let Some(value) = pair.strip_prefix("csrf_token=")
+            && legacy.is_none()
+        {
+            let trimmed = value.trim();
+            if !trimmed.is_empty() {
+                legacy = Some(trimmed.to_owned());
+            }
        }
    }
-    None
+    legacy
 }

 fn extract_csrf_header(request: &Request) -> Option<String> {
@@ -127,18 +166,22 @@ async fn extract_csrf_from_form_body(
    Ok((request, token))
 }

-fn generate_csrf_token() -> String {
-    let mut rng = rand::rng();
-    let bytes: [u8; TOKEN_LENGTH] = rng.random();
-    hex_encode(&bytes)
-}
-
-fn hex_encode(bytes: &[u8]) -> String {
-    let mut s = String::with_capacity(bytes.len() * 2);
-    for byte in bytes {
-        s.push_str(&format!("{byte:02x}"));
+fn is_same_site_request(request: &Request, admin_origin: Option<&str>) -> bool {
+    if let Some(site) = request
+        .headers()
+        .get("sec-fetch-site")
+        .and_then(|value| value.to_str().ok())
+    {
+        return matches!(site, "same-origin" | "same-site" | "none");
+    }
+    match request
+        .headers()
+        .get(header::ORIGIN)
+        .and_then(|value| value.to_str().ok())
+    {
+        Some(origin) => admin_origin.is_some_and(|expected| origin == expected),
+        None => true,
    }
-    s
 }

 #[derive(Clone, Debug)]
@@ -155,39 +198,172 @@ pub fn get_csrf_token(request: &Request) -> String {
 #[cfg(test)]
 mod tests {
    use super::*;
+    use crate::config::{AdminConfig, ProxyConfig, RuntimeEnv};
+    use crate::state::AppState;
+    use axum::{Router, middleware::from_fn_with_state, routing::get};
+    use tower::ServiceExt;

-    #[test]
-    fn generate_csrf_token_correct_length() {
-        let token = generate_csrf_token();
-        assert_eq!(
-            token.len(),
-            TOKEN_LENGTH * 2,
-            "token must be {} hex chars",
-            TOKEN_LENGTH * 2
-        );
+    fn state_with_admin_endpoint(admin_endpoint: &str) -> AppState {
+        AppState::new(AdminConfig {
+            env: RuntimeEnv::Production,
+            host: String::new(),
+            port: 3020,
+            secret_key_base: "test-secret".to_owned(),
+            base_path: String::new(),
+            api_endpoint: String::new(),
+            media_endpoint: String::new(),
+            static_cdn_endpoint: String::new(),
+            admin_endpoint: admin_endpoint.to_owned(),
+            web_app_endpoint: String::new(),
+            kv_url: String::new(),
+            oauth_client_id: String::new(),
+            oauth_client_secret: String::new(),
+            oauth_redirect_uri: String::new(),
+            build_version: "test".to_owned(),
+            release_channel: String::new(),
+            self_hosted: false,
+            proxy: ProxyConfig {
+                trust_client_ip_header: false,
+                client_ip_header_name: String::new(),
+            },
+        })
    }

-    #[test]
-    fn generate_csrf_token_is_valid_hex() {
-        let token = generate_csrf_token();
+    async fn csrf_cookies(admin_endpoint: &str) -> Vec<String> {
+        let state = state_with_admin_endpoint(admin_endpoint);
+        let app = Router::new()
+            .route("/", get(|| async { "ok" }))
+            .layer(from_fn_with_state(state, csrf_protection));
+        let response = app
+            .oneshot(Request::builder().uri("/").body(Body::empty()).unwrap())
+            .await
+            .expect("router responds");
+        response
+            .headers()
+            .get_all(header::SET_COOKIE)
+            .iter()
+            .filter_map(|value| value.to_str().ok())
+            .map(|value| value.to_owned())
+            .collect()
+    }
+
+    #[tokio::test]
+    async fn https_admin_endpoint_sets_a_host_prefixed_secure_cookie() {
+        let cookies = csrf_cookies("https://example.com/admin").await;
        assert!(
-            token.chars().all(|c| c.is_ascii_hexdigit()),
-            "token must contain only hex chars: {token}"
+            cookies
+                .iter()
+                .any(|cookie| cookie.starts_with("__Host-csrf_token=")
+                    && cookie.contains("; Secure")),
+            "expected a secure __Host- cookie, got {cookies:?}"
        );
    }

-    #[test]
-    fn generate_csrf_token_is_unique() {
-        let a = generate_csrf_token();
-        let b = generate_csrf_token();
-        assert_ne!(a, b, "consecutive tokens must differ");
+    #[tokio::test]
+    async fn http_admin_endpoint_sets_a_plain_cookie_without_secure() {
+        let cookies = csrf_cookies("http://example.com/admin").await;
+        assert!(
+            cookies
+                .iter()
+                .any(|cookie| cookie.starts_with("csrf_token=") && !cookie.contains("Secure")),
+            "expected a plain csrf_token cookie, got {cookies:?}"
+        );
+        assert!(
+            !cookies.iter().any(|cookie| cookie.contains("__Host-")),
+            "expected no __Host- cookie, got {cookies:?}"
+        );
    }

-    #[test]
-    fn hex_encode_produces_correct_output() {
-        assert_eq!(hex_encode(&[0x00, 0xff, 0x0a]), "00ff0a");
-        assert_eq!(hex_encode(&[]), "");
-        assert_eq!(hex_encode(&[0xde, 0xad]), "dead");
+    async fn action_status(admin_endpoint: &str, origin: &str) -> StatusCode {
+        let state = state_with_admin_endpoint(admin_endpoint);
+        let app = Router::new()
+            .route("/", get(|| async { "ok" }).post(|| async { "ok" }))
+            .layer(from_fn_with_state(state, csrf_protection));
+        let issued = app
+            .clone()
+            .oneshot(Request::builder().uri("/").body(Body::empty()).unwrap())
+            .await
+            .expect("router responds");
+        let cookie = issued
+            .headers()
+            .get_all(header::SET_COOKIE)
+            .iter()
+            .filter_map(|value| value.to_str().ok())
+            .filter_map(|value| value.split(';').next())
+            .find(|pair| pair.contains("csrf_token=") && !pair.ends_with('='))
+            .expect("a csrf cookie is issued")
+            .to_owned();
+        let token = cookie.split_once('=').expect("a cookie value").1.to_owned();
+        let response = app
+            .oneshot(
+                Request::builder()
+                    .method(Method::POST)
+                    .uri("/")
+                    .header(header::COOKIE, cookie.as_str())
+                    .header(header::ORIGIN, origin)
+                    .header(CSRF_HEADER_NAME, token.as_str())
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .expect("router responds");
+        response.status()
+    }
+
+    #[tokio::test]
+    async fn a_matching_origin_passes_the_same_site_check() {
+        let status = action_status(
+            "https://admin.example.test/admin",
+            "https://admin.example.test",
+        )
+        .await;
+        assert_eq!(status, StatusCode::OK);
+    }
+
+    #[tokio::test]
+    async fn a_matching_origin_on_a_non_default_port_passes_the_same_site_check() {
+        let status = action_status(
+            "https://admin.example.test:19080/admin",
+            "https://admin.example.test:19080",
+        )
+        .await;
+        assert_eq!(status, StatusCode::OK);
+    }
+
+    #[tokio::test]
+    async fn a_foreign_origin_fails_the_same_site_check() {
+        let status = action_status(
+            "https://admin.example.test:19080/admin",
+            "https://evil.example.test:19080",
+        )
+        .await;
+        assert_eq!(status, StatusCode::FORBIDDEN);
+    }
+
+    #[tokio::test]
+    async fn another_port_on_the_admin_host_fails_the_same_site_check() {
+        let status = action_status(
+            "https://admin.example.test:19080/admin",
+            "https://admin.example.test",
+        )
+        .await;
+        assert_eq!(status, StatusCode::FORBIDDEN);
+    }
+
+    #[tokio::test]
+    async fn an_unparseable_admin_endpoint_fails_closed() {
+        let status = action_status("not-an-endpoint", "https://admin.example.test").await;
+        assert_eq!(status, StatusCode::FORBIDDEN);
+    }
+
+    #[tokio::test]
+    async fn an_explicit_default_port_matches_a_portless_origin() {
+        let status = action_status(
+            "https://admin.example.test:443/admin",
+            "https://admin.example.test",
+        )
+        .await;
+        assert_eq!(status, StatusCode::OK);
    }

    #[test]
@@ -92,9 +92,9 @@ pub fn clear_flash_cookie(response: &mut Response) {
    }
 }

-pub fn redirect_with_flash(url: &str, flash: FlashData, is_production: bool) -> Response {
+pub fn redirect_with_flash(url: &str, flash: FlashData, secure: bool) -> Response {
    let encoded = serialize_flash(&flash);
-    let secure_flag = if is_production { "; Secure" } else { "" };
+    let secure_flag = if secure { "; Secure" } else { "" };
    let cookie_value = format!(
        "{FLASH_COOKIE_NAME}={encoded}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60{secure_flag}"
    );
@@ -81,7 +81,7 @@ async fn admin_api_keys_post(
        "create" => {
            let name = form.clean("name").unwrap_or_default();
            let acls = form.list_values_any(&["acls[]", "acls"]);
-            return match client.create_api_key(&name, &acls).await {
+            match client.create_api_key(&name, &acls).await {
                Ok(created) => {
                    let keys = client
                        .list_api_keys()
@@ -107,29 +107,38 @@ async fn admin_api_keys_post(
                        is_htmx,
                    )
                }
-            };
-        }
-        "revoke" => {
-            if let Some(key_id) = form.clean("key_id") {
-                let result = client.revoke_api_key(&key_id).await;
-                let flash = match result.log_error("revoke API key") {
-                    Some(_) => FlashData::success("API key revoked."),
-                    None => FlashData::error("Failed to revoke API key"),
-                };
-                return flash::redirect_with_flash(
-                    &format!("{base}/admin-api-keys"),
-                    flash,
-                    config.is_production(),
-                );
            }
        }
-        _ => {}
+        "revoke" => {
+            let Some(key_id) = form.clean("key_id") else {
+                return admin_api_key_flash_response(
+                    config,
+                    FlashData::error("API key ID is required"),
+                    is_htmx,
+                );
+            };
+            let result = client.revoke_api_key(&key_id).await;
+            let flash = match result.log_error("revoke API key") {
+                Some(_) => FlashData::success("API key revoked."),
+                None => FlashData::error("Failed to revoke API key"),
+            };
+            flash::redirect_with_flash(
+                &format!("{base}/admin-api-keys"),
+                flash,
+                config.secure_cookies(),
+            )
+        }
+        "" => admin_api_key_flash_response(
+            config,
+            FlashData::error("API key action is required"),
+            is_htmx,
+        ),
+        _ => admin_api_key_flash_response(
+            config,
+            FlashData::error("Unknown API key action"),
+            is_htmx,
+        ),
    }
-    flash::redirect_with_flash(
-        &format!("{base}/admin-api-keys"),
-        FlashData::success(format!("API key action '{action}' completed.")),
-        config.is_production(),
-    )
 }

 fn admin_api_key_flash_response(
@@ -143,7 +152,7 @@ fn admin_api_key_flash_response(
        flash::redirect_with_flash(
            &format!("{}/admin-api-keys", config.base_path),
            flash_data,
-            config.is_production(),
+            config.secure_cookies(),
        )
    }
 }
@@ -151,7 +151,7 @@ async fn application_detail_post(
            return flash::redirect_with_flash(
                &format!("{base}/applications/{application_id}"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -178,6 +178,6 @@ async fn application_detail_post(
    flash::redirect_with_flash(
        &format!("{base}/applications/{application_id}"),
        flash,
-        config.is_production(),
+        config.secure_cookies(),
    )
 }
@@ -187,7 +187,7 @@ async fn oauth2_callback_finish(

    let session_cookie_value =
        session::create_session(&user.id, &token.access_token, &config.secret_key_base);
-    let secure = if config.is_production() {
+    let secure = if config.secure_cookies() {
        "; Secure"
    } else {
        ""
@@ -348,7 +348,7 @@ fn oauth_callback_page(config: &AdminConfig, code: Option<&str>, state: Option<&
    )
 }

-fn json_string(value: &str) -> String {
+pub(crate) fn json_string(value: &str) -> String {
    serde_json::to_string(value)
        .expect("JSON string serialization cannot fail")
        .replace('<', "\\u003c")
@@ -16,7 +16,7 @@ use axum::{

 use super::ActionQuery;
 use super::bans_actions::{
-    BanFormData, custom_flash, execute_ban, extract_value, flash_response, htmx_flash,
+    BanFormData, custom_flash, execute_ban, extract_value, flash_response, render_inline_flash,
 };

 pub fn router() -> Router<AppState> {
@@ -105,7 +105,7 @@ async fn generic_ban_post(
        form.audit_log_reason.as_deref(),
    )
    .await;
-    flash_response(config, auth, is_htmx, &level, &msg, ban_cfg, csrf_token)
+    flash_response(config, auth, is_htmx, level, &msg, ban_cfg, csrf_token)
 }

 macro_rules! ban_post {
@@ -171,19 +171,22 @@ async fn url_domain_bans_post(
        Query::try_from_uri(request.uri()).unwrap_or(Query(ActionQuery { action: None }));
    let form: BanFormData = match Form::from_request(request, &state).await {
        Ok(Form(f)) => f,
-        Err(_) => return htmx_flash("error", "Invalid form data", &headers),
+        Err(_) => return render_inline_flash("error", "Invalid form data"),
    };
    let is_htmx = htmx::is_htmx_request(&headers);
    let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
    let domain = form.domain.as_deref().unwrap_or("").trim().to_owned();
    if domain.is_empty() {
-        return htmx_flash("error", "Domain is required", &headers);
+        return render_inline_flash("error", "Domain is required");
    }
    let action = aq.action.as_deref().unwrap_or("");
    let (level, msg) = match action {
        "ban" => {
            let m_sub = form.match_subdomains.as_deref() == Some("true");
-            match client.ban_url_domain(&domain, m_sub).await {
+            match client
+                .ban_url_domain(&domain, m_sub, form.audit_log_reason.as_deref())
+                .await
+            {
                Ok(()) => ("success", format!("Domain {domain} banned successfully")),
                Err(error) => {
                    tracing::warn!(%error, domain, "admin API request failed: ban URL domain");
@@ -191,7 +194,10 @@ async fn url_domain_bans_post(
                }
            }
        }
-        "unban" => match client.unban_url_domain(&domain).await {
+        "unban" => match client
+            .unban_url_domain(&domain, form.audit_log_reason.as_deref())
+            .await
+        {
            Ok(()) => ("success", format!("Domain {domain} unbanned")),
            Err(error) => {
                tracing::warn!(%error, domain, "admin API request failed: unban URL domain");
@@ -247,25 +253,31 @@ async fn profile_substring_bans_post(
        Query::try_from_uri(request.uri()).unwrap_or(Query(ActionQuery { action: None }));
    let form: BanFormData = match Form::from_request(request, &state).await {
        Ok(Form(f)) => f,
-        Err(_) => return htmx_flash("error", "Invalid form data", &headers),
+        Err(_) => return render_inline_flash("error", "Invalid form data"),
    };
    let is_htmx = htmx::is_htmx_request(&headers);
    let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
    let scope = form.scope.as_deref().unwrap_or("").trim().to_owned();
    let substring = form.substring.as_deref().unwrap_or("").trim().to_owned();
    if scope.is_empty() || substring.is_empty() {
-        return htmx_flash("error", "Scope and substring required", &headers);
+        return render_inline_flash("error", "Scope and substring required");
    }
    let action = aq.action.as_deref().unwrap_or("");
    let (level, msg) = match action {
-        "ban" => match client.ban_profile_substring(&scope, &substring).await {
+        "ban" => match client
+            .ban_profile_substring(&scope, &substring, form.audit_log_reason.as_deref())
+            .await
+        {
            Ok(()) => ("success", format!("\"{substring}\" banned for {scope}")),
            Err(error) => {
                tracing::warn!(%error, scope, substring, "admin API request failed: ban profile substring");
                ("error", format!("Failed to ban substring for {scope}"))
            }
        },
-        "unban" => match client.unban_profile_substring(&scope, &substring).await {
+        "unban" => match client
+            .unban_profile_substring(&scope, &substring, form.audit_log_reason.as_deref())
+            .await
+        {
            Ok(()) => ("success", format!("\"{substring}\" unbanned for {scope}")),
            Err(error) => {
                tracing::warn!(%error, scope, substring, "admin API request failed: unban profile substring");
@@ -1,17 +1,13 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

-use crate::api::client::AdminApiClient;
+use crate::api::client::{AdminApiClient, ApiResult};
 use crate::api::types::{FlashLevel, FlashMessage};
 use crate::middleware::auth::AuthContext;
 use crate::templates;
-use axum::{
-    http::HeaderMap,
-    response::{Html, IntoResponse, Response},
-};
+use axum::response::{Html, IntoResponse, Response};
 use serde::Deserialize;

 #[derive(Deserialize)]
-#[allow(dead_code)]
 pub struct BanFormData {
    #[serde(default)]
    pub ip: Option<String>,
@@ -65,7 +61,7 @@ pub async fn execute_ban(
    bulk_hashes: Option<&str>,
    bulk_sha256_list: Option<&str>,
    audit_log_reason: Option<&str>,
-) -> (String, String) {
+) -> (&'static str, String) {
    if (action == "bulk-ban" || action == "bulk-ban-files") && ban_type == "file-sha-bans" {
        let raw_hashes = if action == "bulk-ban-files" {
            bulk_sha256_list
@@ -75,13 +71,13 @@ pub async fn execute_ban(
        return execute_bulk_ban(client, raw_hashes, audit_log_reason).await;
    }
    if value.is_empty() {
-        return ("error".into(), "Value is required".into());
+        return ("error", "Value is required".into());
    }
    match action {
        "ban" => execute_single_ban(client, ban_type, value, audit_log_reason).await,
        "unban" => execute_single_unban(client, ban_type, value, audit_log_reason).await,
        "check" => execute_check(client, ban_type, value).await,
-        _ => ("error".into(), "Unknown action".into()),
+        _ => ("error", "Unknown action".into()),
    }
 }

@@ -89,7 +85,7 @@ async fn execute_bulk_ban(
    client: &AdminApiClient,
    bulk_hashes: Option<&str>,
    audit_log_reason: Option<&str>,
-) -> (String, String) {
+) -> (&'static str, String) {
    let hashes: Vec<String> = bulk_hashes
        .unwrap_or("")
        .split(|c: char| c.is_whitespace() || c == ',' || c == ';')
@@ -98,18 +94,15 @@ async fn execute_bulk_ban(
        .collect();
    if hashes.is_empty() {
        return (
-            "error".into(),
+            "error",
            "No valid 64-character hex hashes found in input".into(),
        );
    }
    match client.bulk_ban_file_shas(&hashes, audit_log_reason).await {
-        Ok(r) => (
-            "success".into(),
-            format!("Bulk ban job created: {}", r.job_id),
-        ),
+        Ok(r) => ("success", format!("Bulk ban job created: {}", r.job_id)),
        Err(error) => {
            tracing::warn!(%error, "admin API request failed: bulk ban file SHAs");
-            ("error".into(), "Failed to enqueue bulk ban job".into())
+            ("error", "Failed to enqueue bulk ban job".into())
        }
    }
 }
@@ -119,29 +112,26 @@ async fn execute_single_ban(
    ban_type: &str,
    value: &str,
    audit_log_reason: Option<&str>,
-) -> (String, String) {
-    let success = format!("{value} banned successfully");
-    let failure = format!("Failed to ban {value}");
-    match ban_type {
-        "ip-bans" => ban_action_result(client.ban_ip(value).await, success, failure),
-        "email-bans" => ban_action_result(client.ban_email(value).await, success, failure),
-        "suspicious-email-domains" => ban_action_result(
-            client.add_suspicious_email_domain(value).await,
-            success,
-            failure,
-        ),
-        "phrase-bans" => ban_action_result(client.ban_phrase(value).await, success, failure),
-        "url-bans" => ban_action_result(client.ban_url(value).await, success, failure),
-        "file-sha-bans" => ban_action_result(
-            client.ban_file_sha(value, audit_log_reason).await,
-            success,
-            failure,
-        ),
-        "avatar-hash-bans" => {
-            ban_action_result(client.ban_avatar_hash(value).await, success, failure)
+) -> (&'static str, String) {
+    let result = match ban_type {
+        "ip-bans" => client.ban_ip(value, audit_log_reason).await,
+        "email-bans" => client.ban_email(value, audit_log_reason).await,
+        "suspicious-email-domains" => {
+            client
+                .add_suspicious_email_domain(value, audit_log_reason)
+                .await
        }
-        _ => ("error".into(), "Unknown ban type".into()),
-    }
+        "phrase-bans" => client.ban_phrase(value, audit_log_reason).await,
+        "url-bans" => client.ban_url(value, audit_log_reason).await,
+        "file-sha-bans" => client.ban_file_sha(value, audit_log_reason).await,
+        "avatar-hash-bans" => client.ban_avatar_hash(value, audit_log_reason).await,
+        _ => return ("error", "Unknown ban type".into()),
+    };
+    ban_action_result(
+        result,
+        format!("{value} banned successfully"),
+        format!("Failed to ban {value}"),
+    )
 }

 async fn execute_single_unban(
@@ -149,32 +139,33 @@ async fn execute_single_unban(
    ban_type: &str,
    value: &str,
    audit_log_reason: Option<&str>,
-) -> (String, String) {
-    let success = format!("{value} unbanned successfully");
-    let failure = format!("Failed to unban {value}");
-    match ban_type {
-        "ip-bans" => ban_action_result(client.unban_ip(value).await, success, failure),
-        "email-bans" => ban_action_result(client.unban_email(value).await, success, failure),
-        "suspicious-email-domains" => ban_action_result(
-            client.remove_suspicious_email_domain(value).await,
-            success,
-            failure,
-        ),
-        "phrase-bans" => ban_action_result(client.unban_phrase(value).await, success, failure),
-        "url-bans" => ban_action_result(client.unban_url(value).await, success, failure),
-        "file-sha-bans" => ban_action_result(
-            client.unban_file_sha(value, audit_log_reason).await,
-            success,
-            failure,
-        ),
-        "avatar-hash-bans" => {
-            ban_action_result(client.unban_avatar_hash(value).await, success, failure)
+) -> (&'static str, String) {
+    let result = match ban_type {
+        "ip-bans" => client.unban_ip(value, audit_log_reason).await,
+        "email-bans" => client.unban_email(value, audit_log_reason).await,
+        "suspicious-email-domains" => {
+            client
+                .remove_suspicious_email_domain(value, audit_log_reason)
+                .await
        }
-        _ => ("error".into(), "Unknown ban type".into()),
-    }
+        "phrase-bans" => client.unban_phrase(value, audit_log_reason).await,
+        "url-bans" => client.unban_url(value, audit_log_reason).await,
+        "file-sha-bans" => client.unban_file_sha(value, audit_log_reason).await,
+        "avatar-hash-bans" => client.unban_avatar_hash(value, audit_log_reason).await,
+        _ => return ("error", "Unknown ban type".into()),
+    };
+    ban_action_result(
+        result,
+        format!("{value} unbanned successfully"),
+        format!("Failed to unban {value}"),
+    )
 }

-async fn execute_check(client: &AdminApiClient, ban_type: &str, value: &str) -> (String, String) {
+async fn execute_check(
+    client: &AdminApiClient,
+    ban_type: &str,
+    value: &str,
+) -> (&'static str, String) {
    let result = match ban_type {
        "ip-bans" => client.check_ip_ban(value).await,
        "email-bans" => client.check_email_ban(value).await,
@@ -183,28 +174,28 @@ async fn execute_check(client: &AdminApiClient, ban_type: &str, value: &str) ->
        "url-bans" => client.check_url_ban(value).await,
        "file-sha-bans" => client.check_file_sha_ban(value).await,
        "avatar-hash-bans" => client.check_avatar_hash_ban(value).await,
-        _ => return ("error".into(), "Unknown ban type".into()),
+        _ => return ("error", "Unknown ban type".into()),
    };
    match result {
-        Ok(r) if r.banned => ("info".into(), format!("{value} is banned")),
-        Ok(_) => ("info".into(), format!("{value} is NOT banned")),
+        Ok(r) if r.banned => ("info", format!("{value} is banned")),
+        Ok(_) => ("info", format!("{value} is NOT banned")),
        Err(error) => {
            tracing::warn!(%error, ban_type, value, "admin API request failed: check ban status");
-            ("error".into(), "Error checking ban status".into())
+            ("error", "Error checking ban status".into())
        }
    }
 }

-fn ban_action_result<T, E: std::fmt::Display>(
-    result: Result<T, E>,
+fn ban_action_result(
+    result: ApiResult<()>,
    success_message: String,
    error_message: String,
-) -> (String, String) {
+) -> (&'static str, String) {
    match result {
-        Ok(_) => ("success".into(), success_message),
+        Ok(()) => ("success", success_message),
        Err(error) => {
            tracing::warn!(%error, "admin API request failed: ban action");
-            ("error".into(), error_message)
+            ("error", error_message)
        }
    }
 }
@@ -228,11 +219,6 @@ pub fn flash_response(
    }
 }

-pub fn htmx_flash(level: &str, message: &str, headers: &HeaderMap) -> Response {
-    let _ = headers;
-    render_inline_flash(level, message)
-}
-
 pub fn render_inline_flash(level: &str, message: &str) -> Response {
    let (border, bg, text) = match level {
        "success" => ("border-green-300", "bg-green-50", "text-green-800"),
@@ -1,14 +1,14 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

 use crate::{
-    api::client::AdminApiClient,
+    api::{client::AdminApiClient, generated::types::GiftCodeDurationTypeSchema},
    middleware::{
        auth::AuthContext,
        csrf::CsrfToken,
        flash::{self, FlashData},
    },
    state::AppState,
-    templates,
+    templates::{self, pages::gift_codes::MAX_GIFT_CODES},
 };
 use axum::{
    Form, Router,
@@ -28,11 +28,11 @@ struct GiftCodesForm {
    #[serde(default)]
    _csrf: Option<String>,
    #[serde(default)]
-    count: Option<String>,
+    count: Option<u32>,
    #[serde(default)]
-    duration_type: Option<String>,
+    duration_type: Option<GiftCodeDurationTypeSchema>,
    #[serde(default)]
-    duration_quantity: Option<String>,
+    duration_quantity: Option<u32>,
 }

 pub fn router() -> Router<AppState> {
@@ -82,31 +82,27 @@ async fn gift_codes_post(
            return flash::redirect_with_flash(
                &format!("{base}/gift-codes"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
-    let count = form
-        .count
-        .as_deref()
-        .and_then(|s| s.parse::<u32>().ok())
-        .unwrap_or(1)
-        .clamp(1, 100);
-    let dur_type = form.duration_type.as_deref().unwrap_or("month");
-    let dur_qty = form
-        .duration_quantity
-        .as_deref()
-        .and_then(|s| s.parse::<u32>().ok())
-        .unwrap_or(1);
+    let count = form.count.unwrap_or(1).clamp(1, MAX_GIFT_CODES);
+    let duration_type = form
+        .duration_type
+        .unwrap_or(GiftCodeDurationTypeSchema::Months);
+    let duration_quantity = form.duration_quantity.unwrap_or(1);
    let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
-    let is_prod = config.is_production();
-    match client.generate_gift_codes(count, dur_type, dur_qty).await {
+    let secure_cookies = config.secure_cookies();
+    match client
+        .generate_gift_codes(count, duration_type, duration_quantity)
+        .await
+    {
        Ok(result) => {
            let codes = result.codes.join(",");
            flash::redirect_with_flash(
                &format!("{base}/gift-codes?codes={codes}"),
                FlashData::success(format!("{} gift code(s) generated", result.codes.len())),
-                is_prod,
+                secure_cookies,
            )
        }
        Err(error) => {
@@ -114,7 +110,7 @@ async fn gift_codes_post(
            flash::redirect_with_flash(
                &format!("{base}/gift-codes"),
                FlashData::error("Failed to generate gift codes"),
-                is_prod,
+                secure_cookies,
            )
        }
    }
@@ -105,7 +105,7 @@ async fn discovery_approve(
            return flash::redirect_with_flash(
                &format!("{base}/discovery"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -115,7 +115,7 @@ async fn discovery_approve(
            return flash::redirect_with_flash(
                &format!("{base}/discovery"),
                FlashData::error("Guild ID is required"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -131,7 +131,7 @@ async fn discovery_approve(
    flash::redirect_with_flash(
        &format!("{base}/discovery?tab=pending"),
        flash,
-        config.is_production(),
+        config.secure_cookies(),
    )
 }

@@ -149,7 +149,7 @@ async fn discovery_reject(
            return flash::redirect_with_flash(
                &format!("{base}/discovery"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -159,7 +159,7 @@ async fn discovery_reject(
            return flash::redirect_with_flash(
                &format!("{base}/discovery"),
                FlashData::error("Guild ID is required"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -173,7 +173,7 @@ async fn discovery_reject(
    flash::redirect_with_flash(
        &format!("{base}/discovery?tab=pending"),
        flash,
-        config.is_production(),
+        config.secure_cookies(),
    )
 }

@@ -191,7 +191,7 @@ async fn discovery_remove(
            return flash::redirect_with_flash(
                &format!("{base}/discovery"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -201,7 +201,7 @@ async fn discovery_remove(
            return flash::redirect_with_flash(
                &format!("{base}/discovery"),
                FlashData::error("Guild ID is required"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -215,6 +215,6 @@ async fn discovery_remove(
    flash::redirect_with_flash(
        &format!("{base}/discovery?tab=listed"),
        flash,
-        config.is_production(),
+        config.secure_cookies(),
    )
 }
@@ -43,7 +43,7 @@ pub async fn render(
            let page = query.members_page.unwrap_or(0);
            let limit: u32 = 50;
            let resp = client
-                .list_guild_members(guild_id, limit, page * limit)
+                .list_guild_members(guild_id, limit, u64::from(page) * u64::from(limit))
                .await
                .log_error("load guild members")?;
            Some(tabs::members::members_tab(
@@ -57,7 +57,7 @@ pub async fn render(
            let page = query.reports_page.unwrap_or(0);
            let limit: u32 = 25;
            let resp = client
-                .search_reports_by_guild(guild_id, limit, page * limit)
+                .search_reports_by_guild(guild_id, limit, u64::from(page) * u64::from(limit))
                .await
                .log_error("load guild reports")?;
            Some(tabs::reports::reports_tab(
@@ -121,6 +121,7 @@ pub async fn render(
                    admin_user_id: None,
                    target_id: Some(guild_id.to_owned()),
                    target_type: Some("guild".to_owned()),
+                    access: Some("write".to_owned()),
                    sort_by: Some("created_at".to_owned()),
                    sort_order: Some("desc".to_owned()),
                    limit: 50,
@@ -134,7 +135,7 @@ pub async fn render(
                    @if let Some(resp) = resp {
                        @if resp.logs.is_empty() {
                            p class="text-sm text-neutral-500" {
-                                "No admin audit log entries for this guild."
+                                "No admin write actions have been recorded for this guild."
                            }
                        } @else {
                            (table_container(table(maud::html! {
@@ -150,22 +151,6 @@ pub async fn render(
                },
            ))
        }
-        "billing" => {
-            if config.self_hosted || !acl::has_permission(admin_acls, acl::BILLING_VIEW) {
-                return None;
-            }
-            let billing = client
-                .get_billing_overview(guild_id)
-                .await
-                .log_error("load guild billing overview")
-                .map(|b| b.data);
-            Some(tabs::billing::billing_tab(
-                config,
-                guild_id,
-                billing.as_ref(),
-                csrf_token,
-            ))
-        }
        "applications" => {
            if !acl::has_any_permission(
                admin_acls,
@@ -174,7 +159,7 @@ pub async fn render(
                return None;
            }
            let apps = client
-                .list_user_applications(guild_id)
+                .list_guild_applications(guild_id)
                .await
                .map_err(|error| tracing::warn!(%error, guild_id, "admin API request failed: list guild applications"))
                .unwrap_or_default();
@@ -82,23 +82,19 @@ async fn guilds_list(
                }
            }
        }
-        Some((guilds, Some(params.requested_ids.len() as u64), false))
+        Some((guilds, params.requested_ids.len() as u64))
    } else if params.has_search() {
-        let offset = params.page.saturating_mul(params.limit);
+        let offset = u64::from(params.page) * u64::from(params.limit);
        client
            .search_guilds(params.search_query(), params.limit, offset)
            .await
            .log_error("search guilds")
-            .map(|response| {
-                let has_more = u64::from(offset) + (response.guilds.len() as u64) < response.total;
-                (response.guilds, Some(response.total), has_more)
-            })
+            .map(|response| (response.guilds, response.total))
    } else {
        None
    };
    let result_guilds = results.as_ref().map(|result| result.0.as_slice());
-    let total = results.as_ref().and_then(|result| result.1);
-    let has_more = results.as_ref().is_some_and(|result| result.2);
+    let total = results.as_ref().map(|result| result.1);

    let markup = templates::pages::guilds_list::guilds_list_page(
        config,
@@ -106,7 +102,6 @@ async fn guilds_list(
        &params,
        result_guilds,
        total,
-        has_more,
        is_results_fragment,
    );
    Html(markup.into_string()).into_response()
@@ -191,7 +186,7 @@ async fn guild_detail_post(
            return flash::redirect_with_flash(
                &format!("{base}/guilds/{guild_id}"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -203,7 +198,7 @@ async fn guild_detail_post(
    } else {
        format!("{base}/guilds/{guild_id}?tab={tab}")
    };
-    flash::redirect_with_flash(&redirect, flash, config.is_production())
+    flash::redirect_with_flash(&redirect, flash, config.secure_cookies())
 }

 async fn dispatch_guild_action(
@@ -324,8 +319,12 @@ async fn dispatch_guild_action(
                "default_message_notifications",
                "disabled_operations",
            ] {
-                if let Some(v) = form.parse_i64(key) {
-                    settings.insert(key.to_string(), serde_json::json!(v));
+                let value = match form.parse_value::<i64>(key) {
+                    Ok(value) => value,
+                    Err(_) => return FlashData::error(format!("Invalid {key} value")),
+                };
+                if let Some(value) = value {
+                    settings.insert(key.to_string(), serde_json::json!(value));
                }
            }
            if form.contains_key("nsfw_submitted") {
@@ -356,11 +355,12 @@ async fn dispatch_guild_action(
            )
        }
        "update_disabled_operations" => {
-            let disabled_operations = form
-                .list_values_any(&["disabled_operations[]", "disabled_operations"])
-                .iter()
-                .filter_map(|value| value.parse::<i64>().ok())
-                .fold(0_i64, |acc, value| acc | value);
+            let Ok(operations) =
+                form.parse_list_values::<i64>(&["disabled_operations[]", "disabled_operations"])
+            else {
+                return FlashData::error("Invalid disabled operation value");
+            };
+            let disabled_operations = operations.into_iter().fold(0_i64, |acc, value| acc | value);
            let settings = serde_json::json!({
                "disabled_operations": disabled_operations,
            });
@@ -415,7 +415,7 @@ async fn dispatch_guild_action(
                return FlashData::error("Emoji ID is required");
            };
            action_result(
-                client.purge_assets(&[emoji_id]).await,
+                client.purge_assets(guild_id, &[emoji_id]).await,
                "Emoji deleted",
                "Failed to delete emoji",
            )
@@ -425,7 +425,7 @@ async fn dispatch_guild_action(
                return FlashData::error("Sticker ID is required");
            };
            action_result(
-                client.purge_assets(&[sticker_id]).await,
+                client.purge_assets(guild_id, &[sticker_id]).await,
                "Sticker deleted",
                "Failed to delete sticker",
            )
@@ -21,7 +21,6 @@ use axum::{
 use serde::Deserialize;

 #[derive(Deserialize)]
-#[allow(dead_code)]
 struct JobsQuery {
    status: Option<String>,
    task_type: Option<String>,
@@ -187,7 +186,7 @@ async fn job_detail_post(
            return flash::redirect_with_flash(
                &format!("{base}/jobs/{job_id}"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -214,54 +213,41 @@ async fn job_detail_post(
    flash::redirect_with_flash(
        &format!("{base}/jobs/{job_id}"),
        flash,
-        config.is_production(),
+        config.secure_cookies(),
    )
 }

 fn jobs_url(config: &crate::config::AdminConfig, query: &JobsQuery) -> String {
-    let mut params = Vec::new();
-    push_query(&mut params, "status", query.status.as_deref());
-    push_query(&mut params, "task_type", query.task_type.as_deref());
-    push_query(
-        &mut params,
-        "requested_by_user_id",
-        query.requested_by_user_id.as_deref(),
-    );
-    push_query(
-        &mut params,
-        "max_lookback_days",
-        query.max_lookback_days.as_deref(),
-    );
-    push_query(
-        &mut params,
-        "cursor_bucket_day",
-        query.cursor_bucket_day.as_deref(),
-    );
-    push_query(
-        &mut params,
-        "cursor_created_at",
-        query.cursor_created_at.as_deref(),
-    );
-    push_query(&mut params, "cursor_job_id", query.cursor_job_id.as_deref());
-    if params.is_empty() {
-        return format!("{}/jobs", config.base_path);
-    }
-    let query = params
-        .iter()
-        .map(|(key, value)| {
-            format!(
-                "{}={}",
-                urlencoding::encode(key),
-                urlencoding::encode(value)
-            )
-        })
-        .collect::<Vec<_>>()
-        .join("&");
-    format!("{}/jobs?{query}", config.base_path)
-}
-
-fn push_query(params: &mut Vec<(String, String)>, key: &str, value: Option<&str>) {
-    if let Some(value) = value.filter(|value| !value.is_empty()) {
-        params.push((key.to_owned(), value.to_owned()));
+    let query = [
+        ("status", query.status.as_deref()),
+        ("task_type", query.task_type.as_deref()),
+        (
+            "requested_by_user_id",
+            query.requested_by_user_id.as_deref(),
+        ),
+        ("max_lookback_days", query.max_lookback_days.as_deref()),
+        ("cursor_bucket_day", query.cursor_bucket_day.as_deref()),
+        ("cursor_created_at", query.cursor_created_at.as_deref()),
+        ("cursor_job_id", query.cursor_job_id.as_deref()),
+    ]
+    .into_iter()
+    .filter_map(|(key, value)| {
+        value
+            .filter(|value| !value.is_empty())
+            .map(|value| (key, value))
+    })
+    .map(|(key, value)| {
+        format!(
+            "{}={}",
+            urlencoding::encode(key),
+            urlencoding::encode(value)
+        )
+    })
+    .collect::<Vec<_>>()
+    .join("&");
+    if query.is_empty() {
+        format!("{}/jobs", config.base_path)
+    } else {
+        format!("{}/jobs?{query}", config.base_path)
    }
 }
@@ -48,7 +48,7 @@ pub(crate) async fn messages_post(
            return flash::redirect_with_flash(
                &format!("{base}/messages"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -59,53 +59,51 @@ pub(crate) async fn messages_post(
    match action {
        "lookup" => {
            let context_limit = parse_context_limit(form.first("context_limit"));
-            return Redirect::to(&format!(
+            Redirect::to(&format!(
                "{base}/messages?channel_id={}&message_id={}&context_limit={context_limit}",
                encode_opt(&channel_id),
                encode_opt(&message_id)
            ))
-            .into_response();
+            .into_response()
        }
        "lookup-by-attachment" => {
            let attachment_id = form.clean("attachment_id");
            let filename = form.clean("filename");
            let context_limit = parse_context_limit(form.first("context_limit"));
-            return Redirect::to(&format!(
+            Redirect::to(&format!(
                "{base}/messages?channel_id={}&attachment_id={}&filename={}&context_limit={context_limit}",
                encode_opt(&channel_id),
                encode_opt(&attachment_id),
                encode_opt(&filename)
            ))
-            .into_response();
-        }
-        "browse" => {
-            return Redirect::to(&format!(
-                "{base}/messages?channel_id={}",
-                encode_opt(&channel_id)
-            ))
-            .into_response();
+            .into_response()
        }
+        "browse" => Redirect::to(&format!(
+            "{base}/messages?channel_id={}",
+            encode_opt(&channel_id)
+        ))
+        .into_response(),
        "search" => {
            let search = form.clean("search");
-            return Redirect::to(&format!(
+            Redirect::to(&format!(
                "{base}/messages?channel_id={}&search={}",
                encode_opt(&channel_id),
                encode_opt(&search)
            ))
-            .into_response();
+            .into_response()
        }
        "delete" => {
            let (Some(cid), Some(mid)) = (&channel_id, &message_id) else {
                return json_error(StatusCode::BAD_REQUEST, "Missing channel_id or message_id");
            };
            let audit_log_reason = form.clean("audit_log_reason");
-            return match client
+            match client
                .delete_message(cid, mid, audit_log_reason.as_deref())
                .await
            {
                Ok(()) => Json(serde_json::json!({"success": true})).into_response(),
                Err(e) => json_error(StatusCode::BAD_REQUEST, &format!("{e}")),
-            };
+            }
        }
        "report-to-ncmec" => {
            let attachment_id = form.clean("attachment_id");
@@ -131,7 +129,7 @@ pub(crate) async fn messages_post(
                    "Missing required NCMEC report fields",
                );
            }
-            return match client
+            match client
                .report_attachment_to_ncmec(
                    cid,
                    mid,
@@ -144,11 +142,10 @@ pub(crate) async fn messages_post(
            {
                Ok(resp) => Json(resp.data).into_response(),
                Err(e) => json_error(StatusCode::BAD_REQUEST, &format!("{e}")),
-            };
+            }
        }
-        _ => {}
+        _ => Redirect::to(&format!("{base}/messages")).into_response(),
    }
-    Redirect::to(&format!("{base}/messages")).into_response()
 }

 pub(crate) async fn system_dms_post(
@@ -164,7 +161,7 @@ pub(crate) async fn system_dms_post(
            return flash::redirect_with_flash(
                &format!("{base}/system-dms"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -184,7 +181,11 @@ pub(crate) async fn system_dms_post(
    } else {
        FlashData::error("Recipients and content are required")
    };
-    flash::redirect_with_flash(&format!("{base}/system-dms"), flash, config.is_production())
+    flash::redirect_with_flash(
+        &format!("{base}/system-dms"),
+        flash,
+        config.secure_cookies(),
+    )
 }

 pub(crate) async fn bulk_actions_post(
@@ -201,7 +202,7 @@ pub(crate) async fn bulk_actions_post(
            return flash::redirect_with_flash(
                &format!("{base}/bulk-actions"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -247,32 +248,40 @@ pub(crate) async fn bulk_actions_post(
                .bulk_add_guild_members(&guild_id, &user_ids, audit_log_reason.as_deref())
                .await
        }
-        "bulk-schedule-user-deletion" => {
+        "bulk-schedule-user-deletion" | "bulk_delete_users" => {
            let user_ids = form.list_values_any(&["user_ids[]", "user_ids"]);
-            let reason_code = form.parse_u32("reason_code").unwrap_or(2);
-            let days = form.parse_u32("days_until_deletion").unwrap_or(14);
+            let (Ok(reason_code), Ok(days)) = (
+                form.parse_value::<u32>("reason_code"),
+                form.parse_value::<u32>("days_until_deletion"),
+            ) else {
+                return flash::redirect_with_flash(
+                    &format!("{base}/bulk-actions"),
+                    FlashData::error("Invalid deletion reason code or delay"),
+                    config.secure_cookies(),
+                );
+            };
            let public_reason = form.clean("public_reason");
            client
                .bulk_schedule_user_deletion(
                    &user_ids,
-                    reason_code,
-                    days,
+                    reason_code.unwrap_or(2),
+                    days.unwrap_or(14),
                    public_reason.as_deref(),
                    audit_log_reason.as_deref(),
                )
                .await
        }
-        "bulk_delete_users" => {
+        "bulk-delete-user-messages" => {
            let user_ids = form.list_values_any(&["user_ids[]", "user_ids"]);
            client
-                .bulk_schedule_user_deletion(&user_ids, 0, 30, None, audit_log_reason.as_deref())
+                .bulk_delete_user_messages(&user_ids, audit_log_reason.as_deref())
                .await
        }
        _ => {
            return flash::redirect_with_flash(
                &format!("{base}/bulk-actions"),
                FlashData::error("Unknown bulk action"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -284,7 +293,7 @@ pub(crate) async fn bulk_actions_post(
                flash::redirect_with_flash(
                    &format!("{base}/bulk-actions"),
                    FlashData::success("Bulk action submitted"),
-                    config.is_production(),
+                    config.secure_cookies(),
                )
            }
        }
@@ -292,8 +301,8 @@ pub(crate) async fn bulk_actions_post(
            tracing::warn!(%error, action, "admin API request failed: submit bulk action");
            flash::redirect_with_flash(
                &format!("{base}/bulk-actions"),
-                FlashData::error("Failed to submit bulk action"),
-                config.is_production(),
+                FlashData::error(format!("Failed to submit bulk action: {error}")),
+                config.secure_cookies(),
            )
        }
    }
@@ -353,7 +362,7 @@ pub(crate) async fn messages_browse_fragment(
    }
 }

-fn parse_context_limit(value: Option<&str>) -> u32 {
+pub(super) fn parse_context_limit(value: Option<&str>) -> u32 {
    value
        .and_then(|s| s.parse::<u32>().ok())
        .filter(|n| *n > 0)
@@ -399,14 +408,14 @@ pub(crate) async fn archives_download(
        Ok(_) => flash::redirect_with_flash(
            &format!("{base}/archives"),
            FlashData::error("Archive download URL was empty"),
-            config.is_production(),
+            config.secure_cookies(),
        ),
        Err(error) => {
            tracing::warn!(%error, "admin API request failed: get archive download URL");
            flash::redirect_with_flash(
                &format!("{base}/archives"),
                FlashData::error("Failed to create archive download URL"),
-                config.is_production(),
+                config.secure_cookies(),
            )
        }
    }
@@ -16,7 +16,6 @@ use axum::{
 use serde::Deserialize;

 #[derive(Deserialize)]
-#[allow(dead_code)]
 struct MessagesQuery {
    channel_id: Option<String>,
    message_id: Option<String>,
@@ -82,13 +81,7 @@ async fn messages_page(
    let before = query.before.as_deref().filter(|s| !s.is_empty());
    let after = query.after.as_deref().filter(|s| !s.is_empty());
    let search = query.search.as_deref().filter(|s| !s.is_empty());
-    let context_limit = query
-        .context_limit
-        .as_deref()
-        .and_then(|s| s.parse::<u32>().ok())
-        .filter(|n| *n > 0)
-        .unwrap_or(50)
-        .min(100);
+    let context_limit = super::message_actions::parse_context_limit(query.context_limit.as_deref());
    let mut lookup_result = None;
    let mut browse_result = None;
    let mut search_result = None;
@@ -73,7 +73,10 @@ pub fn build_router(config: AdminConfig) -> Router {
        .route("/", get(dashboard))
        .route("/dashboard", get(dashboard))
        .layer(from_fn(middleware::htmx::flash_redirect_to_toast))
-        .layer(from_fn(middleware::csrf::csrf_protection))
+        .layer(from_fn_with_state(
+            state.clone(),
+            middleware::csrf::csrf_protection,
+        ))
        .layer(from_fn(middleware::self_hosted::self_hosted_override))
        .layer(from_fn_with_state(
            state.clone(),
@@ -1,7 +1,11 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later

 use crate::{
-    api::client::{AdminApiClient, ApiResultExt},
+    api::{
+        client::{AdminApiClient, ApiResultExt},
+        reports::SearchReportsParams,
+    },
+    config::AdminConfig,
    middleware::{
        auth::AuthContext,
        csrf,
@@ -22,6 +26,8 @@ use axum::{
 };
 use serde::Deserialize;

+const MAX_REPORT_OFFSET: u64 = 10_000;
+
 #[derive(Deserialize)]
 struct ReportsQuery {
    q: Option<String>,
@@ -69,7 +75,15 @@ async fn reports_list(
    let config = state.config();
    let page = query.page.unwrap_or(0);
    let limit = query.limit.unwrap_or(25).clamp(1, 200);
-    let offset = page.saturating_mul(limit);
+    let offset = u64::from(page) * u64::from(limit);
+    if offset > MAX_REPORT_OFFSET {
+        return reports_error_page(
+            config,
+            &auth.0,
+            "That page is out of range. The reports search returns at most the first 10000 reports, so narrow the filters and start again.",
+        );
+    }
+    let search_query = query.q.as_deref().and_then(clean_string);
    let (sort_by, sort_order) = decode_sort(query.sort.as_deref());
    let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
    let status = query.status.as_deref().and_then(|s| s.parse::<i32>().ok());
@@ -78,22 +92,22 @@ async fn reports_list(
        .as_deref()
        .and_then(|s| s.parse::<i32>().ok());
    let reports = client
-        .search_reports(
-            query.q.as_deref(),
+        .search_reports(&SearchReportsParams {
+            query: search_query.as_deref(),
            status,
            report_type,
-            query.category.as_deref(),
-            query.reporter_id.as_deref(),
-            query.reported_user_id.as_deref(),
-            query.reported_guild_id.as_deref(),
-            query.reported_channel_id.as_deref(),
-            query.guild_context_id.as_deref(),
-            query.resolved_by_admin_id.as_deref(),
-            Some(sort_by),
-            Some(sort_order),
+            category: query.category.as_deref(),
+            reporter_id: query.reporter_id.as_deref(),
+            reported_user_id: query.reported_user_id.as_deref(),
+            reported_guild_id: query.reported_guild_id.as_deref(),
+            reported_channel_id: query.reported_channel_id.as_deref(),
+            guild_context_id: query.guild_context_id.as_deref(),
+            resolved_by_admin_id: query.resolved_by_admin_id.as_deref(),
+            sort_by: Some(sort_by),
+            sort_order: Some(sort_order),
            limit,
            offset,
-        )
+        })
        .await
        .log_error("search reports");

@@ -102,7 +116,7 @@ async fn reports_list(
        &auth.0,
        reports.as_ref(),
        &templates::pages::reports_list::ReportFilters {
-            query: query.q.as_deref(),
+            query: search_query.as_deref(),
            status: query.status.as_deref(),
            report_type: query.report_type.as_deref(),
            category: query.category.as_deref(),
@@ -120,6 +134,18 @@ async fn reports_list(
    Html(markup.into_string()).into_response()
 }

+fn reports_error_page(config: &AdminConfig, auth: &AuthContext, message: &str) -> Response {
+    let markup = templates::layout::admin_layout(
+        config,
+        auth,
+        "Reports",
+        "reports",
+        None,
+        templates::components::error_display::error_alert(message),
+    );
+    Html(markup.into_string()).into_response()
+}
+
 async fn report_detail(
    State(state): State<AppState>,
    headers: HeaderMap,
@@ -195,7 +221,7 @@ async fn report_resolve(
            return flash::redirect_with_flash(
                &format!("{base}/reports/{report_id}"),
                FlashData::error("Invalid form data"),
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -212,7 +238,7 @@ async fn report_resolve(
            flash::redirect_with_flash(
                &format!("{base}/reports/{report_id}"),
                FlashData::success("Report resolved"),
-                config.is_production(),
+                config.secure_cookies(),
            )
        }
        Err(error) => {
@@ -223,7 +249,7 @@ async fn report_resolve(
            flash::redirect_with_flash(
                &format!("{base}/reports/{report_id}"),
                FlashData::error("Failed to resolve report"),
-                config.is_production(),
+                config.secure_cookies(),
            )
        }
    }
@@ -17,19 +17,18 @@ use serde::Deserialize;
 use super::system_actions;

 #[derive(Deserialize)]
-#[allow(dead_code)]
 struct GatewayQuery {
    leaderboard_limit: Option<String>,
    node_stats: Option<String>,
 }

 #[derive(Deserialize)]
-#[allow(dead_code)]
 struct AuditLogsQuery {
    q: Option<String>,
    admin_user_id: Option<String>,
    target_id: Option<String>,
    target_type: Option<String>,
+    access: Option<String>,
    sort_by: Option<String>,
    sort_order: Option<String>,
    limit: Option<u32>,
@@ -121,6 +120,7 @@ async fn audit_logs_page(
        admin_user_id: query.admin_user_id.as_deref().unwrap_or(""),
        target_id: query.target_id.as_deref().unwrap_or(""),
        target_type: query.target_type.as_deref().unwrap_or(""),
+        access: query.access.as_deref().unwrap_or(""),
        sort_by: query.sort_by.as_deref().unwrap_or("createdAt"),
        sort_order: query.sort_order.as_deref().unwrap_or("desc"),
        limit,
@@ -133,10 +133,11 @@ async fn audit_logs_page(
        admin_user_id: nonempty(params.admin_user_id),
        target_id: nonempty(params.target_id),
        target_type: nonempty(params.target_type),
+        access: nonempty(params.access),
        sort_by: Some(params.sort_by.to_owned()),
        sort_order: Some(params.sort_order.to_owned()),
        limit,
-        offset: current_page * limit,
+        offset: u64::from(current_page) * u64::from(limit),
    };
    let result = client
        .search_audit_logs(&search_params)
@@ -60,7 +60,9 @@ pub async fn dispatch(
                    "Failed to update user flags",
                );
            }
-            let submitted = parse_u64_list(form, &["flags[]", "flags"]);
+            let Ok(submitted) = form.parse_list_values::<u64>(&["flags[]", "flags"]) else {
+                return DispatchOutcome::error("Invalid user flag value");
+            };
            let selected = submitted.iter().copied().collect::<HashSet<_>>();
            let user = match client.get_user_by_id(user_id).await {
                Ok(user) => user,
@@ -89,15 +91,22 @@ pub async fn dispatch(
        }
        "update_premium_flags" => {
            if has_legacy_flag_delta_fields(form) {
-                let add = parse_i32_list(form, &["add_flags[]", "add_flags"]);
-                let remove = parse_i32_list(form, &["remove_flags[]", "remove_flags"]);
+                let Ok(add) = form.parse_list_values::<i32>(&["add_flags[]", "add_flags"]) else {
+                    return DispatchOutcome::error("Invalid premium flag value to add");
+                };
+                let Ok(remove) = form.parse_list_values::<i32>(&["remove_flags[]", "remove_flags"])
+                else {
+                    return DispatchOutcome::error("Invalid premium flag value to remove");
+                };
                return DispatchOutcome::from_result(
                    client.update_premium_flags(user_id, &add, &remove).await,
                    "Premium flags updated successfully",
                    "Failed to update premium flags",
                );
            }
-            let submitted = parse_i32_list(form, &["flags[]", "flags"]);
+            let Ok(submitted) = form.parse_list_values::<i32>(&["flags[]", "flags"]) else {
+                return DispatchOutcome::error("Invalid premium flag value");
+            };
            let selected = submitted.iter().copied().collect::<HashSet<_>>();
            let user = match client.get_user_by_id(user_id).await {
                Ok(user) => user,
@@ -124,9 +133,12 @@ pub async fn dispatch(
            )
        }
        "update_suspicious_flags" => {
-            let flags = parse_i32_list(form, &["suspicious_flags[]", "suspicious_flags"])
-                .into_iter()
-                .fold(0, |acc, flag| acc | flag);
+            let Ok(submitted) =
+                form.parse_list_values::<i32>(&["suspicious_flags[]", "suspicious_flags"])
+            else {
+                return DispatchOutcome::error("Invalid suspicious activity flag value");
+            };
+            let flags = submitted.into_iter().fold(0, |acc, flag| acc | flag);
            DispatchOutcome::from_result(
                client.update_suspicious_flags(user_id, flags).await,
                "Suspicious activity flags updated successfully",
@@ -225,15 +237,19 @@ pub async fn dispatch(
            )
        }
        "temp_ban" => {
-            let dur = form
-                .parse_u32("duration_hours")
-                .or_else(|| form.parse_u32("duration"))
-                .unwrap_or(24);
+            let Ok(duration) = form.parse_value_any::<u32>(&["duration_hours", "duration"]) else {
+                return DispatchOutcome::error("Invalid ban duration");
+            };
            let reason = get("reason");
            let private = get("private_reason");
            DispatchOutcome::from_result(
                client
-                    .temp_ban_user(user_id, dur, reason.as_deref(), private.as_deref())
+                    .temp_ban_user(
+                        user_id,
+                        duration.unwrap_or(24),
+                        reason.as_deref(),
+                        private.as_deref(),
+                    )
                    .await,
                "User temporarily banned successfully",
                "Failed to temporarily ban user",
@@ -249,7 +265,7 @@ pub async fn dispatch(
                return DispatchOutcome::error("IP address is required");
            };
            DispatchOutcome::from_result(
-                client.ban_ip(&ip).await,
+                client.ban_ip(&ip, None).await,
                "IP banned successfully",
                "Failed to ban IP",
            )
@@ -259,18 +275,29 @@ pub async fn dispatch(
                return DispatchOutcome::error("Avatar hash is required");
            };
            DispatchOutcome::from_result(
-                client.ban_avatar_hash(&hash).await,
+                client.ban_avatar_hash(&hash, None).await,
                "Avatar hash banned successfully",
                "Failed to ban avatar hash",
            )
        }
        "schedule_deletion" => {
-            let reason_code = form.parse_i32("reason_code").unwrap_or(0);
+            let Ok(reason_code) = form.parse_value::<i32>("reason_code") else {
+                return DispatchOutcome::error("Invalid deletion reason code");
+            };
            let public_reason = get("public_reason");
-            let days = form.parse_u32("days_until_deletion").unwrap_or(60);
+            let private_reason = get("private_reason");
+            let Ok(days) = form.parse_value_any::<u32>(&["days_until_deletion", "days"]) else {
+                return DispatchOutcome::error("Invalid deletion delay");
+            };
            DispatchOutcome::from_result(
                client
-                    .schedule_deletion(user_id, reason_code, public_reason.as_deref(), days)
+                    .schedule_deletion(
+                        user_id,
+                        reason_code.unwrap_or(0),
+                        public_reason.as_deref(),
+                        days.unwrap_or(60),
+                        private_reason.as_deref(),
+                    )
                    .await,
                "User deletion scheduled successfully",
                "Failed to schedule user deletion",
@@ -399,55 +426,6 @@ pub async fn dispatch(
            "Bulk message deletion cancelled successfully",
            "Failed to cancel bulk message deletion",
        ),
-        "refund_payment" => {
-            let Some(pi) = form.clean("payment_intent_id") else {
-                return DispatchOutcome::error("Payment intent ID is required");
-            };
-            let amt = form.parse_u64("amount_cents");
-            let reason = get("reason");
-            DispatchOutcome::from_result(
-                client
-                    .issue_refund(user_id, &pi, amt, reason.as_deref())
-                    .await,
-                "Refund issued successfully",
-                "Failed to issue refund",
-            )
-        }
-        "refund_policy_cancel_now" => {
-            let reason = get("reason");
-            DispatchOutcome::from_result(
-                client
-                    .refund_policy_cancel_now(user_id, reason.as_deref())
-                    .await,
-                "Refund policy cancellation completed successfully",
-                "Failed to apply refund policy cancellation",
-            )
-        }
-        "cancel_subscription" => DispatchOutcome::from_result(
-            client.cancel_subscription(user_id).await,
-            "Subscription cancelled successfully",
-            "Failed to cancel subscription",
-        ),
-        "cancel_subscription_now" => {
-            let reason = get("reason");
-            DispatchOutcome::from_result(
-                client
-                    .cancel_subscription_immediately(user_id, reason.as_deref())
-                    .await,
-                "Subscription cancelled immediately",
-                "Failed to cancel subscription immediately",
-            )
-        }
-        "reactivate_subscription" => DispatchOutcome::from_result(
-            client.reactivate_subscription(user_id).await,
-            "Subscription reactivated successfully",
-            "Failed to reactivate subscription",
-        ),
-        "end_premium_grace_period" => DispatchOutcome::from_result(
-            client.end_premium_grace_period(user_id).await,
-            "Premium grace period ended successfully",
-            "Failed to end premium grace period",
-        ),
        "message_shred" => {
            let csv = form.first("csv_data").unwrap_or_default();
            match parse_message_shred_csv(csv) {
@@ -490,20 +468,6 @@ fn is_relationship_category(category: &str) -> bool {
    )
 }

-fn parse_u64_list(form: &MultiValueForm, keys: &[&str]) -> Vec<u64> {
-    form.list_values_any(keys)
-        .iter()
-        .filter_map(|value| value.parse().ok())
-        .collect()
-}
-
-fn parse_i32_list(form: &MultiValueForm, keys: &[&str]) -> Vec<i32> {
-    form.list_values_any(keys)
-        .iter()
-        .filter_map(|value| value.parse().ok())
-        .collect()
-}
-
 fn parse_dry_run(value: Option<&str>) -> bool {
    !matches!(value.map(|value| value.trim().to_ascii_lowercase()), Some(value) if value == "false" || value == "0")
 }
@@ -73,15 +73,11 @@ pub async fn render(
                .map(|r| r.sessions)
                .map_err(|error| tracing::warn!(%error, user_id, "admin API request failed: list user sessions"))
                .unwrap_or_default();
-            let webauthn_credentials = if u.authenticator_types.contains(&2) {
-                client
-                    .list_webauthn_credentials(user_id)
-                    .await
-                    .map_err(|error| tracing::warn!(%error, user_id, "admin API request failed: list webauthn credentials"))
-                    .unwrap_or_default()
-            } else {
-                Vec::new()
-            };
+            let webauthn_credentials = client
+                .list_webauthn_credentials(user_id)
+                .await
+                .map_err(|error| tracing::warn!(%error, user_id, "admin API request failed: list webauthn credentials"))
+                .unwrap_or_default();
            Some(tabs::account::account_tab(
                config,
                &u,
@@ -155,44 +151,6 @@ pub async fn render(
                csrf_token,
            ))
        }
-        "billing" => {
-            if config.self_hosted
-                || !acl::has_any_permission(
-                    admin_acls,
-                    &[
-                        acl::BILLING_VIEW,
-                        acl::BILLING_REFUND,
-                        acl::BILLING_MANAGE_SUBSCRIPTION,
-                    ],
-                )
-            {
-                return None;
-            }
-            let can_view_billing = acl::has_permission(admin_acls, acl::BILLING_VIEW);
-            let b = if can_view_billing {
-                client
-                    .get_billing_overview(user_id)
-                    .await
-                    .log_error("load user billing overview")
-            } else {
-                None
-            };
-            let invoices = if can_view_billing {
-                client
-                    .get_user_invoices(user_id, 25, None)
-                    .await
-                    .log_error("load user invoices")
-            } else {
-                None
-            };
-            Some(tabs::billing::billing_tab(
-                config,
-                user_id,
-                b.as_ref().map(|v| &v.data),
-                invoices.as_ref().map(|v| &v.data),
-                csrf_token,
-            ))
-        }
        "guilds" => {
            let g = client
                .get_user_guilds(user_id, Some(200), None, None, Some(true))
@@ -202,25 +160,29 @@ pub async fn render(
            Some(tabs::guilds::guilds_tab(config, user_id, &g))
        }
        "reports" => {
-            let lim = query.reports_limit.unwrap_or(25);
-            let sp = query.reports_sent_page.unwrap_or(0);
-            let rp = query.reports_received_page.unwrap_or(0);
+            let limit = query.reports_limit.unwrap_or(25);
+            let sent_page = query.reports_sent_page.unwrap_or(0);
+            let received_page = query.reports_received_page.unwrap_or(0);
            let sent = client
-                .search_reports_by_reporter(user_id, lim, sp * lim)
+                .search_reports_by_reporter(user_id, limit, u64::from(sent_page) * u64::from(limit))
                .await
                .log_error("load reports sent by user");
-            let recv = client
-                .search_reports_by_reported_user(user_id, lim, rp * lim)
+            let received = client
+                .search_reports_by_reported_user(
+                    user_id,
+                    limit,
+                    u64::from(received_page) * u64::from(limit),
+                )
                .await
                .log_error("load reports against user");
            Some(tabs::reports::reports_tab(
                config,
                user_id,
                sent.as_ref(),
-                recv.as_ref(),
-                sp,
-                rp,
-                lim,
+                received.as_ref(),
+                sent_page,
+                received_page,
+                limit,
            ))
        }
        "relationships" => {
@@ -278,11 +240,12 @@ pub async fn render(
                    query: None,
                    admin_user_id: None,
                    target_id: Some(user_id.to_owned()),
-                    target_type: Some("user".to_owned()),
+                    target_type: None,
+                    access: Some("write".to_owned()),
                    sort_by: Some("created_at".to_owned()),
                    sort_order: Some("desc".to_owned()),
                    limit,
-                    offset: page * limit,
+                    offset: u64::from(page) * u64::from(limit),
                })
                .await
                .log_error("load user admin audit logs")?;
@@ -2,7 +2,10 @@

 use crate::{
    acl,
-    api::client::{AdminApiClient, ApiResultExt},
+    api::{
+        client::{AdminApiClient, ApiResult, ApiResultExt},
+        types::AdminUser,
+    },
    middleware::{auth::AuthContext, csrf::CsrfToken, flash, htmx},
    routes::user_tabs,
    state::AppState,
@@ -18,6 +21,8 @@ use axum::{
 };
 use serde::Deserialize;

+const USER_ID_LOOKUP_BATCH: usize = 100;
+
 #[derive(Deserialize)]
 struct UserListQuery {
    q: Option<String>,
@@ -55,7 +60,6 @@ pub fn router() -> Router<AppState> {
        .route("/users", get(users_list))
        .route("/users/{user_id}", get(user_detail).post(user_detail_post))
        .route("/users/{user_id}/tabs/{tab}", get(user_tab))
-        .route("/users/{user_id}/peek", get(user_peek))
        .route("/users/{user_id}/fragment", get(user_peek))
 }

@@ -84,16 +88,12 @@ async fn users_list(
    let can_view_email = acl::has_permission(admin_acls, acl::USER_VIEW_EMAIL);
    let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
    let results = if params.has_id_lookup() {
-        let users = client
-            .lookup_users_by_ids(&params.requested_ids)
+        lookup_users_in_batches(&client, &params.requested_ids)
            .await
-            .map_err(
-                |error| tracing::warn!(%error, "admin API request failed: lookup users by ids"),
-            )
-            .unwrap_or_default();
-        Some((users, false))
+            .log_error("lookup users by ids")
+            .map(|users| (users, false))
    } else if params.has_search() {
-        let offset = params.page.saturating_mul(params.limit);
+        let offset = u64::from(params.page) * u64::from(params.limit);
        client
            .search_users(
                params.search_query(),
@@ -105,7 +105,7 @@ async fn users_list(
            .await
            .log_error("search users")
            .map(|r| {
-                let has_more = u64::from(offset) + (r.users.len() as u64) < r.total;
+                let has_more = (r.users.len() as u64) < r.total.saturating_sub(offset);
                (r.users, has_more)
            })
    } else {
@@ -125,6 +125,17 @@ async fn users_list(
    Html(markup.into_string()).into_response()
 }

+async fn lookup_users_in_batches(
+    client: &AdminApiClient,
+    user_ids: &[String],
+) -> ApiResult<Vec<AdminUser>> {
+    let mut users = Vec::new();
+    for batch in user_ids.chunks(USER_ID_LOOKUP_BATCH) {
+        users.extend(client.lookup_users_by_ids(batch).await?);
+    }
+    Ok(users)
+}
+
 async fn user_detail(
    State(state): State<AppState>,
    headers: HeaderMap,
@@ -189,7 +200,7 @@ async fn user_detail_post(
            return flash::redirect_with_flash(
                &format!("{base}/users/{user_id}"),
                flash,
-                config.is_production(),
+                config.secure_cookies(),
            );
        }
    };
@@ -208,7 +219,7 @@ async fn user_detail_post(
    {
        return htmx::toast_response(&outcome.flash);
    }
-    flash::redirect_with_flash(&redirect, outcome.flash, config.is_production())
+    flash::redirect_with_flash(&redirect, outcome.flash, config.secure_cookies())
 }

 async fn user_tab(
@@ -4,7 +4,7 @@ use crate::{
    api::client::AdminApiClient,
    middleware::{auth::AuthContext, csrf},
    state::AppState,
-    templates,
+    templates::{self, pages::voice_servers::VoiceServersPageParams},
 };
 use axum::{
    Router,
@@ -13,12 +13,34 @@ use axum::{
    routing::get,
 };
 use serde::Deserialize;
+use std::collections::HashMap;

 #[derive(Deserialize)]
 struct VoiceServersQuery {
    region_id: Option<String>,
 }

+async fn load_server_connection_counts(client: &AdminApiClient) -> HashMap<String, i64> {
+    let response = match client.get_gateway_voice_state_counts().await {
+        Ok(response) => response,
+        Err(error) => {
+            tracing::warn!(%error, "admin API request failed: load voice state counts");
+            return HashMap::new();
+        }
+    };
+    let Some(servers) = response.data.get("servers").and_then(|v| v.as_array()) else {
+        return HashMap::new();
+    };
+    servers
+        .iter()
+        .filter_map(|entry| {
+            let server_id = entry.get("server_id")?.as_str()?.to_owned();
+            let count = entry.get("voice_state_count")?.as_i64()?;
+            Some((server_id, count))
+        })
+        .collect()
+}
+
 pub fn router() -> Router<AppState> {
    Router::new()
        .route(
@@ -79,17 +101,21 @@ async fn voice_servers_page(
            let markup = templates::pages::voice_servers::voice_servers_page(
                config,
                &auth.0,
-                None,
-                None,
-                None,
-                None,
-                &csrf_token,
+                &VoiceServersPageParams {
+                    region_id: None,
+                    region_name: None,
+                    servers: None,
+                    connection_counts: &HashMap::new(),
+                    error: None,
+                    csrf_token: &csrf_token,
+                },
            );
            return Html(markup.into_string()).into_response();
        }
    };

    let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
+    let connection_counts = load_server_connection_counts(&client).await;

    let region_name = match client.get_voice_region(region_id, false).await {
        Ok(resp) => resp
@@ -107,11 +133,14 @@ async fn voice_servers_page(
            let markup = templates::pages::voice_servers::voice_servers_page(
                config,
                &auth.0,
-                Some(region_id),
-                Some(&region_name),
-                Some(&resp.servers),
-                None,
-                &csrf_token,
+                &VoiceServersPageParams {
+                    region_id: Some(region_id),
+                    region_name: Some(&region_name),
+                    servers: Some(&resp.servers),
+                    connection_counts: &connection_counts,
+                    error: None,
+                    csrf_token: &csrf_token,
+                },
            );
            Html(markup.into_string()).into_response()
        }
@@ -120,11 +149,14 @@ async fn voice_servers_page(
            let markup = templates::pages::voice_servers::voice_servers_page(
                config,
                &auth.0,
-                Some(region_id),
-                Some(&region_name),
-                None,
-                Some(&msg),
-                &csrf_token,
+                &VoiceServersPageParams {
+                    region_id: Some(region_id),
+                    region_name: Some(&region_name),
+                    servers: None,
+                    connection_counts: &connection_counts,
+                    error: Some(&msg),
+                    csrf_token: &csrf_token,
+                },
            );
            Html(markup.into_string()).into_response()
        }
@@ -49,19 +49,26 @@ pub(crate) fn build_region_body(form: &MultiValueForm) -> serde_json::Value {
    }
    body.insert("is_default".into(), form.bool_value("is_default").into());
    body.insert("vip_only".into(), form.bool_value("vip_only").into());
-    body.insert(
-        "required_guild_features".into(),
-        form.list_values_any(&["required_guild_features[]", "required_guild_features"])
-            .into(),
-    );
-    body.insert(
-        "allowed_guild_ids".into(),
-        form.list_values_any(&["allowed_guild_ids[]", "allowed_guild_ids"])
-            .into(),
-    );
+    insert_submitted_list(&mut body, form, "required_guild_features");
+    insert_submitted_list(&mut body, form, "allowed_guild_ids");
    serde_json::Value::Object(body)
 }

+fn insert_submitted_list(
+    body: &mut serde_json::Map<String, serde_json::Value>,
+    form: &MultiValueForm,
+    field: &str,
+) {
+    let repeated = format!("{field}[]");
+    if !form.contains_key(&repeated) && !form.contains_key(field) {
+        return;
+    }
+    body.insert(
+        field.to_owned(),
+        form.list_values_any(&[repeated.as_str(), field]).into(),
+    );
+}
+
 pub(crate) fn build_server_body(form: &MultiValueForm) -> serde_json::Value {
    let mut body = serde_json::Map::new();
    if let Some(v) = form.clean("region_id") {
@@ -92,17 +99,19 @@ pub(crate) fn build_server_body(form: &MultiValueForm) -> serde_json::Value {
        body.insert("longitude".into(), lng.into());
    }
    body.insert("is_active".into(), form.bool_value("is_active").into());
+    if let Some(raw) = form.first("soft_connection_limit") {
+        let trimmed = raw.trim();
+        if trimmed.is_empty() {
+            body.insert("soft_connection_limit".into(), serde_json::Value::Null);
+        } else if let Ok(limit) = trimmed.parse::<i64>()
+            && limit > 0
+        {
+            body.insert("soft_connection_limit".into(), limit.into());
+        }
+    }
    body.insert("vip_only".into(), form.bool_value("vip_only").into());
-    body.insert(
-        "required_guild_features".into(),
-        form.list_values_any(&["required_guild_features[]", "required_guild_features"])
-            .into(),
-    );
-    body.insert(
-        "allowed_guild_ids".into(),
-        form.list_values_any(&["allowed_guild_ids[]", "allowed_guild_ids"])
-            .into(),
-    );
+    insert_submitted_list(&mut body, form, "required_guild_features");
+    insert_submitted_list(&mut body, form, "allowed_guild_ids");
    serde_json::Value::Object(body)
 }

@@ -160,7 +169,7 @@ pub(crate) async fn voice_regions_post(
    flash::redirect_with_flash(
        &format!("{base}/voice-regions"),
        flash_from_level(level, &msg),
-        config.is_production(),
+        config.secure_cookies(),
    )
 }

@@ -232,7 +241,7 @@ pub(crate) async fn voice_servers_post(
    flash::redirect_with_flash(
        &redirect_url,
        flash_from_level(level, &msg),
-        config.is_production(),
+        config.secure_cookies(),
    )
 }

@@ -255,6 +264,86 @@ mod tests {
        assert_eq!(body["allowed_guild_ids"], serde_json::json!(["1", "2"]));
    }

+    #[test]
+    fn build_server_body_clears_restriction_lists_the_form_submitted_empty() {
+        let form = MultiValueForm::parse(
+            b"region_id=us-east&server_id=s1&required_guild_features=&allowed_guild_ids=",
+        );
+        let body = build_server_body(&form);
+        assert_eq!(body["required_guild_features"], serde_json::json!([]));
+        assert_eq!(body["allowed_guild_ids"], serde_json::json!([]));
+    }
+
+    #[test]
+    fn build_server_body_leaves_restriction_lists_alone_when_the_form_omits_them() {
+        let form = MultiValueForm::parse(
+            b"region_id=us-east&server_id=s1&endpoint=wss%3A%2F%2Fvoice.example&is_active=false&vip_only=true",
+        );
+        let body = build_server_body(&form);
+        let object = body.as_object().unwrap();
+        assert!(!object.contains_key("required_guild_features"));
+        assert!(!object.contains_key("allowed_guild_ids"));
+        assert_eq!(body["is_active"], serde_json::json!(false));
+    }
+
+    #[test]
+    fn build_region_body_clears_restriction_lists_the_form_submitted_empty() {
+        let form = MultiValueForm::parse(b"id=us-east&required_guild_features=&allowed_guild_ids=");
+        let body = build_region_body(&form);
+        assert_eq!(body["required_guild_features"], serde_json::json!([]));
+        assert_eq!(body["allowed_guild_ids"], serde_json::json!([]));
+    }
+
+    #[test]
+    fn build_region_body_leaves_restriction_lists_alone_when_the_form_omits_them() {
+        let form = MultiValueForm::parse(b"id=us-east&name=US%20East");
+        let body = build_region_body(&form);
+        let object = body.as_object().unwrap();
+        assert!(!object.contains_key("required_guild_features"));
+        assert!(!object.contains_key("allowed_guild_ids"));
+    }
+
+    #[test]
+    fn build_server_body_sets_soft_connection_limit_from_a_positive_value() {
+        let form =
+            MultiValueForm::parse(b"region_id=us-east&server_id=s1&soft_connection_limit=250");
+        let body = build_server_body(&form);
+        assert_eq!(body["soft_connection_limit"], serde_json::json!(250));
+    }
+
+    #[test]
+    fn build_server_body_clears_soft_connection_limit_when_the_field_is_empty() {
+        let form = MultiValueForm::parse(b"region_id=us-east&server_id=s1&soft_connection_limit=");
+        let body = build_server_body(&form);
+        assert_eq!(body["soft_connection_limit"], serde_json::Value::Null);
+    }
+
+    #[test]
+    fn build_server_body_omits_soft_connection_limit_when_the_field_is_absent_or_invalid() {
+        let absent = MultiValueForm::parse(b"region_id=us-east&server_id=s1&is_active=true");
+        assert!(
+            !build_server_body(&absent)
+                .as_object()
+                .unwrap()
+                .contains_key("soft_connection_limit")
+        );
+        let invalid =
+            MultiValueForm::parse(b"region_id=us-east&server_id=s1&soft_connection_limit=abc");
+        assert!(
+            !build_server_body(&invalid)
+                .as_object()
+                .unwrap()
+                .contains_key("soft_connection_limit")
+        );
+        let zero = MultiValueForm::parse(b"region_id=us-east&server_id=s1&soft_connection_limit=0");
+        assert!(
+            !build_server_body(&zero)
+                .as_object()
+                .unwrap()
+                .contains_key("soft_connection_limit")
+        );
+    }
+
    #[test]
    fn build_server_body_preserves_single_and_repeated_values() {
        let form = MultiValueForm::parse(
@@ -2,6 +2,7 @@

 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
 use hmac::{Hmac, KeyInit, Mac};
+use rand::RngExt;
 use serde::{Deserialize, Serialize};
 use sha2::Sha256;
 use std::time::{SystemTime, UNIX_EPOCH};
@@ -78,6 +79,36 @@ fn verify_signature<'a>(signed_data: &'a str, secret_key: &str) -> Option<&'a st
    if diff == 0 { Some(data) } else { None }
 }

+pub fn create_csrf_token(user_id: &str, secret_key: &str) -> String {
+    let mut rng = rand::rng();
+    let nonce: [u8; 16] = rng.random();
+    let payload = URL_SAFE_NO_PAD.encode(format!(
+        "{}:{}",
+        URL_SAFE_NO_PAD.encode(user_id.as_bytes()),
+        URL_SAFE_NO_PAD.encode(nonce)
+    ));
+    sign_data(&payload, secret_key)
+}
+
+pub fn verify_csrf_token(token: &str, user_id: &str, secret_key: &str) -> bool {
+    let Some(data) = verify_signature(token, secret_key) else {
+        return false;
+    };
+    let Ok(decoded) = URL_SAFE_NO_PAD.decode(data.as_bytes()) else {
+        return false;
+    };
+    let Ok(payload) = String::from_utf8(decoded) else {
+        return false;
+    };
+    let Some((encoded_uid, _nonce)) = payload.split_once(':') else {
+        return false;
+    };
+    match URL_SAFE_NO_PAD.decode(encoded_uid.as_bytes()) {
+        Ok(uid_bytes) => uid_bytes == user_id.as_bytes(),
+        Err(_) => false,
+    }
+}
+
 pub const LEGACY_SESSION_COOKIE_NAME: &str = "session";
 pub const SESSION_COOKIE_NAME: &str = "admin_session";
 pub const SESSION_MAX_AGE: i64 = MAX_AGE_SECONDS as i64;
--- a/Show More
+++ b/Show More